@cueframe/kernel 0.2.2 → 0.2.3

package/dist/chunk-DQLYWNLC.js

@@ -0,0 +1,2063 @@
+import {
+  cacheDir,
+  componentDir,
+  findWorkspace
+} from "./chunk-WB2VFDQZ.js";
+import {
+  sha256Hex,
+  sourceVersionId
+} from "./chunk-EXY4JJPH.js";
+import {
+  assertComponentImportsAllowed
+} from "./chunk-A74FZCPY.js";
+import {
+  assertComponentBrowserHardware,
+  componentBrowserBackend,
+  componentBrowserOptions,
+  readGpuAttestation
+} from "./chunk-WIHXXF3X.js";
+import {
+  ComponentCapturePageRasterAttestationV1,
+  ComponentGraphicsApiV2,
+  ComponentRuntimeError,
+  ComponentRuntimeErrorCode,
+  ComponentSourceV2,
+  ComponentStillPngContainerFactsV1,
+  ComponentStillSessionAttestationV1,
+  ComponentStillSessionHostAttestationV1
+} from "./chunk-ZVG446DJ.js";
+import {
+  parseSceneShotSpecV2
+} from "./chunk-MH3UPKWR.js";
+
+// ../execution/component-runtime/src/sceneAdmission.ts
+import { ZodError } from "zod";
+var SUPPORTED_SCENE_SHOT_VERSIONS = Object.freeze([2]);
+var SCENE_SHOT_PARAM = "scene";
+var SCENE_ADMISSION_STAGE = "admission";
+function subject(context) {
+  const component = context.componentId ? `component '${context.componentId}'` : "component";
+  return context.clipId ? `clip '${context.clipId}' (${component})` : component;
+}
+function locator(context, path) {
+  return {
+    stage: SCENE_ADMISSION_STAGE,
+    ...context.clipId ? { clipId: context.clipId } : {},
+    ...context.componentId ? { componentId: context.componentId } : {},
+    path
+  };
+}
+function sceneShotIssuePath(path) {
+  return [SCENE_SHOT_PARAM, ...path.map(String)].join(".");
+}
+function assertSceneShotCapabilitySupported(manifest, context = {}) {
+  if (!manifest || typeof manifest !== "object") return null;
+  const record = manifest;
+  if (record.sceneShot === void 0) return null;
+  const declaration = record.sceneShot;
+  const declared = declaration && typeof declaration === "object" && !Array.isArray(declaration) ? declaration.version : void 0;
+  if (typeof declared !== "number") {
+    throw new ComponentRuntimeError(
+      "unsupported_runtime_version",
+      `Scene-shot admission refused for ${subject(context)}: manifest declares sceneShot but manifest.sceneShot.version is not a number (received ${JSON.stringify(declaration) ?? String(declaration)}). Declare sceneShot as { version: ${SUPPORTED_SCENE_SHOT_VERSIONS.join(" | ")} } or remove it; a declaration this runtime cannot read is never treated as an ordinary component.`,
+      { locator: locator(context, "manifest.sceneShot.version") }
+    );
+  }
+  if (!SUPPORTED_SCENE_SHOT_VERSIONS.includes(declared)) {
+    throw new ComponentRuntimeError(
+      "unsupported_runtime_version",
+      `Scene-shot admission refused for ${subject(context)}: manifest.sceneShot.version ${declared} is not supported by this runtime (supported: ${SUPPORTED_SCENE_SHOT_VERSIONS.join(", ")}). Re-author the source with a supported sceneShot.version or upgrade the runtime.`,
+      { locator: locator(context, "manifest.sceneShot.version") }
+    );
+  }
+  const api = record.graphics && typeof record.graphics === "object" ? record.graphics.api : void 0;
+  if (api !== "webgl") {
+    throw new ComponentRuntimeError(
+      "invalid_component_source",
+      `Scene-shot admission refused for ${subject(context)}: manifest declares sceneShot but manifest.graphics.api is ${JSON.stringify(api)}. Set manifest.graphics.api to "webgl"; a scene shot renders through WebGL and is never captured as ${typeof api === "string" ? api : "another api"}.`,
+      { locator: locator(context, "manifest.graphics.api") }
+    );
+  }
+  return { version: declared };
+}
+function assertSceneShotParamsAdmitted(manifest, params, context = {}) {
+  if (!assertSceneShotCapabilitySupported(manifest, context)) return null;
+  try {
+    return parseSceneShotSpecV2(params[SCENE_SHOT_PARAM]);
+  } catch (error) {
+    if (!(error instanceof ZodError)) throw error;
+    const [first, ...rest] = error.issues;
+    const path = sceneShotIssuePath(first?.path ?? []);
+    const detail = first?.message ?? "invalid value";
+    const remaining = rest.length > 0 ? ` (${rest.length} more issue${rest.length === 1 ? "" : "s"})` : "";
+    throw new ComponentRuntimeError(
+      "component_scene_invalid",
+      `Scene-shot admission refused for ${subject(context)}: params.scene is invalid at ${path}: ${detail}${remaining}. Correct the clip's scene spec at that path.`,
+      { cause: error, locator: locator(context, path) }
+    );
+  }
+}
+
+// ../execution/component-runtime/src/sourceWorkspace.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+var PINNED_SOURCE_FILENAME = "component-source-v2.json";
+function materializeComponentSource(workspaceRoot, input) {
+  assertSceneShotCapabilitySupported(input?.manifest, { componentId: input?.componentId });
+  const source = ComponentSourceV2.parse(input);
+  assertComponentImportsAllowed(source.tsxSource, source.manifest.graphics.api);
+  mkdirSync(workspaceRoot, { recursive: true });
+  writeFileSync(join(workspaceRoot, "cueframe.json"), '{"componentsDir":"cueframe/components"}\n', {
+    flag: "wx"
+  });
+  const dir = join(workspaceRoot, "cueframe", "components", source.componentId);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "index.tsx"), source.tsxSource, { flag: "wx" });
+  writeFileSync(join(dir, PINNED_SOURCE_FILENAME), `${JSON.stringify(source)}
+`, { flag: "wx" });
+  const workspace = findWorkspace(workspaceRoot);
+  if (!workspace) throw new Error("Materialized component workspace could not be opened.");
+  return {
+    workspace,
+    source,
+    sourceVersionId: sourceVersionId(source),
+    componentDir: dir
+  };
+}
+function readMaterializedComponentSource(ws, id) {
+  const path = join(componentDir(ws, id), PINNED_SOURCE_FILENAME);
+  if (!existsSync(path)) return null;
+  return ComponentSourceV2.parse(JSON.parse(readFileSync(path, "utf8")));
+}
+
+// ../execution/component-runtime/src/browserFirewall.ts
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function decideComponentRequest(url, resourceType, documentOrigin, allowedAssetOrigins) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { allow: false, documentOrigin };
+  }
+  if (parsed.protocol === "data:" || parsed.protocol === "blob:" || parsed.protocol === "about:") {
+    return { allow: true, documentOrigin };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { allow: false, documentOrigin };
+  }
+  if (documentOrigin === null && resourceType === "Document" && isLoopbackHost(parsed.hostname)) {
+    return { allow: true, documentOrigin: parsed.origin };
+  }
+  return {
+    allow: parsed.origin === documentOrigin || allowedAssetOrigins.has(parsed.origin),
+    documentOrigin
+  };
+}
+var PAGE_LOCKDOWN = `
+Object.defineProperties(globalThis, {
+  open: { value: undefined },
+  Worker: { value: undefined },
+  SharedWorker: { value: undefined },
+  RTCPeerConnection: { value: undefined },
+  webkitRTCPeerConnection: { value: undefined },
+  WebSocket: { value: undefined },
+  EventSource: { value: undefined }
+});
+`;
+var COMPONENT_PAGE_LOCKDOWN = PAGE_LOCKDOWN;
+async function installComponentRequestFirewall(browser, allowedAssetOrigins, onDiagnostic) {
+  let closing = false;
+  let fatal = null;
+  let closePromise = null;
+  const denied = [];
+  const closeBrowser = browser.close.bind(browser);
+  const close = () => {
+    closing = true;
+    closePromise ??= closeBrowser({ silent: true });
+    return closePromise;
+  };
+  browser.close = async (options) => {
+    closing = true;
+    closePromise ??= closeBrowser(options);
+    return await closePromise;
+  };
+  const configureSession = async (client) => {
+    let documentOrigin = null;
+    client.on("Fetch.requestPaused", (event) => {
+      const decision = decideComponentRequest(
+        event.request.url,
+        event.resourceType,
+        documentOrigin,
+        allowedAssetOrigins
+      );
+      documentOrigin = decision.documentOrigin;
+      if (!decision.allow) denied.push(event.request.url);
+      const action = decision.allow ? client.send("Fetch.continueRequest", { requestId: event.requestId }) : client.send("Fetch.failRequest", { requestId: event.requestId, errorReason: "BlockedByClient" });
+      void action.catch(() => {
+      });
+    });
+    client.on("Network.loadingFailed", (event) => {
+      onDiagnostic?.({ type: "request-failed", message: String(event.errorText ?? "request failed") });
+    });
+    client.on("Runtime.exceptionThrown", (event) => {
+      onDiagnostic?.({ type: "page-error", message: String(event.exceptionDetails?.text ?? "page exception") });
+    });
+    await client.send("Network.enable");
+    await client.send("Runtime.enable");
+    await client.send("Fetch.enable", { patterns: [{ urlPattern: "*" }] });
+    await client.send("Page.addScriptToEvaluateOnNewDocument", { source: PAGE_LOCKDOWN });
+    await client.send("Runtime.runIfWaitingForDebugger");
+  };
+  browser.connection.on("sessionattached", (client) => {
+    void configureSession(client).catch((error) => {
+      fatal ??= error;
+      if (!closing) void close().catch(() => {
+      });
+    });
+  });
+  await browser.connection.send("Target.setAutoAttach", {
+    autoAttach: true,
+    waitForDebuggerOnStart: true,
+    flatten: true,
+    filter: [{ type: "page", exclude: false }, { exclude: true }]
+  });
+  return {
+    deniedRequests: () => denied,
+    fatalError: () => fatal,
+    close
+  };
+}
+
+// ../execution/component-runtime/src/renderDiagnostics.ts
+var GRAPHICS_ATTESTATION_PREFIX = "__cueframe_graphics_v2__:";
+var CAPTURE_PAGE_RASTER_ATTESTATION_PREFIX = "__cueframe_capture_raster_v1__:";
+var BROWSER_RUNTIME_ERROR_PREFIX = "__cueframe_component_error_v2__:";
+function componentRuntimeError(error, fallbackCode, retryable = false) {
+  if (error instanceof ComponentRuntimeError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  const marker = message.lastIndexOf(BROWSER_RUNTIME_ERROR_PREFIX);
+  if (marker >= 0) {
+    const payload = message.slice(marker + BROWSER_RUNTIME_ERROR_PREFIX.length);
+    const separator = payload.indexOf(":");
+    const code = ComponentRuntimeErrorCode.safeParse(separator >= 0 ? payload.slice(0, separator) : payload);
+    if (code.success) {
+      return new ComponentRuntimeError(
+        code.data,
+        separator >= 0 ? payload.slice(separator + 1) : message,
+        { retryable: code.data === "component_device_lost" || code.data === "component_deadline_exceeded", cause: error }
+      );
+    }
+  }
+  return new ComponentRuntimeError(fallbackCode, message, { retryable, cause: error });
+}
+function parseGraphicsAttestationLog(text) {
+  if (!text.startsWith(GRAPHICS_ATTESTATION_PREFIX)) return null;
+  try {
+    const parsed = JSON.parse(text.slice(GRAPHICS_ATTESTATION_PREFIX.length));
+    if (!ComponentGraphicsApiV2.safeParse(parsed.api).success || parsed.acceleration !== "hardware" && parsed.acceleration !== "software" || parsed.deviceLost !== false) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function parseCapturePageRasterAttestationLog(text) {
+  if (!text.startsWith(CAPTURE_PAGE_RASTER_ATTESTATION_PREFIX)) return null;
+  try {
+    return ComponentCapturePageRasterAttestationV1.parse(
+      JSON.parse(text.slice(CAPTURE_PAGE_RASTER_ATTESTATION_PREFIX.length))
+    );
+  } catch {
+    return null;
+  }
+}
+function graphicsCollector(required) {
+  let attestation = null;
+  return {
+    onBrowserLog(log) {
+      const parsed = parseGraphicsAttestationLog(log.text);
+      if (!parsed) return;
+      if (parsed.api !== required.api) {
+        throw new ComponentRuntimeError(
+          "component_graphics_mismatch",
+          `Renderer reported ${parsed.api} for a ${required.api} component.`
+        );
+      }
+      if (attestation && JSON.stringify(attestation) !== JSON.stringify(parsed)) {
+        throw new ComponentRuntimeError(
+          "component_graphics_mismatch",
+          "Renderer workers reported inconsistent graphics adapters."
+        );
+      }
+      attestation = parsed;
+    },
+    receipt() {
+      if (!attestation) {
+        throw new ComponentRuntimeError(
+          "component_graphics_unavailable",
+          `Renderer produced no trusted ${required.api} attestation.`
+        );
+      }
+      return attestation;
+    }
+  };
+}
+
+// ../execution/component-runtime/src/localRoot.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2, relative } from "path";
+var LOCAL_ROOT_FILENAME = "Root.local.tsx";
+var LOCAL_ENTRY_FILENAME = "entry.local.tsx";
+var LOCAL_COMPOSITION_ID = "CueFrameLocalStill";
+function createLivePresentationRouter(callbacks) {
+  let pending = null;
+  let committedFrame = null;
+  let presentedFrame = null;
+  let presentedScene = null;
+  const matches = (transport, actual) => transport.playing ? actual >= transport.frame : actual === transport.frame;
+  const sameRequest = (left, right) => left.sequence === right.sequence && left.frame === right.frame && left.playing === right.playing;
+  const route = () => {
+    const transport = pending;
+    if (transport === null || committedFrame === null || !matches(transport, committedFrame)) return;
+    const committed = committedFrame;
+    const scene = callbacks.mediaTileScene();
+    if (scene !== null) {
+      if (presentedScene === scene && presentedFrame !== null && matches(transport, presentedFrame)) {
+        pending = null;
+        callbacks.acknowledge(transport, presentedFrame);
+      }
+      return;
+    }
+    callbacks.requestFrame(() => {
+      if (pending === null || !sameRequest(pending, transport) || callbacks.mediaTileScene() !== null || committedFrame === null || !matches(transport, committedFrame)) return;
+      const acknowledged = pending;
+      pending = null;
+      callbacks.acknowledge(acknowledged, committed);
+    });
+  };
+  return {
+    request(transport) {
+      pending = transport;
+      route();
+    },
+    committed(frame) {
+      committedFrame = frame;
+      route();
+    },
+    tilePresented(frame, scene) {
+      presentedFrame = frame;
+      presentedScene = scene;
+      route();
+    },
+    dispose() {
+      pending = null;
+    }
+  };
+}
+function toImportSpecifier(fromDir, toFile) {
+  const rel = relative(fromDir, toFile).split("\\").join("/");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function generateLocalRoot(ws, opts) {
+  const dir = cacheDir(ws);
+  mkdirSync2(dir, { recursive: true });
+  const componentFile = join2(componentDir(ws, opts.id), "index");
+  const componentSpecifier = toImportSpecifier(dir, componentFile);
+  const root = `// GENERATED by @cueframe/component-runtime \u2014 DO NOT EDIT.
+import React from 'react';
+import { useEffect, useLayoutEffect, useState } from 'react';
+import { Composition, cancelRender, continueRender, delayRender, staticFile, useCurrentFrame } from 'remotion';
+
+const importAuthoredComponent = async () => {
+  return import(${JSON.stringify(componentSpecifier)});
+};
+
+const hostFontFaces = ${JSON.stringify(opts.fontFaces ?? [])};
+const hostFontCss = hostFontFaces.map((face) => {
+  const url = face.url.startsWith('/') ? staticFile(face.url) : face.url;
+  return '@font-face{font-family:' + JSON.stringify(face.family) + ';font-weight:' + face.weight +
+    ';font-style:' + (face.style || 'normal') + ';src:url(' + JSON.stringify(url) + ');font-display:block;}';
+}).join('');
+
+const GuardedAuthoredComponent: React.FC<{
+  Component: React.ComponentType<any>;
+  componentProps: Record<string, unknown>;
+  rootFrame: number;
+  captureReceipt?: {sessionId: string; requestId: number};
+}> = ({Component, componentProps, rootFrame, captureReceipt}) => {
+  useEffect(() => {
+    window.dispatchEvent(new CustomEvent('cueframe-authored-component-mounted'));
+  }, []);
+  useLayoutEffect(() => {
+    window.dispatchEvent(new CustomEvent('cueframe-root-frame-committed', {
+      detail: {frame: rootFrame},
+    }));
+    if (captureReceipt) {
+      console.info(${JSON.stringify(CAPTURE_PAGE_RASTER_ATTESTATION_PREFIX)} + JSON.stringify({
+        ...captureReceipt,
+        frame: rootFrame,
+        deviceScaleFactor: window.devicePixelRatio,
+      }));
+    }
+  }, [captureReceipt, rootFrame]);
+  return <div data-cueframe-authored-root data-cueframe-root-frame={rootFrame} style={{display:'contents'}}>
+    <Component {...componentProps} />
+  </div>;
+};
+
+type CueFrameComponentInput = {
+    params: Record<string, unknown>;
+    assets: Record<string, unknown>;
+    seed: string;
+    graphics: {
+      api: 'canvas2d' | 'webgl' | 'webgl2' | 'webgpu';
+      required: true;
+      accelerationPreference: 'hardware-preferred' | 'software-allowed';
+    };
+    __cueframeCaptureReceipt?: {sessionId: string; requestId: number};
+  };
+
+export const CueFrameLocalComponent: React.FC<CueFrameComponentInput> = (input) => {
+  const frame = useCurrentFrame();
+  const [Component, setComponent] = useState<React.ComponentType<any> | null>(null);
+  const [loadError, setLoadError] = useState<Error | null>(null);
+  const [waitHandle] = useState(() => delayRender('CueFrame component admission'));
+
+  // The authored module is lazy-loaded for both graphics APIs. Release the
+  // Canvas2D gate only after React mounts it, so its own asset-loading effects
+  // have registered their render gates before a screenshot can be taken.
+  useEffect(() => {
+    if (Component && input.graphics.api === 'canvas2d') continueRender(waitHandle);
+  }, [Component, waitHandle]);
+
+  useEffect(() => {
+    let disposed = false;
+    let admitted = false;
+    let admissionTimer: ReturnType<typeof setTimeout> | undefined;
+    let gpuPrototype: { requestAdapter: (options?: unknown) => Promise<any> } | undefined;
+    let originalRequestAdapter: ((options?: unknown) => Promise<any>) | undefined;
+    const canvasPrototype = HTMLCanvasElement.prototype as unknown as {
+      getContext: (kind: string, ...args: unknown[]) => unknown;
+    };
+    const originalGetContext = canvasPrototype.getContext;
+
+    void (async () => {
+      try {
+        if (input.graphics.api === 'canvas2d') {
+          const loaded = await importAuthoredComponent();
+          if (disposed) return;
+          setComponent(() => loaded.default);
+          console.info(${JSON.stringify(GRAPHICS_ATTESTATION_PREFIX)} + JSON.stringify({
+            api: 'canvas2d', acceleration: 'software', deviceLost: false,
+          }));
+          return;
+        }
+
+        if (input.graphics.api === 'webgl2' || input.graphics.api === 'webgl') {
+          // A webgl (scene-shot) component draws through a GL context of either
+          // version; a webgl2 component must create exactly WebGL2. Either way the
+          // attestation names the required api, never a substitute.
+          const requiredApi = input.graphics.api;
+          const acceptedKinds: readonly string[] = requiredApi === 'webgl2' ? ['webgl2'] : ['webgl', 'webgl2', 'experimental-webgl'];
+          canvasPrototype.getContext = function (kind: string, ...args: unknown[]) {
+            if (kind === '2d') return originalGetContext.call(this, kind, ...args);
+            if (!acceptedKinds.includes(kind)) {
+              throw new Error('A ' + requiredApi + '-required component may only create a ' + acceptedKinds.join('/') + ' canvas context.');
+            }
+            const context = originalGetContext.call(this, kind, ...args) as WebGLRenderingContext | WebGL2RenderingContext | null;
+            if (!context || admitted) return context;
+            admitted = true;
+            const rendererInfo = context.getExtension('WEBGL_debug_renderer_info');
+            const adapterName = rendererInfo
+              ? String(context.getParameter(rendererInfo.UNMASKED_RENDERER_WEBGL) || '')
+              : String(context.getParameter(context.RENDERER) || '');
+            const acceleration = /swiftshader|software|llvmpipe|lavapipe/i.test(adapterName)
+              ? 'software'
+              : 'hardware';
+            console.info(${JSON.stringify(GRAPHICS_ATTESTATION_PREFIX)} + JSON.stringify({
+              api: requiredApi, acceleration, adapterName: adapterName || undefined, deviceLost: false,
+            }));
+            this.addEventListener('webglcontextlost', () => {
+              if (!disposed) cancelRender(new Error(${JSON.stringify(BROWSER_RUNTIME_ERROR_PREFIX)} + 'component_device_lost:' + requiredApi + ' context was lost during component rendering.'));
+            }, {once: true});
+            if (admissionTimer) clearTimeout(admissionTimer);
+            continueRender(waitHandle as number);
+            return context;
+          };
+          const loaded = await importAuthoredComponent();
+          if (disposed) return;
+          setComponent(() => loaded.default);
+          admissionTimer = setTimeout(() => {
+            if (!disposed && !admitted) cancelRender(new Error(${JSON.stringify(BROWSER_RUNTIME_ERROR_PREFIX)} + 'component_graphics_mismatch:The component did not create a ' + requiredApi + ' canvas surface.'));
+          }, 10_000);
+          return;
+        }
+
+        const gpu = (navigator as unknown as { gpu?: { requestAdapter: (options?: unknown) => Promise<unknown> } }).gpu;
+        if (!gpu) throw new Error(${JSON.stringify(BROWSER_RUNTIME_ERROR_PREFIX)} + 'component_graphics_unavailable:The staged browser does not expose WebGPU.');
+        let adapterInfo: { description?: string; architecture?: string; device?: string; vendor?: string; isFallbackAdapter?: boolean } = {};
+        gpuPrototype = Object.getPrototypeOf(gpu) as { requestAdapter: (options?: unknown) => Promise<any> };
+        originalRequestAdapter = gpuPrototype.requestAdapter;
+        gpuPrototype.requestAdapter = async function (options?: unknown) {
+          const adapter = await originalRequestAdapter!.call(this, options);
+          if (adapter?.info) adapterInfo = adapter.info;
+          return adapter;
+        };
+        canvasPrototype.getContext = function (kind: string, ...args: unknown[]) {
+          if (kind === '2d') return originalGetContext.call(this, kind, ...args);
+          if (kind !== 'webgpu') {
+            throw new Error('A WebGPU-required component may only create a WebGPU canvas context.');
+          }
+          const context = originalGetContext.call(this, kind, ...args) as null | { configure: (configuration: any) => void };
+          if (!context) return context;
+          const contextPrototype = Object.getPrototypeOf(context) as { configure: (configuration: any) => void; __cueframePatched?: boolean };
+          if (!contextPrototype.__cueframePatched) {
+            const originalConfigure = contextPrototype.configure;
+            Object.defineProperty(contextPrototype, '__cueframePatched', { value: true });
+            contextPrototype.configure = function (configuration: any) {
+              const result = originalConfigure.call(this, configuration);
+              if (!disposed && !admitted) {
+                admitted = true;
+                const adapterName = [adapterInfo.vendor, adapterInfo.architecture, adapterInfo.device, adapterInfo.description]
+                  .filter(Boolean)
+                  .join(' ');
+                const softwarePattern = /swiftshader|software|fallback/i;
+                const acceleration = adapterInfo.isFallbackAdapter === true || softwarePattern.test(adapterName)
+                  ? 'software'
+                  : 'hardware';
+                console.info(${JSON.stringify(GRAPHICS_ATTESTATION_PREFIX)} + JSON.stringify({
+                  api: 'webgpu', acceleration, adapterName: adapterName || undefined, deviceLost: false,
+                }));
+                const device = configuration?.device as { lost?: Promise<unknown> } | undefined;
+                void device?.lost?.then(() => {
+                  if (!disposed) cancelRender(new Error(${JSON.stringify(BROWSER_RUNTIME_ERROR_PREFIX)} + 'component_device_lost:WebGPU device was lost during component rendering.'));
+                });
+                if (admissionTimer) clearTimeout(admissionTimer);
+                continueRender(waitHandle as number);
+              }
+              return result;
+            };
+          }
+          return context;
+        };
+        Object.defineProperty(globalThis, 'OffscreenCanvas', { value: undefined, configurable: true });
+        const loaded = await importAuthoredComponent();
+        if (disposed) return;
+        setComponent(() => loaded.default);
+        admissionTimer = setTimeout(() => {
+          if (!disposed && !admitted) cancelRender(new Error(${JSON.stringify(BROWSER_RUNTIME_ERROR_PREFIX)} + 'component_graphics_mismatch:The component did not configure a WebGPU canvas surface.'));
+        }, 10_000);
+      } catch (error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        setLoadError(failure);
+        cancelRender(failure);
+      }
+    })();
+    return () => {
+      disposed = true;
+      if (admissionTimer) clearTimeout(admissionTimer);
+      canvasPrototype.getContext = originalGetContext;
+      if (gpuPrototype && originalRequestAdapter) gpuPrototype.requestAdapter = originalRequestAdapter;
+    };
+  }, []);
+
+  // Commit host-owned face declarations before the authored module import effect
+  // runs. Authored modules may inspect document.fonts during initialization.
+  if (loadError) throw loadError;
+  if (!Component) return hostFontCss ? <style data-cueframe-host-fonts>{hostFontCss}</style> : null;
+  return <><style data-cueframe-host-fonts>{hostFontCss}</style><GuardedAuthoredComponent
+    Component={Component}
+    rootFrame={frame}
+    componentProps={{
+      durationInFrames: ${opts.durationInFrames},
+      params: input.params,
+      assets: input.assets,
+      render: {
+        frame,
+        fps: ${opts.fps},
+        width: ${opts.width},
+        height: ${opts.height},
+        seed: input.seed,
+        colorSpace: 'srgb',
+      },
+    }}
+    captureReceipt={input.__cueframeCaptureReceipt}
+  /></>;
+};
+
+export const RemotionRoot: React.FC = () => (
+  <Composition
+    id=${JSON.stringify(LOCAL_COMPOSITION_ID)}
+    component={CueFrameLocalComponent}
+    durationInFrames={${opts.durationInFrames}}
+    fps={${opts.fps}}
+    width={${opts.width}}
+    height={${opts.height}}
+    defaultProps={{}}
+  />
+);
+`;
+  writeFileSync2(join2(dir, LOCAL_ROOT_FILENAME), root);
+  const entry = `// GENERATED by @cueframe/component-runtime \u2014 DO NOT EDIT.
+import React from 'react';
+import { createRoot } from 'react-dom/client';
+import { Player } from '@remotion/player';
+import { registerRoot } from 'remotion';
+import { CueFrameLocalComponent, RemotionRoot } from './${LOCAL_ROOT_FILENAME}';
+
+const live = new URLSearchParams(window.location.search).has('__cueframe_live');
+if (!live) {
+  registerRoot(RemotionRoot);
+} else {
+  const revision = ${JSON.stringify(opts.revision ?? "")};
+  const instanceId = new URLSearchParams(window.location.search).get('__cueframe_instance') || '';
+  const inputProps = ${JSON.stringify(opts.liveInputProps ?? {})};
+  document.documentElement.style.width = document.body.style.width = '100%';
+  document.documentElement.style.height = document.body.style.height = '100%';
+  document.body.style.margin = '0';
+  document.body.style.overflow = 'hidden';
+  document.body.style.background = 'transparent';
+  const host = document.createElement('div');
+  host.style.width = host.style.height = '100%';
+  document.body.appendChild(host);
+  let player = null;
+  let updatePlaybackRate = null;
+  let pendingTransport = null;
+  let appliedTransportEpoch = null;
+  let appliedSeekEpoch = null;
+  let authoredMounted = false;
+  let ready = false;
+  const announceReady = () => {
+    if (ready || !player || !updatePlaybackRate || !authoredMounted) return;
+    ready = true;
+    window.parent.postMessage({protocol:'cueframe-live-component-v1',type:'ready',revision,instanceId}, '*');
+    if (pendingTransport !== null) applyTransport(pendingTransport);
+  };
+  const acknowledge = ({instanceId, sequence, frame}, presentedFrame = frame) => {
+    window.parent.postMessage({
+      protocol:'cueframe-live-component-v1',type:'frame-applied',revision,
+      instanceId,sequence,frame,presentedFrame,
+    }, '*');
+  };
+  const createLivePresentationRouter = ${createLivePresentationRouter.toString()};
+  const presentation = createLivePresentationRouter({
+    mediaTileScene: () => document.querySelector('[data-cueframe-media-tile-scene]')
+      ?.getAttribute('data-cueframe-media-tile-scene') || null,
+    requestFrame: (callback) => {
+      // WKWebView can suspend requestAnimationFrame inside a paused nested
+      // player even after it has painted the committed React tree. Keep the
+      // paint-aligned receipt when available, with a task fallback so a
+      // visibly presented paused frame cannot wait forever for an animation
+      // clock that is intentionally idle.
+      let delivered = false;
+      const afterPresentation = () => {
+        if (delivered) return;
+        delivered = true;
+        callback();
+      };
+      requestAnimationFrame(afterPresentation);
+      setTimeout(afterPresentation, 50);
+    },
+    acknowledge,
+  });
+  window.addEventListener('pagehide', () => presentation.dispose(), {once:true});
+  const applyTransport = (transport) => {
+    const {sequence, seekEpoch, frame, playing, playbackRate} = transport;
+    if (!player || !updatePlaybackRate || !authoredMounted) {
+      pendingTransport = transport;
+      return;
+    }
+    pendingTransport = null;
+    document.documentElement.dataset.cueframeSeekEpoch = String(seekEpoch);
+    document.documentElement.dataset.cueframePlaying = playing ? 'true' : 'false';
+    updatePlaybackRate(playbackRate);
+    const drift = Math.abs(player.getCurrentFrame() - frame);
+    const newEpoch = sequence !== appliedTransportEpoch;
+    const explicitSeek = seekEpoch !== appliedSeekEpoch;
+    if (!playing || explicitSeek || (newEpoch && drift > 2)) player.seekTo(frame);
+    appliedTransportEpoch = sequence;
+    appliedSeekEpoch = seekEpoch;
+    if (playing) player.play(); else player.pause();
+    presentation.request(transport);
+  };
+  window.addEventListener('cueframe-authored-component-mounted', () => {
+    authoredMounted = true;
+    window.parent.postMessage({
+      protocol:'cueframe-live-component-v1',type:'lifecycle',revision,instanceId,
+      phase:'authored-mounted',
+    }, '*');
+    announceReady();
+    if (pendingTransport !== null) applyTransport(pendingTransport);
+  });
+  window.addEventListener('cueframe-root-frame-committed', (event) => {
+    const frame = event instanceof CustomEvent && Number.isSafeInteger(event.detail?.frame)
+      ? event.detail.frame
+      : null;
+    if (frame === null) return;
+    presentation.committed(frame);
+  });
+  window.addEventListener('cueframe-media-tile-presented', (event) => {
+    const frame = event instanceof CustomEvent && Number.isSafeInteger(event.detail?.frame)
+      ? event.detail.frame
+      : null;
+    const scene = event instanceof CustomEvent && typeof event.detail?.sceneId === 'string'
+      ? event.detail.sceneId
+      : null;
+    if (frame === null || scene === null) return;
+    presentation.tilePresented(frame, scene);
+  });
+  const LiveErrorFallback = ({error}) => {
+    const detail = error instanceof Error
+      ? (error.stack?.includes(error.message) ? error.stack : [error.message, error.stack].filter(Boolean).join('\\n'))
+      : String(error);
+    console.error('CueFrame live component failed', error);
+    window.parent.postMessage({protocol:'cueframe-live-component-v1',type:'error',revision,instanceId,detail}, '*');
+    return <pre data-cueframe-live-error style={{color:'#fff',whiteSpace:'pre-wrap'}}>{detail}</pre>;
+  };
+  window.addEventListener('message', (event) => {
+    const message = event.data;
+    if (!message || message.protocol !== 'cueframe-live-component-v1' || message.revision !== revision) return;
+    if (message.type === 'transport' && message.instanceId === instanceId &&
+        Number.isSafeInteger(message.sequence) && Number.isSafeInteger(message.seekEpoch) &&
+        Number.isSafeInteger(message.frame) &&
+        typeof message.playing === 'boolean' && Number.isFinite(message.playbackRate)) {
+      applyTransport(message);
+    } else if (message.type === 'diagnostics-request' && message.instanceId === instanceId &&
+        typeof message.requestId === 'string') {
+      window.parent.postMessage({
+        protocol:'cueframe-live-component-v1',type:'root-diagnostics',revision,instanceId,
+        requestId:message.requestId,
+        state:{
+          authoredMounted,
+          playerReady:Boolean(player && updatePlaybackRate),
+          currentFrame:player?.getCurrentFrame?.() ?? null,
+          sceneCount:document.querySelectorAll('[data-cueframe-media-tile-scene]').length,
+          hasPendingTransport:pendingTransport !== null,
+          videos:Array.from(document.querySelectorAll('video')).map((video) => ({
+            currentTime:video.currentTime,
+            duration:video.duration,
+            paused:video.paused,
+            readyState:video.readyState,
+            networkState:video.networkState,
+            seeking:video.seeking,
+          })),
+        },
+      }, '*');
+    }
+  });
+  const LivePlayer = () => {
+    const [playbackRate, setPlaybackRate] = React.useState(1);
+    React.useEffect(() => {
+      updatePlaybackRate = setPlaybackRate;
+      announceReady();
+      return () => { updatePlaybackRate = null; };
+    }, []);
+    return <Player
+      ref={(value) => {
+        player = value;
+        if (value) announceReady();
+      }}
+      component={CueFrameLocalComponent}
+      inputProps={inputProps}
+      durationInFrames={${opts.durationInFrames}}
+      fps={${opts.fps}}
+      compositionWidth={${opts.width}}
+      compositionHeight={${opts.height}}
+      controls={false}
+      errorFallback={LiveErrorFallback}
+      clickToPlay={false}
+      playbackRate={playbackRate}
+      acknowledgeRemotionLicense
+      style={{width:'100%',height:'100%',background:'transparent'}}
+    />;
+  };
+  createRoot(host).render(<LivePlayer />);
+}
+`;
+  const entryPath = join2(dir, LOCAL_ENTRY_FILENAME);
+  writeFileSync2(entryPath, entry);
+  return entryPath;
+}
+
+// ../execution/component-runtime/src/render.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "fs";
+import { readFile as readFile2, unlink } from "fs/promises";
+import { randomUUID } from "crypto";
+import { dirname, isAbsolute, join as join4, relative as relative2, resolve, sep as sep2 } from "path";
+import { fileURLToPath } from "url";
+
+// ../execution/component-runtime/src/determinism.ts
+function createDeterministicRuntimeScope(target) {
+  const failure = (name) => {
+    throw new Error(`Ambient nondeterministic API is not allowed: ${name}. Use render.frame, render.fps, and render.seed.`);
+  };
+  const deniedFunction = (name) => function deniedAmbientApi() {
+    return failure(name);
+  };
+  const guardedFacade = (value, label, blockedKeys, denyCall = false) => {
+    const blocked = new Set(blockedKeys);
+    const deniedByKey = /* @__PURE__ */ new Map();
+    const denied = (key) => {
+      let fn = deniedByKey.get(key);
+      if (!fn) {
+        fn = deniedFunction(`${label}.${String(key)}`);
+        deniedByKey.set(key, fn);
+      }
+      return fn;
+    };
+    return new Proxy(value, {
+      get(original, key, receiver) {
+        return blocked.has(key) ? denied(key) : Reflect.get(original, key, receiver);
+      },
+      getOwnPropertyDescriptor(original, key) {
+        const descriptor = Reflect.getOwnPropertyDescriptor(original, key);
+        if (!blocked.has(key) || descriptor?.configurable === false) return descriptor;
+        return {
+          configurable: true,
+          enumerable: descriptor?.enumerable ?? false,
+          writable: false,
+          value: denied(key)
+        };
+      },
+      set(original, key, next, receiver) {
+        if (blocked.has(key)) return failure(`${label}.${String(key)} mutation`);
+        return Reflect.set(original, key, next, receiver);
+      },
+      defineProperty(original, key, descriptor) {
+        if (blocked.has(key)) return failure(`${label}.${String(key)} mutation`);
+        return Reflect.defineProperty(original, key, descriptor);
+      },
+      deleteProperty(original, key) {
+        if (blocked.has(key)) return failure(`${label}.${String(key)} mutation`);
+        return Reflect.deleteProperty(original, key);
+      },
+      apply(original, thisArg, args) {
+        if (denyCall) return failure(label);
+        return Reflect.apply(original, thisArg, args);
+      },
+      construct(original, args, newTarget) {
+        if (denyCall) return failure(label);
+        return Reflect.construct(original, args, newTarget);
+      }
+    });
+  };
+  const overrides = /* @__PURE__ */ new Map();
+  const math = target.Math;
+  if (math && (typeof math === "object" || typeof math === "function")) {
+    overrides.set("Math", guardedFacade(math, "Math", ["random"]));
+  }
+  const date = target.Date;
+  if (typeof date === "function") {
+    overrides.set("Date", guardedFacade(date, "Date", ["now"], true));
+  }
+  const performance2 = target.performance;
+  if (performance2 && (typeof performance2 === "object" || typeof performance2 === "function")) {
+    overrides.set("performance", guardedFacade(performance2, "performance", ["now", "timeOrigin"]));
+  }
+  const crypto = target.crypto;
+  if (crypto && (typeof crypto === "object" || typeof crypto === "function")) {
+    overrides.set("crypto", guardedFacade(crypto, "crypto", ["getRandomValues", "randomUUID"]));
+  }
+  for (const name of ["requestAnimationFrame", "setTimeout", "setInterval", "Worker", "SharedWorker"]) {
+    if (name in target) overrides.set(name, deniedFunction(name));
+  }
+  let scope;
+  scope = new Proxy(target, {
+    get(original, key) {
+      if (key === "globalThis" || key === "window" || key === "self") return scope;
+      return overrides.has(key) ? overrides.get(key) : Reflect.get(original, key, original);
+    },
+    getOwnPropertyDescriptor(original, key) {
+      if (key === "globalThis" || key === "window" || key === "self" || overrides.has(key)) {
+        const descriptor = Reflect.getOwnPropertyDescriptor(original, key);
+        if (descriptor?.configurable === false) return descriptor;
+        return {
+          configurable: true,
+          enumerable: descriptor?.enumerable ?? true,
+          writable: false,
+          value: key === "globalThis" || key === "window" || key === "self" ? scope : overrides.get(key)
+        };
+      }
+      return Reflect.getOwnPropertyDescriptor(original, key);
+    },
+    set(original, key, value, receiver) {
+      if (overrides.has(key) || key === "globalThis" || key === "window" || key === "self") {
+        return failure(`${String(key)} mutation`);
+      }
+      return Reflect.set(original, key, value, receiver);
+    },
+    defineProperty(original, key, descriptor) {
+      if (overrides.has(key) || key === "globalThis" || key === "window" || key === "self") {
+        return failure(`${String(key)} mutation`);
+      }
+      return Reflect.defineProperty(original, key, descriptor);
+    },
+    deleteProperty(original, key) {
+      if (overrides.has(key) || key === "globalThis" || key === "window" || key === "self") {
+        return failure(`${String(key)} mutation`);
+      }
+      return Reflect.deleteProperty(original, key);
+    }
+  });
+  return scope;
+}
+function deterministicRuntimeScopeSource() {
+  return createDeterministicRuntimeScope.toString();
+}
+
+// ../execution/component-runtime/src/livePreviewProxy.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+import { readFile, realpath } from "fs/promises";
+import { extname, join as join3, sep } from "path";
+function contentSecurityPolicy(assetOrigins, scriptNonce, resourceOrigin) {
+  const assets = [...assetOrigins].join(" ");
+  return [
+    "default-src 'none'",
+    `script-src 'self' ${resourceOrigin} 'unsafe-eval' 'nonce-${scriptNonce}'`,
+    `style-src 'self' ${resourceOrigin} 'unsafe-inline'`,
+    `img-src 'self' ${resourceOrigin} data: blob:${assets ? ` ${assets}` : ""}`,
+    `media-src 'self' ${resourceOrigin} data: blob:${assets ? ` ${assets}` : ""}`,
+    `font-src 'self' ${resourceOrigin} data:${assets ? ` ${assets}` : ""}`,
+    `connect-src 'self' ${resourceOrigin}${assets ? ` ${assets}` : ""}`,
+    `worker-src 'self' ${resourceOrigin} blob:`,
+    // Studio has a tauri: origin on macOS. CSP's wildcard source does not
+    // match custom schemes, so the trusted desktop parent must be explicit.
+    "frame-ancestors tauri: http://tauri.localhost"
+  ].join("; ");
+}
+async function startLivePreviewProxy(upstream, assetOrigins) {
+  const upstreamUrl = URL.canParse(upstream) ? new URL(upstream) : null;
+  if (upstreamUrl && (upstreamUrl.protocol !== "http:" || !["127.0.0.1", "localhost"].includes(upstreamUrl.hostname))) {
+    throw new Error("Live component preview requires a loopback bundle origin.");
+  }
+  const bundleRoot = upstreamUrl ? null : await realpath(upstream);
+  const scriptNonce = randomBytes(18).toString("base64");
+  const server = createServer(async (request, response) => {
+    try {
+      let body;
+      let contentType = null;
+      if (upstreamUrl) {
+        const target = new URL(request.url ?? "/", upstreamUrl.origin);
+        const fetched = await fetch(target, { method: request.method });
+        response.statusCode = fetched.status;
+        contentType = fetched.headers.get("content-type");
+        for (const [name, value] of fetched.headers) {
+          if (!["content-security-policy", "content-length", "transfer-encoding"].includes(name.toLowerCase())) {
+            response.setHeader(name, value);
+          }
+        }
+        body = new Uint8Array(await fetched.arrayBuffer());
+      } else {
+        const pathname = decodeURIComponent(new URL(request.url ?? "/", "http://localhost").pathname);
+        const requested = pathname === "/" ? "index.html" : pathname.replace(/^\/+/, "");
+        const resolved = await realpath(join3(bundleRoot, requested));
+        if (resolved !== bundleRoot && !resolved.startsWith(bundleRoot + sep)) throw new Error("Invalid bundle path.");
+        body = await readFile(resolved);
+        const mime = (/* @__PURE__ */ new Map([
+          [".html", "text/html; charset=utf-8"],
+          [".js", "text/javascript; charset=utf-8"],
+          [".css", "text/css; charset=utf-8"],
+          [".json", "application/json"],
+          [".png", "image/png"],
+          [".svg", "image/svg+xml"],
+          [".woff2", "font/woff2"]
+        ])).get(extname(resolved));
+        if (mime) {
+          contentType = mime;
+          response.setHeader("Content-Type", mime);
+        }
+      }
+      if (contentType?.toLowerCase().startsWith("text/html")) {
+        body = Buffer.from(Buffer.from(body).toString("utf8").replaceAll("<script>", `<script nonce="${scriptNonce}">`));
+      }
+      const address2 = server.address();
+      if (!address2 || typeof address2 === "string") throw new Error("Live component preview has no loopback address.");
+      const resourceOrigin = `http://localhost:${address2.port}`;
+      response.setHeader("Content-Security-Policy", contentSecurityPolicy(assetOrigins, scriptNonce, resourceOrigin));
+      response.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+      response.end(Buffer.from(body));
+    } catch (error) {
+      response.statusCode = 502;
+      response.end(error instanceof Error ? error.message : String(error));
+    }
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    server.close();
+    throw new Error("Live component preview did not bind a loopback port.");
+  }
+  const liveUrl = new URL(upstreamUrl ? upstreamUrl.pathname + upstreamUrl.search : "/", `http://localhost:${address.port}`);
+  liveUrl.searchParams.set("__cueframe_live", "1");
+  let closePromise;
+  return {
+    url: liveUrl.href,
+    close: () => closePromise ??= new Promise((resolve2, reject) => {
+      server.close((error) => error ? reject(error) : resolve2());
+    })
+  };
+}
+
+// ../execution/component-runtime/src/render.ts
+function shouldIsolateWebGpuStillBrowser(platform, graphicsApi) {
+  return platform === "darwin" && graphicsApi === "webgpu";
+}
+var COMPONENT_BROWSER_FIREWALL_TIMEOUT_MS = 1e4;
+var COMPONENT_BROWSER_CLEANUP_TIMEOUT_MS = 5e3;
+var COMPONENT_BROWSER_FIREWALL_ATTEMPTS = 2;
+var ComponentBrowserFirewallTimeout = class extends Error {
+};
+function withComponentBrowserFirewallTimeout(promise) {
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(
+      () => reject(
+        new ComponentBrowserFirewallTimeout(
+          `Component browser firewall setup exceeded ${COMPONENT_BROWSER_FIREWALL_TIMEOUT_MS / 1e3}s.`
+        )
+      ),
+      COMPONENT_BROWSER_FIREWALL_TIMEOUT_MS
+    );
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve2(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      }
+    );
+  });
+}
+function withComponentBrowserCleanupTimeout(promise) {
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(
+      () => reject(new Error(
+        `Component browser cleanup exceeded ${COMPONENT_BROWSER_CLEANUP_TIMEOUT_MS / 1e3}s.`
+      )),
+      COMPONENT_BROWSER_CLEANUP_TIMEOUT_MS
+    );
+    promise.then(
+      () => {
+        clearTimeout(timer);
+        resolve2();
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      }
+    );
+  });
+}
+var DeterministicAuthoredModulePlugin = class {
+  #authoredComponentRoot;
+  #scopeSource;
+  constructor(authoredComponentRoot) {
+    this.#authoredComponentRoot = realpathSync(authoredComponentRoot);
+    this.#scopeSource = deterministicRuntimeScopeSource();
+  }
+  apply(compiler) {
+    const pluginName = "CueFrameDeterministicAuthoredModulePlugin";
+    compiler.hooks.compilation.tap(pluginName, (compilation) => {
+      const hooks = compiler.webpack.javascript.JavascriptModulesPlugin.getCompilationHooks(compilation);
+      const { ConcatSource } = compiler.webpack.sources;
+      hooks.renderModuleContent.tap(
+        pluginName,
+        (source, module) => {
+          if (!module.resource) return source;
+          const resource = realpathSync(module.resource.split("?")[0]);
+          const relativeResource = relative2(this.#authoredComponentRoot, resource);
+          const belongsToAuthoredComponent = relativeResource === "" || relativeResource !== ".." && !relativeResource.startsWith(`..${sep2}`) && !isAbsolute(relativeResource);
+          if (!belongsToAuthoredComponent) return source;
+          return new ConcatSource(
+            "const __cueframeHostGlobal = globalThis;\n{\nconst {globalThis, window, self, Math, Date, performance, crypto, requestAnimationFrame, setTimeout, setInterval, Worker, SharedWorker} = (",
+            this.#scopeSource,
+            ")(__cueframeHostGlobal);\n{\n",
+            source,
+            "\n}\n}\n"
+          );
+        }
+      );
+    });
+  }
+};
+function buildLocalWebpackOverride(renderEntryRoot, authoredComponentRoot) {
+  const animateEntry = join4(resolve(renderEntryRoot, ".."), "animate", "src", "index.ts");
+  return (config) => ({
+    ...config,
+    resolve: {
+      ...config.resolve,
+      modules: [
+        ...config.resolve?.modules ?? ["node_modules"],
+        join4(renderEntryRoot, "node_modules"),
+        join4(resolve(renderEntryRoot, ".."), "animate", "node_modules"),
+        // Private workspace packages are copied here for the installed preview runtime. Animate
+        // imports their public subpaths directly, so webpack must search the staged tree rather
+        // than accidentally relying on this checkout's root node_modules.
+        join4(resolve(renderEntryRoot, ".."), "workspace", "node_modules"),
+        join4(resolve(renderEntryRoot, "..", ".."), "node_modules"),
+        join4(resolve(renderEntryRoot, "..", "..", ".."), "node_modules")
+      ],
+      alias: {
+        "@cueframe/animate$": animateEntry
+      }
+    },
+    plugins: [
+      ...config.plugins ?? [],
+      new DeterministicAuthoredModulePlugin(authoredComponentRoot)
+    ]
+  });
+}
+async function importFromRenderEntry(renderEntryRoot, spec) {
+  const { createRequire } = await import("module");
+  const { pathToFileURL } = await import("url");
+  const requireFromRenderEntry = createRequire(join4(renderEntryRoot, "package.json"));
+  return await import(pathToFileURL(requireFromRenderEntry.resolve(spec)).href);
+}
+var LOCAL_BROWSER_VERSION_PROBE_MS = 3e4;
+var stagedBrowserModule = null;
+async function verifyLocalStagedBrowser(renderEntryRoot) {
+  const { pathToFileURL } = await import("url");
+  stagedBrowserModule ??= await import(pathToFileURL(join4(renderEntryRoot, "scripts", "stagedBrowser.mjs")).href);
+  return stagedBrowserModule.verifyStagedBrowser(process.env.CUEFRAME_BROWSER_DIR ?? null, {
+    timeoutMs: LOCAL_BROWSER_VERSION_PROBE_MS
+  });
+}
+var laneWindowModule = null;
+async function installLocalLaneWindowSizer(renderEntryRoot, browser) {
+  const { pathToFileURL } = await import("url");
+  laneWindowModule ??= await import(pathToFileURL(join4(renderEntryRoot, "scripts", "laneWindow.mjs")).href);
+  let refusal = null;
+  const size = await laneWindowModule.installLaneWindowSizer(
+    browser,
+    (error) => {
+      refusal ??= error;
+    },
+    LOCAL_BROWSER_VERSION_PROBE_MS
+  );
+  return async (width, height) => {
+    if (refusal) throw refusal;
+    await size(width, height);
+    if (refusal) throw refusal;
+  };
+}
+async function sizeLocalLaneWindows(renderEntryRoot, browser, width, height) {
+  const size = await installLocalLaneWindowSizer(renderEntryRoot, browser);
+  await size(width, height);
+}
+function stagedBrowserLocator(error) {
+  return stagedBrowserModule?.stagedBrowserLocator(error) ?? null;
+}
+function resolveRenderEntryRoot(override) {
+  if (override) return override;
+  if (process.env.RENDER_ENTRY_ROOT) return process.env.RENDER_ENTRY_ROOT;
+  const here = dirname(fileURLToPath(import.meta.url));
+  return join4(resolve(here, "..", ".."), "render-entry");
+}
+function localSourceRevision(ws, id) {
+  return sha256Hex(readFileSync2(join4(componentDir(ws, id), "index.tsx")));
+}
+var COMPONENT_STILL_RUNTIME_IDENTITY = "@cueframe/component-runtime/still-session-v1";
+var REMOTION_DISABLED_RASTER_FEATURES = "AudioServiceOutOfProcess,IsolateOrigins,site-per-process,Translate,BackForwardCache,AvoidUnnecessaryBeforeUnloadCheckSync,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,BlockInsecurePrivateNetworkRequests,PrivateNetworkAccessSendPreflights,PrivateNetworkAccessRespectPreflightResults";
+function glLaunchArguments(backend) {
+  if (backend === "swangle") return ["--use-gl=angle", "--use-angle=swiftshader"];
+  if (backend === "angle-egl") return ["--use-gl=angle", "--use-angle=gl-egl"];
+  if (backend === "vulkan") return [
+    "--use-angle=vulkan",
+    "--use-vulkan=native",
+    "--disable-vulkan-fallback-to-gl-for-testing",
+    "--disable-vulkan-surface",
+    "--ignore-gpu-blocklist",
+    "--enable-gpu"
+  ];
+  return [`--use-gl=${backend}`];
+}
+function componentStillRasterAffectingFlags(graphics) {
+  const browserBackend = componentBrowserBackend(graphics).chromiumOptions;
+  const backend = browserBackend.gl;
+  const features = backend === "vulkan" ? "NetworkService,NetworkServiceInProcess,Vulkan,UseSkiaRenderer" : backend === "angle-egl" ? "NetworkService,NetworkServiceInProcess,VaapiVideoDecoder" : "NetworkService,NetworkServiceInProcess";
+  const args = [
+    `--enable-features=${features}`,
+    `--disable-features=${REMOTION_DISABLED_RASTER_FEATURES}`,
+    "--force-color-profile=srgb",
+    "--force-device-scale-factor=1",
+    "--font-render-hinting=none",
+    "--ignore-gpu-blocklist",
+    "--enable-unsafe-webgpu",
+    "--hide-scrollbars",
+    "--force-gpu-mem-available-mb=4096",
+    browserBackend.headless === false ? null : "--headless=new",
+    process.platform === "linux" && backend !== "vulkan" && browserBackend.enableMultiProcessOnLinux !== true ? "--single-process" : null,
+    ...glLaunchArguments(backend)
+  ].filter((value) => value !== null);
+  return { browserArguments: [...new Set(args)].sort() };
+}
+async function observedRasterAffectingFlags(browser, expected) {
+  const result = await browser.connection.send("Browser.getBrowserCommandLine");
+  const commandLine = result.value?.arguments;
+  if (!Array.isArray(commandLine) || commandLine.some((arg) => typeof arg !== "string")) {
+    throw new ComponentRuntimeError(
+      "component_runtime_error",
+      "The admitted browser did not expose its effective launch arguments."
+    );
+  }
+  const operationalPrefixes = [
+    "--remote-debugging-port=",
+    "--user-data-dir=",
+    "--disk-cache-dir=",
+    "--crash-dumps-dir=",
+    "--log-file=",
+    "--disk-cache-size=",
+    "--proxy-bypass-list=",
+    "--proxy-server="
+  ];
+  const operationalExact = /* @__PURE__ */ new Set([
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--no-startup-window",
+    "--allow-chrome-scheme-url",
+    "--allow-pre-commit-input",
+    "--allow-running-insecure-content",
+    "--disable-background-media-suspend",
+    "--disable-background-networking",
+    "--disable-background-timer-throttling",
+    "--disable-backgrounding-occluded-windows",
+    "--disable-breakpad",
+    "--disable-client-side-phishing-detection",
+    "--disable-component-extensions-with-background-pages",
+    "--disable-component-update",
+    "--disable-default-apps",
+    "--disable-dev-shm-usage",
+    "--disable-domain-reliability",
+    "--disable-extensions",
+    "--disable-hang-monitor",
+    "--disable-ipc-flooding-protection",
+    "--disable-popup-blocking",
+    "--disable-print-preview",
+    "--disable-prompt-on-repost",
+    "--disable-renderer-backgrounding",
+    "--disable-setuid-sandbox",
+    "--disable-site-isolation-trials",
+    "--disable-sync",
+    "--enable-automation",
+    "--enable-blink-features=IdleDetection",
+    "--export-tagged-pdf",
+    "--flag-switches-begin",
+    "--flag-switches-end",
+    "--intensive-wake-up-throttling-policy=0",
+    "--metrics-recording-only",
+    "--mute-audio",
+    "--no-pings",
+    "--no-proxy-server",
+    "--no-sandbox",
+    "--no-zygote",
+    "--noerrdialogs",
+    "--password-store=basic",
+    "--use-mock-keychain"
+  ]);
+  const actual = commandLine.filter((argument) => argument.startsWith("--")).filter((argument) => !operationalExact.has(argument) && !operationalPrefixes.some((prefix) => argument.startsWith(prefix))).sort();
+  const wanted = [...expected.browserArguments].sort();
+  const videoThreads = actual.filter((argument) => /^--video-threads=[1-9]\d*$/.test(argument));
+  const comparableActual = actual.filter((argument) => !argument.startsWith("--video-threads="));
+  if (videoThreads.length !== 1 || JSON.stringify(comparableActual) !== JSON.stringify(wanted)) {
+    const missing = wanted.filter((argument) => !actual.includes(argument));
+    const unexpected = comparableActual.filter((argument) => !wanted.includes(argument));
+    throw new ComponentRuntimeError(
+      "component_runtime_error",
+      `The admitted browser's raster-affecting launch arguments differ from the admitted configuration (missing: ${missing.join(", ") || "none"}; unexpected: ${unexpected.join(", ") || "none"}).`
+    );
+  }
+  return { browserArguments: actual };
+}
+function effectiveGlBackend(requested, renderer) {
+  const observed = renderer.toLowerCase();
+  if (observed.includes("swiftshader")) return "swiftshader";
+  if (observed.includes("metal")) return "angle-metal";
+  if (observed.includes("vulkan")) return "vulkan";
+  if (observed.includes("opengl")) return requested.startsWith("angle") ? "angle-opengl" : "opengl";
+  if (observed.includes("direct3d11") || observed.includes("d3d11")) return "angle-d3d11";
+  return null;
+}
+async function sessionBrowserVersion(browser) {
+  const result = await browser.connection.send("Browser.getVersion");
+  const product = result.value?.product;
+  if (typeof product !== "string" || !product.includes("/")) {
+    throw new ComponentRuntimeError("component_runtime_error", "The admitted browser did not report its product and version.");
+  }
+  const slash = product.indexOf("/");
+  return { product: product.slice(0, slash), version: product.slice(slash + 1) };
+}
+async function componentStillDependencyIdentity(renderEntryRoot) {
+  const { createRequire } = await import("module");
+  const requireFromRenderEntry = createRequire(join4(renderEntryRoot, "package.json"));
+  let packageRoot = dirname(requireFromRenderEntry.resolve("@remotion/renderer"));
+  while (!existsSync2(join4(packageRoot, "package.json"))) {
+    const parent = dirname(packageRoot);
+    if (parent === packageRoot) {
+      throw new ComponentRuntimeError(
+        "component_runtime_error",
+        "The staged Remotion renderer package manifest could not be located."
+      );
+    }
+    packageRoot = parent;
+  }
+  const manifest = JSON.parse(
+    readFileSync2(join4(packageRoot, "package.json"), "utf8")
+  );
+  if (manifest.name !== "@remotion/renderer" || typeof manifest.version !== "string" || !manifest.version) {
+    throw new ComponentRuntimeError(
+      "component_runtime_error",
+      "The staged Remotion renderer has no verifiable package identity."
+    );
+  }
+  return `${manifest.name}@${manifest.version}/renderStill`;
+}
+function pngContainerFacts(path, bytes) {
+  const signature = [137, 80, 78, 71, 13, 10, 26, 10];
+  const isPng = bytes.length >= 24 && signature.every((value, index) => bytes[index] === value) && String.fromCharCode(...bytes.slice(12, 16)) === "IHDR";
+  if (!isPng) {
+    throw new ComponentRuntimeError("component_runtime_error", "Component still output is not a PNG container.");
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  return ComponentStillPngContainerFactsV1.parse({
+    handle: path,
+    mimeType: "image/png",
+    byteLength: bytes.byteLength,
+    width: view.getUint32(16),
+    height: view.getUint32(20),
+    encodedSha256: sha256Hex(bytes)
+  });
+}
+async function prepareLocalBundle(opts) {
+  const pinnedManifest = readMaterializedComponentSource(opts.ws, opts.id)?.manifest ?? null;
+  if (pinnedManifest) assertSceneShotParamsAdmitted(pinnedManifest, opts.params, { componentId: opts.id });
+  const renderEntryRoot = resolveRenderEntryRoot(opts.renderEntryRoot);
+  const stagedBrowser = await verifyLocalStagedBrowser(renderEntryRoot);
+  const browserExecutable = stagedBrowser.path;
+  const inputProps = {
+    params: opts.params,
+    assets: opts.assets ?? {},
+    seed: opts.seed ?? "cueframe",
+    graphics: opts.graphics ?? {
+      api: "canvas2d",
+      required: true,
+      accelerationPreference: "software-allowed"
+    }
+  };
+  const entryPoint = generateLocalRoot(opts.ws, {
+    id: opts.id,
+    width: opts.width,
+    height: opts.height,
+    fps: opts.fps,
+    durationInFrames: opts.durationInFrames,
+    revision: opts.revision,
+    liveInputProps: inputProps,
+    fontFaces: opts.fontFaces
+  });
+  const { bundle } = await importFromRenderEntry(
+    renderEntryRoot,
+    "@remotion/bundler"
+  );
+  let serveUrl;
+  try {
+    serveUrl = await bundle({
+      entryPoint,
+      rootDir: process.env.CUEFRAME_COMPONENT_BUNDLE_CACHE ?? null,
+      // Prepared scene components load the pinned photographic environment via
+      // Remotion staticFile(). Use the verified render-entry public tree so the
+      // local preview and composition renderer consume the same exact bytes.
+      publicDir: join4(renderEntryRoot, "public"),
+      // NAMED, like the composition lane's (`render-entry/scripts/render.mjs`). Left to Remotion,
+      // `bundle()` mkdtemps `remotion-webpack-bundle-*` into the system temp and never removes it
+      // (@remotion/bundler `prepareOutDir`) — ~28 MB per render into a directory nothing owns, which
+      // is how 5.9 GB of them accumulated before Stage 9 counted. Inside the component's own
+      // workspace directory it lives and dies with the workspace the caller already tears down,
+      // and nothing new needs cleaning up.
+      outDir: join4(componentDir(opts.ws, opts.id), ".remotion-bundle"),
+      webpackOverride: buildLocalWebpackOverride(renderEntryRoot, componentDir(opts.ws, opts.id))
+    });
+  } catch (error) {
+    throw componentRuntimeError(error, "component_does_not_compile");
+  }
+  return {
+    serveUrl,
+    browserExecutable,
+    stagedBrowser,
+    inputProps,
+    renderEntryRoot,
+    pinnedManifest
+  };
+}
+async function createComponentStillSession(opts) {
+  const width = opts.width ?? 1920;
+  const height = opts.height ?? 1080;
+  const fps = opts.fps ?? 30;
+  const durationInFrames = opts.durationInFrames ?? 1;
+  const scale = opts.scale ?? 1;
+  for (const [field, value] of [["width", width], ["height", height], ["durationInFrames", durationInFrames]]) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw new ComponentRuntimeError("component_runtime_error", `${field} must be a positive safe integer.`);
+    }
+  }
+  if (!Number.isFinite(fps) || fps <= 0) {
+    throw new ComponentRuntimeError("component_runtime_error", "fps must be a finite number greater than zero.");
+  }
+  if (!Number.isFinite(scale) || scale <= 0) {
+    throw new ComponentRuntimeError("component_runtime_error", "Component still scale must be a finite number greater than zero.");
+  }
+  const revision = opts.revision ?? localSourceRevision(opts.ws, opts.id);
+  const allowedAssetOrigins = new Set(opts.allowedAssetOrigins ?? []);
+  opts.onStartupPhase?.("prepare");
+  const { serveUrl, browserExecutable, stagedBrowser, inputProps, renderEntryRoot, pinnedManifest } = await prepareLocalBundle({
+    ws: opts.ws,
+    id: opts.id,
+    width,
+    height,
+    fps,
+    durationInFrames,
+    params: opts.params,
+    assets: opts.assets,
+    seed: opts.seed,
+    graphics: opts.graphics,
+    renderEntryRoot: opts.renderEntryRoot,
+    revision,
+    fontFaces: opts.fontFaces
+  });
+  opts.onStartupPhase?.("prepared");
+  const { openBrowser, selectComposition, renderStill } = await importFromRenderEntry(
+    renderEntryRoot,
+    "@remotion/renderer"
+  );
+  const requiredGraphics = opts.graphics ?? {
+    api: "canvas2d",
+    required: true,
+    accelerationPreference: "software-allowed"
+  };
+  const isolatesFrameBrowsers = shouldIsolateWebGpuStillBrowser(process.platform, requiredGraphics.api);
+  const collector = graphicsCollector(requiredGraphics);
+  const launch = {
+    ...componentBrowserOptions(requiredGraphics, browserExecutable, stagedBrowser.chromeMode),
+    // Pin the value Remotion otherwise defaults internally so the attestation describes an
+    // explicit launch fact rather than an assumed browser default.
+    forceDeviceScaleFactor: 1
+  };
+  let browser;
+  let firewall;
+  let composition;
+  let hostAttestation = null;
+  for (let attempt = 1; attempt <= COMPONENT_BROWSER_FIREWALL_ATTEMPTS; attempt += 1) {
+    let candidateBrowser;
+    let candidateFirewall;
+    try {
+      opts.onStartupPhase?.("open-browser");
+      candidateBrowser = await openBrowser("chrome", launch);
+      opts.onStartupPhase?.("browser-open");
+      await sizeLocalLaneWindows(renderEntryRoot, candidateBrowser, width, height);
+      opts.onStartupPhase?.("firewall");
+      candidateFirewall = await withComponentBrowserFirewallTimeout(installComponentRequestFirewall(
+        candidateBrowser,
+        allowedAssetOrigins,
+        opts.onBrowserLog ? (entry) => opts.onBrowserLog?.(entry) : void 0
+      ));
+      await assertComponentBrowserHardware(candidateBrowser, requiredGraphics);
+      let candidateAttestation = null;
+      if (opts.captureAttestation) {
+        const gpu = await readGpuAttestation(candidateBrowser);
+        if (!gpu.renderer) {
+          throw new ComponentRuntimeError(
+            "component_graphics_unavailable",
+            "The admitted browser did not report its actual renderer, so capture identity cannot be established."
+          );
+        }
+        const requestedBackend = componentBrowserBackend(requiredGraphics).chromiumOptions.gl;
+        const actualGlBackend = effectiveGlBackend(requestedBackend, gpu.renderer);
+        if (actualGlBackend === null) {
+          throw new ComponentRuntimeError(
+            "component_graphics_unavailable",
+            `The admitted browser reported an unrecognized renderer (${gpu.renderer}).`
+          );
+        }
+        const browserVersion = await sessionBrowserVersion(candidateBrowser);
+        if (browserVersion.version !== stagedBrowser.version) {
+          throw new ComponentRuntimeError(
+            "component_runtime_error",
+            `The admitted browser version ${browserVersion.version} does not match staged browser version ${stagedBrowser.version}.`
+          );
+        }
+        const rasterAffectingFlags = componentStillRasterAffectingFlags(requiredGraphics);
+        candidateAttestation = ComponentStillSessionHostAttestationV1.parse({
+          loadedRuntimeIdentity: COMPONENT_STILL_RUNTIME_IDENTITY,
+          loadedDependencyIdentity: await componentStillDependencyIdentity(renderEntryRoot),
+          observedRasterAffectingFlags: await observedRasterAffectingFlags(candidateBrowser, rasterAffectingFlags),
+          browserProduct: browserVersion.product,
+          browserVersion: browserVersion.version,
+          browserExecutableSha256: stagedBrowser.sha256,
+          headless: launch.chromiumOptions.headless !== false,
+          os: process.platform,
+          arch: process.arch,
+          // Remotion's admitted browser launch fixes `--force-color-profile=srgb`; its exact package
+          // version is sealed above as dependencyIdentity.
+          colorProfile: "srgb",
+          actualGlBackend,
+          actualRenderer: gpu.renderer,
+          gpuIdentity: gpu.gpuIdentity
+        });
+      }
+      opts.onStartupPhase?.("select-composition");
+      const candidateComposition = await selectComposition({
+        serveUrl,
+        id: LOCAL_COMPOSITION_ID,
+        inputProps,
+        puppeteerInstance: candidateBrowser,
+        timeoutInMilliseconds: 3e4,
+        onBrowserLog: (entry) => {
+          collector.onBrowserLog(entry);
+          opts.onBrowserLog?.(entry);
+        }
+      });
+      const denied = candidateFirewall.deniedRequests();
+      if (denied.length > 0) {
+        throw new ComponentRuntimeError("component_network_denied", `Component attempted ${denied.length} denied network request(s).`);
+      }
+      browser = candidateBrowser;
+      firewall = candidateFirewall;
+      composition = candidateComposition;
+      hostAttestation = candidateAttestation;
+      break;
+    } catch (error) {
+      try {
+        const cleanup = candidateFirewall ? candidateFirewall.close() : candidateBrowser?.close({ silent: true });
+        if (cleanup) await withComponentBrowserCleanupTimeout(cleanup);
+      } catch {
+      }
+      if (!candidateBrowser) {
+        throw componentRuntimeError(error, "component_resource_exhausted", true);
+      }
+      if (error instanceof ComponentBrowserFirewallTimeout && attempt < COMPONENT_BROWSER_FIREWALL_ATTEMPTS) continue;
+      const retryable = error instanceof ComponentBrowserFirewallTimeout;
+      throw componentRuntimeError(
+        error,
+        retryable ? "component_deadline_exceeded" : "component_runtime_error",
+        retryable
+      );
+    }
+  }
+  opts.onStartupPhase?.("composition-ready");
+  let liveProxy;
+  try {
+    opts.onStartupPhase?.("start-proxy");
+    liveProxy = await startLivePreviewProxy(serveUrl, allowedAssetOrigins);
+  } catch (error) {
+    let cleanupError;
+    await firewall.close().catch((caught) => {
+      cleanupError = caught;
+    });
+    const failure = componentRuntimeError(error, "component_runtime_error");
+    if (cleanupError !== void 0 && failure.cause === void 0) failure.cause = cleanupError;
+    throw failure;
+  }
+  opts.onStartupPhase?.("ready");
+  let state = "open";
+  let tail = Promise.resolve();
+  let closePromise = null;
+  let cancelPromise = null;
+  const sessionId = randomUUID();
+  let requestId = 0;
+  const ownedOutputs = /* @__PURE__ */ new Set();
+  const enqueue = (operation) => {
+    const result = tail.then(operation, operation);
+    tail = result.then(() => void 0, () => void 0);
+    return result;
+  };
+  const session = {
+    revision,
+    liveUrl: liveProxy.url,
+    hostAttestation,
+    renderFrame(frameOpts = {}) {
+      if (state !== "open") {
+        return Promise.reject(new ComponentRuntimeError("component_conflict", "Component preview session is closing or closed."));
+      }
+      return enqueue(async () => {
+        const fatal = firewall.fatalError();
+        if (fatal !== null) {
+          state = "closed";
+          closePromise ??= Promise.all([firewall.close(), liveProxy.close()]).then(() => void 0);
+          throw componentRuntimeError(fatal, "component_runtime_error");
+        }
+        if (frameOpts.expectedRevision !== void 0 && frameOpts.expectedRevision !== revision) {
+          throw new ComponentRuntimeError("component_conflict", "Component preview request targets a stale source revision.");
+        }
+        const frame = frameOpts.frame ?? 0;
+        if (!Number.isInteger(frame) || frame < 0 || frame >= durationInFrames) {
+          throw new ComponentRuntimeError(
+            "component_runtime_error",
+            `Component preview frame must be an integer from 0 through ${durationInFrames - 1}.`
+          );
+        }
+        if (frameOpts.params && pinnedManifest) {
+          assertSceneShotParamsAdmitted(pinnedManifest, frameOpts.params, { componentId: opts.id });
+        }
+        const captureId = requestId++;
+        const requestInputProps = {
+          ...inputProps,
+          params: frameOpts.params ?? opts.params,
+          assets: frameOpts.assets ?? opts.assets ?? {},
+          seed: frameOpts.seed ?? opts.seed ?? "cueframe",
+          ...opts.captureAttestation ? { __cueframeCaptureReceipt: { sessionId, requestId: captureId } } : {}
+        };
+        const deniedBefore = firewall.deniedRequests().length;
+        const pngPath = frameOpts.outputPath ?? join4(cacheDir(opts.ws), `still-${opts.id}-${sessionId}-${captureId}.png`);
+        const outputOwnedBySession = frameOpts.outputPath === void 0;
+        if (outputOwnedBySession) ownedOutputs.add(pngPath);
+        const removeOwnedOutput = async () => {
+          if (!outputOwnedBySession) return;
+          await unlink(pngPath).catch((error) => {
+            if (error.code !== "ENOENT") throw error;
+          });
+          ownedOutputs.delete(pngPath);
+        };
+        const refuseAfterCleanup = async (error) => {
+          await removeOwnedOutput().catch((cleanupError) => {
+            if (error.cause === void 0) error.cause = cleanupError;
+            else process.stderr.write(`[component-runtime] output cleanup failed: ${String(cleanupError)}
+`);
+          });
+          throw error;
+        };
+        const frameCollector = graphicsCollector(requiredGraphics);
+        const capturePageRaster = { value: null };
+        let frameBrowser = browser;
+        let frameFirewall = firewall;
+        let frameComposition = composition;
+        let ownsFrameBrowser = false;
+        try {
+          if (isolatesFrameBrowsers) {
+            for (let attempt = 1; attempt <= COMPONENT_BROWSER_FIREWALL_ATTEMPTS; attempt += 1) {
+              let candidateBrowser;
+              let candidateFirewall;
+              try {
+                candidateBrowser = await openBrowser("chrome", launch);
+                await sizeLocalLaneWindows(renderEntryRoot, candidateBrowser, width, height);
+                candidateFirewall = await withComponentBrowserFirewallTimeout(installComponentRequestFirewall(
+                  candidateBrowser,
+                  allowedAssetOrigins,
+                  opts.onBrowserLog ? (entry) => opts.onBrowserLog?.(entry) : void 0
+                ));
+                await assertComponentBrowserHardware(candidateBrowser, requiredGraphics);
+                const candidateComposition = await selectComposition({
+                  serveUrl,
+                  id: LOCAL_COMPOSITION_ID,
+                  inputProps: requestInputProps,
+                  puppeteerInstance: candidateBrowser,
+                  timeoutInMilliseconds: 3e4,
+                  onBrowserLog: frameCollector.onBrowserLog
+                });
+                frameBrowser = candidateBrowser;
+                frameFirewall = candidateFirewall;
+                frameComposition = candidateComposition;
+                ownsFrameBrowser = true;
+                break;
+              } catch (error) {
+                try {
+                  const cleanup = candidateFirewall ? candidateFirewall.close() : candidateBrowser?.close({ silent: true });
+                  if (cleanup) await withComponentBrowserCleanupTimeout(cleanup);
+                } catch {
+                }
+                if (!candidateBrowser) {
+                  throw componentRuntimeError(error, "component_resource_exhausted", true);
+                }
+                if (error instanceof ComponentBrowserFirewallTimeout && attempt < COMPONENT_BROWSER_FIREWALL_ATTEMPTS) continue;
+                const retryable = error instanceof ComponentBrowserFirewallTimeout;
+                throw componentRuntimeError(
+                  error,
+                  retryable ? "component_deadline_exceeded" : "component_runtime_error",
+                  retryable
+                );
+              }
+            }
+          }
+          const frameDeniedBefore = frameFirewall.deniedRequests().length;
+          const stillOptions = {
+            // Remotion sends `composition.props` as the resolved props. Keep it
+            // aligned with each request when reusing a selected composition;
+            // otherwise later preview params can silently render the first call.
+            composition: { ...frameComposition, props: requestInputProps },
+            serveUrl,
+            inputProps: requestInputProps,
+            output: pngPath,
+            frame,
+            scale,
+            puppeteerInstance: frameBrowser,
+            timeoutInMilliseconds: 12e4,
+            onBrowserLog(log) {
+              frameCollector.onBrowserLog(log);
+              const parsed = parseCapturePageRasterAttestationLog(log.text);
+              if (!parsed) return;
+              if (parsed.sessionId !== sessionId || parsed.requestId !== captureId || parsed.frame !== frame) {
+                throw new ComponentRuntimeError(
+                  "component_runtime_error",
+                  "Component capture page reported raster facts for a different request or frame."
+                );
+              }
+              if (capturePageRaster.value && JSON.stringify(capturePageRaster.value) !== JSON.stringify(parsed)) {
+                throw new ComponentRuntimeError(
+                  "component_runtime_error",
+                  "Component capture page reported inconsistent raster facts."
+                );
+              }
+              capturePageRaster.value = parsed;
+            }
+          };
+          await renderStill(stillOptions);
+          const frameDenied = frameFirewall.deniedRequests().length - frameDeniedBefore;
+          if (frameDenied > 0) {
+            throw new ComponentRuntimeError("component_network_denied", `Component attempted ${frameDenied} denied network request(s).`);
+          }
+          const frameFatal = frameFirewall.fatalError();
+          if (frameFatal !== null) throw frameFatal;
+        } catch (error) {
+          await removeOwnedOutput().catch((cleanupError) => {
+            if (error instanceof Error && error.cause === void 0) error.cause = cleanupError;
+          });
+          throw componentRuntimeError(error, "component_runtime_error");
+        } finally {
+          if (ownsFrameBrowser) {
+            await withComponentBrowserCleanupTimeout(frameFirewall.close()).catch(() => {
+            });
+          }
+        }
+        const denied = isolatesFrameBrowsers ? 0 : firewall.deniedRequests().length - deniedBefore;
+        if (denied > 0) {
+          return refuseAfterCleanup(new ComponentRuntimeError("component_network_denied", `Component attempted ${denied} denied network request(s).`));
+        }
+        const renderFatal = firewall.fatalError();
+        if (renderFatal !== null) {
+          state = "closed";
+          closePromise ??= Promise.all([firewall.close(), liveProxy.close()]).then(() => void 0);
+          return refuseAfterCleanup(componentRuntimeError(renderFatal, "component_runtime_error"));
+        }
+        if (opts.captureAttestation && capturePageRaster.value === null) {
+          return refuseAfterCleanup(new ComponentRuntimeError(
+            "component_runtime_error",
+            "Component capture page produced no correlated raster attestation."
+          ));
+        }
+        if (capturePageRaster.value && capturePageRaster.value.deviceScaleFactor !== scale) {
+          return refuseAfterCleanup(new ComponentRuntimeError(
+            "component_runtime_error",
+            `Component capture page used deviceScaleFactor ${capturePageRaster.value.deviceScaleFactor}; expected ${scale}.`
+          ));
+        }
+        return { pngPath, revision, actualGraphics: frameCollector.receipt(), capturePageRaster: capturePageRaster.value, outputOwnedBySession };
+      });
+    },
+    async renderVerifiedFrame(frameOpts = {}) {
+      const rendered = await session.renderFrame(frameOpts);
+      const refuseVerified = async (error) => {
+        if (rendered.outputOwnedBySession) {
+          let removed = false;
+          try {
+            await unlink(rendered.pngPath);
+            removed = true;
+          } catch (cleanupError) {
+            if (cleanupError?.code === "ENOENT") removed = true;
+            else if (error.cause === void 0) error.cause = cleanupError;
+            else process.stderr.write(`[component-runtime] output cleanup failed: ${String(cleanupError)}
+`);
+          }
+          if (removed) ownedOutputs.delete(rendered.pngPath);
+        }
+        throw error;
+      };
+      let bytes;
+      try {
+        bytes = await readFile2(rendered.pngPath);
+      } catch (error) {
+        let cleanupError;
+        if (rendered.outputOwnedBySession) await unlink(rendered.pngPath).catch((caught) => {
+          if (caught.code !== "ENOENT") cleanupError = caught;
+        });
+        if (cleanupError === void 0) ownedOutputs.delete(rendered.pngPath);
+        const failure = new ComponentRuntimeError(
+          "component_runtime_error",
+          `Component still output could not be read: ${error instanceof Error ? error.message : String(error)}.`
+        );
+        if (cleanupError !== void 0) failure.cause = cleanupError;
+        throw failure;
+      }
+      if (!session.hostAttestation || !rendered.capturePageRaster) {
+        return refuseVerified(new ComponentRuntimeError(
+          "component_runtime_error",
+          "Verified component capture requires a session opened with captureAttestation."
+        ));
+      }
+      let png;
+      try {
+        png = pngContainerFacts(rendered.pngPath, bytes);
+      } catch (error) {
+        return refuseVerified(error instanceof Error ? error : new Error(String(error)));
+      }
+      return {
+        png,
+        revision: rendered.revision,
+        actualGraphics: rendered.actualGraphics,
+        attestation: ComponentStillSessionAttestationV1.parse({
+          ...session.hostAttestation,
+          deviceScaleFactor: rendered.capturePageRaster.deviceScaleFactor
+        })
+      };
+    },
+    close() {
+      if (closePromise) return closePromise;
+      state = "closing";
+      closePromise = enqueue(async () => {
+        try {
+          await Promise.all([
+            firewall.close(),
+            liveProxy.close(),
+            ...[...ownedOutputs].map((path) => unlink(path).catch((error) => {
+              if (error.code !== "ENOENT") throw error;
+            }))
+          ]);
+          ownedOutputs.clear();
+        } finally {
+          state = "closed";
+        }
+      });
+      return closePromise;
+    },
+    cancel() {
+      if (cancelPromise) return cancelPromise;
+      state = "closing";
+      const browserClose = Promise.all([firewall.close(), liveProxy.close()]);
+      cancelPromise = (async () => {
+        let closeError;
+        try {
+          await browserClose;
+        } catch (error) {
+          closeError = error;
+        }
+        await tail;
+        const outputCleanup = await Promise.allSettled([...ownedOutputs].map((path) => unlink(path)));
+        ownedOutputs.clear();
+        state = "closed";
+        const outputFailures = outputCleanup.flatMap((result) => result.status === "rejected" && result.reason?.code !== "ENOENT" ? [result.reason] : []);
+        if (closeError !== void 0) {
+          if (outputFailures.length > 0 && closeError instanceof Error && closeError.cause === void 0) {
+            closeError.cause = new AggregateError(outputFailures, "Component capture output cleanup failed.");
+          } else if (outputFailures.length > 0) {
+            throw new AggregateError([closeError, ...outputFailures], "Component session cancellation and output cleanup failed.");
+          }
+          throw closeError;
+        }
+        if (outputFailures.length > 0) throw new AggregateError(outputFailures, "Component capture output cleanup failed.");
+      })();
+      closePromise ??= cancelPromise;
+      return cancelPromise;
+    }
+  };
+  return session;
+}
+async function renderComponentStill(opts) {
+  const session = await createComponentStillSession(opts);
+  let primaryError;
+  try {
+    const rendered = await session.renderFrame({
+      frame: opts.frame,
+      outputPath: join4(cacheDir(opts.ws), `still-${opts.id}.png`)
+    });
+    return { pngPath: rendered.pngPath, actualGraphics: rendered.actualGraphics };
+  } catch (error) {
+    primaryError = error;
+    throw error;
+  } finally {
+    try {
+      await session.close();
+    } catch (closeError) {
+      if (primaryError === void 0) throw closeError;
+    }
+  }
+}
+var vp9AlphaFfmpegOverride = ({ type, args }) => {
+  if (type !== "stitcher") return args;
+  return [...args.slice(0, -1), "-cpu-used", "4", "-row-mt", "1", "-threads", "8", args[args.length - 1]];
+};
+function alphaRenderConfig(codec) {
+  return codec === "prores" ? { codec: "prores", proResProfile: "4444", pixelFormat: "yuva444p10le", imageFormat: "png", muted: true } : { codec: "vp9", pixelFormat: "yuva420p", imageFormat: "png", muted: true, crf: 24, ffmpegOverride: vp9AlphaFfmpegOverride };
+}
+function alphaExt(codec) {
+  return codec === "prores" ? "mov" : "webm";
+}
+async function renderComponentAlpha(opts) {
+  const width = opts.width ?? 1920;
+  const height = opts.height ?? 1080;
+  const fps = opts.fps ?? 30;
+  const durationInFrames = opts.durationInFrames ?? fps * 3;
+  const codec = opts.codec ?? "prores";
+  let stageStarted = performance.now();
+  const timed = (stage) => {
+    const now = performance.now();
+    opts.onTiming?.({ stage, durationMs: now - stageStarted });
+    stageStarted = now;
+  };
+  const { serveUrl, browserExecutable, stagedBrowser, inputProps, renderEntryRoot } = await prepareLocalBundle({
+    ws: opts.ws,
+    id: opts.id,
+    width,
+    height,
+    fps,
+    durationInFrames,
+    params: opts.params,
+    assets: opts.assets,
+    seed: opts.seed,
+    graphics: opts.graphics,
+    renderEntryRoot: opts.renderEntryRoot
+  });
+  timed("bundle");
+  const { openBrowser, selectComposition, renderMedia, RenderInternals } = await importFromRenderEntry(
+    renderEntryRoot,
+    "@remotion/renderer"
+  );
+  const requiredGraphics = opts.graphics ?? {
+    api: "canvas2d",
+    required: true,
+    accelerationPreference: "software-allowed"
+  };
+  const collector = graphicsCollector(requiredGraphics);
+  let browser;
+  try {
+    browser = await openBrowser("chrome", componentBrowserOptions(requiredGraphics, browserExecutable, stagedBrowser.chromeMode));
+    timed("browser");
+  } catch (error) {
+    throw componentRuntimeError(error, "component_resource_exhausted", true);
+  }
+  let primaryError;
+  try {
+    await sizeLocalLaneWindows(renderEntryRoot, browser, width, height);
+    const firewall = await installComponentRequestFirewall(browser, opts.allowedAssetOrigins ?? /* @__PURE__ */ new Set());
+    const host = await assertComponentBrowserHardware(browser, requiredGraphics);
+    const composition = await selectComposition({
+      serveUrl,
+      id: LOCAL_COMPOSITION_ID,
+      inputProps,
+      puppeteerInstance: browser,
+      onBrowserLog: collector.onBrowserLog
+    });
+    timed("composition");
+    const rangeSuffix = opts.frameRange ? `-${opts.frameRange[0]}-${opts.frameRange[1]}` : "";
+    const videoPath = join4(cacheDir(opts.ws), `alpha-${opts.id}${rangeSuffix}.${alphaExt(codec)}`);
+    const renderStarted = performance.now();
+    let firstFrame = false;
+    const reported = /* @__PURE__ */ new Set();
+    const result = await renderMedia({
+      composition,
+      serveUrl,
+      inputProps,
+      puppeteerInstance: browser,
+      outputLocation: videoPath,
+      ...alphaRenderConfig(codec),
+      onBrowserLog: collector.onBrowserLog,
+      concurrency: opts.concurrency ?? 1,
+      // Match extraction capacity to the bounded frame pool. Remotion otherwise
+      // defaults to two extraction threads even when four pages are waiting.
+      offthreadVideoThreads: Math.max(2, Math.min(4, opts.concurrency ?? 1)),
+      // Container memory discovery can expose the entire host (377 GiB on
+      // Modal), so Remotion's host-derived cache defaults are not safe inside
+      // the 10 GiB sandbox.
+      // @remotion/media centralizes decoded frames in the main browser tab;
+      // unlike OffthreadVideo, its cache does not scale with page concurrency.
+      mediaCacheSizeInBytes: 256 * 1024 * 1024,
+      offthreadVideoCacheSizeInBytes: 256 * 1024 * 1024 * (opts.concurrency ?? 1),
+      onProgress: ({ renderedFrames, encodedFrames, renderedDoneIn, encodedDoneIn }) => {
+        if (!firstFrame && renderedFrames > 0) {
+          firstFrame = true;
+          opts.onTiming?.({ stage: "first-frame", durationMs: performance.now() - renderStarted });
+        }
+        for (const [stage, durationMs] of [["frames", renderedDoneIn], ["encoding", encodedDoneIn]]) {
+          if (durationMs != null && !reported.has(stage)) {
+            reported.add(stage);
+            opts.onTiming?.({ stage, durationMs });
+          }
+        }
+        opts.onProgress?.({
+          renderedFrames,
+          encodedFrames,
+          totalFrames: opts.frameRange ? opts.frameRange[1] - opts.frameRange[0] + 1 : durationInFrames
+        });
+      },
+      ...opts.frameRange ? { frameRange: opts.frameRange } : {}
+    });
+    opts.onTiming?.({
+      stage: "render",
+      durationMs: performance.now() - renderStarted,
+      // In pinned Remotion 4.0.429 these are completion intervals under
+      // concurrency, not individual frame latency. Retain the native summary
+      // alongside them so capture work can be assessed independently.
+      slowestFrames: result.slowestFrames,
+      rendererPerformance: RenderInternals.perf.getPerf()
+    });
+    const denied = firewall.deniedRequests();
+    if (denied.length > 0) {
+      throw new ComponentRuntimeError("component_network_denied", `Component attempted ${denied.length} denied network request(s).`);
+    }
+    return { videoPath, actualGraphics: collector.receipt(), host };
+  } catch (error) {
+    primaryError = componentRuntimeError(error, "component_runtime_error");
+    throw primaryError;
+  } finally {
+    try {
+      await browser.close({ silent: true });
+    } catch (closeError) {
+      if (primaryError === void 0) throw closeError;
+    }
+  }
+}
+
+export {
+  SUPPORTED_SCENE_SHOT_VERSIONS,
+  SCENE_SHOT_PARAM,
+  SCENE_ADMISSION_STAGE,
+  sceneShotIssuePath,
+  assertSceneShotCapabilitySupported,
+  assertSceneShotParamsAdmitted,
+  materializeComponentSource,
+  readMaterializedComponentSource,
+  decideComponentRequest,
+  COMPONENT_PAGE_LOCKDOWN,
+  installComponentRequestFirewall,
+  GRAPHICS_ATTESTATION_PREFIX,
+  parseGraphicsAttestationLog,
+  LOCAL_ROOT_FILENAME,
+  LOCAL_ENTRY_FILENAME,
+  LOCAL_COMPOSITION_ID,
+  generateLocalRoot,
+  shouldIsolateWebGpuStillBrowser,
+  COMPONENT_BROWSER_FIREWALL_TIMEOUT_MS,
+  COMPONENT_BROWSER_CLEANUP_TIMEOUT_MS,
+  COMPONENT_BROWSER_FIREWALL_ATTEMPTS,
+  buildLocalWebpackOverride,
+  importFromRenderEntry,
+  LOCAL_BROWSER_VERSION_PROBE_MS,
+  verifyLocalStagedBrowser,
+  installLocalLaneWindowSizer,
+  sizeLocalLaneWindows,
+  stagedBrowserLocator,
+  resolveRenderEntryRoot,
+  COMPONENT_STILL_RUNTIME_IDENTITY,
+  componentStillRasterAffectingFlags,
+  componentStillDependencyIdentity,
+  createComponentStillSession,
+  renderComponentStill,
+  vp9AlphaFfmpegOverride,
+  alphaRenderConfig,
+  alphaExt,
+  renderComponentAlpha
+};