hyperframes 0.8.141 → 0.8.143

package/dist/{chunk-6Q6FR4KH.js → chunk-7UYBQ6NF.js}

@@ -21,7 +21,7 @@ import {
   splitElementInHtml,
   unwrapElementsFromHtml,
   wrapElementsInHtml
-} from "./chunk-A7YQNIQT.js";
+} from "./chunk-UM2GRYM3.js";
 import {
   MAX_WINDOW_IDLE_MS,
   STUDIO_SIGNATURE_MANIFEST_PATHS,
@@ -39,9 +39,11 @@ import {
   DEFAULT_TARGET_LUFS,
   absoluteLoudnessPlan,
   measureAudio,
+  requestSubPath,
+  requestedProjectPath,
   requiredFfmpeg,
   resolveLocalAudioPath
-} from "./chunk-U7E736AJ.js";
+} from "./chunk-BFDJ63J5.js";
 import {
   PROXY_PARAMS_VERSION,
   PROXY_PENDING_RETRY_AFTER_SECONDS,
@@ -63,7 +65,7 @@ import {
   scanProjectMediaCodecMap,
   shouldPrewarmProxy,
   waitForProxy
-} from "./chunk-4BB7V6AI.js";
+} from "./chunk-ZQQ3SEIE.js";
 import {
   STUDIO_MOTION_PATH,
   createStudioMotionRenderBodyScript,
@@ -96,10 +98,10 @@ import {
 } from "./chunk-TJSTGSAW.js";
 import {
   addScenePartsManifest
-} from "./chunk-35RSNI77.js";
+} from "./chunk-F26LCYRY.js";
 import {
   ensureHfIds
-} from "./chunk-A4KQZXZI.js";
+} from "./chunk-NE55C6S5.js";
 import {
   PREVIEW_PROXY_BOX_PARAM,
   formatPreviewProxyBox,
@@ -109,12 +111,7 @@ import {
   parseFps,
   parsePreviewProxyBox,
   sameInstant
-} from "./chunk-6E6CM7WS.js";
-import {
-  MagicString,
-  VALID_CANVAS_RESOLUTIONS,
-  unrollComputedTimeline
-} from "./chunk-OZUQF4NB.js";
+} from "./chunk-4M4EC7JX.js";
 import {
   AFTER_FONTS_SCRIPT_TYPE,
   RUNTIME_BOOTSTRAP_ATTR,
@@ -128,7 +125,15 @@ import {
   resolveRateSpec,
   sourceTimeAt,
   stripEmbeddedRuntimeScripts
-} from "./chunk-SYKKFAUW.js";
+} from "./chunk-6TPZSTCL.js";
+import {
+  HTML_ATTRIBUTE_ENTITIES,
+  MagicString,
+  VALID_CANVAS_RESOLUTIONS,
+  decodeAuthoredAttribute,
+  scanHtmlOpeningTags,
+  unrollComputedTimeline
+} from "./chunk-MQZVBHEY.js";
 import {
   ProjectRootMissingError,
   folderGone,
@@ -140,20 +145,24 @@ import {
 import {
   isWithinProjectRoot,
   readProjectFile
-} from "./chunk-JFKL3WAE.js";
+} from "./chunk-IWFLMU2N.js";
 import {
   FFPROBE_PATH_ENV,
   findFfBinary
 } from "./chunk-PJ3HDUCY.js";
 import {
+  decodeCssEscapes,
+  decodeWellFormedEscapes,
+  decodedUrlPath,
+  encodeUrlPath,
   readMediaOffsetSeconds,
   rewriteAssetPaths,
   rewriteCssAssetUrls,
   rewriteInlineStyleAssetUrls
-} from "./chunk-TQFG7HTI.js";
+} from "./chunk-ZLW2V65P.js";
 import {
   parseHTML
-} from "./chunk-GK4AIFIH.js";
+} from "./chunk-SDYDNHEE.js";
 import {
   ancestor,
   full,
@@ -291,7 +300,7 @@ function clearElementScreenshotIsolation() {
   page.__hfThumbnailFaded = [];
 }
 
-// ../studio-server/dist/chunk-5VCIZYUE.js
+// ../studio-server/dist/chunk-AYKLBPP2.js
 import { resolve } from "path";
 function isAutoProxyEnabled(adapter) {
   return adapter.autoProxy !== false;
@@ -381,7 +390,7 @@ import {
   readdirSync as readdirSync2,
   realpathSync
 } from "fs";
-import { resolve as resolve2, dirname as dirname3, join as join6 } from "path";
+import { resolve as resolve2, dirname as dirname3, join as join6, sep as sep2 } from "path";
 import { readFileSync as readFileSync2 } from "fs";
 import { createHash as createHash2 } from "crypto";
 import { existsSync, readFileSync as readFileSync3 } from "fs";
@@ -1950,8 +1959,8 @@ function upsertProp(ms, objNode, key, value) {
   if (existing) {
     ms.overwrite(existing.value.start, existing.value.end, valueToCode(value));
   } else {
-    const sep3 = objNode.properties.length > 0 ? ", " : "";
-    ms.appendLeft(objNode.end - 1, `${sep3}${safeKey(key)}: ${valueToCode(value)}`);
+    const sep4 = objNode.properties.length > 0 ? ", " : "";
+    ms.appendLeft(objNode.end - 1, `${sep4}${safeKey(key)}: ${valueToCode(value)}`);
   }
 }
 function isEditableVarKey(key) {
@@ -2569,8 +2578,8 @@ function insertNewKeyframe(ms, kfNode, percentage, pctKey, valueCode) {
   if (insertBeforeProp) {
     ms.appendLeft(insertBeforeProp.start, `${JSON.stringify(pctKey)}: ${valueCode}, `);
   } else {
-    const sep3 = allProps.length > 0 ? ", " : "";
-    ms.appendLeft(kfNode.end - 1, `${sep3}${JSON.stringify(pctKey)}: ${valueCode}`);
+    const sep4 = allProps.length > 0 ? ", " : "";
+    ms.appendLeft(kfNode.end - 1, `${sep4}${JSON.stringify(pctKey)}: ${valueCode}`);
   }
 }
 function collapseKeyframesToFlat(ms, varsNode, source, remainingRecord) {
@@ -3048,8 +3057,8 @@ function enableArcPath(ms, call, animation, config) {
     const k = propKeyName2(p);
     return k !== "x" && k !== "y";
   });
-  const sep3 = survivesRemoval ? ", " : "";
-  ms.appendRight(vars.start + 1, ` motionPath: ${motionPathCode}${sep3}`);
+  const sep4 = survivesRemoval ? ", " : "";
+  ms.appendRight(vars.start + 1, ` motionPath: ${motionPathCode}${sep4}`);
   stripXYFromKeyframes(ms, findPropertyNode2(call.varsArg, "keyframes"));
   removePropsByKey(ms, call.varsArg, /* @__PURE__ */ new Set(["x", "y"]));
   return true;
@@ -3590,7 +3599,7 @@ import { readFileSync as readFileSync7 } from "fs";
 import { join as join9 } from "path";
 import { streamSSE } from "hono/streaming";
 import { existsSync as existsSync6, lstatSync as lstatSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync as statSync5 } from "fs";
-import { join as join10 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { HTTPException } from "hono/http-exception";
 import { open, stat } from "fs/promises";
 import { createHash as createHash3 } from "crypto";
@@ -3612,7 +3621,7 @@ import { existsSync as existsSync7, readFileSync as readFileSync10, statSync as
 import { join as join12, resolve as resolve5 } from "path";
 import { execFile } from "child_process";
 import { readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync8 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join13, relative as relative4, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname6, join as join13, relative as relative4, sep as sep3 } from "path";
 import { createHash as createHash5, randomBytes } from "crypto";
 import { existsSync as existsSync8 } from "fs";
 import { existsSync as existsSync9, readFileSync as readFileSync12, statSync as statSync9 } from "fs";
@@ -3622,7 +3631,7 @@ import { promisify } from "util";
 import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync3, openSync as openSync3, readSync } from "fs";
 import { streamSSE as streamSSE2 } from "hono/streaming";
 import { existsSync as existsSync10 } from "fs";
-import { basename as basename3, dirname as dirname6, extname, join as join15, posix } from "path";
+import { basename as basename3, dirname as dirname7, extname, join as join15, posix } from "path";
 import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
 import { homedir } from "os";
 import { join as join16 } from "path";
@@ -4572,12 +4581,6 @@ function resolveGsapWriter(env) {
   if (configured === "recast" || configured === "acorn") return configured;
   throw new Error(`Invalid ${GSAP_WRITER_MIGRATION.flag}=${configured}; expected recast or acorn`);
 }
-function requestSubPath(url, route) {
-  const routeSegments = route.split("/");
-  const segments = new URL(url).pathname.split("/");
-  const start = segments.indexOf(routeSegments[0] ?? "");
-  return decodeURIComponent(segments.slice(start + routeSegments.length).join("/"));
-}
 async function loadGsapParser() {
   return import("./gsapParser-UP3PNPC2.js");
 }
@@ -4879,15 +4882,114 @@ var escapeRegExp = (text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var SEPARATOR = String.raw`\\{0,2}[\\/]`;
 var REFERENCE_START = String.raw`(?<![\w./\\+-])`;
 var FILE_END = String.raw`(?![\w-]|\.\w)`;
+var ENTITY_SPELLINGS = HTML_ATTRIBUTE_ENTITIES;
+function referenceSpellings(char) {
+  const spellings = [escapeRegExp(char)];
+  const encoded = encodeUrlPath(char);
+  if (encoded !== char)
+    spellings.push(encoded.replace(/[A-F]/g, (hex) => `[${hex}${hex.toLowerCase()}]`));
+  if (ENTITY_SPELLINGS[char]) spellings.push(...ENTITY_SPELLINGS[char]);
+  if (["'", '"', "`", "$", " ", "(", ")"].includes(char)) {
+    spellings.push(escapeRegExp(`&#92;${char}`), escapeRegExp(`&#92;${escapeHtmlReference(char)}`));
+  }
+  const scriptSpelling = escapeQuotedReference(char, '"');
+  if (scriptSpelling !== char) spellings.push(escapeRegExp(scriptSpelling));
+  if (["'", "`", "$", " ", "(", ")"].includes(char)) spellings.push(escapeRegExp(`\\${char}`));
+  if (/[\t\n\f\r =<>`]/.test(char)) spellings.push(`&#${char.codePointAt(0)};`);
+  if (char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) {
+    spellings.push(escapeRegExp(`\\${char.charCodeAt(0).toString(16)} `));
+  }
+  return spellings.length === 1 ? spellings[0] : `(?:${spellings.join("|")})`;
+}
+function escapeHtmlReference(path) {
+  return path.replace(/[&"']/g, (char) => ENTITY_SPELLINGS[char][0]);
+}
+function escapeQuotedReference(path, quote) {
+  const escaped = JSON.stringify(path).slice(1, -1);
+  return quote === '"' ? escaped : escaped.replace(new RegExp(escapeRegExp(quote), "g"), `\\${quote}`);
+}
+function escapeRawUrlPath(path) {
+  const encodeSpaces = path.startsWith(" ") || path.endsWith(" ");
+  return path.replace(/[\s\S]/g, (char) => {
+    if (char.charCodeAt(0) < 32 || ":?%#\\".includes(char) || encodeSpaces && char === " ") {
+      return encodeUrlPath(char);
+    }
+    return char;
+  });
+}
+function spellLike(reference, path, oldPath, context) {
+  const { syntax, quote, url, encodeAll } = context;
+  if (url && (encodeAll || reference !== oldPath && /%[0-9A-Fa-f]{2}/.test(reference)))
+    return encodeUrlPath(path);
+  switch (syntax) {
+    case "html": {
+      const escaped = escapeHtmlReference(url ? escapeRawUrlPath(path) : path);
+      return ["'", '"'].includes(quote) ? escaped : escaped.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+    }
+    case "script": {
+      if (!["'", '"', "`"].includes(quote)) return path;
+      const escaped = escapeQuotedReference(path, quote);
+      return quote === "`" ? escaped.replace(/\$\{/g, "\\${") : escaped;
+    }
+    case "css":
+      return url ? encodeUrlPath(path) : path;
+    case "plain":
+      return path;
+  }
+}
+function referenceSyntax(file) {
+  if (/\.html$/i.test(file)) return "html";
+  if (/\.css$/i.test(file)) return "css";
+  if (/\.(?:[cm]?js|jsx|tsx?|json)$/i.test(file)) return "script";
+  return "plain";
+}
+function decodeQuotedReference(text2, syntax) {
+  if (syntax === "css") return decodeCssEscapes(text2);
+  if (syntax === "script") {
+    const controls = { b: "\b", f: "\f", n: "\n", r: "\r", t: "	" };
+    return text2.replace(
+      /\\(?:u([0-9a-fA-F]{4})|([bfnrt"'`$\\/]))/g,
+      (_escaped, hex, char) => {
+        if (hex !== void 0) return String.fromCharCode(Number.parseInt(hex, 16));
+        return controls[char] ?? char;
+      }
+    );
+  }
+  return text2;
+}
 function referencePattern(oldPath, isDirectory) {
-  const name = oldPath.split("/").map(escapeRegExp).join(SEPARATOR);
+  const name = oldPath.split("/").map((segment) => Array.from(segment, referenceSpellings).join("")).join(SEPARATOR);
   const end = isDirectory ? `(?=${SEPARATOR})` : FILE_END;
   return new RegExp(
     String.raw`${REFERENCE_START}(?<lead>(?:\.{1,2}${SEPARATOR}|${SEPARATOR}){0,4})${name}${end}`,
     "g"
   );
 }
+function rewriteEntityAttributes(text2, rewrite) {
+  const parts = [];
+  let cursor = 0;
+  for (const tag of scanHtmlOpeningTags(text2)) {
+    for (const attr of tag.attributes) {
+      if (attr.kind !== "value") continue;
+      const decoded = decodeAuthoredAttribute(attr.value);
+      if (decoded === attr.value) continue;
+      let value = escapeHtmlReference(decoded);
+      if (!attr.quote)
+        value = value.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+      const source = `<x ${attr.name}=${attr.quote}${value}${attr.quote}>`;
+      const updated = rewrite(source);
+      if (updated === source) continue;
+      const replacement = scanHtmlOpeningTags(updated)[0].attributes[0];
+      if (replacement.kind !== "value") throw new Error("Reference rewrite removed its attribute");
+      parts.push(text2.slice(cursor, attr.valueStart), replacement.value);
+      cursor = attr.valueEnd;
+    }
+  }
+  parts.push(text2.slice(cursor));
+  return parts.join("");
+}
 function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
+  const oldIdentity = sep2 === "\\" ? oldPath.replace(/\\/g, "/") : oldPath;
   const pattern = referencePattern(oldPath, isDirectory);
   const around = /* @__PURE__ */ new Map();
   const afterLengths = /* @__PURE__ */ new Set();
@@ -4901,24 +5003,123 @@ function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
         before
       );
       afterLengths.add(after.length);
-      window2 = Math.max(window2, path.length * 3);
-    }
-  }
-  const normalized = (text2) => text2.replace(/\\{0,2}[\\/]/g, "/");
-  return (text2) => text2.replace(pattern, (...args) => {
-    const [match, offset] = [args[0], args.at(-3)];
-    const { lead } = args.at(-1);
-    const at = offset + lead.length;
-    const head = normalized(text2.slice(Math.max(0, at - window2), at));
-    const tail = normalized(text2.slice(offset + match.length, offset + match.length + window2));
-    const inLonger = [...afterLengths].some((after) => {
-      const befores = tail.length >= after && around.get(tail.slice(0, after));
-      return befores && [...befores].some(
-        ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+      window2 = Math.max(window2, path.length * 9);
+    }
+  }
+  const normalized = (text2, context, full2 = false) => {
+    let value = text2;
+    if (context.syntax === "html" || context.htmlAttribute) {
+      value = decodeAuthoredAttribute(value);
+    }
+    value = decodeQuotedReference(value, context.syntax);
+    if (context.url) {
+      value = value.replace(/\\/g, "/");
+      value = full2 ? decodedUrlPath(value) : decodeWellFormedEscapes(value);
+    }
+    return sep2 === "\\" ? value.replace(/\\/g, "/") : value;
+  };
+  return function rewriteText(text2, syntax = "html", normalizeEntities = true) {
+    if (syntax === "html" && normalizeEntities) {
+      text2 = rewriteEntityAttributes(text2, (source) => rewriteText(source, "html", false));
+    }
+    pattern.lastIndex = 0;
+    if (!pattern.test(text2)) return text2;
+    pattern.lastIndex = 0;
+    const tags = syntax === "html" ? scanHtmlOpeningTags(text2) : [];
+    const inlineRegions = tags.filter(
+      (tag) => tag.closed && ["script", "style"].includes(tag.name) && tag.rawTextEnd !== null
+    ).map((tag) => ({
+      start: tag.end,
+      end: tag.rawTextEnd,
+      syntax: tag.name === "style" ? "css" : "script"
+    }));
+    const attributes = tags.flatMap(
+      (tag) => tag.attributes.flatMap((attr) => attr.kind === "value" ? [attr] : [])
+    );
+    const cssContexts = syntax === "css" ? [{ start: 0, end: text2.length, htmlAttribute: false }] : [
+      ...inlineRegions.filter((region) => region.syntax === "css").map((region) => ({ ...region, htmlAttribute: false })),
+      ...attributes.filter((attr) => attr.name === "style").map((attr) => ({ ...attr, htmlAttribute: true }))
+    ];
+    const cssFields = (pattern2) => cssContexts.flatMap(
+      (context) => [...text2.slice(context.start, context.end).matchAll(pattern2)].map((match) => {
+        const prefix = /^(?:url\(\s*|@import\s+)/i.exec(match[0])[0];
+        const rest = match[0].slice(prefix.length);
+        const delimiter = context.htmlAttribute ? /^(?:["']|&quot;|&#39;|&apos;)/.exec(rest)?.[0] : /^["']/.exec(rest)?.[0];
+        const start = context.start + match.index + prefix.length + (delimiter?.length ?? 0);
+        return {
+          start,
+          end: context.start + match.index + match[0].length,
+          syntax: "css",
+          htmlAttribute: context.htmlAttribute,
+          encodeAll: true
+        };
+      })
+    );
+    const urlRegions = [
+      ...attributes.filter((attr) => ["src", "href", "poster", "xlink:href"].includes(attr.name)).map((attr) => ({
+        start: attr.valueStart + (/^[\t\n\f\r ]*/.exec(attr.value)?.[0].length ?? 0),
+        end: attr.valueEnd,
+        syntax: "html",
+        htmlAttribute: true,
+        encodeAll: false
+      })),
+      ...attributes.filter((attr) => attr.name === "srcset").flatMap(
+        (attr) => [...attr.value.matchAll(/(^|,)[\t\n\f\r ]*([^,\t\n\f\r ]+)/g)].map((match) => ({
+          start: attr.valueStart + match.index + match[0].length - match[2].length,
+          end: attr.valueStart + match.index + match[0].length,
+          syntax: "html",
+          htmlAttribute: true,
+          encodeAll: true
+        }))
+      ),
+      ...cssFields(
+        /\burl\((?:\s*"(?:\\.|[^"\\])*"\s*|\s*'(?:\\.|[^'\\])*'\s*|(?:\\.|[^)\\])*)\)/gi
+      ),
+      ...cssFields(/@import\s+(?:"[^"]*"|'[^']*')/gi)
+    ].sort((a, b) => a.start - b.start);
+    let urlIndex = 0;
+    let regionIndex = 0;
+    return text2.replace(pattern, (...args) => {
+      const [match, offset] = [args[0], args.at(-3)];
+      const { lead } = args.at(-1);
+      while (inlineRegions[regionIndex] && inlineRegions[regionIndex].end <= offset) regionIndex++;
+      const region = inlineRegions[regionIndex];
+      const matchSyntax = region && offset >= region.start ? region.syntax : syntax;
+      while (urlRegions[urlIndex] && urlRegions[urlIndex].end <= offset) urlIndex++;
+      const urlRegion = urlRegions[urlIndex];
+      const url = matchSyntax !== "script" && !!urlRegion && offset >= urlRegion.start;
+      const context = {
+        syntax: url ? urlRegion.syntax : matchSyntax,
+        url,
+        htmlAttribute: url && urlRegion.htmlAttribute,
+        encodeAll: url && urlRegion.encodeAll,
+        quote: text2[offset - 1] ?? ""
+      };
+      if (url && offset !== urlRegion.start) return match;
+      const reference = match.slice(lead.length);
+      if (normalized(reference, context, true) !== oldIdentity) return match;
+      if (isDirectory && !normalized(
+        text2.slice(offset + match.length, offset + match.length + 4),
+        context
+      ).startsWith("/"))
+        return match;
+      const at = offset + lead.length;
+      const head = normalized(text2.slice(Math.max(0, at - window2), at), context);
+      const tail = normalized(
+        text2.slice(offset + match.length, offset + match.length + window2),
+        context,
+        context.url
       );
+      const inLonger = [...afterLengths].some((after) => {
+        const befores = tail.length >= after && around.get(tail.slice(0, after));
+        return befores && [...befores].some(
+          ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+        );
+      });
+      if (inLonger) return match;
+      return `${lead}${spellLike(reference, newPath, oldPath, context)}`;
     });
-    return inLonger ? match : `${lead}${newPath}`;
-  });
+  };
 }
 function occurrences(text2, part) {
   const at = [];
@@ -4951,7 +5152,7 @@ function updateReferences(projectDir, oldPath, newPath, isDirectory) {
     if (!isSafePath(projectDir, file) || isPrivateProjectFile(projectDir, file)) continue;
     const content = readableText(file);
     if (content === null) continue;
-    const updated = rewrite(content);
+    const updated = rewrite(content, referenceSyntax(file));
     if (updated !== content) {
       replaceFileAtomically(file, updated, statSync3(file).mode);
       updatedCount++;
@@ -5240,7 +5441,7 @@ async function prepareGsapMutationScript(c, res, firstMutation) {
   let block = extractGsapScriptBlock(html);
   if (!block && (firstMutation.type === "add" || firstMutation.type === "add-with-keyframes")) {
     const compId = html.match(/data-composition-id="([^"]+)"/)?.[1] ?? "main";
-    const { GSAP_CDN } = await import("./dist-ROUDWGLO.js");
+    const { GSAP_CDN } = await import("./dist-XN234YFQ.js");
     const bootstrap = [
       `<script src="${GSAP_CDN}"></script>`,
       "<script>",
@@ -6828,10 +7029,11 @@ function registerFileRoutes(api, adapter) {
     const res = await resolveProjectFile(c, adapter, { mustExist: true });
     if ("error" in res) return res.error;
     const body = await c.req.json();
-    if (!body.newPath || body.newPath.includes("\0")) {
+    const newPath = body !== null && typeof body === "object" && "newPath" in body ? body.newPath : void 0;
+    if (typeof newPath !== "string" || !newPath || newPath.includes("\0") || /[\uD800-\uDFFF]/u.test(newPath)) {
       return c.json({ error: "newPath required" }, 400);
     }
-    const newAbs = resolveWithinProject(res.project.dir, body.newPath);
+    const newAbs = resolveWithinProject(res.project.dir, newPath);
     if (!newAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -6841,8 +7043,8 @@ function registerFileRoutes(api, adapter) {
     const isDirectory = statSync3(res.absPath, { throwIfNoEntry: false })?.isDirectory() ?? false;
     ensureDir(res.project.dir, newAbs);
     renameSync2(res.absPath, newAbs);
-    const updatedFiles = updateReferences(res.project.dir, res.filePath, body.newPath, isDirectory);
-    return c.json({ ok: true, path: body.newPath, updatedReferences: updatedFiles });
+    const updatedFiles = updateReferences(res.project.dir, res.filePath, newPath, isDirectory);
+    return c.json({ ok: true, path: newPath, updatedReferences: updatedFiles });
   });
   api.post("/projects/:id/duplicate-file", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
@@ -7666,6 +7868,21 @@ function registerLintRoutes(api, adapter) {
   });
 }
 var VALID_RESOLUTIONS = new Set(VALID_CANVAS_RESOLUTIONS);
+var RENDER_MIME = {
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime"
+};
+var RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
+var RENDER_ARTIFACT_EXTENSIONS = [...RENDER_EXTENSIONS, ".meta.json"];
+function resolveRenderArtifacts(directories, jobId) {
+  const artifacts = [...new Set(directories)].filter(existsSync6).flatMap(
+    (directory) => RENDER_ARTIFACT_EXTENSIONS.map(
+      (extension) => resolveWithinProject(directory, `${jobId}${extension}`)
+    )
+  );
+  return artifacts.every((path) => path !== null) ? artifacts : null;
+}
 function contentDispositionHeader(disposition, filename) {
   const fallback = filename.replace(/[^\x20-\x7e]|["\\]/g, "_");
   const encoded = encodeURIComponent(filename).replace(
@@ -7783,12 +8000,6 @@ function registerRenderRoutes(api, adapter) {
     }
     return c.json({ status: job.status });
   });
-  const RENDER_MIME = {
-    ".mp4": "video/mp4",
-    ".webm": "video/webm",
-    ".mov": "video/quicktime"
-  };
-  const RENDER_EXTENSIONS = Object.keys(RENDER_MIME);
   const isPlainFile = (path) => {
     try {
       return lstatSync3(path).isFile();
@@ -7834,17 +8045,22 @@ function registerRenderRoutes(api, adapter) {
       }
     });
   });
-  api.delete("/render/:jobId", (c) => {
+  async function renderDirectories(jobId) {
+    const outputPath = renderJobs.get(jobId)?.outputPath;
+    if (outputPath) return [dirname5(outputPath)];
+    const projects = await adapter.listProjects();
+    return projects.map((project) => adapter.rendersDir(project));
+  }
+  api.delete("/render/:jobId", async (c) => {
     const { jobId } = c.req.param();
-    for (const [, state] of renderJobs) {
-      if (state.id === jobId && state.outputPath) {
-        const dir = state.outputPath.replace(/\/[^/]+$/, "");
-        for (const ext of [".mp4", ".webm", ".mov", ".meta.json"]) {
-          const fp = join10(dir, `${jobId}${ext}`);
-          if (existsSync6(fp)) unlinkSync3(fp);
-        }
-        break;
-      }
+    if (jobId.includes("/") || jobId.includes("\\") || jobId.includes("\0")) {
+      return c.json({ error: "forbidden" }, 403);
+    }
+    const directories = await renderDirectories(jobId);
+    const artifacts = resolveRenderArtifacts(directories, jobId);
+    if (!artifacts) return c.json({ error: "forbidden" }, 403);
+    for (const path of artifacts) {
+      if (existsSync6(path)) unlinkSync3(path);
     }
     renderJobs.delete(jobId);
     return c.json({ deleted: true });
@@ -8060,12 +8276,7 @@ async function generateThumbnail(path, signal) {
 async function resolveSource(adapter, id, url) {
   const project = await adapter.resolveProject(id);
   if (!project) throw new HTTPException(404);
-  let relative5;
-  try {
-    relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
-  } catch {
-    throw new HTTPException(400);
-  }
+  const relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
   if (!/\.jpe?g$/i.test(relative5)) throw new HTTPException(415);
   const path = pinWithinProject(project.dir, relative5);
   if (!path) throw new HTTPException(404);
@@ -8585,14 +8796,14 @@ async function extractThenPublishWhole(extract, mediaPath, mediaTime, imagePath)
   }
 }
 async function extractStill(projectDir, absPath, source, playhead, tools) {
-  const fileDir = dirname5(absPath);
+  const fileDir = dirname6(absPath);
   const mediaPath = pinWithinProject(projectDir, relative4(projectDir, join13(fileDir, source.src)));
   if (!mediaPath) return { error: `forbidden media path: ${source.src}`, status: 403 };
   const freezeDir = join13(projectDir, ...FREEZE_DIR);
   const fileName = freezeStillFileName(source.id, playhead, tools.stillToken());
   mkdirWithinProject(projectDir, freezeDir);
   const imagePath = pinWithinProject(projectDir, join13(...FREEZE_DIR, fileName));
-  if (!imagePath || dirname5(imagePath) !== freezeDir) {
+  if (!imagePath || dirname6(imagePath) !== freezeDir) {
     return { error: `forbidden freeze path: ${fileName}`, status: 403 };
   }
   const failed = await extractThenPublishWhole(
@@ -8602,7 +8813,7 @@ async function extractStill(projectDir, absPath, source, playhead, tools) {
     imagePath
   );
   if (failed) return failed;
-  const depth = relative4(projectDir, fileDir).split(sep2).filter(Boolean).length;
+  const depth = relative4(projectDir, fileDir).split(sep3).filter(Boolean).length;
   const stillPath = `${FREEZE_DIR.join("/")}/${fileName}`;
   return { imageSrc: `${"../".repeat(depth)}${stillPath}`, stillPath, imagePath };
 }
@@ -9145,9 +9356,6 @@ function isVideoPath(path) {
 function isImagePath(path) {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
-function normalizeProjectAssetPath(path) {
-  return path.trim().replace(/^[.]\//, "").replace(/[?#].*$/, "");
-}
 function containsNullByte(path) {
   return path.includes("\0");
 }
@@ -9212,7 +9420,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
   api.get("/projects/:id/media/metadata", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const assetPath = normalizeProjectAssetPath(c.req.query("path") ?? "");
+    const assetPath = requestedProjectPath(project.dir, c.req.query("path") ?? "");
     if (!assetPath) return c.json({ error: "path required" }, 400);
     if (containsNullByte(assetPath)) return c.json({ error: "forbidden" }, 403);
     if (/^(?:https?:|data:|blob:)/i.test(assetPath)) {
@@ -9234,7 +9442,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       const project = await adapter.resolveProject(c.req.param("id"));
       if (!project) return c.json({ error: "not found" }, 404);
       const body = await c.req.json().catch(() => ({}));
-      const inputAssetPath = body.inputPath ? normalizeProjectAssetPath(body.inputPath) : "";
+      const inputAssetPath = body.inputPath ? requestedProjectPath(project.dir, body.inputPath) : "";
       if (!inputAssetPath) return c.json({ error: "inputPath required" }, 400);
       if (containsNullByte(inputAssetPath)) return c.json({ error: "forbidden" }, 403);
       if (/^(?:https?:|data:|blob:)/i.test(inputAssetPath)) {
@@ -9248,7 +9456,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (!inputIsVideo && !inputIsImage) {
         return c.json({ error: "background removal supports video or image assets only" }, 400);
       }
-      const requestedOutput = body.outputPath ? posix.normalize(normalizeProjectAssetPath(body.outputPath)) : "";
+      const requestedOutput = body.outputPath ? posix.normalize(requestedProjectPath(project.dir, body.outputPath)) : "";
       if (requestedOutput && containsNullByte(requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
@@ -9278,8 +9486,8 @@ function registerMediaRoutes(api, adapter, options = {}) {
           return c.json({ error: "forbidden" }, 403);
         }
       }
-      mkdirWithinProject(project.dir, dirname6(outputPath));
-      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname6(backgroundOutputPath));
+      mkdirWithinProject(project.dir, dirname7(outputPath));
+      if (backgroundOutputPath) mkdirWithinProject(project.dir, dirname7(backgroundOutputPath));
       const jobId = makeJobId(project.id, mediaJobs);
       const state = adapter.startBackgroundRemoval({
         project,
@@ -9679,7 +9887,6 @@ export {
   buildSubCompositionHtml,
   compositionsAffectedBy,
   applyFileMutations,
-  requestSubPath,
   MAX_UPLOAD_BYTES,
   affectsPreview,
   PREVIEW_BUNDLE_OPTIONS,

package/dist/{chunk-BRITLL56.js → chunk-B4P5VDFQ.js}

@@ -9,7 +9,7 @@ import {
   buildAuthHeaders,
   refreshTokens,
   resolveCredential
-} from "./chunk-246MOR5U.js";
+} from "./chunk-DKSDVDXG.js";
 
 // src/cloud/auth.ts
 async function resolveCloudAuthHeaders() {