From 6e082d68e1e551f59d77f9a193d0210341f60ace Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Thu, 8 Oct 2026 00:40:16 -0700
Subject: [PATCH 1/9] fix(core): a data script in a sub-composition no longer
 stops every timeline

A sub-composition's <script type="application/json"> was wrapped and run as
JavaScript, and because the bundle merges every composition script into one,
its parse error stopped every scene's timeline. Data scripts now stay in the
DOM as authored, and a script run that does not parse is left unmerged so a
bad script fails alone.
---
 .../core/src/compiler/compositionAssembly.ts  | 52 ++++++++++++--
 .../core/src/compiler/htmlBundler.test.ts     | 70 +++++++++++++++++++
 packages/core/src/compiler/htmlBundler.ts     | 39 +++++++----
 .../src/compiler/inlineSubCompositions.ts     |  8 +--
 packages/core/src/compiler/scriptRuns.ts      | 29 ++------
 .../src/runtime/compositionLoader.test.ts     | 25 +++++++
 .../core/src/runtime/compositionLoader.ts     |  4 +-
 7 files changed, 177 insertions(+), 50 deletions(-)

diff --git a/packages/core/src/compiler/compositionAssembly.ts b/packages/core/src/compiler/compositionAssembly.ts
index 256ae161c43..3dfd2bc2c92 100644
--- a/packages/core/src/compiler/compositionAssembly.ts
+++ b/packages/core/src/compiler/compositionAssembly.ts
@@ -34,7 +34,52 @@ const SCRIPT_SELECTOR = "script";
  */
 const HOISTED_LINK_SELECTOR = 'link[rel="stylesheet"], link[rel="preconnect"]';
 
-export const EXTRACTED_COMPOSITION_ASSET_SELECTOR = `${STYLE_SELECTOR}, ${SCRIPT_SELECTOR}, ${HOISTED_LINK_SELECTOR}`;
+// The HTML spec's JavaScript MIME type essence matches: a script with any of these types runs as classic.
+const JAVASCRIPT_TYPES = new Set([
+  "",
+  "application/ecmascript",
+  "application/javascript",
+  "application/x-ecmascript",
+  "application/x-javascript",
+  "text/ecmascript",
+  "text/javascript",
+  "text/javascript1.0",
+  "text/javascript1.1",
+  "text/javascript1.2",
+  "text/javascript1.3",
+  "text/javascript1.4",
+  "text/javascript1.5",
+  "text/jscript",
+  "text/livescript",
+  "text/x-ecmascript",
+  "text/x-javascript",
+]);
+
+export function isJavaScriptType(el: AssemblyAttributed): boolean {
+  return JAVASCRIPT_TYPES.has((el.getAttribute("type") || "").trim().toLowerCase());
+}
+
+/** A data block (application/json, text/template, ...) never runs, so it stays in the content as authored. */
+function isExecutableScript(el: AssemblyAttributed): boolean {
+  const type = (el.getAttribute("type") || "").trim().toLowerCase();
+  return type === "module" || type === "importmap" || isJavaScriptType(el);
+}
+
+function executableScripts<TElement extends AssemblyAttributed>(
+  node: AssemblyQueryable<TElement> | null | undefined,
+): TElement[] {
+  return toArray(node?.querySelectorAll(SCRIPT_SELECTOR)).filter(isExecutableScript);
+}
+
+/** The styles, scripts and links both paths extract, so the mounted copy must drop them. */
+export function extractedCompositionAssets<TElement extends AssemblyAttributed>(
+  node: AssemblyQueryable<TElement>,
+): TElement[] {
+  return [
+    ...toArray(node.querySelectorAll(`${STYLE_SELECTOR}, ${HOISTED_LINK_SELECTOR}`)),
+    ...executableScripts(node),
+  ];
+}
 
 /**
  * The compiler's nesting cap, enforced against the ancestry chain rather than a
@@ -187,10 +232,7 @@ export function planCompositionAssembly<TElement extends AssemblyAttributed>(
       ...toArray(assetHead?.querySelectorAll(STYLE_SELECTOR)),
       ...toArray(contentNode.querySelectorAll(STYLE_SELECTOR)),
     ],
-    scriptSources: [
-      ...toArray(assetHead?.querySelectorAll(SCRIPT_SELECTOR)),
-      ...toArray(contentNode.querySelectorAll(SCRIPT_SELECTOR)),
-    ],
+    scriptSources: [...executableScripts(assetHead), ...executableScripts(contentNode)],
     linkSources: [
       ...toArray(head?.querySelectorAll(HOISTED_LINK_SELECTOR)),
       ...toArray(contentNode.querySelectorAll(HOISTED_LINK_SELECTOR)),
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index 76588417f06..a7743f7f82b 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -2870,6 +2870,76 @@ describe("bundleToSingleHtml script order", () => {
   });
 });
 
+describe("bundleToSingleHtml composition scripts that are not JavaScript", () => {
+  const sceneFile = (id: string, extra: string) => `<template id="${id}-template">
+<div data-composition-id="${id}" data-width="320" data-height="180" data-duration="2">
+  ${extra}
+  <script>window.__timelines = window.__timelines || {}; window.__timelines.${id} = 1;</script>
+</div></template>`;
+
+  async function bundleFilm(sceneExtra: string, options?: { sceneParts?: boolean }) {
+    const dir = makeTempProject({
+      "index.html": `<!doctype html>
+<html><body>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="4">
+    <div data-composition-id="intro" data-composition-src="compositions/intro.html" data-start="0" data-duration="2"></div>
+    <div data-composition-id="scene" data-composition-src="compositions/scene.html" data-start="2" data-duration="2"></div>
+  </div>
+  <script>window.__timelines = window.__timelines || {}; window.__timelines.main = 1;</script>
+</body></html>`,
+      "compositions/intro.html": sceneFile("intro", ""),
+      "compositions/scene.html": sceneFile("scene", sceneExtra),
+    });
+    try {
+      return parseHTML(await bundleToSingleHtml(dir, options)).document;
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+
+  const runnable = (document: Document) =>
+    [...document.querySelectorAll("body script:not([src])")].filter((el) =>
+      [null, AFTER_FONTS_SCRIPT_TYPE].includes(el.getAttribute("type")),
+    );
+  const parses = (el: Element) => {
+    try {
+      new Function(el.textContent ?? "");
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const timelinesThatRun = (document: Document) =>
+    ["main", "intro", "scene"].filter((id) =>
+      runnable(document).some(
+        (el) => parses(el) && (el.textContent ?? "").includes(`__timelines.${id} =`),
+      ),
+    );
+
+  it("keeps a sub-composition's JSON data script readable and out of the JavaScript", async () => {
+    const document = await bundleFilm(
+      `<script type="application/json" id="meta">{"title": "x", "beats": [1, 2]}</script>`,
+    );
+    const meta = document.querySelector('script[type="application/json"]');
+    expect(meta?.getAttribute("id")).toBe("meta");
+    expect(JSON.parse(meta?.textContent ?? "")).toEqual({ title: "x", beats: [1, 2] });
+    expect(runnable(document).every(parses)).toBe(true);
+    expect(runnable(document).some((el) => el.textContent?.includes('"beats"'))).toBe(false);
+    expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
+  });
+
+  it.each([false, true])(
+    "keeps a sub-composition script that does not parse apart, so the others still run (sceneParts %s)",
+    async (sceneParts) => {
+      const document = await bundleFilm(`<script>window.broken = {:</script>`, { sceneParts });
+      const broken = runnable(document).filter((el) => !parses(el));
+      expect(broken).toHaveLength(1);
+      expect(broken[0]!.textContent).toContain("window.broken");
+      expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
+    },
+  );
+});
+
 describe("bundleToSingleHtml sceneParts", () => {
   const film = () =>
     makeTempProject({
diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index b41893abcb3..769807bd453 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -744,10 +744,13 @@ function coalesceHeadStylesAndBodyScripts(document: Document): void {
     isPinned,
   )) {
     const mergedJs = joinJsChunks(members.map((el) => el.textContent || ""));
+    const stripped = mergedJs ? stripJsComments(mergedJs) : "";
+    // Left unmerged, a script that does not parse fails alone instead of taking every timeline with it.
+    if (stripped === null) continue;
     for (const el of members) el.remove();
-    if (!mergedJs) continue;
+    if (!stripped) continue;
     const inlineScript = document.createElement("script");
-    inlineScript.textContent = escapeInlineScriptSource(stripJsCommentsParserSafe(mergedJs));
+    inlineScript.textContent = escapeInlineScriptSource(stripped);
     if (anchor) anchor.before(inlineScript);
     else document.body.appendChild(inlineScript);
   }
@@ -799,16 +802,23 @@ function joinJsChunks(chunks: string[]): string {
     .join("\n");
 }
 
-function stripJsCommentsParserSafe(source: string): string {
-  if (!source) return source;
+/** Null when the source does not parse. */
+function stripJsComments(source: string): string | null {
   try {
-    const result = transformSync(source, { loader: "js", minify: false, legalComments: "none" });
-    return result.code.trim();
+    return transformSync(source, {
+      loader: "js",
+      minify: false,
+      legalComments: "none",
+    }).code.trim();
   } catch {
-    return source;
+    return null;
   }
 }
 
+function stripJsCommentsParserSafe(source: string): string {
+  return source ? (stripJsComments(source) ?? source) : source;
+}
+
 export interface BundleOptions {
   /** Project-relative HTML entry to bundle. Defaults to `index.html`. */
   entryFile?: string;
@@ -1261,12 +1271,15 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
     }
   }
   for (const { scene, chunks } of scriptRuns) {
-    const script = document.createElement("script");
-    if (scene) script.setAttribute(SCENE_PART_ATTR, scene);
-    script.textContent = joinJsChunks(
-      chunks.map((chunk) => (typeof chunk === "string" ? chunk : chunk())),
-    );
-    document.body.appendChild(script);
+    const texts = chunks.map((chunk) => (typeof chunk === "string" ? chunk : chunk()));
+    const joined = joinJsChunks(texts);
+    // One script per chunk when the run does not parse, so one bad composition script fails alone.
+    for (const text of stripJsComments(joined) === null ? texts : [joined]) {
+      const script = document.createElement("script");
+      if (scene) script.setAttribute(SCENE_PART_ATTR, scene);
+      script.textContent = text;
+      document.body.appendChild(script);
+    }
   }
   emitMountedModuleScripts(document, subCompResult.importMaps, subCompResult.moduleScripts);
 
diff --git a/packages/core/src/compiler/inlineSubCompositions.ts b/packages/core/src/compiler/inlineSubCompositions.ts
index fd3f15731bf..60ee920019b 100644
--- a/packages/core/src/compiler/inlineSubCompositions.ts
+++ b/packages/core/src/compiler/inlineSubCompositions.ts
@@ -43,7 +43,7 @@ import {
 import {
   enumerateNestedCompositionHosts,
   planCompositionAssembly,
-  EXTRACTED_COMPOSITION_ASSET_SELECTOR,
+  extractedCompositionAssets,
 } from "./compositionAssembly";
 import { SCENE_NO_SWAP_ATTR, SCENE_PART_ATTR } from "../sceneParts";
 
@@ -610,8 +610,7 @@ export function inlineSubCompositions(
     // Inject content into the host element
     if (innerRoot) {
       innerRoot.setAttribute("data-composition-file", src);
-      for (const child of [...innerRoot.querySelectorAll(EXTRACTED_COMPOSITION_ASSET_SELECTOR)])
-        child.remove();
+      for (const child of extractedCompositionAssets(innerRoot)) child.remove();
       if (flattenInnerRoot) {
         const prepared = flattenInnerRoot(innerRoot);
         if (!compId && scopeCompId) {
@@ -635,8 +634,7 @@ export function inlineSubCompositions(
         }
       }
     } else {
-      for (const child of [...contentDoc.querySelectorAll(EXTRACTED_COMPOSITION_ASSET_SELECTOR)])
-        child.remove();
+      for (const child of extractedCompositionAssets(contentDoc)) child.remove();
       // linkedom fragment parsing: when content is `<div data-composition-id="X">...</div>`,
       // the div becomes documentElement and body is empty. Fall back to documentElement.outerHTML
       // to preserve the composition wrapper.
diff --git a/packages/core/src/compiler/scriptRuns.ts b/packages/core/src/compiler/scriptRuns.ts
index b2ee24b44f6..9aaa7a9efcb 100644
--- a/packages/core/src/compiler/scriptRuns.ts
+++ b/packages/core/src/compiler/scriptRuns.ts
@@ -1,34 +1,13 @@
+import { isJavaScriptType } from "./compositionAssembly";
+
+export { isJavaScriptType };
+
 export interface InlineScriptRun {
   members: Element[];
   /** First later script that executes on its own; the merged run must stay before it. Null: end of body. */
   anchor: Element | null;
 }
 
-// The HTML spec's JavaScript MIME type essence matches: a script with any of these types runs as classic.
-const JAVASCRIPT_TYPES = new Set([
-  "",
-  "application/ecmascript",
-  "application/javascript",
-  "application/x-ecmascript",
-  "application/x-javascript",
-  "text/ecmascript",
-  "text/javascript",
-  "text/javascript1.0",
-  "text/javascript1.1",
-  "text/javascript1.2",
-  "text/javascript1.3",
-  "text/javascript1.4",
-  "text/javascript1.5",
-  "text/jscript",
-  "text/livescript",
-  "text/x-ecmascript",
-  "text/x-javascript",
-]);
-
-export function isJavaScriptType(el: Element): boolean {
-  return JAVASCRIPT_TYPES.has((el.getAttribute("type") || "").trim().toLowerCase());
-}
-
 function isClassicInline(el: Element): boolean {
   return !el.hasAttribute("nomodule") && isJavaScriptType(el);
 }
diff --git a/packages/core/src/runtime/compositionLoader.test.ts b/packages/core/src/runtime/compositionLoader.test.ts
index 3f066cce840..4d9e32145d0 100644
--- a/packages/core/src/runtime/compositionLoader.test.ts
+++ b/packages/core/src/runtime/compositionLoader.test.ts
@@ -1503,6 +1503,31 @@ describe("loadCompositions inline templates", () => {
     expect(injectedScripts[0].textContent).toContain("inline template script");
   });
 
+  it("leaves a JSON data script in the mounted content instead of running it", async () => {
+    const template = document.createElement("template");
+    template.id = "data-comp-template";
+    template.innerHTML = `
+      <div data-composition-id="data-comp" data-width="1920" data-height="1080">
+        <script type="application/json" id="meta">{"title": "x"}</script>
+        <script>window.__dataCompRan = 1;</script>
+      </div>
+    `;
+    document.body.appendChild(template);
+    const host = document.createElement("div");
+    host.setAttribute("data-composition-id", "data-comp");
+    document.body.appendChild(host);
+
+    const { injectedScripts } = await loadFixture();
+
+    expect(injectedScripts.map((script) => script.textContent).join("\n")).not.toContain("title");
+    expect(injectedScripts.some((script) => script.textContent?.includes("__dataCompRan"))).toBe(
+      true,
+    );
+    const meta = host.querySelector("#meta");
+    expect(meta?.getAttribute("type")).toBe("application/json");
+    expect(JSON.parse(meta?.textContent ?? "")).toEqual({ title: "x" });
+  });
+
   it("copies dimension attributes from template inner root to host", async () => {
     const template = document.createElement("template");
     template.id = "dim-comp-template";
diff --git a/packages/core/src/runtime/compositionLoader.ts b/packages/core/src/runtime/compositionLoader.ts
index 0f7814e0af0..b62304639f4 100644
--- a/packages/core/src/runtime/compositionLoader.ts
+++ b/packages/core/src/runtime/compositionLoader.ts
@@ -5,7 +5,7 @@ import {
 } from "../compiler/svgSelectorAliases";
 import {
   planCompositionAssembly,
-  EXTRACTED_COMPOSITION_ASSET_SELECTOR,
+  extractedCompositionAssets,
 } from "../compiler/compositionAssembly";
 import {
   scopeCssToComposition,
@@ -225,7 +225,7 @@ function resetCompositionHost(host: Element) {
  * inline-template path, and mutating it would leave a remount with no styles.
  */
 function stripExtractedCompositionAssets(node: ParentNode): void {
-  for (const el of Array.from(node.querySelectorAll(EXTRACTED_COMPOSITION_ASSET_SELECTOR))) {
+  for (const el of extractedCompositionAssets(node)) {
     el.remove();
   }
 }

From 04ed87c4114289def396f76b3c0d14d74d4e7d0d Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Thu, 8 Oct 2026 01:27:50 -0700
Subject: [PATCH 2/9] fix(core): render and preview keep a broken composition
 script from stopping the rest

The render path's script merge had the same gap as the bundler: one script
that does not parse stopped every timeline. Both now share one parse check.
A run left unmerged, and every scene-part script, is still escaped, so a
string holding "</script>" can no longer end the script early in preview.
---
 .../core/src/compiler/compositionAssembly.ts  |  8 ++-
 .../core/src/compiler/htmlBundler.test.ts     | 29 +++++++-
 packages/core/src/compiler/htmlBundler.ts     | 23 +++++--
 packages/core/src/compiler/index.ts           |  3 +-
 packages/core/src/compiler/scriptRuns.ts      |  2 -
 .../services/htmlCompiler.scriptOrder.test.ts | 69 +++++++++++++++++++
 .../producer/src/services/htmlCompiler.ts     | 11 ++-
 7 files changed, 129 insertions(+), 16 deletions(-)

diff --git a/packages/core/src/compiler/compositionAssembly.ts b/packages/core/src/compiler/compositionAssembly.ts
index 3dfd2bc2c92..85d568df496 100644
--- a/packages/core/src/compiler/compositionAssembly.ts
+++ b/packages/core/src/compiler/compositionAssembly.ts
@@ -55,14 +55,16 @@ const JAVASCRIPT_TYPES = new Set([
   "text/x-javascript",
 ]);
 
+const scriptType = (el: AssemblyAttributed) => (el.getAttribute("type") || "").trim().toLowerCase();
+
 export function isJavaScriptType(el: AssemblyAttributed): boolean {
-  return JAVASCRIPT_TYPES.has((el.getAttribute("type") || "").trim().toLowerCase());
+  return JAVASCRIPT_TYPES.has(scriptType(el));
 }
 
 /** A data block (application/json, text/template, ...) never runs, so it stays in the content as authored. */
 function isExecutableScript(el: AssemblyAttributed): boolean {
-  const type = (el.getAttribute("type") || "").trim().toLowerCase();
-  return type === "module" || type === "importmap" || isJavaScriptType(el);
+  const type = scriptType(el);
+  return type === "module" || type === "importmap" || JAVASCRIPT_TYPES.has(type);
 }
 
 function executableScripts<TElement extends AssemblyAttributed>(
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index a7743f7f82b..1595d52a5b6 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -2877,7 +2877,11 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
   <script>window.__timelines = window.__timelines || {}; window.__timelines.${id} = 1;</script>
 </div></template>`;
 
-  async function bundleFilm(sceneExtra: string, options?: { sceneParts?: boolean }) {
+  async function bundleFilm(
+    sceneExtra: string,
+    options?: { sceneParts?: boolean },
+    files: Record<string, string> = {},
+  ) {
     const dir = makeTempProject({
       "index.html": `<!doctype html>
 <html><body>
@@ -2889,9 +2893,11 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
 </body></html>`,
       "compositions/intro.html": sceneFile("intro", ""),
       "compositions/scene.html": sceneFile("scene", sceneExtra),
+      ...files,
     });
     try {
-      return parseHTML(await bundleToSingleHtml(dir, options)).document;
+      const html = await bundleToSingleHtml(dir, options);
+      return Object.assign(parseHTML(html).document, { html });
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -2938,6 +2944,25 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
       expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
     },
   );
+
+  it.each([
+    [false, `<script>window.broken = {:</script>`],
+    [true, `<script>window.broken = {:</script>`],
+    [true, ""],
+  ])(
+    "escapes a composition script it does not merge (sceneParts %s, extra %j)",
+    async (sceneParts, extra) => {
+      const document = await bundleFilm(
+        `<script src="lib.js"></script>${extra}`,
+        { sceneParts },
+        { "compositions/lib.js": 'window.tag = "</script><b>LEAK</b><!--";' },
+      );
+      expect(document.html).not.toContain("</script><b>LEAK");
+      const lib = runnable(document).find((el) => el.textContent?.includes("LEAK"));
+      const literal = lib?.textContent?.match(/window\.tag\s*=\s*("(?:[^"\\]|\\.)*")/)?.[1];
+      expect(new Function(`return ${literal}`)()).toBe("</script><b>LEAK</b><!--");
+    },
+  );
 });
 
 describe("bundleToSingleHtml sceneParts", () => {
diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index 769807bd453..be06aff028f 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -6,10 +6,10 @@ import {
   headStyleRuns,
   INLINED_FILE_ATTR,
   inlineScriptRuns,
-  isJavaScriptType,
   styleElementsFor,
   type CompositionStyle,
 } from "./scriptRuns";
+import { isJavaScriptType } from "./compositionAssembly";
 import { SCENE_PART_ATTR } from "../sceneParts";
 import {
   ensureExternalScriptTag,
@@ -745,8 +745,11 @@ function coalesceHeadStylesAndBodyScripts(document: Document): void {
   )) {
     const mergedJs = joinJsChunks(members.map((el) => el.textContent || ""));
     const stripped = mergedJs ? stripJsComments(mergedJs) : "";
-    // Left unmerged, a script that does not parse fails alone instead of taking every timeline with it.
-    if (stripped === null) continue;
+    if (stripped === null) {
+      // Left unmerged, a script that does not parse fails alone instead of taking every timeline with it.
+      for (const el of members) el.textContent = inlineScriptSource(el.textContent || "");
+      continue;
+    }
     for (const el of members) el.remove();
     if (!stripped) continue;
     const inlineScript = document.createElement("script");
@@ -815,10 +818,19 @@ function stripJsComments(source: string): string | null {
   }
 }
 
+/** Whether script text parses; a run that does not is left as separate scripts, so one bad script fails alone. */
+export function parsesAsScript(source: string): boolean {
+  return stripJsComments(source) !== null;
+}
+
 function stripJsCommentsParserSafe(source: string): string {
   return source ? (stripJsComments(source) ?? source) : source;
 }
 
+function inlineScriptSource(js: string): string {
+  return escapeInlineScriptSource(stripJsCommentsParserSafe(js));
+}
+
 export interface BundleOptions {
   /** Project-relative HTML entry to bundle. Defaults to `index.html`. */
   entryFile?: string;
@@ -1274,10 +1286,11 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
     const texts = chunks.map((chunk) => (typeof chunk === "string" ? chunk : chunk()));
     const joined = joinJsChunks(texts);
     // One script per chunk when the run does not parse, so one bad composition script fails alone.
-    for (const text of stripJsComments(joined) === null ? texts : [joined]) {
+    for (const text of parsesAsScript(joined) ? [joined] : texts.filter(Boolean)) {
       const script = document.createElement("script");
+      // Scene parts are pinned, so the run merge that escapes the other scripts never reaches them.
       if (scene) script.setAttribute(SCENE_PART_ATTR, scene);
-      script.textContent = text;
+      script.textContent = scene ? inlineScriptSource(text) : text;
       document.body.appendChild(script);
     }
   }
diff --git a/packages/core/src/compiler/index.ts b/packages/core/src/compiler/index.ts
index 06e102e96ce..c8fda718af2 100644
--- a/packages/core/src/compiler/index.ts
+++ b/packages/core/src/compiler/index.ts
@@ -36,6 +36,7 @@ export {
   prepareFlattenedInnerRoot,
   FLATTENED_INNER_ROOT_STRIP_ATTRS,
   emitRootCompositionVariableStyles,
+  parsesAsScript,
 } from "./htmlBundler";
 export { readDeclaredDefaults, parseHostVariableValues } from "../runtime/getVariables";
 
@@ -69,11 +70,11 @@ export {
   deferScriptsUntilFonts,
   headStyleRuns,
   inlineScriptRuns,
-  isJavaScriptType,
   styleElementsFor,
   type CompositionStyle,
   type InlineScriptRun,
 } from "./scriptRuns";
+export { isJavaScriptType } from "./compositionAssembly";
 
 // Static guard
 export {
diff --git a/packages/core/src/compiler/scriptRuns.ts b/packages/core/src/compiler/scriptRuns.ts
index 9aaa7a9efcb..c0ec7c8b373 100644
--- a/packages/core/src/compiler/scriptRuns.ts
+++ b/packages/core/src/compiler/scriptRuns.ts
@@ -1,7 +1,5 @@
 import { isJavaScriptType } from "./compositionAssembly";
 
-export { isJavaScriptType };
-
 export interface InlineScriptRun {
   members: Element[];
   /** First later script that executes on its own; the merged run must stay before it. Null: end of body. */
diff --git a/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts b/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
index 9661ad0ea29..1f15848a7e9 100644
--- a/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
+++ b/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
@@ -140,4 +140,73 @@ describe("compileForRender script order", () => {
       expect(text.some((t) => t.includes(mark))).toBe(true);
     }
   });
+
+  describe("composition scripts that are not JavaScript", () => {
+    const scene = (id: string, extra: string) => `<template id="${id}-template">
+<div data-composition-id="${id}" data-width="320" data-height="180" data-duration="2">
+  ${extra}
+  <script>window.__timelines = window.__timelines || {}; window.__timelines.${id} = 1;</script>
+</div></template>`;
+
+    async function compileFilm(sceneExtra: string) {
+      const dir = project({
+        "index.html": `<!doctype html>
+<html><body>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="4">
+    <div data-composition-id="intro" data-composition-src="compositions/intro.html" data-start="0" data-duration="2"></div>
+    <div data-composition-id="scene" data-composition-src="compositions/scene.html" data-start="2" data-duration="2"></div>
+  </div>
+  <script>window.__timelines = window.__timelines || {}; window.__timelines.main = 1;</script>
+</body></html>`,
+        "compositions/intro.html": scene("intro", ""),
+        "compositions/scene.html": scene("scene", sceneExtra),
+      });
+      const { html } = await compileForRender(
+        dir,
+        join(dir, "index.html"),
+        join(dir, ".downloads"),
+        {
+          allowSystemFontCapture: false,
+        },
+      );
+      return parseHTML(html).document;
+    }
+
+    const runnable = (document: Document) => [
+      ...document.querySelectorAll(`body script[type="${AFTER_FONTS_SCRIPT_TYPE}"]:not([src])`),
+    ];
+    const parses = (el: Element) => {
+      try {
+        new Function(el.textContent ?? "");
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    const timelinesThatRun = (document: Document) =>
+      ["main", "intro", "scene"].filter((id) =>
+        runnable(document).some(
+          (el) => parses(el) && (el.textContent ?? "").includes(`__timelines.${id} =`),
+        ),
+      );
+
+    it("keeps a sub-composition's JSON data script readable and out of the JavaScript", async () => {
+      const document = await compileFilm(
+        `<script type="application/json" id="meta">{"title": "x", "beats": [1, 2]}</script>`,
+      );
+      const meta = document.querySelector('script[type="application/json"]');
+      expect(meta?.getAttribute("id")).toBe("meta");
+      expect(JSON.parse(meta?.textContent ?? "")).toEqual({ title: "x", beats: [1, 2] });
+      expect(runnable(document).every(parses)).toBe(true);
+      expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
+    });
+
+    it("keeps a sub-composition script that does not parse apart, so the others still run", async () => {
+      const document = await compileFilm(`<script>window.broken = {:</script>`);
+      const broken = runnable(document).filter((el) => !parses(el));
+      expect(broken).toHaveLength(1);
+      expect(broken[0]!.textContent).toContain("window.broken");
+      expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
+    });
+  });
 });
diff --git a/packages/producer/src/services/htmlCompiler.ts b/packages/producer/src/services/htmlCompiler.ts
index db9762c74b0..28d66d5bae8 100644
--- a/packages/producer/src/services/htmlCompiler.ts
+++ b/packages/producer/src/services/htmlCompiler.ts
@@ -54,6 +54,7 @@ import {
   parseHostVariableValues,
   headStyleRuns,
   inlineScriptRuns,
+  parsesAsScript,
   styleElementsFor,
   insertBeforeCloseTag,
   isRuntimeFileUrl,
@@ -945,6 +946,7 @@ function coalesceHeadStylesAndBodyScripts(html: string): string {
         .filter(Boolean)
         .join("\n;\n")
         .trim();
+      if (mergedJs && !parsesAsScript(mergedJs)) continue;
       for (const el of members) el.remove();
       if (!mergedJs) continue;
       const script = document.createElement("script");
@@ -1103,9 +1105,12 @@ function inlineSubCompositions(
     let pending = variablesByCompScript ? [variablesByCompScript] : [];
     const flushInline = () => {
       if (!pending.length) return;
-      const scriptEl = document.createElement("script");
-      scriptEl.textContent = pending.join("\n;\n");
-      body.appendChild(scriptEl);
+      const joined = pending.join("\n;\n");
+      for (const text of parsesAsScript(joined) ? [joined] : pending) {
+        const scriptEl = document.createElement("script");
+        scriptEl.textContent = text;
+        body.appendChild(scriptEl);
+      }
       pending = [];
     };
     for (const item of result.scriptItems) {

From bf422a628d02eb7eee059ef2d52f9a51ab6b81db Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Thu, 8 Oct 2026 01:52:17 -0700
Subject: [PATCH 3/9] refactor(core): carry the bundler's script-merge reasons
 in names, not comments

---
 packages/core/src/compiler/htmlBundler.ts | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index be06aff028f..b4455aca7e6 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -744,9 +744,8 @@ function coalesceHeadStylesAndBodyScripts(document: Document): void {
     isPinned,
   )) {
     const mergedJs = joinJsChunks(members.map((el) => el.textContent || ""));
-    const stripped = mergedJs ? stripJsComments(mergedJs) : "";
+    const stripped = mergedJs ? stripJsCommentsIfParses(mergedJs) : "";
     if (stripped === null) {
-      // Left unmerged, a script that does not parse fails alone instead of taking every timeline with it.
       for (const el of members) el.textContent = inlineScriptSource(el.textContent || "");
       continue;
     }
@@ -805,8 +804,7 @@ function joinJsChunks(chunks: string[]): string {
     .join("\n");
 }
 
-/** Null when the source does not parse. */
-function stripJsComments(source: string): string | null {
+function stripJsCommentsIfParses(source: string): string | null {
   try {
     return transformSync(source, {
       loader: "js",
@@ -818,13 +816,12 @@ function stripJsComments(source: string): string | null {
   }
 }
 
-/** Whether script text parses; a run that does not is left as separate scripts, so one bad script fails alone. */
 export function parsesAsScript(source: string): boolean {
-  return stripJsComments(source) !== null;
+  return stripJsCommentsIfParses(source) !== null;
 }
 
 function stripJsCommentsParserSafe(source: string): string {
-  return source ? (stripJsComments(source) ?? source) : source;
+  return source ? (stripJsCommentsIfParses(source) ?? source) : source;
 }
 
 function inlineScriptSource(js: string): string {
@@ -1285,12 +1282,11 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
   for (const { scene, chunks } of scriptRuns) {
     const texts = chunks.map((chunk) => (typeof chunk === "string" ? chunk : chunk()));
     const joined = joinJsChunks(texts);
-    // One script per chunk when the run does not parse, so one bad composition script fails alone.
+    const skipsRunMerge = Boolean(scene);
     for (const text of parsesAsScript(joined) ? [joined] : texts.filter(Boolean)) {
       const script = document.createElement("script");
-      // Scene parts are pinned, so the run merge that escapes the other scripts never reaches them.
       if (scene) script.setAttribute(SCENE_PART_ATTR, scene);
-      script.textContent = scene ? inlineScriptSource(text) : text;
+      script.textContent = skipsRunMerge ? inlineScriptSource(text) : text;
       document.body.appendChild(script);
     }
   }

From 4b8d483c836e565a350e31778bc09f57404f4f0a Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Thu, 8 Oct 2026 08:21:42 -0700
Subject: [PATCH 4/9] fix(core): every composition path runs only the scripts a
 browser would

A script check now matches the browser (esbuild accepted export and top-level
await), so such a script can no longer stop every timeline. Inline template
compositions keep data scripts and run module and import map scripts as such.
A data script beside the composition root is mounted next to it, a nomodule
script never runs, and the render path merges scripts on a page with no head.
---
 .../core/src/compiler/compositionAssembly.ts  |  25 +++-
 .../core/src/compiler/htmlBundler.test.ts     | 109 +++++++++++++++++-
 packages/core/src/compiler/htmlBundler.ts     |  57 +++++----
 .../src/compiler/inlineSubCompositions.ts     |   2 +
 .../src/runtime/compositionLoader.test.ts     |  23 ++++
 .../core/src/runtime/compositionLoader.ts     |   2 +
 .../services/htmlCompiler.scriptOrder.test.ts |  19 ++-
 .../producer/src/services/htmlCompiler.ts     |   4 +-
 8 files changed, 207 insertions(+), 34 deletions(-)

diff --git a/packages/core/src/compiler/compositionAssembly.ts b/packages/core/src/compiler/compositionAssembly.ts
index 85d568df496..b787e54e591 100644
--- a/packages/core/src/compiler/compositionAssembly.ts
+++ b/packages/core/src/compiler/compositionAssembly.ts
@@ -61,13 +61,20 @@ export function isJavaScriptType(el: AssemblyAttributed): boolean {
   return JAVASCRIPT_TYPES.has(scriptType(el));
 }
 
-/** A data block (application/json, text/template, ...) never runs, so it stays in the content as authored. */
+/** A data block (application/json, text/template, ...) or a nomodule script never runs, so it is mounted as authored. */
 function isExecutableScript(el: AssemblyAttributed): boolean {
+  if (el.getAttribute("nomodule") !== null) return false;
   const type = scriptType(el);
   return type === "module" || type === "importmap" || JAVASCRIPT_TYPES.has(type);
 }
 
-function executableScripts<TElement extends AssemblyAttributed>(
+function inertScripts<TElement extends AssemblyAttributed>(
+  node: AssemblyQueryable<TElement> | null | undefined,
+): TElement[] {
+  return toArray(node?.querySelectorAll(SCRIPT_SELECTOR)).filter((el) => !isExecutableScript(el));
+}
+
+export function executableScripts<TElement extends AssemblyAttributed>(
   node: AssemblyQueryable<TElement> | null | undefined,
 ): TElement[] {
   return toArray(node?.querySelectorAll(SCRIPT_SELECTOR)).filter(isExecutableScript);
@@ -183,6 +190,9 @@ export interface CompositionAssemblyPlan<TElement extends AssemblyAttributed> {
   /** Head and content links to hoist into the host document. */
   linkSources: TElement[];
 
+  /** Inert scripts the mounted root would leave behind; both paths mount them next to it. */
+  inertScriptsOutsideRoot: TElement[];
+
   /**
    * Nodes that may declare the composition's variable defaults, in precedence
    * order — later wins. Full-document compositions declare on `<html>`;
@@ -206,9 +216,9 @@ function toArray<TElement>(items: Iterable<TElement> | null | undefined): TEleme
  * how it is identified. Pure: it reads attributes and runs selectors, and does
  * not mutate, fetch, or touch a filesystem.
  */
-export function planCompositionAssembly<TElement extends AssemblyAttributed>(
-  input: CompositionAssemblyInput<TElement>,
-): CompositionAssemblyPlan<TElement> {
+export function planCompositionAssembly<
+  TElement extends AssemblyAttributed & AssemblyQueryable<TElement>,
+>(input: CompositionAssemblyInput<TElement>): CompositionAssemblyPlan<TElement> {
   const { contentNode, head, documentElement, hasTemplate, compositionId } = input;
 
   const compositionRoots = toArray(contentNode.querySelectorAll(COMPOSITION_ROOT_SELECTOR));
@@ -224,6 +234,7 @@ export function planCompositionAssembly<TElement extends AssemblyAttributed>(
 
   // A templated composition's <head> belongs to its host page, not to it.
   const assetHead = hasTemplate ? null : (head ?? null);
+  const mountedInert = innerRoot ? inertScripts(innerRoot) : [];
 
   return {
     innerRoot,
@@ -239,6 +250,10 @@ export function planCompositionAssembly<TElement extends AssemblyAttributed>(
       ...toArray(head?.querySelectorAll(HOISTED_LINK_SELECTOR)),
       ...toArray(contentNode.querySelectorAll(HOISTED_LINK_SELECTOR)),
     ],
+    inertScriptsOutsideRoot: [
+      ...inertScripts(assetHead),
+      ...(innerRoot ? inertScripts(contentNode).filter((el) => !mountedInert.includes(el)) : []),
+    ],
     variableDefaultCarriers: [documentElement, innerRoot].filter(
       (carrier): carrier is TElement => carrier != null,
     ),
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index 1595d52a5b6..8a1a21d5f28 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -2904,7 +2904,7 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
   }
 
   const runnable = (document: Document) =>
-    [...document.querySelectorAll("body script:not([src])")].filter((el) =>
+    [...document.querySelectorAll("body script:not([src]):not([nomodule])")].filter((el) =>
       [null, AFTER_FONTS_SCRIPT_TYPE].includes(el.getAttribute("type")),
     );
   const parses = (el: Element) => {
@@ -2934,17 +2934,114 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
   });
 
-  it.each([false, true])(
-    "keeps a sub-composition script that does not parse apart, so the others still run (sceneParts %s)",
-    async (sceneParts) => {
-      const document = await bundleFilm(`<script>window.broken = {:</script>`, { sceneParts });
+  const BROKEN_INLINE = [`<script>window.broken = {:</script>`, {}] as const;
+  const BROKEN_FILE = [
+    `<script src="lib.js"></script>`,
+    { "compositions/lib.js": "export const broken = 1;" },
+  ] as const;
+  it.each([
+    [false, ...BROKEN_INLINE],
+    [true, ...BROKEN_INLINE],
+    [false, ...BROKEN_FILE],
+    [true, ...BROKEN_FILE],
+  ])(
+    "keeps a sub-composition script that does not parse apart, so the others still run (sceneParts %s, %s)",
+    async (sceneParts, extra, files) => {
+      const document = await bundleFilm(extra, { sceneParts }, files);
       const broken = runnable(document).filter((el) => !parses(el));
       expect(broken).toHaveLength(1);
-      expect(broken[0]!.textContent).toContain("window.broken");
+      expect(broken[0]!.textContent).toContain("broken");
       expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
     },
   );
 
+  it("mounts a JSON data script authored outside the composition root next to it", async () => {
+    const dir = makeTempProject({
+      "index.html": `<!doctype html>
+<html><body>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="4">
+    <div data-composition-id="scene" data-composition-src="compositions/scene.html" data-start="0" data-duration="2"></div>
+    <div data-composition-id="page" data-composition-src="compositions/page.html" data-start="2" data-duration="2"></div>
+  </div>
+</body></html>`,
+      "compositions/scene.html": `<template id="scene-template">
+  <script type="application/json" id="beside">{"where": "template"}</script>
+  <div data-composition-id="scene" data-width="320" data-height="180"></div>
+</template>`,
+      "compositions/page.html": `<!doctype html>
+<html><head><script type="application/json" id="in-head">{"where": "head"}</script></head>
+<body><div data-composition-id="page" data-width="320" data-height="180"></div></body></html>`,
+    });
+    try {
+      const document = parseHTML(await bundleToSingleHtml(dir)).document;
+      const beside = document.querySelector('[data-composition-id="scene"] #beside');
+      const inHead = document.querySelector('[data-composition-id="page"] #in-head');
+      expect(JSON.parse(beside?.textContent ?? "")).toEqual({ where: "template" });
+      expect(JSON.parse(inHead?.textContent ?? "")).toEqual({ where: "head" });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("does not run a sub-composition's nomodule script", async () => {
+    const document = await bundleFilm(`<script nomodule>window.LEGACY_ONLY = 1;</script>`);
+    expect(runnable(document).some((el) => el.textContent?.includes("LEGACY_ONLY"))).toBe(false);
+  });
+
+  it("runs an inline template composition's module script as a module and merges its import map", async () => {
+    const dir = makeTempProject({
+      "index.html": `<!doctype html>
+<html><body>
+  <template id="card-template"><div data-composition-id="card" data-width="320" data-height="180">
+    <script type="importmap">{"imports": {"lib": "./lib.js"}}</script>
+    <script type="module">import "lib"; window.CARD_MODULE = 1;</script>
+  </div></template>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="2">
+    <div data-composition-id="card" data-start="0" data-duration="2"></div>
+  </div>
+</body></html>`,
+    });
+    try {
+      const document = parseHTML(await bundleToSingleHtml(dir)).document;
+      expect(runnable(document).some((el) => el.textContent?.includes("CARD_MODULE"))).toBe(false);
+      const modules = [...document.querySelectorAll("script")].filter((el) =>
+        (el.getAttribute("type") ?? "").includes("module"),
+      );
+      expect(modules.some((el) => el.textContent?.includes("CARD_MODULE"))).toBe(true);
+      const map = document.querySelector('script[type="importmap"]');
+      expect(JSON.parse(map?.textContent ?? "{}").imports).toEqual({ lib: "./lib.js" });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps an inline template composition's JSON data script readable and out of the JavaScript", async () => {
+    const dir = makeTempProject({
+      "index.html": `<!doctype html>
+<html><body>
+  <template id="card-template"><div data-composition-id="card" data-width="320" data-height="180">
+    <script type="application/json" id="card-meta">{"title": "x"}</script>
+    <script>window.__timelines = window.__timelines || {}; window.__timelines.card = 1;</script>
+  </div></template>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="2">
+    <div data-composition-id="card" data-start="0" data-duration="2"></div>
+  </div>
+</body></html>`,
+    });
+    try {
+      const document = parseHTML(await bundleToSingleHtml(dir)).document;
+      const meta = document.querySelector('[data-composition-id="card"] #card-meta');
+      expect(meta?.getAttribute("type")).toBe("application/json");
+      expect(JSON.parse(meta?.textContent ?? "")).toEqual({ title: "x" });
+      expect(runnable(document).every(parses)).toBe(true);
+      expect(runnable(document).some((el) => el.textContent?.includes("__timelines.card ="))).toBe(
+        true,
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it.each([
     [false, `<script>window.broken = {:</script>`],
     [true, `<script>window.broken = {:</script>`],
diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index b4455aca7e6..56832263c7a 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -9,14 +9,14 @@ import {
   styleElementsFor,
   type CompositionStyle,
 } from "./scriptRuns";
-import { isJavaScriptType } from "./compositionAssembly";
+import { executableScripts, isJavaScriptType } from "./compositionAssembly";
 import { SCENE_PART_ATTR } from "../sceneParts";
 import {
   ensureExternalScriptTag,
   readExternalScriptAttributes,
   type ExternalScriptAttributes,
 } from "./externalScripts";
-import { emitMountedModuleScripts } from "./importMaps";
+import { emitMountedModuleScripts, parseImportMap, type ImportMap } from "./importMaps";
 import { markFlattenedInnerRoot } from "../runtime/flattenedRoot";
 export { FLATTENED_INNER_ROOT_STRIP_ATTRS } from "../runtime/flattenedRoot";
 import { parseHostVariableValues, warnUnknownEnumValues } from "../runtime/getVariables";
@@ -48,6 +48,7 @@ import {
   dedupeFontFaceRules,
   scopeCssToComposition,
   wrapInlineScriptWithErrorBoundary,
+  scopedModulePrelude,
   wrapScopedCompositionScript,
 } from "./compositionScoping";
 import { validateHyperframeHtmlContract } from "./staticGuard";
@@ -744,15 +745,14 @@ function coalesceHeadStylesAndBodyScripts(document: Document): void {
     isPinned,
   )) {
     const mergedJs = joinJsChunks(members.map((el) => el.textContent || ""));
-    const stripped = mergedJs ? stripJsCommentsIfParses(mergedJs) : "";
-    if (stripped === null) {
+    if (mergedJs && !parsesAsScript(mergedJs)) {
       for (const el of members) el.textContent = inlineScriptSource(el.textContent || "");
       continue;
     }
     for (const el of members) el.remove();
-    if (!stripped) continue;
+    if (!mergedJs) continue;
     const inlineScript = document.createElement("script");
-    inlineScript.textContent = escapeInlineScriptSource(stripped);
+    inlineScript.textContent = inlineScriptSource(mergedJs);
     if (anchor) anchor.before(inlineScript);
     else document.body.appendChild(inlineScript);
   }
@@ -804,24 +804,24 @@ function joinJsChunks(chunks: string[]): string {
     .join("\n");
 }
 
-function stripJsCommentsIfParses(source: string): string | null {
+// Compiled, never called: esbuild accepts export, top-level await and import.meta, which a classic script rejects.
+export function parsesAsScript(source: string): boolean {
   try {
-    return transformSync(source, {
-      loader: "js",
-      minify: false,
-      legalComments: "none",
-    }).code.trim();
+    new Function(source);
+    return true;
   } catch {
-    return null;
+    return false;
   }
 }
 
-export function parsesAsScript(source: string): boolean {
-  return stripJsCommentsIfParses(source) !== null;
-}
-
 function stripJsCommentsParserSafe(source: string): string {
-  return source ? (stripJsCommentsIfParses(source) ?? source) : source;
+  if (!source) return source;
+  try {
+    const result = transformSync(source, { loader: "js", minify: false, legalComments: "none" });
+    return result.code.trim();
+  } catch {
+    return source;
+  }
 }
 
 function inlineScriptSource(js: string): string {
@@ -947,11 +947,24 @@ function hoistCompositionScripts(
     authoredRootId: string | undefined;
     seenCompScriptSrcs: Set<string>;
     compScriptChunks: DeferredScriptChunk[];
+    importMaps: ImportMap[];
+    moduleScripts: string[];
   },
 ): void {
-  for (const scriptEl of [...container.querySelectorAll("script")]) {
+  for (const scriptEl of executableScripts(container)) {
     const externalSrc = (scriptEl.getAttribute("src") || "").trim();
-    if (externalSrc) {
+    const type = (scriptEl.getAttribute("type") || "").trim().toLowerCase();
+    if (!externalSrc && type === "importmap") {
+      const map = parseImportMap(scriptEl.textContent || "", (url) => url);
+      if (map) opts.importMaps.push(map);
+      else
+        console.warn(
+          `[HyperFrames] ${opts.compId}: import map is not valid JSON, so it is skipped.`,
+        );
+    } else if (!externalSrc && type === "module") {
+      const prelude = opts.compId ? scopedModulePrelude(opts.runtimeCompId || opts.compId) : "";
+      opts.moduleScripts.push(prelude + (scriptEl.textContent || ""));
+    } else if (externalSrc) {
       hoistExternalScript(
         externalSrc,
         opts.projectDir,
@@ -1202,6 +1215,8 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
           authoredRootId: authoredRootId ?? undefined,
           seenCompScriptSrcs,
           compScriptChunks,
+          importMaps: subCompResult.importMaps,
+          moduleScripts: subCompResult.moduleScripts,
         });
 
         // Copy dimension attributes from inner root to host if not already set
@@ -1237,6 +1252,8 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
           authoredRootId: undefined,
           seenCompScriptSrcs,
           compScriptChunks,
+          importMaps: subCompResult.importMaps,
+          moduleScripts: subCompResult.moduleScripts,
         });
 
         host.innerHTML = innerDoc.body.innerHTML || "";
diff --git a/packages/core/src/compiler/inlineSubCompositions.ts b/packages/core/src/compiler/inlineSubCompositions.ts
index 60ee920019b..d49fb693b09 100644
--- a/packages/core/src/compiler/inlineSubCompositions.ts
+++ b/packages/core/src/compiler/inlineSubCompositions.ts
@@ -641,6 +641,8 @@ export function inlineSubCompositions(
       const bodyHtml = contentDoc.body?.innerHTML || "";
       hostEl.innerHTML = bodyHtml || contentDoc.documentElement?.outerHTML || "";
     }
+    for (const el of plan.inertScriptsOutsideRoot)
+      hostEl.insertAdjacentHTML("beforeend", el.outerHTML);
 
     hostEl.setAttribute("data-composition-file", src);
     hostEl.removeAttribute("data-composition-src");
diff --git a/packages/core/src/runtime/compositionLoader.test.ts b/packages/core/src/runtime/compositionLoader.test.ts
index 4d9e32145d0..325bfa11353 100644
--- a/packages/core/src/runtime/compositionLoader.test.ts
+++ b/packages/core/src/runtime/compositionLoader.test.ts
@@ -1528,6 +1528,29 @@ describe("loadCompositions inline templates", () => {
     expect(JSON.parse(meta?.textContent ?? "")).toEqual({ title: "x" });
   });
 
+  it("mounts a JSON data script authored beside the composition root, and never runs a nomodule script", async () => {
+    const template = document.createElement("template");
+    template.id = "beside-comp-template";
+    template.innerHTML = `
+      <script type="application/json" id="beside">{"where": "template"}</script>
+      <script nomodule>window.__legacyOnly = 1;</script>
+      <div data-composition-id="beside-comp" data-width="1920" data-height="1080"></div>
+    `;
+    document.body.appendChild(template);
+    const host = document.createElement("div");
+    host.setAttribute("data-composition-id", "beside-comp");
+    document.body.appendChild(host);
+
+    const { injectedScripts } = await loadFixture();
+
+    expect(JSON.parse(host.querySelector("#beside")?.textContent ?? "")).toEqual({
+      where: "template",
+    });
+    expect(injectedScripts.some((script) => script.textContent?.includes("__legacyOnly"))).toBe(
+      false,
+    );
+  });
+
   it("copies dimension attributes from template inner root to host", async () => {
     const template = document.createElement("template");
     template.id = "dim-comp-template";
diff --git a/packages/core/src/runtime/compositionLoader.ts b/packages/core/src/runtime/compositionLoader.ts
index b62304639f4..3e83a8e219a 100644
--- a/packages/core/src/runtime/compositionLoader.ts
+++ b/packages/core/src/runtime/compositionLoader.ts
@@ -579,6 +579,8 @@ async function mountCompositionContent(params: {
     params.host.innerHTML = params.fallbackBodyInnerHtml;
     stripExtractedCompositionAssets(params.host);
   }
+  for (const el of plan.inertScriptsOutsideRoot)
+    params.host.appendChild(document.importNode(el, true));
 
   // Stash the per-instance variables BEFORE running scripts. The scoped
   // `getVariables()` injected by `compositionScoping.ts` reads from
diff --git a/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts b/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
index 1f15848a7e9..b5b3ba21b6f 100644
--- a/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
+++ b/packages/producer/src/services/htmlCompiler.scriptOrder.test.ts
@@ -141,6 +141,23 @@ describe("compileForRender script order", () => {
     }
   });
 
+  it("merges adjacent inline scripts on a page with no <head>", async () => {
+    const dir = project({
+      "index.html": `<!doctype html>
+<html><body>
+  <div data-composition-id="root" data-width="320" data-height="180"></div>
+  <script>window.FIRST_HALF = 1;</script>
+  <script>window.SECOND_HALF = 1;</script>
+</body></html>`,
+    });
+    const { html } = await compileForRender(dir, join(dir, "index.html"), join(dir, ".downloads"), {
+      allowSystemFontCapture: false,
+    });
+    const scripts = [...parseHTML(html).document.querySelectorAll("body script")];
+    const first = scripts.find((el) => el.textContent?.includes("FIRST_HALF"));
+    expect(first?.textContent).toContain("SECOND_HALF");
+  });
+
   describe("composition scripts that are not JavaScript", () => {
     const scene = (id: string, extra: string) => `<template id="${id}-template">
 <div data-composition-id="${id}" data-width="320" data-height="180" data-duration="2">
@@ -151,7 +168,7 @@ describe("compileForRender script order", () => {
     async function compileFilm(sceneExtra: string) {
       const dir = project({
         "index.html": `<!doctype html>
-<html><body>
+<html><head></head><body>
   <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="4">
     <div data-composition-id="intro" data-composition-src="compositions/intro.html" data-start="0" data-duration="2"></div>
     <div data-composition-id="scene" data-composition-src="compositions/scene.html" data-start="2" data-duration="2"></div>
diff --git a/packages/producer/src/services/htmlCompiler.ts b/packages/producer/src/services/htmlCompiler.ts
index 28d66d5bae8..4c8417c9548 100644
--- a/packages/producer/src/services/htmlCompiler.ts
+++ b/packages/producer/src/services/htmlCompiler.ts
@@ -907,9 +907,9 @@ function coalesceHeadStylesAndBodyScripts(html: string): string {
   const { document } = parseHTML(html);
   const head = document.querySelector("head");
   const body = document.querySelector("body");
-  if (!head) return html;
+  if (!head && !body) return html;
 
-  const styleEls = Array.from(head.querySelectorAll("style"));
+  const styleEls = head ? Array.from(head.querySelectorAll("style")) : [];
   const importRe = /@import\s+url\([^)]*\)\s*;|@import\s+["'][^"']+["']\s*;/gi;
   for (const run of styleEls.length > 1 ? headStyleRuns(styleEls) : []) {
     const imports: string[] = [];

From 159adf44671f2bf44e50d2ddc2349a7bad11e7d5 Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Fri, 9 Oct 2026 10:06:56 -0700
Subject: [PATCH 5/9] fix(core): keep inline-template data scripts and run a
 script with a top-level return alone

- parsesAsScript compiles with vm.Script, so a top-level return or new.target
  no longer passes as mergeable and stops every timeline.
- The bundler's inline <template id="X-template"> path asks the shared
  assembly plan for its root and mounts the inert scripts authored beside it.
- nomodule only stops classic scripts; type="module" nomodule runs, as in
  browsers.
---
 .../src/compiler/compositionAssembly.test.ts  |  8 +++++
 .../core/src/compiler/compositionAssembly.ts  |  6 ++--
 .../core/src/compiler/htmlBundler.test.ts     | 32 ++++++++++++++++++-
 packages/core/src/compiler/htmlBundler.ts     | 21 +++++++++---
 4 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/packages/core/src/compiler/compositionAssembly.test.ts b/packages/core/src/compiler/compositionAssembly.test.ts
index f6a256a44b4..76254294f8a 100644
--- a/packages/core/src/compiler/compositionAssembly.test.ts
+++ b/packages/core/src/compiler/compositionAssembly.test.ts
@@ -126,6 +126,14 @@ describe("planCompositionAssembly", () => {
     expect(ids(plan.scriptSources)).toEqual(["head-script", "body-script"]);
   });
 
+  it.each([
+    [`<script nomodule></script>`, false],
+    [`<script type="module" nomodule></script>`, true],
+  ])("extracts %s only when a browser runs it: %s", (script, runs) => {
+    const plan = planFor(`<template><div data-composition-id="s">${script}</div></template>`, "s");
+    expect(plan.scriptSources).toHaveLength(runs ? 1 : 0);
+  });
+
   it("does not treat a templated composition's page head as an asset source", () => {
     // The head belongs to the host page, not to the composition; only the
     // non-templated (full-document) shape carries composition assets in <head>.
diff --git a/packages/core/src/compiler/compositionAssembly.ts b/packages/core/src/compiler/compositionAssembly.ts
index b787e54e591..6d5074425dd 100644
--- a/packages/core/src/compiler/compositionAssembly.ts
+++ b/packages/core/src/compiler/compositionAssembly.ts
@@ -61,11 +61,11 @@ export function isJavaScriptType(el: AssemblyAttributed): boolean {
   return JAVASCRIPT_TYPES.has(scriptType(el));
 }
 
-/** A data block (application/json, text/template, ...) or a nomodule script never runs, so it is mounted as authored. */
+/** A data block (application/json, text/template, ...) or a classic nomodule script never runs, so it is mounted as authored. */
 function isExecutableScript(el: AssemblyAttributed): boolean {
-  if (el.getAttribute("nomodule") !== null) return false;
   const type = scriptType(el);
-  return type === "module" || type === "importmap" || JAVASCRIPT_TYPES.has(type);
+  if (type === "module" || type === "importmap") return true;
+  return JAVASCRIPT_TYPES.has(type) && el.getAttribute("nomodule") === null;
 }
 
 function inertScripts<TElement extends AssemblyAttributed>(
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index 8a1a21d5f28..8661256fd61 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -3,6 +3,7 @@ import { mkdtempSync, writeFileSync, mkdirSync, symlinkSync, rmSync } from "node
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { parseHTML } from "linkedom";
+import { Script } from "node:vm";
 import { afterEach, beforeEach, describe, it, expect, vi } from "vitest";
 import { bundleToSingleHtml, emitRootCompositionVariableStyles } from "./htmlBundler";
 import { ensureExternalScriptTag } from "./externalScripts";
@@ -2909,7 +2910,7 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     );
   const parses = (el: Element) => {
     try {
-      new Function(el.textContent ?? "");
+      new Script(el.textContent ?? "");
       return true;
     } catch {
       return false;
@@ -2935,6 +2936,11 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
   });
 
   const BROKEN_INLINE = [`<script>window.broken = {:</script>`, {}] as const;
+  // An inline script is wrapped in a function, where return is legal; a local file is not.
+  const BROKEN_RETURN = [
+    `<script src="return.js"></script>`,
+    { "compositions/return.js": "window.broken = 1; return;" },
+  ] as const;
   const BROKEN_FILE = [
     `<script src="lib.js"></script>`,
     { "compositions/lib.js": "export const broken = 1;" },
@@ -2944,6 +2950,8 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     [true, ...BROKEN_INLINE],
     [false, ...BROKEN_FILE],
     [true, ...BROKEN_FILE],
+    [false, ...BROKEN_RETURN],
+    [true, ...BROKEN_RETURN],
   ])(
     "keeps a sub-composition script that does not parse apart, so the others still run (sceneParts %s, %s)",
     async (sceneParts, extra, files) => {
@@ -3042,6 +3050,28 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     }
   });
 
+  it("mounts a JSON data script authored beside the root of an inline template composition", async () => {
+    const dir = makeTempProject({
+      "index.html": `<!doctype html>
+<html><body>
+  <template id="card-template">
+    <script type="application/json" id="beside">{"where": "template"}</script>
+    <div data-composition-id="card" data-width="320" data-height="180"></div>
+  </template>
+  <div id="root" data-composition-id="main" data-width="320" data-height="180" data-duration="2">
+    <div data-composition-id="card" data-start="0" data-duration="2"></div>
+  </div>
+</body></html>`,
+    });
+    try {
+      const document = parseHTML(await bundleToSingleHtml(dir)).document;
+      const beside = document.querySelector('[data-composition-id="card"] #beside');
+      expect(JSON.parse(beside?.textContent ?? "")).toEqual({ where: "template" });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it.each([
     [false, `<script>window.broken = {:</script>`],
     [true, `<script>window.broken = {:</script>`],
diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index 56832263c7a..32f05231397 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -9,7 +9,11 @@ import {
   styleElementsFor,
   type CompositionStyle,
 } from "./scriptRuns";
-import { executableScripts, isJavaScriptType } from "./compositionAssembly";
+import {
+  executableScripts,
+  isJavaScriptType,
+  planCompositionAssembly,
+} from "./compositionAssembly";
 import { SCENE_PART_ATTR } from "../sceneParts";
 import {
   ensureExternalScriptTag,
@@ -24,6 +28,7 @@ import { sanitizeCssValue } from "../runtime/applyVariableBindings";
 import { cssVariableName } from "../tokenSlug";
 import { AsyncLocalStorage } from "async_hooks";
 import { readFileSync, existsSync, statSync } from "fs";
+import { Script } from "vm";
 import { resolve, relative, dirname, isAbsolute, sep } from "path";
 import {
   decodeCssEscapes,
@@ -59,7 +64,6 @@ import {
   inlineSubCompositions,
   refuseSwapsReachedByRootScripts,
 } from "./inlineSubCompositions";
-import { queryByAttr } from "../utils/cssSelector";
 import { isSafePath, resolveWithinProject } from "../safePath.js";
 import { ensureHfIds } from "@hyperframes/parsers/hf-ids";
 import { HF_COLOR_GRADING_ATTR } from "../colorGrading";
@@ -804,10 +808,10 @@ function joinJsChunks(chunks: string[]): string {
     .join("\n");
 }
 
-// Compiled, never called: esbuild accepts export, top-level await and import.meta, which a classic script rejects.
+// Compiled as a classic script, never run: esbuild accepts export, top-level await and return, which a <script> rejects.
 export function parsesAsScript(source: string): boolean {
   try {
-    new Function(source);
+    new Script(source);
     return true;
   } catch {
     return false;
@@ -1165,7 +1169,12 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
       const hostIdentity = hostIdentityByElement.get(host);
       const runtimeCompId = hostIdentity?.runtimeCompositionId || compId;
       const innerDoc = parseHTMLContent(templateHtml);
-      const innerRoot = queryByAttr(innerDoc, "data-composition-id", compId);
+      const plan = planCompositionAssembly<Element>({
+        contentNode: innerDoc,
+        hasTemplate: true,
+        compositionId: compId,
+      });
+      const innerRoot = plan.innerRoot;
       const authoredRootId = innerRoot?.getAttribute("id")?.trim() || null;
       const runtimeScope = runtimeCompId
         ? cssAttributeSelector("data-composition-id", runtimeCompId)
@@ -1258,6 +1267,8 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
 
         host.innerHTML = innerDoc.body.innerHTML || "";
       }
+      for (const el of plan.inertScriptsOutsideRoot)
+        host.insertAdjacentHTML("beforeend", el.outerHTML);
     }
 
     // Remove the template element from the document

From e8105f9a836688b23ace16baca2297c21d6eaf3f Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Fri, 9 Oct 2026 10:20:11 -0700
Subject: [PATCH 6/9] refactor(core): the inline template path reads its root
 id from the shared assembly plan

---
 packages/core/src/compiler/htmlBundler.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index 32f05231397..5c3acd2659d 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -1174,8 +1174,7 @@ async function bundleProject(projectDir: string, options?: BundleOptions): Promi
         hasTemplate: true,
         compositionId: compId,
       });
-      const innerRoot = plan.innerRoot;
-      const authoredRootId = innerRoot?.getAttribute("id")?.trim() || null;
+      const { innerRoot, authoredRootId } = plan;
       const runtimeScope = runtimeCompId
         ? cssAttributeSelector("data-composition-id", runtimeCompId)
         : "";

From be97674b521155d6309300ad7270d229039ea15e Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Fri, 9 Oct 2026 11:21:28 -0700
Subject: [PATCH 7/9] fix(core): a broken composition script stays apart under
 Bun as well as Node

parsesAsScript now parses with acorn in script mode instead of vm.Script.
Bun 1.3's vm.Script compiles lazily and accepted any text, so the Studio dev
server merged a broken script with the rest and every timeline stopped.
acorn is already locked for parsers and lint; core now declares it.
---
 bun.lock                                      |  1 +
 packages/core/package.json                    |  1 +
 .../core/src/compiler/htmlBundler.test.ts     | 20 ++++++++++++++++---
 packages/core/src/compiler/htmlBundler.ts     |  7 ++++---
 4 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/bun.lock b/bun.lock
index 64948f4e616..28dfb581fd0 100644
--- a/bun.lock
+++ b/bun.lock
@@ -116,6 +116,7 @@
         "@hyperframes/lint": "workspace:*",
         "@hyperframes/parsers": "workspace:*",
         "@hyperframes/studio-server": "workspace:*",
+        "acorn": "^8.17.0",
         "bpm-detective": "^2.0.5",
         "linkedom": "^0.18.12",
         "postcss": "^8.5.8",
diff --git a/packages/core/package.json b/packages/core/package.json
index 9f647802bc6..1d657012ea6 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -902,6 +902,7 @@
     "@hyperframes/lint": "workspace:*",
     "@hyperframes/parsers": "workspace:*",
     "@hyperframes/studio-server": "workspace:*",
+    "acorn": "^8.17.0",
     "bpm-detective": "^2.0.5",
     "linkedom": "^0.18.12",
     "postcss": "^8.5.8",
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index 8661256fd61..3a0d9eaa4ff 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -3,9 +3,13 @@ import { mkdtempSync, writeFileSync, mkdirSync, symlinkSync, rmSync } from "node
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { parseHTML } from "linkedom";
-import { Script } from "node:vm";
+import { parse as parseJs } from "acorn";
 import { afterEach, beforeEach, describe, it, expect, vi } from "vitest";
-import { bundleToSingleHtml, emitRootCompositionVariableStyles } from "./htmlBundler";
+import {
+  bundleToSingleHtml,
+  emitRootCompositionVariableStyles,
+  parsesAsScript,
+} from "./htmlBundler";
 import { ensureExternalScriptTag } from "./externalScripts";
 import { resetUnknownEnumWarnings } from "../runtime/getVariables";
 import { sanitizeCssValue } from "../runtime/applyVariableBindings";
@@ -2910,7 +2914,7 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     );
   const parses = (el: Element) => {
     try {
-      new Script(el.textContent ?? "");
+      parseJs(el.textContent ?? "", { ecmaVersion: "latest", sourceType: "script" });
       return true;
     } catch {
       return false;
@@ -2935,6 +2939,16 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
   });
 
+  // A host whose own compile is lazy (Bun 1.3's vm.Script) accepts all of these; the check must not.
+  it.each([
+    ["window.broken = {:", false],
+    ["window.broken = 1; return;", false],
+    ["export const broken = 1;", false],
+    ["window.ok = 1;", true],
+  ])("parsesAsScript(%j) is %s on any host engine", (source, parses) => {
+    expect(parsesAsScript(source)).toBe(parses);
+  });
+
   const BROKEN_INLINE = [`<script>window.broken = {:</script>`, {}] as const;
   // An inline script is wrapped in a function, where return is legal; a local file is not.
   const BROKEN_RETURN = [
diff --git a/packages/core/src/compiler/htmlBundler.ts b/packages/core/src/compiler/htmlBundler.ts
index 5c3acd2659d..e51c48a8753 100644
--- a/packages/core/src/compiler/htmlBundler.ts
+++ b/packages/core/src/compiler/htmlBundler.ts
@@ -28,7 +28,7 @@ import { sanitizeCssValue } from "../runtime/applyVariableBindings";
 import { cssVariableName } from "../tokenSlug";
 import { AsyncLocalStorage } from "async_hooks";
 import { readFileSync, existsSync, statSync } from "fs";
-import { Script } from "vm";
+import { parse as parseJs } from "acorn";
 import { resolve, relative, dirname, isAbsolute, sep } from "path";
 import {
   decodeCssEscapes,
@@ -808,10 +808,11 @@ function joinJsChunks(chunks: string[]): string {
     .join("\n");
 }
 
-// Compiled as a classic script, never run: esbuild accepts export, top-level await and return, which a <script> rejects.
+// acorn in script mode, not the host engine: Bun 1.3's vm.Script compiles lazily and accepts anything.
+// esbuild accepts export, top-level await and return, which a <script> rejects; acorn does not.
 export function parsesAsScript(source: string): boolean {
   try {
-    new Script(source);
+    parseJs(source, { ecmaVersion: "latest", sourceType: "script" });
     return true;
   } catch {
     return false;

From 4b0cfdb58ac522738064e991da9360aafed21b25 Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Fri, 9 Oct 2026 12:40:06 -0700
Subject: [PATCH 8/9] test(core): name the parse-check test for what it pins

---
 packages/core/src/compiler/htmlBundler.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index 3a0d9eaa4ff..abbdafe8f37 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -2939,13 +2939,13 @@ describe("bundleToSingleHtml composition scripts that are not JavaScript", () =>
     expect(timelinesThatRun(document)).toEqual(["main", "intro", "scene"]);
   });
 
-  // A host whose own compile is lazy (Bun 1.3's vm.Script) accepts all of these; the check must not.
+  // Bun 1.3's vm.Script accepts all of these; CI runs Node, so this pins the rules, not the engine.
   it.each([
     ["window.broken = {:", false],
     ["window.broken = 1; return;", false],
     ["export const broken = 1;", false],
     ["window.ok = 1;", true],
-  ])("parsesAsScript(%j) is %s on any host engine", (source, parses) => {
+  ])("parsesAsScript(%j) is %s", (source, parses) => {
     expect(parsesAsScript(source)).toBe(parses);
   });
 

From 4218c75f4162484f9cdcb2ec311ce4327b459e71 Mon Sep 17 00:00:00 2001
From: Miguel Angel Simon Sierra <miguel.sierra@heygen.com>
Date: Fri, 9 Oct 2026 12:42:32 -0700
Subject: [PATCH 9/9] style(core): wrap the data-block comment under the line
 limit

---
 packages/core/src/compiler/compositionAssembly.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/compiler/compositionAssembly.ts b/packages/core/src/compiler/compositionAssembly.ts
index 6d5074425dd..97198ecb390 100644
--- a/packages/core/src/compiler/compositionAssembly.ts
+++ b/packages/core/src/compiler/compositionAssembly.ts
@@ -61,7 +61,10 @@ export function isJavaScriptType(el: AssemblyAttributed): boolean {
   return JAVASCRIPT_TYPES.has(scriptType(el));
 }
 
-/** A data block (application/json, text/template, ...) or a classic nomodule script never runs, so it is mounted as authored. */
+/**
+ * A data block (application/json, text/template, ...) or a classic nomodule script never runs,
+ * so it is mounted as authored.
+ */
 function isExecutableScript(el: AssemblyAttributed): boolean {
   const type = scriptType(el);
   if (type === "module" || type === "importmap") return true;