hyperframes 0.8.141 → 0.8.143

package/dist/{chunk-246MOR5U.js → chunk-DKSDVDXG.js}

@@ -14,6 +14,19 @@ import {
   c
 } from "./chunk-ZTZA4UWZ.js";
 
+// src/auth/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+var CREDENTIAL_FILENAME = "credentials";
+function configDir() {
+  const override = process.env["HEYGEN_CONFIG_DIR"];
+  if (override && override.length > 0) return override;
+  return join(homedir(), ".heygen");
+}
+function credentialPath() {
+  return join(configDir(), CREDENTIAL_FILENAME);
+}
+
 // src/auth/errors.ts
 var AuthError = class extends Error {
   code;
@@ -70,154 +83,6 @@ function isAuthError(err) {
   return err instanceof AuthError;
 }
 
-// src/auth/scrub.ts
-var HEYGEN_KEY = /\b(hg|sk)_[A-Za-z0-9_-]{4,}/g;
-var HEADER_LINE = /(authorization|x-api-key)[ \t]*[:=][ \t]*[^\r\n]+/gi;
-var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
-var SECRET_FIELDS = [
-  "access_token",
-  "refresh_token",
-  "code_verifier",
-  "client_secret",
-  "id_token",
-  "token",
-  "code"
-];
-var FORM_FIELD = new RegExp(`\\b(${SECRET_FIELDS.join("|")})=[^&\\s"']+`, "gi");
-var JSON_FIELD = new RegExp(`("(?:${SECRET_FIELDS.join("|")})"\\s*:\\s*)"[^"]*"`, "gi");
-function scrubCredentials(s) {
-  return s.replace(HEYGEN_KEY, "$1_<redacted>").replace(HEADER_LINE, "$1: <redacted>").replace(JWT, "<jwt-redacted>").replace(FORM_FIELD, "$1=<redacted>").replace(JSON_FIELD, '$1"<redacted>"');
-}
-
-// src/auth/client.ts
-var DEFAULT_BASE_URL = "https://api.heygen.com";
-var HEYGEN_CLI_SOURCE_HEADER = "X-HeyGen-Source";
-var HEYGEN_CLI_SOURCE = "cli";
-var HEYGEN_CLIENT_SOURCE_HEADER = "X-HeyGen-Client-Source";
-var HEYGEN_CLIENT_SOURCE = "hyperframes";
-function apiBaseUrl() {
-  const override = process.env["HEYGEN_API_URL"];
-  return override && override.length > 0 ? override.replace(/\/+$/, "") : DEFAULT_BASE_URL;
-}
-var AuthClient = class {
-  base;
-  fetchImpl;
-  onRefresh;
-  constructor(opts = {}) {
-    this.base = (opts.baseUrl ?? apiBaseUrl()).replace(/\/+$/, "");
-    this.fetchImpl = opts.fetchImpl ?? fetch;
-    this.onRefresh = opts.onUnauthenticatedRefresh;
-  }
-  /**
-   * `GET /v3/users/me`. Throws `ErrUnauthenticated` on 401, `ErrApi`
-   * on any other non-2xx or non-JSON body.
-   *
-   * On OAuth 401 with a refresh hook configured, the request is
-   * retried once after refreshing the access token. The retry's
-   * outcome is what the caller sees — if the refresh itself fails
-   * (REFRESH_FAILED) or the retry still 401s, the user lands on a
-   * "please log in again" path upstream.
-   */
-  async getCurrentUser(credential) {
-    const url = `${this.base}/v3/users/me`;
-    return await this.fetchUser(url, credential, true);
-  }
-  // fallow-ignore-next-line complexity
-  async fetchUser(url, credential, allowRefresh) {
-    const headers = buildAuthHeaders(credential);
-    const res = await this.fetchImpl(url, { method: "GET", headers });
-    if (res.status === 401) {
-      if (allowRefresh && credential.type === "oauth" && credential.refresh_token && this.onRefresh) {
-        const refreshed = await this.tryRefresh(credential.refresh_token);
-        if (refreshed) {
-          const next = {
-            ...credential,
-            access_token: refreshed.access_token,
-            ...refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}
-          };
-          return await this.fetchUser(url, next, false);
-        }
-      }
-      const detail = await safeText(res);
-      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
-    }
-    if (!res.ok) {
-      throw ErrApi(res.status, await safeText(res) || res.statusText);
-    }
-    let payload;
-    try {
-      payload = await res.json();
-    } catch (err) {
-      throw ErrApi(res.status, `non-JSON body: ${err.message}`);
-    }
-    return extractUserInfo(payload);
-  }
-  async tryRefresh(refresh_token) {
-    if (!this.onRefresh) return null;
-    try {
-      return await this.onRefresh(refresh_token);
-    } catch (err) {
-      if (isAuthError(err) && err.code === "REFRESH_FAILED") return null;
-      throw err;
-    }
-  }
-};
-function buildAuthHeaders(credential) {
-  if (credential.type === "oauth") {
-    return {
-      authorization: `Bearer ${credential.access_token}`,
-      [HEYGEN_CLI_SOURCE_HEADER]: HEYGEN_CLI_SOURCE,
-      [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE
-    };
-  }
-  return { "x-api-key": credential.key, [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE };
-}
-async function safeText(res) {
-  try {
-    const body = (await res.text()).slice(0, 500);
-    return scrubCredentials(body);
-  } catch {
-    return "";
-  }
-}
-function extractUserInfo(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
-  const obj = payload;
-  const wrapped = obj["data"];
-  const data = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : obj;
-  return {
-    username: pickString(data, "username"),
-    email: pickString(data, "email"),
-    first_name: pickString(data, "first_name"),
-    last_name: pickString(data, "last_name"),
-    billing_type: pickString(data, "billing_type"),
-    wallet: pickObject(data, "wallet"),
-    subscription: pickObject(data, "subscription"),
-    usage_based: pickObject(data, "usage_based")
-  };
-}
-function pickString(obj, key) {
-  const v = obj[key];
-  return typeof v === "string" ? v : void 0;
-}
-function pickObject(obj, key) {
-  const v = obj[key];
-  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-}
-
-// src/auth/paths.ts
-import { homedir } from "os";
-import { join } from "path";
-var CREDENTIAL_FILENAME = "credentials";
-function configDir() {
-  const override = process.env["HEYGEN_CONFIG_DIR"];
-  if (override && override.length > 0) return override;
-  return join(homedir(), ".heygen");
-}
-function credentialPath() {
-  return join(configDir(), CREDENTIAL_FILENAME);
-}
-
 // src/auth/store.ts
 import { promises as fs } from "fs";
 import { dirname } from "path";
@@ -451,23 +316,27 @@ function looksLikeApiKey(s) {
 }
 
 // src/auth/resolver.ts
+var ENV_CREDENTIAL_VAR = {
+  env: "HEYGEN_API_KEY",
+  env_alias: "HYPERFRAMES_API_KEY",
+  env_oauth: "HEYGEN_ACCESS_TOKEN"
+};
+var envCredentialVar = (source) => source in ENV_CREDENTIAL_VAR ? ENV_CREDENTIAL_VAR[source] : void 0;
 var EXPIRY_SKEW_MS = 60 * 1e3;
 async function resolveCredential(opts = {}) {
   const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  const heygenEnv = process.env["HEYGEN_API_KEY"];
-  if (heygenEnv && heygenEnv.length > 0) {
-    if (!isHeaderSafe(heygenEnv)) {
-      throw ErrInvalidStore("HEYGEN_API_KEY contains control characters");
-    }
+  const heygenEnv = headerSafeEnv(ENV_CREDENTIAL_VAR.env);
+  if (heygenEnv) {
     return { type: "api_key", key: heygenEnv, source: "env" };
   }
-  const hfEnv = process.env["HYPERFRAMES_API_KEY"];
-  if (hfEnv && hfEnv.length > 0) {
-    if (!isHeaderSafe(hfEnv)) {
-      throw ErrInvalidStore("HYPERFRAMES_API_KEY contains control characters");
-    }
+  const hfEnv = headerSafeEnv(ENV_CREDENTIAL_VAR.env_alias);
+  if (hfEnv) {
     return { type: "api_key", key: hfEnv, source: "env_alias" };
   }
+  const accessToken = headerSafeEnv(ENV_CREDENTIAL_VAR.env_oauth);
+  if (accessToken) {
+    return { type: "oauth", access_token: accessToken, source: "env_oauth", refreshable: false };
+  }
   const { credentials, source } = await readStore();
   if (source === "absent") throw ErrNotConfigured();
   const fileSource = source === "file_legacy" ? "file_legacy" : "file_json";
@@ -478,6 +347,13 @@ async function resolveCredential(opts = {}) {
   }
   throw credentials.oauth ? ErrLoginExpired() : ErrNotConfigured();
 }
+function headerSafeEnv(name) {
+  const value = process.env[name];
+  if (value && !isHeaderSafe(value)) {
+    throw ErrInvalidStore(`${name} contains control characters`);
+  }
+  return value;
+}
 async function tryResolveCredential(opts = {}) {
   try {
     return await resolveCredential(opts);
@@ -512,6 +388,141 @@ function parseDate(s) {
   return Number.isNaN(d.getTime()) ? void 0 : d;
 }
 
+// src/auth/scrub.ts
+var HEYGEN_KEY = /\b(hg|sk)_[A-Za-z0-9_-]{4,}/g;
+var HEADER_LINE = /(authorization|x-api-key)[ \t]*[:=][ \t]*[^\r\n]+/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+var SECRET_FIELDS = [
+  "access_token",
+  "refresh_token",
+  "code_verifier",
+  "client_secret",
+  "id_token",
+  "token",
+  "code"
+];
+var FORM_FIELD = new RegExp(`\\b(${SECRET_FIELDS.join("|")})=[^&\\s"']+`, "gi");
+var JSON_FIELD = new RegExp(`("(?:${SECRET_FIELDS.join("|")})"\\s*:\\s*)"[^"]*"`, "gi");
+function scrubCredentials(s) {
+  return s.replace(HEYGEN_KEY, "$1_<redacted>").replace(HEADER_LINE, "$1: <redacted>").replace(JWT, "<jwt-redacted>").replace(FORM_FIELD, "$1=<redacted>").replace(JSON_FIELD, '$1"<redacted>"');
+}
+
+// src/auth/client.ts
+var DEFAULT_BASE_URL = "https://api.heygen.com";
+var HEYGEN_CLI_SOURCE_HEADER = "X-HeyGen-Source";
+var HEYGEN_CLI_SOURCE = "cli";
+var HEYGEN_CLIENT_SOURCE_HEADER = "X-HeyGen-Client-Source";
+var HEYGEN_CLIENT_SOURCE = "hyperframes";
+function apiBaseUrl() {
+  const override = process.env["HEYGEN_API_URL"];
+  return override && override.length > 0 ? override.replace(/\/+$/, "") : DEFAULT_BASE_URL;
+}
+var AuthClient = class {
+  base;
+  fetchImpl;
+  onRefresh;
+  constructor(opts = {}) {
+    this.base = (opts.baseUrl ?? apiBaseUrl()).replace(/\/+$/, "");
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.onRefresh = opts.onUnauthenticatedRefresh;
+  }
+  /**
+   * `GET /v3/users/me`. Throws `ErrUnauthenticated` on 401, `ErrApi`
+   * on any other non-2xx or non-JSON body.
+   *
+   * On OAuth 401 with a refresh hook configured, the request is
+   * retried once after refreshing the access token. The retry's
+   * outcome is what the caller sees — if the refresh itself fails
+   * (REFRESH_FAILED) or the retry still 401s, the user lands on a
+   * "please log in again" path upstream.
+   */
+  async getCurrentUser(credential) {
+    const url = `${this.base}/v3/users/me`;
+    return await this.fetchUser(url, credential, true);
+  }
+  // fallow-ignore-next-line complexity
+  async fetchUser(url, credential, allowRefresh) {
+    const headers = buildAuthHeaders(credential);
+    const res = await this.fetchImpl(url, { method: "GET", headers });
+    if (res.status === 401) {
+      if (allowRefresh && credential.type === "oauth" && credential.refresh_token && this.onRefresh) {
+        const refreshed = await this.tryRefresh(credential.refresh_token);
+        if (refreshed) {
+          const next = {
+            ...credential,
+            access_token: refreshed.access_token,
+            ...refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}
+          };
+          return await this.fetchUser(url, next, false);
+        }
+      }
+      const detail = await safeText(res);
+      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
+    }
+    if (!res.ok) {
+      throw ErrApi(res.status, await safeText(res) || res.statusText);
+    }
+    let payload;
+    try {
+      payload = await res.json();
+    } catch (err) {
+      throw ErrApi(res.status, `non-JSON body: ${err.message}`);
+    }
+    return extractUserInfo(payload);
+  }
+  async tryRefresh(refresh_token) {
+    if (!this.onRefresh) return null;
+    try {
+      return await this.onRefresh(refresh_token);
+    } catch (err) {
+      if (isAuthError(err) && err.code === "REFRESH_FAILED") return null;
+      throw err;
+    }
+  }
+};
+function buildAuthHeaders(credential) {
+  if (credential.type === "oauth") {
+    return {
+      authorization: `Bearer ${credential.access_token}`,
+      [HEYGEN_CLI_SOURCE_HEADER]: HEYGEN_CLI_SOURCE,
+      [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE
+    };
+  }
+  return { "x-api-key": credential.key, [HEYGEN_CLIENT_SOURCE_HEADER]: HEYGEN_CLIENT_SOURCE };
+}
+async function safeText(res) {
+  try {
+    const body = (await res.text()).slice(0, 500);
+    return scrubCredentials(body);
+  } catch {
+    return "";
+  }
+}
+function extractUserInfo(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
+  const obj = payload;
+  const wrapped = obj["data"];
+  const data = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : obj;
+  return {
+    username: pickString(data, "username"),
+    email: pickString(data, "email"),
+    first_name: pickString(data, "first_name"),
+    last_name: pickString(data, "last_name"),
+    billing_type: pickString(data, "billing_type"),
+    wallet: pickObject(data, "wallet"),
+    subscription: pickObject(data, "subscription"),
+    usage_based: pickObject(data, "usage_based")
+  };
+}
+function pickString(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" ? v : void 0;
+}
+function pickObject(obj, key) {
+  const v = obj[key];
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+
 // src/auth/pkce.ts
 import { createHash, randomBytes } from "crypto";
 var VERIFIER_BYTES = 64;
@@ -1190,21 +1201,23 @@ async function safeText2(res) {
 }
 
 export {
-  isAuthError,
-  apiBaseUrl,
-  AuthClient,
-  buildAuthHeaders,
   configDir,
   credentialPath,
+  isAuthError,
   readStore,
   writeStore,
   deleteStore,
   hasPreservedUnknownData,
   clearOAuth,
   isHeaderSafe,
+  ENV_CREDENTIAL_VAR,
+  envCredentialVar,
   resolveCredential,
   tryResolveCredential,
   isTokenExpired,
+  apiBaseUrl,
+  AuthClient,
+  buildAuthHeaders,
   assertOAuthConfiguredOrExit,
   startAuthorizationCodeFlow,
   startDeviceAuthorizationFlow,

package/dist/{chunk-35RSNI77.js → chunk-F26LCYRY.js}

@@ -6,7 +6,7 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   ensureHfIds
-} from "./chunk-A4KQZXZI.js";
+} from "./chunk-NE55C6S5.js";
 import {
   HF_COLOR_GRADING_ATTR,
   INLINED_FILE_ATTR,
@@ -35,7 +35,7 @@ import {
   stripEmbeddedRuntimeScripts,
   styleElementsFor,
   warnUnknownEnumValues
-} from "./chunk-SYKKFAUW.js";
+} from "./chunk-6TPZSTCL.js";
 import {
   cssVariableName
 } from "./chunk-VC76R6W2.js";
@@ -45,25 +45,32 @@ import {
 } from "./chunk-OFQWTKPW.js";
 import {
   lintHyperframeHtml
-} from "./chunk-WY5OODN5.js";
+} from "./chunk-XONFUK3M.js";
 import {
-  CSS_URL_RE,
   checkSubCompositionUsability,
+  resolveSubCompositionContent
+} from "./chunk-3RM2ETQT.js";
+import {
+  CSS_URL_RE,
+  decodeCssEscapes,
+  decodeWellFormedEscapes,
+  decodedUrlPath,
+  encodeUrlPath,
   isNonRelativeUrl,
-  resolveSubCompositionContent,
   rewriteAssetPath,
   rewriteAssetPaths,
   rewriteCssAssetUrls,
-  rewriteInlineStyleAssetUrls
-} from "./chunk-TQFG7HTI.js";
+  rewriteInlineStyleAssetUrls,
+  splitUrlSuffix
+} from "./chunk-ZLW2V65P.js";
 import {
   parseHTML
-} from "./chunk-GK4AIFIH.js";
+} from "./chunk-SDYDNHEE.js";
 
 // ../core/dist/compiler/htmlCompiler.js
 import { resolve } from "path";
 function resolveMediaSrc(src, projectDir) {
-  return src.startsWith("http://") || src.startsWith("https://") ? src : resolve(projectDir, src);
+  return src.startsWith("http://") || src.startsWith("https://") ? src : resolve(projectDir, decodedUrlPath(src));
 }
 async function compileHtml(rawHtml, projectDir, probeMediaDuration) {
   const { html: staticCompiled, unresolved } = compileTimingAttrs(rawHtml);
@@ -88,6 +95,9 @@ async function compileHtml(rawHtml, projectDir, probeMediaDuration) {
       html = injectDurations(html, resolutions);
     }
   }
+  return clampProbedMedia(html, projectDir, probeMediaDuration);
+}
+async function clampProbedMedia(html, projectDir, probeMediaDuration) {
   const preResolved = extractResolvedMedia(html);
   const clampList = [];
   for (const el of preResolved) {
@@ -1870,30 +1880,35 @@ function withCommentsStripped(css, fn) {
   };
   return { result, restore };
 }
+function resolveRelativeUrlPath(fromDir, basePath) {
+  return resolve2(fromDir, decodeWellFormedEscapes(basePath.replaceAll("\\", "/")));
+}
 function rebaseCssUrls(css, cssFileDir, projectDir) {
   const resolvedRoot = resolve2(projectDir);
   const resolvedDir = resolve2(cssFileDir);
   if (resolvedDir === resolvedRoot)
     return css;
   return css.replace(CSS_URL_RE, (full, quote, urlValue) => {
-    if (!urlValue || !isRelativeUrl(urlValue))
+    const decoded = decodeCssEscapes(urlValue);
+    if (!decoded || !isRelativeUrl(decoded))
       return full;
-    const { basePath, suffix } = splitUrlSuffix(urlValue.trim());
+    const { basePath, suffix } = splitUrlSuffix(decoded);
     if (!basePath)
       return full;
-    const absolutePath = resolve2(resolvedDir, basePath);
-    const rebased = relative(resolvedRoot, absolutePath).split(sep).join("/");
+    const absolutePath = resolveRelativeUrlPath(resolvedDir, basePath);
+    const rebased = encodeUrlPath(relative(resolvedRoot, absolutePath).split(sep).join("/"));
     if (rebased === basePath)
       return full;
-    return `url(${quote || ""}${rebased}${suffix}${quote || ""})`;
+    const escapedSuffix = suffix.replace(/[\s\p{Cc}"'()\\<>]/gu, (char) => `\\${char.codePointAt(0).toString(16).padStart(6, "0")}`);
+    return `url(${quote || ""}${rebased}${escapedSuffix}${quote || ""})`;
   });
 }
 function rebaseRelativePath(urlValue, fromDir, toDir) {
   const { basePath, suffix } = splitUrlSuffix(urlValue.trim());
   if (!basePath)
     return urlValue;
-  const absolutePath = resolve2(fromDir, basePath);
-  const rebased = relative(resolve2(toDir), absolutePath).split(sep).join("/");
+  const absolutePath = resolveRelativeUrlPath(fromDir, basePath);
+  const rebased = encodeUrlPath(relative(resolve2(toDir), absolutePath).split(sep).join("/"));
   return appendSuffixToUrl(rebased, suffix);
 }
 function rebaseSrcsetPaths(srcsetValue, fromDir, toDir) {
@@ -1976,7 +1991,7 @@ function inlineCssFile(css, cssFileDir, projectDir, visited = /* @__PURE__ */ ne
     const importPath = urlPath ?? barePath;
     if (!importPath || !isRelativeUrl(importPath))
       return full;
-    const resolved = resolve2(cssFileDir, importPath);
+    const resolved = resolve2(cssFileDir, decodedUrlPath(importPath));
     if (!isSafePath(projectDir, resolved))
       return full;
     if (visited.has(resolved))
@@ -2012,14 +2027,6 @@ function safeReadFileBuffer(filePath) {
     return null;
   }
 }
-function splitUrlSuffix(urlValue) {
-  const queryIdx = urlValue.indexOf("?");
-  const hashIdx = urlValue.indexOf("#");
-  if (queryIdx < 0 && hashIdx < 0)
-    return { basePath: urlValue, suffix: "" };
-  const cutIdx = queryIdx < 0 ? hashIdx : hashIdx < 0 ? queryIdx : Math.min(queryIdx, hashIdx);
-  return { basePath: urlValue.slice(0, cutIdx), suffix: urlValue.slice(cutIdx) };
-}
 function appendSuffixToUrl(baseUrl, suffix) {
   if (!suffix)
     return baseUrl;
@@ -2081,7 +2088,7 @@ function maybeInlineRelativeAssetUrl(urlValue, projectDir, inlineAssets) {
   const { basePath, suffix } = splitUrlSuffix(urlValue.trim());
   if (!basePath)
     return null;
-  const filePath = resolveWithinProject(projectDir, basePath);
+  const filePath = resolveWithinProject(projectDir, decodeWellFormedEscapes(basePath));
   if (!filePath)
     return null;
   const ext = filePath.toLowerCase().match(/\.[^.]+$/)?.[0] ?? "";
@@ -2454,10 +2461,10 @@ function hoistExternalScript(src, projectDir, doc, seenSrcs, chunks, attributes)
     return;
   seenSrcs.add(src);
   if (!isNonRelativeUrl(src) && !isAbsolute(src) && attributes.type !== "module") {
-    const jsPath = resolveWithinProject(projectDir, src);
+    const jsPath = resolveWithinProject(projectDir, decodedUrlPath(src));
     const js = jsPath ? safeReadFile(jsPath) : null;
     if (js != null) {
-      chunks.push(() => preserveLocalScriptIntegrity(doc, src, (value) => resolveWithinProject(projectDir, value)) ? "" : js);
+      chunks.push(() => preserveLocalScriptIntegrity(doc, src, (value) => resolveWithinProject(projectDir, decodedUrlPath(value))) ? "" : js);
       return;
     }
   }
@@ -2489,6 +2496,7 @@ async function bundleProject(projectDir, options) {
     const resolved = resolve2(sourceDir, relativePath);
     return isSafePath(projectDir, resolved) ? resolved : null;
   };
+  const resolveEntryUrl = (url) => resolveEntryPath(decodedUrlPath(url));
   const readSource = options?.stampHfIds ? ensureHfIds : (html) => html;
   noteRead(indexPath);
   const rawHtml = readSource(readFileSync(indexPath, "utf-8"));
@@ -2510,7 +2518,7 @@ async function bundleProject(projectDir, options) {
       continue;
     if (el.hasAttribute("disabled"))
       continue;
-    const cssPath = resolveEntryPath(href);
+    const cssPath = resolveEntryUrl(href);
     if (!cssPath)
       continue;
     const css = safeReadFile(cssPath);
@@ -2532,7 +2540,7 @@ async function bundleProject(projectDir, options) {
     ])
   ].map((el) => {
     const src = el.getAttribute("src");
-    const path = src && isRelativeUrl(src) ? resolveEntryPath(src) : null;
+    const path = src && isRelativeUrl(src) ? resolveEntryUrl(src) : null;
     return src ? path && safeReadFile(path) || "" : el.textContent || "";
   }) : [];
   const trackedCompositionHosts = getBundledTrackedCompositionHosts(document);
@@ -2594,10 +2602,10 @@ async function bundleProject(projectDir, options) {
       continue;
     seenCompScriptSrcs.add(extSrc);
     if (isRelativeUrl(extSrc) && scriptItem.type !== "module") {
-      const jsPath = resolveEntryPath(extSrc);
+      const jsPath = resolveEntryUrl(extSrc);
       const js = jsPath ? safeReadFile(jsPath) : null;
       if (js != null) {
-        const chunk = () => preserveLocalScriptIntegrity(document, extSrc, resolveEntryPath) ? "" : js;
+        const chunk = () => preserveLocalScriptIntegrity(document, extSrc, resolveEntryUrl) ? "" : js;
         pushRun(scriptRuns, scriptItem.scene, chunk);
         continue;
       }
@@ -2690,11 +2698,11 @@ async function bundleProject(projectDir, options) {
     const src = el.getAttribute("src");
     if (!src || !isRelativeUrl(src))
       continue;
-    if (preserveLocalScriptIntegrity(document, src, resolveEntryPath))
+    if (preserveLocalScriptIntegrity(document, src, resolveEntryUrl))
       continue;
     if ((el.getAttribute("type") || "").trim().toLowerCase() === "module")
       continue;
-    const jsPath = resolveEntryPath(src);
+    const jsPath = resolveEntryUrl(src);
     const js = jsPath ? safeReadFile(jsPath) : null;
     if (js == null)
       continue;

package/dist/{chunk-5Z63TBTX.js → chunk-FH7WODJH.js}

@@ -6,7 +6,7 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   ensureDOMParser
-} from "./chunk-PFCFR3KZ.js";
+} from "./chunk-442JNXRM.js";
 
 // src/utils/compositionViewport.ts
 var DEFAULT_VIEWPORT = { width: 1920, height: 1080 };

package/dist/{chunk-NORZWWLK.js → chunk-FVYXDXEV.js}

@@ -6,10 +6,10 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   getMimeType
-} from "./chunk-6Q6FR4KH.js";
+} from "./chunk-7UYBQ6NF.js";
 import {
   injectTagsAtHeadStart
-} from "./chunk-SYKKFAUW.js";
+} from "./chunk-6TPZSTCL.js";
 
 // src/utils/compositionServer.ts
 import { createHash } from "crypto";

package/dist/{chunk-YURXPGAM.js → chunk-GNBGPUJ7.js}

@@ -10,7 +10,7 @@ import {
 import {
   ensureModel,
   selectProviders
-} from "./chunk-2NCHQUPX.js";
+} from "./chunk-SQLK7SJL.js";
 import {
   findFFmpeg,
   findFFprobe,
@@ -18,8 +18,9 @@ import {
 } from "./chunk-TVCRUG2S.js";
 import {
   DEFAULT_VP9_CPU_USED,
+  SDR_RGB_TO_BT709_FILTER,
   renderProvenanceArgs
-} from "./chunk-E6SDW5FV.js";
+} from "./chunk-33RZPZ4K.js";
 
 // src/background-removal/pipeline.ts
 import { spawn } from "child_process";
@@ -202,7 +203,7 @@ function inferInputKind(inputPath) {
 }
 async function probeMedia(inputPath) {
   const isImage = inferInputKind(inputPath) === "image";
-  const engine = await import("./src-I7UC3JTL.js");
+  const engine = await import("./src-JO5JOV7Y.js");
   const meta = await engine.extractMediaMetadata(inputPath);
   if (isImage) {
     return { width: meta.width, height: meta.height, fps: 0, frameCount: 1 };
@@ -228,6 +229,8 @@ function buildEncoderArgs(format, width, height, fps, outputPath, quality = DEFA
   if (format === "webm") {
     return [
       ...base,
+      "-vf",
+      SDR_RGB_TO_BT709_FILTER,
       "-c:v",
       "libvpx-vp9",
       "-b:v",
@@ -244,11 +247,6 @@ function buildEncoderArgs(format, width, height, fps, outputPath, quality = DEFA
       "0",
       "-pix_fmt",
       "yuva420p",
-      // Tag the output as BT.709 limited range so browsers use the same
-      // YUV→RGB matrix the source video was encoded with. Without these tags
-      // ffmpeg's default RGB→YUV conversion is BT.601, which causes a visible
-      // color shift (red/skin tones in particular) when the matted overlay is
-      // composited over the original mp4.
       "-colorspace",
       "bt709",
       "-color_primaries",

package/dist/{chunk-RVCWIIZ7.js → chunk-GV5R5B7Q.js}

@@ -6,7 +6,7 @@ var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
 import {
   errorBox
-} from "./chunk-IHFUKJOR.js";
+} from "./chunk-K2FLNJVB.js";
 import {
   failUsage
 } from "./chunk-PBN6GBJE.js";