@mevdragon/vidfarm-devcli 0.14.0 → 0.15.0

package/dist/src/composition-runtime.js

@@ -8,7 +8,8 @@
 export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
 (() => {
   const root = document.querySelector("[data-composition-id]");
-  const duration = Number(root?.getAttribute("data-duration") || 0);
+  let declaredDuration = Number(root?.getAttribute("data-duration") || 0);
+  let duration = declaredDuration;
   let time = 0;
   let playing = false;
   let playbackRate = 1;
@@ -53,6 +54,11 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
   }
 
   function refreshClips() {
+    // The parent editor can live-patch the composition DOM. Re-read the root's
+    // declared duration so a patched data-duration followed by refreshClips()
+    // never leaves the player clamped to a stale duration.
+    declaredDuration = Number(root?.getAttribute("data-duration") || 0);
+    duration = declaredDuration;
     clips = Array.from(document.querySelectorAll("[data-start]")).filter((node) => node !== root);
     for (const clip of clips) {
       if (clip instanceof HTMLMediaElement && !initialMuted.has(clip)) {
@@ -74,6 +80,7 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
     activeVideoProxyKey = null;
     activeVideoProxyNode = null;
     hasVideoProxies = clips.some((clip) => clip instanceof Element && clip.getAttribute("data-vf-timeline-proxy") === "video");
+    discoverGeneralCssAnimations();
     apply(time, { forceSeek: true });
   }
 
@@ -146,6 +153,130 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
     }
   }
 
+  // Runtime-adapter bridge — mirrors the official @hyperframes/producer
+  // deterministic adapters so compositions driven by a registered GSAP
+  // timeline (window.__timelines), Anime.js (window.__hfAnime), Lottie
+  // (window.__hfLottie), or Three.js/TypeGPU (window.__hfThreeTime/
+  // __hfTypegpuTime + the hf-seek CustomEvent) scrub with the player instead
+  // of running on the wall clock. Everything is duck-typed and try/caught so
+  // a broken composition script never kills the apply loop.
+  function compositionTimeline() {
+    let registry = null;
+    try { registry = window.__timelines; } catch { return null; }
+    if (!registry || typeof registry !== "object") return null;
+    const compId = root?.getAttribute("data-composition-id") || "";
+    let timeline = compId ? registry[compId] : null;
+    if (!timeline) {
+      const keys = Object.keys(registry);
+      if (keys.length === 1) timeline = registry[keys[0]];
+    }
+    if (!timeline || typeof timeline.pause !== "function") return null;
+    if (typeof timeline.totalTime !== "function" && typeof timeline.seek !== "function") return null;
+    return timeline;
+  }
+
+  function timelineDuration(timeline) {
+    try {
+      const value = typeof timeline.duration === "function" ? Number(timeline.duration()) : Number(timeline.duration);
+      if (Number.isFinite(value) && value > 0) return value;
+    } catch {}
+    return 0;
+  }
+
+  function syncTimeline() {
+    const timeline = compositionTimeline();
+    if (!timeline) return;
+    try {
+      timeline.pause();
+      // Official gsap adapter seek: nudge to time+1ms with suppressed events,
+      // then land exactly, so gsap re-renders even when the target equals the
+      // timeline's current time.
+      if (typeof timeline.totalTime === "function") {
+        timeline.totalTime(time + 0.001, true);
+        timeline.totalTime(time, false);
+      } else {
+        timeline.seek(time, false);
+      }
+    } catch {}
+  }
+
+  function syncAnimeInstances() {
+    let instances = null;
+    try { instances = window.__hfAnime; } catch { return; }
+    if (!Array.isArray(instances) || instances.length === 0) return;
+    const ms = Math.max(0, time) * 1000;
+    for (const instance of instances) {
+      try {
+        if (instance && typeof instance.seek === "function") instance.seek(ms);
+      } catch {}
+    }
+  }
+
+  function syncLottiePlayers() {
+    let players = null;
+    try { players = window.__hfLottie; } catch { return; }
+    if (!Array.isArray(players) || players.length === 0) return;
+    const safe = Math.max(0, time);
+    for (const player of players) {
+      try {
+        if (!player || typeof player !== "object") continue;
+        if (typeof player.goToAndStop === "function") {
+          player.goToAndStop(safe * 1000, false);
+        } else if (typeof player.pause === "function" && ("totalFrames" in player || "duration" in player)) {
+          if (typeof player.setCurrentRawFrameValue === "function") {
+            const totalFrames = player.totalFrames ?? 0;
+            const frameRate = player.frameRate ?? 30;
+            if (totalFrames > 0) player.setCurrentRawFrameValue(Math.min(safe * frameRate, totalFrames - 1));
+          } else if (typeof player.seek === "function") {
+            player.seek(Math.min(100, (safe / (player.duration ?? 1)) * 100));
+          }
+        }
+      } catch {}
+    }
+  }
+
+  let lastDispatchedSeekTime = -1;
+  function syncSeekGlobals() {
+    const safe = Math.max(0, time);
+    try { window.__hfThreeTime = safe; } catch {}
+    try { window.__hfTypegpuTime = safe; } catch {}
+    // The official three/typegpu adapters dedupe the hf-seek dispatch on the
+    // last dispatched time.
+    if (safe === lastDispatchedSeekTime) return;
+    lastDispatchedSeekTime = safe;
+    try { window.dispatchEvent(new CustomEvent("hf-seek", { detail: { time: safe } })); } catch {}
+  }
+
+  function syncRuntimeAdapters() {
+    syncTimeline();
+    syncAnimeInstances();
+    syncLottiePlayers();
+    syncSeekGlobals();
+  }
+
+  // data-duration on the root is authoritative when present. Arbitrary
+  // compositions may omit it, so infer the duration from clip extents,
+  // preferring a registered GSAP timeline that reports a longer duration.
+  // Recomputed on every apply so a timeline registered after load still
+  // corrects the duration (and seek clamping) lazily.
+  function ensureDuration() {
+    if (declaredDuration > 0) {
+      duration = declaredDuration;
+      return;
+    }
+    let inferred = 0;
+    for (const clip of clips) {
+      const timing = readTiming(clip);
+      if (timing.end > inferred) inferred = timing.end;
+    }
+    const timeline = compositionTimeline();
+    if (timeline) {
+      const reported = timelineDuration(timeline);
+      if (reported > inferred) inferred = reported;
+    }
+    duration = inferred;
+  }
+
   // Ken Burns image clips carry a CSS transform animation (vf-kb-* keyframes)
   // directly on the [data-kenburns] <img>. CSS animations run on the wall clock,
   // not player time, so the runtime scrubs them: pause + set currentTime from
@@ -313,19 +444,138 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
     }
   }
 
+  // Generalized CSS keyframe scrub — the preview twin of the official
+  // producer CSS adapter: every element whose computed animation-name is set
+  // gets its animations paused and scrubbed to the player time relative to
+  // the nearest ancestor-or-self [data-start] (0 when none). vf-* animations
+  // (Ken Burns, transitions, captions) keep their dedicated machinery above.
+  // Discovery is cached per refreshClips like the official adapter's discover
+  // pass; elements added by live patches are picked up on the next refresh.
+  // Each entry also caches its clip-relative start at discovery so the
+  // per-frame sync skips the ancestor walk; a re-parented or retimed element
+  // is likewise re-resolved on the next refreshClips discovery.
+  let generalCssEntries = [];
+
+  function discoverGeneralCssAnimations() {
+    generalCssEntries = [];
+    let nodes = [];
+    try { nodes = document.querySelectorAll("*"); } catch { return; }
+    for (const node of nodes) {
+      if (!(node instanceof HTMLElement) || typeof node.getAnimations !== "function") continue;
+      let names = "";
+      try { names = getComputedStyle(node).animationName || ""; } catch { continue; }
+      if (!names || names === "none") continue;
+      const expected = [];
+      for (const name of names.split(",")) {
+        const trimmed = name.trim();
+        if (!trimmed || trimmed === "none" || trimmed.indexOf("vf-") === 0) continue;
+        expected.push(trimmed);
+      }
+      if (expected.length) generalCssEntries.push({ el: node, names: expected, start: generalClipStartFor(node) });
+    }
+  }
+
+  function hasAnimationNamed(anims, name) {
+    for (const anim of anims) {
+      if (anim.animationName === name) return true;
+    }
+    return false;
+  }
+
+  function generalClipStartFor(node) {
+    const holder = node.closest("[data-start]");
+    return holder ? readNumberAttr(holder, ["data-start"], 0) : 0;
+  }
+
+  // Cycling animation-name through none re-creates dropped CSS animations
+  // declaratively (same trick as the caption resurrection above), preserving
+  // any authored inline animation-name.
+  function resurrectCssAnimations(node) {
+    try {
+      const inline = node.style.animationName;
+      node.style.animationName = "none";
+      void node.offsetWidth;
+      if (inline && inline !== "none") {
+        node.style.animationName = inline;
+      } else {
+        node.style.removeProperty("animation-name");
+      }
+    } catch {}
+  }
+
+  function scrubGeneralAnimation(anim, offsetMs) {
+    let target = offsetMs;
+    try {
+      const computed = anim.effect && typeof anim.effect.getComputedTiming === "function"
+        ? anim.effect.getComputedTiming()
+        : null;
+      const endTime = computed && typeof computed.endTime === "number" ? computed.endTime : NaN;
+      if (Number.isFinite(endTime) && offsetMs >= endTime) {
+        // Same Chrome guard as the caption scrub: paused fill:none/backwards
+        // animations pushed past their effect end are destroyed permanently,
+        // so park them at 0; fill:forwards/both hold their final keyframe at
+        // the clamped end. Infinite-iteration animations (endTime Infinity)
+        // take the raw clip-relative offset like the official CSS adapter —
+        // the browser resolves the iteration phase.
+        target = computed.fill === "forwards" || computed.fill === "both" ? endTime : 0;
+      }
+    } catch {}
+    try {
+      anim.pause();
+      anim.currentTime = target;
+    } catch {}
+  }
+
+  function syncGeneralCssAnimations() {
+    for (const entry of generalCssEntries) {
+      const node = entry.el;
+      if (!node.isConnected) continue;
+      const offsetMs = Math.max(0, time - entry.start) * 1000;
+      let anims = [];
+      try { anims = node.getAnimations(); } catch { continue; }
+      let missing = null;
+      for (const name of entry.names) {
+        if (!hasAnimationNamed(anims, name)) (missing || (missing = [])).push(name);
+      }
+      if (missing) {
+        resurrectCssAnimations(node);
+        try { anims = node.getAnimations(); } catch { anims = []; }
+        // Names that still have no live animation (e.g. a display:none
+        // subtree) are dropped until the next discovery so a hidden element
+        // is not forced through a reflow every frame.
+        entry.names = entry.names.filter((name) => missing.indexOf(name) === -1 || hasAnimationNamed(anims, name));
+      }
+      for (const anim of anims) {
+        if (typeof anim.animationName !== "string" || anim.animationName.indexOf("vf-") === 0) continue;
+        scrubGeneralAnimation(anim, offsetMs);
+      }
+    }
+  }
+
   function apply(nextTime, options = {}) {
     const forceSeek = Boolean(options.forceSeek);
     const fromClock = Boolean(options.fromClock);
+    ensureDuration();
     time = clampTime(nextTime);
     let activeVideoProxy = null;
+    let activeVideoProxyStart = -Infinity;
     const transitionWindows = collectTransitionWindows();
     for (const clip of clips) {
       const timing = readTiming(clip);
       const hold = transitionHoldFor(clip, timing, transitionWindows);
-      const active = time >= timing.start && time < timing.end + hold;
+      // hyperframes-core clip windows are inclusive of both ends — the final
+      // frame holds.
+      const active = time >= timing.start && time <= timing.end + hold;
       if (clip instanceof HTMLElement && !(clip instanceof HTMLAudioElement)) {
         if (clip.getAttribute("data-vf-timeline-proxy") === "video") {
-          if (active) activeVideoProxy = clip;
+          // Clip windows are inclusive of both ends, so at an exact butt-cut
+          // the outgoing AND incoming proxies are both active. Prefer the
+          // greatest data-start (timeline order — the incoming clip wins);
+          // DOM order only breaks ties between equal starts.
+          if (active && timing.start >= activeVideoProxyStart) {
+            activeVideoProxy = clip;
+            activeVideoProxyStart = timing.start;
+          }
         } else {
           setVisibility(clip, active);
         }
@@ -349,6 +599,8 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
         }
       }
     }
+    syncGeneralCssAnimations();
+    syncRuntimeAdapters();
     if (backingVideo instanceof HTMLVideoElement) {
       applyMediaState(backingVideo);
       const shouldShowBackingVideo = !hasVideoProxies || Boolean(activeVideoProxy);
@@ -457,6 +709,13 @@ export const COMPOSITION_RUNTIME_SCRIPT_BODY = `
       if (!playing) apply(time, { forceSeek: true });
     });
   }
+  window.addEventListener("load", () => {
+    // Composition scripts may register adapter instances (GSAP timelines,
+    // Lottie players, ...) or start CSS animations on the load event —
+    // re-discover and re-scrub so late registrations preview correctly.
+    discoverGeneralCssAnimations();
+    if (!playing) apply(time, { forceSeek: true });
+  });
 
   // Cache the parent frame's origin from the first accepted control message
   // and pin all outbound postMessages to it. Falls back to document.referrer's

package/dist/src/devcli/doctor.js

@@ -0,0 +1,192 @@
+// `vidfarm doctor` — one-shot health check of everything the devcli's local
+// loops depend on: node, the bundled ffmpeg/ffprobe, the hyperframes local
+// engines, Chrome for in-process rendering, cloud auth, provider keys, agent
+// CLIs, poisoned-env traps, port 3000, and installed agent skills.
+//
+// Exit code: 0 unless a HARD requirement (ffmpeg) is missing — everything
+// else prints as ⚠/✗ but does not fail the command, so agents can run doctor
+// unconditionally at session start.
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import net from "node:net";
+import { homedir } from "node:os";
+import path from "node:path";
+import { parseArgs } from "node:util";
+import { detectLocalAgent } from "../services/clip-curation/index.js";
+import { hasFfmpeg, resolveFfmpeg, resolveFfprobe } from "../services/clip-curation/ffmpeg.js";
+import { resolveHyperframesCli } from "./hyperframes-cli.js";
+import { resolveSkillsRoot } from "./skills.js";
+const GREEN = "\x1b[32m";
+const RED = "\x1b[31m";
+const YELLOW = "\x1b[33m";
+const DIM = "\x1b[2m";
+const RESET = "\x1b[0m";
+// The cloud ARNs/URLs the `serve` command blanks before booting (see
+// runServeCommand in src/cli.ts). Any of these set in a plain dev shell will
+// silently route local work to cloud infra — the classic poisoned-.env trap.
+const SERVE_BLANKED_ENV_VARS = [
+    "VIDFARM_JOB_STATE_MACHINE_ARN",
+    "VIDFARM_CLIP_SCAN_STATE_MACHINE_ARN",
+    "VIDFARM_PRIMITIVE_MEDIA_LAMBDA_URL",
+    "VIDFARM_PRIMITIVE_MEDIA_LAMBDA_SECRET",
+    "AWS_S3_BUCKET"
+];
+const PROVIDER_KEY_ENV_VARS = ["OPENAI_API_KEY", "GEMINI_API_KEY", "OPENROUTER_API_KEY", "ELEVENLABS_API_KEY"];
+function isPortInUse(port) {
+    return new Promise((resolve) => {
+        const server = net.createServer();
+        server.once("error", (error) => {
+            resolve(error.code === "EADDRINUSE");
+        });
+        server.once("listening", () => {
+            server.close(() => resolve(false));
+        });
+        server.listen(port, "127.0.0.1");
+    });
+}
+// Best-effort Chrome availability for the in-process HyperFrames render:
+// explicit env overrides, the puppeteer download cache, or a system Chrome.
+function detectChromeForRender() {
+    for (const envName of ["PUPPETEER_EXECUTABLE_PATH", "CHROME_PATH", "HYPERFRAMES_CHROME_PATH"]) {
+        const value = process.env[envName]?.trim();
+        if (value && existsSync(value))
+            return { found: true, detail: `${envName}=${value}` };
+    }
+    const cacheDir = process.env.PUPPETEER_CACHE_DIR?.trim() || path.join(homedir(), ".cache", "puppeteer");
+    try {
+        const entries = readdirSync(cacheDir).filter((name) => /chrome/i.test(name));
+        if (entries.length > 0)
+            return { found: true, detail: `puppeteer cache ${cacheDir} (${entries.join(", ")})` };
+    }
+    catch {
+        // no cache dir — fall through
+    }
+    const systemCandidates = process.platform === "darwin"
+        ? ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "/Applications/Chromium.app/Contents/MacOS/Chromium"]
+        : ["/usr/bin/google-chrome", "/usr/bin/chromium", "/usr/bin/chromium-browser"];
+    for (const candidate of systemCandidates) {
+        if (existsSync(candidate))
+            return { found: true, detail: candidate };
+    }
+    return { found: false, detail: `no PUPPETEER_EXECUTABLE_PATH/CHROME_PATH, no ${cacheDir}, no system Chrome` };
+}
+// Count installed skills under the SAME root the `vidfarm skills` command
+// resolves (resolveSkillsRoot: walk up from cwd to the first dir with
+// .agents/skills or .git, else cwd) — one resolution, no drift.
+function countInstalledSkills() {
+    const root = resolveSkillsRoot();
+    const skillsDir = path.join(root, ".agents", "skills");
+    if (!existsSync(skillsDir))
+        return { root: null, count: 0, names: [] };
+    try {
+        const names = readdirSync(skillsDir).filter((name) => existsSync(path.join(skillsDir, name, "SKILL.md")));
+        return { root, count: names.length, names };
+    }
+    catch {
+        return { root, count: 0, names: [] };
+    }
+}
+async function fetchWhoami(host, apiKey) {
+    try {
+        const res = await fetch(new URL("/api/v1/user/me", host), {
+            headers: { "vidfarm-api-key": apiKey, accept: "application/json" }
+        });
+        if (!res.ok)
+            return { ok: false, detail: `GET /api/v1/user/me → ${res.status} (check the key/host)` };
+        const json = await res.json().catch(() => null);
+        const email = json?.email ?? json?.user?.email ?? json?.customer?.email;
+        return { ok: true, detail: email ? `authenticated as ${email} (${host})` : `authenticated (${host})` };
+    }
+    catch (error) {
+        return { ok: false, detail: `could not reach ${host}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+export async function runDoctorCommand(argv) {
+    const parsed = parseArgs({
+        args: argv,
+        allowPositionals: false,
+        options: {
+            host: { type: "string", default: "https://vidfarm.cc" },
+            "api-key": { type: "string" },
+            json: { type: "boolean", default: false }
+        }
+    });
+    const json = Boolean(parsed.values.json);
+    const checks = [];
+    const add = (name, level, detail) => checks.push({ name, level, detail });
+    // 1. Node version.
+    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    add("node", nodeMajor >= 22 ? "ok" : "fail", `v${process.versions.node}${nodeMajor >= 22 ? "" : " — vidfarm-devcli needs Node >= 22"}`);
+    // 2. ffmpeg / ffprobe (HARD requirement).
+    const ffmpegPath = await resolveFfmpeg();
+    const ffprobePath = await resolveFfprobe();
+    const ffmpegOk = await hasFfmpeg();
+    add("ffmpeg", ffmpegOk ? "ok" : "fail", ffmpegOk ? ffmpegPath : "not found (bundled ffmpeg-static missing and none on PATH) — media commands cannot run");
+    add("ffprobe", existsSync(ffprobePath) || spawnSync(ffprobePath, ["-version"], { stdio: "ignore" }).status === 0 ? "ok" : "warn", ffprobePath);
+    // 3. hyperframes CLI (local engines: Kokoro tts, whisper stt, matting, capture, beats).
+    const hyperframesCli = resolveHyperframesCli();
+    add("hyperframes", hyperframesCli ? "ok" : "warn", hyperframesCli ?? "not installed — local engines (tts/transcribe/remove-background/capture/beats) will fall back to `npx -y hyperframes`");
+    // 4. Chrome for the in-process render (stills / serve local render).
+    const chrome = detectChromeForRender();
+    add("chrome", chrome.found ? "ok" : "warn", chrome.found ? chrome.detail : `${chrome.detail} — local render/stills will try to download one on first run`);
+    // 5. Vidfarm cloud auth.
+    const apiKey = parsed.values["api-key"] ?? process.env.VIDFARM_API_KEY;
+    if (apiKey) {
+        const who = await fetchWhoami(String(parsed.values.host).replace(/\/+$/, ""), apiKey);
+        add("vidfarm auth", who.ok ? "ok" : "warn", who.detail);
+    }
+    else {
+        add("vidfarm auth", "warn", "VIDFARM_API_KEY not set — cloud commands need it (local serve/lint/stills/speech engines work without it)");
+    }
+    // 6. Provider keys in env (BYOK local-first engines).
+    const presentKeys = PROVIDER_KEY_ENV_VARS.filter((name) => process.env[name]?.trim());
+    add("provider keys", presentKeys.length > 0 ? "ok" : "warn", presentKeys.length > 0
+        ? presentKeys.join(", ")
+        : "none of OPENAI/GEMINI/OPENROUTER/ELEVENLABS_API_KEY set — BYOK speech/clip tagging unavailable (keyless local engines still work)");
+    // 7. Local agent CLI (claude / codex) for clips scan etc.
+    const agent = detectLocalAgent();
+    add("agent CLI", agent ? "ok" : "warn", agent ? `${agent.kind} (${agent.bin})` : "no claude/codex CLI on PATH — `clips scan` falls back to provider keys");
+    // 8. Poisoned-env traps.
+    if (process.env.AWS_PROFILE?.trim()) {
+        add("env AWS_PROFILE", "warn", `AWS_PROFILE=${process.env.AWS_PROFILE} is set — it can hijack AWS SDK auth; run \`env -u AWS_PROFILE\` or unset it`);
+    }
+    else {
+        add("env AWS_PROFILE", "ok", "not set");
+    }
+    const poisoned = SERVE_BLANKED_ENV_VARS.filter((name) => process.env[name]?.trim());
+    add("env cloud ARNs/URLs", poisoned.length > 0 ? "warn" : "ok", poisoned.length > 0
+        ? `${poisoned.join(", ")} set — outside \`vidfarm serve\` these route local work to cloud infra (serve blanks them itself)`
+        : "no stray cloud ARNs/URLs in env");
+    // 9. Port 3000 (default serve port).
+    const portBusy = await isPortInUse(3000);
+    add("port 3000", portBusy ? "warn" : "ok", portBusy ? "in use — a serve box may already be running (or pass --port to serve)" : "free");
+    // 10. HeyGen credential file — vidfarm never uses it.
+    const heygenCredentials = path.join(homedir(), ".heygen", "credentials");
+    if (existsSync(heygenCredentials) || existsSync(path.join(homedir(), ".heygen", "credentials.json"))) {
+        add("heygen credentials", "warn", "found a HeyGen credential file — vidfarm never uses it; local engines and vidfarm BYOK keys are the only auth");
+    }
+    else {
+        add("heygen credentials", "ok", "none (vidfarm never uses HeyGen accounts)");
+    }
+    // 11. Installed agent skills.
+    const skills = countInstalledSkills();
+    add("agent skills", skills.count > 0 ? "ok" : "warn", skills.count > 0
+        ? `${skills.count} installed under ${skills.root}/.agents/skills`
+        : "no .agents/skills found walking up from cwd — run `vidfarm skills add <names…>`");
+    const ffmpegMissing = checks.some((check) => check.name === "ffmpeg" && check.level === "fail");
+    if (json) {
+        process.stdout.write(`${JSON.stringify({ ok: !ffmpegMissing, checks }, null, 2)}\n`);
+    }
+    else {
+        for (const check of checks) {
+            const mark = check.level === "ok" ? `${GREEN}✓${RESET}` : check.level === "warn" ? `${YELLOW}⚠${RESET}` : `${RED}✗${RESET}`;
+            console.log(`${mark} ${check.name.padEnd(20)} ${DIM}${check.detail}${RESET}`);
+        }
+        if (ffmpegMissing) {
+            console.log(`\n${RED}ffmpeg is a hard requirement — install it (or \`npm i ffmpeg-static\`) and re-run.${RESET}`);
+        }
+    }
+    if (ffmpegMissing)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/src/devcli/hyperframes-cli.js

@@ -0,0 +1,118 @@
+// Guarded bridge to the bundled `hyperframes` npm CLI — the devcli's local
+// media engine. Only the LOCAL, account-free commands are reachable through
+// this module (tts / transcribe / remove-background / capture / beats / …);
+// the HeyGen account + telemetry surface (`auth`, `cloud`, `publish`, `play`,
+// `feedback`, `telemetry`) is rejected outright so no vidfarm command can ever
+// touch a HeyGen account, even by accident.
+//
+// Every spawn additionally hardens the child env:
+//   - HYPERFRAMES_NO_TELEMETRY=1  → no anonymous usage pings
+//   - HYPERFRAMES_SKIP_SKILLS=1   → no skill-install prompts in pipelines
+//   - HEYGEN_CONFIG_DIR=<fresh empty temp dir> → a stray ~/.heygen credential
+//     can NEVER be picked up (some hyperframes commands silently flip their
+//     audio-provider preference when a HeyGen credential is present).
+import { spawn } from "node:child_process";
+import { mkdtempSync } from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const BLOCKED_SUBCOMMANDS = new Set(["auth", "cloud", "publish", "play", "feedback", "telemetry"]);
+/**
+ * Locate the bundled hyperframes CLI entrypoint by walking node_modules from
+ * this module's directory first (the published devcli package carries the
+ * dependency), then from process.cwd() (running inside a repo that installed
+ * it). Returns null when the package is not installed anywhere reachable.
+ */
+export function resolveHyperframesCli() {
+    const anchors = [path.dirname(fileURLToPath(import.meta.url)), process.cwd()];
+    for (const anchor of anchors) {
+        try {
+            const localRequire = createRequire(path.join(anchor, "__resolve__.js"));
+            return localRequire.resolve("hyperframes/dist/cli.js");
+        }
+        catch {
+            // keep walking — try the next anchor
+        }
+    }
+    return null;
+}
+/**
+ * Run `hyperframes <subcommand> ...args` with the hardened env described in
+ * the module header. Falls back to `npx -y hyperframes` when the package
+ * cannot be resolved locally. Throws on blocked subcommands; resolves with
+ * the exit code + captured output (empty strings in inherit mode).
+ */
+export async function runHyperframesCommand(subcommand, args, opts = {}) {
+    if (BLOCKED_SUBCOMMANDS.has(subcommand)) {
+        throw new Error(`hyperframes ${subcommand} is blocked: vidfarm never uses HeyGen accounts or telemetry. ` +
+            "Local engines and vidfarm BYOK keys are the only auth.");
+    }
+    const cli = resolveHyperframesCli();
+    // Fresh empty config dir per invocation — guarantees no ~/.heygen credential
+    // (or any other persisted account state) leaks into the child process.
+    const emptyConfigDir = mkdtempSync(path.join(os.tmpdir(), "vidfarm-hf-noauth-"));
+    const env = {
+        ...process.env,
+        HYPERFRAMES_NO_TELEMETRY: "1",
+        HYPERFRAMES_SKIP_SKILLS: "1",
+        HEYGEN_CONFIG_DIR: emptyConfigDir,
+        ...opts.env
+    };
+    const [bin, baseArgs] = cli
+        ? [process.execPath, [cli]]
+        : ["npx", ["-y", "hyperframes"]];
+    const capture = opts.stdio === "capture";
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(bin, [...baseArgs, subcommand, ...args], {
+            cwd: opts.cwd,
+            env,
+            stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit"
+        });
+        let stdout = "";
+        let stderr = "";
+        if (capture) {
+            child.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
+            child.stderr?.on("data", (chunk) => (stderr += chunk.toString()));
+        }
+        child.on("error", (error) => {
+            rejectPromise(error.code === "ENOENT"
+                ? new Error("Could not launch the hyperframes CLI (not installed and npx unavailable). Run `npm i hyperframes` in your project.")
+                : error);
+        });
+        child.on("close", (code) => {
+            resolvePromise({ code: code ?? 1, stdout, stderr });
+        });
+    });
+}
+/** Parse the last JSON object printed by a captured hyperframes --json run
+ * (tolerates both compact single-line and pretty multi-line output, with log
+ * lines interleaved before it). */
+export function parseHyperframesJson(output) {
+    const trimmed = output.trim();
+    if (!trimmed)
+        return null;
+    // Whole output is the JSON document (the common --json case).
+    try {
+        const whole = JSON.parse(trimmed);
+        if (whole && typeof whole === "object")
+            return whole;
+    }
+    catch { /* fall through */ }
+    // Log lines first, JSON at the end: parse from each line that opens an
+    // object through the end of the output, scanning bottom-up.
+    const lines = trimmed.split("\n");
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+        if (!lines[i].trimStart().startsWith("{"))
+            continue;
+        const candidate = lines.slice(i).join("\n").trim();
+        try {
+            const parsed = JSON.parse(candidate);
+            if (parsed && typeof parsed === "object")
+                return parsed;
+        }
+        catch { /* keep scanning upward */ }
+    }
+    return null;
+}
+//# sourceMappingURL=hyperframes-cli.js.map