@mrgoonie/multix 1.0.1 → 1.0.3

package/dist/cli.js

@@ -307,6 +307,7 @@ function validateRawInput(spec, body) {
 }
 
 // src/providers/atlascloud/models.ts
+var ATLAS_PROVIDER = "atlascloud";
 var DEFAULT_ATLAS_BASE_URL = "https://api.atlascloud.ai/api/v1";
 var ATLAS_ROUTING = {
   name: "ATLASCLOUD_BASE_URL",
@@ -626,6 +627,134 @@ var defaultLogger = createLogger({ verbose: false });
 // src/providers/atlascloud/commands/env.ts
 init_redact();
 
+// src/core/url-safety.ts
+init_errors();
+init_redact();
+function ipv4Octets(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const octets = parts.map(Number);
+  return octets.every((o) => o <= 255) ? octets : void 0;
+}
+function isNonPublicIpv4([a = 0, b = 0, c2 = 0]) {
+  return a === 0 || // "this network" / unspecified
+  a === 10 || a === 127 || // loopback
+  a === 100 && b >= 64 && b <= 127 || // carrier-grade NAT
+  a === 169 && b === 254 || // link-local (cloud metadata)
+  a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c2 === 0 || // IETF protocol assignments
+  a === 192 && b === 0 && c2 === 2 || // TEST-NET-1
+  a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || // benchmarking
+  a === 198 && b === 51 && c2 === 100 || // TEST-NET-2
+  a === 203 && b === 0 && c2 === 113 || // TEST-NET-3
+  a >= 224;
+}
+function ipv6Groups(host) {
+  if (!/^[0-9a-f:.]+$/i.test(host) || !host.includes(":")) return void 0;
+  let text = host;
+  const tail = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(text);
+  if (tail) {
+    const octets = ipv4Octets(tail[2]);
+    if (!octets) return void 0;
+    const [a = 0, b = 0, c2 = 0, d = 0] = octets;
+    text = `${tail[1]}${(a << 8 | b).toString(16)}:${(c2 << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const parse = (s) => s === "" ? [] : s.split(":");
+  const head = parse(halves[0]);
+  const rest = halves.length === 2 ? parse(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0) return void 0;
+  const all = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest];
+  if (!all.every((g) => /^[0-9a-f]{1,4}$/i.test(g))) return void 0;
+  return all.map((g) => Number.parseInt(g, 16));
+}
+function embeddedIpv4(hi, lo) {
+  return [hi >> 8, hi & 255, lo >> 8, lo & 255];
+}
+function isNonPublicIpv6(groups) {
+  const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;
+  const zeroUpTo = (n) => groups.slice(0, n).every((g) => g === 0);
+  if (zeroUpTo(5) && g5 === 65535) return isNonPublicIpv4(embeddedIpv4(g6, g7));
+  if (g0 === 100 && g1 === 65435 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
+    return isNonPublicIpv4(embeddedIpv4(g6, g7));
+  }
+  if (g0 === 8194) return isNonPublicIpv4(embeddedIpv4(g1, g2));
+  return g0 === 0 || // unspecified (::), loopback (::1), IPv4-compatible and other reserved
+  g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0 || // discard-only 100::/64
+  (g0 & 65024) === 64512 || // unique local fc00::/7
+  (g0 & 65472) === 65152 || // link-local fe80::/10
+  (g0 & 65472) === 65216 || // deprecated site-local fec0::/10
+  (g0 & 65280) === 65280;
+}
+function bareHost(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isLoopbackHost(hostname) {
+  const host = bareHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  const octets = ipv4Octets(host);
+  if (octets) return octets[0] === 127;
+  const groups = ipv6Groups(host);
+  if (!groups) return false;
+  if (groups.slice(0, 5).every((g) => g === 0) && groups[5] === 65535) {
+    return groups[6] !== void 0 && groups[6] >> 8 === 127;
+  }
+  return groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1;
+}
+function isNonPublicHost(hostname) {
+  const host = bareHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  const octets = ipv4Octets(host);
+  if (octets) return isNonPublicIpv4(octets);
+  const groups = ipv6Groups(host);
+  return groups !== void 0 && isNonPublicIpv6(groups);
+}
+var LOOPBACK_BASE_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function checkBaseUrl(raw, variable) {
+  const value = raw.trim();
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${variable} must be an absolute https:// URL`);
+  }
+  const loopbackHttp = url.protocol === "http:" && LOOPBACK_BASE_HOSTS.has(url.hostname);
+  if (url.protocol !== "https:" && !loopbackHttp) {
+    throw new ConfigError(
+      `${variable} must use https:// (got ${redactUrl(value)}); plain http:// is only allowed for localhost, 127.0.0.1, or [::1]`
+    );
+  }
+  return value;
+}
+function checkUrlSafety(url, opts) {
+  const action = opts.action ?? "download from";
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ProviderError(`Refusing to ${action} a malformed URL`, opts.provider);
+  }
+  const host = parsed.hostname.toLowerCase().replace(/\.$/, "");
+  const localOk = opts.allowLocalhostHttp === true && isLoopbackHost(host);
+  const httpOk = parsed.protocol === "https:" || localOk && parsed.protocol === "http:";
+  if (!httpOk) {
+    throw new ProviderError(
+      `Refusing to ${action} ${host || "this URL"}: only https:// URLs are allowed`,
+      opts.provider
+    );
+  }
+  if (!localOk && isNonPublicHost(host)) {
+    throw new ProviderError(
+      `Refusing to ${action} ${host}: it points to a local or private address`,
+      opts.provider
+    );
+  }
+  const trusted = (opts.trustedHosts ?? []).some((t) => host === t || host.endsWith(`.${t}`));
+  return { host, trusted };
+}
+
 // src/core/async-poll.ts
 init_errors();
 var PollTimeoutError = class extends MultixError {
@@ -868,6 +997,7 @@ async function fetchJson(opts) {
 }
 
 // src/providers/atlascloud/prediction-output.ts
+init_errors();
 var SUCCESS_STATUSES = /* @__PURE__ */ new Set(["completed", "succeeded", "success"]);
 var FAILURE_STATUSES = /* @__PURE__ */ new Set(["failed", "error", "canceled", "cancelled", "timeout"]);
 function norm(status) {
@@ -917,6 +1047,9 @@ function collectOutputs(prediction) {
   }
   return out;
 }
+function checkOutputUrl(url) {
+  checkUrlSafety(url, { provider: ATLAS_PROVIDER });
+}
 function isMediaOutput(value) {
   const s = value.trim();
   return /^https?:\/\//i.test(s) || /^data:[^,]*,/i.test(s);
@@ -941,6 +1074,7 @@ var EXT_CATEGORY = {
   flac: "audio",
   ogg: "audio",
   opus: "audio",
+  weba: "audio",
   pcm: "audio",
   glb: "3d",
   gltf: "3d",
@@ -958,8 +1092,14 @@ var MIME_EXT = {
   "image/jpeg": "jpg",
   "image/webp": "webp",
   "image/gif": "gif",
+  "image/avif": "avif",
+  "image/bmp": "bmp",
+  "image/svg+xml": "svg",
   "video/mp4": "mp4",
   "video/webm": "webm",
+  "video/x-matroska": "mkv",
+  "video/matroska": "mkv",
+  "audio/webm": "weba",
   "audio/mpeg": "mp3",
   "audio/mp3": "mp3",
   "audio/wav": "wav",
@@ -976,6 +1116,7 @@ function extensionForContentType(contentType) {
   const mime = contentType?.split(";")[0]?.trim().toLowerCase();
   return mime ? MIME_EXT[mime] : void 0;
 }
+var KNOWN_EXTENSIONS = /* @__PURE__ */ new Set([...Object.keys(EXT_CATEGORY), "svg"]);
 function outputExtension(value) {
   const s = value.trim();
   const dataMatch = /^data:([^;,]+)/i.exec(s);
@@ -989,6 +1130,7 @@ function outputExtension(value) {
   const m = /\.([a-z0-9]{2,5})$/i.exec(pathname);
   if (!m?.[1]) return void 0;
   const ext = m[1].toLowerCase();
+  if (!KNOWN_EXTENSIONS.has(ext)) return void 0;
   return ext === "jpeg" ? "jpg" : ext;
 }
 function outputCategory(value) {
@@ -1022,13 +1164,32 @@ function classifyOutputs(prediction) {
 function hasNsfwFlag(prediction) {
   return Array.isArray(prediction.has_nsfw_contents) && prediction.has_nsfw_contents.some(Boolean);
 }
+function thumbnailSource(prediction) {
+  return prediction.outputs ?? prediction.output ?? null;
+}
+var MAX_PREDICTION_ID_LENGTH = 128;
+var NAME_ID_LENGTH = 64;
+function fnv1a(value) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
 function outputFileName(predictionId, index, ext) {
-  const prefix = predictionId.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 8) || "output";
-  return `atlas-${prefix}-${String(index + 1).padStart(2, "0")}.${ext}`;
+  if (predictionId.length === 0 || predictionId.length > MAX_PREDICTION_ID_LENGTH) {
+    throw new ProviderError(
+      `Atlas Cloud returned an unusable prediction id (${predictionId.length === 0 ? "empty" : `${predictionId.length} characters`}).`,
+      ATLAS_PROVIDER
+    );
+  }
+  const short = predictionId.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, NAME_ID_LENGTH);
+  const id = short === predictionId ? short : short ? `${short}-${fnv1a(predictionId)}` : fnv1a(predictionId);
+  return `atlas-${id}-${String(index + 1).padStart(2, "0")}.${ext}`;
 }
 
 // src/providers/atlascloud/client.ts
-var ATLAS_PROVIDER = "atlascloud";
 var DEFAULT_UPLOAD_TIMEOUT_MS = 3e5;
 var CATALOG_TIMEOUT_MS = 15e3;
 var PREDICTION_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
@@ -1122,13 +1283,13 @@ var AtlasCloudClient = class {
   }
   /** Submit a generation job. `body` holds `model` plus the model's own fields, flattened. */
   async submit(kind, body) {
-    const path57 = SUBMIT_PATHS[kind];
-    if (!path57) throw new ValidationError(`Unknown Atlas Cloud media type: ${String(kind)}`);
+    const path58 = SUBMIT_PATHS[kind];
+    if (!path58) throw new ValidationError(`Unknown Atlas Cloud media type: ${String(kind)}`);
     if (typeof body.model !== "string" || !body.model.trim()) {
       throw new ValidationError("Atlas Cloud request body needs a non-empty `model`");
     }
     const env = await fetchJson({
-      url: `${this.baseUrl}${path57}`,
+      url: `${this.baseUrl}${path58}`,
       method: "POST",
       headers: this.authHeaders(),
       body,
@@ -1316,7 +1477,7 @@ function requireAtlasKey() {
 }
 function createAtlasClientFromEnv() {
   const apiKey = requireAtlasKey();
-  const baseUrl = resolveProviderBaseUrl(ATLAS_ROUTING);
+  const baseUrl = checkBaseUrl(resolveProviderBaseUrl(ATLAS_ROUTING), "ATLASCLOUD_BASE_URL");
   return new AtlasCloudClient({ apiKey, baseUrl });
 }
 async function resolveMediaRef(client, ref, logger) {
@@ -1386,8 +1547,8 @@ async function resolveMediaRefs(client, refs, logger) {
 
 // src/providers/atlascloud/commands/prediction-runner.ts
 init_errors();
-import fs8 from "fs";
-import path7 from "path";
+import fs9 from "fs";
+import path8 from "path";
 
 // src/core/http-client.ts
 import fs3 from "fs";
@@ -1787,14 +1948,18 @@ function detectThumbUrl(obj) {
   }
   return null;
 }
+function resultDest(result) {
+  const dest = result?.dest;
+  return typeof dest === "string" ? dest : void 0;
+}
 async function downloadThumbBeside(thumbUrl, videoPath, logger, download = downloadFile) {
   const match = thumbUrl.match(IMAGE_EXT_RE);
   const ext = match?.[1] ? match[1].toLowerCase().replace("jpeg", "jpg") : "jpg";
   const dir = path6.dirname(videoPath);
   const base = path6.basename(videoPath, path6.extname(videoPath));
-  const dest = path6.join(dir, `${base}_thumb.${ext}`);
+  const planned = path6.join(dir, `${base}_thumb.${ext}`);
   try {
-    await download(thumbUrl, dest);
+    const dest = resultDest(await download(thumbUrl, planned)) ?? planned;
     logger?.success(`Saved thumb ${dest}`);
     return dest;
   } catch (e) {
@@ -1822,6 +1987,189 @@ async function maybeDownloadThumb(source, videoPath, opts = {}) {
   return saved;
 }
 
+// src/providers/atlascloud/commands/output-claims.ts
+init_errors();
+import fs8 from "fs";
+import os2 from "os";
+import path7 from "path";
+var PART = ".part";
+var PART_SUFFIX = /(?:\.\d+-\d+-[a-z0-9]+)?\.part$/i;
+var TEMP_TAIL = /^\.(\d+)-\d+-[a-z0-9]+\.part$/i;
+var MAX_UNIQUE_ATTEMPTS = 1e3;
+var UNREADABLE_LOCK_GRACE_MS = 1e4;
+var foldCase = process.platform === "win32" || process.platform === "darwin";
+var fold = (s) => foldCase ? s.toLowerCase() : s;
+function stemOf(name) {
+  const base = name.replace(PART_SUFFIX, "");
+  return fold(base.slice(0, base.length - path7.extname(base).length));
+}
+function listDir(dir) {
+  try {
+    return fs8.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+function removeQuietly2(file) {
+  try {
+    fs8.rmSync(file, { force: true });
+  } catch {
+  }
+}
+function savedOutput(file) {
+  const dir = path7.dirname(file);
+  const stem = stemOf(path7.basename(file));
+  const matches = listDir(dir).filter((n) => {
+    if (PART_SUFFIX.test(n) || stemOf(n) !== stem) return false;
+    const st = fs8.statSync(path7.join(dir, n), { throwIfNoEntry: false });
+    return st?.isFile() === true && st.size > 0;
+  });
+  const exact = matches.find((n) => n === path7.basename(file));
+  const found = exact ?? matches.sort()[0];
+  return found === void 0 ? void 0 : path7.join(dir, found);
+}
+function* candidateNames(file) {
+  const dir = path7.dirname(file);
+  const ext = path7.extname(file);
+  const stem = path7.basename(file, ext);
+  const taken = new Set(listDir(dir).map(stemOf));
+  for (let n = 0; n < MAX_UNIQUE_ATTEMPTS; n++) {
+    const name = n === 0 ? stem : `${stem}-${n}`;
+    if (!taken.has(fold(name))) yield path7.join(dir, `${name}${ext}`);
+  }
+}
+function readLock(lock) {
+  try {
+    const v = JSON.parse(fs8.readFileSync(lock, "utf8"));
+    if (Number.isInteger(v.pid) && v.pid > 0 && typeof v.host === "string") {
+      return v;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isProcessAlive(pid) {
+  if (pid === process.pid) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code !== "ESRCH";
+  }
+}
+function isStaleLock(lock) {
+  const info = readLock(lock);
+  if (!info) {
+    const st = fs8.statSync(lock, { throwIfNoEntry: false });
+    return st === void 0 || Date.now() - st.mtimeMs > UNREADABLE_LOCK_GRACE_MS;
+  }
+  if (info.host !== os2.hostname()) return false;
+  return !isProcessAlive(info.pid);
+}
+var activeClaims = /* @__PURE__ */ new Set();
+function tryLock(dest) {
+  const lock = `${dest}${PART}`;
+  const content = JSON.stringify({
+    pid: process.pid,
+    host: os2.hostname(),
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      fs8.writeFileSync(lock, content, { flag: "wx" });
+      activeClaims.add(dest);
+      installInterruptCleanup();
+      return true;
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+      if (attempt > 0 || !isStaleLock(lock)) return false;
+      removeQuietly2(lock);
+    }
+  }
+  return false;
+}
+function removeOrphanedTemps(dest) {
+  const base = path7.basename(dest);
+  const dir = path7.dirname(dest);
+  for (const n of listDir(dir)) {
+    if (!n.startsWith(base)) continue;
+    const m = TEMP_TAIL.exec(n.slice(base.length));
+    if (m?.[1] && !isProcessAlive(Number(m[1]))) removeQuietly2(path7.join(dir, n));
+  }
+}
+function releaseClaim(dest) {
+  if (!activeClaims.delete(dest)) return;
+  removeQuietly2(`${dest}${PART}`);
+}
+function cleanupActiveClaims() {
+  for (const dest of [...activeClaims]) {
+    const base = path7.basename(dest);
+    const dir = path7.dirname(dest);
+    for (const n of listDir(dir)) {
+      if (!n.startsWith(base)) continue;
+      const m = TEMP_TAIL.exec(n.slice(base.length));
+      if (m?.[1] && Number(m[1]) === process.pid) removeQuietly2(path7.join(dir, n));
+    }
+    releaseClaim(dest);
+  }
+}
+var INTERRUPT_EXIT_CODES = { SIGINT: 130, SIGTERM: 143 };
+function handleInterrupt(signal, exit = (code) => process.exit(code)) {
+  cleanupActiveClaims();
+  exit(INTERRUPT_EXIT_CODES[signal]);
+}
+var interruptCleanupInstalled = false;
+function installInterruptCleanup() {
+  if (interruptCleanupInstalled) return;
+  interruptCleanupInstalled = true;
+  process.once("SIGINT", () => handleInterrupt("SIGINT"));
+  process.once("SIGTERM", () => handleInterrupt("SIGTERM"));
+}
+function heldMessage(dest) {
+  const info = readLock(`${dest}${PART}`);
+  const holder = info ? ` (pid ${info.pid} on ${info.host})` : "";
+  const advice = "Wait for it to finish, then retry. A lock left by a run that has stopped is replaced automatically.";
+  return `${dest}${PART} is held by another multix run${holder} downloading this output. ${advice}`;
+}
+function claimOutputPath(file, policy) {
+  if (policy === "overwrite") return file;
+  fs8.mkdirSync(path7.dirname(file), { recursive: true });
+  if (policy === "reuse") {
+    if (!tryLock(file)) throw new ProviderError(heldMessage(file), ATLAS_PROVIDER);
+    removeOrphanedTemps(file);
+    return file;
+  }
+  for (const candidate of candidateNames(file)) {
+    if (!tryLock(candidate)) continue;
+    if (fs8.existsSync(candidate)) {
+      releaseClaim(candidate);
+      continue;
+    }
+    removeOrphanedTemps(candidate);
+    return candidate;
+  }
+  throw new ProviderError(
+    `No free file name for ${file} after ${MAX_UNIQUE_ATTEMPTS} attempts; choose another --output.`,
+    ATLAS_PROVIDER
+  );
+}
+async function downloadClaimed(url, choose, policy, opts) {
+  let claimed;
+  try {
+    const { dest } = await downloadToFile(url, {
+      ...opts,
+      dest: (response) => {
+        const dest2 = claimOutputPath(choose(response), policy);
+        if (policy !== "overwrite") claimed = dest2;
+        return dest2;
+      }
+    });
+    return dest;
+  } finally {
+    if (claimed) releaseClaim(claimed);
+  }
+}
+
 // src/providers/atlascloud/commands/prediction-runner.ts
 function addRunOptions(cmd, cfg) {
   cmd.option("--async", "Submit and exit; print the prediction id (resume with `atlas status`)").option("--wait-timeout <ms>", "Max time to wait for completion", String(cfg.waitTimeoutMs)).option("--output <path>", "Output file (single output) or directory (path without extension)").option("--no-download", "Do not download media; print output URLs instead").option("--no-validate", "Skip client-side validation against the model's published schema");
@@ -1882,8 +2230,13 @@ function assertEndpoint(spec, expected, model) {
 function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
-function resumeCommand(id) {
-  return `multix atlas status ${id} --wait --download`;
+function resumeCommand(id, output) {
+  const base = `multix atlas status ${id} --wait --download`;
+  return output ? `${base} --output ${shellQuote(output)}` : base;
+}
+function shellQuote(value) {
+  if (/^[\w@%+=:,./\\-]+$/.test(value)) return value;
+  return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
 }
 async function executePrediction(o) {
   const { client, logger, opts } = o;
@@ -1893,22 +2246,27 @@ async function executePrediction(o) {
   const id = submitted.id;
   if (opts.async) {
     console.log(id);
-    console.error(`Prediction submitted. Resume with: ${resumeCommand(id)}`);
+    console.error(`Prediction submitted. Resume with: ${resumeCommand(id, opts.output)}`);
     return { predictionId: id, files: [], texts: [] };
   }
   logger.info(`Prediction ${id} \u2014 waiting up to ${Math.round(timeoutMs / 1e3)}s...`);
   const final = isTerminalStatus(submitted.status) ? submitted : await client.waitForPrediction(id, {
     timeoutMs,
     intervalMs: o.pollIntervalMs,
-    resumeHint: `Resume with: ${resumeCommand(id)}`,
+    resumeHint: `Resume with: ${resumeCommand(id, opts.output)}`,
     onPoll: (p, n) => logger.debug(`poll ${n}: ${p.status}`)
   });
   assertPredictionSucceeded(final);
-  const delivered = await deliverPrediction(final, { logger, opts, hint: o.hint });
+  const delivered = await deliverPrediction(final, {
+    logger,
+    opts,
+    hint: o.hint,
+    predictionId: id
+  });
   return { predictionId: id, prediction: final, ...delivered };
 }
 function isDirectoryOutput(output) {
-  return /[\\/]$/.test(output) || path7.extname(output) === "" || fs8.existsSync(output) && fs8.statSync(output).isDirectory();
+  return /[\\/]$/.test(output) || path8.extname(output) === "" || fs9.existsSync(output) && fs9.statSync(output).isDirectory();
 }
 function planOutputPaths(urls, cfg) {
   const exts = urls.map((u) => {
@@ -1917,32 +2275,34 @@ function planOutputPaths(urls, cfg) {
   });
   const output = cfg.output;
   if (!output || isDirectoryOutput(output)) {
-    const dir = output ? path7.resolve(output) : cfg.outDir();
-    return exts.map((ext, i) => path7.join(dir, outputFileName(cfg.predictionId, i, ext)));
+    const dir = output ? path8.resolve(output) : cfg.outDir();
+    return exts.map((ext, i) => path8.join(dir, outputFileName(cfg.predictionId, i, ext)));
   }
-  const abs = path7.resolve(output);
+  const abs = path8.resolve(output);
   if (urls.length === 1) return [abs];
-  const base = abs.slice(0, -path7.extname(abs).length);
+  const base = abs.slice(0, -path8.extname(abs).length);
   return exts.map((ext, i) => `${base}-${String(i + 1).padStart(2, "0")}.${ext}`);
 }
 async function deliverPrediction(prediction, cfg) {
   const { logger, opts } = cfg;
+  const id = cfg.predictionId ?? prediction.id;
+  const retry = resumeCommand(id, opts.output);
   if (prediction.price !== void 0 && prediction.price !== "") {
     logger.info(`Cost: $${prediction.price}`);
   }
   const classified = classifyOutputs(prediction);
   if (classified.mode === "empty") {
     throw new ProviderError(
-      hasNsfwFlag(prediction) ? `Prediction ${prediction.id} returned no output: blocked by content safety (has_nsfw_contents). Try a different prompt or input.` : `Prediction ${prediction.id} completed but returned no outputs.`,
+      hasNsfwFlag(prediction) ? `Prediction ${id} returned no output: blocked by content safety (has_nsfw_contents). Try a different prompt or input.` : `Prediction ${id} completed but returned no outputs.`,
       ATLAS_PROVIDER
     );
   }
   for (const text of classified.texts) console.log(text);
   if (classified.mode === "text") {
     if (opts.output) {
-      const dest = isDirectoryOutput(opts.output) ? path7.resolve(opts.output, outputFileName(prediction.id, 0, "txt")) : path7.resolve(opts.output);
-      fs8.mkdirSync(path7.dirname(dest), { recursive: true });
-      fs8.writeFileSync(dest, `${classified.texts.join("\n\n")}
+      const dest = isDirectoryOutput(opts.output) ? path8.resolve(opts.output, outputFileName(id, 0, "txt")) : path8.resolve(opts.output);
+      fs9.mkdirSync(path8.dirname(dest), { recursive: true });
+      fs9.writeFileSync(dest, `${classified.texts.join("\n\n")}
 `, "utf8");
       logger.success(`Saved text output to ${dest}`);
       return { files: [dest], texts: classified.texts };
@@ -1954,26 +2314,39 @@ async function deliverPrediction(prediction, cfg) {
     return { files: [], texts: classified.texts };
   }
   const dests = planOutputPaths(classified.urls, {
-    predictionId: prediction.id,
+    predictionId: id,
     outDir: getOutputDir,
     output: opts.output,
     hint: cfg.hint
   });
-  const explicitFile = classified.urls.length === 1 && opts.output !== void 0 && !isDirectoryOutput(opts.output);
+  const policy = namingPolicy(opts.output, classified.urls.length);
+  const maxBytes = maxDownloadBytes();
   const saved = [];
+  const downloaded = [];
+  const reused = /* @__PURE__ */ new Set();
   let failed = 0;
   for (let i = 0; i < classified.urls.length; i++) {
     const url = classified.urls[i];
     const planned = dests[i];
-    const part = `${planned}.part`;
     try {
-      const contentType = await downloadFile(url, part);
-      const dest = explicitFile || outputExtension(url) ? planned : withContentTypeExtension(planned, contentType);
-      fs8.renameSync(part, dest);
+      const existing = policy === "reuse" ? savedOutput(planned) : void 0;
+      if (existing) {
+        saved.push(existing);
+        reused.add(existing);
+        logger.info(`Already saved: ${existing}`);
+        continue;
+      }
+      const dest = await downloadClaimed(
+        url,
+        (response) => policy === "overwrite" || outputExtension(url) ? planned : withContentTypeExtension(planned, response.headers.get("content-type")),
+        policy,
+        // Inline data: outputs are decoded by fetch, never sent over the network.
+        { maxBytes, validateUrl: isDataUrl(url) ? void 0 : checkOutputUrl }
+      );
       saved.push(dest);
+      downloaded.push(dest);
       logger.debug(`Downloaded ${redactUrl(url)} -> ${dest}`);
     } catch (e) {
-      fs8.rmSync(part, { force: true });
       failed++;
       logger.warn(
         `Download failed (${redactUrl(url)}): ${e instanceof Error ? e.message : String(e)}`
@@ -1982,11 +2355,11 @@ async function deliverPrediction(prediction, cfg) {
   }
   if (saved.length === 0) {
     throw new ProviderError(
-      `Prediction ${prediction.id} produced ${classified.urls.length} output(s) but none downloaded. Retry with: ${resumeCommand(prediction.id)}`,
+      `Prediction ${id} produced ${classified.urls.length} output(s) but none downloaded. Retry with: ${retry}`,
       ATLAS_PROVIDER
     );
   }
-  const images = saved.filter((f) => outputCategory(f) === "image");
+  const images = downloaded.filter((f) => outputCategory(f) === "image");
   const fileOutput = opts.output && !isDirectoryOutput(opts.output) ? opts.output : void 0;
   const finalImages = finalizeGeneratedImages(images, {
     imageFormat: opts.imageFormat,
@@ -1997,23 +2370,42 @@ async function deliverPrediction(prediction, cfg) {
   const files = saved.map((f) => finalImages[images.indexOf(f)] ?? f);
   const firstVideo = files.find((f) => outputCategory(f) === "video");
   if (firstVideo) {
-    await maybeDownloadThumb(prediction, firstVideo, { skip: opts.thumb === false, logger });
+    await maybeDownloadThumb(thumbnailSource(prediction), firstVideo, {
+      skip: opts.thumb === false,
+      logger,
+      download: async (thumbUrl, planned) => {
+        const existing = policy === "reuse" ? savedOutput(planned) : void 0;
+        if (existing) return { dest: existing };
+        const dest = await downloadClaimed(thumbUrl, () => planned, policy, {
+          maxBytes,
+          validateUrl: checkOutputUrl
+        });
+        return { dest };
+      }
+    });
   }
   console.log(`
-Prediction ${prediction.id}: saved ${files.length} file(s)`);
-  for (const f of files) console.log(`  ${f}`);
+Prediction ${id}: saved ${files.length} file(s)`);
+  for (const f of files) console.log(`  ${f}${reused.has(f) ? " (already saved)" : ""}`);
   if (failed > 0) {
     throw new ProviderError(
-      `Prediction ${prediction.id}: downloaded ${saved.length} of ${classified.urls.length} output(s); ${failed} failed. Saved: ${files.join(", ")}. Retry with: ${resumeCommand(prediction.id)}`,
+      `Prediction ${id}: downloaded ${saved.length} of ${classified.urls.length} output(s); ${failed} failed. Saved: ${files.join(", ")}. Retry with: ${retry}`,
       ATLAS_PROVIDER
     );
   }
   return { files, texts: classified.texts };
 }
+function isDataUrl(url) {
+  return /^data:/i.test(url.trim());
+}
+function namingPolicy(output, outputCount) {
+  if (!output || isDirectoryOutput(output)) return "reuse";
+  return outputCount === 1 ? "overwrite" : "unique";
+}
 function withContentTypeExtension(planned, contentType) {
   const ext = extensionForContentType(contentType);
   if (!ext) return planned;
-  const current = path7.extname(planned);
+  const current = path8.extname(planned);
   return `${current ? planned.slice(0, -current.length) : planned}.${ext}`;
 }
 
@@ -2148,12 +2540,12 @@ init_errors();
 
 // src/core/json-input.ts
 init_errors();
-import fs9 from "fs";
+import fs10 from "fs";
 function parseJsonInput(raw, flag = "--input") {
   let text;
   if (raw.startsWith("@")) {
     try {
-      text = fs9.readFileSync(raw.slice(1), "utf8");
+      text = fs10.readFileSync(raw.slice(1), "utf8");
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new ValidationError(`Cannot read ${flag} file: ${msg}`);
@@ -2238,7 +2630,7 @@ function registerAtlasStatusCommand(parent) {
     const wait = Boolean(opts.wait || opts.download);
     const prediction = wait ? await client.waitForPrediction(predictionId, {
       timeoutMs: parseTimeoutMs(opts.waitTimeout, STATUS_WAIT_MS),
-      resumeHint: `Resume with: ${resumeCommand(predictionId)}`,
+      resumeHint: `Resume with: ${resumeCommand(predictionId, opts.output)}`,
       onPoll: (p, n) => logger.debug(`poll ${n}: ${p.status}`)
     }) : await client.getPrediction(predictionId);
     if (!opts.download) {
@@ -2247,7 +2639,11 @@ function registerAtlasStatusCommand(parent) {
       return;
     }
     assertPredictionSucceeded(prediction);
-    await deliverPrediction(prediction, { logger, opts: { ...opts, download: true } });
+    await deliverPrediction(prediction, {
+      logger,
+      opts: { ...opts, download: true },
+      predictionId
+    });
   });
 }
 
@@ -2377,11 +2773,11 @@ function registerAtlasCloudCommands(program2) {
 }
 
 // src/providers/byteplus/commands/generate-3d.ts
-import path9 from "path";
+import path10 from "path";
 
 // src/core/image-input.ts
-import fs10 from "fs/promises";
-import path8 from "path";
+import fs11 from "fs/promises";
+import path9 from "path";
 var IMAGE_MIME_BY_EXT = {
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
@@ -2408,7 +2804,7 @@ function isHttpUrl(input) {
   return /^https?:\/\//i.test(input);
 }
 async function readAsDataUrl(filePath, mimeTable, kindLabel, opts = {}) {
-  const ext = path8.extname(filePath).toLowerCase();
+  const ext = path9.extname(filePath).toLowerCase();
   const mime = mimeTable[ext];
   if (!mime) {
     throw new Error(
@@ -2417,7 +2813,7 @@ async function readAsDataUrl(filePath, mimeTable, kindLabel, opts = {}) {
   }
   const hard = opts.hardLimitBytes ?? DEFAULT_HARD_LIMIT_BYTES;
   const soft = opts.softLimitBytes ?? DEFAULT_SOFT_LIMIT_BYTES;
-  const buf = await fs10.readFile(filePath);
+  const buf = await fs11.readFile(filePath);
   if (buf.byteLength > hard) {
     throw new Error(
       `${kindLabel} file ${filePath} is ${(buf.byteLength / 1024 / 1024).toFixed(1)}MB \u2014 exceeds ${(hard / 1024 / 1024).toFixed(0)}MB limit. Upload to a URL instead.`
@@ -2546,9 +2942,9 @@ var BytePlusClient = class {
   }
   apiKey;
   baseUrl;
-  async request(path57, opts = {}) {
+  async request(path58, opts = {}) {
     const base = this.baseUrl.replace(/\/$/, "");
-    const url = new URL(base + path57);
+    const url = new URL(base + path58);
     if (opts.query) {
       for (const [k, v] of Object.entries(opts.query)) {
         if (v !== void 0 && v !== null) url.searchParams.set(k, String(v));
@@ -2566,14 +2962,14 @@ var BytePlusClient = class {
       timeoutMs: opts.timeoutMs ?? 12e4
     });
   }
-  get(path57, query, logger) {
-    return this.request(path57, { method: "GET", query, logger });
+  get(path58, query, logger) {
+    return this.request(path58, { method: "GET", query, logger });
   }
-  post(path57, body, logger) {
-    return this.request(path57, { method: "POST", body, logger });
+  post(path58, body, logger) {
+    return this.request(path58, { method: "POST", body, logger });
   }
-  delete(path57, logger) {
-    return this.request(path57, { method: "DELETE", logger });
+  delete(path58, logger) {
+    return this.request(path58, { method: "DELETE", logger });
   }
 };
 function createBytePlusClient() {
@@ -2678,7 +3074,7 @@ function registerBytePlusGenerate3DCommand(parent) {
           process.exit(1);
         }
         const ext = inferModelFileExt(url);
-        const outPath = opts.output ?? path9.join(getOutputDir(), `byteplus-3d-${taskId.slice(0, 8)}-${Date.now()}.${ext}`);
+        const outPath = opts.output ?? path10.join(getOutputDir(), `byteplus-3d-${taskId.slice(0, 8)}-${Date.now()}.${ext}`);
         await downloadModelFile(url, outPath, logger);
         console.log(`
 Task: ${taskId}`);
@@ -2701,8 +3097,8 @@ Task: ${taskId}`);
 }
 
 // src/providers/byteplus/generators/image.ts
-import fs11 from "fs";
-import path10 from "path";
+import fs12 from "fs";
+import path11 from "path";
 var ASPECT_TO_SIZE = {
   "1:1": "2048x2048",
   "16:9": "2560x1440",
@@ -2766,14 +3162,14 @@ async function generateSeedream(client, opts) {
     }
     const ext = (() => {
       try {
-        const e = path10.extname(new URL(url).pathname);
+        const e = path11.extname(new URL(url).pathname);
         return e || ".jpg";
       } catch {
         return ".jpg";
       }
     })();
-    const filename = opts.output && items.length === 1 ? path10.resolve(opts.output) : path10.join(outDir, `byteplus-image-${ts}-${i + 1}${ext}`);
-    fs11.mkdirSync(path10.dirname(filename), { recursive: true });
+    const filename = opts.output && items.length === 1 ? path11.resolve(opts.output) : path11.join(outDir, `byteplus-image-${ts}-${i + 1}${ext}`);
+    fs12.mkdirSync(path11.dirname(filename), { recursive: true });
     await downloadFile(url, filename);
     saved.push({ path: filename, url, seed: item.seed });
     logger?.success(`Saved ${filename}`);
@@ -2861,7 +3257,7 @@ function collect2(value, prev) {
 }
 
 // src/providers/byteplus/commands/image-to-video.ts
-import path11 from "path";
+import path12 from "path";
 
 // src/providers/byteplus/generators/video.ts
 function buildFlagSuffix(opts) {
@@ -2984,7 +3380,7 @@ function registerBytePlusImageToVideoCommand(parent) {
           logger.error(`Task succeeded but no video_url: ${JSON.stringify(final)}`);
           process.exit(1);
         }
-        const outPath = opts.output ?? path11.join(getOutputDir(), `byteplus-i2v-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
+        const outPath = opts.output ?? path12.join(getOutputDir(), `byteplus-i2v-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
         await downloadVideo(url, outPath, logger);
         await maybeDownloadThumb(final, outPath, {
           skip: opts.thumb === false,
@@ -3010,7 +3406,7 @@ Task: ${taskId}`);
 }
 
 // src/providers/byteplus/commands/reference-to-video.ts
-import path12 from "path";
+import path13 from "path";
 
 // src/providers/byteplus/reference-input.ts
 var MAX_TOTAL_REFS = 12;
@@ -3042,10 +3438,10 @@ function toRef(kind, resolved, role) {
   return { kind, url: resolved.dataUrl, mime: resolved.mime, role };
 }
 async function resolveRefSpec(kind, spec, logger) {
-  const { path: path57, role } = parseRefSpec(spec);
-  if (kind === "image") return toRef(kind, await resolveImageInput(path57, logger), role);
-  if (kind === "video") return toRef(kind, await resolveVideoInput(path57, logger), role);
-  return toRef(kind, await resolveAudioInput(path57, logger), role);
+  const { path: path58, role } = parseRefSpec(spec);
+  if (kind === "image") return toRef(kind, await resolveImageInput(path58, logger), role);
+  if (kind === "video") return toRef(kind, await resolveVideoInput(path58, logger), role);
+  return toRef(kind, await resolveAudioInput(path58, logger), role);
 }
 async function resolveRefSpecs(specs, logger) {
   const out = [];
@@ -3142,7 +3538,7 @@ function registerBytePlusReferenceToVideoCommand(parent) {
           logger.error(`Task succeeded but no video_url: ${JSON.stringify(final)}`);
           process.exit(1);
         }
-        const outPath = opts.output ?? path12.join(getOutputDir(), `byteplus-r2v-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
+        const outPath = opts.output ?? path13.join(getOutputDir(), `byteplus-r2v-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
         await downloadVideo(url, outPath, logger);
         await maybeDownloadThumb(final, outPath, {
           skip: opts.thumb === false,
@@ -3168,7 +3564,7 @@ Task: ${taskId}`);
 }
 
 // src/providers/byteplus/commands/status.ts
-import path13 from "path";
+import path14 from "path";
 function registerBytePlusStatusCommand(parent) {
   parent.command("status <taskId>").description("Get a Seedance task's status; --wait + --download to fetch the result MP4").option("--wait", "Poll until terminal status").option("--wait-timeout <ms>", "Poll timeout in ms (with --wait)", "600000").option("--download", "Download MP4 on success (implies --wait)").option("--output <path>", "Output MP4 path (with --download)").option("--no-thumb", "Skip downloading the thumbnail if the API returns one").option("-v, --verbose", "Verbose logging").action(
     async (taskId, opts) => {
@@ -3186,7 +3582,7 @@ function registerBytePlusStatusCommand(parent) {
           const videoUrl2 = content?.video_url;
           const fileUrl = content?.file_url;
           if (videoUrl2) {
-            const outPath = opts.output ?? path13.join(getOutputDir(), `byteplus-video-${taskId.slice(0, 8)}.mp4`);
+            const outPath = opts.output ?? path14.join(getOutputDir(), `byteplus-video-${taskId.slice(0, 8)}.mp4`);
             await downloadVideo(videoUrl2, outPath, logger);
             await maybeDownloadThumb(status, outPath, {
               skip: opts.thumb === false,
@@ -3196,7 +3592,7 @@ function registerBytePlusStatusCommand(parent) {
             console.log(`Saved: ${outPath}`);
           } else if (fileUrl) {
             const ext = inferModelFileExt(fileUrl);
-            const outPath = opts.output ?? path13.join(getOutputDir(), `byteplus-3d-${taskId.slice(0, 8)}.${ext}`);
+            const outPath = opts.output ?? path14.join(getOutputDir(), `byteplus-3d-${taskId.slice(0, 8)}.${ext}`);
             await downloadModelFile(fileUrl, outPath, logger);
             console.log(`Saved: ${outPath}`);
           } else {
@@ -3220,7 +3616,7 @@ function registerBytePlusStatusCommand(parent) {
 }
 
 // src/providers/byteplus/commands/video.ts
-import path14 from "path";
+import path15 from "path";
 function registerBytePlusVideoCommand(parent) {
   parent.command("video").description("Generate a video from a text prompt via BytePlus Seedance 2.0").requiredOption("--prompt <text>", "Text prompt").option("-m, --model <id>", "Model id", BYTEPLUS_DEFAULTS.videoModel).option("--resolution <r>", "480p|720p|1080p|2k", BYTEPLUS_DEFAULTS.videoResolution).option("--duration <n>", "Duration seconds (4-15)", String(BYTEPLUS_DEFAULTS.videoDuration)).option(
     "--aspect-ratio <r>",
@@ -3262,7 +3658,7 @@ function registerBytePlusVideoCommand(parent) {
           logger.error(`Task succeeded but no video_url in response: ${JSON.stringify(final)}`);
           process.exit(1);
         }
-        const outPath = opts.output ?? path14.join(getOutputDir(), `byteplus-video-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
+        const outPath = opts.output ?? path15.join(getOutputDir(), `byteplus-video-${taskId.slice(0, 8)}-${Date.now()}.mp4`);
         await downloadVideo(url, outPath, logger);
         await maybeDownloadThumb(final, outPath, {
           skip: opts.thumb === false,
@@ -3548,15 +3944,15 @@ async function downloadVideo2(url) {
 
 // src/providers/cloudflare/media-output.ts
 init_errors();
-import fs12 from "fs";
-import path15 from "path";
+import fs13 from "fs";
+import path16 from "path";
 function destination(filename, output) {
-  return output ? path15.resolve(output) : path15.join(getOutputDir(), filename);
+  return output ? path16.resolve(output) : path16.join(getOutputDir(), filename);
 }
 function saveBytes(bytes, filename, output) {
   const dest = destination(filename, output);
-  fs12.mkdirSync(path15.dirname(dest), { recursive: true });
-  fs12.writeFileSync(dest, bytes);
+  fs13.mkdirSync(path16.dirname(dest), { recursive: true });
+  fs13.writeFileSync(dest, bytes);
   return dest;
 }
 function saveBase64Image(image, output) {
@@ -3739,8 +4135,8 @@ function registerCloudflareCommands(program2) {
 }
 
 // src/providers/elevenlabs/client.ts
-import fs13 from "fs";
-import path16 from "path";
+import fs14 from "fs";
+import path17 from "path";
 init_errors();
 
 // src/providers/elevenlabs/models.ts
@@ -3903,10 +4299,10 @@ async function apiPostMultipart(endpoint2, form, apiKey, opts = {}) {
   return res.json();
 }
 function readFileAsBlob(filePath, fieldFilename) {
-  const abs = path16.resolve(filePath);
-  if (!fs13.existsSync(abs)) throw new ValidationError(`File not found: ${abs}`);
-  const buf = fs13.readFileSync(abs);
-  const name = fieldFilename ?? path16.basename(abs);
+  const abs = path17.resolve(filePath);
+  if (!fs14.existsSync(abs)) throw new ValidationError(`File not found: ${abs}`);
+  const buf = fs14.readFileSync(abs);
+  const name = fieldFilename ?? path17.basename(abs);
   return new File([new Uint8Array(buf)], name);
 }
 async function pollUntil2(fetchStatus, isDone, isFailed, opts = {}) {
@@ -3930,12 +4326,12 @@ async function pollUntil2(fetchStatus, isDone, isFailed, opts = {}) {
 function saveBytes2(opts) {
   const { bytes, task, ext, outputCopy, logger } = opts;
   const dir = getOutputDir();
-  const dest = path16.join(dir, `elevenlabs_${task}_${Date.now()}.${ext}`);
-  fs13.writeFileSync(dest, bytes);
+  const dest = path17.join(dir, `elevenlabs_${task}_${Date.now()}.${ext}`);
+  fs14.writeFileSync(dest, bytes);
   logger?.success(`Saved: ${dest} (${(bytes.length / 1024).toFixed(1)} KB)`);
   if (outputCopy) {
-    fs13.mkdirSync(path16.dirname(path16.resolve(outputCopy)), { recursive: true });
-    fs13.copyFileSync(dest, outputCopy);
+    fs14.mkdirSync(path17.dirname(path17.resolve(outputCopy)), { recursive: true });
+    fs14.copyFileSync(dest, outputCopy);
   }
   return dest;
 }
@@ -3974,14 +4370,14 @@ ${models.length} models`);
 }
 
 // src/providers/elevenlabs/commands/align.ts
-import fs14 from "fs";
-import path17 from "path";
+import fs15 from "fs";
+import path18 from "path";
 function registerAlignCommand(parent) {
   parent.command("align").description("Forced alignment of audio to a transcript (returns word/char timestamps)").requiredOption("--input <path>", "Source audio file").requiredOption("--text <str>", "Transcript text (or pass --text-file)").option("--text-file <path>", "Read transcript from file").option("--output <path>", "Save JSON to this path (default: multix-output)").option("-v, --verbose", "Verbose logging").action(async (opts) => {
     const logger = createLogger({ verbose: opts.verbose ?? false });
     const apiKey = requireElevenLabsKey();
     let text = opts.text;
-    if (opts.textFile) text = fs14.readFileSync(path17.resolve(opts.textFile), "utf8");
+    if (opts.textFile) text = fs15.readFileSync(path18.resolve(opts.textFile), "utf8");
     const form = new FormData();
     form.append("file", readFileAsBlob(opts.input));
     form.append("text", text);
@@ -3989,9 +4385,9 @@ function registerAlignCommand(parent) {
     const data = await apiPostMultipart("forced-alignment", form, apiKey, {
       timeoutMs: 6e5
     });
-    const dest = opts.output ? path17.resolve(opts.output) : path17.join(getOutputDir(), `elevenlabs_align_${Date.now()}.json`);
-    fs14.mkdirSync(path17.dirname(dest), { recursive: true });
-    fs14.writeFileSync(dest, JSON.stringify(data, null, 2));
+    const dest = opts.output ? path18.resolve(opts.output) : path18.join(getOutputDir(), `elevenlabs_align_${Date.now()}.json`);
+    fs15.mkdirSync(path18.dirname(dest), { recursive: true });
+    fs15.writeFileSync(dest, JSON.stringify(data, null, 2));
     logger.success(`Saved alignment: ${dest}`);
     if (data.words) console.log(`Aligned ${data.words.length} words (loss=${data.loss ?? "?"})`);
   });
@@ -4033,8 +4429,8 @@ function registerCloneCommand(parent) {
 
 // src/providers/elevenlabs/commands/dub.ts
 init_errors();
-import fs15 from "fs";
-import path18 from "path";
+import fs16 from "fs";
+import path19 from "path";
 function registerDubCommand(parent) {
   parent.command("dub").description("Dub a video/audio file into target languages (async)").option("--input <path>", "Source media file (use --input or --source-url)").option("--source-url <url>", "Public URL of source media").requiredOption("--target-lang <code>", "Target language ISO code (e.g. es, fr, de)").option("--source-lang <code>", "Source language (auto if omitted)").option("--num-speakers <n>", "Speaker count (auto if omitted)").option("--watermark", "Add ElevenLabs watermark", false).option("--start-time <s>", "Start time in seconds").option("--end-time <s>", "End time in seconds").option("--highest-resolution", "Use highest resolution video", false).option("--name <n>", "Project display name").option("--async", "Return job id immediately, do not wait", false).option("--wait", "Wait until status=dubbed (implied by --download)", false).option("--download", "Download dubbed media when ready", false).option("--poll-interval <s>", "Poll interval seconds", "10").option("--wait-timeout <ms>", "Poll timeout", "1800000").option("--output <path>", "Output path for downloaded dub").option("-v, --verbose", "Verbose logging").action(async (opts) => {
     const logger = createLogger({ verbose: opts.verbose ?? false });
@@ -4077,7 +4473,7 @@ function registerDubCommand(parent) {
     );
     logger.success(`Dub complete: ${start.dubbing_id}`);
     if (opts.download) {
-      const dest = opts.output ? path18.resolve(opts.output) : path18.join(getOutputDir(), `elevenlabs_dub_${start.dubbing_id}_${opts.targetLang}.mp4`);
+      const dest = opts.output ? path19.resolve(opts.output) : path19.join(getOutputDir(), `elevenlabs_dub_${start.dubbing_id}_${opts.targetLang}.mp4`);
       const url = `${ELEVENLABS_BASE_URL}/dubbing/${start.dubbing_id}/audio/${opts.targetLang}`;
       await downloadDub(url, apiKey, dest);
       logger.success(`Saved: ${dest}`);
@@ -4092,7 +4488,7 @@ Dubbed file: ${dest}`);
     const status = await apiGet(`dubbing/${dubbingId}`, apiKey);
     console.log(JSON.stringify(status, null, 2));
     if (opts.download) {
-      const dest = opts.output ? path18.resolve(opts.output) : path18.join(getOutputDir(), `elevenlabs_dub_${dubbingId}_${opts.download}.mp4`);
+      const dest = opts.output ? path19.resolve(opts.output) : path19.join(getOutputDir(), `elevenlabs_dub_${dubbingId}_${opts.download}.mp4`);
       const url = `${ELEVENLABS_BASE_URL}/dubbing/${dubbingId}/audio/${opts.download}`;
       await downloadDub(url, apiKey, dest);
       console.log(`Saved: ${dest}`);
@@ -4100,7 +4496,7 @@ Dubbed file: ${dest}`);
   });
 }
 async function downloadDub(url, apiKey, dest) {
-  fs15.mkdirSync(path18.dirname(dest), { recursive: true });
+  fs16.mkdirSync(path19.dirname(dest), { recursive: true });
   const { response: res } = await fetchWithValidatedRedirects(url, {
     headers: { "xi-api-key": apiKey },
     signal: AbortSignal.timeout(6e5)
@@ -4109,7 +4505,7 @@ async function downloadDub(url, apiKey, dest) {
     throw new Error(`Failed to download dub: HTTP ${res.status}`);
   }
   const arr = new Uint8Array(await res.arrayBuffer());
-  fs15.writeFileSync(dest, arr);
+  fs16.writeFileSync(dest, arr);
 }
 
 // src/providers/elevenlabs/commands/isolate.ts
@@ -4137,8 +4533,8 @@ Isolated audio: ${dest}`);
 
 // src/providers/elevenlabs/commands/music.ts
 init_errors();
-import fs16 from "fs";
-import path19 from "path";
+import fs17 from "fs";
+import path20 from "path";
 function registerMusicCommand(parent) {
   parent.command("music").description("Generate music from a text prompt or composition plan").option("--prompt <str>", "Music prompt (mutually exclusive with --plan)").option("--plan <path>", "Path to composition plan JSON file").option("--music-length-ms <n>", "Total length in milliseconds (default 30000)").option("--model <id>", "Music model", "music_v1").option(
     "--format <fmt>",
@@ -4153,9 +4549,9 @@ function registerMusicCommand(parent) {
     const payload = { model_id: opts.model };
     if (opts.prompt) payload.prompt = opts.prompt;
     if (opts.plan) {
-      const planPath = path19.resolve(opts.plan);
-      if (!fs16.existsSync(planPath)) throw new ValidationError(`Plan file not found: ${planPath}`);
-      const planJson = JSON.parse(fs16.readFileSync(planPath, "utf8"));
+      const planPath = path20.resolve(opts.plan);
+      if (!fs17.existsSync(planPath)) throw new ValidationError(`Plan file not found: ${planPath}`);
+      const planJson = JSON.parse(fs17.readFileSync(planPath, "utf8"));
       payload.composition_plan = planJson;
     }
     if (opts.musicLengthMs) payload.music_length_ms = Number.parseInt(opts.musicLengthMs, 10);
@@ -4214,8 +4610,8 @@ Generated SFX: ${dest}`);
 }
 
 // src/providers/elevenlabs/commands/transcribe.ts
-import fs17 from "fs";
-import path20 from "path";
+import fs18 from "fs";
+import path21 from "path";
 function registerTranscribeCommand(parent) {
   parent.command("transcribe").description("Speech-to-text transcription with Scribe").requiredOption("--input <path>", "Audio or video file to transcribe").option(
     "--model <id>",
@@ -4238,7 +4634,7 @@ function registerTranscribeCommand(parent) {
     });
     const ext = opts.format === "json" ? "json" : opts.format === "srt" ? "srt" : opts.format === "vtt" ? "vtt" : "txt";
     const dir = getOutputDir();
-    const dest = opts.output ? path20.resolve(opts.output) : path20.join(dir, `elevenlabs_transcribe_${Date.now()}.${ext}`);
+    const dest = opts.output ? path21.resolve(opts.output) : path21.join(dir, `elevenlabs_transcribe_${Date.now()}.${ext}`);
     let body;
     switch (opts.format) {
       case "json":
@@ -4253,8 +4649,8 @@ function registerTranscribeCommand(parent) {
       default:
         body = data.text ?? "";
     }
-    fs17.mkdirSync(path20.dirname(dest), { recursive: true });
-    fs17.writeFileSync(dest, body);
+    fs18.mkdirSync(path21.dirname(dest), { recursive: true });
+    fs18.writeFileSync(dest, body);
     logger.success(`Saved transcript: ${dest}`);
     if (data.language_code) {
       logger.info(
@@ -4500,8 +4896,8 @@ function registerElevenLabsCommands(program2) {
 }
 
 // src/providers/fal/commands/image.ts
-import fs19 from "fs";
-import path22 from "path";
+import fs20 from "fs";
+import path23 from "path";
 
 // src/providers/fal/models.ts
 var DEFAULT_FAL_BASE_URL = "https://queue.fal.run";
@@ -4520,14 +4916,43 @@ var FAL_DEFAULTS = {
 };
 
 // src/providers/fal/run-helpers.ts
-import fs18 from "fs";
-import path21 from "path";
+init_errors();
+import fs19 from "fs";
+import path22 from "path";
 init_redact();
 
 // src/providers/fal/client.ts
 init_errors();
 init_errors();
 init_redact();
+var FAL_QUEUE_HOST = "queue.fal.run";
+function parseUrl(url) {
+  try {
+    return new URL(url);
+  } catch {
+    return void 0;
+  }
+}
+function normalizedHost(u) {
+  return u.hostname.toLowerCase().replace(/\.$/, "");
+}
+function normalizedOrigin(u) {
+  return `${u.protocol}//${normalizedHost(u)}:${u.port}`;
+}
+function assertTrustedFalUrl(url, baseUrl) {
+  const target = parseUrl(url);
+  if (!target) {
+    throw new ProviderError("Refusing to send the fal key to a malformed URL", "fal");
+  }
+  const base = parseUrl(baseUrl);
+  if (base && normalizedOrigin(target) === normalizedOrigin(base)) return;
+  const host = normalizedHost(target);
+  if (target.protocol === "https:" && host === FAL_QUEUE_HOST && target.port === "") return;
+  throw new ProviderError(
+    `Refusing to send the fal key to ${host || "this URL"}: not https://${FAL_QUEUE_HOST} or the FAL_BASE_URL origin`,
+    "fal"
+  );
+}
 function requireFalKey() {
   const key = resolveRoutedKey(FAL_ROUTING);
   if (!key) {
@@ -4546,13 +4971,25 @@ var FalClient = class {
   apiKey;
   baseUrl;
   /** `path` is appended verbatim to the base queue URL, e.g. "/fal-ai/flux/schnell". */
-  async request(path57, opts = {}) {
+  async request(path58, opts = {}) {
     const base = this.baseUrl.replace(/\/$/, "");
-    const suffix = path57.startsWith("/") ? path57 : `/${path57}`;
-    return this.requestAbsolute(base + suffix, opts);
+    const suffix = path58.startsWith("/") ? path58 : `/${path58}`;
+    return this.send(base + suffix, opts);
   }
-  /** Same auth/headers as `request`, but `url` is used verbatim (e.g. a status_url/response_url returned by submit). */
+  /**
+   * Same auth/headers as `request`, but `url` is used verbatim (e.g. a
+   * status_url/response_url returned by submit). The URL must pass
+   * {@link assertTrustedFalUrl} before the key is sent.
+   */
   async requestAbsolute(url, opts = {}) {
+    assertTrustedFalUrl(url, this.baseUrl);
+    return this.send(url, opts);
+  }
+  /** Throws a ProviderError when `url` may not receive the key (see {@link assertTrustedFalUrl}). */
+  assertTrustedUrl(url) {
+    assertTrustedFalUrl(url, this.baseUrl);
+  }
+  async send(url, opts) {
     opts.logger?.debug(`${opts.method ?? "GET"} ${redactUrl(url)}`);
     return httpJson({
       url,
@@ -4565,11 +5002,11 @@ var FalClient = class {
       timeoutMs: opts.timeoutMs ?? 12e4
     });
   }
-  get(path57, logger) {
-    return this.request(path57, { method: "GET", logger });
+  get(path58, logger) {
+    return this.request(path58, { method: "GET", logger });
   }
-  post(path57, body, logger) {
-    return this.request(path57, { method: "POST", body, logger });
+  post(path58, body, logger) {
+    return this.request(path58, { method: "POST", body, logger });
   }
   getAbsolute(url, logger) {
     return this.requestAbsolute(url, { method: "GET", logger });
@@ -4620,6 +5057,13 @@ async function submitAndWait(opts) {
   const submitRes = await client.post(submitPath(model), input, logger);
   const requestId = submitRes.request_id;
   logger.debug(`request_id: ${requestId}`);
+  for (const field of ["status_url", "response_url"]) {
+    const url = submitRes[field];
+    if (typeof url !== "string" || url === "") {
+      throw new ProviderError(`fal submit response is missing ${field}`, "fal");
+    }
+    client.assertTrustedUrl(url);
+  }
   logger.info("Polling for completion...");
   const waitTimeoutMs = opts.waitTimeoutMs ?? 48e4;
   const intervalMs = opts.pollIntervalMs ?? 3e3;
@@ -4711,7 +5155,7 @@ function extractMediaUrls(result) {
 function extFromUrl(url, fallback = ".bin") {
   try {
     const u = new URL(url);
-    const e = path21.extname(u.pathname);
+    const e = path22.extname(u.pathname);
     return e.length > 0 ? e : fallback;
   } catch {
     return fallback;
@@ -4724,13 +5168,13 @@ async function downloadResultMedia(urls, outDir, requestId, logger) {
     if (!url) continue;
     const ext = extFromUrl(url);
     const filename = `fal-${requestId.slice(0, 8)}-${String(i + 1).padStart(2, "0")}${ext}`;
-    const filepath = path21.join(outDir, filename);
+    const filepath = path22.join(outDir, filename);
     try {
       await downloadFile(url, filepath);
       saved.push(filepath);
       logger.success(`Saved ${filepath}`);
     } catch (e) {
-      fs18.rmSync(filepath, { force: true });
+      fs19.rmSync(filepath, { force: true });
       logger.warn(`Download failed for ${redactUrl(url)}: ${e instanceof Error ? e.message : e}`);
     }
   }
@@ -4775,9 +5219,9 @@ function registerFalImageCommand(parent) {
         process.exit(1);
       }
       if (opts.output && saved[0]) {
-        const dest = path22.resolve(opts.output);
-        fs19.mkdirSync(path22.dirname(dest), { recursive: true });
-        fs19.copyFileSync(saved[0], dest);
+        const dest = path23.resolve(opts.output);
+        fs20.mkdirSync(path23.dirname(dest), { recursive: true });
+        fs20.copyFileSync(saved[0], dest);
         logger.success(`Copied to ${dest}`);
       }
       const finalImages = finalizeGeneratedImages(saved, { ...opts, logger });
@@ -4932,9 +5376,9 @@ function registerFalCommands(program2) {
 
 // src/core/stdin-file.ts
 init_errors();
-import fs20 from "fs";
-import os2 from "os";
-import path23 from "path";
+import fs21 from "fs";
+import os3 from "os";
+import path24 from "path";
 
 // src/core/limits.ts
 var FILES_API_MAX_BYTES = 2e9;
@@ -5039,7 +5483,7 @@ function trackTempDir(dir) {
   let done = false;
   const remove = () => {
     try {
-      fs20.rmSync(dir, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+      fs21.rmSync(dir, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
     } catch {
     }
   };
@@ -5071,9 +5515,9 @@ async function stdinToTempFile(opts = {}) {
   }
   const forcedExt = opts.ext ? normalizeExt(opts.ext) : void 0;
   const maxBytes = opts.maxBytes ?? MAX_STDIN_BYTES;
-  const dir = fs20.mkdtempSync(path23.join(os2.tmpdir(), "multix-stdin-"));
+  const dir = fs21.mkdtempSync(path24.join(os3.tmpdir(), "multix-stdin-"));
   const cleanup = trackTempDir(dir);
-  const rawPath = path23.join(dir, "input");
+  const rawPath = path24.join(dir, "input");
   const hint = setTimeout(() => {
     process.stderr.write(`Waiting for data on stdin (\`${flag} -\`)... press Ctrl+C to cancel
 `);
@@ -5082,7 +5526,7 @@ async function stdinToTempFile(opts = {}) {
   let head = Buffer.alloc(0);
   let size = 0;
   try {
-    const fd = fs20.openSync(rawPath, "w", 384);
+    const fd = fs21.openSync(rawPath, "w", 384);
     try {
       for await (const chunk of input) {
         clearTimeout(hint);
@@ -5094,17 +5538,17 @@ async function stdinToTempFile(opts = {}) {
           head = Buffer.concat([head, buf.subarray(0, HEAD_BYTES - head.length)]);
         }
         let offset = 0;
-        while (offset < buf.length) offset += fs20.writeSync(fd, buf, offset);
+        while (offset < buf.length) offset += fs21.writeSync(fd, buf, offset);
         size += buf.length;
       }
     } finally {
       clearTimeout(hint);
-      fs20.closeSync(fd);
+      fs21.closeSync(fd);
     }
     if (size === 0) throw new ValidationError(`\`${flag} -\` was given but stdin was empty`);
     const detectedExt = forcedExt ?? detectExtension(head);
-    const finalPath = path23.join(dir, `stdin${detectedExt ?? ".bin"}`);
-    fs20.renameSync(rawPath, finalPath);
+    const finalPath = path24.join(dir, `stdin${detectedExt ?? ".bin"}`);
+    fs21.renameSync(rawPath, finalPath);
     return { path: finalPath, size, detected: detectedExt !== void 0, cleanup };
   } catch (error) {
     cleanup();
@@ -5122,7 +5566,7 @@ async function resolveFileInputs(files, opts = {}) {
     throw new ValidationError(`--stdin-ext only applies when ${flag} includes \`-\``);
   }
   for (const f of files) {
-    if (f !== STDIN_ARG && !fs20.existsSync(f)) throw new ValidationError(`File not found: ${f}`);
+    if (f !== STDIN_ARG && !fs21.existsSync(f)) throw new ValidationError(`File not found: ${f}`);
   }
   if (stdinCount === 0) {
     return { inputs: files.map((f) => ({ path: f, label: f })), cleanup: () => {
@@ -5410,12 +5854,12 @@ async function withGeminiKey(fn, opts = {}) {
 }
 
 // src/providers/gemini/local-files.ts
-import fs21 from "fs";
-import path25 from "path";
+import fs22 from "fs";
+import path26 from "path";
 init_errors();
 
 // src/providers/gemini/task-resolver.ts
-import path24 from "path";
+import path25 from "path";
 var MIME_MAP = {
   // Audio
   ".mp3": "audio/mp3",
@@ -5456,7 +5900,7 @@ var MIME_MAP = {
   ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation"
 };
 function getMimeType(filePath) {
-  const ext = path24.extname(filePath).toLowerCase();
+  const ext = path25.extname(filePath).toLowerCase();
   return MIME_MAP[ext] ?? "application/octet-stream";
 }
 
@@ -5476,10 +5920,10 @@ function minUploadBytesPerSec() {
 }
 async function uploadLocalFile(filePath, opts = {}) {
   const bytesPerSec = minUploadBytesPerSec();
-  const blob = await fs21.openAsBlob(filePath);
+  const blob = await fs22.openAsBlob(filePath);
   const source = {
     blob,
-    displayName: path25.basename(filePath),
+    displayName: path26.basename(filePath),
     mimeType: getMimeType(filePath),
     label: filePath
   };
@@ -5487,12 +5931,12 @@ async function uploadLocalFile(filePath, opts = {}) {
   return opts.apiKey ? upload(opts.apiKey) : withGeminiKey(upload, { logger: opts.logger });
 }
 function inlinePart(filePath) {
-  const data = fs21.readFileSync(filePath).toString("base64");
+  const data = fs22.readFileSync(filePath).toString("base64");
   const mimeType = getMimeType(filePath);
   return { inlineData: { mimeType, data } };
 }
 function shouldUseFileApi(filePath) {
-  const stat = fs21.statSync(filePath);
+  const stat = fs22.statSync(filePath);
   return stat.size > INLINE_MAX_BYTES;
 }
 
@@ -5543,13 +5987,13 @@ function getDefaultModel(task) {
 }
 
 // src/providers/gemini/result-formatter.ts
-import fs22 from "fs";
-import path26 from "path";
+import fs23 from "fs";
+import path27 from "path";
 function formatResults(results, format, outputPath) {
   const content = renderFormat(results, format);
   if (outputPath) {
-    fs22.mkdirSync(path26.dirname(path26.resolve(outputPath)), { recursive: true });
-    fs22.writeFileSync(outputPath, content, "utf8");
+    fs23.mkdirSync(path27.dirname(path27.resolve(outputPath)), { recursive: true });
+    fs23.writeFileSync(outputPath, content, "utf8");
   } else {
     process.stdout.write(content);
   }
@@ -5733,8 +6177,8 @@ function registerExtractCommand(parent) {
 init_errors();
 
 // src/providers/gemini/generators/speech.ts
-import fs23 from "fs";
-import path27 from "path";
+import fs24 from "fs";
+import path28 from "path";
 
 // src/providers/gemini/voices.ts
 var GEMINI_TTS_VOICES = [
@@ -5906,12 +6350,12 @@ function extractWavData(wav) {
 }
 function saveSpeech(outBytes, outputFormat, output, logger) {
   const outDir = getOutputDir();
-  const dest = path27.join(outDir, `gemini_speech_${Date.now()}.${outputFormat}`);
-  fs23.writeFileSync(dest, outBytes);
+  const dest = path28.join(outDir, `gemini_speech_${Date.now()}.${outputFormat}`);
+  fs24.writeFileSync(dest, outBytes);
   logger?.success(`Saved: ${dest} (${(outBytes.length / 1024).toFixed(1)} KB)`);
   if (output) {
-    fs23.mkdirSync(path27.dirname(path27.resolve(output)), { recursive: true });
-    fs23.copyFileSync(dest, output);
+    fs24.mkdirSync(path28.dirname(path28.resolve(output)), { recursive: true });
+    fs24.copyFileSync(dest, output);
     logger?.success(`Copied to: ${output}`);
   }
   return dest;
@@ -6024,24 +6468,24 @@ function collectSpeakers(value, prev) {
 
 // src/providers/gemini/commands/generate-video.ts
 init_errors();
-import fs25 from "fs";
-import path28 from "path";
+import fs26 from "fs";
+import path29 from "path";
 
 // src/providers/gemini/veo.ts
-import fs24 from "fs";
+import fs25 from "fs";
 init_errors();
 var API_HOST = "generativelanguage.googleapis.com";
 var BASE2 = `https://${API_HOST}/v1beta`;
 var VEO_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/webp"]);
 var VEO_TIMEOUT_MS = 10 * 60 * 1e3;
 function veoImageFromFile(imgPath) {
-  if (!fs24.existsSync(imgPath)) throw new ValidationError(`Image not found: ${imgPath}`);
+  if (!fs25.existsSync(imgPath)) throw new ValidationError(`Image not found: ${imgPath}`);
   const detected = getMimeType(imgPath);
   const mimeType = detected === "application/octet-stream" ? "image/jpeg" : detected;
   if (!VEO_IMAGE_TYPES.has(mimeType)) {
     throw new ValidationError(`Veo accepts JPEG, PNG or WebP images: ${imgPath} (${mimeType})`);
   }
-  return { bytesBase64Encoded: fs24.readFileSync(imgPath).toString("base64"), mimeType };
+  return { bytesBase64Encoded: fs25.readFileSync(imgPath).toString("base64"), mimeType };
 }
 function veoFramesFromPaths(paths = []) {
   if (paths.length > 2) {
@@ -6167,7 +6611,7 @@ function registerGenerateVideoCommand(parent) {
       logger.debug(`Submitting video generation with ${model}...`);
       logger.info("This may take 30s\u20136 minutes. Veo requires billing.");
       const frames = veoFramesFromPaths(opts.referenceImages);
-      const dest = path28.join(getOutputDir(), `veo_generated_${Date.now()}.mp4`);
+      const dest = path29.join(getOutputDir(), `veo_generated_${Date.now()}.mp4`);
       const finalOp = await runVeo(
         model,
         {
@@ -6181,8 +6625,8 @@ function registerGenerateVideoCommand(parent) {
       );
       logger.success(`Saved video: ${dest}`);
       if (opts.output) {
-        fs25.mkdirSync(path28.dirname(path28.resolve(opts.output)), { recursive: true });
-        fs25.copyFileSync(dest, opts.output);
+        fs26.mkdirSync(path29.dirname(path29.resolve(opts.output)), { recursive: true });
+        fs26.copyFileSync(dest, opts.output);
         logger.success(`Copied to: ${opts.output}`);
       }
       await maybeDownloadThumb(finalOp.response, dest, {
@@ -6198,8 +6642,8 @@ Generated video: ${dest}`);
 
 // src/providers/gemini/commands/generate.ts
 init_errors();
-import fs26 from "fs";
-import path29 from "path";
+import fs27 from "fs";
+import path30 from "path";
 function registerGenerateCommand(parent) {
   parent.command("generate").description("Generate images with Gemini (Nano Banana / Imagen 4)").requiredOption("--prompt <text>", "Image generation prompt").option("--model <id>", "Gemini image model to use").option("--aspect-ratio <ratio>", `Aspect ratio (${ASPECT_RATIOS.join("|")})`, "1:1").option("--num-images <n>", "Number of images to generate (1-4)", "1").option("--size <sz>", `Image size (${IMAGE_SIZES.join("|")})`).option("--output <path>", "Copy first generated image to this path").addOption(imageFormatOption()).addOption(noWebpOption()).option("-v, --verbose", "Verbose logging").action(
     async (opts) => {
@@ -6247,8 +6691,8 @@ function registerGenerateCommand(parent) {
             const outDir = getOutputDir();
             const ext = img.mimeType.includes("png") ? "png" : "jpg";
             const fname = `gemini_generated_${Date.now()}_${i}.${ext}`;
-            const dest = path29.join(outDir, fname);
-            fs26.writeFileSync(dest, Buffer.from(img.data, "base64"));
+            const dest = path30.join(outDir, fname);
+            fs27.writeFileSync(dest, Buffer.from(img.data, "base64"));
             savedFiles.push(dest);
             logger.success(`Saved: ${dest}`);
           }
@@ -6263,8 +6707,8 @@ function registerGenerateCommand(parent) {
         process.exit(1);
       }
       if (opts.output && savedFiles[0]) {
-        fs26.mkdirSync(path29.dirname(path29.resolve(opts.output)), { recursive: true });
-        fs26.copyFileSync(savedFiles[0], opts.output);
+        fs27.mkdirSync(path30.dirname(path30.resolve(opts.output)), { recursive: true });
+        fs27.copyFileSync(savedFiles[0], opts.output);
         logger.success(`Copied to: ${opts.output}`);
       }
       const finalImages = finalizeGeneratedImages(savedFiles, { ...opts, logger });
@@ -6276,8 +6720,8 @@ Generated ${finalImages.length} image(s):`);
 }
 
 // src/providers/gemini/commands/image-to-image.ts
-import fs27 from "fs";
-import path30 from "path";
+import fs28 from "fs";
+import path31 from "path";
 var SOFT_LIMIT_BYTES = 5 * 1024 * 1024;
 var HARD_LIMIT_BYTES = 7 * 1024 * 1024;
 function registerGeminiImageToImageCommand(parent) {
@@ -6340,14 +6784,14 @@ function registerGeminiImageToImageCommand(parent) {
         const img = images[i];
         if (!img) continue;
         const ext = img.mimeType.includes("png") ? "png" : "jpg";
-        const dest = path30.join(outDir, `gemini-i2i-${ts}-${i + 1}.${ext}`);
-        fs27.writeFileSync(dest, Buffer.from(img.data, "base64"));
+        const dest = path31.join(outDir, `gemini-i2i-${ts}-${i + 1}.${ext}`);
+        fs28.writeFileSync(dest, Buffer.from(img.data, "base64"));
         saved.push(dest);
         logger.success(`Saved: ${dest}`);
       }
       if (opts.output && saved[0]) {
-        fs27.mkdirSync(path30.dirname(path30.resolve(opts.output)), { recursive: true });
-        fs27.copyFileSync(saved[0], opts.output);
+        fs28.mkdirSync(path31.dirname(path31.resolve(opts.output)), { recursive: true });
+        fs28.copyFileSync(saved[0], opts.output);
         logger.success(`Copied to: ${opts.output}`);
       }
       const finalImages = finalizeGeneratedImages(saved, { ...opts, logger });
@@ -6375,7 +6819,7 @@ function sniffImageMime(buf, url) {
     if (buf.length >= 12 && buf.slice(0, 4).toString() === "RIFF" && buf.slice(8, 12).toString() === "WEBP")
       return "image/webp";
   }
-  const ext = path30.extname(new URL(url).pathname).toLowerCase();
+  const ext = path31.extname(new URL(url).pathname).toLowerCase();
   if (ext === ".png") return "image/png";
   if (ext === ".webp") return "image/webp";
   if (ext === ".gif") return "image/gif";
@@ -6384,8 +6828,8 @@ function sniffImageMime(buf, url) {
 
 // src/providers/gemini/commands/image-to-video.ts
 init_errors();
-import fs28 from "fs";
-import path31 from "path";
+import fs29 from "fs";
+import path32 from "path";
 function registerGeminiImageToVideoCommand(parent) {
   parent.command("image-to-video <imagePath>").alias("i2v").description("Generate video from a starting image with Veo (image-to-video) [EXPERIMENTAL]").requiredOption("--prompt <text>", "Motion/scene prompt").option("--last-frame <path>", "Optional closing frame image (Veo 3.1)").option("--model <id>", "Veo model id").option("--resolution <res>", "720p|1080p", "1080p").option("--aspect-ratio <ratio>", "Aspect ratio", "16:9").option("--output <path>", "Copy generated video to this path").option("--no-thumb", "Skip downloading the thumbnail if the API returns one").option("-v, --verbose", "Verbose logging").action(
     async (imagePath, opts) => {
@@ -6405,7 +6849,7 @@ function registerGeminiImageToVideoCommand(parent) {
       logger.info(
         "Submitting image-to-video. This may take 30s\u20136 minutes. Veo requires billing."
       );
-      const dest = path31.join(getOutputDir(), `veo_i2v_${Date.now()}.mp4`);
+      const dest = path32.join(getOutputDir(), `veo_i2v_${Date.now()}.mp4`);
       const finalOp = await runVeo(
         model,
         {
@@ -6420,8 +6864,8 @@ function registerGeminiImageToVideoCommand(parent) {
       );
       logger.success(`Saved video: ${dest}`);
       if (opts.output) {
-        fs28.mkdirSync(path31.dirname(path31.resolve(opts.output)), { recursive: true });
-        fs28.copyFileSync(dest, opts.output);
+        fs29.mkdirSync(path32.dirname(path32.resolve(opts.output)), { recursive: true });
+        fs29.copyFileSync(dest, opts.output);
         logger.success(`Copied to: ${opts.output}`);
       }
       await maybeDownloadThumb(finalOp.response, dest, {
@@ -6626,8 +7070,8 @@ var HEYGEN_OPERATIONS = {
 };
 
 // src/providers/heygen/node-helpers.ts
-import fs29 from "fs";
-import path32 from "path";
+import fs30 from "fs";
+import path33 from "path";
 init_errors();
 init_redact();
 
@@ -6740,12 +7184,12 @@ function describePayload(data) {
   );
   return (text ?? String(data)).slice(0, 500);
 }
-function requireJobId(data, field, path57) {
+function requireJobId(data, field, path58) {
   const value = data?.[field];
   const ok2 = Array.isArray(value) ? value.length > 0 && value.every((v) => typeof v === "string" && v.length > 0) : typeof value === "string" && value.length > 0;
   if (!ok2) {
     throw new ProviderError(
-      `HeyGen ${path57} returned no ${field}; a job may still have been created, so check the HeyGen dashboard. Response: ${describePayload(data)}`,
+      `HeyGen ${path58} returned no ${field}; a job may still have been created, so check the HeyGen dashboard. Response: ${describePayload(data)}`,
       "heygen"
     );
   }
@@ -6770,8 +7214,8 @@ var HeygenClient = class {
     this.newIdempotencyKey = opts.newIdempotencyKey ?? (() => crypto.randomUUID());
   }
   /** Build an absolute URL for a v3 path plus query parameters. */
-  url(path57, query) {
-    const suffix = path57.startsWith("/") ? path57 : `/${path57}`;
+  url(path58, query) {
+    const suffix = path58.startsWith("/") ? path58 : `/${path58}`;
     const params = new URLSearchParams();
     for (const [k, v] of Object.entries(query ?? {})) {
       if (v !== void 0 && v !== "") params.set(k, String(v));
@@ -6793,10 +7237,10 @@ var HeygenClient = class {
    * `request_in_progress` are retried only when an Idempotency-Key makes the
    * replay safe. GET requests are left to the caller's polling loop.
    */
-  async send(path57, opts = {}) {
+  async send(path58, opts = {}) {
     const method = opts.method ?? "GET";
     const key = typeof opts.idempotencyKey === "string" ? opts.idempotencyKey : opts.idempotencyKey ? this.newIdempotencyKey() : void 0;
-    const url = this.url(path57, opts.query);
+    const url = this.url(path58, opts.query);
     for (let attempt = 1; ; attempt++) {
       try {
         return await fetchJson({
@@ -6830,18 +7274,18 @@ var HeygenClient = class {
     return void 0;
   }
   /** Send and unwrap `{ data }`. A 2xx body carrying `error` is treated as a failure. */
-  async request(path57, opts = {}) {
-    const json = await this.send(path57, opts);
-    return unwrapData(json, path57);
+  async request(path58, opts = {}) {
+    const json = await this.send(path58, opts);
+    return unwrapData(json, path58);
   }
-  async page(path57, query) {
-    const json = await this.send(path57, {
+  async page(path58, query) {
+    const json = await this.send(path58, {
       query
     });
-    const items = unwrapData(json, path57);
+    const items = unwrapData(json, path58);
     if (!Array.isArray(items)) {
       throw new ProviderError(
-        `Unexpected HeyGen response from ${path57}: data is not a list`,
+        `Unexpected HeyGen response from ${path58}: data is not a list`,
         "heygen"
       );
     }
@@ -6859,9 +7303,9 @@ var HeygenClient = class {
   // ── Video Agent ───────────────────────────────────────────────────────
   /** POST /v3/video-agents. No Idempotency-Key: the endpoint does not document one. */
   async createVideoAgent(body) {
-    const path57 = "/v3/video-agents";
-    const data = await this.request(path57, { method: "POST", body });
-    return requireJobId(data, "session_id", path57);
+    const path58 = "/v3/video-agents";
+    const data = await this.request(path58, { method: "POST", body });
+    return requireJobId(data, "session_id", path58);
   }
   async getVideoAgentSession(sessionId, opts = {}) {
     return this.request(`/v3/video-agents/${seg(sessionId, "session id")}`, opts);
@@ -6871,36 +7315,36 @@ var HeygenClient = class {
   }
   // ── Videos ────────────────────────────────────────────────────────────
   async createVideo(body, idempotencyKey = true) {
-    const path57 = "/v3/videos";
-    const data = await this.request(path57, {
+    const path58 = "/v3/videos";
+    const data = await this.request(path58, {
       method: "POST",
       body,
       idempotencyKey
     });
-    return requireJobId(data, "video_id", path57);
+    return requireJobId(data, "video_id", path58);
   }
   async getVideo(videoId, opts = {}) {
     return this.request(`/v3/videos/${seg(videoId, "video id")}`, opts);
   }
   /** POST /v3/templates/{id}. Returns the created video's `VideoDetail`. */
   async generateFromTemplate(templateId, body, idempotencyKey = true) {
-    const path57 = `/v3/templates/${seg(templateId, "template id")}`;
-    const data = await this.request(path57, {
+    const path58 = `/v3/templates/${seg(templateId, "template id")}`;
+    const data = await this.request(path58, {
       method: "POST",
       body,
       idempotencyKey
     });
-    return requireJobId(data, "id", path57);
+    return requireJobId(data, "id", path58);
   }
   // ── HeyGen Video model ────────────────────────────────────────────────
   async createModelVideo(body, idempotencyKey = true) {
-    const path57 = "/v3/models/videos";
-    const data = await this.request(path57, {
+    const path58 = "/v3/models/videos";
+    const data = await this.request(path58, {
       method: "POST",
       body,
       idempotencyKey
     });
-    return requireJobId(data, "video_id", path57);
+    return requireJobId(data, "video_id", path58);
   }
   async getModelVideo(videoId, opts = {}) {
     return this.request(`/v3/models/videos/${seg(videoId, "video id")}`, opts);
@@ -6922,13 +7366,13 @@ var HeygenClient = class {
   }
   // ── Translation & lipsync ─────────────────────────────────────────────
   async createVideoTranslation(body, idempotencyKey = true) {
-    const path57 = "/v3/video-translations";
-    const data = await this.request(path57, {
+    const path58 = "/v3/video-translations";
+    const data = await this.request(path58, {
       method: "POST",
       body,
       idempotencyKey
     });
-    return requireJobId(data, "video_translation_ids", path57);
+    return requireJobId(data, "video_translation_ids", path58);
   }
   async getVideoTranslation(id, opts = {}) {
     return this.request(`/v3/video-translations/${seg(id, "video translation id")}`, opts);
@@ -6941,13 +7385,13 @@ var HeygenClient = class {
     return data.languages.filter((l) => typeof l === "string");
   }
   async createLipsync(body, idempotencyKey = true) {
-    const path57 = "/v3/lipsyncs";
-    const data = await this.request(path57, {
+    const path58 = "/v3/lipsyncs";
+    const data = await this.request(path58, {
       method: "POST",
       body,
       idempotencyKey
     });
-    return requireJobId(data, "lipsync_id", path57);
+    return requireJobId(data, "lipsync_id", path58);
   }
   async getLipsync(id, opts = {}) {
     return this.request(`/v3/lipsyncs/${seg(id, "lipsync id")}`, opts);
@@ -7012,9 +7456,9 @@ var HeygenClient = class {
     }
   }
 };
-function unwrapData(json, path57) {
+function unwrapData(json, path58) {
   if (json === null || typeof json !== "object") {
-    throw new ProviderError(`Unexpected HeyGen response from ${path57}: not a JSON object`, "heygen");
+    throw new ProviderError(`Unexpected HeyGen response from ${path58}: not a JSON object`, "heygen");
   }
   const record = json;
   const error = record.error;
@@ -7026,7 +7470,7 @@ function unwrapData(json, path57) {
     );
   }
   if (!("data" in record) || record.data === null || record.data === void 0) {
-    throw new ProviderError(`Unexpected HeyGen response from ${path57}: missing data`, "heygen");
+    throw new ProviderError(`Unexpected HeyGen response from ${path58}: missing data`, "heygen");
   }
   return record.data;
 }
@@ -7239,7 +7683,6 @@ function resumeCommand2(kind, id, opts = {}) {
 
 // src/providers/heygen/request-builders.ts
 init_errors();
-init_redact();
 function oneOf(value, allowed, flag) {
   if (value === void 0) return void 0;
   if (!allowed.includes(value)) {
@@ -7268,23 +7711,6 @@ function isHttpsUrl(url) {
     return false;
   }
 }
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-function checkBaseUrl(raw, variable) {
-  const value = raw.trim();
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new ConfigError(`${variable} must be an absolute https:// URL`);
-  }
-  const loopbackHttp = url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
-  if (url.protocol !== "https:" && !loopbackHttp) {
-    throw new ConfigError(
-      `${variable} must use https:// (got ${redactUrl(value)}); plain http:// is only allowed for localhost, 127.0.0.1, or [::1]`
-    );
-  }
-  return value;
-}
 function classifyMediaRef(value) {
   const v = value.trim();
   if (!v) throw new ValidationError("Media reference must not be empty");
@@ -7555,17 +7981,17 @@ function createHeygenClientFromEnv() {
   return new HeygenClient({ apiKey, baseUrl: checkBaseUrl(baseUrl, "HEYGEN_BASE_URL") });
 }
 async function uploadLocalFile2(client, filePath, logger) {
-  const abs = path32.resolve(filePath);
+  const abs = path33.resolve(filePath);
   let stat;
   try {
-    stat = fs29.statSync(abs);
+    stat = fs30.statSync(abs);
   } catch {
     throw new ValidationError(
       `File not found: ${filePath}. Use an https:// URL, asset:<asset_id>, or an existing file.`
     );
   }
   if (!stat.isFile()) throw new ValidationError(`Not a file: ${filePath}`);
-  const ext = path32.extname(abs).slice(1).toLowerCase();
+  const ext = path33.extname(abs).slice(1).toLowerCase();
   const mimeType = ASSET_MIME_BY_EXT[ext];
   if (!mimeType) {
     throw new ValidationError(
@@ -7577,10 +8003,10 @@ async function uploadLocalFile2(client, filePath, logger) {
       `${filePath} is ${(stat.size / 1024 / 1024).toFixed(1)} MB; HeyGen asset upload accepts at most 32 MB. Host it at a public https:// URL instead.`
     );
   }
-  logger.info(`Uploading ${path32.basename(abs)} to HeyGen assets...`);
+  logger.info(`Uploading ${path33.basename(abs)} to HeyGen assets...`);
   const res = await client.uploadAsset({
-    data: new Uint8Array(fs29.readFileSync(abs)),
-    filename: path32.basename(abs),
+    data: new Uint8Array(fs30.readFileSync(abs)),
+    filename: path33.basename(abs),
     mimeType
   });
   logger.debug(`Uploaded asset ${res.asset_id} (${res.mime_type}, ${res.size_bytes} bytes)`);
@@ -7624,7 +8050,7 @@ var MEDIA_EXTS = /* @__PURE__ */ new Set([...VIDEO_EXTS, ...AUDIO_EXTS]);
 var OUTPUT_EXTS = /* @__PURE__ */ new Set([...MEDIA_EXTS, "srt", "vtt"]);
 function inferExtension(url, fallback) {
   try {
-    const ext = path32.extname(new URL(url).pathname).slice(1).toLowerCase();
+    const ext = path33.extname(new URL(url).pathname).slice(1).toLowerCase();
     return OUTPUT_EXTS.has(ext) ? ext : fallback;
   } catch {
     return fallback;
@@ -7662,11 +8088,11 @@ async function downloadOutput(url, dest, resumeHint) {
 }
 function defaultOutputPath(state, ext) {
   const lang = state.outputLanguage ? `-${safeSlug(state.outputLanguage)}` : "";
-  return path32.join(getOutputDir(), `heygen-${state.kind}${lang}-${safeSlug(state.id)}.${ext}`);
+  return path33.join(getOutputDir(), `heygen-${state.kind}${lang}-${safeSlug(state.id)}.${ext}`);
 }
 function statOrUndefined(p) {
   try {
-    return fs29.statSync(p);
+    return fs30.statSync(p);
   } catch {
     return void 0;
   }
@@ -7675,29 +8101,29 @@ function isDirectoryOutput2(output, target) {
   if (/[\\/]$/.test(output)) return true;
   const stat = statOrUndefined(target);
   if (stat) return stat.isDirectory();
-  return path32.extname(target) === "";
+  return path33.extname(target) === "";
 }
 function withMediaExt(file, ext) {
-  const given = path32.extname(file).slice(1).toLowerCase();
+  const given = path33.extname(file).slice(1).toLowerCase();
   const mismatch = VIDEO_EXTS.has(given) && AUDIO_EXTS.has(ext) || AUDIO_EXTS.has(given) && VIDEO_EXTS.has(ext);
   return mismatch ? `${file.slice(0, -(given.length + 1))}.${ext}` : file;
 }
 function outputPathFor(state, ext, output, count) {
   if (!output) return defaultOutputPath(state, ext);
-  const target = path32.resolve(output);
-  const givenExt = path32.extname(target);
+  const target = path33.resolve(output);
+  const givenExt = path33.extname(target);
   const isTemplate = count > 1 && MEDIA_EXTS.has(givenExt.slice(1).toLowerCase());
   if (isDirectoryOutput2(output, target) || count > 1 && !isTemplate) {
-    fs29.mkdirSync(target, { recursive: true });
-    return path32.join(target, path32.basename(defaultOutputPath(state, ext)));
+    fs30.mkdirSync(target, { recursive: true });
+    return path33.join(target, path33.basename(defaultOutputPath(state, ext)));
   }
   if (!isTemplate) return withMediaExt(target, ext);
-  const base = path32.basename(target, givenExt);
+  const base = path33.basename(target, givenExt);
   const suffix = safeSlug(state.outputLanguage ?? state.id);
-  return withMediaExt(path32.join(path32.dirname(target), `${base}-${suffix}${givenExt}`), ext);
+  return withMediaExt(path33.join(path33.dirname(target), `${base}-${suffix}${givenExt}`), ext);
 }
 function claimPath(dest, state, used) {
-  const ext = path32.extname(dest);
+  const ext = path33.extname(dest);
   const stem = dest.slice(0, dest.length - ext.length);
   let candidate = dest;
   for (let n = 1; used.has(candidate.toLowerCase()); n++) {
@@ -7708,7 +8134,7 @@ function claimPath(dest, state, used) {
   return candidate;
 }
 function captionPathFor(dest, capExt) {
-  const stem = path32.join(path32.dirname(dest), path32.basename(dest, path32.extname(dest)));
+  const stem = path33.join(path33.dirname(dest), path33.basename(dest, path33.extname(dest)));
   const capDest = `${stem}.${capExt}`;
   return capDest.toLowerCase() === dest.toLowerCase() ? `${stem}.captions.${capExt}` : capDest;
 }
@@ -8086,7 +8512,7 @@ function registerHeygenModelVideoCommand(parent) {
 
 // src/providers/heygen/commands/run.ts
 init_errors();
-import path33 from "path";
+import path34 from "path";
 function extractJobIds(operation, data) {
   const op = HEYGEN_OPERATIONS[operation];
   if (!op) return [];
@@ -8124,7 +8550,7 @@ function registerHeygenRunCommand(parent) {
         return;
       }
       const ext = inferExtension(audioUrl, "mp3");
-      const dest = opts.output ? path33.resolve(opts.output) : path33.join(getOutputDir(), `heygen-speech-${Date.now()}.${ext}`);
+      const dest = opts.output ? path34.resolve(opts.output) : path34.join(getOutputDir(), `heygen-speech-${Date.now()}.${ext}`);
       await downloadOutput(audioUrl, dest, "Re-run the command to generate a fresh URL.");
       console.log(`Saved: ${dest}`);
       return;
@@ -8254,7 +8680,7 @@ function registerHeygenTranslateCommand(parent) {
 }
 
 // src/providers/heygen/commands/tts.ts
-import path34 from "path";
+import path35 from "path";
 init_redact();
 function registerHeygenTtsCommand(parent) {
   parent.command("tts <text>").description("Text-to-speech with a HeyGen catalog voice (1-5000 characters)").requiredOption("--voice <voice-id>", "Voice ID from `heygen voices`").option("--ssml", "Treat the text as SSML").option("--speed <n>", "Speed multiplier 0.5-2.0").option("--language <code>", "Base language code, e.g. en (auto-detected when omitted)").option("--locale <tag>", "Locale tag for Starfish voices, e.g. zh-HK").option("--engine <e>", "starfish | orca | elevenlabs (defaults to the voice's engine)").option("--output <path>", "Output audio path").option("--no-download", "Print the audio URL instead of downloading").option("--json", "Print a JSON summary").option("-v, --verbose", "Verbose logging").action(async (text, opts) => {
@@ -8285,7 +8711,7 @@ function registerHeygenTtsCommand(parent) {
     }
     const ext = inferExtension(res.audio_url, "mp3");
     const name = `heygen-tts-${res.request_id ?? Date.now()}.${ext}`.replace(/[^\w.-]+/g, "-");
-    const dest = opts.output ? path34.resolve(opts.output) : path34.join(getOutputDir(), name);
+    const dest = opts.output ? path35.resolve(opts.output) : path35.join(getOutputDir(), name);
     await downloadOutput(res.audio_url, dest, "Re-run the command to generate a fresh URL.");
     if (opts.json) console.log(JSON.stringify({ ...summary, file: dest }, null, 2));
     else console.log(`Saved: ${dest} (${res.duration}s, ${res.engine})`);
@@ -8404,8 +8830,8 @@ function registerHeygenCommands(program2) {
 }
 
 // src/providers/leonardo/commands/generate.ts
-import fs30 from "fs";
-import path35 from "path";
+import fs31 from "fs";
+import path36 from "path";
 
 // src/providers/leonardo/client.ts
 init_errors();
@@ -8483,11 +8909,11 @@ var LeonardoClient = class {
   }
   apiKey;
   baseUrl;
-  async request(path57, opts = {}) {
+  async request(path58, opts = {}) {
     const base = this.baseUrl.replace(/\/$/, "");
-    const v2Override = path57.startsWith("v2:");
+    const v2Override = path58.startsWith("v2:");
     const finalBase = v2Override ? base.replace(/\/v1$/, "/v2") : base;
-    const finalPath = v2Override ? path57.slice(3) : path57;
+    const finalPath = v2Override ? path58.slice(3) : path58;
     const url = new URL(finalBase + finalPath);
     if (opts.query) {
       for (const [k, v] of Object.entries(opts.query)) {
@@ -8506,14 +8932,14 @@ var LeonardoClient = class {
       timeoutMs: opts.timeoutMs ?? 12e4
     });
   }
-  get(path57, query, logger) {
-    return this.request(path57, { method: "GET", query, logger });
+  get(path58, query, logger) {
+    return this.request(path58, { method: "GET", query, logger });
   }
-  post(path57, body, logger) {
-    return this.request(path57, { method: "POST", body, logger });
+  post(path58, body, logger) {
+    return this.request(path58, { method: "POST", body, logger });
   }
-  delete(path57, logger) {
-    return this.request(path57, { method: "DELETE", logger });
+  delete(path58, logger) {
+    return this.request(path58, { method: "DELETE", logger });
   }
 };
 function createLeonardoClient() {
@@ -8524,7 +8950,7 @@ function createLeonardoClient() {
 function extFromUrl2(url, fallback = ".png") {
   try {
     const u = new URL(url);
-    const e = path35.extname(u.pathname);
+    const e = path36.extname(u.pathname);
     return e.length > 0 ? e : fallback;
   } catch {
     return fallback;
@@ -8609,7 +9035,7 @@ function registerLeonardoGenerateCommand(parent) {
         if (!img) continue;
         const ext = extFromUrl2(img.url);
         const filename = autoFilename(generationId, i + 1, ext);
-        const filepath = path35.join(outDir, filename);
+        const filepath = path36.join(outDir, filename);
         try {
           await downloadFile(img.url, filepath);
           saved.push(filepath);
@@ -8619,9 +9045,9 @@ function registerLeonardoGenerateCommand(parent) {
         }
       }
       if (opts.output && saved[0]) {
-        const dest = path35.resolve(opts.output);
-        fs30.mkdirSync(path35.dirname(dest), { recursive: true });
-        fs30.copyFileSync(saved[0], dest);
+        const dest = path36.resolve(opts.output);
+        fs31.mkdirSync(path36.dirname(dest), { recursive: true });
+        fs31.copyFileSync(saved[0], dest);
         logger.success(`Copied to ${dest}`);
       }
       const finalImages = finalizeGeneratedImages(saved, { ...opts, logger });
@@ -8633,11 +9059,11 @@ Generated ${finalImages.length} image(s):`);
 }
 
 // src/providers/leonardo/commands/image-to-image.ts
-import fs31 from "fs";
-import path36 from "path";
+import fs32 from "fs";
+import path37 from "path";
 function extFromUrl3(url, fallback = ".png") {
   try {
-    return path36.extname(new URL(url).pathname) || fallback;
+    return path37.extname(new URL(url).pathname) || fallback;
   } catch {
     return fallback;
   }
@@ -8699,7 +9125,7 @@ function registerLeonardoImageToImageCommand(parent) {
         if (!img) continue;
         const ext = extFromUrl3(img.url);
         const filename = `leonardo-i2i-${generationId.slice(0, 8)}-${String(i + 1).padStart(2, "0")}${ext}`;
-        const filepath = path36.join(outDir, filename);
+        const filepath = path37.join(outDir, filename);
         try {
           await downloadFile(img.url, filepath);
           saved.push(filepath);
@@ -8709,9 +9135,9 @@ function registerLeonardoImageToImageCommand(parent) {
         }
       }
       if (opts.output && saved[0]) {
-        const dest = path36.resolve(opts.output);
-        fs31.mkdirSync(path36.dirname(dest), { recursive: true });
-        fs31.copyFileSync(saved[0], dest);
+        const dest = path37.resolve(opts.output);
+        fs32.mkdirSync(path37.dirname(dest), { recursive: true });
+        fs32.copyFileSync(saved[0], dest);
         logger.success(`Copied to ${dest}`);
       }
       const finalImages = finalizeGeneratedImages(saved, { ...opts, logger });
@@ -8723,7 +9149,7 @@ Generated ${finalImages.length} image(s):`);
 }
 
 // src/providers/leonardo/commands/video.ts
-import path37 from "path";
+import path38 from "path";
 function v2DimsFor(resolution) {
   if (resolution === "RESOLUTION_1080") return { width: 1920, height: 1080 };
   if (resolution === "RESOLUTION_480") return { width: 854, height: 480 };
@@ -8834,7 +9260,7 @@ async function pollAndDownload(client, jobId, opts) {
     logger.error(`No video URL in completed generation: ${JSON.stringify(gen)}`);
     process.exit(1);
   }
-  const outPath = opts.output ?? path37.join(getOutputDir(), `${opts.basename}-${jobId.slice(0, 8)}.mp4`);
+  const outPath = opts.output ?? path38.join(getOutputDir(), `${opts.basename}-${jobId.slice(0, 8)}.mp4`);
   await downloadFile(videoUrl2, outPath);
   logger.success(`Saved ${outPath}`);
   await maybeDownloadThumb(gen, outPath, {
@@ -8940,7 +9366,7 @@ function registerLeonardoModelsCommand(parent) {
 }
 
 // src/providers/leonardo/commands/status.ts
-import path38 from "path";
+import path39 from "path";
 var VIDEO_KEYS = ["motionMP4URL", "url"];
 var IMAGE_EXT_RE2 = /\.(jpe?g|png|webp|gif)(\?|$)/i;
 var VIDEO_EXT_RE = /\.(mp4|webm|mov|m4v)(\?|$)/i;
@@ -9005,7 +9431,7 @@ function registerLeonardoStatusCommand(parent) {
       const outDir = getOutputDir();
       let idx = 0;
       for (const url of videos) {
-        const dest = opts.output && videos.length === 1 && images.length === 0 ? opts.output : path38.join(outDir, `leonardo-${generationId.slice(0, 8)}-${idx}.mp4`);
+        const dest = opts.output && videos.length === 1 && images.length === 0 ? opts.output : path39.join(outDir, `leonardo-${generationId.slice(0, 8)}-${idx}.mp4`);
         await downloadFile(url, dest);
         logger.success(`Saved ${dest}`);
         await maybeDownloadThumb(gen, dest, {
@@ -9018,7 +9444,7 @@ function registerLeonardoStatusCommand(parent) {
       for (const url of images) {
         const m = url.match(IMAGE_EXT_RE2);
         const ext = m?.[1] ? m[1].toLowerCase().replace("jpeg", "jpg") : "png";
-        const dest = path38.join(outDir, `leonardo-${generationId.slice(0, 8)}-${idx}.${ext}`);
+        const dest = path39.join(outDir, `leonardo-${generationId.slice(0, 8)}-${idx}.${ext}`);
         await downloadFile(url, dest);
         logger.success(`Saved ${dest}`);
         idx++;
@@ -9175,8 +9601,8 @@ function sleep3(ms) {
 }
 
 // src/providers/minimax/generators/music.ts
-import fs32 from "fs";
-import path39 from "path";
+import fs33 from "fs";
+import path40 from "path";
 async function generateMinimaxMusic(opts) {
   const {
     apiKey,
@@ -9221,14 +9647,14 @@ async function generateMinimaxMusic(opts) {
   }
   const durationMs = resp.extra_info?.music_duration ?? 0;
   const outDir = getOutputDir();
-  const dest = path39.join(outDir, `minimax_music_${Date.now()}.${outputFormat}`);
+  const dest = path40.join(outDir, `minimax_music_${Date.now()}.${outputFormat}`);
   try {
     if (audioData.startsWith("http")) {
       const bytes = await fetchBytes(audioData);
-      fs32.writeFileSync(dest, bytes);
+      fs33.writeFileSync(dest, bytes);
     } else {
       const audioBytes = Buffer.from(audioData, "hex");
-      fs32.writeFileSync(dest, audioBytes);
+      fs33.writeFileSync(dest, audioBytes);
     }
   } catch (e) {
     return {
@@ -9239,8 +9665,8 @@ async function generateMinimaxMusic(opts) {
   const durSec = durationMs / 1e3;
   logger?.success(`Saved: ${dest} (${durSec.toFixed(1)}s)`);
   if (output) {
-    fs32.mkdirSync(path39.dirname(path39.resolve(output)), { recursive: true });
-    fs32.copyFileSync(dest, output);
+    fs33.mkdirSync(path40.dirname(path40.resolve(output)), { recursive: true });
+    fs33.copyFileSync(dest, output);
   }
   return { status: "success", generatedAudio: dest, durationMs, model };
 }
@@ -9314,8 +9740,8 @@ Generated music: ${result.generatedAudio}`);
 init_errors();
 
 // src/providers/minimax/generators/speech.ts
-import fs33 from "fs";
-import path40 from "path";
+import fs34 from "fs";
+import path41 from "path";
 async function generateMinimaxSpeech(opts) {
   const {
     apiKey,
@@ -9362,12 +9788,12 @@ async function generateMinimaxSpeech(opts) {
   const audioBytes = Buffer.from(audioHex, "hex");
   const ext = ["mp3", "wav", "flac"].includes(outputFormat) ? outputFormat : "mp3";
   const outDir = getOutputDir();
-  const dest = path40.join(outDir, `minimax_speech_${Date.now()}.${ext}`);
-  fs33.writeFileSync(dest, audioBytes);
+  const dest = path41.join(outDir, `minimax_speech_${Date.now()}.${ext}`);
+  fs34.writeFileSync(dest, audioBytes);
   logger?.success(`Saved: ${dest} (${(audioBytes.length / 1024).toFixed(1)} KB)`);
   if (output) {
-    fs33.mkdirSync(path40.dirname(path40.resolve(output)), { recursive: true });
-    fs33.copyFileSync(dest, output);
+    fs34.mkdirSync(path41.dirname(path41.resolve(output)), { recursive: true });
+    fs34.copyFileSync(dest, output);
   }
   return { status: "success", generatedAudio: dest, model };
 }
@@ -9414,8 +9840,8 @@ Generated audio: ${result.generatedAudio}`);
 init_errors();
 
 // src/providers/minimax/generators/video.ts
-import fs34 from "fs";
-import path41 from "path";
+import fs35 from "fs";
+import path42 from "path";
 async function generateMinimaxVideo(opts) {
   const {
     apiKey,
@@ -9461,18 +9887,18 @@ async function generateMinimaxVideo(opts) {
     return { status: "error", error: `No file_id in poll result: ${JSON.stringify(pollResult)}` };
   }
   const outDir = getOutputDir();
-  const dest = path41.join(outDir, `minimax_video_${Date.now()}.mp4`);
+  const dest = path42.join(outDir, `minimax_video_${Date.now()}.mp4`);
   try {
     await downloadMinimaxFile(fileId, apiKey, dest, logger);
   } catch (e) {
     return { status: "error", error: e instanceof Error ? e.message : String(e) };
   }
   const elapsed = (Date.now() - start) / 1e3;
-  const stat = fs34.statSync(dest);
+  const stat = fs35.statSync(dest);
   const fileSizeMb = stat.size / (1024 * 1024);
   if (output) {
-    fs34.mkdirSync(path41.dirname(path41.resolve(output)), { recursive: true });
-    fs34.copyFileSync(dest, output);
+    fs35.mkdirSync(path42.dirname(path42.resolve(output)), { recursive: true });
+    fs35.copyFileSync(dest, output);
   }
   await maybeDownloadThumb(pollResult, dest, {
     skip: thumb === false,
@@ -9534,8 +9960,8 @@ Generated video: ${result.generatedVideo}`);
 
 // src/providers/minimax/generators/image.ts
 init_errors();
-import fs35 from "fs";
-import path42 from "path";
+import fs36 from "fs";
+import path43 from "path";
 async function generateMinimaxImage(opts) {
   const {
     apiKey,
@@ -9573,8 +9999,8 @@ async function generateMinimaxImage(opts) {
     try {
       const bytes = await fetchBytes(url);
       const fname = `minimax_image_${Date.now()}_${i}.png`;
-      const dest = path42.join(outDir, fname);
-      fs35.writeFileSync(dest, bytes);
+      const dest = path43.join(outDir, fname);
+      fs36.writeFileSync(dest, bytes);
       savedFiles.push(dest);
       logger?.success(`Saved: ${dest}`);
     } catch (e) {
@@ -9585,8 +10011,8 @@ async function generateMinimaxImage(opts) {
     }
   }
   if (output && savedFiles[0]) {
-    fs35.mkdirSync(path42.dirname(path42.resolve(output)), { recursive: true });
-    fs35.copyFileSync(savedFiles[0], output);
+    fs36.mkdirSync(path43.dirname(path43.resolve(output)), { recursive: true });
+    fs36.copyFileSync(savedFiles[0], output);
   }
   return { status: "success", generatedImages: savedFiles, model };
 }
@@ -9625,8 +10051,8 @@ Generated ${finalImages.length} image(s):`);
 
 // src/providers/minimax/commands/image-to-image.ts
 init_errors();
-import fs36 from "fs";
-import path43 from "path";
+import fs37 from "fs";
+import path44 from "path";
 function registerMinimaxImageToImageCommand(parent) {
   parent.command("image-to-image").alias("i2i").description(
     "MiniMax character/subject preservation. CAVEAT: NOT free-form image editing \u2014 the --ref image is used only as a character/face reference for a NEW scene described by --prompt."
@@ -9681,8 +10107,8 @@ function registerMinimaxImageToImageCommand(parent) {
         if (!url) continue;
         try {
           const bytes = await fetchBytes(url);
-          const dest = path43.join(outDir, `minimax-i2i-${ts}-${i + 1}.png`);
-          fs36.writeFileSync(dest, bytes);
+          const dest = path44.join(outDir, `minimax-i2i-${ts}-${i + 1}.png`);
+          fs37.writeFileSync(dest, bytes);
           saved.push(dest);
           logger.success(`Saved: ${dest}`);
         } catch (e) {
@@ -9693,8 +10119,8 @@ function registerMinimaxImageToImageCommand(parent) {
         }
       }
       if (opts.output && saved[0]) {
-        fs36.mkdirSync(path43.dirname(path43.resolve(opts.output)), { recursive: true });
-        fs36.copyFileSync(saved[0], opts.output);
+        fs37.mkdirSync(path44.dirname(path44.resolve(opts.output)), { recursive: true });
+        fs37.copyFileSync(saved[0], opts.output);
         logger.success(`Copied to: ${opts.output}`);
       }
       const finalImages = finalizeGeneratedImages(saved, { ...opts, logger });
@@ -9828,12 +10254,12 @@ function validateKnownSpeakerPairing(names = [], refs = []) {
 }
 
 // src/providers/openai/openai-audio.ts
-import fs38 from "fs";
-import path45 from "path";
+import fs39 from "fs";
+import path46 from "path";
 
 // src/providers/openai/client.ts
-import fs37 from "fs";
-import path44 from "path";
+import fs38 from "fs";
+import path45 from "path";
 init_errors();
 var DEFAULT_TIMEOUT_MS4 = 24e4;
 function requireOpenAIKey() {
@@ -9901,10 +10327,10 @@ async function postOpenAIBinary(pathname, body, apiKey, timeoutMs = DEFAULT_TIME
   return Buffer.from(await res.arrayBuffer());
 }
 function fileFromPath(filePath) {
-  const abs = path44.resolve(filePath);
-  if (!fs37.existsSync(abs)) throw new ValidationError(`File not found: ${abs}`);
-  const bytes = fs37.readFileSync(abs);
-  return new File([new Uint8Array(bytes)], path44.basename(abs));
+  const abs = path45.resolve(filePath);
+  if (!fs38.existsSync(abs)) throw new ValidationError(`File not found: ${abs}`);
+  const bytes = fs38.readFileSync(abs);
+  return new File([new Uint8Array(bytes)], path45.basename(abs));
 }
 
 // src/providers/openai/openai-audio.ts
@@ -9943,7 +10369,7 @@ async function resolveAudioReferenceDataUrl(ref) {
 }
 function audioMimeFromReference(ref) {
   const pathname = new URL(ref).pathname;
-  const ext = path45.extname(pathname).toLowerCase();
+  const ext = path46.extname(pathname).toLowerCase();
   switch (ext) {
     case ".mp3":
       return "audio/mpeg";
@@ -9962,12 +10388,12 @@ function audioMimeFromReference(ref) {
 async function generateOpenAISpeech(opts) {
   const bytes = await postOpenAIBinary("/audio/speech", buildSpeechBody(opts), requireOpenAIKey());
   const ext = extFromAudioFormat(opts.outputFormat);
-  const dest = path45.join(getOutputDir(), `openai-speech-${Date.now()}.${ext}`);
-  fs38.writeFileSync(dest, bytes);
+  const dest = path46.join(getOutputDir(), `openai-speech-${Date.now()}.${ext}`);
+  fs39.writeFileSync(dest, bytes);
   opts.logger?.success(`Saved: ${dest} (${(bytes.length / 1024).toFixed(1)} KB)`);
   if (opts.output) {
-    fs38.mkdirSync(path45.dirname(path45.resolve(opts.output)), { recursive: true });
-    fs38.copyFileSync(dest, opts.output);
+    fs39.mkdirSync(path46.dirname(path46.resolve(opts.output)), { recursive: true });
+    fs39.copyFileSync(dest, opts.output);
   }
   return dest;
 }
@@ -9989,9 +10415,9 @@ async function transcribeOpenAIAudio(opts) {
   );
   const text = typeof data.text === "string" ? data.text : void 0;
   const ext = opts.format === "text" ? "txt" : "json";
-  const dest = opts.output ? path45.resolve(opts.output) : path45.join(getOutputDir(), `openai-transcribe-${Date.now()}.${ext}`);
-  fs38.mkdirSync(path45.dirname(dest), { recursive: true });
-  fs38.writeFileSync(dest, opts.format === "text" ? text ?? "" : JSON.stringify(data, null, 2));
+  const dest = opts.output ? path46.resolve(opts.output) : path46.join(getOutputDir(), `openai-transcribe-${Date.now()}.${ext}`);
+  fs39.mkdirSync(path46.dirname(dest), { recursive: true });
+  fs39.writeFileSync(dest, opts.format === "text" ? text ?? "" : JSON.stringify(data, null, 2));
   opts.logger?.success(`Saved transcript: ${dest}`);
   return { path: dest, text };
 }
@@ -10018,9 +10444,9 @@ Generated audio: ${dest}`);
 }
 
 // src/providers/openai/codex-image-driver.ts
-import fs39 from "fs";
-import os3 from "os";
-import path46 from "path";
+import fs40 from "fs";
+import os4 from "os";
+import path47 from "path";
 import { execa } from "execa";
 init_errors();
 var defaultRunner = async (cmd, args, opts) => {
@@ -10069,12 +10495,12 @@ function sanitizeCodexEnv() {
 async function runCodexImageGeneration(opts) {
   const runner = opts.runner ?? defaultRunner;
   const ext = extFromImageFormat(opts.outputFormat);
-  const dest = opts.output ? path46.resolve(opts.output) : path46.join(getOutputDir(), `codex-image-${Date.now()}.${ext}`);
-  fs39.mkdirSync(path46.dirname(dest), { recursive: true });
-  const tmp = fs39.mkdtempSync(path46.join(os3.tmpdir(), "multix-codex-image-"));
-  const schema = path46.join(tmp, "schema.json");
-  const result = path46.join(tmp, "result.json");
-  fs39.writeFileSync(
+  const dest = opts.output ? path47.resolve(opts.output) : path47.join(getOutputDir(), `codex-image-${Date.now()}.${ext}`);
+  fs40.mkdirSync(path47.dirname(dest), { recursive: true });
+  const tmp = fs40.mkdtempSync(path47.join(os4.tmpdir(), "multix-codex-image-"));
+  const schema = path47.join(tmp, "schema.json");
+  const result = path47.join(tmp, "result.json");
+  fs40.writeFileSync(
     schema,
     JSON.stringify({
       type: "object",
@@ -10104,7 +10530,7 @@ async function runCodexImageGeneration(opts) {
   if (res.exitCode !== 0) {
     throw new ProviderError(`Codex image driver failed: ${res.stderr || res.stdout}`, "openai");
   }
-  if (!fs39.existsSync(dest) || fs39.statSync(dest).size === 0) {
+  if (!fs40.existsSync(dest) || fs40.statSync(dest).size === 0) {
     throw new ProviderError(`Codex did not create a non-empty image at ${dest}`, "openai");
   }
   return { path: dest };
@@ -10121,8 +10547,8 @@ function buildCodexPrompt(userPrompt, outputPath) {
 
 // src/providers/openai/openai-image.ts
 init_errors();
-import fs40 from "fs";
-import path47 from "path";
+import fs41 from "fs";
+import path48 from "path";
 function buildImageGenerationBody(opts) {
   return {
     model: opts.model ?? DEFAULT_OPENAI_IMAGE_MODEL,
@@ -10155,14 +10581,14 @@ function saveOpenAIImages(opts) {
   for (let i = 0; i < items.length; i++) {
     const b64 = items[i]?.b64_json;
     if (!b64) throw new ProviderError("No b64_json in OpenAI image response", "openai");
-    const dest = path47.join(outDir, `openai-${opts.task}-${ts}-${i + 1}.${ext}`);
-    fs40.writeFileSync(dest, Buffer.from(b64, "base64"));
+    const dest = path48.join(outDir, `openai-${opts.task}-${ts}-${i + 1}.${ext}`);
+    fs41.writeFileSync(dest, Buffer.from(b64, "base64"));
     saved.push(dest);
     opts.logger?.success(`Saved: ${dest}`);
   }
   if (opts.output && saved[0]) {
-    fs40.mkdirSync(path47.dirname(path47.resolve(opts.output)), { recursive: true });
-    fs40.copyFileSync(saved[0], opts.output);
+    fs41.mkdirSync(path48.dirname(path48.resolve(opts.output)), { recursive: true });
+    fs41.copyFileSync(saved[0], opts.output);
     opts.logger?.success(`Copied to: ${opts.output}`);
   }
   return saved;
@@ -10171,7 +10597,7 @@ async function resolveImageRefBytes(ref) {
   if (isHttpUrl(ref)) {
     const bytes2 = await fetchBytes(ref);
     const pathname = new URL(ref).pathname;
-    const filename = path47.basename(pathname) || "reference.png";
+    const filename = path48.basename(pathname) || "reference.png";
     return { filename, bytes: bytes2, mime: sniffImageMime2(bytes2, filename) };
   }
   const file = fileFromPath(ref);
@@ -10216,7 +10642,7 @@ function sniffImageMime2(buf, name) {
   if (buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return "image/png";
   if (buf.slice(0, 4).toString() === "RIFF" && buf.slice(8, 12).toString() === "WEBP")
     return "image/webp";
-  const ext = path47.extname(name).toLowerCase();
+  const ext = path48.extname(name).toLowerCase();
   if (ext === ".jpg" || ext === ".jpeg") return "image/jpeg";
   if (ext === ".webp") return "image/webp";
   return "image/png";
@@ -10360,8 +10786,8 @@ function registerOpenAICommands(program2) {
 }
 
 // src/providers/openrouter/client.ts
-import fs41 from "fs";
-import path48 from "path";
+import fs42 from "fs";
+import path49 from "path";
 init_errors();
 
 // src/providers/openrouter/payload.ts
@@ -10525,8 +10951,8 @@ async function generateOpenRouterImage(opts) {
     if (!url) continue;
     try {
       const bytes = await fetchBytes(url);
-      const dest = path48.join(outDir, `openrouter_image_${Date.now()}_${i}.png`);
-      fs41.writeFileSync(dest, bytes);
+      const dest = path49.join(outDir, `openrouter_image_${Date.now()}_${i}.png`);
+      fs42.writeFileSync(dest, bytes);
       savedFiles.push(dest);
       logger?.success(`Saved: ${dest}`);
     } catch (e) {
@@ -10537,8 +10963,8 @@ async function generateOpenRouterImage(opts) {
     }
   }
   if (output && savedFiles[0]) {
-    fs41.mkdirSync(path48.dirname(path48.resolve(output)), { recursive: true });
-    fs41.writeFileSync(output, fs41.readFileSync(savedFiles[0]));
+    fs42.mkdirSync(path49.dirname(path49.resolve(output)), { recursive: true });
+    fs42.writeFileSync(output, fs42.readFileSync(savedFiles[0]));
   }
   return { status: "success", generatedImages: savedFiles, model: usedModel };
 }
@@ -10579,8 +11005,8 @@ Generated ${finalImages.length} image(s):`);
 }
 
 // src/providers/openrouter/commands/image-to-image.ts
-import fs42 from "fs";
-import path49 from "path";
+import fs43 from "fs";
+import path50 from "path";
 init_errors();
 var DEFAULT_MODEL = "google/gemini-2.5-flash-image";
 var SOFT_LIMIT_BYTES2 = 5 * 1024 * 1024;
@@ -10672,14 +11098,14 @@ async function runImageToImage(opts) {
     const url = parsed.urls[i];
     if (!url) continue;
     const bytes = await fetchBytes(url);
-    const dest = path49.join(outDir, `openrouter-i2i-${ts}-${i + 1}.png`);
-    fs42.writeFileSync(dest, bytes);
+    const dest = path50.join(outDir, `openrouter-i2i-${ts}-${i + 1}.png`);
+    fs43.writeFileSync(dest, bytes);
     saved.push(dest);
     opts.logger.success(`Saved: ${dest}`);
   }
   if (opts.output && saved[0]) {
-    fs42.mkdirSync(path49.dirname(path49.resolve(opts.output)), { recursive: true });
-    fs42.copyFileSync(saved[0], opts.output);
+    fs43.mkdirSync(path50.dirname(path50.resolve(opts.output)), { recursive: true });
+    fs43.copyFileSync(saved[0], opts.output);
     opts.logger.success(`Copied to: ${opts.output}`);
   }
   return saved;
@@ -10724,13 +11150,13 @@ async function listVideoModels(apiKey = requireOpenRouterKey()) {
 }
 
 // src/providers/openrouter/commands/video-status.ts
-import fs43 from "fs";
-import path50 from "path";
+import fs44 from "fs";
+import path51 from "path";
 async function downloadOpenRouterVideo(opts) {
   const { jobId, logger, source } = opts;
   const apiKey = requireOpenRouterKey();
   const url = videoContentUrl(jobId);
-  const dest = path50.join(getOutputDir(), `openrouter_video_${jobId}.mp4`);
+  const dest = path51.join(getOutputDir(), `openrouter_video_${jobId}.mp4`);
   const { response: r } = await fetchWithValidatedRedirects(url, {
     headers: { Authorization: `Bearer ${apiKey}` }
   });
@@ -10742,14 +11168,14 @@ async function downloadOpenRouterVideo(opts) {
     logger.error("Empty response body");
     process.exit(1);
   }
-  fs43.mkdirSync(path50.dirname(dest), { recursive: true });
-  const ws = fs43.createWriteStream(dest);
+  fs44.mkdirSync(path51.dirname(dest), { recursive: true });
+  const ws = fs44.createWriteStream(dest);
   const { pipeline: pipeline2 } = await import("stream/promises");
   await pipeline2(r.body, ws);
   logger.success(`Saved ${dest}`);
   if (opts.output) {
-    fs43.mkdirSync(path50.dirname(path50.resolve(opts.output)), { recursive: true });
-    fs43.copyFileSync(dest, opts.output);
+    fs44.mkdirSync(path51.dirname(path51.resolve(opts.output)), { recursive: true });
+    fs44.copyFileSync(dest, opts.output);
     logger.success(`Copied to ${opts.output}`);
   }
   await maybeDownloadThumb(source, dest, {
@@ -10947,8 +11373,8 @@ function parseModelRef(ref, explicitVersion) {
     }
     return { kind: "version", version: trimmed };
   }
-  const [path57, inlineVersion, ...rest] = trimmed.split(":");
-  const [owner, name, ...extra] = (path57 ?? "").split("/");
+  const [path58, inlineVersion, ...rest] = trimmed.split(":");
+  const [owner, name, ...extra] = (path58 ?? "").split("/");
   if (rest.length > 0 || extra.length > 0 || !owner || !name) {
     throw new ValidationError(
       `Invalid Replicate model "${ref}" \u2014 expected owner/name, owner/name:version, or a 64-char version id`
@@ -11108,9 +11534,9 @@ var ReplicateClient = class {
     return { accept: "application/json", authorization: `Bearer ${this.apiKey}`, ...extra };
   }
   /** Raw request: throws HttpError so polling can classify transient failures. */
-  raw(path57, method, body, headers2, timeoutMs = REQUEST_TIMEOUT_MS) {
+  raw(path58, method, body, headers2, timeoutMs = REQUEST_TIMEOUT_MS) {
     return fetchJson({
-      url: `${this.baseUrl}${path57}`,
+      url: `${this.baseUrl}${path58}`,
       method,
       headers: this.headers(headers2),
       body,
@@ -11122,7 +11548,7 @@ var ReplicateClient = class {
   async createPrediction(opts) {
     const { model, input } = opts;
     const isOfficial = model.kind === "official";
-    const path57 = isOfficial ? `/models/${model.owner}/${model.name}/predictions` : "/predictions";
+    const path58 = isOfficial ? `/models/${model.owner}/${model.name}/predictions` : "/predictions";
     const body = isOfficial ? { input } : { version: model.version, input };
     const subject = isOfficial ? `model ${model.owner}/${model.name}` : `model version ${model.version}`;
     const headers2 = {};
@@ -11134,7 +11560,7 @@ var ReplicateClient = class {
     }
     for (let attempt = 0; ; attempt++) {
       try {
-        const res = await this.raw(path57, "POST", body, headers2, timeoutMs);
+        const res = await this.raw(path58, "POST", body, headers2, timeoutMs);
         return validatePrediction(res);
       } catch (error) {
         if (error instanceof HttpError && error.status === 429 && attempt < CREATE_MAX_RETRIES) {
@@ -11297,145 +11723,33 @@ import { InvalidArgumentError, Option as Option2 } from "commander";
 
 // src/providers/replicate/node-outputs.ts
 init_errors();
-import fs44 from "fs";
-import path51 from "path";
+import fs45 from "fs";
+import path52 from "path";
 init_redact();
 
 // src/providers/replicate/output.ts
 init_redact();
-
-// src/core/url-safety.ts
-init_errors();
-function ipv4Octets(host) {
-  const parts = host.split(".");
-  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
-  const octets = parts.map(Number);
-  return octets.every((o) => o <= 255) ? octets : void 0;
-}
-function isNonPublicIpv4([a = 0, b = 0, c2 = 0]) {
-  return a === 0 || // "this network" / unspecified
-  a === 10 || a === 127 || // loopback
-  a === 100 && b >= 64 && b <= 127 || // carrier-grade NAT
-  a === 169 && b === 254 || // link-local (cloud metadata)
-  a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c2 === 0 || // IETF protocol assignments
-  a === 192 && b === 0 && c2 === 2 || // TEST-NET-1
-  a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || // benchmarking
-  a === 198 && b === 51 && c2 === 100 || // TEST-NET-2
-  a === 203 && b === 0 && c2 === 113 || // TEST-NET-3
-  a >= 224;
-}
-function ipv6Groups(host) {
-  if (!/^[0-9a-f:.]+$/i.test(host) || !host.includes(":")) return void 0;
-  let text = host;
-  const tail = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(text);
-  if (tail) {
-    const octets = ipv4Octets(tail[2]);
-    if (!octets) return void 0;
-    const [a = 0, b = 0, c2 = 0, d = 0] = octets;
-    text = `${tail[1]}${(a << 8 | b).toString(16)}:${(c2 << 8 | d).toString(16)}`;
-  }
-  const halves = text.split("::");
-  if (halves.length > 2) return void 0;
-  const parse = (s) => s === "" ? [] : s.split(":");
-  const head = parse(halves[0]);
-  const rest = halves.length === 2 ? parse(halves[1]) : [];
-  const missing = 8 - head.length - rest.length;
-  if (halves.length === 2 ? missing < 1 : missing !== 0) return void 0;
-  const all = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest];
-  if (!all.every((g) => /^[0-9a-f]{1,4}$/i.test(g))) return void 0;
-  return all.map((g) => Number.parseInt(g, 16));
-}
-function embeddedIpv4(hi, lo) {
-  return [hi >> 8, hi & 255, lo >> 8, lo & 255];
-}
-function isNonPublicIpv6(groups) {
-  const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;
-  const zeroUpTo = (n) => groups.slice(0, n).every((g) => g === 0);
-  if (zeroUpTo(5) && g5 === 65535) return isNonPublicIpv4(embeddedIpv4(g6, g7));
-  if (g0 === 100 && g1 === 65435 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
-    return isNonPublicIpv4(embeddedIpv4(g6, g7));
-  }
-  if (g0 === 8194) return isNonPublicIpv4(embeddedIpv4(g1, g2));
-  return g0 === 0 || // unspecified (::), loopback (::1), IPv4-compatible and other reserved
-  g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0 || // discard-only 100::/64
-  (g0 & 65024) === 64512 || // unique local fc00::/7
-  (g0 & 65472) === 65152 || // link-local fe80::/10
-  (g0 & 65472) === 65216 || // deprecated site-local fec0::/10
-  (g0 & 65280) === 65280;
-}
-function bareHost(hostname) {
-  const host = hostname.toLowerCase().replace(/\.$/, "");
-  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}
-function isLoopbackHost(hostname) {
-  const host = bareHost(hostname);
-  if (host === "localhost" || host.endsWith(".localhost")) return true;
-  const octets = ipv4Octets(host);
-  if (octets) return octets[0] === 127;
-  const groups = ipv6Groups(host);
-  if (!groups) return false;
-  if (groups.slice(0, 5).every((g) => g === 0) && groups[5] === 65535) {
-    return groups[6] !== void 0 && groups[6] >> 8 === 127;
-  }
-  return groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1;
-}
-function isNonPublicHost(hostname) {
-  const host = bareHost(hostname);
-  if (host === "localhost" || host.endsWith(".localhost")) return true;
-  const octets = ipv4Octets(host);
-  if (octets) return isNonPublicIpv4(octets);
-  const groups = ipv6Groups(host);
-  return groups !== void 0 && isNonPublicIpv6(groups);
-}
-function checkUrlSafety(url, opts) {
-  const action = opts.action ?? "download from";
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new ProviderError(`Refusing to ${action} a malformed URL`, opts.provider);
-  }
-  const host = parsed.hostname.toLowerCase().replace(/\.$/, "");
-  const localOk = opts.allowLocalhostHttp === true && isLoopbackHost(host);
-  const httpOk = parsed.protocol === "https:" || localOk && parsed.protocol === "http:";
-  if (!httpOk) {
-    throw new ProviderError(
-      `Refusing to ${action} ${host || "this URL"}: only https:// URLs are allowed`,
-      opts.provider
-    );
-  }
-  if (!localOk && isNonPublicHost(host)) {
-    throw new ProviderError(
-      `Refusing to ${action} ${host}: it points to a local or private address`,
-      opts.provider
-    );
-  }
-  const trusted = (opts.trustedHosts ?? []).some((t) => host === t || host.endsWith(`.${t}`));
-  return { host, trusted };
-}
-
-// src/providers/replicate/output.ts
 var HTTP_RE = /^https?:\/\//i;
 var DATA_URI_RE = /^data:[^,]*,/i;
 function isMediaRef(value) {
   return typeof value === "string" && (HTTP_RE.test(value) || DATA_URI_RE.test(value));
 }
 var REPLICATE_DELIVERY_HOST = "replicate.delivery";
-function checkOutputUrl(url) {
+function checkOutputUrl2(url) {
   return checkUrlSafety(url, { provider: "replicate", trustedHosts: [REPLICATE_DELIVERY_HOST] });
 }
 function extractOutput(output) {
   const result = { media: [], texts: [] };
   const seen = /* @__PURE__ */ new Set();
-  const visit = (value, path57) => {
+  const visit = (value, path58) => {
     if (value === null || value === void 0) return;
     if (typeof value === "string") {
-      if (isMediaRef(value)) result.media.push({ url: value, path: path57 || "output" });
-      else if (value.length > 0) result.texts.push(path57 ? `${path57}: ${value}` : value);
+      if (isMediaRef(value)) result.media.push({ url: value, path: path58 || "output" });
+      else if (value.length > 0) result.texts.push(path58 ? `${path58}: ${value}` : value);
       return;
     }
     if (typeof value !== "object") {
-      result.texts.push(path57 ? `${path57}: ${String(value)}` : String(value));
+      result.texts.push(path58 ? `${path58}: ${String(value)}` : String(value));
       return;
     }
     if (seen.has(value)) return;
@@ -11443,14 +11757,14 @@ function extractOutput(output) {
     if (Array.isArray(value)) {
       if (value.length > 0 && value.every((v) => typeof v === "string" && !isMediaRef(v))) {
         const joined = value.join("");
-        if (joined.length > 0) result.texts.push(path57 ? `${path57}: ${joined}` : joined);
+        if (joined.length > 0) result.texts.push(path58 ? `${path58}: ${joined}` : joined);
         return;
       }
-      value.forEach((item, i) => visit(item, `${path57}[${i}]`));
+      value.forEach((item, i) => visit(item, `${path58}[${i}]`));
       return;
     }
     for (const [key, val] of Object.entries(value)) {
-      visit(val, path57 ? `${path57}.${key}` : key);
+      visit(val, path58 ? `${path58}.${key}` : key);
     }
   };
   visit(output, "");
@@ -11568,16 +11882,16 @@ var DOWNLOAD_TIMEOUT_MS = 3e5;
 function isDirTarget(output) {
   if (/[\\/]$/.test(output)) return true;
   try {
-    return fs44.statSync(output).isDirectory();
+    return fs45.statSync(output).isDirectory();
   } catch {
     return false;
   }
 }
 function resolveDestination(predictionId, index, count, ext, opts) {
-  if (!opts.output) return path51.join(opts.outDir, outputFilename(predictionId, index, ext));
-  const output = path51.resolve(opts.output);
-  if (isDirTarget(opts.output)) return path51.join(output, outputFilename(predictionId, index, ext));
-  const givenExt = path51.extname(output);
+  if (!opts.output) return path52.join(opts.outDir, outputFilename(predictionId, index, ext));
+  const output = path52.resolve(opts.output);
+  if (isDirTarget(opts.output)) return path52.join(output, outputFilename(predictionId, index, ext));
+  const givenExt = path52.extname(output);
   if (count === 1) return givenExt ? output : `${output}${ext}`;
   const base = givenExt ? output.slice(0, -givenExt.length) : output;
   return `${base}-${String(index + 1).padStart(2, "0")}${ext}`;
@@ -11595,8 +11909,8 @@ async function saveOne(item, predictionId, index, count, opts) {
       extFromUrl4(item.url) ?? ".bin",
       opts
     );
-    fs44.mkdirSync(path51.dirname(dest), { recursive: true });
-    fs44.writeFileSync(dest, bytes);
+    fs45.mkdirSync(path52.dirname(dest), { recursive: true });
+    fs45.writeFileSync(dest, bytes);
     return dest;
   }
   const warned2 = opts.warnedHosts;
@@ -11610,7 +11924,7 @@ async function saveOne(item, predictionId, index, count, opts) {
       maxBytes: opts.maxBytes,
       fetch: opts.fetch,
       validateUrl: (url) => {
-        const { host, trusted } = checkOutputUrl(url);
+        const { host, trusted } = checkOutputUrl2(url);
         if (!trusted && !warned2.has(host)) {
           warned2.add(host);
           opts.logger.warn(
@@ -11811,8 +12125,8 @@ function registerReplicateImageCommand(parent) {
 
 // src/providers/replicate/node-input-files.ts
 init_errors();
-import fs45 from "fs";
-import path52 from "path";
+import fs46 from "fs";
+import path53 from "path";
 var DATA_URI_MAX_BYTES = 256 * 1024;
 var UPLOAD_MAX_BYTES = 100 * 1024 * 1024;
 function formatMb4(bytes) {
@@ -11820,10 +12134,10 @@ function formatMb4(bytes) {
 }
 async function resolveFileInput(value, client, logger) {
   if (isMediaRef(value)) return value;
-  const filePath = path52.resolve(value);
+  const filePath = path53.resolve(value);
   let stat;
   try {
-    stat = fs45.statSync(filePath);
+    stat = fs46.statSync(filePath);
   } catch {
     throw new ValidationError(`Input file not found: ${value} (pass a local path or an https URL)`);
   }
@@ -11834,9 +12148,9 @@ async function resolveFileInput(value, client, logger) {
       `Input file ${value} is ${formatMb4(stat.size)}; Replicate accepts uploads under 100MB. Host it and pass an https URL instead.`
     );
   }
-  const filename = path52.basename(filePath);
+  const filename = path53.basename(filePath);
   const contentType = mimeFromFilename(filename);
-  const bytes = fs45.readFileSync(filePath);
+  const bytes = fs46.readFileSync(filePath);
   if (stat.size <= DATA_URI_MAX_BYTES) {
     logger.debug(`Inlining ${filename} (${stat.size} bytes) as a data URI`);
     return `data:${contentType};base64,${bytes.toString("base64")}`;
@@ -11963,8 +12277,8 @@ function registerReplicateCommands(program2) {
 }
 
 // src/commands/check.ts
-import fs46 from "fs";
-import os4 from "os";
+import fs47 from "fs";
+import os5 from "os";
 
 // src/commands/check-helpers/binary-check.ts
 import { execa as execa2 } from "execa";
@@ -12212,8 +12526,8 @@ function registerCheckCommand(program2) {
       logger.info(`Env files loaded: ${files.length > 0 ? files.join(", ") : "none"}`);
     }
     if (!legacyClaudeEnvEnabled()) {
-      const home = process.env.MULTIX_DISABLE_HOME_ENV ? void 0 : os4.homedir();
-      const legacy = legacyClaudeEnvFiles(process.cwd(), home).filter((f) => fs46.existsSync(f));
+      const home = process.env.MULTIX_DISABLE_HOME_ENV ? void 0 : os5.homedir();
+      const legacy = legacyClaudeEnvFiles(process.cwd(), home).filter((f) => fs47.existsSync(f));
       if (legacy.length > 0) {
         logger.info(
           `Found ${legacy.length} legacy .claude env file(s); set MULTIX_LEGACY_CLAUDE_ENV=1 to load them`
@@ -12330,8 +12644,8 @@ function registerCheckCommand(program2) {
 }
 
 // src/commands/doc/convert.ts
-import fs47 from "fs";
-import path53 from "path";
+import fs48 from "fs";
+import path54 from "path";
 
 // src/commands/doc/default-prompt.ts
 var DEFAULT_CONVERT_PROMPT = `Convert this document to clean, well-formatted Markdown.
@@ -12349,7 +12663,7 @@ Output only the markdown content without any preamble or explanation.`;
 // src/commands/doc/convert.ts
 function autoNameBase(input) {
   if (input === STDIN_ARG) return "stdin";
-  return path53.basename(input, path53.extname(input));
+  return path54.basename(input, path54.extname(input));
 }
 async function convertDocuments(opts) {
   const { output, autoName = false, verbose, logger } = opts;
@@ -12366,13 +12680,13 @@ async function convertDocuments(opts) {
   try {
     let outputPath;
     if (output) {
-      outputPath = path53.resolve(output);
+      outputPath = path54.resolve(output);
     } else if (autoName && opts.inputs.length === 1 && opts.inputs[0]) {
-      outputPath = path53.join(getOutputDir(), `${autoNameBase(opts.inputs[0])}-extraction.md`);
+      outputPath = path54.join(getOutputDir(), `${autoNameBase(opts.inputs[0])}-extraction.md`);
     } else {
-      outputPath = path53.join(getOutputDir(), "document-extraction.md");
+      outputPath = path54.join(getOutputDir(), "document-extraction.md");
     }
-    fs47.mkdirSync(path53.dirname(outputPath), { recursive: true });
+    fs48.mkdirSync(path54.dirname(outputPath), { recursive: true });
     failed = await convertResolved(inputs, { outputPath, model, prompt, verbose, logger });
   } finally {
     cleanup();
@@ -12445,7 +12759,7 @@ async function convertResolved(inputs, ctx) {
 `);
   for (const r of results) {
     lines.push(`
-## ${path53.basename(r.file).replace(/[<>]/g, "\\$&")}
+## ${path54.basename(r.file).replace(/[<>]/g, "\\$&")}
 `);
     if (r.status === "success" && r.markdown) {
       lines.push(`${r.markdown}
@@ -12458,7 +12772,7 @@ async function convertResolved(inputs, ctx) {
     }
     lines.push("\n---\n");
   }
-  fs47.writeFileSync(outputPath, lines.join("\n"), "utf8");
+  fs48.writeFileSync(outputPath, lines.join("\n"), "utf8");
   const succeeded = results.filter((r) => r.status === "success").length;
   console.log(`
 ${"=".repeat(50)}`);
@@ -12512,12 +12826,12 @@ function registerDocCommands(program2) {
 
 // src/commands/media/index.ts
 init_errors();
-import fs50 from "fs";
-import path56 from "path";
+import fs51 from "fs";
+import path57 from "path";
 
 // src/commands/media/batch.ts
-import fs48 from "fs";
-import path54 from "path";
+import fs49 from "fs";
+import path55 from "path";
 
 // src/commands/media/detect-type.ts
 var VIDEO_EXTS2 = /* @__PURE__ */ new Set([".mp4", ".mov", ".avi", ".mkv", ".webm", ".flv", ".mpg", ".mpeg"]);
@@ -12713,10 +13027,10 @@ async function batchOptimize(opts) {
     verbose,
     logger
   } = opts;
-  fs48.mkdirSync(outputDir, { recursive: true });
-  const entries = fs48.readdirSync(inputDir);
+  fs49.mkdirSync(outputDir, { recursive: true });
+  const entries = fs49.readdirSync(inputDir);
   const mediaFiles = entries.filter((f) => {
-    const ext = path54.extname(f).toLowerCase();
+    const ext = path55.extname(f).toLowerCase();
     return ALL_EXTS.has(ext);
   });
   if (mediaFiles.length === 0) {
@@ -12727,9 +13041,9 @@ async function batchOptimize(opts) {
   let succeeded = 0;
   const errors = [];
   for (const file of mediaFiles) {
-    const inputPath = path54.join(inputDir, file);
-    const outputPath = path54.join(outputDir, file);
-    const ext = path54.extname(file).toLowerCase();
+    const inputPath = path55.join(inputDir, file);
+    const outputPath = path55.join(outputDir, file);
+    const ext = path55.extname(file).toLowerCase();
     const kind = extToKind(ext);
     logger?.debug(`Processing: ${file}`);
     try {
@@ -12766,8 +13080,8 @@ async function batchOptimize(opts) {
 
 // src/commands/media/split-video.ts
 init_errors();
-import fs49 from "fs";
-import path55 from "path";
+import fs50 from "fs";
+import path56 from "path";
 async function splitVideo(opts) {
   await assertFfmpeg();
   const { input, outputDir, chunkDuration = 3600, verbose, logger } = opts;
@@ -12778,10 +13092,10 @@ async function splitVideo(opts) {
     logger?.info("Video is short enough \u2014 no splitting needed");
     return [input];
   }
-  fs49.mkdirSync(outputDir, { recursive: true });
-  const ext = path55.extname(input) || ".mp4";
-  const baseName = path55.basename(input, ext);
-  const outputPattern = path55.join(outputDir, `${baseName}_chunk_%03d${ext}`);
+  fs50.mkdirSync(outputDir, { recursive: true });
+  const ext = path56.extname(input) || ".mp4";
+  const baseName = path56.basename(input, ext);
+  const outputPattern = path56.join(outputDir, `${baseName}_chunk_%03d${ext}`);
   logger?.debug(`Splitting into ~${numChunks} chunks of ${chunkDuration}s each`);
   const args = [
     "-i",
@@ -12800,8 +13114,8 @@ async function splitVideo(opts) {
   await runFfmpeg(args, { verbose, logger });
   const files = [];
   for (let i = 0; i < numChunks + 1; i++) {
-    const fname = path55.join(outputDir, `${baseName}_chunk_${String(i).padStart(3, "0")}${ext}`);
-    if (fs49.existsSync(fname)) files.push(fname);
+    const fname = path56.join(outputDir, `${baseName}_chunk_${String(i).padStart(3, "0")}${ext}`);
+    if (fs50.existsSync(fname)) files.push(fname);
   }
   logger?.success(`Created ${files.length} chunks in ${outputDir}`);
   return files;
@@ -12815,9 +13129,9 @@ function registerMediaCommands(program2) {
   media.command("optimize").description("Optimize a single media file (video, audio, or image)").requiredOption("--input <file>", "Input media file").requiredOption("--output <file>", "Output file path").option("--target-size <MB>", "Target file size in MB").option("--quality <n>", "Quality: video CRF (0-51) or image (1-100)", "85").option("--max-width <px>", "Max image/video width in pixels", "1920").option("--bitrate <rate>", "Audio bitrate (e.g. 64k)", "64k").option("--resolution <WxH>", "Force video resolution (e.g. 1920x1080)").option("-v, --verbose", "Verbose logging").action(
     async (opts) => {
       const logger = createLogger({ verbose: opts.verbose ?? false });
-      if (!fs50.existsSync(opts.input)) throw new ValidationError(`Input not found: ${opts.input}`);
-      fs50.mkdirSync(path56.dirname(path56.resolve(opts.output)), { recursive: true });
-      const ext = path56.extname(opts.input).toLowerCase();
+      if (!fs51.existsSync(opts.input)) throw new ValidationError(`Input not found: ${opts.input}`);
+      fs51.mkdirSync(path57.dirname(path57.resolve(opts.output)), { recursive: true });
+      const ext = path57.extname(opts.input).toLowerCase();
       const kind = extToKind(ext);
       if (!kind) throw new ValidationError(`Unsupported file type: ${ext}`);
       const quality = Number.parseInt(opts.quality, 10);
@@ -12857,7 +13171,7 @@ function registerMediaCommands(program2) {
   media.command("split").description("Split a long video into fixed-duration chunks").requiredOption("--input <file>", "Input video file").option("--output-dir <dir>", "Output directory for chunks", "./chunks").option("--chunk-duration <sec>", "Chunk duration in seconds", "3600").option("-v, --verbose", "Verbose logging").action(
     async (opts) => {
       const logger = createLogger({ verbose: opts.verbose ?? false });
-      if (!fs50.existsSync(opts.input)) throw new ValidationError(`Input not found: ${opts.input}`);
+      if (!fs51.existsSync(opts.input)) throw new ValidationError(`Input not found: ${opts.input}`);
       const chunks = await splitVideo({
         input: opts.input,
         outputDir: opts.outputDir,
@@ -12873,7 +13187,7 @@ Created ${chunks.length} chunk(s) in ${opts.outputDir}`);
   media.command("batch").description("Batch optimize all media files in a directory").requiredOption("--input-dir <dir>", "Input directory").requiredOption("--output-dir <dir>", "Output directory").option("--quality <n>", "Quality setting", "85").option("--max-width <px>", "Max image/video width", "1920").option("--bitrate <rate>", "Audio bitrate", "64k").option("-v, --verbose", "Verbose logging").action(
     async (opts) => {
       const logger = createLogger({ verbose: opts.verbose ?? false });
-      if (!fs50.existsSync(opts.inputDir))
+      if (!fs51.existsSync(opts.inputDir))
         throw new ValidationError(`Input dir not found: ${opts.inputDir}`);
       const result = await batchOptimize({
         inputDir: opts.inputDir,