mulmocast 2.9.2 → 2.10.0

package/lib/utils/image_plugins/markdown_layout.js

@@ -1,118 +1,132 @@
-import { marked } from "marked";
-import { generateMermaidHtml } from "./mermaid.js";
-// Regex to match mermaid code blocks
-const mermaidBlockRegex = /```mermaid\n([\s\S]*?)```/g;
-// Convert string or string array to markdown string
-const toMarkdownString = (content) => {
-    if (Array.isArray(content)) {
-        return content.join("\n");
-    }
-    return content;
-};
-// Replace mermaid code blocks with rendered HTML
-const convertMermaidBlocks = (text) => {
-    return text.replace(mermaidBlockRegex, (_match, code) => {
-        return generateMermaidHtml(code.trim());
+import { Marked } from "marked";
+import { mermaidHtml } from "./mermaid_html.js";
+/**
+ * The one markdown implementation, shared by the Node render path
+ * (`image_plugins/markdown.ts`, which turns it into a PNG) and the browser fragment path
+ * (`beat_html/markdown.ts`, which hands it to a host's DOM).
+ *
+ * Deliberately pure: no `node:*`, no filesystem, no puppeteer. That is what lets the
+ * browser side import it rather than keep a second copy — and a second copy is not
+ * hypothetical, it existed for one commit and the two immediately disagreed about which
+ * fences are diagrams. `test/beat_html/test_browser_safety.ts` bundles the browser entry
+ * with esbuild and fails if anything here reaches Node.
+ *
+ * Element ids come from a caller-supplied generator, because that is the only thing the
+ * two callers genuinely need to differ on.
+ */
+/** A markdown field is written either as one string or as lines to be joined. */
+export const toMarkdownString = (content) => (Array.isArray(content) ? content.join("\n") : content);
+/**
+ * A fence's info string can carry more than the language (```mermaid title="x"), and
+ * marked hands it over verbatim. The language is its first word.
+ */
+const languageOf = (info) => (info ?? "").trim().split(/\s+/)[0].toLowerCase();
+/**
+ * Renders markdown, turning fenced `mermaid` blocks into mermaid markup.
+ *
+ * Asked of marked's own lexer rather than matched against the raw source. A regex over
+ * text was what both copies used, and review found four inputs it got wrong: a CRLF fence
+ * and a fence with trailing whitespace after the language were missed, while a mermaid
+ * fence quoted INSIDE an outer ````markdown fence, and one inside an indented code block,
+ * were converted — turning somebody's example of mermaid syntax into an actual diagram.
+ * marked decides what is a code block and what language it is, so all four follow from
+ * asking it.
+ *
+ * A fresh `Marked` instance per call rather than the global `marked.use`, because the
+ * renderer closes over this call's mermaid counter — a shared one would leak ids between
+ * beats.
+ */
+export const renderMarkdownContent = (content, nextId) => {
+    let hasMermaid = false;
+    const md = new Marked({
+        async: false,
+        renderer: {
+            code({ text, lang }) {
+                if (languageOf(lang) !== "mermaid")
+                    return false;
+                hasMermaid = true;
+                return mermaidHtml(text, nextId());
+            },
+        },
     });
+    return { html: md.parse(toMarkdownString(content), { async: false }), hasMermaid };
 };
-// Parse markdown content to HTML (with mermaid support)
-const parseMarkdown = async (content) => {
-    const text = toMarkdownString(content);
-    const textWithMermaidHtml = convertMermaidBlocks(text);
-    return await marked.parse(textWithMermaidHtml);
-};
-// Generate header HTML
-const generateHeaderHtml = async (data) => {
-    const headerHtml = await parseMarkdown(data);
-    return `
+/** The object form of `markdown`, as opposed to a plain string or array of lines. */
+export const isMarkdownLayout = (md) => typeof md === "object" && md !== null && !Array.isArray(md);
+/**
+ * The slot markup is main's, verbatim including its indentation. Reformatting it would
+ * change every rendered markdown beat's HTML for no reason — semantically inert, but this
+ * feeds Puppeteer and the `mulmo html` export, and "no behaviour change" should mean the
+ * bytes too.
+ */
+const HEADER_HTML = (inner) => `
     <div class="shrink-0 px-8 py-4 border-b border-gray-200 bg-gray-50">
-      <div class="prose prose-lg max-w-none">${headerHtml}</div>
+      <div class="prose prose-lg max-w-none">${inner}</div>
     </div>
   `;
-};
-// Generate sidebar HTML
-const generateSidebarHtml = async (data) => {
-    const sidebarHtml = await parseMarkdown(data);
-    return `
+const SIDEBAR_HTML = (inner) => `
     <div class="shrink-0 w-56 px-4 py-4 border-r border-gray-200 bg-gray-100 overflow-auto">
-      <div class="prose prose-sm max-w-none">${sidebarHtml}</div>
+      <div class="prose prose-sm max-w-none">${inner}</div>
     </div>
   `;
-};
-// Generate row-2 layout HTML (two columns)
-const generateRow2Html = async (data) => {
-    const [left, right] = data;
-    const leftHtml = await parseMarkdown(left);
-    const rightHtml = await parseMarkdown(right);
-    return `
+const ROW2_HTML = (left, right) => `
     <div class="h-full flex gap-6">
       <div class="flex-1 overflow-auto">
-        <div class="prose max-w-none">${leftHtml}</div>
+        <div class="prose max-w-none">${left}</div>
       </div>
       <div class="flex-1 overflow-auto">
-        <div class="prose max-w-none">${rightHtml}</div>
+        <div class="prose max-w-none">${right}</div>
       </div>
     </div>
   `;
-};
-// Generate 2x2 grid layout HTML
-const generate2x2Html = async (data) => {
-    const [tl, tr, bl, br] = data;
-    const [tlHtml, trHtml, blHtml, brHtml] = await Promise.all([parseMarkdown(tl), parseMarkdown(tr), parseMarkdown(bl), parseMarkdown(br)]);
-    return `
+const GRID_2X2_HTML = (cells) => `
     <div class="h-full grid grid-cols-2 grid-rows-2 gap-4">
-      <div class="overflow-auto p-4 bg-gray-50 rounded-lg">
-        <div class="prose prose-sm max-w-none">${tlHtml}</div>
-      </div>
-      <div class="overflow-auto p-4 bg-gray-50 rounded-lg">
-        <div class="prose prose-sm max-w-none">${trHtml}</div>
-      </div>
-      <div class="overflow-auto p-4 bg-gray-50 rounded-lg">
-        <div class="prose prose-sm max-w-none">${blHtml}</div>
-      </div>
-      <div class="overflow-auto p-4 bg-gray-50 rounded-lg">
-        <div class="prose prose-sm max-w-none">${brHtml}</div>
-      </div>
+${cells
+    .map((cell) => `      <div class="overflow-auto p-4 bg-gray-50 rounded-lg">
+        <div class="prose prose-sm max-w-none">${cell}</div>
+      </div>`)
+    .join("\n")}
     </div>
   `;
-};
-// Generate content HTML (single column)
-const generateContentHtml = async (data) => {
-    const contentHtml = await parseMarkdown(data);
-    return `<div class="prose max-w-none">${contentHtml}</div>`;
-};
-// Generate Tailwind HTML for layout
-export const generateLayoutHtml = async (md) => {
+const CONTENT_HTML = (inner) => `<div class="prose max-w-none">${inner}</div>`;
+/** Lay a markdown layout out in Tailwind: header / sidebar-left / row-2 | 2x2 | content. */
+export const renderMarkdownLayout = (md, nextId) => {
+    let hasMermaid = false;
+    const render = (content) => {
+        const rendered = renderMarkdownContent(content, nextId);
+        hasMermaid = hasMermaid || rendered.hasMermaid;
+        return rendered.html;
+    };
     const parts = ['<div class="w-full h-full flex flex-col overflow-hidden">'];
-    if (md.header) {
-        parts.push(await generateHeaderHtml(md.header));
-    }
+    if (md.header)
+        parts.push(HEADER_HTML(render(md.header)));
     parts.push('<div class="flex-1 flex min-h-0 overflow-hidden">');
-    if (md["sidebar-left"]) {
-        parts.push(await generateSidebarHtml(md["sidebar-left"]));
-    }
+    if (md["sidebar-left"])
+        parts.push(SIDEBAR_HTML(render(md["sidebar-left"])));
     parts.push('<div class="flex-1 p-6 overflow-auto">');
     if ("row-2" in md) {
-        parts.push(await generateRow2Html(md["row-2"]));
+        const [left, right] = md["row-2"];
+        parts.push(ROW2_HTML(render(left), render(right)));
     }
     else if ("2x2" in md) {
-        parts.push(await generate2x2Html(md["2x2"]));
+        parts.push(GRID_2X2_HTML(md["2x2"].map(render)));
     }
     else if ("content" in md) {
-        parts.push(await generateContentHtml(md.content));
+        parts.push(CONTENT_HTML(render(md.content)));
     }
     parts.push("</div>", "</div>", "</div>");
-    return parts.join("");
+    return { html: parts.join(""), hasMermaid };
 };
-// Convert layout to plain markdown string
+/**
+ * A layout flattened back to plain markdown, in slot order. Used by `mulmo markdown`,
+ * which wants what the beat SAYS rather than how it is laid out.
+ */
 export const layoutToMarkdown = (md) => {
     const parts = [];
-    if (md.header) {
+    if (md.header)
         parts.push(toMarkdownString(md.header));
-    }
-    if (md["sidebar-left"]) {
+    if (md["sidebar-left"])
         parts.push(toMarkdownString(md["sidebar-left"]));
-    }
     if ("row-2" in md) {
         parts.push(...md["row-2"].map(toMarkdownString));
     }
@@ -124,4 +138,3 @@ export const layoutToMarkdown = (md) => {
     }
     return parts.join("\n\n");
 };
-export { toMarkdownString, parseMarkdown };

package/lib/utils/image_plugins/media_html.d.ts

@@ -0,0 +1,16 @@
+import type { MulmoMediaSource } from "../../types/index.js";
+/**
+ * Markup for image and movie media. Pure — no Node, no filesystem — because the Node dump
+ * path and the browser fragment path show the same media and must show it the same way.
+ *
+ * `src` is escaped: `z.url()` accepts a quote, so a url from a script can otherwise close
+ * the attribute. Measured — `https://e.com/a.mp4" onerror="pwn()` parses clean.
+ */
+/**
+ * The src a browser can load from a media source. A `base64` source has no media type in
+ * the schema, so there is nothing to build a `data:` URI from; a `path` is emitted as
+ * written and left for the host to resolve against its own page.
+ */
+export declare const mediaSrc: (source: MulmoMediaSource) => string | undefined;
+export declare const imageHtml: (src: string, alt: string) => string;
+export declare const movieHtml: (src: string) => string;

package/lib/utils/image_plugins/media_html.js

@@ -0,0 +1,39 @@
+import { escapeHtml } from "@mulmocast/deck/lib/utils.js";
+/**
+ * Markup for image and movie media. Pure — no Node, no filesystem — because the Node dump
+ * path and the browser fragment path show the same media and must show it the same way.
+ *
+ * `src` is escaped: `z.url()` accepts a quote, so a url from a script can otherwise close
+ * the attribute. Measured — `https://e.com/a.mp4" onerror="pwn()` parses clean.
+ */
+/**
+ * The src a browser can load from a media source. A `base64` source has no media type in
+ * the schema, so there is nothing to build a `data:` URI from; a `path` is emitted as
+ * written and left for the host to resolve against its own page.
+ */
+export const mediaSrc = (source) => {
+    if (source.kind === "url")
+        return source.url;
+    if (source.kind === "path")
+        return source.path;
+    return undefined;
+};
+export const imageHtml = (src, alt) => `\n<img src="${escapeHtml(src)}" alt="${escapeHtml(alt)}" class="w-full rounded-lg shadow-lg" />`;
+export const movieHtml = (src) => {
+    const url = escapeHtml(src);
+    return `
+<div class="movie-container mb-6">
+  <div class="relative w-full" style="padding-bottom: 56.25%; /* 16:9 aspect ratio */">
+    <video
+      class="absolute top-0 left-0 w-full h-full rounded-lg shadow-lg"
+      controls
+      preload="metadata"
+    >
+      <source src="${url}" type="video/mp4">
+      <source src="${url}" type="video/webm">
+      <source src="${url}" type="video/ogg">
+      Your browser does not support the video tag.
+    </video>
+  </div>
+</div>`;
+};

package/lib/utils/image_plugins/mermaid.d.ts

@@ -1,5 +1,6 @@
 import { ImageProcessorParams } from "../../types/index.js";
 export declare const imageType = "mermaid";
+/** Mermaid markup for this path. The markup itself is shared with the browser path. */
 export declare const generateMermaidHtml: (code: string, title?: string) => string;
 export declare const process: (params: ImageProcessorParams) => Promise<string | undefined>;
 export declare const path: (params: ImageProcessorParams) => string;

package/lib/utils/image_plugins/mermaid.js

@@ -2,23 +2,12 @@ import { MulmoMediaSourceMethods } from "../../methods/index.js";
 import { getHTMLFile } from "../file.js";
 import { renderHTMLToImage, interpolate } from "../html_render.js";
 import { parrotingImagePath, generateUniqueId } from "./utils.js";
+import { escapedMermaidTemplateValues, mermaidHtml } from "./mermaid_html.js";
 import { resolveCombinedStyle } from "./bg_image_util.js";
 import { resolveImageRefs, resolveMovieRefs, resolveRelativeImagePaths } from "./html_tailwind.js";
 export const imageType = "mermaid";
-// Generate mermaid HTML from code string (shared utility)
-export const generateMermaidHtml = (code, title) => {
-    const diagramId = generateUniqueId("mermaid");
-    const titleHtml = title ? `<h3 class="text-xl font-semibold mb-4">${title}</h3>` : "";
-    return `
-<div class="mermaid-container mb-6">
-  ${titleHtml}
-  <div class="flex justify-center">
-    <div id="${diagramId}" class="mermaid">
-      ${code.trim()}
-    </div>
-  </div>
-</div>`;
-};
+/** Mermaid markup for this path. The markup itself is shared with the browser path. */
+export const generateMermaidHtml = (code, title) => mermaidHtml(code, generateUniqueId("mermaid"), title);
 const processMermaid = async (params) => {
     const { beat, imagePath, canvasSize, context } = params;
     if (!beat?.image || beat.image.type !== imageType)
@@ -28,9 +17,8 @@ const processMermaid = async (params) => {
     if (diagram_code) {
         const combinedStyle = await resolveCombinedStyle(params, beat.image.backgroundImage, beat.image.style);
         const rawHtml = interpolate(template, {
-            title: beat.image.title,
+            ...escapedMermaidTemplateValues(beat.image.title, `${diagram_code}\n${beat.image.appendix?.join("\n") ?? ""}`),
             style: combinedStyle,
-            diagram_code: `${diagram_code}\n${beat.image.appendix?.join("\n") ?? ""}`,
         });
         const resolvedImageRefs = resolveImageRefs(rawHtml, params.imageRefs ?? {});
         const resolvedAllRefs = resolveMovieRefs(resolvedImageRefs, params.movieRefs ?? {});

package/lib/utils/image_plugins/mermaid_html.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Mermaid markup. Pure — no Node, no filesystem — because both the Node render path and
+ * the browser fragment path draw the same diagram and must draw it the same way.
+ *
+ * The element id is a parameter rather than generated here: the Node path renders once to
+ * a PNG so a random id is fine, while the browser path re-renders and needs the same beat
+ * to produce the same markup, or a host diffing fragments sees every diagram change
+ * identity on every render. That parameter is caller-supplied — the markdown path builds it
+ * from an idPrefix, and a beat's `id` comes from the script — so it is validated rather than
+ * escaped: see element_id.ts for why the permitted-set rule beats a per-context escaper.
+ *
+ * Both values are escaped. Mermaid reads the element's innerHTML and entity-decodes it
+ * before parsing (mermaid 11.17.0: `o = u.innerHTML; o = entityDecode(o)`), so it receives
+ * the original characters either way — measured across ten diagram shapes including `<br/>`
+ * in labels, `#quot;`, raw tags and an init directive, the rendered SVG is byte-identical.
+ */
+export declare const mermaidHtml: (code: string, id: string, title?: string) => string;
+/** The two values assets/html/mermaid.html interpolates from user data, escaped for its `<h1>` and `.mermaid` text contexts. */
+export declare const escapedMermaidTemplateValues: (title: string, diagramCode: string) => {
+    title: string;
+    diagram_code: string;
+};

package/lib/utils/image_plugins/mermaid_html.js

@@ -0,0 +1,36 @@
+import { escapeHtml } from "@mulmocast/deck/lib/utils.js";
+import { assertSafeElementId } from "../element_id.js";
+/**
+ * Mermaid markup. Pure — no Node, no filesystem — because both the Node render path and
+ * the browser fragment path draw the same diagram and must draw it the same way.
+ *
+ * The element id is a parameter rather than generated here: the Node path renders once to
+ * a PNG so a random id is fine, while the browser path re-renders and needs the same beat
+ * to produce the same markup, or a host diffing fragments sees every diagram change
+ * identity on every render. That parameter is caller-supplied — the markdown path builds it
+ * from an idPrefix, and a beat's `id` comes from the script — so it is validated rather than
+ * escaped: see element_id.ts for why the permitted-set rule beats a per-context escaper.
+ *
+ * Both values are escaped. Mermaid reads the element's innerHTML and entity-decodes it
+ * before parsing (mermaid 11.17.0: `o = u.innerHTML; o = entityDecode(o)`), so it receives
+ * the original characters either way — measured across ten diagram shapes including `<br/>`
+ * in labels, `#quot;`, raw tags and an init directive, the rendered SVG is byte-identical.
+ */
+export const mermaidHtml = (code, id, title) => {
+    assertSafeElementId(id);
+    const titleHtml = title ? `<h3 class="text-xl font-semibold mb-4">${escapeHtml(title)}</h3>` : "";
+    return `
+<div class="mermaid-container mb-6">
+  ${titleHtml}
+  <div class="flex justify-center">
+    <div id="${id}" class="mermaid">
+      ${escapeHtml(code.trim())}
+    </div>
+  </div>
+</div>`;
+};
+/** The two values assets/html/mermaid.html interpolates from user data, escaped for its `<h1>` and `.mermaid` text contexts. */
+export const escapedMermaidTemplateValues = (title, diagramCode) => ({
+    title: escapeHtml(title),
+    diagram_code: escapeHtml(diagramCode),
+});

package/lib/utils/image_plugins/movie.js

@@ -1,5 +1,6 @@
 import { processSource, pathSource } from "./source.js";
 import { MulmoMediaSourceMethods } from "../../methods/mulmo_media_source.js";
+import { movieHtml } from "./media_html.js";
 export const imageType = "movie";
 const dumpHtml = async (params) => {
     const { beat, context } = params;
@@ -8,21 +9,7 @@ const dumpHtml = async (params) => {
     const moviePathOrUrl = MulmoMediaSourceMethods.resolve(beat.image.source, context);
     if (!moviePathOrUrl)
         return;
-    return `
-<div class="movie-container mb-6">
-  <div class="relative w-full" style="padding-bottom: 56.25%; /* 16:9 aspect ratio */">
-    <video
-      class="absolute top-0 left-0 w-full h-full rounded-lg shadow-lg"
-      controls
-      preload="metadata"
-    >
-      <source src="${moviePathOrUrl}" type="video/mp4">
-      <source src="${moviePathOrUrl}" type="video/webm">
-      <source src="${moviePathOrUrl}" type="video/ogg">
-      Your browser does not support the video tag.
-    </video>
-  </div>
-</div>`;
+    return movieHtml(moviePathOrUrl);
 };
 export const process = processSource(imageType);
 export const path = pathSource(imageType);

package/lib/utils/sdk_timeout.d.ts

@@ -0,0 +1,3 @@
+export declare const GENAI_REQUEST_TIMEOUT_MS = 120000;
+export declare const REPLICATE_RUN_TIMEOUT_MS = 600000;
+export declare const VIDEO_POLL_TIMEOUT_MS = 1200000;

package/lib/utils/sdk_timeout.js

@@ -0,0 +1,7 @@
+// Timeout budgets for provider SDK calls (OpenAI has its own in openai_client.ts).
+// Generous safety nets against a stalled connection or a never-completing
+// operation — NOT tight deadlines. A stall becomes a rejection so the caller's
+// GraphAI `retry` can recover instead of hanging forever.
+export const GENAI_REQUEST_TIMEOUT_MS = 120_000; // per @google/genai API call (kick-off / each poll)
+export const REPLICATE_RUN_TIMEOUT_MS = 600_000; // whole replicate.run() job (video models run minutes)
+export const VIDEO_POLL_TIMEOUT_MS = 1_200_000; // wall-clock cap for a long-running Veo video operation

package/lib/utils/swipe_to_html.d.ts

@@ -49,6 +49,24 @@ export interface SwipeElement {
     loop?: SwipeLoop;
     elements?: SwipeElement[];
 }
+/**
+ * The element id both the markup and the generated animation script use. It reaches an HTML
+ * attribute AND a raw CSS selector inside a JavaScript string literal
+ * (`animation.animate('#id')`), so it is validated rather than escaped — escaping one
+ * context leaves the other wrong, and a quote in an id silently produces broken JavaScript
+ * instead of a diagnosable error.
+ *
+ * Not a privilege boundary: `html_tailwind` accepts an author's own `script` by design, so
+ * an author already has that capability. This is here so the two contexts agree.
+ */
+/**
+ * Bridges a TypeScript gap, not a validation gap: `swipeElementSchema` is declared
+ * `z.ZodType` because it is recursive through `z.lazy`, so `z.array(...)` infers `unknown[]`
+ * and the shape zod already checked at parse time is lost to the compiler. Every field of
+ * SwipeElement is optional, so any object satisfies it structurally — which is what makes
+ * this a sound narrowing rather than a cast wearing a guard's clothes.
+ */
+export declare const isSwipeElements: (value: unknown) => value is SwipeElement[];
 /** Generate HTML from Swipe elements */
 export declare const swipeElementsToHtml: (elements: SwipeElement[]) => string;
 /** Generate render() script from Swipe element animations */

package/lib/utils/swipe_to_html.js

@@ -1,6 +1,30 @@
+import { assertSafeElementId } from "./element_id.js";
 const escapeHtml = (str) => {
     return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 };
+/**
+ * The element id both the markup and the generated animation script use. It reaches an HTML
+ * attribute AND a raw CSS selector inside a JavaScript string literal
+ * (`animation.animate('#id')`), so it is validated rather than escaped — escaping one
+ * context leaves the other wrong, and a quote in an id silently produces broken JavaScript
+ * instead of a diagnosable error.
+ *
+ * Not a privilege boundary: `html_tailwind` accepts an author's own `script` by design, so
+ * an author already has that capability. This is here so the two contexts agree.
+ */
+/**
+ * Bridges a TypeScript gap, not a validation gap: `swipeElementSchema` is declared
+ * `z.ZodType` because it is recursive through `z.lazy`, so `z.array(...)` infers `unknown[]`
+ * and the shape zod already checked at parse time is lost to the compiler. Every field of
+ * SwipeElement is optional, so any object satisfies it structurally — which is what makes
+ * this a sound narrowing rather than a cast wearing a guard's clothes.
+ */
+export const isSwipeElements = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null);
+const elementId = (el, index) => {
+    const id = el.id ?? `swipe_el_${index}`;
+    assertSafeElementId(id);
+    return id;
+};
 const toCssValue = (value) => {
     return typeof value === "number" ? `${value}px` : value;
 };
@@ -69,7 +93,7 @@ const buildTextStyle = (el) => {
     return styles.join(" ");
 };
 const elementToHtml = (el, index) => {
-    const id = el.id ?? `swipe_el_${index}`;
+    const id = elementId(el, index);
     const style = buildElementStyle(el);
     const textStyle = buildTextStyle(el);
     const lines = [];
@@ -96,7 +120,7 @@ export const swipeElementsToHtml = (elements) => {
 };
 const collectAnimations = (elements, entries, indexBase = 0) => {
     elements.forEach((el, i) => {
-        const id = el.id ?? `swipe_el_${indexBase + i}`;
+        const id = elementId(el, indexBase + i);
         if (el.to || el.loop) {
             entries.push({ id, to: el.to, loop: el.loop });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mulmocast",
-  "version": "2.9.2",
+  "version": "2.10.0",
   "description": "",
   "type": "module",
   "main": "lib/index.node.js",
@@ -24,7 +24,7 @@
     }
   },
   "resolutions": {
-    "minimatch": "^10.2.5",
+    "minimatch": "^10.2.6",
     "tar": "7.5.22",
     "yauzl": "^3.4.0"
   },
@@ -89,7 +89,7 @@
   "homepage": "https://github.com/receptron/mulmocast-cli#readme",
   "dependencies": {
     "@google-cloud/text-to-speech": "^6.4.1",
-    "@google/genai": "^2.13.0",
+    "@google/genai": "^2.15.0",
     "@graphai/anthropic_agent": "^2.0.12",
     "@graphai/browserless_agent": "^2.0.3",
     "@graphai/gemini_agent": "^2.0.5",
@@ -102,9 +102,9 @@
     "@inquirer/input": "^5.1.2",
     "@inquirer/select": "^5.2.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@modernized/fluent-ffmpeg": "^1.0.2",
+    "@modernized/fluent-ffmpeg": "^1.0.3",
     "@mozilla/readability": "^0.6.0",
-    "@mulmocast/deck": "^1.1.0",
+    "@mulmocast/deck": "^2.0.0",
     "@tavily/core": "^0.7.6",
     "archiver": "^8.0.0",
     "clipboardy": "^5.3.2",
@@ -115,10 +115,10 @@
     "marked": "^18.0.7",
     "mulmocast-vision": "^1.0.12",
     "ora": "^9.4.1",
-    "puppeteer": "^25.3.0",
+    "puppeteer": "^25.4.0",
     "replicate": "^1.4.0",
     "yaml": "^2.9.0",
-    "yargs": "^18.0.0",
+    "yargs": "^18.1.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -128,16 +128,17 @@
     "@types/jsdom": "^28.0.3",
     "@types/yargs": "^17.0.35",
     "cross-env": "^10.1.0",
+    "esbuild": "^0.28.2",
     "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-sonarjs": "^4.2.0",
-    "globals": "^17.7.0",
+    "globals": "^17.9.0",
     "prettier": "^3.9.6",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.5",
     "typescript": "6.0.3",
-    "typescript-eslint": "^8.65.0"
+    "typescript-eslint": "^8.66.0"
   },
   "engines": {
     "node": ">=22.0.0"