@ignix-social/editor 0.1.27 → 0.1.29

package/NOTICE

@@ -97,3 +97,5 @@ Inter (font, from @fontsource/inter) — SIL Open Font License 1.1, Copyright (c
 
 Ignix Creator's composition templates (src/creator) were ported from Ignix Creator's own
   code (Copyright (c) 2026 Ignix); no Remotion code is included.
+
+Reference downloads use official standalone yt-dlp release binaries (https://github.com/yt-dlp/yt-dlp), downloaded separately and checked against release SHA-256 checksums. yt-dlp source is Unlicense; standalone executables include third-party dependencies with their own license notices, available with the official release/source distribution. These executables are not included in this npm package.

package/README.md

@@ -2,17 +2,20 @@
 
 Render videos from HTML on your own computer: reels made from scratch, edits of your recorded videos and clips from long ones. It is the video engine behind Ignix's reel and edit playbooks for AI assistants (Claude, ChatGPT) and behind Ignix Creator.
 
+Ignix Editor is for Ignix customers: it needs an active [Ignix plan](https://ignix.social/pricing). Your AI assistant gets a short-lived license (72 h) from the Ignix MCP tool `get_editor_license` and saves it with `ignix-editor license <token>`; the license is checked on your machine, offline.
+
 ```sh
-npx @ignix-social/editor doctor        # checks Node 22+, ffmpeg, whisper and the H.264 encoder
+npx @ignix-social/editor license <token> # saves the license from the Ignix MCP
+npx @ignix-social/editor doctor        # checks Node 22+, ffmpeg, whisper, yt-dlp and the H.264 encoder
 npx @ignix-social/editor init my-reel  # creates ~/ignix-videos/my-reel
 npx @ignix-social/editor render ~/ignix-videos/my-reel
 ```
 
-Commands: `doctor`, `init`, `check`, `snapshot`, `render`, `preview`, `transcribe`, `faces`, `ffmpeg`, `ffprobe`, `skills add`, `fetch`, `serve`, `creator-job`, `help`.
+Commands: `license`, `doctor`, `init`, `check`, `snapshot`, `render`, `preview`, `download`, `transcribe`, `faces`, `ffmpeg`, `ffprobe`, `skills add`, `fetch`, `serve`, `creator-job`, `help`.
 
 - Everything runs locally; your footage never leaves your machine.
 - ffmpeg (GPL build, without libx264) and whisper.cpp are downloaded once per machine into `~/.ignix-editor`, checked against their SHA-256. Chrome for rendering is downloaded once from Google's official channel.
-- No telemetry and no automatic updates: the version you install is the version that runs.
+- No telemetry and no automatic updates: the version you install is the version that runs. At most once a day it asks ignix.social which version is recommended (a plain request, nothing about you or your projects is sent) and, if yours is older, prints the command to update; it never updates by itself. Turn the check off with `IGNIX_EDITOR_NO_UPDATE_CHECK=1`.
 - The final audio is normalised to −14 LUFS.
 - Analysis (`faces`, and `serve`, the local service Ignix Creator talks to: shots, people, faces, burned-in text, voice clean-up, transcription) runs on ONNX Runtime with open models (YOLOX, YuNet, PP-OCR, CLIP), downloaded the first time they are needed and checked against their SHA-256.
 - `ignix-editor skills add` installs the `ignix-editor` skill for Claude.
@@ -22,3 +25,5 @@ Requires Node.js 22 or newer. Runs on macOS (Intel and Apple Silicon) and Window
 ## License
 
 Apache-2.0. Ignix Editor is based on [HyperFrames](https://github.com/heygen-com/hyperframes) by HeyGen, Inc. (Apache-2.0), included in `vendor/hyperframes` with the modifications listed in `patches/`. See `NOTICE`. Ignix Editor is not affiliated with or endorsed by HeyGen.
+
+Public references: `ignix-editor download <URL> -o work/ref.mp4` uses a pinned, SHA-256-checked official yt-dlp binary and bundled FFmpeg/Node, without browser cookies or user downloader configuration. Reuse the transcript supplied by Ignix; run local Whisper if it is absent or needs checking. Inspect frames for visual structure and names. Downloaded source footage is study material, not a render asset.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ignix-social/editor",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Ignix Editor: render HTML video compositions (reels, edits, clips) on your own computer. Based on HyperFrames.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/ignix-editor/SKILL.md

@@ -7,11 +7,15 @@ description: Build and render videos with Ignix Editor (HTML + GSAP compositions
 
 Ignix Editor turns an HTML page into an MP4. You write `index.html` (layout in HTML/CSS, motion in JS), the editor renders it frame by frame in a headless browser and encodes it with ffmpeg. The Ignix playbooks say WHAT to make; this skill says HOW to write it so that what you write is what renders.
 
+**License first.** Ignix Editor needs an active Ignix plan. Before the first command of a session, call the Ignix MCP tool `get_editor_license` and run `ignix-editor license <token>` with what it returns. It lasts 72 h; when a command says the license is missing or expired, renew it the same way. If the Ignix MCP says the plan is not active (or `get_editor_license` refuses), STOP: do not render or keep working with Ignix Editor and do not look for workarounds. Tell the user their Ignix plan is not active and that they can reactivate it at https://ignix.social/app/billing.
+
 Commands. `ignix-editor` means the copy the Ignix playbook installed: `~/.ignix-editor/cli/node_modules/.bin/ignix-editor` (Windows PowerShell: `& "$env:USERPROFILE\.ignix-editor\cli\node_modules\.bin\ignix-editor.cmd"`; PowerShell blocks `.ps1` scripts by default, so use the `.cmd` and `npm.cmd`, and `$env:USERPROFILE` instead of `~`). Do not use `npx`: it may fetch another version.
 
 | Command | What it does |
 |---|---|
-| `ignix-editor doctor` | Node 22+ and the H.264 encoder; downloads its own ffmpeg and whisper the first time. Run it first. |
+| `ignix-editor license <token>` | Saves the license from the Ignix MCP (`get_editor_license`). Without a token, shows whether there is a valid one and until when. |
+| `ignix-editor download <URL> -o work/ref.mp4` | Downloads a public Instagram, TikTok or YouTube reference with bundled yt-dlp, FFmpeg and Node. No cookies. Keep it in `work/`, never `assets/`. Reuse the transcript supplied by Ignix; use local Whisper if absent. If downloading fails, use that saved speech transcript and disclose that visuals are unverified. |
+| `ignix-editor doctor` | Node 22+ and the H.264 encoder; downloads its own ffmpeg, whisper and yt-dlp the first time. Run it first. |
 | `ignix-editor init <name>` | Creates `~/ignix-videos/<name>` with a working skeleton, GSAP, local fonts and `ignix-frame.js`. |
 | `ignix-editor transcribe <file> --lang es [--script "…"] -o words.json` | Words with start/end seconds, plus `pauses` ([start, end] of every silence ≥0.35 s, for cutting silences), on this machine. Over 2 min it prints whisper's progress; without a GPU it takes about as long as the audio. |
 | `ignix-editor faces <video> -o work/faces.json` | Where the face is over time (macOS and Windows; the first run downloads the face detector): a smoothed path `{t, cx, cy, size}` (0–1, top-left origin) to frame the person. |
@@ -44,13 +48,13 @@ The engine reads `<video>`/`<audio>` from the HTML file before the page runs. Me
 ```html
 <video id="cut1" src="assets/take.mp4" muted playsinline data-start="0" data-duration="2.9667" data-media-start="0.1" data-track-index="0"></video>
 <audio id="vo1" src="assets/vo/l1.wav" data-start="0" data-duration="3.64" data-track-index="10" data-volume="1"></audio>
-<audio id="sfx3" src="assets/sfx/click.mp3" data-start="4.88" data-duration="0.4" data-track-index="23" data-volume="0.45"></audio>
+<audio id="sfx3" src="assets/sfx/click.mp3" data-start="4.88" data-duration="0.4" data-track-index="23" data-volume="0.8"></audio>
 ```
 
 - `data-start` = when it appears in the video; `data-duration` = how long; `data-media-start` = where in the source file it starts (trim in). One `<video>` per kept piece of a recording; the same source file can be used many times.
 - Every `<video>`/`<audio>` has a unique `id`. An `<audio>` without id is silently dropped from the mix.
 - Footage you show without its sound: `muted`. A video whose own sound you keep: `data-has-audio="true"` and no `muted`.
-- Give each sound effect its own `data-track-index` (overlapping sounds on one track get a warning).
+- Give each sound effect its own `data-track-index` (overlapping sounds on one track get a warning). Effects must be heard: `data-volume` 0.7–1 for the Ignix library effects (already level-matched); below 0.6 a short click or pop disappears under the voice and the music. Never louder than the voice.
 - Never put `data-start` on BOTH a video and an element that contains it: time the video, and put a plain (untimed) wrapper around it for zoom/crop/position.
 - Never add `crossorigin` to media. Never call `play()`, `pause()` or set `currentTime`: the engine owns playback.
 - Music ducks BY ITSELF under the voice at check/render: give the music `<audio>` the id `music` (or `data-role="music"`) and set its `data-volume` to its level when nobody talks; it drops about 13 dB under every voice line (`vo1`, `voice2`… or `data-role="voice"`) and under any `<video>` that keeps its own sound, and comes back up in pauses longer than 0.6 s. Do not draw that by hand. `data-duck="off"` on the music keeps it flat.
@@ -270,6 +274,10 @@ run({ id, duration, fps }, (t) => O.draw(t));
 - Captions: groups of 2–3 words that never cross the end of a line; current word in the brand accent; font size shrinks for long groups so they fit the ~820 px column. Keep a real gap between words (`gap: 0 0.3em` on the flex row): if the active word grows (`scale`), it eats a smaller gap and «EDITORES DE» reads «EDITORESDE» — grow it at most ~5 %, or only change its colour.
 - The final mix is normalised to −14 LUFS by `render` (`--lufs` to change, `--no-normalize` to skip).
 
+### A reel modelled on a reference
+
+When the user brings a reel they want theirs to look like, study it; never use it. Download it first with `ignix-editor download <URL> -o work/ref.mp4`. Read `inspiredBy.transcript` from the Ignix playbook when supplied: the app already obtained it, so the agent never calls APISmith. Reuse that speech evidence; local Whisper is for missing transcripts or recognition errors. If downloading fails, you can still adapt the saved speech argument, but say that visuals are unverified and keep the visual mapping provisional. If neither video nor transcript is available, ask for the file before proposing a script. Verify named recommendations against frames when available and preserve each reason; do not replace a comparison followed by specific recommendations with generic categories. Show the original preview or representative frames, then its sequence and the adaptation mapping before the script. Keep it in `work/` (never `assets/`), tile its frames (`ignix-editor ffmpeg -i work/ref.mp4 -vf "fps=2,scale=240:-1,tile=6x4" work/ref-%02d.jpg`) and transcribe it to read its layout, its beats and their timing, and the moments that carry it. Then rebuild that structure with your own pieces: the layout in CSS (e.g. a split screen with graphics in the top third, the presenter's video below and short captions on the seam), each beat's visual drawn for this brand, the key moment recreated with what you have (a gesture clip, cards fanning out, a reveal). None of it reaches the render: not its footage, music, words or branding. In the review, compare your stills with its contact sheet beat by beat.
+
 ## 5. Generate the HTML from data
 
 When there are many clips, lines or cues, keep them in data and let a script write the media tags and the timing file:

package/src/binaries.json

@@ -20,6 +20,13 @@
         "size": 2912480,
         "sha256": "73fc58436c1e1a9d2cc3ea08bddf18bf78270d8c6940c5fd89a3c9cb31535efe",
         "build": "whisper.cpp v1.7.6, scripts/build-whisper-macos.sh"
+      },
+      "ytdlp": {
+        "file": "yt-dlp_macos",
+        "size": 37146048,
+        "sha256": "0f192b7ec147ab6288885d6351d9ab67367640029b4377576ef46dd79cf7b202",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_macos",
+        "build": "yt-dlp 2026.08.19 official standalone; SHA2-256SUMS verified"
       }
     },
     "darwin-arm64": {
@@ -40,6 +47,13 @@
         "size": 2573144,
         "sha256": "215d93a2edc77f8929311f127f368727859e13833e925652315ca5ea774595ee",
         "build": "whisper.cpp v1.7.6, CI binaries.yml (macos-15, run 37375441240)"
+      },
+      "ytdlp": {
+        "file": "yt-dlp_macos",
+        "size": 37146048,
+        "sha256": "0f192b7ec147ab6288885d6351d9ab67367640029b4377576ef46dd79cf7b202",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_macos",
+        "build": "yt-dlp 2026.08.19 official standalone; SHA2-256SUMS verified"
       }
     },
     "win32-x64": {
@@ -59,7 +73,32 @@
         "file": "whisper-cli.exe",
         "size": 1990144,
         "sha256": "26cef7a9b82544e4076a4977c93635bb1b324bd5ab3b4301d6d06e8224e580ea",
-        "build": "whisper.cpp v1.7.6, MSVC estático sin OpenMP, CI windows.yml (run 37392626795)"
+        "build": "whisper.cpp v1.7.6, MSVC est\u00e1tico sin OpenMP, CI windows.yml (run 37392626795)"
+      },
+      "ytdlp": {
+        "file": "yt-dlp.exe",
+        "size": 17840399,
+        "sha256": "66674953fe251b89f4d08c5f0e35e0728679bd67ab3d7d05c0562af101dd3e7a",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp.exe",
+        "build": "yt-dlp 2026.08.19 official standalone; SHA2-256SUMS verified"
+      }
+    },
+    "linux-x64": {
+      "ytdlp": {
+        "file": "yt-dlp_linux",
+        "size": 40446224,
+        "sha256": "58162f9bfdc27458ea47bfcb311cf47028f17d8154a8bf7d689861d46399230a",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_linux",
+        "build": "yt-dlp 2026.08.19 official standalone; SHA2-256SUMS verified"
+      }
+    },
+    "linux-arm64": {
+      "ytdlp": {
+        "file": "yt-dlp_linux_aarch64",
+        "size": 40167448,
+        "sha256": "b16e4dab368a816cd05d477d698a605a6ae87ccee1c8ffd38fa21d7254141fcc",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_linux_aarch64",
+        "build": "yt-dlp 2026.08.19 official standalone; SHA2-256SUMS verified"
       }
     }
   },

package/src/binaries.mjs

@@ -17,6 +17,7 @@ const EXE = process.platform === 'win32' ? '.exe' : '';
 const manifest = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'binaries.json'), 'utf8'));
 
 export const TOOLS = {
+  ytdlp: { env: 'IGNIX_EDITOR_YTDLP', file: `yt-dlp${EXE}` },
   ffmpeg: { env: 'IGNIX_EDITOR_FFMPEG', file: `ffmpeg${EXE}` },
   ffprobe: { env: 'IGNIX_EDITOR_FFPROBE', file: `ffprobe${EXE}` },
   whisper: { env: 'IGNIX_EDITOR_WHISPER', file: `whisper-cli${EXE}` },
@@ -44,7 +45,7 @@ export async function ensureTool(name, log = () => {}) {
   if (!entry) {
     throw new Error(`${name} is not available for ${PLATFORM} yet. Meanwhile, point ${TOOLS[name].env} to a local ${TOOLS[name].file}.`);
   }
-  const url = `${manifest.baseUrl}/${manifest.version}/${PLATFORM}/${entry.file}`;
+  const url = entry.url ?? `${manifest.baseUrl}/${manifest.version}/${PLATFORM}/${entry.file}`;
   log(`Downloading ${name} (${(entry.size / 1e6).toFixed(0)} MB)…`);
   const res = await fetch(url);
   if (!res.ok) throw new Error(`Could not download ${name}: ${res.status} ${url}`);

package/src/cli.mjs

@@ -1,3 +1,4 @@
+import { downloadReference } from './reference-download.mjs';
 // ignix-editor — CLI de Ignix Editor. El motor (HyperFrames, en vendor/) corre siempre por
 // debajo con nuestro entorno: sin telemetría, sin actualizaciones solas, con nuestros binarios.
 // Los mensajes van en inglés, como el manual y la skill: los lee sobre todo el agente.
@@ -23,6 +24,7 @@ import { reviewVideo } from './analysis/review.mjs';
 import { pickAudio } from './pick-audio.mjs';
 import { importGiphy, openGiphySearch } from './giphy.mjs';
 import { warnIfOutdated } from './update-check.mjs';
+import { LICENSE_ENV, LICENSE_FILE, licenseMessage, licenseStatus, requireLicense, saveLicense } from './license.mjs';
 
 const PKG_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
 const PKG = JSON.parse(readFileSync(join(PKG_DIR, 'package.json'), 'utf8'));
@@ -214,6 +216,14 @@ const commands = {
     process.exit(runEngine(['preview', build, ...rest], env, dir));
   },
 
+  async download(argv) {
+    const { pos, opts } = parseArgs(argv, { output: 'str' });
+    if (pos.length !== 1 || !opts.output) fail('Usage: ignix-editor download <Instagram|TikTok|YouTube URL> -o work/ref.mp4');
+    const ytdlp = await ensureTool('ytdlp', log);
+    const ffmpeg = await ensureTool('ffmpeg', log);
+    console.log(downloadReference({ url: pos[0], output: opts.output, ytdlp, ffmpeg }));
+  },
+
   async transcribe(argv) {
     const { pos, opts } = parseArgs(argv, { lang: 'str', model: 'str', script: 'str', output: 'str', threads: 'str' });
     const input = pos[0] && resolve(pos[0]);
@@ -433,6 +443,27 @@ const commands = {
     }
   },
 
+  // Licencia de Ignix (src/license.mjs). Con token: la comprueba y la guarda. Sin nada: dice
+  // si hay una válida y hasta cuándo (código 1 si no la hay, para que el agente lo vea).
+  async license(argv) {
+    const { pos } = parseArgs(argv, {});
+    const when = (exp) => new Date(exp * 1000).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' });
+    if (pos[0]) {
+      const r = saveLicense(pos[0]);
+      console.log(`✓ License valid until ${when(r.exp)}`);
+      if (process.env[LICENSE_ENV]) log(`• ${LICENSE_ENV} is set in this environment and takes precedence over the saved license.`);
+      return;
+    }
+    const st = licenseStatus();
+    if (st.ok) {
+      console.log(`✓ License valid until ${when(st.exp)} (${st.source === 'env' ? LICENSE_ENV : LICENSE_FILE})`);
+      return;
+    }
+    if (st.reason === 'expired') log(`✗ The license expired on ${when(st.exp)}.`);
+    log(`✗ ${licenseMessage(st.reason)}`);
+    process.exitCode = 1;
+  },
+
   async version() {
     console.log(`ignix-editor ${PKG.version} (engine ${UPSTREAM.version})`);
   },
@@ -440,13 +471,14 @@ const commands = {
   async help() {
     console.log(`Ignix Editor ${PKG.version} — video from HTML, rendered on your own computer.
 
-  ignix-editor doctor                          checks Node and the encoder, downloads ffmpeg and whisper if missing
+  ignix-editor doctor                          checks Node and the encoder, downloads ffmpeg, whisper and yt-dlp if missing
   ignix-editor init <name>                     creates ~/ignix-videos/<name>, ready to work in
   ignix-editor check [folder]                  HTML, assets, layout, motion and contrast
   ignix-editor snapshot [folder] --at 0,2.5,5  single frames to look at (into <folder>/snapshots)
   ignix-editor render [folder] [-o out.mp4] [--lufs -14] [--no-normalize] [--no-review]
   ignix-editor review <video.mp4> [--json]     is it ready to show? stillness, empty frame, voice gaps, cuts
   ignix-editor preview [folder]                live preview in the browser
+  ignix-editor download <URL> -o work/ref.mp4   downloads a public reference with yt-dlp (no cookies)
   ignix-editor transcribe <file> [--lang es] [--script "text"] [-o words.json]
   ignix-editor faces <video> [--every 0.2] [-o faces.json]   where the face is, smoothed
   ignix-editor pick-audio [folder] --kind music|sfx --query "inspiring" [--order trending]
@@ -457,10 +489,12 @@ const commands = {
   ignix-editor style measure <video>… [--speech] [--stills dir] [-o style.json]   someone's editing style, measured on 2–3 of their videos
   ignix-editor ffmpeg|ffprobe <args>           Ignix Editor's own ffmpeg
   ignix-editor skills add                      installs the skill for Claude
+  ignix-editor license [<token>]               saves the license from the Ignix MCP (get_editor_license), or shows it
   ignix-editor fetch [--whisper small] [--no-analysis]   downloads everything up front (each file SHA-256-checked)
   ignix-editor serve                           local service for Ignix Creator (JSON lines on stdin/stdout)
 
-The folder defaults to the current one. Open source (Apache-2.0); credits in NOTICE.`);
+The folder defaults to the current one. Requires an active Ignix plan (license from the Ignix MCP).
+Open source (Apache-2.0); credits in NOTICE.`);
   },
 };
 
@@ -470,10 +504,25 @@ function printReview(rv, out = log) {
   if (rv.ready && rv.issues.length) out('  (! = worth fixing if it is quick.)');
 }
 
+// Comandos que funcionan SIN licencia de Ignix; todos los demás (y los que se añadan) la piden.
+// - help, version, license, skills add: para ponerse en marcha y pedir/guardar la licencia.
+// - doctor, fetch: solo comprueban la máquina y descargan binarios/modelos una vez.
+// - serve, creator-job: los usa Ignix Creator, que lleva este paquete dentro y comprueba el
+//   plan él mismo (ADR-0023); aquí no se piden para no romper sus renders ni su análisis.
+const NO_LICENSE = new Set(['help', 'version', 'license', 'skills', 'doctor', 'fetch', 'serve', 'creator-job']);
+
 export async function main(argv) {
   const [cmd = 'help', ...rest] = argv;
-  const fn = commands[cmd === '--version' || cmd === '-v' ? 'version' : cmd === '--help' || cmd === '-h' ? 'help' : cmd];
+  const name = cmd === '--version' || cmd === '-v' ? 'version' : cmd === '--help' || cmd === '-h' ? 'help' : cmd;
+  const fn = Object.hasOwn(commands, name) ? commands[name] : null;
   if (!fn) fail(`Unknown command: ${cmd}. See: ignix-editor help`);
+  if (!NO_LICENSE.has(name)) {
+    try {
+      requireLicense();
+    } catch (e) {
+      fail(e.message);
+    }
+  }
   // Aviso de versión nueva (src/update-check.mjs): no en `help`/`--version`, que el
   // agente usa justo para comprobar qué tiene.
   if (!['help', 'version', '--version', '-v', '--help', '-h'].includes(cmd)) {

package/src/fetch.mjs

@@ -11,7 +11,7 @@ export async function fetchAll({ whisper = 'small', analysis = true, json = fals
   const emit = (e) => json && process.stdout.write(`${JSON.stringify(e)}\n`);
   if (!WHISPER_MODELS[whisper]) throw Object.assign(new Error(`Unknown model: ${whisper}`), { code: 'invalid_args' });
   const todo = [];
-  for (const name of ['ffmpeg', 'ffprobe', 'whisper']) {
+  for (const name of ['ffmpeg', 'ffprobe', 'whisper', 'ytdlp']) {
     if (!findTool(name).path) todo.push({ item: name, size: toolSize(name), run: () => ensureTool(name, log) });
   }
   if (!existsSync(whisperModelPath(whisper))) todo.push({ item: `whisper-${whisper}`, size: WHISPER_MODELS[whisper].size, run: () => ensureWhisperModel(whisper, log) });

package/src/license.mjs

@@ -0,0 +1,126 @@
+// LICENCIA DE USO (2026-10-09, Fran: Ignix Editor solo para clientes de Ignix con plan activo).
+//
+// El asistente pide una licencia corta (72 h) a la herramienta del MCP de Ignix
+// `get_editor_license`, que solo la emite con el plan activo, y la guarda con
+// `ignix-editor license <token>`. Aquí solo se COMPRUEBA, sin red: la firma Ed25519 de
+// Ignix y la caducidad. Renovarla es volver a pedirla al MCP.
+//
+// Token: `<payloadB64url>.<firmaB64url>`. El payload es JSON UTF-8
+// {"v":1,"sub":"<hash opaco de la org>","iat":<s unix>,"exp":<s unix>} y la firma va sobre
+// los bytes EXACTOS del payload decodificado.
+//
+// Dónde: `IGNIX_EDITOR_LICENSE` (variable de entorno) manda sobre el fichero
+// ~/.ignix-editor/license (la misma carpeta base que los binarios, src/binaries.mjs).
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createPublicKey, verify } from 'node:crypto';
+import { join } from 'node:path';
+import { HOME } from './binaries.mjs';
+
+// Clave pública de Ignix (SPKI DER en base64). La privada vive solo en el servidor de Ignix.
+const PUBLIC_KEY_SPKI = 'MCowBQYDK2VwAyEAFwuR7qOsial9svJLSIIzeAKCy/y7gWr4MRSP8UKlAg4=';
+
+export const LICENSE_FILE = join(HOME, 'license');
+export const LICENSE_ENV = 'IGNIX_EDITOR_LICENSE';
+
+export const MSG_NEEDS_PLAN =
+  'Ignix Editor needs an active Ignix plan. Ask your assistant to get a license with the Ignix MCP tool get_editor_license and run: ignix-editor license <token>. Plans: https://ignix.social/pricing';
+export const MSG_INVALID = 'That license is not valid. Get a new one with the Ignix MCP tool get_editor_license.';
+
+const toKey = (k) => (typeof k === 'string' ? createPublicKey({ key: Buffer.from(k, 'base64'), format: 'der', type: 'spki' }) : k);
+
+// Solo para los tests: `node --test` pone NODE_TEST_CONTEXT en el proceso de cada fichero de
+// test (y lo heredan los procesos que lanza), y entonces IGNIX_EDITOR_LICENSE_PUBKEY_TEST
+// (SPKI DER en base64 de una clave generada en el propio test) sustituye a la de Ignix, para
+// poder probar la CLI con licencias firmadas allí. Fuera de `node --test` se ignora.
+function defaultKey() {
+  const testKey = process.env.NODE_TEST_CONTEXT && process.env.IGNIX_EDITOR_LICENSE_PUBKEY_TEST;
+  return toKey(testKey || PUBLIC_KEY_SPKI);
+}
+
+const B64URL = /^[A-Za-z0-9_-]+$/;
+
+/** Separa el token. null si no tiene la forma `<payload>.<firma>` con un payload JSON. */
+export function parseToken(token) {
+  const parts = String(token ?? '').trim().split('.');
+  if (parts.length !== 2 || !parts.every((p) => B64URL.test(p))) return null;
+  const payloadBytes = Buffer.from(parts[0], 'base64url');
+  const sig = Buffer.from(parts[1], 'base64url');
+  let claims;
+  try {
+    claims = JSON.parse(payloadBytes.toString('utf8'));
+  } catch {
+    return null;
+  }
+  if (!claims || typeof claims !== 'object' || Array.isArray(claims)) return null;
+  return { payloadBytes, sig, claims };
+}
+
+/**
+ * ¿Vale la licencia? `now` en milisegundos (Date.now()); `publicKey` = KeyObject o SPKI DER en
+ * base64 (por defecto, la de Ignix). → {ok:true, exp} o {ok:false, reason}.
+ */
+export function verifyToken(token, now = Date.now(), publicKey = defaultKey()) {
+  if (!token || !String(token).trim()) return { ok: false, reason: 'missing' };
+  const parsed = parseToken(token);
+  if (!parsed) return { ok: false, reason: 'malformed' };
+  let signed = false;
+  try {
+    signed = verify(null, parsed.payloadBytes, toKey(publicKey), parsed.sig);
+  } catch {
+    signed = false;
+  }
+  if (!signed) return { ok: false, reason: 'bad_signature' };
+  const { v, exp } = parsed.claims;
+  if (v !== 1) return { ok: false, reason: 'unsupported' };
+  if (!Number.isFinite(exp)) return { ok: false, reason: 'malformed' };
+  if (exp * 1000 <= now) return { ok: false, reason: 'expired', exp };
+  return { ok: true, exp };
+}
+
+/** La licencia guardada: primero la variable de entorno, después el fichero. */
+export function readLicense() {
+  const fromEnv = process.env[LICENSE_ENV];
+  if (fromEnv && fromEnv.trim()) return { token: fromEnv.trim(), source: 'env' };
+  if (existsSync(LICENSE_FILE)) {
+    const token = readFileSync(LICENSE_FILE, 'utf8').trim();
+    if (token) return { token, source: 'file' };
+  }
+  return { token: null, source: null };
+}
+
+/** Estado de la licencia guardada, con su origen ('env' | 'file' | null). */
+export function licenseStatus(now = Date.now()) {
+  const { token, source } = readLicense();
+  return { ...verifyToken(token, now), source };
+}
+
+/** El texto para la persona/el agente según el motivo del rechazo. */
+export function licenseMessage(reason) {
+  return reason === 'malformed' || reason === 'bad_signature' ? MSG_INVALID : MSG_NEEDS_PLAN;
+}
+
+/** Comprueba y guarda la licencia (solo legible por el usuario). Lanza si no vale. */
+export function saveLicense(token, now = Date.now()) {
+  const clean = String(token ?? '').trim();
+  const r = verifyToken(clean, now);
+  if (!r.ok) {
+    const e = new Error(licenseMessage(r.reason));
+    e.code = 'license';
+    e.reason = r.reason;
+    throw e;
+  }
+  mkdirSync(HOME, { recursive: true });
+  writeFileSync(LICENSE_FILE, `${clean}\n`, { mode: 0o600 });
+  chmodSync(LICENSE_FILE, 0o600); // `mode` solo cuenta al crear: si ya existía, se ajusta aquí
+  return r;
+}
+
+/** Corta con un error claro si no hay una licencia válida. Devuelve {ok, exp, source}. */
+export function requireLicense(now = Date.now()) {
+  const st = licenseStatus(now);
+  if (st.ok) return st;
+  const e = new Error(licenseMessage(st.reason));
+  e.code = 'license';
+  e.reason = st.reason;
+  throw e;
+}

package/src/reference-download.mjs

@@ -0,0 +1,42 @@
+// Reference study only: these files belong in work/, never in render assets.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+
+export function referenceUrl(raw) {
+  let u;
+  try { u = new URL(raw); } catch { throw new Error('Expected an Instagram, TikTok or YouTube video URL.'); }
+  const host = u.hostname.toLowerCase();
+  const allowed = ['instagram.com', 'www.instagram.com', 'youtube.com', 'www.youtube.com', 'm.youtube.com', 'youtu.be', 'tiktok.com', 'www.tiktok.com', 'vm.tiktok.com', 'vt.tiktok.com'];
+  if (u.protocol !== 'https:' || !allowed.includes(host) || u.username || u.password || u.port) throw new Error('Expected an HTTPS Instagram, TikTok or YouTube video URL.');
+  return u.href;
+}
+
+export function downloadArgs({ url, output, ffmpeg, node = process.execPath }) {
+  return [
+    '--ignore-config', '--no-simulate', '--no-cache-dir', '--no-playlist', '--no-overwrites',
+    '--socket-timeout', '20', '--retries', '1', '--fragment-retries', '1',
+    '--max-filesize', '500M', '--match-filter', 'duration <=? 1800',
+    '--js-runtimes', `node:${node}`, '--ffmpeg-location', dirname(ffmpeg),
+    '--format', 'bv[height<=720][ext=mp4][vcodec^=avc1]+ba[ext=m4a]/b[height<=?720][ext=mp4]/b[height<=?720]',
+    '--merge-output-format', 'mp4', '--remux-video', 'mp4',
+    '--print', 'after_move:filepath', '--output', output.replace(/\.mp4$/i, '') + '.%(ext)s',
+    '--', referenceUrl(url),
+  ];
+}
+
+export function downloadReference({ url, output, ytdlp, ffmpeg, run = spawnSync }) {
+  const dest = resolve(output);
+  if (!/\.mp4$/i.test(dest)) throw new Error('Reference output must end in .mp4.');
+  referenceUrl(url);
+  if (existsSync(dest)) return dest;
+  mkdirSync(dirname(dest), { recursive: true });
+  const r = run(ytdlp, downloadArgs({ url, output: dest, ffmpeg }), {
+    encoding: 'utf8', timeout: 600_000, maxBuffer: 4 * 1024 * 1024,
+    env: { ...process.env, PATH: `${dirname(ffmpeg)}${process.platform === 'win32' ? ';' : ':'}${process.env.PATH ?? ''}` },
+  });
+  if (r.error || r.status !== 0 || !existsSync(dest)) {
+    throw new Error(`Reference download failed. Use the transcript already supplied by Ignix if available; do not claim to have seen the visuals. Otherwise request the original file. ${r.error?.message ?? (r.stderr ?? '').slice(-1200)}`);
+  }
+  return dest;
+}