@anvpx/motion-build 0.0.0-stage → 0.1.0

package/dist/cache.js

@@ -0,0 +1,249 @@
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join, resolve } from "node:path";
+import { collectIcons, sceneSourceHash } from "@anvpx/motion-scenes";
+import { canonicalJson } from "@anvpx/motion-schema";
+import { hashAsset, normaliseRef, sha256Of } from "./assets.js";
+import { readVersions } from "./versions.js";
+const VERSION = 2;
+const FILE_NAME = /^[0-9a-f]{64}\.(?:json|refs)(?:\.\d+\.tmp)?$/;
+/** Key of a scene before its assets are known: type, config (incl. overlay `over`/window), placement, salt. */
+export const baseKey = (entry, ctx, salt) => sha256Of(canonicalJson({
+    kind: "scene-base",
+    version: VERSION,
+    sceneType: entry.type,
+    config: entry,
+    placement: {
+        fps: ctx.fps,
+        width: ctx.width,
+        height: ctx.height,
+        duration: ctx.duration,
+        timeline: ctx.timeline ?? null,
+        ...(ctx.insets === undefined ? {} : { insets: ctx.insets }),
+    },
+    salt,
+}));
+/** Final key: the base key plus the content hash of every asset the scene references. */
+export const fullKey = (base, assets) => sha256Of(canonicalJson({ kind: "scene-full", version: VERSION, base, assets }));
+const assetHashes = (refs, hash) => Object.fromEntries(refs.map((ref) => [ref, hash(ref)]));
+const readJson = (path) => {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isCleanRef = (ref) => {
+    if (typeof ref !== "string")
+        return false;
+    try {
+        return normaliseRef(ref) === ref;
+    }
+    catch {
+        return false;
+    }
+};
+const isIconName = (name) => typeof name === "string" && /^[a-z0-9-]+$/.test(name);
+const parseRegistered = (raw) => {
+    if (!isRecord(raw) || raw.version !== VERSION)
+        return undefined;
+    const { refs, icons } = raw;
+    if (!Array.isArray(refs) || !Array.isArray(icons))
+        return undefined;
+    return refs.every(isCleanRef) && icons.every(isIconName)
+        ? { refs: [...refs], icons: [...icons] }
+        : undefined;
+};
+const isSafePath = (path, prefix) => path.startsWith(prefix) && !path.includes("\\") && !path.split("/").includes("..");
+/** A corrupt, tampered or foreign entry yields undefined, i.e. a miss. */
+const parseFiles = (raw, prefix) => {
+    if (!isRecord(raw) || raw.version !== VERSION || !isRecord(raw.files))
+        return undefined;
+    const entries = Object.entries(raw.files);
+    const valid = entries.every(([path, text]) => typeof text === "string" && isSafePath(path, prefix));
+    if (!valid || raw.sha256 !== sha256Of(canonicalJson(raw.files)))
+        return undefined;
+    return new Map(entries);
+};
+/** Scene fragments are kilobytes; anything above this in the shared dir is never trusted. */
+const MAX_SHARED_ENTRY_BYTES = 8 * 1024 * 1024;
+/** Shared entries dated further than this in the future are treated as tampered. */
+const SHARED_MTIME_SKEW_MS = 60_000;
+const sharedBudgetOf = (opts) => opts?.maxSharedEntryBytes ?? MAX_SHARED_ENTRY_BYTES;
+const fileSizeOf = (path) => {
+    try {
+        return statSync(path).size;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Missing or future-dated files in the shared dir are never trusted: a miss, never an error. */
+const isPlausibleSharedFile = (path) => {
+    try {
+        return statSync(path).mtimeMs <= Date.now() + SHARED_MTIME_SKEW_MS;
+    }
+    catch {
+        return false;
+    }
+};
+const readSharedJson = (path, maxBytes) => {
+    const size = fileSizeOf(path);
+    if (size === undefined || size > maxBytes)
+        return undefined;
+    return readJson(path);
+};
+/** Reads one entry; shared reads add mtime and size guards, local reads stay as they were. */
+const loadFromDir = (dir, base, hash, prefix, maxBytes) => {
+    const refsPath = join(dir, `${base}.refs`);
+    if (maxBytes !== undefined && !isPlausibleSharedFile(refsPath))
+        return undefined;
+    const registered = parseRegistered(maxBytes === undefined ? readJson(refsPath) : readSharedJson(refsPath, maxBytes));
+    if (!registered)
+        return undefined;
+    const { refs, icons } = registered;
+    const key = fullKey(base, assetHashes(refs, hash));
+    const jsonPath = join(dir, `${key}.json`);
+    if (maxBytes !== undefined && !isPlausibleSharedFile(jsonPath))
+        return undefined;
+    const files = parseFiles(maxBytes === undefined ? readJson(jsonPath) : readSharedJson(jsonPath, maxBytes), prefix);
+    return files ? { files, refs, icons } : undefined;
+};
+/** Stores one entry; callers swallow failures so a failed store only costs a future miss. */
+const storeInDir = (dir, base, refs, hash, files, icons) => {
+    mkdirSync(dir, { recursive: true });
+    const object = Object.fromEntries(files);
+    const key = fullKey(base, assetHashes(refs, hash));
+    writeAtomic(dir, key, "json", {
+        version: VERSION,
+        files: object,
+        sha256: sha256Of(canonicalJson(object)),
+    });
+    writeAtomic(dir, base, "refs", { version: VERSION, refs, icons });
+};
+const writeAtomic = (dir, key, ext, data) => {
+    const target = join(dir, `${key}.${ext}`);
+    const tmp = `${target}.${process.pid}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(data));
+        renameSync(tmp, target);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+};
+/**
+ * Disk-backed cache; every failure degrades to a miss or a skipped store, never an error.
+ * With `sharedDir` set, entries are content-addressed (same salt plus config plus asset
+ * hashes yields the same keys), so two storyboards sharing a scene share its entries: load
+ * falls back to the shared dir and promotes hits locally, save writes through to both.
+ */
+export const createDiskCache = (dir, opts) => {
+    const sharedDir = opts?.sharedDir;
+    const shared = sharedDir === undefined || resolve(sharedDir) === resolve(dir) ? undefined : sharedDir;
+    const maxBytes = shared === undefined ? 0 : sharedBudgetOf(opts);
+    return {
+        load(base, hash, prefix) {
+            const local = loadFromDir(dir, base, hash, prefix, undefined);
+            if (local !== undefined || shared === undefined)
+                return local;
+            const hit = loadFromDir(shared, base, hash, prefix, maxBytes);
+            if (!hit)
+                return undefined;
+            try {
+                storeInDir(dir, base, hit.refs, hash, hit.files, hit.icons);
+            }
+            catch {
+                // promotion is best-effort; the shared hit still counts
+            }
+            return hit;
+        },
+        save(base, refs, hash, files, icons) {
+            try {
+                storeInDir(dir, base, refs, hash, files, icons);
+            }
+            catch {
+                // a failed store only costs a future miss
+            }
+            if (shared !== undefined) {
+                try {
+                    storeInDir(shared, base, refs, hash, files, icons);
+                }
+                catch {
+                    // a failed shared store only costs a future shared miss
+                }
+            }
+        },
+    };
+};
+/** Deletes cache files only (hex-named `.json`/`.refs` and their tmp files); returns how many. */
+export const clearCache = (dir) => {
+    let names;
+    try {
+        names = readdirSync(dir).filter((name) => FILE_NAME.test(name));
+    }
+    catch {
+        return 0;
+    }
+    for (const name of names)
+        rmSync(join(dir, name), { force: true });
+    try {
+        rmdirSync(dir);
+    }
+    catch {
+        // not empty (foreign files): leave the directory alone
+    }
+    return names.length;
+};
+export const createCachePlan = (dir, theme, assetsDir, opts) => {
+    const { packages, hyperframes, node } = readVersions();
+    const memo = new Map();
+    return {
+        cache: createDiskCache(dir, opts),
+        salt: {
+            themeHash: sha256Of(canonicalJson(theme)),
+            packages,
+            hyperframes,
+            nodeMajor: node.split(".")[0] ?? node,
+            scenesSource: sceneSourceHash(),
+        },
+        hashAsset: (ref) => {
+            const known = memo.get(ref) ?? hashAsset(assetsDir, ref);
+            memo.set(ref, known);
+            return known;
+        },
+        stats: { hits: 0, misses: 0 },
+    };
+};
+/**
+ * Replays a cached scene (re-registering its asset refs) or emits and stores it. The icon names the
+ * scene drew go to `onIcons` either way, so a cache hit still reaches the licence ledger.
+ */
+export const emitCached = (plan, entry, ctx, emit, onIcons = () => undefined) => {
+    const base = baseKey(entry, ctx, plan.salt);
+    const hit = plan.cache.load(base, plan.hashAsset, `scenes/${entry.id}/`);
+    if (hit) {
+        for (const ref of hit.refs)
+            ctx.assetResolver(ref);
+        onIcons(hit.icons);
+        plan.stats.hits += 1;
+        return hit.files;
+    }
+    plan.stats.misses += 1;
+    const refs = [];
+    const { value: files, icons } = collectIcons(() => emit({
+        ...ctx,
+        assetResolver: (ref) => {
+            const resolved = ctx.assetResolver(ref);
+            const clean = normaliseRef(ref);
+            if (!refs.includes(clean))
+                refs.push(clean);
+            return resolved;
+        },
+    }));
+    plan.cache.save(base, refs, plan.hashAsset, files, icons);
+    onIcons(icons);
+    return files;
+};

package/dist/emit/boot.d.ts

@@ -0,0 +1,16 @@
+import type { TimedScene } from "../timing.ts";
+export interface BootScene {
+    readonly timed: Pick<TimedScene, "id" | "start" | "duration" | "overlap"> & {
+        readonly transition?: TimedScene["transition"];
+    };
+    /** Visible through its last frame (the closing base scene, or an overlay ending with it). */
+    readonly final: boolean;
+    readonly config: {
+        readonly ease?: string;
+        readonly move?: string;
+        readonly focus?: string;
+    };
+}
+export declare const clipId: (sceneId: string) => string;
+/** The single boot.js: mounts every scene and wires one `hf-seek` listener. */
+export declare const renderBoot: (scenes: readonly BootScene[], fps: number) => string;

package/dist/emit/boot.js

@@ -0,0 +1,32 @@
+import { readFileSync } from "node:fs";
+import { safeJson } from "./safe-json.js";
+const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const template = () => readFileSync(new URL("./boot.template.js", import.meta.url), "utf8").replaceAll("\r\n", "\n");
+export const clipId = (sceneId) => `clip-${sceneId}`;
+const importLines = (scenes) => {
+    const names = scenes.map((_, index) => `scene${index}`);
+    const imports = scenes.map(({ timed }, index) => {
+        if (!SLUG.test(timed.id))
+            throw new Error(`scene id "${timed.id}" is not a slug`);
+        return `import { createScene as ${names[index]} } from "./scenes/${timed.id}/scene.js";`;
+    });
+    return [...imports, `const FACTORIES = [${names.join(", ")}];`].join("\n");
+};
+const configJson = (scenes, fps) => safeJson({
+    fps,
+    scenes: scenes.map(({ timed, config, final }) => ({
+        clipId: clipId(timed.id),
+        start: timed.start,
+        duration: timed.duration,
+        overlap: timed.overlap,
+        ...(timed.transition === "push" ? { push: true } : {}),
+        ...(timed.transition === "wipe" ? { wipe: true } : {}),
+        ...(timed.transition === "zoom-through" ? { zoomThrough: true } : {}),
+        final,
+        config,
+    })),
+});
+/** The single boot.js: mounts every scene and wires one `hf-seek` listener. */
+export const renderBoot = (scenes, fps) => template()
+    .replace("/*@imports*/", () => importLines(scenes))
+    .replace("/*@config*/ null", () => configJson(scenes, fps));

package/dist/emit/boot.template.js

@@ -0,0 +1,85 @@
+// Emitted boot glue: the only file that knows the renderer's `hf-seek` event.
+/*@imports*/
+window.__timelines = window.__timelines || {};
+const CONFIG = /*@config*/ null;
+
+const clamp = (value, low, high) => Math.min(high, Math.max(low, value));
+
+const ease = (p) => 1 - (1 - p) ** 3;
+
+/** Eased progress 0..1 of a scene entering over its predecessor (1 when no overlap transition). */
+const transOf = (t, scene) =>
+  scene?.overlap > 0 && (scene.push || scene.wipe || scene.zoomThrough)
+    ? ease(clamp((t - scene.start) / scene.overlap, 0, 1))
+    : 1;
+
+/** Push progress 0..1 of a scene entering over its predecessor (1 when it is not a push). */
+const pushOf = (t, scene) => (scene?.push && scene.overlap > 0 ? transOf(t, scene) : 1);
+
+/** Pure function of global time `t`: local scene time, visibility and fade opacity. */
+const stateAt = (t, scene) => {
+  const end = scene.start + scene.duration;
+  const live = t >= scene.start && (t < end || (scene.final && t <= end));
+  const fade = scene.overlap > 0 ? clamp((t - scene.start) / scene.overlap, 0, 1) : 1;
+  return {
+    local: clamp(t - scene.start, 0, scene.duration),
+    visible: live,
+    opacity: live ? (scene.push || scene.wipe ? 1 : fade) : 0,
+  };
+};
+
+const mounts = CONFIG.scenes.map((scene, index) => {
+  const clip = document.getElementById(scene.clipId);
+  const ctx = { fps: CONFIG.fps, duration: scene.duration };
+  const runtime = FACTORIES[index](clip.firstElementChild, scene.config, ctx);
+  return { scene, clip, runtime };
+});
+
+const ready = Promise.all([document.fonts.ready, ...mounts.map((mount) => mount.runtime.ready)]);
+
+/** Horizontal offset in percent: an entering push scene starts one frame to the right, the one it replaces leaves to the left. */
+const offsetOf = (t, scene, next) => {
+  if (scene.push) return (1 - pushOf(t, scene)) * 100;
+  return next?.push ? -pushOf(t, next) * 100 : null;
+};
+
+/** Scale punch of a zoom-through: incoming shrinks 1.25 -> 1, outgoing grows 1 -> 1.12. */
+const ZOOM_IN_FROM = 1.25;
+const ZOOM_OUT_TO = 1.12;
+
+const scaleOf = (t, scene, next) => {
+  if (scene.zoomThrough) return ZOOM_IN_FROM - (ZOOM_IN_FROM - 1) * transOf(t, scene);
+  if (next?.zoomThrough) return 1 + (ZOOM_OUT_TO - 1) * transOf(t, next);
+  return null;
+};
+
+/** Directional reveal of a wipe: incoming clip opens left -> right. */
+const clipOf = (t, scene) => {
+  if (!scene.wipe) return null;
+  const p = transOf(t, scene);
+  if (p >= 1) return "";
+  return `inset(0 ${(1 - p) * 100}% 0 0)`;
+};
+
+const apply = (t) =>
+  mounts.map(({ scene, clip, runtime }, index) => {
+    const state = stateAt(t, scene);
+    clip.style.visibility = state.visible ? "visible" : "hidden";
+    clip.style.opacity = String(state.opacity);
+    const next = CONFIG.scenes[index + 1];
+    const offset = offsetOf(t, scene, next);
+    if (offset !== null) clip.style.transform = `translateX(${offset}%)`;
+    else {
+      const scale = scaleOf(t, scene, next);
+      if (scale !== null) clip.style.transform = `scale(${scale})`;
+    }
+    const clipPath = clipOf(t, scene);
+    if (clipPath !== null) clip.style.clipPath = clipPath;
+    return runtime.seek(state.local);
+  });
+
+window.addEventListener("hf-seek", (event) => {
+  event.detail.waitUntil(Promise.all([ready, ...apply(event.detail.time)]));
+});
+
+apply(0);

package/dist/emit/fragment-guard.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The CSP forbids inline script, so a scene fragment may not carry any.
+ * Throws a message naming the scene so the build fails with a fixable error.
+ */
+export declare const assertInertFragment: (sceneId: string, fragment: string) => void;

package/dist/emit/fragment-guard.js

@@ -0,0 +1,15 @@
+const SCRIPT_TAG = /<script/i;
+/** An `on*` attribute inside a tag (`<img onerror=...>`, `<a/onclick=...>`). */
+const EVENT_HANDLER = /<[^>]*[\s/"']on[a-z]+\s*=/i;
+/**
+ * The CSP forbids inline script, so a scene fragment may not carry any.
+ * Throws a message naming the scene so the build fails with a fixable error.
+ */
+export const assertInertFragment = (sceneId, fragment) => {
+    if (SCRIPT_TAG.test(fragment)) {
+        throw new Error(`scene "${sceneId}" fragment contains <script>; scripts live in scene.js`);
+    }
+    if (EVENT_HANDLER.test(fragment)) {
+        throw new Error(`scene "${sceneId}" fragment contains an inline event handler (on*=)`);
+    }
+};

package/dist/emit/index-html.d.ts

@@ -0,0 +1,26 @@
+import type { StoryboardMeta } from "@anvpx/motion-schema";
+/**
+ * Defence in depth (PLAN 3b); `script-src` and `style-src` allow 'self' for emitted modules and sheets.
+ * `script-src 'unsafe-inline'` stays only because HyperFrames injects its own runtime as inline
+ * scripts (check/snapshot/render fail without it, verified 0.8.212). The page itself emits no inline
+ * script and `assertInertFragment` rejects `<script` and `on*=` in scene fragments.
+ */
+export declare const CSP: string;
+export interface PageScene {
+    readonly id: string;
+    readonly start: number;
+    readonly duration: number;
+    readonly index: number;
+    /** The scene fragment (`<section id="scene-…">…</section>`). */
+    readonly fragment: string;
+}
+export interface PageInput {
+    readonly meta: StoryboardMeta;
+    readonly total: number;
+    readonly themeCss: string;
+    readonly scenes: readonly PageScene[];
+    /** Import-map tag for vendored libraries; "" when no scene imports one. */
+    readonly importMap?: string;
+}
+/** The root composition: scenes inline, scene stylesheets linked, boot.js as the only module. */
+export declare const renderIndexHtml: (input: PageInput) => string;

package/dist/emit/index-html.js

@@ -0,0 +1,63 @@
+import { esc } from "@anvpx/motion-scenes";
+import { FONTS_STYLESHEET } from "../fonts.js";
+import { clipId } from "./boot.js";
+/**
+ * Defence in depth (PLAN 3b); `script-src` and `style-src` allow 'self' for emitted modules and sheets.
+ * `script-src 'unsafe-inline'` stays only because HyperFrames injects its own runtime as inline
+ * scripts (check/snapshot/render fail without it, verified 0.8.212). The page itself emits no inline
+ * script and `assertInertFragment` rejects `<script` and `on*=` in scene fragments.
+ */
+export const CSP = [
+    "default-src 'none'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "font-src 'self' data:",
+    "media-src 'self' data:",
+    "connect-src 'none'",
+    "worker-src 'none'",
+    "frame-src 'none'",
+].join("; ");
+const baseCss = (meta) => `html, body {
+  margin: 0;
+  width: ${meta.width}px;
+  height: ${meta.height}px;
+  overflow: hidden;
+  background: var(--mk-color-bg);
+}
+#root { position: relative; width: ${meta.width}px; height: ${meta.height}px; overflow: hidden; }
+.clip { position: absolute; inset: 0; }
+`;
+const clipHtml = (scene) => [
+    `<div id="${clipId(scene.id)}" class="clip" data-start="${scene.start}"`,
+    ` data-duration="${scene.duration}" data-track-index="${scene.index}">\n`,
+    scene.fragment.trimEnd(),
+    "\n</div>",
+].join("");
+/** The root composition: scenes inline, scene stylesheets linked, boot.js as the only module. */
+export const renderIndexHtml = (input) => {
+    const { meta } = input;
+    const links = [
+        FONTS_STYLESHEET,
+        ...input.scenes.map((scene) => `scenes/${scene.id}/style.css`),
+    ].map((href) => `    <link rel="stylesheet" href="${href}" />`);
+    return `<!doctype html>
+<html lang="${esc(meta.lang ?? "en")}">
+  <head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="Content-Security-Policy" content="${CSP}" />
+    <meta name="viewport" content="width=${meta.width}, height=${meta.height}" />
+    <title>${esc(meta.title)}</title>
+    <style>
+${input.themeCss}${baseCss(meta)}    </style>
+${links.join("\n")}
+${input.importMap ?? ""}  </head>
+  <body>
+    <div id="root" data-composition-id="main" data-no-timeline data-start="0" data-duration="${input.total}" data-width="${meta.width}" data-height="${meta.height}">
+${input.scenes.map(clipHtml).join("\n")}
+    </div>
+    <script type="module" src="boot.js"></script>
+  </body>
+</html>
+`;
+};

package/dist/emit/safe-json.d.ts

@@ -0,0 +1,2 @@
+/** JSON that is safe inside `<script>` and in JS source (no `</script>`, no U+2028/2029). */
+export declare const safeJson: (value: unknown) => string;

package/dist/emit/safe-json.js

@@ -0,0 +1,7 @@
+const BACKSLASH = String.fromCharCode(0x5c);
+const LINE_SEPARATOR = String.fromCharCode(0x2028);
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029);
+const UNSAFE = new RegExp(`[<>&${LINE_SEPARATOR}${PARAGRAPH_SEPARATOR}]`, "g");
+const unicodeEscape = (char) => `${BACKSLASH}u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+/** JSON that is safe inside `<script>` and in JS source (no `</script>`, no U+2028/2029). */
+export const safeJson = (value) => JSON.stringify(value).replace(UNSAFE, unicodeEscape);

package/dist/emit/vendor.d.ts

@@ -0,0 +1,7 @@
+import type { VendorLib } from "@anvpx/motion-schema";
+/** Vendor libraries named by scenes, deduplicated and in a stable order. */
+export declare const vendorLibs: (used: readonly VendorLib[]) => readonly VendorLib[];
+/** `vendor/…` path -> bytes, for every library in `libs`. Empty when nothing is vendored. */
+export declare const vendorFiles: (libs: readonly VendorLib[]) => Map<string, Uint8Array>;
+/** The `importmap` script tag, or "" when no scene imports a vendored library. */
+export declare const renderImportMap: (libs: readonly VendorLib[]) => string;

package/dist/emit/vendor.js

@@ -0,0 +1,57 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const SPECS = [
+    {
+        specifier: "three",
+        pkg: "three",
+        // three.module.js re-exports the core build, so both files are required.
+        files: [
+            ["three.module.js", "three.module.js"],
+            ["three.core.js", "three.core.js"],
+        ],
+        target: "vendor/three.module.js",
+    },
+    {
+        specifier: "postprocessing",
+        pkg: "postprocessing",
+        // Imports `three` by bare specifier; the import map resolves it to the copy above.
+        files: [["index.js", "postprocessing.js"]],
+        target: "vendor/postprocessing.js",
+    },
+];
+const specOf = (lib) => {
+    const spec = SPECS.find((candidate) => candidate.specifier === lib);
+    if (spec === undefined)
+        throw new Error(`unknown vendor library "${lib}"`);
+    return spec;
+};
+/** Directory holding a package's ESM entry, resolved from this module. */
+const entryDir = (pkg) => {
+    const resolved = import.meta.resolve(pkg);
+    if (!resolved.startsWith("file:"))
+        throw new Error(`vendor package "${pkg}" is not a local file`);
+    return dirname(fileURLToPath(resolved));
+};
+/** Vendor libraries named by scenes, deduplicated and in a stable order. */
+export const vendorLibs = (used) => [...new Set(used)].sort();
+/** `vendor/…` path -> bytes, for every library in `libs`. Empty when nothing is vendored. */
+export const vendorFiles = (libs) => {
+    const files = new Map();
+    for (const lib of vendorLibs(libs)) {
+        const spec = specOf(lib);
+        const dir = entryDir(spec.pkg);
+        for (const [source, dest] of spec.files) {
+            files.set(`vendor/${dest}`, readFileSync(join(dir, source)));
+        }
+    }
+    return files;
+};
+/** The `importmap` script tag, or "" when no scene imports a vendored library. */
+export const renderImportMap = (libs) => {
+    const sorted = vendorLibs(libs);
+    if (sorted.length === 0)
+        return "";
+    const imports = Object.fromEntries(sorted.map((lib) => [specOf(lib).specifier, `./${specOf(lib).target}`]));
+    return `    <script type="importmap">${JSON.stringify({ imports })}</script>\n`;
+};

package/dist/fonts.d.ts

@@ -0,0 +1,39 @@
+import type { AssetRow } from "@anvpx/motion-schema";
+/** Weights the scenes use for Inter (400 body default; 600/700/800 declared in scene styles). */
+export declare const FONT_WEIGHTS: readonly [400, 600, 700, 800];
+export declare const FONTS_STYLESHEET = "fonts/fonts.css";
+export type FontFamilyId = "inter" | "space-grotesk" | "jetbrains-mono" | "source-serif-4";
+interface FontFamily {
+    /** CSS family name as it appears in theme font stacks. */
+    readonly name: string;
+    readonly weights: readonly number[];
+    readonly sourceUrl: string;
+    readonly attribution: string;
+    /** Output path of this family's OFL text. */
+    readonly licencePath: string;
+}
+/** Latin subset only; order here is the emission order (Inter first keeps default output stable). */
+export declare const FONT_FAMILIES: Readonly<Record<FontFamilyId, FontFamily>>;
+export interface FontBundle {
+    /** Project-relative output path -> bytes. */
+    readonly files: ReadonlyMap<string, Uint8Array>;
+    /** One licence row per shipped font file, ready for the credits / assets ledger. */
+    readonly licences: readonly AssetRow[];
+}
+export interface FontSizeReport {
+    readonly files: readonly {
+        readonly path: string;
+        readonly bytes: number;
+    }[];
+    readonly totalBytes: number;
+}
+/** Families whose CSS name appears in a theme's font stacks; Inter (the base face) is always first. */
+export declare const fontFamiliesFor: (fonts: Readonly<Record<string, string>>) => FontFamilyId[];
+/** Per-file bytes and the total, for the build's size report. */
+export declare const fontSizeReport: (bundle: FontBundle) => FontSizeReport;
+/**
+ * Reads the pinned `@fontsource/*` latin subsets so renders never fetch fonts over the network.
+ * Pass only the families a theme uses (see `fontFamiliesFor`); the default is Inter alone.
+ */
+export declare const bundleFonts: (families?: readonly FontFamilyId[]) => FontBundle;
+export {};