hyperframes 0.7.93 → 0.7.96

package/dist/cli.js

@@ -50,7 +50,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = true ? "0.7.93" : "0.0.0-dev";
+    VERSION = true ? "0.7.96" : "0.0.0-dev";
   }
 });
 
@@ -479,6 +479,7 @@ var init_dist = __esm({
 });
 
 // src/telemetry/runId.ts
+import { randomUUID } from "crypto";
 function getRunId() {
   if (!resolved) {
     const value = process.env["HYPERFRAMES_RUN_ID"]?.trim().slice(0, 128);
@@ -487,7 +488,11 @@ function getRunId() {
   }
   return runId;
 }
-var resolved, runId;
+function getInvocationId() {
+  invocationId ??= randomUUID();
+  return invocationId;
+}
+var resolved, runId, invocationId;
 var init_runId = __esm({
   "src/telemetry/runId.ts"() {
     "use strict";
@@ -62374,10 +62379,15 @@ function parseCanaryOverride(raw) {
 function canaryFeatureKey(name) {
   return `${CANARY_FEATURE_PREFIX}${name}`;
 }
+function canaryReasonKey(name) {
+  return `canary_reason_${name.replace(/[^A-Za-z0-9]+/g, "_")}`;
+}
 function canaryFeatureProperties(entries2) {
   const props = {};
   for (const entry of entries2) {
     props[canaryFeatureKey(entry.name)] = entry.enabled ? "true" : "false";
+    if (entry.reason !== void 0)
+      props[canaryReasonKey(entry.name)] = entry.reason;
   }
   return props;
 }
@@ -62735,7 +62745,7 @@ var init_policy = __esm({
 import { existsSync as existsSync2, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import { join as join3 } from "path";
 import { homedir } from "os";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function salvageInstallState(parsed) {
   const markerAt = typeof parsed.markerAt === "string" ? parsed.markerAt : void 0;
   const bucketSeed = parseNonEmptyString(parsed.bucketSeed);
@@ -62765,9 +62775,10 @@ function warnSeedBackfillFailed(error) {
 }
 function backfillBucketSeed(config) {
   const recorded = readInstallState();
-  config.bucketSeed = (isInstallState(recorded) ? recorded.bucketSeed : void 0) ?? randomUUID();
+  config.bucketSeed = (isInstallState(recorded) ? recorded.bucketSeed : void 0) ?? randomUUID2();
   const write = writeConfigWithResult(config);
   if (!write.ok) warnSeedBackfillFailed(write.error);
+  return write;
 }
 function installStateLatchedFired() {
   if (latchedFiredSeen) return true;
@@ -62856,6 +62867,7 @@ function mintAndCacheConfig() {
   const config = mintConfig();
   const write = writeConfigWithResult(config);
   if (!write.ok) warnSeedBackfillFailed(write.error);
+  classifyIdentity(write.ok ? "unknown" : "process_only", writeOutcomeOf(write));
   cachedConfig = { ...config };
   return { ...config };
 }
@@ -62864,7 +62876,7 @@ function mintConfig() {
   const state = isInstallState(read) ? read : null;
   return {
     ...DEFAULT_CONFIG,
-    anonymousId: randomUUID(),
+    anonymousId: randomUUID2(),
     // A corrupt record still means this machine had an install — reporting it
     // as `false` would count a partial disk write as a brand-new machine and
     // understate recoverable churn, which is the one thing this field exists
@@ -62875,7 +62887,7 @@ function mintConfig() {
     // machine stays tripped for the new one, and the canary bucketing seed is
     // inherited so cohorts hold across a config.json re-mint.
     deParallelRouterTrialFired: state?.deParallelRouterTrialFired === true ? true : void 0,
-    bucketSeed: state?.bucketSeed ?? randomUUID()
+    bucketSeed: state?.bucketSeed ?? randomUUID2()
   };
 }
 function recordRecentRender(id, ok) {
@@ -62884,6 +62896,23 @@ function recordRecentRender(id, ok) {
   config.recentRenders = ring.slice(-MAX_RECENT_RENDERS);
   writeConfig(config);
 }
+function classifyIdentity(persistence, outcome) {
+  if (identityPersistence !== void 0) return;
+  identityPersistence = persistence;
+  identityWriteOutcome = outcome;
+}
+function writeOutcomeOf(write) {
+  if (!write.ok) return "failed";
+  return write.mirrored === false ? "ok_unmirrored" : "ok";
+}
+function getIdentityPersistence() {
+  readConfig();
+  return identityPersistence ?? "unknown";
+}
+function getIdentityWriteOutcome() {
+  readConfig();
+  return identityWriteOutcome;
+}
 function parseNonEmptyString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
@@ -62933,7 +62962,7 @@ function materializeConfig(parsed) {
   return {
     ...passthroughFields(parsed),
     telemetryEnabled: parsed.telemetryEnabled ?? DEFAULT_CONFIG.telemetryEnabled,
-    anonymousId: parsed.anonymousId || randomUUID(),
+    anonymousId: parsed.anonymousId || randomUUID2(),
     telemetryNoticeShown: parsed.telemetryNoticeShown ?? DEFAULT_CONFIG.telemetryNoticeShown,
     commandCount: parsed.commandCount ?? DEFAULT_CONFIG.commandCount,
     renderSuccessCount: parsed.renderSuccessCount ?? DEFAULT_CONFIG.renderSuccessCount,
@@ -62949,16 +62978,21 @@ function readConfig() {
     const raw = readFileSync(CONFIG_FILE, "utf-8");
     const parsed = JSON.parse(raw);
     const config = materializeConfig(parsed);
+    const idFromDisk = parseNonEmptyString(parsed.anonymousId) !== void 0;
     if (config.bucketSeed === void 0) {
-      backfillBucketSeed(config);
+      const write = backfillBucketSeed(config);
+      if (idFromDisk) classifyIdentity("durable");
+      else classifyIdentity(write.ok ? "unknown" : "process_only", writeOutcomeOf(write));
       cachedConfig = config;
       return { ...config };
     }
+    classifyIdentity(idFromDisk ? "durable" : "process_only");
     cachedConfig = config;
     return { ...config };
   } catch {
     const config = { ...mintConfig(), telemetryEnabled: false };
-    writeConfig(config);
+    const write = writeConfigWithResult(config);
+    classifyIdentity(write.ok ? "unknown" : "process_only", writeOutcomeOf(write));
     return config;
   }
 }
@@ -62988,7 +63022,7 @@ function incrementCommandCount() {
   writeConfig(config);
   return config.commandCount;
 }
-var CONFIG_DIR, CONFIG_FILE, STATE_FILE, LEGACY_STATE_FILE, seedBackfillWarned, latchedFiredSeen, stateMarkerSynced, stateFiredSynced, MAX_RECENT_RENDERS, DEFAULT_CONFIG, cachedConfig, CONFIG_PATH, STATE_PATH;
+var CONFIG_DIR, CONFIG_FILE, STATE_FILE, LEGACY_STATE_FILE, seedBackfillWarned, latchedFiredSeen, stateMarkerSynced, stateFiredSynced, MAX_RECENT_RENDERS, DEFAULT_CONFIG, cachedConfig, identityPersistence, identityWriteOutcome, CONFIG_PATH, STATE_PATH;
 var init_config = __esm({
   "src/telemetry/config.ts"() {
     "use strict";
@@ -70836,7 +70870,7 @@ import {
   statSync as statSync4,
   unlinkSync
 } from "fs";
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID as randomUUID3 } from "crypto";
 import { BlockList, isIP } from "net";
 import { dirname as dirname6, extname as extname2, join as join9 } from "path";
 import { Readable, Transform } from "stream";
@@ -71004,7 +71038,7 @@ async function acquireCachePathLock(localPath, timeoutMs, signal) {
       if (error.code !== "EEXIST") throw error;
     }
     if (createdLock) {
-      const owner = `${CACHE_LOCK_OWNER_PREFIX}${randomUUID2()}`;
+      const owner = `${CACHE_LOCK_OWNER_PREFIX}${randomUUID3()}`;
       try {
         mkdirSync5(join9(lockPath, owner));
         const entries2 = readdirSync3(lockPath);
@@ -84955,7 +84989,7 @@ var init_htmlTemplate = __esm({
 });
 
 // ../engine/src/services/extractionCache.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync2,
@@ -85003,7 +85037,7 @@ function lookupCacheEntry(rootDir, input2) {
   return { entry: { dir, keyHash }, hit: complete };
 }
 function partialCacheEntryDir(entry) {
-  return `${entry.dir}.partial-${process.pid}-${randomUUID3().slice(0, 8)}`;
+  return `${entry.dir}.partial-${process.pid}-${randomUUID4().slice(0, 8)}`;
 }
 function isTargetExistsRenameError(err) {
   const code = err.code;
@@ -90728,7 +90762,10 @@ function canaryDecisionsForStudio() {
 }
 function canaryEventProperties() {
   return canaryFeatureProperties(
-    CANARIES.map((c3) => ({ name: c3.name, enabled: resolveCanary(c3.name).enabled }))
+    CANARIES.map((c3) => {
+      const { enabled, reason } = resolveCanary(c3.name);
+      return { name: c3.name, enabled, reason };
+    })
   );
 }
 var decisions, decisionsTelemetryPosture;
@@ -90746,10 +90783,10 @@ var init_canary2 = __esm({
 
 // src/telemetry/transport.ts
 import { spawn as spawn5 } from "child_process";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 function enqueue(event, properties, distinctId) {
   eventQueue.push({
-    uuid: randomUUID4(),
+    uuid: randomUUID5(),
     event,
     distinctId,
     properties,
@@ -90867,6 +90904,19 @@ function trackEvent(event, properties = {}, distinctId) {
       // could not read. Without it a partial disk write is indistinguishable
       // from a genuinely fresh install. Absent in the normal case.
       install_state_file_corrupt: readConfig().stateFileCorrupt,
+      // Whether this process's anonymousId can be trusted to survive to the
+      // next run: `durable` (loaded from a preexisting config), `unknown`
+      // (minted+persisted this run — an ephemeral HOME is indistinguishable
+      // from a genuine first run), `process_only` (persist failed). Install-
+      // grain metrics should count only durable identities; the identity-
+      // churn workloads (fresh id per run) are never durable.
+      identity_persistence: getIdentityPersistence(),
+      // Outcome of the identity-establishing config write; absent when the
+      // identity came from disk and nothing needed writing.
+      config_write_outcome: getIdentityWriteOutcome(),
+      // Groups one invocation's events even when the install identity is
+      // untrustworthy. Always present, unlike the orchestrator-set run_id.
+      invocation_id: getInvocationId(),
       // Canary assignments as `$feature/canary-<name>` — PostHog's native flag
       // property shape, so breakdowns and experiment analysis work on a canary
       // with nothing configured server-side. On EVERY event, not just renders:
@@ -90901,6 +90951,7 @@ var init_client = __esm({
   "src/telemetry/client.ts"() {
     "use strict";
     init_config();
+    init_runId();
     init_version();
     init_colors();
     init_diagnostics2();
@@ -94501,7 +94552,7 @@ import { execFileSync as execFileSync5 } from "child_process";
 import { existsSync as existsSync25, readFileSync as readFileSync14, mkdirSync as mkdirSync12, unlinkSync as unlinkSync3 } from "fs";
 import { join as join21, extname as extname5 } from "path";
 import { tmpdir as tmpdir3 } from "os";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function detectLanguage(whisperPath, modelPath2, wavPath) {
   try {
     const output = execFileSync5(whisperPath, ["--model", modelPath2, "--detect-language", wavPath], {
@@ -94643,7 +94694,7 @@ function isVideoFile(filePath) {
   return VIDEO_EXTENSIONS.has(extname5(filePath).toLowerCase());
 }
 function tempWavPath() {
-  return join21(tmpdir3(), `hyperframes-audio-${process.pid}-${randomUUID5()}.wav`);
+  return join21(tmpdir3(), `hyperframes-audio-${process.pid}-${randomUUID6()}.wav`);
 }
 function extractAudio(videoPath) {
   const ffmpegPath = findFFmpeg();
@@ -99246,7 +99297,7 @@ var init_chunk_6H3V3WGJ = __esm({
 
 // ../studio-server/dist/chunk-ZPI6QXJH.js
 import { spawn as spawn8 } from "child_process";
-import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
 import {
   existsSync as existsSync210,
   mkdirSync as mkdirSync15,
@@ -99570,7 +99621,7 @@ async function transcodeToCache(absoluteSourcePath, cachePath2, variant) {
     if (existsSync210(cachePath2)) return cachePath2;
     const cacheDir = dirname14(cachePath2);
     mkdirSync15(cacheDir, { recursive: true });
-    const tempPath = join29(cacheDir, `.tmp-${randomUUID6()}-${basename4(cachePath2)}`);
+    const tempPath = join29(cacheDir, `.tmp-${randomUUID7()}-${basename4(cachePath2)}`);
     try {
       await runFfmpeg2(absoluteSourcePath, tempPath, variant);
       renameSync6(tempPath, cachePath2);
@@ -106487,7 +106538,7 @@ import { basename as basename5, join as join42 } from "path";
 import { mkdirSync as mkdirSync22, readdirSync as readdirSync32, readFileSync as readFileSync32, unlinkSync as unlinkSync5, writeFileSync as writeFileSync32 } from "fs";
 import { Buffer as Buffer2 } from "buffer";
 import { join as join52, relative as relative22 } from "path";
-import { createHash as createHash22, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash22, randomUUID as randomUUID8 } from "crypto";
 import { existsSync as existsSync37, readFileSync as readFileSync42, realpathSync as realpathSync6 } from "fs";
 import { randomUUID as randomUUID22 } from "crypto";
 import { dirname as dirname15, relative as relative32, resolve as resolve24, sep as sep7 } from "path";
@@ -106511,9 +106562,19 @@ import { join as join92 } from "path";
 import { streamSSE } from "hono/streaming";
 import { existsSync as existsSync72, readFileSync as readFileSync102, mkdirSync as mkdirSync42, unlinkSync as unlinkSync32, readdirSync as readdirSync52, statSync as statSync32 } from "fs";
 import { join as join102 } from "path";
-import { existsSync as existsSync82, readFileSync as readFileSync112, writeFileSync as writeFileSync62, mkdirSync as mkdirSync52, statSync as statSync42 } from "fs";
+import {
+  existsSync as existsSync82,
+  mkdirSync as mkdirSync52,
+  readFileSync as readFileSync112,
+  readdirSync as readdirSync62,
+  renameSync as renameSync22,
+  rmSync as rmSync32,
+  statSync as statSync42,
+  unlinkSync as unlinkSync42,
+  writeFileSync as writeFileSync62
+} from "fs";
 import { join as join112 } from "path";
-import { createHash as createHash42 } from "crypto";
+import { createHash as createHash42, randomUUID as randomUUID32 } from "crypto";
 import { existsSync as existsSync92, readFileSync as readFileSync122, writeFileSync as writeFileSync72, mkdirSync as mkdirSync62 } from "fs";
 import { join as join122 } from "path";
 import { closeSync as closeSync32, constants as constants22, fstatSync as fstatSync2, openSync as openSync32, readSync } from "fs";
@@ -106940,7 +107001,7 @@ function fileContentVersion(content) {
 }
 function createWriteToken(requestToken) {
   const token = requestToken?.trim();
-  return token && token.length <= 200 ? token : randomUUID7();
+  return token && token.length <= 200 ? token : randomUUID8();
 }
 function recordFileWriteReceipt(absPath, receipt) {
   const now = Date.now();
@@ -110026,6 +110087,46 @@ function registerRenderRoutes(api, adapter2) {
     return c3.json({ renders: files });
   });
 }
+function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
+  if (!existsSync82(cacheDir)) return;
+  const files = readdirSync62(cacheDir, { withFileTypes: true }).flatMap((entry) => {
+    if (!entry.isFile()) return [];
+    const path2 = join112(cacheDir, entry.name);
+    try {
+      const stats = statSync42(path2);
+      return [{ path: path2, bytes: stats.size, mtimeMs: stats.mtimeMs }];
+    } catch {
+      return [];
+    }
+  });
+  const retained = [];
+  for (const file of files) {
+    if (!protectedPaths.has(file.path) && now - file.mtimeMs > THUMBNAIL_CACHE_MAX_AGE_MS) {
+      rmSync32(file.path, { force: true });
+    } else {
+      retained.push(file);
+    }
+  }
+  let bytes = retained.reduce((total, file) => total + file.bytes, 0);
+  for (const file of retained.sort((left, right) => left.mtimeMs - right.mtimeMs)) {
+    if (bytes <= THUMBNAIL_CACHE_MAX_BYTES) break;
+    if (protectedPaths.has(file.path)) continue;
+    try {
+      unlinkSync42(file.path);
+      bytes -= file.bytes;
+    } catch {
+    }
+  }
+}
+function writeThumbnailAtomically(path2, buffer) {
+  const temporaryPath = `${path2}.${process.pid}.${randomUUID32()}.tmp`;
+  try {
+    writeFileSync62(temporaryPath, buffer, { flag: "wx" });
+    renameSync22(temporaryPath, path2);
+  } finally {
+    rmSync32(temporaryPath, { force: true });
+  }
+}
 function registerThumbnailRoutes(api, adapter2) {
   api.get("/projects/:id/thumbnail/*", async (c3) => {
     if (!adapter2.generateThumbnail) {
@@ -110046,6 +110147,8 @@ function registerThumbnailRoutes(api, adapter2) {
     const selector = url.searchParams.get("selector") || void 0;
     const format = url.searchParams.get("format") === "png" ? "png" : "jpeg";
     const contentType = format === "png" ? "image/png" : "image/jpeg";
+    const requestedOutput = url.searchParams.get("output");
+    const outputMode = requestedOutput === "source" || requestedOutput !== "preview" && format === "png" ? "source" : "preview";
     const rawSelectorIndex = Number.parseInt(url.searchParams.get("selectorIndex") || "0", 10);
     const selectorIndex = Number.isFinite(rawSelectorIndex) && rawSelectorIndex > 0 ? rawSelectorIndex : void 0;
     const urlVersion = url.searchParams.get("v") || "";
@@ -110083,37 +110186,62 @@ function registerThumbnailRoutes(api, adapter2) {
     const cacheDir = join112(project.dir, ".thumbnails");
     const selectorKey = selector ? `_${selector.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 80)}_${selectorIndex ?? 0}` : "";
     const urlVersionKey = urlVersion ? `_${urlVersion.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32)}` : "";
-    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${manualEditsKey}${motionKey}${sourceKey}_${format}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
+    const outputScale = outputMode === "source" ? 1 : Math.min(1, THUMBNAIL_MAX_OUTPUT_WIDTH / compW, THUMBNAIL_MAX_OUTPUT_HEIGHT / compH);
+    const outputWidth = Math.max(1, Math.round(compW * outputScale));
+    const outputHeight = Math.max(1, Math.round(compH * outputScale));
+    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${manualEditsKey}${motionKey}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
     const cachePath2 = join112(cacheDir, cacheKey);
+    if (!prunedCacheDirs.has(cacheDir)) {
+      prunedCacheDirs.add(cacheDir);
+      pruneThumbnailCache(
+        cacheDir,
+        /* @__PURE__ */ new Set([...thumbnailGenerationCoordinator.protectedKeys(), cachePath2])
+      );
+    }
     if (existsSync82(cachePath2)) {
       return new Response(new Uint8Array(readFileSync112(cachePath2)), {
         headers: { "Content-Type": contentType, "Cache-Control": "no-cache" }
       });
     }
     try {
-      const buffer = await adapter2.generateThumbnail({
-        project,
-        compPath,
-        seekTime,
-        width: compW,
-        height: compH,
-        previewUrl,
-        selector,
-        format,
-        selectorIndex
-      });
+      const buffer = await thumbnailGenerationCoordinator.acquire(
+        cachePath2,
+        c3.req.raw.signal,
+        async (signal) => {
+          const generated = await adapter2.generateThumbnail({
+            project,
+            compPath,
+            seekTime,
+            width: compW,
+            height: compH,
+            outputWidth,
+            outputHeight,
+            previewUrl,
+            selector,
+            format,
+            selectorIndex,
+            signal
+          });
+          if (!generated) return null;
+          if (!existsSync82(cacheDir)) mkdirSync52(cacheDir, { recursive: true });
+          writeThumbnailAtomically(cachePath2, generated);
+          return generated;
+        }
+      );
       if (!buffer) {
         return c3.json(
           { error: "Thumbnail generation failed \u2014 Chrome browser may not be available" },
           500
         );
       }
-      if (!existsSync82(cacheDir)) mkdirSync52(cacheDir, { recursive: true });
-      writeFileSync62(cachePath2, buffer);
+      pruneThumbnailCache(cacheDir, thumbnailGenerationCoordinator.protectedKeys());
       return new Response(new Uint8Array(buffer), {
         headers: { "Content-Type": contentType, "Cache-Control": "no-cache" }
       });
     } catch (err) {
+      if (err instanceof DOMException && err.name === "AbortError") {
+        return new Response(null, { status: 499 });
+      }
       const msg = err instanceof Error ? err.message : String(err);
       return c3.json({ error: `Thumbnail generation failed: ${msg}` }, 500);
     }
@@ -110592,6 +110720,18 @@ function createStudioApi(adapter2) {
   registerGlobalAssetRoutes(api);
   return api;
 }
+function thumbnailDeviceScaleFactor({
+  width,
+  height,
+  outputWidth,
+  outputHeight
+}) {
+  const dimensions = [width, height, outputWidth, outputHeight];
+  if (dimensions.some((value) => !Number.isFinite(value) || value <= 0)) {
+    throw new RangeError("Thumbnail dimensions must be positive finite numbers");
+  }
+  return Math.min(1, outputWidth / width, outputHeight / height);
+}
 function createBackgroundRemovalJob(opts, render3) {
   const state = {
     id: opts.jobId,
@@ -110644,7 +110784,7 @@ function updateBackgroundRemovalProgress(state, event) {
   state.framesProcessed = event.index;
   state.avgMsPerFrame = event.avgMsPerFrame;
 }
-var IGNORE_DIRS, SIGNATURE_TEXT_EXTENSIONS, SIGNATURE_EXCLUDED_DIRS, MAX_SIGNATURE_TEXT_BYTES, STUDIO_SIGNATURE_MANIFEST_PATHS, projectSignatureCache, COMPOSITION_ID_RE, MIME_TYPES2, SAMPLE_RATE, PEAK_COUNT, WAVEFORM_CACHE_VERSION, VIDEO_EXT2, AUDIO_EXT2, DEFAULT_KEEP_PER_FILE, RECEIPT_TTL_MS, receipts, CompositionInsertionError, differential, behavioral, GSAP_MUTATION_CAPABILITIES, GSAP_WRITER_MIGRATION, atomicCutTail, HOLD_SYNC_MUTATION_TYPES, REGEXP_SPECIALS, NON_RENDERED_TAGS, VARIABLES_PAYLOAD_ERROR, PROJECT_SIGNATURE_META, GSAP_CDN_VERSION, GSAP_CDN_SCRIPT, GSAP_CUSTOM_EASE_CDN_SCRIPT, GSAP_MOTION_PATH_CDN_SCRIPT, GSAP_CDN_FALLBACK_SCRIPT, VALID_RESOLUTIONS, THUMBNAIL_CACHE_VERSION, MAX_FONT_RESULTS, GOOGLE_FONTS_METADATA_URL, GOOGLE_FONTS_FETCH_TIMEOUT_MS, cachedFonts, cachedGoogleFonts, GOOGLE_FONT_FALLBACKS, VIDEO_EXTENSIONS2, IMAGE_EXTENSIONS, VIDEO_OUTPUT_EXTENSIONS, QUALITIES, DEVICES;
+var IGNORE_DIRS, SIGNATURE_TEXT_EXTENSIONS, SIGNATURE_EXCLUDED_DIRS, MAX_SIGNATURE_TEXT_BYTES, STUDIO_SIGNATURE_MANIFEST_PATHS, projectSignatureCache, COMPOSITION_ID_RE, MIME_TYPES2, SAMPLE_RATE, PEAK_COUNT, WAVEFORM_CACHE_VERSION, VIDEO_EXT2, AUDIO_EXT2, DEFAULT_KEEP_PER_FILE, RECEIPT_TTL_MS, receipts, CompositionInsertionError, differential, behavioral, GSAP_MUTATION_CAPABILITIES, GSAP_WRITER_MIGRATION, atomicCutTail, HOLD_SYNC_MUTATION_TYPES, REGEXP_SPECIALS, NON_RENDERED_TAGS, VARIABLES_PAYLOAD_ERROR, PROJECT_SIGNATURE_META, GSAP_CDN_VERSION, GSAP_CDN_SCRIPT, GSAP_CUSTOM_EASE_CDN_SCRIPT, GSAP_MOTION_PATH_CDN_SCRIPT, GSAP_CDN_FALLBACK_SCRIPT, VALID_RESOLUTIONS, ThumbnailGenerationCoordinator, thumbnailGenerationCoordinator, THUMBNAIL_CACHE_VERSION, THUMBNAIL_MAX_OUTPUT_WIDTH, THUMBNAIL_MAX_OUTPUT_HEIGHT, THUMBNAIL_CACHE_MAX_BYTES, THUMBNAIL_CACHE_MAX_AGE_MS, prunedCacheDirs, MAX_FONT_RESULTS, GOOGLE_FONTS_METADATA_URL, GOOGLE_FONTS_FETCH_TIMEOUT_MS, cachedFonts, cachedGoogleFonts, GOOGLE_FONT_FALLBACKS, VIDEO_EXTENSIONS2, IMAGE_EXTENSIONS, VIDEO_OUTPUT_EXTENSIONS, QUALITIES, DEVICES;
 var init_dist9 = __esm({
   "../studio-server/dist/index.js"() {
     "use strict";
@@ -110885,7 +111025,113 @@ var init_dist9 = __esm({
 })();
 </script>`;
     VALID_RESOLUTIONS = new Set(VALID_CANVAS_RESOLUTIONS);
+    ThumbnailGenerationCoordinator = class {
+      constructor(concurrency = 1) {
+        this.concurrency = concurrency;
+        if (!Number.isInteger(concurrency) || concurrency < 1) {
+          throw new RangeError("Thumbnail concurrency must be a positive integer");
+        }
+      }
+      concurrency;
+      entries = /* @__PURE__ */ new Map();
+      queue = [];
+      activeEntries = /* @__PURE__ */ new Set();
+      active = 0;
+      acquire(key2, signal, work) {
+        if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+        let entry = this.entries.get(key2);
+        if (!entry) {
+          let resolve510;
+          let reject;
+          const promise = new Promise((resolvePromise, rejectPromise) => {
+            resolve510 = resolvePromise;
+            reject = rejectPromise;
+          });
+          entry = {
+            key: key2,
+            controller: new AbortController(),
+            leases: 0,
+            state: "queued",
+            work,
+            promise,
+            resolve: resolve510,
+            reject
+          };
+          this.entries.set(key2, entry);
+          this.queue.push(entry);
+        }
+        entry.leases++;
+        this.pump();
+        return this.lease(entry, signal);
+      }
+      protectedKeys() {
+        return /* @__PURE__ */ new Set([...this.entries.keys(), ...[...this.activeEntries].map((entry) => entry.key)]);
+      }
+      lease(entry, signal) {
+        return new Promise((resolve510, reject) => {
+          let released = false;
+          const release4 = () => {
+            if (released) return;
+            released = true;
+            signal.removeEventListener("abort", onAbort);
+            entry.leases--;
+            if (entry.leases > 0 || !this.entries.has(entry.key)) return;
+            entry.controller.abort();
+            if (this.entries.get(entry.key) === entry) this.entries.delete(entry.key);
+            if (entry.state === "queued") {
+              const index = this.queue.indexOf(entry);
+              if (index >= 0) this.queue.splice(index, 1);
+              entry.reject(new DOMException("Aborted", "AbortError"));
+            }
+          };
+          const onAbort = () => {
+            release4();
+            reject(new DOMException("Aborted", "AbortError"));
+          };
+          signal.addEventListener("abort", onAbort, { once: true });
+          entry.promise.then(
+            (value) => {
+              release4();
+              resolve510(value);
+            },
+            (reason) => {
+              release4();
+              reject(reason);
+            }
+          );
+        });
+      }
+      pump() {
+        while (this.active < this.concurrency) {
+          const entry = this.queue.shift();
+          if (!entry) return;
+          if (entry.leases === 0) continue;
+          entry.state = "active";
+          this.activeEntries.add(entry);
+          this.active++;
+          void this.run(entry);
+        }
+      }
+      async run(entry) {
+        try {
+          entry.resolve(await entry.work(entry.controller.signal));
+        } catch (error) {
+          entry.reject(error);
+        } finally {
+          this.active--;
+          this.activeEntries.delete(entry);
+          if (this.entries.get(entry.key) === entry) this.entries.delete(entry.key);
+          this.pump();
+        }
+      }
+    };
+    thumbnailGenerationCoordinator = new ThumbnailGenerationCoordinator(1);
     THUMBNAIL_CACHE_VERSION = "v4";
+    THUMBNAIL_MAX_OUTPUT_WIDTH = 240;
+    THUMBNAIL_MAX_OUTPUT_HEIGHT = 135;
+    THUMBNAIL_CACHE_MAX_BYTES = 512 * 1024 * 1024;
+    THUMBNAIL_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
+    prunedCacheDirs = /* @__PURE__ */ new Set();
     MAX_FONT_RESULTS = 2e3;
     GOOGLE_FONTS_METADATA_URL = "https://fonts.google.com/metadata/fonts";
     GOOGLE_FONTS_FETCH_TIMEOUT_MS = 3e3;
@@ -124868,7 +125114,7 @@ import {
 import { tmpdir as tmpdir8 } from "os";
 import { join as join60, dirname as dirname25, resolve as resolve33 } from "path";
 import { totalmem as totalmem2 } from "os";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function sampleDirectoryBytes(dir) {
   let total = 0;
@@ -125227,7 +125473,7 @@ async function executeDiskCaptureWithAdaptiveRetry(options) {
 }
 function createRenderJob(config) {
   return {
-    id: randomUUID8(),
+    id: randomUUID9(),
     config: {
       ...config,
       fps: toFps(config.fps),
@@ -132359,9 +132605,19 @@ function createStudioServer(options) {
         );
       }
       let page = null;
+      const closePage = () => void page?.close().catch(() => {
+      });
+      opts.signal.addEventListener("abort", closePage, { once: true });
       try {
         page = await session.browser.newPage();
-        await page.setViewport({ width: opts.width || 1920, height: opts.height || 1080 });
+        if (opts.signal.aborted) return null;
+        const width = opts.width || 1920;
+        const height = opts.height || 1080;
+        await page.setViewport({
+          width,
+          height,
+          deviceScaleFactor: thumbnailDeviceScaleFactor(opts)
+        });
         await page.goto(opts.previewUrl, { waitUntil: "domcontentloaded", timeout: 1e4 });
         await page.waitForFunction(
           () => {
@@ -132404,12 +132660,15 @@ function createStudioServer(options) {
         );
         return screenshot;
       } catch (err) {
-        console.warn(
-          "[Studio] Thumbnail generation failed:",
-          err instanceof Error ? err.message : err
-        );
+        if (!opts.signal.aborted) {
+          console.warn(
+            "[Studio] Thumbnail generation failed:",
+            err instanceof Error ? err.message : err
+          );
+        }
         return null;
       } finally {
+        opts.signal.removeEventListener("abort", closePage);
         await page?.close().catch(() => {
         });
       }
@@ -135057,6 +135316,7 @@ __export(studio_api_exports, {
   getElementScreenshotClip: () => getElementScreenshotClip,
   getMimeType: () => getMimeType,
   isSafePath: () => isSafePath,
+  thumbnailDeviceScaleFactor: () => thumbnailDeviceScaleFactor,
   walkDir: () => walkDir
 });
 var init_studio_api = __esm({
@@ -135598,7 +135858,7 @@ var init_present = __esm({
 function isAuthError(err) {
   return err instanceof AuthError;
 }
-var AuthError, ErrNotConfigured, ErrInvalidStore, ErrUnauthenticated, ErrApi, ErrOAuthNotConfigured, ErrRefreshFailed;
+var AuthError, ErrNotConfigured, ErrInvalidStore, ErrUnauthenticated, ErrApi, ErrOAuthNotConfigured, ErrRefreshFailed, ErrDeviceAuthFailed;
 var init_errors = __esm({
   "src/auth/errors.ts"() {
     "use strict";
@@ -135638,6 +135898,11 @@ var init_errors = __esm({
       detail ? `Failed to refresh OAuth tokens: ${detail}` : "Failed to refresh OAuth tokens",
       "Run `hyperframes auth login` to re-authenticate."
     );
+    ErrDeviceAuthFailed = (detail) => new AuthError(
+      "DEVICE_AUTH_FAILED",
+      `Device authorization failed: ${detail}`,
+      "Run `hyperframes auth login --device` to start a new code."
+    );
   }
 });
 
@@ -136347,6 +136612,9 @@ function tokenEndpoint() {
 function revokeEndpoint() {
   return process.env["HYPERFRAMES_OAUTH_REVOKE_URL"] || DEFAULT_REVOKE_URL;
 }
+function deviceAuthorizationEndpoint() {
+  return process.env["HYPERFRAMES_OAUTH_DEVICE_URL"] || DEFAULT_DEVICE_AUTHORIZATION_URL;
+}
 function resolveClientId() {
   const override = process.env["HYPERFRAMES_OAUTH_CLIENT_ID"];
   const id = override && override.length > 0 ? override : DEFAULT_CLIENT_ID;
@@ -136402,6 +136670,127 @@ async function startAuthorizationCodeFlow(opts = {}) {
   await persistOAuth(tokens, { preserveMissing: false });
   return { tokens };
 }
+async function startDeviceAuthorizationFlow(opts = {}) {
+  const runtime = {
+    clientId: resolveClientId(),
+    fetchImpl: opts.fetchImpl ?? fetch,
+    sleepImpl: opts.sleepImpl ?? ((ms) => new Promise((resolve77) => setTimeout(resolve77, ms))),
+    now: opts.now ?? Date.now,
+    requestTimeoutMs: opts.requestTimeoutMs ?? DEVICE_REQUEST_TIMEOUT_MS
+  };
+  const issuance = await requestDeviceAuthorization(runtime, opts.scope ?? DEFAULT_SCOPES);
+  await opts.onChallenge?.({
+    userCode: issuance.userCode,
+    verificationUri: issuance.verificationUri,
+    ...issuance.verificationUriComplete ? { verificationUriComplete: issuance.verificationUriComplete } : {}
+  });
+  return await pollDeviceToken(runtime, issuance);
+}
+async function requestDeviceAuthorization(runtime, scope) {
+  return await withDeviceRequestTimeout(
+    runtime,
+    "could not reach the authorization server",
+    async (signal) => {
+      const response = await runtime.fetchImpl(deviceAuthorizationEndpoint(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({ client_id: runtime.clientId, scope }).toString(),
+        signal
+      });
+      if (!response.ok) {
+        throw ErrDeviceAuthFailed(`authorization server returned HTTP ${response.status}`);
+      }
+      return parseDeviceAuthorizationResponse(await readJsonOrDeviceError(response));
+    }
+  );
+}
+async function pollDeviceToken(runtime, issuance) {
+  const deadline = runtime.now() + Math.min(issuance.expiresIn, MAX_DEVICE_FLOW_SECONDS) * 1e3;
+  let intervalSeconds = issuance.interval;
+  while (runtime.now() < deadline) {
+    const remainingMs = deadline - runtime.now();
+    if (remainingMs <= 0) break;
+    await runtime.sleepImpl(Math.min(intervalSeconds * 1e3, remainingMs));
+    const result = await requestDeviceToken(runtime, issuance.deviceCode);
+    if (result.tokens) return result.tokens;
+    if (result.slowDown) {
+      intervalSeconds = Math.min(
+        Math.max(intervalSeconds + 5, result.retryAfterSeconds ?? 0),
+        MAX_DEVICE_POLL_SECONDS
+      );
+    }
+  }
+  throw ErrDeviceAuthFailed("the code expired");
+}
+async function requestDeviceToken(runtime, deviceCode) {
+  return await withDeviceRequestTimeout(
+    runtime,
+    "lost contact with the authorization server",
+    async (signal) => {
+      const response = await runtime.fetchImpl(tokenEndpoint(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: DEVICE_CODE_GRANT_TYPE,
+          device_code: deviceCode,
+          client_id: runtime.clientId
+        }).toString(),
+        signal
+      });
+      return await evaluateDevicePollResponse(response, runtime.now());
+    }
+  );
+}
+async function evaluateDevicePollResponse(response, nowMs) {
+  if (response.ok) {
+    return { tokens: parseTokenResponse(await readJsonOrDeviceError(response)) };
+  }
+  const error = await readDeviceOAuthError(response);
+  switch (error) {
+    case "authorization_pending":
+      return {};
+    case "slow_down":
+      return { slowDown: true, retryAfterSeconds: retryAfterSeconds(response, nowMs) };
+    case "access_denied":
+      throw ErrDeviceAuthFailed("access was denied");
+    case "expired_token":
+      throw ErrDeviceAuthFailed("the code expired");
+    default:
+      if (response.status === 429) {
+        return { slowDown: true, retryAfterSeconds: retryAfterSeconds(response, nowMs) };
+      }
+      throw ErrDeviceAuthFailed(`authorization server returned HTTP ${response.status}`);
+  }
+}
+async function withDeviceRequestTimeout(runtime, networkError, operation) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), runtime.requestTimeoutMs);
+  try {
+    return await operation(controller.signal);
+  } catch (err) {
+    if (controller.signal.aborted) {
+      throw ErrDeviceAuthFailed("authorization server request timed out");
+    }
+    if (isAuthError(err)) throw err;
+    throw ErrDeviceAuthFailed(networkError);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function retryAfterSeconds(response, nowMs) {
+  const value = response.headers.get("retry-after")?.trim();
+  if (!value) return void 0;
+  if (/^\d+$/.test(value)) return Math.min(Number(value), MAX_DEVICE_POLL_SECONDS);
+  const retryAt = Date.parse(value);
+  if (!Number.isFinite(retryAt)) return void 0;
+  return Math.min(Math.max(Math.ceil((retryAt - nowMs) / 1e3), 0), MAX_DEVICE_POLL_SECONDS);
+}
 async function refreshTokens(refresh_token, opts = {}) {
   const clientId = resolveClientId();
   const fetchImpl = opts.fetchImpl ?? fetch;
@@ -136562,6 +136951,146 @@ async function persistOAuth(tokens, opts) {
   const oauth = opts.preserveMissing ? { ...existing.oauth, ...tokens } : { ...tokens };
   await writeStore({ ...existing, oauth });
 }
+async function persistVerifiedOAuthSession(tokens, user) {
+  let credentials = {};
+  try {
+    ({ credentials } = await readStore());
+  } catch {
+    credentials = {};
+  }
+  const next = {
+    ...credentials,
+    oauth: { ...tokens }
+  };
+  if (user.email || user.first_name || user.last_name || user.username) {
+    next.user = {
+      ...credentials.user,
+      email: user.email,
+      first_name: user.first_name,
+      last_name: user.last_name,
+      username: user.username
+    };
+  } else {
+    delete next.user;
+  }
+  await writeStore(next);
+}
+function parseDeviceAuthorizationResponse(payload) {
+  const data2 = requireDeviceAuthorizationRecord(payload);
+  const deviceCode = stringField(data2, "device_code");
+  const userCode = stringField(data2, "user_code");
+  const verificationUri = requiredSafeVerificationUri(data2, "verification_uri");
+  const verificationUriComplete = optionalSafeVerificationUri(data2, "verification_uri_complete");
+  const expiresIn = strictNumericField(data2, "expires_in");
+  const interval = strictNumericField(data2, "interval");
+  requireSafeDeviceCode(deviceCode);
+  requireSafeDeviceCode(userCode);
+  const timing2 = normalizeDeviceAuthorizationTiming(data2, expiresIn, interval);
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...verificationUriComplete ? { verificationUriComplete } : {},
+    ...timing2
+  };
+}
+function requireSafeDeviceCode(value) {
+  if (!value || !isHeaderSafe(value)) {
+    throw ErrDeviceAuthFailed("authorization server returned an invalid response");
+  }
+}
+function normalizeDeviceAuthorizationTiming(data2, expiresIn, interval) {
+  if (!isPositiveNumber(expiresIn) || data2["interval"] !== void 0 && !isPositiveNumber(interval)) {
+    throw ErrDeviceAuthFailed("authorization server returned invalid timing values");
+  }
+  return {
+    expiresIn,
+    interval: Math.min(
+      Math.max(Math.ceil(interval ?? MIN_DEVICE_POLL_SECONDS), MIN_DEVICE_POLL_SECONDS),
+      MAX_DEVICE_POLL_SECONDS
+    )
+  };
+}
+function requiredSafeVerificationUri(data2, key2) {
+  const value = normalizeSafeVerificationUri(stringField(data2, key2));
+  if (!value) throw ErrDeviceAuthFailed("authorization server returned an unsafe verification URL");
+  return value;
+}
+function optionalSafeVerificationUri(data2, key2) {
+  if (data2[key2] === void 0) return void 0;
+  return requiredSafeVerificationUri(data2, key2);
+}
+function requireDeviceAuthorizationRecord(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw ErrDeviceAuthFailed("authorization server returned an invalid response");
+  }
+  return payload;
+}
+function isPositiveNumber(value) {
+  return value !== void 0 && value > 0;
+}
+function normalizeSafeVerificationUri(value) {
+  if (!value || !isHeaderSafe(value)) return void 0;
+  try {
+    const url = new URL(value);
+    if (url.username || url.password) return void 0;
+    const allowed = url.protocol === "https:" || url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname);
+    return allowed ? url.href : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readJsonOrDeviceError(res) {
+  return await readBoundedDeviceJson(res);
+}
+async function readDeviceOAuthError(res) {
+  try {
+    const payload = await readBoundedDeviceJson(res);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    const error = payload["error"];
+    return typeof error === "string" ? error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function strictNumericField(obj, key2) {
+  const value = obj[key2];
+  if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+  if (typeof value !== "string" || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+async function readBoundedDeviceJson(res) {
+  if (!res.body) throw ErrDeviceAuthFailed("authorization server returned no data");
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > MAX_DEVICE_RESPONSE_BYTES) {
+        await reader.cancel();
+        throw ErrDeviceAuthFailed("authorization server response was too large");
+      }
+      chunks.push(value);
+    }
+    const body = new Uint8Array(total);
+    let offset2 = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset2);
+      offset2 += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder().decode(body));
+  } catch (err) {
+    if (isAuthError(err)) throw err;
+    throw ErrDeviceAuthFailed("authorization server returned non-JSON data");
+  } finally {
+    reader.releaseLock();
+  }
+}
 async function readJsonOrThrow(res) {
   try {
     return await res.json();
@@ -136576,7 +137105,7 @@ async function safeText2(res) {
     return "";
   }
 }
-var REVOKE_TIMEOUT_MS, MIN_EXPIRES_IN_SECONDS, DEFAULT_CLIENT_ID, DEFAULT_SCOPES, DEFAULT_AUTHORIZE_URL, DEFAULT_TOKEN_URL, DEFAULT_REVOKE_URL;
+var REVOKE_TIMEOUT_MS, MIN_EXPIRES_IN_SECONDS, DEFAULT_CLIENT_ID, DEFAULT_SCOPES, DEFAULT_AUTHORIZE_URL, DEFAULT_TOKEN_URL, DEFAULT_REVOKE_URL, DEFAULT_DEVICE_AUTHORIZATION_URL, DEVICE_CODE_GRANT_TYPE, MAX_DEVICE_FLOW_SECONDS, MIN_DEVICE_POLL_SECONDS, MAX_DEVICE_POLL_SECONDS, MAX_DEVICE_RESPONSE_BYTES, DEVICE_REQUEST_TIMEOUT_MS;
 var init_oauth = __esm({
   "src/auth/oauth.ts"() {
     "use strict";
@@ -136595,6 +137124,13 @@ var init_oauth = __esm({
     DEFAULT_AUTHORIZE_URL = "https://app.heygen.com/oauth/authorize";
     DEFAULT_TOKEN_URL = "https://api2.heygen.com/v1/oauth/token";
     DEFAULT_REVOKE_URL = "https://api2.heygen.com/v1/oauth/revoke";
+    DEFAULT_DEVICE_AUTHORIZATION_URL = "https://api2.heygen.com/v1/oauth/device_authorization";
+    DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+    MAX_DEVICE_FLOW_SECONDS = 30 * 60;
+    MIN_DEVICE_POLL_SECONDS = 5;
+    MAX_DEVICE_POLL_SECONDS = 60;
+    MAX_DEVICE_RESPONSE_BYTES = 64 * 1024;
+    DEVICE_REQUEST_TIMEOUT_MS = 15e3;
   }
 });
 
@@ -136613,7 +137149,7 @@ var init_auth = __esm({
 });
 
 // src/utils/projectLink.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { existsSync as existsSync75, mkdirSync as mkdirSync39, readFileSync as readFileSync46, writeFileSync as writeFileSync28 } from "fs";
 import { homedir as homedir16 } from "os";
 import { join as join83, resolve as resolve47 } from "path";
@@ -136664,7 +137200,7 @@ function ensureProjectId(absDir) {
   const path2 = resolve47(absDir);
   const existing = links[path2];
   if (existing) return existing.projectId;
-  const projectId = randomUUID9();
+  const projectId = randomUUID10();
   links[path2] = { projectId, url: "" };
   writeProjectLinks(links);
   return projectId;
@@ -150344,7 +150880,7 @@ __export(feedback_exports, {
   default: () => feedback_default,
   examples: () => examples26
 });
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { resolve as resolve66 } from "path";
 import open from "open";
 function normalizeComment(raw) {
@@ -150497,7 +151033,7 @@ var init_feedback2 = __esm({
         }
         const comment = normalizeComment(args.comment);
         const doctorSummary = await getDoctorSummary();
-        const feedbackId = randomUUID10();
+        const feedbackId = randomUUID11();
         const config = readConfig();
         const joinKeys = buildTelemetryJoinKeys({
           feedbackId,
@@ -158802,7 +159338,7 @@ var require_gaxios = __commonJS({
     var retry_js_1 = require_retry3();
     var stream_1 = __require("stream");
     var interceptor_js_1 = require_interceptor();
-    var randomUUID11 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
+    var randomUUID12 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
     var HTTP_STATUS_NO_CONTENT = 204;
     var Gaxios = class {
       agentCache = /* @__PURE__ */ new Map();
@@ -159075,7 +159611,7 @@ var require_gaxios = __commonJS({
          */
         ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
         if (opts.multipart?.length) {
-          const boundary = await randomUUID11();
+          const boundary = await randomUUID12();
           preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
           opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
         } else if (shouldDirectlyPassData) {
@@ -192744,7 +193280,7 @@ __export(compare_exports, {
   parseCompareArgs: () => parseCompareArgs,
   prepareCompareVariantProjects: () => prepareCompareVariantProjects
 });
-import { cpSync as cpSync6, existsSync as existsSync105, mkdirSync as mkdirSync51, mkdtempSync as mkdtempSync17, renameSync as renameSync15, rmSync as rmSync32, statSync as statSync36 } from "fs";
+import { cpSync as cpSync6, existsSync as existsSync105, mkdirSync as mkdirSync51, mkdtempSync as mkdtempSync17, renameSync as renameSync15, rmSync as rmSync33, statSync as statSync36 } from "fs";
 import { tmpdir as tmpdir17 } from "os";
 import { basename as basename28, dirname as dirname55, extname as extname23, join as join110 } from "path";
 function defaultLabelForPath(input2) {
@@ -192864,7 +193400,7 @@ function stageHtmlVariant(variant) {
       stagedDir
     };
   } catch (err) {
-    rmSync32(stagedDir, { recursive: true, force: true });
+    rmSync33(stagedDir, { recursive: true, force: true });
     throw err;
   }
 }
@@ -192893,7 +193429,7 @@ function prepareCompareVariantProjects(variants) {
   } catch (err) {
     for (const variant of prepared) {
       if (variant.stagedDir) {
-        rmSync32(variant.stagedDir, { recursive: true, force: true });
+        rmSync33(variant.stagedDir, { recursive: true, force: true });
       }
     }
     throw err;
@@ -192902,7 +193438,7 @@ function prepareCompareVariantProjects(variants) {
 function cleanupPreparedCompareVariants(variants) {
   for (const variant of variants) {
     if (variant.stagedDir) {
-      rmSync32(variant.stagedDir, { recursive: true, force: true });
+      rmSync33(variant.stagedDir, { recursive: true, force: true });
     }
   }
 }
@@ -192974,7 +193510,7 @@ async function renderCompareSheet(parsed) {
     return buildCompareSuccessPayload(parsed.outPath, variants, capResult);
   } finally {
     cleanupPreparedCompareVariants(prepared);
-    rmSync32(frameDir, { recursive: true, force: true });
+    rmSync33(frameDir, { recursive: true, force: true });
   }
 }
 function printJson2(payload) {
@@ -197690,7 +198226,7 @@ __export(state_exports, {
   stateFilePath: () => stateFilePath,
   writeStackOutputs: () => writeStackOutputs
 });
-import { existsSync as existsSync113, mkdirSync as mkdirSync58, readdirSync as readdirSync38, readFileSync as readFileSync77, rmSync as rmSync33, writeFileSync as writeFileSync53 } from "fs";
+import { existsSync as existsSync113, mkdirSync as mkdirSync58, readdirSync as readdirSync38, readFileSync as readFileSync77, rmSync as rmSync34, writeFileSync as writeFileSync53 } from "fs";
 import { dirname as dirname56, join as join121 } from "path";
 function stateFilePath(stackName = DEFAULT_STACK_NAME, cwd = process.cwd()) {
   return join121(cwd, STATE_DIR_NAME, `${STATE_FILE_PREFIX}${stackName}.json`);
@@ -197712,7 +198248,7 @@ function readStackOutputs(stackName = DEFAULT_STACK_NAME, cwd = process.cwd()) {
 }
 function deleteStackOutputs(stackName = DEFAULT_STACK_NAME, cwd = process.cwd()) {
   const path2 = stateFilePath(stackName, cwd);
-  if (existsSync113(path2)) rmSync33(path2);
+  if (existsSync113(path2)) rmSync34(path2);
 }
 function listStackNames(cwd = process.cwd()) {
   const dir = join121(cwd, STATE_DIR_NAME);
@@ -201752,6 +202288,98 @@ __export(login_exports, {
   default: () => login_default
 });
 import { stdin as input } from "process";
+function isRemoteOrHeadless() {
+  const remoteEnvironment = [
+    "CODESPACES",
+    "GITHUB_CODESPACES",
+    "REMOTE_CONTAINERS",
+    "GITPOD_WORKSPACE_ID",
+    "container"
+  ].some(envFlagEnabled);
+  return Boolean(
+    process.env["SSH_CONNECTION"] || process.env["SSH_CLIENT"] || process.env["SSH_TTY"] || process.env["BROWSER"] === "none" || process.env["HF_NO_BROWSER"] === "1" || remoteEnvironment || process.stdout.isTTY !== true
+  );
+}
+function envFlagEnabled(name) {
+  const value = process.env[name]?.trim().toLowerCase();
+  return Boolean(value && value !== "0" && value !== "false" && value !== "no");
+}
+function assertAttendedDeviceFlow() {
+  if (envFlagEnabled("CI") || process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    console.error(
+      c.error(
+        "`--device` requires an attended terminal and is disabled in CI. Use an API key or workload credential for automation."
+      )
+    );
+    failUsage();
+  }
+}
+async function runDeviceLogin() {
+  assertAttendedDeviceFlow();
+  assertOAuthConfiguredOrExit();
+  const { trackAuthLoginStarted: trackAuthLoginStarted2, trackAuthLoginCompleted: trackAuthLoginCompleted2, trackAuthLoginFailed: trackAuthLoginFailed2, identifyUser: identifyUser2 } = await Promise.resolve().then(() => (init_telemetry2(), telemetry_exports2));
+  trackAuthLoginStarted2("device");
+  let tokens;
+  try {
+    tokens = await startDeviceAuthorizationFlow({
+      onChallenge: ({ verificationUri, verificationUriComplete, userCode }) => {
+        console.log(`Open ${c.accent(verificationUriComplete ?? verificationUri)} in a browser.`);
+        if (!verificationUriComplete) console.log(`Enter code ${c.bold(userCode)}.`);
+        console.log(c.dim("Waiting for approval\u2026"));
+      }
+    });
+  } catch (err) {
+    const message = err.message || "Device authorization failed.";
+    trackAuthLoginFailed2("device", /expired/i.test(message) ? "flow_timeout" : "flow_error");
+    console.error(c.error(message));
+    failCommand();
+  }
+  const credential = {
+    type: "oauth",
+    access_token: tokens.access_token,
+    ...tokens.refresh_token ? { refresh_token: tokens.refresh_token } : {},
+    source: "file_json",
+    refreshable: false
+  };
+  let user;
+  try {
+    user = await new AuthClient().getCurrentUser(credential);
+  } catch (err) {
+    await revokeDeviceTokens(tokens);
+    trackAuthLoginFailed2("device", "rejected");
+    console.error(
+      c.error(
+        `HeyGen could not verify the approved device session; no credential was saved. ${err.message}`
+      )
+    );
+    failCommand();
+  }
+  try {
+    await persistVerifiedOAuthSession(tokens, toStoredUserInfo(user));
+  } catch (err) {
+    await revokeDeviceTokens(tokens);
+    trackAuthLoginFailed2("device", "flow_error");
+    console.error(
+      c.error(
+        `Could not save the verified device session; it was revoked. ${err.message}`
+      )
+    );
+    failCommand();
+  }
+  const id = identityKey(user);
+  if (id) identifyUser2(id);
+  trackAuthLoginCompleted2("device", id);
+  const identity = userDisplayName(toStoredUserInfo(user)) ?? "(unknown user)";
+  console.log(c.success(`\u2713 Signed in as ${identity}.`));
+}
+async function revokeDeviceTokens(tokens) {
+  await revokeTokens(tokens.access_token, { token_type_hint: "access_token" });
+  if (tokens.refresh_token) {
+    await revokeTokens(tokens.refresh_token, {
+      token_type_hint: "refresh_token"
+    });
+  }
+}
 async function runOAuthLogin() {
   assertOAuthConfiguredOrExit();
   const { trackAuthLoginStarted: trackAuthLoginStarted2, trackAuthLoginFailed: trackAuthLoginFailed2 } = await Promise.resolve().then(() => (init_telemetry2(), telemetry_exports2));
@@ -201886,7 +202514,11 @@ async function rollback(previous) {
 async function verifyAndReport(key2) {
   const client = new AuthClient();
   try {
-    const user = await client.getCurrentUser({ type: "api_key", key: key2, source: "file_json" });
+    const user = await client.getCurrentUser({
+      type: "api_key",
+      key: key2,
+      source: "file_json"
+    });
     await persistUserInfo(user);
     const identity = userDisplayName(toStoredUserInfo(user)) ?? "(unknown user)";
     console.log(c.success(`\u2713 API key saved. Authenticated as ${identity}.`));
@@ -201963,15 +202595,35 @@ var init_login = __esm({
         "api-key": {
           type: "string",
           description: "API key value, or pass `--api-key` with no value to read from stdin / prompt."
+        },
+        device: {
+          type: "boolean",
+          description: "Use an attended device code (for SSH/headless terminals; never for CI)."
         }
       },
       // fallow-ignore-next-line complexity
       async run({ args }) {
         const inlineKey = args["api-key"];
+        if (inlineKey !== void 0 && args.device) {
+          console.error(c.error("Choose either --device or --api-key, not both."));
+          failUsage();
+        }
         if (inlineKey !== void 0) {
           await runApiKeyLogin(inlineKey);
           return;
         }
+        if (args.device) {
+          await runDeviceLogin();
+          return;
+        }
+        if (isRemoteOrHeadless()) {
+          console.error(
+            c.error(
+              "Browser callback login is unavailable in this remote/headless terminal. Run `hyperframes auth login --device`."
+            )
+          );
+          failUsage();
+        }
         await runOAuthLogin();
       }
     });
@@ -202394,6 +203046,7 @@ var init_auth3 = __esm({
     init_colors();
     examples37 = [
       ["Sign in via browser (OAuth)", "hyperframes auth login"],
+      ["Sign in from SSH/headless terminal", "hyperframes auth login --device"],
       ["Save an API key (interactive)", "hyperframes auth login --api-key"],
       ["Save an API key from stdin", "echo $HEYGEN_API_KEY | hyperframes auth login --api-key"],
       ["Check who you're signed in as", "hyperframes auth status"],
@@ -202407,7 +203060,7 @@ Manage HeyGen credentials. Credentials live in
 ${c.accent("~/.heygen/credentials")} and are shared with heygen-cli.
 
 ${c.bold("SUBCOMMANDS:")}
-  ${c.accent("login")}    ${c.dim("Sign in via browser (default) or --api-key for a long-lived key.")}
+  ${c.accent("login")}    ${c.dim("Sign in via browser, --device for SSH, or --api-key for a long-lived key.")}
   ${c.accent("status")}   ${c.dim("Show the active credential's source, type, and identity.")}
   ${c.accent("refresh")}  ${c.dim("Force-refresh the OAuth access token.")}
   ${c.accent("logout")}   ${c.dim("Remove the stored credential (--keep-api-key for OAuth-only).")}
@@ -202418,6 +203071,7 @@ ${c.bold("ENV VARS:")}
   ${c.accent("HEYGEN_API_URL")}              Override the API base URL (default https://api.heygen.com).
   ${c.accent("HEYGEN_CONFIG_DIR")}           Override the credentials directory (default ~/.heygen).
   ${c.accent("HYPERFRAMES_OAUTH_CLIENT_ID")} Override the OAuth client_id (for dev/test).
+  ${c.accent("HYPERFRAMES_OAUTH_DEVICE_URL")} Override the RFC 8628 device endpoint (for dev/test).
 `;
     auth_default = defineCommand({
       meta: { name: "auth", description: "Sign in to HeyGen and manage credentials" },
@@ -202699,7 +203353,7 @@ var init_parseFigmaRef = __esm({
 });
 
 // ../core/dist/figma/freeze.js
-import { copyFileSync as copyFileSync11, mkdirSync as mkdirSync61, rmSync as rmSync34, statSync as statSync39, writeFileSync as writeFileSync55 } from "fs";
+import { copyFileSync as copyFileSync11, mkdirSync as mkdirSync61, rmSync as rmSync35, statSync as statSync39, writeFileSync as writeFileSync55 } from "fs";
 import { dirname as dirname59 } from "path";
 function exceedsFreezeCap(byteLength) {
   return byteLength > MAX_FREEZE_BYTES;
@@ -202715,7 +203369,7 @@ function freezeBytes(bytes, destPath) {
   } catch (err) {
     if (err.code !== "EEXIST")
       throw err;
-    rmSync34(destPath);
+    rmSync35(destPath);
     writeFileSync55(destPath, bytes, { flag: "wx" });
   }
   return bytes.length;