videodraft 0.1.0 → 0.1.1

package/README.md

@@ -14,7 +14,7 @@ npx videodraft create "30s launch video for our espresso machine" --ar 9:16
 npm install -g videodraft     # or: npx videodraft <command>
 ```
 
-Requires Node ≥ 20.
+Requires Node ≥ 20.18.1.
 
 ## Authenticate
 

package/dist/client.js

@@ -99,10 +99,16 @@ function writeConfig(config, env = process.env) {
   }
 }
 function updateConfig(mutate, env = process.env) {
-  const config = readConfig(env);
-  mutate(config);
-  writeConfig(config, env);
-  return config;
+  return withLockSync(
+    "config",
+    () => {
+      const config = readConfig(env);
+      mutate(config);
+      writeConfig(config, env);
+      return config;
+    },
+    env
+  );
 }
 function getProfile(name, env = process.env) {
   const config = readConfig(env);
@@ -110,15 +116,64 @@ function getProfile(name, env = process.env) {
   return { name: profileName, profile: config.profiles[profileName], config };
 }
 var LOCK_STALE_MS = 3e4;
+function lockOwnerToken() {
+  return `${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+function releaseOwnedLock(lockPath, owner) {
+  try {
+    const current = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+    if (current && current.owner === owner) {
+      fs.rmSync(lockPath, { force: true });
+    }
+  } catch {
+  }
+}
+function withLockSync(lockName, fn, env = process.env) {
+  const dir = configDir(env);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const lockPath = path.join(dir, `${lockName}.lock`);
+  const owner = lockOwnerToken();
+  const deadline = Date.now() + 1e4;
+  let held = false;
+  for (; ; ) {
+    try {
+      const fd = fs.openSync(lockPath, "wx");
+      fs.writeSync(fd, JSON.stringify({ owner, pid: process.pid, at: Date.now() }));
+      fs.closeSync(fd);
+      held = true;
+      break;
+    } catch {
+      try {
+        const stat = fs.statSync(lockPath);
+        if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+          fs.rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() > deadline) break;
+      const until = Date.now() + 5;
+      while (Date.now() < until) {
+      }
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) releaseOwnedLock(lockPath, owner);
+  }
+}
 async function withLock(lockName, fn, env = process.env) {
   const dir = configDir(env);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
   const lockPath = path.join(dir, `${lockName}.lock`);
+  const owner = lockOwnerToken();
   const deadline = Date.now() + 15e3;
   for (; ; ) {
     try {
       const fd = fs.openSync(lockPath, "wx");
-      fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
+      fs.writeSync(fd, JSON.stringify({ owner, pid: process.pid, at: Date.now() }));
       fs.closeSync(fd);
       break;
     } catch {
@@ -140,7 +195,7 @@ async function withLock(lockName, fn, env = process.env) {
   try {
     return await fn();
   } finally {
-    fs.rmSync(lockPath, { force: true });
+    releaseOwnedLock(lockPath, owner);
   }
 }
 
@@ -494,10 +549,13 @@ function isExpiring(profile) {
   if (!profile.expires_at) return false;
   return new Date(profile.expires_at).getTime() - Date.now() < EXPIRY_SKEW_MS;
 }
-function saveRotatedTokens(profileName, tokens, env) {
+function saveRotatedTokens(profileName, expected, tokens, env) {
   updateConfig((config) => {
     const profile = config.profiles[profileName];
     if (!profile) return;
+    if (profile.auth_kind !== "oauth" || profile.refresh_token !== expected.refreshToken || profile.client_id !== expected.clientId) {
+      return;
+    }
     profile.access_token = tokens.access_token;
     profile.refresh_token = tokens.refresh_token;
     profile.expires_at = new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
@@ -512,14 +570,16 @@ async function refreshUnderLock(profileName, env) {
       if (profile.auth_kind !== "oauth") return profile.access_token;
       if (!isExpiring(profile)) return profile.access_token;
       if (!profile.refresh_token || !profile.client_id) return null;
+      const expected = { refreshToken: profile.refresh_token, clientId: profile.client_id };
       const tokens = await refreshAccessToken({
         baseUrl: profile.base_url || DEFAULT_BASE_URL,
-        clientId: profile.client_id,
-        refreshToken: profile.refresh_token
+        clientId: expected.clientId,
+        refreshToken: expected.refreshToken
       });
       if (!tokens) return null;
-      saveRotatedTokens(profileName, tokens, env);
-      return tokens.access_token;
+      saveRotatedTokens(profileName, expected, tokens, env);
+      const { profile: latest } = getProfile(profileName, env);
+      return latest?.access_token ?? tokens.access_token;
     },
     env
   );
@@ -764,6 +824,7 @@ async function downloadOutputs(urls, template, vars, fetchImpl = fetch) {
 // src/core/upload.ts
 import fs3 from "fs";
 import path3 from "path";
+import { Readable as Readable2 } from "stream";
 var MIME_BY_EXT = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -808,11 +869,13 @@ async function uploadFile(client, localPath, options = {}) {
   if (!uploadUrl || !filePath) {
     throw new CliError("create_media_upload did not return upload_url/file_path.");
   }
-  const body = fs3.readFileSync(resolved);
+  const { size } = fs3.statSync(resolved);
   const putRes = await fetchImpl(uploadUrl, {
     method: "PUT",
-    headers: { "content-type": contentType },
-    body,
+    headers: { "content-type": contentType, "content-length": String(size) },
+    body: Readable2.toWeb(fs3.createReadStream(resolved)),
+    // Node/undici requires duplex:"half" when the body is a stream.
+    duplex: "half",
     signal: AbortSignal.timeout(6e5)
   });
   if (!putRes.ok) {

package/dist/index.js

@@ -233,10 +233,16 @@ function writeConfig(config, env = process.env) {
   }
 }
 function updateConfig(mutate, env = process.env) {
-  const config = readConfig(env);
-  mutate(config);
-  writeConfig(config, env);
-  return config;
+  return withLockSync(
+    "config",
+    () => {
+      const config = readConfig(env);
+      mutate(config);
+      writeConfig(config, env);
+      return config;
+    },
+    env
+  );
 }
 function getProfile(name, env = process.env) {
   const config = readConfig(env);
@@ -247,21 +253,73 @@ function anonymousId(env = process.env) {
   const config = readConfig(env);
   if (config.anonymous_id) return config.anonymous_id;
   const id = crypto.randomUUID();
-  updateConfig((c) => {
-    c.anonymous_id = id;
-  }, env);
+  try {
+    updateConfig((c) => {
+      c.anonymous_id = id;
+    }, env);
+  } catch {
+  }
   return id;
 }
 var LOCK_STALE_MS = 3e4;
+function lockOwnerToken() {
+  return `${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+function releaseOwnedLock(lockPath, owner) {
+  try {
+    const current = JSON.parse(fs2.readFileSync(lockPath, "utf8"));
+    if (current && current.owner === owner) {
+      fs2.rmSync(lockPath, { force: true });
+    }
+  } catch {
+  }
+}
+function withLockSync(lockName, fn, env = process.env) {
+  const dir = configDir(env);
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  const lockPath = path.join(dir, `${lockName}.lock`);
+  const owner = lockOwnerToken();
+  const deadline = Date.now() + 1e4;
+  let held = false;
+  for (; ; ) {
+    try {
+      const fd = fs2.openSync(lockPath, "wx");
+      fs2.writeSync(fd, JSON.stringify({ owner, pid: process.pid, at: Date.now() }));
+      fs2.closeSync(fd);
+      held = true;
+      break;
+    } catch {
+      try {
+        const stat = fs2.statSync(lockPath);
+        if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+          fs2.rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() > deadline) break;
+      const until = Date.now() + 5;
+      while (Date.now() < until) {
+      }
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) releaseOwnedLock(lockPath, owner);
+  }
+}
 async function withLock(lockName, fn, env = process.env) {
   const dir = configDir(env);
   fs2.mkdirSync(dir, { recursive: true, mode: 448 });
   const lockPath = path.join(dir, `${lockName}.lock`);
+  const owner = lockOwnerToken();
   const deadline = Date.now() + 15e3;
   for (; ; ) {
     try {
       const fd = fs2.openSync(lockPath, "wx");
-      fs2.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
+      fs2.writeSync(fd, JSON.stringify({ owner, pid: process.pid, at: Date.now() }));
       fs2.closeSync(fd);
       break;
     } catch {
@@ -283,7 +341,7 @@ async function withLock(lockName, fn, env = process.env) {
   try {
     return await fn();
   } finally {
-    fs2.rmSync(lockPath, { force: true });
+    releaseOwnedLock(lockPath, owner);
   }
 }
 
@@ -310,26 +368,29 @@ function maybePrintFirstRunNotice(env = process.env) {
   );
 }
 function capture(event, properties = {}) {
-  if (!telemetryEnabled()) return;
-  const body = JSON.stringify({
-    api_key: POSTHOG_KEY,
-    event,
-    distinct_id: anonymousId(),
-    properties: {
-      cli_version: VERSION,
-      os: process.platform,
-      arch: process.arch,
-      node_major: Number(process.versions.node.split(".")[0]),
-      is_ci: Boolean(process.env.CI),
-      ...properties
-    }
-  });
-  pending = fetch(`${POSTHOG_HOST}/capture/`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body,
-    signal: AbortSignal.timeout(1500)
-  }).catch(() => void 0);
+  try {
+    if (!telemetryEnabled()) return;
+    const body = JSON.stringify({
+      api_key: POSTHOG_KEY,
+      event,
+      distinct_id: anonymousId(),
+      properties: {
+        cli_version: VERSION,
+        os: process.platform,
+        arch: process.arch,
+        node_major: Number(process.versions.node.split(".")[0]),
+        is_ci: Boolean(process.env.CI),
+        ...properties
+      }
+    });
+    pending = fetch(`${POSTHOG_HOST}/capture/`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body,
+      signal: AbortSignal.timeout(1500)
+    }).catch(() => void 0);
+  } catch {
+  }
 }
 async function shutdown() {
   if (!pending) return;
@@ -729,10 +790,13 @@ function isExpiring(profile) {
   if (!profile.expires_at) return false;
   return new Date(profile.expires_at).getTime() - Date.now() < EXPIRY_SKEW_MS;
 }
-function saveRotatedTokens(profileName, tokens, env) {
+function saveRotatedTokens(profileName, expected, tokens, env) {
   updateConfig((config) => {
     const profile = config.profiles[profileName];
     if (!profile) return;
+    if (profile.auth_kind !== "oauth" || profile.refresh_token !== expected.refreshToken || profile.client_id !== expected.clientId) {
+      return;
+    }
     profile.access_token = tokens.access_token;
     profile.refresh_token = tokens.refresh_token;
     profile.expires_at = new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
@@ -747,14 +811,16 @@ async function refreshUnderLock(profileName, env) {
       if (profile.auth_kind !== "oauth") return profile.access_token;
       if (!isExpiring(profile)) return profile.access_token;
       if (!profile.refresh_token || !profile.client_id) return null;
+      const expected = { refreshToken: profile.refresh_token, clientId: profile.client_id };
       const tokens = await refreshAccessToken({
         baseUrl: profile.base_url || DEFAULT_BASE_URL,
-        clientId: profile.client_id,
-        refreshToken: profile.refresh_token
+        clientId: expected.clientId,
+        refreshToken: expected.refreshToken
       });
       if (!tokens) return null;
-      saveRotatedTokens(profileName, tokens, env);
-      return tokens.access_token;
+      saveRotatedTokens(profileName, expected, tokens, env);
+      const { profile: latest } = getProfile(profileName, env);
+      return latest?.access_token ?? tokens.access_token;
     },
     env
   );
@@ -862,6 +928,8 @@ function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
     const child = spawn(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+    child.on("error", () => {
+    });
     child.unref();
   } catch {
   }
@@ -950,9 +1018,8 @@ ${fmt.bold(ctxOut, "Open this URL to log in:")}
   });
   program.command("logout").description("Revoke the current OAuth grant (best-effort) and clear stored credentials").action(async function() {
     const globals = this.optsWithGlobals();
-    const profileName = globals.profile ?? "default";
     const ctxOut = buildContext(this).out;
-    const { profile } = getProfile(profileName);
+    const { name: profileName, profile } = getProfile(globals.profile);
     if (!profile) {
       emit(ctxOut, { ok: true, message: "No stored credentials." }, (o) => note(o, "No stored credentials."));
       return;
@@ -1172,6 +1239,8 @@ function registerProjectCommands(program) {
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     try {
       const child = spawn2(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+      child.on("error", () => {
+      });
       child.unref();
     } catch {
     }
@@ -1401,6 +1470,7 @@ async function downloadOutputs(urls, template, vars, fetchImpl = fetch) {
 // src/core/upload.ts
 import fs4 from "fs";
 import path3 from "path";
+import { Readable as Readable2 } from "stream";
 var MIME_BY_EXT = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -1445,11 +1515,13 @@ async function uploadFile(client, localPath, options = {}) {
   if (!uploadUrl || !filePath) {
     throw new CliError("create_media_upload did not return upload_url/file_path.");
   }
-  const body = fs4.readFileSync(resolved);
+  const { size } = fs4.statSync(resolved);
   const putRes = await fetchImpl(uploadUrl, {
     method: "PUT",
-    headers: { "content-type": contentType },
-    body,
+    headers: { "content-type": contentType, "content-length": String(size) },
+    body: Readable2.toWeb(fs4.createReadStream(resolved)),
+    // Node/undici requires duplex:"half" when the body is a stream.
+    duplex: "half",
     signal: AbortSignal.timeout(6e5)
   });
   if (!putRes.ok) {
@@ -2628,6 +2700,8 @@ _videodraft
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     try {
       const child = spawn3(cmd, [DOCS_URL], { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+      child.on("error", () => {
+      });
       child.unref();
     } catch {
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "videodraft",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Official VideoDraft CLI — create AI videos, images, voiceovers and music from your terminal. Agent-friendly: --json everywhere, stable exit codes, async job polling.",
   "license": "MIT",
   "type": "module",
@@ -41,8 +41,9 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20.18.1"
   },
+  "packageManager": "pnpm@10.28.1",
   "scripts": {
     "build": "tsup",
     "build:watch": "tsup --watch",