@koda-sl/baker-cli 0.306.2-dev.bb28562ac → 0.306.6-dev.368ebfa99

package/README.md

@@ -3898,10 +3898,16 @@ paid for by the time it runs — and the findings come back as `review` and `hin
 Each per-frame finding names the **scene file** that produced that second, so a defect is
 an edit rather than a hunt — and re-running re-renders only the scenes you changed.
 
-It needs `GEMINI_API_KEY` (the Runtime receives it automatically). Without one the run
+It needs `OPENROUTER_API_KEY` (the Runtime receives it automatically). Without one the run
 says the video was **not** reviewed rather than reporting it clean, and a frame that
 could not be read is reported as unchecked for the same reason.
 
+The review goes through OpenRouter like every other model call on the platform, so what
+it costs comes back with the answer and is billed against the run. The models float
+(`~google/gemini-flash-latest` watches, `~google/gemini-pro-latest` reads the stills) —
+safe to float precisely because nothing here holds a price list that could go stale
+against them.
+
 
 > Scaffolded canvases use **workspace-relative** composition/asset paths and are validated
 > against the engine's hyperframe pre-render gate at `validate` time, so a broken overlay
@@ -6157,6 +6163,7 @@ Pushing to `main` with changes in `packages/cli/` triggers the GitHub Actions wo
 
 - **0.291.0**: **the image handover Task no longer depends on having uploaded the images.** It was built only from staged `asset.create` image ops, so a Session that audited a live account — found the brand campaign carrying 22 image extensions and the generic one carrying none, and reached for `assets attach` on assets that were *already in the library* — got Google's refusal and nothing else: no upload to hang a Task on, and a CLI hint telling the agent not to raise one by hand because "Baker stages it itself". The one step only the user can take reached them as a sentence in a chat that scrolls away. An image `assets attach` is now **skipped rather than refused**: it still never reaches Google (re-verified live with `validate_only` on v23 *and* v25 against 3865083115, against a control op that validates clean in the same request — `AD_IMAGE` → `UNSUPPORTED_FIELD_TYPE` at customer and campaign level, `MARKETING_IMAGE` → `FIELD_TYPE_INCOMPATIBLE_WITH_CAMPAIGN_TYPE`, `BUSINESS_LOGO` → `CUSTOMER_NOT_VERIFIED`, which is what proves the field type is the objection; **we are not on Google's allowlist for it**), but the skip carries the image and campaign names, recorded on the draft so the next staged op cannot recompute the Task away, and a batch that also carries sitelinks keeps them instead of failing whole. The schema stopped refusing the field type for the same reason: a boundary refusal has no chat to record a handover against.
 
+- **0.306.6**: the render review moved onto OpenRouter, where every other model call on this platform already goes. It was calling Gemini directly on the stated grounds that the watch pass uploads the finished mp4 inline and OpenRouter had no route that takes one — it does: a `video_url` content part accepts a base64 data URL, verified end to end (HTTP 200, video tokens counted, the model describing the clip it was sent). That one wrong premise had cost a hand-maintained price table in the backend, token counts round-tripping through the run record to be priced there, a second credential in every Runtime, and a model id pinned to `gemini-3.7-flash` so the table's key would not drift — which is also why the review had quietly stayed off `gemini-3.8-flash`. Now the reply carries `usage.cost`, the Runtime relays the gateway's figure instead of computing one, and the models float (`~google/gemini-flash-latest`, `~google/gemini-pro-latest`). The key it reads is `OPENROUTER_API_KEY`; `GEMINI_API_KEY` is still shipped for HyperFrames' own `snapshot --describe` pass, which is a third-party tool and reads that name.
 - **0.306.0**: review fixes across the avatar and ad paths. **A silent clip is 5 seconds again** — the 8s speaking floor was applied to every `studio animate` call, not just ones that cast an avatar, so plain b-roll was lengthened by three seconds and billed for them. **`scaffold-ad` validates the mark it will actually draw**: the logo gates read the path the spec named rather than the one `fetchClientLogo` had just put there, so a fetched mark either skipped both checks or was refused as unreadable. **The render review is told where the ad is set, who it is for and what the script says** — read off the blueprint beside the canvas; without them the watch pass judged an accent against nothing and still graded the verdict as blocking. **A beat is "too short" by its LINE, not by the clip floor** — the old test needed a 25-word clause, so it fired on all three beats of this command's own documented example. **A voiceover stays a voiceover** — a phrase nobody is shown speaking was being folded into the presenter's clip and said on camera, words that shot was never generated for; the fold now applies only where there is a mouth for the words to contradict. `--voice-id` / `--voice-description` are gone from `baker avatars create` (0.252.0 said so; the flags were still declared and still sent), `end_card.cta` is documented as having no default, and the dead Veo/Omni content-block fallbacks are removed.
 
 ### Testing a pre-release in sandboxes

package/dist/{chunk-A2VZOTCV.js → chunk-AEU5X443.js}

@@ -1,10 +1,10 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-KDTHRRAC.js";
+} from "./chunk-TTIGSGXE.js";
 import {
   getEnv
-} from "./chunk-WFWU3CHS.js";
+} from "./chunk-UIQJZGBG.js";
 
 // src/error-handler.ts
 var REQUEST_CONNECTION_PLATFORM = {
@@ -294,4 +294,4 @@ export {
   writeAdsOutput,
   resolveCustomerId
 };
-//# sourceMappingURL=chunk-A2VZOTCV.js.map
+//# sourceMappingURL=chunk-AEU5X443.js.map

package/dist/{chunk-2IUN3S3E.js → chunk-FOWT5AS4.js}

@@ -1,6 +1,6 @@
 import {
   debugLogSetting
-} from "./chunk-WFWU3CHS.js";
+} from "./chunk-UIQJZGBG.js";
 
 // src/debugLog.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
@@ -150,4 +150,4 @@ export {
   readBodyForLog,
   installStreamTaps
 };
-//# sourceMappingURL=chunk-2IUN3S3E.js.map
+//# sourceMappingURL=chunk-FOWT5AS4.js.map

package/dist/{chunk-4YF56EGK.js → chunk-KMQHIAYG.js}

@@ -2,13 +2,13 @@ import {
   handleConnectionError,
   needsConnectionFix,
   writeAdsJson
-} from "./chunk-A2VZOTCV.js";
+} from "./chunk-AEU5X443.js";
 import {
   ApiError
-} from "./chunk-KDTHRRAC.js";
+} from "./chunk-TTIGSGXE.js";
 import {
   getEnv
-} from "./chunk-WFWU3CHS.js";
+} from "./chunk-UIQJZGBG.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
@@ -108,4 +108,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-4YF56EGK.js.map
+//# sourceMappingURL=chunk-KMQHIAYG.js.map

package/dist/{chunk-3TEVIAAV.js → chunk-PY7R67NE.js}

@@ -1,7 +1,7 @@
 import {
   debugLogHttp,
   readBodyForLog
-} from "./chunk-2IUN3S3E.js";
+} from "./chunk-FOWT5AS4.js";
 import {
   DIRECT_ROUTE,
   __commonJS,
@@ -15,11 +15,11 @@ import {
   plannedRoutes,
   refuseNonPublicUrl,
   shouldEscalate
-} from "./chunk-WFWU3CHS.js";
+} from "./chunk-UIQJZGBG.js";
 
-// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/766ad107c42df28eeadaf0ac2f9089c8a9e200f6ba0b2b1a817b8d536cbdcc49/node_modules/safe-stable-stringify/index.js
+// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/509a695c9237c6e3727f1f1f99169917f329e3ff3f7877be290b684e24bf153d/node_modules/safe-stable-stringify/index.js
 var require_safe_stable_stringify = __commonJS({
-  "../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/766ad107c42df28eeadaf0ac2f9089c8a9e200f6ba0b2b1a817b8d536cbdcc49/node_modules/safe-stable-stringify/index.js"(exports, module) {
+  "../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/509a695c9237c6e3727f1f1f99169917f329e3ff3f7877be290b684e24bf153d/node_modules/safe-stable-stringify/index.js"(exports, module) {
     "use strict";
     var { hasOwnProperty } = Object.prototype;
     var stringify = configure2();
@@ -1111,7 +1111,7 @@ function resolveAdaptFormats(params) {
   return params.formats ?? [];
 }
 
-// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/766ad107c42df28eeadaf0ac2f9089c8a9e200f6ba0b2b1a817b8d536cbdcc49/node_modules/safe-stable-stringify/esm/wrapper.js
+// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/509a695c9237c6e3727f1f1f99169917f329e3ff3f7877be290b684e24bf153d/node_modules/safe-stable-stringify/esm/wrapper.js
 var import__ = __toESM(require_safe_stable_stringify(), 1);
 var configure = import__.default.configure;
 var wrapper_default = import__.default;
@@ -2204,11 +2204,10 @@ function supportsParam(kind, model, param) {
 }
 var DEFAULT_CLIP_DURATION_S = 5;
 var SPOKEN_WORDS_PER_SECOND = 2.5;
+var SPOKEN_LINE = new RegExp(`(?<![\\p{L}\\p{N}])['"\\u201c\\u201d\\u2018\\u2019]((?:[^'"\\u201c\\u201d\\u2018\\u2019]|(?<=\\p{L})['\\u2019](?=\\p{L})){8,})['"\\u201c\\u201d\\u2018\\u2019](?![\\p{L}\\p{N}])`, "gu");
 function spokenWordsIn(prompt) {
   if (!prompt) return 0;
-  const quoted = [
-    ...prompt.matchAll(/['"\u201c\u201d\u2018\u2019]([^'"\u201c\u201d\u2018\u2019]{8,})['"\u201c\u201d\u2018\u2019]/g)
-  ].map((m) => m[1] ?? "");
+  const quoted = [...prompt.matchAll(SPOKEN_LINE)].map((m) => m[1] ?? "");
   const text = quoted.join(" ").trim();
   return text ? text.split(/\s+/).filter(Boolean).length : 0;
 }
@@ -9662,4 +9661,4 @@ export {
   defaultRegistry,
   createEngineFromEnv
 };
-//# sourceMappingURL=chunk-3TEVIAAV.js.map
+//# sourceMappingURL=chunk-PY7R67NE.js.map