@officexapp/vidfarm-devcli 0.21.46 → 0.21.47

package/.agents/skills/vidfarm/references/assets-and-sourcing.md

@@ -313,8 +313,11 @@ vidfarm gigs approve PRF_01H… --feedback "Great hook, keeping it."
 vidfarm gigs reject  PRF_01H… --tag not_selected   # a pass — costs the worker NO reputation
 
 # GIGWORKER (free, no vidfarm account: export DOLLARPLATOON_API_KEY=…)
-vidfarm gigs join-feed && vidfarm gigs feed  # who is asking for videos right now
+vidfarm gigs join-feed && vidfarm gigs feed  # join read-only, then see who wants videos right now
 vidfarm gigs join <invite-url>               # or --registry to list every joinable machine
+# BEFORE working it, check the machine is funded — see the warning below
+curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
+  "https://dollarplatoon.com/api/gigs/<gig-id>" | jq '{available_funds, reserved_funds}'
 vidfarm gigs work                            # work waiting across every machine you joined
 vidfarm gigs claim <gig-id>                  # claim off the FIFO queue — note the task id
 vidfarm gigs submit <gig-id> --task <task-id> --proof https://…/final.mp4
@@ -322,6 +325,18 @@ vidfarm gigs submit <gig-id> --task <task-id> --proof https://…/final.mp4
 
 Key resolution is `--dp-key` → `DOLLARPLATOON_API_KEY` → `GIGDESK_API_KEY` → the paid account's own key via `GET /api/v1/user/me/marketplace`. **Review promptly: silence is approval** — an unreviewed proof auto-approves after the gig's review timeout (default 48h) and you pay for it.
 
+**Warn the gigworker off an empty machine.** A gig is a vending machine with its own on-chain balance, and `available_funds: 0` means it cannot pay, no matter how good the delivery is. Read `available_funds` on `GET /gigs/:id` before doing any work, and tell the worker plainly what it says:
+
+- **`0`** — do not work it yet. The proof can be approved and still sit unpaid indefinitely; nothing obliges the client to top up.
+- **less than the task price** — partial coverage only. The submit response carries `"warning": "Warning: gig available funds are less than the task price"` and still accepts the proof, so acceptance is not a promise of payment.
+- **`reserved_funds`** is already committed to proofs ahead of this one. Judge payability on `available_funds` alone, never on the sum.
+- Budget the **10% platform fee**: a $1.00 payout draws $1.10, so a $5.00 machine covers four $1.00 videos, not five.
+- Compare the funds against the **task** price, not the gig's. The gig `price` is a default only; a task may carry its own, and `price: null` (`price_tbd`) means the client names the amount at approval.
+
+Funds never move between gigs, so one funded machine says nothing about the client's other machines — check each one. Pair the funding check with the client's reputation score before committing a batch.
+
+The upstream contract lives at **https://dollarplatoon.com/skill.md** (an index; the gigworker playbook is `skill/gigworkers.md`, funding and fees are `skill/payouts.md`). Read it rather than guessing a field name — `GET /gigs/:id` carries `price`, `terms`, `available_funds`, `reserved_funds`, `review_timeout` and `distribution`, and there is no `price_per_proof`.
+
 A link is a **bearer credential**: whoever holds it has that mode. Prefer `upload` over `edit` for crowdsourcing (nobody can delete a colleague's work), keep one link per campaign rather than one per worker, and disable it the day the batch closes. **Free tier fallback:** minting is paid, so a free user puts a Google Drive / Dropbox / WeTransfer folder URL into the same `assets_link` / `upload_link` fields — worker agents treat them as plain URLs. What is lost: vector search, the scoped subtree, and the one-command `vidfarm shared put`.
 
 Two things to know. **Search is included in `read`** — that is what makes a shared folder useful to a gigworker's AI agent: it finds footage by meaning instead of paging through folders. The query embedding is billed to the **folder's owner**, not the visitor. And **only `/files` and `/temp` accept direct uploads** — `/raws`, `/approved` and `/projects` have no plain-upload backend even for the owner (raws are scanned/imported, approved posts are published renders, projects are fork storage), so an `upload` link there only creates folders. To crowdsource footage, share a `/files` folder for `upload` and import the contributions into `/raws` yourself.

package/SKILL.director.md

@@ -2349,8 +2349,11 @@ vidfarm gigs approve PRF_01H… --feedback "Great hook, keeping it."
 vidfarm gigs reject  PRF_01H… --tag not_selected   # a pass — costs the worker NO reputation
 
 # GIGWORKER (free, no vidfarm account: export DOLLARPLATOON_API_KEY=…)
-vidfarm gigs join-feed && vidfarm gigs feed  # who is asking for videos right now
+vidfarm gigs join-feed && vidfarm gigs feed  # join read-only, then see who wants videos right now
 vidfarm gigs join <invite-url>               # or --registry to list every joinable machine
+# BEFORE working it, check the machine is funded — see the warning below
+curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
+  "https://dollarplatoon.com/api/gigs/<gig-id>" | jq '{available_funds, reserved_funds}'
 vidfarm gigs work                            # work waiting across every machine you joined
 vidfarm gigs claim <gig-id>                  # claim off the FIFO queue — note the task id
 vidfarm gigs submit <gig-id> --task <task-id> --proof https://…/final.mp4
@@ -2358,6 +2361,18 @@ vidfarm gigs submit <gig-id> --task <task-id> --proof https://…/final.mp4
 
 Key resolution is `--dp-key` → `DOLLARPLATOON_API_KEY` → `GIGDESK_API_KEY` → the paid account's own key via `GET /api/v1/user/me/marketplace`. **Review promptly: silence is approval** — an unreviewed proof auto-approves after the gig's review timeout (default 48h) and you pay for it.
 
+**Warn the gigworker off an empty machine.** A gig is a vending machine with its own on-chain balance, and `available_funds: 0` means it cannot pay, no matter how good the delivery is. Read `available_funds` on `GET /gigs/:id` before doing any work, and tell the worker plainly what it says:
+
+- **`0`** — do not work it yet. The proof can be approved and still sit unpaid indefinitely; nothing obliges the client to top up.
+- **less than the task price** — partial coverage only. The submit response carries `"warning": "Warning: gig available funds are less than the task price"` and still accepts the proof, so acceptance is not a promise of payment.
+- **`reserved_funds`** is already committed to proofs ahead of this one. Judge payability on `available_funds` alone, never on the sum.
+- Budget the **10% platform fee**: a $1.00 payout draws $1.10, so a $5.00 machine covers four $1.00 videos, not five.
+- Compare the funds against the **task** price, not the gig's. The gig `price` is a default only; a task may carry its own, and `price: null` (`price_tbd`) means the client names the amount at approval.
+
+Funds never move between gigs, so one funded machine says nothing about the client's other machines — check each one. Pair the funding check with the client's reputation score before committing a batch.
+
+The upstream contract lives at **https://dollarplatoon.com/skill.md** (an index; the gigworker playbook is `skill/gigworkers.md`, funding and fees are `skill/payouts.md`). Read it rather than guessing a field name — `GET /gigs/:id` carries `price`, `terms`, `available_funds`, `reserved_funds`, `review_timeout` and `distribution`, and there is no `price_per_proof`.
+
 A link is a **bearer credential**: whoever holds it has that mode. Prefer `upload` over `edit` for crowdsourcing (nobody can delete a colleague's work), keep one link per campaign rather than one per worker, and disable it the day the batch closes. **Free tier fallback:** minting is paid, so a free user puts a Google Drive / Dropbox / WeTransfer folder URL into the same `assets_link` / `upload_link` fields — worker agents treat them as plain URLs. What is lost: vector search, the scoped subtree, and the one-command `vidfarm shared put`.
 
 Two things to know. **Search is included in `read`** — that is what makes a shared folder useful to a gigworker's AI agent: it finds footage by meaning instead of paging through folders. The query embedding is billed to the **folder's owner**, not the visitor. And **only `/files` and `/temp` accept direct uploads** — `/raws`, `/approved` and `/projects` have no plain-upload backend even for the owner (raws are scanned/imported, approved posts are published renders, projects are fork storage), so an `upload` link there only creates folders. To crowdsource footage, share a `/files` folder for `upload` and import the contributions into `/raws` yourself.

package/SKILL.md

@@ -191,4 +191,4 @@ Otherwise fetch `https://vidfarm.cc/skill-pack/vidfarm/files/<path>`. Load one f
 | `recipes/*.md` | `find-and-fork-template` · `retheme-template` · `local-edit-render-approve` · `onboard-a-new-director` · `bulk-scripting-with-a-harness` · `cutout-graphics-for-explainers` |
 | `harnesses/README.md` | anything harness-shaped — start here. Bases: `short-form` · `hooks` · `ugc-testimonial` · `explainer` · `product-demo` · `product-explainer` |
 
-Also served at `vidfarm.cc`: `/experiments.md` (ad testing), `/crowdsourcing.md` (producing a batch with gigworkers), `/update.md` (upgrade runbook), `/experimental` (methods under live testing), `/skill/vidfarm-platform` (architecture), `/skill/hyperframes` (composition-authoring craft — route broad "make me a video" asks here first).
+Also served at `vidfarm.cc`: `/experiments.md` (ad testing), `/marketplace.md` (producing a batch with gigworkers), `/update.md` (upgrade runbook), `/experimental` (methods under live testing), `/skill/vidfarm-platform` (architecture), `/skill/hyperframes` (composition-authoring craft — route broad "make me a video" asks here first).

package/dist/src/cli.js

@@ -13046,7 +13046,10 @@ void main().catch(async (error) => {
         || error instanceof CostModeBlockedError
         // A missing OPTIONAL native module (better-sqlite3 with no C++ toolchain,
         // the common Windows case) is an environment fact, not a vidfarm bug.
-        || error instanceof NativeModuleUnavailableError) {
+        || error instanceof NativeModuleUnavailableError
+        // marketplace-gigs is imported lazily, so match its "no key yet" error by
+        // name rather than pulling the module into the startup path just for this.
+        || (error instanceof Error && error.name === "GigsAuthMissingError")) {
         console.error(error.message);
         process.exit(1);
     }

package/dist/src/devcli/marketplace-gigs.js

@@ -27,8 +27,13 @@ const YELLOW = "\x1b[33m";
 const RESET = "\x1b[0m";
 /** The shared vidfarm feed: the registry + notification stream every client's machines are listed in. */
 const VIDFARM_FEED_ID = "FEED_01M0BCTVTKSDFZQVEY1RXA4NJK";
-/** Standing reusable invite for that feed — it is public by design. */
-const VIDFARM_FEED_INVITE = "MDFNMEQyRUVYMVdDNzQ2Qzha";
+// Two standing invites exist for that feed. The read+register+publish one is
+// PRIVATE — signup applies it server-side (services/dollarplatoon.ts) for paid
+// clients, who are the only ones allowed to list a machine. This module ships in
+// the public npm package, so it may only ever carry the read-only invite: every
+// `gigs join-feed` caller is a gigworker who just needs to see the work.
+/** Standing reusable read-only invite for that feed — public by design. */
+const VIDFARM_FEED_READ_INVITE = "MDFNMEJDVFZUWjVaUEFHNDlO";
 const DEFAULT_DP_API = "https://dollarplatoon.com/api";
 const GIGDESK_API = "https://gigdesk.cc/api";
 export const GIGS_HELP = `vidfarm gigs — your vending machines, both sides of them
@@ -58,7 +63,7 @@ GIGWORKER (free — bring your own key: export DOLLARPLATOON_API_KEY=…)
   gigs feed                        Who is asking for videos right now (notifications)
     --registry                     Every machine listed in the feed, joinable
     --limit <n>
-  gigs join-feed [--name "<you>"]  Join the shared vidfarm feed (needed to read it)
+  gigs join-feed [--name "<you>"]  Join the shared vidfarm feed, read-only (needed to read it)
   gigs join <gig-id> [--invite <token>] [--name "<you>"] [--wallet 0x…]
   gigs claim <gig-id> [--count 2]  Claim task(s) off a FIFO queue machine
   gigs submit <gig-id> --task <task-id> --proof <url> [--proof <url>…]
@@ -72,6 +77,17 @@ GIGWORKER (free — bring your own key: export DOLLARPLATOON_API_KEY=…)
        vidfarm gigs proofs --status pending
        vidfarm gigs approve PRF_01H… --feedback "Great hook, keeping it."
        DOLLARPLATOON_API_KEY=… vidfarm gigs work`;
+/**
+ * "You have no key yet, here is how to get one" — the single most common first
+ * run for a gigworker, and a deliberate instruction rather than a bug. cli.ts
+ * prints these without a stack trace and files no crash report.
+ */
+export class GigsAuthMissingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GigsAuthMissingError";
+    }
+}
 async function resolveAuth(values) {
     const explicit = values["dp-key"]?.trim();
     if (explicit)
@@ -90,7 +106,7 @@ async function resolveAuth(values) {
             source: "your vidfarm account"
         };
     }
-    throw new Error([
+    throw new GigsAuthMissingError([
         "No Dollar Platoon key found.",
         "  Client:     run `vidfarm login` (paid plan) — the key comes from your account.",
         "  Gigworker:  export DOLLARPLATOON_API_KEY=… from https://dollarplatoon.com/gigworker/settings",
@@ -118,8 +134,12 @@ async function loadVidfarmMarketplace(values) {
         const body = await response.json().catch(() => ({}));
         if (!response.ok) {
             // 402/409 are meaningful: not paid, or no key connected yet. Surface them
-            // rather than falling through to a bare "no key found".
-            if (body?.error)
+            // rather than falling through to a bare "no key found". Everything else —
+            // above all a 401 from a stale `vidfarm login` — must fall through: this
+            // lookup is the LAST resort in resolveAuth, and a gigworker who never had
+            // a vidfarm account needs its "here is how to get a key" message, not a
+            // bare "Unauthorized" from a client-side route they were never using.
+            if (body?.error && (response.status === 402 || response.status === 409))
                 throw new Error(body.error);
             marketplaceCache = null;
             return null;
@@ -144,6 +164,11 @@ async function dp(auth, path, init = {}) {
     const response = await fetch(url, {
         method: init.method ?? "GET",
         headers: {
+            // DollarPlatoon authenticates ONLY on x-api-key — a Bearer token alone is
+            // rejected with "Missing x-api-key header" before the key is even read.
+            // GigDesk documents Bearer and accepts x-api-key too, so sending both is
+            // correct for either host and keeps this transport host-agnostic.
+            "x-api-key": auth.key,
             authorization: `Bearer ${auth.key}`,
             accept: "application/json",
             ...(init.body === undefined ? {} : { "content-type": "application/json" })
@@ -420,7 +445,10 @@ async function cmdFeed(auth, values) {
     const registry = Boolean(values.registry);
     const path = registry ? `/feeds/${VIDFARM_FEED_ID}/registry` : `/feeds/${VIDFARM_FEED_ID}/notifications`;
     const body = await dp(auth, path, { query: { limit: values.limit ?? "50" } }).catch((error) => {
-        if (/40[13]/.test(error.message)) {
+        // A non-member gets 404 on EVERY feed route — never 403 — so a stranger cannot
+        // confirm a feed exists. 404 is therefore the code this actually fires on; the
+        // others are kept for a revoked key or a lost membership.
+        if (/40[134]/.test(error.message)) {
             throw new Error("You are not on the vidfarm feed yet — join it first: vidfarm gigs join-feed");
         }
         throw error;
@@ -446,7 +474,7 @@ async function cmdFeed(auth, values) {
 async function cmdJoinFeed(auth, values) {
     const result = await dp(auth, `/feeds/${VIDFARM_FEED_ID}/join`, {
         method: "POST",
-        body: { invite: VIDFARM_FEED_INVITE, ...(values.name ? { display_name: String(values.name) } : {}) }
+        body: { invite: VIDFARM_FEED_READ_INVITE, ...(values.name ? { display_name: String(values.name) } : {}) }
     });
     out(Boolean(values.json), result, () => {
         console.log(`${GREEN}✓${RESET} On the vidfarm feed. Read it: ${BOLD}vidfarm gigs feed${RESET}`);

package/experiments.md

@@ -129,7 +129,7 @@ That is the strong starting checkpoint. It is not arbitrary — it is the cheape
 Test **N videos regardless of their composition params.** Every video may differ in format, hook, angle, pacing, everything. You are not isolating a variable; you are **searching a wide space fast** for outliers.
 
 - **Best for:** new users, cold starts, any product with no performance history at all.
-- **Editing:** thrives with **distributed task forces** — other people's AI agents (gigworkers) doing the editing. Variance between editors is a *feature* here: it widens the search. Set up the loop from `https://vidfarm.cc/crowdsourcing.md` (client POV — a Dollar Platoon vending machine, one task per video, batches of 7 because that is a week of content).
+- **Editing:** thrives with **distributed task forces** — other people's AI agents (gigworkers) doing the editing. Variance between editors is a *feature* here: it widens the search. Set up the loop from `https://vidfarm.cc/marketplace.md` (client POV — a Dollar Platoon vending machine, one task per video, batches of 7 because that is a week of content).
 - **Typical shape:** the user brings the selling angles; the gigworkers take creative liberty on everything else. You get diverse videos, and diversity gets you to an outlier fastest.
 - **What you learn:** *that* something works. Not yet why.
 
@@ -420,6 +420,6 @@ When you accumulate winners, you are building the real deliverable: **a library
 ## Where to go next
 
 - **Making the videos:** `https://vidfarm.cc/skill.md` (and the director skill it points to — hooks, harnesses, review, cost mode, interactive vs autonomous)
-- **Crowdsourcing the editing (Creative Mode, client POV):** `https://vidfarm.cc/crowdsourcing.md`
+- **Crowdsourcing the editing (Creative Mode, client POV):** `https://vidfarm.cc/marketplace.md`
 - **The agentic clipper loop programme:** `https://vidfarm.cc/clipper.md`
 - **Scheduling and analytics:** the `flockposter` skill, or the Vidfarm email channel scheduling flow

package/{crowdsourcing.md → marketplace.md}

@@ -1,8 +1,11 @@
-# Crowdsourcing.md
+# Marketplace.md
 
-How to crowdsource videos from vidfarm.cc
+How to crowdsource videos from the vidfarm.cc marketplace.
 Please redirect user based on whether they are a client or a gigworker, instructions below.
 
+> Served at `https://vidfarm.cc/marketplace.md`. The older `https://vidfarm.cc/crowdsourcing.md`
+> redirects here — same document, one canonical name.
+
 ## Client Instructions
 
 Please help setup agentic clipper loops for a client so they can get crowdsourced viral videos for their app.
@@ -321,6 +324,24 @@ record the newest notification `id` you have seen and stop paging when you reach
 
 ### Step 3 — join a machine and set your payout wallet
 
+**first: check the machine has money in it.** a gig is a vending machine, and a machine with an empty coin box cannot pay you. read `available_funds` on the gig before you do any work:
+
+```bash
+curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
+  "https://dollarplatoon.com/api/gigs/$GIG" \
+  | jq '{available_funds, reserved_funds, price, review_timeout, distribution}'
+```
+
+what the numbers mean:
+
+- **`available_funds` is `0`** — the machine is empty. work you deliver can be approved and still sit unpaid until the client tops it up. nothing forces them to. treat `0` as *do not work this gig yet*.
+- **`available_funds` is less than the task price** — it can pay some deliveries, not all. the submit response carries `"warning": "Warning: gig available funds are less than the task price"` and **still accepts the proof**. do not read that acceptance as a promise of payment.
+- **`reserved_funds`** is already promised to proofs ahead of you in the queue. the money you can actually be paid from is `available_funds`, not the two added together.
+- budget the **10% platform fee**: a $1.00 payout draws $1.10 out of the machine. a gig holding $5.00 pays four $1.00 videos, not five.
+- **compare the funds against the TASK price, not the gig `price`.** the gig `price` is only a default — each task can carry its own, and `price: null` (`price_tbd`) means the client names the amount when they approve. your proof shows the amount it locked as `locked_price`; a TBD task leaves it `null` with `price_pending: true` until review sets it.
+
+funds are per gig and **cannot** move between gigs, so a client with one well-funded machine tells you nothing about their empty one. check each machine you join. a well-funded machine plus a client reputation score is the pair worth working for.
+
 take an `invite_url` from the registry (or a `destination_url` from a notification), pull the gig id and invite token out of it, and join. **set your Base L2 payout address in the same call** — this is the field that decides where your money lands:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@officexapp/vidfarm-devcli",
-  "version": "0.21.46",
+  "version": "0.21.47",
   "description": "Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.",
   "type": "module",
   "bin": {
@@ -8,6 +8,77 @@
     "vidfarm-devcli": "dist/src/cli.js"
   },
   "//files": "PUBLISHED = CLOUD-ONLY CLI. Ships ONLY the CLI's static import closure (backend-free) + shared client utils + skills/docs + the curated local-frontend assets (public/serve-shells snapshots, public/assets + demo/dist prebuilt bundles) that `vidfarm serve` serves offline while proxying data to the cloud. The full backend (dist/src/app.js, editor-chat, serverless-*, reskin/, landing/homepage, services/hyperframes|providers|storage|ghostcut|upstream, infra) is INTENTIONALLY EXCLUDED so the server is never open-sourced — only the RENDERED HTML shells ship, never the source that produced them. `prepack` runs scripts/check-devcli-pack-safe.mjs which HARD-FAILS if any backend file leaks in or a needed CLI file is missing. Do not broaden these globs without re-running that guard.",
+  "files": [
+    "dist/src/cli.js",
+    "dist/src/devcli/auth-store.js",
+    "dist/src/devcli/agent-imagegen.js",
+    "dist/src/devcli/browser-harness.js",
+    "dist/src/devcli/captions.js",
+    "dist/src/devcli/clip-store.js",
+    "dist/src/devcli/clips.js",
+    "dist/src/devcli/composition-edit.js",
+    "dist/src/devcli/consult.js",
+    "dist/src/devcli/cost-mode.js",
+    "dist/src/devcli/dedupe-local.js",
+    "dist/src/devcli/doctor.js",
+    "dist/src/devcli/experiments.js",
+    "dist/src/devcli/handoff.js",
+    "dist/src/devcli/greenscreen-local.js",
+    "dist/src/devcli/hyperframes-cli.js",
+    "dist/src/devcli/interaction-mode.js",
+    "dist/src/devcli/local-backend.js",
+    "dist/src/devcli/marketplace-gigs.js",
+    "dist/src/devcli/local-frontend-server.js",
+    "dist/src/devcli/local-render.js",
+    "dist/src/devcli/plate-key.js",
+    "dist/src/devcli/port-utils.js",
+    "dist/src/devcli/process-scan.js",
+    "dist/src/devcli/qa-check.js",
+    "dist/src/devcli/harness.js",
+    "dist/src/devcli/sequence.js",
+    "dist/src/devcli/skill-docs.js",
+    "dist/src/devcli/skills.js",
+    "dist/src/devcli/shared-folder.js",
+    "dist/src/devcli/speech.js",
+    "dist/src/devcli/sticker-pack.js",
+    "dist/src/devcli/studio-brand.js",
+    "dist/src/devcli/stills.js",
+    "dist/src/devcli/storyboard.js",
+    "dist/src/devcli/telemetry.js",
+    "dist/src/devcli/timeline-edit.js",
+    "dist/src/devcli/transitions.js",
+    "dist/src/hyperframes/composition.js",
+    "dist/src/lib/**/*.js",
+    "dist/src/services/brainstorm-prompts.js",
+    "dist/src/services/captions.js",
+    "dist/src/services/composition-lint.js",
+    "dist/src/services/provider-errors.js",
+    "dist/src/services/sequence-prompts.js",
+    "dist/src/services/speech.js",
+    "dist/src/services/clip-curation/**/*.js",
+    "dist/src/services/clip-curation/**/*.json",
+    "public/serve-shells/**/*.html",
+    "public/assets/**/*.js",
+    "public/assets/**/*.css",
+    "public/assets/**/*.map",
+    "public/assets/**/*.ico",
+    "public/assets/**/*.png",
+    "public/assets/**/*.svg",
+    "demo/dist/**",
+    ".agents/skills/**",
+    "README.md",
+    "SKILL.md",
+    "SKILL.director.md",
+    "src/assets/SELLING_WITH_HOOKS.md",
+    "src/assets/SELLING_AWARENESS_STAGES.md",
+    "clipper.md",
+    "experiments.md",
+    "marketplace.md",
+    "update.md",
+    "experimental/**/*.md",
+    "!readme.secret.md",
+    "!**/*.secret.*"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -18,19 +89,104 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "scripts": {
+    "prepare": "patch-package || true",
+    "dev": "tsx --import ./src/instrument.ts watch src/index.ts",
+    "dev:frontend": "node scripts/build-homepage-client.mjs --watch",
+    "dev:cli": "tsx src/cli.ts",
+    "build:frontend": "node scripts/build-homepage-client.mjs",
+    "build:hyperframes-editor": "cd demo && node scripts/build.mjs",
+    "build:serve-shells": "tsx scripts/build-serve-shells.ts",
+    "seo:refresh": "tsx scripts/generate-route-seo.ts",
+    "portfolio:share": "tsx scripts/render-portfolio-share.ts",
+    "operator:template-artifact": "node scripts/platform-operator-template-artifact.mjs",
+    "bootstrap:staging-templates": "tsx scripts/bootstrap-staging-template-releases.ts",
+    "migrate:sqlite-to-dynamodb": "tsx scripts/migrate-sqlite-to-dynamodb.ts",
+    "deploy:prod": "bash scripts/deploy-prod.sh",
+    "deploy:staging": "bash scripts/deploy-staging.sh",
+    "build": "npm run build:frontend && npm run build:hyperframes-editor && npm run build:serve-shells && node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
+    "start": "node --import ./dist/src/instrument.js --enable-source-maps dist/src/index.js",
+    "check": "tsc -p tsconfig.json --noEmit && npm run check:skills",
+    "test:clips": "node --import tsx --test test/clip-curation.test.ts",
+    "test:social-download": "node --import tsx --test test/video-download-media.test.ts test/social-download-lookup.test.ts",
+    "test:qa": "node --import tsx --test test/qa-check.test.ts",
+    "test:studio-brand": "node --import tsx --test test/studio-brand.test.ts",
+    "test:stickers": "node --import tsx --test test/sticker-pack.test.ts test/plate-key.test.ts",
+    "test:social-recycle": "node --import tsx --test test/social-recycle.test.ts",
+    "test:dedupe": "node --import tsx --test test/dedupe-recipe.test.ts",
+    "test:iconscout": "node --import tsx --test test/iconscout.test.ts",
+    "test:web-search": "node --import tsx --test test/web-search.test.ts",
+    "test:billing": "node --import tsx --test test/billing-wallet-cas.test.ts",
+    "test:skill-docs": "node --import tsx --test test/skill-docs.test.ts",
+    "test:consult": "node --import tsx --test test/consult.test.ts",
+    "test:agent-imagegen": "node --import tsx --test test/agent-imagegen.test.ts",
+    "test:social-meta": "node --import tsx --test test/social-meta.test.ts",
+    "check:skills": "node scripts/build-director-skill-rollup.mjs --check && node scripts/check-skill-routes.mjs && node scripts/check-skill-nav.mjs",
+    "benchmark:editor-chat": "node --import tsx scripts/benchmark-editor-chat-harness.mjs",
+    "cdk:deploy:prod-serverless": "npm run build && dotenv -e .env.production -- npx aws-cdk deploy --app 'node dist/infra/cdk/bin/vidfarm-prod.js'",
+    "cdk:synth:staging-serverless": "npm run build && dotenv -e .env.staging -- npx aws-cdk synth --app 'node dist/infra/cdk/bin/vidfarm-serverless-staging.js'",
+    "cdk:deploy:staging-serverless": "npm run build && dotenv -e .env.staging -- npx aws-cdk deploy --app 'node dist/infra/cdk/bin/vidfarm-serverless-staging.js'",
+    "cdk:deploy:staging-serverless:hotswap": "npm run build && dotenv -e .env.staging -- npx aws-cdk deploy --app 'node dist/infra/cdk/bin/vidfarm-serverless-staging.js' --hotswap-fallback --require-approval never",
+    "cdk:deploy:prod-serverless:hotswap": "npm run build && dotenv -e .env.production -- npx aws-cdk deploy --app 'node dist/infra/cdk/bin/vidfarm-prod.js' --hotswap-fallback --require-approval never",
+    "prepack": "npm run build && node scripts/check-devcli-pack-safe.mjs",
+    "check:pack-safe": "node scripts/check-devcli-pack-safe.mjs",
+    "pack:devcli": "npm run build && node scripts/check-devcli-pack-safe.mjs && node scripts/build-devcli-package.mjs",
+    "pack:devcli:fast": "node scripts/check-devcli-pack-safe.mjs && node scripts/build-devcli-package.mjs",
+    "test:render-routing": "node --import tsx --test test/render-routing.test.ts",
+    "test:shared-folder": "node --import tsx --test test/shared-folder.test.ts"
+  },
   "dependencies": {
     "@ai-sdk/google": "^3.0.79",
     "@ai-sdk/openai": "^3.0.65",
     "@ai-sdk/openai-compatible": "^2.0.48",
+    "@assistant-ui/react": "^0.14.8",
+    "@assistant-ui/react-data-stream": "^0.12.14",
+    "@aws-sdk/client-cloudformation": "^3.1076.0",
+    "@aws-sdk/client-dynamodb": "^3.1056.0",
+    "@aws-sdk/client-lambda": "^3.1087.0",
+    "@aws-sdk/client-s3": "^3.1064.0",
+    "@aws-sdk/client-sfn": "^3.1073.0",
+    "@aws-sdk/lib-dynamodb": "^3.1073.0",
+    "@aws-sdk/s3-request-presigner": "^3.787.0",
     "@ffprobe-installer/ffprobe": "^2.1.2",
+    "@fontsource/libre-baskerville": "^5.2.10",
+    "@fontsource/montserrat": "^5.2.8",
+    "@fontsource/source-code-pro": "^5.2.7",
+    "@fontsource/tiktok-sans": "^5.2.4",
+    "@hono/node-server": "^1.14.4",
+    "@hyperframes/aws-lambda": "0.8.2",
+    "@hyperframes/studio-server": "0.8.2",
+    "@sentry/aws-serverless": "^10.56.0",
+    "@sentry/hono": "^10.56.0",
     "@sentry/node": "^10.56.0",
+    "@sentry/react": "^10.56.0",
     "ai": "^6.0.191",
+    "dotenv": "^16.5.0",
+    "esbuild": "^0.28.1",
     "ffmpeg-static": "^5.3.0",
+    "fontkit": "^2.0.4",
+    "hono": "^4.8.3",
     "hyperframes": "0.8.2",
     "linkedom": "^0.18.12",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
     "sharp": "^0.34.5",
     "zod": "^3.25.28"
   },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^24.0.1",
+    "@types/react": "^18.3.23",
+    "@types/react-dom": "^18.3.7",
+    "aws-cdk-lib": "^2.196.0",
+    "constructs": "^10.4.2",
+    "dotenv-cli": "^11.0.0",
+    "patch-package": "^8.0.1",
+    "react-grab": "^0.1.48",
+    "tsx": "^4.19.4",
+    "typescript": "^5.8.3",
+    "zustand": "^5.0.13"
+  },
   "main": "index.js",
   "keywords": [],
   "author": "",