@hyperframes/studio-server 0.8.141 → 0.8.143

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   splitElementInHtml,
   unwrapElementsFromHtml,
   wrapElementsInHtml
-} from "./chunk-CLWFZQUU.js";
+} from "./chunk-JJ4N3PXT.js";
 import {
   isCompositionSource,
   stampProjectHfIds
@@ -55,16 +55,19 @@ import {
 import {
   DEFAULT_TARGET_LUFS,
   absoluteLoudnessPlan,
+  decodeWellFormedEscapes,
   measureAudio,
+  requestSubPath,
+  requestedProjectPath,
   requiredFfmpeg,
   resolveLocalAudioPath
-} from "./chunk-DSVQ2U7J.js";
+} from "./chunk-32IH7WBY.js";
 import {
   injectMediaCodecMap,
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "./chunk-5VCIZYUE.js";
+} from "./chunk-AYKLBPP2.js";
 import {
   CACHE_DIR_NAME,
   PROXY_PENDING_RETRY_AFTER_SECONDS,
@@ -75,7 +78,7 @@ import {
   proxyActivityMark,
   resolveProxy,
   waitForProxy
-} from "./chunk-QP7LKFU2.js";
+} from "./chunk-6EFY2WPN.js";
 import {
   PROXY_VARIANT_CONFIG,
   decideMediaProxyEligibility,
@@ -84,7 +87,7 @@ import {
   probeMediaMetadata,
   recordProxyRequest,
   resolveProxyVariantRequest
-} from "./chunk-74JVVCWL.js";
+} from "./chunk-RN33UALN.js";
 import {
   folderGone,
   isInHiddenOrVendorDir,
@@ -158,6 +161,12 @@ function registerProjectRoutes(api, adapter) {
 }
 
 // src/routes/files.ts
+import { encodeUrlPath, decodedUrlPath, decodeCssEscapes } from "@hyperframes/parsers/asset-paths";
+import {
+  scanHtmlOpeningTags,
+  decodeAuthoredAttribute,
+  HTML_ATTRIBUTE_ENTITIES
+} from "@hyperframes/parsers";
 import { bodyLimit } from "hono/body-limit";
 import {
   closeSync,
@@ -174,7 +183,7 @@ import {
   readdirSync as readdirSync2,
   realpathSync
 } from "fs";
-import { resolve as resolve2, dirname as dirname3, join as join6 } from "path";
+import { resolve as resolve2, dirname as dirname3, join as join6, sep as sep2 } from "path";
 
 // src/helpers/mime.ts
 var MIME_TYPES = {
@@ -1191,14 +1200,6 @@ function resolveGsapWriter(env) {
   throw new Error(`Invalid ${GSAP_WRITER_MIGRATION.flag}=${configured}; expected recast or acorn`);
 }
 
-// src/helpers/requestSubPath.ts
-function requestSubPath(url, route) {
-  const routeSegments = route.split("/");
-  const segments = new URL(url).pathname.split("/");
-  const start = segments.indexOf(routeSegments[0] ?? "");
-  return decodeURIComponent(segments.slice(start + routeSegments.length).join("/"));
-}
-
 // src/routes/files.ts
 import {
   hasCompositionOutsideTemplates,
@@ -1505,15 +1506,114 @@ var escapeRegExp = (text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var SEPARATOR = String.raw`\\{0,2}[\\/]`;
 var REFERENCE_START = String.raw`(?<![\w./\\+-])`;
 var FILE_END = String.raw`(?![\w-]|\.\w)`;
+var ENTITY_SPELLINGS = HTML_ATTRIBUTE_ENTITIES;
+function referenceSpellings(char) {
+  const spellings = [escapeRegExp(char)];
+  const encoded = encodeUrlPath(char);
+  if (encoded !== char)
+    spellings.push(encoded.replace(/[A-F]/g, (hex) => `[${hex}${hex.toLowerCase()}]`));
+  if (ENTITY_SPELLINGS[char]) spellings.push(...ENTITY_SPELLINGS[char]);
+  if (["'", '"', "`", "$", " ", "(", ")"].includes(char)) {
+    spellings.push(escapeRegExp(`&#92;${char}`), escapeRegExp(`&#92;${escapeHtmlReference(char)}`));
+  }
+  const scriptSpelling = escapeQuotedReference(char, '"');
+  if (scriptSpelling !== char) spellings.push(escapeRegExp(scriptSpelling));
+  if (["'", "`", "$", " ", "(", ")"].includes(char)) spellings.push(escapeRegExp(`\\${char}`));
+  if (/[\t\n\f\r =<>`]/.test(char)) spellings.push(`&#${char.codePointAt(0)};`);
+  if (char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) {
+    spellings.push(escapeRegExp(`\\${char.charCodeAt(0).toString(16)} `));
+  }
+  return spellings.length === 1 ? spellings[0] : `(?:${spellings.join("|")})`;
+}
+function escapeHtmlReference(path) {
+  return path.replace(/[&"']/g, (char) => ENTITY_SPELLINGS[char][0]);
+}
+function escapeQuotedReference(path, quote) {
+  const escaped = JSON.stringify(path).slice(1, -1);
+  return quote === '"' ? escaped : escaped.replace(new RegExp(escapeRegExp(quote), "g"), `\\${quote}`);
+}
+function escapeRawUrlPath(path) {
+  const encodeSpaces = path.startsWith(" ") || path.endsWith(" ");
+  return path.replace(/[\s\S]/g, (char) => {
+    if (char.charCodeAt(0) < 32 || ":?%#\\".includes(char) || encodeSpaces && char === " ") {
+      return encodeUrlPath(char);
+    }
+    return char;
+  });
+}
+function spellLike(reference, path, oldPath, context) {
+  const { syntax, quote, url, encodeAll } = context;
+  if (url && (encodeAll || reference !== oldPath && /%[0-9A-Fa-f]{2}/.test(reference)))
+    return encodeUrlPath(path);
+  switch (syntax) {
+    case "html": {
+      const escaped = escapeHtmlReference(url ? escapeRawUrlPath(path) : path);
+      return ["'", '"'].includes(quote) ? escaped : escaped.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+    }
+    case "script": {
+      if (!["'", '"', "`"].includes(quote)) return path;
+      const escaped = escapeQuotedReference(path, quote);
+      return quote === "`" ? escaped.replace(/\$\{/g, "\\${") : escaped;
+    }
+    case "css":
+      return url ? encodeUrlPath(path) : path;
+    case "plain":
+      return path;
+  }
+}
+function referenceSyntax(file) {
+  if (/\.html$/i.test(file)) return "html";
+  if (/\.css$/i.test(file)) return "css";
+  if (/\.(?:[cm]?js|jsx|tsx?|json)$/i.test(file)) return "script";
+  return "plain";
+}
+function decodeQuotedReference(text2, syntax) {
+  if (syntax === "css") return decodeCssEscapes(text2);
+  if (syntax === "script") {
+    const controls = { b: "\b", f: "\f", n: "\n", r: "\r", t: "	" };
+    return text2.replace(
+      /\\(?:u([0-9a-fA-F]{4})|([bfnrt"'`$\\/]))/g,
+      (_escaped, hex, char) => {
+        if (hex !== void 0) return String.fromCharCode(Number.parseInt(hex, 16));
+        return controls[char] ?? char;
+      }
+    );
+  }
+  return text2;
+}
 function referencePattern(oldPath, isDirectory) {
-  const name = oldPath.split("/").map(escapeRegExp).join(SEPARATOR);
+  const name = oldPath.split("/").map((segment) => Array.from(segment, referenceSpellings).join("")).join(SEPARATOR);
   const end = isDirectory ? `(?=${SEPARATOR})` : FILE_END;
   return new RegExp(
     String.raw`${REFERENCE_START}(?<lead>(?:\.{1,2}${SEPARATOR}|${SEPARATOR}){0,4})${name}${end}`,
     "g"
   );
 }
+function rewriteEntityAttributes(text2, rewrite) {
+  const parts = [];
+  let cursor = 0;
+  for (const tag of scanHtmlOpeningTags(text2)) {
+    for (const attr of tag.attributes) {
+      if (attr.kind !== "value") continue;
+      const decoded = decodeAuthoredAttribute(attr.value);
+      if (decoded === attr.value) continue;
+      let value = escapeHtmlReference(decoded);
+      if (!attr.quote)
+        value = value.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+      const source = `<x ${attr.name}=${attr.quote}${value}${attr.quote}>`;
+      const updated = rewrite(source);
+      if (updated === source) continue;
+      const replacement = scanHtmlOpeningTags(updated)[0].attributes[0];
+      if (replacement.kind !== "value") throw new Error("Reference rewrite removed its attribute");
+      parts.push(text2.slice(cursor, attr.valueStart), replacement.value);
+      cursor = attr.valueEnd;
+    }
+  }
+  parts.push(text2.slice(cursor));
+  return parts.join("");
+}
 function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
+  const oldIdentity = sep2 === "\\" ? oldPath.replace(/\\/g, "/") : oldPath;
   const pattern = referencePattern(oldPath, isDirectory);
   const around = /* @__PURE__ */ new Map();
   const afterLengths = /* @__PURE__ */ new Set();
@@ -1527,24 +1627,123 @@ function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
         before
       );
       afterLengths.add(after.length);
-      window = Math.max(window, path.length * 3);
-    }
-  }
-  const normalized = (text2) => text2.replace(/\\{0,2}[\\/]/g, "/");
-  return (text2) => text2.replace(pattern, (...args) => {
-    const [match, offset] = [args[0], args.at(-3)];
-    const { lead } = args.at(-1);
-    const at = offset + lead.length;
-    const head = normalized(text2.slice(Math.max(0, at - window), at));
-    const tail = normalized(text2.slice(offset + match.length, offset + match.length + window));
-    const inLonger = [...afterLengths].some((after) => {
-      const befores = tail.length >= after && around.get(tail.slice(0, after));
-      return befores && [...befores].some(
-        ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+      window = Math.max(window, path.length * 9);
+    }
+  }
+  const normalized = (text2, context, full = false) => {
+    let value = text2;
+    if (context.syntax === "html" || context.htmlAttribute) {
+      value = decodeAuthoredAttribute(value);
+    }
+    value = decodeQuotedReference(value, context.syntax);
+    if (context.url) {
+      value = value.replace(/\\/g, "/");
+      value = full ? decodedUrlPath(value) : decodeWellFormedEscapes(value);
+    }
+    return sep2 === "\\" ? value.replace(/\\/g, "/") : value;
+  };
+  return function rewriteText(text2, syntax = "html", normalizeEntities = true) {
+    if (syntax === "html" && normalizeEntities) {
+      text2 = rewriteEntityAttributes(text2, (source) => rewriteText(source, "html", false));
+    }
+    pattern.lastIndex = 0;
+    if (!pattern.test(text2)) return text2;
+    pattern.lastIndex = 0;
+    const tags = syntax === "html" ? scanHtmlOpeningTags(text2) : [];
+    const inlineRegions = tags.filter(
+      (tag) => tag.closed && ["script", "style"].includes(tag.name) && tag.rawTextEnd !== null
+    ).map((tag) => ({
+      start: tag.end,
+      end: tag.rawTextEnd,
+      syntax: tag.name === "style" ? "css" : "script"
+    }));
+    const attributes = tags.flatMap(
+      (tag) => tag.attributes.flatMap((attr) => attr.kind === "value" ? [attr] : [])
+    );
+    const cssContexts = syntax === "css" ? [{ start: 0, end: text2.length, htmlAttribute: false }] : [
+      ...inlineRegions.filter((region) => region.syntax === "css").map((region) => ({ ...region, htmlAttribute: false })),
+      ...attributes.filter((attr) => attr.name === "style").map((attr) => ({ ...attr, htmlAttribute: true }))
+    ];
+    const cssFields = (pattern2) => cssContexts.flatMap(
+      (context) => [...text2.slice(context.start, context.end).matchAll(pattern2)].map((match) => {
+        const prefix = /^(?:url\(\s*|@import\s+)/i.exec(match[0])[0];
+        const rest = match[0].slice(prefix.length);
+        const delimiter = context.htmlAttribute ? /^(?:["']|&quot;|&#39;|&apos;)/.exec(rest)?.[0] : /^["']/.exec(rest)?.[0];
+        const start = context.start + match.index + prefix.length + (delimiter?.length ?? 0);
+        return {
+          start,
+          end: context.start + match.index + match[0].length,
+          syntax: "css",
+          htmlAttribute: context.htmlAttribute,
+          encodeAll: true
+        };
+      })
+    );
+    const urlRegions = [
+      ...attributes.filter((attr) => ["src", "href", "poster", "xlink:href"].includes(attr.name)).map((attr) => ({
+        start: attr.valueStart + (/^[\t\n\f\r ]*/.exec(attr.value)?.[0].length ?? 0),
+        end: attr.valueEnd,
+        syntax: "html",
+        htmlAttribute: true,
+        encodeAll: false
+      })),
+      ...attributes.filter((attr) => attr.name === "srcset").flatMap(
+        (attr) => [...attr.value.matchAll(/(^|,)[\t\n\f\r ]*([^,\t\n\f\r ]+)/g)].map((match) => ({
+          start: attr.valueStart + match.index + match[0].length - match[2].length,
+          end: attr.valueStart + match.index + match[0].length,
+          syntax: "html",
+          htmlAttribute: true,
+          encodeAll: true
+        }))
+      ),
+      ...cssFields(
+        /\burl\((?:\s*"(?:\\.|[^"\\])*"\s*|\s*'(?:\\.|[^'\\])*'\s*|(?:\\.|[^)\\])*)\)/gi
+      ),
+      ...cssFields(/@import\s+(?:"[^"]*"|'[^']*')/gi)
+    ].sort((a, b) => a.start - b.start);
+    let urlIndex = 0;
+    let regionIndex = 0;
+    return text2.replace(pattern, (...args) => {
+      const [match, offset] = [args[0], args.at(-3)];
+      const { lead } = args.at(-1);
+      while (inlineRegions[regionIndex] && inlineRegions[regionIndex].end <= offset) regionIndex++;
+      const region = inlineRegions[regionIndex];
+      const matchSyntax = region && offset >= region.start ? region.syntax : syntax;
+      while (urlRegions[urlIndex] && urlRegions[urlIndex].end <= offset) urlIndex++;
+      const urlRegion = urlRegions[urlIndex];
+      const url = matchSyntax !== "script" && !!urlRegion && offset >= urlRegion.start;
+      const context = {
+        syntax: url ? urlRegion.syntax : matchSyntax,
+        url,
+        htmlAttribute: url && urlRegion.htmlAttribute,
+        encodeAll: url && urlRegion.encodeAll,
+        quote: text2[offset - 1] ?? ""
+      };
+      if (url && offset !== urlRegion.start) return match;
+      const reference = match.slice(lead.length);
+      if (normalized(reference, context, true) !== oldIdentity) return match;
+      if (isDirectory && !normalized(
+        text2.slice(offset + match.length, offset + match.length + 4),
+        context
+      ).startsWith("/"))
+        return match;
+      const at = offset + lead.length;
+      const head = normalized(text2.slice(Math.max(0, at - window), at), context);
+      const tail = normalized(
+        text2.slice(offset + match.length, offset + match.length + window),
+        context,
+        context.url
       );
+      const inLonger = [...afterLengths].some((after) => {
+        const befores = tail.length >= after && around.get(tail.slice(0, after));
+        return befores && [...befores].some(
+          ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+        );
+      });
+      if (inLonger) return match;
+      return `${lead}${spellLike(reference, newPath, oldPath, context)}`;
     });
-    return inLonger ? match : `${lead}${newPath}`;
-  });
+  };
 }
 function occurrences(text2, part) {
   const at = [];
@@ -1577,7 +1776,7 @@ function updateReferences(projectDir, oldPath, newPath, isDirectory) {
     if (!isSafePath(projectDir, file) || isPrivateProjectFile(projectDir, file)) continue;
     const content = readableText(file);
     if (content === null) continue;
-    const updated = rewrite(content);
+    const updated = rewrite(content, referenceSyntax(file));
     if (updated !== content) {
       replaceFileAtomically2(file, updated, statSync3(file).mode);
       updatedCount++;
@@ -3454,10 +3653,11 @@ function registerFileRoutes(api, adapter) {
     const res = await resolveProjectFile(c, adapter, { mustExist: true });
     if ("error" in res) return res.error;
     const body = await c.req.json();
-    if (!body.newPath || body.newPath.includes("\0")) {
+    const newPath = body !== null && typeof body === "object" && "newPath" in body ? body.newPath : void 0;
+    if (typeof newPath !== "string" || !newPath || newPath.includes("\0") || /[\uD800-\uDFFF]/u.test(newPath)) {
       return c.json({ error: "newPath required" }, 400);
     }
-    const newAbs = resolveWithinProject(res.project.dir, body.newPath);
+    const newAbs = resolveWithinProject(res.project.dir, newPath);
     if (!newAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -3467,8 +3667,8 @@ function registerFileRoutes(api, adapter) {
     const isDirectory = statSync3(res.absPath, { throwIfNoEntry: false })?.isDirectory() ?? false;
     ensureDir(res.project.dir, newAbs);
     renameSync2(res.absPath, newAbs);
-    const updatedFiles = updateReferences(res.project.dir, res.filePath, body.newPath, isDirectory);
-    return c.json({ ok: true, path: body.newPath, updatedReferences: updatedFiles });
+    const updatedFiles = updateReferences(res.project.dir, res.filePath, newPath, isDirectory);
+    return c.json({ ok: true, path: newPath, updatedReferences: updatedFiles });
   });
   api.post("/projects/:id/duplicate-file", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
@@ -4339,10 +4539,25 @@ function registerLintRoutes(api, adapter) {
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
 import { existsSync as existsSync6, lstatSync as lstatSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync as statSync5 } from "fs";
-import { join as join10 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
 var VALID_RESOLUTIONS = new Set(VALID_CANVAS_RESOLUTIONS);
+var RENDER_MIME = {
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime"
+};
+var RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
+var RENDER_ARTIFACT_EXTENSIONS = [...RENDER_EXTENSIONS, ".meta.json"];
+function resolveRenderArtifacts(directories, jobId) {
+  const artifacts = [...new Set(directories)].filter(existsSync6).flatMap(
+    (directory) => RENDER_ARTIFACT_EXTENSIONS.map(
+      (extension) => resolveWithinProject(directory, `${jobId}${extension}`)
+    )
+  );
+  return artifacts.every((path) => path !== null) ? artifacts : null;
+}
 function contentDispositionHeader(disposition, filename) {
   const fallback = filename.replace(/[^\x20-\x7e]|["\\]/g, "_");
   const encoded = encodeURIComponent(filename).replace(
@@ -4460,12 +4675,6 @@ function registerRenderRoutes(api, adapter) {
     }
     return c.json({ status: job.status });
   });
-  const RENDER_MIME = {
-    ".mp4": "video/mp4",
-    ".webm": "video/webm",
-    ".mov": "video/quicktime"
-  };
-  const RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
   const isPlainFile = (path) => {
     try {
       return lstatSync3(path).isFile();
@@ -4511,17 +4720,22 @@ function registerRenderRoutes(api, adapter) {
       }
     });
   });
-  api.delete("/render/:jobId", (c) => {
+  async function renderDirectories(jobId) {
+    const outputPath = renderJobs.get(jobId)?.outputPath;
+    if (outputPath) return [dirname5(outputPath)];
+    const projects = await adapter.listProjects();
+    return projects.map((project) => adapter.rendersDir(project));
+  }
+  api.delete("/render/:jobId", async (c) => {
     const { jobId } = c.req.param();
-    for (const [, state] of renderJobs) {
-      if (state.id === jobId && state.outputPath) {
-        const dir = state.outputPath.replace(/\/[^/]+$/, "");
-        for (const ext of [".mp4", ".webm", ".mov", ".meta.json"]) {
-          const fp = join10(dir, `${jobId}${ext}`);
-          if (existsSync6(fp)) unlinkSync3(fp);
-        }
-        break;
-      }
+    if (jobId.includes("/") || jobId.includes("\\") || jobId.includes("\0")) {
+      return c.json({ error: "forbidden" }, 403);
+    }
+    const directories = await renderDirectories(jobId);
+    const artifacts = resolveRenderArtifacts(directories, jobId);
+    if (!artifacts) return c.json({ error: "forbidden" }, 403);
+    for (const path of artifacts) {
+      if (existsSync6(path)) unlinkSync3(path);
     }
     renderJobs.delete(jobId);
     return c.json({ deleted: true });
@@ -4746,12 +4960,7 @@ async function generateThumbnail(path, signal) {
 async function resolveSource(adapter, id, url) {
   const project = await adapter.resolveProject(id);
   if (!project) throw new HTTPException(404);
-  let relative5;
-  try {
-    relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
-  } catch {
-    throw new HTTPException(400);
-  }
+  const relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
   if (!/\.jpe?g$/i.test(relative5)) throw new HTTPException(415);
   const path = pinWithinProject(project.dir, relative5);
   if (!path) throw new HTTPException(404);
@@ -5065,7 +5274,7 @@ function registerWaveformRoutes(api, adapter) {
 // src/routes/freezeFrame.ts
 import { execFile } from "child_process";
 import { readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync8 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join13, relative as relative4, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname6, join as join13, relative as relative4, sep as sep3 } from "path";
 import { findFfBinary as findFfBinary3 } from "@hyperframes/parsers/ff-binaries";
 import {
   atomicTempPath,
@@ -5312,14 +5521,14 @@ async function extractThenPublishWhole(extract, mediaPath, mediaTime, imagePath)
   }
 }
 async function extractStill(projectDir, absPath, source, playhead, tools) {
-  const fileDir = dirname5(absPath);
+  const fileDir = dirname6(absPath);
   const mediaPath = pinWithinProject(projectDir, relative4(projectDir, join13(fileDir, source.src)));
   if (!mediaPath) return { error: `forbidden media path: ${source.src}`, status: 403 };
   const freezeDir = join13(projectDir, ...FREEZE_DIR);
   const fileName = freezeStillFileName(source.id, playhead, tools.stillToken());
   mkdirWithinProject(projectDir, freezeDir);
   const imagePath = pinWithinProject(projectDir, join13(...FREEZE_DIR, fileName));
-  if (!imagePath || dirname5(imagePath) !== freezeDir) {
+  if (!imagePath || dirname6(imagePath) !== freezeDir) {
     return { error: `forbidden freeze path: ${fileName}`, status: 403 };
   }
   const failed = await extractThenPublishWhole(
@@ -5329,7 +5538,7 @@ async function extractStill(projectDir, absPath, source, playhead, tools) {
     imagePath
   );
   if (failed) return failed;
-  const depth = relative4(projectDir, fileDir).split(sep2).filter(Boolean).length;
+  const depth = relative4(projectDir, fileDir).split(sep3).filter(Boolean).length;
   const stillPath = `${FREEZE_DIR.join("/")}/${fileName}`;
   return { imageSrc: `${"../".repeat(depth)}${stillPath}`, stillPath, imagePath };
 }
@@ -5883,7 +6092,7 @@ function registerSelectionRoutes(api, adapter) {
 // src/routes/media.ts
 import { streamSSE as streamSSE2 } from "hono/streaming";
 import { existsSync as existsSync10 } from "fs";
-import { basename as basename3, dirname as dirname6, extname, join as join15, posix } from "path";
+import { basename as basename3, dirname as dirname7, extname, join as join15, posix } from "path";
 var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov",
@@ -5906,9 +6115,6 @@ function isVideoPath(path) {
 function isImagePath(path) {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
-function normalizeProjectAssetPath(path) {
-  return path.trim().replace(/^[.]\//, "").replace(/[?#].*$/, "");
-}
 function containsNullByte(path) {
   return path.includes("\0");
 }
@@ -5973,7 +6179,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
   api.get("/projects/:id/media/metadata", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const assetPath = normalizeProjectAssetPath(c.req.query("path") ?? "");
+    const assetPath = requestedProjectPath(project.dir, c.req.query("path") ?? "");
     if (!assetPath) return c.json({ error: "path required" }, 400);
     if (containsNullByte(assetPath)) return c.json({ error: "forbidden" }, 403);
     if (/^(?:https?:|data:|blob:)/i.test(assetPath)) {
@@ -5995,7 +6201,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       const project = await adapter.resolveProject(c.req.param("id"));
       if (!project) return c.json({ error: "not found" }, 404);
       const body = await c.req.json().catch(() => ({}));
-      const inputAssetPath = body.inputPath ? normalizeProjectAssetPath(body.inputPath) : "";
+      const inputAssetPath = body.inputPath ? requestedProjectPath(project.dir, body.inputPath) : "";
       if (!inputAssetPath) return c.json({ error: "inputPath required" }, 400);
       if (containsNullByte(inputAssetPath)) return c.json({ error: "forbidden" }, 403);
       if (/^(?:https?:|data:|blob:)/i.test(inputAssetPath)) {
@@ -6009,7 +6215,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (!inputIsVideo && !inputIsImage) {
         return c.json({ error: "background removal supports video or image assets only" }, 400);
       }
-      const requestedOutput = body.outputPath ? posix.normalize(normalizeProjectAssetPath(body.outputPath)) : "";
+      const requestedOutput = body.outputPath ? posix.normalize(requestedProjectPath(project.dir, body.outputPath)) : "";
       if (requestedOutput && containsNullByte(requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
@@ -6039,8 +6245,8 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "forbidden" }, 403);
         }
       }
-      mkdirWithinProject(project.dir, dirname6(outputPath));
-      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname6(backgroundOutputPath));
+      mkdirWithinProject(project.dir, dirname7(outputPath));
+      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname7(backgroundOutputPath));
       const jobId = makeJobId(project.id, mediaJobs);
       const state = adapter.startBackgroundRemoval({
         project,
@@ -6483,6 +6689,7 @@ export {
   createStudioManualEditsRenderBodyScript,
   createStudioMotionRenderBodyScript,
   createStudioPositionSeekReapplyScript,
+  decodeWellFormedEscapes,
   dedupeClonedCompositionId,
   duplicateElementInHtml,
   fileContentVersion,