@hyperframes/core 0.7.107 → 0.7.109

package/dist/audioLeveller.d.ts

@@ -0,0 +1,62 @@
+/**
+ * "Even Out Levels" — the first of the adaptive scripts.
+ *
+ * A preset cannot fix inconsistent loudness, because the right correction
+ * depends on the recording. So this measures the track and writes an automation
+ * lane that lifts the quiet passages toward the loud ones, exactly as the carve
+ * measures a voice and writes its bands.
+ *
+ * It is NOT loudness normalisation. Platform targets (-14 LUFS and friends) are
+ * ITU-R BS.1770 — K-weighted and gated — and this is plain windowed RMS, so
+ * calling it LUFS would be a claim the measurement does not support. It is
+ * named for what it does: evening out.
+ *
+ * ## Why the lane rides a `gain` node
+ *
+ * The obvious home is the track's volume lane, and that cannot work: volume is
+ * 0..1 and `normaliseEnvelope` clamps every keyframe into it, so a volume lane
+ * can only ever attenuate. Lifting a quiet passage needs a `gain` node, which
+ * spans -60..+12 dB — which is what the audio skill means when it calls `gain`
+ * "what an automation lane rides when a track has to move".
+ */
+import { type HfAutomation, type HfAutomationPoint } from "./audioAutomation.js";
+import { type HfAudioFxChain } from "./audioFx.js";
+export interface HfLevellerSettings {
+    /** 0 = leave it alone, 1 = as even as this can make it. */
+    strength: number;
+}
+export declare const DEFAULT_LEVELLER: HfLevellerSettings;
+export interface HfLevellerProfile {
+    /** How much of the measured difference to correct. */
+    correction: number;
+}
+/**
+ * One knob to a profile, the shape `carveProfile` established.
+ *
+ * At full strength this still corrects only most of the difference: driving a
+ * track to a flat line removes the performance along with the inconsistency.
+ */
+export declare function levellerProfile(strength: number): HfLevellerProfile;
+/**
+ * Measure a track and return the gain moves that even it out, in dB against
+ * clip-local seconds. Empty when there is nothing worth correcting.
+ */
+export declare function analyseLevelling(samples: Float32Array, sampleRate: number, strength?: number): HfAutomationPoint[];
+/**
+ * The chain and lane for "Even Out Levels".
+ *
+ * Returns nothing when the track needs no correcting — a script that always
+ * writes something teaches an author that it is doing nothing.
+ */
+export declare function levellingResult(chain: HfAudioFxChain, samples: Float32Array, sampleRate: number, strength?: number): {
+    chain: HfAudioFxChain;
+    automation: HfAutomation;
+} | null;
+/** Drop the leveller and say which lane went with it. */
+export declare function removeLevelling(chain: HfAudioFxChain): {
+    chain: HfAudioFxChain;
+    removedTarget: string | null;
+};
+/** What the module says when it is closed. */
+export declare function levellingSummary(points: readonly HfAutomationPoint[]): string;
+//# sourceMappingURL=audioLeveller.d.ts.map

package/dist/audioLeveller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audioLeveller.d.ts","sourceRoot":"","sources":["../src/audioLeveller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAgBtB,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,gBAAgB,EAAE,kBAAsC,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAGnE;AAiBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,SAA4B,GACnC,iBAAiB,EAAE,CAsErB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,SAA4B,GACnC;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CA4C5D;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG;IACtD,KAAK,EAAE,cAAc,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAMA;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAS7E"}

package/dist/audioLeveller.js

@@ -0,0 +1,208 @@
+/**
+ * "Even Out Levels" — the first of the adaptive scripts.
+ *
+ * A preset cannot fix inconsistent loudness, because the right correction
+ * depends on the recording. So this measures the track and writes an automation
+ * lane that lifts the quiet passages toward the loud ones, exactly as the carve
+ * measures a voice and writes its bands.
+ *
+ * It is NOT loudness normalisation. Platform targets (-14 LUFS and friends) are
+ * ITU-R BS.1770 — K-weighted and gated — and this is plain windowed RMS, so
+ * calling it LUFS would be a claim the measurement does not support. It is
+ * named for what it does: evening out.
+ *
+ * ## Why the lane rides a `gain` node
+ *
+ * The obvious home is the track's volume lane, and that cannot work: volume is
+ * 0..1 and `normaliseEnvelope` clamps every keyframe into it, so a volume lane
+ * can only ever attenuate. Lifting a quiet passage needs a `gain` node, which
+ * spans -60..+12 dB — which is what the audio skill means when it calls `gain`
+ * "what an automation lane rides when a track has to move".
+ */
+import { fxAutomationTarget, } from "./audioAutomation.js";
+import { HF_AUDIO_FX_CHAIN_VERSION, mintAudioFxNodeId, normalizeAudioFxParams, } from "./audioFx.js";
+/** One window per emitted point; the hop keeps the lane inside its budget. */
+const FRAME = 4096;
+const POINT_BUDGET = 400;
+/** Below this, a window is silence rather than a quiet passage worth lifting. */
+const FLOOR_BELOW_PEAK_DB = 42;
+/** How far a correction may go. Beyond this, lifting a whisper only lifts the room. */
+const MAX_LIFT_DB = 12;
+const MAX_CUT_DB = 12;
+/** Ignore differences smaller than this — they are not audible and they add points. */
+const SNAP_DB = 0.4;
+/** Attack/release in seconds, so a correction rides the phrase and not the syllable. */
+const ATTACK_S = 0.35;
+const RELEASE_S = 0.9;
+export const DEFAULT_LEVELLER = { strength: 0.5 };
+/**
+ * One knob to a profile, the shape `carveProfile` established.
+ *
+ * At full strength this still corrects only most of the difference: driving a
+ * track to a flat line removes the performance along with the inconsistency.
+ */
+export function levellerProfile(strength) {
+    const s = Number.isFinite(strength) ? Math.min(1, Math.max(0, strength)) : 0.5;
+    return { correction: Number((0.25 + s * 0.6).toFixed(3)) };
+}
+/** Level in dB of one window, or -Infinity for silence. */
+function windowDb(samples, from, count) {
+    let sum = 0;
+    let n = 0;
+    for (let i = from; i < from + count; i += 1) {
+        const s = samples[i];
+        if (s === undefined)
+            break;
+        sum += s * s;
+        n += 1;
+    }
+    if (n === 0)
+        return Number.NEGATIVE_INFINITY;
+    const rms = Math.sqrt(sum / n);
+    return rms > 0 ? 20 * Math.log10(rms) : Number.NEGATIVE_INFINITY;
+}
+/**
+ * Measure a track and return the gain moves that even it out, in dB against
+ * clip-local seconds. Empty when there is nothing worth correcting.
+ */
+export function analyseLevelling(samples, sampleRate, strength = DEFAULT_LEVELLER.strength) {
+    if (samples.length === 0 || sampleRate <= 0)
+        return [];
+    const profile = levellerProfile(strength);
+    const hop = Math.max(FRAME, Math.ceil(samples.length / POINT_BUDGET));
+    const levels = [];
+    const times = [];
+    for (let start = 0; start < samples.length; start += hop) {
+        levels.push(windowDb(samples, start, FRAME));
+        times.push((start + FRAME / 2) / sampleRate);
+    }
+    const speaking = levels.filter((d) => Number.isFinite(d));
+    if (speaking.length === 0)
+        return [];
+    const peak = Math.max(...speaking);
+    const floor = peak - FLOOR_BELOW_PEAK_DB;
+    /**
+     * The target is a level the track ALREADY REACHES — the 80th percentile of
+     * its speaking windows — not an absolute one.
+     *
+     * Anchoring it to an absolute figure means an already-even track gets pulled
+     * bodily up or down to meet it, which is a volume change wearing a
+     * levelling label. Against a level the track reaches, its loud passages
+     * correct to roughly nothing and only the quiet ones move, which is what
+     * evening out means. It is a percentile rather than the peak so one loud
+     * word cannot set the target for the whole track.
+     */
+    const sorted = [...speaking].sort((a, b) => a - b);
+    const target = sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * 0.8))] ?? peak;
+    const attack = 1 - Math.exp(-(hop / sampleRate) / ATTACK_S);
+    const release = 1 - Math.exp(-(hop / sampleRate) / RELEASE_S);
+    let applied = 0;
+    const raw = [];
+    levels.forEach((db, i) => {
+        // Silence is left alone. Lifting a pause only lifts the room with it.
+        const wanted = Number.isFinite(db) && db > floor
+            ? Math.max(-MAX_CUT_DB, Math.min(MAX_LIFT_DB, (target - db) * profile.correction))
+            : 0;
+        applied += (wanted > applied ? attack : release) * (wanted - applied);
+        const v = Math.abs(applied) < SNAP_DB ? 0 : Number(applied.toFixed(1));
+        raw.push({ t: Number((times[i] ?? 0).toFixed(3)), v });
+    });
+    // Keep only the moves. A run of equal values is held by keeping the last of
+    // the run, or interpolation would slide across a passage that is steady.
+    const points = [];
+    let lastKept = 0;
+    let keptIndex = -1;
+    raw.forEach((pt, i) => {
+        if (i !== raw.length - 1 && Math.abs(pt.v - lastKept) < SNAP_DB)
+            return;
+        if (i > 0 && keptIndex !== i - 1) {
+            const prev = raw[i - 1];
+            if (prev)
+                points.push(prev);
+        }
+        points.push(pt);
+        lastKept = pt.v;
+        keptIndex = i;
+    });
+    // A lane of zeroes is not a correction, it is a lane that says nothing. An
+    // author who runs this on an even track should be told there was nothing to
+    // do, not handed an inert envelope to wonder about.
+    if (points.length === 0 || points.every((p) => p.v === 0))
+        return [];
+    // A lane's first point has to sit at the clip's start, or everything before
+    // it is drawn from wherever the first move happens to be.
+    if ((points[0]?.t ?? 0) > 0)
+        points.unshift({ t: 0, v: points[0]?.v ?? 0 });
+    return points;
+}
+/**
+ * The chain and lane for "Even Out Levels".
+ *
+ * Returns nothing when the track needs no correcting — a script that always
+ * writes something teaches an author that it is doing nothing.
+ */
+export function levellingResult(chain, samples, sampleRate, strength = DEFAULT_LEVELLER.strength) {
+    const points = analyseLevelling(samples, sampleRate, strength);
+    if (points.length === 0)
+        return null;
+    const existing = chain.nodes.find((n) => n.fromLeveller);
+    const id = existing?.id ?? mintAudioFxNodeId(chain);
+    const node = {
+        type: "gain",
+        id,
+        fromLeveller: true,
+        label: "Even Out Levels",
+        enabled: true,
+        // Seeded at 0 dB: the lane is what moves it, and a non-zero seed would be
+        // heard for the instant before the first ramp is scheduled.
+        params: normalizeAudioFxParams("gain", { gain: 0 }),
+    };
+    /**
+     * In FRONT of a trailing limiter, not after it.
+     *
+     * The likely sequence is "apply Clean Voice, then even out the levels", and
+     * Clean Voice ends in a Peak Ceiling. Appending would put up to 12 dB of lift
+     * AFTER the ceiling that exists to bound the chain — so every quiet-to-loud
+     * transition leaves residual lift on loud material sitting at -1 dBFS, and
+     * the render shears it flat. A ceiling that something is added after is not
+     * a ceiling.
+     */
+    const insertAt = !existing && chain.nodes[chain.nodes.length - 1]?.type === "limiter"
+        ? chain.nodes.length - 1
+        : chain.nodes.length;
+    return {
+        chain: {
+            version: HF_AUDIO_FX_CHAIN_VERSION,
+            nodes: existing
+                ? chain.nodes.map((n) => (n.fromLeveller ? node : n))
+                : [...chain.nodes.slice(0, insertAt), node, ...chain.nodes.slice(insertAt)],
+        },
+        automation: {
+            version: 1,
+            lanes: [{ target: fxAutomationTarget(id, "gain"), points }],
+        },
+    };
+}
+/** Drop the leveller and say which lane went with it. */
+export function removeLevelling(chain) {
+    const node = chain.nodes.find((n) => n.fromLeveller);
+    return {
+        chain: { ...chain, nodes: chain.nodes.filter((n) => !n.fromLeveller) },
+        removedTarget: node?.id ? fxAutomationTarget(node.id, "gain") : null,
+    };
+}
+/** What the module says when it is closed. */
+export function levellingSummary(points) {
+    const moves = points.filter((p) => p.v !== 0);
+    if (moves.length === 0)
+        return "Already even — nothing to do";
+    const lift = Math.max(...moves.map((p) => p.v));
+    const cut = Math.min(...moves.map((p) => p.v));
+    const parts = [];
+    if (lift > 0)
+        parts.push(`lifting quiet parts up to ${lift.toFixed(1)} dB`);
+    if (cut < 0)
+        parts.push(`holding loud parts down ${Math.abs(cut).toFixed(1)} dB`);
+    return parts.join(", ");
+}
+//# sourceMappingURL=audioLeveller.js.map

package/dist/audioLeveller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audioLeveller.js","sourceRoot":"","sources":["../src/audioLeveller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,8EAA8E;AAC9E,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,uFAAuF;AACvF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,uFAAuF;AACvF,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,wFAAwF;AACxF,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,SAAS,GAAG,GAAG,CAAC;AAOtB,MAAM,CAAC,MAAM,gBAAgB,GAAuB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAOtE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,OAAqB,EAAE,IAAY,EAAE,KAAa;IAClE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM;QAC3B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,UAAkB,EAClB,QAAQ,GAAG,gBAAgB,CAAC,QAAQ;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,mBAAmB,CAAC;IACzC;;;;;;;;;;OAUG;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE5F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,SAAS,CAAC,CAAC;IAE9D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACvB,sEAAsE;QACtE,MAAM,MAAM,GACV,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK;YAC/B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC,CAAC;QACR,OAAO,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO;YAAE,OAAO;QACxE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;QAChB,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACrE,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,OAAqB,EACrB,UAAkB,EAClB,QAAQ,GAAG,gBAAgB,CAAC,QAAQ;IAEpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,QAAQ,EAAE,EAAE,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,IAAI,GAAkB;QAC1B,IAAI,EAAE,MAAM;QACZ,EAAE;QACF,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,IAAI;QACb,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,EAAE,sBAAsB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,QAAQ,GACZ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS;QAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IAEzB,OAAO;QACL,KAAK,EAAE;YACL,OAAO,EAAE,yBAAyB;YAClC,KAAK,EAAE,QAAQ;gBACb,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SAC9E;QACD,UAAU,EAAE;YACV,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,KAAqB;IAInD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO;QACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;QACtE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACrE,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,MAAoC;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,GAAG,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/canaryRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canaryRegistry.d.ts","sourceRoot":"","sources":["../src/canaryRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,QAAQ,EAAE,SAAS,gBAAgB,EAmCtC,CAAC;AAEX,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAErE;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,EAAE,CAQhE"}
+{"version":3,"file":"canaryRegistry.d.ts","sourceRoot":"","sources":["../src/canaryRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,QAAQ,EAAE,SAAS,gBAAgB,EA4CtC,CAAC;AAEX,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAErE;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,EAAE,CAQhE"}

package/dist/canaryRegistry.js

@@ -59,6 +59,14 @@ export const CANARIES = [
         owner: "vance",
         sunsetAfter: "2026-09-15",
     },
+    // ── Audio FX ─────────────────────────────────────────────────────────────
+    {
+        name: "audio-fx-rack",
+        percentage: 0,
+        description: "Show the Audio FX rack on audio tracks in Studio — effects, presets, the voiceover carve and levelling. Gates the AUTHORING surface only: a composition that already carries data-fx-chain still plays and renders it, because a canary should stage who can reach a feature, not make a written attribute silently inert.",
+        owner: "vance",
+        sunsetAfter: "2026-11-15",
+    },
 ];
 export function findCanary(name) {
     return CANARIES.find((c) => c.name === name);

package/dist/canaryRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"canaryRegistry.js","sourceRoot":"","sources":["../src/canaryRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAqBH,MAAM,CAAC,MAAM,QAAQ,GAAgC;IACnD,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,wDAAwD;IACxD,sEAAsE;IACtE,kEAAkE;IAClE,EAAE;IACF,kEAAkE;IAClE,mDAAmD;IACnD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,yEAAyE;QACtF,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,EAAE;QACd,WAAW,EACT,oFAAoF;QACtF,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;CACO,CAAC;AAEX,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAY,IAAI,IAAI,EAAE;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,gBAAgB,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC;IACjE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"canaryRegistry.js","sourceRoot":"","sources":["../src/canaryRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAqBH,MAAM,CAAC,MAAM,QAAQ,GAAgC;IACnD,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,wDAAwD;IACxD,sEAAsE;IACtE,kEAAkE;IAClE,EAAE;IACF,kEAAkE;IAClE,mDAAmD;IACnD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,yEAAyE;QACtF,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,EAAE;QACd,WAAW,EACT,oFAAoF;QACtF,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;IACD,4EAA4E;IAC5E;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,CAAC;QACb,WAAW,EACT,4TAA4T;QAC9T,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,YAAY;KAC1B;CACO,CAAC;AAEX,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAY,IAAI,IAAI,EAAE;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,gBAAgB,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC;IACjE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/compiler/compositionScoping.d.ts

@@ -17,6 +17,9 @@ export declare function wrapInlineScriptWithErrorBoundary(source: string, errorL
  * `getVariables()` returned `{}` only during render — parametrized sub-comps
  * silently shipped blank/default text in the final MP4 while snapshot QA passed
  * (issue #2064). Both callers now share this one builder so they can't drift.
+ *
+ * Values, keys and composition ids are all attacker-reachable, so the whole
+ * table goes through `jsonScriptLiteral` — see there for why.
  */
 export declare function buildVariablesByCompScript(variablesByComp: Record<string, Record<string, unknown>>): string | null;
 //# sourceMappingURL=compositionScoping.d.ts.map

package/dist/compiler/compositionScoping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compositionScoping.d.ts","sourceRoot":"","sources":["../../src/compiler/compositionScoping.ts"],"names":[],"mappings":"AA4NA,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,qBAAqB,CAAC,EAAE,MAAM,EAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GACzE,MAAM,CAwBR;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,UAAU,SAA4C,EACtD,qBAAqB,CAAC,EAAE,MAAM,EAC9B,qBAAqB,SAAgB,EACrC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,MAAM,CAqUR;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvD,MAAM,GAAG,IAAI,CAGf"}
+{"version":3,"file":"compositionScoping.d.ts","sourceRoot":"","sources":["../../src/compiler/compositionScoping.ts"],"names":[],"mappings":"AA4NA,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,qBAAqB,CAAC,EAAE,MAAM,EAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GACzE,MAAM,CAwBR;AAsBD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,UAAU,SAA4C,EACtD,qBAAqB,CAAC,EAAE,MAAM,EAC9B,qBAAqB,SAAgB,EACrC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,MAAM,CAqUR;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvD,MAAM,GAAG,IAAI,CAIf"}

package/dist/compiler/compositionScoping.js

@@ -190,22 +190,41 @@ export function scopeCssToComposition(css, compositionId, scopeSelectorOverride,
     });
     return root.toResult({ map: false }).css;
 }
+/**
+ * Serialize a value as a JS literal safe to emit inside a `<script>` element.
+ *
+ * `<script>` is a RAW TEXT element: HTML serialization does not escape its
+ * content, and the tokenizer ends the element at the first `</script` — in any
+ * string, comment or regex context. `JSON.stringify` escapes `"` and `\` but
+ * neither `<` nor `/`, so any dynamic literal carrying `</script>` would close
+ * the element early and have the remainder parsed as markup. Rewriting every
+ * `<` to `<` removes the only byte that can start a closing tag, and is
+ * transparent to both `JSON.parse` and the JS string grammar, so the value the
+ * runtime reads is unchanged.
+ *
+ * Every dynamic literal in an emitted script body must go through here: a
+ * per-value guard on this surface has already been missed once, since the
+ * composition id reaches the emitted script through four separate literals.
+ */
+function jsonScriptLiteral(value) {
+    return JSON.stringify(value).replace(/</g, "\\u003c");
+}
 export function wrapScopedCompositionScript(source, compositionId, errorLabel = "[HyperFrames] composition script error:", scopeSelectorOverride, timelineCompositionId = compositionId, authoredRootId) {
-    const compositionIdLiteral = JSON.stringify(compositionId);
-    const timelineCompositionIdLiteral = JSON.stringify(timelineCompositionId);
-    const errorLabelLiteral = JSON.stringify(errorLabel);
+    const compositionIdLiteral = jsonScriptLiteral(compositionId);
+    const timelineCompositionIdLiteral = jsonScriptLiteral(timelineCompositionId);
+    const errorLabelLiteral = jsonScriptLiteral(errorLabel);
     const escapedCompositionId = escapeRegExp(compositionId);
-    const authoredRootIdLiteral = JSON.stringify(authoredRootId?.trim() || null);
-    const scopeSelectorLiteral = JSON.stringify(scopeSelectorOverride ?? null);
-    const rootSelectorPatternLiteral = JSON.stringify(String.raw `\[\s*data-composition-id\s*=\s*(?:"${escapedCompositionId}"|'${escapedCompositionId}')\s*\]`);
-    const timingSelectorPatternLiteral = JSON.stringify(String.raw `\s*\[\s*data-(?:start|duration)\s*=\s*(?:"[^"]*"|'[^']*')\s*\]`);
-    const authoredRootIdFormsLiteral = JSON.stringify(getAuthoredRootIdSelectorForms(authoredRootId?.trim() || ""));
+    const authoredRootIdLiteral = jsonScriptLiteral(authoredRootId?.trim() || null);
+    const scopeSelectorLiteral = jsonScriptLiteral(scopeSelectorOverride ?? null);
+    const rootSelectorPatternLiteral = jsonScriptLiteral(String.raw `\[\s*data-composition-id\s*=\s*(?:"${escapedCompositionId}"|'${escapedCompositionId}')\s*\]`);
+    const timingSelectorPatternLiteral = jsonScriptLiteral(String.raw `\s*\[\s*data-(?:start|duration)\s*=\s*(?:"[^"]*"|'[^']*')\s*\]`);
+    const authoredRootIdFormsLiteral = jsonScriptLiteral(getAuthoredRootIdSelectorForms(authoredRootId?.trim() || ""));
     return `(function(){
   var __hfCompId = ${compositionIdLiteral};
   var __hfTimelineCompId = ${timelineCompositionIdLiteral};
   var __hfErrorLabel = ${errorLabelLiteral};
   var __hfAuthoredRootId = ${authoredRootIdLiteral};
-  var __hfAuthoredRootAttr = ${JSON.stringify(AUTHORED_ROOT_ID_ATTR)};
+  var __hfAuthoredRootAttr = ${jsonScriptLiteral(AUTHORED_ROOT_ID_ATTR)};
   var __hfEscapeAttr = function(value) {
     return (value + "").replace(/\\\\/g, "\\\\\\\\").replace(/"/g, "\\\\\\"");
   };
@@ -511,7 +530,7 @@ ${source.replace(/<\/(script)/gi, "<\\/$1")}
 })();`;
 }
 export function wrapInlineScriptWithErrorBoundary(source, errorLabel) {
-    return `(function(){ try { Function(${JSON.stringify(source)}).call(window); } catch (_err) { console.error(${JSON.stringify(errorLabel)}, _err); } })();`;
+    return `(function(){ try { Function(${jsonScriptLiteral(source)}).call(window); } catch (_err) { console.error(${jsonScriptLiteral(errorLabel)}, _err); } })();`;
 }
 /**
  * Build the statement that populates `window.__hfVariablesByComp` — the table
@@ -526,10 +545,14 @@ export function wrapInlineScriptWithErrorBoundary(source, errorLabel) {
  * `getVariables()` returned `{}` only during render — parametrized sub-comps
  * silently shipped blank/default text in the final MP4 while snapshot QA passed
  * (issue #2064). Both callers now share this one builder so they can't drift.
+ *
+ * Values, keys and composition ids are all attacker-reachable, so the whole
+ * table goes through `jsonScriptLiteral` — see there for why.
  */
 export function buildVariablesByCompScript(variablesByComp) {
     if (!variablesByComp || Object.keys(variablesByComp).length === 0)
         return null;
-    return `window.__hfVariablesByComp = Object.assign({}, window.__hfVariablesByComp || {}, ${JSON.stringify(variablesByComp)});`;
+    const json = jsonScriptLiteral(variablesByComp);
+    return `window.__hfVariablesByComp = Object.assign({}, window.__hfVariablesByComp || {}, ${json});`;
 }
 //# sourceMappingURL=compositionScoping.js.map

package/dist/compiler/compositionScoping.js.map

@@ -1 +1 @@
-{"version":3,"file":"compositionScoping.js","sourceRoot":"","sources":["../../src/compiler/compositionScoping.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8C,MAAM,SAAS,CAAC;AAErE,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AACpD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,8BAA8B,CAAC,cAAsB;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAwB;IAClD,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,8BAA8B,CACrC,QAAgB,EAChB,cAAsB,EACtB,WAAmB;IAEnB,MAAM,KAAK,GAAG,8BAA8B,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAqB,IAAI,CAAC;IAEnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,IAAI,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC5C,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,WAAW,CAAC;oBACtB,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC;oBAC5B,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CAAC,QAAgB,EAAE,cAA8B;IACvF,MAAM,OAAO,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,8BAA8B,CACnC,QAAQ,EACR,OAAO,EACP,IAAI,qBAAqB,KAAK,uBAAuB,CAAC,OAAO,CAAC,IAAI,CACnE,CAAC;AACJ,CAAC;AAED;;;;mEAImE;AACnE,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,GAAG,KAAK,cAAc,eAAe,QAAQ,KAAK,OAAO,eAAe,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,cAA8B,EAC9B,oBAA8B,EAC9B,kBAA4B;IAE5B,MAAM,6BAA6B,GAAG,+BAA+B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChG,MAAM,yBAAyB,GAAG,gCAAgC,CAChE,6BAA6B,EAC7B,KAAK,EACL,aAAa,CACd,CAAC;IACF,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,+EAA+E;QAC/E,EAAE;QACF,oEAAoE;QACpE,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,oEAAoE;QACpE,OAAO,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,MAAM,CACrC,4CAA4C,YAAY,CAAC,aAAa,CAAC,YAAY,EACnF,GAAG,CACJ,CAAC;IACF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAClF,IAAI,iBAAiB,EAAE,CAAC;YACtB,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,kEAAkE;YAClE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,yBAAyB,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,cAAc;YACrC,CAAC,CAAC,IAAI,qBAAqB,KAAK,uBAAuB,CAAC,cAAc,CAAC,IAAI;YAC3E,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,gBAAgB,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,OAAO,GAAG,KAAK,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,gCAAgC,CACvC,QAAgB,EAChB,KAAa,EACb,aAAqB;IAErB,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,sCAAsC,YAAY,MAAM,YAAY,SAAS,CAAC;IACzG,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAAC;IAC9F,OAAO,QAAQ;SACZ,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,QAAQ,MAAM,UAAU,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;SAChE,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,UAAU,KAAK,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjF,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAU;IACtC,IAAI,OAAO,GAAmB,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,IAAU;IAC3C,IAAI,OAAO,GAAmB,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,aAAqB,EACrB,qBAA8B,EAC9B,cAA8B,EAC9B,OAA0E;IAE1E,MAAM,oBAAoB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,KAAK,GACT,qBAAqB;QACrB,yBAAyB,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,IAAI,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,aAAa,CACX,QAAQ,EACR,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,kBAAkB,CAC5B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAc,EACd,aAAqB,EACrB,UAAU,GAAG,yCAAyC,EACtD,qBAA8B,EAC9B,qBAAqB,GAAG,aAAa,EACrC,cAA8B;IAE9B,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,4BAA4B,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,oBAAoB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;IAC7E,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,0BAA0B,GAAG,IAAI,CAAC,SAAS,CAC/C,MAAM,CAAC,GAAG,CAAA,sCAAsC,oBAAoB,MAAM,oBAAoB,SAAS,CACxG,CAAC;IACF,MAAM,4BAA4B,GAAG,IAAI,CAAC,SAAS,CACjD,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAC3E,CAAC;IACF,MAAM,0BAA0B,GAAG,IAAI,CAAC,SAAS,CAC/C,8BAA8B,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;IACF,OAAO;qBACY,oBAAoB;6BACZ,4BAA4B;yBAChC,iBAAiB;6BACb,qBAAqB;+BACnB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;;2BAIzC,oBAAoB;;;;kCAIb,0BAA0B;oCACxB,4BAA4B;kCAC9B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6R1D,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC;;;;;;;;MAQrC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,MAAc,EAAE,UAAkB;IAClF,OAAO,+BAA+B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC;AAC7J,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,eAAwD;IAExD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,oFAAoF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC;AACjI,CAAC"}
+{"version":3,"file":"compositionScoping.js","sourceRoot":"","sources":["../../src/compiler/compositionScoping.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8C,MAAM,SAAS,CAAC;AAErE,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AACpD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,8BAA8B,CAAC,cAAsB;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAwB;IAClD,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,8BAA8B,CACrC,QAAgB,EAChB,cAAsB,EACtB,WAAmB;IAEnB,MAAM,KAAK,GAAG,8BAA8B,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAqB,IAAI,CAAC;IAEnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,IAAI,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC5C,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,WAAW,CAAC;oBACtB,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC;oBAC5B,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CAAC,QAAgB,EAAE,cAA8B;IACvF,MAAM,OAAO,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,8BAA8B,CACnC,QAAQ,EACR,OAAO,EACP,IAAI,qBAAqB,KAAK,uBAAuB,CAAC,OAAO,CAAC,IAAI,CACnE,CAAC;AACJ,CAAC;AAED;;;;mEAImE;AACnE,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,GAAG,KAAK,cAAc,eAAe,QAAQ,KAAK,OAAO,eAAe,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,cAA8B,EAC9B,oBAA8B,EAC9B,kBAA4B;IAE5B,MAAM,6BAA6B,GAAG,+BAA+B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChG,MAAM,yBAAyB,GAAG,gCAAgC,CAChE,6BAA6B,EAC7B,KAAK,EACL,aAAa,CACd,CAAC;IACF,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,+EAA+E;QAC/E,EAAE;QACF,oEAAoE;QACpE,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,oEAAoE;QACpE,OAAO,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,MAAM,CACrC,4CAA4C,YAAY,CAAC,aAAa,CAAC,YAAY,EACnF,GAAG,CACJ,CAAC;IACF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAClF,IAAI,iBAAiB,EAAE,CAAC;YACtB,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,kEAAkE;YAClE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,yBAAyB,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,cAAc;YACrC,CAAC,CAAC,IAAI,qBAAqB,KAAK,uBAAuB,CAAC,cAAc,CAAC,IAAI;YAC3E,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,gBAAgB,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,OAAO,GAAG,KAAK,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,gCAAgC,CACvC,QAAgB,EAChB,KAAa,EACb,aAAqB;IAErB,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,sCAAsC,YAAY,MAAM,YAAY,SAAS,CAAC;IACzG,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAAC;IAC9F,OAAO,QAAQ;SACZ,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,QAAQ,MAAM,UAAU,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;SAChE,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,UAAU,KAAK,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjF,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAU;IACtC,IAAI,OAAO,GAAmB,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,IAAU;IAC3C,IAAI,OAAO,GAAmB,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,aAAqB,EACrB,qBAA8B,EAC9B,cAA8B,EAC9B,OAA0E;IAE1E,MAAM,oBAAoB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,KAAK,GACT,qBAAqB;QACrB,yBAAyB,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,IAAI,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,aAAa,CACX,QAAQ,EACR,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,kBAAkB,CAC5B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAc,EACd,aAAqB,EACrB,UAAU,GAAG,yCAAyC,EACtD,qBAA8B,EAC9B,qBAAqB,GAAG,aAAa,EACrC,cAA8B;IAE9B,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,4BAA4B,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;IAChF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;IAC9E,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,MAAM,CAAC,GAAG,CAAA,sCAAsC,oBAAoB,MAAM,oBAAoB,SAAS,CACxG,CAAC;IACF,MAAM,4BAA4B,GAAG,iBAAiB,CACpD,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAC3E,CAAC;IACF,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,8BAA8B,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;IACF,OAAO;qBACY,oBAAoB;6BACZ,4BAA4B;yBAChC,iBAAiB;6BACb,qBAAqB;+BACnB,iBAAiB,CAAC,qBAAqB,CAAC;;;;2BAI5C,oBAAoB;;;;kCAIb,0BAA0B;oCACxB,4BAA4B;kCAC9B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6R1D,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC;;;;;;;;MAQrC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,MAAc,EAAE,UAAkB;IAClF,OAAO,+BAA+B,iBAAiB,CAAC,MAAM,CAAC,kDAAkD,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACnK,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CACxC,eAAwD;IAExD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,oFAAoF,IAAI,IAAI,CAAC;AACtG,CAAC"}

package/dist/compiler/htmlBundler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"htmlBundler.d.ts","sourceRoot":"","sources":["../../src/compiler/htmlBundler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAO5E,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAwYvE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AA4CF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,EAAE,EAChB,MAAM,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAA6C,GACtE,GAAG,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAyC9C;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAWrE;AA2KD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACnC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAmFD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CA2VjB;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,QAAQ,EAClB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,EAC7D,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CAcT"}
+{"version":3,"file":"htmlBundler.d.ts","sourceRoot":"","sources":["../../src/compiler/htmlBundler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAQ5E,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAiZvE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AA4CF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,EAAE,EAChB,MAAM,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAA6C,GACtE,GAAG,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAyC9C;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAWrE;AA2KD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACnC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAmFD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CA2VjB;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,QAAQ,EAClB,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,EAC7D,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CAcT"}

package/dist/compiler/htmlBundler.js

@@ -1,6 +1,7 @@
 import { markFlattenedInnerRoot } from "../runtime/flattenedRoot.js";
 export { FLATTENED_INNER_ROOT_STRIP_ATTRS } from "../runtime/flattenedRoot.js";
 import { parseHostVariableValues, warnUnknownEnumValues } from "../runtime/getVariables.js";
+import { sanitizeCssValue } from "../runtime/applyVariableBindings.js";
 import { cssVariableName } from "../tokenSlug.js";
 import { readFileSync, existsSync } from "fs";
 import { resolve, relative, dirname, isAbsolute, sep } from "path";
@@ -382,8 +383,17 @@ function rewriteCssUrlsWithInlinedAssets(cssText, projectDir) {
         return `url(${quote || ""}${maybeInlined}${quote || ""})`;
     });
 }
+/**
+ * Selectors built here are serialized inside a `<style>` element, which is a RAW
+ * TEXT element: the tokenizer ends it at the first `</style` regardless of CSS
+ * context, and the serializer does not escape its content. Backslash and quote
+ * escaping keeps the selector's own string grammar valid; it does nothing about
+ * element termination, so `<` needs the CSS hex escape too. `\3c ` is legal
+ * wherever a string is, and matches the same attribute value, so selectors keep
+ * matching. The trailing space terminates the escape.
+ */
 function cssAttributeSelector(attr, value) {
-    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/</g, "\\3c ");
     return `[${attr}="${escaped}"]`;
 }
 function uniqueCompositionId(baseId, index) {
@@ -1021,12 +1031,42 @@ export async function bundleToSingleHtml(projectDir, options) {
     }
     return document.toString();
 }
+/**
+ * Make a scalar variable value safe to bake into a stylesheet.
+ *
+ * Two independent hazards, so two layers:
+ *
+ * 1. `sanitizeCssValue` is the runtime's own contract (`applyVariableBindings`,
+ *    and `docs/concepts/variables.mdx` promises it): a scalar folded into
+ *    `background: var(--x)` must not be able to close the declaration and open a
+ *    new rule (`red; } body { background-image: url(//evil?data=…) }`). The
+ *    compile path has to reach the same result as the runtime — a value the
+ *    runtime strips but a compile-time emit honours would make the rendered MP4
+ *    diverge from the preview.
+ * 2. These rules are then serialized inside a `<style>` element, which is a RAW
+ *    TEXT element: HTML serialization does not escape its content and the
+ *    tokenizer ends it at the first `</style`. `\3c ` is the CSS escape for `<`,
+ *    valid in every value position including inside an unquoted `url()`, and
+ *    resolves back to `<`, so rendering is unchanged. The trailing space is
+ *    consumed as part of the escape.
+ *
+ * The sanitizer already removes `<`, so today layer 2 is redundant for values
+ * and load-bearing only for the selector (`cssAttributeSelector`, which must
+ * preserve `<` to keep matching). It stays because the two layers answer to
+ * different rules: narrowing the scalar character set must not silently reopen
+ * an element-termination hole.
+ *
+ * Variable IDs need no equivalent: `cssVariableName` slugifies them.
+ */
+function cssSafeVariableValue(value) {
+    return sanitizeCssValue(String(value)).replace(/</g, "\\3c ");
+}
 /** One stylesheet rule defining primitive composition variables under `selector`. */
 function compositionVariablesCssBlock(variables, selector) {
     const lines = [];
     for (const [id, value] of Object.entries(variables)) {
         if ((typeof value === "string" && value !== "") || typeof value === "number") {
-            lines.push(`  ${cssVariableName(id)}: ${String(value)};`);
+            lines.push(`  ${cssVariableName(id)}: ${cssSafeVariableValue(value)};`);
         }
     }
     if (lines.length === 0)