feat(export): enable multi-threaded ffmpeg and add vercel security he…

[codewithakshyaaa]

Description

Description

This PR resolves a critical issue where clicking the "Export" button would completely freeze the browser tab. The application was previously running FFmpeg.wasm in single-threaded mode on the main JavaScript thread, locking the browser's event loop during heavy CPU-bound video processing.

To fix this, I have transitioned the video processing pipeline to use Multi-Threaded (MT) FFmpeg.wasm, shifting the heavy processing execution to Web Workers via SharedArrayBuffer (SAB).

Changes Made

• FFmpeg Configuration: Updated SRI_HASHES with valid Subresource Integrity cryptographic signatures (sha384) for @ffmpeg/core-mt@0.12.10 to safely fetch multi-threaded assets from jsDelivr.
• Vercel Headers: Added/Cleaned vercel.json configurations to inject required security headers across all routes:
  • Cross-Origin-Opener-Policy: same-origin
  • Cross-Origin-Embedder-Policy: require-corp
• Routing Cleanup: Removed a redundant "handle": "filesystem" route from vercel.json to avoid any potential deployment framework routing edge cases.

How to Test / Verification

1. Run the app locally using vercel dev or access the generated Vercel Preview deployment.
2. Open the browser Console to ensure no Integrity mismatch or SharedArrayBuffer security blocking warnings appear.
3. Click Export on a project video:
   • Verify that the browser tab stays fully responsive.
   • Verify that you can still interact with UI buttons (like a cancel option) and see fluid progression.

Related Issue

Type of Contribution

• Bug fix
• New feature
• Documentation update
• GSSoC contribution

Participant Info

• GitHub username:codewithakshyaaa
• Contribution level (Beginner/Intermediate/Advanced):Advanced

Checklist

• I have read the contribution guidelines
• My changes follow the project structure
• I have tested my changes in Chrome, Firefox, and Safari
• bun run lint passes (no ESLint errors)
• bunx tsc --noEmit passes (no TypeScript errors)
• New interactive elements have aria-label / accessible names
• No console.log statements left in
• This PR is related to a valid issue
• Screen recording attached above (required for UI/feature/design changes)

[vercel]

@codewithakshyaaa is attempting to deploy a commit to the magic-peach1's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

👋 Thanks for your PR, @codewithakshyaaa!

Welcome to Reframe — a browser-based video editor built for everyone 🎬

🟠 GSSoC'26 PR detected — thanks for contributing under GirlScript Summer of Code 2026!

What happens next

1. 🤖 Automated checks — build & TypeScript typecheck will run automatically
2. ✅ Vercel preview — a preview deployment will be created (requires maintainer authorization for fork PRs)
3. 👀 Code review — a maintainer will review your changes
4. 🚀 Merge — once approved, your PR will be merged!

Quick checklist

• PR title follows Conventional Commits (e.g. feat: add dark mode)
• Linked the issue this PR closes (e.g. Closes #123)
• Tested the changes locally (bun run dev)
• Build passes (bun run build)

Useful links

• 📖 CONTRIBUTING.md
• 🐛 Open Issues
• ⭐ Star the repo to support the project!

Happy coding! 🎉

[github-actions]

✅ PR Format Check Passed — @codewithakshyaaa

Basic format checks passed. A maintainer will review your code changes.

This does not mean the PR is approved — it just means the format is correct.