@hyperframes/studio-server 0.8.71 → 0.8.73

package/dist/index.d.ts

@@ -90,6 +90,8 @@ declare const PREVIEW_BUNDLE_OPTIONS: {
 declare const MIME_TYPES: Record<string, string>;
 declare function getMimeType(path: string): string;
 
+declare function requestSubPath(url: string, route: string): string;
+
 interface FileWriteReceipt {
     path: string;
     version: string;
@@ -183,4 +185,4 @@ type BackgroundRemovalRender = (options: {
 }>;
 declare function createBackgroundRemovalJob(opts: BackgroundRemovalJobOptions, render: BackgroundRemovalRender): MediaProcessingJobState;
 
-export { type AppliedFileMutation, type BackgroundRemovalRender, type DuplicateElementResult, type FileMutationInput, type FileWriteReceipt, MIME_TYPES, MediaProcessingJobState, PREVIEW_BUNDLE_OPTIONS, SourceMutationTarget, StudioApiAdapter, type ThumbnailOutputDimensions, affectsProjectSignature, applyFileMutations, buildSubCompositionHtml, compositionsAffectedBy, consumeFileWriteReceipt, createBackgroundRemovalJob, createProjectSignature, createStudioApi, duplicateElementInHtml, fileContentVersion, getMimeType, identifyFileWrite, settledFileTag, thumbnailDeviceScaleFactor, walkDir };
+export { type AppliedFileMutation, type BackgroundRemovalRender, type DuplicateElementResult, type FileMutationInput, type FileWriteReceipt, MIME_TYPES, MediaProcessingJobState, PREVIEW_BUNDLE_OPTIONS, SourceMutationTarget, StudioApiAdapter, type ThumbnailOutputDimensions, affectsProjectSignature, applyFileMutations, buildSubCompositionHtml, compositionsAffectedBy, consumeFileWriteReceipt, createBackgroundRemovalJob, createProjectSignature, createStudioApi, duplicateElementInHtml, fileContentVersion, getMimeType, identifyFileWrite, requestSubPath, settledFileTag, thumbnailDeviceScaleFactor, walkDir };

package/dist/index.js

@@ -1018,6 +1018,14 @@ function resolveGsapWriter(env) {
   throw new Error(`Invalid ${GSAP_WRITER_MIGRATION.flag}=${configured}; expected recast or acorn`);
 }
 
+// src/helpers/requestSubPath.ts
+function requestSubPath(url, route) {
+  const routeSegments = route.split("/");
+  const segments = new URL(url).pathname.split("/");
+  const start = segments.indexOf(routeSegments[0] ?? "");
+  return decodeURIComponent(segments.slice(start + routeSegments.length).join("/"));
+}
+
 // src/routes/files.ts
 async function loadGsapParser() {
   return import("@hyperframes/parsers/gsap-parser-recast");
@@ -1040,7 +1048,7 @@ function isDanglingSymlinkInProject(projectDir, lexicalPath) {
     return true;
   }
 }
-async function resolveProjectPath(c, adapter, pathPrefix, opts) {
+async function resolveProjectPath(c, adapter, route, opts) {
   const id = c.req.param("id");
   const project = await adapter.resolveProject(id);
   if (!project) {
@@ -1051,7 +1059,7 @@ async function resolveProjectPath(c, adapter, pathPrefix, opts) {
       error: c.json({ error: "not found", why: "project_dir_missing" }, 404)
     };
   }
-  const filePath = decodeURIComponent(c.req.path.replace(pathPrefix(project.id), ""));
+  const filePath = requestSubPath(c.req.url, `projects/:id/${route}`);
   if (filePath.includes("\0")) {
     return { error: c.json({ error: "forbidden", why: "nul" }, 403) };
   }
@@ -1068,10 +1076,10 @@ async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   return { project, filePath, absPath };
 }
 function resolveProjectFile(c, adapter, opts) {
-  return resolveProjectPath(c, adapter, (id) => `/projects/${id}/files/`, opts);
+  return resolveProjectPath(c, adapter, "files", opts);
 }
 function resolveFileMutationContext(c, adapter, operation) {
-  return resolveProjectPath(c, adapter, (id) => `/projects/${id}/file-mutations/${operation}/`);
+  return resolveProjectPath(c, adapter, `file-mutations/${operation}`);
 }
 function isOptionalInteger(value) {
   return value === void 0 || Number.isInteger(value);
@@ -3142,7 +3150,7 @@ function registerFileRoutes(api, adapter) {
     }
   );
   api.get("/projects/:id/gsap-animations/*", async (c) => {
-    const res = await resolveProjectPath(c, adapter, (id) => `/projects/${id}/gsap-animations/`, {
+    const res = await resolveProjectPath(c, adapter, "gsap-animations", {
       mustExist: true
     });
     if ("error" in res) return res.error;
@@ -3165,7 +3173,7 @@ function registerFileRoutes(api, adapter) {
     return c.json({ atomicOwnershipPairs: true });
   });
   api.post("/projects/:id/gsap-mutations/*", async (c) => {
-    const res = await resolveProjectPath(c, adapter, (id) => `/projects/${id}/gsap-mutations/`, {
+    const res = await resolveProjectPath(c, adapter, "gsap-mutations", {
       mustExist: true
     });
     if ("error" in res) return res.error;
@@ -3176,12 +3184,7 @@ function registerFileRoutes(api, adapter) {
     return applyGsapMutations(c, res, [body]);
   });
   api.post("/projects/:id/gsap-mutations-batch/*", async (c) => {
-    const res = await resolveProjectPath(
-      c,
-      adapter,
-      (id) => `/projects/${id}/gsap-mutations-batch/`,
-      { mustExist: true }
-    );
+    const res = await resolveProjectPath(c, adapter, "gsap-mutations-batch", { mustExist: true });
     if ("error" in res) return res.error;
     const body = await c.req.json().catch(() => null);
     if (!body || !Array.isArray(body.mutations) || body.mutations.length === 0) {
@@ -3194,12 +3197,7 @@ function registerFileRoutes(api, adapter) {
     return applyGsapMutations(c, res, body.mutations);
   });
   api.post("/projects/:id/gsap-mutation-rollback/*", async (c) => {
-    const res = await resolveProjectPath(
-      c,
-      adapter,
-      (id) => `/projects/${id}/gsap-mutation-rollback/`,
-      { mustExist: true }
-    );
+    const res = await resolveProjectPath(c, adapter, "gsap-mutation-rollback", { mustExist: true });
     if ("error" in res) return res.error;
     const body = await c.req.json().catch(() => null);
     if (!body || typeof body.expected !== "string" || typeof body.restore !== "string") {
@@ -3766,9 +3764,7 @@ ${runtimeTag}`;
     const vars = previewVariablesFromRequest(c.req.query("variables"));
     if (vars.error !== void 0) return c.json({ error: vars.error }, 400);
     const previewVariables = vars.values;
-    const compPath = decodeURIComponent(
-      c.req.path.replace(`/projects/${project.id}/preview/comp/`, "").split("?")[0] ?? ""
-    );
+    const compPath = requestSubPath(c.req.url, "projects/:id/preview/comp");
     const compFile = resolveWithinProject(project.dir, compPath);
     if (!compFile || !existsSync5(compFile) || !statSync5(compFile).isFile()) {
       return c.text("not found", 404);
@@ -3802,9 +3798,7 @@ ${runtimeTag}`;
   api.get("/projects/:id/preview/*", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const subPath = decodeURIComponent(
-      c.req.path.replace(`/projects/${project.id}/preview/`, "").split("?")[0] ?? ""
-    );
+    const subPath = requestSubPath(c.req.url, "projects/:id/preview");
     const candidate = resolve4(project.dir, subPath);
     const file = isWithinProjectRoot(project.dir, candidate) ? candidate : null;
     if (!file) {
@@ -4198,7 +4192,10 @@ function registerRenderRoutes(api, adapter) {
 
 // src/routes/thumbnail.ts
 import {
+  closeSync as closeSync3,
   existsSync as existsSync7,
+  fstatSync as fstatSync3,
+  openSync as openSync3,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync12,
   readdirSync as readdirSync6,
@@ -4285,10 +4282,10 @@ var ThumbnailGenerationCoordinator = class {
     if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
     let entry = this.entries.get(key);
     if (!entry) {
-      let resolve5;
+      let resolve6;
       let reject;
       const promise = new Promise((resolvePromise, rejectPromise) => {
-        resolve5 = resolvePromise;
+        resolve6 = resolvePromise;
         reject = rejectPromise;
       });
       entry = {
@@ -4298,7 +4295,7 @@ var ThumbnailGenerationCoordinator = class {
         state: "queued",
         work,
         promise,
-        resolve: resolve5,
+        resolve: resolve6,
         reject
       };
       this.entries.set(key, entry);
@@ -4312,7 +4309,7 @@ var ThumbnailGenerationCoordinator = class {
     return /* @__PURE__ */ new Set([...this.entries.keys(), ...[...this.activeEntries].map((entry) => entry.key)]);
   }
   lease(entry, signal) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       let released = false;
       const release = () => {
         if (released) return;
@@ -4336,7 +4333,7 @@ var ThumbnailGenerationCoordinator = class {
       entry.promise.then(
         (value) => {
           release();
-          resolve5(value);
+          resolve6(value);
         },
         (reason) => {
           release();
@@ -4418,6 +4415,22 @@ function writeThumbnailAtomically(path, buffer) {
     rmSync4(temporaryPath, { force: true });
   }
 }
+function readCompositionSource(file) {
+  let fd;
+  try {
+    fd = openSync3(file, "r");
+  } catch (err) {
+    if (err.code === "ENOENT") return "missing";
+    throw err;
+  }
+  try {
+    const stat = fstatSync3(fd);
+    if (!stat.isFile()) return "not-a-file";
+    return { html: readFileSync12(fd, "utf-8"), mtimeMs: stat.mtimeMs };
+  } finally {
+    closeSync3(fd);
+  }
+}
 function registerThumbnailRoutes(api, adapter) {
   api.get("/projects/:id/thumbnail/*", async (c) => {
     if (!adapter.generateThumbnail) {
@@ -4426,10 +4439,11 @@ function registerThumbnailRoutes(api, adapter) {
     const resolved = await resolveProjectAndSignature(adapter, c.req.param("id"));
     if (!resolved) return c.json({ error: "not found" }, 404);
     const { project, signature: projectSignature } = resolved;
-    let compPath = decodeURIComponent(
-      c.req.path.replace(`/projects/${project.id}/thumbnail/`, "").split("?")[0] ?? ""
-    );
+    let compPath = requestSubPath(c.req.url, "projects/:id/thumbnail");
     if (compPath && !compPath.includes(".")) compPath += ".html";
+    const htmlFile = resolveWithinProject(project.dir, compPath);
+    const source = htmlFile ? readCompositionSource(htmlFile) : "not-a-file";
+    if (source === "not-a-file") return c.json({ error: "not found" }, 404);
     const inputSignature = compositionInputSignature(project.dir, compPath, projectSignature);
     const url = new URL(c.req.url, `http://${c.req.header("host") || "localhost"}`);
     const rawSeekTime = url.searchParams.get("t");
@@ -4449,11 +4463,10 @@ function registerThumbnailRoutes(api, adapter) {
     let compH = vpHeight || 1080;
     let sourceMtime = 0;
     let sourceKey = "";
-    const htmlFile = join11(project.dir, compPath);
-    if (existsSync7(htmlFile)) {
-      const html = readFileSync12(htmlFile, "utf-8");
+    if (source !== "missing") {
+      const { html } = source;
       sourceKey = `_${createHash4("sha1").update(html).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.round(statSync7(htmlFile).mtimeMs);
+      sourceMtime = Math.round(source.mtimeMs);
       if (!vpWidth) {
         const wMatch = html.match(/data-width=["'](\d+)["']/);
         const hMatch = html.match(/data-height=["'](\d+)["']/);
@@ -4475,7 +4488,8 @@ function registerThumbnailRoutes(api, adapter) {
       motionKey = `_${createHash4("sha1").update(motionContent).digest("hex").slice(0, 16)}`;
       sourceMtime = Math.max(sourceMtime, Math.round(statSync7(motionFile).mtimeMs));
     }
-    const previewUrl = compPath === "index.html" ? `http://${c.req.header("host")}/api/projects/${project.id}/preview` : `http://${c.req.header("host")}/api/projects/${project.id}/preview/comp/${compPath}`;
+    const projectUrl = `http://${c.req.header("host")}/api/projects/${encodeURIComponent(project.id)}`;
+    const previewUrl = compPath === "index.html" ? `${projectUrl}/preview` : `${projectUrl}/preview/comp/${compPath.split("/").map(encodeURIComponent).join("/")}`;
     const cacheDir = join11(project.dir, ".thumbnails");
     const selectorKey = selector ? `_${selector.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 80)}_${selectorIndex ?? 0}` : "";
     const urlVersionKey = urlVersion ? `_${urlVersion.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32)}` : "";
@@ -4549,15 +4563,17 @@ function registerThumbnailRoutes(api, adapter) {
 
 // src/routes/waveform.ts
 import { existsSync as existsSync8, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
-import { join as join12 } from "path";
+import { join as join12, resolve as resolve5 } from "path";
+import { isWithinProjectRoot as isWithinProjectRoot2 } from "@hyperframes/parsers/asset-resolution";
 function registerWaveformRoutes(api, adapter) {
   api.get("/projects/:id/waveform/*", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const assetPath = decodeURIComponent(
-      c.req.path.replace(`/projects/${project.id}/waveform/`, "").split("?")[0] ?? ""
-    );
-    const audioPath = join12(project.dir, assetPath);
+    const assetPath = requestSubPath(c.req.url, "projects/:id/waveform");
+    const audioPath = resolve5(project.dir, assetPath);
+    if (!isWithinProjectRoot2(project.dir, audioPath)) {
+      return c.json({ error: "file not found" }, 404);
+    }
     const stats = statSync8(audioPath, { throwIfNoEntry: false });
     if (!stats) return c.json({ error: "file not found" }, 404);
     const cacheDir = join12(project.dir, ".waveform-cache");
@@ -4584,7 +4600,7 @@ function registerWaveformRoutes(api, adapter) {
 }
 
 // src/routes/fonts.ts
-import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync3, openSync as openSync3, readSync } from "fs";
+import { closeSync as closeSync4, constants as constants2, fstatSync as fstatSync4, openSync as openSync4, readSync } from "fs";
 import {
   collectFontFileEntries,
   fontDirectories,
@@ -4691,12 +4707,12 @@ function registerFontRoutes(api) {
     if (!located) return c.json({ error: "font not found" }, 404);
     let fd;
     try {
-      fd = openSync3(located.path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+      fd = openSync4(located.path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
     } catch {
       return c.json({ error: "font file not accessible" }, 404);
     }
     try {
-      const stat = fstatSync3(fd);
+      const stat = fstatSync4(fd);
       if (stat.size > SYSTEM_FONT_SIZE_LIMIT) {
         return c.json({ error: "font file too large" }, 413);
       }
@@ -4713,7 +4729,7 @@ function registerFontRoutes(api) {
     } catch {
       return c.json({ error: "failed to read font file" }, 500);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   });
 }
@@ -5237,6 +5253,7 @@ export {
   parseSourceDocument,
   patchElementInHtml,
   removeElementFromHtml,
+  requestSubPath,
   settledFileTag,
   splitElementInHtml,
   thumbnailDeviceScaleFactor,