@hyperframes/studio-server 0.8.30 → 0.8.32

package/dist/index.js

@@ -364,12 +364,12 @@ import {
   writeSync,
   mkdirSync as mkdirSync3,
   unlinkSync as unlinkSync2,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   statSync as statSync2,
-  renameSync,
+  renameSync as renameSync2,
   readdirSync as readdirSync4
 } from "fs";
-import { resolve as resolve3, dirname as dirname2, join as join6 } from "path";
+import { resolve as resolve3, dirname as dirname3, join as join6 } from "path";
 
 // src/helpers/mime.ts
 var MIME_TYPES = {
@@ -419,8 +419,17 @@ function isAudioFile(name) {
 
 // src/helpers/waveform.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, writeFileSync, mkdirSync, statSync } from "fs";
-import { join as join3 } from "path";
+import {
+  existsSync as existsSync2,
+  writeFileSync,
+  mkdirSync,
+  lstatSync as lstatSync2,
+  mkdtempSync,
+  renameSync,
+  rmSync,
+  statSync
+} from "fs";
+import { dirname, join as join3 } from "path";
 import { findFfBinary } from "@hyperframes/parsers/ff-binaries";
 var SAMPLE_RATE = 4e3;
 var PEAK_COUNT = 4e3;
@@ -492,15 +501,39 @@ async function generateWaveformCache(projectDir, assetPath) {
   const stats = statSync(audioPath);
   const cacheDir = join3(projectDir, ".waveform-cache");
   const cachePath = join3(cacheDir, buildWaveformCacheKey(assetPath, stats));
-  if (existsSync2(cachePath)) return;
+  if (isWaveformCacheDirectory(cacheDir) && existsSync2(cachePath)) return;
   const peaks = await decodeAudioPeaks(audioPath);
-  mkdirSync(cacheDir, { recursive: true });
-  writeFileSync(cachePath, JSON.stringify(peaks));
+  writeWaveformCache(cachePath, peaks);
+}
+function isWaveformCacheDirectory(cacheDir) {
+  return lstatSync2(cacheDir, { throwIfNoEntry: false })?.isDirectory() ?? false;
+}
+function writeWaveformCache(cachePath, peaks) {
+  const cacheDir = dirname(cachePath);
+  try {
+    mkdirSync(cacheDir, { mode: 448 });
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+  }
+  if (!isWaveformCacheDirectory(cacheDir)) {
+    throw new Error("Waveform cache must be a directory, not a symlink");
+  }
+  const stagingDir = mkdtempSync(join3(cacheDir, ".waveform-"));
+  try {
+    const stagingPath = join3(stagingDir, "peaks.json");
+    writeFileSync(stagingPath, JSON.stringify(peaks), { flag: "wx" });
+    renameSync(stagingPath, cachePath);
+  } finally {
+    try {
+      rmSync(stagingDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
 }
 
 // src/helpers/mediaValidation.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
 import { basename, join as join4 } from "path";
 var VIDEO_EXT = /\.(mp4|webm|mov|mkv|avi|m4v|mxf|mts|m2ts|ts)$/i;
@@ -539,13 +572,13 @@ function validateUploadedMedia(filePath, runner = spawnSync) {
   }
 }
 function validateUploadedMediaBuffer(fileName, buffer, runner = spawnSync) {
-  const tempDir = mkdtempSync(join4(tmpdir(), "hyperframes-upload-"));
+  const tempDir = mkdtempSync2(join4(tmpdir(), "hyperframes-upload-"));
   const tempPath = join4(tempDir, basename(fileName));
   try {
     writeFileSync2(tempPath, buffer);
     return validateUploadedMedia(tempPath, runner);
   } finally {
-    rmSync(tempDir, { recursive: true, force: true });
+    rmSync2(tempDir, { recursive: true, force: true });
   }
 }
 
@@ -687,7 +720,7 @@ import { parseHTML as parseHTML2 } from "linkedom";
 // src/helpers/compositionInsertion.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-import { dirname, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
+import { dirname as dirname2, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
 import { parseHTML } from "linkedom";
 var CompositionInsertionError = class extends Error {
   constructor(message, status) {
@@ -742,7 +775,7 @@ function canonicalDependency(projectDir, ownerAbs, sourcePath) {
   validateSourcePath(sourcePath);
   return canonicalProjectPath(
     projectDir,
-    resolveWithinProject(projectDir, relative3(projectDir, resolve2(dirname(ownerAbs), sourcePath)))
+    resolveWithinProject(projectDir, relative3(projectDir, resolve2(dirname2(ownerAbs), sourcePath)))
   );
 }
 function validateDependencyGraph(projectDir, targetAbs, sourceAbs) {
@@ -815,7 +848,7 @@ function uniqueHostId(root, base) {
   return `${base}_${suffix}`;
 }
 function relativeSourcePath(targetAbs, sourceAbs) {
-  return relative3(dirname(targetAbs), sourceAbs).split(sep2).join("/");
+  return relative3(dirname2(targetAbs), sourceAbs).split(sep2).join("/");
 }
 function insertCompositionIntoSource(input) {
   const targetAbs = canonicalProjectFile(input.projectDir, input.targetPath);
@@ -1153,7 +1186,7 @@ async function parseMutationBody(c) {
   return { target: body.target, body };
 }
 function ensureDir(filePath) {
-  const dir = dirname2(filePath);
+  const dir = dirname3(filePath);
   if (!existsSync4(dir)) mkdirSync3(dir, { recursive: true });
 }
 function generateCopyPath(projectDir, originalPath) {
@@ -2285,12 +2318,13 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
     if (!isSafePath(projectDir, destPath)) continue;
     let finalPath = destPath;
     let finalName = name;
+    const dotIdx = name.indexOf(".", name.startsWith(".") ? 1 : 0);
+    const ext = dotIdx > 0 ? name.slice(dotIdx) : "";
+    const base = dotIdx > 0 ? name.slice(0, dotIdx) : name;
+    const MAX_COPY_INDEX = 1e4;
+    let n = 1;
     if (existsSync4(finalPath)) {
-      const dotIdx = name.indexOf(".", name.startsWith(".") ? 1 : 0);
-      const ext = dotIdx > 0 ? name.slice(dotIdx) : "";
-      const base = dotIdx > 0 ? name.slice(0, dotIdx) : name;
-      let n = 2;
-      const MAX_COPY_INDEX = 1e4;
+      n = 2;
       while (n < MAX_COPY_INDEX && existsSync4(resolve3(targetDir, `${base} (${n})${ext}`))) n++;
       if (n >= MAX_COPY_INDEX) {
         skipped.push(name);
@@ -2306,7 +2340,30 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
       invalid.push({ name: finalName, reason: validation.reason });
       continue;
     }
-    writeFileSync4(finalPath, buffer);
+    let written = false;
+    while (n < MAX_COPY_INDEX && isSafePath(projectDir, finalPath)) {
+      try {
+        const fd = openSync(finalPath, "wx");
+        try {
+          writeFileSync4(fd, buffer);
+        } finally {
+          closeSync(fd);
+        }
+        written = true;
+        break;
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST") {
+          throw error;
+        }
+        n++;
+        finalName = `${base} (${n})${ext}`;
+        finalPath = resolve3(targetDir, finalName);
+      }
+    }
+    if (!written) {
+      if (n >= MAX_COPY_INDEX) skipped.push(name);
+      continue;
+    }
     const relativePath = subDir ? join6(subDir, finalName) : finalName;
     uploaded.push(relativePath);
     if (isAudioFile(finalName)) {
@@ -2457,7 +2514,7 @@ function registerFileRoutes(api, adapter) {
     const backup = snapshotBeforeWrite(res.project.dir, res.absPath);
     if (backup.error) console.warn(`Failed to create backup for ${res.filePath}: ${backup.error}`);
     if (stat.isDirectory()) {
-      rmSync2(res.absPath, { recursive: true });
+      rmSync3(res.absPath, { recursive: true });
     } else {
       unlinkSync2(res.absPath);
     }
@@ -2953,7 +3010,7 @@ function registerFileRoutes(api, adapter) {
       return c.json({ error: "already exists" }, 409);
     }
     ensureDir(newAbs);
-    renameSync(res.absPath, newAbs);
+    renameSync2(res.absPath, newAbs);
     const updatedFiles = updateReferences(res.project.dir, res.filePath, body.newPath);
     return c.json({ ok: true, path: body.newPath, updatedReferences: updatedFiles });
   });
@@ -3073,7 +3130,8 @@ function registerFileRoutes(api, adapter) {
 }
 
 // src/routes/preview.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { createReadStream, existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { Readable } from "stream";
 import { join as join8, resolve as resolve4 } from "path";
 import { createHash as createHash3 } from "crypto";
 import { injectScriptsIntoHtml, stripEmbeddedRuntimeScripts as stripEmbeddedRuntimeScripts2 } from "@hyperframes/core/compiler";
@@ -3714,29 +3772,39 @@ ${runtimeTag}`;
       }
       servedContentType = PROXY_VARIANT_CONFIG[proxyVariant].contentType;
     }
-    const buffer = isText ? Buffer.from(readFileSync8(file, "utf-8"), "utf-8") : readFileSync8(servedPath);
-    const totalSize = buffer.length;
+    const textBuffer = isText ? Buffer.from(readFileSync8(file, "utf-8"), "utf-8") : null;
+    const totalSize = textBuffer ? textBuffer.length : statSync3(servedPath).size;
+    const bodyFor = (start, end) => textBuffer ? new Uint8Array(textBuffer.subarray(start, end + 1)) : (
+      // Node's web stream type and the DOM one do not overlap for tsc on
+      // every platform's lib set; the double cast is the documented bridge.
+      Readable.toWeb(
+        createReadStream(servedPath, { start, end })
+      )
+    );
     const rangeHeader = c.req.header("Range");
-    if (rangeHeader) {
-      const match = /bytes=(\d+)-(\d*)/.exec(rangeHeader);
-      if (match) {
-        const start = parseInt(match[1], 10);
-        const end = match[2] ? parseInt(match[2], 10) : totalSize - 1;
-        const safeEnd = Math.min(end, totalSize - 1);
-        const chunkSize = safeEnd - start + 1;
-        return new Response(new Uint8Array(buffer.slice(start, safeEnd + 1)), {
-          status: 206,
-          headers: {
-            ...cacheHeaders,
-            "Content-Type": servedContentType,
-            "Content-Range": `bytes ${start}-${safeEnd}/${totalSize}`,
-            "Accept-Ranges": "bytes",
-            "Content-Length": String(chunkSize)
-          }
+    const match = rangeHeader ? /bytes=(\d+)-(\d*)/.exec(rangeHeader) : null;
+    if (match) {
+      const start = parseInt(match[1], 10);
+      const end = match[2] ? parseInt(match[2], 10) : totalSize - 1;
+      const safeEnd = Math.min(end, totalSize - 1);
+      if (start > safeEnd) {
+        return new Response(null, {
+          status: 416,
+          headers: { ...cacheHeaders, "Content-Range": `bytes */${totalSize}` }
         });
       }
+      return new Response(bodyFor(start, safeEnd), {
+        status: 206,
+        headers: {
+          ...cacheHeaders,
+          "Content-Type": servedContentType,
+          "Content-Range": `bytes ${start}-${safeEnd}/${totalSize}`,
+          "Accept-Ranges": "bytes",
+          "Content-Length": String(safeEnd - start + 1)
+        }
+      });
     }
-    return new Response(new Uint8Array(buffer), {
+    return new Response(totalSize > 0 ? bodyFor(0, totalSize - 1) : null, {
       headers: {
         ...cacheHeaders,
         "Content-Type": servedContentType,
@@ -4041,8 +4109,8 @@ import {
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync11,
   readdirSync as readdirSync6,
-  renameSync as renameSync2,
-  rmSync as rmSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync4,
   statSync as statSync5,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync6
@@ -4176,7 +4244,7 @@ function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
   const retained = [];
   for (const file of files) {
     if (!protectedPaths.has(file.path) && now - file.mtimeMs > THUMBNAIL_CACHE_MAX_AGE_MS) {
-      rmSync3(file.path, { force: true });
+      rmSync4(file.path, { force: true });
     } else {
       retained.push(file);
     }
@@ -4196,9 +4264,9 @@ function writeThumbnailAtomically(path, buffer) {
   const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
   try {
     writeFileSync6(temporaryPath, buffer, { flag: "wx" });
-    renameSync2(temporaryPath, path);
+    renameSync3(temporaryPath, path);
   } finally {
-    rmSync3(temporaryPath, { force: true });
+    rmSync4(temporaryPath, { force: true });
   }
 }
 function registerThumbnailRoutes(api, adapter) {
@@ -4334,7 +4402,7 @@ function registerThumbnailRoutes(api, adapter) {
 }
 
 // src/routes/waveform.ts
-import { existsSync as existsSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, statSync as statSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync12, statSync as statSync6 } from "fs";
 import { join as join12 } from "path";
 function registerWaveformRoutes(api, adapter) {
   api.get("/projects/:id/waveform/*", async (c) => {
@@ -4348,12 +4416,12 @@ function registerWaveformRoutes(api, adapter) {
     if (!stats) return c.json({ error: "file not found" }, 404);
     const cacheDir = join12(project.dir, ".waveform-cache");
     const cachePath = join12(cacheDir, buildWaveformCacheKey(assetPath, stats));
-    if (existsSync9(cachePath)) {
-      try {
+    try {
+      if (isWaveformCacheDirectory(cacheDir) && existsSync9(cachePath)) {
         const peaks2 = JSON.parse(readFileSync12(cachePath, "utf-8"));
         return c.json({ peaks: peaks2 });
-      } catch {
       }
+    } catch {
     }
     let peaks;
     try {
@@ -4362,8 +4430,7 @@ function registerWaveformRoutes(api, adapter) {
       return c.json({ error: "failed to decode audio" }, 500);
     }
     try {
-      mkdirSync6(cacheDir, { recursive: true });
-      writeFileSync7(cachePath, JSON.stringify(peaks));
+      writeWaveformCache(cachePath, peaks);
     } catch {
     }
     return c.json({ peaks });
@@ -4634,8 +4701,8 @@ function registerSelectionRoutes(api, adapter) {
 
 // src/routes/media.ts
 import { streamSSE as streamSSE2 } from "hono/streaming";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7 } from "fs";
-import { basename as basename2, dirname as dirname3, extname as extname2, join as join13 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, extname as extname2, join as join13 } from "path";
 var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov",
@@ -4779,8 +4846,8 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "forbidden" }, 403);
         }
       }
-      mkdirSync7(dirname3(outputPath), { recursive: true });
-      if (backgroundOutputPath) mkdirSync7(dirname3(backgroundOutputPath), { recursive: true });
+      mkdirSync6(dirname4(outputPath), { recursive: true });
+      if (backgroundOutputPath) mkdirSync6(dirname4(backgroundOutputPath), { recursive: true });
       const jobId = makeJobId(project.id, mediaJobs);
       const state = adapter.startBackgroundRemoval({
         project,