@ignix-social/editor 0.1.0

package/vendor/hyperframes/dist/chunk-I465DBM6.js

@@ -0,0 +1,1214 @@
+import { createRequire as __hf_createRequire } from "node:module";
+import { fileURLToPath as __hf_fileURLToPath } from "node:url";
+import { dirname as __hf_dirname } from "node:path";
+var require = __hf_createRequire(import.meta.url);
+var __filename = __hf_fileURLToPath(import.meta.url);
+var __dirname = __hf_dirname(__filename);
+import {
+  c
+} from "./chunk-ZTZA4UWZ.js";
+import {
+  failCommand
+} from "./chunk-PBN6GBJE.js";
+import {
+  normalizeErrorMessage
+} from "./chunk-KNU5COPB.js";
+
+// src/auth/errors.ts
+var AuthError = class extends Error {
+  code;
+  hint;
+  constructor(code, message, hint) {
+    super(message);
+    this.name = "AuthError";
+    this.code = code;
+    this.hint = hint;
+  }
+};
+var ErrNotConfigured = () => new AuthError(
+  "NOT_CONFIGURED",
+  "No HeyGen credentials found",
+  "Run `hyperframes auth login` to sign in."
+);
+var ErrInvalidStore = (detail) => new AuthError(
+  "INVALID_STORE",
+  `Credential file is unreadable: ${detail}`,
+  "Delete ~/.heygen/credentials and run `hyperframes auth login` to re-create it."
+);
+var ErrUnauthenticated = (detail) => new AuthError(
+  "UNAUTHENTICATED",
+  detail ? `HeyGen rejected the credential: ${detail}` : "HeyGen rejected the credential",
+  "Run `hyperframes auth login` to re-authenticate."
+);
+var ErrApi = (status, detail) => new AuthError("API_ERROR", `HeyGen API error (${status}): ${detail}`);
+var ErrOAuthNotConfigured = () => new AuthError(
+  "OAUTH_NOT_CONFIGURED",
+  "OAuth client is not configured",
+  "Set HYPERFRAMES_OAUTH_CLIENT_ID, or run `hyperframes auth login --api-key`."
+);
+var ErrRefreshFailed = (detail) => new AuthError(
+  "REFRESH_FAILED",
+  detail ? `Failed to refresh OAuth tokens: ${detail}` : "Failed to refresh OAuth tokens",
+  "Run `hyperframes auth login` to re-authenticate."
+);
+var ErrLoginExpired = () => new AuthError(
+  "LOGIN_EXPIRED",
+  "Your HeyGen login expired",
+  "Run `hyperframes auth login` to sign in again."
+);
+var ErrLoginChanged = () => new AuthError(
+  "LOGIN_CHANGED",
+  "Your HeyGen login changed while this command ran",
+  "Run the command again."
+);
+var ErrDeviceAuthFailed = (detail) => new AuthError(
+  "DEVICE_AUTH_FAILED",
+  `Device authorization failed: ${detail}`,
+  "Run `hyperframes auth login --device` to start a new code."
+);
+function isAuthError(err) {
+  return err instanceof AuthError;
+}
+
+// src/auth/scrub.ts
+var HEYGEN_KEY = /\b(hg|sk)_[A-Za-z0-9_-]{4,}/g;
+var HEADER_LINE = /(authorization|x-api-key)[ \t]*[:=][ \t]*[^\r\n]+/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+var SECRET_FIELDS = [
+  "access_token",
+  "refresh_token",
+  "code_verifier",
+  "client_secret",
+  "id_token",
+  "token",
+  "code"
+];
+var FORM_FIELD = new RegExp(`\\b(${SECRET_FIELDS.join("|")})=[^&\\s"']+`, "gi");
+var JSON_FIELD = new RegExp(`("(?:${SECRET_FIELDS.join("|")})"\\s*:\\s*)"[^"]*"`, "gi");
+function scrubCredentials(s) {
+  return s.replace(HEYGEN_KEY, "$1_<redacted>").replace(HEADER_LINE, "$1: <redacted>").replace(JWT, "<jwt-redacted>").replace(FORM_FIELD, "$1=<redacted>").replace(JSON_FIELD, '$1"<redacted>"');
+}
+
+// src/auth/client.ts
+var DEFAULT_BASE_URL = "https://api.heygen.com";
+var HEYGEN_CLI_SOURCE_HEADER = "X-HeyGen-Source";
+var HEYGEN_CLI_SOURCE = "cli";
+var HEYGEN_CLIENT_SOURCE_HEADER = "X-HeyGen-Client-Source";
+var HEYGEN_CLIENT_SOURCE = "hyperframes";
+function apiBaseUrl() {
+  const override = process.env["HEYGEN_API_URL"];
+  return override && override.length > 0 ? override.replace(/\/+$/, "") : DEFAULT_BASE_URL;
+}
+var AuthClient = class {
+  base;
+  fetchImpl;
+  onRefresh;
+  constructor(opts = {}) {
+    this.base = (opts.baseUrl ?? apiBaseUrl()).replace(/\/+$/, "");
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.onRefresh = opts.onUnauthenticatedRefresh;
+  }
+  /**
+   * `GET /v3/users/me`. Throws `ErrUnauthenticated` on 401, `ErrApi`
+   * on any other non-2xx or non-JSON body.
+   *
+   * On OAuth 401 with a refresh hook configured, the request is
+   * retried once after refreshing the access token. The retry's
+   * outcome is what the caller sees — if the refresh itself fails
+   * (REFRESH_FAILED) or the retry still 401s, the user lands on a
+   * "please log in again" path upstream.
+   */
+  async getCurrentUser(credential) {
+    const url = `${this.base}/v3/users/me`;
+    return await this.fetchUser(url, credential, true);
+  }
+  // fallow-ignore-next-line complexity
+  async fetchUser(url, credential, allowRefresh) {
+    const headers = buildAuthHeaders(credential);
+    const res = await this.fetchImpl(url, { method: "GET", headers });
+    if (res.status === 401) {
+      if (allowRefresh && credential.type === "oauth" && credential.refresh_token && this.onRefresh) {
+        const refreshed = await this.tryRefresh(credential.refresh_token);
+        if (refreshed) {
+          const next = {
+            ...credential,
+            access_token: refreshed.access_token,
+            ...refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}
+          };
+          return await this.fetchUser(url, next, false);
+        }
+      }
+      const detail = await safeText(res);
+      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
+    }
+    if (!res.ok) {
+      throw ErrApi(res.status, await safeText(res) || res.statusText);
+    }
+    let payload;
+    try {
+      payload = await res.json();
+    } catch (err) {
+      throw ErrApi(res.status, `non-JSON body: ${err.message}`);
+    }
+    return extractUserInfo(payload);
+  }
+  async tryRefresh(refresh_token) {
+    if (!this.onRefresh) return null;
+    try {
+      return await this.onRefresh(refresh_token);
+    } catch (err) {
+      if (isAuthError(err) && err.code === "REFRESH_FAILED") return null;
+      throw err;
+    }
+  }
+};
+function buildAuthHeaders(credential) {
+  if (credential.type === "oauth") {
+    return {
+      authorization: `Bearer ${credential.access_token}`,
+      [HEYGEN_CLI_SOURCE_HEADER]: HEYGEN_CLI_SOURCE,
+      [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE
+    };
+  }
+  return { "x-api-key": credential.key, [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE };
+}
+async function safeText(res) {
+  try {
+    const body = (await res.text()).slice(0, 500);
+    return scrubCredentials(body);
+  } catch {
+    return "";
+  }
+}
+function extractUserInfo(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
+  const obj = payload;
+  const wrapped = obj["data"];
+  const data = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : obj;
+  return {
+    username: pickString(data, "username"),
+    email: pickString(data, "email"),
+    first_name: pickString(data, "first_name"),
+    last_name: pickString(data, "last_name"),
+    billing_type: pickString(data, "billing_type"),
+    wallet: pickObject(data, "wallet"),
+    subscription: pickObject(data, "subscription"),
+    usage_based: pickObject(data, "usage_based")
+  };
+}
+function pickString(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" ? v : void 0;
+}
+function pickObject(obj, key) {
+  const v = obj[key];
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+
+// src/auth/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+var CREDENTIAL_FILENAME = "credentials";
+function configDir() {
+  const override = process.env["HEYGEN_CONFIG_DIR"];
+  if (override && override.length > 0) return override;
+  return join(homedir(), ".heygen");
+}
+function credentialPath() {
+  return join(configDir(), CREDENTIAL_FILENAME);
+}
+
+// src/auth/store.ts
+import { promises as fs } from "fs";
+import { dirname } from "path";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var UNKNOWN = /* @__PURE__ */ Symbol("hf.credentials.unknownFields");
+var KNOWN_ROOT_KEYS = /* @__PURE__ */ new Set(["api_key", "oauth", "user"]);
+var KNOWN_OAUTH_KEYS = /* @__PURE__ */ new Set([
+  "access_token",
+  "refresh_token",
+  "expires_at",
+  "scope",
+  "token_type"
+]);
+var KNOWN_USER_KEYS = /* @__PURE__ */ new Set(["email", "first_name", "last_name", "username"]);
+async function readStore(path = credentialPath()) {
+  let raw;
+  try {
+    raw = await fs.readFile(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { credentials: {}, source: "absent" };
+    }
+    throw ErrInvalidStore(`unable to read ${path}: ${err.message}`);
+  }
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return { credentials: {}, source: "absent" };
+  if (trimmed.startsWith("{")) {
+    return { credentials: parseJsonStore(trimmed), source: "file_json" };
+  }
+  if (looksLikeApiKey(trimmed)) {
+    return { credentials: { api_key: trimmed }, source: "file_legacy" };
+  }
+  throw ErrInvalidStore("file is not JSON and does not look like a plain API key");
+}
+async function writeStore(credentials, path = credentialPath()) {
+  await ensureDir(dirname(path));
+  const body = JSON.stringify(serializeCredentials(credentials), null, 2);
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await fs.writeFile(tmp, `${body}
+`, { mode: FILE_MODE, encoding: "utf8" });
+  await fs.chmod(tmp, FILE_MODE);
+  await fs.rename(tmp, path);
+}
+async function deleteStore(path = credentialPath()) {
+  try {
+    await fs.unlink(path);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+}
+function hasPreservedUnknownData(credentials) {
+  if (hasUnknownBag(credentials[UNKNOWN])) return true;
+  if (hasUnknownBag(credentials.oauth?.[UNKNOWN])) return true;
+  if (hasUnknownBag(credentials.user?.[UNKNOWN])) return true;
+  return false;
+}
+function hasUnknownBag(bag) {
+  return bag !== void 0 && Object.keys(bag).length > 0;
+}
+async function clearOAuth(path = credentialPath()) {
+  const { credentials, source } = await readStore(path);
+  if (source === "absent" || !credentials.oauth) return;
+  const next = { ...credentials };
+  delete next.oauth;
+  if (!next.api_key && !hasPreservedUnknownData(next)) {
+    await deleteStore(path);
+    return;
+  }
+  await writeStore(next, path);
+}
+async function ensureDir(dir) {
+  try {
+    const stat = await fs.stat(dir);
+    if (!stat.isDirectory()) {
+      throw ErrInvalidStore(`${dir} exists and is not a directory`);
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    await fs.mkdir(dir, { recursive: true, mode: DIR_MODE });
+  }
+  try {
+    await fs.chmod(dir, DIR_MODE);
+  } catch {
+  }
+}
+function parseJsonStore(text) {
+  const obj = parseJsonObject(text, "credential file root");
+  const out = {};
+  const apiKey = pickRequiredStringOrAbsent(obj, "api_key", "api_key");
+  if (apiKey !== void 0) {
+    if (!isHeaderSafe(apiKey)) {
+      throw ErrInvalidStore("api_key must not contain control characters");
+    }
+    out.api_key = apiKey;
+  }
+  if (obj["oauth"] !== void 0 && obj["oauth"] !== null) {
+    out.oauth = parseOAuth(obj["oauth"]);
+  }
+  if (obj["user"] !== void 0 && obj["user"] !== null) {
+    out.user = parseUser(obj["user"]);
+  }
+  const unknownRoot = collectUnknown(obj, KNOWN_ROOT_KEYS);
+  if (unknownRoot) out[UNKNOWN] = unknownRoot;
+  return out;
+}
+var PICKERS = {
+  header_safe: pickHeaderSafeString,
+  non_empty: pickNonEmptyString
+};
+function assignOptionalStrings(out, obj, spec) {
+  const target = out;
+  for (const [field, picker] of spec) {
+    const v = PICKERS[picker](obj, field);
+    if (v) target[field] = v;
+  }
+}
+var OAUTH_OPTIONAL = [
+  ["refresh_token", "header_safe"],
+  ["expires_at", "non_empty"],
+  ["scope", "non_empty"],
+  ["token_type", "non_empty"]
+];
+function parseOAuth(raw) {
+  const obj = asJsonObject(raw, "oauth");
+  const accessToken = pickHeaderSafeString(obj, "access_token");
+  if (!accessToken) {
+    throw ErrInvalidStore("oauth.access_token must be a non-empty string with no control chars");
+  }
+  const out = { access_token: accessToken };
+  assignOptionalStrings(out, obj, OAUTH_OPTIONAL);
+  const unknownOAuth = collectUnknown(obj, KNOWN_OAUTH_KEYS);
+  if (unknownOAuth) out[UNKNOWN] = unknownOAuth;
+  return out;
+}
+var USER_OPTIONAL = [
+  ["email", "non_empty"],
+  ["first_name", "non_empty"],
+  ["last_name", "non_empty"],
+  ["username", "non_empty"]
+];
+function parseUser(raw) {
+  const obj = asJsonObject(raw, "user");
+  const out = {};
+  assignOptionalStrings(out, obj, USER_OPTIONAL);
+  const unknownUser = collectUnknown(obj, KNOWN_USER_KEYS);
+  if (unknownUser) out[UNKNOWN] = unknownUser;
+  return out;
+}
+function asJsonObject(raw, label) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw ErrInvalidStore(`${label} must be a JSON object`);
+  }
+  return raw;
+}
+function collectUnknown(obj, known) {
+  let bag;
+  for (const key of Object.keys(obj)) {
+    if (known.has(key)) continue;
+    (bag ??= {})[key] = obj[key];
+  }
+  return bag;
+}
+function parseJsonObject(text, label) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw ErrInvalidStore(`invalid JSON: ${err.message}`);
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw ErrInvalidStore(`${label} must be a JSON object`);
+  }
+  return raw;
+}
+function pickNonEmptyString(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function pickHeaderSafeString(obj, key) {
+  const v = pickNonEmptyString(obj, key);
+  return v !== void 0 && isHeaderSafe(v) ? v : void 0;
+}
+function isHeaderSafe(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c2 = s.charCodeAt(i);
+    if (c2 < 32 || c2 === 127) return false;
+  }
+  return true;
+}
+function pickRequiredStringOrAbsent(obj, key, errorLabel) {
+  const v = obj[key];
+  if (v === void 0 || v === null) return void 0;
+  if (typeof v !== "string" || v.length === 0) {
+    throw ErrInvalidStore(`${errorLabel} must be a non-empty string`);
+  }
+  return v;
+}
+function serializeCredentials(c2) {
+  const out = { ...c2[UNKNOWN] ?? {} };
+  if (c2.api_key) out["api_key"] = c2.api_key;
+  if (c2.oauth) out["oauth"] = serializeOAuth(c2.oauth);
+  if (c2.user) {
+    const user = serializeUser(c2.user);
+    if (Object.keys(user).length > 0) out["user"] = user;
+  }
+  return out;
+}
+function serializeOAuth(o) {
+  const oauth = { ...o[UNKNOWN] ?? {} };
+  oauth["access_token"] = o.access_token;
+  if (o.refresh_token) oauth["refresh_token"] = o.refresh_token;
+  if (o.expires_at) oauth["expires_at"] = o.expires_at;
+  if (o.scope) oauth["scope"] = o.scope;
+  if (o.token_type) oauth["token_type"] = o.token_type;
+  return oauth;
+}
+function serializeUser(u) {
+  const user = { ...u[UNKNOWN] ?? {} };
+  if (u.email) user["email"] = u.email;
+  if (u.first_name) user["first_name"] = u.first_name;
+  if (u.last_name) user["last_name"] = u.last_name;
+  if (u.username) user["username"] = u.username;
+  return user;
+}
+function looksLikeApiKey(s) {
+  if (s.length < 8) return false;
+  if (!isHeaderSafe(s)) return false;
+  return /^[!-~]+$/.test(s);
+}
+
+// src/auth/resolver.ts
+var EXPIRY_SKEW_MS = 60 * 1e3;
+async function resolveCredential(opts = {}) {
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  const heygenEnv = process.env["HEYGEN_API_KEY"];
+  if (heygenEnv && heygenEnv.length > 0) {
+    if (!isHeaderSafe(heygenEnv)) {
+      throw ErrInvalidStore("HEYGEN_API_KEY contains control characters");
+    }
+    return { type: "api_key", key: heygenEnv, source: "env" };
+  }
+  const hfEnv = process.env["HYPERFRAMES_API_KEY"];
+  if (hfEnv && hfEnv.length > 0) {
+    if (!isHeaderSafe(hfEnv)) {
+      throw ErrInvalidStore("HYPERFRAMES_API_KEY contains control characters");
+    }
+    return { type: "api_key", key: hfEnv, source: "env_alias" };
+  }
+  const { credentials, source } = await readStore();
+  if (source === "absent") throw ErrNotConfigured();
+  const fileSource = source === "file_legacy" ? "file_legacy" : "file_json";
+  const oauth = credentials.oauth ? pickOAuth(credentials.oauth, now, fileSource) : null;
+  if (oauth) return oauth;
+  if (credentials.api_key) {
+    return { type: "api_key", key: credentials.api_key, source: fileSource };
+  }
+  throw credentials.oauth ? ErrLoginExpired() : ErrNotConfigured();
+}
+async function tryResolveCredential(opts = {}) {
+  try {
+    return await resolveCredential(opts);
+  } catch (err) {
+    if (isAuthError(err) && err.code === "NOT_CONFIGURED") {
+      return null;
+    }
+    throw err;
+  }
+}
+function pickOAuth(tokens, now, source) {
+  const expiresAt = parseDate(tokens.expires_at);
+  const expired = isTokenExpired(expiresAt, now);
+  if (expired && !tokens.refresh_token) return null;
+  const out = {
+    type: "oauth",
+    access_token: tokens.access_token,
+    source,
+    refreshable: expired && tokens.refresh_token !== void 0
+  };
+  if (tokens.refresh_token) out.refresh_token = tokens.refresh_token;
+  if (expiresAt) out.expires_at = expiresAt;
+  if (tokens.scope) out.scope = tokens.scope;
+  return out;
+}
+function isTokenExpired(expiresAt, now) {
+  return expiresAt !== void 0 && expiresAt.getTime() - EXPIRY_SKEW_MS < now.getTime();
+}
+function parseDate(s) {
+  if (!s) return void 0;
+  const d = new Date(s);
+  return Number.isNaN(d.getTime()) ? void 0 : d;
+}
+
+// src/auth/pkce.ts
+import { createHash, randomBytes } from "crypto";
+var VERIFIER_BYTES = 64;
+function generatePkcePair() {
+  const verifier = base64UrlEncode(randomBytes(VERIFIER_BYTES));
+  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge, method: "S256" };
+}
+function generateState() {
+  return base64UrlEncode(randomBytes(32));
+}
+function base64UrlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/auth/loopback.ts
+import { timingSafeEqual } from "crypto";
+import { createServer } from "http";
+var CALLBACK_PATH = "/oauth/callback";
+var DEFAULT_TIMEOUT_MS = 12e4;
+async function startLoopback(opts) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolve, reject) => {
+    resolveResult = resolve;
+    rejectResult = reject;
+  });
+  let redirectUri = "";
+  const server = createServer(
+    (req, res) => handleRequest(req, res, opts.state, redirectUri, resolveResult, rejectResult)
+  );
+  await listen(server, opts.port ?? 0);
+  const address = server.address();
+  redirectUri = `http://127.0.0.1:${address.port}${CALLBACK_PATH}`;
+  let closed = false;
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    clearTimeout(timer);
+    server.closeAllConnections?.();
+    await new Promise((resolve) => server.close(() => resolve()));
+  };
+  const timer = setTimeout(() => {
+    rejectResult(new Error(`OAuth callback timed out after ${timeoutMs}ms`));
+    void close();
+  }, timeoutMs);
+  result.finally(close).catch(() => {
+  });
+  return { result, redirectUri, close };
+}
+async function listen(server, port) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+function handleRequest(req, res, expectedState, redirectUri, resolveResult, rejectResult) {
+  if (req.method !== "GET") {
+    res.writeHead(405, { "content-type": "text/plain" }).end("Method Not Allowed");
+    return;
+  }
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname !== CALLBACK_PATH) {
+    res.writeHead(404, { "content-type": "text/plain" }).end("Not Found");
+    return;
+  }
+  const params = url.searchParams;
+  const error = params.get("error");
+  if (error) {
+    const desc = params.get("error_description") ?? "";
+    respond(res, 400, errorPage(error, desc));
+    rejectResult(new Error(`OAuth authorize returned error: ${error}${desc ? ` \u2014 ${desc}` : ""}`));
+    return;
+  }
+  const state = params.get("state");
+  if (!state || !stateMatches(state, expectedState)) {
+    respond(res, 400, errorPage("invalid_state", "State parameter did not match."));
+    rejectResult(new Error("OAuth state mismatch \u2014 possible CSRF, aborting."));
+    return;
+  }
+  const code = params.get("code");
+  if (!code) {
+    respond(
+      res,
+      400,
+      errorPage("missing_code", "Authorization code is missing from the redirect.")
+    );
+    rejectResult(new Error("OAuth redirect did not include `code`."));
+    return;
+  }
+  respond(res, 200, successPage());
+  resolveResult({ code, redirectUri });
+}
+function stateMatches(actual, expected) {
+  const a = Buffer.from(actual, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function respond(res, status, body) {
+  res.writeHead(status, {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    // Tell the browser not to keep the TCP socket alive — otherwise
+    // `server.close()` blocks on the idle keep-alive timeout
+    // (Chrome ~5min). Combined with `server.closeAllConnections()`
+    // in `close()` this guarantees the CLI exits promptly after the
+    // user sees the success page.
+    connection: "close"
+  }).end(body);
+}
+function successPage() {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Signed in to HeyGen</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#0b0f14;color:#e6e8eb}main{max-width:480px;text-align:center;padding:32px;border-radius:12px;background:#11161d;border:1px solid #1f2630}h1{font-weight:600;margin:0 0 8px;color:#3CE6AC}p{margin:0;color:#9aa3ad}</style>
+</head><body><main><h1>You're signed in.</h1><p>You can close this tab and return to your terminal.</p></main></body></html>`;
+}
+function errorPage(code, description) {
+  const safeCode = escapeHtml(code);
+  const safeDesc = escapeHtml(description);
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Sign-in failed</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#1a0b0b;color:#e6e8eb}main{max-width:480px;text-align:center;padding:32px;border-radius:12px;background:#1d1111;border:1px solid #301f1f}h1{font-weight:600;margin:0 0 8px;color:#ff7a7a}code{background:#2a1414;padding:2px 6px;border-radius:4px}p{margin:8px 0 0;color:#9aa3ad}</style>
+</head><body><main><h1>Sign-in failed</h1><p><code>${safeCode}</code></p><p>${safeDesc}</p></main></body></html>`;
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+// src/auth/browser.ts
+async function openBrowser(url) {
+  if (process.env["BROWSER"] === "none" || process.env["HF_NO_BROWSER"] === "1") {
+    printManualInstructions(url);
+    return { opened: false };
+  }
+  try {
+    const open = (await import("open")).default;
+    await open(url);
+    return { opened: true };
+  } catch (err) {
+    printManualInstructions(url, normalizeErrorMessage(err));
+    return { opened: false };
+  }
+}
+function printManualInstructions(url, detail) {
+  if (detail) {
+    console.error(c.warn(`Could not open browser automatically (${detail}).`));
+  } else {
+    console.error(c.warn("Browser auto-open is disabled."));
+  }
+  console.error(`Open this URL manually to continue:
+  ${c.accent(url)}`);
+}
+
+// src/auth/oauth.ts
+var REVOKE_TIMEOUT_MS = 5e3;
+var MIN_EXPIRES_IN_SECONDS = 30;
+var DEFAULT_CLIENT_ID = "q2A2QRSke2LrFTPJhoDbHtXh";
+var DEFAULT_SCOPES = "openid profile email";
+var DEFAULT_AUTHORIZE_URL = "https://app.heygen.com/oauth/authorize";
+var DEFAULT_TOKEN_URL = "https://api2.heygen.com/v1/oauth/token";
+var DEFAULT_REVOKE_URL = "https://api2.heygen.com/v1/oauth/revoke";
+var DEFAULT_DEVICE_AUTHORIZATION_URL = "https://api2.heygen.com/v1/oauth/device_authorization";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var MAX_DEVICE_FLOW_SECONDS = 30 * 60;
+var MIN_DEVICE_POLL_SECONDS = 5;
+var MAX_DEVICE_POLL_SECONDS = 60;
+var MAX_DEVICE_RESPONSE_BYTES = 64 * 1024;
+var DEVICE_REQUEST_TIMEOUT_MS = 15e3;
+function authorizeEndpoint() {
+  return process.env["HYPERFRAMES_OAUTH_AUTHORIZE_URL"] || DEFAULT_AUTHORIZE_URL;
+}
+function tokenEndpoint() {
+  return process.env["HYPERFRAMES_OAUTH_TOKEN_URL"] || DEFAULT_TOKEN_URL;
+}
+function revokeEndpoint() {
+  return process.env["HYPERFRAMES_OAUTH_REVOKE_URL"] || DEFAULT_REVOKE_URL;
+}
+function deviceAuthorizationEndpoint() {
+  return process.env["HYPERFRAMES_OAUTH_DEVICE_URL"] || DEFAULT_DEVICE_AUTHORIZATION_URL;
+}
+function resolveClientId() {
+  const override = process.env["HYPERFRAMES_OAUTH_CLIENT_ID"];
+  const id = override && override.length > 0 ? override : DEFAULT_CLIENT_ID;
+  if (!id || id.length === 0) throw ErrOAuthNotConfigured();
+  return id;
+}
+function assertOAuthConfiguredOrExit() {
+  try {
+    resolveClientId();
+  } catch (err) {
+    if (isAuthError(err) && err.code === "OAUTH_NOT_CONFIGURED") {
+      console.error(`Error: ${err.message}`);
+      if (err.hint) console.error(err.hint);
+      failCommand();
+    }
+    throw err;
+  }
+}
+async function startAuthorizationCodeFlow(opts = {}) {
+  const clientId = resolveClientId();
+  const scope = opts.scope ?? DEFAULT_SCOPES;
+  const pkce = generatePkcePair();
+  const state = generateState();
+  const loopback = await startLoopback({ state, timeoutMs: opts.timeoutMs });
+  const authorizeUrl = buildAuthorizeUrl({
+    clientId,
+    redirectUri: loopback.redirectUri,
+    scope,
+    state,
+    challenge: pkce.challenge
+  });
+  console.log(`Opening browser to ${c.dim(authorizeHost(authorizeUrl))} ...`);
+  const { opened } = await openBrowser(authorizeUrl);
+  if (!opened) {
+    console.log(c.dim("(open the URL above to continue)"));
+  }
+  console.log(`Waiting for callback on ${c.accent(loopback.redirectUri)} ...`);
+  let codeResult;
+  try {
+    codeResult = await loopback.result;
+  } catch (err) {
+    await loopback.close().catch(() => {
+    });
+    throw err;
+  }
+  const tokens = await exchangeCodeForTokens({
+    clientId,
+    code: codeResult.code,
+    redirectUri: codeResult.redirectUri,
+    verifier: pkce.verifier,
+    fetchImpl: opts.fetchImpl
+  });
+  await persistOAuth(tokens);
+  return { tokens };
+}
+async function startDeviceAuthorizationFlow(opts = {}) {
+  const runtime = {
+    clientId: resolveClientId(),
+    fetchImpl: opts.fetchImpl ?? fetch,
+    sleepImpl: opts.sleepImpl ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    now: opts.now ?? Date.now,
+    requestTimeoutMs: opts.requestTimeoutMs ?? DEVICE_REQUEST_TIMEOUT_MS
+  };
+  const issuance = await requestDeviceAuthorization(runtime, opts.scope ?? DEFAULT_SCOPES);
+  await opts.onChallenge?.({
+    userCode: issuance.userCode,
+    verificationUri: issuance.verificationUri,
+    ...issuance.verificationUriComplete ? { verificationUriComplete: issuance.verificationUriComplete } : {}
+  });
+  return await pollDeviceToken(runtime, issuance);
+}
+async function requestDeviceAuthorization(runtime, scope) {
+  return await withDeviceRequestTimeout(
+    runtime,
+    "could not reach the authorization server",
+    async (signal) => {
+      const response = await runtime.fetchImpl(deviceAuthorizationEndpoint(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({ client_id: runtime.clientId, scope }).toString(),
+        signal
+      });
+      if (!response.ok) {
+        throw ErrDeviceAuthFailed(`authorization server returned HTTP ${response.status}`);
+      }
+      return parseDeviceAuthorizationResponse(await readJsonOrDeviceError(response));
+    }
+  );
+}
+async function pollDeviceToken(runtime, issuance) {
+  const deadline = runtime.now() + Math.min(issuance.expiresIn, MAX_DEVICE_FLOW_SECONDS) * 1e3;
+  let intervalSeconds = issuance.interval;
+  while (runtime.now() < deadline) {
+    const remainingMs = deadline - runtime.now();
+    if (remainingMs <= 0) break;
+    await runtime.sleepImpl(Math.min(intervalSeconds * 1e3, remainingMs));
+    const result = await requestDeviceToken(runtime, issuance.deviceCode);
+    if (result.tokens) return result.tokens;
+    if (result.slowDown) {
+      intervalSeconds = Math.min(
+        Math.max(intervalSeconds + 5, result.retryAfterSeconds ?? 0),
+        MAX_DEVICE_POLL_SECONDS
+      );
+    }
+  }
+  throw ErrDeviceAuthFailed("the code expired");
+}
+async function requestDeviceToken(runtime, deviceCode) {
+  return await withDeviceRequestTimeout(
+    runtime,
+    "lost contact with the authorization server",
+    async (signal) => {
+      const response = await runtime.fetchImpl(tokenEndpoint(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: DEVICE_CODE_GRANT_TYPE,
+          device_code: deviceCode,
+          client_id: runtime.clientId
+        }).toString(),
+        signal
+      });
+      return await evaluateDevicePollResponse(response, runtime.now());
+    }
+  );
+}
+async function evaluateDevicePollResponse(response, nowMs) {
+  if (response.ok) {
+    return { tokens: parseTokenResponse(await readJsonOrDeviceError(response)) };
+  }
+  const error = await readDeviceOAuthError(response);
+  switch (error) {
+    case "authorization_pending":
+      return {};
+    case "slow_down":
+      return { slowDown: true, retryAfterSeconds: retryAfterSeconds(response, nowMs) };
+    case "access_denied":
+      throw ErrDeviceAuthFailed("access was denied");
+    case "expired_token":
+      throw ErrDeviceAuthFailed("the code expired");
+    default:
+      if (response.status === 429) {
+        return { slowDown: true, retryAfterSeconds: retryAfterSeconds(response, nowMs) };
+      }
+      throw ErrDeviceAuthFailed(`authorization server returned HTTP ${response.status}`);
+  }
+}
+async function withDeviceRequestTimeout(runtime, networkError, operation) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), runtime.requestTimeoutMs);
+  try {
+    return await operation(controller.signal);
+  } catch (err) {
+    if (controller.signal.aborted) {
+      throw ErrDeviceAuthFailed("authorization server request timed out");
+    }
+    if (isAuthError(err)) throw err;
+    throw ErrDeviceAuthFailed(networkError);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function retryAfterSeconds(response, nowMs) {
+  const value = response.headers.get("retry-after")?.trim();
+  if (!value) return void 0;
+  if (/^\d+$/.test(value)) return Math.min(Number(value), MAX_DEVICE_POLL_SECONDS);
+  const retryAt = Date.parse(value);
+  if (!Number.isFinite(retryAt)) return void 0;
+  return Math.min(Math.max(Math.ceil((retryAt - nowMs) / 1e3), 0), MAX_DEVICE_POLL_SECONDS);
+}
+async function refreshTokens(refresh_token, opts = {}) {
+  const clientId = resolveClientId();
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token,
+    client_id: clientId
+  });
+  const res = await fetchImpl(tokenEndpoint(), {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: body.toString()
+  });
+  if (res.status === 400 || res.status === 401) {
+    throw ErrRefreshFailed(await safeText2(res));
+  }
+  if (!res.ok) {
+    throw ErrApi(res.status, await safeText2(res) || res.statusText);
+  }
+  const payload = await readJsonOrThrow(res);
+  const tokens = parseTokenResponse(payload);
+  await persistOAuth(tokens, { refreshed: refresh_token });
+  return tokens;
+}
+async function revokeTokens(token, opts = {}) {
+  let clientId;
+  try {
+    clientId = resolveClientId();
+  } catch {
+    return;
+  }
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const params = { token, client_id: clientId };
+  if (opts.token_type_hint) params["token_type_hint"] = opts.token_type_hint;
+  const body = new URLSearchParams(params);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? REVOKE_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(revokeEndpoint(), {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+      signal: controller.signal
+    });
+    if (!res.ok) {
+      console.error(
+        c.dim(`Note: token revoke returned HTTP ${res.status}; local credentials cleared anyway.`)
+      );
+    }
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function authorizeHost(fullUrl) {
+  try {
+    const u = new URL(fullUrl);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return fullUrl.split("?")[0] ?? fullUrl;
+  }
+}
+function buildAuthorizeUrl(args) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: args.clientId,
+    redirect_uri: args.redirectUri,
+    scope: args.scope,
+    state: args.state,
+    code_challenge: args.challenge,
+    code_challenge_method: "S256"
+  });
+  return `${authorizeEndpoint()}?${params.toString()}`;
+}
+async function exchangeCodeForTokens(args) {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: args.code,
+    redirect_uri: args.redirectUri,
+    client_id: args.clientId,
+    code_verifier: args.verifier
+  });
+  const res = await fetchImpl(tokenEndpoint(), {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: body.toString()
+  });
+  if (res.status === 400 || res.status === 401) {
+    const detail = await safeText2(res) || res.statusText;
+    throw ErrRefreshFailed(
+      `authorization code rejected (${detail}); please run \`auth login\` again`
+    );
+  }
+  if (!res.ok) {
+    throw ErrApi(res.status, await safeText2(res) || res.statusText);
+  }
+  return parseTokenResponse(await readJsonOrThrow(res));
+}
+function parseTokenResponse(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw ErrRefreshFailed("token endpoint returned a non-object payload");
+  }
+  const obj = payload;
+  const accessToken = stringField(obj, "access_token");
+  if (!accessToken) {
+    throw ErrRefreshFailed("token endpoint did not return an access_token");
+  }
+  if (!isHeaderSafe(accessToken)) {
+    throw ErrRefreshFailed("access_token contains control characters");
+  }
+  const out = { access_token: accessToken };
+  const refreshToken = stringField(obj, "refresh_token");
+  if (refreshToken) {
+    if (!isHeaderSafe(refreshToken)) {
+      throw ErrRefreshFailed("refresh_token contains control characters");
+    }
+    out.refresh_token = refreshToken;
+  }
+  const tokenType = stringField(obj, "token_type");
+  if (tokenType) out.token_type = tokenType;
+  const scope = stringField(obj, "scope");
+  if (scope) out.scope = scope;
+  const expiresIn = numericField(obj, "expires_in");
+  if (expiresIn !== void 0) {
+    const clamped = Math.max(expiresIn, MIN_EXPIRES_IN_SECONDS);
+    out.expires_at = new Date(Date.now() + clamped * 1e3).toISOString();
+  }
+  return out;
+}
+function stringField(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function numericField(obj, key) {
+  const v = obj[key];
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string") {
+    const n = Number.parseFloat(v);
+    return Number.isFinite(n) ? n : void 0;
+  }
+  return void 0;
+}
+async function persistOAuth(tokens, opts = {}) {
+  let existing = {};
+  try {
+    const { credentials } = await readStore();
+    existing = credentials;
+  } catch (err) {
+    if (opts.refreshed !== void 0) throw err;
+  }
+  if (opts.refreshed !== void 0 && existing.oauth?.refresh_token !== opts.refreshed) {
+    throw ErrLoginChanged();
+  }
+  const oauth = opts.refreshed !== void 0 ? { ...existing.oauth, ...tokens } : { ...tokens };
+  await writeStore({ ...existing, oauth });
+}
+async function persistVerifiedOAuthSession(tokens, user) {
+  let credentials = {};
+  try {
+    ({ credentials } = await readStore());
+  } catch {
+    credentials = {};
+  }
+  const next = {
+    ...credentials,
+    oauth: { ...tokens }
+  };
+  if (user.email || user.first_name || user.last_name || user.username) {
+    next.user = {
+      ...credentials.user,
+      email: user.email,
+      first_name: user.first_name,
+      last_name: user.last_name,
+      username: user.username
+    };
+  } else {
+    delete next.user;
+  }
+  await writeStore(next);
+}
+function parseDeviceAuthorizationResponse(payload) {
+  const data = requireDeviceAuthorizationRecord(payload);
+  const deviceCode = stringField(data, "device_code");
+  const userCode = stringField(data, "user_code");
+  const verificationUri = requiredSafeVerificationUri(data, "verification_uri");
+  const verificationUriComplete = optionalSafeVerificationUri(data, "verification_uri_complete");
+  const expiresIn = strictNumericField(data, "expires_in");
+  const interval = strictNumericField(data, "interval");
+  requireSafeDeviceCode(deviceCode);
+  requireSafeDeviceCode(userCode);
+  const timing = normalizeDeviceAuthorizationTiming(data, expiresIn, interval);
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...verificationUriComplete ? { verificationUriComplete } : {},
+    ...timing
+  };
+}
+function requireSafeDeviceCode(value) {
+  if (!value || !isHeaderSafe(value)) {
+    throw ErrDeviceAuthFailed("authorization server returned an invalid response");
+  }
+}
+function normalizeDeviceAuthorizationTiming(data, expiresIn, interval) {
+  if (!isPositiveNumber(expiresIn) || data["interval"] !== void 0 && !isPositiveNumber(interval)) {
+    throw ErrDeviceAuthFailed("authorization server returned invalid timing values");
+  }
+  return {
+    expiresIn,
+    interval: Math.min(
+      Math.max(Math.ceil(interval ?? MIN_DEVICE_POLL_SECONDS), MIN_DEVICE_POLL_SECONDS),
+      MAX_DEVICE_POLL_SECONDS
+    )
+  };
+}
+function requiredSafeVerificationUri(data, key) {
+  const value = normalizeSafeVerificationUri(stringField(data, key));
+  if (!value) throw ErrDeviceAuthFailed("authorization server returned an unsafe verification URL");
+  return value;
+}
+function optionalSafeVerificationUri(data, key) {
+  if (data[key] === void 0) return void 0;
+  return requiredSafeVerificationUri(data, key);
+}
+function requireDeviceAuthorizationRecord(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw ErrDeviceAuthFailed("authorization server returned an invalid response");
+  }
+  return payload;
+}
+function isPositiveNumber(value) {
+  return value !== void 0 && value > 0;
+}
+function normalizeSafeVerificationUri(value) {
+  if (!value || !isHeaderSafe(value)) return void 0;
+  try {
+    const url = new URL(value);
+    if (url.username || url.password) return void 0;
+    const allowed = url.protocol === "https:" || url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname);
+    return allowed ? url.href : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readJsonOrDeviceError(res) {
+  return await readBoundedDeviceJson(res);
+}
+async function readDeviceOAuthError(res) {
+  try {
+    const payload = await readBoundedDeviceJson(res);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    const error = payload["error"];
+    return typeof error === "string" ? error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function strictNumericField(obj, key) {
+  const value = obj[key];
+  if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+  if (typeof value !== "string" || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+async function readBoundedDeviceJson(res) {
+  if (!res.body) throw ErrDeviceAuthFailed("authorization server returned no data");
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > MAX_DEVICE_RESPONSE_BYTES) {
+        await reader.cancel();
+        throw ErrDeviceAuthFailed("authorization server response was too large");
+      }
+      chunks.push(value);
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder().decode(body));
+  } catch (err) {
+    if (isAuthError(err)) throw err;
+    throw ErrDeviceAuthFailed("authorization server returned non-JSON data");
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function readJsonOrThrow(res) {
+  try {
+    return await res.json();
+  } catch (err) {
+    throw ErrApi(res.status, `non-JSON body: ${err.message}`);
+  }
+}
+async function safeText2(res) {
+  try {
+    return scrubCredentials((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+export {
+  isAuthError,
+  apiBaseUrl,
+  AuthClient,
+  buildAuthHeaders,
+  configDir,
+  credentialPath,
+  readStore,
+  writeStore,
+  deleteStore,
+  hasPreservedUnknownData,
+  clearOAuth,
+  isHeaderSafe,
+  resolveCredential,
+  tryResolveCredential,
+  isTokenExpired,
+  assertOAuthConfiguredOrExit,
+  startAuthorizationCodeFlow,
+  startDeviceAuthorizationFlow,
+  refreshTokens,
+  revokeTokens,
+  persistVerifiedOAuthSession
+};