* fix(engine): a muted video no longer plays at full volume in renders that skip the browser probe
A <video data-has-audio="true" muted> with an audio stream is silent in
preview and in renders that run the browser probe, but a render that
skipped the probe mixed it at volume 1.0, ignoring data-volume. The audio
parser drops muted videos; the video parser kept hasAudio from
data-has-audio alone, so the auto-detect fallback re-added the sound.
The video parser now asks the same isAudibleVideoElement check.
* style(producer): format the muted-video parity test
* perf(producer): multi-worker mp4 renders start encoding while frames are still being captured
On the multi-worker disk capture path the encoder used to start only after
every worker had finished. It now starts with capture and is fed frame 0, 1,
2... in order as each frame file lands, with the same encoder arguments, so
the output is byte-identical and the encode left after capture is shorter.
Off for drawElement capture (a failed self-check discards every frame) and
for png/gif/webm/mov/HDR/GPU/chunked/HLS output. If the overlapped encode
fails, the frames are encoded after capture exactly as before.
* perf(producer): encode during capture only when a core is spare for the encoder
With every core busy capturing, the encoder only slowed capture down, so the
overlap now runs only when the render uses fewer workers than the CPU count
worker sizing sees. Also pins the reviewed producer test-lane source hash and
drops an added comment line.
* refactor(producer): shorter comments on the encode-while-capturing helpers
* fix(studio-server): keep transparency in proxies of VP8/VP9 alpha webm
A webm whose alpha lives in the VP8/VP9 side channel (alpha_mode=1,
pix_fmt yuv420p) was proxied to opaque H.264, and the VP8 proxy path
decoded it with ffmpeg's native decoder, which drops alpha. The alpha
rule and the alpha-reading decoder now live once in
@hyperframes/parsers/media-alpha, used by engine and studio-server.
* build(parsers): raise the packed size budget for the media-alpha subpath
parsers already sat at its packed budget on main; the shared alpha rule
adds 676 B of JS and 803 B of declarations (190958 B packed in CI).
* chore: release v0.8.182
* chore: list #5953 in the v0.8.182 notes
* chore: add #5843, #5932 and #5945 to the v0.8.182 notes
* chore: add #5923, #5943, #5956, #5960, #5961, #5963, #5964 and #5966 to the v0.8.182 notes
* chore: add #5972, #5977, #5981 and #5982 to the v0.8.182 notes
* chore: add the 13 PRs merged since the last refresh to the v0.8.182 notes
* chore: add #6003, #6005 and #5579 to the v0.8.182 notes
* chore: add #6006 to the v0.8.182 notes
* fix(lint): place each scene's audio at its host's start in the audio overlap check
* fix(lint): drop internal tags from two comments
* fix(lint): check audio in scenes chained by a reference start
* fix(engine): cloud renders fail instead of going silent when an audio read is cut off
* fix(engine): cloud audio reads of a file whose audio ends early no longer fail
* test(engine): the audio link test's media setup passes the ffmpeg argv contract
* perf(producer): cloud render chunks hand Chrome each video near the size it is shown
A chunk now measures the largest box each video is drawn in over its own frames,
in device pixels, before extracting that video's frames, and halves the frames
while they still cover that box. Graded videos, pages with a canvas, and
object-fit none/scale-down keep full-size frames.
* docs(engine): shorten the shown-box measurement comment
* refactor(engine): name the halving filter instead of commenting it
* test(producer): end ffprobe options before the frame path in the shown-size tests
* fix(engine): renders use the browser the CLI picked; Linux system Chrome is not beginframe
* fix(cli): state the browser env rule without its history
* fix(engine): renders from the CLI launch the browser it picked, not the engine config's
* fix(producer): a render no longer ends early on a frame it cannot read
Frame-sequence encodes pass -xerror so an unreadable frame fails the encode
at that frame with the OS error, instead of ffmpeg ending the video there and
exiting 0. macOS keeps render scratch in the system temp folder, as Windows
does, so a synced project folder never sees the captured frames.
* fix(producer): a render refuses to publish a video smaller than it asked for
The final output check compares the encoded width and height with the
requested size. A non-native --resolution with HDR footage is refused before
calibration launches Chrome, and the refusal names --sdr or the project size.
* fix(engine): a frame read failure reports the OS error on every platform
ffmpeg prints the unreadable file and the OS reason on separate lines; on
Windows the file line comes first, so reporting only the first match dropped
the reason.
* test(engine): stream start offset fixture cleanup gets the 30 s budget
Its afterAll removed the fixture media within vitest's 10 s default and timed
out on a Windows runner after all 16 tests passed. Real-ffmpeg fixture cleanup
gets 30 s everywhere else (#5368).
* fix(cli): snapshots, compare and check wait for late images the way render does
* fix(cli): check runs its browser pass inside a macOS sandbox that does not name itself
Every CLI Chrome launch has used a pipe since the warm-check change. A pipe
launch that a seatbelt kills fails with only "Protocol error
(Target.setDiscoverTargets): Target closed". The one-process fallback keyed
on Chrome's bootstrap_check_in stderr, which a pipe launch failure never
carries, so it never fired. On macOS a pipe launch that fails at the
protocol level now relaunches as one process over the pipe.
* fix(cli): retry only a pipe launch whose connection closed, and keep puppeteer lazy
* perf(producer): the true-peak correction of long audio encodes in parallel segments
* perf(producer): a cloud plan corrects its audio peak from the mix itself, one lossy pass
* fix(producer): only the PCM-sourced peak correction splits; AAC input stays one encoder
* perf(engine): cloud renders cut a video's audio from its URL instead of downloading the file
* refactor(engine): keep the audio mixer's comment share at the base
* fix(engine): a cloud-held file's audio probe retries once, then fails instead of mixing unprobed
* fix(engine): a cancelled probe is not retried, and the encode test noise is seeded so it repeats
* fix(engine): a sharp sound in a film's first moments no longer grows louder with each audio pass
Every AAC encode now starts in digital silence that is dropped afterwards. Opening cold on quiet sound, the native encoder coded the first loud frame three scalefactor steps hot (4.5 dB), and each re-encode (pad, true-peak correction) did it again.
* fix(engine): AAC encodes stay in step with audio that is not 48 kHz before the encoder
* test(producer): regression goldens for audio that now opens without the encoder's cold start
* perf(cli): commands run without esbuild, puppeteer-core or sharp until they need them
A host that bundles the CLI can now leave these packages out: each command
loads them only where it uses them, and sharp installs once on first use when
it is missing. The build check fails on any static import of them again.
* fix(cli): use a host's sharp from NODE_PATH and let hosts turn first-use installs off
* fix(cli): capture fails when sharp is missing, and one install serves every caller
A missing sharp now stops the asset download up front instead of counting every
image as unavailable. Concurrent first uses share one install, a failed install
is not retried in the same run, and preview thumbnails report why. Hosts can turn
off installs for a list of packages, e.g. HYPERFRAMES_NO_OPTIONAL_INSTALL=sharp.
* fix(cli): snapshot --describe still works without sharp, resizing only when it is installed
* style(cli): format the sharp loader and its tests
* build(cli): sharp is an optional dependency, so a host can ship the CLI without it
* build(studio-server): keep sharp out of the bundle now that it is optional
* test: queue runs on slow windows runners stop failing four timing tests
* test(cli): the keepalive process test budgets for a cold start on a slow runner
* perf(producer): the plan's true-peak check runs in parallel segments
The plan's -1 dBTP check ran one single-threaded ebur128 pass over the whole
mix. It now scans fixed segments in parallel and reports the same printed
value: each later segment starts one 100 ms block early and drops that block
(the oversampler's mirrored start can invent a peak, and a scan never measures
its last 16 samples); the last segment falls back to one whole-file pass when
its dropped block alone could be the loudest. Segments decode from the file
start, since the AAC decoder carries noise-substitution state.
* fix(producer): a true-peak scan with no summary fails instead of reading 0 dBFS
A run whose stderr has no Peak line threw before the parser moved; it
parsed as 0 dBFS after, which would lower and re-encode audio that was
never measured. It throws again. When one segment scan fails, the others
are stopped, and only 48 kHz audio is split into segments, since ebur128
resamples any other rate.
* docs(producer): shorter true-peak doc comment
* fix(engine): long 4K video exports no longer time out while frames are still coming
* test(engine): the paced extraction test keeps a wide margin on a loaded runner
* fix(engine): long phone-video exports probe each source once instead of once per cut
* fix(engine): a failed source probe is retried, and probes share the extraction slots
* test(engine): synthesize the tone-mapped concurrency fixture with known input colour
* chore: release v0.8.180
* docs(release): describe chunk sub-ranges as groundwork for split retries
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: release v0.8.180 notes list the empty-frame fix
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>
* revert(engine): render workers keep the media of FFmpeg-fed videos loaded again
This reverts the behavior change of #5795 (6ed89a1e4). Releasing the media of
videos whose frames come from FFmpeg leaves some worker pages that never paint,
so parallel renders fail intermittently with "Invalid JPEG input at frame N:
empty frame". The shared loopback test fixture it added stays: later tests use it.
* chore(ci): agree the deletion of the reverted release test
* fix(cli): check and snapshot use the pinned Chrome, not an older one another tool cached
* fix(cli): keep the browser-order comment within the line limit
* fix(engine): renders that resolve their own browser follow the same pinned-first rule
* fix(engine): keep the browser rule's reasoning in the PR, not new comments
* fix: a shared-cache shell is used only if it starts, after the pinned build
* fix(engine): import the shared-shell pick, and probe shells with a blank page
* fix(skills): caption scripts launch the browser the CLI chooses
* chore(skills): regenerate the skills manifest for the caption scripts
* perf(producer): distributed chunks download only the videos they show
A project video under compiled/ that chunks extract their own frames from
now goes only to the chunks that show it, like video-sources/ files. A
chunk skips the readiness wait for a deferred video it does not show, so
it no longer logs media_load_failed for a file it was never given.
* fix(producer): cloud site uploads pack the files their id hashes, symlinks included
* perf(aws-lambda): chunks read only the byte ranges of a video they need
A chunk that extracts its own frames from a deferred project video now
reads it from S3 by byte range through a short-lived pre-signed URL,
instead of downloading and hashing the whole object first. S3 attests the
object's stored SHA-256 before the URL is signed; every other artifact is
still downloaded and verified as before.
* perf(aws-lambda): upload project files once to a shared content-addressed area
* chore(producer): keep planV2 comment share at the base level
* fix(engine): verify the TLS certificate of https video inputs and never surface their signed query
* fix(aws-lambda): renders re-upload a site's expired files instead of failing
* perf(aws-lambda): the plan step probes project videos in place instead of downloading them
* fix(engine): https video reads reconnect and time out, and redaction covers wrapped causes
Signed-URL reads now pass -rw_timeout, -reconnect and -reconnect_delay_max (both Lambda builds accept them) and ffmpeg also -reconnect_on_network_error, so a transient S3 error or a stalled read fails fast or recovers instead of waiting out the process timeout. Query redaction now descends into error.cause.
* fix(aws-lambda): share entry bundles and ratchet package budget
* fix(aws-lambda): site ids uploaded before files.json still render
A site id from an earlier sites create has only sites/<id>/project.tar.gz.
renderToLambda now falls back to that tarball, which the plan step still
reads, and when neither key exists it fails before starting with both keys
named and the fix (run sites create again).
* fix(aws-lambda): renders fail before upload on a stack too old to read sites
A stack deployed before files.json sites untars the site file in its plan
step and fails after four retries. renderToLambda now reads the state
machine definition first and stops with STACK_TOO_OLD and the redeploy
command when the plan task does not list SITE_MANIFEST_INVALID, which new
SAM and CDK stacks now treat as terminal. The README's upgrade section
drops the planProtocol v1 fallback, which hits the same failure.
* docs(aws-lambda): document shared content storage and the upgrade path
The deploy guide still described the tarball HeadObject short-circuit. It
now covers the cas/sha256/ store and its 30-day lifecycle rule, the
STACK_TOO_OLD, SITE_FILES_MISSING and SITE_NOT_FOUND errors, that old site
ids keep working, and that every project uploads once more after the
upgrade. A test keeps a troubleshooting entry for each pre-submit error.
* fix(producer): chunks log each video they read by URL, without its query
A chunk reading a video straight from the bucket left no trace in its log.
It now logs one line per remote source with the path and the URL minus its
query string, so signatures never reach the log.
* fix(engine): ffmpeg errors never keep part of a signed URL's query
A process's stderr tail was trimmed before its URLs were redacted, so a
cut inside a signed URL left a query fragment the URL pattern no longer
matched, and the fragment reached the error. The stderr tail is now
redacted before every trim, and the redactor also strips a signing
parameter cut off from its URL.
* fix(aws-lambda): comments name the site manifest instead of a file path
* fix(engine): stderr redaction survives chunk splits, and every ffmpeg spawn uses it
The stderr tail was redacted on each chunk and then cut, so once a cut
severed a long URL's scheme, the rest of its signature in the next chunk
matched neither pattern. The tail is now kept raw with 2x slack and
redacted only when the text is produced, then cut to size. The unused
producer audioExtractor (its own spawn, unredacted stderr) is deleted and
the parity harness's PCM decode goes through ManagedChildProcess; a test
fails on any ffmpeg/ffprobe spawn in engine, producer or aws-lambda that
does not.
* chore(producer): record the audioExtractor deletion as intended
* fix(engine): drop a signature fragment the stderr tail cut from its URL
The raw tail is kept at twice the cap, but that cut can itself land inside a
signature, and when redaction shrinks the rest below the cap the fragment
survived. After a cut, the severed token is dropped before redaction.
* refactor(engine): name the severed-token drop instead of commenting it
* test(engine): a cut-off URL leaves nothing behind; aws-lambda size budget to measured
* fix(producer): chunk URL-read tests use main's frame list; producer size budget to measured
* chore(producer): size budget at the measured size, no headroom
* chore(producer): size budget back to measured x1.05, the check's own rule
* fix(engine): SDR content in HLG exports sits at reference white, not peak
The sRGB to HLG conversion for DOM layers fed SDR-relative light straight into the HLG OETF, whose input is light relative to the HLG peak, so SDR white landed at 100% signal. Graded HLG footage (graded as SDR, then converted back) and every white overlay were pushed to peak and blew out. SDR white now sits at 75% HLG signal (BT.2408), the same model the PQ branch uses with 203 nits.
* docs(engine): shorten the SDR-white note in the HDR LUT
* docs(engine): cut the LUT generator's notes to its usage and drift rule
* perf(producer): assemble chunks that carry audio under one faststart index
Reads each chunk's moov, merges the sample tables into one moov at the front, and writes
the chunks' mdat payloads after it unchanged: the same bytes storage can copy into place.
The assembler no longer needs the plan audio for such plans.
* perf(aws-lambda): build the final mp4 inside S3 with its index up front
The Lambda plan asks chunks to carry their audio. Assemble writes the faststart header as
part 1 of a multipart upload and copies each chunk's mdat payload with UploadPartCopy, so
the video bytes never pass through the function; any failure aborts the upload.
* fix(engine): a chunk's first frame shows its own time, not the composition's opening frame
* fix(producer): stitch silent AAC tails and clean failed outputs
* fix(producer): open stitched chunks read-only with an explicit mode
* chore(aws-lambda): raise the package size budget for S3-side MP4 assembly
handler.js and index.js each bundle the new S3 stitch code (+5,550 bytes apiece) and s3Stitch.d.ts adds 970: +3,479 packed and +12,070 unpacked over main, measured with the CI pack. The budget rises by exactly that delta.
* fix(aws-lambda): v1 plans give chunks their audio too, so both protocols match
* perf(producer): plans whose chunks carry audio encode it once, at the frames' exact length
* test(producer): terminate the plan audio ffprobe argv like every other probe
* fix(engine): SDR exports carry BT.709 transfer and primaries with every encoder
The SDR conversion filter set the BT.709 matrix on its frames but not the
transfer or primaries. Encoders that take colour from the frames rather than
from -color_* options (VideoToolbox on macOS) wrote color_space=bt709 with
color_transfer and color_primaries unknown. The capture and raw-input SDR
filters now end in the tagged BT.709 filter ProRes already uses.
* fix(engine): HDR exports tag BT.2020 with PQ or HLG on the frames too
VideoToolbox HDR encodes had the same gap as SDR: given only -color_* options
it wrote bt2020nc with transfer and primaries unknown, so players read the
export as SDR. Every HDR branch of the streamed and disk encoders now tags the
frames through one hdrFrameTagsFilter built from the encoder colour params.
* test(engine): colour-tag probes pass -- before the output path
* fix(engine): a 29.97 fps camera clip exports smoothly at 30 fps
Extraction samples each output frame from the last source frame starting at
or before it. Millisecond container ticks move each frame by up to half a
millisecond, while 29.97 fps drifts against 30 fps by 0.033 ms per frame, so
the rounding decided the slot and the export alternated repeats and skips.
Constant-rate frames are now re-spaced on the stream's own frame grid from
the first decoded frame before sampling. The cache schema moves to v8 so
exports stop reusing frames extracted the old way.
* fix(engine): every extraction process snaps frames to one absolute grid
The grid was anchored on each process's first decoded frame, which carries its
own millisecond rounding, so a segment or distributed chunk could place the
29.97 -> 30 repeat elsewhere and skip a frame at its seam. Frames are now
snapped to the stream's own grid in file time (this process's seek plus the
video's lead), the same in every process.
* fix(cli): check and snapshot wait for a slow CDN script as long as render does
check, snapshot, layout, motion-shot and validate gave the page 10 s to reach
DOMContentLoaded while render gives it the engine's page-navigation timeout
(60 s), so a parser-blocking script from a slow CDN failed the diagnostics
with "Navigation timeout of 10000 ms exceeded" on projects that render fine.
The separate 10 s budgets are gone: every caller takes the engine's value
(and its env override), raised only by a command's own longer --timeout.
The cold-Chrome allowance for sending the first request is unchanged.
* fix(cli): check and snapshot read only the page-load budget from the engine
resolvePageNavigationTimeout() owns the page-navigation env read for render
and the diagnostics, so check and snapshot no longer resolve the whole render
config, which printed render's Windows streaming-encode warning. validate's
comment and timeout hint now say render shares the budget.
* perf(engine): long renders encode their audio in parallel segments
* fix(engine): parallel audio encode counts packets from whole samples
The expected packet count came from a floating-point duration, so frame-aligned lengths such as 147.52 s (one ulp above 7080960 samples) expected one packet more than the encoder writes, the last segment check threw, and the render lost its audio. Round to whole samples first; a 147.52 s test fails without the fix.
* fix(gcp-cloud-run): the BeginFrame contract image resolves the engine's core import
The engine config imports the distributed fps set from @hyperframes/core, and the contract stage of the GCP image copies only parsers and engine sources, so the import failed at build time. The set now lives in a small core subpath (@hyperframes/core/distributed-fps) that the engine imports like its other light core imports, and the contract stage copies core like parsers. The core root export is unchanged.
* style(core): format package.json
* perf(producer): assemble in one pass and keep its disk use under one output copy
The distributed assembler joined the chunks into a full-size file, muxed the
audio into a second one and rewrote that again for faststart, so local disk
peaked near four copies of the video and a 30-minute 1080p render came close
to Lambda's 10 GB /tmp. The join, audio mux and faststart now run as one
ffmpeg pass over the concat demuxer; the audio pad/trim takes its frame count
from the chunks. Video and audio packets are unchanged. Assemble and the
Lambda assemble handler log per-stage timings.
* refactor(producer): split assemble into plan check, cfr re-encode and final write
Keeps assemble under the complexity gate and drops an orphaned doc comment in chunkEncoder. No behaviour change.
Miguel Ángel