Upload 45 files

.gitattributes

@@ -35,6 +35,3 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
 fonts/TikTok-Bold.ttf filter=lfs diff=lfs merge=lfs -text
 gradio_demo.png filter=lfs diff=lfs merge=lfs -text
-assets/edu_note.wav filter=lfs diff=lfs merge=lfs -text
-assets/fun_fact.wav filter=lfs diff=lfs merge=lfs -text
-assets/thanks.wav filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -19,7 +19,9 @@ jobs/*
 storage/*
 !storage/.gitkeep
 
+ingestion/cookies/*
+!ingestion/cookies/.gitkeep
+
 *.db
 *.sqlite
 *.sqlite3
-

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10-slim
+FROM python:3.11-slim
 
 ENV PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
@@ -16,7 +16,9 @@ ENV PYTHONUNBUFFERED=1 \
     FFMPEG_TIMEOUT_SECONDS=900 \
     DOWNLOAD_TIMEOUT_SECONDS=60 \
     MAX_DOWNLOAD_BYTES=524288000 \
-    ALLOW_PRIVATE_ASSET_URLS=false
+    ALLOW_PRIVATE_ASSET_URLS=false \
+    ENABLE_API_DOCS=false \
+    SUPPRESS_SCANNER_ACCESS_LOGS=true
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
@@ -53,4 +55,3 @@ RUN mkdir -p /app/temp /app/exports /app/jobs /app/models /app/storage \
 EXPOSE 7860
 
 CMD ["bash", "start.sh"]
-

Dockerfile.renderer

@@ -19,6 +19,8 @@ ENV PYTHONUNBUFFERED=1 \
     WHISPER_DEVICE=cpu \
     WHISPER_MODEL_DIR=/app/models \
     MAX_RETRIES=3 \
+    CALLBACK_MAX_RETRIES=3 \
+    CALLBACK_RETRY_SECONDS=1 \
     JOB_RETENTION_SECONDS=86400
 
 RUN apt-get update && apt-get install -y --no-install-recommends \

N8N_ENDPOINTS.md

@@ -91,6 +91,10 @@ Recommended n8n flow:
 For payloads with `callback_url`, use an n8n Webhook node's production URL to
 avoid polling.
 
+Render callbacks use `render.completed`, `render.failed`, and
+`render.cancelled`; toolkit and analysis callbacks use `task.*`. The event is
+available in both the JSON `event` property and `X-Ava2lon-Event` header.
+
 ## Root and Discovery
 
 | Method | Path | n8n input | Response |
@@ -105,6 +109,7 @@ These routes use the root base URL.
 | Method | Path | n8n input | Response |
 | --- | --- | --- | --- |
 | GET | `/health` | None | Renderer health. |
+| GET | `/healthz` | None | Health-check alias for hosting probes. |
 | GET | `/monitor` | None | Runtime, queue, storage, and capability summary. |
 | GET | `/queue` | None | Job queue summary. |
 | GET | `/workers` | None | Worker and runtime settings. |
@@ -190,6 +195,8 @@ Example:
 | Method | Path | n8n input | Auth | Response |
 | --- | --- | --- | --- | --- |
 | POST | `/render` | JSON `RenderPayload` or `AIReelsPayload` | None | Async job. |
+| POST | `/render/variants` | JSON `RenderVariantsPayload` | None | Render group plus child jobs. |
+| POST | `/render/template` | JSON `TemplateRenderPayload` | None | Async job. |
 | POST | `/render/ai-reels` | JSON `AIReelsPayload` | None | Async job. |
 | POST | `/render/batch` | JSON `BatchPayload` | None | Array of job IDs. |
 | POST | `/automation/batch` | JSON `BatchPayload` | API key | Array of job IDs. |
@@ -198,6 +205,8 @@ Example:
 | POST | `/render/ai-reels/upload` | Multipart `request_json` plus zero or more `files` | None | Async job. |
 | POST | `/assets/upload` | Multipart; one or more `files` | None | Uploaded asset references. |
 | POST | `/upload` | Multipart `files`; optional `expand_zip` | None | Uploaded or expanded assets. |
+| GET | `/render/groups/{group_id}` | Replace `{group_id}` | None | Aggregate state and child jobs. |
+| GET | `/templates/automation` | None | None | Data-driven render templates. |
 
 Basic render body:
 
@@ -244,6 +253,36 @@ For `/render/upload`, configure n8n Form-Data as:
 
 The filename in `upload://clip.mp4` must match the uploaded binary filename.
 
+Render several platform outputs from one timeline with `/render/variants`:
+
+```json
+{
+  "scenes": [{"start": 0, "duration": 12, "media": "https://example.com/input.mp4"}],
+  "callback_url": "https://n8n.example/webhook/render-events",
+  "variants": [
+    {"name": "shorts", "platform": "youtube_shorts", "output_name": "shorts.mp4"},
+    {"name": "reels", "platform": "instagram_reels", "output_name": "reels.mp4"},
+    {"name": "youtube", "platform": "youtube_1080p", "output_name": "youtube.mp4"}
+  ]
+}
+```
+
+Use `/render/template` for spreadsheet, CRM, and database-driven renders. An
+exact placeholder preserves arrays, objects, numbers, and booleans instead of
+converting them to strings.
+
+```json
+{
+  "template": "vertical-captioned-clip",
+  "variables": {
+    "output_name": "customer-42.mp4",
+    "scenes": [{"start": 0, "duration": 8, "media": "https://example.com/42.mp4"}],
+    "voiceover": null,
+    "background_music": null
+  }
+}
+```
+
 ## Platform Processing and Toolkit
 
 All routes in this table require `X-API-Key` and return asynchronous job
@@ -275,6 +314,21 @@ Toolkit example:
 }
 ```
 
+FFmpeg automation tasks added for n8n:
+
+| Task | Important `params` | Download artifact |
+| --- | --- | --- |
+| `inspect` | None | FFprobe metadata JSON |
+| `loudness_analyze` | `target_lufs` | LUFS/LRA/true-peak JSON |
+| `silence_detect` | `noise_db`, `duration_seconds` | Timed silence events JSON |
+| `black_detect` | `pixel_threshold`, `duration_seconds` | Timed black-frame events JSON |
+| `scene_detect` | `threshold` | Scene-change timestamps JSON |
+| `contact_sheet` | `columns`, `rows`, `interval_seconds`, `thumbnail_width` | JPEG/PNG |
+| `hls` | `segment_seconds`, `playlist_type`, `crf` | ZIP with M3U8 and TS segments |
+
+All use the normal `POST /toolkit` body with `task`, `media`, optional `params`,
+and optional `callback_url`.
+
 ## Transcription, Subtitles, Jobs, and Downloads
 
 | Method | Path | n8n input | Response |
@@ -283,13 +337,14 @@ Toolkit example:
 | POST | `/subtitles` | JSON `SubtitlePayload` | File response (`.srt` or `.ass`). |
 | POST | `/scene-builder` | JSON `SceneBuildPayload` | Generated scene array. |
 | POST | `/transcribe/upload` | Multipart `file` plus optional transcription fields | Transcription JSON. |
-| GET | `/status` | Query `job_id` | Job record. |
+| GET | `/status` | Optional query `job_id` | Service status without `job_id`; job record with it. |
 | GET | `/status/{job_id}` | Replace `{job_id}` | Job record. |
 | POST | `/cancel/{job_id}` | Replace `{job_id}` | Updated job record. |
 | POST | `/admin/cleanup` | Optional query `older_than_seconds` | Cleanup counts. |
 | GET | `/download` | Query `job_id`; optional `token` | File response. |
 | GET | `/download/{job_id}` | Replace `{job_id}`; optional query `token` | File response. |
 | POST | `/inspect` | Query `path` | Media metadata JSON. |
+| POST | `/media/inspect` | JSON `{ "media": "...", "callback_url": "..." }` | Async remote-safe inspection. |
 
 Transcription body:
 
@@ -392,45 +447,6 @@ strategy
 batch
 ```
 
-## Whisper Authentication
-
-These routes exist only when the Whisper authentication subsystem starts
-successfully.
-
-| Method | Path | n8n input |
-| --- | --- | --- |
-| POST | `/whisper/api/auth/signup` | JSON `SignupSchema` |
-| POST | `/whisper/api/auth/login` | JSON `LoginSchema` |
-| POST | `/whisper/api/auth/verify` | JSON `TokenSchema` |
-| POST | `/whisper/api/auth/refresh` | JSON `TokenSchema` |
-| POST | `/whisper/api/auth/logout` | No body |
-
-Examples:
-
-```json
-{
-  "email": "user@example.com",
-  "username": "studio_user",
-  "password": "strong-password"
-}
-```
-
-```json
-{
-  "email": "user@example.com",
-  "password": "strong-password"
-}
-```
-
-```json
-{
-  "token": "<JWT returned by signup or login>"
-}
-```
-
-Logout returns success but does not currently maintain a server-side token
-revocation list.
-
 ## FFmpeg Editor
 
 | Method | Path | n8n input | Response |
@@ -610,6 +626,7 @@ music_volume: number = 0.316
 music_fade_in, music_fade_out, music_start: number = 0
 music_loop, music_ducking: boolean = true
 voice_volume: number = 1
+callback_url, export_target: string | null
 ```
 
 `BatchPayload`
@@ -837,29 +854,6 @@ transition: string = "fade"
 creative_style: string | null
 ```
 
-### Authentication
-
-`SignupSchema`
-
-```text
-email*: valid email
-username*: 3-32 letters, numbers, or underscores
-password*: 8-72 characters
-```
-
-`LoginSchema`
-
-```text
-email*: valid email
-password*: 1-72 characters
-```
-
-`TokenSchema`
-
-```text
-token*: 10-2048 characters
-```
-
 ## Framework and UI Endpoints
 
 These are not business API operations:
@@ -872,9 +866,8 @@ These are not business API operations:
 | `/whisper/` | Whisper Gradio interface. |
 | `/editor/` | FFmpeg editor Gradio interface. |
 | `/mcp/` | MCP Streamable HTTP transport; use an MCP client rather than a normal REST request. |
-| `/docs` | Root FastAPI Swagger UI. |
-| `/redoc` | Root FastAPI ReDoc UI. |
-| `/openapi.json` | Root renderer OpenAPI schema. |
-| `/<service>/docs` | Mounted service Swagger UI when not shadowed by its UI mount. |
-| `/<service>/openapi.json` | Mounted service OpenAPI schema. |
-
+| `/docs` | Root FastAPI Swagger UI when `ENABLE_API_DOCS=true`. |
+| `/redoc` | Root FastAPI ReDoc UI when `ENABLE_API_DOCS=true`. |
+| `/openapi.json` | Root renderer OpenAPI schema when `ENABLE_API_DOCS=true`. |
+| `/<service>/docs` | Mounted service Swagger UI when `ENABLE_API_DOCS=true`. |
+| `/<service>/openapi.json` | Mounted service OpenAPI schema when `ENABLE_API_DOCS=true`. |

README.md

@@ -31,6 +31,10 @@ See [N8N_ENDPOINTS.md](N8N_ENDPOINTS.md) for all API endpoints, payload
 schemas, editor task IDs, file upload settings, asynchronous job handling, and
 HTTP Request node examples.
 
+Public Swagger, ReDoc, and OpenAPI routes are disabled by default. Set
+`ENABLE_API_DOCS=true` in the Space environment when interactive API
+documentation is required.
+
 ## MCP
 
 Connect an MCP client to:

README.renderer.md

@@ -261,6 +261,14 @@ Deletes expired job records, old exports, and staged upload folders. Default ret
 
 Probe one local asset path and return MIME type, duration, codecs, bitrate, resolution, FPS, stream list, and cache metadata.
 
+### n8n automation endpoints
+
+- `POST /media/inspect` safely downloads a local or remote asset and returns FFprobe metadata as an asynchronous JSON artifact.
+- `POST /render/template` substitutes validated JSON variables into a named or inline render template.
+- `POST /render/variants` creates up to 12 platform outputs and returns a render group ID.
+- `GET /render/groups/{group_id}` returns aggregate and per-variant status.
+- `POST /toolkit` supports `loudness_analyze`, `silence_detect`, `black_detect`, `scene_detect`, `contact_sheet`, and `hls` tasks.
+
 ## n8n Workflow Integration
 
 Recommended URL-based flow:
@@ -268,7 +276,7 @@ Recommended URL-based flow:
 1. Use an HTTP Request node with `POST https://YOUR-SPACE.hf.space/render`.
 2. Pass public file URLs from S3, Supabase Storage, Cloudinary, Google Drive direct-download links, or another CDN in `scenes[].media`, `voiceover`, and `background_music`.
 3. Set `auto_subtitles` to `true` when you want faster-whisper captions generated from `voiceover`.
-4. Add `callback_url` to receive a POST when the job completes or fails.
+4. Add `callback_url` to receive `render.completed`, `render.failed`, or `render.cancelled` events. Toolkit and analysis jobs use the corresponding `task.*` event names.
 5. Poll `GET https://YOUR-SPACE.hf.space/status/{{$json.job_id}}` only if you do not use callbacks.
 6. Download the final MP4 from the signed `download_url`.
 
@@ -323,12 +331,14 @@ Templates are selected per request and do not require code changes.
 - Remote asset downloads are killed after `DOWNLOAD_TIMEOUT_SECONDS`.
 - Remote and multipart input size is capped by `MAX_DOWNLOAD_BYTES`.
 - faster-whisper models are loaded lazily and cached under `WHISPER_MODEL_DIR`.
-- Webhook callbacks are best-effort and callback failures are written to job logs.
+- Webhook callbacks retry with exponential backoff. `CALLBACK_MAX_RETRIES` and `CALLBACK_RETRY_SECONDS` control delivery.
+- Webhooks include `X-Ava2lon-Event` and an HMAC `X-Ava2lon-Signature` computed with the signing secret.
+- Set `PUBLIC_BASE_URL` so submissions, status payloads, and callbacks contain absolute URLs.
 - `export_target=local` copies completed renders to `STORAGE_DIR`.
 - `export_target=https://...` uploads the completed MP4 with HTTP `PUT`, which works with presigned URLs from S3, Supabase Storage, and similar providers.
 - Jobs retry up to `MAX_RETRIES`.
 - Intermediate files are created under `TEMP_DIR` and removed after export.
-- Job records retain command history, logs, render time, output size, and failure reasons.
+- Job records retain command history, logs, render time, output size, SHA-256 artifact checksums, callback delivery state, and failure reasons.
 
 ## Docker Deployment
 

access_log_filter.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import logging
+import os
+
+
+SCANNER_PATH_PREFIXES = (
+    "/.env",
+    "/.git",
+    "/.streamlit",
+    "/_debug",
+    "/_profiler",
+    "/_stcore",
+    "/actuator",
+    "/admin",
+    "/api/config",
+    "/api/credentials",
+    "/api/env",
+    "/api/keys",
+    "/api/predict",
+    "/api/queue/status",
+    "/api/secrets",
+    "/api/settings",
+    "/api/v1/",
+    "/api-docs",
+    "/app.py",
+    "/backup/",
+    "/config",
+    "/debug",
+    "/docs",
+    "/elmah",
+    "/file",
+    "/graphql",
+    "/horizon",
+    "/info",
+    "/internal",
+    "/main.py",
+    "/manifest.json",
+    "/metrics",
+    "/openapi.json",
+    "/phpinfo",
+    "/proc/",
+    "/prometheus",
+    "/redoc",
+    "/run/predict",
+    "/server-",
+    "/settings",
+    "/swagger",
+    "/telescope",
+    "/trace",
+    "/upload?upload_id=",
+    "/wp-config",
+    "/__phpinfo",
+)
+
+
+class ScannerNoiseFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        try:
+            path = str(record.args[2]).lower()
+            status_code = int(record.args[4])
+        except (IndexError, TypeError, ValueError):
+            return True
+
+        if status_code not in {404, 405}:
+            return True
+        return not path.startswith(SCANNER_PATH_PREFIXES)
+
+
+def install_access_log_filter() -> None:
+    enabled = os.getenv("SUPPRESS_SCANNER_ACCESS_LOGS", "true").lower() in {
+        "1",
+        "true",
+        "yes",
+    }
+    if not enabled:
+        return
+
+    logger = logging.getLogger("uvicorn.access")
+    if not any(isinstance(item, ScannerNoiseFilter) for item in logger.filters):
+        logger.addFilter(ScannerNoiseFilter())

api.py

@@ -13,9 +13,9 @@ from pydantic import BaseModel, Field
 
 from renderer.core.config import Settings
 from renderer.core.ingest import stage_upload
-from renderer.core.models import AIReelsRequest, RenderRequest, Scene
+from renderer.core.models import AIReelsRequest, JobRecord, RenderRequest, Scene
 from renderer.core.security import verify_download_token
-from renderer.core.utils import safe_filename
+from renderer.core.utils import new_id, safe_filename
 from renderer.jobs import JobManager
 from renderer.platform import PlatformProcessor, supported_toolkit_tasks
 from renderer.scenes import Timeline
@@ -44,6 +44,7 @@ from renderer.templates import (
     scene_effect_metadata,
 )
 from renderer.transitions import TransitionBuilder
+from renderer.automation import automation_template_catalog, list_automation_templates, resolve_render_template
 
 settings = Settings()
 settings.ensure_dirs()
@@ -60,7 +61,7 @@ def _verify_api_key(api_key: str | None = Header(default=None, alias=API_KEY_HEA
         raise HTTPException(status_code=401, detail="Invalid or missing API key")
 
 def _submission_response(job_id: str) -> dict[str, str]:
-    download_url = f"/download/{job_id}"
+    download_url = _public_endpoint(f"/download/{job_id}")
     try:
         record = job_manager.get(job_id)
     except KeyError:
@@ -69,7 +70,21 @@ def _submission_response(job_id: str) -> dict[str, str]:
         token = record.download_token
     if token:
         download_url = f"{download_url}?token={token}"
-    return {"job_id": job_id, "status_url": f"/status/{job_id}", "download_url": download_url}
+    return {"job_id": job_id, "status_url": _public_endpoint(f"/status/{job_id}"), "download_url": download_url}
+
+
+def _public_endpoint(path: str) -> str:
+    return f"{settings.public_base_url}{path}" if settings.public_base_url else path
+
+
+def _status_payload(record: JobRecord) -> dict[str, Any]:
+    data = record.__dict__.copy()
+    data["status_url"] = _public_endpoint(f"/status/{record.job_id}")
+    data["download_url"] = _public_endpoint(f"/download/{record.job_id}?token={record.download_token}")
+    artifact = record.metrics.get("artifact") if isinstance(record.metrics, dict) else None
+    if artifact:
+        data["artifact"] = artifact
+    return data
 
 
 class ScenePayload(BaseModel):
@@ -117,6 +132,35 @@ class RenderPayload(BaseModel):
     metadata: dict[str, Any] = Field(default_factory=dict)
 
 
+class RenderVariantPayload(BaseModel):
+    name: str = "variant"
+    preset: str | None = None
+    template: str | None = None
+    creative_style: str | None = None
+    platform: str | None = None
+    output_name: str | None = None
+    preview: bool | None = None
+    metadata: dict[str, Any] = Field(default_factory=dict)
+
+
+class RenderVariantsPayload(RenderPayload):
+    variants: list[RenderVariantPayload] = Field(min_length=1, max_length=12)
+
+
+class TemplateRenderPayload(BaseModel):
+    template: str | dict[str, Any]
+    variables: dict[str, Any] = Field(default_factory=dict)
+    overrides: dict[str, Any] = Field(default_factory=dict)
+    callback_url: str | None = None
+    export_target: str | None = None
+
+
+class MediaInspectPayload(BaseModel):
+    media: str
+    callback_url: str | None = None
+    export_target: str | None = None
+
+
 class AIReelsPayload(BaseModel):
     script: str
     voiceover: str
@@ -133,6 +177,8 @@ class AIReelsPayload(BaseModel):
     music_start: float = Field(default=0.0, ge=0)
     music_ducking: bool = True
     voice_volume: float = Field(default=1.0, ge=0, le=2)
+    callback_url: str | None = None
+    export_target: str | None = None
 
 
 class BatchPayload(BaseModel):
@@ -361,6 +407,11 @@ def health() -> dict[str, str]:
     return {"status": "ok"}
 
 
+@api.get("/healthz", include_in_schema=False)
+def healthz() -> dict[str, str]:
+    return health()
+
+
 @api.get("/monitor")
 def monitor() -> dict[str, Any]:
     return _monitor_payload()
@@ -444,9 +495,15 @@ def templates_catalog() -> dict[str, Any]:
         "caption_templates": list_templates(),
         "render_presets": list_presets(),
         "creative_styles": creative_style_metadata(),
+        "automation_templates": automation_template_catalog(),
     }
 
 
+@api.get("/templates/automation")
+def automation_templates() -> dict[str, Any]:
+    return {"templates": list_automation_templates(), "catalog": automation_template_catalog()}
+
+
 @api.get("/projects")
 def list_projects() -> dict[str, list[dict[str, Any]]]:
     return {"projects": project_manager.list()}
@@ -719,6 +776,38 @@ def render(payload: RenderPayload | AIReelsPayload) -> dict[str, str]:
     return _submission_response(job_id)
 
 
+@api.post("/render/variants")
+def render_variants(payload: RenderVariantsPayload) -> dict[str, Any]:
+    group_id = new_id("render_group")
+    jobs: list[dict[str, str]] = []
+    common = payload.model_dump(exclude={"variants"})
+    for variant in payload.variants:
+        data = dict(common)
+        selected = variant.model_dump(exclude_none=True)
+        variant_name = selected.pop("name", "variant")
+        variant_metadata = dict(data.get("metadata") or {})
+        variant_metadata.update(selected.pop("metadata", {}) or {})
+        variant_metadata.update({"group_id": group_id, "variant_name": variant_name})
+        data.update(selected)
+        data["metadata"] = variant_metadata
+        request = _render_request(RenderPayload.model_validate(data))
+        job_id = job_manager.submit_render(request)
+        jobs.append({"variant": variant_name, **_submission_response(job_id)})
+    return {"group_id": group_id, "group_status_url": _public_endpoint(f"/render/groups/{group_id}"), "jobs": jobs}
+
+
+@api.post("/render/template")
+def render_template(payload: TemplateRenderPayload) -> dict[str, str]:
+    try:
+        data = resolve_render_template(payload.template, payload.variables, payload.overrides)
+        data["callback_url"] = payload.callback_url or data.get("callback_url")
+        data["export_target"] = payload.export_target or data.get("export_target")
+        request = _render_request(RenderPayload.model_validate(data))
+        return _submission_response(job_manager.submit_render(request))
+    except (KeyError, TypeError, ValueError) as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
 
 @api.post("/render/ai-reels")
 def render_ai_reels(payload: AIReelsPayload) -> dict[str, str]:
@@ -881,6 +970,16 @@ def toolkit(payload: ToolkitPayload) -> dict[str, str]:
     return _submission_response(job_id)
 
 
+@api.post("/media/inspect")
+def media_inspect(payload: MediaInspectPayload) -> dict[str, str]:
+    job_id = job_manager.submit_task(
+        lambda task_id, log: PlatformProcessor(settings, log=log).inspect_media(payload.media, task_id),
+        callback_url=payload.callback_url,
+        export_target=payload.export_target,
+    )
+    return _submission_response(job_id)
+
+
 @api.post("/edit", dependencies=[Depends(_verify_api_key)])
 def edit(payload: ToolkitPayload) -> dict[str, str]:
     return toolkit(payload)
@@ -976,14 +1075,20 @@ async def transcribe_upload(
 
 
 @api.get("/status")
-def status_query(job_id: str = Query(...)) -> dict:
+def status_query(job_id: str | None = Query(default=None)) -> dict:
+    if job_id is None:
+        return {
+            "status": "ok",
+            "queue": job_manager.summary(),
+        }
     return status(job_id)
 
 
 @api.get("/status/{job_id}")
 def status(job_id: str) -> dict:
     try:
-        return job_manager.get(job_id).__dict__
+        record = job_manager.get(job_id)
+        return _status_payload(record)
     except KeyError as exc:
         raise HTTPException(status_code=404, detail="Job not found") from exc
 
@@ -991,7 +1096,7 @@ def status(job_id: str) -> dict:
 @api.post("/cancel/{job_id}")
 def cancel(job_id: str) -> dict:
     try:
-        return job_manager.cancel(job_id).__dict__
+        return _status_payload(job_manager.cancel(job_id))
     except KeyError as exc:
         raise HTTPException(status_code=404, detail="Job not found") from exc
 
@@ -1030,6 +1135,26 @@ def inspect_asset(path: str) -> dict:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
 
 
+@api.get("/render/groups/{group_id}")
+def render_group_status(group_id: str) -> dict[str, Any]:
+    records = job_manager.group(group_id)
+    if not records:
+        raise HTTPException(status_code=404, detail="Render group not found")
+    jobs = [_status_payload(record) for record in records]
+    states = [record.state for record in records]
+    if any(state in {"PENDING", "RUNNING", "CANCEL_REQUESTED"} for state in states):
+        group_state = "RUNNING"
+    elif all(state == "COMPLETED" for state in states):
+        group_state = "COMPLETED"
+    elif any(state == "FAILED" for state in states):
+        group_state = "FAILED"
+    elif any(state == "CANCELLED" for state in states):
+        group_state = "CANCELLED"
+    else:
+        group_state = "RUNNING"
+    return {"group_id": group_id, "state": group_state, "total": len(jobs), "completed": states.count("COMPLETED"), "jobs": jobs}
+
+
 def _render_request(payload: RenderPayload) -> RenderRequest:
     payload = RenderPayload.model_validate(apply_creative_style(apply_preset(payload.model_dump(exclude_unset=True))))
     request = RenderRequest(

app.py

@@ -1,7 +1,10 @@
+import os
 from contextlib import AsyncExitStack, asynccontextmanager
 
-from fastapi.responses import RedirectResponse
+from fastapi import Request
+from fastapi.responses import RedirectResponse, Response
 
+from access_log_filter import install_access_log_filter
 from editor_app import app as editor_app
 from ktts_app import app as tts_app
 from musicgen_app import app as music_app
@@ -10,6 +13,30 @@ from renderer_app import app
 from whisper_app import app as whisper_app
 
 
+install_access_log_filter()
+
+
+def _is_api_docs_path(path: str) -> bool:
+    return (
+        path.endswith("/openapi.json")
+        or path.endswith("/docs")
+        or "/docs/" in path
+        or path.endswith("/redoc")
+    )
+
+
+@app.middleware("http")
+async def protect_api_docs(request: Request, call_next):
+    docs_enabled = os.getenv("ENABLE_API_DOCS", "false").lower() in {
+        "1",
+        "true",
+        "yes",
+    }
+    if not docs_enabled and _is_api_docs_path(request.url.path):
+        return Response(status_code=404)
+    return await call_next(request)
+
+
 CHILD_APPS = (
     ("/tts", tts_app, "tts"),
     ("/music", music_app, "music"),

musicgen_app.py

@@ -33,8 +33,7 @@ def ui_generate(prompt, duration):
 
 
 with gr.Blocks(
-    title="AI Background Music Generator",
-    theme=gr.themes.Soft()
+    title="AI Background Music Generator"
 ) as demo:
 
     gr.Markdown("""
@@ -71,4 +70,9 @@ Generate royalty-free background music instantly.
 # ======================
 # Mount GRADIO as ROOT APP
 
-app = gr.mount_gradio_app(api, demo, path="/")
+app = gr.mount_gradio_app(
+    api,
+    demo,
+    path="/",
+    theme=gr.themes.Soft(),
+)

requirements.txt

@@ -2,7 +2,6 @@
 
 accelerate
 aiofiles>=23.2.1
-email-validator
 fastapi>=0.115.0
 faster-whisper==1.0.3
 ffmpeg-python>=0.2.0
@@ -11,7 +10,7 @@ google-auth>=2.29.0
 google-auth-httplib2>=0.2.0
 google-auth-oauthlib>=1.2.0
 google-generativeai>=0.7.2
-gradio>=5.0.0
+gradio>=6.0,<7
 httplib2>=0.22.0
 huggingface_hub<1.0
 httpx>=0.27.0
@@ -21,21 +20,17 @@ moviepy==1.0.3
 mcp>=1.28.1,<2
 numpy>=1.26.0
 onnxruntime
-passlib[bcrypt]>=1.7.4
 phonemizer
 psutil>=5.9.8
-psycopg2-binary>=2.9.9
 pydantic>=2.7.0
 pytest>=8.2.0
 pytest-cov>=5.0.0
 pysrt>=1.1.2
-python-jose[cryptography]>=3.3.0
 python-magic
 python-multipart>=0.0.9
 requests>=2.31.0
 scipy
 soundfile
-sqlalchemy>=2.0.25
 torch
 torchaudio
 torchvision

requirements.whisper.txt

@@ -50,22 +50,7 @@ google-auth-httplib2>=0.2.0
 # =========================
 google-generativeai>=0.7.2
 
-# =========================
-# AUTH SYSTEM (JWT + SECURITY)
-# =========================
-python-jose[cryptography]>=3.3.0
-
-# FIXED BCRYPT STACK (CRITICAL STABILITY FIX)
-passlib[bcrypt]>=1.7.4
-email-validator
-
-# =========================
-# DATABASE (SQLALCHEMY + POSTGRES)
-# =========================
-sqlalchemy>=2.0.25
-psycopg2-binary>=2.9.9
-
 # =========================
 # OPTIONAL STABILITY LAYER
 # =========================
-aiofiles>=23.2.1
+aiofiles>=23.2.1

whisper_app.py

@@ -14,17 +14,6 @@ from utils.logger import logger
 from utils.job_queue import start_worker, create_job, get_job
 from ingestion.resolver import resolve_input
 
-# ==============================
-# AUTH SYSTEM (HARDENED IMPORT)
-# ==============================
-try:
-    from auth.routes import router as auth_router
-    from auth.database import Base, engine
-    AUTH_ENABLED = True
-except Exception as e:
-    logger.error(f"[AUTH BOOT FAILED] {e}")
-    AUTH_ENABLED = False
-
 # ==============================
 # CORE PIPELINE
 # ==============================
@@ -50,14 +39,6 @@ from publisher.bulk import execute as bulk_execute
 from publisher.metadata_engine import generate_metadata
 from publisher.thumbnail_engine import generate_thumbnail
 
-# ==============================
-# SAFE bcrypt SHIELD (DO NOT FAIL BOOT)
-# ==============================
-try:
-    import bcrypt
-except Exception as e:
-    logger.warning(f"[bcrypt warning ignored] {e}")
-
 # ==============================
 # INIT
 # ==============================
@@ -66,21 +47,6 @@ UPLOAD_DIR = str(BASE_DIR / "jobs")
 os.makedirs(UPLOAD_DIR, exist_ok=True)
 
 
-# =========================================================
-# SAFE DB INITIALIZATION
-# =========================================================
-def init_database_safe():
-    if not AUTH_ENABLED:
-        logger.warning("Auth disabled - skipping DB init")
-        return
-
-    try:
-        Base.metadata.create_all(bind=engine)
-        logger.info("Database initialized successfully")
-    except Exception as e:
-        logger.error(f"Database init failed (non-fatal): {e}")
-
-
 # =========================================================
 # LIFECYCLE
 # =========================================================
@@ -89,9 +55,6 @@ async def lifespan(app: FastAPI):
 
     logger.info("Starting Basyx Whisper V10.1")
 
-    # DB init (NON-FATAL)
-    init_database_safe()
-
     # workers (must not block boot)
     try:
         start_worker()
@@ -123,11 +86,6 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# AUTH ROUTER (only if available)
-if AUTH_ENABLED:
-    app.include_router(auth_router)
-
-
 # =========================================================
 # TASKS
 # =========================================================
@@ -305,8 +263,7 @@ async def execute_router(
 def health():
     return {
         "status": "online",
-        "version": "V10.1",
-        "auth_enabled": AUTH_ENABLED
+        "version": "V10.1"
     }