@bendyline/squisq 2.1.0 → 2.3.0

package/dist/{chunk-JHZWYRSW.js → chunk-C33GTPUZ.js}

@@ -1,9 +1,9 @@
 import {
   cloneAndFreezeData
-} from "./chunk-5J4HKRJF.js";
+} from "./chunk-BAOV476U.js";
 import {
   isTransitionType
-} from "./chunk-QE7TWGVT.js";
+} from "./chunk-4VOD55SX.js";
 
 // src/schemas/CustomTemplates.ts
 var FRONTMATTER_CUSTOM_TEMPLATES_KEY = "squisq-custom-templates";
@@ -323,6 +323,14 @@ var V = class {
       }
       if (!this.isString(c.name) || c.name.length === 0) {
         this.err(`${path}.custom.name`, "expected non-empty string");
+      } else if (/[<>{};]/.test(c.name) || [...c.name].some((char) => {
+        const code = char.codePointAt(0);
+        return code < 32 || code === 127;
+      })) {
+        this.err(
+          `${path}.custom.name`,
+          "font name contains control characters or CSS/HTML delimiters"
+        );
       }
       if (!this.isString(c.fallback) || !VALID_FALLBACK.has(c.fallback)) {
         this.err(
@@ -2261,7 +2269,7 @@ function resolveFontFamily(family, roleFallback) {
   if ("custom" in family) {
     const { name, fallback } = family.custom;
     const fb = fallback === "system-ui" ? "system-ui, sans-serif" : fallback === "serif" ? "Georgia, serif" : fallback === "monospace" ? "Consolas, monospace" : "system-ui, sans-serif";
-    const safeName = name.includes(" ") || name.includes(",") ? `"${name}"` : name;
+    const safeName = `"${name.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/[\n\r\f]/g, (ch) => `\\${ch.codePointAt(0).toString(16)} `).replace(/</g, "\\3c ")}"`;
     return `${safeName}, ${fb}`;
   }
   return roleFallback;
@@ -2380,4 +2388,3 @@ export {
   guessFontFallback,
   matchFontFamily
 };
-//# sourceMappingURL=chunk-JHZWYRSW.js.map

package/dist/{chunk-XNLB57UD.js → chunk-EK446BUE.js}

@@ -1,7 +1,7 @@
 import {
   expectedSyllablesAt,
   wordPosAtExpectedSyllables
-} from "./chunk-JI77MGAK.js";
+} from "./chunk-GIIOY6XR.js";
 
 // src/narration/types.ts
 var DEFAULT_FEATURE_CONFIG = Object.freeze({
@@ -50,6 +50,9 @@ var DEFAULT_PACING_CONFIG = Object.freeze({
   resyncSyllables: 8
 });
 var DEFAULT_ALIGN_CONFIG = Object.freeze({
+  maxDurationSec: 2 * 60 * 60,
+  maxPcmSamples: 2e8,
+  maxScriptTokens: 25e4,
   hopSec: 0.01,
   gapMinSec: 0.35,
   bandRadiusSec: 1.5,
@@ -516,11 +519,25 @@ var MAX_BAND_RADIUS_SEC = 60;
 function alignNarration(input, config) {
   const c = { ...DEFAULT_ALIGN_CONFIG, ...config };
   const { pcm, sampleRate, script } = input;
+  input.signal?.throwIfAborted();
+  if (!Number.isFinite(sampleRate) || sampleRate <= 0) {
+    throw new RangeError("sampleRate must be a positive finite number");
+  }
+  if (pcm.length > c.maxPcmSamples) {
+    throw new RangeError(`Narration take exceeds the ${c.maxPcmSamples}-sample safety limit`);
+  }
+  if (script.tokens.length > c.maxScriptTokens) {
+    throw new RangeError(`Narration script exceeds the ${c.maxScriptTokens}-token safety limit`);
+  }
   const takeDuration = pcm.length / Math.max(1, sampleRate);
+  if (takeDuration > c.maxDurationSec) {
+    throw new RangeError(`Narration take exceeds the ${c.maxDurationSec}-second safety limit`);
+  }
   if (script.tokens.length === 0 || takeDuration <= 0) {
     return { words: [], blocks: [], detectedSyllables: 0, cost: 0 };
   }
   const frames = extractFrameFeatures(pcm, sampleRate, { hopSec: c.hopSec });
+  input.signal?.throwIfAborted();
   const vadFlags = runVad(frames);
   const onsets = detectSyllableOnsets(frames, vadFlags);
   const gaps = findSilenceGaps(frames, vadFlags, c.gapMinSec);
@@ -881,4 +898,3 @@ export {
   downsampleTrace,
   alignNarration
 };
-//# sourceMappingURL=chunk-XNLB57UD.js.map

package/dist/{chunk-VR7UPJ7C.js → chunk-FCG3BIZN.js}

@@ -108,6 +108,7 @@ var LocalForageAdapter = class {
       await this.store.removeItem(this.prefix + key);
     } catch (e) {
       console.warn("[Storage] remove (IndexedDB) failed:", key, e);
+      throw e;
     }
   }
   async clear() {
@@ -121,6 +122,7 @@ var LocalForageAdapter = class {
       }
     } catch (e) {
       console.error("[Storage] clear (IndexedDB) failed:", e);
+      throw e;
     }
   }
   async keys() {
@@ -151,6 +153,7 @@ function findDocumentPath(entries) {
 var MemoryContentContainer = class {
   constructor() {
     this.files = /* @__PURE__ */ new Map();
+    this.mutationLock = this;
   }
   async readFile(path) {
     const stored = this.files.get(path)?.data;
@@ -170,6 +173,11 @@ var MemoryContentContainer = class {
       mimeType: mimeType ?? guessMimeType(path)
     });
   }
+  async writeFileExclusive(path, data, mimeType) {
+    if (this.files.has(path)) return false;
+    await this.writeFile(path, data, mimeType);
+    return true;
+  }
   async removeFile(path) {
     this.files.delete(path);
   }
@@ -260,6 +268,10 @@ var ScopedContentContainer = class {
     this.parent = parent;
     this.prefix = normalizePrefix(prefix);
     this.prefixSlash = `${this.prefix}/`;
+    this.mutationLock = parent.mutationLock ?? parent;
+    if (parent.writeFileExclusive) {
+      this.writeFileExclusive = (path, data, mimeType) => parent.writeFileExclusive(this.toParent(path), data, mimeType);
+    }
   }
   toParent(path, options = {}) {
     const normalized = normalizeRelativePath(path, "path", options);
@@ -377,4 +389,3 @@ export {
   scopeContainer,
   createMediaProviderFromContainer
 };
-//# sourceMappingURL=chunk-VR7UPJ7C.js.map