@hyperframes/studio-server 0.8.80 → 0.8.81

package/dist/index.js

@@ -22,21 +22,28 @@ import {
   isAutoProxyEnabled,
   proxyEtagSalt,
   resolvePreviewMediaCodecProbeCache
-} from "./chunk-YGANSFUU.js";
+} from "./chunk-FTDTO3QP.js";
 import {
   ProxyCapacityError,
   ProxyTranscodeError,
   resolveProxy
-} from "./chunk-56JREE33.js";
+} from "./chunk-G6IIFKXY.js";
 import {
   PROXY_VARIANT_CONFIG,
   decideMediaProxyEligibility,
+  isInHiddenOrVendorDir,
   isProxyVariantRequest,
+  isSafePath,
+  pinWithinProject,
   probeAssetCodec,
   probeMediaMetadata,
+  realFilePath,
+  realpath,
   recordProxyRequest,
-  resolveProxyVariantRequest
-} from "./chunk-KOB22VPG.js";
+  resolveProxyVariantRequest,
+  resolveWithinProject,
+  walkDir
+} from "./chunk-TJQ76IEA.js";
 import {
   STUDIO_MANUAL_EDITS_PATH,
   createStudioManualEditsRenderBodyScript,
@@ -52,64 +59,7 @@ import { Hono } from "hono";
 
 // src/routes/projects.ts
 import { readFile } from "fs/promises";
-import { join as join3 } from "path";
-
-// src/helpers/safePath.ts
-import { basename, dirname, isAbsolute, join, relative, sep } from "path";
-import { readdirSync, realpathSync } from "fs";
-import { resolveWithinProject } from "@hyperframes/core";
-import { isSafePath, resolveWithinProject as resolveWithinProject2 } from "@hyperframes/core";
-function realFilePath(filePath) {
-  try {
-    return realpathSync(filePath);
-  } catch {
-    const dir = dirname(filePath);
-    return dir === filePath ? filePath : join(realFilePath(dir), basename(filePath));
-  }
-}
-function pinWithinProject(base, relativePath) {
-  const checked = resolveWithinProject(base, relativePath);
-  if (!checked) return null;
-  const inside = relative(realFilePath(base), realFilePath(checked));
-  const escapes = inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
-  return escapes ? null : join(base, inside);
-}
-var IGNORE_DIRS = /* @__PURE__ */ new Set([
-  ".thumbnails",
-  ".transcode-cache",
-  ".waveform-cache",
-  "node_modules",
-  ".git"
-]);
-function shouldIgnoreDir(rel) {
-  return rel === ".hyperframes/backup";
-}
-function isInHiddenOrVendorDir(relPath) {
-  const segments = relPath.split("/");
-  return segments.slice(0, -1).some((seg) => seg.startsWith(".") || seg === "node_modules");
-}
-var UNREADABLE_DIR_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM", "ENOENT", "ENOTDIR"]);
-function walkDir(dir, prefix = "") {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch (err) {
-    const code = err.code;
-    if (!prefix || !code || !UNREADABLE_DIR_CODES.has(code)) throw err;
-    return [];
-  }
-  const files = [];
-  for (const entry of entries) {
-    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (IGNORE_DIRS.has(entry.name) || shouldIgnoreDir(rel)) continue;
-    if (entry.isDirectory()) {
-      files.push(...walkDir(join(dir, entry.name), rel));
-    } else {
-      files.push(rel);
-    }
-  }
-  return files;
-}
+import { join as join2 } from "path";
 
 // src/helpers/hfIdPersist.ts
 import { ensureHfIds } from "@hyperframes/parsers/hf-ids";
@@ -123,7 +73,7 @@ import {
   readFileSync,
   writeFileSync
 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname, join } from "path";
 
 // src/helpers/atomicFile.ts
 import * as fs from "fs";
@@ -145,10 +95,10 @@ function replaceFileAtomically(filePath, content, mode, operations = fs) {
 
 // src/helpers/hfIdPersist.ts
 var isCompositionSource = (html) => /data-composition-id\s*=/.test(html);
-var STAMP_RECORD = join2(".hyperframes", "hf-ids-stamped.json");
+var STAMP_RECORD = join(".hyperframes", "hf-ids-stamped.json");
 var contentHash = (text2) => createHash("sha1").update(text2).digest("base64url");
 function stampProjectHfIds(projectDir) {
-  const recordPath = join2(projectDir, STAMP_RECORD);
+  const recordPath = join(projectDir, STAMP_RECORD);
   let last = {};
   try {
     last = JSON.parse(readFileSync(recordPath, "utf-8"));
@@ -157,7 +107,7 @@ function stampProjectHfIds(projectDir) {
   const next = {};
   for (const file of walkDir(projectDir)) {
     if (!file.endsWith(".html") || isInHiddenOrVendorDir(file)) continue;
-    const absPath = join2(projectDir, file);
+    const absPath = join(projectDir, file);
     let html;
     try {
       html = readFileSync(absPath, "utf-8");
@@ -173,7 +123,7 @@ function stampProjectHfIds(projectDir) {
     next[file] = hash;
   }
   try {
-    mkdirSync(dirname2(recordPath), { recursive: true });
+    mkdirSync(dirname(recordPath), { recursive: true });
     writeFileSync(recordPath, JSON.stringify(next));
   } catch {
   }
@@ -226,8 +176,8 @@ function stampFileHfIds(filePath) {
 
 // src/helpers/projectSignature.ts
 import { createHash as createHash2 } from "crypto";
-import { lstatSync, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
-import { extname, isAbsolute as isAbsolute2, relative as relative2, resolve, sep as sep2 } from "path";
+import { lstatSync, readFileSync as readFileSync2, readdirSync } from "fs";
+import { extname, isAbsolute, relative, resolve, sep } from "path";
 var SIGNATURE_TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".cjs",
   ".css",
@@ -262,18 +212,18 @@ var STUDIO_SIGNATURE_MANIFEST_PATHS = [
   ".hyperframes/studio-motion.json"
 ];
 function affectsProjectSignature(projectDir, changedPath) {
-  const relativePath = relative2(resolve(projectDir), resolve(changedPath));
-  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
+  const relativePath = relative(resolve(projectDir), resolve(changedPath));
+  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute(relativePath)) {
     return false;
   }
-  const segments = relativePath.split(sep2);
+  const segments = relativePath.split(sep);
   if (STUDIO_SIGNATURE_MANIFEST_PATHS.includes(segments.join("/"))) return true;
   return !segments.some((segment) => SIGNATURE_EXCLUDED_DIRS.has(segment));
 }
 var projectSignatureCache = /* @__PURE__ */ new Map();
 function isPathWithin(parentDir, childPath) {
-  const childRelativePath = relative2(parentDir, childPath);
-  return childRelativePath === "" || !childRelativePath.startsWith("..") && !isAbsolute2(childRelativePath);
+  const childRelativePath = relative(parentDir, childPath);
+  return childRelativePath === "" || !childRelativePath.startsWith("..") && !isAbsolute(childRelativePath);
 }
 function isTextContentEligible(file, size) {
   return SIGNATURE_TEXT_EXTENSIONS.has(extname(file).toLowerCase()) && size <= MAX_SIGNATURE_TEXT_BYTES;
@@ -281,7 +231,7 @@ function isTextContentEligible(file, size) {
 function collectProjectSignatureFiles(projectDir, dir, files) {
   let entries;
   try {
-    entries = readdirSync2(dir).sort();
+    entries = readdirSync(dir).sort();
   } catch {
     return;
   }
@@ -334,7 +284,7 @@ function collectProjectSignatureManifestFiles(projectDir, files) {
 function createProjectFingerprint(projectDir, files) {
   const hash = createHash2("sha256");
   for (const entry of files) {
-    hash.update(relative2(projectDir, entry.file));
+    hash.update(relative(projectDir, entry.file));
     hash.update("\0");
     hash.update(String(entry.size));
     hash.update("\0");
@@ -356,7 +306,7 @@ function collectProjectFiles(normalizedProjectDir) {
 function listProjectFiles(projectDir) {
   const normalizedProjectDir = resolve(projectDir);
   return collectProjectFiles(normalizedProjectDir).map((entry) => ({
-    path: relative2(normalizedProjectDir, entry.file).split(sep2).join("/"),
+    path: relative(normalizedProjectDir, entry.file).split(sep).join("/"),
     size: entry.size,
     mtimeMs: entry.mtimeMs,
     ctimeMs: entry.ctimeMs
@@ -374,7 +324,7 @@ function createProjectSignature(projectDir, excluding = /* @__PURE__ */ new Set(
   const normalizedProjectDir = resolve(projectDir);
   const collected = collectProjectFiles(normalizedProjectDir);
   const files = collected.filter(
-    (entry) => !excluding.has(relative2(normalizedProjectDir, entry.file).split(sep2).join("/"))
+    (entry) => !excluding.has(relative(normalizedProjectDir, entry.file).split(sep).join("/"))
   );
   files.sort((a, b) => a.file.localeCompare(b.file));
   const fingerprint = createProjectFingerprint(normalizedProjectDir, files);
@@ -383,7 +333,7 @@ function createProjectSignature(projectDir, excluding = /* @__PURE__ */ new Set(
   if (cached?.fingerprint === fingerprint) return cached.signature;
   const hash = createHash2("sha256");
   for (const entry of files) {
-    const relativePath = relative2(normalizedProjectDir, entry.file);
+    const relativePath = relative(normalizedProjectDir, entry.file);
     hash.update(relativePath);
     hash.update("\0");
     hash.update(String(entry.size));
@@ -410,7 +360,7 @@ async function filterCompositionFiles(projectDir, files) {
   const checks = await Promise.all(
     htmlFiles.map(async (f) => {
       try {
-        const content = await readFile(join3(projectDir, f), "utf-8");
+        const content = await readFile(join2(projectDir, f), "utf-8");
         return isCompositionSource(content);
       } catch {
         return false;
@@ -464,9 +414,9 @@ import {
   statSync as statSync3,
   fstatSync as fstatSync2,
   renameSync as renameSync2,
-  readdirSync as readdirSync4
+  readdirSync as readdirSync3
 } from "fs";
-import { resolve as resolve3, dirname as dirname5, join as join7 } from "path";
+import { resolve as resolve3, dirname as dirname4, join as join6 } from "path";
 
 // src/helpers/mime.ts
 var MIME_TYPES = {
@@ -526,7 +476,7 @@ import {
   rmSync,
   statSync
 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { findFfBinary } from "@hyperframes/parsers/ff-binaries";
 var SAMPLE_RATE = 4e3;
 var PEAK_COUNT = 4e3;
@@ -593,11 +543,11 @@ function decodeAudioPeaks(audioPath) {
   });
 }
 async function generateWaveformCache(projectDir, assetPath) {
-  const audioPath = join4(projectDir, assetPath);
+  const audioPath = join3(projectDir, assetPath);
   if (!existsSync(audioPath)) return;
   const stats = statSync(audioPath);
-  const cacheDir = join4(projectDir, ".waveform-cache");
-  const cachePath = join4(cacheDir, buildWaveformCacheKey(assetPath, stats));
+  const cacheDir = join3(projectDir, ".waveform-cache");
+  const cachePath = join3(cacheDir, buildWaveformCacheKey(assetPath, stats));
   if (isWaveformCacheDirectory(cacheDir) && existsSync(cachePath)) return;
   const peaks = await decodeAudioPeaks(audioPath);
   writeWaveformCache(cachePath, peaks);
@@ -606,7 +556,7 @@ function isWaveformCacheDirectory(cacheDir) {
   return lstatSync2(cacheDir, { throwIfNoEntry: false })?.isDirectory() ?? false;
 }
 function writeWaveformCache(cachePath, peaks) {
-  const cacheDir = dirname3(cachePath);
+  const cacheDir = dirname2(cachePath);
   try {
     mkdirSync2(cacheDir, { mode: 448 });
   } catch (error) {
@@ -615,9 +565,9 @@ function writeWaveformCache(cachePath, peaks) {
   if (!isWaveformCacheDirectory(cacheDir)) {
     throw new Error("Waveform cache must be a directory, not a symlink");
   }
-  const stagingDir = mkdtempSync(join4(cacheDir, ".waveform-"));
+  const stagingDir = mkdtempSync(join3(cacheDir, ".waveform-"));
   try {
-    const stagingPath = join4(stagingDir, "peaks.json");
+    const stagingPath = join3(stagingDir, "peaks.json");
     writeFileSync2(stagingPath, JSON.stringify(peaks), { flag: "wx" });
     renameSync(stagingPath, cachePath);
   } finally {
@@ -632,7 +582,7 @@ function writeWaveformCache(cachePath, peaks) {
 import { spawnSync } from "child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename2, join as join5 } from "path";
+import { basename, join as join4 } from "path";
 var VIDEO_EXT = /\.(mp4|webm|mov|mkv|avi|m4v|mxf|mts|m2ts|ts)$/i;
 var AUDIO_EXT = /\.(mp3|wav|ogg|m4a|aac)$/i;
 function validateUploadedMedia(filePath, runner = spawnSync) {
@@ -669,8 +619,8 @@ function validateUploadedMedia(filePath, runner = spawnSync) {
   }
 }
 function validateUploadedMediaBuffer(fileName, buffer, runner = spawnSync) {
-  const tempDir = mkdtempSync2(join5(tmpdir(), "hyperframes-upload-"));
-  const tempPath = join5(tempDir, basename2(fileName));
+  const tempDir = mkdtempSync2(join4(tmpdir(), "hyperframes-upload-"));
+  const tempPath = join4(tempDir, basename(fileName));
   try {
     writeFileSync3(tempPath, buffer);
     return validateUploadedMedia(tempPath, runner);
@@ -680,9 +630,9 @@ function validateUploadedMediaBuffer(fileName, buffer, runner = spawnSync) {
 }
 
 // src/helpers/backupJournal.ts
-import { mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { Buffer as Buffer2 } from "buffer";
-import { join as join6, relative as relative3 } from "path";
+import { join as join5, relative as relative2 } from "path";
 var DEFAULT_KEEP_PER_FILE = 10;
 function backupKeyForPath(path) {
   return Buffer2.from(path, "utf-8").toString("base64url");
@@ -692,7 +642,7 @@ function timestampPrefix() {
 }
 function backupPathForResponse(projectDir, backupPath) {
   if (!backupPath) return null;
-  const rel = relative3(projectDir, backupPath);
+  const rel = relative2(projectDir, backupPath);
   if (!rel || rel.startsWith("..")) return null;
   return rel.split("\\").join("/");
 }
@@ -700,8 +650,8 @@ function snapshotBeforeWrite(projectDir, absPath, options = {}) {
   if (!isSafePath(projectDir, absPath)) return { backupPath: null };
   try {
     const content = readFileSync3(absPath);
-    const relativePath = relative3(projectDir, absPath);
-    const backupDir = join6(projectDir, ".hyperframes", "backup");
+    const relativePath = relative2(projectDir, absPath);
+    const backupDir = join5(projectDir, ".hyperframes", "backup");
     mkdirSync3(backupDir, { recursive: true });
     const backupKey = backupKeyForPath(relativePath);
     const backupPath = nextBackupPath(backupDir, backupKey);
@@ -717,7 +667,7 @@ function snapshotBeforeWrite(projectDir, absPath, options = {}) {
 }
 function nextBackupPath(backupDir, backupKey) {
   const base = `${timestampPrefix()}-${backupKey}`;
-  let candidate = join6(backupDir, base);
+  let candidate = join5(backupDir, base);
   let counter = 2;
   while (true) {
     try {
@@ -728,7 +678,7 @@ function nextBackupPath(backupDir, backupKey) {
       }
       throw error;
     }
-    candidate = join6(backupDir, `${base}-${counter}`);
+    candidate = join5(backupDir, `${base}-${counter}`);
     counter += 1;
   }
 }
@@ -736,7 +686,7 @@ function pruneBackups(backupDir, backupKey, keepPerFile) {
   const keep = Math.max(1, Math.floor(keepPerFile));
   const suffix = `-${backupKey}`;
   const numberedSuffix = new RegExp(`-${backupKey}-\\d+$`);
-  const matches = readdirSync3(backupDir).filter((name) => name.endsWith(suffix) || numberedSuffix.test(name)).map((name) => join6(backupDir, name)).sort((a, b) => {
+  const matches = readdirSync2(backupDir).filter((name) => name.endsWith(suffix) || numberedSuffix.test(name)).map((name) => join5(backupDir, name)).sort((a, b) => {
     return b.localeCompare(a);
   });
   for (const file of matches.slice(keep)) {
@@ -937,9 +887,9 @@ import { parseHTML as parseHTML2 } from "linkedom";
 import { ensureHfIds as ensureHfIds2 } from "@hyperframes/parsers/hf-ids";
 
 // src/helpers/compositionInsertion.ts
-import { existsSync as existsSync2, readFileSync as readFileSync5, realpathSync as realpathSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { dirname as dirname4, relative as relative4, resolve as resolve2, sep as sep3 } from "path";
+import { dirname as dirname3, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
 import { parseHTML } from "linkedom";
 var CompositionInsertionError = class extends Error {
   constructor(message, status) {
@@ -975,8 +925,8 @@ function canonicalProjectPath(projectDir, candidate) {
   if (!existsSync2(candidate)) {
     throw new CompositionInsertionError("Composition source was not found", 404);
   }
-  const canonical = realpathSync2(candidate);
-  if (!isSafePath(realpathSync2(projectDir), canonical)) {
+  const canonical = realpath(candidate);
+  if (!isSafePath(realpath(projectDir), canonical)) {
     throw new CompositionInsertionError("Composition source escapes the project", 400);
   }
   return canonical;
@@ -988,13 +938,13 @@ function validateSourcePath(sourcePath) {
 }
 function canonicalProjectFile(projectDir, sourcePath) {
   validateSourcePath(sourcePath);
-  return canonicalProjectPath(projectDir, resolveWithinProject2(projectDir, sourcePath));
+  return canonicalProjectPath(projectDir, resolveWithinProject(projectDir, sourcePath));
 }
 function canonicalDependency(projectDir, ownerAbs, sourcePath) {
   validateSourcePath(sourcePath);
   return canonicalProjectPath(
     projectDir,
-    resolveWithinProject2(projectDir, relative4(projectDir, resolve2(dirname4(ownerAbs), sourcePath)))
+    resolveWithinProject(projectDir, relative3(projectDir, resolve2(dirname3(ownerAbs), sourcePath)))
   );
 }
 function validateDependencyGraph(projectDir, targetAbs, sourceAbs) {
@@ -1067,7 +1017,7 @@ function uniqueHostId(root, base) {
   return `${base}_${suffix}`;
 }
 function relativeSourcePath(targetAbs, sourceAbs) {
-  return relative4(dirname4(targetAbs), sourceAbs).split(sep3).join("/");
+  return relative3(dirname3(targetAbs), sourceAbs).split(sep2).join("/");
 }
 function insertCompositionIntoSource(input) {
   const targetAbs = canonicalProjectFile(input.projectDir, input.targetPath);
@@ -1199,7 +1149,7 @@ async function loadGsapParser() {
   return import("@hyperframes/parsers/gsap-parser-recast");
 }
 function isDanglingSymlinkInProject(projectDir, lexicalPath) {
-  if (!isSafePath(projectDir, dirname5(lexicalPath))) return false;
+  if (!isSafePath(projectDir, dirname4(lexicalPath))) return false;
   let stats;
   try {
     stats = lstatSync3(lexicalPath);
@@ -1207,7 +1157,7 @@ function isDanglingSymlinkInProject(projectDir, lexicalPath) {
     return false;
   }
   if (!stats.isSymbolicLink()) return false;
-  const target = resolve3(dirname5(lexicalPath), readlinkSync(lexicalPath));
+  const target = resolve3(dirname4(lexicalPath), readlinkSync(lexicalPath));
   if (!isSafePath(projectDir, target)) return false;
   try {
     statSync3(lexicalPath);
@@ -1231,7 +1181,7 @@ async function resolveProjectPath(c, adapter, route, opts) {
   if (filePath.includes("\0")) {
     return { error: c.json({ error: "forbidden", why: "nul" }, 403) };
   }
-  const absPath = (opts?.pin ? pinWithinProject : resolveWithinProject2)(project.dir, filePath);
+  const absPath = (opts?.pin ? pinWithinProject : resolveWithinProject)(project.dir, filePath);
   if (!absPath) {
     if (isDanglingSymlinkInProject(project.dir, resolve3(project.dir, filePath))) {
       return { error: c.json({ error: "not found", why: "dangling_symlink" }, 404) };
@@ -1430,7 +1380,7 @@ async function parseMutationBody(c) {
   return { target: body.target, body };
 }
 function ensureDir(filePath) {
-  const dir = dirname5(filePath);
+  const dir = dirname4(filePath);
   if (!existsSync3(dir)) mkdirSync4(dir, { recursive: true });
 }
 function generateCopyPath(projectDir, originalPath) {
@@ -1448,8 +1398,8 @@ function generateCopyPath(projectDir, originalPath) {
 }
 function walkFiles(dir, filter) {
   const results = [];
-  for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-    const full = join7(dir, entry.name);
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    const full = join6(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".thumbnails" || entry.name === "renders" || entry.name === ".transcode-cache")
         continue;
@@ -2612,7 +2562,7 @@ async function processUploadedFiles(formData, targetDir, projectDir) {
       if (n >= MAX_COPY_INDEX) skipped.push(name);
       continue;
     }
-    const relativePath = subDir ? join7(subDir, finalName) : finalName;
+    const relativePath = subDir ? join6(subDir, finalName) : finalName;
     uploaded.push(relativePath);
     if (isAudioFile(finalName)) {
       generateWaveformCache(projectDir, relativePath).catch(() => {
@@ -3295,7 +3245,7 @@ function registerFileRoutes(api, adapter) {
     if (!body.newPath || body.newPath.includes("\0")) {
       return c.json({ error: "newPath required" }, 400);
     }
-    const newAbs = resolveWithinProject2(res.project.dir, body.newPath);
+    const newAbs = resolveWithinProject(res.project.dir, body.newPath);
     if (!newAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -3314,12 +3264,12 @@ function registerFileRoutes(api, adapter) {
     if (!body.path || body.path.includes("\0")) {
       return c.json({ error: "path required" }, 400);
     }
-    const srcAbs = resolveWithinProject2(project.dir, body.path);
+    const srcAbs = resolveWithinProject(project.dir, body.path);
     if (!srcAbs || !existsSync3(srcAbs)) {
       return c.json({ error: "not found" }, 404);
     }
     const copyPath = generateCopyPath(project.dir, body.path);
-    const destAbs = resolveWithinProject2(project.dir, copyPath);
+    const destAbs = resolveWithinProject(project.dir, copyPath);
     if (!destAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -3345,7 +3295,7 @@ function registerFileRoutes(api, adapter) {
       const project = await adapter.resolveProject(c.req.param("id"));
       if (!project) return c.json({ error: "not found" }, 404);
       const subDir = c.req.query("dir") ?? "";
-      const targetDir = subDir ? resolveWithinProject2(project.dir, subDir) : project.dir;
+      const targetDir = subDir ? resolveWithinProject(project.dir, subDir) : project.dir;
       if (!targetDir) return c.json({ error: "forbidden" }, 403);
       if (subDir && !existsSync3(targetDir)) mkdirSync4(targetDir, { recursive: true });
       const formData = await c.req.formData();
@@ -3429,7 +3379,7 @@ function registerFileRoutes(api, adapter) {
 // src/routes/preview.ts
 import { createReadStream, existsSync as existsSync5, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
 import { Readable } from "stream";
-import { join as join10, resolve as resolve5 } from "path";
+import { join as join9, resolve as resolve5 } from "path";
 import { createHash as createHash4 } from "crypto";
 import {
   addScenePartsManifest,
@@ -3441,7 +3391,7 @@ import { isWithinProjectRoot } from "@hyperframes/parsers/asset-resolution";
 
 // src/helpers/subComposition.ts
 import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 import { parseHTML as parseHTML3 } from "linkedom";
 import {
   rewriteAssetPaths,
@@ -3451,7 +3401,7 @@ import {
 import { stripEmbeddedRuntimeScripts } from "@hyperframes/core/compiler";
 import { isFullHtmlDocument } from "@hyperframes/core/compiler/html-document";
 function rewriteRelativePaths(root, compPath, projectDir) {
-  const assetExists = (path) => existsSync4(join8(projectDir, path));
+  const assetExists = (path) => existsSync4(join7(projectDir, path));
   rewriteAssetPaths(
     root.querySelectorAll("[src], [href]"),
     compPath,
@@ -3548,7 +3498,7 @@ function tagRootCompositionFile(bodyHtml, compPath) {
   return bodyHtml.slice(0, tagEnd) + ` data-composition-file="${compPath}"` + bodyHtml.slice(tagEnd);
 }
 function buildSubCompositionHtml(projectDir, compPath, runtimeUrl, baseHref, rawOverride) {
-  const compFile = join8(projectDir, compPath);
+  const compFile = join7(projectDir, compPath);
   if (!existsSync4(compFile)) return null;
   const rawComp = rawOverride ?? readFileSync7(compFile, "utf-8");
   let compHeadContent = "";
@@ -3580,7 +3530,7 @@ function buildSubCompositionHtml(projectDir, compPath, runtimeUrl, baseHref, raw
   }
   rewrittenContent = stripEmbeddedRuntimeScripts(rewrittenContent);
   rewrittenContent = tagRootCompositionFile(rewrittenContent, compPath);
-  const indexPath = join8(projectDir, "index.html");
+  const indexPath = join7(projectDir, "index.html");
   let headContent = "";
   if (existsSync4(indexPath)) {
     const indexHtml = readFileSync7(indexPath, "utf-8");
@@ -3624,14 +3574,14 @@ import { ensureHfIds as ensureHfIds3 } from "@hyperframes/parsers/hf-ids";
 
 // src/helpers/previewReads.ts
 import { readlinkSync as readlinkSync2 } from "fs";
-import { dirname as dirname6, join as join9, parse, relative as relative5, resolve as resolve4 } from "path";
+import { dirname as dirname5, join as join8, parse, relative as relative4, resolve as resolve4 } from "path";
 var ALWAYS_AFFECTS = ["hyperframes.json", ...STUDIO_SIGNATURE_MANIFEST_PATHS];
 var REFERENCE = /\b(?:src|href|poster|data-composition-src)\s*=\s*(?:"([^"\n]*)"|'([^'\n]*)')|url\(\s*(?:"([^"\n]*)"|'([^'\n]*)'|([^"'\s)]+))/gi;
 var pathKey = process.platform === "darwin" || process.platform === "win32" ? (path) => resolve4(path).toLowerCase() : (path) => resolve4(path);
 var readsByProject = /* @__PURE__ */ new Map();
 var builtProjects = /* @__PURE__ */ new Set();
 var projectKey = (projectDir) => pathKey(realFilePath(resolve4(projectDir)));
-var inRealProject = (projectDir, path) => join9(realFilePath(resolve4(projectDir)), relative5(resolve4(projectDir), resolve4(projectDir, path)));
+var inRealProject = (projectDir, path) => join8(realFilePath(resolve4(projectDir)), relative4(resolve4(projectDir), resolve4(projectDir, path)));
 var readLink = (path) => {
   try {
     return readlinkSync2(path);
@@ -3647,10 +3597,10 @@ function linksOnTheWay(path) {
     const part = rest.shift();
     if (!part || part === ".") continue;
     if (part === "..") {
-      at = dirname6(at);
+      at = dirname5(at);
       continue;
     }
-    const next = join9(at, part);
+    const next = join8(at, part);
     const target = hops < 40 ? readLink(next) : null;
     if (target === null) {
       at = next;
@@ -3671,7 +3621,7 @@ function recordPreviewRead(projectDir, filePath) {
   if (!reads) readsByProject.set(key, reads = /* @__PURE__ */ new Set());
   const read = inRealProject(projectDir, filePath);
   for (const found of [read, ...linksOnTheWay(read)]) {
-    for (let path = pathKey(found); !reads.has(path); path = dirname6(path)) reads.add(path);
+    for (let path = pathKey(found); !reads.has(path); path = dirname5(path)) reads.add(path);
   }
 }
 function recordPreviewReferences(projectDir, html) {
@@ -3740,7 +3690,7 @@ function injectProjectSignature(html, signature) {
 ${html}`;
 }
 function readStudioMotionManifestContent(projectDir) {
-  const manifestPath = join10(projectDir, STUDIO_MOTION_PATH);
+  const manifestPath = join9(projectDir, STUDIO_MOTION_PATH);
   if (!existsSync5(manifestPath)) return "";
   try {
     return readFileSync8(manifestPath, "utf-8");
@@ -3885,8 +3835,8 @@ async function transformPreviewHtml(html, adapter, project, activeCompositionPat
   }
 }
 function resolveProjectMainHtml(projectDir, projectId) {
-  const indexPath = join10(projectDir, "index.html");
-  const blockHtmlPath = join10(projectDir, `${projectId}.html`);
+  const indexPath = join9(projectDir, "index.html");
+  const blockHtmlPath = join9(projectDir, `${projectId}.html`);
   recordPreviewRead(projectDir, indexPath);
   recordPreviewRead(projectDir, blockHtmlPath);
   if (existsSync5(indexPath)) {
@@ -4040,7 +3990,7 @@ ${etag}`;
     if (vars.error !== void 0) return c.json({ error: vars.error }, 400);
     const previewVariables = vars.values;
     const compPath = requestSubPath(c.req.url, "projects/:id/preview/comp");
-    const compFile = resolveWithinProject2(project.dir, compPath);
+    const compFile = resolveWithinProject(project.dir, compPath);
     if (compFile) recordPreviewRead(project.dir, compFile);
     recordPreviewRead(project.dir, "index.html");
     if (!compFile || !existsSync5(compFile) || !statSync4(compFile).isFile()) {
@@ -4175,7 +4125,7 @@ ${etag}`;
 
 // src/routes/lint.ts
 import { readFileSync as readFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 async function collectProjectFindings(adapter, projectDir) {
   const findings = [];
   const coveredFiles = /* @__PURE__ */ new Set();
@@ -4193,7 +4143,7 @@ async function lintUncoveredHtml(adapter, projectDir, htmlFiles, coveredFiles) {
   const findings = [];
   for (const file of htmlFiles) {
     if (coveredFiles.has(file)) continue;
-    const content = readFileSync9(join11(projectDir, file), "utf-8");
+    const content = readFileSync9(join10(projectDir, file), "utf-8");
     const result = await adapter.lint(content, { filePath: file, isSubComposition: true });
     for (const finding of result?.findings ?? []) {
       findings.push({ ...finding, file });
@@ -4226,8 +4176,8 @@ function registerLintRoutes(api, adapter) {
 
 // src/routes/render.ts
 import { streamSSE } from "hono/streaming";
-import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync10, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+import { join as join11 } from "path";
 import { VALID_CANVAS_RESOLUTIONS } from "@hyperframes/parsers";
 import { formatRenderOutputTimestamp, parseFps } from "@hyperframes/core";
 var VALID_RESOLUTIONS = new Set(VALID_CANVAS_RESOLUTIONS);
@@ -4278,7 +4228,7 @@ function registerRenderRoutes(api, adapter) {
     const outputResolution = VALID_RESOLUTIONS.has(body.resolution ?? "") ? body.resolution : void 0;
     let composition;
     if (typeof body.composition === "string" && body.composition.length > 0) {
-      if (!resolveWithinProject2(project.dir, body.composition)) {
+      if (!resolveWithinProject(project.dir, body.composition)) {
         return c.json({ error: "composition path must be within the project directory" }, 400);
       }
       composition = body.composition;
@@ -4295,7 +4245,7 @@ function registerRenderRoutes(api, adapter) {
     const rendersDir = adapter.rendersDir(project);
     if (!existsSync6(rendersDir)) mkdirSync5(rendersDir, { recursive: true });
     const ext = FORMAT_EXT[format] ?? ".mp4";
-    const outputPath = join12(rendersDir, `${jobId}${ext}`);
+    const outputPath = join11(rendersDir, `${jobId}${ext}`);
     const jobState = adapter.startRender({
       project,
       outputPath,
@@ -4396,7 +4346,7 @@ function registerRenderRoutes(api, adapter) {
       if (state.id === jobId && state.outputPath) {
         const dir = state.outputPath.replace(/\/[^/]+$/, "");
         for (const ext of [".mp4", ".webm", ".mov", ".meta.json"]) {
-          const fp = join12(dir, `${jobId}${ext}`);
+          const fp = join11(dir, `${jobId}${ext}`);
           if (existsSync6(fp)) unlinkSync3(fp);
         }
         break;
@@ -4411,7 +4361,7 @@ function registerRenderRoutes(api, adapter) {
     const filename = c.req.path.split("/renders/file/")[1];
     if (!filename) return c.json({ error: "missing filename" }, 400);
     const rendersDir = adapter.rendersDir(project);
-    const fp = resolveWithinProject2(rendersDir, filename);
+    const fp = resolveWithinProject(rendersDir, filename);
     if (!fp) return c.json({ error: "forbidden" }, 403);
     if (!existsSync6(fp)) return c.json({ error: "not found" }, 404);
     const contentType = renderContentType(fp);
@@ -4430,11 +4380,11 @@ function registerRenderRoutes(api, adapter) {
     if (!project) return c.json({ error: "not found" }, 404);
     const rendersDir = adapter.rendersDir(project);
     if (!existsSync6(rendersDir)) return c.json({ renders: [] });
-    const files = readdirSync5(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
-      const fp = join12(rendersDir, f);
+    const files = readdirSync4(rendersDir).filter((f) => f.endsWith(".mp4") || f.endsWith(".webm") || f.endsWith(".mov")).map((f) => {
+      const fp = join11(rendersDir, f);
       const stat3 = statSync5(fp);
       const rid = f.replace(/\.(mp4|webm|mov)$/, "");
-      const metaPath = join12(rendersDir, `${rid}.meta.json`);
+      const metaPath = join11(rendersDir, `${rid}.meta.json`);
       let status = "complete";
       let durationMs;
       if (existsSync6(metaPath)) {
@@ -4460,7 +4410,7 @@ function registerRenderRoutes(api, adapter) {
           id: file.id,
           status: file.status,
           progress: 100,
-          outputPath: join12(rendersDir, file.filename),
+          outputPath: join11(rendersDir, file.filename),
           createdAt: file.createdAt
         });
       }
@@ -4608,14 +4558,14 @@ async function generateThumbnail(path, signal) {
 async function resolveSource(adapter, id, url) {
   const project = await adapter.resolveProject(id);
   if (!project) throw new HTTPException(404);
-  let relative7;
+  let relative6;
   try {
-    relative7 = requestSubPath(url, "projects/:id/image-thumbnail");
+    relative6 = requestSubPath(url, "projects/:id/image-thumbnail");
   } catch {
     throw new HTTPException(400);
   }
-  if (!/\.jpe?g$/i.test(relative7)) throw new HTTPException(415);
-  const path = pinWithinProject(project.dir, relative7);
+  if (!/\.jpe?g$/i.test(relative6)) throw new HTTPException(415);
+  const path = pinWithinProject(project.dir, relative6);
   if (!path) throw new HTTPException(404);
   const info = await stat(path).catch(() => {
     throw new HTTPException(404);
@@ -4676,14 +4626,14 @@ import {
   openSync as openSync3,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync12,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync5,
   renameSync as renameSync3,
   rmSync as rmSync4,
   statSync as statSync6,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join13 } from "path";
+import { join as join12 } from "path";
 import { createHash as createHash6, randomUUID as randomUUID4 } from "crypto";
 
 // src/helpers/compositionInputs.ts
@@ -4694,7 +4644,7 @@ function projectReader(projectDir) {
   const sources = /* @__PURE__ */ new Map();
   return (compPath) => {
     if (!sources.has(compPath)) {
-      const file = resolveWithinProject2(projectDir, compPath);
+      const file = resolveWithinProject(projectDir, compPath);
       let source = null;
       try {
         source = file ? readFileSync11(file, "utf-8") : null;
@@ -4753,14 +4703,14 @@ var prunedCacheDirs = /* @__PURE__ */ new Set();
 function pruneThumbnailCache(cacheDir, protectedPaths, now = Date.now()) {
   let entries;
   try {
-    entries = readdirSync6(cacheDir, { withFileTypes: true });
+    entries = readdirSync5(cacheDir, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
   }
   const files = entries.flatMap((entry) => {
     if (!entry.isFile()) return [];
-    const path = join13(cacheDir, entry.name);
+    const path = join12(cacheDir, entry.name);
     try {
       const stats = statSync6(path);
       return [{ path, bytes: stats.size, mtimeMs: stats.mtimeMs }];
@@ -4830,7 +4780,7 @@ function registerThumbnailRoutes(api, adapter) {
     const { project, signature: projectSignature } = resolved;
     let compPath = requestSubPath(c.req.url, "projects/:id/thumbnail");
     if (compPath && !compPath.includes(".")) compPath += ".html";
-    const htmlFile = resolveWithinProject2(project.dir, compPath);
+    const htmlFile = resolveWithinProject(project.dir, compPath);
     const source = htmlFile ? readFileOnce(htmlFile) : "not-a-file";
     if (source === "not-a-file") return c.json({ error: "not found" }, 404);
     const inputSignature = compositionInputSignature(project.dir, compPath, projectSignature);
@@ -4863,12 +4813,12 @@ function registerThumbnailRoutes(api, adapter) {
         if (hMatch?.[1]) compH = parseInt(hMatch[1]);
       }
     }
-    const manualEdits = manifestKey(join13(project.dir, STUDIO_MANUAL_EDITS_PATH));
-    const motion = manifestKey(join13(project.dir, STUDIO_MOTION_PATH));
+    const manualEdits = manifestKey(join12(project.dir, STUDIO_MANUAL_EDITS_PATH));
+    const motion = manifestKey(join12(project.dir, STUDIO_MOTION_PATH));
     sourceMtime = Math.max(sourceMtime, manualEdits.mtimeMs, motion.mtimeMs);
     const projectUrl = `http://${c.req.header("host")}/api/projects/${encodeURIComponent(project.id)}`;
     const previewUrl = compPath === "index.html" ? `${projectUrl}/preview` : `${projectUrl}/preview/comp/${compPath.split("/").map(encodeURIComponent).join("/")}`;
-    const cacheDir = join13(project.dir, ".thumbnails");
+    const cacheDir = join12(project.dir, ".thumbnails");
     const selectorKey = selector ? `_${selector.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 80)}_${selectorIndex ?? 0}` : "";
     const urlVersionKey = urlVersion ? `_${urlVersion.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32)}` : "";
     const inputSignatureKey = `_${createHash6("sha1").update(inputSignature).digest("hex").slice(0, 16)}`;
@@ -4876,7 +4826,7 @@ function registerThumbnailRoutes(api, adapter) {
     const outputWidth = Math.max(1, Math.round(compW * outputScale));
     const outputHeight = Math.max(1, Math.round(compH * outputScale));
     const cacheKey = `${THUMBNAIL_CACHE_VERSION}${urlVersionKey}${inputSignatureKey}${manualEdits.key}${motion.key}${sourceKey}_${format}_${outputMode}_${compPath.replace(/\//g, "_")}_${compW}x${compH}_${outputWidth}x${outputHeight}_${sourceMtime}_${seekTime.toFixed(2)}${selectorKey}.${format === "png" ? "png" : "jpg"}`;
-    const cachePath = join13(cacheDir, cacheKey);
+    const cachePath = join12(cacheDir, cacheKey);
     if (!prunedCacheDirs.has(cacheDir)) {
       prunedCacheDirs.add(cacheDir);
       pruneThumbnailCache(
@@ -4943,7 +4893,7 @@ function registerThumbnailRoutes(api, adapter) {
 
 // src/routes/waveform.ts
 import { existsSync as existsSync7, readFileSync as readFileSync13, statSync as statSync7 } from "fs";
-import { join as join14, resolve as resolve6 } from "path";
+import { join as join13, resolve as resolve6 } from "path";
 import { isWithinProjectRoot as isWithinProjectRoot2 } from "@hyperframes/parsers/asset-resolution";
 function registerWaveformRoutes(api, adapter) {
   api.get("/projects/:id/waveform/*", async (c) => {
@@ -4956,8 +4906,8 @@ function registerWaveformRoutes(api, adapter) {
     }
     const stats = statSync7(audioPath, { throwIfNoEntry: false });
     if (!stats) return c.json({ error: "file not found" }, 404);
-    const cacheDir = join14(project.dir, ".waveform-cache");
-    const cachePath = join14(cacheDir, buildWaveformCacheKey(assetPath, stats));
+    const cacheDir = join13(project.dir, ".waveform-cache");
+    const cachePath = join13(cacheDir, buildWaveformCacheKey(assetPath, stats));
     try {
       if (isWaveformCacheDirectory(cacheDir) && existsSync7(cachePath)) {
         const peaks2 = JSON.parse(readFileSync13(cachePath, "utf-8"));
@@ -5244,7 +5194,7 @@ function registerSelectionRoutes(api, adapter) {
 // src/routes/media.ts
 import { streamSSE as streamSSE2 } from "hono/streaming";
 import { existsSync as existsSync8, mkdirSync as mkdirSync7 } from "fs";
-import { basename as basename3, dirname as dirname7, extname as extname2, join as join15 } from "path";
+import { basename as basename2, dirname as dirname6, extname as extname2, join as join14 } from "path";
 var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov",
@@ -5274,14 +5224,14 @@ function containsNullByte(path) {
   return path.includes("\0");
 }
 function slugFileBase(path) {
-  const name = basename3(path, extname2(path)).replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  const name = basename2(path, extname2(path)).replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
   return name || "media";
 }
 function uniqueAssetPath(projectDir, assetPath) {
   const ext = extname2(assetPath);
   const withoutExt = assetPath.slice(0, -ext.length);
   let candidate = assetPath;
-  for (let index = 2; existsSync8(join15(projectDir, candidate)); index++) {
+  for (let index = 2; existsSync8(join14(projectDir, candidate)); index++) {
     candidate = `${withoutExt}-${index}${ext}`;
   }
   return candidate;
@@ -5330,7 +5280,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
     if (/^(?:https?:|data:|blob:)/i.test(assetPath)) {
       return c.json({ error: "media metadata requires a project-local asset" }, 400);
     }
-    const filePath = resolveWithinProject2(project.dir, assetPath);
+    const filePath = resolveWithinProject(project.dir, assetPath);
     if (!filePath) return c.json({ error: "forbidden" }, 403);
     if (!existsSync8(filePath)) return c.json({ error: "media not found" }, 404);
     return c.json({ path: assetPath, metadata: await readMediaMetadata(filePath) });
@@ -5352,7 +5302,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (/^(?:https?:|data:|blob:)/i.test(inputAssetPath)) {
         return c.json({ error: "background removal requires a project-local media asset" }, 400);
       }
-      const inputPath = resolveWithinProject2(project.dir, inputAssetPath);
+      const inputPath = resolveWithinProject(project.dir, inputAssetPath);
       if (!inputPath) return c.json({ error: "forbidden" }, 403);
       if (!existsSync8(inputPath)) return c.json({ error: "input media not found" }, 404);
       const inputIsVideo = isVideoPath(inputAssetPath);
@@ -5364,11 +5314,11 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (requestedOutput && containsNullByte(requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
-      if (requestedOutput && !resolveWithinProject2(project.dir, requestedOutput)) {
+      if (requestedOutput && !resolveWithinProject(project.dir, requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
       const outputAssetPath = requestedOutput ? uniqueAssetPath(project.dir, requestedOutput) : defaultOutputPath(project.dir, inputAssetPath);
-      const outputPath = resolveWithinProject2(project.dir, outputAssetPath);
+      const outputPath = resolveWithinProject(project.dir, outputAssetPath);
       if (!outputPath) return c.json({ error: "forbidden" }, 403);
       if (inputIsVideo && !VIDEO_OUTPUT_EXTENSIONS.has(extname2(outputAssetPath).toLowerCase())) {
         return c.json({ error: "video background removal output must be .webm or .mov" }, 400);
@@ -5383,13 +5333,13 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "background plates are only supported for video inputs" }, 400);
         }
         backgroundOutputAssetPath = defaultPlatePath(project.dir, inputAssetPath);
-        backgroundOutputPath = resolveWithinProject2(project.dir, backgroundOutputAssetPath) ?? void 0;
+        backgroundOutputPath = resolveWithinProject(project.dir, backgroundOutputAssetPath) ?? void 0;
         if (!backgroundOutputPath) {
           return c.json({ error: "forbidden" }, 403);
         }
       }
-      mkdirSync7(dirname7(outputPath), { recursive: true });
-      if (backgroundOutputPath) mkdirSync7(dirname7(backgroundOutputPath), { recursive: true });
+      mkdirSync7(dirname6(outputPath), { recursive: true });
+      if (backgroundOutputPath) mkdirSync7(dirname6(backgroundOutputPath), { recursive: true });
       const jobId = makeJobId(project.id, mediaJobs);
       const state = adapter.startBackgroundRemoval({
         project,
@@ -5448,9 +5398,9 @@ function registerMediaRoutes(api, adapter, options = {}) {
 // src/routes/globalAssets.ts
 import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
 import { homedir } from "os";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 function readGlobalAssets(home = homedir()) {
-  const manifestPath = join16(home, ".media", "manifest.jsonl");
+  const manifestPath = join15(home, ".media", "manifest.jsonl");
   if (!existsSync9(manifestPath)) return [];
   const out = [];
   for (const line of readFileSync14(manifestPath, "utf8").split("\n")) {
@@ -5478,19 +5428,19 @@ import {
   lstatSync as lstatSync4,
   statSync as statSync9,
   mkdirSync as mkdirSync11,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync18,
-  realpathSync as realpathSync3,
+  realpathSync,
   rmSync as rmSync6
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname10, isAbsolute as isAbsolute3, join as join20, relative as relative6, resolve as resolve8, sep as sep4 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute2, join as join19, relative as relative5, resolve as resolve8, sep as sep3 } from "path";
 
 // src/history/blobStore.ts
 import { createHash as createHash7, randomUUID as randomUUID5 } from "crypto";
 import { constants as constants3, createReadStream as createReadStream2, renameSync as renameSync4 } from "fs";
 import { copyFile, mkdir, readdir, readFile as readFile2, rename, rm, stat as stat2 } from "fs/promises";
-import { dirname as dirname8, join as join17 } from "path";
+import { dirname as dirname7, join as join16 } from "path";
 var BLOB_HASH = /^[0-9a-f]{64}$/;
 async function hashFile(path) {
   const hash = createHash7("sha256");
@@ -5498,7 +5448,7 @@ async function hashFile(path) {
   return hash.digest("hex");
 }
 async function cloneOrCopy(from, to, beforeReplace) {
-  await mkdir(dirname8(to), { recursive: true });
+  await mkdir(dirname7(to), { recursive: true });
   const temp = `${to}.${randomUUID5()}.tmp`;
   try {
     await copyFile(from, temp, constants3.COPYFILE_FICLONE);
@@ -5513,16 +5463,16 @@ async function openBlobStore(dir) {
   const sizes = /* @__PURE__ */ new Map();
   await mkdir(dir, { recursive: true });
   for (const shard of await readdir(dir))
-    for (const hash of await readdir(join17(dir, shard)).catch(() => []))
-      sizes.set(hash, (await stat2(join17(dir, shard, hash))).size);
+    for (const hash of await readdir(join16(dir, shard)).catch(() => []))
+      sizes.set(hash, (await stat2(join16(dir, shard, hash))).size);
   const pathOf = (hash) => {
     if (!BLOB_HASH.test(hash)) throw new Error("That is not a history blob.");
-    return join17(dir, hash.slice(0, 2), hash);
+    return join16(dir, hash.slice(0, 2), hash);
   };
   let total = [...sizes.values()].reduce((sum, size) => sum + size, 0);
   return {
     async put(absPath) {
-      const temp = join17(dir, `incoming-${randomUUID5()}`);
+      const temp = join16(dir, `incoming-${randomUUID5()}`);
       await mkdir(dir, { recursive: true });
       await copyFile(absPath, temp, constants3.COPYFILE_FICLONE);
       const hash = await hashFile(temp);
@@ -5530,7 +5480,7 @@ async function openBlobStore(dir) {
         await rm(temp, { force: true });
         return hash;
       }
-      await mkdir(dirname8(pathOf(hash)), { recursive: true });
+      await mkdir(dirname7(pathOf(hash)), { recursive: true });
       const size = (await stat2(temp)).size;
       await rename(temp, pathOf(hash));
       sizes.set(hash, size);
@@ -5556,12 +5506,12 @@ async function openBlobStore(dir) {
 // src/history/historyId.ts
 import { randomUUID as randomUUID6 } from "crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync15, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join18, resolve as resolve7 } from "path";
-var ID_PATH = join18(".hyperframes", "history-id");
+import { basename as basename3, join as join17, resolve as resolve7 } from "path";
+var ID_PATH = join17(".hyperframes", "history-id");
 var ID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function readId(projectDir) {
   try {
-    const id = readFileSync15(join18(projectDir, ID_PATH), "utf-8").trim();
+    const id = readFileSync15(join17(projectDir, ID_PATH), "utf-8").trim();
     return ID_SHAPE.test(id) ? id : null;
   } catch {
     return null;
@@ -5569,36 +5519,62 @@ function readId(projectDir) {
 }
 var sameFolder = (a, b) => a.ino === b.ino && a.birthtimeMs === b.birthtimeMs;
 function isRecordedFolder(historyDir, folder) {
+  const was = readRecord(historyDir);
+  if (typeof was?.ino === "number")
+    return sameFolder({ ino: was.ino, birthtimeMs: was.born ?? NaN }, folder);
+  const unreadableSo0878KeptTheId = typeof was?.dir !== "string";
+  if (unreadableSo0878KeptTheId) return true;
+  return !isCopyOf0878Folder(was.dir, basename3(historyDir), folder);
+}
+function readRecord(historyDir) {
   try {
-    const was = JSON.parse(readFileSync15(join18(historyDir, "project.json"), "utf-8"));
-    return sameFolder({ ino: was.ino, birthtimeMs: was.born }, folder);
+    return JSON.parse(readFileSync15(join17(historyDir, "project.json"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function isCopyOf0878Folder(recordedDir, id, folder) {
+  let there;
+  try {
+    there = statSync8(recordedDir, { throwIfNoEntry: false });
   } catch {
     return false;
   }
+  return !!there && !sameFolder(there, folder) && readId(recordedDir) === id;
 }
 function projectHistoryId(projectDir, historyRoot) {
   const dir = resolve7(projectDir);
   const folder = statSync8(dir);
   let id = readId(dir);
-  if (!id || existsSync10(join18(historyRoot, id)) && !isRecordedFolder(join18(historyRoot, id), folder)) {
+  if (!id && existsSync10(join17(dir, ID_PATH)))
+    throw new HistoryIdError(
+      `${join17(dir, ID_PATH)} holds no history id this version can read; move it aside to start anew.`
+    );
+  if (!id || existsSync10(join17(historyRoot, id)) && !isRecordedFolder(join17(historyRoot, id), folder)) {
     id = randomUUID6();
-    mkdirSync8(join18(dir, ".hyperframes"), { recursive: true });
-    writeFileSync7(join18(dir, ID_PATH), `${id}
+    mkdirSync8(join17(dir, ".hyperframes"), { recursive: true });
+    writeFileSync7(join17(dir, ID_PATH), `${id}
 `);
   }
-  recordProject(join18(historyRoot, id), dir, folder);
+  recordProject(join17(historyRoot, id), dir, folder);
   return id;
 }
+var HistoryIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HistoryIdError";
+  }
+};
 function recordProject(historyDir, dir, folder) {
   const record = { dir, ino: folder.ino, born: folder.birthtimeMs };
   mkdirSync8(historyDir, { recursive: true });
-  replaceFileAtomically(join18(historyDir, "project.json"), JSON.stringify(record), 420);
+  replaceFileAtomically(join17(historyDir, "project.json"), JSON.stringify(record), 420);
 }
 
 // src/history/ownerLock.ts
 import { randomUUID as randomUUID7 } from "crypto";
 import { linkSync, mkdirSync as mkdirSync9, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join19 } from "path";
+import { join as join18 } from "path";
 var HistoryBusyError = class extends Error {
   constructor(pid) {
     super(`This project's history is open in another process (pid ${pid}).`);
@@ -5657,7 +5633,7 @@ function evictDeadOwner(file) {
   }
 }
 async function takeHistoryOwnership(home, waitMs) {
-  const file = join19(home, "owner.pid");
+  const file = join18(home, "owner.pid");
   const deadline = Date.now() + waitMs;
   mkdirSync9(home, { recursive: true });
   for (; ; ) {
@@ -5678,7 +5654,7 @@ async function takeHistoryOwnership(home, waitMs) {
 
 // src/history/historyLog.ts
 import { closeSync as closeSync5, constants as constants4, mkdirSync as mkdirSync10, openSync as openSync5, readFileSync as readFileSync17, writeSync as writeSync2 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname8 } from "path";
 var START = "start";
 function parseRecord(line) {
   try {
@@ -5730,7 +5706,7 @@ function writeLog(file, log) {
     ...log.entries.map((entry) => ({ type: "entry", entry })),
     ...[...log.pins].map((id) => ({ type: "pin", id, pinned: true }))
   ];
-  mkdirSync10(dirname9(file), { recursive: true });
+  mkdirSync10(dirname8(file), { recursive: true });
   replaceFileAtomically(file, records.map((r) => `${JSON.stringify(r)}
 `).join(""), 420);
 }
@@ -5803,7 +5779,7 @@ function referencedHashes(log, current) {
 }
 
 // src/history/projectHistory.ts
-var DEFAULT_HISTORY_ROOT = join20(homedir2(), ".cache", "hyperframes", "history");
+var DEFAULT_HISTORY_ROOT = join19(homedir2(), ".cache", "hyperframes", "history");
 var MAX_WINDOW_IDLE_MS = 10 * 6e4;
 var UNDO_MODES = ["just-this", "back-to-before", "keep-later-edits"];
 var OUTSIDE = { kind: "outside", name: "Outside" };
@@ -5829,20 +5805,20 @@ async function removeEmptyFolders(dir) {
     throw error;
   }
   for (const entry of entries)
-    if (entry.isDirectory()) await removeEmptyFolders(join20(dir, entry.name));
+    if (entry.isDirectory()) await removeEmptyFolders(join19(dir, entry.name));
   await rmdir(dir);
 }
 function fileLeftIn(dir, at, deleted) {
-  for (const entry of readdirSync7(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
     const path = `${at}/${entry.name}`;
-    const left = entry.isDirectory() ? fileLeftIn(join20(dir, entry.name), path, deleted) : deleted.has(path) ? void 0 : path;
+    const left = entry.isDirectory() ? fileLeftIn(join19(dir, entry.name), path, deleted) : deleted.has(path) ? void 0 : path;
     if (left) return left;
   }
   return void 0;
 }
 function ignoresCase(dir) {
-  const self = statSync9(join20(dir, ID_PATH), { throwIfNoEntry: false });
-  const other = statSync9(join20(dir, ID_PATH.toUpperCase()), { throwIfNoEntry: false });
+  const self = statSync9(join19(dir, ID_PATH), { throwIfNoEntry: false });
+  const other = statSync9(join19(dir, ID_PATH.toUpperCase()), { throwIfNoEntry: false });
   return self !== void 0 && other?.ino === self.ino && other.dev === self.dev;
 }
 var blocks = (removed, added) => added.startsWith(`${removed}/`) || removed.startsWith(`${added}/`);
@@ -5859,7 +5835,7 @@ var Engine = class {
     this.projectId = projectId;
     this.blobs = blobs;
     this.dir = resolve8(options.projectDir);
-    this.home = join20(options.historyRoot, projectId);
+    this.home = join19(options.historyRoot, projectId);
     this.foldsCase = ignoresCase(this.dir);
     const folder = statSync9(this.dir, { throwIfNoEntry: false });
     if (!folder || readId(this.dir) !== projectId || !isRecordedFolder(this.home, folder))
@@ -5892,7 +5868,7 @@ var Engine = class {
     return this.foldsCase ? path.toLowerCase() : path;
   }
   get logFile() {
-    return join20(this.home, "log.jsonl");
+    return join19(this.home, "log.jsonl");
   }
   now() {
     return (this.options.now ?? Date.now)();
@@ -5920,7 +5896,7 @@ var Engine = class {
   persistLog(record) {
     if (record) saveRecord(this.logFile, this.log, record);
     else writeLog(this.logFile, this.log);
-    if (!existsSync11(join20(this.home, "project.json")))
+    if (!existsSync11(join19(this.home, "project.json")))
       recordProject(this.home, this.dir, this.folder);
   }
   replaced() {
@@ -5970,7 +5946,7 @@ var Engine = class {
   }
   readStatCache() {
     try {
-      const files = JSON.parse(readFileSync18(join20(this.home, "stat.json"), "utf-8"));
+      const files = JSON.parse(readFileSync18(join19(this.home, "stat.json"), "utf-8"));
       return new Map(Object.entries(files));
     } catch {
       return /* @__PURE__ */ new Map();
@@ -5979,7 +5955,7 @@ var Engine = class {
   saveStatCache() {
     const files = JSON.stringify(Object.fromEntries(this.tracked));
     mkdirSync11(this.home, { recursive: true });
-    replaceFileAtomically(join20(this.home, "stat.json"), files, 420);
+    replaceFileAtomically(join19(this.home, "stat.json"), files, 420);
   }
   /**
    * Takes in every write since the last sweep and files each change to its writer. ponytail: always the whole
@@ -6019,7 +5995,7 @@ var Engine = class {
   /** The file's hash once copied in; null when it was removed before the copy (the next sweep records that). */
   async storeIfPresent(path) {
     try {
-      return await this.blobs.put(join20(this.dir, path));
+      return await this.blobs.put(join19(this.dir, path));
     } catch (error) {
       if (error.code === "ENOENT") return null;
       throw error;
@@ -6082,7 +6058,7 @@ var Engine = class {
     return group && taken.every((change) => after(change.path, change.before) === change.before) && [...group.changes.values()].every(untouched) ? group : null;
   }
   logPath(path) {
-    return relative6(this.dir, resolve8(this.dir, path)).split(sep4).join("/");
+    return relative5(this.dir, resolve8(this.dir, path)).split(sep3).join("/");
   }
   /** Takes `paths`' uncommitted changes from others, cut at what `who` overwrote. */
   async takeClaimed(who, paths, overwrote) {
@@ -6106,7 +6082,7 @@ var Engine = class {
     }
     hits.forEach(
       ({ change }, i) => forgetOverwrittenBytes(
-        join20(this.dir, change.path),
+        join19(this.dir, change.path),
         new Set([...walked[i]].map(hashVersion))
       )
     );
@@ -6114,7 +6090,7 @@ var Engine = class {
   }
   /** Walks the server's writes back from `change.after` to the bytes they replaced, stored so an undo restores them. */
   async overwrittenBy(change, told, seen) {
-    const absPath = join20(this.dir, change.path);
+    const absPath = join19(this.dir, change.path);
     let bytes;
     for (let hash = change.after; hash; ) {
       if (seen.has(hash)) return void 0;
@@ -6126,7 +6102,7 @@ var Engine = class {
       if (hash === change.before || hash === told) return hash;
     }
     if (bytes === void 0) return void 0;
-    const staged = join20(this.home, `overwrote-${randomUUID8()}`);
+    const staged = join19(this.home, `overwrote-${randomUUID8()}`);
     await writeFile(staged, bytes);
     try {
       return await this.blobs.put(staged);
@@ -6148,6 +6124,7 @@ var Engine = class {
       part.changes.set(path, window.changes.get(path));
       window.changes.delete(path);
     }
+    (window.parts ??= /* @__PURE__ */ new Set()).add(part.id);
     window.entry = await this.commit(part);
   }
   holdClaim(group, key, idleMs = this.options.quietMs ?? 2e3) {
@@ -6297,7 +6274,7 @@ var Engine = class {
     const parts = path.split("/");
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const at = parts.slice(0, depth).join("/");
-      const stat3 = lstatSync4(join20(this.dir, at), { throwIfNoEntry: false });
+      const stat3 = lstatSync4(join19(this.dir, at), { throwIfNoEntry: false });
       if (!stat3) return void 0;
       if (at === path || !stat3.isDirectory()) return { at, stat: stat3 };
     }
@@ -6309,8 +6286,8 @@ var Engine = class {
     if (!standing) return void 0;
     if (standing.stat.isSymbolicLink()) return standing.at;
     if (standing.at === path && !standing.stat.isDirectory()) return void 0;
-    const real = realpathSync3.native(join20(this.dir, standing.at));
-    const at = relative6(realpathSync3.native(this.dir), real).split(sep4).join("/");
+    const real = realpathSync.native(join19(this.dir, standing.at));
+    const at = relative5(realpathSync.native(this.dir), real).split(sep3).join("/");
     if (standing.at !== path) return deleted.has(at) ? void 0 : at;
     return fileLeftIn(real, at, deleted);
   }
@@ -6334,7 +6311,7 @@ var Engine = class {
   /** Writes one project file (null deletes it), first leaving the running operation's receipt for its echo. */
   async writeProjectFile(path, hash) {
     this.assertWritable();
-    const absPath = join20(this.dir, path);
+    const absPath = join19(this.dir, path);
     const { writeToken } = this;
     if (writeToken) {
       const version = hash === null ? DELETED_VERSION : hashVersion(hash);
@@ -6387,7 +6364,13 @@ var Engine = class {
       (group) => group?.changes.size && mine(group.who)
     );
     if (pending) return direction === "back" ? this.pendingEntry(pending) : void 0;
-    return stepTarget(this.log.entries, direction, (entry) => mine(entry.who));
+    const everyone = this.options.undoScope === "everyone";
+    const ofOpenTurn = (entry) => this.windows.some((open2) => open2.parts?.has(entry.id));
+    return stepTarget(
+      this.log.entries,
+      direction,
+      (entry) => mine(entry.who) || everyone && !ofOpenTurn(entry)
+    );
   }
   /** A pending group as the entry it becomes once committed (a window's part gets a fresh id). */
   pendingEntry(group) {
@@ -6466,10 +6449,10 @@ var Engine = class {
           throw new Error(`Checkout writes into an empty folder only: ${dest}`);
         const files = manifestAround(this.log, entryId, side);
         try {
-          for (const [path, hash] of files) await this.blobs.writeTo(hash, join20(dest, path));
+          for (const [path, hash] of files) await this.blobs.writeTo(hash, join19(dest, path));
         } catch (error) {
           for (const name of await readdir2(dest).catch(() => []))
-            await rm2(join20(dest, name), { recursive: true, force: true });
+            await rm2(join19(dest, name), { recursive: true, force: true });
           throw error;
         }
       }),
@@ -6505,9 +6488,9 @@ var Engine = class {
 };
 function isWithin(dir, path) {
   let probe = resolve8(path);
-  while (!existsSync11(probe) && dirname10(probe) !== probe) probe = dirname10(probe);
-  const rel = relative6(realpathSync3.native(dir), realpathSync3.native(probe));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute3(rel);
+  while (!existsSync11(probe) && dirname9(probe) !== probe) probe = dirname9(probe);
+  const rel = relative5(realpathSync.native(dir), realpathSync.native(probe));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute2(rel);
 }
 function missingIsEmpty(error) {
   if (error.code === "ENOENT") return [];
@@ -6524,11 +6507,11 @@ async function openProjectHistory(options) {
     throw new HistoryClosedError(`${options.projectDir} is gone or now another project.`);
   const projectId = projectHistoryId(options.projectDir, options.historyRoot);
   const release = await takeHistoryOwnership(
-    join20(options.historyRoot, projectId),
+    join19(options.historyRoot, projectId),
     options.ownerWaitMs ?? 5e3
   );
   try {
-    const blobs = await openBlobStore(join20(options.historyRoot, projectId, "blobs"));
+    const blobs = await openBlobStore(join19(options.historyRoot, projectId, "blobs"));
     const engine = new Engine(options, projectId, blobs);
     await engine.queue(() => engine.start());
     const api = engine.api();
@@ -6777,10 +6760,10 @@ function numericAttribute(element, name) {
 
 // src/helpers/previewDocumentStore.ts
 import { createHash as createHash8 } from "crypto";
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync8, rmSync as rmSync7 } from "fs";
-import { join as join21 } from "path";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync7, rmSync as rmSync7 } from "fs";
+import { join as join20 } from "path";
 function createPreviewDocumentStore(dir, salt) {
-  const fileFor = (key) => join21(dir, `${createHash8("sha256").update(`${salt}
+  const fileFor = (key) => join20(dir, `${createHash8("sha256").update(`${salt}
 ${key}`).digest("hex").slice(0, 32)}.html`);
   return {
     read(key) {
@@ -6795,8 +6778,8 @@ ${key}`).digest("hex").slice(0, 32)}.html`);
         mkdirSync12(dir, { recursive: true });
         const file = fileFor(key);
         replaceFileAtomically(file, html, 420);
-        for (const name of readdirSync8(dir)) {
-          if (join21(dir, name) !== file) rmSync7(join21(dir, name), { force: true });
+        for (const name of readdirSync7(dir)) {
+          if (join20(dir, name) !== file) rmSync7(join20(dir, name), { force: true });
         }
       } catch {
       }
@@ -6877,6 +6860,7 @@ export {
   START as HISTORY_START,
   HistoryBusyError,
   HistoryClosedError,
+  HistoryIdError,
   MAX_WINDOW_IDLE_MS,
   MIME_TYPES,
   PREVIEW_BUNDLE_OPTIONS,