hyperframes 0.8.141 → 0.8.142

package/dist/{chunk-EDYBFSPE.js → chunk-6RAD4BCC.js}

@@ -6,13 +6,14 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   refreshIfNeeded
-} from "./chunk-BRITLL56.js";
+} from "./chunk-B4P5VDFQ.js";
 import {
   buildAuthHeaders,
+  envCredentialVar,
   isAuthError,
   isTokenExpired,
   tryResolveCredential
-} from "./chunk-246MOR5U.js";
+} from "./chunk-DKSDVDXG.js";
 import {
   CSS_URL_RE,
   isNonRelativeUrl,
@@ -204,12 +205,9 @@ async function metadataRequestError(response, fallback) {
 }
 var LOGIN_EXPIRED = "Your login expired. Run hyperframes auth login, then publish again.";
 var LOGIN_CHANGED = "Your login changed during publish. Run publish again.";
-var API_KEY_ENV_VAR = { env: "HEYGEN_API_KEY", env_alias: "HYPERFRAMES_API_KEY" };
 function rejectedCredentialMessage(credential) {
-  if (credential.type === "api_key" && (credential.source === "env" || credential.source === "env_alias")) {
-    return `${API_KEY_ENV_VAR[credential.source]} was rejected. Fix or unset it, then publish again.`;
-  }
-  return LOGIN_EXPIRED;
+  const envVar = envCredentialVar(credential.source);
+  return envVar ? `${envVar} was rejected. Fix or unset it, then publish again.` : LOGIN_EXPIRED;
 }
 async function resolvePublishCredential(checked) {
   try {
@@ -637,7 +635,6 @@ export {
   ensureProjectId,
   readTeamProject,
   writeTeamProject,
-  API_KEY_ENV_VAR,
   resolvePublishCredential,
   rewriteHtmlAttributes,
   buildPublishFileMap,

package/dist/{chunk-4BB7V6AI.js → chunk-6UM3R7PP.js}

@@ -9,7 +9,7 @@ import {
   formatPreviewProxyBox,
   hdrToSdrToneMapFilter,
   parseFirstFrameColour
-} from "./chunk-6E6CM7WS.js";
+} from "./chunk-YFT3BL7N.js";
 import {
   mkdirWithinProject,
   realProjectRoot,

package/dist/{chunk-BM5PX3DJ.js → chunk-6UYZB4TY.js}

@@ -16,7 +16,7 @@ import {
 import {
   formatVariableValidationIssue,
   validateVariables
-} from "./chunk-6E6CM7WS.js";
+} from "./chunk-YFT3BL7N.js";
 import {
   extractCompositionMetadata
 } from "./chunk-OZUQF4NB.js";

package/dist/{chunk-L3JSAB4L.js → chunk-75JJVANE.js}

@@ -8,14 +8,14 @@ import {
   DEFAULT_REGISTRY_URL,
   fetchItemFile,
   validRegistryItem
-} from "./chunk-Q65ZQFF2.js";
+} from "./chunk-QXPCARFE.js";
 import {
   publishRegistryFile,
   registryTargetPath
 } from "./chunk-GMECXFAN.js";
 import {
   validateVariables
-} from "./chunk-6E6CM7WS.js";
+} from "./chunk-YFT3BL7N.js";
 import {
   realProjectRoot
 } from "./chunk-OFQWTKPW.js";

package/dist/{chunk-IV7EI5E2.js → chunk-7FCDA4RH.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-6IHWCZ3W.js";
 import {
   stoppedByCancelSignal
-} from "./chunk-3A5AAPMP.js";
+} from "./chunk-FWRNQOLT.js";
 import {
   DEFAULT_MODEL,
   ensureModel,

package/dist/{chunk-HKCNZITN.js → chunk-AM5L5YIA.js}

@@ -8,7 +8,7 @@ import {
   forceRefreshCredentials,
   resolveCloudAuthHeaders,
   resolveCloudBaseUrl
-} from "./chunk-BRITLL56.js";
+} from "./chunk-B4P5VDFQ.js";
 import {
   errorBox
 } from "./chunk-IHFUKJOR.js";

package/dist/{chunk-BRITLL56.js → chunk-B4P5VDFQ.js}

@@ -9,7 +9,7 @@ import {
   buildAuthHeaders,
   refreshTokens,
   resolveCredential
-} from "./chunk-246MOR5U.js";
+} from "./chunk-DKSDVDXG.js";
 
 // src/cloud/auth.ts
 async function resolveCloudAuthHeaders() {

package/dist/{chunk-IO7ZIDRP.js → chunk-B6SMSALD.js}

@@ -6,24 +6,24 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   serveStaticProjectHtml
-} from "./chunk-34TXESM7.js";
+} from "./chunk-LQASVU3I.js";
 import {
   resolveProject
-} from "./chunk-TC2FBZJZ.js";
+} from "./chunk-LJAU4TPS.js";
 import {
   AUDIT_SEEK_OPTIONS,
   installPageFunctionGuard,
   seekCompositionTimeline,
   waitForCompositionFonts,
   waitForRuntimeReady
-} from "./chunk-XDSOIJC3.js";
+} from "./chunk-WSGY5CDQ.js";
 import {
   launchManagedBrowser,
   resolveManagedGpuMode
-} from "./chunk-O3SKIXQK.js";
+} from "./chunk-OSUKETIH.js";
 import {
   resolveDiagnosticNavigationTimeoutMs
-} from "./chunk-EKA4ZZBI.js";
+} from "./chunk-TY6XOHEM.js";
 import {
   defineCommand
 } from "./chunk-S3S4TGEH.js";
@@ -34,7 +34,7 @@ import {
 import {
   printDeprecationNotice,
   withMeta
-} from "./chunk-IYFKBFTW.js";
+} from "./chunk-JLKMWY2T.js";
 import {
   normalizeErrorMessage
 } from "./chunk-KNU5COPB.js";
@@ -47,6 +47,36 @@ import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
+// src/utils/checkFindings.ts
+var SEVERITY = { info: 0, warning: 1, error: 2 };
+function findingElementKey(finding) {
+  return JSON.stringify([finding.sourceFile, finding.selector]);
+}
+function groupSampledFindings(findings, compareEvidence = () => 0) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const key = JSON.stringify([findingElementKey(finding), finding.code]);
+    const times = finding.times ?? [finding.time];
+    const group = groups.get(key);
+    if (!group) {
+      groups.set(key, { finding, times: new Set(times) });
+      continue;
+    }
+    for (const time of times) group.times.add(time);
+    const severity = SEVERITY[finding.severity] - SEVERITY[group.finding.severity];
+    if (severity > 0 || severity === 0 && compareEvidence(finding, group.finding) > 0) {
+      group.finding = finding;
+    }
+  }
+  return [...groups.values()].map(({ finding, times }) => ({
+    ...finding,
+    times: [...times].sort((a, b) => a - b)
+  }));
+}
+function formatFindingTimes(finding) {
+  return `t=${(finding.times ?? [finding.time]).join(", ")}s`;
+}
+
 // src/utils/layoutAudit.ts
 function buildLayoutSampleTimes({ duration, samples, at }) {
   if (at?.length) {
@@ -73,7 +103,12 @@ function summarizeLayoutIssues(issues) {
   };
 }
 function formatLayoutIssue(issue) {
-  const timeLabel = issue.occurrences && issue.occurrences > 1 ? `t=${formatNumber(issue.firstSeen ?? issue.time)}-${formatNumber(issue.lastSeen ?? issue.time)}s (${issue.occurrences} samples)` : `t=${formatNumber(issue.time)}s`;
+  let timeLabel = `t=${formatNumber(issue.time)}s`;
+  if (issue.times) {
+    timeLabel = formatFindingTimes(issue);
+  } else if (issue.occurrences && issue.occurrences > 1) {
+    timeLabel = `t=${formatNumber(issue.firstSeen ?? issue.time)}-${formatNumber(issue.lastSeen ?? issue.time)}s (${issue.occurrences} samples)`;
+  }
   const parts = [
     timeLabel,
     issue.code,
@@ -91,6 +126,7 @@ function dedupeLayoutIssues(issues) {
   const result = [];
   for (const issue of issues) {
     const key = [
+      Reflect.get(issue, "sourceFile") ?? "",
       issue.code,
       issue.severity,
       issue.time.toFixed(3),
@@ -152,11 +188,11 @@ function collapseStaticLayoutIssues(issues, totalSampleCount) {
     ({ issue, firstSeen, lastSeen, occurrences, times }) => applyPersistenceTier(
       {
         ...issue,
-        time: firstSeen,
         firstSeen,
         lastSeen,
         occurrences,
-        heldMs: longestContiguousRunMs(times)
+        heldMs: longestContiguousRunMs(times),
+        times: [...new Set(times)].sort((a, b) => a - b)
       },
       multiSampleRun
     )
@@ -234,6 +270,7 @@ function severityRank(severity) {
 }
 function staticIssueKey(issue) {
   return [
+    Reflect.get(issue, "sourceFile") ?? "",
     issue.code,
     issue.severity,
     issue.selector,
@@ -670,7 +707,7 @@ async function collectTweenBoundaries(page) {
   });
 }
 async function bundleProjectHtml(projectDir) {
-  const { bundleToSingleHtml } = await import("./compiler-ACHWOU5N.js");
+  const { bundleToSingleHtml } = await import("./compiler-VTH2D3ID.js");
   return bundleToSingleHtml(projectDir);
 }
 async function alignViewportToComposition(page, url) {
@@ -692,8 +729,8 @@ async function alignViewportToComposition(page, url) {
 async function runLayoutAudit(projectDir, opts) {
   const { ensureBrowser } = await import("./manager-CT3D67CG.js");
   const puppeteer = await import("puppeteer-core");
-  const { buildChromeArgs } = await import("./src-I7UC3JTL.js");
-  const { assertWebGpuAdapterAvailable, compositionRequiresWebGpu, resolveLocalBrowserGpuMode } = await import("./gpuPolicy-LYOVBAJP.js");
+  const { buildChromeArgs } = await import("./src-3I3RH3V5.js");
+  const { assertWebGpuAdapterAvailable, compositionRequiresWebGpu, resolveLocalBrowserGpuMode } = await import("./gpuPolicy-LCBWVGEH.js");
   const html = await bundleProjectHtml(projectDir);
   const server = await serveStaticProjectHtml(
     projectDir,
@@ -1056,10 +1093,14 @@ function createInspectCommand(commandName) {
 var layout_default = createInspectCommand("layout");
 
 export {
+  findingElementKey,
+  groupSampledFindings,
+  formatFindingTimes,
   buildLayoutSampleTimes,
   formatLayoutIssue,
   dedupeLayoutIssues,
   collapseStaticLayoutIssues,
+  longestContiguousRunMs,
   limitLayoutIssues,
   buildTransitionSampleTimes,
   mergeSampleTimes,

package/dist/{chunk-XWVGSEUT.js → chunk-BPZVDBHY.js}

@@ -6,7 +6,7 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   VERSION
-} from "./chunk-W6HTOVHU.js";
+} from "./chunk-DZEVA7DI.js";
 
 // src/registry/compatibility.ts
 import { compareVersions } from "compare-versions";

package/dist/{chunk-246MOR5U.js → chunk-DKSDVDXG.js}

@@ -14,6 +14,19 @@ import {
   c
 } from "./chunk-ZTZA4UWZ.js";
 
+// src/auth/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+var CREDENTIAL_FILENAME = "credentials";
+function configDir() {
+  const override = process.env["HEYGEN_CONFIG_DIR"];
+  if (override && override.length > 0) return override;
+  return join(homedir(), ".heygen");
+}
+function credentialPath() {
+  return join(configDir(), CREDENTIAL_FILENAME);
+}
+
 // src/auth/errors.ts
 var AuthError = class extends Error {
   code;
@@ -70,154 +83,6 @@ function isAuthError(err) {
   return err instanceof AuthError;
 }
 
-// src/auth/scrub.ts
-var HEYGEN_KEY = /\b(hg|sk)_[A-Za-z0-9_-]{4,}/g;
-var HEADER_LINE = /(authorization|x-api-key)[ \t]*[:=][ \t]*[^\r\n]+/gi;
-var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
-var SECRET_FIELDS = [
-  "access_token",
-  "refresh_token",
-  "code_verifier",
-  "client_secret",
-  "id_token",
-  "token",
-  "code"
-];
-var FORM_FIELD = new RegExp(`\\b(${SECRET_FIELDS.join("|")})=[^&\\s"']+`, "gi");
-var JSON_FIELD = new RegExp(`("(?:${SECRET_FIELDS.join("|")})"\\s*:\\s*)"[^"]*"`, "gi");
-function scrubCredentials(s) {
-  return s.replace(HEYGEN_KEY, "$1_<redacted>").replace(HEADER_LINE, "$1: <redacted>").replace(JWT, "<jwt-redacted>").replace(FORM_FIELD, "$1=<redacted>").replace(JSON_FIELD, '$1"<redacted>"');
-}
-
-// src/auth/client.ts
-var DEFAULT_BASE_URL = "https://api.heygen.com";
-var HEYGEN_CLI_SOURCE_HEADER = "X-HeyGen-Source";
-var HEYGEN_CLI_SOURCE = "cli";
-var HEYGEN_CLIENT_SOURCE_HEADER = "X-HeyGen-Client-Source";
-var HEYGEN_CLIENT_SOURCE = "hyperframes";
-function apiBaseUrl() {
-  const override = process.env["HEYGEN_API_URL"];
-  return override && override.length > 0 ? override.replace(/\/+$/, "") : DEFAULT_BASE_URL;
-}
-var AuthClient = class {
-  base;
-  fetchImpl;
-  onRefresh;
-  constructor(opts = {}) {
-    this.base = (opts.baseUrl ?? apiBaseUrl()).replace(/\/+$/, "");
-    this.fetchImpl = opts.fetchImpl ?? fetch;
-    this.onRefresh = opts.onUnauthenticatedRefresh;
-  }
-  /**
-   * `GET /v3/users/me`. Throws `ErrUnauthenticated` on 401, `ErrApi`
-   * on any other non-2xx or non-JSON body.
-   *
-   * On OAuth 401 with a refresh hook configured, the request is
-   * retried once after refreshing the access token. The retry's
-   * outcome is what the caller sees — if the refresh itself fails
-   * (REFRESH_FAILED) or the retry still 401s, the user lands on a
-   * "please log in again" path upstream.
-   */
-  async getCurrentUser(credential) {
-    const url = `${this.base}/v3/users/me`;
-    return await this.fetchUser(url, credential, true);
-  }
-  // fallow-ignore-next-line complexity
-  async fetchUser(url, credential, allowRefresh) {
-    const headers = buildAuthHeaders(credential);
-    const res = await this.fetchImpl(url, { method: "GET", headers });
-    if (res.status === 401) {
-      if (allowRefresh && credential.type === "oauth" && credential.refresh_token && this.onRefresh) {
-        const refreshed = await this.tryRefresh(credential.refresh_token);
-        if (refreshed) {
-          const next = {
-            ...credential,
-            access_token: refreshed.access_token,
-            ...refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}
-          };
-          return await this.fetchUser(url, next, false);
-        }
-      }
-      const detail = await safeText(res);
-      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
-    }
-    if (!res.ok) {
-      throw ErrApi(res.status, await safeText(res) || res.statusText);
-    }
-    let payload;
-    try {
-      payload = await res.json();
-    } catch (err) {
-      throw ErrApi(res.status, `non-JSON body: ${err.message}`);
-    }
-    return extractUserInfo(payload);
-  }
-  async tryRefresh(refresh_token) {
-    if (!this.onRefresh) return null;
-    try {
-      return await this.onRefresh(refresh_token);
-    } catch (err) {
-      if (isAuthError(err) && err.code === "REFRESH_FAILED") return null;
-      throw err;
-    }
-  }
-};
-function buildAuthHeaders(credential) {
-  if (credential.type === "oauth") {
-    return {
-      authorization: `Bearer ${credential.access_token}`,
-      [HEYGEN_CLI_SOURCE_HEADER]: HEYGEN_CLI_SOURCE,
-      [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE
-    };
-  }
-  return { "x-api-key": credential.key, [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE };
-}
-async function safeText(res) {
-  try {
-    const body = (await res.text()).slice(0, 500);
-    return scrubCredentials(body);
-  } catch {
-    return "";
-  }
-}
-function extractUserInfo(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
-  const obj = payload;
-  const wrapped = obj["data"];
-  const data = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : obj;
-  return {
-    username: pickString(data, "username"),
-    email: pickString(data, "email"),
-    first_name: pickString(data, "first_name"),
-    last_name: pickString(data, "last_name"),
-    billing_type: pickString(data, "billing_type"),
-    wallet: pickObject(data, "wallet"),
-    subscription: pickObject(data, "subscription"),
-    usage_based: pickObject(data, "usage_based")
-  };
-}
-function pickString(obj, key) {
-  const v = obj[key];
-  return typeof v === "string" ? v : void 0;
-}
-function pickObject(obj, key) {
-  const v = obj[key];
-  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-}
-
-// src/auth/paths.ts
-import { homedir } from "os";
-import { join } from "path";
-var CREDENTIAL_FILENAME = "credentials";
-function configDir() {
-  const override = process.env["HEYGEN_CONFIG_DIR"];
-  if (override && override.length > 0) return override;
-  return join(homedir(), ".heygen");
-}
-function credentialPath() {
-  return join(configDir(), CREDENTIAL_FILENAME);
-}
-
 // src/auth/store.ts
 import { promises as fs } from "fs";
 import { dirname } from "path";
@@ -451,23 +316,27 @@ function looksLikeApiKey(s) {
 }
 
 // src/auth/resolver.ts
+var ENV_CREDENTIAL_VAR = {
+  env: "HEYGEN_API_KEY",
+  env_alias: "HYPERFRAMES_API_KEY",
+  env_oauth: "HEYGEN_ACCESS_TOKEN"
+};
+var envCredentialVar = (source) => source in ENV_CREDENTIAL_VAR ? ENV_CREDENTIAL_VAR[source] : void 0;
 var EXPIRY_SKEW_MS = 60 * 1e3;
 async function resolveCredential(opts = {}) {
   const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  const heygenEnv = process.env["HEYGEN_API_KEY"];
-  if (heygenEnv && heygenEnv.length > 0) {
-    if (!isHeaderSafe(heygenEnv)) {
-      throw ErrInvalidStore("HEYGEN_API_KEY contains control characters");
-    }
+  const heygenEnv = headerSafeEnv(ENV_CREDENTIAL_VAR.env);
+  if (heygenEnv) {
     return { type: "api_key", key: heygenEnv, source: "env" };
   }
-  const hfEnv = process.env["HYPERFRAMES_API_KEY"];
-  if (hfEnv && hfEnv.length > 0) {
-    if (!isHeaderSafe(hfEnv)) {
-      throw ErrInvalidStore("HYPERFRAMES_API_KEY contains control characters");
-    }
+  const hfEnv = headerSafeEnv(ENV_CREDENTIAL_VAR.env_alias);
+  if (hfEnv) {
     return { type: "api_key", key: hfEnv, source: "env_alias" };
   }
+  const accessToken = headerSafeEnv(ENV_CREDENTIAL_VAR.env_oauth);
+  if (accessToken) {
+    return { type: "oauth", access_token: accessToken, source: "env_oauth", refreshable: false };
+  }
   const { credentials, source } = await readStore();
   if (source === "absent") throw ErrNotConfigured();
   const fileSource = source === "file_legacy" ? "file_legacy" : "file_json";
@@ -478,6 +347,13 @@ async function resolveCredential(opts = {}) {
   }
   throw credentials.oauth ? ErrLoginExpired() : ErrNotConfigured();
 }
+function headerSafeEnv(name) {
+  const value = process.env[name];
+  if (value && !isHeaderSafe(value)) {
+    throw ErrInvalidStore(`${name} contains control characters`);
+  }
+  return value;
+}
 async function tryResolveCredential(opts = {}) {
   try {
     return await resolveCredential(opts);
@@ -512,6 +388,141 @@ function parseDate(s) {
   return Number.isNaN(d.getTime()) ? void 0 : d;
 }
 
+// src/auth/scrub.ts
+var HEYGEN_KEY = /\b(hg|sk)_[A-Za-z0-9_-]{4,}/g;
+var HEADER_LINE = /(authorization|x-api-key)[ \t]*[:=][ \t]*[^\r\n]+/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+var SECRET_FIELDS = [
+  "access_token",
+  "refresh_token",
+  "code_verifier",
+  "client_secret",
+  "id_token",
+  "token",
+  "code"
+];
+var FORM_FIELD = new RegExp(`\\b(${SECRET_FIELDS.join("|")})=[^&\\s"']+`, "gi");
+var JSON_FIELD = new RegExp(`("(?:${SECRET_FIELDS.join("|")})"\\s*:\\s*)"[^"]*"`, "gi");
+function scrubCredentials(s) {
+  return s.replace(HEYGEN_KEY, "$1_<redacted>").replace(HEADER_LINE, "$1: <redacted>").replace(JWT, "<jwt-redacted>").replace(FORM_FIELD, "$1=<redacted>").replace(JSON_FIELD, '$1"<redacted>"');
+}
+
+// src/auth/client.ts
+var DEFAULT_BASE_URL = "https://api.heygen.com";
+var HEYGEN_CLI_SOURCE_HEADER = "X-HeyGen-Source";
+var HEYGEN_CLI_SOURCE = "cli";
+var HEYGEN_CLIENT_SOURCE_HEADER = "X-HeyGen-Client-Source";
+var HEYGEN_CLIENT_SOURCE = "hyperframes";
+function apiBaseUrl() {
+  const override = process.env["HEYGEN_API_URL"];
+  return override && override.length > 0 ? override.replace(/\/+$/, "") : DEFAULT_BASE_URL;
+}
+var AuthClient = class {
+  base;
+  fetchImpl;
+  onRefresh;
+  constructor(opts = {}) {
+    this.base = (opts.baseUrl ?? apiBaseUrl()).replace(/\/+$/, "");
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.onRefresh = opts.onUnauthenticatedRefresh;
+  }
+  /**
+   * `GET /v3/users/me`. Throws `ErrUnauthenticated` on 401, `ErrApi`
+   * on any other non-2xx or non-JSON body.
+   *
+   * On OAuth 401 with a refresh hook configured, the request is
+   * retried once after refreshing the access token. The retry's
+   * outcome is what the caller sees — if the refresh itself fails
+   * (REFRESH_FAILED) or the retry still 401s, the user lands on a
+   * "please log in again" path upstream.
+   */
+  async getCurrentUser(credential) {
+    const url = `${this.base}/v3/users/me`;
+    return await this.fetchUser(url, credential, true);
+  }
+  // fallow-ignore-next-line complexity
+  async fetchUser(url, credential, allowRefresh) {
+    const headers = buildAuthHeaders(credential);
+    const res = await this.fetchImpl(url, { method: "GET", headers });
+    if (res.status === 401) {
+      if (allowRefresh && credential.type === "oauth" && credential.refresh_token && this.onRefresh) {
+        const refreshed = await this.tryRefresh(credential.refresh_token);
+        if (refreshed) {
+          const next = {
+            ...credential,
+            access_token: refreshed.access_token,
+            ...refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}
+          };
+          return await this.fetchUser(url, next, false);
+        }
+      }
+      const detail = await safeText(res);
+      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
+    }
+    if (!res.ok) {
+      throw ErrApi(res.status, await safeText(res) || res.statusText);
+    }
+    let payload;
+    try {
+      payload = await res.json();
+    } catch (err) {
+      throw ErrApi(res.status, `non-JSON body: ${err.message}`);
+    }
+    return extractUserInfo(payload);
+  }
+  async tryRefresh(refresh_token) {
+    if (!this.onRefresh) return null;
+    try {
+      return await this.onRefresh(refresh_token);
+    } catch (err) {
+      if (isAuthError(err) && err.code === "REFRESH_FAILED") return null;
+      throw err;
+    }
+  }
+};
+function buildAuthHeaders(credential) {
+  if (credential.type === "oauth") {
+    return {
+      authorization: `Bearer ${credential.access_token}`,
+      [HEYGEN_CLI_SOURCE_HEADER]: HEYGEN_CLI_SOURCE,
+      [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE
+    };
+  }
+  return { "x-api-key": credential.key, [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE };
+}
+async function safeText(res) {
+  try {
+    const body = (await res.text()).slice(0, 500);
+    return scrubCredentials(body);
+  } catch {
+    return "";
+  }
+}
+function extractUserInfo(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
+  const obj = payload;
+  const wrapped = obj["data"];
+  const data = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : obj;
+  return {
+    username: pickString(data, "username"),
+    email: pickString(data, "email"),
+    first_name: pickString(data, "first_name"),
+    last_name: pickString(data, "last_name"),
+    billing_type: pickString(data, "billing_type"),
+    wallet: pickObject(data, "wallet"),
+    subscription: pickObject(data, "subscription"),
+    usage_based: pickObject(data, "usage_based")
+  };
+}
+function pickString(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" ? v : void 0;
+}
+function pickObject(obj, key) {
+  const v = obj[key];
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+
 // src/auth/pkce.ts
 import { createHash, randomBytes } from "crypto";
 var VERIFIER_BYTES = 64;
@@ -1190,21 +1201,23 @@ async function safeText2(res) {
 }
 
 export {
-  isAuthError,
-  apiBaseUrl,
-  AuthClient,
-  buildAuthHeaders,
   configDir,
   credentialPath,
+  isAuthError,
   readStore,
   writeStore,
   deleteStore,
   hasPreservedUnknownData,
   clearOAuth,
   isHeaderSafe,
+  ENV_CREDENTIAL_VAR,
+  envCredentialVar,
   resolveCredential,
   tryResolveCredential,
   isTokenExpired,
+  apiBaseUrl,
+  AuthClient,
+  buildAuthHeaders,
   assertOAuthConfiguredOrExit,
   startAuthorizationCodeFlow,
   startDeviceAuthorizationFlow,

package/dist/{chunk-35RSNI77.js → chunk-DPHJKWP5.js}

@@ -35,7 +35,7 @@ import {
   stripEmbeddedRuntimeScripts,
   styleElementsFor,
   warnUnknownEnumValues
-} from "./chunk-SYKKFAUW.js";
+} from "./chunk-J4UX3RS3.js";
 import {
   cssVariableName
 } from "./chunk-VC76R6W2.js";
@@ -45,7 +45,7 @@ import {
 } from "./chunk-OFQWTKPW.js";
 import {
   lintHyperframeHtml
-} from "./chunk-WY5OODN5.js";
+} from "./chunk-IW2CKH6A.js";
 import {
   CSS_URL_RE,
   checkSubCompositionUsability,