@ignix-social/editor 0.1.26 → 0.1.28

package/README.md

@@ -2,17 +2,20 @@
 
 Render videos from HTML on your own computer: reels made from scratch, edits of your recorded videos and clips from long ones. It is the video engine behind Ignix's reel and edit playbooks for AI assistants (Claude, ChatGPT) and behind Ignix Creator.
 
+Ignix Editor is for Ignix customers: it needs an active [Ignix plan](https://ignix.social/pricing). Your AI assistant gets a short-lived license (72 h) from the Ignix MCP tool `get_editor_license` and saves it with `ignix-editor license <token>`; the license is checked on your machine, offline.
+
 ```sh
+npx @ignix-social/editor license <token> # saves the license from the Ignix MCP
 npx @ignix-social/editor doctor        # checks Node 22+, ffmpeg, whisper and the H.264 encoder
 npx @ignix-social/editor init my-reel  # creates ~/ignix-videos/my-reel
 npx @ignix-social/editor render ~/ignix-videos/my-reel
 ```
 
-Commands: `doctor`, `init`, `check`, `snapshot`, `render`, `preview`, `transcribe`, `faces`, `ffmpeg`, `ffprobe`, `skills add`, `fetch`, `serve`, `creator-job`, `help`.
+Commands: `license`, `doctor`, `init`, `check`, `snapshot`, `render`, `preview`, `transcribe`, `faces`, `ffmpeg`, `ffprobe`, `skills add`, `fetch`, `serve`, `creator-job`, `help`.
 
 - Everything runs locally; your footage never leaves your machine.
 - ffmpeg (GPL build, without libx264) and whisper.cpp are downloaded once per machine into `~/.ignix-editor`, checked against their SHA-256. Chrome for rendering is downloaded once from Google's official channel.
-- No telemetry and no automatic updates: the version you install is the version that runs.
+- No telemetry and no automatic updates: the version you install is the version that runs. At most once a day it asks ignix.social which version is recommended (a plain request, nothing about you or your projects is sent) and, if yours is older, prints the command to update; it never updates by itself. Turn the check off with `IGNIX_EDITOR_NO_UPDATE_CHECK=1`.
 - The final audio is normalised to −14 LUFS.
 - Analysis (`faces`, and `serve`, the local service Ignix Creator talks to: shots, people, faces, burned-in text, voice clean-up, transcription) runs on ONNX Runtime with open models (YOLOX, YuNet, PP-OCR, CLIP), downloaded the first time they are needed and checked against their SHA-256.
 - `ignix-editor skills add` installs the `ignix-editor` skill for Claude.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ignix-social/editor",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Ignix Editor: render HTML video compositions (reels, edits, clips) on your own computer. Based on HyperFrames.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/ignix-editor/SKILL.md

@@ -7,10 +7,13 @@ description: Build and render videos with Ignix Editor (HTML + GSAP compositions
 
 Ignix Editor turns an HTML page into an MP4. You write `index.html` (layout in HTML/CSS, motion in JS), the editor renders it frame by frame in a headless browser and encodes it with ffmpeg. The Ignix playbooks say WHAT to make; this skill says HOW to write it so that what you write is what renders.
 
+**License first.** Ignix Editor needs an active Ignix plan. Before the first command of a session, call the Ignix MCP tool `get_editor_license` and run `ignix-editor license <token>` with what it returns. It lasts 72 h; when a command says the license is missing or expired, renew it the same way. If the Ignix MCP says the plan is not active (or `get_editor_license` refuses), STOP: do not render or keep working with Ignix Editor and do not look for workarounds. Tell the user their Ignix plan is not active and that they can reactivate it at https://ignix.social/app/billing.
+
 Commands. `ignix-editor` means the copy the Ignix playbook installed: `~/.ignix-editor/cli/node_modules/.bin/ignix-editor` (Windows PowerShell: `& "$env:USERPROFILE\.ignix-editor\cli\node_modules\.bin\ignix-editor.cmd"`; PowerShell blocks `.ps1` scripts by default, so use the `.cmd` and `npm.cmd`, and `$env:USERPROFILE` instead of `~`). Do not use `npx`: it may fetch another version.
 
 | Command | What it does |
 |---|---|
+| `ignix-editor license <token>` | Saves the license from the Ignix MCP (`get_editor_license`). Without a token, shows whether there is a valid one and until when. |
 | `ignix-editor doctor` | Node 22+ and the H.264 encoder; downloads its own ffmpeg and whisper the first time. Run it first. |
 | `ignix-editor init <name>` | Creates `~/ignix-videos/<name>` with a working skeleton, GSAP, local fonts and `ignix-frame.js`. |
 | `ignix-editor transcribe <file> --lang es [--script "…"] -o words.json` | Words with start/end seconds, plus `pauses` ([start, end] of every silence ≥0.35 s, for cutting silences), on this machine. Over 2 min it prints whisper's progress; without a GPU it takes about as long as the audio. |
@@ -44,16 +47,17 @@ The engine reads `<video>`/`<audio>` from the HTML file before the page runs. Me
 ```html
 <video id="cut1" src="assets/take.mp4" muted playsinline data-start="0" data-duration="2.9667" data-media-start="0.1" data-track-index="0"></video>
 <audio id="vo1" src="assets/vo/l1.wav" data-start="0" data-duration="3.64" data-track-index="10" data-volume="1"></audio>
-<audio id="sfx3" src="assets/sfx/click.mp3" data-start="4.88" data-duration="0.4" data-track-index="23" data-volume="0.45"></audio>
+<audio id="sfx3" src="assets/sfx/click.mp3" data-start="4.88" data-duration="0.4" data-track-index="23" data-volume="0.8"></audio>
 ```
 
 - `data-start` = when it appears in the video; `data-duration` = how long; `data-media-start` = where in the source file it starts (trim in). One `<video>` per kept piece of a recording; the same source file can be used many times.
 - Every `<video>`/`<audio>` has a unique `id`. An `<audio>` without id is silently dropped from the mix.
 - Footage you show without its sound: `muted`. A video whose own sound you keep: `data-has-audio="true"` and no `muted`.
-- Give each sound effect its own `data-track-index` (overlapping sounds on one track get a warning).
+- Give each sound effect its own `data-track-index` (overlapping sounds on one track get a warning). Effects must be heard: `data-volume` 0.7–1 for the Ignix library effects (already level-matched); below 0.6 a short click or pop disappears under the voice and the music. Never louder than the voice.
 - Never put `data-start` on BOTH a video and an element that contains it: time the video, and put a plain (untimed) wrapper around it for zoom/crop/position.
 - Never add `crossorigin` to media. Never call `play()`, `pause()` or set `currentTime`: the engine owns playback.
-- Fades and ducking: a volume lane on the element, e.g. 8 ms fades at each cut so it does not click:
+- Music ducks BY ITSELF under the voice at check/render: give the music `<audio>` the id `music` (or `data-role="music"`) and set its `data-volume` to its level when nobody talks; it drops about 13 dB under every voice line (`vo1`, `voice2`… or `data-role="voice"`) and under any `<video>` that keeps its own sound, and comes back up in pauses longer than 0.6 s. Do not draw that by hand. `data-duck="off"` on the music keeps it flat.
+- Fades: a volume lane on the element, e.g. 8 ms fades at each cut so it does not click:
   `data-automation='{"version":1,"lanes":[{"target":"volume","points":[{"t":0,"v":0},{"t":0.008,"v":1},{"t":2.95,"v":1},{"t":2.9667,"v":0}]}]}'` (`t` is seconds from the clip's own start).
 - Times are snapped to the nearest frame by the editor; still write them with enough decimals (frame / fps).
 

package/src/cli.mjs

@@ -23,6 +23,7 @@ import { reviewVideo } from './analysis/review.mjs';
 import { pickAudio } from './pick-audio.mjs';
 import { importGiphy, openGiphySearch } from './giphy.mjs';
 import { warnIfOutdated } from './update-check.mjs';
+import { LICENSE_ENV, LICENSE_FILE, licenseMessage, licenseStatus, requireLicense, saveLicense } from './license.mjs';
 
 const PKG_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
 const PKG = JSON.parse(readFileSync(join(PKG_DIR, 'package.json'), 'utf8'));
@@ -35,6 +36,11 @@ const requireHere = createRequire(import.meta.url);
 const depDir = (name) => dirname(requireHere.resolve(`${name}/package.json`));
 
 const log = (...a) => console.error(...a);
+// Qué hizo el ducking automático (duck.mjs): que el asistente lo sepa y no lo duplique a mano.
+function logDuck(duck) {
+  for (const d of duck?.ducked ?? []) log(`• Music "${d.id}" ducked under the voice (${d.spans} span${d.spans === 1 ? '' : 's'}). Set data-duck="off" on it to keep it flat.`);
+  for (const d of duck?.skipped ?? []) log(`• Music "${d.id}" not ducked: ${d.reason}.`);
+}
 const fail = (msg) => {
   log(`✗ ${msg}`);
   process.exit(1);
@@ -145,8 +151,9 @@ const commands = {
     const { pos, rest } = parseArgs(argv, {});
     const dir = projectDir(pos[0]);
     const errors = validateProject(dir);
-    const { build, snapped } = prepare(dir);
+    const { build, snapped, duck } = prepare(dir);
     if (snapped) log(`• ${snapped} time(s) snapped to the nearest frame`);
+    logDuck(duck);
     const { env } = await engineEnv(log);
     const code = runEngine(['check', build, ...rest], env, dir);
     process.exit(errors ? 1 : code);
@@ -169,6 +176,7 @@ const commands = {
     const output = resolve(opts.output ?? join(dir, 'renders', `${basename(dir)}.mp4`));
     const r = await renderProject(dir, output, { lufs: opts.lufs, normalize: opts.normalize, engineArgs: rest, log });
     if (r.snapped) log(`• ${r.snapped} time(s) snapped to the nearest frame`);
+    logDuck(r.duck);
     if (r.loudness) log(`✓ Loudness: ${r.loudness.before.toFixed(1)} → ${r.loudness.after?.toFixed(1)} LUFS`);
     // La revisión va SIEMPRE detrás del render (salvo --no-review): un agente con prisa se
     // salta un paso aparte, pero no puede no ver esto. El MP4 queda hecho igualmente.
@@ -426,6 +434,27 @@ const commands = {
     }
   },
 
+  // Licencia de Ignix (src/license.mjs). Con token: la comprueba y la guarda. Sin nada: dice
+  // si hay una válida y hasta cuándo (código 1 si no la hay, para que el agente lo vea).
+  async license(argv) {
+    const { pos } = parseArgs(argv, {});
+    const when = (exp) => new Date(exp * 1000).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' });
+    if (pos[0]) {
+      const r = saveLicense(pos[0]);
+      console.log(`✓ License valid until ${when(r.exp)}`);
+      if (process.env[LICENSE_ENV]) log(`• ${LICENSE_ENV} is set in this environment and takes precedence over the saved license.`);
+      return;
+    }
+    const st = licenseStatus();
+    if (st.ok) {
+      console.log(`✓ License valid until ${when(st.exp)} (${st.source === 'env' ? LICENSE_ENV : LICENSE_FILE})`);
+      return;
+    }
+    if (st.reason === 'expired') log(`✗ The license expired on ${when(st.exp)}.`);
+    log(`✗ ${licenseMessage(st.reason)}`);
+    process.exitCode = 1;
+  },
+
   async version() {
     console.log(`ignix-editor ${PKG.version} (engine ${UPSTREAM.version})`);
   },
@@ -450,10 +479,12 @@ const commands = {
   ignix-editor style measure <video>… [--speech] [--stills dir] [-o style.json]   someone's editing style, measured on 2–3 of their videos
   ignix-editor ffmpeg|ffprobe <args>           Ignix Editor's own ffmpeg
   ignix-editor skills add                      installs the skill for Claude
+  ignix-editor license [<token>]               saves the license from the Ignix MCP (get_editor_license), or shows it
   ignix-editor fetch [--whisper small] [--no-analysis]   downloads everything up front (each file SHA-256-checked)
   ignix-editor serve                           local service for Ignix Creator (JSON lines on stdin/stdout)
 
-The folder defaults to the current one. Open source (Apache-2.0); credits in NOTICE.`);
+The folder defaults to the current one. Requires an active Ignix plan (license from the Ignix MCP).
+Open source (Apache-2.0); credits in NOTICE.`);
   },
 };
 
@@ -463,10 +494,25 @@ function printReview(rv, out = log) {
   if (rv.ready && rv.issues.length) out('  (! = worth fixing if it is quick.)');
 }
 
+// Comandos que funcionan SIN licencia de Ignix; todos los demás (y los que se añadan) la piden.
+// - help, version, license, skills add: para ponerse en marcha y pedir/guardar la licencia.
+// - doctor, fetch: solo comprueban la máquina y descargan binarios/modelos una vez.
+// - serve, creator-job: los usa Ignix Creator, que lleva este paquete dentro y comprueba el
+//   plan él mismo (ADR-0023); aquí no se piden para no romper sus renders ni su análisis.
+const NO_LICENSE = new Set(['help', 'version', 'license', 'skills', 'doctor', 'fetch', 'serve', 'creator-job']);
+
 export async function main(argv) {
   const [cmd = 'help', ...rest] = argv;
-  const fn = commands[cmd === '--version' || cmd === '-v' ? 'version' : cmd === '--help' || cmd === '-h' ? 'help' : cmd];
+  const name = cmd === '--version' || cmd === '-v' ? 'version' : cmd === '--help' || cmd === '-h' ? 'help' : cmd;
+  const fn = Object.hasOwn(commands, name) ? commands[name] : null;
   if (!fn) fail(`Unknown command: ${cmd}. See: ignix-editor help`);
+  if (!NO_LICENSE.has(name)) {
+    try {
+      requireLicense();
+    } catch (e) {
+      fail(e.message);
+    }
+  }
   // Aviso de versión nueva (src/update-check.mjs): no en `help`/`--version`, que el
   // agente usa justo para comprobar qué tiene.
   if (!['help', 'version', '--version', '-v', '--help', '-h'].includes(cmd)) {

package/src/creator/build.mjs

@@ -288,7 +288,8 @@ export function buildProject({ spec, media, dir, ffmpeg, ffprobe }) {
     const keys = new Set([0, spec.audio.fadeInSec, duration - spec.audio.fadeOutSec, dur]);
     if (spec.audio.duck) for (const iv of speechIntervals(spec)) for (const x of [iv.start - DUCK_RAMP_SEC, iv.start, iv.end, iv.end + DUCK_RAMP_SEC * 2]) keys.add(x);
     const points = [...keys].filter((x) => x >= 0 && x <= dur).sort((a, b) => a - b).map((x) => [x, musicLevel(spec, duration, x)]);
-    body.push(`<audio ${attrs({ id: 'music', src: file, 'data-start': 0, 'data-duration': dur, 'data-volume': 1, 'data-automation': lane(points), 'data-track-index': track++ })}></audio>`);
+    // Creator ya decide (spec.audio.duck) y lo lleva en la curva: el ducking automático no la toca.
+    body.push(`<audio ${attrs({ id: 'music', src: file, 'data-start': 0, 'data-duration': dur, 'data-volume': 1, 'data-automation': lane(points), 'data-duck': 'off', 'data-track-index': track++ })}></audio>`);
   }
   spec.voice.forEach((v, i) => {
     let file = place(v.asset);

package/src/duck.mjs

@@ -0,0 +1,142 @@
+// Ducking automático: la música baja sola mientras alguien habla y vuelve a subir en las pausas.
+//
+// Creator ya lo hacía (creator/build.mjs, `duck`), pero una composición escrita a mano por un
+// asistente dejaba la música plana: la guía lo mencionaba y nadie lo hacía (2026-10-09, reel
+// «One post. One job.»: música a 0,16 fija bajo once frases). Ahora se aplica en la copia de
+// trabajo (prepare), así que check, snapshot, preview y render lo oyen igual, y el proyecto del
+// usuario no se toca.
+//
+//   música  <audio> con data-role="music", o id music / bgm / soundtrack / song / bed (music2…)
+//   voz     <audio> con data-role="voice|speech|narration", o id vo / voice / narration / line (+n);
+//           y <video> con su sonido (data-has-audio="true", sin muted), salvo data-role="music|sfx".
+//
+// Se respeta: data-duck="off" (o cualquier valor distinto de "auto"/"on") y una música que ya trae
+// su propia curva de volumen con más de 4 puntos (alguien la dibujó a mano). Las fades sencillas
+// (entrada / salida) se conservan: el ducking se MULTIPLICA por la curva que hubiera.
+
+export const DUCKED = 0.22; // ≈ −13 dB bajo la voz (lo mismo que Creator)
+export const DUCK_RAMP_SEC = 0.18; // baja en 0,18 s antes de la frase, sube en 0,36 s después
+const JOIN_GAP_SEC = 0.6; // pausas más cortas no la suben: sin «bombeo» entre frase y frase
+
+const TAG = /<(audio|video)\b[^>]*>/gi;
+const ATTR = /([\w:-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'))?/g;
+const MUSIC_ID = /^(music|bgm|soundtrack|song|bed)([-_]?\w*)?$/i;
+const VOICE_ID = /^(vo|voice|narration|narrator|line|speech)([-_]?\d+)?$/i;
+
+function attrsOf(tag) {
+  const inner = tag.replace(/^<\w+/, '').replace(/\/?>$/, '');
+  const out = {};
+  for (const m of inner.matchAll(ATTR)) out[m[1].toLowerCase()] = m[2] ?? m[3] ?? true;
+  return out;
+}
+
+const num = (v, d = NaN) => (v === undefined || v === true || v === '' ? d : Number(v));
+
+function isMusic(kind, a) {
+  if (kind !== 'audio') return false;
+  return a['data-role'] === 'music' || (typeof a.id === 'string' && MUSIC_ID.test(a.id));
+}
+
+function isSpeech(kind, a) {
+  if (num(a['data-volume'], 1) <= 0) return false;
+  const role = a['data-role'];
+  if (role === 'voice' || role === 'speech' || role === 'narration') return true;
+  if (role === 'music' || role === 'sfx') return false;
+  if (kind === 'audio') return typeof a.id === 'string' && VOICE_ID.test(a.id);
+  return a['data-has-audio'] === 'true' && a.muted === undefined;
+}
+
+/** Tramos [inicio, fin] (tiempo de la composición) en los que habla alguien, ya unidos. */
+export function speechSpans(html) {
+  const spans = [];
+  for (const m of html.matchAll(TAG)) {
+    const a = attrsOf(m[0]);
+    if (!isSpeech(m[1].toLowerCase(), a)) continue;
+    const s = num(a['data-start']);
+    const d = num(a['data-duration']);
+    if (Number.isFinite(s) && Number.isFinite(d) && d > 0) spans.push([s, s + d]);
+  }
+  spans.sort((x, y) => x[0] - y[0]);
+  const out = [];
+  for (const [s, e] of spans) {
+    const last = out[out.length - 1];
+    if (last && s - last[1] < JOIN_GAP_SEC) last[1] = Math.max(last[1], e);
+    else out.push([s, e]);
+  }
+  return out;
+}
+
+const lin = (t, [a, b], [va, vb]) => (t <= a ? va : t >= b ? vb : va + ((t - a) / (b - a)) * (vb - va));
+
+function laneAt(points, t) {
+  if (!points?.length) return 1;
+  if (t <= points[0].t) return points[0].v;
+  for (let i = 1; i < points.length; i++) {
+    if (t <= points[i].t) return lin(t, [points[i - 1].t, points[i].t], [points[i - 1].v, points[i].v]);
+  }
+  return points[points.length - 1].v;
+}
+
+function duckAt(spans, t) {
+  let g = 1;
+  for (const [s, e] of spans) {
+    if (t < s - DUCK_RAMP_SEC || t > e + DUCK_RAMP_SEC * 2) continue;
+    const down = lin(t, [s - DUCK_RAMP_SEC, s], [1, DUCKED]);
+    const up = lin(t, [e, e + DUCK_RAMP_SEC * 2], [DUCKED, 1]);
+    g = Math.min(g, t < s ? down : t > e ? up : DUCKED);
+  }
+  return g;
+}
+
+/**
+ * Baja la música bajo la voz en un HTML. Devuelve el HTML (igual si no hay nada que hacer) y
+ * qué hizo: { ducked: [{ id, spans }], skipped: [{ id, reason }] }.
+ */
+export function autoDuck(html) {
+  const spans = speechSpans(html);
+  const report = { ducked: [], skipped: [] };
+  if (spans.length === 0) return { html, ...report };
+  const out = html.replace(TAG, (tag, kind) => {
+    const a = attrsOf(tag);
+    if (!isMusic(kind.toLowerCase(), a)) return tag;
+    const id = typeof a.id === 'string' ? a.id : '(music)';
+    const mode = a['data-duck'];
+    if (mode !== undefined && mode !== 'auto' && mode !== 'on') {
+      report.skipped.push({ id, reason: `data-duck="${mode}"` });
+      return tag;
+    }
+    let auto = { version: 1, lanes: [] };
+    if (typeof a['data-automation'] === 'string') {
+      try {
+        auto = JSON.parse(a['data-automation'].replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, '&'));
+      } catch {
+        report.skipped.push({ id, reason: 'its data-automation is not valid JSON' });
+        return tag;
+      }
+    }
+    const lanes = Array.isArray(auto.lanes) ? auto.lanes : [];
+    const vol = lanes.find((l) => l?.target === 'volume');
+    const own = Array.isArray(vol?.points) ? vol.points.filter((p) => Number.isFinite(p?.t) && Number.isFinite(p?.v)).sort((x, y) => x.t - y.t) : [];
+    if (own.length > 4) {
+      report.skipped.push({ id, reason: 'it already has its own volume curve' });
+      return tag;
+    }
+    const start = num(a['data-start'], 0);
+    const dur = num(a['data-duration']);
+    const end = Number.isFinite(dur) ? dur : Math.max(...spans.map(([, e]) => e - start)) + 1;
+    const local = spans.map(([s, e]) => [s - start, e - start]).filter(([s, e]) => e > 0 && s < end);
+    if (local.length === 0) return tag;
+    const keys = new Set([0, end, ...own.map((p) => p.t)]);
+    for (const [s, e] of local) for (const x of [s - DUCK_RAMP_SEC, s, e, e + DUCK_RAMP_SEC * 2]) keys.add(x);
+    const points = [...keys]
+      .filter((x) => x >= 0 && x <= end)
+      .sort((x, y) => x - y)
+      .map((t) => ({ t: Number(t.toFixed(4)), v: Number((laneAt(own, t) * duckAt(local, t)).toFixed(4)) }));
+    const next = { ...auto, version: auto.version ?? 1, lanes: [...lanes.filter((l) => l !== vol), { ...(vol ?? {}), target: 'volume', points }] };
+    report.ducked.push({ id, spans: local.length });
+    const json = JSON.stringify(next).replace(/'/g, '&#39;');
+    const without = tag.replace(/\sdata-automation\s*=\s*(?:"[^"]*"|'[^']*')/i, '');
+    return without.replace(/^<audio\b/i, `<audio data-automation='${json}'`);
+  });
+  return { html: out, ...report };
+}

package/src/engine.mjs

@@ -81,7 +81,7 @@ export function runEngineAsync(args, env, cwd, { onLine = () => {}, signal } = {
  * y, si hay sonido, la mezcla a `lufs` (−14 por defecto; `normalize: false` lo deja tal cual).
  */
 export async function renderProject(dir, output, { lufs = -14, normalize = true, engineArgs = [], quiet = false, onProgress, signal, browser, log = () => {} } = {}) {
-  const { build, snapped } = prepare(dir);
+  const { build, snapped, duck } = prepare(dir);
   const { env, ffmpeg, ffprobe } = await engineEnv(log);
   if (browser) env.HYPERFRAMES_BROWSER_PATH = browser;
   mkdirSync(dirname(output), { recursive: true });
@@ -109,5 +109,5 @@ export async function renderProject(dir, output, { lufs = -14, normalize = true,
     const r = normalizeLoudness(ffmpeg, raw, output, { lufs: Number(lufs ?? -14) });
     level = { before: r.before, after: loudness(ffmpeg, output) };
   } else cpSync(raw, output);
-  return { output, snapped, loudness: level };
+  return { output, snapped, duck, loudness: level };
 }

package/src/license.mjs

@@ -0,0 +1,126 @@
+// LICENCIA DE USO (2026-10-09, Fran: Ignix Editor solo para clientes de Ignix con plan activo).
+//
+// El asistente pide una licencia corta (72 h) a la herramienta del MCP de Ignix
+// `get_editor_license`, que solo la emite con el plan activo, y la guarda con
+// `ignix-editor license <token>`. Aquí solo se COMPRUEBA, sin red: la firma Ed25519 de
+// Ignix y la caducidad. Renovarla es volver a pedirla al MCP.
+//
+// Token: `<payloadB64url>.<firmaB64url>`. El payload es JSON UTF-8
+// {"v":1,"sub":"<hash opaco de la org>","iat":<s unix>,"exp":<s unix>} y la firma va sobre
+// los bytes EXACTOS del payload decodificado.
+//
+// Dónde: `IGNIX_EDITOR_LICENSE` (variable de entorno) manda sobre el fichero
+// ~/.ignix-editor/license (la misma carpeta base que los binarios, src/binaries.mjs).
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createPublicKey, verify } from 'node:crypto';
+import { join } from 'node:path';
+import { HOME } from './binaries.mjs';
+
+// Clave pública de Ignix (SPKI DER en base64). La privada vive solo en el servidor de Ignix.
+const PUBLIC_KEY_SPKI = 'MCowBQYDK2VwAyEAFwuR7qOsial9svJLSIIzeAKCy/y7gWr4MRSP8UKlAg4=';
+
+export const LICENSE_FILE = join(HOME, 'license');
+export const LICENSE_ENV = 'IGNIX_EDITOR_LICENSE';
+
+export const MSG_NEEDS_PLAN =
+  'Ignix Editor needs an active Ignix plan. Ask your assistant to get a license with the Ignix MCP tool get_editor_license and run: ignix-editor license <token>. Plans: https://ignix.social/pricing';
+export const MSG_INVALID = 'That license is not valid. Get a new one with the Ignix MCP tool get_editor_license.';
+
+const toKey = (k) => (typeof k === 'string' ? createPublicKey({ key: Buffer.from(k, 'base64'), format: 'der', type: 'spki' }) : k);
+
+// Solo para los tests: `node --test` pone NODE_TEST_CONTEXT en el proceso de cada fichero de
+// test (y lo heredan los procesos que lanza), y entonces IGNIX_EDITOR_LICENSE_PUBKEY_TEST
+// (SPKI DER en base64 de una clave generada en el propio test) sustituye a la de Ignix, para
+// poder probar la CLI con licencias firmadas allí. Fuera de `node --test` se ignora.
+function defaultKey() {
+  const testKey = process.env.NODE_TEST_CONTEXT && process.env.IGNIX_EDITOR_LICENSE_PUBKEY_TEST;
+  return toKey(testKey || PUBLIC_KEY_SPKI);
+}
+
+const B64URL = /^[A-Za-z0-9_-]+$/;
+
+/** Separa el token. null si no tiene la forma `<payload>.<firma>` con un payload JSON. */
+export function parseToken(token) {
+  const parts = String(token ?? '').trim().split('.');
+  if (parts.length !== 2 || !parts.every((p) => B64URL.test(p))) return null;
+  const payloadBytes = Buffer.from(parts[0], 'base64url');
+  const sig = Buffer.from(parts[1], 'base64url');
+  let claims;
+  try {
+    claims = JSON.parse(payloadBytes.toString('utf8'));
+  } catch {
+    return null;
+  }
+  if (!claims || typeof claims !== 'object' || Array.isArray(claims)) return null;
+  return { payloadBytes, sig, claims };
+}
+
+/**
+ * ¿Vale la licencia? `now` en milisegundos (Date.now()); `publicKey` = KeyObject o SPKI DER en
+ * base64 (por defecto, la de Ignix). → {ok:true, exp} o {ok:false, reason}.
+ */
+export function verifyToken(token, now = Date.now(), publicKey = defaultKey()) {
+  if (!token || !String(token).trim()) return { ok: false, reason: 'missing' };
+  const parsed = parseToken(token);
+  if (!parsed) return { ok: false, reason: 'malformed' };
+  let signed = false;
+  try {
+    signed = verify(null, parsed.payloadBytes, toKey(publicKey), parsed.sig);
+  } catch {
+    signed = false;
+  }
+  if (!signed) return { ok: false, reason: 'bad_signature' };
+  const { v, exp } = parsed.claims;
+  if (v !== 1) return { ok: false, reason: 'unsupported' };
+  if (!Number.isFinite(exp)) return { ok: false, reason: 'malformed' };
+  if (exp * 1000 <= now) return { ok: false, reason: 'expired', exp };
+  return { ok: true, exp };
+}
+
+/** La licencia guardada: primero la variable de entorno, después el fichero. */
+export function readLicense() {
+  const fromEnv = process.env[LICENSE_ENV];
+  if (fromEnv && fromEnv.trim()) return { token: fromEnv.trim(), source: 'env' };
+  if (existsSync(LICENSE_FILE)) {
+    const token = readFileSync(LICENSE_FILE, 'utf8').trim();
+    if (token) return { token, source: 'file' };
+  }
+  return { token: null, source: null };
+}
+
+/** Estado de la licencia guardada, con su origen ('env' | 'file' | null). */
+export function licenseStatus(now = Date.now()) {
+  const { token, source } = readLicense();
+  return { ...verifyToken(token, now), source };
+}
+
+/** El texto para la persona/el agente según el motivo del rechazo. */
+export function licenseMessage(reason) {
+  return reason === 'malformed' || reason === 'bad_signature' ? MSG_INVALID : MSG_NEEDS_PLAN;
+}
+
+/** Comprueba y guarda la licencia (solo legible por el usuario). Lanza si no vale. */
+export function saveLicense(token, now = Date.now()) {
+  const clean = String(token ?? '').trim();
+  const r = verifyToken(clean, now);
+  if (!r.ok) {
+    const e = new Error(licenseMessage(r.reason));
+    e.code = 'license';
+    e.reason = r.reason;
+    throw e;
+  }
+  mkdirSync(HOME, { recursive: true });
+  writeFileSync(LICENSE_FILE, `${clean}\n`, { mode: 0o600 });
+  chmodSync(LICENSE_FILE, 0o600); // `mode` solo cuenta al crear: si ya existía, se ajusta aquí
+  return r;
+}
+
+/** Corta con un error claro si no hay una licencia válida. Devuelve {ok, exp, source}. */
+export function requireLicense(now = Date.now()) {
+  const st = licenseStatus(now);
+  if (st.ok) return st;
+  const e = new Error(licenseMessage(st.reason));
+  e.code = 'license';
+  e.reason = st.reason;
+  throw e;
+}

package/src/prepare.mjs

@@ -7,6 +7,7 @@ import './win-fs-preload.mjs'; // Windows: fs.cpSync con rutas no ASCII (win-fs.
 import { copyFileSync, cpSync, existsSync, linkSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { autoDuck } from './duck.mjs';
 
 const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), 'runtime', 'ignix-frame.js');
 const SKIP = new Set(['.ignix-build', 'renders', 'snapshots', 'node_modules', '.git', '.DS_Store']);
@@ -88,6 +89,9 @@ export function prepare(projectDir) {
   if ((/IgnixFrame/.test(rootHtml) || /ignix-frame\.js/.test(rootHtml)) && !/window\.__timelines\s*(=|\[|\.|\?\?=)/.test(rootHtml)) {
     writeFileSync(root, rootHtml.replace(/<\/body>/i, '<script>window.__timelines = window.__timelines || {};</script>\n</body>'));
   }
+  // La música baja sola bajo la voz (duck.mjs), con los tiempos ya ajustados al fotograma.
+  const duck = autoDuck(readFileSync(root, 'utf8'));
+  if (duck.ducked.length) writeFileSync(root, duck.html);
   cpSync(RUNTIME, join(build, 'ignix-frame.js'));
-  return { build, fps, snapped };
+  return { build, fps, snapped, duck: { ducked: duck.ducked, skipped: duck.skipped } };
 }