@hyperframes/studio-server 0.8.24 → 0.8.26

package/dist/index.js

@@ -160,6 +160,7 @@ function collectProjectSignatureFiles(projectDir, dir, files) {
       files.push({
         file,
         mtimeMs: stat.mtimeMs,
+        ctimeMs: stat.ctimeMs,
         size: stat.size,
         textContentEligible: isTextContentEligible(file, stat.size)
       });
@@ -181,6 +182,7 @@ function collectProjectSignatureManifestFiles(projectDir, files) {
     files.push({
       file,
       mtimeMs: stat.mtimeMs,
+      ctimeMs: stat.ctimeMs,
       size: stat.size,
       textContentEligible: isTextContentEligible(file, stat.size)
     });
@@ -196,6 +198,8 @@ function createProjectFingerprint(projectDir, files) {
     hash.update("\0");
     hash.update(String(entry.mtimeMs));
     hash.update("\0");
+    hash.update(String(entry.ctimeMs));
+    hash.update("\0");
     hash.update(entry.textContentEligible ? "text" : "binary");
     hash.update("\0");
   }
@@ -1443,6 +1447,9 @@ function validateGsapMutationRequest(c, body) {
   if (!body || typeof body !== "object" || !("type" in body) || !body.type) {
     return c.json({ error: "mutation type required" }, 400);
   }
+  if (containsRawGsapExpression(body)) {
+    return c.json({ error: "raw JavaScript expressions are not accepted" }, 400);
+  }
   const unsafeFields = findUnsafeMutationValues(body);
   if (unsafeFields.length > 0) return rejectUnsafeMutationValues(c, unsafeFields);
   if (body.type === "shift-positions-batch" && (!("shifts" in body) || !Array.isArray(body.shifts))) {
@@ -1450,6 +1457,12 @@ function validateGsapMutationRequest(c, body) {
   }
   return null;
 }
+function containsRawGsapExpression(value) {
+  if (typeof value === "string") return value.startsWith("__raw:");
+  if (Array.isArray(value)) return value.some(containsRawGsapExpression);
+  if (!value || typeof value !== "object") return false;
+  return Object.values(value).some(containsRawGsapExpression);
+}
 async function prepareGsapMutationScript(c, res, firstMutation) {
   const beforeHtml = readFileSync5(res.absPath, "utf-8");
   let html = beforeHtml;
@@ -2748,27 +2761,32 @@ function registerFileRoutes(api, adapter) {
       parsed.body.operations
     );
     if (patched === originalContent) {
+      const version2 = fileContentVersion(originalContent);
+      c.header("ETag", version2);
       return c.json({
         ok: true,
         changed: false,
         matched,
         content: originalContent,
-        path: ctx.filePath
+        path: ctx.filePath,
+        version: version2
       });
     }
-    const { backupPath } = writeMutationResult(
+    const { backupPath, version } = writeMutationResult(
       c,
       ctx.project.dir,
       ctx.filePath,
       ctx.absPath,
       patched
     );
+    c.header("ETag", version);
     return c.json({
       ok: true,
       changed: true,
       matched,
       content: patched,
       path: ctx.filePath,
+      version,
       backupPath
     });
   });
@@ -4178,8 +4196,9 @@ function registerThumbnailRoutes(api, adapter) {
     if (!adapter.generateThumbnail) {
       return c.json({ error: "Thumbnails not available" }, 501);
     }
-    const project = await adapter.resolveProject(c.req.param("id"));
-    if (!project) return c.json({ error: "not found" }, 404);
+    const resolved = await resolveProjectAndSignature(adapter, c.req.param("id"));
+    if (!resolved) return c.json({ error: "not found" }, 404);
+    const { project, signature: projectSignature } = resolved;
     let compPath = decodeURIComponent(
       c.req.path.replace(`/projects/${project.id}/thumbnail/`, "").split("?")[0] ?? ""
     );
@@ -4232,6 +4251,7 @@ function registerThumbnailRoutes(api, adapter) {
     const cacheDir = join11(project.dir, ".thumbnails");
     const selectorKey = selector ? `_${selector.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 80)}_${selectorIndex ?? 0}` : "";
     const urlVersionKey = urlVersion ? `_${urlVersion.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32)}` : "";
+    const projectSignatureKey = `_${createHash4("sha1").update(projectSignature).digest("hex").slice(0, 16)}`;
     const outputScale = outputMode === "source" ? 1 : outputMode === "storyboard" ? Math.min(
       1,
       STORYBOARD_MAX_OUTPUT_DIMENSION / compW,
@@ -4239,7 +4259,7 @@ function registerThumbnailRoutes(api, adapter) {
     ) : Math.min(1, THUMBNAIL_MAX_OUTPUT_WIDTH / compW, THUMBNAIL_MAX_OUTPUT_HEIGHT / compH);
     const outputWidth = Math.max(1, Math.round(compW * outputScale));
     const outputHeight = Math.max(1, Math.round(compH * outputScale));
-    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${manualEditsKey}${motionKey}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
+    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${projectSignatureKey}${manualEditsKey}${motionKey}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
     const cachePath = join11(cacheDir, cacheKey);
     if (!prunedCacheDirs.has(cacheDir)) {
       prunedCacheDirs.add(cacheDir);
@@ -4273,6 +4293,11 @@ function registerThumbnailRoutes(api, adapter) {
             signal
           });
           if (!generated) return null;
+          const afterGeneration = await resolveProjectAndSignature(adapter, project.id);
+          const freshSignature = createProjectSignature(project.dir);
+          if (!afterGeneration || afterGeneration.project.dir !== project.dir || afterGeneration.signature !== projectSignature || freshSignature !== projectSignature) {
+            return generated;
+          }
           if (!existsSync8(cacheDir)) mkdirSync5(cacheDir, { recursive: true });
           writeThumbnailAtomically(cachePath, generated);
           return generated;