@hyperframes/studio-server 0.8.140 → 0.8.142

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   splitElementInHtml,
   unwrapElementsFromHtml,
   wrapElementsInHtml
-} from "./chunk-CLWFZQUU.js";
+} from "./chunk-JJ4N3PXT.js";
 import {
   isCompositionSource,
   stampProjectHfIds
@@ -64,7 +64,7 @@ import {
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "./chunk-G7FEKQ32.js";
+} from "./chunk-5VCIZYUE.js";
 import {
   CACHE_DIR_NAME,
   PROXY_PENDING_RETRY_AFTER_SECONDS,
@@ -75,7 +75,7 @@ import {
   proxyActivityMark,
   resolveProxy,
   waitForProxy
-} from "./chunk-6RFZWPPN.js";
+} from "./chunk-QP7LKFU2.js";
 import {
   PROXY_VARIANT_CONFIG,
   decideMediaProxyEligibility,
@@ -3615,6 +3615,7 @@ import {
   STUDIO_PREVIEW_MARK_META,
   STUDIO_PREVIEW_ERRORS
 } from "@hyperframes/core/studio-preview-mark";
+import { PREVIEW_PROXY_BOX_PARAM, parsePreviewProxyBox } from "@hyperframes/core";
 import { gsapCdnDist as gsapCdnDist2, motionPathPluginUrl } from "@hyperframes/core/gsap-cdn";
 import { findStartTags as findStartTags2, injectTagsAtHeadStart } from "@hyperframes/core/compiler/html-document";
 import { isWithinProjectRoot } from "@hyperframes/parsers/asset-resolution";
@@ -4189,6 +4190,11 @@ ${etag}`;
     const contentType = getMimeType(subPath);
     const isText = /\.(html|css|js|json|svg|txt|md|cube)$/i.test(subPath);
     const proxyParam = c.req.query("hf-proxy");
+    const boxParam = c.req.query(PREVIEW_PROXY_BOX_PARAM);
+    const proxyBox = boxParam === void 0 ? void 0 : parsePreviewProxyBox(boxParam);
+    if (proxyBox === null || proxyBox && proxyParam === void 0) {
+      return c.text("not found", 404);
+    }
     let proxyVariant;
     if (proxyParam !== void 0) {
       if (!isProxyVariantRequest(proxyParam) || !contentType.startsWith("video/") || !isAutoProxyEnabled(adapter)) {
@@ -4206,7 +4212,7 @@ ${etag}`;
       }
     }
     const tag = settledFileTag(stat2);
-    const etag = tag && `"${tag}${proxyEtagSalt(proxyVariant)}"`;
+    const etag = tag && `"${tag}${proxyEtagSalt(proxyVariant, proxyBox)}"`;
     const cacheHeaders = isText ? { "Cache-Control": "no-store" } : { "Cache-Control": "private, no-cache", ...etag && { ETag: etag } };
     if (!isText && etag) {
       const ifNoneMatch = c.req.header("If-None-Match");
@@ -4218,7 +4224,7 @@ ${etag}`;
     let servedContentType = contentType;
     if (proxyVariant !== void 0) {
       try {
-        servedPath = await waitForProxy(resolveProxy(project.dir, file, proxyVariant), 0);
+        servedPath = await waitForProxy(resolveProxy(project.dir, file, proxyVariant, proxyBox), 0);
       } catch (err) {
         if (err instanceof ProxyWaitTimeoutError) {
           return c.text("media proxy is being made", 202, {
@@ -4333,10 +4339,25 @@ function registerLintRoutes(api, adapter) {
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
 import { existsSync as existsSync6, lstatSync as lstatSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync as statSync5 } from "fs";
-import { join as join10 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
 var VALID_RESOLUTIONS = new Set(VALID_CANVAS_RESOLUTIONS);
+var RENDER_MIME = {
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime"
+};
+var RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
+var RENDER_ARTIFACT_EXTENSIONS = [...RENDER_EXTENSIONS, ".meta.json"];
+function resolveRenderArtifacts(directories, jobId) {
+  const artifacts = [...new Set(directories)].filter(existsSync6).flatMap(
+    (directory) => RENDER_ARTIFACT_EXTENSIONS.map(
+      (extension) => resolveWithinProject(directory, `${jobId}${extension}`)
+    )
+  );
+  return artifacts.every((path) => path !== null) ? artifacts : null;
+}
 function contentDispositionHeader(disposition, filename) {
   const fallback = filename.replace(/[^\x20-\x7e]|["\\]/g, "_");
   const encoded = encodeURIComponent(filename).replace(
@@ -4454,12 +4475,6 @@ function registerRenderRoutes(api, adapter) {
     }
     return c.json({ status: job.status });
   });
-  const RENDER_MIME = {
-    ".mp4": "video/mp4",
-    ".webm": "video/webm",
-    ".mov": "video/quicktime"
-  };
-  const RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
   const isPlainFile = (path) => {
     try {
       return lstatSync3(path).isFile();
@@ -4505,17 +4520,22 @@ function registerRenderRoutes(api, adapter) {
       }
     });
   });
-  api.delete("/render/:jobId", (c) => {
+  async function renderDirectories(jobId) {
+    const outputPath = renderJobs.get(jobId)?.outputPath;
+    if (outputPath) return [dirname5(outputPath)];
+    const projects = await adapter.listProjects();
+    return projects.map((project) => adapter.rendersDir(project));
+  }
+  api.delete("/render/:jobId", async (c) => {
     const { jobId } = c.req.param();
-    for (const [, state] of renderJobs) {
-      if (state.id === jobId && state.outputPath) {
-        const dir = state.outputPath.replace(/\/[^/]+$/, "");
-        for (const ext of [".mp4", ".webm", ".mov", ".meta.json"]) {
-          const fp = join10(dir, `${jobId}${ext}`);
-          if (existsSync6(fp)) unlinkSync3(fp);
-        }
-        break;
-      }
+    if (jobId.includes("/") || jobId.includes("\\") || jobId.includes("\0")) {
+      return c.json({ error: "forbidden" }, 403);
+    }
+    const directories = await renderDirectories(jobId);
+    const artifacts = resolveRenderArtifacts(directories, jobId);
+    if (!artifacts) return c.json({ error: "forbidden" }, 403);
+    for (const path of artifacts) {
+      if (existsSync6(path)) unlinkSync3(path);
     }
     renderJobs.delete(jobId);
     return c.json({ deleted: true });
@@ -5059,7 +5079,7 @@ function registerWaveformRoutes(api, adapter) {
 // src/routes/freezeFrame.ts
 import { execFile } from "child_process";
 import { readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync8 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join13, relative as relative4, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname6, join as join13, relative as relative4, sep as sep2 } from "path";
 import { findFfBinary as findFfBinary3 } from "@hyperframes/parsers/ff-binaries";
 import {
   atomicTempPath,
@@ -5306,14 +5326,14 @@ async function extractThenPublishWhole(extract, mediaPath, mediaTime, imagePath)
   }
 }
 async function extractStill(projectDir, absPath, source, playhead, tools) {
-  const fileDir = dirname5(absPath);
+  const fileDir = dirname6(absPath);
   const mediaPath = pinWithinProject(projectDir, relative4(projectDir, join13(fileDir, source.src)));
   if (!mediaPath) return { error: `forbidden media path: ${source.src}`, status: 403 };
   const freezeDir = join13(projectDir, ...FREEZE_DIR);
   const fileName = freezeStillFileName(source.id, playhead, tools.stillToken());
   mkdirWithinProject(projectDir, freezeDir);
   const imagePath = pinWithinProject(projectDir, join13(...FREEZE_DIR, fileName));
-  if (!imagePath || dirname5(imagePath) !== freezeDir) {
+  if (!imagePath || dirname6(imagePath) !== freezeDir) {
     return { error: `forbidden freeze path: ${fileName}`, status: 403 };
   }
   const failed = await extractThenPublishWhole(
@@ -5877,7 +5897,7 @@ function registerSelectionRoutes(api, adapter) {
 // src/routes/media.ts
 import { streamSSE as streamSSE2 } from "hono/streaming";
 import { existsSync as existsSync10 } from "fs";
-import { basename as basename3, dirname as dirname6, extname, join as join15, posix } from "path";
+import { basename as basename3, dirname as dirname7, extname, join as join15, posix } from "path";
 var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov",
@@ -6033,8 +6053,8 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "forbidden" }, 403);
         }
       }
-      mkdirWithinProject(project.dir, dirname6(outputPath));
-      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname6(backgroundOutputPath));
+      mkdirWithinProject(project.dir, dirname7(outputPath));
+      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname7(backgroundOutputPath));
       const jobId = makeJobId(project.id, mediaJobs);
       const state = adapter.startBackgroundRemoval({
         project,