feat: a demo is never ugly (audit integration)

.github/workflows/update-homebrew-cask.yml

@@ -222,7 +222,7 @@ jobs:
             homepage "https://github.com/${REPO}"
 
             auto_updates false
-            depends_on macos: ">= :big_sur"
+            depends_on macos: ">= :ventura"
 
             app "Openscreen.app"
 

README.md

@@ -37,7 +37,7 @@ A raw capture goes in and comes out ready to post — on X, Reddit, YouTube, a d
 - Record microphone and system audio.
 - Webcam overlay with picture-in-picture, eight snap positions, adjustable roundness, mirroring, and shape options.
 - Auto or manual zooms with adjustable depth, duration, easing, and pixel-precise position; auto-zoom follows your cursor as you work.
-- Custom cursor size, smoothing, and click effects, with cursor themes and post-recording path smoothing.
+- Custom cursor size, smoothing, and click effects, with post-recording path smoothing.
 - Automatic captions for voiceovers, transcribed on-device with no upload (works offline), with an editable transcript you can cut from and optional subtitle translation.
 - AI editing assistant: describe the edit you want in chat and it applies to the timeline — cuts, zooms, speed ramps, annotations, camera framing. Bring your own key (Claude, OpenAI, Gemini, Mistral, OpenRouter, MiniMax, or any OpenAI-compatible endpoint); nothing is enabled by default.
 - Wallpapers, solid colors, gradients, or your own background image.
@@ -176,7 +176,7 @@ You may need to grant screen recording permissions depending on your desktop env
 Everything in the editor and export is the same on macOS, Windows, and Linux: zooms, backgrounds, motion blur, crop/trim/speed, blur regions, annotations, auto-captions, AI editing, projects, export, and all languages. All three now record through a native capture pipeline; the remaining differences are narrower than they used to be:
 
 - **Native recording**: macOS (ScreenCaptureKit), Windows (Windows Graphics Capture), and Linux (PipeWire via the ScreenCast portal) all record through a native pipeline for higher quality and clean window-level capture. On Linux the browser pipeline stays as an automatic fallback if the helper isn't available.
-- **Custom cursors**: on macOS and Windows the real cursor is captured with shape, type, and clicks. Linux captures position and cursor shape through the portal, so cursor themes and the editable cursor overlay work there too. Click effects work on Linux as well, but not through the portal — Wayland exposes no portal for mouse buttons, so the capture helper reads the left button from evdev, which needs your user in the `input` group. Without that, recording is unaffected and every cursor sample is simply a move.
+- **Custom cursors**: on macOS and Windows the real cursor is captured with shape, type, and clicks. Linux captures position and cursor shape through the portal, so the editable cursor overlay works there too. Click effects work on Linux as well, but not through the portal — Wayland exposes no portal for mouse buttons, so the capture helper reads the left button from evdev, which needs your user in the `input` group. Without that, recording is unaffected and every cursor sample is simply a move.
 - **Webcam**: every platform saves the webcam as a separate file next to the screen recording. Windows captures it natively in the recording helper; macOS and Linux record it in the app. It works as a picture-in-picture overlay on all three.
 - **System audio** support varies by OS:
   - **macOS**: works on every supported version. On macOS 14.2+ you'll be prompted to grant audio capture permission.

THIRD-PARTY-NOTICES.md

@@ -123,6 +123,30 @@ distributed by their own registries, not redistributed inside our binaries.
   so nothing of PipeWire's ships inside our installers beyond the compiled
   result of its headers (inline functions and struct layouts).
 
+## Fonts — Inter, Lora, Oswald, Caveat, IBM Plex Mono
+
+- **Components**: the Regular and Bold `.ttf` of each family, under
+  `resources/fonts/`.
+- **Used by**: the native compositor, which draws captions and annotations with
+  these files and nothing else (it registers them privately at start and never
+  reads the fonts installed on the machine), and the editor's font picker.
+- **License**: **SIL Open Font License 1.1** — <https://openfontlicense.org>.
+  Each family's copyright notice and licence text ship beside its files as
+  `<Family>-OFL.txt`, as the licence requires.
+- **Unmodified**: every file is redistributed exactly as upstream publishes it,
+  which is also why the Reserved Font Names "Lora" and "Plex" are kept.
+- **Upstream**:
+  - Inter — Copyright 2016 The Inter Project Authors. `extras/ttf/` of the v4.1
+    release, <https://github.com/rsms/inter/releases/tag/v4.1>.
+  - Lora 3.021 — Copyright 2011 The Lora Project Authors. `fonts/ttf/` of
+    <https://github.com/cyrealtype/Lora-Cyrillic> at `2d53b449b6`.
+  - Oswald 4.103 — Copyright 2016 The Oswald Project Authors. `fonts/ttf/` of
+    <https://github.com/googlefonts/OswaldFont> at `89795261ac`.
+  - Caveat 2.000 — Copyright 2014 The Caveat Project Authors. `fonts/ttf/` of
+    <https://github.com/googlefonts/caveat> at `59745e818e`.
+  - IBM Plex Mono 2.3 — Copyright © 2017 IBM Corp. `ofl/ibmplexmono/` of
+    <https://github.com/google/fonts> at `23e54b51dd`.
+
 ## OpenScreen native helpers
 
 `wgc-capture` (Windows Graphics Capture), the ScreenCaptureKit helper (macOS),

crates/compositor-view-napi/src/lib.rs

@@ -87,6 +87,56 @@ pub fn segmentation_runtime_available() -> bool {
     openscreen_compositor::segmentation::runtime_available()
 }
 
+pub struct SegmentFrameTask {
+    model_path: String,
+    rgba: Vec<u8>,
+}
+
+impl Task for SegmentFrameTask {
+    type Output = Vec<u8>;
+    type JsValue = Buffer;
+
+    fn compute(&mut self) -> Result<Self::Output> {
+        let rgb: Vec<u8> = self
+            .rgba
+            .chunks_exact(4)
+            .flat_map(|p| [p[0], p[1], p[2]])
+            .collect();
+        // ponytail: une session ONNX chargée par appel (quelques dizaines de ms), parce qu'il
+        // n'y a qu'un appel par caméra et par ouverture du panneau. À garder en cache si un
+        // appelant se met à segmenter en continu.
+        let mut segmenter = openscreen_compositor::segmentation::Segmenter::load(
+            std::path::Path::new(&self.model_path),
+        )
+        .map_err(|e| Error::from_reason(format!("{e:#}")))?;
+        segmenter
+            .run(&rgb)
+            .map(<[u8]>::to_vec)
+            .map_err(|e| Error::from_reason(format!("{e:#}")))
+    }
+
+    fn resolve(&mut self, _env: Env, mask: Self::Output) -> Result<Self::JsValue> {
+        Ok(mask.into())
+    }
+}
+
+/// Masque du sujet pour UNE image, sans vue : la vignette de recadrage du panneau caméra s'en
+/// sert pour montrer le fond choisi sur sa propre frame.
+///
+/// `rgba` est une frame RGBA8 déjà réduite à la taille du modèle (`segmentation::MODEL_WIDTH` x
+/// `MODEL_HEIGHT`), soit le `getImageData` d'un canvas tel quel. Le retour a le format de
+/// `Segmenter::run` : un octet par pixel, 0 = fond, 255 = sujet.
+///
+/// `AsyncTask`, comme `remux_seekable` : charger la session prend plus longtemps que l'inférence,
+/// et ce temps n'a rien à faire sur le thread principal de Node.
+#[napi]
+pub fn segment_frame(model_path: String, rgba: Buffer) -> AsyncTask<SegmentFrameTask> {
+    AsyncTask::new(SegmentFrameTask {
+        model_path,
+        rgba: rgba.to_vec(),
+    })
+}
+
 #[napi]
 pub fn create_view(
     rect: CompositorViewRect,
@@ -198,7 +248,7 @@ pub fn read_frame(id: i32, since_gen: f64) -> Result<Option<FramePacket>> {
 }
 
 /// Param live (inspector). Le type de valeur route vers le bon setter :
-/// bool = switch (backgroundBlur…), number = slider (shadow/roundness/motionBlur),
+/// bool = switch (webcamMirror…), number = slider (shadow/roundness/motionBlur/backgroundBlur),
 /// string = sélection (backgroundColor "#rrggbb").
 #[napi]
 pub fn set_param(id: i32, key: String, value: Either3<bool, f64, String>) {
@@ -442,6 +492,9 @@ pub struct ExportParamsInput {
     /// "h264" | "h265". Toute autre valeur (ex. "vp9", pas d'équivalent matériel AMF) fait
     /// échouer l'export avec un message clair plutôt que de silencieusement retomber sur h264.
     pub codec: Option<String>,
+    /// Débit vidéo visé, en bits/s, calculé par l'app d'après la taille et la cadence.
+    /// Absent ou nul → le repli du pipeline, qui ignore la cadence.
+    pub bitrate: Option<u32>,
 }
 
 /// Export multiclip mesuré (worker libuv). Rend la vraie timeline (clips + trims) en un MP4.
@@ -496,6 +549,7 @@ impl Task for ExportMultiTask {
         export_params.height = height;
         if let Some(p) = &self.params {
             export_params.fps = p.fps;
+            export_params.bit_rate = p.bitrate.filter(|&b| b > 0).map(i64::from);
             if let Some(codec) = &p.codec {
                 export_params.codec = match codec.as_str() {
                     "h264" => pipeline::ExportCodec::H264,
@@ -579,21 +633,18 @@ pub fn export_multi(
 }
 
 /// Sortie GIF native (slice 1) — taille, cadence, compteur de loop, dithering.
-/// Tout optionnel : absent → 854×480, 12 fps, boucle infinie, pas de
-/// dithering. Les défauts sont choisis pour un export « petit / net » :
-/// GIF est un format 256-couleurs, 12 fps est la cadence historique de
-/// `gif.js` côté renderer, et 854×480 tient confortablement dans la
-/// palette 8 bits sans banding visible sur du contenu de présentation.
+/// Tout optionnel : absent → 854×480, 12 fps, boucle infinie, dithering
+/// Floyd-Steinberg. GIF est un format 256-couleurs et 12 fps est la cadence
+/// historique de `gif.js` côté renderer.
 #[napi(object)]
 pub struct GifParamsInput {
     pub width: Option<u32>,
     pub height: Option<u32>,
     pub fps: Option<u32>,
     /// Compteur de loop GIF : `None` ou `0` = infini, sinon `n` boucles.
     pub loop_count: Option<u16>,
-    /// Floyd-Steinberg error diffusion avant quantification. Off par
-    /// défaut (qualité acceptable sans, et ça double تقريبًا le coût
-    /// CPU du quantize par frame).
+    /// Floyd-Steinberg error diffusion à la quantification. Actif par défaut :
+    /// sans lui, un fond en dégradé se découpe en bandes (cf. `GifExportParams`).
     pub dither: Option<bool>,
 }
 
@@ -759,7 +810,7 @@ pub fn export_gif(
             height: p.height,
             fps: p.fps,
             loop_count: p.loop_count,
-            dither: p.dither.unwrap_or(false),
+            dither: p.dither.unwrap_or(GifExportParams::default().dither),
         })
         .unwrap_or_default();
     Ok(AsyncTask::new(ExportGifTask {
@@ -824,3 +875,32 @@ pub fn remux_seekable(input_path: String, output_path: String) -> AsyncTask<Remu
         output_path,
     })
 }
+
+pub struct LoudnessGainTask {
+    path: String,
+}
+
+impl Task for LoudnessGainTask {
+    type Output = f64;
+    type JsValue = f64;
+
+    fn compute(&mut self) -> Result<Self::Output> {
+        Ok(f64::from(openscreen_compositor::audio::loudness_gain_db(&self.path)))
+    }
+
+    fn resolve(&mut self, _env: Env, out: Self::Output) -> Result<Self::JsValue> {
+        Ok(out)
+    }
+}
+
+/// Le gain de normalisation de loudness (dB) que l'export applique à ce fichier voix — le
+/// même nombre, par la même fonction, pour que la preview de l'éditeur joue la voix au
+/// niveau où l'export l'écrira. Voir `openscreen_compositor::audio::loudness_gain_db`.
+///
+/// `AsyncTask` : la mesure décode tout l'audio du fichier, ce qui se compte en secondes sur
+/// un long enregistrement. Le résultat est mis en cache dans le processus, donc l'export qui
+/// suit ne le refait pas.
+#[napi]
+pub fn loudness_gain_db(path: String) -> AsyncTask<LoudnessGainTask> {
+    AsyncTask::new(LoudnessGainTask { path })
+}