@acedatacloud/skills 2026.712.1 → 2026.713.0

package/AGENTS.md

@@ -24,6 +24,7 @@ Skills are located in the `skills/` directory (also mirrored to `.agents/skills/
 - **hailuo-video** — Generate videos with Hailuo / MiniMax
 - **seedance-video** — Generate dance/motion videos with ByteDance Seedance
 - **wan-video** — Generate videos with Alibaba Wan
+- **maestro-video** — Produce complete videos from a brief with scripting, media, voiceover, editing, captions, and multilingual variants
 
 ### AI Chat & Tools
 - **ai-chat** — Unified LLM gateway — GPT, Claude, Gemini, Kimi, Grok (50+ models)

package/README.md

@@ -12,7 +12,7 @@
 
 Compatible with **30+ AI coding agents** via the [agentskills.io](https://agentskills.io/) open standard: Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, Cursor, Roo Code, Goose, and more.
 
-## Available Skills (30)
+## Available Skills
 
 ### AI Music & Audio
 
@@ -40,6 +40,7 @@ Compatible with **30+ AI coding agents** via the [agentskills.io](https://agents
 | [kling-video](skills/kling-video/) | Generate videos with Kuaishou Kling (motion control) |
 | [hailuo-video](skills/hailuo-video/) | Generate videos with Hailuo / MiniMax |
 | [seedance-video](skills/seedance-video/) | Generate dance/motion videos with ByteDance Seedance |
+| [maestro-video](skills/maestro-video/) | Produce complete videos from a brief with script, media, voiceover, captions, and editing |
 
 ### AI Chat & Tools
 
@@ -208,6 +209,7 @@ Skills provide **knowledge** (when to use, parameters, gotchas). MCP servers pro
 | veo-video | [mcp-veo](https://pypi.org/project/mcp-veo/) | `pip install mcp-veo` | `https://veo.mcp.acedata.cloud/mcp` |
 | seedream-image | [mcp-seedream](https://pypi.org/project/mcp-seedream/) | `pip install mcp-seedream` | `https://seedream.mcp.acedata.cloud/mcp` |
 | seedance-video | [mcp-seedance](https://pypi.org/project/mcp-seedance/) | `pip install mcp-seedance` | `https://seedance.mcp.acedata.cloud/mcp` |
+| maestro-video | [mcp-maestro](https://pypi.org/project/mcp-maestro/) | `pip install mcp-maestro` | `https://maestro.mcp.acedata.cloud/mcp` |
 | nano-banana-image | [mcp-nano-banana](https://pypi.org/project/mcp-nano-banana/) | `pip install mcp-nano-banana` | `https://nano-banana.mcp.acedata.cloud/mcp` |
 | short-url | [mcp-shorturl](https://pypi.org/project/mcp-shorturl/) | `pip install mcp-shorturl` | `https://short-url.mcp.acedata.cloud/mcp` |
 | wan-video | [mcp-wan](https://pypi.org/project/mcp-wan/) | `pip install mcp-wan` | `https://wan.mcp.acedata.cloud/mcp` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.712.1",
+  "version": "2026.713.0",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/_shared/mcp-servers.md

@@ -15,6 +15,7 @@ Each AceDataCloud service has a corresponding MCP server that provides tool-use
 | veo-video | `pip install mcp-veo` | `https://veo.mcp.acedata.cloud/mcp` |
 | seedream-image | `pip install mcp-seedream` | `https://seedream.mcp.acedata.cloud/mcp` |
 | seedance-video | `pip install mcp-seedance` | `https://seedance.mcp.acedata.cloud/mcp` |
+| maestro-video | `pip install mcp-maestro` | `https://maestro.mcp.acedata.cloud/mcp` |
 | nano-banana-image | `pip install mcp-nano-banana` | `https://nano-banana.mcp.acedata.cloud/mcp` |
 | short-url | `pip install mcp-shorturl` | `https://short-url.mcp.acedata.cloud/mcp` |
 | wan-video | `pip install mcp-wan` | `https://wan.mcp.acedata.cloud/mcp` |

package/skills/hashnode/SKILL.md

@@ -1,171 +1,119 @@
 ---
 name: hashnode
-description: Publish, update and read blog posts on Hashnode via its GraphQL API. Use when the user mentions Hashnode, publishing a blog post to Hashnode, cross-posting an article to their Hashnode blog, saving a Hashnode draft, updating a published Hashnode post, or listing their Hashnode publications and posts.
+description: Publish, draft and read blog posts on the user's Hashnode blog using their own login cookies (BYOC) — no Hashnode Pro plan required. Use when the user mentions Hashnode, publishing/cross-posting an article to their Hashnode blog, saving a Hashnode draft, or listing their Hashnode publications.
 when_to_use: |
-  Trigger when the user wants to publish a Markdown article to their
-  Hashnode blog, save it as a draft, update a previously published
-  post, or list / inspect their own Hashnode publications and posts.
-  The connector stores a Hashnode Personal Access Token with full
-  account access — confirm before publishing publicly (you can save a
-  draft first with the createDraft mutation).
+  Trigger when the user wants to publish a Markdown article to their Hashnode
+  blog, save it as a private draft, or list their Hashnode publications. This
+  drives the user's REAL blog, so publishing is gated behind an explicit
+  confirmation (save a draft first if unsure).
 connections: [hashnode]
-allowed_tools: [Bash]
+allowed_tools: [Bash, publish_artifact]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "2.0"
 ---
 
-Call the **Hashnode GraphQL API** with `curl + jq`. The user's Personal Access
-Token is in `$HASHNODE_TOKEN`. Single endpoint: `https://gql-beta.hashnode.com`
-(always `POST` a JSON body `{query, variables}`).
+# hashnode — publish to your Hashnode blog via your own cookies (no Pro)
 
-> The old `https://gql.hashnode.com` host is **deprecated** — it now 301-redirects
-> to a changelog page and returns HTML, not JSON. Always use `gql-beta.hashnode.com`.
+Hashnode moved its **public GraphQL API behind a paid Pro plan** (2026-05-13), so
+a Personal Access Token can no longer publish for free. This skill instead drives
+the **same first-party REST API the Hashnode web editor uses**
+(`https://hashnode.com/api/...`), authenticated by the user's login **session
+cookie** — which is free and needs no Pro plan.
 
-Every request needs these headers:
+The connector injects the cookie jar as `HASHNODE_COOKIES` (a JSON array; the
+session cookie is `hashnode-session`). **Secret — full account access. Never echo
+or print it.**
 
-```
-Authorization: Bearer $HASHNODE_TOKEN
-Content-Type: application/json
-```
-
-GraphQL always returns HTTP `200`; real failures live in the JSON `errors`
-array — always inspect it and show it verbatim. Two error cases matter:
-
-- `Unauthorized` / `not authenticated` → the token is invalid → the user must
-  re-connect the Hashnode connector.
-- `extensions.code == "FORBIDDEN"` with a message like *"Publication does not have
-  an active Pro plan"* → this is **not** a token problem. As of 2026-05-13 Hashnode
-  moved its API behind a paid plan: **every write mutation** (`publishPost`,
-  `createDraft`, `updatePost`) **and publication-scoped reads require the target
-  publication to be on [Hashnode Pro](https://hashnode.com/pro)**. Do NOT tell the
-  user to reconnect and do NOT retry in a loop — tell them the publication owner
-  must upgrade to Hashnode Pro (blog dashboard → Billing → Upgrade to Pro), after
-  which the API works immediately. Public reads (posts/feeds/users/tags) stay free.
-
-Helper — send a query/mutation (`$1` = query string, `$2` = variables JSON):
-
-```bash
-gql() {
-  jq -n --arg q "$1" --argjson v "${2:-null}" '{query:$q, variables:$v}' \
-  | curl -sS -X POST https://gql-beta.hashnode.com \
-      -H "Authorization: Bearer $HASHNODE_TOKEN" \
-      -H "Content-Type: application/json" \
-      -d @-
-}
-```
+> E2E-verified 2026-07-12 on a real connected blog: list publications, create +
+> save draft (title / subtitle / cover / tags / Markdown), publish, and delete —
+> all via cookie auth, no Pro.
 
-## Always start by confirming the token and finding the publication id
+## Setup — anchor on our own script
 
-`publishPost` / `createDraft` need a `publicationId`. Fetch the account and its
-publications first (a user can have several blogs):
-
-```bash
-gql 'query { me { id username publications(first: 10) { edges { node { id title url } } } } }' \
-  | jq '{me: .data.me.username, publications: [.data.me.publications.edges[].node | {id, title, url}], errors: .errors}'
+```sh
+# $SKILL_DIR can point at another skill loaded this turn — anchor on our script.
+H="$SKILL_DIR/scripts/hashnode.py"; [ -f "$H" ] || H=$(find /tmp -maxdepth 8 -path '*/skills/*/hashnode/scripts/hashnode.py' 2>/dev/null | head -1)
+[ -f "$H" ] || { echo "hashnode script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+python3 "$H" publications          # list the user's blogs (verifies the cookie)
 ```
 
-Pick the target blog's `id` (that is the `publicationId`). If the user has
-exactly one publication, use it; otherwise ask which blog to post to.
-
-## Publish a post
+On an auth error the cookie is expired — have the user reconnect at
+<https://auth.acedata.cloud/user/connections>. Do **not** loop-retry.
 
-**Confirm with the user before publishing publicly.** If they are not sure, save
-a draft first (see below). `tags` is required — supply 1–5 tags, each as
-`{name, slug}` (slug lowercase, no spaces).
+## ⚠️ Non-Pro blogs are automoderated — write EDITORIAL, not ads
 
-```bash
-PUB_ID="PUBLICATION_ID"          # from the me query above
-TITLE="My title"
-BODY_MD="$(cat article.md)"      # full Markdown body
+This is the single most important rule. A **non-Pro** publication is subject to
+Hashnode **automoderation**: an overtly promotional post (hypey language,
+"free credits!!", the *same* CTA link repeated 3–4 times) is **auto-removed
+within seconds** — the publish call still returns success, but the live URL then
+404s. (Pro's one benefit here is "protection from automoderation removal".)
 
-VARS=$(jq -n --arg p "$PUB_ID" --arg t "$TITLE" --arg b "$BODY_MD" '{
-  input: {
-    publicationId: $p,
-    title: $t,
-    contentMarkdown: $b,
-    tags: [{name:"AI", slug:"ai"}, {name:"Web Development", slug:"web-development"}]
-  }
-}')
+To stay live, write a genuinely useful **how-to / guide** that happens to feature
+the product:
 
-gql 'mutation PublishPost($input: PublishPostInput!) {
-  publishPost(input: $input) { post { id slug url title } }
-}' "$VARS" | jq '{post: .data.publishPost.post, errors: .errors}'
-```
+- Educational framing and a concrete title (e.g. *"… (Beginner's Guide)"*).
+- At most a couple of **tasteful** links, not the same CTA repeated.
+- No "limited-time!! grab now!!" marketing voice.
 
-Useful optional `input` fields:
+`publish` re-fetches the live URL after publishing and returns a `warning` if the
+post was moderated away — if you see that, rewrite it editorially and republish.
 
-- `subtitle` — post subtitle.
-- `slug` — custom URL slug (otherwise derived from the title).
-- `canonicalUrl` / `originalArticleURL` — when cross-posting, point SEO back to
-  the original source. Set this whenever the same article also lives elsewhere.
-- `coverImageOptions: { coverImageURL: "https://..." }` — cover image.
-- `publishedAt` — ISO-8601 timestamp to backdate; `disableComments` etc. live
-  under `settings`.
+## Read
 
-## Save a draft (safe, non-public)
-
-Use this when the user has not explicitly approved public publishing:
+```sh
+python3 "$H" publications        # {publications:[{id,title,url}]}
+```
 
-```bash
-VARS=$(jq -n --arg p "$PUB_ID" --arg t "$TITLE" --arg b "$BODY_MD" '{
-  input: { publicationId: $p, title: $t, contentMarkdown: $b }
-}')
+## Save a private draft (safe, non-public)
 
-gql 'mutation CreateDraft($input: CreateDraftInput!) {
-  createDraft(input: $input) { draft { id slug title } }
-}' "$VARS" | jq '{draft: .data.createDraft.draft, errors: .errors}'
+```sh
+python3 "$H" draft \
+  --title "My Title" \
+  --subtitle "Optional subtitle" \
+  --content-file article.md \
+  --cover "https://cdn.example.com/cover.jpg" \
+  --tags ai,apis
+# → {draft_id, editor_url}. Nothing is public yet.
 ```
 
-## Update a published post
-
-`updatePost` needs the post `id` (from `publishPost`, or the list query below):
+- `--content-file` is the Markdown body (use a file for long posts; `--content`
+  for a short inline string). Inline **images** and **links** are just Markdown.
+- `--cover` sets the header/cover image (also used as the OG image).
+- `--tags` are comma-separated slugs (`ai,apis,web-development`); they're resolved
+  to real Hashnode tag ids automatically (up to 5).
+- `--publication <id>` is only needed if the account has more than one blog.
 
-```bash
-VARS=$(jq -n --arg id "POST_ID" --arg b "$(cat article.md)" '{
-  input: { id: $id, contentMarkdown: $b }
-}')
+## Publish — GATED (dry-run unless trailing `--confirm`)
 
-gql 'mutation UpdatePost($input: UpdatePostInput!) {
-  updatePost(input: $input) { post { id url title } }
-}' "$VARS" | jq '{post: .data.updatePost.post, errors: .errors}'
+```sh
+python3 "$H" publish --title "My Title" --content-file article.md --cover "https://…" --tags ai,apis          # dry-run
+python3 "$H" publish --title "My Title" --content-file article.md --cover "https://…" --tags ai,apis --confirm # LIVE
+# → {ok, url}  (or {ok:false, warning:"…automoderation removed…"} — rewrite editorially)
 ```
 
-## List / inspect my posts
+A confirmed `publish` is **immediately public** on the user's real blog. Always
+show the final title + body, get an explicit "yes", then run with `--confirm` as
+the **last** argument.
 
-```bash
-gql 'query { me { posts(pageSize: 20, page: 1) { nodes { id title slug url views reactionCount responseCount publishedAt } } } }' \
-  | jq '[.data.me.posts.nodes[] | {id, title, url, views, reactions: .reactionCount, responses: .responseCount}]'
-```
-
-Single post with full content + stats:
+## Delete a draft or post — GATED
 
-```bash
-gql 'query GetPost($id: ObjectId!) { post(id: $id) { title url views reactionCount responseCount content { markdown } } }' \
-  "$(jq -n --arg id "POST_ID" '{id:$id}')" | jq '.data.post | {title, url, views, reactions: .reactionCount}'
+```sh
+python3 "$H" delete --id <draftOrPostId>            # dry-run
+python3 "$H" delete --id <draftOrPostId> --confirm  # delete
 ```
 
 ## Gotchas
 
-- **Endpoint is `https://gql-beta.hashnode.com`** — the old `gql.hashnode.com`
-  host is deprecated (301 → HTML changelog page, never valid GraphQL JSON).
-- **`Authorization: Bearer $HASHNODE_TOKEN`** — send the token with the `Bearer`
-  prefix (this is what Hashnode's own official skill uses).
-- **Pro plan required for writes** — since 2026-05-13, `publishPost` / `createDraft`
-  / `updatePost` and publication-scoped reads only work if the target publication
-  has an active **Hashnode Pro** plan; otherwise the call returns a `FORBIDDEN`
-  *"does not have an active Pro plan"* error. That is a billing state on the user's
-  blog, not something the skill or a reconnect can fix — surface it and stop.
-- **`publicationId` is mandatory** for publishing/drafting — never guess it, read
-  it from the `me` query.
-- **`tags` is required on `publishPost`** — supply at least one `{name, slug}`;
-  slug must be lowercase with hyphens (e.g. `machine-learning`).
-- **`errors` on HTTP 200** — GraphQL reports failures in the `errors` array, not
-  via status codes; always surface them.
-- **Idempotency** — re-running `publishPost` creates a *new* post each time; to
-  change an existing one use `updatePost` with its `id`.
-
+- **No Pro, no PAT.** This uses the cookie-authed `hashnode.com/api/*` editor API,
+  not `gql-beta.hashnode.com` (which requires a paid Pro plan).
+- **Automoderation** (above) is the main failure mode on free blogs — keep it
+  editorial.
+- **This is the user's real blog.** Confirm before any publish/delete.
+- **Never print `HASHNODE_COOKIES`** — it is full account access.
+- **First-party internal API** — it can change when Hashnode updates the editor;
+  if a call starts returning HTML/404 unexpectedly, report it as upstream drift.
 
 ## Record the output
 

package/skills/hashnode/scripts/hashnode.py

@@ -0,0 +1,364 @@
+#!/usr/bin/env python3
+"""
+hashnode — read & publish on Hashnode with the user's own login cookies (BYOC).
+Standard-library only (urllib), no third-party deps.
+
+Hashnode moved its **public GraphQL API behind a paid Pro plan** (2026-05-13), so
+this skill does NOT use ``gql-beta.hashnode.com`` / a Personal Access Token.
+Instead it drives the **same first-party REST endpoints the web editor uses**
+(``https://hashnode.com/api/...``), authenticated by the login session cookie —
+which is free and needs no Pro plan.
+
+The connector injects the cookie jar as a JSON env var ``HASHNODE_COOKIES`` (a
+JSON list of cookie dicts; the session cookie is ``hashnode-session``). It is
+full account access — NEVER echo or print it.
+
+⚠️ Non-Pro publications are subject to Hashnode **automoderation**: overtly
+promotional posts (hypey language, repeated identical CTA links, "free credits!!")
+are auto-removed within seconds of publishing, so the post 404s even though the
+publish call returned success. Write **editorial / how-to** content (a helpful
+guide that happens to feature the product, with at most a couple of tasteful
+links) and it stays live. ``publish`` re-fetches the live URL and warns if the
+post was moderated away.
+
+Read commands run directly. ``publish`` / ``delete`` are GATED by a trailing
+``--confirm`` (honored only as the LAST arg). ``draft`` saves a private draft.
+
+Examples:
+  python3 hashnode.py publications
+  python3 hashnode.py draft   --title T --content-file a.md --cover https://x/y.jpg --tags ai,apis
+  python3 hashnode.py publish --title T --content-file a.md --cover https://x/y.jpg --tags ai,apis --confirm
+  python3 hashnode.py delete  --id <draftOrPostId> --confirm
+"""
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import json
+import os
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+UA = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+    "(KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+)
+BASE = "https://hashnode.com"
+
+_RAW = sys.argv[1:]
+# --confirm is honored ONLY as the last token, so body text containing
+# "--confirm" can never silently trigger a write.
+CONFIRM = bool(_RAW) and _RAW[-1] == "--confirm"
+ARGV = _RAW[:-1] if CONFIRM else list(_RAW)
+
+# State-changing commands — dry-run unless the invocation ends with --confirm.
+GATED = {"publish", "delete"}
+
+
+def out(obj) -> None:
+    print(json.dumps(obj, ensure_ascii=False, indent=2, default=str))
+
+
+def die(msg: str, code: int = 1) -> None:
+    out({"error": msg})
+    sys.exit(code)
+
+
+# ── Cookie jar ──────────────────────────────────────────────────────
+
+def load_cookies() -> list:
+    raw = os.environ.get("HASHNODE_COOKIES")
+    if not raw:
+        die("HASHNODE_COOKIES is not set — connect Hashnode at "
+            "https://auth.acedata.cloud/user/connections, then retry.")
+    try:
+        jar = json.loads(raw)
+    except json.JSONDecodeError as e:
+        die(f"HASHNODE_COOKIES is not valid JSON: {e}")
+    if not isinstance(jar, list):
+        die(f"HASHNODE_COOKIES must be a JSON list of cookies, got {type(jar).__name__}")
+    if not any(c.get("name") == "hashnode-session" for c in jar):
+        die("HASHNODE_COOKIES is missing the 'hashnode-session' cookie — re-capture "
+            "on hashnode.com with the ACE extension, then reconnect at "
+            "https://auth.acedata.cloud/user/connections.")
+    return jar
+
+
+def _domain_matches(host: str, domain: str) -> bool:
+    d = domain.lstrip(".").lower()
+    h = host.lower()
+    return not d or h == d or h.endswith("." + d)
+
+
+def cookie_header(jar: list, url: str) -> str:
+    host = urllib.parse.urlsplit(url).hostname or ""
+    host_in_scope = any(
+        c.get("domain") and _domain_matches(host, str(c["domain"])) for c in jar
+    )
+    parts = []
+    for c in jar:
+        name, value = c.get("name"), c.get("value")
+        if not name or value is None:
+            continue
+        domain = c.get("domain")
+        if domain:
+            if not _domain_matches(host, str(domain)):
+                continue
+        elif not host_in_scope:
+            # A domain-less cookie only rides along when at least one scoped
+            # cookie already matched this host (never leak it to a stray host).
+            continue
+        parts.append(f"{name}={value}")
+    return "; ".join(parts)
+
+
+# ── HTTP ────────────────────────────────────────────────────────────
+
+def request(method, path, jar, *, body=None):
+    url = BASE + path
+    hdrs = {
+        "User-Agent": UA,
+        "Accept": "application/json",
+        "Origin": BASE,
+        "Referer": BASE + "/",
+        "X-Requested-With": "XMLHttpRequest",
+    }
+    data = None
+    if body is not None:
+        data = json.dumps(body).encode("utf-8")
+        hdrs["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=hdrs, method=method)
+    # Unredirected → the cookie is not re-sent if the API 30x-redirects to a
+    # different host, so the jar never leaks off-site.
+    req.add_unredirected_header("Cookie", cookie_header(jar, url))
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            raw = resp.read()
+            if resp.headers.get("Content-Encoding") == "gzip":
+                raw = gzip.decompress(raw)
+            return resp.status, raw.decode("utf-8", "replace")
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        try:
+            if e.headers.get("Content-Encoding") == "gzip":
+                raw = gzip.decompress(raw)
+        except Exception:
+            pass
+        return e.code, raw.decode("utf-8", "replace")
+    except urllib.error.URLError as e:
+        die(f"network error reaching {url}: {e.reason}")
+
+
+def api(method, path, jar, *, body=None, _retried=False):
+    status, text = request(method, path, jar, body=body)
+    # Hashnode sits behind Cloudflare, which intermittently 403/429s an
+    # otherwise valid session; retry idempotent GETs once. Never replay a
+    # write (POST/PUT/DELETE) — it could duplicate a publish.
+    if status in (403, 429) and method == "GET" and not _retried:
+        time.sleep(1.5)
+        return api(method, path, jar, body=body, _retried=True)
+    if status in (401, 403):
+        die(f"auth failed ({status}) on {path} — cookie likely expired. "
+            f"Reconnect at https://auth.acedata.cloud/user/connections.")
+    # A hashnode.com/api path that 404s with an HTML body means the route/id is
+    # wrong; a JSON {success:false} is a real API error.
+    stripped = text.lstrip()
+    if stripped.startswith("<"):
+        die(f"unexpected non-JSON ({status}) from {path} — the route or id is "
+            f"likely wrong.")
+    try:
+        d = json.loads(text)
+    except json.JSONDecodeError:
+        die(f"non-JSON response ({status}) from {path}: {text[:300]}")
+    if isinstance(d, dict) and d.get("success") is False:
+        die(f"Hashnode API error ({status}) on {path}: {d.get('error')}")
+    return d
+
+
+# ── helpers ─────────────────────────────────────────────────────────
+
+def resolve_publication(jar, wanted: str | None) -> dict:
+    d = api("GET", "/api/publications", jar)
+    pubs = d.get("publications") or []
+    if not pubs:
+        die("no publications on this account — create a blog on hashnode.com first.")
+    if wanted:
+        for p in pubs:
+            if wanted in (p.get("_id"), p.get("title"), p.get("displayTitle")):
+                return p
+        die(f"publication {wanted!r} not found; have: "
+            + ", ".join(f'{p.get("title")}({p.get("_id")})' for p in pubs))
+    if len(pubs) > 1:
+        die("multiple publications — pass --publication <id>. Have: "
+            + ", ".join(f'{p.get("title")}({p.get("_id")})' for p in pubs))
+    return pubs[0]
+
+
+def resolve_tags(jar, slugs_csv: str | None) -> list:
+    if not slugs_csv:
+        return []
+    tags = []
+    for slug in [s.strip() for s in slugs_csv.split(",") if s.strip()]:
+        d = api("GET", f"/api/tags/search?q={urllib.parse.quote(slug)}", jar)
+        cands = d.get("tags") or []
+        pick = next((t for t in cands if t.get("slug") == slug), None) \
+            or (max(cands, key=lambda t: t.get("numPosts", 0)) if cands else None)
+        if pick:
+            tags.append({"_id": pick["_id"], "name": pick["name"], "slug": pick["slug"]})
+    return tags[:5]
+
+
+def read_content(args) -> str:
+    if args.content_file:
+        if not os.path.isfile(args.content_file):
+            die(f"content file not found: {args.content_file}")
+        with open(args.content_file, encoding="utf-8") as fh:
+            return fh.read()
+    if args.content:
+        return args.content
+    die("provide --content-file or --content")
+
+
+def build_save(args, pub_id, jar) -> dict:
+    body = {
+        "title": (args.title or "").strip(),
+        "contentMarkdown": read_content(args),
+        "publicationId": pub_id,
+    }
+    if not body["title"]:
+        die("provide --title")
+    if args.subtitle:
+        body["subtitle"] = args.subtitle
+    if args.cover:
+        body["coverImage"] = args.cover
+        body["ogImage"] = args.cover
+    if args.slug:
+        body["slug"] = args.slug
+    tags = resolve_tags(jar, args.tags)
+    if tags:
+        body["tags"] = tags
+    return body
+
+
+def create_and_save(args, jar) -> tuple[str, dict]:
+    pub = resolve_publication(jar, args.publication)
+    d = api("POST", "/api/drafts", jar, body={"publicationId": pub["_id"]})
+    did = d.get("draftId")
+    if not did:
+        die(f"draft creation returned no draftId: {d}")
+    save = build_save(args, pub["_id"], jar)
+    api("PUT", f"/api/drafts/{did}", jar, body=save)
+    return did, pub
+
+
+# ── commands ────────────────────────────────────────────────────────
+
+def cmd_publications(jar, _args):
+    d = api("GET", "/api/publications", jar)
+    out({"publications": [
+        {"id": p.get("_id"), "title": p.get("title"),
+         "url": p.get("url") or p.get("domain")} for p in d.get("publications") or []]})
+
+
+def cmd_draft(jar, args):
+    did, pub = create_and_save(args, jar)
+    out({"ok": True, "draft_id": did, "publication": pub.get("title"),
+         "editor_url": f"https://hashnode.com/draft/{did}",
+         "note": "Private draft saved. Review it, then run `publish ... --confirm` to go live."})
+
+
+def cmd_publish(jar, args):
+    did, pub = create_and_save(args, jar)
+    d = api("POST", f"/api/drafts/{did}/publish", jar, body={})
+    post = d.get("post") or {}
+    url = post.get("url")
+    result = {"ok": True, "posted": True, "id": post.get("id"),
+              "title": post.get("title"), "url": url, "publication": pub.get("title")}
+    # Verify the post is actually live — non-Pro blogs auto-moderate promo posts.
+    if url:
+        time.sleep(4)
+        try:
+            code = _url_status(url)
+            if code == 404:
+                result["ok"] = False
+                result["warning"] = (
+                    "The publish call succeeded but the live URL returns 404 — "
+                    "Hashnode automoderation removed the post (common for overtly "
+                    "promotional content on a non-Pro blog). Rewrite it in an "
+                    "editorial / how-to style with fewer repeated CTA links and "
+                    "republish.")
+        except Exception:
+            pass
+    out(result)
+
+
+def _url_status(url: str) -> int:
+    req = urllib.request.Request(url, headers={"User-Agent": UA}, method="GET")
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+    except Exception:
+        return 0
+
+
+def cmd_delete(jar, args):
+    d = api("DELETE", f"/api/drafts/{args.id}", jar)
+    out({"ok": True, "deleted": True, "id": d.get("deletedDraftId") or args.id})
+
+
+COMMANDS = {
+    "publications": cmd_publications,
+    "draft": cmd_draft,
+    "publish": cmd_publish,
+    "delete": cmd_delete,
+}
+
+
+def gated_dry_run(args) -> None:
+    out({"dry_run": True, "command": args.command,
+         "title": getattr(args, "title", None), "id": getattr(args, "id", None),
+         "note": "Re-run with --confirm as the LAST argument to actually run this "
+                 "on the user's REAL Hashnode blog."})
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(description="Hashnode via login cookies (no Pro).")
+    sub = p.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("publications", help="list my blogs (publications)")
+
+    def add_write_args(sp):
+        sp.add_argument("--title", required=True)
+        sp.add_argument("--subtitle")
+        sp.add_argument("--content-file", dest="content_file", help="path to a Markdown file")
+        sp.add_argument("--content", help="inline Markdown (use --content-file for长文)")
+        sp.add_argument("--cover", help="cover image URL (also used as OG image)")
+        sp.add_argument("--tags", help="comma-separated tag slugs, e.g. ai,apis")
+        sp.add_argument("--slug", help="custom URL slug (optional)")
+        sp.add_argument("--publication", help="publication id (needed only if >1 blog)")
+
+    add_write_args(sub.add_parser("draft", help="save a PRIVATE draft (safe, non-public)"))
+    add_write_args(sub.add_parser("publish", help="publish a post (GATED by trailing --confirm)"))
+
+    sp = sub.add_parser("delete", help="delete a draft or post (GATED by trailing --confirm)")
+    sp.add_argument("--id", required=True)
+    return p
+
+
+def main() -> None:
+    args = build_parser().parse_args(ARGV)
+    if args.command in GATED and not CONFIRM:
+        gated_dry_run(args)
+        return
+    jar = load_cookies()
+    COMMANDS[args.command](jar, args)
+
+
+if __name__ == "__main__":
+    main()

package/skills/maestro-video/SKILL.md

@@ -0,0 +1,271 @@
+---
+name: maestro-video
+description: "Produce complete AI videos with Maestro via AceDataCloud API. Use when: Maestro, article-to-video, prompt-to-video, turn a brief or reference media into a finished captioned video, generate scripts/visuals/voiceover/music/editing in one workflow, create multilingual video variants, or remix/edit/extend a previous Maestro video. Covers task creation, progress polling, history, and final output retrieval."
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+compatibility: Requires ACEDATACLOUD_API_TOKEN in .env file (see _shared/authentication.md). Optionally pair with mcp-maestro for tool-use.
+---
+
+# Maestro End-to-End Video Production
+
+Use Maestro when the user wants a **finished video**, not only a generated clip. A headless AI director turns one natural-language brief into a script, visual assets, voiceover, music, edit, captions, quality checks, and rendered video variants.
+
+> **Setup:** See [authentication](../_shared/authentication.md) for token setup.
+
+## Choose Maestro When
+
+- The user wants an article, idea, product brief, or campaign turned into a complete video.
+- The workflow needs scripting, visuals, narration, captions, and editing handled together.
+- The user supplies product images, a logo, portrait, source footage, or reference audio.
+- One visual production must be rendered in multiple languages.
+- A completed Maestro video needs to be remixed, edited, or extended.
+
+Use a model-specific video API such as Seedance, Kling, or Veo when the user only needs a short generated shot and wants direct model controls. Maestro may use multiple media services internally and is optimized for the finished production.
+
+## Quick Start
+
+```bash
+curl -X POST https://api.acedata.cloud/maestro/videos \
+  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "prompt": "Create a 30-second beginner-friendly video explaining vector databases. End with one memorable takeaway.",
+    "aspect": "16:9",
+    "duration": 30,
+    "quality": "standard",
+    "scenario": "narrated",
+    "langs": ["en"]
+  }'
+```
+
+The response contains a `task_id`. Maestro is asynchronous, so query the task until it reaches `succeeded` or `failed`:
+
+```bash
+curl -X POST https://api.acedata.cloud/maestro/tasks \
+  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"id": "<task_id>", "action": "retrieve"}'
+```
+
+Do not invent output URLs or report completion while the task is still running.
+
+## Core Workflow
+
+1. Translate the user's goal into a concrete production brief.
+2. Call `POST /maestro/videos` and preserve the returned `task_id` and `trace_id`.
+3. Poll `POST /maestro/tasks` at a reasonable interval.
+4. Continue through nonterminal states; stop only at `succeeded` or `failed`.
+5. On success, return every item in `response.data.variants`, including its language and `output_url`.
+6. If requested, iterate by creating a new task with `action`, `ref_task_id`, and a change-focused prompt.
+
+Polling and history queries are free; the video task is settled after production based on delivered output. Avoid submitting duplicate creation requests while an existing task is still running.
+
+## Creation Parameters
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `prompt` | string | required | Natural-language production brief: topic, audience, content, tone, and desired result |
+| `action` | string | `generate` | `generate`, `remix`, `edit`, or `extend` |
+| `ref_task_id` | string | - | Required for `remix`, `edit`, and `extend` |
+| `file_urls` | string[] | - | Public image, video, or audio references, up to the limits enforced by the API |
+| `langs` | string[] | `["zh-cn"]` | Output language codes; each creates a localized rendered variant |
+| `aspect` | string | `9:16` | `9:16`, `16:9`, or `1:1` |
+| `duration` | integer | `30` | Target duration from 1 to 600 seconds |
+| `quality` | string | `standard` | `draft`, `standard`, or `premium` |
+| `scenario` | string | `auto` | `auto`, `narrated`, `drama`, `avatar`, `motion`, or `slideshow` |
+| `style` | string | `auto` | Preset or freeform visual direction |
+| `voice` | string | `auto` | Cross-lingual voice preset or a 32-hex-character Fish reference ID |
+| `callback_url` | string | - | Optional webhook called on success or failure |
+
+### Quality
+
+- `draft`: fast rough cut for validating direction.
+- `standard`: balanced default for normal production.
+- `premium`: richer, more polished production with a higher cost and longer turnaround.
+
+### Scenarios
+
+- `auto`: let the director choose from the brief.
+- `narrated`: multi-scene explainer, documentary, brand, history, or product video with voiceover.
+- `drama`: acted short drama with characters and dialogue.
+- `avatar`: talking-head or digital-human video; normally provide a portrait in `file_urls`.
+- `motion`: kinetic typography, data, logo, or abstract motion graphics.
+- `slideshow`: presentation deck, pitch, or slide-led video.
+
+### Styles
+
+Named presets include `cinematic`, `glass`, `luxury`, `swiss`, `modern`, `editorial`, `warm`, `vibrant`, `neon`, `mono`, `pastel`, `bold`, `industrial`, `futuristic`, and `retro`. The API also accepts a freeform style hint.
+
+### Voices
+
+Available presets include:
+
+- Female: `warm-female`, `bright-female`, `anchor-female`, `clean-female`
+- Male: `calm-male`, `deep-male`, `documentary-male`, `energetic-male`, `storyteller-male`
+- Automatic: `auto`
+
+Voice controls timbre rather than language. The same preset speaks the language selected in `langs`.
+
+## Reference Media
+
+Pass public URLs in `file_urls`:
+
+```json
+{
+  "prompt": "Create a product launch video that clearly shows the camera body and logo. Use the supplied audio as the tone reference.",
+  "file_urls": [
+    "https://example.com/product.jpg",
+    "https://example.com/logo.png",
+    "https://example.com/reference.mp3"
+  ],
+  "scenario": "narrated",
+  "style": "editorial",
+  "aspect": "16:9"
+}
+```
+
+Reference URLs must be reachable by the service. Do not pass local file paths. Upload local assets first, then use their public URLs.
+
+## Multilingual Variants
+
+Use one request to reuse the production across languages:
+
+```json
+{
+  "prompt": "A concise product walkthrough for first-time customers",
+  "langs": ["en", "de", "ja"],
+  "voice": "warm-female",
+  "duration": 45
+}
+```
+
+The first language is primary. A successful task normally returns one item per delivered language in `response.data.variants`. Do not assume every requested language succeeded; inspect the actual variants.
+
+## Iterate on a Previous Video
+
+All iteration actions require `ref_task_id`.
+
+### Remix
+
+Use `remix` for a new creative interpretation that keeps the previous task as context:
+
+```json
+{
+  "action": "remix",
+  "ref_task_id": "previous-task-id",
+  "prompt": "Rework this as a faster social cut with a stronger opening hook and neon styling.",
+  "aspect": "9:16"
+}
+```
+
+### Edit
+
+Use `edit` for targeted revisions:
+
+```json
+{
+  "action": "edit",
+  "ref_task_id": "previous-task-id",
+  "prompt": "Keep the structure and visuals. Replace the final call to action and use a calmer narrator."
+}
+```
+
+### Extend
+
+Use `extend` to continue or lengthen the production:
+
+```json
+{
+  "action": "extend",
+  "ref_task_id": "previous-task-id",
+  "prompt": "Add a 15-second customer example before the conclusion.",
+  "duration": 60
+}
+```
+
+Iteration creates a new task. Continue polling the new `task_id`; do not overwrite or confuse it with the source task.
+
+## Task Response
+
+A task response exposes top-level progress for user feedback:
+
+```json
+{
+  "id": "task-id",
+  "status": "producing",
+  "progress": {
+    "percent": 52,
+    "stage": "visuals",
+    "message": "Generating scene assets",
+    "activity": "Creating scene 4"
+  },
+  "response": null
+}
+```
+
+On success, inspect the delivered variants:
+
+```json
+{
+  "status": "succeeded",
+  "response": {
+    "success": true,
+    "data": {
+      "variants": [
+        {
+          "lang": "en",
+          "output_url": "https://cdn.example/video.mp4",
+          "captions_url": "https://cdn.example/captions.vtt",
+          "cover_url": "https://cdn.example/cover.jpg",
+          "duration": 31.2,
+          "qc_score": 0.96
+        }
+      ]
+    }
+  }
+}
+```
+
+Treat the fields above as a shape guide. Return fields that are actually present; never fabricate missing captions, covers, durations, or QC scores.
+
+## List Recent Tasks
+
+The live task endpoint also supports account history:
+
+```bash
+curl -X POST https://api.acedata.cloud/maestro/tasks \
+  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"action": "retrieve_batch", "limit": 20}'
+```
+
+Optional Unix timestamp filters are `created_at_min` and `created_at_max`. The authenticated identity determines which tasks are returned; do not supply or trust a body-level user ID.
+
+## Prompting Guidance
+
+A useful brief answers:
+
+- What is the subject and desired outcome?
+- Who is the audience?
+- What facts, products, people, or scenes must appear?
+- What should the viewer feel or do afterward?
+- Which platform determines aspect ratio and pacing?
+- Are there exact brand, compliance, or wording constraints?
+
+Prefer a concrete production brief over a list of low-level model instructions. Maestro is responsible for choosing and orchestrating media tools.
+
+## Gotchas
+
+- This API is asynchronous. Always preserve and poll the returned `task_id`.
+- Terminal states are `succeeded` and `failed`; other status names may evolve as the production pipeline changes.
+- `remix`, `edit`, and `extend` fail without `ref_task_id`.
+- `file_urls` must be public URLs, not local paths.
+- `avatar` usually needs a usable portrait reference.
+- Requested duration is a target; report the actual delivered duration from the result.
+- Multilingual requests may return fewer variants than requested if one output fails.
+- Do not resubmit the same brief merely because a long-running poll has not finished.
+- Do not expose the API token in logs, output, source files, or examples.
+
+> **MCP:** `pip install mcp-maestro` | Hosted: `https://maestro.mcp.acedata.cloud/mcp` | See [all MCP servers](../_shared/mcp-servers.md)