vrex-flow-engine 0.2.2__tar.gz → 0.2.4__tar.gz

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vrex-flow-engine
-Version: 0.2.2
+Version: 0.2.4
 Summary: Launcher + supervisor and OpenAI-compatible image/video generation service (Vrex Flow Engine).
 Author: Vrex
 License: Proprietary

vrex_flow_engine-0.2.4/README.md

@@ -0,0 +1,268 @@
+# flow-engine
+
+Host a **Google Flow browser-extension instance** and expose **OpenAI-compatible
+image/video generation endpoints** backed by Google Flow (labs.google).
+
+flow-engine drives a Chrome extension that borrows your authenticated Flow
+session (token + cookies + reCAPTCHA solving) and proxies Flow's private
+`aisandbox-pa.googleapis.com` calls, mapping the results onto familiar OpenAI
+request/response shapes. PyPI package `vrex-flow-engine`, import module
+`flow_engine`, console commands `vrex-flow-engine` / `flow-engine` (subcommands:
+`start`, `serve`, `setup`, `doctor`).
+
+```
+OpenAI client ──HTTP :8101──> flow-engine ──WS :9223──> Chrome extension ──fetch──> Google Flow
+                               (this repo)               (extension/, in your browser)
+```
+
+In production the HTTP surface is published at `https://flow.getvrex.com`
+(a `cloudflared` tunnel → `127.0.0.1:8101`); the Next.js app reaches it via
+`FLOW_ENGINE_URL`. See "Expose to production" below.
+
+## Endpoints
+
+- `POST /v1/images/generations` — synchronous image (Nano Banana 2).
+- `POST /v1/videos/generations` + `GET /v1/videos/{id}` — async video job + poll (Veo 3.1 lite).
+- `GET /v1/videos/{id}/debug` — raw `{dispatch, last_poll}` Google payloads for a job (troubleshooting).
+- `POST /v1/flow/uploads` — image **or video** bytes → Flow media id (routes by mime).
+- `GET /v1/models` — model catalog (cached on disk, refresh with `?refresh=1`).
+- `GET /media/{id}` — cached generated bytes at a stable URL.
+- `GET /api/health` — liveness + extension-connected status (ungated).
+
+`/v1/*` and `/api/pool/status` require `Authorization: Bearer <FLOW_ENGINE_API_KEY>`.
+`/api/health` and `/media/{id}` are ungated.
+
+## Requirements
+
+- Python 3.10+
+- Google Chrome signed in to **labs.google** with a Flow tab open, and the
+  extension in `extension/` loaded (chrome://extensions → Load unpacked).
+- A Flow account (Pro or Ultra — the paygate tier is read from your session).
+- `cloudflared` (only for exposing to production).
+
+> The extension's `background.js` hardcodes `ws://127.0.0.1:9223` and
+> `http://127.0.0.1:8101/api/ext/callback`, so flow-engine defaults to those
+> ports. It therefore **cannot run alongside the legacy flowboard agent on
+> defaults** — change both the env vars and the extension URLs to run both.
+
+## Quickstart — one command
+
+`flow-engine start` is a supervisor: it stores your secrets, launches the engine
+**and** the Cloudflare tunnel as child processes, restarts either on crash, and
+renders a live status dashboard. The package is published to PyPI as
+**`vrex-flow-engine`**. Run it with [uv](https://docs.astral.sh/uv/) (the Python
+equivalent of `npx` — no manual venv):
+
+```bash
+uvx vrex-flow-engine start
+```
+
+`uvx` ships with `uv`. If you get `uvx: command not found`, install uv first
+(then re-run the line above):
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh   # then: exec $SHELL   (adds ~/.local/bin to PATH)
+# or on macOS: brew install uv
+```
+
+No uv? It's a normal PyPI package — `pipx run vrex-flow-engine start`, or
+`pip install --user vrex-flow-engine && flow-engine start`.
+
+First run prompts for the **engine API key** (must match the value the Next.js
+app sends — `FLOW_ENGINE_API_KEY` on Vrex Multimodal / `.env.prd`) and the
+**Cloudflare tunnel token** (dashboard → Zero Trust → Networks → Tunnels → your
+tunnel → "run a connector"). Both are saved to `~/.vrex-flow/config.json` (0600)
+so later runs need no input. Then it brings up the engine + tunnel and shows:
+
+```
+🎬 Vrex Flow Engine   ● running   uptime 3m02s
+┌ engine ──────────────┐ ┌ tunnel ───────────────┐
+│ status     ● UP       │ │ status  ● connected    │
+│ extension  ● connected│ │ public  flow.getvrex.com│
+│ instances  1          │ │ →       127.0.0.1:8101  │
+└──────────────────────┘ └───────────────────────┘
+```
+
+The one thing the CLI can't automate: open a `labs.google/fx/tools/flow` tab in
+Chrome with the `extension/` loaded and signed into a Flow Pro/Ultra account.
+Until you do, the dashboard shows `extension ● OPEN A FLOW TAB`. Ctrl-C stops
+both processes cleanly.
+
+### CLI commands
+
+| Command | What it does |
+|---|---|
+| `flow-engine start` | Supervise engine + tunnel + live dashboard (the one-liner). `--no-tunnel` runs the engine only; `--tunnel-config <path>` runs a named tunnel from a cloudflared config.yml instead of a token; `--non-interactive` fails instead of prompting. |
+| `flow-engine setup` | (Re)store the engine key + tunnel token in `~/.vrex-flow/config.json`. |
+| `flow-engine doctor` | Check prerequisites (python, cloudflared, config) and probe a running engine. |
+| `flow-engine serve` | Run just the engine in the foreground (for systemd / your own supervisor). |
+
+Secrets can also come from env (`FLOW_ENGINE_API_KEY`, `CLOUDFLARE_TUNNEL_TOKEN`)
+or flags (`--engine-key`, `--tunnel-token`) — flags > env > stored config.
+
+## Run manually (without the CLI)
+
+The engine reads config from the environment directly — **no `.env` auto-load**.
+`FLOW_ENGINE_API_KEY` is **required**; the server refuses to boot without it.
+
+```bash
+cd flow-engine
+python -m venv .venv && source .venv/bin/activate
+pip install -e .
+export FLOW_ENGINE_API_KEY=<shared-secret>     # must match the caller's key
+flow-engine serve                              # serves :8101 (HTTP) + :9223 (WS)
+# equivalent: python -m flow_engine.main
+```
+
+Load `extension/` in Chrome, open a `labs.google/fx/tools/flow` tab, then check:
+
+```bash
+curl localhost:8101/api/health
+# {"ok":true,"extension_connected":true,"instances":1}
+```
+
+`extension_connected:false` means no Flow tab/extension is bridged yet — open
+the tab and reload the extension.
+
+## Expose to production (Cloudflare Tunnel)
+
+The public origin `https://flow.getvrex.com` is a `cloudflared` tunnel to the
+local `:8101`. **`flow-engine start` runs this tunnel for you** (via the stored
+token), so normally you don't touch `cloudflared` directly. To run it standalone
+— e.g. the `serve` path — start the tunnel as a separate process on the same
+machine:
+
+```bash
+cloudflared tunnel run --token <your-tunnel-token>   # flow.getvrex.com → 127.0.0.1:8101
+# or, with a named-tunnel config file:
+cloudflared tunnel run --config cloudflared.yml
+```
+
+If `https://flow.getvrex.com` returns **HTTP 530 / `error code: 1033`**, the
+tunnel is down (Cloudflare has no active connection to the origin) — restart it
+(or `flow-engine start`). A `502`/`1016` instead means the tunnel is up but the
+engine on `:8101` is not — restart the engine.
+
+## Examples
+
+Image (`model` must be `NANO_BANANA_2`, or omit to force it):
+
+```bash
+curl localhost:8101/v1/images/generations \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY" \
+  -H 'content-type: application/json' -d '{
+  "prompt": "a studio portrait, soft light", "n": 2,
+  "size": "1024x1024", "model": "NANO_BANANA_2"
+}'
+# {"created":..., "data":[{"url":"http://127.0.0.1:8101/media/<uuid>"}, ...]}
+```
+
+Video (`model` must be `veo_3_1_lite_low_priority`). Text-to-video:
+
+```bash
+JOB=$(curl -s localhost:8101/v1/videos/generations \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY" \
+  -H 'content-type: application/json' -d '{
+    "prompt": "slow dolly in over a city at dusk",
+    "model": "veo_3_1_lite_low_priority", "seconds": 8, "size": "1280x720"
+  }' | jq -r .id)
+curl -s localhost:8101/v1/videos/$JOB \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY"   # poll until status == "completed"
+```
+
+Image-to-video — pass the start frame inline; flow-engine uploads it for you:
+
+```bash
+curl localhost:8101/v1/videos/generations \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY" \
+  -H 'content-type: application/json' -d "{
+    \"prompt\": \"the subject turns to camera\", \"model\": \"veo_3_1_lite_low_priority\",
+    \"start_images\": [\"$(base64 < frame.png)\"], \"size\": \"1280x720\"
+  }"
+```
+
+`start_images` / `ref_images` accept a data URL, an `http(s)` URL, or bare
+base64. Already have a Flow media id (e.g. from `/v1/flow/uploads`)? Pass it in
+`start_media_ids` / `ref_media_ids` instead — the two forms merge. Uploading a
+reference **video** (for v2v/edit/extend) works the same way via
+`/v1/flow/uploads -F file=@clip.mp4`, which returns a `"kind":"video"` media id.
+
+Extend or edit a clip you already generated — pass back the `media_id` you got
+and flow-engine resolves the rest (scene / workflow / frame count) from what it
+remembered this run:
+
+```bash
+# extend (continue a Veo clip — only Veo-generated videos can be extended)
+curl localhost:8101/v1/videos/generations \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY" \
+  -H 'content-type: application/json' -d '{
+  "prompt": "a dog joins in", "mode": "extend",
+  "model": "veo_3_1_lite_low_priority", "source_media_id": "<prev media_id>"
+}'
+
+# edit (video-to-video rewrite)
+curl localhost:8101/v1/videos/generations \
+  -H "authorization: Bearer $FLOW_ENGINE_API_KEY" \
+  -H 'content-type: application/json' -d '{
+  "prompt": "add a green ball", "mode": "edit",
+  "model": "veo_3_1_lite_low_priority", "source_media_id": "<prev media_id>",
+  "source_seconds": 8
+}'
+```
+
+For a source flow-engine didn't generate this run (e.g. after a restart), pass
+`workflow_id` explicitly (extend resolves the scene from it; edit uses it
+directly) — plus `source_seconds` for edit so the frame range matches. The
+generation-context registry is in-memory, so it resets when the server restarts.
+
+## Configuration
+
+These configure the **engine** process (read from its environment). The
+`flow-engine start` launcher injects `FLOW_ENGINE_API_KEY` + ports for you from
+`~/.vrex-flow/config.json`; set these directly only for the manual `serve` path.
+All optional except the API key. Port/host/storage vars keep the `FLOWPROXY_`
+prefix for extension compatibility; the API key and pool size use the
+`FLOW_ENGINE_` / `FLOW_POOL_` names.
+
+| Env var | Default | Purpose |
+|---|---|---|
+| `FLOW_ENGINE_API_KEY` | — (**required**) | Bearer key gating `/v1/*`. Legacy `FLOWPROXY_API_KEY` still accepted. |
+| `FLOWPROXY_HTTP_PORT` | `8101` | HTTP surface (OpenAI endpoints + `/media` + callback). |
+| `FLOWPROXY_WS_HOST` | `127.0.0.1` | Extension WS bind — **must be loopback** (unauthenticated by design). |
+| `FLOWPROXY_EXT_WS_PORT` | `9223` | Extension WebSocket port. |
+| `FLOWPROXY_PUBLIC_BASE_URL` | `http://127.0.0.1:8101` | Base used to build absolute `/media` URLs returned to clients. |
+| `FLOW_POOL_CONCURRENCY` | `4` | Max concurrent in-flight Flow calls per instance (back-pressure, no 503). |
+| `FLOWPROXY_STORAGE` | `./storage` | Local byte cache dir. |
+| `FLOWPROXY_CATALOG_TTL` | `86400` | Model-catalog cache TTL (seconds). |
+| `VIDEO_POLL_MAX_CYCLES` / `VIDEO_POLL_INTERVAL_S` | `72` / `10` | Video poll budget (default 12 min). |
+
+## Layout
+
+```
+extension/            Chrome MV3 bridge (open a labs.google/fx/tools/flow tab)
+flow_engine/
+  bridge/             WS server + flow_client + flow_sdk (Flow API port)
+  media.py            DB-free media cache (registry + on-disk bytes)
+  jobs.py             in-memory job store + async video poller
+  session.py          readiness gate + default project + pool seam
+  catalog.py          model catalog (flow.projectInitialData), disk-cached
+  openai/             /v1/images, /v1/videos, /v1/flow/uploads, /v1/models
+  main.py             FastAPI app, /api/ext/callback, /media/{id}, lifespan
+  cli/                launcher: app (argparse), supervisor, dashboard,
+                      processes, health, config (~/.vrex-flow)
+```
+
+## Notes & caveats
+
+- **Single account.** One extension instance = one Google account = one tier.
+  Multi-tenant needs a browser-instance pool routed by API key — the
+  `session.get_bridge(api_key)` indirection is where that goes.
+- **Live Flow tab required.** Every dispatch solves an enterprise reCAPTCHA in
+  an open Flow tab; hosting needs a headful/virtual-display Chrome kept warm.
+- **Signed URLs expire.** flow-engine caches bytes locally and serves stable
+  `/media/{id}` URLs; workflow-mode video arrives as inline base64 MP4.
+- **Localhost WS is unauthenticated** by design — never bind it to a network
+  interface. Gate the HTTP `/v1/*` surface with `FLOW_ENGINE_API_KEY` when exposed.
+- **No `.env` auto-load.** The process reads `os.environ` directly — export vars
+  in the shell (or a wrapper/launchd unit), don't rely on a `.env` file.
+```

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/__init__.py

@@ -1,4 +1,4 @@
 """flow_engine — host a Flowboard browser-extension instance and expose
 OpenAI-compatible image/video generation endpoints over Google Flow."""
 
-__version__ = "0.0.1"
+__version__ = "0.2.4"

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/bridge/flow_client.py

@@ -397,6 +397,21 @@ class FlowClient:
             timeout=timeout,
         )
 
+    async def media_url_request(
+        self,
+        url: str,
+        timeout: Optional[float] = 60.0,
+    ) -> dict:
+        """Resolve a TRPC media-redirect URL to its final location.
+
+        ``media.getMediaUrlRedirect`` answers with a 302 to the actual asset,
+        which only the browser session can follow (cookie auth). The extension
+        follows it and reports back where it landed WITHOUT reading the body,
+        so a multi-megabyte clip never crosses the WebSocket — the engine then
+        downloads it server-side.
+        """
+        return await self._send("media_url_request", {"url": url}, timeout=timeout)
+
     async def upload_video(
         self,
         project_id: str,

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/bridge/flow_sdk.py

@@ -42,6 +42,15 @@ VIDEO_T2V_URL = f"{FLOW_API_BASE}/v1/video:batchAsyncGenerateVideoText"
 # capture (2026-05). NOTE: only Veo-generated videos can be extended.
 VIDEO_EXTEND_URL = f"{FLOW_API_BASE}/v1/video:batchAsyncGenerateVideoExtendVideo"
 VIDEO_EDIT_URL = f"{FLOW_API_BASE}/v1/video:batchAsyncGenerateVideoEditVideo"
+# Interpolation ("Frames to Video"): takes BOTH a startImage and an endImage and
+# generates the motion between them. Passing the same media id as both frames is
+# how you get a clip that ends where it began, i.e. one that loops seamlessly.
+# Verified from a live labs.google capture (2026-08): Flow web dispatches
+# `veo_3_1_interpolation_lite_low_priority` to this endpoint with each frame as
+# `{mediaId, cropCoordinates}`. See gen_video_interpolation() for the body.
+VIDEO_INTERPOLATION_URL = (
+    f"{FLOW_API_BASE}/v1/video:batchAsyncGenerateVideoStartAndEndImage"
+)
 VIDEO_POLL_URL = f"{FLOW_API_BASE}/v1/video:batchCheckAsyncVideoGenerationStatus"
 UPLOAD_IMAGE_URL = f"{FLOW_API_BASE}/v1/flow/uploadImage"
 # Video upload is a resumable, cookie-authed flow against labs.google (NOT
@@ -53,6 +62,12 @@ UPLOAD_IMAGE_URL = f"{FLOW_API_BASE}/v1/flow/uploadImage"
 UPLOAD_VIDEO_START_URL = "https://labs.google/fx/api/upload-video?action=start"
 UPLOAD_VIDEO_UPLOAD_URL = "https://labs.google/fx/api/upload-video?action=upload"
 TRPC_UPDATE_VIDEO_OFFSET = "https://labs.google/fx/api/trpc/videoFx.updateVideoOffset"
+# Resolves a media id to the asset itself via a 302. This is how the web client
+# loads a finished clip: `batchCheckAsync` reports SUCCESSFUL but carries no
+# fifeUrl for workflow-schema (Low Priority) video, and the old
+# `GET /v1/media/<id>` byte probe now returns 400 INVALID_ARGUMENT for every id
+# — including bogus ones — so it is gone rather than merely restricted.
+TRPC_MEDIA_URL_REDIRECT = "https://labs.google/fx/api/trpc/media.getMediaUrlRedirect"
 
 
 # Veo 3.1 reference-to-video (r2v). Verified against a live labs.google web
@@ -601,6 +616,94 @@ class FlowSDK:
             out["workflows"] = workflows
         return out
 
+    # ── Veo 3.1 interpolation (start + end frame) ──────────────────────────
+    async def gen_video_interpolation(
+        self,
+        prompt: str,
+        project_id: str,
+        start_media_ids: list[str],
+        end_media_ids: Optional[list[str]] = None,
+        aspect_ratio: str = "VIDEO_ASPECT_RATIO_LANDSCAPE",
+        paygate_tier: Optional[str] = None,
+        scene_id: Optional[str] = None,
+        model_key: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Kick off interpolation operation(s) — motion between two frames.
+
+        One item is dispatched per start/end pair. ``end_media_ids`` defaults to
+        ``start_media_ids``, which produces a clip whose last frame matches its
+        first — the seamless-loop case. When both lists are given they are zipped
+        pairwise and must be the same length.
+
+        Same return contract as ``gen_video``: ``{raw, operation_names}`` on
+        success (plus ``workflows`` for the low-priority schema), ``{raw, error}``
+        otherwise.
+        """
+        if paygate_tier is None:
+            raise ValueError("paygate_tier is required")
+        if not model_key:
+            return {"raw": None, "error": "missing_model_key_for_interpolation"}
+
+        starts = [m for m in (start_media_ids or []) if isinstance(m, str) and m]
+        if not starts:
+            return {"raw": None, "error": "missing_start_media_id"}
+        ends = [m for m in (end_media_ids or []) if isinstance(m, str) and m] or list(starts)
+        if len(ends) != len(starts):
+            return {
+                "raw": None,
+                "error": (
+                    f"start/end frame count mismatch: {len(starts)} start vs "
+                    f"{len(ends)} end — pass equal-length lists or omit end frames"
+                ),
+            }
+
+        ts = int(time.time() * 1000)
+        ctx = _client_context(project_id, paygate_tier)
+        # Full-frame crop; Flow's web client sends the UI's letterbox crop here,
+        # but we always condition on the whole generated still.
+        crop = {"top": 0, "left": 0, "bottom": 1, "right": 1}
+        items: list[dict[str, Any]] = []
+        for i, (start_mid, end_mid) in enumerate(zip(starts, ends)):
+            item: dict[str, Any] = {
+                "aspectRatio": aspect_ratio,
+                # Distinct seed per item so Flow doesn't dedupe.
+                "seed": (ts + i * 9973) % 1_000_000,
+                "textInput": {"structuredPrompt": {"parts": [{"text": prompt}]}},
+                "videoModelKey": model_key,
+                "metadata": {"sceneId": scene_id} if scene_id else {},
+                "startImage": {"mediaId": start_mid, "cropCoordinates": dict(crop)},
+                "endImage": {"mediaId": end_mid, "cropCoordinates": dict(crop)},
+            }
+            items.append(item)
+        body = {
+            "clientContext": ctx,
+            "mediaGenerationContext": {"batchId": str(uuid.uuid4())},
+            "requests": items,
+            "useV2ModelConfig": True,
+        }
+
+        resp = await self._client.api_request(
+            url=VIDEO_INTERPOLATION_URL,
+            method="POST",
+            headers=dict(_API_HEADERS),
+            body=body,
+            captcha_action=CAPTCHA_VIDEO,
+        )
+        if isinstance(resp, dict) and resp.get("error"):
+            return {"raw": resp, "error": resp["error"]}
+        inner_err = _extract_inner_api_error(resp)
+        if inner_err:
+            return {"raw": resp, "error": inner_err}
+
+        op_names = extract_operation_names(resp)
+        if not op_names:
+            return {"raw": resp, "error": "no_operations_in_response"}
+        out: dict[str, Any] = {"raw": resp, "operation_names": op_names}
+        workflows = extract_video_workflows(resp)
+        if workflows:
+            out["workflows"] = workflows
+        return out
+
     # ── Veo 3.1 reference-to-video (r2v) ───────────────────────────────────
     async def gen_video_r2v(
         self,
@@ -1112,8 +1215,11 @@ class FlowSDK:
                 continue
 
             # 2. SUCCESSFUL. Prefer a direct URL if the status payload carries
-            #    one; otherwise fetch the encoded MP4 bytes.
-            url = _media_url_from_entry(m)
+            #    one; otherwise resolve it through the media redirect. The
+            #    encoded-bytes probe is kept last as a legacy fallback — Flow
+            #    stopped serving it, but it costs one call and can only help if
+            #    Google restores it.
+            url = _media_url_from_entry(m) or await self.resolve_media_url(mid)
             if url:
                 ops_summary.append({
                     "name": name, "done": True,
@@ -1135,6 +1241,46 @@ class FlowSDK:
             })
         return ops_summary, raw_polls
 
+    async def resolve_media_url(self, mid: str) -> Optional[str]:
+        """Ask the browser session where a media id's asset actually lives.
+
+        Returns the resolved asset URL, or None while it is not yet servable
+        (caller keeps polling). The URL is public/signed, so the engine fetches
+        the bytes itself rather than routing them through the extension.
+        """
+        from urllib.parse import quote
+
+        try:
+            resp = await self._client.media_url_request(
+                f"{TRPC_MEDIA_URL_REDIRECT}?name={quote(mid)}"
+            )
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("media url resolve error for %s: %s", mid[:8], exc)
+            return None
+        if not isinstance(resp, dict) or resp.get("error"):
+            # An extension predating media_url_request never answers this
+            # method, so the call times out — the one failure that looks
+            # identical to "not ready yet". Name it so it is not mistaken for
+            # a slow render.
+            logger.warning(
+                "media url resolve failed for %s: %s (if this repeats, reload the "
+                "browser extension — media_url_request needs extension >= 0.2.0)",
+                mid[:8], (resp or {}).get("error") if isinstance(resp, dict) else resp,
+            )
+            return None
+        status = resp.get("status")
+        if isinstance(status, int) and status >= 400:
+            logger.warning("media url resolve HTTP %s for %s", status, mid[:8])
+            return None
+        url = (resp.get("data") or {}).get("url")
+        if not isinstance(url, str) or not url:
+            return None
+        # The redirect landing page is the asset; if we came back pointing at
+        # the TRPC route itself nothing was followed, so treat it as not ready.
+        if url.startswith(TRPC_MEDIA_URL_REDIRECT):
+            return None
+        return url
+
     async def _fetch_workflow_bytes(self, mid: str) -> Optional[dict[str, Any]]:
         """Fetch a finished workflow clip's encoded MP4 via ``GET /v1/media/<id>``.
 

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/catalog.py

@@ -26,6 +26,7 @@ from flow_engine.bridge.flow_sdk import (
     VIDEO_EDIT_URL,
     VIDEO_EXTEND_URL,
     VIDEO_I2V_URL,
+    VIDEO_INTERPOLATION_URL,
     VIDEO_R2V_URL,
     VIDEO_T2V_URL,
     FlowSDK,
@@ -36,13 +37,14 @@ logger = logging.getLogger(__name__)
 
 _CACHE_FILE = STORAGE_DIR / "catalog.json"
 
-# Endpoints we can actually dispatch today (body shapes verified). interpolation
-# / upsample still need a captured request before we wire them — resolve()
-# returns endpoint=None for those so callers 400 clearly.
+# Endpoints we can actually dispatch today (body shapes verified). upsample
+# still needs a captured request before we wire it — resolve() returns
+# endpoint=None for that so callers 400 clearly.
 _MODE_ENDPOINTS: dict[str, str] = {
     "t2v": VIDEO_T2V_URL,
     "i2v": VIDEO_I2V_URL,
     "r2v": VIDEO_R2V_URL,
+    "interpolation": VIDEO_INTERPOLATION_URL,
     "extension": VIDEO_EXTEND_URL,
     "edit": VIDEO_EDIT_URL,
 }

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/cli/processes.py

@@ -29,6 +29,7 @@ class ManagedProcess:
         log_file: Optional[Path] = None,
         on_line: Optional[OnLine] = None,
         display: Optional[str] = None,
+        cwd: Optional[str] = None,
     ) -> None:
         self.name = name
         self.argv = list(argv)
@@ -37,6 +38,7 @@ class ManagedProcess:
         self._env = {**os.environ, **(env or {})}
         self._log_file = log_file
         self._on_line = on_line
+        self._cwd = cwd
 
         self._proc: Optional[subprocess.Popen] = None
         self._pump: Optional[threading.Thread] = None
@@ -52,6 +54,7 @@ class ManagedProcess:
         self._proc = subprocess.Popen(
             self.argv,
             env=self._env,
+            cwd=self._cwd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             text=True,

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/cli/supervisor.py

@@ -22,7 +22,7 @@ from typing import Optional
 from rich.console import Console
 
 from . import dashboard, health
-from .config import LOGS_DIR, FlowConfig, mask
+from .config import CONFIG_DIR, LOGS_DIR, FlowConfig, mask
 from .processes import ManagedProcess
 
 console = Console()
@@ -92,6 +92,10 @@ class Supervisor:
             "engine",
             [sys.executable, "-m", "flow_engine.main"],
             env=env,
+            # Run from a package-free dir: `python -m` prepends cwd to sys.path, so
+            # launching from a checkout that contains a `flow_engine/` package would
+            # shadow the installed one and silently run stale code.
+            cwd=str(CONFIG_DIR),
             log_file=LOGS_DIR / "engine.log",
             on_line=self._on_line,
             display=f"{sys.executable} -m flow_engine.main",

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/jobs.py

@@ -58,6 +58,7 @@ _DISPATCH = {
     "t2v": "gen_video_t2v",
     "r2v": "gen_video_r2v",
     "i2v": "gen_video",
+    "interpolation": "gen_video_interpolation",
     "extension": "gen_video_extend",
     "edit": "gen_video_edit",
 }
@@ -84,8 +85,8 @@ def start_video_job(
 ) -> Job:
     """Create a job and kick off dispatch+poll in the background.
 
-    ``mode`` ∈ {t2v, i2v, r2v, extension, edit} selects the FlowSDK dispatch
-    method; ``dispatch_kwargs`` is forwarded to it.
+    ``mode`` ∈ {t2v, i2v, r2v, interpolation, extension, edit} selects the
+    FlowSDK dispatch method; ``dispatch_kwargs`` is forwarded to it.
     """
     job = _new_job("video", job_store)
     asyncio.create_task(

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/media.py

@@ -13,11 +13,13 @@ restarts or a horizontal pool.
 from __future__ import annotations
 
 import logging
+import os
 import re
 import threading
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Optional
+from urllib.parse import urlparse
 
 import httpx
 
@@ -36,6 +38,20 @@ _MEDIA_ID_RE = re.compile(r"^[0-9a-fA-F-]{1,64}$")
 # `data.media[].image.generatedImage.fifeUrl`.
 _ALLOWED_URL_PREFIXES: tuple[str, ...] = ("https://flow-content.google/",)
 
+# Video takes a second route: `media.getMediaUrlRedirect` 302s to whichever
+# Google host currently serves the asset, so we cannot pin one prefix. These
+# URLs come from resolving our OWN redirect against labs.google — not from
+# caller input — so the host check is defence in depth rather than the primary
+# control. Extra hosts can be added via FLOW_MEDIA_ALLOWED_HOSTS (comma list).
+_ALLOWED_HOST_SUFFIXES: tuple[str, ...] = tuple(
+    h.strip().lower()
+    for h in os.getenv(
+        "FLOW_MEDIA_ALLOWED_HOSTS",
+        "flow-content.google,googleusercontent.com,googleapis.com,ggpht.com",
+    ).split(",")
+    if h.strip()
+)
+
 _EXT_BY_MIME = {
     "image/jpeg": ".jpg",
     "image/png": ".png",
@@ -60,7 +76,19 @@ _lock = threading.Lock()
 
 
 def _url_allowed(url: Any) -> bool:
-    return isinstance(url, str) and any(url.startswith(p) for p in _ALLOWED_URL_PREFIXES)
+    if not isinstance(url, str) or not url:
+        return False
+    if any(url.startswith(p) for p in _ALLOWED_URL_PREFIXES):
+        return True
+    parsed = urlparse(url)
+    if parsed.scheme != "https" or not parsed.hostname:
+        return False
+    host = parsed.hostname.lower()
+    # Suffix match on a dot boundary so "evil-googleapis.com" cannot pass.
+    return any(
+        host == suffix or host.endswith(f".{suffix}")
+        for suffix in _ALLOWED_HOST_SUFFIXES
+    )
 
 
 def is_valid_media_id(media_id: str) -> bool:

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/flow_engine/openai/videos.py

@@ -11,8 +11,13 @@ returns HTTP 400.
 
 The generation MODE is inferred from the inputs you provide:
   - ``ref_media_ids`` / ``ref_images``     → reference-to-video (r2v, "Ingredients")
+  - start frames + end frames              → interpolation      (motion between two frames)
   - ``start_media_ids`` / ``start_images`` → image-to-video    (i2v, "Frames")
   - neither                                → text-to-video     (t2v, prompt only)
+
+End frames come from ``end_media_ids`` / ``end_images``, or set ``loop: true`` to
+reuse the start frame as the end frame — that yields a clip finishing on the frame
+it began with, which tiles seamlessly for any duration.
 Optional ``reference_audio`` (voice ids from GET /v1/audio/voices) and
 ``seconds`` (4/6/8 where the family supports it) refine the request.
 """
@@ -45,6 +50,11 @@ class VideoRequest(BaseModel):
     start_media_ids: Optional[list[str]] = None     # → i2v (Frames), pre-uploaded
     ref_images: Optional[list[str]] = None          # → r2v, raw (uploaded for you)
     start_images: Optional[list[str]] = None        # → i2v, raw (uploaded for you)
+    # end frames — presence upgrades i2v to interpolation (motion between two
+    # frames). Pass loop=true instead to reuse the start frame as the end frame.
+    end_media_ids: Optional[list[str]] = None       # → interpolation, pre-uploaded
+    end_images: Optional[list[str]] = None          # → interpolation, raw
+    loop: bool = False                              # end frame := start frame
     reference_audio: Optional[list[str]] = None     # voice ids (r2v)
     project: Optional[str] = None
     # extend / edit — operate on a previously generated Veo video
@@ -186,6 +196,11 @@ async def create_video(
     ref_ids += await ingest.resolve_image_inputs(sdk, project_id, req.ref_images)
     start_ids = list(req.start_media_ids or [])
     start_ids += await ingest.resolve_image_inputs(sdk, project_id, req.start_images)
+    end_ids = list(req.end_media_ids or [])
+    end_ids += await ingest.resolve_image_inputs(sdk, project_id, req.end_images)
+    # `loop` is sugar for "end frame is the start frame" — the seamless-loop case.
+    if req.loop and start_ids and not end_ids:
+        end_ids = list(start_ids)
 
     explicit = (req.mode or "").lower().strip()
     if explicit in ("extend", "extension"):
@@ -194,11 +209,19 @@ async def create_video(
         mode = "edit"
     elif ref_ids:
         mode = "r2v"
+    elif start_ids and end_ids:
+        mode = "interpolation"
     elif start_ids:
         mode = "i2v"
     else:
         mode = "t2v"
 
+    if end_ids and not start_ids:
+        raise HTTPException(
+            status_code=400,
+            detail="end frames require start frames — pass start_images/start_media_ids",
+        )
+
     resolved = catalog.resolve_video(req.model, mode, aspect, req.seconds)
     if resolved.get("error"):
         raise HTTPException(status_code=400, detail=resolved["error"])
@@ -223,6 +246,16 @@ async def create_video(
             paygate_tier=tier,
             model_key=model_key,
         )
+    elif mode == "interpolation":
+        kwargs = dict(
+            prompt=req.prompt.strip(),
+            project_id=project_id,
+            start_media_ids=start_ids,
+            end_media_ids=end_ids,
+            aspect_ratio=aspect,
+            paygate_tier=tier,
+            model_key=model_key,
+        )
     elif mode == "extension":
         kwargs = await _extend_kwargs(
             sdk, req, project_id, tier, aspect, model_key, inst.video_ctx

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vrex-flow-engine"
-version = "0.2.2"
+version = "0.2.4"
 description = "Launcher + supervisor and OpenAI-compatible image/video generation service (Vrex Flow Engine)."
 # Neutral public description (the in-repo README.md carries the full internal docs).
 readme = "PYPI_README.md"

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/vrex_flow_engine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vrex-flow-engine
-Version: 0.2.2
+Version: 0.2.4
 Summary: Launcher + supervisor and OpenAI-compatible image/video generation service (Vrex Flow Engine).
 Author: Vrex
 License: Proprietary

{vrex_flow_engine-0.2.2 → vrex_flow_engine-0.2.4}/vrex_flow_engine.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
 PYPI_README.md
+README.md
 pyproject.toml
 flow_engine/__init__.py
 flow_engine/catalog.py