hyperframes 0.8.119 → 0.8.121

package/dist/{projectConfig-A4DXJF4P.js → projectConfig-DBP5POAQ.js}

@@ -17,20 +17,20 @@ import {
   resolveAutoProxy,
   seedProjectAuthoringSkill,
   writeProjectConfig
-} from "./chunk-WJP3UOB3.js";
+} from "./chunk-3WXWL7AY.js";
 import "./chunk-XT7X6QCP.js";
 import "./chunk-4YYJOFKS.js";
 import "./chunk-HVW7ABXD.js";
-import "./chunk-4PTKEI2C.js";
-import "./chunk-FNX7RJIJ.js";
-import "./chunk-PPTHGZTG.js";
+import "./chunk-JACPHNUK.js";
+import "./chunk-KYDM3W7A.js";
+import "./chunk-ZBMQOBQK.js";
 import "./chunk-AWDFDFI3.js";
 import "./chunk-P6LJ4Y32.js";
 import "./chunk-GMECXFAN.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-HBBJFK6I.js";

package/dist/{publication-QY2H23JU.js → publication-SUAGUL5G.js}

@@ -8,10 +8,10 @@ import {
   publishRegistryFile,
   registryTargetPath
 } from "./chunk-GMECXFAN.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import {
   realProjectRoot

package/dist/{publish-PCT6JM4B.js → publish-CDKO6FSQ.js}

@@ -5,19 +5,23 @@ var require = __hf_createRequire(import.meta.url);
 var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
+  API_KEY_ENV_VAR,
   buildPublishFileMap,
   ensureProjectId,
   publishProjectArchive,
   readProjectLink,
   readTeamProject,
+  resolvePublishCredential,
   rewriteHtmlAttributes,
   writeTeamProject,
   zipPublishFileMap
-} from "./chunk-MVWXSRY6.js";
-import "./chunk-RZAXPDIT.js";
+} from "./chunk-JH556Q42.js";
+import "./chunk-ZTZ7NCJT.js";
+import "./chunk-SHB5VDMH.js";
+import "./chunk-I465DBM6.js";
 import {
-  tryResolveCredential
-} from "./chunk-DNXD7TOA.js";
+  formatLintStartupMessage
+} from "./chunk-6CSYCFQV.js";
 import "./chunk-X7MTZ4T2.js";
 import {
   ProxyTranscodeError,
@@ -26,13 +30,10 @@ import {
   resolveProxy,
   scanProjectMediaCodecMap,
   waitForProxy
-} from "./chunk-OWMGDQBZ.js";
-import {
-  formatLintStartupMessage
-} from "./chunk-6CSYCFQV.js";
+} from "./chunk-SJ64QY5Z.js";
 import {
   resolveAutoProxy
-} from "./chunk-WJP3UOB3.js";
+} from "./chunk-3WXWL7AY.js";
 import "./chunk-XT7X6QCP.js";
 import "./chunk-4YYJOFKS.js";
 import "./chunk-HVW7ABXD.js";
@@ -42,9 +43,9 @@ import {
   q,
   ue
 } from "./chunk-WMQNIQDJ.js";
-import "./chunk-4PTKEI2C.js";
-import "./chunk-FNX7RJIJ.js";
-import "./chunk-PPTHGZTG.js";
+import "./chunk-JACPHNUK.js";
+import "./chunk-KYDM3W7A.js";
+import "./chunk-ZBMQOBQK.js";
 import "./chunk-AWDFDFI3.js";
 import "./chunk-P6LJ4Y32.js";
 import "./chunk-GMECXFAN.js";
@@ -58,10 +59,10 @@ import {
   failCommand,
   setCommandExitCode
 } from "./chunk-PBN6GBJE.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import {
@@ -299,12 +300,25 @@ var publish_default = defineCommand({
     }
     const updateTarget = typeof args.update === "string" && args.update.trim() ? parseUpdateTarget(args.update) : void 0;
     const spaceOverride = typeof args.space === "string" && args.space.trim() ? args.space.trim() : void 0;
+    let credential;
+    try {
+      credential = await resolvePublishCredential();
+    } catch (err) {
+      console.error();
+      console.error(`  ${err.message}`);
+      console.error();
+      setCommandExitCode(1);
+      return;
+    }
     if (updateTarget || spaceOverride) {
-      const credential = await tryResolveCredential();
-      if (!credential) {
+      if (credential?.type !== "oauth") {
+        const flag = updateTarget ? "--update" : "--space";
+        const envKey = credential?.source === "env" || credential?.source === "env_alias" ? API_KEY_ENV_VAR[credential.source] : void 0;
         console.log();
         console.log(
-          `  ${c.error(`${updateTarget ? "--update" : "--space"} requires authentication. Run 'hyperframes auth login' first.`)}`
+          `  ${c.error(
+            !credential ? `${flag} requires authentication. Run 'hyperframes auth login' first.` : envKey ? `${flag} requires a login; ${envKey} cannot own a project. Unset it and run 'hyperframes auth login'.` : `${flag} requires a login; an API key cannot own a project. Run 'hyperframes auth login'.`
+          )}`
         );
         console.log();
         setCommandExitCode(1);
@@ -336,7 +350,8 @@ var publish_default = defineCommand({
         public: args.public === true,
         projectId: requestedProjectId,
         spaceId,
-        archive
+        archive,
+        credential
       });
       publishSpinner.stop(c.success("Project published"));
       console.log();
@@ -389,21 +404,12 @@ var publish_default = defineCommand({
         console.log(`  ${c.dim("Claim URL")}  ${c.accent(claimUrl.toString())}`);
         console.log(`  ${c.dim("Access")}     ${c.accent("Sign in required to claim")}`);
         console.log();
-        if (updateTarget || spaceOverride) {
-          console.log(
-            `  ${c.error(`Your login looks expired or invalid, so ${updateTarget ? "--update" : "--space"} was ignored and a NEW url was created above.`)}`
-          );
-          console.log(
-            `  ${c.dim("Run 'hyperframes auth login' again, then re-publish to update in place.")}`
-          );
-        } else {
-          console.log(
-            `  ${c.dim("Open the claim URL on hyperframes.dev, sign in, and claim the project to continue editing.")}`
-          );
-          console.log();
-          const visibilityTip = args.public === true ? "--public applies to the claimed project; this claim URL still requires sign-in." : "Run 'hyperframes auth login' first for a stable link you can re-publish to; add --public to allow signed-out viewing.";
-          console.log(`  ${c.dim(`Tip: ${visibilityTip}`)}`);
-        }
+        console.log(
+          `  ${c.dim("Open the claim URL on hyperframes.dev, sign in, and claim the project to continue editing.")}`
+        );
+        console.log();
+        const visibilityTip = args.public === true ? "--public applies to the claimed project; this claim URL still requires sign-in." : "Run 'hyperframes auth login' first for a stable link you can re-publish to; add --public to allow signed-out viewing.";
+        console.log(`  ${c.dim(`Tip: ${visibilityTip}`)}`);
         console.log();
       }
       return;

package/dist/{refresh-IK6LUV5Z.js → refresh-K24ETHMA.js}

@@ -4,13 +4,13 @@ import { dirname as __hf_dirname } from "node:path";
 var require = __hf_createRequire(import.meta.url);
 var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
-import "./chunk-RZAXPDIT.js";
+import "./chunk-ZTZ7NCJT.js";
 import {
   assertOAuthConfiguredOrExit,
   isAuthError,
   readStore,
   refreshTokens
-} from "./chunk-DNXD7TOA.js";
+} from "./chunk-I465DBM6.js";
 import {
   c
 } from "./chunk-ZTZA4UWZ.js";

package/dist/{remove-background-O2J7EVEN.js → remove-background-QFMDODZ4.js}

@@ -8,7 +8,7 @@ import {
   DEFAULT_QUALITY,
   QUALITIES,
   isQuality
-} from "./chunk-KWABBJYI.js";
+} from "./chunk-2XV3S6TA.js";
 import {
   DEVICES,
   isDevice
@@ -28,12 +28,12 @@ import {
 import {
   failCommand
 } from "./chunk-PBN6GBJE.js";
-import "./chunk-IUBZ3DSO.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-MNMD6XLG.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-5IABQ7OX.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-GPGWCFIA.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-LCSMOLGX.js";
@@ -159,7 +159,7 @@ var remove_background_default = defineCommand({
     const outputPath = resolve(args.output);
     const backgroundOutputArg = args["background-output"];
     const backgroundOutputPath = backgroundOutputArg ? resolve(backgroundOutputArg) : void 0;
-    const { render } = await import("./pipeline-HYULUMEV.js");
+    const { render } = await import("./pipeline-WRNKPJZH.js");
     const spin = args.json ? null : ft();
     spin?.start("Preparing background-removal pipeline...");
     try {

package/dist/{render-6QXPYNLY.js → render-BYD7ZASF.js}

@@ -6,15 +6,21 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   maybePromptRenderFeedback
-} from "./chunk-KNXXZ73S.js";
+} from "./chunk-RYSHGEZL.js";
 import {
   reportVariableIssues,
   resolveVariablesArg,
   validateVariablesAgainstProject
-} from "./chunk-LHU6KXWL.js";
+} from "./chunk-WW7V2GQJ.js";
 import {
   loadProducer
-} from "./chunk-2MMAA5I3.js";
+} from "./chunk-XLG5C3XA.js";
+import {
+  formatLintStartupMessage
+} from "./chunk-6CSYCFQV.js";
+import {
+  resolveProject
+} from "./chunk-WBRDOH4A.js";
 import {
   renderJobObservabilityTelemetryPayload
 } from "./chunk-VXVRPIJA.js";
@@ -28,14 +34,8 @@ import {
   resolveBrowserTimeoutMsArg,
   resolveCompositionEntryArg,
   resolveDefaultFpsArg
-} from "./chunk-OLFFCC2D.js";
+} from "./chunk-5OS5XIWZ.js";
 import "./chunk-YEIFI443.js";
-import {
-  resolveProject
-} from "./chunk-6Q3Q7HGA.js";
-import {
-  formatLintStartupMessage
-} from "./chunk-6CSYCFQV.js";
 import {
   errorBox,
   formatBytes,
@@ -46,21 +46,24 @@ import {
 } from "./chunk-IHFUKJOR.js";
 import {
   runEnvironmentChecks
-} from "./chunk-OV62R47Q.js";
+} from "./chunk-VU4KRDRL.js";
 import "./chunk-PFCFR3KZ.js";
+import {
+  createRenderCancellationScope
+} from "./chunk-LZN67SFR.js";
 import {
   loadProjectConfig,
   readProjectConfigWithStatus,
   seedProjectAuthoringSkill
-} from "./chunk-WJP3UOB3.js";
+} from "./chunk-3WXWL7AY.js";
 import "./chunk-XT7X6QCP.js";
 import "./chunk-4YYJOFKS.js";
 import {
   normalizeSkillSlug
 } from "./chunk-HVW7ABXD.js";
-import "./chunk-4PTKEI2C.js";
-import "./chunk-FNX7RJIJ.js";
-import "./chunk-PPTHGZTG.js";
+import "./chunk-JACPHNUK.js";
+import "./chunk-KYDM3W7A.js";
+import "./chunk-ZBMQOBQK.js";
 import "./chunk-AWDFDFI3.js";
 import "./chunk-P6LJ4Y32.js";
 import "./chunk-GMECXFAN.js";
@@ -72,23 +75,20 @@ import {
   findFFprobe,
   getFFmpegInstallHint
 } from "./chunk-TVCRUG2S.js";
-import {
-  createRenderCancellationScope
-} from "./chunk-U3CILSBM.js";
 import {
   trackRenderComplete,
   trackRenderError,
   trackRenderObservation,
   trackRenderPreflightRejected
-} from "./chunk-CDTPNYO3.js";
-import "./chunk-M6LKSPER.js";
+} from "./chunk-NPHNGWJH.js";
+import "./chunk-6WIWCYD5.js";
 import "./chunk-VWG7OQKU.js";
 import {
   c
 } from "./chunk-ZTZA4UWZ.js";
 import {
   bytesToMb
-} from "./chunk-U7AMFQ6G.js";
+} from "./chunk-BN5KOC5O.js";
 import "./chunk-AMKC3AXA.js";
 import {
   markRenderSucceeded,
@@ -110,13 +110,13 @@ import {
   MAX_VP9_CPU_USED,
   MIN_VP9_CPU_USED,
   isVideoFrameFormat
-} from "./chunk-IUBZ3DSO.js";
+} from "./chunk-MNMD6XLG.js";
 import {
   formatRenderOutputTimestamp,
   fpsToFfmpegArg,
   fpsToNumber,
   parseFps
-} from "./chunk-2WKWEB4T.js";
+} from "./chunk-RCNDZEBU.js";
 import {
   checkOutputResolutionCompatibility,
   isAspectAgnosticResolutionAlias,
@@ -124,8 +124,8 @@ import {
   suggestMatchingPreset
 } from "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-5IABQ7OX.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-GPGWCFIA.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import {
@@ -162,7 +162,7 @@ import {
 } from "./chunk-ISN5GRYI.js";
 import {
   VERSION
-} from "./chunk-3NXDJSD5.js";
+} from "./chunk-WG4IZWEH.js";
 import {
   normalizeErrorMessage
 } from "./chunk-KNU5COPB.js";
@@ -660,7 +660,7 @@ async function executeRenderPlan(plan, dependencies, cancellation) {
   let batchModule;
   let preparedBatch;
   if (plan.batchPath) {
-    batchModule = await import("./batchRender-BBBUJETN.js");
+    batchModule = await import("./batchRender-2HXYPO62.js");
     try {
       preparedBatch = batchModule.prepareBatchRender({
         batchPath: plan.batchPath,

package/dist/{render-QUQJP5PP.js → render-NRNF56OV.js}

@@ -15,7 +15,7 @@ import {
   reportVariableIssues,
   resolveVariablesArg,
   validateVariablesAgainstProject
-} from "./chunk-LHU6KXWL.js";
+} from "./chunk-WW7V2GQJ.js";
 import "./chunk-5Z63TBTX.js";
 import "./chunk-IHFUKJOR.js";
 import "./chunk-PFCFR3KZ.js";
@@ -25,10 +25,10 @@ import {
 import {
   setCommandExitCode
 } from "./chunk-PBN6GBJE.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-TQFG7HTI.js";

package/dist/{render-HYA6UBZD.js → render-XTI7E22A.js}

@@ -20,38 +20,39 @@ import {
   createCloudClient,
   pollUntilTerminal,
   reportApiError
-} from "./chunk-RLYTIMTS.js";
+} from "./chunk-Y6W4DVPS.js";
 import {
   downloadToFile
 } from "./chunk-BXCMXMJQ.js";
+import {
+  buildPublishFileMap,
+  zipPublishFileMap
+} from "./chunk-JH556Q42.js";
+import "./chunk-ZTZ7NCJT.js";
+import "./chunk-SHB5VDMH.js";
+import "./chunk-I465DBM6.js";
 import {
   reportVariableIssues,
   resolveVariablesArg,
   validateVariablesAgainstProject
-} from "./chunk-LHU6KXWL.js";
-import {
-  buildPublishFileMap,
-  zipPublishFileMap
-} from "./chunk-MVWXSRY6.js";
-import "./chunk-RZAXPDIT.js";
-import "./chunk-DNXD7TOA.js";
-import "./chunk-EOVYQ3IG.js";
+} from "./chunk-WW7V2GQJ.js";
 import {
   resolveProject
-} from "./chunk-6Q3Q7HGA.js";
+} from "./chunk-WBRDOH4A.js";
 import {
   errorBox,
   formatBytes,
   formatDuration
 } from "./chunk-IHFUKJOR.js";
+import "./chunk-EOVYQ3IG.js";
 import "./chunk-PFCFR3KZ.js";
-import "./chunk-CDTPNYO3.js";
-import "./chunk-M6LKSPER.js";
+import "./chunk-NPHNGWJH.js";
+import "./chunk-6WIWCYD5.js";
 import "./chunk-VWG7OQKU.js";
 import {
   c
 } from "./chunk-ZTZA4UWZ.js";
-import "./chunk-U7AMFQ6G.js";
+import "./chunk-BN5KOC5O.js";
 import "./chunk-AMKC3AXA.js";
 import {
   defineCommand
@@ -60,12 +61,12 @@ import "./chunk-54HJ63Q2.js";
 import {
   failCommand
 } from "./chunk-PBN6GBJE.js";
-import "./chunk-IUBZ3DSO.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-MNMD6XLG.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-5IABQ7OX.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-GPGWCFIA.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-TWWSYAKJ.js";
@@ -77,12 +78,12 @@ import "./chunk-GK4AIFIH.js";
 import "./chunk-2PSPARWP.js";
 import {
   withMeta
-} from "./chunk-FRIRP3DN.js";
+} from "./chunk-7VXU7E5S.js";
 import "./chunk-K4WIOZFP.js";
 import "./chunk-XUXGIA7H.js";
 import "./chunk-WERLJGIC.js";
 import "./chunk-ISN5GRYI.js";
-import "./chunk-3NXDJSD5.js";
+import "./chunk-WG4IZWEH.js";
 import {
   normalizeErrorMessage
 } from "./chunk-KNU5COPB.js";

package/dist/{render-batch-OS4UEZA4.js → render-batch-L2AIXYA3.js}

@@ -14,7 +14,7 @@ import {
   loadProjectVariableSchema,
   reportVariableIssues,
   validateVariablesAgainstSchema
-} from "./chunk-LHU6KXWL.js";
+} from "./chunk-WW7V2GQJ.js";
 import "./chunk-5Z63TBTX.js";
 import {
   errorBox
@@ -27,10 +27,10 @@ import {
   failCommand,
   setCommandExitCode
 } from "./chunk-PBN6GBJE.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-TQFG7HTI.js";

package/dist/{renderCancellation-RWWLGOOD.js → renderCancellation-XR3W2AQT.js}

@@ -7,13 +7,13 @@ var __dirname = __hf_dirname(__filename);
 import {
   createRenderCancellationScope,
   stoppedByCancelSignal
-} from "./chunk-U3CILSBM.js";
-import "./chunk-IUBZ3DSO.js";
-import "./chunk-2WKWEB4T.js";
+} from "./chunk-LZN67SFR.js";
+import "./chunk-MNMD6XLG.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-5IABQ7OX.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-GPGWCFIA.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-LAOCA3MQ.js";

package/dist/{resolver-IM46W362.js → resolver-RYPIAEGU.js}

@@ -11,15 +11,15 @@ import {
   resolveItemWithDependencies,
   resolveItemsByTag,
   unreachableRegistryMessage
-} from "./chunk-4PTKEI2C.js";
-import "./chunk-PPTHGZTG.js";
+} from "./chunk-JACPHNUK.js";
+import "./chunk-ZBMQOBQK.js";
 import "./chunk-AWDFDFI3.js";
 import "./chunk-P6LJ4Y32.js";
 import "./chunk-GMECXFAN.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-TQFG7HTI.js";

package/dist/{sherpa-COBFACPG.js → sherpa-MXQ34FFS.js}

@@ -11,20 +11,20 @@ import "./chunk-EOVYQ3IG.js";
 import {
   getPreparedWavDurationSeconds,
   prepareWav
-} from "./chunk-KFKEMNSW.js";
+} from "./chunk-AA4KEZGW.js";
+import {
+  stoppedByCancelSignal
+} from "./chunk-LZN67SFR.js";
 import "./chunk-OAF4XJOW.js";
 import "./chunk-X5HWXQPU.js";
 import "./chunk-TVCRUG2S.js";
-import {
-  stoppedByCancelSignal
-} from "./chunk-U3CILSBM.js";
 import "./chunk-AMKC3AXA.js";
-import "./chunk-IUBZ3DSO.js";
-import "./chunk-2WKWEB4T.js";
+import "./chunk-MNMD6XLG.js";
+import "./chunk-RCNDZEBU.js";
 import "./chunk-FSLYPQ5Z.js";
 import "./chunk-DPVXBVLL.js";
-import "./chunk-5IABQ7OX.js";
-import "./chunk-SHLFJFPM.js";
+import "./chunk-GPGWCFIA.js";
+import "./chunk-PATLRNZA.js";
 import "./chunk-VC76R6W2.js";
 import "./chunk-OFQWTKPW.js";
 import "./chunk-LAOCA3MQ.js";

package/dist/skills/media-use/audio/scripts/lib/heygen.mjs

@@ -5,7 +5,7 @@ import { fetchMedia } from "../../../scripts/lib/media-fetch.mjs";
 // credentials (oauth → Bearer, else api_key → X-Api-Key; $HEYGEN_CONFIG_DIR
 // overrides the dir). Vendored so the skill ships standalone. Pure node.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 
@@ -17,13 +17,24 @@ export const HEYGEN_CLI_SOURCE_HEADERS = { "X-HeyGen-Source": "cli" };
 // OAuth-only cli-source header above, which also gates the free allowance.
 export const HEYGEN_CLIENT_SOURCE_HEADERS = { "X-HeyGen-Client-Source": "media-use" };
 
+// A missing `.env`, or a `.env` folder (some home dirs have one), is no env file: null. Read without checking first,
+// so the file cannot change between a check and the read.
+function envFileText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR", "EISDIR"].includes(error.code)) return null;
+    throw error;
+  }
+}
+
 // Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).
 export function loadEnvFromDir(startDir) {
   let dir = resolve(startDir);
   for (let i = 0; i < 5; i++) {
-    const envPath = join(dir, ".env");
-    if (existsSync(envPath)) {
-      for (const raw of readFileSync(envPath, "utf8").split("\n")) {
+    const text = envFileText(join(dir, ".env"));
+    if (text != null) {
+      for (const raw of text.split("\n")) {
         let line = raw.trim();
         if (!line || line.startsWith("#")) continue;
         if (line.startsWith("export ")) line = line.slice(7).trim();
@@ -52,8 +63,14 @@ export function heygenCredential() {
   if (envKey) return { headers: { "X-Api-Key": envKey } };
 
   const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), ".heygen"), "credentials");
-  if (!existsSync(file)) return null;
-  const raw = readFileSync(file, "utf8").trim();
+  // Callers only probe for a credential, so any path that cannot be read (missing, a folder, a locked ~/.heygen)
+  // is none. Read without checking first, so the file cannot change between a check and the read.
+  let raw;
+  try {
+    raw = readFileSync(file, "utf8").trim();
+  } catch {
+    return null;
+  }
   if (!raw) return null;
   if (!raw.startsWith("{")) return { headers: { "X-Api-Key": raw } };