@remotion/studio-server 4.0.540 → 4.0.541

package/dist/preview-server/sequence-node-path-mutation-build.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trackSequenceNodePathMutationBuilds = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const file_watcher_1 = require("../file-watcher");
+const sequence_node_path_mutation_1 = require("./sequence-node-path-mutation");
+// Loader-runner and SWC remove a leading BOM before transforming a module.
+const sourceHash = (contents) => (0, node_crypto_1.createHash)('sha256')
+    .update(contents.replace(/^\uFEFF/, ''))
+    .digest('hex');
+const fastRefreshLoader = node_path_1.default.join(node_path_1.default.dirname(require.resolve('@remotion/bundler')), 'fast-refresh', 'loader.js');
+const compiledSourceHash = (module, file, context) => {
+    var _a, _b, _c, _d;
+    var _e, _f;
+    let map;
+    try {
+        map = (_a = module.originalSource()) === null || _a === void 0 ? void 0 : _a.map();
+    }
+    catch (_g) {
+        // An override can supply a size-only source without a readable map.
+        return null;
+    }
+    if (!map || ((_b = map.sources) === null || _b === void 0 ? void 0 : _b.length) !== 1)
+        return null;
+    const name = map.sources[0].replace(/^webpack:\/\//, '');
+    if (node_path_1.default.resolve(context, (_e = map.sourceRoot) !== null && _e !== void 0 ? _e : '', name) !== file)
+        return null;
+    const contents = (_c = map.sourcesContent) === null || _c === void 0 ? void 0 : _c[0];
+    if (typeof contents !== 'string')
+        return null;
+    if ('loaders' in module &&
+        module.loaders.some((loader) => loader.loader === fastRefreshLoader)) {
+        return ((_f = (_d = contents
+            .slice(-96)
+            .match(/\/\* remotion-source-sha256:([a-f0-9]{64}) \*\/\s*$/)) === null || _d === void 0 ? void 0 : _d[1]) !== null && _f !== void 0 ? _f : null);
+    }
+    return sourceHash(contents);
+};
+const trackSequenceNodePathMutationBuilds = (compiler) => {
+    let sourceMutationId = null;
+    const pending = [];
+    const files = new Map();
+    const writesThisTurn = new Map();
+    let order = 0;
+    let building = [];
+    const inputs = new Map();
+    let resourceHashes = new WeakMap();
+    const recordWrite = (state, contents) => {
+        state.hashes.set(sourceHash(contents), state.order);
+        state.written = state.order;
+    };
+    const unsubscribeWrites = (0, file_watcher_1.subscribeToStudioSourceWrites)((file, contents) => {
+        if (writesThisTurn.size === 0)
+            queueMicrotask(() => writesThisTurn.clear());
+        writesThisTurn.set(file, contents);
+        const state = files.get(file);
+        if (state)
+            recordWrite(state, contents);
+    });
+    const unsubscribeMutations = (0, sequence_node_path_mutation_1.subscribeToSequenceNodePathMutations)((mutation) => {
+        var _a;
+        var _b;
+        const affected = mutation.applyWithoutFastRefresh
+            ? []
+            : mutation.files.map(({ absolutePath }) => absolutePath);
+        const next = ++order;
+        if (affected.length === 0 && ((_a = pending.at(-1)) === null || _a === void 0 ? void 0 : _a.files.length) === 0)
+            pending.pop();
+        pending.push({ id: mutation.mutationId, order: next, files: affected });
+        for (const file of affected) {
+            const state = (_b = files.get(file)) !== null && _b !== void 0 ? _b : {
+                order: next,
+                written: 0,
+                compiled: 0,
+                hashes: new Map(),
+            };
+            state.order = next;
+            files.set(file, state);
+            // Precompose broadcasts after writing; most structural edits broadcast first.
+            const written = writesThisTurn.get(file);
+            if (written !== undefined)
+                queueMicrotask(() => {
+                    if (state.order === next && state.written !== next)
+                        recordWrite(state, written);
+                });
+        }
+    });
+    compiler.hooks.shutdown.tap('remotion-source-receipts', () => {
+        unsubscribeWrites();
+        unsubscribeMutations();
+    });
+    compiler.hooks.watchRun.tap('remotion-source-receipts', () => {
+        var _a;
+        var _b;
+        building = pending.slice();
+        inputs.clear();
+        resourceHashes = new WeakMap();
+        for (const [file, state] of files) {
+            const changed = (_b = (_a = compiler.modifiedFiles) === null || _a === void 0 ? void 0 : _a.has(file)) !== null && _b !== void 0 ? _b : false;
+            const hashes = new Map(state.hashes);
+            // External edits can supersede a Studio write before compilation begins.
+            if (changed && state.written === state.order) {
+                try {
+                    hashes.set(sourceHash((0, node_fs_1.readFileSync)(file, 'utf8')), state.order);
+                }
+                catch (_c) {
+                    // The resource can disappear between invalidation and compilation.
+                }
+            }
+            inputs.set(file, { ...state, changed, hashes, modules: [] });
+        }
+    });
+    compiler.hooks.thisCompilation.tap('remotion-source-receipts', (compilation) => {
+        if (inputs.size === 0)
+            return;
+        if (!('rspackVersion' in compiler.webpack)) {
+            // FileUriPlugin reads through Webpack's input cache. These exact bytes
+            // are available even when the project's loader omits its source map.
+            const { readResource } = compiler.webpack.NormalModule.getCompilationHooks(compilation);
+            readResource.for(undefined).intercept({
+                register(tap) {
+                    if (tap.name !== 'FileUriPlugin' || tap.type !== 'async')
+                        return tap;
+                    const read = tap.fn;
+                    return {
+                        ...tap,
+                        fn: (context, callback) => {
+                            const module = context._module;
+                            if (!module || !inputs.has(context.resourcePath))
+                                return read(context, callback);
+                            read(context, (error, value) => {
+                                if (!error && value !== null && value !== undefined)
+                                    resourceHashes.set(module, sourceHash(value.toString()));
+                                callback(error, value);
+                            });
+                        },
+                    };
+                },
+            });
+        }
+        compilation.hooks.succeedModule.tap('remotion-source-receipts', (module) => {
+            var _a;
+            const file = module.nameForCondition();
+            if (file !== null)
+                (_a = inputs.get(file)) === null || _a === void 0 ? void 0 : _a.modules.push(module);
+        });
+    });
+    return (statsResult) => {
+        var _a;
+        if (building.length > 0 && !statsResult.hasErrors()) {
+            const { compilation } = statsResult;
+            const covered = new Map();
+            const cached = new Set();
+            for (const [file, input] of inputs) {
+                if (input.modules.length === 0 &&
+                    input.changed &&
+                    compilation.fileDependencies.has(file))
+                    cached.add(file);
+            }
+            // A build can reuse a cached module when opposing writes restore its input.
+            if (cached.size > 0)
+                for (const module of compilation.modules) {
+                    const file = module.nameForCondition();
+                    if (file !== null && cached.has(file))
+                        (_a = inputs.get(file)) === null || _a === void 0 ? void 0 : _a.modules.push(module);
+                }
+            for (const [file, input] of inputs) {
+                if (input.modules.length === 0) {
+                    covered.set(file, compilation.fileDependencies.has(file)
+                        ? input.compiled
+                        : (0, node_fs_1.existsSync)(file)
+                            ? input.written
+                            : input.order);
+                    continue;
+                }
+                const revisions = input.modules.map((module) => {
+                    var _a, _b;
+                    const hash = (_a = resourceHashes.get(module)) !== null && _a !== void 0 ? _a : compiledSourceHash(module, file, compiler.context);
+                    if (hash !== null)
+                        return (_b = input.hashes.get(hash)) !== null && _b !== void 0 ? _b : 0;
+                    // An opaque override without either authored source signal retains
+                    // compatibility only for a directly modified, actually rebuilt target.
+                    return input.changed && !cached.has(file) ? input.written : 0;
+                });
+                covered.set(file, Math.min(...revisions));
+            }
+            for (const [file, revision] of covered) {
+                const state = files.get(file);
+                if (state)
+                    state.compiled = revision;
+            }
+            let confirmed = 0;
+            for (const mutation of building) {
+                if (!mutation.files.every((file) => { var _a; return ((_a = covered.get(file)) !== null && _a !== void 0 ? _a : 0) >= mutation.order; }))
+                    break;
+                sourceMutationId = mutation.id;
+                confirmed = mutation.order;
+            }
+            while (pending[0] && pending[0].order <= confirmed)
+                pending.shift();
+            if (confirmed > 0)
+                for (const [file, state] of files) {
+                    if (state.order <= confirmed)
+                        files.delete(file);
+                    else
+                        for (const [hash, revision] of state.hashes)
+                            if (revision <= confirmed)
+                                state.hashes.delete(hash);
+                }
+        }
+        building = [];
+        inputs.clear();
+        return sourceMutationId;
+    };
+};
+exports.trackSequenceNodePathMutationBuilds = trackSequenceNodePathMutationBuilds;

package/dist/preview-server/sequence-node-path-mutation.d.ts

@@ -1,5 +1,6 @@
 import type { SequenceNodePathMutation, SequenceNodePathRemapping } from '@remotion/studio-shared';
+export declare const subscribeToSequenceNodePathMutations: (listener: (mutation: SequenceNodePathMutation) => void) => () => void;
 export declare const broadcastSequenceNodePathMutation: (files: Array<{
     absolutePath: string;
     remappings: SequenceNodePathRemapping[];
-}>, timelineSelection: SequenceNodePathMutation['timelineSelection']) => SequenceNodePathMutation;
+}>, timelineSelection: SequenceNodePathMutation['timelineSelection'], applyWithoutFastRefresh?: boolean) => SequenceNodePathMutation;

package/dist/preview-server/sequence-node-path-mutation.js

@@ -1,15 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.broadcastSequenceNodePathMutation = void 0;
+exports.broadcastSequenceNodePathMutation = exports.subscribeToSequenceNodePathMutations = void 0;
 const node_crypto_1 = require("node:crypto");
 const live_events_1 = require("./live-events");
 const mutationSessionId = (0, node_crypto_1.randomUUID)();
 let mutationCounter = 0;
-const broadcastSequenceNodePathMutation = (files, timelineSelection) => {
+const listeners = new Set();
+const subscribeToSequenceNodePathMutations = (listener) => {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+};
+exports.subscribeToSequenceNodePathMutations = subscribeToSequenceNodePathMutations;
+const broadcastSequenceNodePathMutation = (files, timelineSelection, applyWithoutFastRefresh = false) => {
     var _a;
     mutationCounter++;
     const mutation = {
         mutationId: `${mutationSessionId}:${mutationCounter}`,
+        ...(applyWithoutFastRefresh ? { applyWithoutFastRefresh: true } : {}),
         timelineSelection,
         files,
     };
@@ -17,6 +26,9 @@ const broadcastSequenceNodePathMutation = (files, timelineSelection) => {
         type: 'sequence-node-paths-remapped',
         mutation,
     });
+    for (const listener of listeners) {
+        listener(mutation);
+    }
     return mutation;
 };
 exports.broadcastSequenceNodePathMutation = broadcastSequenceNodePathMutation;

package/dist/preview-server/sequence-props-watchers.d.ts

@@ -1,11 +1,12 @@
 import type { LogLevel } from '@remotion/renderer';
 import { type SubscribeToSequencePropsResponse } from '@remotion/studio-shared';
 import type { JsxComponentIdentity, SequenceNodePath } from 'remotion';
-export declare const subscribeToSequencePropsWatchers: ({ fileName, line, column, nodePath: preferredNodePath, resolvedNodePath, componentIdentity, keys, assetKeys, effects, remotionRoot, clientId, logLevel, fileContentsCache, }: {
+export declare const subscribeToSequencePropsWatchers: ({ fileName, line, column, nodePath: preferredNodePath, requireExactNodePath, resolvedNodePath, componentIdentity, keys, assetKeys, effects, remotionRoot, clientId, logLevel, fileContentsCache, }: {
     fileName: string;
     line: number;
     column: number;
     nodePath: SequenceNodePath | null;
+    requireExactNodePath: boolean;
     resolvedNodePath?: SequenceNodePath | null;
     componentIdentity: JsxComponentIdentity | null;
     keys: string[];

package/dist/preview-server/sequence-props-watchers.js

@@ -15,7 +15,7 @@ const node_path_cache_1 = require("./node-path-cache");
 const can_update_sequence_props_1 = require("./routes/can-update-sequence-props");
 const sequencePropsWatchers = {};
 const getWatcherKey = (nodePath, assetKeys) => `${(0, studio_shared_1.stringifySequenceSubscriptionKey)(nodePath)}:${assetKeys.join('\0')}`;
-const getSequencePropsStatus = ({ fileName, line, column, preferredNodePath, resolvedNodePath, componentIdentity, keys, assetKeys, effects, remotionRoot, logLevel, fileContentsCache, }) => {
+const getSequencePropsStatus = ({ fileName, line, column, preferredNodePath, requireExactNodePath, resolvedNodePath, componentIdentity, keys, assetKeys, effects, remotionRoot, logLevel, fileContentsCache, }) => {
     if (preferredNodePath) {
         try {
             const fromNodePath = (0, can_update_sequence_props_1.computeSequencePropsStatus)({
@@ -47,6 +47,9 @@ const getSequencePropsStatus = ({ fileName, line, column, preferredNodePath, res
             }
         }
     }
+    if (requireExactNodePath) {
+        return { success: false, status: { canUpdate: false, reason: 'not-found' } };
+    }
     // Try cached nodePath first (handles stale source maps after suppressed rebuilds)
     const cachedNodePath = (0, node_path_cache_1.getCachedNodePath)(fileName, line, column);
     if (cachedNodePath) {
@@ -129,13 +132,14 @@ const getSequencePropsStatus = ({ fileName, line, column, preferredNodePath, res
     });
     return status;
 };
-const subscribeToSequencePropsWatchers = ({ fileName, line, column, nodePath: preferredNodePath, resolvedNodePath = null, componentIdentity, keys, assetKeys, effects, remotionRoot, clientId, logLevel, fileContentsCache, }) => {
+const subscribeToSequencePropsWatchers = ({ fileName, line, column, nodePath: preferredNodePath, requireExactNodePath, resolvedNodePath = null, componentIdentity, keys, assetKeys, effects, remotionRoot, clientId, logLevel, fileContentsCache, }) => {
     var _a;
     const initialResult = getSequencePropsStatus({
         fileName,
         line,
         column,
         preferredNodePath,
+        requireExactNodePath,
         resolvedNodePath,
         componentIdentity,
         keys,

package/dist/preview-server/serve-static.js

@@ -89,6 +89,9 @@ const serveStatic = async function ({ root, path, req, res, allowOutsidePublicFo
     if (!hasRange) {
         res.setHeader('content-type', renderer_1.RenderInternals.mimeLookup(path) || 'application/octet-stream');
         res.setHeader('content-length', lstat.size);
+        if (req.method === 'HEAD') {
+            res.setHeader('x-remotion-file-mtime', lstat.mtimeMs);
+        }
         res.writeHead(200);
         if (req.method === 'HEAD') {
             res.end();

package/dist/preview-server/undo-stack.d.ts

@@ -4,7 +4,7 @@ export interface UndoEntryDescription {
     undoMessage: string;
     redoMessage: string;
 }
-type UndoEntryType = 'visual-control' | 'default-props' | 'sequence-props' | 'effect-props' | 'keyframe-add' | 'keyframe-delete' | 'add-effect' | 'delete-effect' | 'duplicate-effect' | 'paste-effects' | 'reorder-effect' | 'reorder-sequence' | 'delete-nodes' | 'duplicate-nodes' | 'wrap-node' | 'unwrap-node' | 'precompose-jsx-nodes' | 'split-sequences' | 'split-video-from-audio' | 'insert-basic-captions' | 'replace-video-source' | 'insert-composition-element' | 'delete-composition' | 'rename-composition' | 'update-composition-metadata' | 'new-composition' | 'duplicate-composition' | 'move-composition-or-folder' | 'new-folder' | 'delete-folder' | 'rename-folder';
+export type UndoEntryType = 'visual-control' | 'default-props' | 'sequence-props' | 'effect-props' | 'keyframe-add' | 'keyframe-delete' | 'add-effect' | 'delete-effect' | 'duplicate-effect' | 'paste-effects' | 'reorder-effect' | 'reorder-sequence' | 'delete-nodes' | 'duplicate-nodes' | 'wrap-node' | 'unwrap-node' | 'precompose-jsx-nodes' | 'split-sequences' | 'split-video-from-audio' | 'insert-basic-captions' | 'replace-video-source' | 'prerender' | 'restore-prerendered-scene' | 'insert-composition-element' | 'delete-composition' | 'rename-composition' | 'update-composition-metadata' | 'new-composition' | 'duplicate-composition' | 'move-composition-or-folder' | 'new-folder' | 'delete-folder' | 'rename-folder';
 type UndoEntrySnapshot = {
     filePath: string;
     oldContents: string | null;

package/dist/preview-server/undo-stack.js

@@ -281,11 +281,21 @@ function popUndo() {
                     ...(remapping.oldJsxName === undefined
                         ? {}
                         : { newJsxName: remapping.oldJsxName }),
+                    ...(remapping.sourceLocations
+                        ? {
+                            sourceLocations: {
+                                before: remapping.sourceLocations.after,
+                                after: remapping.sourceLocations.before,
+                            },
+                        }
+                        : {}),
                 })),
             },
         ];
     });
-    const nodePathMutation = files.length === 0 ? null : (0, sequence_node_path_mutation_1.broadcastSequenceNodePathMutation)(files, null);
+    const nodePathMutation = files.length === 0
+        ? null
+        : (0, sequence_node_path_mutation_1.broadcastSequenceNodePathMutation)(files, null, entry.suppressHmrOnFileRestore);
     for (const snapshot of entry.snapshots) {
         suppressUndoStackInvalidation(snapshot.filePath);
         if (entry.suppressHmrOnFileRestore) {
@@ -365,7 +375,9 @@ function popRedo() {
             },
         ];
     });
-    const nodePathMutation = files.length === 0 ? null : (0, sequence_node_path_mutation_1.broadcastSequenceNodePathMutation)(files, null);
+    const nodePathMutation = files.length === 0
+        ? null
+        : (0, sequence_node_path_mutation_1.broadcastSequenceNodePathMutation)(files, null, entry.suppressHmrOnFileRestore);
     for (const snapshot of snapshotsWithNewContents) {
         suppressUndoStackInvalidation(snapshot.filePath);
         if (entry.suppressHmrOnFileRestore) {

package/dist/preview-server/watch-ignore-next-change.d.ts

@@ -2,5 +2,5 @@ import type { WatchIgnoreNextChangePlugin } from '@remotion/bundler';
 export declare const setWatchIgnoreNextChangePlugin: (plugin: WatchIgnoreNextChangePlugin) => void;
 export declare const suppressBundlerUpdateForFile: (absolutePath: string) => void;
 export declare const prepareBundlerForFileWrite: (absolutePath: string) => void;
-export declare const invalidatePreviouslySuppressedFiles: () => Promise<boolean>;
+export declare const invalidatePreviouslySuppressedFiles: (onlyFile: string | null) => Promise<boolean>;
 export declare const reloadPreviouslySuppressedFiles: () => Promise<void>;

package/dist/preview-server/watch-ignore-next-change.js

@@ -24,11 +24,11 @@ const prepareBundlerForFileWrite = (absolutePath) => {
     }
 };
 exports.prepareBundlerForFileWrite = prepareBundlerForFileWrite;
-const invalidatePreviouslySuppressedFiles = async () => {
+const invalidatePreviouslySuppressedFiles = async (onlyFile) => {
     if (!currentPlugin) {
         return false;
     }
-    const files = currentPlugin.consumeSuppressedFilesForRebuild();
+    const files = currentPlugin.consumeSuppressedFilesForRebuild(onlyFile);
     const now = new Date();
     const touchedFiles = await Promise.all(files.map(async (file) => {
         try {
@@ -52,6 +52,6 @@ exports.invalidatePreviouslySuppressedFiles = invalidatePreviouslySuppressedFile
 //    The same happens again - infinite loop!
 // --> When reloading the Studio, it is a good idea to reset Webpack to a non-hacked state.
 const reloadPreviouslySuppressedFiles = async () => {
-    await (0, exports.invalidatePreviouslySuppressedFiles)();
+    await (0, exports.invalidatePreviouslySuppressedFiles)(null);
 };
 exports.reloadPreviouslySuppressedFiles = reloadPreviouslySuppressedFiles;

package/dist/routes.js

@@ -34,12 +34,15 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRoutes = void 0;
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importStar(require("node:path"));
+const promises_1 = require("node:stream/promises");
 const node_url_1 = require("node:url");
 const bundler_1 = require("@remotion/bundler");
 const renderer_1 = require("@remotion/renderer");
 const studio_shared_1 = require("@remotion/studio-shared");
+const remotion_1 = require("remotion");
 const better_opn_1 = require("./better-opn");
 const client_render_queue_1 = require("./client-render-queue");
 const get_file_source_1 = require("./helpers/get-file-source");
@@ -228,47 +231,87 @@ const handleAddAsset = ({ req, res, search, publicDir, }) => {
     }
     return Promise.resolve();
 };
-const handleUploadOutput = ({ req, res, search, remotionRoot, }) => {
+const validateOutputDestination = (rootDirectory, absolutePath) => {
+    (0, open_file_for_writing_without_symlinks_1.assertNoSymlinks)({ rootDirectory, absolutePath });
+    const existing = (0, node_fs_1.lstatSync)(absolutePath, { throwIfNoEntry: false });
+    if (existing && (!existing.isFile() || existing.nlink !== 1)) {
+        throw new Error('Not allowed to replace a non-regular or multiply linked output file');
+    }
+};
+const handleUploadOutput = async ({ req, res, search, remotionRoot, liveEventsServer, }) => {
     try {
+        if (req.method !== 'POST') {
+            res.setHeader('Allow', 'POST');
+            res.statusCode = 405;
+            res.end(JSON.stringify({ error: 'Output uploads require POST' }));
+            return;
+        }
         (0, validate_same_origin_1.validateSameOrigin)(req);
         const query = new node_url_1.URLSearchParams(search);
-        const filePath = query.get('filePath');
+        let filePath = query.get('filePath');
         if (typeof filePath !== 'string') {
             throw new Error('No `filePath` provided');
         }
+        const compositionId = query.get('artifactCompositionId');
+        if (compositionId !== null) {
+            if (!remotion_1.Internals.isCompositionIdValid(compositionId)) {
+                throw new Error('Invalid artifact composition ID');
+            }
+            (0, studio_shared_1.validateStudioArtifactFilename)(compositionId);
+            (0, studio_shared_1.validateStudioArtifactFilename)(filePath);
+            filePath = `out/${compositionId}/${filePath}`;
+            const outputName = query.get('outputName');
+            if (!outputName) {
+                throw new Error('No `outputName` provided for artifact upload');
+            }
+            const outputPath = (0, resolve_output_path_1.resolveOutputPath)(remotionRoot, outputName.replace(/\\/g, '/'));
+            const relativeOutput = node_path_1.default
+                .relative(remotionRoot, outputPath)
+                .split(node_path_1.default.sep)
+                .join('/');
+            (0, studio_shared_1.validateStudioArtifactFilename)(relativeOutput);
+            if ((0, studio_shared_1.getConflictingOutputPaths)([relativeOutput, filePath])) {
+                throw new Error('The artifact path conflicts with the main render output');
+            }
+        }
         const absolutePath = (0, resolve_output_path_1.resolveOutputPath)(remotionRoot, filePath);
-        const extension = node_path_1.default.extname(absolutePath).slice(1).toLowerCase();
-        if (!clientRenderOutputExtensions.has(extension)) {
-            throw new Error(`Not allowed to upload a .${extension || 'unknown'} file`);
+        if (compositionId === null) {
+            const extension = node_path_1.default.extname(absolutePath).slice(1).toLowerCase();
+            if (!clientRenderOutputExtensions.has(extension)) {
+                throw new Error(`Not allowed to upload a .${extension || 'unknown'} file`);
+            }
         }
+        validateOutputDestination(remotionRoot, absolutePath);
+        const temporaryPath = (0, node_path_1.join)(node_path_1.default.dirname(absolutePath), `.remotion-output-${(0, node_crypto_1.randomUUID)()}.tmp`);
         const fileDescriptor = (0, open_file_for_writing_without_symlinks_1.openFileForWritingWithoutSymlinks)({
             rootDirectory: remotionRoot,
-            absolutePath,
-            exclusive: false,
-        });
-        const writeStream = (0, node_fs_1.createWriteStream)(absolutePath, {
-            fd: fileDescriptor,
-            autoClose: true,
-        });
-        writeStream.on('close', () => {
-            res.end(JSON.stringify({ success: true }));
-        });
-        writeStream.on('error', (err) => {
-            res.statusCode = 500;
-            res.end(JSON.stringify({ error: err.message }));
+            absolutePath: temporaryPath,
+            exclusive: true,
         });
-        req.on('error', (err) => {
-            writeStream.destroy();
-            res.statusCode = 500;
-            res.end(JSON.stringify({ error: err.message }));
+        try {
+            await (0, promises_1.pipeline)(req, (0, node_fs_1.createWriteStream)(temporaryPath, { fd: fileDescriptor }));
+            validateOutputDestination(remotionRoot, temporaryPath);
+            validateOutputDestination(remotionRoot, absolutePath);
+            (0, node_fs_1.renameSync)(temporaryPath, absolutePath);
+        }
+        catch (err) {
+            (0, open_file_for_writing_without_symlinks_1.assertNoSymlinks)({
+                rootDirectory: remotionRoot,
+                absolutePath: temporaryPath,
+            });
+            (0, node_fs_1.rmSync)(temporaryPath, { force: true });
+            throw err;
+        }
+        liveEventsServer.sendEventToClient({
+            type: 'render-output-written',
+            path: filePath,
         });
-        req.pipe(writeStream);
+        res.end(JSON.stringify({ success: true }));
     }
     catch (err) {
         res.statusCode = 500;
         res.end(JSON.stringify({ error: err.message }));
     }
-    return Promise.resolve();
 };
 const handleFavicon = (_, response) => {
     const filePath = node_path_1.default.join(__dirname, '..', 'web', 'favicon.png');
@@ -317,6 +360,7 @@ const handleRoutes = ({ staticHash, staticHashPrefix, outputHash, outputHashPref
             res: response,
             search: url.search,
             remotionRoot,
+            liveEventsServer,
         });
     }
     if (url.pathname.startsWith('/api/app-icon/')) {
@@ -453,15 +497,34 @@ const handleRoutes = ({ staticHash, staticHashPrefix, outputHash, outputHashPref
     if (url.pathname.startsWith(staticHashPrefix)) {
         return static404(response);
     }
-    if (url.pathname.startsWith(outputHash)) {
-        const filename = new URL(request.url, 'http://localhost').pathname.replace(new RegExp(`^${outputHash}`), '');
-        const filePath = (0, node_path_1.join)(remotionRoot, decodeURIComponent(filename));
+    if (url.pathname.startsWith(`${outputHash}/`)) {
+        let filename;
+        try {
+            filename = decodeURIComponent(url.pathname.slice(outputHash.length + 1));
+        }
+        catch (_a) {
+            response.writeHead(400);
+            response.end('Invalid output path');
+            return Promise.resolve();
+        }
+        const filePath = node_path_1.default.resolve(remotionRoot, filename);
+        const outsideProject = !renderer_1.RenderInternals.isPathInside(filePath, remotionRoot);
+        const isCompletedOutput = outsideProject &&
+            getRenderQueue().some((job) => job.status === 'done' &&
+                (job.type === 'video' || job.type === 'still') &&
+                !job.deletedOutputLocation &&
+                node_path_1.default.resolve(remotionRoot, job.outName) === filePath);
+        if (outsideProject && !isCompletedOutput) {
+            response.writeHead(404);
+            response.end('Output file not found');
+            return Promise.resolve();
+        }
         return (0, serve_static_1.serveStatic)({
             root: remotionRoot,
             path: filePath,
             req: request,
             res: response,
-            allowOutsidePublicFolder: false,
+            allowOutsidePublicFolder: isCompletedOutput,
             allowRemotionConvertCors: false,
         });
     }

package/package.json

@@ -3,7 +3,7 @@
 		"url": "https://github.com/remotion-dev/remotion/tree/main/packages/studio-server"
 	},
 	"name": "@remotion/studio-server",
-	"version": "4.0.540",
+	"version": "4.0.541",
 	"description": "Run a Remotion Studio with a server backend",
 	"main": "dist",
 	"scripts": {
@@ -23,7 +23,7 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@remotion/studio-protocol": "4.0.540",
+		"@remotion/studio-protocol": "4.0.541",
 		"@babel/types": "7.24.0",
 		"@babel/parser": "7.24.1",
 		"@svgr/core": "8.1.0",
@@ -31,12 +31,12 @@
 		"kiwi-schema": "0.5.0",
 		"semver": "7.5.3",
 		"zod": "4.6.7",
-		"remotion": "4.0.540",
+		"remotion": "4.0.541",
 		"recast": "0.23.21",
-		"@remotion/bundler": "4.0.540",
-		"@remotion/renderer": "4.0.540",
-		"@remotion/codemods": "4.0.540",
-		"@remotion/studio-shared": "4.0.540",
+		"@remotion/bundler": "4.0.541",
+		"@remotion/renderer": "4.0.541",
+		"@remotion/codemods": "4.0.541",
+		"@remotion/studio-shared": "4.0.541",
 		"memfs": "3.4.3",
 		"open": "8.4.2"
 	},
@@ -44,7 +44,7 @@
 		"ast-types": "0.16.1",
 		"react": "19.3.1",
 		"@types/semver": "7.5.3",
-		"@remotion/eslint-config-internal": "4.0.540",
+		"@remotion/eslint-config-internal": "4.0.541",
 		"eslint": "9.19.0",
 		"prettier": "3.8.1",
 		"@types/node": "20.12.14",