@koda-sl/baker-cli 0.421.0 → 0.422.0

package/README.md

@@ -5988,14 +5988,20 @@ baker canvas catalog --category audio --full
 // Path source — an absolute path is used as-is, and so resolves only on the machine that wrote it.
 // Keep canvases portable: creative canvases are validated for this (`absolute-reference`).
 { "id": "src", "type": "ingest", "params": { "source": "path", "path": "/abs/work/clip.mp4", "expect": "video" } }
+
+// URL source — an earlier output, by its durable canvas-assets URL: the same bytes and sha back
+{ "id": "src", "type": "ingest", "params": { "source": "url", "url": "https://media.withbaker.com/canvas-assets/5b/5b50…c672.mp3", "expect": "audio" } }
 ```
 
+**Never point `path` into `canvas/`.** `canvas/.cache/` and `canvas/r_<id>/` are the engine's own working folder and are never committed, so a canvas that reads from them renders only where it was written. `canvas validate` and `canvas run` rewrite such a path to the durable URL of the same bytes (reported under `normalized_paths`), keeping the file first if the store does not hold it yet.
+
 **Strategy resolution** (deterministic from `source` + `expect` + URL extension for text):
 
 | `source` | `expect`      | URL / path                       | Strategy        |
 |----------|---------------|----------------------------------|-----------------|
 | path     | any           | any                              | `local_file` — read from disk, sniff mime, upload to R2 via presign |
-| url      | video / audio | any                              | `yt_dlp` (works on platform URLs *and* direct file URLs via the generic extractor) |
+| url      | any           | `…/canvas-assets/<xx>/<sha>.<ext>` | `canvas_asset` — the stored asset, verbatim, its sha checked |
+| url      | video / audio | any other                        | `yt_dlp` (works on platform URLs *and* direct file URLs via the generic extractor; verifies TLS against the system bundle) |
 | url      | image / json / font | any                        | `direct_fetch` (HTTP GET) |
 | url      | text          | ends in `.txt` or `.md`          | `direct_fetch` |
 | url      | text          | anything else (HTML, PDF, …)     | `firecrawl` `/v2/scrape` (extracted markdown — HTML/PDF made readable) |

package/dist/{chunk-GLPQQP5C.js → chunk-2S6QIXLX.js}

@@ -1,12 +1,13 @@
 import {
   debugLogHttp,
   readBodyForLog
-} from "./chunk-FKFJKE75.js";
+} from "./chunk-S36N4SOX.js";
 import {
   API_KEY_FORMAT_MESSAGE,
   DIRECT_ROUTE,
   __commonJS,
   __toESM,
+  canvasAssetOriginsSetting,
   captureProxyCredentials,
   childEnvWith,
   hasFrameVisionKey,
@@ -21,7 +22,7 @@ import {
   refuseNonPublicUrl,
   requireConnection,
   shouldEscalate
-} from "./chunk-YZLLC7DL.js";
+} from "./chunk-5JVAP5DC.js";
 
 // ../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/index.js
 var require_safe_stable_stringify = __commonJS({
@@ -12495,6 +12496,38 @@ function isAssetRefLike(v) {
 
 // src/engine/storage/remote-cache-store.ts
 var CANVAS_ASSETS_URL_SEGMENT = "/canvas-assets/";
+function canvasAssetOrigins(setting = canvasAssetOriginsSetting()) {
+  return (setting ?? "https://media.withbaker.com,https://media.dev-baker.com").split(",").map((origin) => origin.trim().replace(/\/+$/, "")).filter(Boolean);
+}
+function isCanvasAssetOrigin(url) {
+  try {
+    const { origin } = new URL(url);
+    return canvasAssetOrigins().some((allowed) => {
+      try {
+        return new URL(allowed).origin === origin;
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+function parseCanvasAssetUrl(url) {
+  let pathname;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    pathname = parsed.pathname;
+  } catch {
+    return null;
+  }
+  const match = /\/canvas-assets\/([0-9a-f]{2})\/([0-9a-f]{64})\.([a-z0-9]+)$/.exec(pathname);
+  if (!match) return null;
+  const [, shard, sha256, ext] = match;
+  if (shard === void 0 || sha256 === void 0 || ext === void 0 || !sha256.startsWith(shard)) return null;
+  return { sha256, ext };
+}
 function isPersistedAssetRef(ref) {
   const { url, sha256 } = ref;
   if (typeof url !== "string" || typeof sha256 !== "string") return false;
@@ -18202,6 +18235,7 @@ function ytDlpBlockSignal(stderr) {
 var YT_DLP_BIN = "yt-dlp";
 var YT_DLP_TIMEOUT_MS = 10 * 60 * 1e3;
 var YT_DLP_PROBE_TIMEOUT_MS = 60 * 1e3;
+var TRUST_SYSTEM_CERTS = ["--compat-options", "no-certifi"];
 var YtDlpError = class extends Error {
   constructor(message2, stderrTail) {
     super(message2);
@@ -18222,6 +18256,7 @@ async function runYtDlp(args) {
     "--no-warnings",
     "--quiet",
     "--write-info-json",
+    ...TRUST_SYSTEM_CERTS,
     "-o",
     outTemplate
   ];
@@ -18270,7 +18305,8 @@ async function probeYtDlp(args) {
     // exits "Requested format is not available" and we learn nothing — measured
     // against a stale build, which returned full metadata the moment this flag
     // was added. Duration and id come from the page, not from a format.
-    "--ignore-no-formats-error"
+    "--ignore-no-formats-error",
+    ...TRUST_SYSTEM_CERTS
   ];
   if (args.cookieDir) {
     const cookieFile = await writeVimeoCookieFile(args.vimeoCookie, args.cookieDir);
@@ -18588,6 +18624,7 @@ var IngestOutputs = z44.object({ asset: AssetRef }).strict();
 var RAW_TEXT_EXTENSIONS = [".txt", ".md"];
 function resolveStrategy(params) {
   if (params.source === "path") return "local_file";
+  if (takesCanvasAssetVerbatim(params.url, params.expect)) return "canvas_asset";
   switch (params.expect) {
     case "video":
     case "audio":
@@ -18619,8 +18656,8 @@ var ingestNode = defineNode({
   version: "1.3.0",
   category: "io",
   location: "local",
-  summary: "Ingest an external URL or a local file into the asset store. Declare the kind you expect (image/video/audio/text/json/font); the node picks the strategy. For source=url: yt-dlp for video/audio (YouTube/TikTok/Vimeo/etc. and direct file URLs), Firecrawl for HTML/PDF pages \u2192 markdown, direct HTTP fetch for binary URLs (images, fonts) and raw .txt/.md. For source=path: read from the local filesystem and upload to R2.",
-  when_to_use: 'Use as the on-ramp for any external asset a canvas needs. `expect` makes the output port statically typed so downstream wiring is checked before any byte is fetched. Pick `source: "url"` for portable canvas; pick `source: "path"` for local files (canvas is not portable across machines without the file). Compose with other nodes for richer pipelines (e.g. `ingest expect=video` \u2192 `video_transcribe`).',
+  summary: "Ingest an external URL or a local file into the asset store. Declare the kind you expect (image/video/audio/text/json/font); the node picks the strategy. For source=url: a canvas-assets URL (`\u2026/canvas-assets/<xx>/<sha>.<ext>`, the durable copy of an earlier output) is taken back byte-for-byte with its sha unchanged; yt-dlp for other video/audio (YouTube/TikTok/Vimeo/etc. and direct file URLs), Firecrawl for HTML/PDF pages \u2192 markdown, direct HTTP fetch for binary URLs (images, fonts) and raw .txt/.md. For source=path: read a committed file from the workspace and upload to R2.",
+  when_to_use: 'Use as the on-ramp for any external asset a canvas needs. `expect` makes the output port statically typed so downstream wiring is checked before any byte is fetched. Pick `source: "url"` for portable canvas; pick `source: "path"` only for a file committed to the workspace (`src/brand/\u2026`, `src/creatives/<slug>/assets/\u2026`) \u2014 the canvas is rendered again in other Sessions, which have only what is committed. To reuse an earlier output (a voice take, a clip, a frame), ingest its canvas-assets URL from the run outputs: it comes back with the same sha, so nothing downstream re-renders. Never point `path` into `canvas/` (`canvas/.cache/`, `canvas/r_*`): that folder is not committed, and validate rewrites a cache path to its canvas-assets URL. Compose with other nodes for richer pipelines (e.g. `ingest expect=video` \u2192 `video_transcribe`).',
   inputs: IngestInputs,
   params: IngestParams,
   outputs: IngestOutputs,
@@ -18644,6 +18681,8 @@ function runStrategy(strategy, params, ctx) {
     return execLocalFile(params, ctx);
   }
   switch (strategy) {
+    case "canvas_asset":
+      return execCanvasAsset(params, ctx);
     case "direct_fetch":
       return execDirectFetch(params, ctx);
     case "firecrawl":
@@ -18658,6 +18697,30 @@ function runStrategy(strategy, params, ctx) {
     }
   }
 }
+function canvasAssetMime(url, expect) {
+  const address = parseCanvasAssetUrl(url);
+  const mime = address ? EXT_TO_MIME[address.ext] : void 0;
+  return mime !== void 0 && inferKindFromMime(mime) === expect ? mime : null;
+}
+function takesCanvasAssetVerbatim(url, expect) {
+  return isCanvasAssetOrigin(url) && canvasAssetMime(url, expect) !== null;
+}
+async function execCanvasAsset(params, ctx) {
+  const address = parseCanvasAssetUrl(params.url);
+  const mime = canvasAssetMime(params.url, params.expect);
+  if (!address || mime === null) throw new Error(`ingest: invariant \u2014 canvas_asset strategy for ${params.url}`);
+  try {
+    return await ctx.assets.ingestRemote({
+      kind: params.expect,
+      url: params.url,
+      sha256: address.sha256,
+      mime,
+      metadata: { strategy: "canvas_asset", source_url: params.url, ingested_at: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  } catch (e) {
+    throw localExecError(ctx, e.message);
+  }
+}
 async function execDirectFetch(params, ctx) {
   if (params.expect === "image") {
     return ingestImageUrl(params.url, ctx);
@@ -19077,13 +19140,19 @@ async function runYtDlpForNode(args) {
     if (error instanceof YtDlpError) {
       throw new NodeExecutionError(args.ctx.nodeId, args.ctx.nodeType, {
         kind: "local",
-        cause: new Error(error.stderrTail ? `${error.message}
-${error.stderrTail}` : error.message)
+        cause: new Error(describeYtDlpFailure(error.message, error.stderrTail))
       });
     }
     throw error;
   }
 }
+function describeYtDlpFailure(message2, stderrTail) {
+  const base = stderrTail ? `${message2}
+${stderrTail}` : message2;
+  if (!/CERTIFICATE_VERIFY_FAILED|SSL certificate problem/i.test(stderrTail)) return base;
+  return `${base}
+This machine could not verify the download's TLS certificate; the file itself is fine. Report it and leave this ingest as it is. Never copy the file out of canvas/ (the render cache or a run folder) to work around it: canvas/ is not committed, so the creative would fail every later publish. To reuse one of our own outputs, ingest its canvas-assets URL, which does not go through this downloader.`;
+}
 function buildYtDlpMetadata(sourceUrl, info) {
   const out = {
     source_url: sourceUrl,
@@ -19128,7 +19197,7 @@ ingestNode.cacheKeyExtras = async ({ params }) => {
     } catch {
     }
   }
-  if (p.source === "url" && (p.expect === "video" || p.expect === "audio")) {
+  if (p.source === "url" && (p.expect === "video" || p.expect === "audio") && !(typeof p.url === "string" && takesCanvasAssetVerbatim(p.url, p.expect))) {
     extras.yt_dlp_version = await ytDlpVersion();
   }
   return extras;
@@ -24434,6 +24503,8 @@ export {
   durationSeconds,
   canonicalUrl,
   coercePathUrlToUrl,
+  canvasAssetMime,
+  inferMimeFromPath,
   toModelSafeImage,
   loadCompositionMeta,
   videoPathFromOutput,
@@ -24459,4 +24530,4 @@ export {
   defaultRegistry,
   createEngineFromEnv
 };
-//# sourceMappingURL=chunk-GLPQQP5C.js.map
+//# sourceMappingURL=chunk-2S6QIXLX.js.map