@hyperframes/studio-server 0.8.60 → 0.8.62

package/dist/index.js

@@ -298,15 +298,15 @@ import { bodyLimit } from "hono/body-limit";
 import {
   closeSync,
   existsSync as existsSync3,
-  ftruncateSync,
   openSync,
   readFileSync as readFileSync5,
-  writeFileSync as writeFileSync5,
+  writeFileSync as writeFileSync4,
   writeSync,
   mkdirSync as mkdirSync3,
   unlinkSync as unlinkSync2,
   rmSync as rmSync3,
-  statSync as statSync2,
+  statSync as statSync3,
+  fstatSync,
   renameSync as renameSync2,
   readdirSync as readdirSync4
 } from "fs";
@@ -358,6 +358,24 @@ function isAudioFile(name) {
   return (getMimeType(name) ?? "").startsWith("audio/");
 }
 
+// src/helpers/atomicFile.ts
+import * as fs from "fs";
+import { randomUUID } from "crypto";
+function replaceFileAtomically(filePath, content, mode, operations = fs) {
+  const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    operations.writeFileSync(tempPath, content, { encoding: "utf-8", mode });
+    operations.chmodSync(tempPath, mode);
+    operations.renameSync(tempPath, filePath);
+  } catch (error) {
+    try {
+      operations.unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
+}
+
 // src/helpers/waveform.ts
 import { spawn } from "child_process";
 import {
@@ -592,7 +610,7 @@ function pruneBackups(backupDir, backupKey, keepPerFile) {
 }
 
 // src/helpers/fileVersion.ts
-import { createHash as createHash2, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 var RECEIPT_TTL_MS = 1e4;
 var receipts = /* @__PURE__ */ new Map();
 function fileContentVersion(content) {
@@ -600,7 +618,7 @@ function fileContentVersion(content) {
 }
 function createWriteToken(requestToken) {
   const token = requestToken?.trim();
-  return token && token.length <= 200 ? token : randomUUID();
+  return token && token.length <= 200 ? token : randomUUID2();
 }
 function recordFileWriteReceipt(absPath, receipt) {
   const now = Date.now();
@@ -635,8 +653,8 @@ function identifyFileWrite(absPath, expectedVersion) {
 var consumeFileWriteReceipt = identifyFileWrite;
 
 // src/helpers/applyFileMutations.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-function applyFileMutations(projectDir, mutations, requestToken, writeFile = writeFileSync4) {
+import { readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+function applyFileMutations(projectDir, mutations, requestToken, writeFile = (path, content) => replaceFileAtomically(path, content, statSync2(path).mode)) {
   const prepared = mutations.map((mutation) => ({
     ...mutation,
     before: mutation.before ?? readFileSync3(mutation.absPath, "utf-8")
@@ -743,7 +761,7 @@ import { parseHTML as parseHTML2 } from "linkedom";
 
 // src/helpers/compositionInsertion.ts
 import { existsSync as existsSync2, readFileSync as readFileSync4, realpathSync } from "fs";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { dirname as dirname2, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
 import { parseHTML } from "linkedom";
 var CompositionInsertionError = class extends Error {
@@ -907,7 +925,7 @@ function insertCompositionIntoSource(input) {
   const host = document.createElement("div");
   host.id = hostId;
   host.className = "clip";
-  host.setAttribute("data-hf-id", `hf-${randomUUID2()}`);
+  host.setAttribute("data-hf-id", `hf-${randomUUID3()}`);
   host.setAttribute("data-composition-id", hostId);
   host.setAttribute("data-composition-src", relativeSourcePath(targetAbs, sourceAbs));
   host.setAttribute("data-start", String(Math.round(input.start * 100) / 100));
@@ -1000,13 +1018,18 @@ async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   if (!project) {
     return { error: c.json({ error: "not found" }, 404) };
   }
+  if (!existsSync3(project.dir)) {
+    return {
+      error: c.json({ error: "not found", why: "project_dir_missing" }, 404)
+    };
+  }
   const filePath = decodeURIComponent(c.req.path.replace(pathPrefix(project.id), ""));
   if (filePath.includes("\0")) {
-    return { error: c.json({ error: "forbidden" }, 403) };
+    return { error: c.json({ error: "forbidden", why: "nul" }, 403) };
   }
   const absPath = resolveWithinProject(project.dir, filePath);
   if (!absPath) {
-    return { error: c.json({ error: "forbidden" }, 403) };
+    return { error: c.json({ error: "forbidden", why: "outside_project" }, 403) };
   }
   if (opts?.mustExist && !existsSync3(absPath)) {
     return { error: c.json({ error: "not found" }, 404) };
@@ -1066,7 +1089,7 @@ function foldElementPatches(originalContent, patches) {
   }
   return { content, matched };
 }
-function commitElementPatchBatches(projectDir, batches, writeFile = writeFileSync5, requestToken) {
+function commitElementPatchBatches(projectDir, batches, writeFile = (path, content) => replaceFileAtomically(path, content, statSync3(path).mode), requestToken) {
   const resolvedPaths = /* @__PURE__ */ new Set();
   const prepared = [];
   for (const batch of batches) {
@@ -1127,7 +1150,7 @@ function commitElementPatchBatchesWithReceipts(c, projectDir, batches) {
   return commitElementPatchBatches(
     projectDir,
     batches,
-    writeFileSync5,
+    writeFileSync4,
     c.req.header("X-Hyperframes-Write-Token")
   );
 }
@@ -1138,7 +1161,7 @@ function recordMutationReceipt(c, filePath, absPath, html) {
   return { version, writeToken };
 }
 function writeFileWithReceipt(c, filePath, absPath, html) {
-  writeFileSync5(absPath, html, "utf-8");
+  replaceFileAtomically(absPath, html, statSync3(absPath).mode);
   return recordMutationReceipt(c, filePath, absPath, html);
 }
 function writeMutationResult(c, projectDir, filePath, absPath, html) {
@@ -1227,7 +1250,7 @@ function updateReferences(projectDir, oldPath, newPath) {
     if (!content.includes(oldPath)) continue;
     const updated = content.split(oldPath).join(newPath);
     if (updated !== content) {
-      writeFileSync5(file, updated, "utf-8");
+      replaceFileAtomically(file, updated, statSync3(file).mode);
       updatedCount++;
     }
   }
@@ -2347,7 +2370,7 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
       try {
         const fd = openSync(finalPath, "wx");
         try {
-          writeFileSync5(fd, buffer);
+          writeFileSync4(fd, buffer);
         } finally {
           closeSync(fd);
         }
@@ -2475,10 +2498,12 @@ function registerFileRoutes(api, adapter) {
         }
         backup = snapshotBeforeWrite(res.project.dir, res.absPath);
         if (backup.error) return c.json({ error: `backup failed: ${backup.error}` }, 500);
-        ftruncateSync(fd, 0);
-        writeSync(fd, body, 0, body.length, 0);
-      } finally {
+        const mode = fstatSync(fd).mode;
         closeSync(fd);
+        fd = null;
+        replaceFileAtomically(res.absPath, body, mode);
+      } finally {
+        if (fd !== null) closeSync(fd);
       }
     }
     const version = fileContentVersion(body);
@@ -2499,7 +2524,7 @@ function registerFileRoutes(api, adapter) {
     ensureDir(res.absPath);
     const body = Buffer.from(await c.req.arrayBuffer());
     try {
-      writeFileSync5(res.absPath, body, { flag: "wx" });
+      writeFileSync4(res.absPath, body, { flag: "wx" });
     } catch (error) {
       if (!error || typeof error !== "object" || !("code" in error) || error.code !== "EEXIST") {
         throw error;
@@ -2511,7 +2536,7 @@ function registerFileRoutes(api, adapter) {
   api.delete("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter, { mustExist: true });
     if ("error" in res) return res.error;
-    const stat = statSync2(res.absPath);
+    const stat = statSync3(res.absPath);
     const backup = snapshotBeforeWrite(res.project.dir, res.absPath);
     if (backup.error) return c.json({ error: `backup failed: ${backup.error}` }, 500);
     if (stat.isDirectory()) {
@@ -2701,7 +2726,7 @@ function registerFileRoutes(api, adapter) {
       const written = [];
       try {
         for (const file of prepared) {
-          writeFileSync5(file.absPath, file.after, "utf-8");
+          replaceFileAtomically(file.absPath, file.after, statSync3(file.absPath).mode);
           written.push(file);
           recordFileWriteReceipt(file.absPath, {
             path: file.path,
@@ -2718,7 +2743,7 @@ function registerFileRoutes(api, adapter) {
               conflicts.push(file.path);
               continue;
             }
-            writeFileSync5(file.absPath, file.before, "utf-8");
+            replaceFileAtomically(file.absPath, file.before, statSync3(file.absPath).mode);
             recordFileWriteReceipt(file.absPath, {
               path: file.path,
               version: fileContentVersion(file.before),
@@ -3045,7 +3070,7 @@ function registerFileRoutes(api, adapter) {
       return c.json({ error: "forbidden" }, 403);
     }
     ensureDir(destAbs);
-    writeFileSync5(destAbs, readFileSync5(srcAbs));
+    writeFileSync4(destAbs, readFileSync5(srcAbs));
     return c.json({ ok: true, path: copyPath }, 201);
   });
   const MAX_UPLOAD_BYTES = 500 * 1024 * 1024;
@@ -3138,13 +3163,13 @@ function registerFileRoutes(api, adapter) {
     if (current !== body.expected) {
       return c.json({ ok: true, restored: false, conflict: true });
     }
-    writeFileSync5(res.absPath, body.restore, "utf-8");
+    replaceFileAtomically(res.absPath, body.restore, statSync3(res.absPath).mode);
     return c.json({ ok: true, restored: true, conflict: false });
   });
 }
 
 // src/routes/preview.ts
-import { createReadStream, existsSync as existsSync5, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { createReadStream, existsSync as existsSync5, readFileSync as readFileSync8, statSync as statSync5 } from "fs";
 import { Readable } from "stream";
 import { join as join8, resolve as resolve4 } from "path";
 import { createHash as createHash3 } from "crypto";
@@ -3335,16 +3360,7 @@ import { ensureHfIds as ensureHfIds2 } from "@hyperframes/parsers/hf-ids";
 
 // src/helpers/hfIdPersist.ts
 import { ensureHfIds } from "@hyperframes/parsers/hf-ids";
-import {
-  closeSync as closeSync2,
-  constants,
-  fstatSync,
-  ftruncateSync as ftruncateSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync7,
-  writeFileSync as writeFileSync6,
-  writeSync as writeSync2
-} from "fs";
+import { closeSync as closeSync2, constants, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
 function persistHfIdsIfNeeded(filePath, html) {
   const normalized = ensureHfIds(html);
   const idsBefore = (html.match(/\bdata-hf-id=/g) ?? []).length;
@@ -3353,7 +3369,7 @@ function persistHfIdsIfNeeded(filePath, html) {
     try {
       const current = readFileSync7(filePath, "utf-8");
       if (current === html) {
-        writeFileSync6(filePath, normalized, "utf-8");
+        replaceFileAtomically(filePath, normalized, statSync4(filePath).mode);
       }
     } catch (err) {
       console.warn("[hyperframes] persistHfIdsIfNeeded: failed to write ids to disk:", err);
@@ -3378,21 +3394,23 @@ function stampFileHfIds(filePath) {
   }
   if (fd === null) return null;
   try {
-    if (!fstatSync(fd).isFile()) return null;
+    if (!fstatSync2(fd).isFile()) return null;
     const html = readFileSync7(fd, "utf-8");
     const normalized = ensureHfIds(html);
     const idsBefore = (html.match(/\bdata-hf-id=/g) ?? []).length;
     const idsAfter = (normalized.match(/\bdata-hf-id=/g) ?? []).length;
     if (writable && idsAfter > idsBefore) {
-      ftruncateSync2(fd, 0);
-      writeSync2(fd, normalized, 0, "utf-8");
+      const mode = fstatSync2(fd).mode;
+      closeSync2(fd);
+      fd = null;
+      replaceFileAtomically(filePath, normalized, mode);
     }
     return normalized;
   } catch (err) {
     console.warn("[hyperframes] stampFileHfIds: failed to stamp ids:", err);
     return null;
   } finally {
-    closeSync2(fd);
+    if (fd !== null) closeSync2(fd);
   }
 }
 
@@ -3699,7 +3717,7 @@ ${runtimeTag}`;
       c.req.path.replace(`/projects/${project.id}/preview/comp/`, "").split("?")[0] ?? ""
     );
     const compFile = resolveWithinProject(project.dir, compPath);
-    if (!compFile || !existsSync5(compFile) || !statSync3(compFile).isFile()) {
+    if (!compFile || !existsSync5(compFile) || !statSync5(compFile).isFile()) {
       return c.text("not found", 404);
     }
     const compPathHash = createHash3("sha1").update(compPath).digest("hex");
@@ -3739,7 +3757,7 @@ ${runtimeTag}`;
     if (!file) {
       return c.text("not found", 404);
     }
-    const stat = existsSync5(file) ? statSync3(file) : null;
+    const stat = existsSync5(file) ? statSync5(file) : null;
     if (!stat?.isFile()) {
       return c.text("not found", 404);
     }
@@ -3789,7 +3807,7 @@ ${runtimeTag}`;
       servedContentType = PROXY_VARIANT_CONFIG[proxyVariant].contentType;
     }
     const textBuffer = isText ? Buffer.from(readFileSync8(file, "utf-8"), "utf-8") : null;
-    const totalSize = textBuffer ? textBuffer.length : statSync3(servedPath).size;
+    const totalSize = textBuffer ? textBuffer.length : statSync5(servedPath).size;
     const bodyFor = (start, end) => textBuffer ? new Uint8Array(textBuffer.subarray(start, end + 1)) : (
       // Node's web stream type and the DOM one do not overlap for tsc on
       // every platform's lib set; the double cast is the documented bridge.
@@ -3884,7 +3902,7 @@ function registerLintRoutes(api, adapter) {
 
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
-import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync4, unlinkSync as unlinkSync3, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync4, unlinkSync as unlinkSync3, readdirSync as readdirSync5, statSync as statSync6 } from "fs";
 import { join as join10 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
@@ -4090,7 +4108,7 @@ function registerRenderRoutes(api, adapter) {
     if (!existsSync6(rendersDir)) return c.json({ renders: [] });
     const files = readdirSync5(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
       const fp = join10(rendersDir, f);
-      const stat = statSync4(fp);
+      const stat = statSync6(fp);
       const rid = f.replace(/\.(mp4|webm|mov)$/, "");
       const metaPath = join10(rendersDir, `${rid}.meta.json`);
       let status = "complete";
@@ -4135,12 +4153,12 @@ import {
   readdirSync as readdirSync6,
   renameSync as renameSync3,
   rmSync as rmSync4,
-  statSync as statSync5,
+  statSync as statSync7,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync5
 } from "fs";
 import { join as join11 } from "path";
-import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
 
 // src/routes/thumbnailGenerationCoordinator.ts
 var ThumbnailGenerationCoordinator = class {
@@ -4258,7 +4276,7 @@ function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
     if (!entry.isFile()) return [];
     const path = join11(cacheDir, entry.name);
     try {
-      const stats = statSync5(path);
+      const stats = statSync7(path);
       return [{ path, bytes: stats.size, mtimeMs: stats.mtimeMs }];
     } catch {
       return [];
@@ -4284,9 +4302,9 @@ function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
   }
 }
 function writeThumbnailAtomically(path, buffer) {
-  const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
+  const temporaryPath = `${path}.${process.pid}.${randomUUID4()}.tmp`;
   try {
-    writeFileSync7(temporaryPath, buffer, { flag: "wx" });
+    writeFileSync5(temporaryPath, buffer, { flag: "wx" });
     renameSync3(temporaryPath, path);
   } finally {
     rmSync4(temporaryPath, { force: true });
@@ -4326,7 +4344,7 @@ function registerThumbnailRoutes(api, adapter) {
     if (existsSync7(htmlFile)) {
       const html = readFileSync11(htmlFile, "utf-8");
       sourceKey = `_${createHash4("sha1").update(html).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.round(statSync5(htmlFile).mtimeMs);
+      sourceMtime = Math.round(statSync7(htmlFile).mtimeMs);
       if (!vpWidth) {
         const wMatch = html.match(/data-width=["'](\d+)["']/);
         const hMatch = html.match(/data-height=["'](\d+)["']/);
@@ -4339,14 +4357,14 @@ function registerThumbnailRoutes(api, adapter) {
     if (existsSync7(manualEditsFile)) {
       const manualEditsContent = readFileSync11(manualEditsFile, "utf-8");
       manualEditsKey = `_${createHash4("sha1").update(manualEditsContent).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.max(sourceMtime, Math.round(statSync5(manualEditsFile).mtimeMs));
+      sourceMtime = Math.max(sourceMtime, Math.round(statSync7(manualEditsFile).mtimeMs));
     }
     const motionFile = join11(project.dir, STUDIO_MOTION_PATH);
     let motionKey = "";
     if (existsSync7(motionFile)) {
       const motionContent = readFileSync11(motionFile, "utf-8");
       motionKey = `_${createHash4("sha1").update(motionContent).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.max(sourceMtime, Math.round(statSync5(motionFile).mtimeMs));
+      sourceMtime = Math.max(sourceMtime, Math.round(statSync7(motionFile).mtimeMs));
     }
     const previewUrl = compPath === "index.html" ? `http://${c.req.header("host")}/api/projects/${project.id}/preview` : `http://${c.req.header("host")}/api/projects/${project.id}/preview/comp/${compPath}`;
     const cacheDir = join11(project.dir, ".thumbnails");
@@ -4421,7 +4439,7 @@ function registerThumbnailRoutes(api, adapter) {
 }
 
 // src/routes/waveform.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12, statSync as statSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
 import { join as join12 } from "path";
 function registerWaveformRoutes(api, adapter) {
   api.get("/projects/:id/waveform/*", async (c) => {
@@ -4431,7 +4449,7 @@ function registerWaveformRoutes(api, adapter) {
       c.req.path.replace(`/projects/${project.id}/waveform/`, "").split("?")[0] ?? ""
     );
     const audioPath = join12(project.dir, assetPath);
-    const stats = statSync6(audioPath, { throwIfNoEntry: false });
+    const stats = statSync8(audioPath, { throwIfNoEntry: false });
     if (!stats) return c.json({ error: "file not found" }, 404);
     const cacheDir = join12(project.dir, ".waveform-cache");
     const cachePath = join12(cacheDir, buildWaveformCacheKey(assetPath, stats));
@@ -4457,7 +4475,7 @@ function registerWaveformRoutes(api, adapter) {
 }
 
 // src/routes/fonts.ts
-import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync2, openSync as openSync3, readSync } from "fs";
+import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync3, openSync as openSync3, readSync } from "fs";
 import {
   collectFontFileEntries,
   fontDirectories,
@@ -4569,7 +4587,7 @@ function registerFontRoutes(api) {
       return c.json({ error: "font file not accessible" }, 404);
     }
     try {
-      const stat = fstatSync2(fd);
+      const stat = fstatSync3(fd);
       if (stat.size > SYSTEM_FONT_SIZE_LIMIT) {
         return c.json({ error: "font file too large" }, 413);
       }