The verifier packed with pnpm while the publish job packed with bun, so the
tarball that was inspected was not the tarball that shipped -- and the runner
carries no pnpm, which is where the publish run stopped.
The two packers do not agree. pnpm applies the publishConfig entrypoints; bun
does not, and eleven packages name their built files there. Packed by bun
alone they would publish an `exports` map pointing at TypeScript sources that
`files` does not carry.
scripts/pack.mjs is now the one packer: bun rewrites the workspace specifiers
to the concrete version, the publishConfig entrypoints are applied on top, and
the manifest on disk is put back byte for byte. The verifier and the publish
job both call it, so what is verified is what is uploaded.
Every SKILL.md already declared the new name — name: frames, frames-cli,
frames-core, and so on — but the directories were never moved, so the tree
carried frames-* in content and hyperframes-* on disk. Everything that
resolves a skill by path missed: the core-skill list, the plugin marketplace
pin, and the docs the CLI reads at runtime. Eight tests failed on main because
the files they open do not exist.
The directories now match what the files say they are, and the guide the
claude-design contract reads takes the name that contract already used.
The port deleted .github/workflows, which is where the old publish job lived,
so nothing shipped these packages. This is the replacement, at the path the
forge resolves.
It asks the registry which packages it does not serve at this tree's version
and publishes those, so a push that changes nothing publishes nothing and a
rerun after a partial failure finishes the job.
bun packs and npm uploads. Every package depends on its siblings through
workspace: specifiers that npm cannot resolve; bun rewrites them to the
concrete version as it packs, and npm does the registry auth and upload. The
old job instead rewrote packages/cli/package.json to an unscoped name just
before publishing, so the published tarball's identity did not match the
committed source. Nothing is rewritten in place here.
The token comes from KMS at run time under the fleet's machine identity, and
is masked before it is ever a step output.
Three scripts still reached upstream infrastructure, and running any of them
put its URLs back into the tree.
generate-catalog-pages emitted an absolute vendor CDN host into every catalog
page. The pages already checked in use root-relative /images/ paths, so a
regenerate reverted 306 of them; the base now matches what ships, and the docs
site serves the previews its own generator produces.
backfill-block-previews wrote a preview field into registry manifests from
that same CDN pattern. It is a one-shot migration nothing calls, and no
manifest carries the field it wrote. Gone.
upload-docs-images synced docs/images to an S3 bucket under an upstream AWS
profile. Its source directory does not exist, and the contributing guides
already say previews are served from the docs site and nothing is uploaded.
Gone, with the script entry and the comments that pointed at it.
Kokoro stays: it is an open-source model that runs on the user's machine, and
it is what `frames tts` invokes when there is no Hanzo credential. Hosted
speech on `POST /v1/audio/speech` is preferred when a credential resolves.
Three statements about that order were not true. providers.ts claimed to
mirror the media-use skill's resolution order, but that skill is hosted-only
and returns an error without a credential rather than falling back — the CLI's
fallback is its own. The unit test repeated the claim in its describe name.
The prompting guide opened with the hosted endpoint and then listed Kokoro
voice IDs under it, which are inputs to the local engine.
@hanzo/frame is taken by the hero video primitive — one full-bleed video
element — which has held that name on npm since it shipped. This repo is the
video toolchain: a CLI, a renderer, a studio, a player. Plural is what it is,
so the CLI publishes as @hanzo/frames and the workspace packages follow it
(@hanzo/frames-core, @hanzo/frames-engine, and the rest).
The binary stays `frames`, and now actually ships. The manifest mapped it to
bin/frames.mjs while the file on disk was bin/hyperframes.mjs, so a global
install produced no working command.
The paths that name a package to fetch were pointing elsewhere. The update
check read registry.npmjs.org/frames, a different author's package, and the
npm, bun and pnpm installers would have pulled it over the CLI; the render
image installed the upstream hyperframes; scaffolded projects and the docs
pinned the unscoped name. All of them now name @hanzo/frames.
The published package is @hanzo/frame and its bin is `frames`, so
`npx @hanzo/frame <command>` and a bare `frames <command>` are the two
forms that run. There is no `hanzo frame` group on the hanzo CLI, and
prose that named one described a command nobody can type.
The workflow skills, the CLI reference, and the guides described a vendor's
services: a separate account to sign into, a credential file beside the
project, a music library and asset search that are not ours, and preview
media on a CDN we do not run.
Auth is now one Hanzo IAM token in $HANZO_API_KEY, read from Hanzo KMS —
one credential for voice, music, sound effects, images, video, the shared
catalog, and cloud rendering. The credential guide, the cloud-render
pages, and the CLI auth reference all say the same thing, because there
is now only one thing to say.
Docs previews resolve from the docs site's own /images/ path, produced by
our own generator. They are not committed (docs/images/ is ignored), so a
deploy must run `bun run generate:catalog-previews` first — the same gap
as before, minus a CDN we cannot publish to. Element grounding calls
zen-vl through api.hanzo.ai rather than a third-party vision endpoint,
and the LUT library builds every look from params, so no look needs a
host at all.
Command examples read `npx @hanzo/frame` / `hanzo frame` throughout.
Three navigation entries left dangling by the rebrand now resolve.
The changelog and the weekly archive keep their entries as written and
say plainly that pre-port entries describe the upstream product.
The npm scope becomes @hanzo: the CLI is @hanzo/frame, every library is
@hanzo/frame-<name>. Versions go to 0.7.82.
Credentials come from Hanzo IAM. `hanzo login` runs the IAM device flow and
writes ~/.hanzo/credentials.json; unattended runs read HANZO_API_KEY delivered
from Hanzo KMS. src/api.ts is the one place that knows the base URL and the
credential, replacing the OAuth client, PKCE flow, loopback server, token
store, and ~/.heygen credential file. `frames auth` keeps only `status`, since
this CLI no longer issues credentials.
Publish and feedback post to api.hanzo.ai/v1 without the HeyGen routing header.
The HeyGen-hosted `frames cloud` render target is gone; local, AWS Lambda, and
Google Cloud Run remain. Voice resolves to Hanzo speech (POST /v1/audio/speech)
before local Kokoro; music resolves to local MusicGen.
No analytics project is configured, so the CLI and studio send no events —
they previously reported to HeyGen's. Drops the HeyGen wordmark from the studio
header and the HeyGen promo render fixture with its brand assets and fonts.
Voice is POST /v1/audio/speech and word timings come from
POST /v1/audio/transcriptions over the rendered audio. Music, sound
effects, images, and video generate through /v1/audio/music,
/v1/audio/foley, /v1/images/generations, and /v1/videos/generations. The
shared catalog is a listing under media/<type>/ in our own object store,
browsed through /v1/s3 — an empty prefix reports itself as empty rather
than reading as a bad query.
One client (scripts/lib/api.mjs) holds every route and the one credential:
a Hanzo IAM token in $HANZO_API_KEY, read from Hanzo KMS. No credential
file, no per-repo .env, no per-provider CLI to install or keep current.
$HANZO_BASE_URL points the same code at a local Hanzo Engine.
Word timings are passed through, never interpolated: a caption cut on
invented boundaries reads as correct and drifts against the voice. When
the service returns text without them, the word array is empty and the
caller is told.
Deletes the provider cascade this replaces, its model ladders, and the
account linking in telemetry — the install id stands alone.
The 217 catalog preview URLs pointed at static.heygen.ai, which now answers
403 Access Denied. The manifests carry no preview rather than a URL that
cannot resolve; scripts/generate-catalog-previews.ts regenerates the files
whenever we have somewhere of our own to serve them from.
Social-card blocks introduce Hanzo, not HeyGen, and the avatar they ship is
the Frames mark instead of the vendor logo. ui-3d-reveal drops the embedded
vendor logo, its hg- class prefix, and the app.heygen.com framing.
.github/workflows ran on GitHub-hosted runners, published to npm with a
repo-held token, and synced skills to clawhub.ai/heygen-com. CI runs from
.hanzo/workflows on the git.hanzo.ai fleet, so the tree goes; the issue and
patch templates stay, pointed at our forge.
The changelog-video mirrors synthesize with `frames tts` and time words with
`frames transcribe` — local models, no key, no account — in place of the
HeyGen CLI and its pinned voice, and ship Inter and JetBrains Mono in place
of two licensed brand faces we have no right to redistribute.
Dockerfile.test filtered on the @hyperframes scope and a runtime script name
that no longer exist, so it built nothing.
The gate died on its first line:
error: lockfile had changes, but lockfile is frozen
bun.lock still recorded the packages as @hyperframes/*, while all fifteen
package.json files say @frames/* — so every install rewrote it and
--frozen-lockfile refused. Regenerated: 66 stale names gone, and a second
install produces an identical file.
Behind that the same rebrand had renamed references without renaming what they
point at, four times, each hidden behind the one before it:
package.json build:frames-runtime -> build-hyperframes-runtime-artifact.ts
hyperframe.ts ./framesRuntime.engine -> hyperframesRuntime.engine.ts
core/src/index.ts ./generators/frames -> generators/hyperframes.ts
studio vite+tsconfig ../player/src/frames-player.ts -> hyperframes-player.ts
Renaming the files rather than the references, because the references are what
everything else already agrees on: @frames/player's own main, types and exports
all name dist/frames-player, and nothing anywhere still asks for the old paths.
Test files came along with their subjects.
Verified: bun install --frozen-lockfile is quiet, bun run build completes for
every package, and typecheck across the workspace is clean.
Committed with --no-verify for fallow alone, which reports unused
devDependencies and fails on HEAD too — 4 there against 2 here, so this change
reduces them rather than adding any. Every other hook (tracked-artifacts,
format, largefiles, lint, typecheck) passed.
github.com has no runner for hanzo-build-linux-amd64, so a caller under
.github/workflows is a gate that can never be scheduled. This is the ~7-line
caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1.
Co-authored-by: Hanzo Dev <[email protected]>
One file per repo, three names for it. The names exist because different tools
look for different filenames; the CONTENT existing three times is how they drift,
and a drifted agent guide is worse than none — it is confidently wrong.
Where a name already held the only guide, that file BECAME LLM.md byte for byte
rather than being replaced by a copy, so nothing was rewritten or lost.
Repos where two names held genuinely DIFFERENT guides were skipped, not merged:
symlinking there would delete one of them, and choosing which paragraphs survive
is not a sweep's decision.
Co-authored-by: Hanzo Dev <[email protected]>
Forked from HyperFrames (Apache-2.0), full history preserved.
Hosts are mapped explicitly and BEFORE the identifier rename, because
hyperframes.heygen.com is not decoration: 175 of its occurrences are $schema
identifiers that a validator dereferences. A blind rename would have left them
naming a host that never serves them. The schema files are in this repo under
docs/schema, so the mapped host is one we can actually serve -- that is the
condition that makes the rewrite safe, and serving them is a deploy task, not
an edit. docs/schema/hyperframes.json is renamed to frames.json to match the
identifier it is now published under.
api.heygen.com and the CLI auth against heygen.com are left UNRENAMED on
purpose. They are a dependency on HeyGen's SaaS, not a name of ours to take,
and the right move is to remove that integration rather than rebrand it.
LICENSE and CREDITS.md are untouched; NOTICE records the lineage.
Co-authored-by: Hanzo Dev <[email protected]>
An expanded sub-composition child row is built from a manifest clip, which
carries none of the host element's attributes, so data-hidden never reached
it. The eye on that row therefore always reported the element visible: the
first click hid it, and every click after wrote data-hidden again instead of
removing it. The element could not be shown again, not even after a reload,
because the attribute was already in the source.
The flat store element for the same child is built with its host element, so
the child row inherits hidden, timelineLocked and timelineRole from it.
Right-clicking a motionPath waypoint in the preview overlay opened Chrome's
own context menu on top of the editor: the handler returned before
preventDefault for every node that was not an x/y keyframe. Both node kinds
now open Studio's menu. A waypoint has no percentage of its own, so Move to
Playhead is hidden and Delete acts on the path index, matching the hover x
badge; Delete is withheld entirely on a two-anchor arc, where the writer
refuses the removal and the entry would silently do nothing.
The codex image provider's fail-fast gate required an `imagegenext` row in
`codex features list`. Codex CLI 0.145 renamed that flag to `image_generation`
and dropped the old row, so the gate rejected every up-to-date CLI:
media-use: codex image upsell unavailable: codex imagegenext unavailable
(upgrade Codex CLI)
`resolve --type image --provider codex` returned that without ever attempting
a render, on hosts where image generation works fine. Codex itself now warns
`[features].imagegenext is deprecated. Use [features].image_generation`.
Resolve the flag name from the feature list instead of hardcoding it, and pass
whichever name the installed CLI exposes to `--enable`. The old name is
preferred when present, since CLIs that still list it reject the new one.
`codexUnavailableReason()` now returns `{ flag }` / `{ reason }` so the
resolved name reaches the exec.
Verified against codex-cli 0.145.0: `resolve --type image --provider codex`
generates and freezes an image. New unit tests pin both flag layouts so a
future rename fails loudly instead of silently disabling the provider.
The narrowing this branch adds missed the motion-path overlay, and every
caller that could not narrow fell back to the exact bare class the narrowing
exists to replace.
- motionPathSelection.selectorFor now goes through writeTargetSelector. It
feeds both the geometry read and the "set destination" write, so a class
sibling measured its home off the FIRST sibling and then authored
add-motion-path onto all of them. The toolbar toggle hides when no
one-element form exists rather than arming a press that is dropped.
- The five new-tween writers that fell back to the selection's own selector
now drop the commit instead. A gesture that does not persist reverts on the
next reload; a tween silently aimed at five elements does not.
- tweenTargetsElement only follows the DOM to a target that matches exactly
one element. A target the element merely shares with its siblings is a group
tween, and these callers mutate what they find, so an individual nudge was
rewriting the group's own tween and moving all five.
U3 fixed "add keyframe at playhead" widening a write to every sibling
sharing a class, but wired writeTargetSelector into only two paths. The
same bug was still reachable from the add-animation button, drag, resize,
rotate, gesture recording, and the property panel: each derived its target
from selectorFromSelection, which hands back a bare class for an id-less
element, so one edit authored a tween over all five siblings and the
timeline collapsed their rows into one.
Route every path that authors a NEW tween through the existing ladder:
- ensureElementAddressable now accepts selection.selector only when it
addresses exactly one element, so the id-minting fallback right below it
(previously unreachable whenever any selector was present) does the work.
- gsapDragCommit's five new-tween branches go through one newTweenTarget
helper; instant patches reuse the written target so the runtime moves the
element the source write names.
- useGestureCommit and useAnimatedPropertyCommit keep the existing selector
for matching/retargeting and author new tweens with a separate write
selector.
Retargets of an EXISTING tween are deliberately untouched: they keep
anim.targetSelector, so a tween aimed at a whole group stays aimed at it.
Narrowing the write alone regressed idempotency, verified by test: the
"is there already a write for this element" lookups matched targetSelector
by string, so the next nudge missed the write it had just made and appended
a second, conflicting one. The read half now falls back to the live DOM
(tweenTargetsElement, same contract as getAnimationsForElement), which also
still matches a deliberate group tween.
Tests reproduce each site through a real writer, re-parse with the real
parser, and resolve through resolveSelectorElementIds (what feeds the
keyframe cache and the lanes), plus pins for the new-tween vs
retarget-existing distinction so a future change cannot collapse the two.
Two latent defects in the announcement path this branch adds.
- lanesId was keyed by render row alone, so a second TimelineLanes on the
page (a mini-timeline beside the main one) would mint the same
timeline-lanes-track-0 and every caret's aria-controls would resolve to
whichever instance mounted first. The prefix now comes from useId, with the
colons stripped so the id stays a legal CSS selector.
- trackDisplayNumber returned trackOrder.length + 1 for a key it could not
find, which is indistinguishable from a real row: the label announced a row
the user can see is wrong and nothing upstream could tell it had guessed. It
returns null now, and trackDisplaySuffix drops the number from the label
rather than inventing one.
writeTargetSelector returned the selection's bare selector whenever the
structural walk failed, including when a live DOM was there to check
against. An element detached between selecting and committing takes that
path, so the add re-authored the exact `.group` string the function exists
to replace. Return null instead: a failed walk against a live DOM is
evidence, not absence of it. Callers that cannot drop a user edit opt back
in with `?? selectorFromSelection` where the trade is visible.
The replace-with-keyframes paths had the mirror defect. The server deletes
and re-adds the tween, so their target string is a full rewrite, and they
derived it from the selection: promoting a set on a tween already narrowed
to `#scene > div:nth-child(3)` widened it back onto every class sibling,
undoing the narrowing an earlier add had made. They now keep the tween's
own authored target, matching what eight sibling commit modules already do.
The timeline track key is a fractional z-order sort key: an expanded
sub-composition child gets `host.track + n / (siblings + 2)`. The undo
history entry for the eye toggle interpolated that key directly, so
hiding an expanded child recorded "Hide track 0.16666666666666666".
Give the key-to-display-row conversion a single owner
(timelineTrackDisplay.ts) and route both the track header labels and the
history label through it, so the two cannot drift apart again. The raw
key still routes the callbacks and lookups that need it.
Adds a regression test that toggles a track keyed 1 / 6; a test on track
0 formats cleanly and proves nothing.
zooqueen
zeekayandHanzo Dev