CueFrame

Read the certified decode representation for media selected in this project before starting an editorial run. Supply projectId and mediaId; a null representation means this source cannot be pinned. The response omits internal storage paths. Select a bounded range from the returned frameCount and exact fps ratio; do not invent a source identity.

Recover persisted authored briefs for a project. Read bounded pages; pass nextCursor as cursor until done. Brief IDs link to editorial runs.

Recover persisted editorial runs for a project in bounded pages. Pass nextCursor as cursor until done, then read each relevant run for its integration decisions and unresolved gaps.

Read a persisted editorial run, including its revision, state, inputs, outline, selected finding IDs, omitted reasons and unresolved integration gaps. Read findings and evidence separately for complete coverage.

Read delivered evidence and inspection coverage for a run in bounded pages. Pass nextCursor as cursor until done; an empty page does not prove the whole source was inspected.

Read durable observations, including useful, nothing-useful and uncertain outcomes, in bounded pages. Pass nextCursor as cursor until done; retain evidence IDs, supersession and uncertainty when recovering decisions.

Persist an authored brief for the selected project. The projectId belongs in body.brief; use the returned briefId to start an editorial run.

Start an editorial run from a persisted brief and explicitly selected certified source ranges. Read editorial_run_source for each project media source first; use its exact identity, revision, frame count and fps ratio. Never invent a source pin or infer inspection from an index.

Deliver one exact decoded source frame as JPEG and save its evidence receipt. Only that sampled frame is visually inspected; preserve the returned evidenceId and coverage.

Deliver bounded sampled motion frames and save their evidence receipt. The sampled frames do not certify continuous visual coverage.

Deliver a bounded 16 kHz source audio interval and save an audio evidence receipt. The interval must lie inside a certified run input.

Deliver at most 100 verified transcript words with their mapped certified decode interval and save a transcript evidence receipt.

Persist one evidence-backed observation. A nothing_useful outcome may cover only what the cited evidence actually inspected; sparse stills do not certify an unsampled interval.

Save selected finding IDs, explicit omitted reasons and unresolved gaps with the observed run revision. Read the run and findings before deciding.

Commit an integrated editorial edit to the saved project composition with both runExpectedRevision and guarded composition fields. Preserve the observed concurrency basis and the composition journal identity: nested composition.commandId must equal composition.clientId + ":" + composition.sequence. The session call commandId is a separate HTTP request identity.

Start an async Director compose job: it authors an ensemble of full composition candidates, verifies each, and saves the winner to the project. Body must set EXACTLY ONE source (mutually exclusive): `briefId` — author FROM a persisted Brief (the PLANNED path: create_brief first; every Brief field is honored or the compose is refused loudly naming the field); `fromComposition: true` — author from the project's CURRENT composition (the GENERAL path: seed it with apply_composition first — your media clips are the intent, and any graphics you authored are CARRIED VERBATIM as locked clips the Director authors around, never re-authors or drops); or `suggestionId` — author from an AI clip suggestion (the CLIPPING path, paired with suggest_briefs). Returns { composeJobId, status, streamUrl }. Then call wait_job(kind="compose", id=composeJobId, projectId=...) to block until the winner is selected.

Atomically apply an array of CompositionOps to a project composition. All ops succeed or none do (transactional). Call describe_composition_ops without type for the compact operation list, then with a type for its exact JSON Schema. For negotiated component execution, read get_composition with componentExecutionVersions=["3","4"] and includeDependencies="true", then send componentExecutionVersions:[3,4] and that exact expectedBrandIdentity. A changed brand refuses the command; never refresh the witness to conceal a conflict. Explicit builtinSources selectors attach only the approved exact source pins referenced by the final composition. The additive `concurrency` envelope requires an endpoint confirmed to enforce guardedCompositionV1; unsupported hosted endpoints refuse it with unsupported_concurrency. Obtain dependency expectations from the observed composition; never rebuild a stale basis from current state. Every committing call REQUIRES `if_match`, the composition ETag from a fresh get_composition, or the `concurrency` envelope; a call with neither is refused with 428 precondition_required. On 409 stale_etag, read get_composition again and reconsider the batch against what changed; never copy the error's currentEtag into a retry without that read. `dry_run: true` validates the batch without persisting and needs no revision. Ops land on the project's ACTIVE composition unless you pass `composition_id` (mutually exclusive with `session_id`), which targets a specific one — that is how you author a second composition minted with new_composition and run an A/B. Use this to seed a composition (add media clips) or make targeted edits (set a crop intent, reorder clips, set the format). CAPTIONS FOR EDITED TIMELINES: after saving all clip edits, call again with {type:"captions.fromComposition", trackId} to build captions from every audible clip on that track, honoring trims, exclusions and placement. Clips must have duration matching playable source duration divided by p

Dry-run a full Composition object against the SAME pure, DB-free authoring guards saveComposition enforces, WITHOUT persisting it (no project needed). Checks: wire shape (Zod), primitive membership (unknown_primitive / custom_missing_sourcecode), required-param shape (invalid_primitive_params), clip↔track family (clip_source_track_mismatch), and reframe coverage (reframe_coverage_gap). Always returns ONE shape — 200 { valid, errors, quote } — for BOTH malformed wire shapes and deep-invariant failures (so branch on `valid`, not on HTTP status); errors[] lists every problem at once as a sanitized envelope { code, stage, category, retryable, message, fix } you can fix before composing/rendering. The `quote` triple states the render price to finish from a valid composition — relay it to your human BEFORE create_render. `valid:true` means save-safe EXCEPT for the three genuinely DB-bound checks that can only run at save/render, because this tool takes no project: trim-bounds (needs the media duration), image/asset-on-a-video-track (needs the media kind), and componentId resolution (needs the installed components of YOUR org — a `{kind:'component', componentId, props}` clip naming a component you have not created, or naming a CATALOG PRIMITIVE, passes here and is refused at save with `component_source_unavailable`). Pass the Composition as `body`.

Queue an MP4 render of a project's composition (in a compose session, the session's scratch). Returns { id (renderId), status, warnings? } — `warnings[]` carries non-fatal advisories (omitted when none). The render themes from the project's brand kit (bind one via create_project / update_project with brandKitId — or PATCH /projects/:id over REST; without one the output is unbranded). Then call wait_job(kind="render", id=renderId, projectId=...) to block until the file is ready and get the download URL, or register a webhook (create_webhook on render.completed — status rides the payload).

Queue durable still-frame evidence for layout/copy judgment. Returns immediately with {jobId, kind:'preview_frame', status}; then call wait_job(kind="preview_frame", id=jobId) to receive every presigned frame as an image. The immutable snapshot records geometry, layers, warnings, and whether the target was persisted, inline, or session scratch. A still cannot prove motion — use preview_clip or preview_component for animation.

Queue a typed preview artifact for ONE org-installed component — ASYNC: returns a jobId immediately; then wait_job(kind="preview", id=jobId). The preview and production compositor consume the same content-addressed component bundle and verified artifact contract. `body.componentId` selects the component; pass `body.params` to render it with props (the mount's `params`); declared manifest slots are bound separately and reach the scene's `assets`, never params. Admission/runtime/capability failures land on the job terminal with sanitized author-fixable messages. Idempotent per immutable render key.

Render a scoped, cheap MOTION preview — ONLY body.fromSec→body.toSec of the composition (max 60s) at preview quality (capped resolution, lighter encode) through the real render pipeline. THE way to judge motion — a cut, a transition, a component's animation — at full fidelity BEFORE paying for a full render (a still cannot show motion; a full render costs the export). ASYNC: returns a render job; wait_job(kind="render", id=renderId) or a render.completed webhook for the URL. Meters the capture feature, never an exports credit.

Queue the durable server-side judge — it snapshots the exact authored target, samples eval beats, captures frames asynchronously, and grades editorial/spatial/brand/caption. Then wait_job(kind="verify", id=jobId) for per-criterion scores, weighted composite, worst-first critique, and checkpointId. `body.composition` is optional (absent ⇒ ACTIVE). Fix the lowest criterion via apply_composition and re-score. Idempotent per immutable snapshot; compose_verify bills only on the guarded success terminal.

Ask the Director for editing advice on the project's CURRENT composition — it NEVER writes your composition (you stay the decider). Async: returns a consultJobId; then wait_job(kind="consult", id=consultJobId, projectId=...) surfaces the advisory envelope (assessment / proposals / principles / plan). `body.mode`: 'advise' = the planner agent (fast, ~30s-2min) returns a `plan` (framing/cuts/captions/graphics intents) as GUIDANCE you re-author from — no grounded scores, nothing to adopt; 'amend' (default) = the full author→judge→refine loop (minutes) returns a graded `assessment` + a fix candidate you ADOPT via select_candidate with its candidateIndex. ('explore' is coming soon → use amend.) `body.intent` = your goal in plain English; optional `body.focus` (editorial|spatial|brand|caption); `body.ifMatch` binds to your current etag. Use advise for a fast directional nudge, amend for a grounded, adoptable fix.

Answer the checkpoint packet wait_job reported as awaiting_input (its {checkpointId} — read the packet FIRST with get_checkpoint and relay the stills + money triple to your human). ONE `body.decision` per gate: 'approve' (proceed; comments allowed — they record as taste without gating), 'revise' (the director revises per your `body.comments` [{anchor: {beatId}|{timecodeMs}, verdict: 'approve'|'revise'|'lock', note}] and/or `body.edits`, then RE-PRESENTS this same gate as a new packet — in-job, no new charge; the brief quote states the included revision cycles, beyond them revise is refused 402), or 'abandon' (end the run — the only terminal refusal). 'lock' freezes an element contractually: the director touching it surfaces as a lock_violation verdict on the next packet. On approve/revise the Director rehydrates its warm box and continues; then wait_job again.

Persist the video's INTENT as a Brief — the Director's rich input contract (spec: the storyboard skill's output lands here). Fields: goal (required), audience, platform, format, durationSec, tone, cta, locale (output language — all on-screen copy + captions), hook, caption, beats[] (each with an editorial intent and optional MOMENT PINNING {mediaId, startSec, endSec} — honored to-the-frame or refused), mustIncludes, captions {styleId, emphasisPhrases} (the big-serif emphasis treatment), motionStyle, seededGraphics (your authored overlay/component/card clips, carried VERBATIM as locked clips — never re-authored), exclusions (hard negatives: graphic kinds the Director must NEVER author + 'no-transitions'), gates {holdAt, autoApprove}. Then compose it: compose with {briefId}. The response carries the QUOTE (compose + estimated render) — relay it to your human BEFORE composing.

Read a brief by id — the persisted intent plus its current quote (compose + estimated render).

List briefs. DEFAULT shows human-authored briefs only; kind:"clip" shows the machine-minted clip briefs (suggest_briefs output), kind:"all" shows everything. Each carries its quote.

Read a checkpoint packet — the durable approval unit a held compose pauses at (wait_job reports awaiting_input with {checkpointId, stage, version}). Carries the stage artifact, presigned storyboard stills (REVIEW THE EVIDENCE, not raw JSON), critic verdicts, the money triple {thisStepUsd, jobSpendSoFarUsd, estimatedJourneyTotalUsd} to relay to your human, and the recorded decision once resolved. When the Brief's gates set reviewMode:'hosted' the packet also carries reviewUrl — a browser review page where your human decides directly (relay THAT link instead of raw stills; you learn the decision via checkpoint webhooks / wait_job). Answer an awaiting packet with resume(checkpointId, ...).

List checkpoint packets newest-first (filter with composeJobId for one run's v1→vN gate history, or projectId). The version stack with per-version status + decisions IS the review history — nothing is deleted.

Edit a brief (partial). REFUSED with 409 while an ACTIVE compose job references it — finish, resume, or abandon the job first (the Director never has its input edited mid-run). Edits apply to the NEXT compose.

Delete a brief. Compose jobs already run from it are unaffected (they snapshot).

Select one candidate from a finished compose/consult ensemble as the project's saved composition (whole-candidate replace). Body REQUIRES both fields: { candidateIndex, selectStrategy: "agent-authoritative" } — candidateIndex from wait_job(kind="consult") proposals (mode=amend) or the compose winner report; selectStrategy is required and API keys must use 'agent-authoritative' (editor-merge/editor-replace need an editor-session token and 403 on an API key). agent-authoritative replaces the saved composition unconditionally and ignores ifMatch, so read get_composition first and adopt only when no edit made since the consult or compose must survive. After selecting, render with create_render.

Create and store a custom component for the tenant: a native scene that arranges its declared images and videos as tiles in 3D space. Returns the ComponentResponse (id + metadata) you can then reference from a composition. No project arg — components are tenant-scoped. SOURCE CONTRACT (version 4; the server instructions' Component Contract has the full rules and an example): send the complete source object {version:4, componentId, template, manifest, definition}. `template` is one sub-composition: a root <div id="root" data-composition-id="<componentId>" data-width data-height data-no-timeline data-composition-variables='…'> holding <div data-cf-scene></div>, and one inline script ending in __cfScene.mount({ root: document.getElementById('root'), component, variables: __hyperframes.getVariables() }). data-composition-variables is the definition's projection (scalar inputSchema properties, then manifest slots). The manifest is {version:4, runtime:'hyperframes', hfContract:1, kind:'scene', assets, graphics:{api:'webgl2',…}, alphaPolicy}; slots are image or video. The source is admitted before it is stored: template lint, determinism (no timers, Date, network or CSS animation) and the declaration are checked, and a refusal names the rule. A version-3 source is retired and refused as component_source_retired. Place it with execution {version:4, componentId, sourceVersionId, params, seed, assets:{ slot: mediaId }} and placement {version:3, kind:'clip'}; slots never travel in params.

Use projection:'component-library' for the unified source-free library page, returned as complete JSON with exact scoped definition/preset/recipe cards and pagination. Choose origin:'builtin' for the maintained builtins or origin:'library' for the authenticated serving home; use libraryKind, category, q, limit and after to filter/page. Preserve each card identity.scope and identity.revision, its source/definition pin or exact recipe document identity; same names/IDs in different scopes remain distinct. Resolve the selected exact source with sourceVersionId (plus builtinCollection for an explicitly selected builtin), never a latest-head or another-home lookup. Presets identify their exact presetVersionId, definition pin and historical document witness; recipes identify their complete exact document and member source pins. This projection contains no source bodies or legacy thumbnail substitution. Omit projection for the historical catalog protocol below. DISCOVER WHAT TO BUILD WITH — list the component catalog: the one built-in primitive (heroText, the behind-subject overlay) plus your org-installed components. Desktop also includes bundled kind:'component-package' entries: these are complete reusable authored packages; insert them with the desktop apply_template tool using placement.template and explicit insert.startTime/idPrefix, media bindings and parameter values. Do not pass their ids to clip.add, get_component_source, or cueframe://component resources. Their draft status does not certify visual review or licensing. For hosted builtin preset/recipe cards, call resolve_builtin_component with the exact collection, id and revision, then apply_template with template:<builtin id> and body:{projectId,documentSha256,insert:{startTime,idPrefix},...}. Hosted tool request fields live under body; desktop tool shapes may differ. The agent-safe default page is 20 entries; use pagination.nextCursor as `after`, or narrow with category, kind, tier, useCase, mood, q, or intent.

Resolve a selected builtin component-library card using its exact collection, id and revision. Returns the canonical pinned document and source snapshots for a preset or recipe, or the exact source for a definition. Preserve documentSha256 and all identities; a missing revision refuses without falling back to another version or scope. Resolve before apply_template; do not invent wrapper source or reconstruct a package from a thumbnail.

List this organization's saved templates. Follow pagination.nextCursor with after to read further pages. Public catalog slugs are not enumerated here; read a known public slug with get_template.

Read a saved organization template by id or a known public catalog template by slug. The answer is a summary: the media and value parameters with their kinds and options, presets with their values and brand kit, the brand kit, rubric, components (id, version, asset slots) and an outline of the tracks and clips; never component sources (read one with get_component_source, or pass full: true for the whole document). Use the exact reference with start_template or apply_template. Do not invent a slug from a component-library card.

Insert a resolved builtin component package into an existing project. Pass template as the selected builtin id and body with projectId, the resolved documentSha256, insert:{startTime,idPrefix}, parameter values and explicit media bindings. Read get_composition first and retain expectedRevision, commandId, componentExecutionVersions:[3,4] and expectedBrandIdentity as required by the contract. Insertion preserves existing timeline content and package source offsets. Select pinned samples explicitly with media:{slot:{sample:true}}, or bind real media IDs. Missing required media is refused; samples are never selected implicitly. A stale revision, pin or brand refuses; do not silently refresh the witness. For ordinary templates, this operation retains its existing apply behavior.

Read an exact component source as complete JSON. Supply sourceVersionId from the selected catalog card to read that immutable revision, retaining sourceSnapshot with its complete versioned definition, manifest and template beside its exact pin and schema metadata. For an explicitly selected builtin, also supply builtinCollection:'native'|'curated-definitions' and its exact sourceVersionId; without builtinCollection resolution is scoped to the authenticated org. An unavailable exact pin refuses; never retry a head or another scope. To fork, keep the version-4 snapshot whole, change its componentId (the template root's data-composition-id too) and template, and send it to create_component. Builtins always require an exact collection and pin; ID-only builtin reads are refused. Declared slots are bound per placement in execution.assets, never caller params.

Fetch bounded authoring context for a media item: dimensions/thumbnail, compact face roster, transcript counts/sample, temporal grids, and fact readiness. Transcript and word-grid counts cover one page only (default 20 utterances); pass transcript.data.pagination.nextCursor as after to get_media_context for the next context page, or use get_transcript for exact paginated word timings.

Read exact source-time transcript words in bounded utterance pages. Word start/end values are seconds from the source media start. Default limit is 20; pass pagination.nextCursor as after for later pages. The formatter omits the unbounded fullText duplicate.

Prepare the perception artifact an authored edit needs BEFORE sighted review. Pass body.kind="subjectTrack" for face/active-speaker reframing, or body.kind="matte" for a true zPlane:"behind-subject" graphic. Pass body.intent {startSec,endSec} using SOURCE time (the media trim, not timeline time); it is required for mattes and strongly recommended for subject tracks so the prepared fact exactly matches the clip and quote. This is the supported product path — never accept a preview that silently flattens depth or ignores speaker tracking. Returns a fact receipt; with intent, poll get_media_facts using the same kind/window until exact.state is ready; without intent, omit all three filters and find the whole-source subjectTrack in facts until status is ready (failed is terminal). Existing pending/ready facts are reused without another charge.

Read prepared subject tracks and behind-subject mattes for one media item. For an exact readiness check, pass kind + startSec + endSec together using the same SOURCE window sent to prepare_media; exact.state is pending | ready | failed | available | unavailable. If subjectTrack was prepared without intent, omit all three filters and check the whole-source subjectTrack in facts instead. Wait for the required fact to be ready before preview_frame / score_composition.

List the media in your CueFrame library. Filter a real library with kind (video|audio|image|gif|asset|source|stock), source (upload|generated|import-url|stock), or tag — so you find YOUR footage, not e2e debris. Returns media item IDs and metadata; use an ID with get_media_context, suggest_briefs, or as a composition source.

Get a presigned download URL for a media item's stored SOURCE file — the bytes CueFrame composes from (the raw upload, or its conformed transcode). This is how you copy media OUT of a library: fetch the URL directly (no auth header) and PUT the bytes elsewhere with create_upload, or hand it to import_media on another account. Works as soon as the upload or import is stored, before processing completes. The URL expires at `expiresAt` (about an hour) — call again for a fresh one rather than caching it. Read-only and free; nothing is persisted. For a render's MP4 use refresh_render_url instead.

Read ONE render's record without waiting on it: status, progress while it runs, outputUrl + outputExpiresAt once complete, the typed failure (errorCode / category / retryable) if it failed, and WHAT RENDERED — compositionId (the composition it froze), format (aspect/fps/resolution it encoded at), engine, createdAt / completedAt, outputDurationSec, and the preview window for a preview_clip. Free, read-only, instant — use it to audit or correlate a past render (which composition, when, how long) where wait_job would block; wait_job remains the way to block until a running render finishes. An expired outputUrl is refreshed with refresh_render_url.

Re-sign a COMPLETE render's output URL. A render's presigned MP4 link lasts ~7 days, so wait_job / getRender on an old render hands back a link that 403s; this mints a fresh one for the same file and returns { outputUrl, outputExpiresAt }. Needs projectId + renderId (from create_render). 422 render_not_complete while the render is still running or failed — wait_job for it first. Requires renders:write (the row's stored URL is updated).

Create a new project — the unit you compose and render into. compose / apply_composition / create_render / the preview family all require a projectId; this mints one. Pass name (required) plus optionally a format (aspectRatio/fps/resolution) and brandKitId. brandKitId binds a brand kit to the PROJECT (pass the kitId from create_brand_kit): colors/fonts/motion theme every render of this project automatically (omit it and the output is unbranded). Bind or change it later via update_project (PATCH /projects/:id over REST). Returns the ProjectResponse (id + metadata).

Create a NEW composition (a new video) inside a project — a project is a workspace that holds many videos. Returns { compositionId, format, etag }. Pass an optional name and format (aspectRatio/fps/resolution); format defaults to the project's compositionFormat. The first composition becomes the project's active default. To author it, seed with apply_composition then compose({ fromComposition: true }) — your authored graphics ride as locked clips, carried verbatim; to render a specific one, pass its compositionId to create_render. (For a reframed sibling in another aspect, use derive_composition.)

READ BACK a composition as JSON — the edit itself: tracks, clips, card HTML, reframe segments, captions, markers, format. This is what create_render encodes, so it is also what you hand to validate_composition (which needs a full inline composition body), what you diff after an edit, and what you archive/share so someone else can re-render the SAME video. Read-only and free. Authoring stays op-based (apply_composition) — do not round-trip this object back as a write. A composition too large to fit one MCP result degrades to a STRUCTURAL SUMMARY (every track and clip still listed; card html and caption words elided as lengths) with a header saying so — read it over REST if you need the verbatim body. Defaults to the project's ACTIVE composition; pass `compositionId` to read a specific one (the same id apply_composition takes as `composition_id`, and preview_frame / create_render take as compositionId) so an A/B variant can be read back, not just written. The result includes the exact HTTP etag string; copy it to apply_composition.body.if_match (the numeric revision is not an ETag). In a compose session this reads the session's scratch, the composition its edits, previews and renders target. Pass includeDependencies="true" on a v1 guarded endpoint to read composition_id, revision and dependency tokens. With componentExecutionVersions=["3","4"], this envelope also returns expectedBrandIdentity from the persisted project authority; carry it unchanged into the matching negotiated write. Preserve those observed tokens when authoring; never refresh the basis to hide a conflict. BOTH shapes carry `needsUpgrade` when clips are stored in a retired form (unpinned or TSX component placements, removed primitives): each entry names the clipId, the kind and, when one exists, the native successor pin — move those with repin_component and rebuild the rest with create_component; such a composition will not save or render as-is. Absent when nothing needs upgrading.

List every composition (video) in a project, with its format and which one is active. Use a returned compositionId with create_render(compositionId=...) to render a specific video, or apply_composition to edit it.

Delete a composition (and its version history) from a project. REFUSES the ACTIVE composition (409) — make another one active first, or delete the project. Use list_compositions to see which is active.

List your projects — re-orient in an existing workspace instead of minting duplicates (steady-state entry, A9). Each row carries the id every other tool needs.

Derive a reframed SIBLING composition for a different aspect ratio (the agent-native Auto-Reframe / Magic-Resize). Pass projectId + body { fromCompositionId, targetFormat: { aspectRatio, fps?, resolution? } }. CueFrame copies the source composition's authored intent and content-aware-reframes every clip for the new aspect (point/face/active-speaker focus), then saves a new independent composition in the same project. Returns { compositionId } — render it with create_render, or refine it with apply_composition. Use this to make 9:16 + 1:1 + 4:5 cuts from one 16:9 edit. (To only change resolution within the SAME aspect, pass create_render.format instead — that is a scale-only export override, not a new composition.)

Import a media item into your library from a public URL — the agent-friendly ingest path (single call, no upload protocol). Pass url (https) + filename (+ optional contentType). Returns { id, status:"importing" }. Processing is async: call wait_job(kind="media", id=mediaItemId), or register a webhook (create_webhook on media.completed — status: complete|failed rides the payload). Use the returned id with get_media_context, suggest_briefs, or as a composition source.

Generate one first-class Library media item from a prompt. Choose generator: text-to-video | text-to-image | image-to-video | text-to-music | text-to-speech | text-to-sfx | auto. Put supported presentation controls in body.style and first/last/image references in body.refs. Returns { id, status:"generating", estimateUsd? }; returns 402 if the estimate exceeds the per-call ceiling. Async — call wait_job(kind="media", id=mediaItemId) or use a webhook (media.completed — status rides the payload). Use the returned id like any other media item.

Ingest a LOCAL file — bytes you hold, when there is no public URL to hand import_media (prefer import_media whenever the bytes already sit at an https URL). TWO steps: (1) this tool reserves a media item and returns { id, uploadUrl, expiresAt } — a short-lived PUT URL. PUT the raw file bytes to uploadUrl over HTTPS with your declared Content-Type (≤ ~5 GB per PUT). (2) call finalize_upload({ mediaItemId: id }) to start processing. Body: filename, contentType (allowed enum), size (bytes). Thereafter it is async exactly like import_media: poll list_media for processingStatus, or register a webhook (create_webhook on media.completed). Use the returned id with get_media_context, suggest_briefs, or as a composition source.

Finalize a direct upload once you have PUT the bytes to the uploadUrl from create_upload. Confirms the bytes landed and starts ingest: image/asset become ready immediately (status "complete"); audio/video enter processing (status "processing"). Returns { id, status, processingPhase }. 400 if no bytes were uploaded (PUT first) or the item is not yours. Then call wait_job(kind="media", id=mediaItemId), or use a media.completed webhook.

Search licensed stock media to compose with across video, photo, sound effects, and GIFs. Pass query for ONE search, or queries[] (≤10) to run them all in a SINGLE call — strongly prefer the batch when you know several things you need. A batch returns results[], one per query in order, each with its own candidates; a query that fails carries an error and never discards the others. Optional kind [default video], provider pin, and limit ≤50 apply to every query in the batch. Returns ranked candidates, each with an opaque candidateId + attribution (author, assetUrl) + license, and a preview URL in the text. FREE + rate-limited + cached — reach for this before generate_media when real footage beats synthesis. TO SEE the candidates rather than read about them, pass limit ≥2: thumbnails/audio are attached only when you asked for options to compare. Import a chosen candidate into a project with import_resource. Candidate handles expire; re-search to refresh one.

The fonts the RENDERER can actually draw — read this BEFORE authoring type, not after a refusal. Per family: the exact family name authoring accepts, the weight RANGES a shipped file declares (a static face has min===max; a variable face gives its axis range), the caption default weights, and whether the bytes are bundled or an aliased metric-compatible stand-in. Anything listed here passes validation by construction: it is derived from the same table the font gate refuses by. Two facts worth reading off it — every family's `styles` is ["normal"], because NO bundled family ships an italic FILE (a real italic comes only from a brand-kit font asset), and a weight outside every range is REFUSED, never synthesised. Contrast search_fonts, which searches the GOOGLE catalog and will happily return families the renderer cannot draw. `manifestVersion` identifies this exact face table; record it beside a composition to state what a font choice was validated against. Covers the bundled set only — a brand kit's sealed faces are per-org and per-render. No args, read-only, free.

無需輸入參數。

Search web font families by name/style — returns family names to use in composition/component params. Pass query (+ optional perPage ≤50). Read-only + free; surfaces the Google Fonts catalog (family + category + variants + css2 stylesheet URL). IMPORTANT: this searches the GOOGLE catalog, not what the render can actually draw. Only the faces vendored into the render page are guaranteed to rasterize; naming any other family gets you the generic fallback (Liberation Sans) with no error. Call list_render_fonts for the set you may actually choose from, WITH the admitted weights per family — treat that, not this catalog, as the list. An empty result set here means no match, or the upstream catalog was unavailable.

Import a stock candidate (candidateId from search_resources) into a project as an ORG-OWNED media item — provider/externalId/license provenance preserved, bytes deduped across orgs. Pass projectId + candidateId. Returns { id, status:"importing"|"ready" }; processing is async — call wait_job(kind="media", id=mediaItemId), then use the returned id as a composition source. Gated on the resource_import plan feature (402 billing_required if your plan lacks it). COST: 0 credits — search and import are both free for a keyed caller (get_account → entitlements.resource_import.listUsdPerUnit is 0); imported bytes count toward the storage gauge. 422 candidate_mismatch if the candidate expired — re-run search_resources.

Run AI clip-suggestion analysis on a long-form media item — the CLIPPING path (find the best short-form moments). Returns { status, alreadyRunning? }; then wait_job(kind="suggestions", id=mediaItemId) — its terminal lists each suggestion WITH its briefId. When the media belongs to a PROJECT, each finalized suggestion is promoted to a kind-'clip' BRIEF (its window pinned as a beat) — list_briefs {kind:"clip"} shows them and compose({ briefId }) runs the flagship path from one. Project-less media: pass the suggestion id to compose({ suggestionId }) directly. Clipping is a vertical, NOT the general path.

Register a webhook so long-running jobs notify you instead of blocking on wait_job — the right pattern for fan-out/async agents. Pass url + events — ONE terminal event per job kind with status INSIDE the payload (render.completed, compose.completed, media.completed, suggest.completed) plus checkpoint.ready (a held compose paused for review). DELIVERY: a POST { event, timestamp, projectId?, data } with Standard-Webhooks headers (webhook-id, webhook-timestamp, webhook-signature: v1,<base64>); the secret (whsec_<base64>) is returned ONCE — verify the RAW body with new Webhook(secret).verify(rawBody, headers). ACTIVATION is synchronous: CueFrame POSTs a signed webhook.verify challenge and your endpoint must reply 2xx echoing data.token — otherwise it returns status:"pending" and receives NO events (recover with verify_webhook, no delete/recreate). Read the cueframe://webhook-events resource (or GET /webhooks/events) for the full contract + every event's data shape BEFORE building your receiver.

Re-run ownership verification on a PENDING webhook — one whose endpoint did not echo the challenge at create time (check its verification.reason: token_not_echoed / non_2xx_<code> / unreachable / ssrf_blocked). After you fix the receiver to reply 2xx echoing data.token, call this to re-send the signed webhook.verify challenge and flip it active IN PLACE (id + secret preserved — no delete/recreate). Returns { id, status:"active"|"pending", verification? }. An already-active webhook returns active unchanged.

The org's legible taste in ONE read: brand kits, registered critics (the machine-checkable standard both the Director's gates and score_composition enforce), their reference media (presigned thumbnails), the recent checkpoint-decision log, and the learned `taste` (style preferences saved with remember_taste). Read this BEFORE composing for an org you haven't worked with — it is the house style. Learned taste is advice: the current request, brief, project, brand kit, exclusions and critics take precedence; name any conflict.

無需輸入參數。

List registered critics: criticId, label, tier (rules|rubric|evaluator), phase, floor, referenceMediaIds. Rubric text / rules / evaluator URLs are write-only — never echoed. Manage with register_critic (upsert) / delete_critic.

無需輸入參數。

Delete a registered critic by its criticId. It stops running in the Director gates and score_composition immediately.

Save one durable style preference to the org's learned taste, with its source (the job, checkpoint or chat, plus the date). Only for a preference the user stated: a revise comment, a chat correction or an explicit "remember this"; never one-off brief content, footage facts or secrets. Tell the user what you saved and that they can say undo (forget_taste). Saving text the org already holds changes nothing. Refused, never truncated, past 2,048 bytes per entry or 4,000 characters per org, or while the owner has learned taste off; a refusal is final. get_profile returns the saved entries as `taste`.

Read the org's learned taste: whether the owner has it on (`enabled`) and its saved entries, oldest first. While `enabled` is false, do not apply the entries. Learned taste is advice: the current request, brief, project, brand kit, exclusions and critics take precedence.

無需輸入參數。

Delete one entry from the org's learned taste by its id (from get_profile `taste` or remember_taste). This is how the user's "undo" works.

Register a custom eval into the compose critic panel — the critic contract is { rubric (or rules/evaluator), referenceMediaIds?, floor }. Three tiers: rules (declarative constraints — keep-out regions, required elements, max overlays, brand colors), rubric (a text criterion scored by the judge as an extra column), or evaluator (your HTTPS webhook — CueFrame POSTs the composition+stills+facts, you return { score, critique }). referenceMediaIds (≤6 org media ids) attach YOUR reference frames as the standard — the judge scores candidates for consistency with them, so "indistinguishable from mine" is a machine check. Lane scope: rules + rubric critics run in BOTH lanes (the Director's gates AND standalone score_composition); evaluator webhooks run in the Director lane only. Use phase 'static' (the default) — 'temporal' (final-render evaluation) is accepted but not yet wired, so a temporal critic produces no verdicts today. A low client score drives a refine like a built-in criterion. You see your eval output + our scores, never our rubric. Re-registering the same criticId upserts (list_critics / delete_critic manage the set). Evaluator tier returns a signing secret ONCE.

Update a project's mutable fields (e.g. name, format, brandKitId). Pass projectId + the changed fields as `body`. Setting brandKitId binds/changes the project brand kit so every render of this project themes from it. Returns the updated ProjectResponse.

Permanently delete a project you created (cleanup). Removes its composition and render history. Irreversible — only call on a project you own and no longer need.

Permanently delete a media item from your library (cleanup). Irreversible. Compositions referencing it will fail to render — only delete media no composition still needs.

Update an authored component's complete version-4 source/metadata IN PLACE (same id) — the correct verb for the author→preview→fix loop (preview_component returns the admission or runtime error; fix the template here and re-preview, instead of creating a new component each iteration). Pass componentId + the changed fields as `body`. Same source contract as create_component: {version:4, componentId, template, manifest, definition}, admitted before the write; the template finds its root with document.getElementById('root'), and declared slots arrive in the scene's `assets`, never params. PLACED CLIPS: every placed clip renders the exact version it pins, so an update moves placed clips ONLY when you name a project — put `projectId` (and optionally `compositionId`; default the project's active composition) in `body`, and that composition's placements move to the new version in the same write. The answer carries `repinned` (what moved) and `placementsPinnedToPrevious` (placements across the org still rendering the previous version). Without `projectId` nothing placed moves: previews and renders of an existing clip keep the old version. For one placement, register the source WITHOUT projectId, read its immutable sourceVersionId, then use apply_composition clip.update to change only the selected clip source and exact pin under observed concurrency expectations. Explicit-project update_component admits and repins all matching placements in that composition; use it only when that broader edit is requested.

Move clips stored in a retired form to their native (version 4) successors: a clip pinning a retired TSX (version 3) component, or one stored before execution pins (`needsUpgrade` kind `unpinned-component`), moves to the `successorSourceVersionId` that get_composition's `needsUpgrade` (or a `component_source_retired` refusal) names. Pass projectId and, in `body`, optional `clip_ids` (omit them to move every clip that has a successor) and `composition_id` (the active composition when omitted). Saved inputs are kept. The answer lists `moved` and `withoutSuccessor`; rebuild the latter as native components (create_component, then apply_composition at the same timing and placement). A retired clip with no successor must be rebuilt or removed in the same write that upgrades the others: a write never leaves one in place.

Update a webhook subscription (its url or event list). Pass webhookId + changed fields as `body`. The signing secret is NOT rotated here.

Delete a webhook subscription (stop receiving its deliveries). Irreversible — the signing secret is invalidated.

Cancel an in-flight render (stop a runaway/queued job). Needs projectId + renderId (from create_render). No-op if already terminal.

Cancel an in-flight compose job (stop a runaway/mis-priced ensemble). Needs projectId + composeJobId (from compose). The director cancel is confirmed before the row flips; any linked charge is released. No-op-reject (422) if already terminal.

Cancel a running async job (verify / preview / brand-kit-extract) returned by an enqueue call — abort a mis-priced job instead of waiting out its TTL. For box-backed jobs the warm box is reaped best-effort; cancel never meters. No-op-reject (422) if already terminal.

Cancel an in-flight NLE export (fcpxml/premiere). Needs projectId + exportId (from the export enqueue). No-op-reject (422) if already terminal.

Re-render an existing render job's FROZEN composition snapshot — it inherits that job's exact composition/intent/priority and queues a fresh renderJob; it does NOT re-read the project's current composition. So it only helps a TRANSIENT failure (the failed render's `retryable:true` / `category:"transient"` — a flaky pipeline/infra fault): re-attempting the same snapshot may succeed. For a DETERMINISTIC failure (`retryable:false` / `category:"authoring"` — a bad param, an unresolvable media/brand ref), retry_render reproduces the SAME failure: FIX the composition first via apply_composition, then create_render (a retry alone is futile). Check `retryable` on getRender / wait_job to pick the path. Returns the new render; then wait_job(kind="render", id=<new id>).

ORIENT FIRST — show THIS key's account before you spend a metered call: the org it is bound to, the current plan, a per-feature entitlements map, and per-call cost ceilings. READ `balance`, NOT `included`. CueFrame is credit-funded: rendering (entitlements.exports), generation (generate), preview stills (compose_capture), the judge (compose_verify) and the Director (compose) have NO separate per-plan allowance — they all spend one shared wallet, named in `fundedBy` (`credits`; generation is metered in provider-cost units against that wallet). Each `balance` restates that ONE wallet in that feature's own unit at `creditCost` credits per unit, so they are alternative ways to spend the same money, not four budgets. Each entitlement also carries `listUsdPerUnit`: the dollar quote for ONE unit before you call (0 = a plan grant that draws no credits, e.g. resource_import — stock search + import are free; null = not quotable up front). Check the requested cost against the balance. For generation, also check generationLimit: free accounts have a separate provider-cost cap even with a positive wallet. A billing_required error with reason free_generation_cap requires a credit-pack purchase through normal checkout. `included:false` means the plan genuinely lacks the feature. Every new org starts with a free credit grant, so an account with an empty usage history can still render, generate, preview and score. costCeilings.generateMediaUsdPerCall is the generate_media per-call USD cap. No args — identity is resolved from your key (never echoed from input).

無需輸入參數。

List the plan catalog (tiers, intervals, product ids, prices) BEFORE a checkout, so create_checkout requests a real {plan, interval} instead of guessing an id. No args — reads the platform catalog.

無需輸入參數。

The A2 usage ledger: every metered billing event newest-first with attribution — featureId, amount, the project/job that produced it, and the event's LIST price in USD (a plan allowance may zero it on the invoice). Answer "what did project X cost this period?" with a query instead of summing your own quotes. Filter by projectId, jobId, and/or a [from, to) epoch-ms window. Requires the billing:read scope.

Top up the CURRENT org's credit wallet. Body { plan: "credit_pack_10"|"credit_pack_30"|"credit_pack_100" } → returns { url }: a hosted Stripe checkout page to open in a browser and confirm payment. There are no subscription tiers — a pack is a one-off top-up, and it is also the only thing that raises the generation (premium_credits) allowance. Always a URL — an existing saved card is NEVER charged silently; the human confirms on Stripe. The org is resolved from your key, never the body. Requires the billing:write scope. Only send a user here when get_account shows the relevant `balance` at or near zero. Discover the packs with list_plans.

Create or UPSERT a brand kit (re-POSTing the same kitId updates it in place — this is also the brand-kit UPDATE path). Sets fonts/colors/logo. This is brand step 0 of the workflow: author the kit, then bind it to a PROJECT so colors/fonts/motion theme the output AUTOMATICALLY — pass its kitId as brandKitId to create_project, or attach it to an existing project via update_project (PATCH /projects/:id over REST). Without a bound kit, create_render produces UNBRANDED output. Tenant-scoped (no project arg).

Queue brand-token extraction from a website URL — ASYNC: returns a jobId immediately; then wait_job(kind="brand_kit_extract", id=jobId) for the tokens (colors/fonts/title/description, fetched + regex-parsed from the site's HTML/CSS — NOT a screenshot/vision pass). It does NOT persist — review the tokens, then call create_brand_kit to save a kit. A blocked (private/SSRF), non-2xx, non-HTML, or slow (>20s) URL degrades to EMPTY token arrays (a succeeded job) rather than erroring — JS-rendered SPAs typically extract empty; author the kit manually from the compiled CSS in that case.

Discover the exact CompositionOp vocabulary accepted by apply_composition. Omit type for a compact list of operation names and descriptions; pass type for only that operation's JSON Schema. Read this before authoring edits or captions.

Create a new project from a catalog or org template. The server prepares media and verified mattes before the project is ready. Pass the returned jobId to wait_job(kind="template").

Wait for a long-running job and return the resolved result — a bounded long-poll. Includes template preparation (kind="template", id=jobId), media import, render, compose, consult, suggestions and preview. If still running, call wait_job again with the same arguments; work continues server-side.

Render ONE authored card on its own and SEE it, before placing it in a composition. Pass the same `html` (+ optional `tokens`) you would put in a {kind:"card"} clip; you get the still back as an image. Use this while writing a card — it is the fast loop for catching type that overflows the frame, a headline that collides with a logo, or tokens that did not resolve. Sized to the format you name, so what you see is what that aspect ratio will show. To judge MOTION rather than layout, shell the card with a motion preset and use preview_clip.