@hyperframes/studio-server 0.8.69 → 0.8.71

package/dist/index.d.ts

@@ -80,6 +80,13 @@ interface AppliedFileMutation {
 /** Applies prepared HTML mutations with the same journal and receipt semantics as Studio. */
 declare function applyFileMutations(projectDir: string, mutations: readonly FileMutationInput[], requestToken?: string, writeFile?: (path: string, content: string, encoding: "utf-8") => void): AppliedFileMutation[];
 
+/** The bundler options every adapter's `bundle()` uses. This route serves project files under a
+ * `<base href>`, so assets keep their URLs: inlined base64 multiplies the document per reference. */
+declare const PREVIEW_BUNDLE_OPTIONS: {
+    readonly runtime: "placeholder";
+    readonly inlineAssets: false;
+};
+
 declare const MIME_TYPES: Record<string, string>;
 declare function getMimeType(path: string): string;
 
@@ -90,6 +97,15 @@ interface FileWriteReceipt {
 }
 /** Strong content version used as both the JSON version and HTTP ETag. */
 declare function fileContentVersion(content: string | Uint8Array): string;
+/** A validator from a file's inode, change time and size, or null while the change is under three
+ * seconds old. Change time, not mtime: copy tools (`cp -p`, rsync, robocopy) set mtime back but not
+ * ctime, which Node reads from NTFS ChangeTime on Windows. A same-size rewrite within one tick keeps
+ * both, so only a settled file is tagged. */
+declare function settledFileTag(stat: {
+    ino: number;
+    ctimeMs: number;
+    size: number;
+}, now?: number): string | null;
 /**
  * Attach one API write's identity to the watcher echo for its exact bytes.
  *
@@ -167,4 +183,4 @@ type BackgroundRemovalRender = (options: {
 }>;
 declare function createBackgroundRemovalJob(opts: BackgroundRemovalJobOptions, render: BackgroundRemovalRender): MediaProcessingJobState;
 
-export { type AppliedFileMutation, type BackgroundRemovalRender, type DuplicateElementResult, type FileMutationInput, type FileWriteReceipt, MIME_TYPES, MediaProcessingJobState, SourceMutationTarget, StudioApiAdapter, type ThumbnailOutputDimensions, affectsProjectSignature, applyFileMutations, buildSubCompositionHtml, compositionsAffectedBy, consumeFileWriteReceipt, createBackgroundRemovalJob, createProjectSignature, createStudioApi, duplicateElementInHtml, fileContentVersion, getMimeType, identifyFileWrite, thumbnailDeviceScaleFactor, walkDir };
+export { type AppliedFileMutation, type BackgroundRemovalRender, type DuplicateElementResult, type FileMutationInput, type FileWriteReceipt, MIME_TYPES, MediaProcessingJobState, PREVIEW_BUNDLE_OPTIONS, SourceMutationTarget, StudioApiAdapter, type ThumbnailOutputDimensions, affectsProjectSignature, applyFileMutations, buildSubCompositionHtml, compositionsAffectedBy, consumeFileWriteReceipt, createBackgroundRemovalJob, createProjectSignature, createStudioApi, duplicateElementInHtml, fileContentVersion, getMimeType, identifyFileWrite, settledFileTag, thumbnailDeviceScaleFactor, walkDir };

package/dist/index.js

@@ -302,8 +302,10 @@ import { bodyLimit } from "hono/body-limit";
 import {
   closeSync,
   existsSync as existsSync3,
+  lstatSync as lstatSync3,
   openSync,
   readFileSync as readFileSync5,
+  readlinkSync,
   writeFileSync as writeFileSync4,
   writeSync,
   mkdirSync as mkdirSync3,
@@ -620,6 +622,10 @@ var receipts = /* @__PURE__ */ new Map();
 function fileContentVersion(content) {
   return `"sha256:${createHash2("sha256").update(content).digest("hex")}"`;
 }
+function settledFileTag(stat, now = Date.now()) {
+  if (now - stat.ctimeMs < 3e3) return null;
+  return [stat.ino, stat.ctimeMs, stat.size].map((n) => n.toString(36)).join("-");
+}
 function createWriteToken(requestToken) {
   const token = requestToken?.trim();
   return token && token.length <= 200 ? token : randomUUID2();
@@ -1016,6 +1022,24 @@ function resolveGsapWriter(env) {
 async function loadGsapParser() {
   return import("@hyperframes/parsers/gsap-parser-recast");
 }
+function isDanglingSymlinkInProject(projectDir, lexicalPath) {
+  if (!isSafePath(projectDir, dirname3(lexicalPath))) return false;
+  let stats;
+  try {
+    stats = lstatSync3(lexicalPath);
+  } catch {
+    return false;
+  }
+  if (!stats.isSymbolicLink()) return false;
+  const target = resolve3(dirname3(lexicalPath), readlinkSync(lexicalPath));
+  if (!isSafePath(projectDir, target)) return false;
+  try {
+    statSync3(lexicalPath);
+    return false;
+  } catch {
+    return true;
+  }
+}
 async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   const id = c.req.param("id");
   const project = await adapter.resolveProject(id);
@@ -1033,6 +1057,9 @@ async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   }
   const absPath = resolveWithinProject(project.dir, filePath);
   if (!absPath) {
+    if (isDanglingSymlinkInProject(project.dir, resolve3(project.dir, filePath))) {
+      return { error: c.json({ error: "not found", why: "dangling_symlink" }, 404) };
+    }
     return { error: c.json({ error: "forbidden", why: "outside_project" }, 403) };
   }
   if (opts?.mustExist && !existsSync3(absPath)) {
@@ -2406,21 +2433,31 @@ function registerFileRoutes(api, adapter) {
   api.get("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter);
     if ("error" in res) return res.error;
-    if (!existsSync3(res.absPath)) {
+    let fd;
+    try {
+      fd = openSync(res.absPath, "r");
+    } catch {
       if (c.req.query("optional") === "1") {
         return c.json({ filename: res.filePath, content: "", missing: true });
       }
       return c.json({ error: "not found" }, 404);
     }
-    const content = readFileSync5(res.absPath);
-    const version = fileContentVersion(content);
-    c.header("ETag", version);
-    return c.json({
-      filename: res.filePath,
-      content: content.toString("utf-8"),
-      version,
-      missing: false
-    });
+    try {
+      if (!fstatSync(fd).isFile()) {
+        return c.json({ error: "not found", why: "not_a_file" }, 404);
+      }
+      const content = readFileSync5(fd);
+      const version = fileContentVersion(content);
+      c.header("ETag", version);
+      return c.json({
+        filename: res.filePath,
+        content: content.toString("utf-8"),
+        version,
+        missing: false
+      });
+    } finally {
+      closeSync(fd);
+    }
   });
   api.put("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter);
@@ -3182,7 +3219,10 @@ import { createReadStream, existsSync as existsSync5, readFileSync as readFileSy
 import { Readable } from "stream";
 import { join as join8, resolve as resolve4 } from "path";
 import { createHash as createHash3 } from "crypto";
-import { injectScriptsIntoHtml, stripEmbeddedRuntimeScripts as stripEmbeddedRuntimeScripts2 } from "@hyperframes/core/compiler";
+import {
+  injectScriptsIntoHtml,
+  stripEmbeddedRuntimeScripts as stripEmbeddedRuntimeScripts2
+} from "@hyperframes/core/compiler";
 import { isWithinProjectRoot } from "@hyperframes/parsers/asset-resolution";
 
 // src/helpers/subComposition.ts
@@ -3627,6 +3667,10 @@ function resolveProjectMainHtml(projectDir, projectId) {
   }
   return null;
 }
+var PREVIEW_BUNDLE_OPTIONS = {
+  runtime: "placeholder",
+  inlineAssets: false
+};
 function registerPreviewRoutes(api, adapter) {
   const previewCacheHeaders = (etag) => ({
     "Cache-Control": "private, no-cache",
@@ -3789,12 +3833,10 @@ ${runtimeTag}`;
         return c.text("media proxy variant does not match asset", 422);
       }
     }
-    const etag = `"${stat.mtimeMs.toString(36)}-${stat.size.toString(36)}${proxyEtagSalt(proxyVariant)}"`;
-    const cacheHeaders = isText ? { "Cache-Control": "no-store" } : {
-      "Cache-Control": "private, no-cache",
-      ETag: etag
-    };
-    if (!isText) {
+    const tag = settledFileTag(stat);
+    const etag = tag && `"${tag}${proxyEtagSalt(proxyVariant)}"`;
+    const cacheHeaders = isText ? { "Cache-Control": "no-store" } : { "Cache-Control": "private, no-cache", ...etag && { ETag: etag } };
+    if (!isText && etag) {
       const ifNoneMatch = c.req.header("If-None-Match");
       if (ifNoneMatch === etag) {
         return new Response(null, { status: 304, headers: cacheHeaders });
@@ -5170,6 +5212,7 @@ function updateBackgroundRemovalProgress(state, event) {
 }
 export {
   MIME_TYPES,
+  PREVIEW_BUNDLE_OPTIONS,
   STUDIO_MANUAL_EDITS_PATH,
   STUDIO_MOTION_PATH,
   affectsProjectSignature,
@@ -5194,6 +5237,7 @@ export {
   parseSourceDocument,
   patchElementInHtml,
   removeElementFromHtml,
+  settledFileTag,
   splitElementInHtml,
   thumbnailDeviceScaleFactor,
   walkDir