hyperframes 0.8.142 → 0.8.143

package/dist/{chunk-YHRZQJXH.js → chunk-7UYBQ6NF.js}

@@ -21,7 +21,7 @@ import {
   splitElementInHtml,
   unwrapElementsFromHtml,
   wrapElementsInHtml
-} from "./chunk-OKCR3JTO.js";
+} from "./chunk-UM2GRYM3.js";
 import {
   MAX_WINDOW_IDLE_MS,
   STUDIO_SIGNATURE_MANIFEST_PATHS,
@@ -39,9 +39,11 @@ import {
   DEFAULT_TARGET_LUFS,
   absoluteLoudnessPlan,
   measureAudio,
+  requestSubPath,
+  requestedProjectPath,
   requiredFfmpeg,
   resolveLocalAudioPath
-} from "./chunk-U7E736AJ.js";
+} from "./chunk-BFDJ63J5.js";
 import {
   PROXY_PARAMS_VERSION,
   PROXY_PENDING_RETRY_AFTER_SECONDS,
@@ -63,7 +65,7 @@ import {
   scanProjectMediaCodecMap,
   shouldPrewarmProxy,
   waitForProxy
-} from "./chunk-6UM3R7PP.js";
+} from "./chunk-ZQQ3SEIE.js";
 import {
   STUDIO_MOTION_PATH,
   createStudioMotionRenderBodyScript,
@@ -96,10 +98,10 @@ import {
 } from "./chunk-TJSTGSAW.js";
 import {
   addScenePartsManifest
-} from "./chunk-DPHJKWP5.js";
+} from "./chunk-F26LCYRY.js";
 import {
   ensureHfIds
-} from "./chunk-A4KQZXZI.js";
+} from "./chunk-NE55C6S5.js";
 import {
   PREVIEW_PROXY_BOX_PARAM,
   formatPreviewProxyBox,
@@ -109,12 +111,7 @@ import {
   parseFps,
   parsePreviewProxyBox,
   sameInstant
-} from "./chunk-YFT3BL7N.js";
-import {
-  MagicString,
-  VALID_CANVAS_RESOLUTIONS,
-  unrollComputedTimeline
-} from "./chunk-OZUQF4NB.js";
+} from "./chunk-4M4EC7JX.js";
 import {
   AFTER_FONTS_SCRIPT_TYPE,
   RUNTIME_BOOTSTRAP_ATTR,
@@ -128,7 +125,15 @@ import {
   resolveRateSpec,
   sourceTimeAt,
   stripEmbeddedRuntimeScripts
-} from "./chunk-J4UX3RS3.js";
+} from "./chunk-6TPZSTCL.js";
+import {
+  HTML_ATTRIBUTE_ENTITIES,
+  MagicString,
+  VALID_CANVAS_RESOLUTIONS,
+  decodeAuthoredAttribute,
+  scanHtmlOpeningTags,
+  unrollComputedTimeline
+} from "./chunk-MQZVBHEY.js";
 import {
   ProjectRootMissingError,
   folderGone,
@@ -140,20 +145,24 @@ import {
 import {
   isWithinProjectRoot,
   readProjectFile
-} from "./chunk-JFKL3WAE.js";
+} from "./chunk-IWFLMU2N.js";
 import {
   FFPROBE_PATH_ENV,
   findFfBinary
 } from "./chunk-PJ3HDUCY.js";
 import {
+  decodeCssEscapes,
+  decodeWellFormedEscapes,
+  decodedUrlPath,
+  encodeUrlPath,
   readMediaOffsetSeconds,
   rewriteAssetPaths,
   rewriteCssAssetUrls,
   rewriteInlineStyleAssetUrls
-} from "./chunk-TQFG7HTI.js";
+} from "./chunk-ZLW2V65P.js";
 import {
   parseHTML
-} from "./chunk-GK4AIFIH.js";
+} from "./chunk-SDYDNHEE.js";
 import {
   ancestor,
   full,
@@ -291,7 +300,7 @@ function clearElementScreenshotIsolation() {
   page.__hfThumbnailFaded = [];
 }
 
-// ../studio-server/dist/chunk-5VCIZYUE.js
+// ../studio-server/dist/chunk-AYKLBPP2.js
 import { resolve } from "path";
 function isAutoProxyEnabled(adapter) {
   return adapter.autoProxy !== false;
@@ -381,7 +390,7 @@ import {
   readdirSync as readdirSync2,
   realpathSync
 } from "fs";
-import { resolve as resolve2, dirname as dirname3, join as join6 } from "path";
+import { resolve as resolve2, dirname as dirname3, join as join6, sep as sep2 } from "path";
 import { readFileSync as readFileSync2 } from "fs";
 import { createHash as createHash2 } from "crypto";
 import { existsSync, readFileSync as readFileSync3 } from "fs";
@@ -1950,8 +1959,8 @@ function upsertProp(ms, objNode, key, value) {
   if (existing) {
     ms.overwrite(existing.value.start, existing.value.end, valueToCode(value));
   } else {
-    const sep3 = objNode.properties.length > 0 ? ", " : "";
-    ms.appendLeft(objNode.end - 1, `${sep3}${safeKey(key)}: ${valueToCode(value)}`);
+    const sep4 = objNode.properties.length > 0 ? ", " : "";
+    ms.appendLeft(objNode.end - 1, `${sep4}${safeKey(key)}: ${valueToCode(value)}`);
   }
 }
 function isEditableVarKey(key) {
@@ -2569,8 +2578,8 @@ function insertNewKeyframe(ms, kfNode, percentage, pctKey, valueCode) {
   if (insertBeforeProp) {
     ms.appendLeft(insertBeforeProp.start, `${JSON.stringify(pctKey)}: ${valueCode}, `);
   } else {
-    const sep3 = allProps.length > 0 ? ", " : "";
-    ms.appendLeft(kfNode.end - 1, `${sep3}${JSON.stringify(pctKey)}: ${valueCode}`);
+    const sep4 = allProps.length > 0 ? ", " : "";
+    ms.appendLeft(kfNode.end - 1, `${sep4}${JSON.stringify(pctKey)}: ${valueCode}`);
   }
 }
 function collapseKeyframesToFlat(ms, varsNode, source, remainingRecord) {
@@ -3048,8 +3057,8 @@ function enableArcPath(ms, call, animation, config) {
     const k = propKeyName2(p);
     return k !== "x" && k !== "y";
   });
-  const sep3 = survivesRemoval ? ", " : "";
-  ms.appendRight(vars.start + 1, ` motionPath: ${motionPathCode}${sep3}`);
+  const sep4 = survivesRemoval ? ", " : "";
+  ms.appendRight(vars.start + 1, ` motionPath: ${motionPathCode}${sep4}`);
   stripXYFromKeyframes(ms, findPropertyNode2(call.varsArg, "keyframes"));
   removePropsByKey(ms, call.varsArg, /* @__PURE__ */ new Set(["x", "y"]));
   return true;
@@ -3612,7 +3621,7 @@ import { existsSync as existsSync7, readFileSync as readFileSync10, statSync as
 import { join as join12, resolve as resolve5 } from "path";
 import { execFile } from "child_process";
 import { readFileSync as readFileSync11, rmSync as rmSync5, statSync as statSync8 } from "fs";
-import { basename as basename2, dirname as dirname6, join as join13, relative as relative4, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname6, join as join13, relative as relative4, sep as sep3 } from "path";
 import { createHash as createHash5, randomBytes } from "crypto";
 import { existsSync as existsSync8 } from "fs";
 import { existsSync as existsSync9, readFileSync as readFileSync12, statSync as statSync9 } from "fs";
@@ -4572,12 +4581,6 @@ function resolveGsapWriter(env) {
   if (configured === "recast" || configured === "acorn") return configured;
   throw new Error(`Invalid ${GSAP_WRITER_MIGRATION.flag}=${configured}; expected recast or acorn`);
 }
-function requestSubPath(url, route) {
-  const routeSegments = route.split("/");
-  const segments = new URL(url).pathname.split("/");
-  const start = segments.indexOf(routeSegments[0] ?? "");
-  return decodeURIComponent(segments.slice(start + routeSegments.length).join("/"));
-}
 async function loadGsapParser() {
   return import("./gsapParser-UP3PNPC2.js");
 }
@@ -4879,15 +4882,114 @@ var escapeRegExp = (text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var SEPARATOR = String.raw`\\{0,2}[\\/]`;
 var REFERENCE_START = String.raw`(?<![\w./\\+-])`;
 var FILE_END = String.raw`(?![\w-]|\.\w)`;
+var ENTITY_SPELLINGS = HTML_ATTRIBUTE_ENTITIES;
+function referenceSpellings(char) {
+  const spellings = [escapeRegExp(char)];
+  const encoded = encodeUrlPath(char);
+  if (encoded !== char)
+    spellings.push(encoded.replace(/[A-F]/g, (hex) => `[${hex}${hex.toLowerCase()}]`));
+  if (ENTITY_SPELLINGS[char]) spellings.push(...ENTITY_SPELLINGS[char]);
+  if (["'", '"', "`", "$", " ", "(", ")"].includes(char)) {
+    spellings.push(escapeRegExp(`&#92;${char}`), escapeRegExp(`&#92;${escapeHtmlReference(char)}`));
+  }
+  const scriptSpelling = escapeQuotedReference(char, '"');
+  if (scriptSpelling !== char) spellings.push(escapeRegExp(scriptSpelling));
+  if (["'", "`", "$", " ", "(", ")"].includes(char)) spellings.push(escapeRegExp(`\\${char}`));
+  if (/[\t\n\f\r =<>`]/.test(char)) spellings.push(`&#${char.codePointAt(0)};`);
+  if (char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) {
+    spellings.push(escapeRegExp(`\\${char.charCodeAt(0).toString(16)} `));
+  }
+  return spellings.length === 1 ? spellings[0] : `(?:${spellings.join("|")})`;
+}
+function escapeHtmlReference(path) {
+  return path.replace(/[&"']/g, (char) => ENTITY_SPELLINGS[char][0]);
+}
+function escapeQuotedReference(path, quote) {
+  const escaped = JSON.stringify(path).slice(1, -1);
+  return quote === '"' ? escaped : escaped.replace(new RegExp(escapeRegExp(quote), "g"), `\\${quote}`);
+}
+function escapeRawUrlPath(path) {
+  const encodeSpaces = path.startsWith(" ") || path.endsWith(" ");
+  return path.replace(/[\s\S]/g, (char) => {
+    if (char.charCodeAt(0) < 32 || ":?%#\\".includes(char) || encodeSpaces && char === " ") {
+      return encodeUrlPath(char);
+    }
+    return char;
+  });
+}
+function spellLike(reference, path, oldPath, context) {
+  const { syntax, quote, url, encodeAll } = context;
+  if (url && (encodeAll || reference !== oldPath && /%[0-9A-Fa-f]{2}/.test(reference)))
+    return encodeUrlPath(path);
+  switch (syntax) {
+    case "html": {
+      const escaped = escapeHtmlReference(url ? escapeRawUrlPath(path) : path);
+      return ["'", '"'].includes(quote) ? escaped : escaped.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+    }
+    case "script": {
+      if (!["'", '"', "`"].includes(quote)) return path;
+      const escaped = escapeQuotedReference(path, quote);
+      return quote === "`" ? escaped.replace(/\$\{/g, "\\${") : escaped;
+    }
+    case "css":
+      return url ? encodeUrlPath(path) : path;
+    case "plain":
+      return path;
+  }
+}
+function referenceSyntax(file) {
+  if (/\.html$/i.test(file)) return "html";
+  if (/\.css$/i.test(file)) return "css";
+  if (/\.(?:[cm]?js|jsx|tsx?|json)$/i.test(file)) return "script";
+  return "plain";
+}
+function decodeQuotedReference(text2, syntax) {
+  if (syntax === "css") return decodeCssEscapes(text2);
+  if (syntax === "script") {
+    const controls = { b: "\b", f: "\f", n: "\n", r: "\r", t: "	" };
+    return text2.replace(
+      /\\(?:u([0-9a-fA-F]{4})|([bfnrt"'`$\\/]))/g,
+      (_escaped, hex, char) => {
+        if (hex !== void 0) return String.fromCharCode(Number.parseInt(hex, 16));
+        return controls[char] ?? char;
+      }
+    );
+  }
+  return text2;
+}
 function referencePattern(oldPath, isDirectory) {
-  const name = oldPath.split("/").map(escapeRegExp).join(SEPARATOR);
+  const name = oldPath.split("/").map((segment) => Array.from(segment, referenceSpellings).join("")).join(SEPARATOR);
   const end = isDirectory ? `(?=${SEPARATOR})` : FILE_END;
   return new RegExp(
     String.raw`${REFERENCE_START}(?<lead>(?:\.{1,2}${SEPARATOR}|${SEPARATOR}){0,4})${name}${end}`,
     "g"
   );
 }
+function rewriteEntityAttributes(text2, rewrite) {
+  const parts = [];
+  let cursor = 0;
+  for (const tag of scanHtmlOpeningTags(text2)) {
+    for (const attr of tag.attributes) {
+      if (attr.kind !== "value") continue;
+      const decoded = decodeAuthoredAttribute(attr.value);
+      if (decoded === attr.value) continue;
+      let value = escapeHtmlReference(decoded);
+      if (!attr.quote)
+        value = value.replace(/[\t\n\f\r =<>`]/g, (char) => `&#${char.codePointAt(0)};`);
+      const source = `<x ${attr.name}=${attr.quote}${value}${attr.quote}>`;
+      const updated = rewrite(source);
+      if (updated === source) continue;
+      const replacement = scanHtmlOpeningTags(updated)[0].attributes[0];
+      if (replacement.kind !== "value") throw new Error("Reference rewrite removed its attribute");
+      parts.push(text2.slice(cursor, attr.valueStart), replacement.value);
+      cursor = attr.valueEnd;
+    }
+  }
+  parts.push(text2.slice(cursor));
+  return parts.join("");
+}
 function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
+  const oldIdentity = sep2 === "\\" ? oldPath.replace(/\\/g, "/") : oldPath;
   const pattern = referencePattern(oldPath, isDirectory);
   const around = /* @__PURE__ */ new Map();
   const afterLengths = /* @__PURE__ */ new Set();
@@ -4901,24 +5003,123 @@ function referenceRewriter(oldPath, newPath, isDirectory, existing = []) {
         before
       );
       afterLengths.add(after.length);
-      window2 = Math.max(window2, path.length * 3);
-    }
-  }
-  const normalized = (text2) => text2.replace(/\\{0,2}[\\/]/g, "/");
-  return (text2) => text2.replace(pattern, (...args) => {
-    const [match, offset] = [args[0], args.at(-3)];
-    const { lead } = args.at(-1);
-    const at = offset + lead.length;
-    const head = normalized(text2.slice(Math.max(0, at - window2), at));
-    const tail = normalized(text2.slice(offset + match.length, offset + match.length + window2));
-    const inLonger = [...afterLengths].some((after) => {
-      const befores = tail.length >= after && around.get(tail.slice(0, after));
-      return befores && [...befores].some(
-        ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+      window2 = Math.max(window2, path.length * 9);
+    }
+  }
+  const normalized = (text2, context, full2 = false) => {
+    let value = text2;
+    if (context.syntax === "html" || context.htmlAttribute) {
+      value = decodeAuthoredAttribute(value);
+    }
+    value = decodeQuotedReference(value, context.syntax);
+    if (context.url) {
+      value = value.replace(/\\/g, "/");
+      value = full2 ? decodedUrlPath(value) : decodeWellFormedEscapes(value);
+    }
+    return sep2 === "\\" ? value.replace(/\\/g, "/") : value;
+  };
+  return function rewriteText(text2, syntax = "html", normalizeEntities = true) {
+    if (syntax === "html" && normalizeEntities) {
+      text2 = rewriteEntityAttributes(text2, (source) => rewriteText(source, "html", false));
+    }
+    pattern.lastIndex = 0;
+    if (!pattern.test(text2)) return text2;
+    pattern.lastIndex = 0;
+    const tags = syntax === "html" ? scanHtmlOpeningTags(text2) : [];
+    const inlineRegions = tags.filter(
+      (tag) => tag.closed && ["script", "style"].includes(tag.name) && tag.rawTextEnd !== null
+    ).map((tag) => ({
+      start: tag.end,
+      end: tag.rawTextEnd,
+      syntax: tag.name === "style" ? "css" : "script"
+    }));
+    const attributes = tags.flatMap(
+      (tag) => tag.attributes.flatMap((attr) => attr.kind === "value" ? [attr] : [])
+    );
+    const cssContexts = syntax === "css" ? [{ start: 0, end: text2.length, htmlAttribute: false }] : [
+      ...inlineRegions.filter((region) => region.syntax === "css").map((region) => ({ ...region, htmlAttribute: false })),
+      ...attributes.filter((attr) => attr.name === "style").map((attr) => ({ ...attr, htmlAttribute: true }))
+    ];
+    const cssFields = (pattern2) => cssContexts.flatMap(
+      (context) => [...text2.slice(context.start, context.end).matchAll(pattern2)].map((match) => {
+        const prefix = /^(?:url\(\s*|@import\s+)/i.exec(match[0])[0];
+        const rest = match[0].slice(prefix.length);
+        const delimiter = context.htmlAttribute ? /^(?:["']|&quot;|&#39;|&apos;)/.exec(rest)?.[0] : /^["']/.exec(rest)?.[0];
+        const start = context.start + match.index + prefix.length + (delimiter?.length ?? 0);
+        return {
+          start,
+          end: context.start + match.index + match[0].length,
+          syntax: "css",
+          htmlAttribute: context.htmlAttribute,
+          encodeAll: true
+        };
+      })
+    );
+    const urlRegions = [
+      ...attributes.filter((attr) => ["src", "href", "poster", "xlink:href"].includes(attr.name)).map((attr) => ({
+        start: attr.valueStart + (/^[\t\n\f\r ]*/.exec(attr.value)?.[0].length ?? 0),
+        end: attr.valueEnd,
+        syntax: "html",
+        htmlAttribute: true,
+        encodeAll: false
+      })),
+      ...attributes.filter((attr) => attr.name === "srcset").flatMap(
+        (attr) => [...attr.value.matchAll(/(^|,)[\t\n\f\r ]*([^,\t\n\f\r ]+)/g)].map((match) => ({
+          start: attr.valueStart + match.index + match[0].length - match[2].length,
+          end: attr.valueStart + match.index + match[0].length,
+          syntax: "html",
+          htmlAttribute: true,
+          encodeAll: true
+        }))
+      ),
+      ...cssFields(
+        /\burl\((?:\s*"(?:\\.|[^"\\])*"\s*|\s*'(?:\\.|[^'\\])*'\s*|(?:\\.|[^)\\])*)\)/gi
+      ),
+      ...cssFields(/@import\s+(?:"[^"]*"|'[^']*')/gi)
+    ].sort((a, b) => a.start - b.start);
+    let urlIndex = 0;
+    let regionIndex = 0;
+    return text2.replace(pattern, (...args) => {
+      const [match, offset] = [args[0], args.at(-3)];
+      const { lead } = args.at(-1);
+      while (inlineRegions[regionIndex] && inlineRegions[regionIndex].end <= offset) regionIndex++;
+      const region = inlineRegions[regionIndex];
+      const matchSyntax = region && offset >= region.start ? region.syntax : syntax;
+      while (urlRegions[urlIndex] && urlRegions[urlIndex].end <= offset) urlIndex++;
+      const urlRegion = urlRegions[urlIndex];
+      const url = matchSyntax !== "script" && !!urlRegion && offset >= urlRegion.start;
+      const context = {
+        syntax: url ? urlRegion.syntax : matchSyntax,
+        url,
+        htmlAttribute: url && urlRegion.htmlAttribute,
+        encodeAll: url && urlRegion.encodeAll,
+        quote: text2[offset - 1] ?? ""
+      };
+      if (url && offset !== urlRegion.start) return match;
+      const reference = match.slice(lead.length);
+      if (normalized(reference, context, true) !== oldIdentity) return match;
+      if (isDirectory && !normalized(
+        text2.slice(offset + match.length, offset + match.length + 4),
+        context
+      ).startsWith("/"))
+        return match;
+      const at = offset + lead.length;
+      const head = normalized(text2.slice(Math.max(0, at - window2), at), context);
+      const tail = normalized(
+        text2.slice(offset + match.length, offset + match.length + window2),
+        context,
+        context.url
       );
+      const inLonger = [...afterLengths].some((after) => {
+        const befores = tail.length >= after && around.get(tail.slice(0, after));
+        return befores && [...befores].some(
+          ([length, set]) => head.length >= length && set.has(head.slice(head.length - length))
+        );
+      });
+      if (inLonger) return match;
+      return `${lead}${spellLike(reference, newPath, oldPath, context)}`;
     });
-    return inLonger ? match : `${lead}${newPath}`;
-  });
+  };
 }
 function occurrences(text2, part) {
   const at = [];
@@ -4951,7 +5152,7 @@ function updateReferences(projectDir, oldPath, newPath, isDirectory) {
     if (!isSafePath(projectDir, file) || isPrivateProjectFile(projectDir, file)) continue;
     const content = readableText(file);
     if (content === null) continue;
-    const updated = rewrite(content);
+    const updated = rewrite(content, referenceSyntax(file));
     if (updated !== content) {
       replaceFileAtomically(file, updated, statSync3(file).mode);
       updatedCount++;
@@ -5240,7 +5441,7 @@ async function prepareGsapMutationScript(c, res, firstMutation) {
   let block = extractGsapScriptBlock(html);
   if (!block && (firstMutation.type === "add" || firstMutation.type === "add-with-keyframes")) {
     const compId = html.match(/data-composition-id="([^"]+)"/)?.[1] ?? "main";
-    const { GSAP_CDN } = await import("./dist-2GC6XKRQ.js");
+    const { GSAP_CDN } = await import("./dist-XN234YFQ.js");
     const bootstrap = [
       `<script src="${GSAP_CDN}"></script>`,
       "<script>",
@@ -6828,10 +7029,11 @@ function registerFileRoutes(api, adapter) {
     const res = await resolveProjectFile(c, adapter, { mustExist: true });
     if ("error" in res) return res.error;
     const body = await c.req.json();
-    if (!body.newPath || body.newPath.includes("\0")) {
+    const newPath = body !== null && typeof body === "object" && "newPath" in body ? body.newPath : void 0;
+    if (typeof newPath !== "string" || !newPath || newPath.includes("\0") || /[\uD800-\uDFFF]/u.test(newPath)) {
       return c.json({ error: "newPath required" }, 400);
     }
-    const newAbs = resolveWithinProject(res.project.dir, body.newPath);
+    const newAbs = resolveWithinProject(res.project.dir, newPath);
     if (!newAbs) {
       return c.json({ error: "forbidden" }, 403);
     }
@@ -6841,8 +7043,8 @@ function registerFileRoutes(api, adapter) {
     const isDirectory = statSync3(res.absPath, { throwIfNoEntry: false })?.isDirectory() ?? false;
     ensureDir(res.project.dir, newAbs);
     renameSync2(res.absPath, newAbs);
-    const updatedFiles = updateReferences(res.project.dir, res.filePath, body.newPath, isDirectory);
-    return c.json({ ok: true, path: body.newPath, updatedReferences: updatedFiles });
+    const updatedFiles = updateReferences(res.project.dir, res.filePath, newPath, isDirectory);
+    return c.json({ ok: true, path: newPath, updatedReferences: updatedFiles });
   });
   api.post("/projects/:id/duplicate-file", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
@@ -8074,12 +8276,7 @@ async function generateThumbnail(path, signal) {
 async function resolveSource(adapter, id, url) {
   const project = await adapter.resolveProject(id);
   if (!project) throw new HTTPException(404);
-  let relative5;
-  try {
-    relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
-  } catch {
-    throw new HTTPException(400);
-  }
+  const relative5 = requestSubPath(url, "projects/:id/image-thumbnail");
   if (!/\.jpe?g$/i.test(relative5)) throw new HTTPException(415);
   const path = pinWithinProject(project.dir, relative5);
   if (!path) throw new HTTPException(404);
@@ -8616,7 +8813,7 @@ async function extractStill(projectDir, absPath, source, playhead, tools) {
     imagePath
   );
   if (failed) return failed;
-  const depth = relative4(projectDir, fileDir).split(sep2).filter(Boolean).length;
+  const depth = relative4(projectDir, fileDir).split(sep3).filter(Boolean).length;
   const stillPath = `${FREEZE_DIR.join("/")}/${fileName}`;
   return { imageSrc: `${"../".repeat(depth)}${stillPath}`, stillPath, imagePath };
 }
@@ -9159,9 +9356,6 @@ function isVideoPath(path) {
 function isImagePath(path) {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
-function normalizeProjectAssetPath(path) {
-  return path.trim().replace(/^[.]\//, "").replace(/[?#].*$/, "");
-}
 function containsNullByte(path) {
   return path.includes("\0");
 }
@@ -9226,7 +9420,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
   api.get("/projects/:id/media/metadata", async (c) => {
     const project = await adapter.resolveProject(c.req.param("id"));
     if (!project) return c.json({ error: "not found" }, 404);
-    const assetPath = normalizeProjectAssetPath(c.req.query("path") ?? "");
+    const assetPath = requestedProjectPath(project.dir, c.req.query("path") ?? "");
     if (!assetPath) return c.json({ error: "path required" }, 400);
     if (containsNullByte(assetPath)) return c.json({ error: "forbidden" }, 403);
     if (/^(?:https?:|data:|blob:)/i.test(assetPath)) {
@@ -9248,7 +9442,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       const project = await adapter.resolveProject(c.req.param("id"));
       if (!project) return c.json({ error: "not found" }, 404);
       const body = await c.req.json().catch(() => ({}));
-      const inputAssetPath = body.inputPath ? normalizeProjectAssetPath(body.inputPath) : "";
+      const inputAssetPath = body.inputPath ? requestedProjectPath(project.dir, body.inputPath) : "";
       if (!inputAssetPath) return c.json({ error: "inputPath required" }, 400);
       if (containsNullByte(inputAssetPath)) return c.json({ error: "forbidden" }, 403);
       if (/^(?:https?:|data:|blob:)/i.test(inputAssetPath)) {
@@ -9262,7 +9456,7 @@ function registerMediaRoutes(api, adapter, options = {}) {
       if (!inputIsVideo && !inputIsImage) {
         return c.json({ error: "background removal supports video or image assets only" }, 400);
       }
-      const requestedOutput = body.outputPath ? posix.normalize(normalizeProjectAssetPath(body.outputPath)) : "";
+      const requestedOutput = body.outputPath ? posix.normalize(requestedProjectPath(project.dir, body.outputPath)) : "";
       if (requestedOutput && containsNullByte(requestedOutput)) {
         return c.json({ error: "forbidden" }, 403);
       }
@@ -9693,7 +9887,6 @@ export {
   buildSubCompositionHtml,
   compositionsAffectedBy,
   applyFileMutations,
-  requestSubPath,
   MAX_UPLOAD_BYTES,
   affectsPreview,
   PREVIEW_BUNDLE_OPTIONS,

package/dist/{chunk-U7E736AJ.js → chunk-BFDJ63J5.js}

@@ -4,6 +4,9 @@ import { dirname as __hf_dirname } from "node:path";
 var require = __hf_createRequire(import.meta.url);
 var __filename = __hf_fileURLToPath(import.meta.url);
 var __dirname = __hf_dirname(__filename);
+import {
+  resolveWithinProject
+} from "./chunk-G75ENCEZ.js";
 import {
   MAX_AUDIO_GAIN_DB,
   formatAudioGain,
@@ -12,11 +15,28 @@ import {
 import {
   findFfBinary
 } from "./chunk-PJ3HDUCY.js";
+import {
+  decodeWellFormedEscapes,
+  decodedUrlPath,
+  readMediaOffsetSeconds
+} from "./chunk-ZLW2V65P.js";
 
-// ../studio-server/dist/chunk-DSVQ2U7J.js
+// ../studio-server/dist/chunk-32IH7WBY.js
 import { execFile } from "child_process";
 import { isAbsolute, relative, resolve } from "path";
 import { promisify } from "util";
+import { existsSync } from "fs";
+function requestSubPath(url, route) {
+  const routeSegments = route.split("/");
+  const segments = new URL(url).pathname.split("/");
+  const start = segments.indexOf(routeSegments[0] ?? "");
+  return decodeWellFormedEscapes(segments.slice(start + routeSegments.length).join("/"));
+}
+function requestedProjectPath(projectDir, field) {
+  const trimmed = field.trim().replace(/^[.]\//, "");
+  const named = resolveWithinProject(projectDir, trimmed);
+  return named && existsSync(named) ? trimmed : decodedUrlPath(trimmed);
+}
 var execFileAsync = promisify(execFile);
 var FFMPEG_TIMEOUT_MS = 12e4;
 function authoredNumber(raw, fallback, attribute, id, strictlyPositive = false) {
@@ -161,6 +181,13 @@ function requiredAudioIdentity(attributes) {
   if (!src) throw new Error(`Audio #${id} has no src`);
   return { id, src };
 }
+function authoredMediaStart(attributes, id) {
+  return readMediaOffsetSeconds((name) => {
+    const raw = attributes.get(name)?.value;
+    if (name === "data-media-start") authoredNumber(raw, 0, name, id);
+    return raw;
+  });
+}
 function hasBareAttribute(html, range, name) {
   const unquoted = html.slice(range.start, range.end).replace(/"[^"]*"|'[^']*'/g, '""');
   return new RegExp(`\\s${name}(?=[\\s/>=])`, "i").test(unquoted);
@@ -185,12 +212,7 @@ function mediaTagFromRange(html, range) {
     id,
     src,
     volume: authoredNumber(volumeAttribute?.value, 1, "data-volume", id),
-    mediaStart: authoredNumber(
-      attributes.get("data-media-start")?.value,
-      0,
-      "data-media-start",
-      id
-    ),
+    mediaStart: authoredMediaStart(attributes, id),
     duration: authoredDuration(attributes, id),
     playbackRate: authoredNumber(
       attributes.get("data-playback-rate")?.value,
@@ -217,13 +239,7 @@ function audioTags(html) {
   return tags;
 }
 function resolveLocalAudioPath(projectDir, src) {
-  const withoutSuffix = src.split(/[?#]/, 1)[0] ?? "";
-  let decoded = "";
-  try {
-    decoded = decodeURIComponent(withoutSuffix);
-  } catch {
-    throw new Error(`Audio source must be a local project file: ${src}`);
-  }
+  const decoded = requestedProjectPath(projectDir, src);
   if (!decoded || isAbsolute(decoded) || /^(?:[a-z][a-z\d+.-]*:|\/\/)/i.test(decoded)) {
     throw new Error(`Audio source must be a local project file: ${src}`);
   }
@@ -358,6 +374,8 @@ function absoluteLoudnessPlan(track, targetLufs = DEFAULT_TARGET_LUFS) {
 }
 
 export {
+  requestSubPath,
+  requestedProjectPath,
   audioTags,
   resolveLocalAudioPath,
   parseEbur128Summary,

package/dist/{chunk-WCJGTLPF.js → chunk-BHVFTYSI.js}

@@ -52,6 +52,7 @@ function downloadFile(url, dest, options = {}) {
   return new Promise((resolve, reject) => {
     const follow = (u, hops = 0) => {
       let activeResponse;
+      let responseDiscarded = false;
       let responsePipelineStarted = false;
       let requestError;
       let request;
@@ -61,15 +62,15 @@ function downloadFile(url, dest, options = {}) {
           if (res.statusCode && REDIRECT_CODES.has(res.statusCode)) {
             const location = res.headers.location;
             if (location) {
+              responseDiscarded = true;
+              res.destroy();
               if (hops >= MAX_REDIRECTS) {
-                res.resume();
                 removePartialFile(tmp);
                 reject(
                   new Error(`Download failed: more than ${MAX_REDIRECTS} redirects from ${url}`)
                 );
                 return;
               }
-              res.resume();
               try {
                 follow(redirectTarget(location, u), hops + 1);
               } catch (error) {
@@ -80,7 +81,8 @@ function downloadFile(url, dest, options = {}) {
             }
           }
           if (res.statusCode !== 200) {
-            res.resume();
+            responseDiscarded = true;
+            res.destroy();
             removePartialFile(tmp);
             reject(new Error(`Download failed: HTTP ${res.statusCode}`));
             return;
@@ -107,6 +109,7 @@ function downloadFile(url, dest, options = {}) {
         request.destroy(new Error(`Download timed out after ${timeoutMs}ms`));
       });
       request.on("error", (err) => {
+        if (responseDiscarded) return;
         if (responsePipelineStarted) {
           requestError = err;
           activeResponse?.destroy(err);