@hyperframes/studio-server 0.8.137 → 0.8.138

package/dist/{chunk-YOBWV2CY.js → chunk-6RFZWPPN.js}

@@ -2,12 +2,12 @@ import {
   PROXY_VARIANT_CONFIG,
   probeFirstFrameColour,
   probeMediaMetadata
-} from "./chunk-I3DRHG52.js";
+} from "./chunk-74JVVCWL.js";
 import {
   mkdirWithinProject,
   realProjectRoot,
   realpath
-} from "./chunk-TTWLTYSQ.js";
+} from "./chunk-DTKK7TKL.js";
 
 // src/helpers/proxyTranscoder.ts
 import { spawn } from "child_process";
@@ -481,4 +481,4 @@ export {
   proxyActivityMark,
   resolveProxy
 };
-//# sourceMappingURL=chunk-YOBWV2CY.js.map
+//# sourceMappingURL=chunk-6RFZWPPN.js.map

package/dist/{chunk-I3DRHG52.js → chunk-74JVVCWL.js}

@@ -1,6 +1,6 @@
 import {
   realpath
-} from "./chunk-TTWLTYSQ.js";
+} from "./chunk-DTKK7TKL.js";
 
 // src/helpers/mediaCodecMap.ts
 import { existsSync, statSync } from "fs";
@@ -346,4 +346,4 @@ export {
   probeAssetCodec,
   scanProjectMediaCodecMap
 };
-//# sourceMappingURL=chunk-I3DRHG52.js.map
+//# sourceMappingURL=chunk-74JVVCWL.js.map

package/dist/{chunk-7ON477WG.js → chunk-DG2VOIGR.js}

@@ -2,7 +2,7 @@ import {
   isInHiddenOrVendorDir,
   mkdirWithinProject,
   walkDir
-} from "./chunk-TTWLTYSQ.js";
+} from "./chunk-DTKK7TKL.js";
 
 // src/helpers/hfIdPersist.ts
 import { ensureHfIds } from "@hyperframes/parsers/hf-ids";
@@ -95,4 +95,4 @@ export {
   stampProjectHfIds,
   stampFileHfIds
 };
-//# sourceMappingURL=chunk-7ON477WG.js.map
+//# sourceMappingURL=chunk-DG2VOIGR.js.map

package/dist/{chunk-TTWLTYSQ.js → chunk-DTKK7TKL.js}

@@ -1,16 +1,26 @@
+import {
+  STUDIO_MANUAL_EDITS_PATH
+} from "./chunk-6XMC64FJ.js";
+import {
+  STUDIO_MOTION_PATH
+} from "./chunk-4ETS2LXI.js";
+
 // src/helpers/safePath.ts
 import { basename, dirname, isAbsolute, join, relative, sep } from "path";
 import { readdirSync } from "fs";
-import { realpath, resolveWithinProject } from "@hyperframes/core/safe-path";
+import { realpath, resolveWithinProject as resolveInProject } from "@hyperframes/core/safe-path";
 import {
   folderGone,
   isProjectRootMissing,
   isSafePath,
   mkdirWithinProject,
   realpath as realpath2,
-  realProjectRoot,
-  resolveWithinProject as resolveWithinProject2
+  realProjectRoot
 } from "@hyperframes/core/safe-path";
+function resolveWithinProject(base, relativePath) {
+  const resolved = resolveInProject(base, relativePath);
+  return resolved && !isPrivateProjectFile(base, resolved) ? resolved : null;
+}
 function realFilePath(filePath) {
   try {
     return realpath(filePath);
@@ -19,6 +29,18 @@ function realFilePath(filePath) {
     return dir === filePath ? filePath : join(realFilePath(dir), basename(filePath));
   }
 }
+var STUDIO_FILES = /* @__PURE__ */ new Set([STUDIO_MOTION_PATH, STUDIO_MANUAL_EDITS_PATH]);
+var STUDIO_FOLDERS = [".hyperframes/prepared-assets", ".hyperframes/requests"];
+function isPrivateProjectPath(relPath) {
+  const path = relPath.toLowerCase();
+  return (path === ".hyperframes" || path.startsWith(".hyperframes/")) && !STUDIO_FILES.has(path) && !STUDIO_FOLDERS.some((folder) => path === folder || path.startsWith(`${folder}/`));
+}
+function isPrivateProjectFile(projectDir, filePath) {
+  const rel = (from, to) => relative(from, to).split(sep).join("/");
+  return [rel(projectDir, filePath), rel(realFilePath(projectDir), realFilePath(filePath))].some(
+    isPrivateProjectPath
+  );
+}
 function pinWithinProject(base, relativePath) {
   const checked = resolveWithinProject(base, relativePath);
   if (!checked) return null;
@@ -64,7 +86,10 @@ function walkDir(dir, prefix = "") {
 }
 
 export {
+  resolveWithinProject,
   realFilePath,
+  isPrivateProjectPath,
+  isPrivateProjectFile,
   pinWithinProject,
   isInHiddenOrVendorDir,
   walkDir,
@@ -73,7 +98,6 @@ export {
   isSafePath,
   mkdirWithinProject,
   realpath2 as realpath,
-  realProjectRoot,
-  resolveWithinProject2 as resolveWithinProject
+  realProjectRoot
 };
-//# sourceMappingURL=chunk-TTWLTYSQ.js.map
+//# sourceMappingURL=chunk-DTKK7TKL.js.map

package/dist/chunk-DTKK7TKL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/helpers/safePath.ts"],"sourcesContent":["import { basename, dirname, isAbsolute, join, relative, sep } from \"node:path\";\nimport { readdirSync, type Dirent } from \"node:fs\";\nimport { realpath, resolveWithinProject as resolveInProject } from \"@hyperframes/core/safe-path\";\nimport { STUDIO_MANUAL_EDITS_PATH } from \"./manualEditsRenderScript.js\";\nimport { STUDIO_MOTION_PATH } from \"./studioMotionRenderScript.js\";\n\n// `isSafePath` lives at the package root so non-studio-api layers (compiler,\n// CLI, engine) can share it without a backwards dependency on studio-api.\n// Re-exported here for back-compat with existing `../helpers/safePath.js` imports.\nexport {\n  folderGone,\n  isProjectRootMissing,\n  isSafePath,\n  mkdirWithinProject,\n  realpath,\n  realProjectRoot,\n} from \"@hyperframes/core/safe-path\";\n\n/** Core's `resolveWithinProject`, closed to the desktop app's private files for every route a request path reaches. */\nexport function resolveWithinProject(base: string, relativePath: string): string | null {\n  const resolved = resolveInProject(base, relativePath);\n  return resolved && !isPrivateProjectFile(base, resolved) ? resolved : null;\n}\n\n/** The real path; for a path not there (yet, or any more), the nearest existing folder's real path plus the rest. */\nexport function realFilePath(filePath: string): string {\n  try {\n    return realpath(filePath);\n  } catch {\n    const dir = dirname(filePath);\n    return dir === filePath ? filePath : join(realFilePath(dir), basename(filePath));\n  }\n}\n\n// `.hyperframes/` holds the desktop app's and the CLI's own records (a hand-off, chat history, read marks): no route\n// reaches any of it, the folder itself included, but Studio's own files and the app's request pictures.\nconst STUDIO_FILES = new Set([STUDIO_MOTION_PATH, STUDIO_MANUAL_EDITS_PATH]);\nconst STUDIO_FOLDERS = [\".hyperframes/prepared-assets\", \".hyperframes/requests\"];\n\n/** For a project-relative path with `/` separators. */\nexport function isPrivateProjectPath(relPath: string): boolean {\n  const path = relPath.toLowerCase();\n  return (\n    (path === \".hyperframes\" || path.startsWith(\".hyperframes/\")) &&\n    !STUDIO_FILES.has(path) &&\n    !STUDIO_FOLDERS.some((folder) => path === folder || path.startsWith(`${folder}/`))\n  );\n}\n\nexport function isPrivateProjectFile(projectDir: string, filePath: string): boolean {\n  const rel = (from: string, to: string) => relative(from, to).split(sep).join(\"/\");\n  return [rel(projectDir, filePath), rel(realFilePath(projectDir), realFilePath(filePath))].some(\n    isPrivateProjectPath,\n  );\n}\n\n/**\n * `resolveWithinProject` with every link inside the project resolved now, so a write to the result lands on the\n * file checked here even if a link on the way is retargeted before the write.\n */\nexport function pinWithinProject(base: string, relativePath: string): string | null {\n  const checked = resolveWithinProject(base, relativePath);\n  if (!checked) return null;\n  const inside = relative(realFilePath(base), realFilePath(checked));\n  const escapes = inside === \"..\" || inside.startsWith(`..${sep}`) || isAbsolute(inside);\n  return escapes ? null : join(base, inside);\n}\n\nconst IGNORE_DIRS = new Set([\n  \".thumbnails\",\n  \".transcode-cache\",\n  \".waveform-cache\",\n  \"node_modules\",\n  \".git\",\n]);\n\nfunction shouldIgnoreDir(rel: string): boolean {\n  return rel === \".hyperframes/backup\";\n}\n\n/**\n * True when any directory segment of a relative path is a dot-directory or\n * node_modules. Projects that vendor tooling assets under dot-directories\n * (.hyperframes/, .cache/, …) ship example/preset HTML that must not surface\n * as project compositions or studio lint targets (#1384). The file tree is\n * deliberately not filtered — this only gates discovery.\n */\nexport function isInHiddenOrVendorDir(relPath: string): boolean {\n  const segments = relPath.split(\"/\");\n  return segments.slice(0, -1).some((seg) => seg.startsWith(\".\") || seg === \"node_modules\");\n}\n\nconst UNREADABLE_DIR_CODES = new Set([\"EACCES\", \"EPERM\", \"ENOENT\", \"ENOTDIR\"]);\n\n/** Recursively walk a directory and return relative file paths. A subfolder that is unreadable\n * or removed mid-walk is skipped; any other failure, or an unreadable `dir` itself, throws. */\nexport function walkDir(dir: string, prefix = \"\"): string[] {\n  let entries: Dirent[];\n  try {\n    entries = readdirSync(dir, { withFileTypes: true });\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (!prefix || !code || !UNREADABLE_DIR_CODES.has(code)) throw err;\n    return [];\n  }\n  const files: string[] = [];\n  for (const entry of entries) {\n    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;\n    if (IGNORE_DIRS.has(entry.name) || shouldIgnoreDir(rel)) continue;\n    if (entry.isDirectory()) {\n      files.push(...walkDir(join(dir, entry.name), rel));\n    } else {\n      files.push(rel);\n    }\n  }\n  return files;\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,UAAU,SAAS,YAAY,MAAM,UAAU,WAAW;AACnE,SAAS,mBAAgC;AACzC,SAAS,UAAU,wBAAwB,wBAAwB;AAOnE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAAA;AAAA,EACA;AAAA,OACK;AAGA,SAAS,qBAAqB,MAAc,cAAqC;AACtF,QAAM,WAAW,iBAAiB,MAAM,YAAY;AACpD,SAAO,YAAY,CAAC,qBAAqB,MAAM,QAAQ,IAAI,WAAW;AACxE;AAGO,SAAS,aAAa,UAA0B;AACrD,MAAI;AACF,WAAO,SAAS,QAAQ;AAAA,EAC1B,QAAQ;AACN,UAAM,MAAM,QAAQ,QAAQ;AAC5B,WAAO,QAAQ,WAAW,WAAW,KAAK,aAAa,GAAG,GAAG,SAAS,QAAQ,CAAC;AAAA,EACjF;AACF;AAIA,IAAM,eAAe,oBAAI,IAAI,CAAC,oBAAoB,wBAAwB,CAAC;AAC3E,IAAM,iBAAiB,CAAC,gCAAgC,uBAAuB;AAGxE,SAAS,qBAAqB,SAA0B;AAC7D,QAAM,OAAO,QAAQ,YAAY;AACjC,UACG,SAAS,kBAAkB,KAAK,WAAW,eAAe,MAC3D,CAAC,aAAa,IAAI,IAAI,KACtB,CAAC,eAAe,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AAErF;AAEO,SAAS,qBAAqB,YAAoB,UAA2B;AAClF,QAAM,MAAM,CAAC,MAAc,OAAe,SAAS,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,KAAK,GAAG;AAChF,SAAO,CAAC,IAAI,YAAY,QAAQ,GAAG,IAAI,aAAa,UAAU,GAAG,aAAa,QAAQ,CAAC,CAAC,EAAE;AAAA,IACxF;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,MAAc,cAAqC;AAClF,QAAM,UAAU,qBAAqB,MAAM,YAAY;AACvD,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,SAAS,aAAa,IAAI,GAAG,aAAa,OAAO,CAAC;AACjE,QAAM,UAAU,WAAW,QAAQ,OAAO,WAAW,KAAK,GAAG,EAAE,KAAK,WAAW,MAAM;AACrF,SAAO,UAAU,OAAO,KAAK,MAAM,MAAM;AAC3C;AAEA,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,gBAAgB,KAAsB;AAC7C,SAAO,QAAQ;AACjB;AASO,SAAS,sBAAsB,SAA0B;AAC9D,QAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,SAAO,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,IAAI,WAAW,GAAG,KAAK,QAAQ,cAAc;AAC1F;AAEA,IAAM,uBAAuB,oBAAI,IAAI,CAAC,UAAU,SAAS,UAAU,SAAS,CAAC;AAItE,SAAS,QAAQ,KAAa,SAAS,IAAc;AAC1D,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EACpD,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAC5C,QAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,IAAI,IAAI,EAAG,OAAM;AAC/D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,SAAS;AAC3B,UAAM,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,KAAK,MAAM;AACvD,QAAI,YAAY,IAAI,MAAM,IAAI,KAAK,gBAAgB,GAAG,EAAG;AACzD,QAAI,MAAM,YAAY,GAAG;AACvB,YAAM,KAAK,GAAG,QAAQ,KAAK,KAAK,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACnD,OAAO;AACL,YAAM,KAAK,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;","names":["realpath"]}

package/dist/{chunk-WK3ZL3SN.js → chunk-G7FEKQ32.js}

@@ -1,14 +1,14 @@
 import {
   PROXY_PARAMS_VERSION,
   resolveProxy
-} from "./chunk-YOBWV2CY.js";
+} from "./chunk-6RFZWPPN.js";
 import {
   createMediaCodecProbeCache,
   proxyVariantFor,
   recordProxyPrewarm,
   scanProjectMediaCodecMap,
   shouldPrewarmProxy
-} from "./chunk-I3DRHG52.js";
+} from "./chunk-74JVVCWL.js";
 
 // src/helpers/mediaProxyPreview.ts
 import { resolve } from "path";
@@ -63,4 +63,4 @@ export {
   injectMediaCodecMapIntoHtml,
   injectMediaCodecMap
 };
-//# sourceMappingURL=chunk-WK3ZL3SN.js.map
+//# sourceMappingURL=chunk-G7FEKQ32.js.map

package/dist/{chunk-36F5I56K.js → chunk-K3H6HTVC.js}

@@ -2,7 +2,7 @@ import {
   isSafePath,
   mkdirWithinProject,
   realFilePath
-} from "./chunk-TTWLTYSQ.js";
+} from "./chunk-DTKK7TKL.js";
 
 // src/history/projectHistory.ts
 import { randomUUID as randomUUID6 } from "crypto";
@@ -1750,4 +1750,4 @@ export {
   openProjectHistory,
   historyCache
 };
-//# sourceMappingURL=chunk-36F5I56K.js.map
+//# sourceMappingURL=chunk-K3H6HTVC.js.map

package/dist/helpers/hfIdPersist.js

@@ -2,8 +2,10 @@ import {
   isCompositionSource,
   stampFileHfIds,
   stampProjectHfIds
-} from "../chunk-7ON477WG.js";
-import "../chunk-TTWLTYSQ.js";
+} from "../chunk-DG2VOIGR.js";
+import "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   isCompositionSource,
   stampFileHfIds,

package/dist/helpers/mediaCodecMap.js

@@ -13,8 +13,10 @@ import {
   resolveProxyVariantRequest,
   scanProjectMediaCodecMap,
   shouldPrewarmProxy
-} from "../chunk-I3DRHG52.js";
-import "../chunk-TTWLTYSQ.js";
+} from "../chunk-74JVVCWL.js";
+import "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   BROWSER_HOSTILE_CODECS,
   PROXY_VARIANT_CONFIG,

package/dist/helpers/mediaProxyPreview.js

@@ -4,10 +4,12 @@ import {
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "../chunk-WK3ZL3SN.js";
-import "../chunk-YOBWV2CY.js";
-import "../chunk-I3DRHG52.js";
-import "../chunk-TTWLTYSQ.js";
+} from "../chunk-G7FEKQ32.js";
+import "../chunk-6RFZWPPN.js";
+import "../chunk-74JVVCWL.js";
+import "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   injectMediaCodecMap,
   injectMediaCodecMapIntoHtml,

package/dist/helpers/proxyTranscoder.js

@@ -14,9 +14,11 @@ import {
   proxyActivityMark,
   resolveProxy,
   waitForProxy
-} from "../chunk-YOBWV2CY.js";
-import "../chunk-I3DRHG52.js";
-import "../chunk-TTWLTYSQ.js";
+} from "../chunk-6RFZWPPN.js";
+import "../chunk-74JVVCWL.js";
+import "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   CACHE_DIR_NAME,
   DEFAULT_PROXY_WAIT_TIMEOUT_MS,

package/dist/helpers/safePath.d.ts

@@ -1,7 +1,12 @@
-export { folderGone, isProjectRootMissing, isSafePath, mkdirWithinProject, realProjectRoot, realpath, resolveWithinProject } from '@hyperframes/core/safe-path';
+export { folderGone, isProjectRootMissing, isSafePath, mkdirWithinProject, realProjectRoot, realpath } from '@hyperframes/core/safe-path';
 
+/** Core's `resolveWithinProject`, closed to the desktop app's private files for every route a request path reaches. */
+declare function resolveWithinProject(base: string, relativePath: string): string | null;
 /** The real path; for a path not there (yet, or any more), the nearest existing folder's real path plus the rest. */
 declare function realFilePath(filePath: string): string;
+/** For a project-relative path with `/` separators. */
+declare function isPrivateProjectPath(relPath: string): boolean;
+declare function isPrivateProjectFile(projectDir: string, filePath: string): boolean;
 /**
  * `resolveWithinProject` with every link inside the project resolved now, so a write to the result lands on the
  * file checked here even if a link on the way is retargeted before the write.
@@ -19,4 +24,4 @@ declare function isInHiddenOrVendorDir(relPath: string): boolean;
  * or removed mid-walk is skipped; any other failure, or an unreadable `dir` itself, throws. */
 declare function walkDir(dir: string, prefix?: string): string[];
 
-export { isInHiddenOrVendorDir, pinWithinProject, realFilePath, walkDir };
+export { isInHiddenOrVendorDir, isPrivateProjectFile, isPrivateProjectPath, pinWithinProject, realFilePath, resolveWithinProject, walkDir };

package/dist/helpers/safePath.js

@@ -1,6 +1,8 @@
 import {
   folderGone,
   isInHiddenOrVendorDir,
+  isPrivateProjectFile,
+  isPrivateProjectPath,
   isProjectRootMissing,
   isSafePath,
   mkdirWithinProject,
@@ -10,10 +12,14 @@ import {
   realpath,
   resolveWithinProject,
   walkDir
-} from "../chunk-TTWLTYSQ.js";
+} from "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   folderGone,
   isInHiddenOrVendorDir,
+  isPrivateProjectFile,
+  isPrivateProjectPath,
   isProjectRootMissing,
   isSafePath,
   mkdirWithinProject,

package/dist/history/index.js

@@ -10,8 +10,10 @@ import {
   listProjectHistories,
   openProjectHistory,
   pruneGoneProjectHistories
-} from "../chunk-36F5I56K.js";
-import "../chunk-TTWLTYSQ.js";
+} from "../chunk-K3H6HTVC.js";
+import "../chunk-DTKK7TKL.js";
+import "../chunk-6XMC64FJ.js";
+import "../chunk-4ETS2LXI.js";
 export {
   DEFAULT_HISTORY_ROOT,
   START as HISTORY_START,

package/dist/index.js

@@ -21,7 +21,7 @@ import {
 import {
   isCompositionSource,
   stampProjectHfIds
-} from "./chunk-7ON477WG.js";
+} from "./chunk-DG2VOIGR.js";
 import {
   DEFAULT_HISTORY_ROOT,
   DELETED_VERSION,
@@ -47,7 +47,7 @@ import {
   resolveProjectAndSignature,
   resolveProjectSignature,
   settledFileTag
-} from "./chunk-36F5I56K.js";
+} from "./chunk-K3H6HTVC.js";
 import {
   clearElementScreenshotIsolation,
   getElementScreenshotClip
@@ -64,7 +64,7 @@ import {
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "./chunk-WK3ZL3SN.js";
+} from "./chunk-G7FEKQ32.js";
 import {
   CACHE_DIR_NAME,
   PROXY_PENDING_RETRY_AFTER_SECONDS,
@@ -75,7 +75,7 @@ import {
   proxyActivityMark,
   resolveProxy,
   waitForProxy
-} from "./chunk-YOBWV2CY.js";
+} from "./chunk-6RFZWPPN.js";
 import {
   PROXY_VARIANT_CONFIG,
   decideMediaProxyEligibility,
@@ -84,10 +84,12 @@ import {
   probeMediaMetadata,
   recordProxyRequest,
   resolveProxyVariantRequest
-} from "./chunk-I3DRHG52.js";
+} from "./chunk-74JVVCWL.js";
 import {
   folderGone,
   isInHiddenOrVendorDir,
+  isPrivateProjectFile,
+  isPrivateProjectPath,
   isProjectRootMissing,
   isSafePath,
   mkdirWithinProject,
@@ -96,7 +98,7 @@ import {
   realpath,
   resolveWithinProject,
   walkDir
-} from "./chunk-TTWLTYSQ.js";
+} from "./chunk-DTKK7TKL.js";
 import {
   STUDIO_MANUAL_EDITS_PATH,
   createStudioManualEditsRenderBodyScript,
@@ -149,7 +151,7 @@ function registerProjectRoutes(api, adapter) {
   api.get("/projects/:id", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const files = walkDir(project.dir);
+    const files = walkDir(project.dir).filter((file) => !isPrivateProjectPath(file));
     const compositions = await filterCompositionFiles(project.dir, files);
     return c.json({ id: project.id, dir: project.dir, title: project.title, files, compositions });
   });
@@ -1572,7 +1574,7 @@ function updateReferences(projectDir, oldPath, newPath, isDirectory) {
   const rewrite = referenceRewriter(oldPath, newPath, isDirectory, projectPaths(projectDir));
   let updatedCount = 0;
   for (const file of textFiles) {
-    if (!isSafePath(projectDir, file)) continue;
+    if (!isSafePath(projectDir, file) || isPrivateProjectFile(projectDir, file)) continue;
     const content = readableText(file);
     if (content === null) continue;
     const updated = rewrite(content);
@@ -2716,7 +2718,7 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
       finalName = `${base} (${n})${ext}`;
       finalPath = resolve2(targetDir, finalName);
     }
-    if (!isSafePath(projectDir, finalPath)) continue;
+    if (!isSafePath(projectDir, finalPath) || isPrivateProjectFile(projectDir, finalPath)) continue;
     const buffer = Buffer.from(await value.arrayBuffer());
     const validation = validateUploadedMediaBuffer(finalName, buffer);
     if (!validation.ok) {
@@ -3609,7 +3611,10 @@ import {
   insertRuntimeTag,
   stripEmbeddedRuntimeScripts as stripEmbeddedRuntimeScripts2
 } from "@hyperframes/core/compiler";
-import { STUDIO_PREVIEW_MARK_META } from "@hyperframes/core/studio-preview-mark";
+import {
+  STUDIO_PREVIEW_MARK_META,
+  STUDIO_PREVIEW_ERRORS
+} from "@hyperframes/core/studio-preview-mark";
 import { gsapCdnDist as gsapCdnDist2, motionPathPluginUrl } from "@hyperframes/core/gsap-cdn";
 import { findStartTags as findStartTags2, injectTagsAtHeadStart } from "@hyperframes/core/compiler/html-document";
 import { isWithinProjectRoot } from "@hyperframes/parsers/asset-resolution";
@@ -3904,15 +3909,17 @@ var GSAP_CDN_FALLBACK_SCRIPT = `<script ${GSAP_FALLBACK_ATTR}>
     if(loaded[file])return loaded[file];
     return loaded[file]=new Promise(function(ok,fail){
       var s=document.createElement("script");
-      s.src=cdnBase+file;s.onload=ok;s.onerror=fail;
+      s.src=cdnBase+file;s.hfGsapFallback=true;s.onload=ok;s.onerror=fail;
       document.head.appendChild(s);
     });
   }
   document.addEventListener("error",function(e){
     var t=e.target;
-    if(!t||t.tagName!=="SCRIPT"||!t.src)return;
+    if(!t||t.tagName!=="SCRIPT"||!t.src||t.hfGsapFallback)return;
     var m=t.src.match(/gsap[^/]*\\/dist\\/(.+\\.js)/);
-    if(m)loadFallback(m[1]);
+    if(m)loadFallback(m[1]).catch(function(){
+      reportError(new Error("GSAP could not load from "+t.src+" or "+cdnBase+m[1]+", so this preview's animations will not play."));
+    });
   },true);
 })();
 </script>`;
@@ -3944,8 +3951,13 @@ function previewVariablesFromRequest(rawVariables) {
   return { raw: rawVariables, values: parse2.values };
 }
 var PREVIEW_CAPTURE_PARAM = "hf-capture";
+var EARLY_ERRORS_SCRIPT = `<script>(function(){var seen=window.${STUDIO_PREVIEW_ERRORS}=[];
+addEventListener("error",function(e){seen.push(e.message||String(e))});})();</script>`;
 function injectStudioPreviewAugmentations(html, adapter, projectDir, activeCompositionPath, capture) {
-  const marked = capture ? html : injectTagsAtHeadStart(lazyPreviewImages(html), `<meta name="${STUDIO_PREVIEW_MARK_META}">`);
+  const marked = capture ? html : injectTagsAtHeadStart(
+    lazyPreviewImages(html),
+    `<meta name="${STUDIO_PREVIEW_MARK_META}">${EARLY_ERRORS_SCRIPT}`
+  );
   return injectStudioMotionScript(
     injectMotionPathPluginIfNeeded(
       injectGsapCdnFallback(
@@ -4166,7 +4178,7 @@ ${etag}`;
     const subPath = requestSubPath(c.req.url, "projects/:id/preview");
     const candidate = resolve4(project.dir, subPath);
     const file = isWithinProjectRoot(project.dir, candidate) ? candidate : null;
-    if (!file) {
+    if (!file || isPrivateProjectFile(project.dir, file)) {
       return c.text("not found", 404);
     }
     recordPreviewRead(project.dir, file);
@@ -4320,7 +4332,7 @@ function registerLintRoutes(api, adapter) {
 
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
-import { existsSync as existsSync6, readFileSync as readFileSync8, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync as statSync5 } from "fs";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync as statSync5 } from "fs";
 import { join as join10 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
@@ -4448,6 +4460,13 @@ function registerRenderRoutes(api, adapter) {
     ".mov": "video/quicktime"
   };
   const RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
+  const isPlainFile = (path) => {
+    try {
+      return lstatSync3(path).isFile();
+    } catch {
+      return false;
+    }
+  };
   function renderContentType(filePath) {
     const ext = RENDER_EXTENSIONS.find((e) => filePath.endsWith(e));
     return (ext && RENDER_MIME[ext]) ?? "video/mp4";
@@ -4455,7 +4474,7 @@ function registerRenderRoutes(api, adapter) {
   api.get("/render/:jobId/view", (c) => {
     const { jobId } = c.req.param();
     const job = renderJobs.get(jobId);
-    if (!job?.outputPath || !existsSync6(job.outputPath)) {
+    if (!job?.outputPath || !isPlainFile(job.outputPath)) {
       return c.json({ error: "not found" }, 404);
     }
     const contentType = renderContentType(job.outputPath);
@@ -4473,7 +4492,7 @@ function registerRenderRoutes(api, adapter) {
   api.get("/render/:jobId/download", (c) => {
     const { jobId } = c.req.param();
     const job = renderJobs.get(jobId);
-    if (!job?.outputPath || !existsSync6(job.outputPath)) {
+    if (!job?.outputPath || !isPlainFile(job.outputPath)) {
       return c.json({ error: "not found" }, 404);
     }
     const contentType = renderContentType(job.outputPath);
@@ -4508,7 +4527,7 @@ function registerRenderRoutes(api, adapter) {
     if (!filename) return c.json({ error: "missing filename" }, 400);
     const rendersDir = adapter.rendersDir(project);
     const fp = resolveWithinProject(rendersDir, filename);
-    if (!fp) return c.json({ error: "forbidden" }, 403);
+    if (!fp || isPrivateProjectFile(project.dir, fp)) return c.json({ error: "forbidden" }, 403);
     if (!existsSync6(fp)) return c.json({ error: "not found" }, 404);
     const contentType = renderContentType(fp);
     const content = readFileSync8(fp);
@@ -4526,8 +4545,10 @@ function registerRenderRoutes(api, adapter) {
     if (!project) return c.json({ error: "not found" }, 404);
     const rendersDir = adapter.rendersDir(project);
     if (!existsSync6(rendersDir)) return c.json({ renders: [] });
-    const files = readdirSync3(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
-      const fp = join10(rendersDir, f);
+    const files = readdirSync3(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).flatMap((f) => {
+      const fp = resolveWithinProject(rendersDir, f);
+      return fp && !isPrivateProjectFile(project.dir, fp) ? [{ f, fp }] : [];
+    }).map(({ f, fp }) => {
       const stat2 = statSync5(fp);
       const rid = f.replace(/\.(mp4|webm|mov)$/, "");
       const metaPath = join10(rendersDir, `${rid}.meta.json`);
@@ -4546,6 +4567,7 @@ function registerRenderRoutes(api, adapter) {
       return {
         id: rid,
         filename: f,
+        path: fp,
         size: stat2.size,
         createdAt: stat2.mtimeMs,
         status,
@@ -4559,12 +4581,12 @@ function registerRenderRoutes(api, adapter) {
           id: file.id,
           status: file.status,
           progress: 100,
-          outputPath: join10(rendersDir, file.filename),
+          outputPath: file.path,
           createdAt: file.createdAt
         });
       }
     }
-    return c.json({ renders: files });
+    return c.json({ renders: files.map(({ path: _path, ...render }) => render) });
   });
 }