@ignix-social/editor 0.1.0

package/vendor/hyperframes/dist/policies-FSDZVS2E.js

@@ -0,0 +1,292 @@
+import { createRequire as __hf_createRequire } from "node:module";
+import { fileURLToPath as __hf_fileURLToPath } from "node:url";
+import { dirname as __hf_dirname } from "node:path";
+var require = __hf_createRequire(import.meta.url);
+var __filename = __hf_fileURLToPath(import.meta.url);
+var __dirname = __hf_dirname(__filename);
+import {
+  c
+} from "./chunk-ZTZA4UWZ.js";
+import {
+  setCommandExitCode
+} from "./chunk-PBN6GBJE.js";
+import {
+  normalizeErrorMessage
+} from "./chunk-KNU5COPB.js";
+import "./chunk-M2WBOQ2Q.js";
+
+// src/commands/lambda/policies.ts
+import { readFileSync } from "fs";
+var REQUIRED_ACTIONS = {
+  cloudformation: [
+    "cloudformation:CreateChangeSet",
+    "cloudformation:CreateStack",
+    "cloudformation:DeleteChangeSet",
+    "cloudformation:DeleteStack",
+    "cloudformation:DescribeChangeSet",
+    "cloudformation:DescribeStackEvents",
+    "cloudformation:DescribeStackResource",
+    "cloudformation:DescribeStackResources",
+    "cloudformation:DescribeStacks",
+    "cloudformation:ExecuteChangeSet",
+    "cloudformation:GetTemplate",
+    "cloudformation:GetTemplateSummary",
+    "cloudformation:ListStacks",
+    "cloudformation:UpdateStack",
+    "cloudformation:ValidateTemplate"
+  ],
+  cloudwatchAlarms: [
+    "cloudwatch:DeleteAlarms",
+    "cloudwatch:DescribeAlarms",
+    "cloudwatch:PutMetricAlarm"
+  ],
+  iam: [
+    "iam:AttachRolePolicy",
+    "iam:CreateRole",
+    "iam:DeleteRole",
+    "iam:DeleteRolePolicy",
+    "iam:DetachRolePolicy",
+    "iam:GetRole",
+    "iam:GetRolePolicy",
+    "iam:PassRole",
+    "iam:PutRolePolicy",
+    "iam:TagRole",
+    "iam:UntagRole"
+  ],
+  lambda: [
+    "lambda:AddPermission",
+    "lambda:CreateFunction",
+    "lambda:DeleteFunction",
+    "lambda:GetFunction",
+    "lambda:GetFunctionConfiguration",
+    "lambda:InvokeFunction",
+    "lambda:ListFunctions",
+    "lambda:PutFunctionConcurrency",
+    "lambda:RemovePermission",
+    "lambda:TagResource",
+    "lambda:UntagResource",
+    "lambda:UpdateFunctionCode",
+    "lambda:UpdateFunctionConfiguration"
+  ],
+  logs: [
+    "logs:CreateLogGroup",
+    "logs:DeleteLogGroup",
+    "logs:DescribeLogGroups",
+    "logs:PutRetentionPolicy",
+    "logs:TagResource"
+  ],
+  s3Bucket: [
+    "s3:CreateBucket",
+    "s3:DeleteBucket",
+    "s3:DeleteBucketPolicy",
+    "s3:GetBucketLocation",
+    "s3:GetBucketPolicy",
+    "s3:GetBucketTagging",
+    "s3:GetBucketVersioning",
+    // SAM's `--resolve-s3` managed bucket (aws-sam-cli-managed-default) sets
+    // default SSE encryption; CloudFormation reads it on update/drift. Without
+    // Get/PutEncryptionConfiguration the first `lambda deploy` 403s creating
+    // that bucket and the managed stack rolls back.
+    "s3:GetEncryptionConfiguration",
+    "s3:GetLifecycleConfiguration",
+    "s3:ListAllMyBuckets",
+    "s3:ListBucket",
+    "s3:PutBucketPolicy",
+    "s3:PutBucketTagging",
+    "s3:PutBucketVersioning",
+    "s3:PutEncryptionConfiguration",
+    "s3:PutLifecycleConfiguration",
+    "s3:PutPublicAccessBlock"
+  ],
+  s3Object: ["s3:DeleteObject", "s3:GetObject", "s3:PutObject"],
+  states: [
+    "states:CreateStateMachine",
+    "states:DeleteStateMachine",
+    "states:DescribeExecution",
+    "states:DescribeStateMachine",
+    "states:GetExecutionHistory",
+    "states:ListExecutions",
+    "states:ListStateMachines",
+    "states:StartExecution",
+    "states:StopExecution",
+    "states:TagResource",
+    "states:UntagResource",
+    "states:UpdateStateMachine"
+  ]
+};
+function allRequiredActions() {
+  const set = /* @__PURE__ */ new Set();
+  for (const group of Object.values(REQUIRED_ACTIONS)) {
+    for (const action of group) set.add(action);
+  }
+  return [...set].sort();
+}
+function buildPolicyDocument() {
+  return {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Allow",
+        Action: allRequiredActions(),
+        Resource: "*"
+      }
+    ]
+  };
+}
+function buildRoleTrustPolicy() {
+  return {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Allow",
+        Principal: { Service: "cloudformation.amazonaws.com" },
+        Action: "sts:AssumeRole"
+      }
+    ]
+  };
+}
+async function runPolicies(args) {
+  switch (args.verb) {
+    case "user": {
+      const doc = buildPolicyDocument();
+      console.log(JSON.stringify(doc, null, 2));
+      if (!args.json) {
+        console.error(
+          c.dim(
+            "\n# Attach the above as an inline policy to the IAM user/role that runs `hyperframes lambda *`.\n# Scope `Resource` to your stack's ARNs after the first successful deploy."
+          )
+        );
+      }
+      return;
+    }
+    case "role": {
+      const trust = buildRoleTrustPolicy();
+      const inline = buildPolicyDocument();
+      const wrapped = {
+        TrustRelationship: trust,
+        InlinePolicy: inline
+      };
+      console.log(JSON.stringify(wrapped, null, 2));
+      return;
+    }
+    case "validate": {
+      if (!args.inputPath) {
+        const msg = "[lambda policies validate] usage: hyperframes lambda policies validate <policy.json>";
+        if (args.json) {
+          console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          setCommandExitCode(1);
+          return;
+        }
+        throw new Error(msg);
+      }
+      let result;
+      try {
+        result = validatePolicy(args.inputPath);
+      } catch (err) {
+        const msg = normalizeErrorMessage(err);
+        if (args.json) {
+          console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+          setCommandExitCode(1);
+          return;
+        }
+        console.error(c.error(`Failed to validate ${args.inputPath}: ${msg}`));
+        setCommandExitCode(1);
+        return;
+      }
+      if (args.json) {
+        console.log(JSON.stringify({ ok: result.missing.length === 0, ...result }, null, 2));
+        if (result.missing.length > 0) setCommandExitCode(1);
+        return;
+      }
+      for (const warning of result.warnings) {
+        console.warn(c.dim(`Warning: ${warning}`));
+      }
+      if (result.missing.length === 0) {
+        console.log(c.success(`Policy covers all ${result.required.length} required actions.`));
+        return;
+      }
+      console.log(c.error(`Policy is missing ${result.missing.length} required action(s):`));
+      for (const action of result.missing) {
+        console.log(`  \u2022 ${action}`);
+      }
+      console.log();
+      console.log(
+        c.dim("Run `hyperframes lambda policies user` to print the full required policy.")
+      );
+      setCommandExitCode(1);
+      return;
+    }
+  }
+}
+function validatePolicy(policyPath) {
+  const raw = readFileSync(policyPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  const statements = Array.isArray(parsed.Statement) ? parsed.Statement : parsed.Statement ? [
+    parsed.Statement
+  ] : [];
+  const grantedPatterns = [];
+  const warnings = [];
+  for (const stmt of statements) {
+    if (stmt.Effect !== "Allow") continue;
+    if (stmt.NotAction !== void 0) {
+      warnings.push(
+        "Allow statement uses NotAction; the validator only checks positive Action grants, so this statement is being ignored. Convert to an explicit Action list to validate it."
+      );
+      continue;
+    }
+    if (stmt.NotResource !== void 0) {
+      warnings.push(
+        "Allow statement uses NotResource; resource-scoping is not modelled by this validator. Treating the statement as fully granted on its Action set."
+      );
+    }
+    const actions = stmt.Action;
+    if (typeof actions === "string") {
+      grantedPatterns.push(actions);
+    } else if (Array.isArray(actions)) {
+      for (const a of actions) if (typeof a === "string") grantedPatterns.push(a);
+    }
+  }
+  for (const pattern of grantedPatterns) {
+    if (hasMidStringWildcard(pattern)) {
+      warnings.push(
+        `Action pattern ${JSON.stringify(pattern)} contains a mid-string wildcard the validator can't expand; only end-anchored wildcards (\`*\`, \`service:*\`, \`prefix*\`) are honoured.`
+      );
+    }
+  }
+  const required = allRequiredActions();
+  const granted = [];
+  const missing = [];
+  for (const action of required) {
+    if (grantedPatterns.some((pattern) => actionMatches(pattern, action))) {
+      granted.push(action);
+    } else {
+      missing.push(action);
+    }
+  }
+  return { required, granted, missing, warnings };
+}
+function hasMidStringWildcard(pattern) {
+  if (pattern === "*") return false;
+  if (pattern.endsWith(":*")) return false;
+  if (pattern.endsWith("*") && !pattern.slice(0, -1).includes("*")) return false;
+  return pattern.includes("*") || pattern.includes("?");
+}
+function actionMatches(pattern, action) {
+  if (pattern === "*") return true;
+  if (pattern === action) return true;
+  if (pattern.endsWith(":*")) {
+    const service = pattern.slice(0, -2);
+    return action.startsWith(`${service}:`);
+  }
+  if (pattern.endsWith("*")) {
+    return action.startsWith(pattern.slice(0, -1));
+  }
+  return false;
+}
+export {
+  allRequiredActions,
+  buildPolicyDocument,
+  buildRoleTrustPolicy,
+  runPolicies,
+  validatePolicy
+};

package/vendor/hyperframes/dist/preflight-SMNV6RW2.js

@@ -0,0 +1,45 @@
+import { createRequire as __hf_createRequire } from "node:module";
+import { fileURLToPath as __hf_fileURLToPath } from "node:url";
+import { dirname as __hf_dirname } from "node:path";
+var require = __hf_createRequire(import.meta.url);
+var __filename = __hf_fileURLToPath(import.meta.url);
+var __dirname = __hf_dirname(__filename);
+import {
+  checkDisk,
+  extractMajorVersion,
+  parseToolVersion,
+  resolveRenderBrowser,
+  runEnvironmentChecks
+} from "./chunk-FCSIGXXP.js";
+import "./chunk-TVCRUG2S.js";
+import "./chunk-IUZFXWSV.js";
+import "./chunk-AMKC3AXA.js";
+import "./chunk-K2FTXJYH.js";
+import "./chunk-2YN64IN5.js";
+import "./chunk-AVUUN2XD.js";
+import "./chunk-DPVXBVLL.js";
+import "./chunk-Z6B37SNM.js";
+import "./chunk-HWKCIWQT.js";
+import "./chunk-VC76R6W2.js";
+import "./chunk-OFQWTKPW.js";
+import "./chunk-4PFZPP2N.js";
+import "./chunk-LCSMOLGX.js";
+import "./chunk-TWWSYAKJ.js";
+import "./chunk-ZJUKFZ2P.js";
+import "./chunk-HBBJFK6I.js";
+import "./chunk-PJ3HDUCY.js";
+import "./chunk-TQFG7HTI.js";
+import "./chunk-GK4AIFIH.js";
+import "./chunk-2PSPARWP.js";
+import "./chunk-KNU5COPB.js";
+import "./chunk-3GXQPCJC.js";
+import "./chunk-RQVDTPGD.js";
+import "./chunk-PMRBLBUP.js";
+import "./chunk-M2WBOQ2Q.js";
+export {
+  checkDisk,
+  extractMajorVersion,
+  parseToolVersion,
+  resolveRenderBrowser,
+  runEnvironmentChecks
+};

package/vendor/hyperframes/dist/present-WQVHV5CR.js

@@ -0,0 +1,350 @@
+import { createRequire as __hf_createRequire } from "node:module";
+import { fileURLToPath as __hf_fileURLToPath } from "node:url";
+import { dirname as __hf_dirname } from "node:path";
+var require = __hf_createRequire(import.meta.url);
+var __filename = __hf_fileURLToPath(import.meta.url);
+var __dirname = __hf_dirname(__filename);
+import {
+  assetContentType,
+  listenOnFreePort,
+  resolvePlayerPath,
+  resolveSlideshowPath
+} from "./chunk-UEZXMWG3.js";
+import {
+  requestSubPath
+} from "./chunk-S7NPLFWV.js";
+import "./chunk-RMHUQGRK.js";
+import "./chunk-EOVYQ3IG.js";
+import "./chunk-QC4FJVLM.js";
+import "./chunk-TCLGPL65.js";
+import {
+  openBrowser,
+  parseRemoteDebuggingPort,
+  validateRemoteDebuggingPortDeps
+} from "./chunk-LFGJWOVA.js";
+import {
+  resolveProject
+} from "./chunk-S3D6GE5W.js";
+import "./chunk-IHFUKJOR.js";
+import {
+  R,
+  ft,
+  ge
+} from "./chunk-WMQNIQDJ.js";
+import "./chunk-4NWOGZZS.js";
+import "./chunk-JTHMTOMQ.js";
+import "./chunk-EISRN4E6.js";
+import "./chunk-VWG7OQKU.js";
+import {
+  c
+} from "./chunk-ZTZA4UWZ.js";
+import "./chunk-IUZFXWSV.js";
+import "./chunk-AMKC3AXA.js";
+import {
+  defineCommand
+} from "./chunk-S3S4TGEH.js";
+import "./chunk-54HJ63Q2.js";
+import {
+  setCommandExitCode
+} from "./chunk-PBN6GBJE.js";
+import "./chunk-KC5XXX3X.js";
+import "./chunk-TJSTGSAW.js";
+import "./chunk-K2FTXJYH.js";
+import "./chunk-2YN64IN5.js";
+import "./chunk-AVUUN2XD.js";
+import "./chunk-DPVXBVLL.js";
+import "./chunk-Z6B37SNM.js";
+import "./chunk-HWKCIWQT.js";
+import "./chunk-VC76R6W2.js";
+import "./chunk-OFQWTKPW.js";
+import "./chunk-TWWSYAKJ.js";
+import "./chunk-ZJUKFZ2P.js";
+import "./chunk-HBBJFK6I.js";
+import "./chunk-PJ3HDUCY.js";
+import "./chunk-TQFG7HTI.js";
+import "./chunk-GK4AIFIH.js";
+import "./chunk-2PSPARWP.js";
+import "./chunk-K4WIOZFP.js";
+import "./chunk-XUXGIA7H.js";
+import "./chunk-WERLJGIC.js";
+import "./chunk-ISN5GRYI.js";
+import "./chunk-FLWXXDNS.js";
+import "./chunk-KNU5COPB.js";
+import "./chunk-3GXQPCJC.js";
+import "./chunk-RQVDTPGD.js";
+import "./chunk-PMRBLBUP.js";
+import "./chunk-M2WBOQ2Q.js";
+
+// src/commands/present.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var examples = [
+  ["Present the current deck", "hyperframes present"],
+  ["Present a specific project directory", "hyperframes present ./my-deck"],
+  ["Use a custom port", "hyperframes present --port 8080"],
+  ["Start without opening the browser", "hyperframes present --no-open"],
+  ["Open with a specific browser", "hyperframes present --browser-path /usr/bin/chromium"]
+];
+var present_default = defineCommand({
+  meta: {
+    name: "present",
+    description: "Serve a slideshow deck and open it in presenter mode (with audience sync)"
+  },
+  args: {
+    dir: { type: "positional", description: "Project directory", required: false },
+    port: { type: "string", description: "Port to run the present server on", default: "3004" },
+    open: { type: "boolean", default: true, description: "Open browser automatically" },
+    "browser-path": { type: "string", description: "Path to the browser executable to open" },
+    "user-data-dir": {
+      type: "string",
+      description: "Chromium-compatible user data directory (requires --browser-path)"
+    },
+    "remote-debugging-port": {
+      type: "string",
+      description: "Chromium remote debugging port (requires --browser-path and --user-data-dir)"
+    }
+  },
+  async run({ args }) {
+    const project = resolveProject(args.dir);
+    const startPort = parseInt(args.port ?? "3004", 10);
+    if (args["user-data-dir"] && !args["browser-path"]) {
+      R.error("--user-data-dir requires --browser-path");
+      setCommandExitCode(1);
+      return;
+    }
+    const depsError = validateRemoteDebuggingPortDeps({
+      browserPath: args["browser-path"],
+      userDataDir: args["user-data-dir"],
+      remoteDebuggingPort: args["remote-debugging-port"]
+    });
+    if (depsError) {
+      R.error(depsError);
+      setCommandExitCode(1);
+      return;
+    }
+    let remoteDebuggingPort;
+    try {
+      remoteDebuggingPort = parseRemoteDebuggingPort(
+        args["remote-debugging-port"]
+      );
+    } catch (err) {
+      R.error(err.message);
+      setCommandExitCode(1);
+      return;
+    }
+    const playerPath = resolvePlayerPath();
+    const slideshowPath = resolveSlideshowPath();
+    if (!playerPath || !slideshowPath) {
+      R.error(
+        "@hyperframes/player not found. Run `bun run --cwd packages/player build` first."
+      );
+      setCommandExitCode(1);
+      return;
+    }
+    const indexHtml = readFileSync(project.indexPath, "utf-8");
+    const { slideshowIslandRegex } = await import("./slideshow-EJ4IMY6P.js");
+    const islandMatch = slideshowIslandRegex("i").exec(indexHtml);
+    if (!islandMatch?.[1]) {
+      R.error(
+        `No slideshow island found in ${project.indexPath}. Add a <script type="application/hyperframes-slideshow+json"> block \u2014 see /hyperframes (slideshow).`
+      );
+      setCommandExitCode(1);
+      return;
+    }
+    const islandJson = islandMatch[1].trim();
+    try {
+      JSON.parse(islandJson);
+    } catch (err) {
+      R.error(
+        `Slideshow island in ${project.indexPath} is not valid JSON: ${err.message}`
+      );
+      setCommandExitCode(1);
+      return;
+    }
+    const { Hono } = await import("hono");
+    const { createAdaptorServer } = await import("@hono/node-server");
+    const app = new Hono();
+    app.get(
+      "/player.js",
+      (ctx) => ctx.body(readFileSync(playerPath, "utf-8"), 200, {
+        "Content-Type": "application/javascript",
+        "Cache-Control": "no-cache"
+      })
+    );
+    app.get(
+      "/slideshow.js",
+      (ctx) => ctx.body(readFileSync(slideshowPath, "utf-8"), 200, {
+        "Content-Type": "application/javascript",
+        "Cache-Control": "no-cache"
+      })
+    );
+    await registerPresentCompositionRoute(app, project);
+    app.get("/", (ctx) => ctx.html(buildPresentPage(project.name, islandJson)));
+    ge(c.bold("hyperframes present"));
+    const s = ft();
+    s.start("Starting presenter server...");
+    const server = createAdaptorServer({ fetch: app.fetch });
+    const actualPort = await listenOnFreePort(server, startPort);
+    const url = `http://localhost:${actualPort}`;
+    s.stop(c.success("Presenter server running"));
+    console.log();
+    if (actualPort !== startPort) {
+      console.log(`  ${c.warn(`Port ${startPort} is in use, using ${actualPort} instead`)}`);
+    }
+    console.log(`  ${c.dim("Deck")}      ${c.accent(project.name)}`);
+    console.log(`  ${c.dim("Present")}   ${c.accent(url)}`);
+    console.log();
+    console.log(
+      `  ${c.dim("Click the Present control (or press P) to open the audience display.")}`
+    );
+    console.log(
+      `  ${c.dim('Google Meet: share the AUDIENCE tab ("Share screen \u2192 A tab"), not a window or your whole screen.')}`
+    );
+    console.log(
+      `  ${c.dim("Zoom desktop: drag the audience tab into its own window and share that window (keep it at least partly visible).")}`
+    );
+    console.log(`  ${c.dim("Press Ctrl+C to stop")}`);
+    console.log();
+    if (args.open) {
+      void openBrowser(url, {
+        browserPath: args["browser-path"],
+        userDataDir: args["user-data-dir"],
+        remoteDebuggingPort
+      });
+    }
+    return new Promise(() => {
+    });
+  }
+});
+function buildPresentPage(projectName, islandJson) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${escHtml(projectName)} \u2014 Presenter</title>
+    <script>
+      // Retitle the audience tab so the two tabs are distinguishable in the
+      // browser tab strip and in Meet's "Share a tab" picker.
+      if (new URLSearchParams(location.search).get("mode") === "audience") {
+        document.title = ${JSON.stringify(projectName).replace(/</g, "\\u003c")} + " \u2014 Audience";
+      }
+    </script>
+    <style>
+      * { margin: 0; padding: 0; box-sizing: border-box; }
+      html, body { height: 100%; background: #0a0a0a; overflow: hidden; }
+      hyperframes-slideshow { display: block; position: relative; width: 100vw; height: 100vh; }
+      hyperframes-player { position: absolute; inset: 0; }
+    </style>
+    <script src="/player.js"></script>
+    <script src="/slideshow.js"></script>
+  </head>
+  <body>
+    <hyperframes-slideshow tabindex="0" sound>
+      <hyperframes-player interactive src="/composition/index.html"></hyperframes-player>
+      <script type="application/hyperframes-slideshow+json">
+${islandJson}
+      </script>
+    </hyperframes-slideshow>
+    <!-- Present CTA lives in the component's nav cluster (data-hf-present, plus
+         the P key) \u2014 no page-level button, or we'd render two Present CTAs. -->
+    <script>
+      // Sound effects play HERE, in the parent document. The composition runs in the
+      // player's iframe, which is autoplay-blocked without its own user gesture; the
+      // slideshow posts { type: "hf-sfx", name } to the parent on nav, and we play the
+      // matching clip from the deck's sfx/ folder (served under /composition/sfx/).
+      // Runs in both presenter and audience windows. Missing clips fail silently.
+      (function () {
+        var clips = {
+          advance: new Audio("/composition/sfx/advance.mp3"),
+          fragment: new Audio("/composition/sfx/fragment.mp3"),
+          "branch-enter": new Audio("/composition/sfx/branch-enter.mp3"),
+          back: new Audio("/composition/sfx/back.mp3"),
+        };
+        clips.advance.volume = 0.45;
+        clips.fragment.volume = 0.4;
+        clips["branch-enter"].volume = 0.4;
+        clips.back.volume = 0.4;
+        for (var k in clips) clips[k].preload = "auto";
+
+        // Mute state is owned by <hyperframes-slideshow sound>; mirror it.
+        var muted = false;
+        function setClipsMuted(nextMuted) {
+          Object.keys(clips).forEach(function (name) {
+            clips[name].muted = nextMuted;
+          });
+        }
+        var ss = document.querySelector("hyperframes-slideshow");
+        if (ss) {
+          ss.addEventListener("hf-sound", function (e) {
+            muted = e.detail && e.detail.muted === true;
+            setClipsMuted(muted);
+          });
+        }
+
+        // Autoplay needs a user gesture \u2014 prime each clip (play muted, reset) on the
+        // first interaction so later plays are instant and allowed.
+        var unlocked = false;
+        function unlock() {
+          if (unlocked) return;
+          unlocked = true;
+          Object.keys(clips).forEach(function (name) {
+            var el = clips[name];
+            var v = el.volume;
+            el.volume = 0;
+            el.play()
+              .then(function () {
+                el.pause();
+                el.currentTime = 0;
+                el.volume = v;
+              })
+              .catch(function () {
+                el.volume = v;
+              });
+          });
+        }
+        window.addEventListener("keydown", unlock, true);
+        window.addEventListener("pointerdown", unlock, true);
+        window.addEventListener("click", unlock, true);
+
+        window.addEventListener("message", function (e) {
+          // Only accept cues from this origin (the composition iframe is same-origin).
+          if (e.origin !== location.origin) return;
+          var d = e.data;
+          if (!d || d.type !== "hf-sfx" || muted) return;
+          // Own-property guard: a malicious name like "__proto__" must not resolve to
+          // a prototype object (which would be truthy and then get mutated below).
+          if (!Object.prototype.hasOwnProperty.call(clips, d.name)) return;
+          var el = clips[d.name];
+          if (!el || !unlocked) return;
+          try {
+            el.currentTime = 0;
+            el.play().catch(function () {});
+          } catch (err) {
+            /* ignore */
+          }
+        });
+      })();
+    </script>
+  </body>
+</html>`;
+}
+function escHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function registerPresentCompositionRoute(app, project) {
+  const { isSafePath } = await import("./studio-api-PNQZRPX5.js");
+  app.get("/composition/*", (ctx) => {
+    const reqPath = requestSubPath(ctx.req.url, "composition");
+    const filePath = resolve(project.dir, reqPath);
+    if (!isSafePath(project.dir, filePath)) return ctx.text("Forbidden", 403);
+    if (!existsSync(filePath)) return ctx.text("Not found", 404);
+    if (filePath.endsWith(".html")) return ctx.html(readFileSync(filePath, "utf-8"));
+    return ctx.body(readFileSync(filePath), 200, { "Content-Type": assetContentType(filePath) });
+  });
+}
+export {
+  present_default as default,
+  examples,
+  registerPresentCompositionRoute
+};