CueFrame

Explicitly acquire a selected external candidate through the pinned maintained installer in disposable staging. Pass body:{snapshot,name,expectedManifestSha256,variables,commandId}; native author sessions supply their replay-stable top-level commandId automatically through the existing adapter. Keep the snapshot and manifest digest exactly as observed. The response owns immutable original/transformed bytes and dependency/installer provenance; it does not execute source, convert arbitrary HTML or mark it CueFrame compatible. Inspect the receipt with get_registry_acquisition, then author through existing admitted component/template operations with the acquisition receipt ancestry. Changed source versions remain provenance-pending until exact adaptation bytes are captured. Never force-overwrite authored work or use an upstream preview as a CueFrame preview.

Atomically apply an array of CompositionOps to a project composition. All ops succeed or none do (transactional). Call describe_composition_ops without type for the compact operation list, then with a type for its exact JSON Schema. For negotiated component execution, read get_composition with componentExecutionVersions=["3","4"] and includeDependencies="true", then send componentExecutionVersions:[3,4] and that exact expectedBrandIdentity. A changed brand refuses the command; never refresh the witness to conceal a conflict. Explicit builtinSources selectors attach only the approved exact source pins referenced by the final composition. The additive `concurrency` envelope requires an endpoint confirmed to enforce guardedCompositionV1; unsupported hosted endpoints refuse it with unsupported_concurrency. Obtain dependency expectations from the observed composition; never rebuild a stale basis from current state. Every committing call REQUIRES `if_match`, the composition ETag from a fresh get_composition, or the `concurrency` envelope; a call with neither is refused with 428 precondition_required. On 409 stale_etag, read get_composition again and reconsider the batch against what changed; never copy the error's currentEtag into a retry without that read. `dry_run: true` validates without persisting. For negotiated component execution, EVERY dry-run and commit must still carry the observed `composition_id`, `concurrency:{mode:"exact",expectedRevision:<observed project revision>}` (or supported guarded dependency expectations), `componentExecutionVersions` and exact `expectedBrandIdentity`; retain the observed `if_match` too. Only non-negotiated legacy dry-runs may omit revision preconditions. Ops land on the project's ACTIVE composition unless you pass `composition_id` (mutually exclusive with `session_id`), which targets a specific one — that is how you author a second composition minted with new_composition and run an A/B. Use this to seed a composition (add media clips) or make targeted edits (set a crop intent, reorder clips, set the format). CAPTIONS FOR EDITED TIMELINES: after saving all clip edits, call again with {type:"captions.fromComposition", trackId} to build captions from every audible clip on that track, honoring trims, exclusions and placement. Clips must have duration matching playable source duration divided by playbackRate; unsupported timing fails explicitly. Re-run it after later timeline edits; captions do not update automatically. {type:"captions.fromTranscript", mediaId, window?} instead replaces all captions from one media transcript, rebased to zero; it does not follow a montage. Style with {type:"setCaptionStyle", style}; or set explicit words with {type:"setCaptions", segments, style?} (e.g. translations or your own VO timings). Brand is NOT set here — it lives on the project (create_project / update_project with brandKitId — or PATCH /projects/:id over REST). CARDS: a {kind:"card", html, tokens} clip projects each `tokens` KEY `x` to the CSS custom property `--cf-x`, so the html must read it as `var(--cf-x)` — write `tokens:{"plate":"#0af"}` + `background:var(--cf-plate)`. Do NOT put dashes in the key: `"--plate"` becomes `--cf---plate` and your `var(--plate)` then resolves to NOTHING, which CSS silently degrades to a transparent background and black text. Responses carry `warnings[]` when a card reads a var nothing defines. SCENE SHOTS: for a 3D product shot — a tilted page screenshot, a lit laptop/phone showing a real screenshot, two-colour type, a colour-field backdrop, focus/grain/vignette and a camera move — use {type:"scene.add", clipId, newTrack|trackId, startTime, duration, scene, assets} and revise it with {type:"scene.update", clipId, scene?, assets?, startTime?, duration?}. You author a scene SPEC, never wrapper TSX; the server registers the component for you. There is NO built-in scene primitive in list_catalog — READ cueframe://scene-shot first for the JSON schema, the canonical V2 world-objects recipe with nested groups, slabs, pages, phones, laptops, world/screen text, admitted surfaces, camera motion, lighting, and the current resource limits.

Insert a resolved builtin component package into an existing project. Pass template as the selected builtin id and body with projectId, the resolved documentSha256, insert:{startTime,idPrefix}, parameter values and explicit media bindings. Read get_composition first and retain expectedRevision, commandId, componentExecutionVersions:[3,4] and expectedBrandIdentity as required by the contract. Insertion preserves existing timeline content and package source offsets. Select pinned samples explicitly with media:{slot:{sample:true}}, or bind real media IDs. Missing required media is refused; samples are never selected implicitly. A stale revision, pin or brand refuses; do not silently refresh the witness. For ordinary templates, this operation retains its existing apply behavior.

Cancel an in-flight compose job (stop a runaway/mis-priced ensemble). Needs projectId + composeJobId (from compose). The director cancel is confirmed before the row flips; any linked charge is released. No-op-reject (422) if already terminal.

Cancel an in-flight NLE export (fcpxml/premiere). Needs projectId + exportId (from the export enqueue). No-op-reject (422) if already terminal.

Cancel a running async job (verify / preview / brand-kit-extract) returned by an enqueue call — abort a mis-priced job instead of waiting out its TTL. For box-backed jobs the warm box is reaped best-effort; cancel never meters. No-op-reject (422) if already terminal.

Cancel an in-flight render (stop a runaway/queued job). Needs projectId + renderId (from create_render). No-op if already terminal.

Compare a certified reference frame with an existing full-resolution PNG preview. Returns unaligned side-by-side and overlay images with exact source identities. Read editorial_run_source for the reference identity and preview_frame then wait_job for the candidate artifact. This call never rerenders or edits the composition. Frame numbers refer to the certified representation; use explicit event correspondence after intentional retiming. Optional views and identical-coordinate crop change only diagnostic evidence.

Start an async Director compose job: it authors an ensemble of full composition candidates, verifies each, and saves the winner to the project. Body must set EXACTLY ONE source (mutually exclusive): `briefId` — author FROM a persisted Brief (the PLANNED path: create_brief first; every Brief field is honored or the compose is refused loudly naming the field); `fromComposition: true` — author from the project's CURRENT composition (the GENERAL path: seed it with apply_composition first — your media clips are the intent, and any graphics you authored are CARRIED VERBATIM as locked clips the Director authors around, never re-authors or drops); or `suggestionId` — author from an AI clip suggestion (the CLIPPING path, paired with suggest_briefs). Returns { composeJobId, status, streamUrl }. Then call wait_job(kind="compose", id=composeJobId, projectId=...) to block until the winner is selected.

Ask the Director for editing advice on the project's CURRENT composition — it NEVER writes your composition (you stay the decider). Async: returns a consultJobId; then wait_job(kind="consult", id=consultJobId, projectId=...) surfaces the advisory envelope (assessment / proposals / principles / plan). `body.mode`: 'advise' = the planner agent (fast, ~30s-2min) returns a `plan` (framing/cuts/captions/graphics intents) as GUIDANCE you re-author from — no grounded scores, nothing to adopt; 'amend' (default) = the full author→judge→refine loop (minutes) returns a graded `assessment` + a fix candidate you ADOPT via select_candidate with its candidateIndex. ('explore' is coming soon → use amend.) `body.intent` = your goal in plain English; optional `body.focus` (editorial|spatial|brand|caption); `body.ifMatch` binds to your current etag. Use advise for a fast directional nudge, amend for a grounded, adoptable fix.

Create or UPSERT a brand kit (re-POSTing the same kitId updates it in place — this is also the brand-kit UPDATE path). Sets fonts/colors/logo. This is brand step 0 of the workflow: author the kit, then bind it to a PROJECT so colors/fonts/motion theme the output AUTOMATICALLY — pass its kitId as brandKitId to create_project, or attach it to an existing project via update_project (PATCH /projects/:id over REST). Without a bound kit, create_render produces UNBRANDED output. Tenant-scoped (no project arg).

Persist the video's INTENT as a Brief — the Director's rich input contract (spec: the storyboard skill's output lands here). Fields: goal (required), audience, platform, format, durationSec, tone, cta, locale (output language — all on-screen copy + captions), hook, caption, beats[] (each with an editorial intent and optional MOMENT PINNING {mediaId, startSec, endSec} — honored to-the-frame or refused), mustIncludes, captions {styleId, emphasisPhrases} (the big-serif emphasis treatment), motionStyle, seededGraphics (your authored overlay/component/card clips, carried VERBATIM as locked clips — never re-authored), exclusions (hard negatives: graphic kinds the Director must NEVER author + 'no-transitions'), gates {holdAt, autoApprove}. Then compose it: compose with {briefId}. The response carries the QUOTE (compose + estimated render) — relay it to your human BEFORE composing.

Top up the CURRENT org's credit wallet. Body { plan: "credit_pack_10"|"credit_pack_30"|"credit_pack_100" } → returns { url }: a hosted Stripe checkout page to open in a browser and confirm payment. There are no subscription tiers — a pack is a one-off top-up, and it is also the only thing that raises the generation (premium_credits) allowance. Always a URL — an existing saved card is NEVER charged silently; the human confirms on Stripe. The org is resolved from your key, never the body. Requires the billing:write scope. Only send a user here when get_account shows the relevant `balance` at or near zero. Discover the packs with list_plans.

Create and store a custom component for the tenant: a native scene that arranges its declared images and videos as tiles in 3D space. Returns the ComponentResponse (id + metadata) you can then reference from a composition. No project arg — components are tenant-scoped. SOURCE CONTRACT (version 4; the server instructions' Component Contract has the full rules and an example): send the complete source object {version:4, componentId, template, manifest, definition}. `template` is one sub-composition: a root <div id="root" data-composition-id="<componentId>" data-width data-height data-no-timeline data-composition-variables='…'> holding <div data-cf-scene></div>, and one inline script ending in __cfScene.mount({ root: document.getElementById('root'), component, variables: __hyperframes.getVariables() }). data-composition-variables is the definition's projection (scalar inputSchema properties, then manifest slots). The manifest is {version:4, runtime:'hyperframes', hfContract:1, kind:'scene', assets, graphics:{api:'webgl2',…}, alphaPolicy}; slots are image or video. The source is admitted before it is stored: template lint, determinism (no timers, Date, network or CSS animation) and the declaration are checked, and a refusal names the rule. A version-3 source is retired and refused as component_source_retired. Place it with execution {version:4, componentId, sourceVersionId, params, seed, assets:{ slot: mediaId }} and placement {version:3, kind:'clip'}; slots never travel in params.

Create a new project — the unit you compose and render into. compose / apply_composition / create_render / the preview family all require a projectId; this mints one. Pass name (required) plus optionally a format (aspectRatio/fps/resolution) and brandKitId. brandKitId binds a brand kit to the PROJECT (pass the kitId from create_brand_kit): colors/fonts/motion theme every render of this project automatically (omit it and the output is unbranded). Bind or change it later via update_project (PATCH /projects/:id over REST). Returns the ProjectResponse (id + metadata).

Queue an MP4 render of a project's composition (in a compose session, the session's scratch). Returns { id (renderId), status, warnings? } — `warnings[]` carries non-fatal advisories (omitted when none). The render themes from the project's brand kit (bind one via create_project / update_project with brandKitId — or PATCH /projects/:id over REST; without one the output is unbranded). Then call wait_job(kind="render", id=renderId, projectId=...) to block until the file is ready and get the download URL, or register a webhook (create_webhook on render.completed — status rides the payload).

Reserve a LOCAL portable CueFrame template package ZIP for import into the organization library. Supply idempotencyKey, archiveSha256 (exact lowercase SHA256) and archiveBytes (1..128MiB). Returns uploadId and a short-lived single PUT uploadUrl. PUT the exact raw archive bytes with Content-Type application/zip, then call import_template_package using uploadId. A reservation is not an import or a media item. Organization-library operation; project-bound editor credentials are refused.

Ingest a LOCAL file — bytes you hold, when there is no public URL to hand import_media (prefer import_media whenever the bytes already sit at an https URL). TWO steps: (1) this tool reserves a media item and returns { id, uploadUrl, expiresAt } — a short-lived PUT URL. PUT the raw file bytes to uploadUrl over HTTPS with your declared Content-Type (≤ ~5 GB per PUT). (2) call finalize_upload({ mediaItemId: id }) to start processing. Body: filename, contentType (allowed enum), size (bytes). Thereafter it is async exactly like import_media: poll list_media for processingStatus, or register a webhook (create_webhook on media.completed). Use the returned id with get_media_context, suggest_briefs, or as a composition source.

Register a webhook so long-running jobs notify you instead of blocking on wait_job — the right pattern for fan-out/async agents. Pass url + events — ONE terminal event per job kind with status INSIDE the payload (render.completed, compose.completed, media.completed, suggest.completed) plus checkpoint.ready (a held compose paused for review). DELIVERY: a POST { event, timestamp, projectId?, data } with Standard-Webhooks headers (webhook-id, webhook-timestamp, webhook-signature: v1,<base64>); the secret (whsec_<base64>) is returned ONCE — verify the RAW body with new Webhook(secret).verify(rawBody, headers). ACTIVATION is synchronous: CueFrame POSTs a signed webhook.verify challenge and your endpoint must reply 2xx echoing data.token — otherwise it returns status:"pending" and receives NO events (recover with verify_webhook, no delete/recreate). Read the cueframe://webhook-events resource (or GET /webhooks/events) for the full contract + every event's data shape BEFORE building your receiver.

Delete a brief. Compose jobs already run from it are unaffected (they snapshot).

Delete a composition (and its version history) from a project. REFUSES the ACTIVE composition (409) — make another one active first, or delete the project. Use list_compositions to see which is active.

Delete a registered critic by its criticId. It stops running in the Director gates and score_composition immediately.

Permanently delete a media item from your library (cleanup). Irreversible. Compositions referencing it will fail to render — only delete media no composition still needs.

Permanently delete a project you created (cleanup). Removes its composition and render history. Irreversible — only call on a project you own and no longer need.

Delete a webhook subscription (stop receiving its deliveries). Irreversible — the signing secret is invalidated.

Derive a reframed SIBLING composition for a different aspect ratio (the agent-native Auto-Reframe / Magic-Resize). Pass projectId + body { fromCompositionId, targetFormat: { aspectRatio, fps?, resolution? } }. CueFrame copies the source composition's authored intent and content-aware-reframes every clip for the new aspect (point/face/active-speaker focus), then saves a new independent composition in the same project. Returns { compositionId } — render it with create_render, or refine it with apply_composition. Use this to make 9:16 + 1:1 + 4:5 cuts from one 16:9 edit. (To only change resolution within the SAME aspect, pass create_render.format instead — that is a scale-only export override, not a new composition.)

Discover the exact CompositionOp vocabulary accepted by apply_composition. Omit type for a compact list of operation names and descriptions; pass type for only that operation's JSON Schema. Read this before authoring edits or captions.

Return the exact JSON Schema for a body field the tool list abbreviates. An abbreviated field names this tool in its description. Pass that tool and field.

Get a presigned download URL for a media item's stored SOURCE file — the bytes CueFrame composes from (the raw upload, or its conformed transcode). This is how you copy media OUT of a library: fetch the URL directly (no auth header) and PUT the bytes elsewhere with create_upload, or hand it to import_media on another account. Works as soon as the upload or import is stored, before processing completes. The URL expires at `expiresAt` (about an hour) — call again for a fresh one rather than caching it. Read-only and free; nothing is persisted. For a render's MP4 use refresh_render_url instead.

Commit an integrated editorial edit to the saved project composition with both runExpectedRevision and guarded composition fields. Preserve the observed concurrency basis and the composition journal identity: nested composition.commandId must equal composition.clientId + ":" + composition.sequence. The session call commandId is a separate HTTP request identity.

Persist an authored brief for the selected project. The projectId belongs in body.brief; use the returned briefId to start an editorial run.

Start an editorial run from a persisted brief and explicitly selected certified source ranges. Read editorial_run_source for each project media source first; use its exact identity, revision, frame count and fps ratio. Never invent a source pin or infer inspection from an index.

Persist one evidence-backed observation. A nothing_useful outcome may cover only what the cited evidence actually inspected; sparse stills do not certify an unsampled interval.

Read durable observations, including useful, nothing-useful and uncertain outcomes, in bounded pages. Pass nextCursor as cursor until done; retain evidence IDs, supersession and uncertainty when recovering decisions.

Read a persisted editorial run, including its revision, state, inputs, outline, selected finding IDs, omitted reasons and unresolved integration gaps. Read findings and evidence separately for complete coverage.

Deliver a bounded 16 kHz source audio interval and save an audio evidence receipt. The interval must lie inside a certified run input.

Deliver one exact decoded source frame as JPEG and save its evidence receipt. Only that sampled frame is visually inspected; preserve the returned evidenceId and coverage.

Deliver at most 100 verified transcript words with their mapped certified decode interval and save a transcript evidence receipt.

Save selected finding IDs, explicit omitted reasons and unresolved gaps with the observed run revision. Read the run and findings before deciding.

Recover persisted authored briefs for a project. Read bounded pages; pass nextCursor as cursor until done. Brief IDs link to editorial runs.

Read delivered evidence and inspection coverage for a run in bounded pages. Pass nextCursor as cursor until done; an empty page does not prove the whole source was inspected.

Recover persisted editorial runs for a project in bounded pages. Pass nextCursor as cursor until done, then read each relevant run for its integration decisions and unresolved gaps.

Read the certified decode representation for media selected in this project before starting an editorial run. Supply projectId and mediaId; a null representation means this source cannot be pinned. The response omits internal storage paths. Select a bounded range from the returned frameCount and exact fps ratio; do not invent a source identity.

Deliver bounded sampled motion frames and save their evidence receipt. The sampled frames do not certify continuous visual coverage.

Export an exact SAVED project snapshot as a portable template package. Supply idempotencyKey, expectedRevision, name, new slug and optional bounded mediaParams/textParams selectors for existing clip/leaf sites. Reads actual saved composition/components/media through the maintained extractor; no caller document, source, sample URL or provenance assertions. Returns a durable library-export job; poll get_template_job until ready, then pass its receiptId to get_template_package_download. An existing slug conflicts. A project-bound editor may export only its bound project. Does not render or create a new project.

Queue brand-token extraction from a website URL — ASYNC: returns a jobId immediately; then wait_job(kind="brand_kit_extract", id=jobId) for the tokens (colors/fonts/title/description, fetched + regex-parsed from the site's HTML/CSS — NOT a screenshot/vision pass). It does NOT persist — review the tokens, then call create_brand_kit to save a kit. A blocked (private/SSRF), non-2xx, non-HTML, or slow (>20s) URL degrades to EMPTY token arrays (a succeeded job) rather than erroring — JS-rendered SPAs typically extract empty; author the kit manually from the compiled CSS in that case.

Finalize a direct upload once you have PUT the bytes to the uploadUrl from create_upload. Confirms the bytes landed and starts ingest: image/asset become ready immediately (status "complete"); audio/video enter processing (status "processing"). Returns { id, status, processingPhase }. 400 if no bytes were uploaded (PUT first) or the item is not yours. Then call wait_job(kind="media", id=mediaItemId), or use a media.completed webhook.

Delete one entry from the org's learned taste by its id (from get_profile `taste` or remember_taste). This is how the user's "undo" works.

Generate one first-class Library media item from a prompt. Choose generator: text-to-video | text-to-image | image-to-video | text-to-music | text-to-speech | text-to-sfx | auto. Put supported presentation controls in body.style and first/last/image references in body.refs. Returns { id, status:"generating", estimateUsd? }; returns 402 if the estimate exceeds the per-call ceiling. Async — call wait_job(kind="media", id=mediaItemId) or use a webhook (media.completed — status rides the payload). Use the returned id like any other media item.

ORIENT FIRST — show THIS key's account before you spend a metered call: the org it is bound to, the current plan, a per-feature entitlements map, and per-call cost ceilings. READ `balance`, NOT `included`. CueFrame is credit-funded: rendering (entitlements.exports), generation (generate), preview stills (compose_capture), the judge (compose_verify) and the Director (compose) have NO separate per-plan allowance — they all spend one shared wallet, named in `fundedBy` (`credits`; generation is metered in provider-cost units against that wallet). Each `balance` restates that ONE wallet in that feature's own unit at `creditCost` credits per unit, so they are alternative ways to spend the same money, not four budgets. Each entitlement also carries `listUsdPerUnit`: the dollar quote for ONE unit before you call (0 = a plan grant that draws no credits, e.g. resource_import — stock search + import are free; null = not quotable up front). Check the requested cost against the balance. For generation, also check generationLimit: free accounts have a separate provider-cost cap even with a positive wallet. A billing_required error with reason free_generation_cap requires a credit-pack purchase through normal checkout. `included:false` means the plan genuinely lacks the feature. Every new org starts with a free credit grant, so an account with an empty usage history can still render, generate, preview and score. costCeilings.generateMediaUsdPerCall is the generate_media per-call USD cap. No args — identity is resolved from your key (never echoed from input).

Read a brief by id — the persisted intent plus its current quote (compose + estimated render).

Read a checkpoint packet — the durable approval unit a held compose pauses at (wait_job reports awaiting_input with {checkpointId, stage, version}). Carries the stage artifact, presigned storyboard stills (REVIEW THE EVIDENCE, not raw JSON), critic verdicts, the money triple {thisStepUsd, jobSpendSoFarUsd, estimatedJourneyTotalUsd} to relay to your human, and the recorded decision once resolved. When the Brief's gates set reviewMode:'hosted' the packet also carries reviewUrl — a browser review page where your human decides directly (relay THAT link instead of raw stills; you learn the decision via checkpoint webhooks / wait_job). Answer an awaiting packet with resume(checkpointId, ...).

Read an exact component source as complete JSON. Supply sourceVersionId from the selected catalog card to read that immutable revision, retaining sourceSnapshot with its complete versioned definition, manifest and template beside its exact pin and schema metadata. For an explicitly selected builtin, also supply builtinCollection:'native'|'curated-definitions' and its exact sourceVersionId; without builtinCollection resolution is scoped to the authenticated org. An unavailable exact pin refuses; never retry a head or another scope. To fork, keep the version-4 snapshot whole, change its componentId (the template root's data-composition-id too) and template, and send it to create_component. Builtins always require an exact collection and pin; ID-only builtin reads are refused. Declared slots are bound per placement in execution.assets, never caller params.

Read a compact structural composition view by default, preserving observed ETag, authority metadata, clip timing, token values and source pins without large HTML bodies. Ordinary exact-ETag reads can omit includeDependencies. With includeDependencies=true, compact returns a dependency key/size index, not executable tokens; these tokens can contain full sources. Request explicit dependencyKeys for exact selected tokens, or response:"full" for all tokens. Selection does not establish a sufficient operation basis. Use clipIds:[id] with response:"full" for complete exact selected sources; unknown IDs are refused. Use response:"full" without clipIds for the original full backend JSON. Local response/clipIds/dependencyKeys arguments never reach the backend. READ BACK a composition as JSON — the edit itself: tracks, clips, card HTML, reframe segments, captions, markers, format. This is what create_render encodes, so it is also what you hand to validate_composition (which needs a full inline composition body), what you diff after an edit, and what you archive/share so someone else can re-render the SAME video. Read-only and free. Authoring stays op-based (apply_composition) — do not round-trip this object back as a write. A composition too large for routine model context can be read selectively with clipIds and response:"full"; the compact view explicitly identifies omitted source bodies. Defaults to the project's ACTIVE composition; pass `compositionId` to read a specific one (the same id apply_composition takes as `composition_id`, and preview_frame / create_render take as compositionId) so an A/B variant can be read back, not just written. The result includes the exact HTTP etag string; copy it to apply_composition.body.if_match (the numeric revision is not an ETag). In a compose session this reads the session's scratch, the composition its edits, previews and renders target. Pass includeDependencies="true" on a v1 guarded endpoint to read composition_id, revision and dependency tokens. With componentExecutionVersions=["3","4"], this envelope also returns expectedBrandIdentity from the persisted project authority; carry it unchanged into the matching negotiated write. Preserve those observed tokens when authoring; never refresh the basis to hide a conflict. BOTH shapes carry `needsUpgrade` when clips are stored in a retired form (unpinned or TSX component placements, removed primitives): each entry names the clipId, the kind and, when one exists, the native successor pin — move those with repin_component and rebuild the rest with create_component; such a composition will not save or render as-is. Absent when nothing needs upgrading.

Fetch bounded authoring context for a media item: dimensions/thumbnail, compact face roster, transcript counts/sample, temporal grids, and fact readiness. Transcript and word-grid counts cover one page only (default 20 utterances); pass transcript.data.pagination.nextCursor as after to get_media_context for the next context page, or use get_transcript for exact paginated word timings.

Read prepared subject tracks and behind-subject mattes for one media item. For an exact readiness check, pass kind + startSec + endSec together using the same SOURCE window sent to prepare_media; exact.state is pending | ready | failed | available | unavailable. If subjectTrack was prepared without intent, omit all three filters and check the whole-source subjectTrack in facts instead. Wait for the required fact to be ready before preview_frame / score_composition.

The org's legible taste in ONE read: brand kits, registered critics (the machine-checkable standard both the Director's gates and score_composition enforce), their reference media (presigned thumbnails), the recent checkpoint-decision log, and the learned `taste` (style preferences saved with remember_taste). Read this BEFORE composing for an org you haven't worked with — it is the house style. Learned taste is advice: the current request, brief, project, brand kit, exclusions and critics take precedence; name any conflict.

Recover an organization-owned immutable acquisition receipt, exact raw/transformed file descriptors, bounded source text and an expiring archive link. Retain the bundle digest and distinguish original upstream bytes, installer transformations and later CueFrame adaptations. Binary/large files are explicitly identified; omitted text is not empty source. Foreign live references refuse. Saved provenance supports owned forks; it never grants compatibility, ownership of another organization’s objects, or a fresh rendered preview.

Inspect one exact external registry item manifest, including examples. Supply all snapshot fields returned by discovery together, or omit all to inspect current. Unknown upstream metadata is preserved. Inspect actual source and requirements before adaptation; an upstream poster/movie is unverified reference evidence. This read never invokes add/init or executes downloaded source. An example can be inspectable while its init acquisition remains explicitly unsupported.

Read ONE render's record without waiting on it: status, progress while it runs, outputUrl + outputExpiresAt once complete, the typed failure (errorCode / category / retryable) if it failed, and WHAT RENDERED — compositionId (the composition it froze), format (aspect/fps/resolution it encoded at), engine, createdAt / completedAt, outputDurationSec, and the preview window for a preview_clip. Free, read-only, instant — use it to audit or correlate a past render (which composition, when, how long) where wait_job would block; wait_job remains the way to block until a running render finishes. An expired outputUrl is refreshed with refresh_render_url.

Read a saved organization template by id or a known public catalog template by slug. The answer is a summary: the media and value parameters with their kinds and options, presets with their values and brand kit, the brand kit, rubric, components (id, version, asset slots) and an outline of the tracks and clips; never component sources (read one with get_component_source, or pass full: true for the whole document). Use the exact reference with start_template or apply_template. Do not invent a slug from a component-library card.

Read exact durable template preparation status. For library-import or library-export, ready means a saved organization template and destination-owned package receipt; projectId remains null. Preserve templateId/templateVersion, documentSha256 and package receipt; refresh its URL with get_template_package_download. Export sourceProjectId identifies the original saved project; projectId remains null. For ordinary instantiation/apply, read the returned projectId. Failed/cancelled states include the retained reason. Do not treat preparing as successful import.

Refresh the short-lived download URL for an exact organization-owned portable template package receipt. Supply the receiptId from a ready import/export template job. Server verifies retained immutable package/document authority; never pass bucket keys or arbitrary archive URLs. Project-bound editors must also pass the exact ready export jobId for their bound source project and this receipt; an unrelated job or receipt refuses.

Read exact source-time transcript words in bounded utterance pages. Word start/end values are seconds from the source media start. Default limit is 20; pass pagination.nextCursor as after for later pages. The formatter omits the unbounded fullText duplicate.

The A2 usage ledger: every metered billing event newest-first with attribution — featureId, amount, the project/job that produced it, and the event's LIST price in USD (a plan allowance may zero it on the invoice). Answer "what did project X cost this period?" with a query instead of summing your own quotes. Filter by projectId, jobId, and/or a [from, to) epoch-ms window. Requires the billing:read scope.

Import a media item into your library from a public URL — the agent-friendly ingest path (single call, no upload protocol). Pass url (https) + filename (+ optional contentType). Returns { id, status:"importing" }. Processing is async: call wait_job(kind="media", id=mediaItemId), or register a webhook (create_webhook on media.completed — status: complete|failed rides the payload). Use the returned id with get_media_context, suggest_briefs, or as a composition source.

Import a stock candidate (candidateId from search_resources) into a project as an ORG-OWNED media item — provider/externalId/license provenance preserved, bytes deduped across orgs. Pass projectId + candidateId. Returns { id, status:"importing"|"ready" }; processing is async — call wait_job(kind="media", id=mediaItemId), then use the returned id as a composition source. Gated on the resource_import plan feature (402 billing_required if your plan lacks it). COST: 0 credits — search and import are both free for a keyed caller (get_account → entitlements.resource_import.listUsdPerUnit is 0); imported bytes count toward the storage gauge. 422 candidate_mismatch if the candidate expired — re-run search_resources.

Import an uploaded portable template package using only uploadId and idempotencyKey. The reservation binds archive bytes and ownership; never supply storage keys, document bodies or provenance assertions. Optional destinationSlug/name creates an explicit fork. Updating an existing slug requires both expectedVersion and expectedDocumentSha256. Returns a durable library-import job; use get_template_job until ready. Read its destination templateId/templateVersion and package receipt. Organization-library operation; project-bound editor credentials are refused.

List briefs. DEFAULT shows human-authored briefs only; kind:"clip" shows the machine-minted clip briefs (suggest_briefs output), kind:"all" shows everything. Each carries its quote.

Use projection:'component-library' for the unified source-free library page, returned as complete JSON with exact scoped definition/preset/recipe cards and pagination. Choose origin:'builtin' for the maintained builtins or origin:'library' for the authenticated serving home; use libraryKind, category, q, limit and after to filter/page. Preserve each card identity.scope and identity.revision, its source/definition pin or exact recipe document identity; same names/IDs in different scopes remain distinct. Resolve the selected exact source with sourceVersionId (plus builtinCollection for an explicitly selected builtin), never a latest-head or another-home lookup. Presets identify their exact presetVersionId, definition pin and historical document witness; recipes identify their complete exact document and member source pins. This projection contains no source bodies or legacy thumbnail substitution. Omit projection for the historical catalog protocol below. DISCOVER WHAT TO BUILD WITH — list the component catalog: the one built-in primitive (heroText, the behind-subject overlay) plus your org-installed components. Desktop also includes bundled kind:'component-package' entries: these are complete reusable authored packages; insert them with the desktop apply_template tool using placement.template and explicit insert.startTime/idPrefix, media bindings and parameter values. Do not pass their ids to clip.add, get_component_source, or cueframe://component resources. Their draft status does not certify visual review or licensing. For hosted builtin preset/recipe cards, call resolve_builtin_component with the exact collection, id and revision, then apply_template with template:<builtin id> and body:{projectId,documentSha256,insert:{startTime,idPrefix},...}. Hosted tool request fields live under body; desktop tool shapes may differ. The agent-safe default page is 20 entries; use pagination.nextCursor as `after`, or narrow with category, kind, tier, useCase, mood, q, or intent. Results are recommended-tier-first when filtered. Primitive/installed entries carry the exact placement hint for apply_composition and fixedCopy warnings; use get_component_source to fork a primitive when baked copy must change. Read cueframe://component/{id} for the full primitive/installed prop schema. SCENE SHOTS ARE NOT LISTED HERE: there is no built-in scene primitive, so do not look for one — author a shot with the scene.add op (see cueframe://scene-shot). The wrapper it registers then appears here as an ordinary INSTALLED component under these same rules.

List checkpoint packets newest-first (filter with composeJobId for one run's v1→vN gate history, or projectId). The version stack with per-version status + decisions IS the review history — nothing is deleted.

List every composition (video) in a project, with its format and which one is active. Use a returned compositionId with create_render(compositionId=...) to render a specific video, or apply_composition to edit it.

List registered critics: criticId, label, tier (rules|rubric|evaluator), phase, floor, referenceMediaIds. Rubric text / rules / evaluator URLs are write-only — never echoed. Manage with register_critic (upsert) / delete_critic.

List the media in your CueFrame library. Filter a real library with kind (video|audio|image|gif|asset|source|stock), source (upload|generated|import-url|stock), or tag — so you find YOUR footage, not e2e debris. Returns media item IDs and metadata; use an ID with get_media_context, suggest_briefs, or as a composition source.

List the plan catalog (tiers, intervals, product ids, prices) BEFORE a checkout, so create_checkout requests a real {plan, interval} instead of guessing an id. No args — reads the platform catalog.

List your projects — re-orient in an existing workspace instead of minting duplicates (steady-state entry, A9). Each row carries the id every other tool needs.

The fonts the RENDERER can actually draw — read this BEFORE authoring type, not after a refusal. Per family: the exact family name authoring accepts, the weight RANGES a shipped file declares (a static face has min===max; a variable face gives its axis range), the caption default weights, and whether the bytes are bundled or an aliased metric-compatible stand-in. Anything listed here passes validation by construction: it is derived from the same table the font gate refuses by. Two facts worth reading off it — every family's `styles` is ["normal"], because NO bundled family ships an italic FILE (a real italic comes only from a brand-kit font asset), and a weight outside every range is REFUSED, never synthesised. Contrast search_fonts, which searches the GOOGLE catalog and will happily return families the renderer cannot draw. `manifestVersion` identifies this exact face table; record it beside a composition to state what a font choice was validated against. Covers the bundled set only — a brand kit's sealed faces are per-org and per-render. No args, read-only, free.

Read the org's learned taste: whether the owner has it on (`enabled`) and its saved entries, oldest first. While `enabled` is false, do not apply the entries. Learned taste is advice: the current request, brief, project, brand kit, exclusions and critics take precedence.

List this organization's saved templates. Follow pagination.nextCursor with after to read further pages. Public catalog slugs are not enumerated here; read a known public slug with get_template.

Create a NEW composition (a new video) inside a project — a project is a workspace that holds many videos. Returns { compositionId, format, etag }. Pass an optional name and format (aspectRatio/fps/resolution); format defaults to the project's compositionFormat. The first composition becomes the project's active default. To author it, seed with apply_composition then compose({ fromComposition: true }) — your authored graphics ride as locked clips, carried verbatim; to render a specific one, pass its compositionId to create_render. (For a reframed sibling in another aspect, use derive_composition.)

Prepare the perception artifact an authored edit needs BEFORE sighted review. Pass body.kind="subjectTrack" for face/active-speaker reframing, or body.kind="matte" for a true zPlane:"behind-subject" graphic. Pass body.intent {startSec,endSec} using SOURCE time (the media trim, not timeline time); it is required for mattes and strongly recommended for subject tracks so the prepared fact exactly matches the clip and quote. This is the supported product path — never accept a preview that silently flattens depth or ignores speaker tracking. Returns a fact receipt; with intent, poll get_media_facts using the same kind/window until exact.state is ready; without intent, omit all three filters and find the whole-source subjectTrack in facts until status is ready (failed is terminal). Existing pending/ready facts are reused without another charge.

Render ONE authored card on its own and SEE it, before placing it in a composition. Pass the same `html` (+ optional `tokens`) you would put in a {kind:"card"} clip; you get the still back as an image. Use this while writing a card — it is the fast loop for catching type that overflows the frame, a headline that collides with a logo, or tokens that did not resolve. Sized to the format you name, so what you see is what that aspect ratio will show. To judge MOTION rather than layout, shell the card with a motion preset and use preview_clip.

Render a scoped, cheap MOTION preview — ONLY body.fromSec→body.toSec of the composition (max 60s) at preview quality (capped resolution, lighter encode) through the real render pipeline. THE way to judge motion — a cut, a transition, a component's animation — at full fidelity BEFORE paying for a full render (a still cannot show motion; a full render costs the export). ASYNC: returns a render job; wait_job(kind="render", id=renderId) or a render.completed webhook for the URL. Meters the capture feature, never an exports credit.

Queue a typed preview artifact for ONE org-installed component — ASYNC: returns a jobId immediately; then wait_job(kind="preview", id=jobId). The preview and production compositor consume the same content-addressed component bundle and verified artifact contract. `body.componentId` selects the component; pass `body.params` to render it with props (the mount's `params`); declared manifest slots are bound separately and reach the scene's `assets`, never params. Admission/runtime/capability failures land on the job terminal with sanitized author-fixable messages. Idempotent per immutable render key.

Queue durable still-frame evidence for layout/copy judgment. Returns immediately with {jobId, kind:'preview_frame', status}; then call wait_job(kind="preview_frame", id=jobId) for artifact metadata and up to four embedded frame images; fetch failures or payload limits may return fewer. Use wait_job imageIndices to read other original image artifacts from the completed job, at most four indices per call, without rendering again. Repeating the same arguments repeats the same selection. Artifact URLs alone are not observed pixels. The immutable snapshot records geometry, layers, warnings, and whether the target was persisted, inline, or session scratch. A still cannot prove motion — use preview_clip or preview_component for animation.

Explicitly refresh external registry metadata: resolve moving main once to a full commit, then capture one coherent fixed inventory/manifest snapshot using the qualified client. Pass body:{commandId,expectedSnapshot,expectedRevision}; both expected values are null only for first selection. Preserve the observed snapshotRevision returned by current discovery and the exact snapshot as the CAS witness. Native author sessions inject their existing replay-stable top-level commandId. Stale head/revision refuses rather than rebasing silently. Refresh does not change customer sources, local forks or timeline placements. Preview/variable/dependency metadata changes remain separate, and actual source-byte differences require explicit acquisition before adaptation, review and guarded adoption.

Re-sign a COMPLETE render's output URL. A render's presigned MP4 link lasts ~7 days, so wait_job / getRender on an old render hands back a link that 403s; this mints a fresh one for the same file and returns { outputUrl, outputExpiresAt }. Needs projectId + renderId (from create_render). 422 render_not_complete while the render is still running or failed — wait_job for it first. Requires renders:write (the row's stored URL is updated).

Register a custom eval into the compose critic panel — the critic contract is { rubric (or rules/evaluator), referenceMediaIds?, floor }. Three tiers: rules (declarative constraints — keep-out regions, required elements, max overlays, brand colors), rubric (a text criterion scored by the judge as an extra column), or evaluator (your HTTPS webhook — CueFrame POSTs the composition+stills+facts, you return { score, critique }). referenceMediaIds (≤6 org media ids) attach YOUR reference frames as the standard — the judge scores candidates for consistency with them, so "indistinguishable from mine" is a machine check. Lane scope: rules + rubric critics run in BOTH lanes (the Director's gates AND standalone score_composition); evaluator webhooks run in the Director lane only. Use phase 'static' (the default) — 'temporal' (final-render evaluation) is accepted but not yet wired, so a temporal critic produces no verdicts today. A low client score drives a refine like a built-in criterion. You see your eval output + our scores, never our rubric. Re-registering the same criticId upserts (list_critics / delete_critic manage the set). Evaluator tier returns a signing secret ONCE.

Save one durable style preference to the org's learned taste, with its source (the job, checkpoint or chat, plus the date). Only for a preference the user stated: a revise comment, a chat correction or an explicit "remember this"; never one-off brief content, footage facts or secrets. Tell the user what you saved and that they can say undo (forget_taste). Saving text the org already holds changes nothing. Refused, never truncated, past 2,048 bytes per entry or 4,000 characters per org, or while the owner has learned taste off; a refusal is final. get_profile returns the saved entries as `taste`.

Move clips stored in a retired form to their native (version 4) successors: a clip pinning a retired TSX (version 3) component, or one stored before execution pins (`needsUpgrade` kind `unpinned-component`), moves to the `successorSourceVersionId` that get_composition's `needsUpgrade` (or a `component_source_retired` refusal) names. Pass projectId and, in `body`, optional `clip_ids` (omit them to move every clip that has a successor) and `composition_id` (the active composition when omitted). Saved inputs are kept. The answer lists `moved` and `withoutSuccessor`; rebuild the latter as native components (create_component, then apply_composition at the same timing and placement). A retired clip with no successor must be rebuilt or removed in the same write that upgrades the others: a write never leaves one in place.

Resolve a selected builtin component-library card using its exact collection, id and revision. Returns the canonical pinned document and source snapshots for a preset or recipe, or the exact source for a definition. Preserve documentSha256 and all identities; a missing revision refuses without falling back to another version or scope. Resolve before apply_template; do not invent wrapper source or reconstruct a package from a thumbnail.

Answer the checkpoint packet wait_job reported as awaiting_input (its {checkpointId} — read the packet FIRST with get_checkpoint and relay the stills + money triple to your human). ONE `body.decision` per gate: 'approve' (proceed; comments allowed — they record as taste without gating), 'revise' (the director revises per your `body.comments` [{anchor: {beatId}|{timecodeMs}, verdict: 'approve'|'revise'|'lock', note}] and/or `body.edits`, then RE-PRESENTS this same gate as a new packet — in-job, no new charge; the brief quote states the included revision cycles, beyond them revise is refused 402), or 'abandon' (end the run — the only terminal refusal). 'lock' freezes an element contractually: the director touching it surfaces as a lock_violation verdict on the next packet. On approve/revise the Director rehydrates its warm box and continues; then wait_job again.

Re-render an existing render job's FROZEN composition snapshot — it inherits that job's exact composition/intent/priority and queues a fresh renderJob; it does NOT re-read the project's current composition. So it only helps a TRANSIENT failure (the failed render's `retryable:true` / `category:"transient"` — a flaky pipeline/infra fault): re-attempting the same snapshot may succeed. For a DETERMINISTIC failure (`retryable:false` / `category:"authoring"` — a bad param, an unresolvable media/brand ref), retry_render reproduces the SAME failure: FIX the composition first via apply_composition, then create_render (a retry alone is futile). Check `retryable` on getRender / wait_job to pick the path. Returns the new render; then wait_job(kind="render", id=<new id>).

Queue the durable server-side judge — it snapshots the exact authored target, samples eval beats, captures frames asynchronously, and grades editorial/spatial/brand/caption. Then wait_job(kind="verify", id=jobId) for per-criterion scores, weighted composite, worst-first critique, and checkpointId. `body.composition` is optional (absent ⇒ ACTIVE). Fix the lowest criterion via apply_composition and re-score. Idempotent per immutable snapshot; compose_verify bills only on the guarded success terminal.

Search web font families by name/style — returns family names to use in composition/component params. Pass query (+ optional perPage ≤50). Read-only + free; surfaces the Google Fonts catalog (family + category + variants + css2 stylesheet URL). IMPORTANT: this searches the GOOGLE catalog, not what the render can actually draw. Only the faces vendored into the render page are guaranteed to rasterize; naming any other family gets you the generic fallback (Liberation Sans) with no error. Call list_render_fonts for the set you may actually choose from, WITH the admitted weights per family — treat that, not this catalog, as the list. An empty result set here means no match, or the upstream catalog was unavailable.

Discover external registry source candidates through the maintained pinned client. Omit every snapshot field to use the current organization snapshot, or provide registryOrigin, sourceCommit, inventorySha256 and cliArtifactSha256 together. Preserve the exact returned snapshot, item manifest digest, source requirements and unverified upstream preview provenance. Results may be partial; zero compatible candidates in a shortlist does not prove catalog-wide absence. itemType:example lists examples in inventory order; query/tag ranking for examples is unsupported. These are external candidates, not insertable CueFrame cards or rendered fidelity evidence. If no current snapshot exists, explicitly refresh with an observed null snapshot and revision; do not fabricate pins.

Search licensed stock media to compose with across video, photo, sound effects, and GIFs. Pass query for ONE search, or queries[] (≤10) to run them all in a SINGLE call — strongly prefer the batch when you know several things you need. A batch returns results[], one per query in order, each with its own candidates; a query that fails carries an error and never discards the others. Optional kind [default video], provider pin, and limit ≤50 apply to every query in the batch. Returns ranked candidates, each with an opaque candidateId + attribution (author, assetUrl) + license, and a preview URL in the text. FREE + rate-limited + cached — reach for this before generate_media when real footage beats synthesis. TO SEE the candidates rather than read about them, pass limit ≥2: thumbnails/audio are attached only when you asked for options to compare. Import a chosen candidate into a project with import_resource. Candidate handles expire; re-search to refresh one.

Select one candidate from a finished compose/consult ensemble as the project's saved composition (whole-candidate replace). Body REQUIRES both fields: { candidateIndex, selectStrategy: "agent-authoritative" } — candidateIndex from wait_job(kind="consult") proposals (mode=amend) or the compose winner report; selectStrategy is required and API keys must use 'agent-authoritative' (editor-merge/editor-replace need an editor-session token and 403 on an API key). agent-authoritative replaces the saved composition unconditionally and ignores ifMatch, so read get_composition first and adopt only when no edit made since the consult or compose must survive. After selecting, render with create_render.

Create a new project from a catalog or org template. The server prepares media and verified mattes before the project is ready. Pass the returned jobId to wait_job(kind="template").

Run AI clip-suggestion analysis on a long-form media item — the CLIPPING path (find the best short-form moments). Returns { status, alreadyRunning? }; then wait_job(kind="suggestions", id=mediaItemId) — its terminal lists each suggestion WITH its briefId. When the media belongs to a PROJECT, each finalized suggestion is promoted to a kind-'clip' BRIEF (its window pinned as a beat) — list_briefs {kind:"clip"} shows them and compose({ briefId }) runs the flagship path from one. Project-less media: pass the suggestion id to compose({ suggestionId }) directly. Clipping is a vertical, NOT the general path.