@hyperframes/studio-server 0.8.79 → 0.8.81

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   splitElementInHtml,
   unwrapElementsFromHtml,
   wrapElementsInHtml
-} from "./chunk-QYDRVMJ6.js";
+} from "./chunk-P5EJPIH3.js";
 import {
   getElementScreenshotClip
 } from "./chunk-W2SBTCO2.js";
@@ -22,21 +22,28 @@ import {
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "./chunk-X3T65KC2.js";
+} from "./chunk-FTDTO3QP.js";
 import {
   ProxyCapacityError,
   ProxyTranscodeError,
   resolveProxy
-} from "./chunk-45POWYFS.js";
+} from "./chunk-G6IIFKXY.js";
 import {
   PROXY_VARIANT_CONFIG,
   decideMediaProxyEligibility,
+  isInHiddenOrVendorDir,
   isProxyVariantRequest,
+  isSafePath,
+  pinWithinProject,
   probeAssetCodec,
   probeMediaMetadata,
+  realFilePath,
+  realpath,
   recordProxyRequest,
-  resolveProxyVariantRequest
-} from "./chunk-4MNTZVVZ.js";
+  resolveProxyVariantRequest,
+  resolveWithinProject,
+  walkDir
+} from "./chunk-TJQ76IEA.js";
 import {
   STUDIO_MANUAL_EDITS_PATH,
   createStudioManualEditsRenderBodyScript,
@@ -52,64 +59,7 @@ import { Hono } from "hono";
 
 // src/routes/projects.ts
 import { readFile } from "fs/promises";
-import { join as join3 } from "path";
-
-// src/helpers/safePath.ts
-import { basename, dirname, isAbsolute, join, relative, sep } from "path";
-import { readdirSync, realpathSync } from "fs";
-import { resolveWithinProject } from "@hyperframes/core";
-import { isSafePath, resolveWithinProject as resolveWithinProject2 } from "@hyperframes/core";
-function realFilePath(filePath) {
-  try {
-    return realpathSync(filePath);
-  } catch {
-    const dir = dirname(filePath);
-    return dir === filePath ? filePath : join(realFilePath(dir), basename(filePath));
-  }
-}
-function pinWithinProject(base, relativePath) {
-  const checked = resolveWithinProject(base, relativePath);
-  if (!checked) return null;
-  const inside = relative(realFilePath(base), realFilePath(checked));
-  const escapes = inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
-  return escapes ? null : join(base, inside);
-}
-var IGNORE_DIRS = /* @__PURE__ */ new Set([
-  ".thumbnails",
-  ".transcode-cache",
-  ".waveform-cache",
-  "node_modules",
-  ".git"
-]);
-function shouldIgnoreDir(rel) {
-  return rel === ".hyperframes/backup";
-}
-function isInHiddenOrVendorDir(relPath) {
-  const segments = relPath.split("/");
-  return segments.slice(0, -1).some((seg) => seg.startsWith(".") || seg === "node_modules");
-}
-var UNREADABLE_DIR_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM", "ENOENT", "ENOTDIR"]);
-function walkDir(dir, prefix = "") {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch (err) {
-    const code = err.code;
-    if (!prefix || !code || !UNREADABLE_DIR_CODES.has(code)) throw err;
-    return [];
-  }
-  const files = [];
-  for (const entry of entries) {
-    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (IGNORE_DIRS.has(entry.name) || shouldIgnoreDir(rel)) continue;
-    if (entry.isDirectory()) {
-      files.push(...walkDir(join(dir, entry.name), rel));
-    } else {
-      files.push(rel);
-    }
-  }
-  return files;
-}
+import { join as join2 } from "path";
 
 // src/helpers/hfIdPersist.ts
 import { ensureHfIds } from "@hyperframes/parsers/hf-ids";
@@ -123,7 +73,7 @@ import {
   readFileSync,
   writeFileSync
 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname, join } from "path";
 
 // src/helpers/atomicFile.ts
 import * as fs from "fs";
@@ -145,10 +95,10 @@ function replaceFileAtomically(filePath, content, mode, operations = fs) {
 
 // src/helpers/hfIdPersist.ts
 var isCompositionSource = (html) => /data-composition-id\s*=/.test(html);
-var STAMP_RECORD = join2(".hyperframes", "hf-ids-stamped.json");
+var STAMP_RECORD = join(".hyperframes", "hf-ids-stamped.json");
 var contentHash = (text2) => createHash("sha1").update(text2).digest("base64url");
 function stampProjectHfIds(projectDir) {
-  const recordPath = join2(projectDir, STAMP_RECORD);
+  const recordPath = join(projectDir, STAMP_RECORD);
   let last = {};
   try {
     last = JSON.parse(readFileSync(recordPath, "utf-8"));
@@ -157,7 +107,7 @@ function stampProjectHfIds(projectDir) {
   const next = {};
   for (const file of walkDir(projectDir)) {
     if (!file.endsWith(".html") || isInHiddenOrVendorDir(file)) continue;
-    const absPath = join2(projectDir, file);
+    const absPath = join(projectDir, file);
     let html;
     try {
       html = readFileSync(absPath, "utf-8");
@@ -173,7 +123,7 @@ function stampProjectHfIds(projectDir) {
     next[file] = hash;
   }
   try {
-    mkdirSync(dirname2(recordPath), { recursive: true });
+    mkdirSync(dirname(recordPath), { recursive: true });
     writeFileSync(recordPath, JSON.stringify(next));
   } catch {
   }
@@ -226,8 +176,8 @@ function stampFileHfIds(filePath) {
 
 // src/helpers/projectSignature.ts
 import { createHash as createHash2 } from "crypto";
-import { lstatSync, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
-import { extname, isAbsolute as isAbsolute2, relative as relative2, resolve, sep as sep2 } from "path";
+import { lstatSync, readFileSync as readFileSync2, readdirSync } from "fs";
+import { extname, isAbsolute, relative, resolve, sep } from "path";
 var SIGNATURE_TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".cjs",
   ".css",
@@ -262,18 +212,18 @@ var STUDIO_SIGNATURE_MANIFEST_PATHS = [
   ".hyperframes/studio-motion.json"
 ];
 function affectsProjectSignature(projectDir, changedPath) {
-  const relativePath = relative2(resolve(projectDir), resolve(changedPath));
-  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
+  const relativePath = relative(resolve(projectDir), resolve(changedPath));
+  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute(relativePath)) {
     return false;
   }
-  const segments = relativePath.split(sep2);
+  const segments = relativePath.split(sep);
   if (STUDIO_SIGNATURE_MANIFEST_PATHS.includes(segments.join("/"))) return true;
   return !segments.some((segment) => SIGNATURE_EXCLUDED_DIRS.has(segment));
 }
 var projectSignatureCache = /* @__PURE__ */ new Map();
 function isPathWithin(parentDir, childPath) {
-  const childRelativePath = relative2(parentDir, childPath);
-  return childRelativePath === "" || !childRelativePath.startsWith("..") && !isAbsolute2(childRelativePath);
+  const childRelativePath = relative(parentDir, childPath);
+  return childRelativePath === "" || !childRelativePath.startsWith("..") && !isAbsolute(childRelativePath);
 }
 function isTextContentEligible(file, size) {
   return SIGNATURE_TEXT_EXTENSIONS.has(extname(file).toLowerCase()) && size <= MAX_SIGNATURE_TEXT_BYTES;
@@ -281,7 +231,7 @@ function isTextContentEligible(file, size) {
 function collectProjectSignatureFiles(projectDir, dir, files) {
   let entries;
   try {
-    entries = readdirSync2(dir).sort();
+    entries = readdirSync(dir).sort();
   } catch {
     return;
   }
@@ -289,22 +239,22 @@ function collectProjectSignatureFiles(projectDir, dir, files) {
     if (SIGNATURE_EXCLUDED_DIRS.has(entry)) continue;
     const file = resolve(dir, entry);
     if (!isPathWithin(projectDir, file)) continue;
-    let stat2;
+    let stat3;
     try {
-      stat2 = lstatSync(file);
+      stat3 = lstatSync(file);
     } catch {
       continue;
     }
-    if (stat2.isSymbolicLink()) continue;
-    if (stat2.isDirectory()) {
+    if (stat3.isSymbolicLink()) continue;
+    if (stat3.isDirectory()) {
       collectProjectSignatureFiles(projectDir, file, files);
-    } else if (stat2.isFile()) {
+    } else if (stat3.isFile()) {
       files.push({
         file,
-        mtimeMs: stat2.mtimeMs,
-        ctimeMs: stat2.ctimeMs,
-        size: stat2.size,
-        textContentEligible: isTextContentEligible(file, stat2.size)
+        mtimeMs: stat3.mtimeMs,
+        ctimeMs: stat3.ctimeMs,
+        size: stat3.size,
+        textContentEligible: isTextContentEligible(file, stat3.size)
       });
     }
   }
@@ -314,19 +264,19 @@ function collectProjectSignatureManifestFiles(projectDir, files) {
   for (const manifestPath of STUDIO_SIGNATURE_MANIFEST_PATHS) {
     const file = resolve(projectDir, manifestPath);
     if (seen.has(file) || !isPathWithin(projectDir, file)) continue;
-    let stat2;
+    let stat3;
     try {
-      stat2 = lstatSync(file);
+      stat3 = lstatSync(file);
     } catch {
       continue;
     }
-    if (stat2.isSymbolicLink() || !stat2.isFile()) continue;
+    if (stat3.isSymbolicLink() || !stat3.isFile()) continue;
     files.push({
       file,
-      mtimeMs: stat2.mtimeMs,
-      ctimeMs: stat2.ctimeMs,
-      size: stat2.size,
-      textContentEligible: isTextContentEligible(file, stat2.size)
+      mtimeMs: stat3.mtimeMs,
+      ctimeMs: stat3.ctimeMs,
+      size: stat3.size,
+      textContentEligible: isTextContentEligible(file, stat3.size)
     });
     seen.add(file);
   }
@@ -334,7 +284,7 @@ function collectProjectSignatureManifestFiles(projectDir, files) {
 function createProjectFingerprint(projectDir, files) {
   const hash = createHash2("sha256");
   for (const entry of files) {
-    hash.update(relative2(projectDir, entry.file));
+    hash.update(relative(projectDir, entry.file));
     hash.update("\0");
     hash.update(String(entry.size));
     hash.update("\0");
@@ -356,7 +306,7 @@ function collectProjectFiles(normalizedProjectDir) {
 function listProjectFiles(projectDir) {
   const normalizedProjectDir = resolve(projectDir);
   return collectProjectFiles(normalizedProjectDir).map((entry) => ({
-    path: relative2(normalizedProjectDir, entry.file).split(sep2).join("/"),
+    path: relative(normalizedProjectDir, entry.file).split(sep).join("/"),
     size: entry.size,
     mtimeMs: entry.mtimeMs,
     ctimeMs: entry.ctimeMs
@@ -374,7 +324,7 @@ function createProjectSignature(projectDir, excluding = /* @__PURE__ */ new Set(
   const normalizedProjectDir = resolve(projectDir);
   const collected = collectProjectFiles(normalizedProjectDir);
   const files = collected.filter(
-    (entry) => !excluding.has(relative2(normalizedProjectDir, entry.file).split(sep2).join("/"))
+    (entry) => !excluding.has(relative(normalizedProjectDir, entry.file).split(sep).join("/"))
   );
   files.sort((a, b) => a.file.localeCompare(b.file));
   const fingerprint = createProjectFingerprint(normalizedProjectDir, files);
@@ -383,7 +333,7 @@ function createProjectSignature(projectDir, excluding = /* @__PURE__ */ new Set(
   if (cached?.fingerprint === fingerprint) return cached.signature;
   const hash = createHash2("sha256");
   for (const entry of files) {
-    const relativePath = relative2(normalizedProjectDir, entry.file);
+    const relativePath = relative(normalizedProjectDir, entry.file);
     hash.update(relativePath);
     hash.update("\0");
     hash.update(String(entry.size));
@@ -410,7 +360,7 @@ async function filterCompositionFiles(projectDir, files) {
   const checks = await Promise.all(
     htmlFiles.map(async (f) => {
       try {
-        const content = await readFile(join3(projectDir, f), "utf-8");
+        const content = await readFile(join2(projectDir, f), "utf-8");
         return isCompositionSource(content);
       } catch {
         return false;
@@ -464,9 +414,9 @@ import {
   statSync as statSync3,
   fstatSync as fstatSync2,
   renameSync as renameSync2,
-  readdirSync as readdirSync4
+  readdirSync as readdirSync3
 } from "fs";
-import { resolve as resolve3, dirname as dirname5, join as join7 } from "path";
+import { resolve as resolve3, dirname as dirname4, join as join6 } from "path";
 
 // src/helpers/mime.ts
 var MIME_TYPES = {
@@ -526,7 +476,7 @@ import {
   rmSync,
   statSync
 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { findFfBinary } from "@hyperframes/parsers/ff-binaries";
 var SAMPLE_RATE = 4e3;
 var PEAK_COUNT = 4e3;
@@ -593,11 +543,11 @@ function decodeAudioPeaks(audioPath) {
   });
 }
 async function generateWaveformCache(projectDir, assetPath) {
-  const audioPath = join4(projectDir, assetPath);
+  const audioPath = join3(projectDir, assetPath);
   if (!existsSync(audioPath)) return;
   const stats = statSync(audioPath);
-  const cacheDir = join4(projectDir, ".waveform-cache");
-  const cachePath = join4(cacheDir, buildWaveformCacheKey(assetPath, stats));
+  const cacheDir = join3(projectDir, ".waveform-cache");
+  const cachePath = join3(cacheDir, buildWaveformCacheKey(assetPath, stats));
   if (isWaveformCacheDirectory(cacheDir) && existsSync(cachePath)) return;
   const peaks = await decodeAudioPeaks(audioPath);
   writeWaveformCache(cachePath, peaks);
@@ -606,7 +556,7 @@ function isWaveformCacheDirectory(cacheDir) {
   return lstatSync2(cacheDir, { throwIfNoEntry: false })?.isDirectory() ?? false;
 }
 function writeWaveformCache(cachePath, peaks) {
-  const cacheDir = dirname3(cachePath);
+  const cacheDir = dirname2(cachePath);
   try {
     mkdirSync2(cacheDir, { mode: 448 });
   } catch (error) {
@@ -615,9 +565,9 @@ function writeWaveformCache(cachePath, peaks) {
   if (!isWaveformCacheDirectory(cacheDir)) {
     throw new Error("Waveform cache must be a directory, not a symlink");
   }
-  const stagingDir = mkdtempSync(join4(cacheDir, ".waveform-"));
+  const stagingDir = mkdtempSync(join3(cacheDir, ".waveform-"));
   try {
-    const stagingPath = join4(stagingDir, "peaks.json");
+    const stagingPath = join3(stagingDir, "peaks.json");
     writeFileSync2(stagingPath, JSON.stringify(peaks), { flag: "wx" });
     renameSync(stagingPath, cachePath);
   } finally {
@@ -632,7 +582,7 @@ function writeWaveformCache(cachePath, peaks) {
 import { spawnSync } from "child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename2, join as join5 } from "path";
+import { basename, join as join4 } from "path";
 var VIDEO_EXT = /\.(mp4|webm|mov|mkv|avi|m4v|mxf|mts|m2ts|ts)$/i;
 var AUDIO_EXT = /\.(mp3|wav|ogg|m4a|aac)$/i;
 function validateUploadedMedia(filePath, runner = spawnSync) {
@@ -669,8 +619,8 @@ function validateUploadedMedia(filePath, runner = spawnSync) {
   }
 }
 function validateUploadedMediaBuffer(fileName, buffer, runner = spawnSync) {
-  const tempDir = mkdtempSync2(join5(tmpdir(), "hyperframes-upload-"));
-  const tempPath = join5(tempDir, basename2(fileName));
+  const tempDir = mkdtempSync2(join4(tmpdir(), "hyperframes-upload-"));
+  const tempPath = join4(tempDir, basename(fileName));
   try {
     writeFileSync3(tempPath, buffer);
     return validateUploadedMedia(tempPath, runner);
@@ -680,9 +630,9 @@ function validateUploadedMediaBuffer(fileName, buffer, runner = spawnSync) {
 }
 
 // src/helpers/backupJournal.ts
-import { mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { Buffer as Buffer2 } from "buffer";
-import { join as join6, relative as relative3 } from "path";
+import { join as join5, relative as relative2 } from "path";
 var DEFAULT_KEEP_PER_FILE = 10;
 function backupKeyForPath(path) {
   return Buffer2.from(path, "utf-8").toString("base64url");
@@ -692,7 +642,7 @@ function timestampPrefix() {
 }
 function backupPathForResponse(projectDir, backupPath) {
   if (!backupPath) return null;
-  const rel = relative3(projectDir, backupPath);
+  const rel = relative2(projectDir, backupPath);
   if (!rel || rel.startsWith("..")) return null;
   return rel.split("\\").join("/");
 }
@@ -700,8 +650,8 @@ function snapshotBeforeWrite(projectDir, absPath, options = {}) {
   if (!isSafePath(projectDir, absPath)) return { backupPath: null };
   try {
     const content = readFileSync3(absPath);
-    const relativePath = relative3(projectDir, absPath);
-    const backupDir = join6(projectDir, ".hyperframes", "backup");
+    const relativePath = relative2(projectDir, absPath);
+    const backupDir = join5(projectDir, ".hyperframes", "backup");
     mkdirSync3(backupDir, { recursive: true });
     const backupKey = backupKeyForPath(relativePath);
     const backupPath = nextBackupPath(backupDir, backupKey);
@@ -717,7 +667,7 @@ function snapshotBeforeWrite(projectDir, absPath, options = {}) {
 }
 function nextBackupPath(backupDir, backupKey) {
   const base = `${timestampPrefix()}-${backupKey}`;
-  let candidate = join6(backupDir, base);
+  let candidate = join5(backupDir, base);
   let counter = 2;
   while (true) {
     try {
@@ -728,7 +678,7 @@ function nextBackupPath(backupDir, backupKey) {
       }
       throw error;
     }
-    candidate = join6(backupDir, `${base}-${counter}`);
+    candidate = join5(backupDir, `${base}-${counter}`);
     counter += 1;
   }
 }
@@ -736,7 +686,7 @@ function pruneBackups(backupDir, backupKey, keepPerFile) {
   const keep = Math.max(1, Math.floor(keepPerFile));
   const suffix = `-${backupKey}`;
   const numberedSuffix = new RegExp(`-${backupKey}-\\d+$`);
-  const matches = readdirSync3(backupDir).filter((name) => name.endsWith(suffix) || numberedSuffix.test(name)).map((name) => join6(backupDir, name)).sort((a, b) => {
+  const matches = readdirSync2(backupDir).filter((name) => name.endsWith(suffix) || numberedSuffix.test(name)).map((name) => join5(backupDir, name)).sort((a, b) => {
     return b.localeCompare(a);
   });
   for (const file of matches.slice(keep)) {
@@ -761,9 +711,9 @@ function hashVersion(hex) {
 function hashOfVersion(version) {
   return /^"sha256:([0-9a-f]{64})"$/.exec(version)?.[1];
 }
-function settledFileTag(stat2, now = Date.now()) {
-  if (now - stat2.ctimeMs < 3e3) return null;
-  return [stat2.ino, stat2.ctimeMs, stat2.size].map((n) => n.toString(36)).join("-");
+function settledFileTag(stat3, now = Date.now()) {
+  if (now - stat3.ctimeMs < 3e3) return null;
+  return [stat3.ino, stat3.ctimeMs, stat3.size].map((n) => n.toString(36)).join("-");
 }
 function createWriteToken(requestToken) {
   const token = requestToken?.trim();
@@ -937,9 +887,9 @@ import { parseHTML as parseHTML2 } from "linkedom";
 import { ensureHfIds as ensureHfIds2 } from "@hyperframes/parsers/hf-ids";
 
 // src/helpers/compositionInsertion.ts
-import { existsSync as existsSync2, readFileSync as readFileSync5, realpathSync as realpathSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { dirname as dirname4, relative as relative4, resolve as resolve2, sep as sep3 } from "path";
+import { dirname as dirname3, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
 import { parseHTML } from "linkedom";
 var CompositionInsertionError = class extends Error {
   constructor(message, status) {
@@ -975,8 +925,8 @@ function canonicalProjectPath(projectDir, candidate) {
   if (!existsSync2(candidate)) {
     throw new CompositionInsertionError("Composition source was not found", 404);
   }
-  const canonical = realpathSync2(candidate);
-  if (!isSafePath(realpathSync2(projectDir), canonical)) {
+  const canonical = realpath(candidate);
+  if (!isSafePath(realpath(projectDir), canonical)) {
     throw new CompositionInsertionError("Composition source escapes the project", 400);
   }
   return canonical;
@@ -988,13 +938,13 @@ function validateSourcePath(sourcePath) {
 }
 function canonicalProjectFile(projectDir, sourcePath) {
   validateSourcePath(sourcePath);
-  return canonicalProjectPath(projectDir, resolveWithinProject2(projectDir, sourcePath));
+  return canonicalProjectPath(projectDir, resolveWithinProject(projectDir, sourcePath));
 }
 function canonicalDependency(projectDir, ownerAbs, sourcePath) {
   validateSourcePath(sourcePath);
   return canonicalProjectPath(
     projectDir,
-    resolveWithinProject2(projectDir, relative4(projectDir, resolve2(dirname4(ownerAbs), sourcePath)))
+    resolveWithinProject(projectDir, relative3(projectDir, resolve2(dirname3(ownerAbs), sourcePath)))
   );
 }
 function validateDependencyGraph(projectDir, targetAbs, sourceAbs) {
@@ -1067,7 +1017,7 @@ function uniqueHostId(root, base) {
   return `${base}_${suffix}`;
 }
 function relativeSourcePath(targetAbs, sourceAbs) {
-  return relative4(dirname4(targetAbs), sourceAbs).split(sep3).join("/");
+  return relative3(dirname3(targetAbs), sourceAbs).split(sep2).join("/");
 }
 function insertCompositionIntoSource(input) {
   const targetAbs = canonicalProjectFile(input.projectDir, input.targetPath);
@@ -1199,7 +1149,7 @@ async function loadGsapParser() {
   return import("@hyperframes/parsers/gsap-parser-recast");
 }
 function isDanglingSymlinkInProject(projectDir, lexicalPath) {
-  if (!isSafePath(projectDir, dirname5(lexicalPath))) return false;
+  if (!isSafePath(projectDir, dirname4(lexicalPath))) return false;
   let stats;
   try {
     stats = lstatSync3(lexicalPath);
@@ -1207,7 +1157,7 @@ function isDanglingSymlinkInProject(projectDir, lexicalPath) {
     return false;
   }
   if (!stats.isSymbolicLink()) return false;
-  const target = resolve3(dirname5(lexicalPath), readlinkSync(lexicalPath));
+  const target = resolve3(dirname4(lexicalPath), readlinkSync(lexicalPath));
   if (!isSafePath(projectDir, target)) return false;
   try {
     statSync3(lexicalPath);
@@ -1231,7 +1181,7 @@ async function resolveProjectPath(c, adapter, route, opts) {
   if (filePath.includes("\0")) {
     return { error: c.json({ error: "forbidden", why: "nul" }, 403) };
   }
-  const absPath = (opts?.pin ? pinWithinProject : resolveWithinProject2)(project.dir, filePath);
+  const absPath = (opts?.pin ? pinWithinProject : resolveWithinProject)(project.dir, filePath);
   if (!absPath) {
     if (isDanglingSymlinkInProject(project.dir, resolve3(project.dir, filePath))) {
       return { error: c.json({ error: "not found", why: "dangling_symlink" }, 404) };
@@ -1430,7 +1380,7 @@ async function parseMutationBody(c) {
   return { target: body.target, body };
 }
 function ensureDir(filePath) {
-  const dir = dirname5(filePath);
+  const dir = dirname4(filePath);
   if (!existsSync3(dir)) mkdirSync4(dir, { recursive: true });
 }
 function generateCopyPath(projectDir, originalPath) {
@@ -1448,8 +1398,8 @@ function generateCopyPath(projectDir, originalPath) {
 }
 function walkFiles(dir, filter) {
   const results = [];
-  for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-    const full = join7(dir, entry.name);
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    const full = join6(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".thumbnails" || entry.name === "renders" || entry.name === ".transcode-cache")
         continue;
@@ -2612,7 +2562,7 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
       if (n >= MAX_COPY_INDEX) skipped.push(name);
       continue;
     }
-    const relativePath = subDir ? join7(subDir, finalName) : finalName;
+    const relativePath = subDir ? join6(subDir, finalName) : finalName;
     uploaded.push(relativePath);
     if (isAudioFile(finalName)) {
       generateWaveformCache(projectDir, relativePath).catch(() => {
@@ -2776,10 +2726,10 @@ function registerFileRoutes(api, adapter) {
   api.delete("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter, { mustExist: true });
     if ("error" in res) return res.error;
-    const stat2 = statSync3(res.absPath);
+    const stat3 = statSync3(res.absPath);
     const backup = snapshotBeforeWrite(res.project.dir, res.absPath);
     if (backup.error) return c.json({ error: `backup failed: ${backup.error}` }, 500);
-    if (stat2.isDirectory()) {
+    if (stat3.isDirectory()) {
       rmSync3(res.absPath, { recursive: true });
     } else {
       unlinkSync2(res.absPath);
@@ -3295,7 +3245,7 @@ function registerFileRoutes(api, adapter) {
     if (!body.newPath || body.newPath.includes("\0")) {
       return c.json({ error: "newPath required" }, 400);
     }
-    const newAbs = resolveWithinProject2(res.project.dir, body.newPath);
+    const newAbs = resolveWithinProject(res.project.dir, body.newPath);
     if (!newAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -3314,12 +3264,12 @@ function registerFileRoutes(api, adapter) {
     if (!body.path || body.path.includes("\0")) {
       return c.json({ error: "path required" }, 400);
     }
-    const srcAbs = resolveWithinProject2(project.dir, body.path);
+    const srcAbs = resolveWithinProject(project.dir, body.path);
     if (!srcAbs || !existsSync3(srcAbs)) {
       return c.json({ error: "not found" }, 404);
     }
     const copyPath = generateCopyPath(project.dir, body.path);
-    const destAbs = resolveWithinProject2(project.dir, copyPath);
+    const destAbs = resolveWithinProject(project.dir, copyPath);
     if (!destAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -3345,7 +3295,7 @@ function registerFileRoutes(api, adapter) {
       const project = await adapter.resolveProject(c.req.param("id"));
       if (!project) return c.json({ error: "not found" }, 404);
       const subDir = c.req.query("dir") ?? "";
-      const targetDir = subDir ? resolveWithinProject2(project.dir, subDir) : project.dir;
+      const targetDir = subDir ? resolveWithinProject(project.dir, subDir) : project.dir;
       if (!targetDir) return c.json({ error: "forbidden" }, 403);
       if (subDir && !existsSync3(targetDir)) mkdirSync4(targetDir, { recursive: true });
       const formData = await c.req.formData();
@@ -3429,7 +3379,7 @@ function registerFileRoutes(api, adapter) {
 // src/routes/preview.ts
 import { createReadStream, existsSync as existsSync5, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
 import { Readable } from "stream";
-import { join as join9, resolve as resolve4 } from "path";
+import { join as join9, resolve as resolve5 } from "path";
 import { createHash as createHash4 } from "crypto";
 import {
   addScenePartsManifest,
@@ -3441,7 +3391,7 @@ import { isWithinProjectRoot } from "@hyperframes/parsers/asset-resolution";
 
 // src/helpers/subComposition.ts
 import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 import { parseHTML as parseHTML3 } from "linkedom";
 import {
   rewriteAssetPaths,
@@ -3451,7 +3401,7 @@ import {
 import { stripEmbeddedRuntimeScripts } from "@hyperframes/core/compiler";
 import { isFullHtmlDocument } from "@hyperframes/core/compiler/html-document";
 function rewriteRelativePaths(root, compPath, projectDir) {
-  const assetExists = (path) => existsSync4(join8(projectDir, path));
+  const assetExists = (path) => existsSync4(join7(projectDir, path));
   rewriteAssetPaths(
     root.querySelectorAll("[src], [href]"),
     compPath,
@@ -3548,7 +3498,7 @@ function tagRootCompositionFile(bodyHtml, compPath) {
   return bodyHtml.slice(0, tagEnd) + ` data-composition-file="${compPath}"` + bodyHtml.slice(tagEnd);
 }
 function buildSubCompositionHtml(projectDir, compPath, runtimeUrl, baseHref, rawOverride) {
-  const compFile = join8(projectDir, compPath);
+  const compFile = join7(projectDir, compPath);
   if (!existsSync4(compFile)) return null;
   const rawComp = rawOverride ?? readFileSync7(compFile, "utf-8");
   let compHeadContent = "";
@@ -3580,7 +3530,7 @@ function buildSubCompositionHtml(projectDir, compPath, runtimeUrl, baseHref, raw
   }
   rewrittenContent = stripEmbeddedRuntimeScripts(rewrittenContent);
   rewrittenContent = tagRootCompositionFile(rewrittenContent, compPath);
-  const indexPath = join8(projectDir, "index.html");
+  const indexPath = join7(projectDir, "index.html");
   let headContent = "";
   if (existsSync4(indexPath)) {
     const indexHtml = readFileSync7(indexPath, "utf-8");
@@ -3622,6 +3572,83 @@ function hasBaseElement(html) {
 // src/routes/preview.ts
 import { ensureHfIds as ensureHfIds3 } from "@hyperframes/parsers/hf-ids";
 
+// src/helpers/previewReads.ts
+import { readlinkSync as readlinkSync2 } from "fs";
+import { dirname as dirname5, join as join8, parse, relative as relative4, resolve as resolve4 } from "path";
+var ALWAYS_AFFECTS = ["hyperframes.json", ...STUDIO_SIGNATURE_MANIFEST_PATHS];
+var REFERENCE = /\b(?:src|href|poster|data-composition-src)\s*=\s*(?:"([^"\n]*)"|'([^'\n]*)')|url\(\s*(?:"([^"\n]*)"|'([^'\n]*)'|([^"'\s)]+))/gi;
+var pathKey = process.platform === "darwin" || process.platform === "win32" ? (path) => resolve4(path).toLowerCase() : (path) => resolve4(path);
+var readsByProject = /* @__PURE__ */ new Map();
+var builtProjects = /* @__PURE__ */ new Set();
+var projectKey = (projectDir) => pathKey(realFilePath(resolve4(projectDir)));
+var inRealProject = (projectDir, path) => join8(realFilePath(resolve4(projectDir)), relative4(resolve4(projectDir), resolve4(projectDir, path)));
+var readLink = (path) => {
+  try {
+    return readlinkSync2(path);
+  } catch {
+    return null;
+  }
+};
+function linksOnTheWay(path) {
+  const passed = [];
+  let at = parse(path).root;
+  let rest = path.slice(at.length).split(/[\\/]+/);
+  for (let hops = 0; rest.length > 0; ) {
+    const part = rest.shift();
+    if (!part || part === ".") continue;
+    if (part === "..") {
+      at = dirname5(at);
+      continue;
+    }
+    const next = join8(at, part);
+    const target = hops < 40 ? readLink(next) : null;
+    if (target === null) {
+      at = next;
+      continue;
+    }
+    hops++;
+    passed.push(next);
+    const root = parse(target).root;
+    if (root) at = root;
+    rest = [...target.slice(root.length).split(/[\\/]+/), ...rest];
+  }
+  passed.push(at);
+  return passed;
+}
+function recordPreviewRead(projectDir, filePath) {
+  const key = projectKey(projectDir);
+  let reads = readsByProject.get(key);
+  if (!reads) readsByProject.set(key, reads = /* @__PURE__ */ new Set());
+  const read = inRealProject(projectDir, filePath);
+  for (const found of [read, ...linksOnTheWay(read)]) {
+    for (let path = pathKey(found); !reads.has(path); path = dirname5(path)) reads.add(path);
+  }
+}
+function recordPreviewReferences(projectDir, html) {
+  const named = /* @__PURE__ */ new Set();
+  for (const match of html.matchAll(REFERENCE)) {
+    const url = (match[1] ?? match[2] ?? match[3] ?? match[4] ?? match[5] ?? "").trim();
+    if (!url || /^(?:[a-z][a-z0-9+.-]*:|[/#])/i.test(url)) continue;
+    const path = url.split(/[?#]/)[0] ?? "";
+    let decoded = path;
+    try {
+      decoded = decodeURIComponent(path);
+    } catch {
+    }
+    if (decoded) named.add(decoded);
+  }
+  for (const path of named) recordPreviewRead(projectDir, path);
+}
+function recordPreviewBuilt(projectDir) {
+  for (const path of ALWAYS_AFFECTS) recordPreviewRead(projectDir, path);
+  builtProjects.add(projectKey(projectDir));
+}
+function affectsPreview(projectDir, changedPath) {
+  const key = projectKey(projectDir);
+  if (!builtProjects.has(key)) return true;
+  return readsByProject.get(key)?.has(pathKey(inRealProject(projectDir, changedPath))) ?? false;
+}
+
 // src/helpers/variablesPayload.ts
 var VARIABLES_PAYLOAD_ERROR = "variables must be a JSON object of {variableId: value}";
 function isVariablesPayload(value) {
@@ -3779,9 +3806,9 @@ function variablesEtagSalt(raw) {
   return `:vars:${createHash4("sha1").update(raw).digest("hex").slice(0, 12)}`;
 }
 function previewVariablesFromRequest(rawVariables) {
-  const parse = parsePreviewVariablesParam(rawVariables);
-  if (!parse.ok) return { error: parse.error };
-  return { raw: rawVariables, values: parse.values };
+  const parse2 = parsePreviewVariablesParam(rawVariables);
+  if (!parse2.ok) return { error: parse2.error };
+  return { raw: rawVariables, values: parse2.values };
 }
 function injectStudioPreviewAugmentations(html, adapter, projectDir, activeCompositionPath) {
   return injectStudioMotionScript(
@@ -3809,13 +3836,15 @@ async function transformPreviewHtml(html, adapter, project, activeCompositionPat
 }
 function resolveProjectMainHtml(projectDir, projectId) {
   const indexPath = join9(projectDir, "index.html");
+  const blockHtmlPath = join9(projectDir, `${projectId}.html`);
+  recordPreviewRead(projectDir, indexPath);
+  recordPreviewRead(projectDir, blockHtmlPath);
   if (existsSync5(indexPath)) {
     return {
       html: readFileSync8(indexPath, "utf-8"),
       compositionPath: "index.html"
     };
   }
-  const blockHtmlPath = join9(projectDir, `${projectId}.html`);
   if (existsSync5(blockHtmlPath)) {
     return {
       html: readFileSync8(blockHtmlPath, "utf-8"),
@@ -3847,13 +3876,18 @@ function registerPreviewRoutes(api, adapter) {
     const diskMain = resolveProjectMainHtml(project.dir, project.id);
     const normalizedDisk = diskMain ? ensureHfIds3(diskMain.html) : null;
     try {
-      let bundled = await adapter.bundle(project.dir, { stampHfIds: true });
+      let bundled = await adapter.bundle(project.dir, {
+        stampHfIds: true,
+        onRead: (filePath) => recordPreviewRead(project.dir, filePath)
+      });
       let mainCompositionPath = "index.html";
       if (!bundled) {
         if (!diskMain) return null;
         bundled = stripEmbeddedRuntimeScripts2(normalizedDisk ?? diskMain.html);
         mainCompositionPath = diskMain.compositionPath;
       }
+      recordPreviewReferences(project.dir, bundled);
+      recordPreviewBuilt(project.dir);
       if (!bundled.includes("hyperframe.runtime") && !bundled.includes("hyperframes-preview-runtime")) {
         const runtimeTag = `<script src="${adapter.runtimeUrl}"></script>`;
         bundled = insertBeforeCloseTag2(bundled, "body", `${runtimeTag}
@@ -3956,7 +3990,9 @@ ${etag}`;
     if (vars.error !== void 0) return c.json({ error: vars.error }, 400);
     const previewVariables = vars.values;
     const compPath = requestSubPath(c.req.url, "projects/:id/preview/comp");
-    const compFile = resolveWithinProject2(project.dir, compPath);
+    const compFile = resolveWithinProject(project.dir, compPath);
+    if (compFile) recordPreviewRead(project.dir, compFile);
+    recordPreviewRead(project.dir, "index.html");
     if (!compFile || !existsSync5(compFile) || !statSync4(compFile).isFile()) {
       return c.text("not found", 404);
     }
@@ -3980,6 +4016,7 @@ ${etag}`;
       stamped
     );
     if (!html) return c.text("not found", 404);
+    recordPreviewReferences(project.dir, html);
     html = ensureHfIds3(await transformPreviewHtml(html, adapter, project, compPath));
     html = injectStudioPreviewAugmentations(html, adapter, project.dir, compPath);
     if (previewVariables) html = injectPreviewVariables(html, previewVariables);
@@ -3990,13 +4027,14 @@ ${etag}`;
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
     const subPath = requestSubPath(c.req.url, "projects/:id/preview");
-    const candidate = resolve4(project.dir, subPath);
+    const candidate = resolve5(project.dir, subPath);
     const file = isWithinProjectRoot(project.dir, candidate) ? candidate : null;
     if (!file) {
       return c.text("not found", 404);
     }
-    const stat2 = existsSync5(file) ? statSync4(file) : null;
-    if (!stat2?.isFile()) {
+    recordPreviewRead(project.dir, file);
+    const stat3 = existsSync5(file) ? statSync4(file) : null;
+    if (!stat3?.isFile()) {
       return c.text("not found", 404);
     }
     const contentType = getMimeType(subPath);
@@ -4007,7 +4045,7 @@ ${etag}`;
       if (!isProxyVariantRequest(proxyParam) || !contentType.startsWith("video/") || !isAutoProxyEnabled(adapter)) {
         return c.text("not found", 404);
       }
-      const facts = await probeAssetCodec(file);
+      const facts = await probeAssetCodec(file, void 0, mediaCodecProbeCache);
       const eligibility = decideMediaProxyEligibility(facts);
       if (!eligibility.eligible) {
         return c.text(`media proxy unavailable: ${eligibility.reason}`, 422);
@@ -4018,7 +4056,7 @@ ${etag}`;
         return c.text("media proxy variant does not match asset", 422);
       }
     }
-    const tag = settledFileTag(stat2);
+    const tag = settledFileTag(stat3);
     const etag = tag && `"${tag}${proxyEtagSalt(proxyVariant)}"`;
     const cacheHeaders = isText ? { "Cache-Control": "no-store" } : { "Cache-Control": "private, no-cache", ...etag && { ETag: etag } };
     if (!isText && etag) {
@@ -4138,7 +4176,7 @@ function registerLintRoutes(api, adapter) {
 
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
-import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join11 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
@@ -4190,7 +4228,7 @@ function registerRenderRoutes(api, adapter) {
     const outputResolution = VALID_RESOLUTIONS.has(body.resolution ?? "") ? body.resolution : void 0;
     let composition;
     if (typeof body.composition === "string" && body.composition.length > 0) {
-      if (!resolveWithinProject2(project.dir, body.composition)) {
+      if (!resolveWithinProject(project.dir, body.composition)) {
         return c.json({ error: "composition path must be within the project directory" }, 400);
       }
       composition = body.composition;
@@ -4323,7 +4361,7 @@ function registerRenderRoutes(api, adapter) {
     const filename = c.req.path.split("/renders/file/")[1];
     if (!filename) return c.json({ error: "missing filename" }, 400);
     const rendersDir = adapter.rendersDir(project);
-    const fp = resolveWithinProject2(rendersDir, filename);
+    const fp = resolveWithinProject(rendersDir, filename);
     if (!fp) return c.json({ error: "forbidden" }, 403);
     if (!existsSync6(fp)) return c.json({ error: "not found" }, 404);
     const contentType = renderContentType(fp);
@@ -4342,9 +4380,9 @@ function registerRenderRoutes(api, adapter) {
     if (!project) return c.json({ error: "not found" }, 404);
     const rendersDir = adapter.rendersDir(project);
     if (!existsSync6(rendersDir)) return c.json({ renders: [] });
-    const files = readdirSync5(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
+    const files = readdirSync4(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
       const fp = join11(rendersDir, f);
-      const stat2 = statSync5(fp);
+      const stat3 = statSync5(fp);
       const rid = f.replace(/\.(mp4|webm|mov)$/, "");
       const metaPath = join11(rendersDir, `${rid}.meta.json`);
       let status = "complete";
@@ -4360,8 +4398,8 @@ function registerRenderRoutes(api, adapter) {
       return {
         id: rid,
         filename: f,
-        size: stat2.size,
-        createdAt: stat2.mtimeMs,
+        size: stat3.size,
+        createdAt: stat3.mtimeMs,
         status,
         durationMs
       };
@@ -4381,80 +4419,11 @@ function registerRenderRoutes(api, adapter) {
   });
 }
 
-// src/routes/thumbnail.ts
-import {
-  closeSync as closeSync3,
-  existsSync as existsSync7,
-  fstatSync as fstatSync3,
-  openSync as openSync3,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync12,
-  readdirSync as readdirSync6,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  statSync as statSync6,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6
-} from "fs";
-import { join as join12 } from "path";
-import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
-
-// src/helpers/compositionInputs.ts
-import { readFileSync as readFileSync11 } from "fs";
-var ROOT_COMPOSITION = "index.html";
-var COMPOSITION_SRC = /\bdata-composition-src\s*=\s*(["'])(.*?)\1/g;
-function projectReader(projectDir) {
-  const sources = /* @__PURE__ */ new Map();
-  return (compPath) => {
-    if (!sources.has(compPath)) {
-      const file = resolveWithinProject2(projectDir, compPath);
-      let source = null;
-      try {
-        source = file ? readFileSync11(file, "utf-8") : null;
-      } catch {
-      }
-      sources.set(compPath, source);
-    }
-    return sources.get(compPath) ?? null;
-  };
-}
-function normalizeSource(src) {
-  if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//")) return null;
-  const path = src.split(/[?#]/)[0]?.replace(/^\.?\//, "") ?? "";
-  return path || null;
-}
-function closureOf(read, compPath) {
-  const closure = /* @__PURE__ */ new Set();
-  const visit = (path) => {
-    if (closure.has(path)) return;
-    closure.add(path);
-    for (const match of (read(path) ?? "").matchAll(COMPOSITION_SRC)) {
-      const mounted = normalizeSource(match[2] ?? "");
-      if (mounted) visit(mounted);
-    }
-  };
-  visit(compPath);
-  return closure;
-}
-var inputSignatures = /* @__PURE__ */ new Map();
-function compositionInputSignature(projectDir, compPath, projectSignature) {
-  const key = `${projectDir}\0${compPath}`;
-  const known = inputSignatures.get(key);
-  if (known?.projectSignature === projectSignature) return known.inputSignature;
-  const read = projectReader(projectDir);
-  const inputs = closureOf(read, normalizeSource(compPath) ?? compPath).add(ROOT_COMPOSITION);
-  const siblings = [...closureOf(read, ROOT_COMPOSITION)].filter((path) => !inputs.has(path));
-  const inputSignature = createProjectSignature(projectDir, new Set(siblings));
-  inputSignatures.set(key, { projectSignature, inputSignature });
-  return inputSignature;
-}
-function compositionsAffectedBy(projectDir, changedPath) {
-  const changed = changedPath.replace(/\\/g, "/");
-  const read = projectReader(projectDir);
-  const mounted = closureOf(read, ROOT_COMPOSITION);
-  if (changed === ROOT_COMPOSITION || !mounted.has(changed)) return null;
-  return [...mounted].filter((path) => closureOf(read, path).has(changed));
-}
+// src/routes/imageThumbnail.ts
+import { HTTPException } from "hono/http-exception";
+import { open, stat } from "fs/promises";
+import { createHash as createHash5 } from "crypto";
+import sharp from "sharp";
 
 // src/routes/thumbnailGenerationCoordinator.ts
 var ThumbnailGenerationCoordinator = class {
@@ -4473,10 +4442,10 @@ var ThumbnailGenerationCoordinator = class {
     if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
     let entry = this.entries.get(key);
     if (!entry) {
-      let resolve8;
+      let resolve9;
       let reject;
       const promise = new Promise((resolvePromise, rejectPromise) => {
-        resolve8 = resolvePromise;
+        resolve9 = resolvePromise;
         reject = rejectPromise;
       });
       entry = {
@@ -4486,7 +4455,7 @@ var ThumbnailGenerationCoordinator = class {
         state: "queued",
         work,
         promise,
-        resolve: resolve8,
+        resolve: resolve9,
         reject
       };
       this.entries.set(key, entry);
@@ -4500,7 +4469,7 @@ var ThumbnailGenerationCoordinator = class {
     return /* @__PURE__ */ new Set([...this.entries.keys(), ...[...this.activeEntries].map((entry) => entry.key)]);
   }
   lease(entry, signal) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       let released = false;
       const release = () => {
         if (released) return;
@@ -4524,7 +4493,7 @@ var ThumbnailGenerationCoordinator = class {
       entry.promise.then(
         (value) => {
           release();
-          resolve8(value);
+          resolve9(value);
         },
         (reason) => {
           release();
@@ -4559,6 +4528,171 @@ var ThumbnailGenerationCoordinator = class {
 };
 var thumbnailGenerationCoordinator = new ThumbnailGenerationCoordinator(1);
 
+// src/routes/imageThumbnail.ts
+var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
+var MAX_CACHE_BYTES = 8 * 1024 * 1024;
+async function generateThumbnail(path, signal) {
+  const file = await open(path, "r");
+  try {
+    const info = await file.stat();
+    if (!info.isFile() || info.size > MAX_SOURCE_BYTES) throw new Error("Unsupported image");
+    const source = Buffer.alloc(info.size);
+    let offset = 0;
+    while (offset < source.length) {
+      signal.throwIfAborted();
+      const { bytesRead } = await file.read(source, offset, source.length - offset, offset);
+      if (!bytesRead) break;
+      offset += bytesRead;
+    }
+    if (source[0] !== 255 || source[1] !== 216) throw new Error("Unsupported image");
+    const image = sharp(source.subarray(0, offset), { limitInputPixels: 4e7 });
+    if ((await image.metadata()).format !== "jpeg") throw new Error("Unsupported image");
+    signal.throwIfAborted();
+    const result = await image.rotate().resize(240, 135, { fit: "inside", withoutEnlargement: true }).jpeg({ quality: 80 }).toBuffer();
+    signal.throwIfAborted();
+    return result;
+  } finally {
+    await file.close();
+  }
+}
+async function resolveSource(adapter, id, url) {
+  const project = await adapter.resolveProject(id);
+  if (!project) throw new HTTPException(404);
+  let relative6;
+  try {
+    relative6 = requestSubPath(url, "projects/:id/image-thumbnail");
+  } catch {
+    throw new HTTPException(400);
+  }
+  if (!/\.jpe?g$/i.test(relative6)) throw new HTTPException(415);
+  const path = pinWithinProject(project.dir, relative6);
+  if (!path) throw new HTTPException(404);
+  const info = await stat(path).catch(() => {
+    throw new HTTPException(404);
+  });
+  if (!info.isFile()) throw new HTTPException(404);
+  if (info.size > MAX_SOURCE_BYTES) throw new HTTPException(413);
+  return { path, info };
+}
+function registerImageThumbnailRoutes(api, adapter) {
+  const coordinator = new ThumbnailGenerationCoordinator(2);
+  const cache = /* @__PURE__ */ new Map();
+  let cacheBytes = 0;
+  const remember = (key, image) => {
+    cacheBytes -= cache.get(key)?.byteLength ?? 0;
+    cache.delete(key);
+    cache.set(key, image);
+    cacheBytes += image.byteLength;
+    while (cacheBytes > MAX_CACHE_BYTES || cache.size > 128) {
+      const oldest = cache.keys().next().value;
+      if (oldest === void 0) break;
+      cacheBytes -= cache.get(oldest)?.byteLength ?? 0;
+      cache.delete(oldest);
+    }
+  };
+  api.get("/projects/:id/image-thumbnail/*", async (c) => {
+    try {
+      const { path, info } = await resolveSource(adapter, c.req.param("id"), c.req.url);
+      const key = createHash5("sha256").update(JSON.stringify([path, info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs])).digest("hex");
+      const etag = `"${key}"`;
+      c.header("ETag", etag);
+      c.header("Cache-Control", "private, no-cache");
+      c.header("X-Content-Type-Options", "nosniff");
+      if (c.req.header("If-None-Match") === etag) return c.body(null, 304);
+      let result = cache.get(key);
+      if (result) remember(key, result);
+      else {
+        if (coordinator.protectedKeys().size >= 32) return c.text("thumbnail queue full", 429);
+        result = await coordinator.acquire(key, c.req.raw.signal, async (signal) => {
+          const image = await generateThumbnail(path, signal);
+          remember(key, image);
+          return image;
+        }) ?? void 0;
+      }
+      if (!result) return c.text("image unavailable", 422);
+      c.header("Content-Type", "image/jpeg");
+      return c.body(new Uint8Array(result));
+    } catch (error) {
+      if (error instanceof HTTPException) return error.getResponse();
+      return c.text("image unavailable", 422);
+    }
+  });
+}
+
+// src/routes/thumbnail.ts
+import {
+  closeSync as closeSync3,
+  fstatSync as fstatSync3,
+  openSync as openSync3,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync12,
+  readdirSync as readdirSync5,
+  renameSync as renameSync3,
+  rmSync as rmSync4,
+  statSync as statSync6,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { join as join12 } from "path";
+import { createHash as createHash6, randomUUID as randomUUID4 } from "crypto";
+
+// src/helpers/compositionInputs.ts
+import { readFileSync as readFileSync11 } from "fs";
+var ROOT_COMPOSITION = "index.html";
+var COMPOSITION_SRC = /\bdata-composition-src\s*=\s*(["'])(.*?)\1/g;
+function projectReader(projectDir) {
+  const sources = /* @__PURE__ */ new Map();
+  return (compPath) => {
+    if (!sources.has(compPath)) {
+      const file = resolveWithinProject(projectDir, compPath);
+      let source = null;
+      try {
+        source = file ? readFileSync11(file, "utf-8") : null;
+      } catch {
+      }
+      sources.set(compPath, source);
+    }
+    return sources.get(compPath) ?? null;
+  };
+}
+function normalizeSource(src) {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//")) return null;
+  const path = src.split(/[?#]/)[0]?.replace(/^\.?\//, "") ?? "";
+  return path || null;
+}
+function closureOf(read, compPath) {
+  const closure = /* @__PURE__ */ new Set();
+  const visit = (path) => {
+    if (closure.has(path)) return;
+    closure.add(path);
+    for (const match of (read(path) ?? "").matchAll(COMPOSITION_SRC)) {
+      const mounted = normalizeSource(match[2] ?? "");
+      if (mounted) visit(mounted);
+    }
+  };
+  visit(compPath);
+  return closure;
+}
+var inputSignatures = /* @__PURE__ */ new Map();
+function compositionInputSignature(projectDir, compPath, projectSignature) {
+  const key = `${projectDir}\0${compPath}`;
+  const known = inputSignatures.get(key);
+  if (known?.projectSignature === projectSignature) return known.inputSignature;
+  const read = projectReader(projectDir);
+  const inputs = closureOf(read, normalizeSource(compPath) ?? compPath).add(ROOT_COMPOSITION);
+  const siblings = [...closureOf(read, ROOT_COMPOSITION)].filter((path) => !inputs.has(path));
+  const inputSignature = createProjectSignature(projectDir, new Set(siblings));
+  inputSignatures.set(key, { projectSignature, inputSignature });
+  return inputSignature;
+}
+function compositionsAffectedBy(projectDir, changedPath) {
+  const changed = changedPath.replace(/\\/g, "/");
+  const read = projectReader(projectDir);
+  const mounted = closureOf(read, ROOT_COMPOSITION);
+  if (changed === ROOT_COMPOSITION || !mounted.has(changed)) return null;
+  return [...mounted].filter((path) => closureOf(read, path).has(changed));
+}
+
 // src/routes/thumbnail.ts
 var THUMBNAIL_CACHE_VERSION = "v4";
 var THUMBNAIL_MAX_OUTPUT_WIDTH = 240;
@@ -4567,8 +4701,14 @@ var THUMBNAIL_CACHE_MAX_BYTES = 512 * 1024 * 1024;
 var THUMBNAIL_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
 var prunedCacheDirs = /* @__PURE__ */ new Set();
 function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
-  if (!existsSync7(cacheDir)) return;
-  const files = readdirSync6(cacheDir, { withFileTypes: true }).flatMap((entry) => {
+  let entries;
+  try {
+    entries = readdirSync5(cacheDir, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  const files = entries.flatMap((entry) => {
     if (!entry.isFile()) return [];
     const path = join12(cacheDir, entry.name);
     try {
@@ -4606,22 +4746,30 @@ function writeThumbnailAtomically(path, buffer) {
     rmSync4(temporaryPath, { force: true });
   }
 }
-function readCompositionSource(file) {
+function readFileOnce(file) {
   let fd;
   try {
     fd = openSync3(file, "r");
   } catch (err) {
-    if (err.code === "ENOENT") return "missing";
+    const code = err.code;
+    if (code === "ENOENT") return "missing";
+    if (code === "ENOTDIR") return "not-a-file";
     throw err;
   }
   try {
-    const stat2 = fstatSync3(fd);
-    if (!stat2.isFile()) return "not-a-file";
-    return { html: readFileSync12(fd, "utf-8"), mtimeMs: stat2.mtimeMs };
+    const stat3 = fstatSync3(fd);
+    if (!stat3.isFile()) return "not-a-file";
+    return { data: readFileSync12(fd), mtimeMs: stat3.mtimeMs };
   } finally {
     closeSync3(fd);
   }
 }
+function manifestKey(file) {
+  const manifest = readFileOnce(file);
+  if (typeof manifest === "string") return { key: "", mtimeMs: -Infinity };
+  const hash = createHash6("sha1").update(manifest.data).digest("hex").slice(0, 16);
+  return { key: `_${hash}`, mtimeMs: Math.round(manifest.mtimeMs) };
+}
 function registerThumbnailRoutes(api, adapter) {
   api.get("/projects/:id/thumbnail/*", async (c) => {
     if (!adapter.generateThumbnail) {
@@ -4632,8 +4780,8 @@ function registerThumbnailRoutes(api, adapter) {
     const { project, signature: projectSignature } = resolved;
     let compPath = requestSubPath(c.req.url, "projects/:id/thumbnail");
     if (compPath && !compPath.includes(".")) compPath += ".html";
-    const htmlFile = resolveWithinProject2(project.dir, compPath);
-    const source = htmlFile ? readCompositionSource(htmlFile) : "not-a-file";
+    const htmlFile = resolveWithinProject(project.dir, compPath);
+    const source = htmlFile ? readFileOnce(htmlFile) : "not-a-file";
     if (source === "not-a-file") return c.json({ error: "not found" }, 404);
     const inputSignature = compositionInputSignature(project.dir, compPath, projectSignature);
     const url = new URL(c.req.url, `http://${c.req.header("host") || "localhost"}`);
@@ -4655,8 +4803,8 @@ function registerThumbnailRoutes(api, adapter) {
     let sourceMtime = 0;
     let sourceKey = "";
     if (source !== "missing") {
-      const { html } = source;
-      sourceKey = `_${createHash5("sha1").update(html).digest("hex").slice(0, 16)}`;
+      const html = source.data.toString("utf-8");
+      sourceKey = `_${createHash6("sha1").update(html).digest("hex").slice(0, 16)}`;
       sourceMtime = Math.round(source.mtimeMs);
       if (!vpWidth) {
         const wMatch = html.match(/data-width=["'](\d+)["']/);
@@ -4665,30 +4813,19 @@ function registerThumbnailRoutes(api, adapter) {
         if (hMatch?.[1]) compH = parseInt(hMatch[1]);
       }
     }
-    const manualEditsFile = join12(project.dir, STUDIO_MANUAL_EDITS_PATH);
-    let manualEditsKey = "";
-    if (existsSync7(manualEditsFile)) {
-      const manualEditsContent = readFileSync12(manualEditsFile, "utf-8");
-      manualEditsKey = `_${createHash5("sha1").update(manualEditsContent).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.max(sourceMtime, Math.round(statSync6(manualEditsFile).mtimeMs));
-    }
-    const motionFile = join12(project.dir, STUDIO_MOTION_PATH);
-    let motionKey = "";
-    if (existsSync7(motionFile)) {
-      const motionContent = readFileSync12(motionFile, "utf-8");
-      motionKey = `_${createHash5("sha1").update(motionContent).digest("hex").slice(0, 16)}`;
-      sourceMtime = Math.max(sourceMtime, Math.round(statSync6(motionFile).mtimeMs));
-    }
+    const manualEdits = manifestKey(join12(project.dir, STUDIO_MANUAL_EDITS_PATH));
+    const motion = manifestKey(join12(project.dir, STUDIO_MOTION_PATH));
+    sourceMtime = Math.max(sourceMtime, manualEdits.mtimeMs, motion.mtimeMs);
     const projectUrl = `http://${c.req.header("host")}/api/projects/${encodeURIComponent(project.id)}`;
     const previewUrl = compPath === "index.html" ? `${projectUrl}/preview` : `${projectUrl}/preview/comp/${compPath.split("/").map(encodeURIComponent).join("/")}`;
     const cacheDir = join12(project.dir, ".thumbnails");
     const selectorKey = selector ? `_${selector.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 80)}_${selectorIndex ?? 0}` : "";
     const urlVersionKey = urlVersion ? `_${urlVersion.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32)}` : "";
-    const inputSignatureKey = `_${createHash5("sha1").update(inputSignature).digest("hex").slice(0, 16)}`;
+    const inputSignatureKey = `_${createHash6("sha1").update(inputSignature).digest("hex").slice(0, 16)}`;
     const outputScale = outputMode === "source" ? 1 : Math.min(1, THUMBNAIL_MAX_OUTPUT_WIDTH / compW, THUMBNAIL_MAX_OUTPUT_HEIGHT / compH);
     const outputWidth = Math.max(1, Math.round(compW * outputScale));
     const outputHeight = Math.max(1, Math.round(compH * outputScale));
-    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${inputSignatureKey}${manualEditsKey}${motionKey}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
+    const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${inputSignatureKey}${manualEdits.key}${motion.key}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
     const cachePath = join12(cacheDir, cacheKey);
     if (!prunedCacheDirs.has(cacheDir)) {
       prunedCacheDirs.add(cacheDir);
@@ -4697,8 +4834,9 @@ function registerThumbnailRoutes(api, adapter) {
         /* @__PURE__ */ new Set([...thumbnailGenerationCoordinator.protectedKeys(), cachePath])
       );
     }
-    if (existsSync7(cachePath)) {
-      return new Response(new Uint8Array(readFileSync12(cachePath)), {
+    const cached = readFileOnce(cachePath);
+    if (typeof cached === "object") {
+      return new Response(new Uint8Array(cached.data), {
         headers: { "Content-Type": contentType, "Cache-Control": "no-cache" }
       });
     }
@@ -4728,7 +4866,7 @@ function registerThumbnailRoutes(api, adapter) {
           if (afterGeneration?.project.dir !== project.dir || !inputsUnchanged(afterGeneration.signature) || !inputsUnchanged(createProjectSignature(project.dir))) {
             return generated;
           }
-          if (!existsSync7(cacheDir)) mkdirSync6(cacheDir, { recursive: true });
+          mkdirSync6(cacheDir, { recursive: true });
           writeThumbnailAtomically(cachePath, generated);
           return generated;
         }
@@ -4754,15 +4892,15 @@ function registerThumbnailRoutes(api, adapter) {
 }
 
 // src/routes/waveform.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, statSync as statSync7 } from "fs";
-import { join as join13, resolve as resolve5 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync13, statSync as statSync7 } from "fs";
+import { join as join13, resolve as resolve6 } from "path";
 import { isWithinProjectRoot as isWithinProjectRoot2 } from "@hyperframes/parsers/asset-resolution";
 function registerWaveformRoutes(api, adapter) {
   api.get("/projects/:id/waveform/*", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
     const assetPath = requestSubPath(c.req.url, "projects/:id/waveform");
-    const audioPath = resolve5(project.dir, assetPath);
+    const audioPath = resolve6(project.dir, assetPath);
     if (!isWithinProjectRoot2(project.dir, audioPath)) {
       return c.json({ error: "file not found" }, 404);
     }
@@ -4771,7 +4909,7 @@ function registerWaveformRoutes(api, adapter) {
     const cacheDir = join13(project.dir, ".waveform-cache");
     const cachePath = join13(cacheDir, buildWaveformCacheKey(assetPath, stats));
     try {
-      if (isWaveformCacheDirectory(cacheDir) && existsSync8(cachePath)) {
+      if (isWaveformCacheDirectory(cacheDir) && existsSync7(cachePath)) {
         const peaks2 = JSON.parse(readFileSync13(cachePath, "utf-8"));
         return c.json({ peaks: peaks2 });
       }
@@ -4904,12 +5042,12 @@ function registerFontRoutes(api) {
       return c.json({ error: "font file not accessible" }, 404);
     }
     try {
-      const stat2 = fstatSync4(fd);
-      if (stat2.size > SYSTEM_FONT_SIZE_LIMIT) {
+      const stat3 = fstatSync4(fd);
+      if (stat3.size > SYSTEM_FONT_SIZE_LIMIT) {
         return c.json({ error: "font file too large" }, 413);
       }
-      const buffer = Buffer.alloc(stat2.size);
-      readSync(fd, buffer, 0, stat2.size, 0);
+      const buffer = Buffer.alloc(stat3.size);
+      readSync(fd, buffer, 0, stat3.size, 0);
       const mimeType = located.format === "otf" ? "font/otf" : located.format === "woff2" ? "font/woff2" : located.format === "woff" ? "font/woff" : located.format === "ttc" ? "font/collection" : "font/ttf";
       const fileName = `${family.replace(/[^a-zA-Z0-9 -]/g, "")}.${located.format}`;
       return new Response(buffer, {
@@ -4937,7 +5075,7 @@ function registerRegistryRoutes(api, adapter) {
   });
   api.post("/projects/:id/registry/install", async (c) => {
     if (!adapter.installRegistryBlock) {
-      return c.json({ error: "Registry install not available" }, 501);
+      return c.json({ error: "Installing catalog items needs hyperframes preview" }, 501);
     }
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "Project not found" }, 404);
@@ -5055,8 +5193,8 @@ function registerSelectionRoutes(api, adapter) {
 
 // src/routes/media.ts
 import { streamSSE as streamSSE2 } from "hono/streaming";
-import { existsSync as existsSync9, mkdirSync as mkdirSync7 } from "fs";
-import { basename as basename3, dirname as dirname6, extname as extname2, join as join14 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7 } from "fs";
+import { basename as basename2, dirname as dirname6, extname as extname2, join as join14 } from "path";
 var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov",
@@ -5086,14 +5224,14 @@ function containsNullByte(path) {
   return path.includes("\0");
 }
 function slugFileBase(path) {
-  const name = basename3(path, extname2(path)).replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  const name = basename2(path, extname2(path)).replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
   return name || "media";
 }
 function uniqueAssetPath(projectDir, assetPath) {
   const ext = extname2(assetPath);
   const withoutExt = assetPath.slice(0, -ext.length);
   let candidate = assetPath;
-  for (let index = 2; existsSync9(join14(projectDir, candidate)); index++) {
+  for (let index = 2; existsSync8(join14(projectDir, candidate)); index++) {
     candidate = `${withoutExt}-${index}${ext}`;
   }
   return candidate;
@@ -5142,9 +5280,9 @@ function registerMediaRoutes(api, adapter, options = {}) {
     if (/^(?:https?:|data:|blob:)/i.test(assetPath)) {
       return c.json({ error: "media metadata requires a project-local asset" }, 400);
     }
-    const filePath = resolveWithinProject2(project.dir, assetPath);
+    const filePath = resolveWithinProject(project.dir, assetPath);
     if (!filePath) return c.json({ error: "forbidden" }, 403);
-    if (!existsSync9(filePath)) return c.json({ error: "media not found" }, 404);
+    if (!existsSync8(filePath)) return c.json({ error: "media not found" }, 404);
     return c.json({ path: assetPath, metadata: await readMediaMetadata(filePath) });
   });
   api.post(
@@ -5164,9 +5302,9 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (/^(?:https?:|data:|blob:)/i.test(inputAssetPath)) {
         return c.json({ error: "background removal requires a project-local media asset" }, 400);
       }
-      const inputPath = resolveWithinProject2(project.dir, inputAssetPath);
+      const inputPath = resolveWithinProject(project.dir, inputAssetPath);
       if (!inputPath) return c.json({ error: "forbidden" }, 403);
-      if (!existsSync9(inputPath)) return c.json({ error: "input media not found" }, 404);
+      if (!existsSync8(inputPath)) return c.json({ error: "input media not found" }, 404);
       const inputIsVideo = isVideoPath(inputAssetPath);
       const inputIsImage = isImagePath(inputAssetPath);
       if (!inputIsVideo && !inputIsImage) {
@@ -5176,11 +5314,11 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (requestedOutput && containsNullByte(requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
-      if (requestedOutput && !resolveWithinProject2(project.dir, requestedOutput)) {
+      if (requestedOutput && !resolveWithinProject(project.dir, requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
       const outputAssetPath = requestedOutput ? uniqueAssetPath(project.dir, requestedOutput) : defaultOutputPath(project.dir, inputAssetPath);
-      const outputPath = resolveWithinProject2(project.dir, outputAssetPath);
+      const outputPath = resolveWithinProject(project.dir, outputAssetPath);
       if (!outputPath) return c.json({ error: "forbidden" }, 403);
       if (inputIsVideo && !VIDEO_OUTPUT_EXTENSIONS.has(extname2(outputAssetPath).toLowerCase())) {
         return c.json({ error: "video background removal output must be .webm or .mov" }, 400);
@@ -5195,7 +5333,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "background plates are only supported for video inputs" }, 400);
         }
         backgroundOutputAssetPath = defaultPlatePath(project.dir, inputAssetPath);
-        backgroundOutputPath = resolveWithinProject2(project.dir, backgroundOutputAssetPath) ?? void 0;
+        backgroundOutputPath = resolveWithinProject(project.dir, backgroundOutputAssetPath) ?? void 0;
         if (!backgroundOutputPath) {
           return c.json({ error: "forbidden" }, 403);
         }
@@ -5258,12 +5396,12 @@ function registerMediaRoutes(api, adapter, options = {}) {
 }
 
 // src/routes/globalAssets.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
 import { homedir } from "os";
 import { join as join15 } from "path";
 function readGlobalAssets(home = homedir()) {
   const manifestPath = join15(home, ".media", "manifest.jsonl");
-  if (!existsSync10(manifestPath)) return [];
+  if (!existsSync9(manifestPath)) return [];
   const out = [];
   for (const line of readFileSync14(manifestPath, "utf8").split("\n")) {
     if (!line.trim()) continue;
@@ -5286,26 +5424,26 @@ function registerGlobalAssetRoutes(api) {
 import { randomUUID as randomUUID8 } from "crypto";
 import { readdir as readdir2, rm as rm2, rmdir, writeFile } from "fs/promises";
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   lstatSync as lstatSync4,
   statSync as statSync9,
   mkdirSync as mkdirSync11,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync18,
-  realpathSync as realpathSync3,
+  realpathSync,
   rmSync as rmSync6
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname9, isAbsolute as isAbsolute3, join as join19, relative as relative5, resolve as resolve7, sep as sep4 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute2, join as join19, relative as relative5, resolve as resolve8, sep as sep3 } from "path";
 
 // src/history/blobStore.ts
-import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID5 } from "crypto";
 import { constants as constants3, createReadStream as createReadStream2, renameSync as renameSync4 } from "fs";
-import { copyFile, mkdir, readdir, readFile as readFile2, rename, rm, stat } from "fs/promises";
+import { copyFile, mkdir, readdir, readFile as readFile2, rename, rm, stat as stat2 } from "fs/promises";
 import { dirname as dirname7, join as join16 } from "path";
 var BLOB_HASH = /^[0-9a-f]{64}$/;
 async function hashFile(path) {
-  const hash = createHash6("sha256");
+  const hash = createHash7("sha256");
   for await (const chunk of createReadStream2(path)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -5326,7 +5464,7 @@ async function openBlobStore(dir) {
   await mkdir(dir, { recursive: true });
   for (const shard of await readdir(dir))
     for (const hash of await readdir(join16(dir, shard)).catch(() => []))
-      sizes.set(hash, (await stat(join16(dir, shard, hash))).size);
+      sizes.set(hash, (await stat2(join16(dir, shard, hash))).size);
   const pathOf = (hash) => {
     if (!BLOB_HASH.test(hash)) throw new Error("That is not a history blob.");
     return join16(dir, hash.slice(0, 2), hash);
@@ -5343,7 +5481,7 @@ async function openBlobStore(dir) {
         return hash;
       }
       await mkdir(dirname7(pathOf(hash)), { recursive: true });
-      const size = (await stat(temp)).size;
+      const size = (await stat2(temp)).size;
       await rename(temp, pathOf(hash));
       sizes.set(hash, size);
       total += size;
@@ -5367,8 +5505,8 @@ async function openBlobStore(dir) {
 
 // src/history/historyId.ts
 import { randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync15, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join17, resolve as resolve6 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync15, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename3, join as join17, resolve as resolve7 } from "path";
 var ID_PATH = join17(".hyperframes", "history-id");
 var ID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function readId(projectDir) {
@@ -5381,18 +5519,38 @@ function readId(projectDir) {
 }
 var sameFolder = (a, b) => a.ino === b.ino && a.birthtimeMs === b.birthtimeMs;
 function isRecordedFolder(historyDir, folder) {
+  const was = readRecord(historyDir);
+  if (typeof was?.ino === "number")
+    return sameFolder({ ino: was.ino, birthtimeMs: was.born ?? NaN }, folder);
+  const unreadableSo0878KeptTheId = typeof was?.dir !== "string";
+  if (unreadableSo0878KeptTheId) return true;
+  return !isCopyOf0878Folder(was.dir, basename3(historyDir), folder);
+}
+function readRecord(historyDir) {
+  try {
+    return JSON.parse(readFileSync15(join17(historyDir, "project.json"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function isCopyOf0878Folder(recordedDir, id, folder) {
+  let there;
   try {
-    const was = JSON.parse(readFileSync15(join17(historyDir, "project.json"), "utf-8"));
-    return sameFolder({ ino: was.ino, birthtimeMs: was.born }, folder);
+    there = statSync8(recordedDir, { throwIfNoEntry: false });
   } catch {
     return false;
   }
+  return !!there && !sameFolder(there, folder) && readId(recordedDir) === id;
 }
 function projectHistoryId(projectDir, historyRoot) {
-  const dir = resolve6(projectDir);
+  const dir = resolve7(projectDir);
   const folder = statSync8(dir);
   let id = readId(dir);
-  if (!id || existsSync11(join17(historyRoot, id)) && !isRecordedFolder(join17(historyRoot, id), folder)) {
+  if (!id && existsSync10(join17(dir, ID_PATH)))
+    throw new HistoryIdError(
+      `${join17(dir, ID_PATH)} holds no history id this version can read; move it aside to start anew.`
+    );
+  if (!id || existsSync10(join17(historyRoot, id)) && !isRecordedFolder(join17(historyRoot, id), folder)) {
     id = randomUUID6();
     mkdirSync8(join17(dir, ".hyperframes"), { recursive: true });
     writeFileSync7(join17(dir, ID_PATH), `${id}
@@ -5401,6 +5559,12 @@ function projectHistoryId(projectDir, historyRoot) {
   recordProject(join17(historyRoot, id), dir, folder);
   return id;
 }
+var HistoryIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HistoryIdError";
+  }
+};
 function recordProject(historyDir, dir, folder) {
   const record = { dir, ino: folder.ino, born: folder.birthtimeMs };
   mkdirSync8(historyDir, { recursive: true });
@@ -5645,7 +5809,7 @@ async function removeEmptyFolders(dir) {
   await rmdir(dir);
 }
 function fileLeftIn(dir, at, deleted) {
-  for (const entry of readdirSync7(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
     const path = `${at}/${entry.name}`;
     const left = entry.isDirectory() ? fileLeftIn(join19(dir, entry.name), path, deleted) : deleted.has(path) ? void 0 : path;
     if (left) return left;
@@ -5670,7 +5834,7 @@ var Engine = class {
     this.options = options;
     this.projectId = projectId;
     this.blobs = blobs;
-    this.dir = resolve7(options.projectDir);
+    this.dir = resolve8(options.projectDir);
     this.home = join19(options.historyRoot, projectId);
     this.foldsCase = ignoresCase(this.dir);
     const folder = statSync9(this.dir, { throwIfNoEntry: false });
@@ -5732,7 +5896,7 @@ var Engine = class {
   persistLog(record) {
     if (record) saveRecord(this.logFile, this.log, record);
     else writeLog(this.logFile, this.log);
-    if (!existsSync12(join19(this.home, "project.json")))
+    if (!existsSync11(join19(this.home, "project.json")))
       recordProject(this.home, this.dir, this.folder);
   }
   replaced() {
@@ -5837,17 +6001,17 @@ var Engine = class {
       throw error;
     }
   }
-  async observe(path, stat2, at) {
+  async observe(path, stat3, at) {
     const known = this.tracked.get(path) ?? { hash: null, stat: null };
-    if (stat2 && known.stat === stat2) return false;
+    if (stat3 && known.stat === stat3) return false;
     const hash = await this.storeIfPresent(path);
     if (hash === null || this.whereFolder() !== "here") return false;
-    this.tracked.set(path, { hash, stat: stat2 });
+    this.tracked.set(path, { hash, stat: stat3 });
     if (known.hash !== hash) await this.record(path, known.hash, hash, at);
-    return known.hash !== hash || known.stat !== stat2;
+    return known.hash !== hash || known.stat !== stat3;
   }
   async record(path, before, after, at) {
-    const endedBeforeThisWrite = this.windows.filter((open) => !takesWrite(open, at));
+    const endedBeforeThisWrite = this.windows.filter((open2) => !takesWrite(open2, at));
     if (endedBeforeThisWrite.length) await this.commitOutside();
     for (const window2 of endedBeforeThisWrite) await this.endWindow(window2);
     const window = this.windows.at(-1);
@@ -5880,7 +6044,7 @@ var Engine = class {
       if (window.changes.size) await this.commitCut(window, [...window.changes.keys()]);
   }
   pendingElsewhere() {
-    return Boolean(this.outside?.changes.size) || this.windows.some((open) => open.changes.size > 0);
+    return Boolean(this.outside?.changes.size) || this.windows.some((open2) => open2.changes.size > 0);
   }
   /** The held claim `taken` continues: same key, each file from its own last change, no held file changed since. */
   heldFor(key, taken) {
@@ -5894,7 +6058,7 @@ var Engine = class {
     return group && taken.every((change) => after(change.path, change.before) === change.before) && [...group.changes.values()].every(untouched) ? group : null;
   }
   logPath(path) {
-    return relative5(this.dir, resolve7(this.dir, path)).split(sep4).join("/");
+    return relative5(this.dir, resolve8(this.dir, path)).split(sep3).join("/");
   }
   /** Takes `paths`' uncommitted changes from others, cut at what `who` overwrote. */
   async takeClaimed(who, paths, overwrote) {
@@ -5905,7 +6069,7 @@ var Engine = class {
         hashOfVersion(version)
       ])
     );
-    const others = this.windows.filter((open) => !sameWho(open.who, who));
+    const others = this.windows.filter((open2) => !sameWho(open2.who, who));
     const groups = this.outside ? [this.outside, ...others] : others;
     const hits = groups.flatMap(
       (group) => [...group.changes.values()].filter((change) => wanted.has(change.path)).map((change) => ({ group, change }))
@@ -5960,6 +6124,7 @@ var Engine = class {
       part.changes.set(path, window.changes.get(path));
       window.changes.delete(path);
     }
+    (window.parts ??= /* @__PURE__ */ new Set()).add(part.id);
     window.entry = await this.commit(part);
   }
   holdClaim(group, key, idleMs = this.options.quietMs ?? 2e3) {
@@ -6051,7 +6216,7 @@ var Engine = class {
   }
   /** A watcher saw a write: one sweep per burst takes it in (a deleted folder is reported by its name alone). */
   noteChange(path) {
-    if (this.notedTimer || !affectsProjectSignature(this.dir, resolve7(this.dir, path))) return;
+    if (this.notedTimer || !affectsProjectSignature(this.dir, resolve8(this.dir, path))) return;
     this.notedTimer = setTimeout(() => {
       this.notedTimer = null;
       this.background(() => this.sweep());
@@ -6093,7 +6258,7 @@ var Engine = class {
     if (!this.windows.includes(window)) return window.entry ?? null;
     clearTimeout(window.idleTimer);
     await this.commitClaim();
-    this.windows = this.windows.filter((open) => open !== window);
+    this.windows = this.windows.filter((open2) => open2 !== window);
     window.entry = await this.commit(window) ?? window.entry ?? null;
     return window.entry;
   }
@@ -6109,9 +6274,9 @@ var Engine = class {
     const parts = path.split("/");
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const at = parts.slice(0, depth).join("/");
-      const stat2 = lstatSync4(join19(this.dir, at), { throwIfNoEntry: false });
-      if (!stat2) return void 0;
-      if (at === path || !stat2.isDirectory()) return { at, stat: stat2 };
+      const stat3 = lstatSync4(join19(this.dir, at), { throwIfNoEntry: false });
+      if (!stat3) return void 0;
+      if (at === path || !stat3.isDirectory()) return { at, stat: stat3 };
     }
     return void 0;
   }
@@ -6121,8 +6286,8 @@ var Engine = class {
     if (!standing) return void 0;
     if (standing.stat.isSymbolicLink()) return standing.at;
     if (standing.at === path && !standing.stat.isDirectory()) return void 0;
-    const real = realpathSync3.native(join19(this.dir, standing.at));
-    const at = relative5(realpathSync3.native(this.dir), real).split(sep4).join("/");
+    const real = realpathSync.native(join19(this.dir, standing.at));
+    const at = relative5(realpathSync.native(this.dir), real).split(sep3).join("/");
     if (standing.at !== path) return deleted.has(at) ? void 0 : at;
     return fileLeftIn(real, at, deleted);
   }
@@ -6139,7 +6304,7 @@ var Engine = class {
       for (const [path, hash] of changes) await this.writeProjectFile(path, hash);
       await this.sweep();
     } finally {
-      this.windows = this.windows.filter((open) => open !== group);
+      this.windows = this.windows.filter((open2) => open2 !== group);
     }
     return this.commit(group, extra);
   }
@@ -6199,7 +6364,13 @@ var Engine = class {
       (group) => group?.changes.size && mine(group.who)
     );
     if (pending) return direction === "back" ? this.pendingEntry(pending) : void 0;
-    return stepTarget(this.log.entries, direction, (entry) => mine(entry.who));
+    const everyone = this.options.undoScope === "everyone";
+    const ofOpenTurn = (entry) => this.windows.some((open2) => open2.parts?.has(entry.id));
+    return stepTarget(
+      this.log.entries,
+      direction,
+      (entry) => mine(entry.who) || everyone && !ofOpenTurn(entry)
+    );
   }
   /** A pending group as the entry it becomes once committed (a window's part gets a fresh id). */
   pendingEntry(group) {
@@ -6270,8 +6441,8 @@ var Engine = class {
       },
       checkout: (entryId, side, emptyDir) => this.queue(async () => {
         this.entry(entryId);
-        if (!existsSync12(this.dir)) throw new Error(`The project folder is gone: ${this.dir}`);
-        const dest = resolve7(emptyDir);
+        if (!existsSync11(this.dir)) throw new Error(`The project folder is gone: ${this.dir}`);
+        const dest = resolve8(emptyDir);
         if (isWithin(this.dir, dest))
           throw new Error(`Checkout writes outside the project only: ${dest}`);
         if ((await readdir2(dest).catch(missingIsEmpty)).length > 0)
@@ -6316,10 +6487,10 @@ var Engine = class {
   }
 };
 function isWithin(dir, path) {
-  let probe = resolve7(path);
-  while (!existsSync12(probe) && dirname9(probe) !== probe) probe = dirname9(probe);
-  const rel = relative5(realpathSync3.native(dir), realpathSync3.native(probe));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute3(rel);
+  let probe = resolve8(path);
+  while (!existsSync11(probe) && dirname9(probe) !== probe) probe = dirname9(probe);
+  const rel = relative5(realpathSync.native(dir), realpathSync.native(probe));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute2(rel);
 }
 function missingIsEmpty(error) {
   if (error.code === "ENOENT") return [];
@@ -6332,7 +6503,7 @@ var HistoryClosedError = class extends Error {
   }
 };
 async function openProjectHistory(options) {
-  if (!existsSync12(options.projectDir))
+  if (!existsSync11(options.projectDir))
     throw new HistoryClosedError(`${options.projectDir} is gone or now another project.`);
   const projectId = projectHistoryId(options.projectDir, options.historyRoot);
   const release = await takeHistoryOwnership(
@@ -6499,6 +6670,7 @@ function createStudioApi(adapter) {
   registerLintRoutes(api, adapter);
   registerRenderRoutes(api, adapter);
   registerThumbnailRoutes(api, adapter);
+  registerImageThumbnailRoutes(api, adapter);
   registerSelectionRoutes(api, adapter);
   registerMediaRoutes(api, adapter);
   registerWaveformRoutes(api, adapter);
@@ -6510,14 +6682,14 @@ function createStudioApi(adapter) {
 }
 
 // src/history/historyCache.ts
-function historyCache(open) {
+function historyCache(open2) {
   const histories = /* @__PURE__ */ new Map();
   const get = async (projectDir) => {
     let cached = histories.get(projectDir);
-    if (!cached) histories.set(projectDir, cached = open(projectDir));
+    if (!cached) histories.set(projectDir, cached = open2(projectDir));
     const opened = await cached;
     if (!opened?.replacedAtPath()) return opened;
-    const reopen = () => open(projectDir);
+    const reopen = () => open2(projectDir);
     if (histories.get(projectDir) === cached)
       histories.set(projectDir, opened.close().then(reopen, reopen));
     return get(projectDir);
@@ -6534,6 +6706,7 @@ function historyCache(open) {
 }
 
 // src/helpers/duplicateElement.ts
+import { sameInstant } from "@hyperframes/core/clip-facts";
 import { ensureHfIds as ensureHfIds4 } from "@hyperframes/parsers/hf-ids";
 function duplicateElementInHtml(source, target, newId, at) {
   const { document, wrappedFragment } = parseSourceDocument(source);
@@ -6568,9 +6741,10 @@ function rippleElements(document, element, at, duration, track) {
       continue;
     }
     const start = numericAttribute(candidate, "data-start");
-    if (start !== null && start >= at) {
-      candidate.setAttribute("data-start", String(start + duration));
-    }
+    if (start === null) continue;
+    const metInsertionPoint = sameInstant(start, at);
+    if (start < at && !metInsertionPoint) continue;
+    candidate.setAttribute("data-start", String((metInsertionPoint ? at : start) + duration));
   }
 }
 function stripStableIds(element) {
@@ -6585,11 +6759,11 @@ function numericAttribute(element, name) {
 }
 
 // src/helpers/previewDocumentStore.ts
-import { createHash as createHash7 } from "crypto";
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync8, rmSync as rmSync7 } from "fs";
+import { createHash as createHash8 } from "crypto";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync7, rmSync as rmSync7 } from "fs";
 import { join as join20 } from "path";
 function createPreviewDocumentStore(dir, salt) {
-  const fileFor = (key) => join20(dir, `${createHash7("sha256").update(`${salt}
+  const fileFor = (key) => join20(dir, `${createHash8("sha256").update(`${salt}
 ${key}`).digest("hex").slice(0, 32)}.html`);
   return {
     read(key) {
@@ -6604,7 +6778,7 @@ ${key}`).digest("hex").slice(0, 32)}.html`);
         mkdirSync12(dir, { recursive: true });
         const file = fileFor(key);
         replaceFileAtomically(file, html, 420);
-        for (const name of readdirSync8(dir)) {
+        for (const name of readdirSync7(dir)) {
           if (join20(dir, name) !== file) rmSync7(join20(dir, name), { force: true });
         }
       } catch {
@@ -6686,12 +6860,14 @@ export {
   START as HISTORY_START,
   HistoryBusyError,
   HistoryClosedError,
+  HistoryIdError,
   MAX_WINDOW_IDLE_MS,
   MIME_TYPES,
   PREVIEW_BUNDLE_OPTIONS,
   STUDIO_MANUAL_EDITS_PATH,
   STUDIO_MOTION_PATH,
   UNDO_MODES,
+  affectsPreview,
   affectsProjectSignature,
   applyFileMutations,
   buildSubCompositionHtml,