@mevdragon/vidfarm-devcli 0.6.0 → 0.7.1

package/dist/src/app.js

@@ -21,6 +21,7 @@ import { writeForkManifest } from "./services/fork-manifest.js";
 import { renderHelpPage } from "./help-page.js";
 import { renderHomepage } from "./homepage.js";
 import { COMPOSITION_RUNTIME_SCRIPT_BODY } from "./composition-runtime.js";
+import { KEN_BURNS_CSS, KEN_BURNS_STYLE_MARKER } from "./hyperframes/composition.js";
 import { normalizeCompositionZIndexHtml, sanitizeCompositionHtml } from "./services/composition-sanitize.js";
 import { applyMarkupUsd } from "./services/billing-pricing.js";
 import { primitiveRegistry } from "./primitive-registry.js";
@@ -49,6 +50,7 @@ import { createPrimitiveJobContext } from "./primitive-context.js";
 import { buildPendingCastState, castMemberFromRaw, extractCastStill, isolateCastMember } from "./services/cast.js";
 import { MediaDurationExceededError, probeMediaAsset } from "./services/media-processing.js";
 import { estimateGhostcutCostUsd, isGhostcutConfigured, mirrorGhostcutVideoToStorage, pollStatus as pollGhostcutStatus, submitSubtitleRemoval } from "./services/ghostcut.js";
+import { hasUpstreamKey, isUpstreamEnabled, proxyRequestToUpstream, seedFromUpstream, upstreamHost, upstreamJson } from "./services/upstream.js";
 import { TemplateSourceService } from "./services/template-sources.js";
 import { TemplateSourceAlreadyRegisteredError } from "./services/template-sources.js";
 import { renderCustomInpaintPage } from "./template-editor-pages.js";
@@ -1576,6 +1578,9 @@ function primitiveOperationPathForJob(job) {
     if (job.templateId === "primitive:video_trim" && job.operationName === "run") {
         return `${PRIMITIVES_PREFIX}/videos/trim`;
     }
+    if (job.templateId === "primitive:video_remove_captions" && job.operationName === "run") {
+        return `${PRIMITIVES_PREFIX}/videos/remove-captions`;
+    }
     if (job.templateId === "primitive:video_extract_audio" && job.operationName === "run") {
         return `${PRIMITIVES_PREFIX}/videos/extract-audio`;
     }
@@ -3061,6 +3066,7 @@ function buildPrimitiveEditorDocsRoutes() {
         { method: "POST", path: `${PRIMITIVES_PREFIX}/media/dedupe`, summary: "Primitive dedupe transform for any image or video. Body must be { tracer, payload: { source_media_url, media_type?: \"image\"|\"video\", effects?: { zoom?, tilt?, rotate?, saturation?, speed?, horizontal_flip?, contrast?, brightness?, hue_rotate?, blur? }, tint_color?, tint_opacity?, width?, height?, duration_ms?, fallback_duration_ms?, object_fit?, background_color?, muted?, volume?, output_format? }, webhook_url? }. Use to camouflage reused media by applying small transforms (zoom/tilt/rotate/filter/tint) before republishing." },
         { method: "POST", path: `${PRIMITIVES_PREFIX}/timeline/render`, summary: "Primitive timeline/layer render job. Body must be { tracer, payload: { composition_html | composition: { composition_id, width?, height?, fps?, layers: [{ id, kind, start, duration, src?, text?, html?, x?, y?, width?, height?, track?, z? }] }, chunk_size?, max_parallel_chunks?, output_key? }, webhook_url? }. Use this instead of creating new per-template REST APIs." },
         { method: "POST", path: `${PRIMITIVES_PREFIX}/videos/trim`, summary: "Primitive video trim job. Body must be { tracer, payload: { source_video_url, start_ms, duration_ms|end_ms, max_width?, max_height?, crf?, preset?, audio_bitrate_kbps? }, webhook_url? }." },
+        { method: "POST", path: `${PRIMITIVES_PREFIX}/videos/remove-captions`, summary: "Primitive caption-removal job. Removes burned-in captions/subtitles/on-screen text from a source video (GhostCut) and returns a durable caption-free platform MP4. Body must be { tracer, payload: { source_video_url }, webhook_url? }. Async job that typically takes a few minutes; bills ~$0.10 per 30 seconds of source video. Also reachable at POST /api/v1/primitives/remove-video-captions." },
         { method: "POST", path: `${PRIMITIVES_PREFIX}/videos/extract-audio`, summary: "Primitive audio extraction job from a source video. Body must be { tracer, payload: { source_video_url, output_format?, audio_bitrate_kbps? }, webhook_url? }." },
         { method: "POST", path: `${PRIMITIVES_PREFIX}/videos/probe`, summary: "Primitive video probe job. Body must be { tracer, payload: { source_video_url }, webhook_url? }. Returns durable JSON metadata." },
         { method: "POST", path: `${PRIMITIVES_PREFIX}/videos/extract-frame`, summary: "Primitive video frame extraction job. Body must be { tracer, payload: { source_video_url, at_ms?, output_format? }, webhook_url? }." },
@@ -3485,12 +3491,13 @@ function normalizeEditorChatPath(input) {
         // /discover/templates (a different prefix) and stays out of reach.
         "/discover/feed",
         VIDEOS_PREFIX,
-        // Read-only ghostcut state per fork so the AI can pick between the original
-        // upload and the subtitle-removed mirror before feeding a video into a
-        // primitive route. Only the GET /ghostcut variant is exercised by the AI —
-        // POST /ghostcut-poll advances the job so the copilot must be explicit
-        // about wanting it, but it lives under the same prefix and is protected by
-        // its own auth guard, which is fine.
+        // Read-only subtitle-removal state per fork so the AI can pick between the
+        // original upload and the caption-free mirror before feeding a video into a
+        // primitive route. Only the GET /remove-video-captions variant (legacy
+        // alias: /ghostcut) is exercised by the AI — POST /remove-video-captions-poll
+        // advances the job so the copilot must be explicit about wanting it, but it
+        // lives under the same prefix and is protected by its own auth guard, which
+        // is fine.
         COMPOSITIONS_PREFIX
     ];
     const parsed = trimmed.startsWith("http://") || trimmed.startsWith("https://")
@@ -3621,7 +3628,7 @@ function normalizeOperationRequestTracer(tracer) {
 }
 function createTemplateHttpTool(input) {
     return tool({
-        description: "Call exactly one Vidfarm REST API route and inspect the response before deciding the next call. Use template routes for metadata, skill, config, operations, jobs, logs, and cancel routes. Use primitive routes under /api/v1/primitives for reusable image generation, image editing, inpainting, still rendering, social/media video download, AI video generation, video slide rendering, video trim/extract/probe/mute/concat operations, audio trim/probe/concat/normalize operations, brainstorm strategy routes, and primitive job inspection; these primitive routes are allowed directly from editor chat even when they are not specific to the current template. Primitive POST bodies must use { tracer, payload: { ...primitive fields... }, webhook_url? }; do not put prompt, source_image_url, instruction, slides, html, or other primitive fields at the top level. Never say primitive image generation, image edit, inpaint, HTML render, video download, AI video generation, trim, probe, extract-audio, concat, mute, video render, or brainstorm routes are unavailable here when the route exists. If the user asks to generate a new image similar to an attachment, call POST /api/v1/primitives/images/generate with body { tracer, payload: { prompt, prompt_attachments: [exact attachment URL] } }. If the user asks to revise the attached image itself, call POST /api/v1/primitives/images/edit with body { tracer, payload: { source_image_url, instruction } }. If the user asks to download a social/media post into a durable MP4, call POST /api/v1/primitives/videos/download with body { tracer, payload: { source_url|video_url|url, quality?: \"best\"|\"hd\"|\"full_hd\" } }. If the user asks to generate a new AI video, call POST /api/v1/primitives/videos/generate with body { tracer, payload: { prompt, provider?: \"openai\"|\"gemini\"|\"openrouter\", duration?: seconds, input_references?: [direct image asset URL], frame_images?: [{ image_url, frame_type }] } }; never send webpage or social post URLs in input_references. duration is seconds, not milliseconds, and duration_ms belongs only to /videos/render-slides slides. Default video models are openai/sora-2, gemini/veo-3.0-generate-001, and openrouter/bytedance/seedance-2.0. Use POST /api/v1/primitives/videos/render-slides only to assemble existing media URLs into an MP4 slideshow. Use POST /api/v1/primitives/media/dedupe to apply subtle dedupe transforms (zoom/tilt/rotate/saturation/speed/horizontal_flip/contrast/brightness/hue_rotate/blur/tint) to any image or video URL, with body { tracer, payload: { source_media_url, media_type?, effects?, tint_color?, tint_opacity?, width?, height?, duration_ms?, object_fit?, background_color?, output_format? }, webhook_url? }. Use POST /api/v1/primitives/videos/trim for clipping, /videos/extract-audio for demuxing, /videos/probe or /audio/probe for metadata-only JSON outputs, /videos/extract-frame for stills, /videos/mute to remove audio, /videos/replace-audio to swap tracks, /videos/concat for sequential muted MP4 joins, /audio/trim for clipped audio, /audio/concat for stitched audio, and /audio/normalize for leveled/re-encoded audio. If the user explicitly asks for hooks, angles, awareness-stage advice, or a cold-start strategy questionnaire, call the matching brainstorm route immediately instead of brainstorming in chat from memory. Use POST /api/v1/primitives/brainstorm/coldstart when the customer is starting from zero, /brainstorm/awareness_stages when they do not know what ad types to make, /brainstorm/angles when they want persuasive angles, and /brainstorm/hooks when they want many openings. Product placement is a first-class brainstorm primitive like angles and hooks: when the user wants to identify product-placement opportunities in a video or repurpose a video into a native ad for their product, call POST /api/v1/primitives/brainstorm/product_placement with body { tracer, payload: { source_video_url, offer_description }, webhook_url? } — it watches the video and returns timestamped native placement opportunities and prefers a Gemini key. You may also analyze an attached video directly to answer product-placement questions conversationally instead of the primitive when the user just wants a quick take. For brainstorm routes, do not send count by default; only include count when the user explicitly asks for a specific number of hooks, angles, questions, or opportunities. When brainstorm jobs finish and the response includes a JSON artifact, tell the user to open and review that JSON in the chat UI because it contains the structured output. When the user asks for content ideas or says they do not know where to start, prefer the sequence coldstart -> awareness_stages -> angles -> hooks, then use the output to choose templates. For template operation POST bodies, use top-level template_preview_media=\"auto\" by default, \"include\" when the user wants the template to use catalog preview media as references where supported, and \"exclude\" when the user asks not to use preview media as references. Templates decide which generation steps honor that policy. If a POST returns a queued job, do not poll it in this same response; continue with any remaining requested POST calls, then summarize the queued job ids and tracers. If you know a job_id but not the template or primitive, use GET /api/v1/user/me/jobs/:jobId or its /logs and /artifacts subroutes instead of paging through job lists. Use GET /api/v1/compositions/:forkId/ghostcut to look up both the original source video URL and the subtitle-removed mirrored URL for the current fork before feeding a video URL into a primitive route; this is a read-only, non-billing status check — never confuse it with POST /ghostcut-poll (which advances the job and can bill). Use POST /api/v1/approved/posts with title, caption, pinned_comment, media URLs, and tracer to approve a finished output into a preview/share page. Use POST /api/v1/approved/posts/:postId/schedules with destination_type, destination_id, scheduled_at, timezone, and optional settings/additional_notes to schedule an approved post. When a rendered video was built from slideshow frame images, include both versions in one media array: final MP4 first with kind=\"video\" and role=\"primary\", then every finished captioned slide frame image in order with kind=\"image\" and role=\"slide\". Prefer create-slideshow result.renderVideoInput.slides[].imageUrl or result.slides[].frameImageUrl for carousel media; do not use backgroundImageUrl, manifests, thumbnails, or a partial files array as the full slide set. If the user supplies exact media file URLs for approval, use those URLs as the backup source of truth, preserve their order, infer kind when needed, and assign primary/video and slide/image roles correctly. If the user asks for N distinct generated outputs, make N sequential POST calls rather than one combined POST and do not stop after the first queued job.",
+        description: "Call exactly one Vidfarm REST API route and inspect the response before deciding the next call. Use template routes for metadata, skill, config, operations, jobs, logs, and cancel routes. Use primitive routes under /api/v1/primitives for reusable image generation, image editing, inpainting, still rendering, social/media video download, AI video generation, video slide rendering, burned-in caption removal, video trim/extract/probe/mute/concat operations, audio trim/probe/concat/normalize operations, brainstorm strategy routes, and primitive job inspection; these primitive routes are allowed directly from editor chat even when they are not specific to the current template. Primitive POST bodies must use { tracer, payload: { ...primitive fields... }, webhook_url? }; do not put prompt, source_image_url, instruction, slides, html, or other primitive fields at the top level. Never say primitive image generation, image edit, inpaint, HTML render, video download, AI video generation, caption removal, trim, probe, extract-audio, concat, mute, video render, or brainstorm routes are unavailable here when the route exists. If the user asks to generate a new image similar to an attachment, call POST /api/v1/primitives/images/generate with body { tracer, payload: { prompt, prompt_attachments: [exact attachment URL] } }. If the user asks to revise the attached image itself, call POST /api/v1/primitives/images/edit with body { tracer, payload: { source_image_url, instruction } }. If the user asks to download a social/media post into a durable MP4, call POST /api/v1/primitives/videos/download with body { tracer, payload: { source_url|video_url|url, quality?: \"best\"|\"hd\"|\"full_hd\" } }. If the user asks to generate a new AI video, call POST /api/v1/primitives/videos/generate with body { tracer, payload: { prompt, provider?: \"openai\"|\"gemini\"|\"openrouter\", duration?: seconds, input_references?: [direct image asset URL], frame_images?: [{ image_url, frame_type }] } }; never send webpage or social post URLs in input_references. duration is seconds, not milliseconds, and duration_ms belongs only to /videos/render-slides slides. Default video models are openai/sora-2, gemini/veo-3.0-generate-001, and openrouter/bytedance/seedance-2.0. Use POST /api/v1/primitives/videos/render-slides only to assemble existing media URLs into an MP4 slideshow. Use POST /api/v1/primitives/media/dedupe to apply subtle dedupe transforms (zoom/tilt/rotate/saturation/speed/horizontal_flip/contrast/brightness/hue_rotate/blur/tint) to any image or video URL, with body { tracer, payload: { source_media_url, media_type?, effects?, tint_color?, tint_opacity?, width?, height?, duration_ms?, object_fit?, background_color?, output_format? }, webhook_url? }. Use POST /api/v1/primitives/videos/trim for clipping, /videos/extract-audio for demuxing, /videos/probe or /audio/probe for metadata-only JSON outputs, /videos/extract-frame for stills, /videos/mute to remove audio, /videos/replace-audio to swap tracks, /videos/concat for sequential muted MP4 joins, /audio/trim for clipped audio, /audio/concat for stitched audio, and /audio/normalize for leveled/re-encoded audio. If the user asks to remove burned-in captions, subtitles, or on-screen text from a video, call POST /api/v1/primitives/videos/remove-captions with body { tracer, payload: { source_video_url } } — an async job that returns a durable caption-free MP4 and bills about $0.10 per 30 seconds of source video. If the user explicitly asks for hooks, angles, awareness-stage advice, or a cold-start strategy questionnaire, call the matching brainstorm route immediately instead of brainstorming in chat from memory. Use POST /api/v1/primitives/brainstorm/coldstart when the customer is starting from zero, /brainstorm/awareness_stages when they do not know what ad types to make, /brainstorm/angles when they want persuasive angles, and /brainstorm/hooks when they want many openings. Product placement is a first-class brainstorm primitive like angles and hooks: when the user wants to identify product-placement opportunities in a video or repurpose a video into a native ad for their product, call POST /api/v1/primitives/brainstorm/product_placement with body { tracer, payload: { source_video_url, offer_description }, webhook_url? } — it watches the video and returns timestamped native placement opportunities and prefers a Gemini key. You may also analyze an attached video directly to answer product-placement questions conversationally instead of the primitive when the user just wants a quick take. For brainstorm routes, do not send count by default; only include count when the user explicitly asks for a specific number of hooks, angles, questions, or opportunities. When brainstorm jobs finish and the response includes a JSON artifact, tell the user to open and review that JSON in the chat UI because it contains the structured output. When the user asks for content ideas or says they do not know where to start, prefer the sequence coldstart -> awareness_stages -> angles -> hooks, then use the output to choose templates. For template operation POST bodies, use top-level template_preview_media=\"auto\" by default, \"include\" when the user wants the template to use catalog preview media as references where supported, and \"exclude\" when the user asks not to use preview media as references. Templates decide which generation steps honor that policy. If a POST returns a queued job, do not poll it in this same response; continue with any remaining requested POST calls, then summarize the queued job ids and tracers. If you know a job_id but not the template or primitive, use GET /api/v1/user/me/jobs/:jobId or its /logs and /artifacts subroutes instead of paging through job lists. Use GET /api/v1/compositions/:forkId/remove-video-captions to look up both the original source video URL and the subtitle-removed mirrored URL for the current fork before feeding a video URL into a primitive route; this is a read-only, non-billing status check — never confuse it with POST /remove-video-captions-poll (which advances the fork's decompose-time subtitle-removal job and can bill). Use POST /api/v1/approved/posts with title, caption, pinned_comment, media URLs, and tracer to approve a finished output into a preview/share page. Use POST /api/v1/approved/posts/:postId/schedules with destination_type, destination_id, scheduled_at, timezone, and optional settings/additional_notes to schedule an approved post. When a rendered video was built from slideshow frame images, include both versions in one media array: final MP4 first with kind=\"video\" and role=\"primary\", then every finished captioned slide frame image in order with kind=\"image\" and role=\"slide\". Prefer create-slideshow result.renderVideoInput.slides[].imageUrl or result.slides[].frameImageUrl for carousel media; do not use backgroundImageUrl, manifests, thumbnails, or a partial files array as the full slide set. If the user supplies exact media file URLs for approval, use those URLs as the backup source of truth, preserve their order, infer kind when needed, and assign primary/video and slide/image roles correctly. If the user asks for N distinct generated outputs, make N sequential POST calls rather than one combined POST and do not stop after the first queued job.",
         inputSchema: z.object({
             method: z.enum(["GET", "POST"]).describe("HTTP method to use."),
             path: z.string().min(1).describe("Absolute path or same-origin URL for an allowed Vidfarm REST route."),
@@ -4134,6 +4141,8 @@ function createEditorActionTool() {
             background_style: z.enum(["plain", "outline", "highlight-solid", "highlight-translucent"]).optional().describe("Text background treatment."),
             object_fit: z.string().optional().describe("CSS object-fit for image/video (cover, contain, fill, none, scale-down)."),
             object_position: z.string().optional().describe("CSS object-position for image/video (e.g., center, top, bottom left)."),
+            ken_burns: z.enum(["zoom-in", "zoom-out", "pan-left", "pan-right", "pan-up", "pan-down", "zoom-in-left", "zoom-in-right", "none"]).optional().describe("Ken Burns motion for still-image layers: a slow pan/zoom spanning the clip's full duration. Apply with set_layer_media on an existing image, or seed it on add_layer/generate_layer when kind/media_type is image. 'none' removes the effect. When the user says 'animate the images' / 'ken burns', apply it to every still image, varying presets across adjacent clips (zoom-in, pan-left, zoom-out, ...) for a documentary feel."),
+            ken_burns_intensity: z.number().optional().describe("Ken Burns strength: extra zoom / pan travel as a fraction of the frame, 0.04-0.5 (default 0.18; ~0.1 subtle, ~0.3 dramatic). Only meaningful alongside ken_burns."),
             volume: z.number().optional().describe("Volume 0..1 for audio/video."),
             muted: z.boolean().optional().describe("Toggle mute on audio/video."),
             group_label: z.string().optional().describe("Optional label for group_layers."),
@@ -4508,6 +4517,21 @@ function rewriteHyperframesDraftCompositionHtml(html, draftPath) {
             rewritten = `${rewritten}\n${runtimeTag}`;
         }
     }
+    // Ken Burns keyframes: always available in the editor iframe so toggling
+    // data-kenburns on a layer animates immediately, even for compositions
+    // stored before the builder embedded the stylesheet.
+    if (!rewritten.includes(KEN_BURNS_STYLE_MARKER)) {
+        const kenBurnsTag = `<style data-vf-kenburns="true">${KEN_BURNS_CSS}</style>`;
+        if (/<\/head>/i.test(rewritten)) {
+            rewritten = rewritten.replace(/<\/head>/i, `${kenBurnsTag}\n</head>`);
+        }
+        else if (/<\/body>/i.test(rewritten)) {
+            rewritten = rewritten.replace(/<\/body>/i, `${kenBurnsTag}\n</body>`);
+        }
+        else {
+            rewritten = `${rewritten}\n${kenBurnsTag}`;
+        }
+    }
     return rewritten;
 }
 async function renderHyperframesStudioEditorPage(input) {
@@ -4527,7 +4551,12 @@ async function renderHyperframesStudioEditorPage(input) {
         vidfarmApiKey: input.customer ? await getVisibleApiKey(input.customer.id) : null,
         // Only `vidfarm serve` (local disk) streams on-disk edits back to the tab;
         // deployed environments have nothing to watch, so the client skips the SSE.
-        liveReload: config.STORAGE_DRIVER === "local"
+        liveReload: config.STORAGE_DRIVER === "local",
+        // Cloud passthrough (vidfarm serve): when this box renders in-process AND
+        // an upstream key is configured, the editor's Render button becomes a
+        // popover offering "Render Local (Free)" vs "Render in Cloud".
+        localRender: !config.VIDFARM_JOB_STATE_MACHINE_ARN,
+        cloudRenderAvailable: hasUpstreamKey()
     };
     return `<!doctype html>
 <html lang="en">
@@ -4589,7 +4618,20 @@ app.get("/editor/:templateId", async (c) => {
     const customer = await getOptionalPreferredBrowserCustomer(c);
     if (!templateId.startsWith("template_"))
         return c.notFound();
-    const template = await serverlessRecords.getTemplate(templateId);
+    let template = await serverlessRecords.getTemplate(templateId);
+    // Cloud passthrough (vidfarm serve): first open of an upstream catalog
+    // template (clicked on the proxied /discover feed) — pull its composition
+    // and mint the local template + fork records, then continue as if it had
+    // always been local. Only the editor's working data lands on disk.
+    if (!template && isUpstreamEnabled() && customer) {
+        await seedFromUpstream({
+            customerId: customer.id,
+            templateId,
+            forkId: c.req.query("fork") ?? undefined,
+            shareToken: readShareToken(c) ?? undefined
+        });
+        template = await serverlessRecords.getTemplate(templateId);
+    }
     if (!template)
         return c.notFound();
     // Private templates are only openable by their owner; 404 (not 403) so the
@@ -4606,7 +4648,19 @@ app.get("/editor/:templateId", async (c) => {
     // instead of a broken URL.
     let effectiveForkParam = forkParam ?? null;
     if (effectiveForkParam) {
-        const forkRecord = await serverlessRecords.getCompositionFork(effectiveForkParam);
+        let forkRecord = await serverlessRecords.getCompositionFork(effectiveForkParam);
+        // Cloud passthrough: an unknown ?fork= on a known template is an upstream
+        // fork the user opened from the cloud catalog — seed it locally too.
+        if (!forkRecord && isUpstreamEnabled() && customer) {
+            const seeded = await seedFromUpstream({
+                customerId: customer.id,
+                templateId,
+                forkId: effectiveForkParam,
+                shareToken: readShareToken(c) ?? undefined
+            });
+            if (seeded)
+                forkRecord = await serverlessRecords.getCompositionFork(effectiveForkParam);
+        }
         if (!forkRecord || forkRecord.deletedAt) {
             effectiveForkParam = null;
         }
@@ -4737,6 +4791,24 @@ app.get("/discover/feed", async (c) => {
         if (entry)
             templateEntries.push(entry);
     }
+    // Cloud passthrough (vidfarm serve): the local records are just the working
+    // set of seeded templates, so surface the upstream (cloud) catalog behind
+    // them. Local entries win on id conflicts — a seeded template also exists
+    // upstream and the local copy reflects any local edits. Fail-soft: an
+    // unreachable upstream degrades to the local-only feed.
+    if (isUpstreamEnabled()) {
+        const search = new URLSearchParams({ limit: String(limit) });
+        if (query)
+            search.set("q", query);
+        const upstreamFeed = (await upstreamJson(`/discover/feed?${search.toString()}`)).json?.templates ?? [];
+        const seen = new Set(templateEntries.map((entry) => entry.templateId));
+        for (const entry of upstreamFeed) {
+            if (entry && typeof entry.templateId === "string" && !seen.has(entry.templateId)) {
+                templateEntries.push(entry);
+                seen.add(entry.templateId);
+            }
+        }
+    }
     // The public feed is identical for every caller, but a logged-in response
     // interleaves the caller's private templates — never let a shared cache
     // serve that to someone else.
@@ -4752,7 +4824,10 @@ function buildTemplateHomepageEntry(template) {
     if (!template.videoUrl)
         return null;
     const isPrivate = template.visibility === "private";
-    const title = isPrivate ? (template.title || template.id) : template.id;
+    // Older records stored the source host ("youtube.com") as a title fallback —
+    // never show that as a card title; the template id is the canonical default.
+    const storedTitle = template.title && template.title !== template.sourceHost ? template.title : null;
+    const title = isPrivate ? (storedTitle || template.id) : template.id;
     const previewUrl = template.thumbnailUrl || template.videoUrl || null;
     return {
         title,
@@ -4788,17 +4863,213 @@ const DISCOVER_SUBMISSION_HOSTS = [
 function isSupportedDiscoverSubmissionHost(host) {
     return DISCOVER_SUBMISSION_HOSTS.some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
 }
-// Discover "Add Template": ingest a social video URL as a PRIVATE inspiration
-// owned by the caller. The download job runs async; /discover/feed finalizes
-// it and mints the private template once the video lands.
+// Upload cap for "Add Template → upload a video". Generous relative to the
+// 50 MB My Files cap because template sources are full short-form videos; the
+// bytes go straight to S3 via presigned PUT, never through a Lambda body.
+const INSPIRATION_UPLOAD_MAX_BYTES = 200 * 1024 * 1024;
+function isUploadableInspirationVideo(fileName, contentType) {
+    if (contentType.startsWith("video/"))
+        return true;
+    return [".mp4", ".m4v", ".mov", ".webm"].includes(path.extname(fileName).toLowerCase());
+}
+function isOwnInspirationUploadKey(storageKey, customerId) {
+    return storageKey.startsWith(`users/${customerId}/inspiration-uploads/`);
+}
+// Discover "Add Template" (upload, step 1 of 3): mint a write target for a
+// local video file. Contract shared by web + devcli: presign here (JSON), PUT
+// (or multipart-fallback POST) the bytes, then POST /discover/templates with
+// { upload: { storage_key, file_name } } to queue the ingest. In `vidfarm
+// serve` cloud-passthrough mode this proxies upstream so the client PUTs
+// straight to cloud S3 and the ingest lands in the cloud account — multipart
+// bodies can't proxy (text-only proxy), so proxying the presign avoids ever
+// needing to.
+app.post("/discover/templates/upload/presign", async (c) => {
+    const customer = await requireBrowserCustomer(c);
+    if (!customer)
+        return c.json({ ok: false, error: "Log in to add templates." }, 401);
+    if (hasUpstreamKey()) {
+        const proxied = await proxyRequestToUpstream(c);
+        if (proxied)
+            return proxied;
+    }
+    const body = asRecord(await c.req.json().catch(() => ({}))) ?? {};
+    const fileName = sanitizeFileName(readNonEmptyString(body.file_name) ?? "upload.mp4");
+    const contentType = readNonEmptyString(body.content_type) ?? inferAttachmentContentType(fileName);
+    if (!isUploadableInspirationVideo(fileName, contentType)) {
+        return c.json({ ok: false, error: "Upload a video file (MP4, MOV, or WebM)." }, 400);
+    }
+    const sizeBytes = Number(body.size_bytes);
+    if (Number.isFinite(sizeBytes) && sizeBytes > INSPIRATION_UPLOAD_MAX_BYTES) {
+        return c.json({ ok: false, error: "Video uploads can be at most 200 MB." }, 400);
+    }
+    const uploadId = randomUUID();
+    const storageKey = storage.inspirationUploadKey(customer.id, uploadId, fileName);
+    if (config.STORAGE_DRIVER !== "s3") {
+        return c.json({
+            transport: "server",
+            upload_id: uploadId,
+            file_name: fileName,
+            content_type: contentType,
+            storage_key: storageKey,
+            upload: {
+                method: "POST",
+                url: "/discover/templates/upload",
+                form_field: "file"
+            }
+        });
+    }
+    const upload = await storage.createWriteUrl(storageKey, { contentType, expiresIn: 3600 });
+    return c.json({
+        transport: "presigned",
+        upload_id: uploadId,
+        file_name: fileName,
+        content_type: contentType,
+        storage_key: storageKey,
+        upload: {
+            method: upload.method,
+            url: upload.url,
+            headers: upload.headers,
+            expires_in_seconds: upload.expiresIn
+        }
+    });
+});
+// Upload step 2 (multipart fallback): only used when presign returned
+// transport "server" — i.e. the local storage driver (vidfarm serve without
+// S3). Deliberately not proxied upstream: the upstream proxy is text-only,
+// and in passthrough mode the presign already handed the client a direct
+// cloud target.
+app.post("/discover/templates/upload", async (c) => {
+    const customer = await requireBrowserCustomer(c);
+    if (!customer)
+        return c.json({ ok: false, error: "Log in to add templates." }, 401);
+    const formData = await c.req.formData().catch(() => null);
+    const file = formData?.get("file");
+    if (!isFormFile(file))
+        return c.json({ ok: false, error: "Select a video file to upload." }, 400);
+    const fileName = sanitizeFileName(file.name || "upload.mp4");
+    const contentType = file.type || inferAttachmentContentType(fileName);
+    if (!isUploadableInspirationVideo(fileName, contentType)) {
+        return c.json({ ok: false, error: "Upload a video file (MP4, MOV, or WebM)." }, 400);
+    }
+    const buffer = Buffer.from(await file.arrayBuffer());
+    if (buffer.byteLength > INSPIRATION_UPLOAD_MAX_BYTES) {
+        return c.json({ ok: false, error: "Video uploads can be at most 200 MB." }, 400);
+    }
+    const uploadId = randomUUID();
+    const storageKey = storage.inspirationUploadKey(customer.id, uploadId, fileName);
+    const stored = await storage.putBuffer(storageKey, buffer, contentType);
+    return c.json({
+        ok: true,
+        storage_key: storageKey,
+        file_name: fileName,
+        content_type: contentType,
+        size_bytes: buffer.byteLength,
+        url: stored.url
+    }, 201);
+});
+// Discover "Add Template": ingest a social video URL — or a video the caller
+// just uploaded via the presign/upload pair above — as a PRIVATE inspiration
+// owned by the caller. The download/ingest job runs async; /discover/feed
+// finalizes it and mints the private template once the video lands.
 app.post("/discover/templates", async (c) => {
     const customer = await requireBrowserCustomer(c);
     if (!customer)
         return c.json({ ok: false, error: "Log in to add templates." }, 401);
     const body = asRecord(await c.req.json().catch(() => ({}))) ?? {};
+    const uploadRef = asRecord(body.upload);
+    const uploadStorageKey = readNonEmptyString(uploadRef?.storage_key);
+    // Cloud passthrough (vidfarm serve): Add Template ingests into the CLOUD
+    // account — the download/ingest job, billing, and catalog entry all live
+    // upstream, and the proxied /discover/feed finalizes it. The one exception:
+    // an upload key minted by THIS box (local presign fallback while upstream
+    // was unreachable) — its bytes only exist locally, so ingest locally.
+    if (hasUpstreamKey() && !(uploadStorageKey && isOwnInspirationUploadKey(uploadStorageKey, customer.id))) {
+        const proxied = await proxyRequestToUpstream(c);
+        if (proxied)
+            return proxied;
+    }
+    if (uploadStorageKey) {
+        if (!isOwnInspirationUploadKey(uploadStorageKey, customer.id)) {
+            return c.json({ ok: false, error: "That upload doesn't belong to this account." }, 403);
+        }
+        const uploadUrl = storage.getPublicUrl(uploadStorageKey);
+        if (!uploadUrl)
+            return c.json({ ok: false, error: "Uploaded video could not be resolved." }, 400);
+        const explicitTitle = readNonEmptyString(body.title) ?? null;
+        const tagline = readNonEmptyString(body.tagline) ?? readNonEmptyString(body.trend_tagline) ?? null;
+        const notes = readNonEmptyString(body.notes) ?? null;
+        const uploadFileName = readNonEmptyString(uploadRef?.file_name) ?? null;
+        const primitive = primitiveRegistry.get("primitive:video_ingest");
+        if (!primitive)
+            return c.json({ ok: false, error: "Video ingest primitive not available" }, 500);
+        const operation = primitive.operations["run"];
+        if (!operation)
+            return c.json({ ok: false, error: "Video ingest operation not available" }, 500);
+        // Only a caller-chosen title flows into the manifest — never the file
+        // name. An untitled upload finalizes with title null so its /discover
+        // card displays the minted template id.
+        const payload = operation.inputSchema.parse({
+            source_video_url: uploadUrl,
+            title: explicitTitle ?? tagline ?? undefined,
+            file_name: uploadFileName ?? undefined,
+            save_manifest: true
+        });
+        let job;
+        try {
+            await assertWalletCanQueueJobs(customer.id);
+            job = await jobs.createRootJob({
+                templateId: primitive.id,
+                operationName: "run",
+                workflowName: operation.workflow,
+                tracer: `discover_template_upload:${customer.id}`,
+                payload,
+                webhookUrl: null,
+                customer,
+                providerHint: undefined
+            });
+        }
+        catch (error) {
+            if (error instanceof InsufficientWalletFundsError)
+                return insufficientFundsResponse(c, error);
+            if (error instanceof ActiveJobLimitExceededError)
+                return activeJobLimitExceededResponse(c, error);
+            throw error;
+        }
+        // No Step Functions worker on a local (vidfarm serve) box — run the ingest
+        // in-process, detached, exactly like local renders. /discover/feed polls
+        // finalize the inspiration when the job lands.
+        if (!config.VIDFARM_JOB_STATE_MACHINE_ARN) {
+            void runPrimitiveJobInProcess(job.id).catch((error) => {
+                console.error("local video ingest failed", job.id, error instanceof Error ? error.message : error);
+            });
+        }
+        // Every upload key is unique (uuid segment), so no dedupe pass: two
+        // uploads of the same file are two intentional inspirations.
+        let inspiration = await serverlessRecords.createInspiration({
+            customerId: customer.id,
+            sourceUrl: uploadUrl,
+            originalUrl: uploadUrl,
+            sourceHost: "upload",
+            downloadJobId: job.id,
+            trendTagline: tagline,
+            visibility: "private",
+            notes
+        });
+        // Pending-card label while the ingest runs: explicit title, else the file
+        // name. Finalize overwrites this from the manifest, so an untitled upload
+        // ends at title null → the card shows the minted template id.
+        const pendingTitle = explicitTitle ?? uploadFileName;
+        if (pendingTitle) {
+            inspiration = (await serverlessRecords.updateInspiration({
+                inspirationId: inspiration.id,
+                patch: { title: pendingTitle }
+            })) ?? inspiration;
+        }
+        return c.json(serializeInspiration(inspiration), 202);
+    }
     const sourceUrl = readNonEmptyString(body.source_url);
     if (!sourceUrl)
-        return c.json({ ok: false, error: "Enter a video URL." }, 400);
+        return c.json({ ok: false, error: "Enter a video URL or upload a video file." }, 400);
     const originalUrl = stripTrackingParams(sourceUrl);
     const sourceHost = safeUrlHostname(originalUrl);
     if (!sourceHost)
@@ -4845,6 +5116,13 @@ app.post("/discover/templates", async (c) => {
             return activeJobLimitExceededResponse(c, error);
         throw error;
     }
+    // Same local-box treatment as the upload branch: no Step Functions worker
+    // means the download job must run in-process or it queues forever.
+    if (!config.VIDFARM_JOB_STATE_MACHINE_ARN) {
+        void runPrimitiveJobInProcess(job.id).catch((error) => {
+            console.error("local video download failed", job.id, error instanceof Error ? error.message : error);
+        });
+    }
     const inspiration = await serverlessRecords.createInspiration({
         customerId: customer.id,
         sourceUrl,
@@ -4866,6 +5144,17 @@ app.delete("/discover/templates/:entryId", async (c) => {
     if (!customer)
         return c.json({ ok: false, error: "Unauthorized" }, 401);
     const entryId = c.req.param("entryId");
+    // Cloud passthrough (vidfarm serve): an id that doesn't resolve locally is
+    // an upstream catalog entry (private ones show via the proxied feed).
+    if (hasUpstreamKey()) {
+        const localTemplate = entryId.startsWith("template_") ? await serverlessRecords.getTemplate(entryId) : null;
+        const localInspiration = entryId.startsWith("inspiration_") ? await serverlessRecords.getInspiration(entryId) : null;
+        if (!localTemplate && !localInspiration) {
+            const proxied = await proxyRequestToUpstream(c);
+            if (proxied)
+                return proxied;
+        }
+    }
     let template = null;
     let inspiration = null;
     if (entryId.startsWith("template_")) {
@@ -4901,13 +5190,21 @@ app.delete("/discover/templates/:entryId", async (c) => {
 // client-side via status.
 function buildPendingInspirationHomepageEntry(inspiration) {
     return {
-        title: inspiration.trendTagline || inspiration.title || inspiration.sourceHost || "New template",
+        // Uploads: explicit title (or file name, stored at submit time) outranks
+        // the tagline; URL ingests keep tagline-first.
+        title: (inspiration.sourceHost === "upload"
+            ? (inspiration.title || inspiration.trendTagline)
+            : (inspiration.trendTagline || inspiration.title)) || inspiration.sourceHost || "New template",
         templateId: inspiration.id,
         slugId: inspiration.id,
         difficulty: "easy",
         viralDna: inspiration.status === "failed"
-            ? (inspiration.errorMessage || "Video download failed. Check the URL and try adding it again.")
-            : (inspiration.notes || "Downloading the source video. This card unlocks automatically once it's ready."),
+            ? (inspiration.errorMessage || (inspiration.sourceHost === "upload"
+                ? "Video ingest failed. Try uploading the file again."
+                : "Video download failed. Check the URL and try adding it again."))
+            : (inspiration.notes || (inspiration.sourceHost === "upload"
+                ? "Processing your uploaded video. This card unlocks automatically once it's ready."
+                : "Downloading the source video. This card unlocks automatically once it's ready.")),
         previewUrl: inspiration.thumbnailUrl || "",
         approvedAt: inspiration.createdAt,
         sourceType: inspiration.sourceHost || "social",
@@ -6240,7 +6537,7 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/auto-decompose`, async (c) => {
         // fast (~1s), but the removal itself can take minutes and exceed the
         // CloudFront origin timeout, so we intentionally DO NOT wait here. We
         // persist the pending task to ghostcut.json under the fork and let the
-        // client drive completion via POST /ghostcut-poll below. Only runs for
+        // client drive completion via POST /remove-video-captions-poll below. Only runs for
         // actual videos — slideshows and images skip it.
         let ghostcutTaskId = null;
         let ghostcutSkipReason = null;
@@ -6298,7 +6595,7 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/auto-decompose`, async (c) => {
         }
         // Charges the caller's wallet for the lambda compute cost of this
         // decompose run. GhostCut chunk cost is billed separately from the
-        // ghostcut-poll endpoint (only when the task actually completes).
+        // remove-video-captions-poll endpoint (only when the task actually completes).
         // Wrapped so billing outages never fail the request.
         const chargeDecomposeUsage = async (input) => {
             const durationMs = Date.now() - startedAtMs;
@@ -6425,7 +6722,7 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/auto-decompose`, async (c) => {
         }
         const nextHtml = buildSmartDecomposedHtml({ compositionId, sourceUrl, title, result: smart });
         await storage.putText(storage.compositionForkWorkingKey(fork.id, "composition.html"), nextHtml, "text/html; charset=utf-8");
-        // Persist the raw smart-decompose result so the async /ghostcut-poll
+        // Persist the raw smart-decompose result so the async /remove-video-captions-poll
         // handler can rebuild the composition HTML pointing at the cleaned
         // (ghostcut-mirrored) video URL — with the ORIGINAL captions, positions,
         // and viral_dna intact — instead of doing a fragile source-URL string
@@ -6454,7 +6751,7 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/auto-decompose`, async (c) => {
             });
         }
         catch (persistError) {
-            // Non-fatal: /ghostcut-poll will fall back to the URL string-swap path
+            // Non-fatal: /remove-video-captions-poll will fall back to the URL string-swap path
             // if this file is missing.
             console.error("smart-decompose persist failed", persistError instanceof Error ? persistError.message : persistError);
         }
@@ -6536,27 +6833,16 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/auto-decompose`, async (c) => {
         return c.json({ ok: false, error: error instanceof Error ? error.message : "Auto-decompose failed." }, 500);
     }
 });
-// Idempotent status probe for the async GhostCut subtitle-removal task kicked
-// off by /auto-decompose. The client polls this every few seconds after a
-// successful decompose. On this endpoint's side:
-//   - "none": no ghostcut task was submitted for this fork (slideshow, or
-//     ghostcut disabled / submit failed).
-//   - "pending": task still running. Response includes progress %.
-//   - "done": task finished. We download the cleaned mp4, mirror it to our
-//     own S3, swap the original source URL for the mirror URL throughout the
-//     current composition.html, snapshot a new version, and bill the
-//     per-30s-chunk GhostCut cost. Idempotent — safe to re-poll.
-//   - "failed": task or mirror errored; original video stays in place.
-// Read-only ghostcut state for a fork. Lets the editor chat harness (and the
-// AI copilot via http_request) inspect BOTH the original source video URL and
-// the ghostcut-mirrored (subtitle-removed) URL without triggering an extra
-// billable GhostCut API poll. Returns { status: "none" } when the fork has no
-// ghostcut task on file (slideshow forks, ghostcut disabled, etc.). Chat can
-// call this to pick which video URL to feed into primitive routes: prefer the
-// mirrored URL when the fork's timeline should be baked-caption-free, prefer
-// the original when the AI needs the raw source (thumbnail extraction,
-// re-edits, style references).
-app.get(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut`, async (c) => {
+// Read-only subtitle-removal (GhostCut) state for a fork. Lets the editor chat
+// harness (and the AI copilot via http_request) inspect BOTH the original
+// source video URL and the mirrored (subtitle-removed) URL without triggering
+// an extra billable GhostCut API poll. Returns { status: "none" } when the
+// fork has no subtitle-removal task on file (slideshow forks, ghostcut
+// disabled, etc.). Chat can call this to pick which video URL to feed into
+// primitive routes: prefer the mirrored URL when the fork's timeline should be
+// baked-caption-free, prefer the original when the AI needs the raw source
+// (thumbnail extraction, re-edits, style references).
+const readForkSubtitleRemovalState = async (c) => {
     // Optional auth, same as the composition.html / manifest.json / video-context
     // read routes: the forkId is the view bearer token. A hard cookie requirement
     // here silently 401'd the editor-chat http_request tool (which authenticates
@@ -6594,7 +6880,12 @@ app.get(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut`, async (c) => {
             return forkAccessErrorResponse(c, error);
         return c.json({ ok: false, error: error instanceof Error ? error.message : String(error) }, 500);
     }
-});
+};
+app.get(`${COMPOSITIONS_PREFIX}/:forkId/remove-video-captions`, readForkSubtitleRemovalState);
+// Legacy alias: this route shipped as /ghostcut before the vendor-neutral
+// /remove-video-captions name. Kept for old clients, cached editor bundles,
+// and published devcli builds.
+app.get(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut`, readForkSubtitleRemovalState);
 // Consolidated "what is this video" context for a fork: the verbatim audio
 // transcript (timestamped segments) plus a literal visual description of each
 // scene, straight from the smart-decompose.json snapshot written by
@@ -6690,7 +6981,18 @@ app.get(`${COMPOSITIONS_PREFIX}/:forkId/video-context.json`, async (c) => {
         return c.json({ ok: false, error: error instanceof Error ? error.message : String(error) }, 500);
     }
 });
-app.post(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut-poll`, async (c) => {
+// Idempotent status probe for the async GhostCut subtitle-removal task kicked
+// off by /auto-decompose. The client polls this every few seconds after a
+// successful decompose. On this endpoint's side:
+//   - "none": no subtitle-removal task was submitted for this fork (slideshow,
+//     or ghostcut disabled / submit failed).
+//   - "pending": task still running. Response includes progress %.
+//   - "done": task finished. We download the cleaned mp4, mirror it to our
+//     own S3, swap the original source URL for the mirror URL throughout the
+//     current composition.html, snapshot a new version, and bill the
+//     per-30s-chunk GhostCut cost. Idempotent — safe to re-poll.
+//   - "failed": task or mirror errored; original video stays in place.
+const pollForkSubtitleRemoval = async (c) => {
     const caller = await getBrowserCustomer(c);
     if (!caller)
         return c.json({ ok: false, error: "Unauthorized" }, 401);
@@ -6914,9 +7216,14 @@ app.post(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut-poll`, async (c) => {
     catch (error) {
         if (error instanceof ForkNotFoundError || error instanceof ForkAccessDeniedError)
             return forkAccessErrorResponse(c, error);
-        return c.json({ ok: false, error: error instanceof Error ? error.message : "ghostcut-poll failed" }, 500);
+        return c.json({ ok: false, error: error instanceof Error ? error.message : "remove-video-captions-poll failed" }, 500);
     }
-});
+};
+app.post(`${COMPOSITIONS_PREFIX}/:forkId/remove-video-captions-poll`, pollForkSubtitleRemoval);
+// Legacy alias: this route shipped as /ghostcut-poll before the vendor-neutral
+// /remove-video-captions-poll name. Kept for old clients, cached editor
+// bundles, and published devcli builds.
+app.post(`${COMPOSITIONS_PREFIX}/:forkId/ghostcut-poll`, pollForkSubtitleRemoval);
 // Read-only cast context for a fork: the recurring people/characters
 // identified by the decompose 2nd pass, each with a description (for
 // consistent regeneration), the scenes they appear in, and reference image
@@ -7020,7 +7327,7 @@ app.get(`${COMPOSITIONS_PREFIX}/:forkId/product-placement.json`, async (c) => {
 });
 // Drives the async cast-identification 2nd pass one unit of work per call
 // (analyze -> per-member still -> per-member isolation -> done), mirroring
-// /ghostcut-poll. Each invocation makes at most one heavy external call so the
+// /remove-video-captions-poll. Each invocation makes at most one heavy external call so the
 // client controls cadence and lambda time stays bounded. Idempotent: terminal
 // states short-circuit.
 app.post(`${COMPOSITIONS_PREFIX}/:forkId/cast-poll`, async (c) => {
@@ -7199,7 +7506,7 @@ app.on("POST", [`${COMPOSITIONS_PREFIX}/:forkId/render`, `${COMPOSITIONS_PREFIX}
         // Block the render while ghostcut is still processing. The composition
         // currently points at the ORIGINAL video with baked-in captions; if we
         // let the render proceed the MP4 output will double up subtitles (baked +
-        // decomposed overlay layers). Client should poll /ghostcut-poll until
+        // decomposed overlay layers). Client should poll /remove-video-captions-poll until
         // it flips to done or failed, then retry /render.
         try {
             const ghostcutStateText = await storage.readText(storage.compositionForkWorkingKey(fork.id, "ghostcut.json"));
@@ -7251,6 +7558,27 @@ app.on("POST", [`${COMPOSITIONS_PREFIX}/:forkId/render`, `${COMPOSITIONS_PREFIX}
         const forkTemplateRecord = await serverlessRecords.getTemplate(fork.templateId);
         const projectFiles = [];
         const title = readNonEmptyString(requestBody.title) ?? fork.title ?? forkTemplateRecord?.title ?? fork.templateId;
+        // Cloud passthrough (vidfarm serve): render_target="cloud" hands this
+        // render to the upstream (cloud) renderer instead of the free in-process
+        // one. Any submitted html was already saved to the LOCAL working state
+        // above; the upstream render saves + versions its own copy. Identity
+        // stamping and local version snapshots are skipped — they belong to the
+        // upstream fork.
+        const renderTarget = readNonEmptyString(requestBody.render_target) ?? readNonEmptyString(requestBody.target);
+        if (renderTarget === "cloud" && rendersLocally) {
+            if (!hasUpstreamKey()) {
+                return c.json({ ok: false, error: "Cloud render needs a cloud API key — start `vidfarm serve` with VIDFARM_API_KEY (or --api-key) set." }, 400);
+            }
+            const cloudRender = await startUpstreamCloudRender({
+                fork,
+                compositionHtml,
+                title,
+                tracer: readNonEmptyString(requestBody.tracer) ?? `fork:${fork.id}:by:${caller.id}:cloud`
+            });
+            if (!cloudRender.ok)
+                return c.json({ ok: false, error: cloudRender.error }, (cloudRender.status ?? 502));
+            return c.json(cloudRender.payload, 202);
+        }
         // Composition identity is fork_id + version. Stamp it before publish so the
         // rendered MP4 embeds a stable, sortable composition_id per version.
         const nextVersion = requestedVersion && Number.isFinite(requestedVersion)
@@ -7296,11 +7624,89 @@ app.on("POST", [`${COMPOSITIONS_PREFIX}/:forkId/render`, `${COMPOSITIONS_PREFIX}
         return c.json({ ok: false, error: error instanceof Error ? error.message : "Publish failed." }, 500);
     }
 });
+// Cloud passthrough (vidfarm serve): start a render on the upstream host for
+// a locally-edited fork. Seeded forks share their id with the cloud source,
+// but that source is usually another user's shared decomposition the cloud
+// account cannot publish to — in that case it is cloned into the cloud
+// account once and the mapping is remembered in the fork's working
+// upstream-link.json. The upstream render both saves the submitted html and
+// snapshots a version on the upstream fork; billing happens upstream against
+// the cloud account's wallet.
+async function startUpstreamCloudRender(input) {
+    const linkKey = storage.compositionForkWorkingKey(input.fork.id, "upstream-link.json");
+    let upstreamForkId = input.fork.id;
+    try {
+        const linkText = await storage.readText(linkKey);
+        if (linkText) {
+            const link = asRecord(JSON.parse(linkText));
+            if (typeof link?.upstream_fork_id === "string" && link.upstream_fork_id)
+                upstreamForkId = link.upstream_fork_id;
+        }
+    }
+    catch {
+        // Unreadable link file — fall back to the shared fork id.
+    }
+    const renderBody = { title: input.title, html: input.compositionHtml, tracer: input.tracer };
+    // Rendering can take a moment to accept (upstream saves html + snapshots).
+    let render = await upstreamJson(`/api/v1/compositions/${encodeURIComponent(upstreamForkId)}/render`, { method: "POST", body: renderBody, timeoutMs: 60_000 });
+    if (!render.ok && [401, 403, 404].includes(render.status)) {
+        const clone = await upstreamJson(`/api/v1/compositions/${encodeURIComponent(upstreamForkId)}/clone`, { method: "POST", body: { title: input.title } });
+        const clonedForkId = typeof clone.json?.fork_id === "string" ? clone.json.fork_id : null;
+        if (!clone.ok || !clonedForkId) {
+            return {
+                ok: false,
+                error: `Cloud render failed: the cloud account cannot publish to fork ${upstreamForkId} (HTTP ${render.status}) and cloning it failed (HTTP ${clone.status}).`,
+                status: 502
+            };
+        }
+        upstreamForkId = clonedForkId;
+        render = await upstreamJson(`/api/v1/compositions/${encodeURIComponent(upstreamForkId)}/render`, { method: "POST", body: renderBody, timeoutMs: 60_000 });
+    }
+    if (!render.ok || !render.json) {
+        const upstreamError = typeof render.json?.error === "string" ? render.json.error : `HTTP ${render.status}`;
+        return {
+            ok: false,
+            error: `Cloud render failed: ${upstreamError}`,
+            status: render.status >= 400 && render.status < 500 ? render.status : 502
+        };
+    }
+    await storage.putJson(linkKey, { upstream_fork_id: upstreamForkId, updated_at_ms: Date.now() });
+    const renderId = typeof render.json.renderId === "string" ? render.json.renderId : null;
+    if (renderId) {
+        // Marker consumed by GET /renders/:renderId — the editor keeps polling the
+        // LOCAL fork id, and the marker routes that poll to the upstream job.
+        await storage.putJson(storage.compositionForkWorkingKey(input.fork.id, `cloud-render-${renderId}.json`), { upstream_fork_id: upstreamForkId, render_id: renderId, started_at_ms: Date.now() });
+    }
+    return {
+        ok: true,
+        payload: { ...render.json, render_target: "cloud", upstream_fork_id: upstreamForkId, upstream_host: upstreamHost() }
+    };
+}
 app.get(`${COMPOSITIONS_PREFIX}/:forkId/renders/:renderId`, async (c) => {
     const customer = await getBrowserCustomer(c);
     try {
         const access = await assertForkAccess({ forkId: c.req.param("forkId"), customerId: customer?.id ?? null, shareToken: readShareToken(c) }, "view");
         const renderId = c.req.param("renderId");
+        // Cloud passthrough (vidfarm serve): a marker written by
+        // startUpstreamCloudRender means this render runs on the upstream host —
+        // proxy the status poll there (against the mapped upstream fork).
+        if (isUpstreamEnabled() && /^[A-Za-z0-9_-]+$/.test(renderId)) {
+            const markerText = await storage.readText(storage.compositionForkWorkingKey(access.fork.id, `cloud-render-${renderId}.json`)).catch(() => null);
+            if (markerText) {
+                try {
+                    const marker = asRecord(JSON.parse(markerText));
+                    const upstreamForkId = typeof marker?.upstream_fork_id === "string" ? marker.upstream_fork_id : access.fork.id;
+                    const status = await upstreamJson(`/api/v1/compositions/${encodeURIComponent(upstreamForkId)}/renders/${encodeURIComponent(renderId)}`);
+                    if (status.json) {
+                        return c.json({ ...status.json, render_target: "cloud" }, status.ok ? 200 : status.status);
+                    }
+                    return c.json({ ok: false, error: "Cloud render status unavailable (upstream unreachable)." }, 502);
+                }
+                catch {
+                    // Corrupt marker — fall through to the local job lookup.
+                }
+            }
+        }
         const job = await jobs.getJobAsync(renderId);
         if (!job || job.customerId !== access.fork.customerId) {
             return c.json({ ok: false, error: "Render job not found" }, 404);
@@ -7598,8 +8004,15 @@ app.get(`${COMPOSITIONS_PREFIX}/:forkId/versions`, async (c) => {
         const limit = Number.parseInt(c.req.query("limit") ?? "25", 10);
         const cursor = c.req.query("cursor") ?? null;
         const page = await serverlessRecords.listForkVersions({ forkId: access.fork.id, limit, cursor });
+        // Fork content is world-viewable, but the snapshot trail is personal.
+        // /editor parks users without their own fork on the template's shared
+        // default fork, so without this scoping the History modal would list the
+        // fork owner's (i.e. another user's) publish/decompose history.
+        const visible = access.capabilities.isOwner
+            ? page.items
+            : page.items.filter((version) => Boolean(customer && version.createdBy === customer.id));
         return c.json({
-            versions: page.items.map(serializeVersion),
+            versions: visible.map(serializeVersion),
             next_cursor: page.nextCursor
         });
     }
@@ -7762,7 +8175,14 @@ async function finalizeInspirationIfReady(inspiration) {
                 customerId: ready.customerId,
                 originalUrl: ready.originalUrl,
                 sourceHost: ready.sourceHost,
-                title: ready.trendTagline || ready.title || ready.sourceHost || "Untitled",
+                // No host/"Untitled" fallback: a template without an explicit title or
+                // tagline displays as its template id on /discover. For uploads the
+                // manifest title IS the caller's explicit title, so it outranks the
+                // tagline; URL ingests keep tagline-first (manifest title is just the
+                // social post's own caption).
+                title: (ready.sourceHost === "upload"
+                    ? (ready.title || ready.trendTagline)
+                    : (ready.trendTagline || ready.title)) || null,
                 thumbnailUrl: ready.thumbnailUrl,
                 videoUrl: ready.videoUrl,
                 durationSeconds: ready.durationSeconds,
@@ -7851,21 +8271,50 @@ app.get(VIDEOS_PREFIX, async (c) => {
     // Optional keyword search over the source-video catalog, matching the same
     // decompose-derived metadata as the template feed.
     const query = (c.req.query("q") || c.req.query("query") || "").trim() || null;
+    let videos = [];
     if (mine) {
         if (!customer)
             return c.json({ ok: false, error: "Unauthorized" }, 401);
         const items = await serverlessRecords.listInspirationsForCustomer(customer.id);
         const finalized = await Promise.all(items.map(finalizeInspirationIfReady));
         const matched = finalized.filter((inspiration) => recordMatchesSearchQuery(inspiration, query));
-        return c.json({ videos: matched.slice(0, limit).map(serializeInspiration) });
+        videos = matched.slice(0, limit).map(serializeInspiration);
+    }
+    else {
+        const items = await serverlessRecords.listInspirationsFeed({ limit, query });
+        videos = items.map(serializeInspiration);
+    }
+    // Cloud passthrough (vidfarm serve): surface the upstream source-video
+    // catalog behind the local working set. `mine` is the cloud account's own
+    // list so it needs the upstream key; the public feed proxies keyless.
+    if (isUpstreamEnabled() && (!mine || hasUpstreamKey())) {
+        const search = new URLSearchParams({ limit: String(limit) });
+        if (query)
+            search.set("q", query);
+        if (mine)
+            search.set("mine", "true");
+        const upstreamVideos = (await upstreamJson(`/api/v1/videos?${search.toString()}`)).json?.videos ?? [];
+        const seen = new Set(videos.map((video) => String(video.inspiration_id ?? "")));
+        for (const video of upstreamVideos) {
+            const id = String(video?.inspiration_id ?? "");
+            if (id && !seen.has(id)) {
+                videos.push(video);
+                seen.add(id);
+            }
+        }
     }
-    const items = await serverlessRecords.listInspirationsFeed({ limit, query });
-    return c.json({ videos: items.map(serializeInspiration) });
+    return c.json({ videos });
 });
 app.get(`${VIDEOS_PREFIX}/:inspirationId`, async (c) => {
     const inspiration = await serverlessRecords.getInspiration(c.req.param("inspirationId"));
-    if (!inspiration)
+    if (!inspiration) {
+        // Cloud passthrough (vidfarm serve): unknown ids belong to the upstream
+        // catalog this box mirrors. Keyless is fine — the read is public-feed data.
+        const proxied = await proxyRequestToUpstream(c, { requireKey: false });
+        if (proxied)
+            return proxied;
         return c.json({ ok: false, error: "Inspiration not found" }, 404);
+    }
     const finalized = await finalizeInspirationIfReady(inspiration);
     return c.json(serializeInspiration(finalized));
 });
@@ -8663,7 +9112,7 @@ app.get("/library", async (c) => {
             avatarUrl: channel.avatarUrl
         }))
     ];
-    const posts = await Promise.all((await serverlessRecords.listReadyPosts(customer.id))
+    const localPosts = await Promise.all((await serverlessRecords.listReadyPosts(customer.id))
         .filter((post) => (post.source ?? "legacy") === "hyperframes")
         .filter((post) => post.status === "ready" || post.status === "scheduled")
         .map(async (post) => {
@@ -8673,6 +9122,7 @@ app.get("/library", async (c) => {
             template_id: post.compositionId ?? null
         };
     }));
+    const posts = await mergeUpstreamReadyPosts(localPosts);
     return c.html(renderLibraryPage({
         userId: customer.id,
         currentAccountId: customer.id,
@@ -10292,6 +10742,41 @@ function readyPostSharePath(post, password) {
     const suffix = params.size ? `?${params.toString()}` : "";
     return `${accountApprovedPostPath(post.customerId, post.id)}${suffix}`;
 }
+// Cloud passthrough (vidfarm serve): /library and the approved-posts list
+// mirror the upstream account's posts next to anything approved locally.
+// Upstream entries keep their absolute share/download URLs (they open on the
+// cloud host) and carry no local template_id. Fail-soft: an unreachable
+// upstream returns the local list unchanged.
+async function mergeUpstreamReadyPosts(localPosts) {
+    if (!hasUpstreamKey())
+        return localPosts;
+    const upstreamPosts = (await upstreamJson(`${APPROVED_POSTS_PREFIX}?limit=100`)).json?.posts ?? [];
+    const seen = new Set(localPosts.map((post) => post.post_id));
+    const merged = [...localPosts];
+    for (const post of upstreamPosts) {
+        const id = typeof post?.post_id === "string" ? post.post_id : "";
+        if (!id || seen.has(id))
+            continue;
+        merged.push({ template_id: null, ...post });
+        seen.add(id);
+    }
+    return merged.sort((a, b) => String(b.created_at ?? "").localeCompare(String(a.created_at ?? "")));
+}
+// Cloud passthrough (vidfarm serve): a post id that doesn't resolve locally
+// belongs to the upstream account whose /library this box mirrors — forward
+// the whole request there. Returns null when the post exists locally (or no
+// upstream is configured), letting the local handler proceed.
+async function maybeProxyUnknownReadyPostToUpstream(c) {
+    if (!hasUpstreamKey())
+        return null;
+    const postId = String(c.req.param("postId") ?? "");
+    if (!postId)
+        return null;
+    const post = await serverlessRecords.getReadyPost(postId);
+    if (post)
+        return null;
+    return proxyRequestToUpstream(c);
+}
 function serializeReadyPost(c, post, input) {
     const sharePath = readyPostSharePath(post, input?.password);
     return {
@@ -12658,6 +13143,8 @@ function primitiveAliasPathForKind(kind) {
             return `${PRIMITIVES_PREFIX}/videos/download`;
         case "video_trim":
             return `${PRIMITIVES_PREFIX}/videos/trim`;
+        case "video_remove_captions":
+            return `${PRIMITIVES_PREFIX}/videos/remove-captions`;
         case "video_extract_audio":
             return `${PRIMITIVES_PREFIX}/videos/extract-audio`;
         case "video_probe":
@@ -13297,6 +13784,11 @@ app.post(`${PRIMITIVES_PREFIX}/media/dedupe`, async (c) => createPrimitiveJob(c,
 app.post(`${PRIMITIVES_PREFIX}/timeline/render`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:hyperframes_render", operationName: "run" }));
 app.post(`${PRIMITIVES_PREFIX}/videos/normalize`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_normalize", operationName: "run" }));
 app.post(`${PRIMITIVES_PREFIX}/videos/trim`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_trim", operationName: "run" }));
+// Caption removal (GhostCut). Canonical path follows the videos/* convention;
+// the flat /remove-video-captions alias keeps the primitive reachable under
+// its plain-English name.
+app.post(`${PRIMITIVES_PREFIX}/videos/remove-captions`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_remove_captions", operationName: "run" }));
+app.post(`${PRIMITIVES_PREFIX}/remove-video-captions`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_remove_captions", operationName: "run" }));
 app.post(`${PRIMITIVES_PREFIX}/videos/extract-audio`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_extract_audio", operationName: "run" }));
 app.post(`${PRIMITIVES_PREFIX}/videos/probe`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_probe", operationName: "run" }));
 app.post(`${PRIMITIVES_PREFIX}/videos/extract-frame`, async (c) => createPrimitiveJob(c, { primitiveId: "primitive:video_extract_frame", operationName: "run" }));
@@ -13324,8 +13816,14 @@ app.get(APPROVED_POSTS_PREFIX, requireAuth, async (c) => {
             || (post.createdAt === cursor.createdAt && post.id < cursor.id)))
         : filteredPosts;
     const page = paginateDescendingByCreatedAt(posts, limit);
+    let serialized = page.items.map((post) => serializeReadyPost(c, post, { includePrivate: true }));
+    // Cloud passthrough (vidfarm serve): only the first (cursorless) page merges
+    // the upstream account's posts — cursors keep paging the local set exactly.
+    if (!cursor && !tracerFilter) {
+        serialized = (await mergeUpstreamReadyPosts(serialized)).slice(0, limit);
+    }
     return c.json({
-        posts: page.items.map((post) => serializeReadyPost(c, post, { includePrivate: true })),
+        posts: serialized,
         next_cursor: page.nextCursor
     });
 });
@@ -13359,6 +13857,9 @@ app.post(APPROVED_POSTS_PREFIX, requireAuth, async (c) => {
     }
 });
 app.get(`${APPROVED_POSTS_PREFIX}/:postId`, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     const post = await serverlessRecords.getReadyPost(c.req.param("postId"));
     if (!post || post.status === "deleted") {
         return c.json({ error: "Approved post not found." }, 404);
@@ -13370,18 +13871,33 @@ app.get(`${APPROVED_POSTS_PREFIX}/:postId`, async (c) => {
     return c.json({ post: serializeReadyPost(c, post, { includePrivate: viewer.canManage, password: viewer.hasPasswordAccess ? viewer.password : null }) });
 });
 app.get(`${APPROVED_POSTS_PREFIX}/:postId/schedules`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     return await listReadyPostSchedulesResponse(c, requireCustomer(c), String(c.req.param("postId")));
 });
 app.post(`${APPROVED_POSTS_PREFIX}/:postId/schedules`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     return createReadyPostScheduleResponse(c, requireCustomer(c), String(c.req.param("postId")));
 });
 app.patch(`${APPROVED_POSTS_PREFIX}/:postId/schedules/:scheduleId`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     return updateReadyPostScheduleResponse(c, requireCustomer(c), String(c.req.param("postId")), String(c.req.param("scheduleId")));
 });
 app.delete(`${APPROVED_POSTS_PREFIX}/:postId/schedules/:scheduleId`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     return deleteReadyPostScheduleResponse(c, requireCustomer(c), String(c.req.param("postId")), String(c.req.param("scheduleId")));
 });
 app.post(`${APPROVED_POSTS_PREFIX}/:postId/archive`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     const post = await serverlessRecords.getReadyPost(String(c.req.param("postId")));
     if (!post || post.status === "deleted") {
         return c.json({ error: "Approved post not found." }, 404);
@@ -13396,6 +13912,9 @@ app.post(`${APPROVED_POSTS_PREFIX}/:postId/archive`, requireAuth, async (c) => {
     }
 });
 app.delete(`${APPROVED_POSTS_PREFIX}/:postId`, requireAuth, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     const post = await serverlessRecords.getReadyPost(String(c.req.param("postId")));
     if (!post) {
         return c.json({ error: "Approved post not found." }, 404);
@@ -13410,6 +13929,9 @@ app.delete(`${APPROVED_POSTS_PREFIX}/:postId`, requireAuth, async (c) => {
     }
 });
 app.get(`${APPROVED_POSTS_PREFIX}/:postId/download-zip`, async (c) => {
+    const proxied = await maybeProxyUnknownReadyPostToUpstream(c);
+    if (proxied)
+        return proxied;
     const post = await serverlessRecords.getReadyPost(c.req.param("postId"));
     if (!post || post.status === "deleted") {
         return c.json({ error: "Approved post not found." }, 404);