@jokerized/decksmith 0.5.0 → 0.5.2

package/README.md

@@ -6,7 +6,7 @@ storyboard rendered to a 9:16 short or an MP4 without replanning.
 
 Rendering is bought, not built. A deck is a
 [HyperFrames](https://github.com/heygen-com/hyperframes) composition (Apache-2.0, pinned
-at 0.8.35), so the animation runtime, the headless capture and the FFmpeg encode are
+at 0.8.43), so the animation runtime, the headless capture and the FFmpeg encode are
 upstream's. What DeckSmith owns is the part nothing else does well: turning a document
 into a *good explanation*, and being able to check that the explanation is true to its
 source.
@@ -420,9 +420,12 @@ not a polish gap:
 
 - **No authentication and no TLS.** Anyone who can reach the port can spend your Codex
   quota. This is why the default bind is loopback.
-- **No CSRF defence.** `POST /api/jobs` is `multipart/form-data`, which is a CORS-*simple*
-  request: any website a victim visits can make their browser submit a job. There is no
-  token and no `Origin` check. Fix that before `DECKSMITH_HOST` is ever anything else.
+- **DNS rebinding is refused only on a loopback bind.** A write another site's page makes
+  a browser send is refused on any bind: `Sec-Fetch-Site`, or `Origin` where that is
+  missing. But a rebinding page is same-origin to itself, and the only thing that gives it
+  away is a `Host` naming something other than the server. On `127.0.0.1` that check is
+  on. On any other `DECKSMITH_HOST` the server cannot know its own names, so the check is
+  off until it is given an allowlist.
 - **Codex spend is unmetered per upload.** The per-IP hourly limit is the only brake, and
   it is per-IP.
 - **Rate limiting is by `socket.remoteAddress` only.** `X-Forwarded-For` is deliberately

package/dist/cli.js

@@ -1092,8 +1092,7 @@ var DESTINATIONS = {
   "video-16x9": [],
   "short-9x16": [
     { name: "YouTube Shorts", maxSeconds: 180 },
-    { name: "Instagram Reels", maxSeconds: 180 },
-    { name: "Facebook Reels", maxSeconds: 90 }
+    { name: "Instagram Reels", maxSeconds: 180 }
   ],
   "post-1x1": [{ name: "X (standard account)", maxSeconds: 140 }]
 };
@@ -11547,13 +11546,13 @@ function readCanvas(html) {
   if (width === void 0 || height === void 0 || seconds === void 0) return void 0;
   return { width, height, seconds };
 }
-function profilesFor(width, height) {
-  return Object.values(FORMATS).filter((f) => f.width === width && f.height === height);
+function profilesFor(width, height, formats = FORMATS) {
+  return Object.values(formats).filter((f) => f.width === width && f.height === height);
 }
-function scanBudget(html, storyboard, kept) {
+function scanBudget(html, storyboard, kept, formats = FORMATS) {
   const canvas = readCanvas(html);
   if (!canvas) return [];
-  const profiles = profilesFor(canvas.width, canvas.height);
+  const profiles = profilesFor(canvas.width, canvas.height, formats);
   if (profiles.length === 0) {
     return [
       {

package/dist/index.js

@@ -1087,8 +1087,7 @@ var DESTINATIONS = {
   "video-16x9": [],
   "short-9x16": [
     { name: "YouTube Shorts", maxSeconds: 180 },
-    { name: "Instagram Reels", maxSeconds: 180 },
-    { name: "Facebook Reels", maxSeconds: 90 }
+    { name: "Instagram Reels", maxSeconds: 180 }
   ],
   "post-1x1": [{ name: "X (standard account)", maxSeconds: 140 }]
 };
@@ -10934,13 +10933,13 @@ function readCanvas(html) {
   if (width === void 0 || height === void 0 || seconds === void 0) return void 0;
   return { width, height, seconds };
 }
-function profilesFor(width, height) {
-  return Object.values(FORMATS).filter((f) => f.width === width && f.height === height);
+function profilesFor(width, height, formats = FORMATS) {
+  return Object.values(formats).filter((f) => f.width === width && f.height === height);
 }
-function scanBudget(html, storyboard, kept) {
+function scanBudget(html, storyboard, kept, formats = FORMATS) {
   const canvas = readCanvas(html);
   if (!canvas) return [];
-  const profiles = profilesFor(canvas.width, canvas.height);
+  const profiles = profilesFor(canvas.width, canvas.height, formats);
   if (profiles.length === 0) {
     return [
       {

package/dist/mcp.js

@@ -1118,8 +1118,7 @@ var DESTINATIONS = {
   "video-16x9": [],
   "short-9x16": [
     { name: "YouTube Shorts", maxSeconds: 180 },
-    { name: "Instagram Reels", maxSeconds: 180 },
-    { name: "Facebook Reels", maxSeconds: 90 }
+    { name: "Instagram Reels", maxSeconds: 180 }
   ],
   "post-1x1": [{ name: "X (standard account)", maxSeconds: 140 }]
 };

package/dist/types/types.d.ts

@@ -2531,6 +2531,29 @@ export interface Destination {
  * Verified by hand, not by network (nothing here may reach one). These move;
  * when one does, the finding it produces names it, so the stale number is
  * findable from the message rather than only from this file.
+ *
+ * LAST CHECKED 2026-09-17, against each platform's own pages where they would
+ * load. And it happened again: FACEBOOK REELS IS GONE, because its 90 was stale
+ * the same way Instagram's once was. Meta's newsroom, 2025-06-17: "Reels on
+ * Facebook will also not have any length or format restrictions." By the rule
+ * above a platform that takes anything adds nothing but slack — and the 90 was
+ * not harmless slack, it was the tightest entry, so it made `near_budget` tell
+ * every short between 1m30s and 3m00s that it was "not postable everywhere",
+ * naming a destination that would have taken it. The 90 had been flagged in
+ * EXPERIMENT-010 as "from memory, not the network" for months before anyone
+ * looked.
+ *
+ * Note what each remaining number MEANS, because they are not the same thing:
+ *
+ * - YouTube Shorts, 180 — a CLASSIFICATION limit. A vertical or square upload of
+ *   three minutes or less is a Short; longer is long-form, off the Shorts feed.
+ *   YouTube Help, "Understand three-minute YouTube Shorts".
+ * - Instagram Reels, 180 — a DISTRIBUTION limit, not an upload cap. Uploads run
+ *   longer, but "we recommend videos to unconnected audiences that are 3 minutes
+ *   or less" (Instagram for Creators, FAQ). For a short, reaching people who do
+ *   not follow you is the point, so this is the limit that constrains it.
+ * - X, standard account, 140 — NOT verified at source: X's help centre refused
+ *   the fetch. Every secondary source agrees and it has not moved in years.
  */
 export declare const DESTINATIONS: Readonly<Record<PresetId, readonly Destination[]>>;
 /** The loosest destination: what the format may produce at all. */

package/dist/types/verify/budget.d.ts

@@ -26,7 +26,7 @@ export declare function readCanvas(html: string): Canvas | undefined;
  * be its own is a gate people learn to ignore. Today the two 16:9 profiles have
  * the same (absent) budget, so the reading is exact as well as safe.
  */
-export declare function profilesFor(width: number, height: number): Format[];
+export declare function profilesFor(width: number, height: number, formats?: Readonly<Record<string, Format>>): Format[];
 /**
  * The budget finding for one built composition, if there is one.
  *
@@ -37,5 +37,13 @@ export declare function profilesFor(width: number, height: number): Format[];
  * length of the beat at the same index, and getting that pairing wrong would
  * attribute one beat's seconds to another. Absent, it is re-derived with the
  * flat threshold, which is the same list only while the budget cut nothing.
+ *
+ * `formats` is a seam for the test and nothing else, and it exists because of
+ * what the shipped table stopped containing. `near_budget` fires only when a
+ * format's destinations DISAGREE, and since Facebook Reels left `DESTINATIONS`
+ * on 2026-09-17 none of them do. A branch no shipped format can reach is a gate
+ * that cannot fail — the thing this project keeps finding — so the test hands in
+ * a table that disagrees, rather than the rule being deleted and silently absent
+ * the next time a real destination is tighter than the rest.
  */
-export declare function scanBudget(html: string, storyboard?: Storyboard, kept?: readonly Beat[]): Finding[];
+export declare function scanBudget(html: string, storyboard?: Storyboard, kept?: readonly Beat[], formats?: Readonly<Record<string, Format>>): Finding[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jokerized/decksmith",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Turn a source document into an animated explanation deck.",
   "type": "module",
   "license": "MIT",
@@ -63,7 +63,7 @@
     "commander": "^14.0.1",
     "fflate": "^0.8.3",
     "gsap": "^3.14.2",
-    "hyperframes": "0.8.35",
+    "hyperframes": "0.8.43",
     "katex": "^0.16.11",
     "puppeteer-core": "^25.3.0",
     "remark-gfm": "^4.0.1",