fix(video): check fal start frame provenance before sending it to the model

A fal start frame now passes the same opaque model-input provenance check as a
Runway reference before its bytes reach the model.

Author: waleedlatif1

apps/sim/lib/internal/video/operations.test.ts

@@ -71,27 +71,30 @@ describe('executeVideoOperation', () => {
     })
   })
 
-  it('fails opaque provenance before inspecting or downloading a Runway file', async () => {
-    mocks.validateOpaqueModelInputProvenance.mockReturnValue({
-      success: false,
-      error: 'Model input provenance is unavailable',
-      status: 400,
-    })
+  it.each(['runway', 'falai'] as const)(
+    'fails opaque provenance before inspecting or downloading a %s file',
+    async (provider) => {
+      mocks.validateOpaqueModelInputProvenance.mockReturnValue({
+        success: false,
+        error: 'Model input provenance is unavailable',
+        status: 400,
+      })
 
-    await expect(
-      executeVideoOperation(
-        {
-          provider: 'runway',
-          apiKey: 'key',
-          prompt: 'A cinematic sunrise',
-          visualReference: file,
-        },
-        { headers: new Headers(), requestId: 'request-1', userId: 'user-1' }
-      )
-    ).rejects.toMatchObject({ status: 400, message: 'Model input provenance is unavailable' })
-    expect(mockAssertToolFileAccess).not.toHaveBeenCalled()
-    expect(mocks.generateVideo).not.toHaveBeenCalled()
-  })
+      await expect(
+        executeVideoOperation(
+          {
+            provider,
+            apiKey: 'key',
+            prompt: 'A cinematic sunrise',
+            visualReference: file,
+          },
+          { headers: new Headers(), requestId: 'request-1', userId: 'user-1' }
+        )
+      ).rejects.toMatchObject({ status: 400, message: 'Model input provenance is unavailable' })
+      expect(mockAssertToolFileAccess).not.toHaveBeenCalled()
+      expect(mocks.generateVideo).not.toHaveBeenCalled()
+    }
+  )
 
   it('fails closed for model-unsafe workspace files', async () => {
     mockIsModelSafeWorkspaceFileKey.mockResolvedValue(false)

apps/sim/lib/internal/video/operations.ts

@@ -72,7 +72,7 @@ function validateModelInputProvenance(
   input: VideoOperationInput,
   context: VideoOperationContext
 ): void {
-  if (input.provider !== 'runway') return
+  if (input.provider !== 'runway' && !input.visualReference) return
   const provenance = validateOpaqueModelInputProvenance({
     headers: context.headers,
     payload: input,