@officexapp/vidfarm-devcli 0.21.10

package/dist/src/devcli/local-frontend-server.js

@@ -0,0 +1,681 @@
+// Backend-free curated local frontend for the PUBLISHED cloud-only CLI.
+//
+// The full `vidfarm serve` boots the real Hono `app` in-process (records +
+// storage on disk, free local render) — but that requires shipping the 26k-line
+// backend, which the published package deliberately omits. This module is the
+// published-package fallback: a tiny Node http server that ships ZERO backend.
+// It only
+//   1. serves BUILD-TIME HTML SNAPSHOTS of the client-hydrated pages
+//      (/editor, /tools/*, /library/{raws,files}) from public/serve-shells,
+//   2. serves their prebuilt static bundles (demo/dist editor + public/assets),
+//   3. reverse-proxies their data/API calls (/api, /raws, /clips, /composition,
+//      /auto-login, /editor/*/composition) to the logged-in cloud host,
+//   4. intercepts the editor's render POST and runs it ON THIS MACHINE via the
+//      bundled hyperframes CLI (free local render — no backend needed; an
+//      explicit render_target:"cloud" still proxies to the billed renderer),
+//   5. serves the same live-reload SSE the full backend does, driven by
+//      polling the cloud working copy of watched forks, so open editor tabs
+//      live-morph when `vidfarm publish` / another tab changes the fork, and
+//   6. for every OTHER route, shows a small "this page lives in the cloud"
+//      interstitial with an open-in-new-tab button (browser page loads), so
+//      users aren't silently auto-forwarded off localhost; non-HTML requests
+//      still 302 to https://vidfarm.cc/* so programmatic fetches keep working.
+//
+// It imports only Node built-ins + the CLI's own backend-free helpers
+// (auth-store, lib/package-root), so it stays inside the public static closure
+// and never drags a backend module into the tarball.
+import { createServer } from "node:http";
+import { createReadStream, existsSync, readFileSync, statSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { Readable } from "node:stream";
+import { resolveRootFileCandidates } from "../lib/package-root.js";
+const DEFAULT_HOST = "https://vidfarm.cc";
+// ── snapshot + asset resolution ─────────────────────────────────────────────
+function readRootFile(relativePath) {
+    for (const candidate of resolveRootFileCandidates(relativePath)) {
+        if (existsSync(candidate)) {
+            try {
+                return readFileSync(candidate);
+            }
+            catch {
+                // keep trying other candidates
+            }
+        }
+    }
+    return null;
+}
+/** True when the shipped snapshots exist next to this CLI (or in the cwd). */
+export function serveShellsPresent() {
+    return readRootFile("public/serve-shells/editor.html") !== null;
+}
+// The client-hydrated pages we can serve locally, mapped to their snapshot file.
+// SSR-data pages (/library/approved, /library/logs) are intentionally absent —
+// they render per-user data server-side, so a static snapshot would be stale;
+// those get the cloud-only interstitial like every other non-served route.
+function shellFileForPath(pathname) {
+    const p = pathname.replace(/\/+$/, "") || "/";
+    // Editor: any /editor or /editor/... EXCEPT the composition data sub-route.
+    if ((p === "/editor" || p.startsWith("/editor/")) && !p.endsWith("/composition")) {
+        return "editor.html";
+    }
+    // Bare /library mirrors the cloud default (Files view).
+    if (p === "/library" || p === "/library/files")
+        return "library-files.html";
+    if (p === "/library/raws" || p === "/library/clips")
+        return "library-raws.html";
+    if (p === "/tools" || p === "/tools/image" || p === "/inpaint" || p === "/inpaint/image")
+        return "tools-image.html";
+    if (p === "/tools/video" || p === "/inpaint/video")
+        return "tools-video.html";
+    if (p === "/tools/clipper" || p === "/inpaint/clipper")
+        return "tools-clipper.html";
+    return null;
+}
+// Prefixes whose requests are reverse-proxied to the cloud host (the pages'
+// data plane). Everything the served shells fetch at runtime lives here.
+const PROXY_PREFIXES = ["/api/", "/raws", "/clips", "/composition", "/auto-login", "/me/"];
+function isProxyPath(pathname) {
+    if (pathname.startsWith("/editor/") && pathname.endsWith("/composition"))
+        return true;
+    return PROXY_PREFIXES.some((prefix) => prefix.endsWith("/") ? pathname.startsWith(prefix) : pathname === prefix || pathname.startsWith(prefix + "/"));
+}
+// ── default-fork resolution (editor) ────────────────────────────────────────
+// The cloud's GET /editor/<templateId> resolves the caller's per-user fork
+// (most-recent own fork → template default fork → mint one) and 302s to
+// /editor/<tid>/fork/<forkId>. The SPA reads its fork id ONLY off that URL
+// segment — without it, it loads the template's raw ORIGINAL composition and
+// the decomposed default fork never appears. So a bare /editor/<templateId>
+// page load asks the cloud where it WOULD redirect (redirect:"manual" + the
+// stored api key, same trick as services/upstream.ts resolveUpstreamForkId)
+// and replays that redirect locally. Best-effort: any failure falls through
+// to serving the shell exactly as before.
+const FORK_RESOLVE_TIMEOUT_MS = 15_000;
+async function resolveEditorForkRedirect(host, pathname, search, auth) {
+    if (!auth?.apiKey)
+        return null;
+    // Only bare /editor/<template_...> (no /fork/ segment) needs resolution.
+    const match = pathname.match(/^\/editor\/(template_[^/]+)\/?$/);
+    if (!match)
+        return null;
+    try {
+        const res = await fetch(`${host}${pathname}${search}`, {
+            method: "GET",
+            redirect: "manual",
+            headers: { accept: "text/html", "vidfarm-api-key": auth.apiKey },
+            signal: AbortSignal.timeout(FORK_RESOLVE_TIMEOUT_MS)
+        });
+        if (res.status < 300 || res.status >= 400)
+            return null;
+        const location = res.headers.get("location");
+        if (!location)
+            return null;
+        const target = new URL(location, host);
+        // Follow only the fork-form editor redirect (never e.g. /login).
+        if (!/^\/editor\/[^/]+\/fork\/[^/]+\/?$/.test(target.pathname))
+            return null;
+        return `${target.pathname}${target.search}`;
+    }
+    catch {
+        return null;
+    }
+}
+// ── boot injection (editor) ─────────────────────────────────────────────────
+/** Escape a JSON string for safe embedding inside a <script> element. */
+function escapeJsonForHtml(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026");
+}
+function editorBoot(pathname, query, auth) {
+    const loggedIn = Boolean(auth?.apiKey);
+    const accountId = auth?.customerId ?? "";
+    // /editor/<templateId>[/fork/<forkId>] — a bare /editor (or /editor/original)
+    // is a fresh blank project the SPA persists client-side.
+    const match = pathname.match(/^\/editor\/([^/]+)/);
+    const templateId = match?.[1] && match[1] !== "original" ? decodeURIComponent(match[1]) : "original";
+    const isBlank = templateId === "original";
+    return {
+        compositionId: templateId,
+        inspirationId: null,
+        slugId: templateId,
+        templateId,
+        title: isBlank ? "Untitled project" : "VidFarm Studio",
+        origin: isBlank ? "raw" : null,
+        originalUrl: null,
+        songName: null,
+        songUrl: null,
+        initialThreadId: query.get("thread") || null,
+        jobRunsUrl: accountId ? `/job-runs?account=${encodeURIComponent(accountId)}` : "/job-runs",
+        // Logged out → free-tier client-only editor (IndexedDB autosave, no cloud
+        // persist/render). Logged in → the cloud account is paid, so drop the gate
+        // and let persist/chat/render proxy to the cloud host.
+        freeTier: !loggedIn,
+        editorChatApiUrl: "/api/v1/editor-chat",
+        vidfarmApiKey: auth?.apiKey ?? null,
+        // Renders run locally (the shell intercepts the render POST and drives the
+        // bundled hyperframes CLI — free; with a login the Render button becomes
+        // the local/cloud picker), and live-reload is on: the shell polls the
+        // cloud working copy of watched forks and pushes the same `reload` SSE the
+        // full-backend serve emits, so `vidfarm publish` / other tabs live-morph
+        // into an open editor instead of requiring a new tab.
+        liveReload: true,
+        localRender: true,
+        cloudRenderAvailable: loggedIn
+    };
+}
+function fillShell(shellFile, html, pathname, query, auth) {
+    const accountId = auth?.customerId ?? "";
+    let out = html.split("{{ACCOUNT_ID}}").join(accountId);
+    out = out.split("{{API_KEY}}").join(auth?.apiKey ?? "");
+    if (shellFile === "editor.html") {
+        const boot = editorBoot(pathname, query, auth);
+        out = out.split("{{HF_BOOT_JSON}}").join(escapeJsonForHtml(boot));
+        out = out.split("{{PAGE_TITLE}}").join(`${boot.title} | VidFarm Studio`);
+    }
+    return out;
+}
+// ── static asset serving ────────────────────────────────────────────────────
+const MIME = {
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".html": "text/html; charset=utf-8",
+    ".ico": "image/x-icon",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2"
+};
+/** Resolve an /assets/* URL to a repo-relative file, or null if unknown. */
+function assetRelativePath(pathname) {
+    // The hyperframes trackpad editor bundle lives in demo/dist and is served
+    // under /assets/editor/*; everything else is a public/assets bundle.
+    if (pathname.startsWith("/assets/editor/")) {
+        const rest = pathname.slice("/assets/editor/".length);
+        if (rest.includes(".."))
+            return null;
+        return path.posix.join("demo/dist", rest);
+    }
+    if (pathname.startsWith("/assets/")) {
+        const rest = pathname.slice("/assets/".length);
+        if (rest.includes(".."))
+            return null;
+        return path.posix.join("public/assets", rest);
+    }
+    return null;
+}
+function serveAsset(res, pathname) {
+    // Sentry is backend-generated; a no-op stub keeps the shell's <script> from 404ing.
+    if (pathname === "/assets/sentry-config.js") {
+        res.statusCode = 200;
+        res.setHeader("content-type", MIME[".js"]);
+        res.setHeader("cache-control", "no-cache");
+        res.end("// sentry disabled (local frontend)\n");
+        return true;
+    }
+    const rel = assetRelativePath(pathname);
+    if (!rel)
+        return false;
+    const buf = readRootFile(rel);
+    if (!buf)
+        return false;
+    res.statusCode = 200;
+    res.setHeader("content-type", MIME[path.extname(rel)] ?? "application/octet-stream");
+    res.setHeader("cache-control", "no-cache");
+    res.end(buf);
+    return true;
+}
+// ── reverse proxy to the cloud host ─────────────────────────────────────────
+// Hop-by-hop headers are stripped so we forward a clean request/response.
+const HOP_BY_HOP = new Set([
+    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
+    "te", "trailer", "transfer-encoding", "upgrade", "host", "content-length"
+]);
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+async function proxyToCloud(req, res, host, pathWithSearch, auth, bodyOverride) {
+    const target = new URL(pathWithSearch, host);
+    const headers = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        if (HOP_BY_HOP.has(key.toLowerCase()))
+            continue;
+        headers[key] = Array.isArray(value) ? value.join(", ") : value;
+    }
+    // Inject the persisted login so proxied data calls authenticate as the
+    // logged-in account even if the browser didn't attach the key itself.
+    if (auth?.apiKey) {
+        headers["vidfarm-api-key"] = auth.apiKey;
+        headers["authorization"] = `Bearer ${auth.apiKey}`;
+    }
+    const method = req.method ?? "GET";
+    const body = method === "GET" || method === "HEAD" ? undefined : (bodyOverride ?? await readBody(req));
+    let upstream;
+    try {
+        upstream = await fetch(target, { method, headers, body: body, redirect: "manual" });
+    }
+    catch (error) {
+        res.statusCode = 502;
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ error: "upstream_unreachable", detail: error instanceof Error ? error.message : String(error), host }));
+        return;
+    }
+    res.statusCode = upstream.status;
+    upstream.headers.forEach((value, key) => {
+        if (HOP_BY_HOP.has(key.toLowerCase()))
+            return;
+        if (key.toLowerCase() === "content-encoding")
+            return; // fetch already decoded the body
+        res.setHeader(key, value);
+    });
+    res.setHeader("x-vidfarm-upstream", host);
+    if (upstream.body) {
+        // Stream the response (covers SSE from /api/v1/editor-chat too).
+        Readable.fromWeb(upstream.body).pipe(res);
+    }
+    else {
+        res.end();
+    }
+}
+// ── live reload (cloud-poll edition) ────────────────────────────────────────
+// The full-backend serve watches the working composition ON DISK and pushes a
+// `reload` SSE so an open editor tab live-morphs when an agent edits the file.
+// This shell has no disk copy — the working state lives on the cloud host — so
+// an open tab used to go stale the moment `vidfarm publish` (or another tab)
+// updated the fork, and users learned to open new tabs. Same SSE contract
+// (`/api/v1/dev/events`, event `reload`, data `{forkId}`), different change
+// source: while at least one tab is subscribed, poll the cloud working copy of
+// every fork a tab has touched and broadcast when its content hash moves.
+// Self-saves are suppressed by pre-seeding the hash from proxied PUT bodies —
+// the shell's equivalent of the backend's compositionWatch.suppressFork.
+const LIVE_POLL_INTERVAL_MS = 3_000;
+const LIVE_WATCH_TTL_MS = 30 * 60_000;
+const LIVE_WATCH_MAX_FORKS = 8;
+const watchedForks = new Map();
+const sseClients = new Set();
+let livePollTimer = null;
+let livePollInFlight = false;
+function contentHash(body) {
+    return createHash("sha256").update(body).digest("hex");
+}
+/** Record that a tab uses this fork; an explicit hash pre-seeds/suppresses. */
+function noteForkSeen(forkId, hash) {
+    const existing = watchedForks.get(forkId);
+    watchedForks.set(forkId, { hash: hash ?? existing?.hash ?? null, lastSeen: Date.now() });
+    // Keep the watch list tiny — drop the stalest fork beyond the cap.
+    if (watchedForks.size > LIVE_WATCH_MAX_FORKS) {
+        let oldest = null;
+        let oldestSeen = Infinity;
+        for (const [id, entry] of watchedForks) {
+            if (entry.lastSeen < oldestSeen) {
+                oldest = id;
+                oldestSeen = entry.lastSeen;
+            }
+        }
+        if (oldest)
+            watchedForks.delete(oldest);
+    }
+}
+function broadcastReload(forkId) {
+    const frame = `event: reload\ndata: ${JSON.stringify({ forkId })}\n\n`;
+    for (const client of sseClients) {
+        try {
+            client.write(frame);
+        }
+        catch { /* dropped client — close handler prunes it */ }
+    }
+}
+async function pollWatchedForks(host, auth) {
+    if (livePollInFlight)
+        return;
+    livePollInFlight = true;
+    try {
+        const now = Date.now();
+        for (const [forkId, entry] of watchedForks) {
+            if (now - entry.lastSeen > LIVE_WATCH_TTL_MS) {
+                watchedForks.delete(forkId);
+                continue;
+            }
+            try {
+                const res = await fetch(`${host}/api/v1/compositions/${encodeURIComponent(forkId)}/composition.html`, {
+                    headers: auth?.apiKey ? { "vidfarm-api-key": auth.apiKey } : {},
+                    signal: AbortSignal.timeout(10_000)
+                });
+                if (!res.ok)
+                    continue;
+                const hash = contentHash(await res.text());
+                if (entry.hash !== null && entry.hash !== hash)
+                    broadcastReload(forkId);
+                entry.hash = hash;
+            }
+            catch { /* transient — retry next tick */ }
+        }
+    }
+    finally {
+        livePollInFlight = false;
+    }
+}
+// Poll only while a tab is actually listening; idle shells make zero requests.
+function syncLivePollLoop(host, auth) {
+    if (sseClients.size > 0 && !livePollTimer) {
+        livePollTimer = setInterval(() => { void pollWatchedForks(host, auth); }, LIVE_POLL_INTERVAL_MS);
+        livePollTimer.unref?.();
+        void pollWatchedForks(host, auth); // immediate baseline
+    }
+    else if (sseClients.size === 0 && livePollTimer) {
+        clearInterval(livePollTimer);
+        livePollTimer = null;
+    }
+}
+function handleDevEventsStream(req, res, host, auth) {
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/event-stream");
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("connection", "keep-alive");
+    res.write(": connected\n\n");
+    sseClients.add(res);
+    syncLivePollLoop(host, auth);
+    // Keep intermediaries from timing the stream out.
+    const ping = setInterval(() => {
+        try {
+            res.write(": ping\n\n");
+        }
+        catch { /* close handler cleans up */ }
+    }, 25_000);
+    ping.unref?.();
+    req.on("close", () => {
+        clearInterval(ping);
+        sseClients.delete(res);
+        syncLivePollLoop(host, auth);
+    });
+}
+const localRenders = new Map();
+const localRenderDir = path.join(os.tmpdir(), "vidfarm-serve-renders");
+// Synthetic progress: hyperframes runs captured, so creep toward 93% on an
+// elapsed-time estimate and snap to 1 on completion. UI-only.
+const LOCAL_RENDER_ESTIMATE_MS = 3 * 60_000;
+function localRenderStatusJson(renderId, record) {
+    const progress = record.status === "SUCCEEDED"
+        ? 1
+        : record.status === "FAILED"
+            ? 0
+            : Math.min(0.93, 0.04 + ((Date.now() - record.startedAt) / LOCAL_RENDER_ESTIMATE_MS) * 0.9);
+    return {
+        ok: true,
+        renderId,
+        render_target: "local",
+        title: record.title,
+        status: record.status,
+        progress,
+        cost: "$0.00 (local render)",
+        outputUrl: record.status === "SUCCEEDED" ? `/local-renders/${encodeURIComponent(renderId)}.mp4` : undefined,
+        error: record.error,
+        fatalErrorEncountered: record.status === "FAILED" ? true : undefined
+    };
+}
+function sendJson(res, status, payload) {
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader("cache-control", "no-store");
+    res.end(JSON.stringify(payload));
+}
+async function startLocalRender(input) {
+    const submittedHtml = typeof input.body.html === "string" && input.body.html.includes("data-composition-id=")
+        ? input.body.html
+        : null;
+    let compositionHtml = submittedHtml;
+    if (!compositionHtml) {
+        const res = await fetch(`${input.host}/api/v1/compositions/${encodeURIComponent(input.forkId)}/composition.html`, {
+            headers: input.auth?.apiKey ? { "vidfarm-api-key": input.auth.apiKey } : {}
+        });
+        if (!res.ok)
+            throw new Error(`Could not load composition.html for ${input.forkId} (${res.status}). Log in with \`vidfarm login\` or render from the editor (which submits the HTML).`);
+        compositionHtml = await res.text();
+        if (!compositionHtml.includes("data-composition-id=")) {
+            throw new Error(`Composition for ${input.forkId} is missing data-composition-id — not renderable.`);
+        }
+    }
+    else if (input.auth?.apiKey) {
+        // The cloud route persists submitted HTML to the fork's working copy as a
+        // side effect of render; mirror that so the account's saved state matches
+        // what was rendered. Best-effort — the local render proceeds regardless.
+        void fetch(`${input.host}/api/v1/compositions/${encodeURIComponent(input.forkId)}/composition.html`, {
+            method: "PUT",
+            headers: { "content-type": "text/html; charset=utf-8", "vidfarm-api-key": input.auth.apiKey },
+            body: submittedHtml
+        }).catch(() => { });
+    }
+    const renderId = `local-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+    const title = typeof input.body.title === "string" && input.body.title.trim() ? input.body.title.trim() : input.forkId;
+    const record = { status: "RUNNING", title, startedAt: Date.now() };
+    localRenders.set(renderId, record);
+    await mkdir(localRenderDir, { recursive: true });
+    const outputPath = path.join(localRenderDir, `${renderId}.mp4`);
+    void (async () => {
+        try {
+            const { renderCompositionLocally } = await import("./local-render.js");
+            await renderCompositionLocally({
+                compositionHtml: compositionHtml,
+                outputPath,
+                stdio: "capture"
+            });
+            record.status = "SUCCEEDED";
+            record.outputPath = outputPath;
+            record.endedAt = Date.now();
+            console.log(`[vidfarm] local render ${renderId} finished (${((record.endedAt - record.startedAt) / 1000).toFixed(1)}s) → ${outputPath}`);
+        }
+        catch (error) {
+            record.status = "FAILED";
+            record.error = error instanceof Error ? error.message : String(error);
+            record.endedAt = Date.now();
+            console.error(`[vidfarm] local render ${renderId} failed: ${record.error}`);
+        }
+    })();
+    return { renderId, record };
+}
+// ── cloud-only interstitial ─────────────────────────────────────────────────
+// Shown instead of an auto-forwarding 302 when a browser navigates to a route
+// the local frontend doesn't serve. Keeps the user oriented on localhost and
+// opens the cloud page in a new tab.
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function renderCloudOnlyPage(cloudUrl, pathname) {
+    const safeUrl = escapeHtml(cloudUrl);
+    const safePath = escapeHtml(pathname);
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Available in cloud | VidFarm</title>
+<style>
+  body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#fbfbfb;color:#171717;font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
+  .card{max-width:440px;margin:24px;padding:36px 32px;background:#fff;border:1px solid #ededed;border-radius:16px;box-shadow:0 4px 24px -8px #00000026,0 1px 2px #0000000d;text-align:center}
+  h1{margin:0 0 8px;font-size:19px}
+  p{margin:0 0 20px;color:#737373}
+  code{font-size:13px;background:#f5f5f5;border-radius:6px;padding:2px 6px}
+  .open{display:inline-block;padding:10px 22px;border-radius:999px;background:#ffc738;color:#171717;font-weight:600;text-decoration:none}
+  .open:hover{background:#fcb900}
+  .hint{margin-top:16px;font-size:13px;color:#a3a3a3}
+</style>
+</head>
+<body>
+<div class="card">
+  <h1>This page is available in cloud</h1>
+  <p><code>${safePath}</code> isn't served by the local devcli frontend — open it on VidFarm cloud with the link below.</p>
+  <a class="open" href="${safeUrl}" target="_blank" rel="noopener noreferrer">Open in VidFarm cloud</a>
+  <div class="hint">Local pages: /editor, /tools/*, /library, /library/raws, /library/files</div>
+</div>
+</body>
+</html>
+`;
+}
+export function startLocalFrontendServer(opts) {
+    const host = opts.host.replace(/\/+$/, "");
+    const server = createServer((req, res) => {
+        void handleRequest(req, res, host, opts.auth).catch((error) => {
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.setHeader("content-type", "text/plain");
+            }
+            res.end(`Local frontend error: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.port, () => resolve({ port: opts.port, host }));
+    });
+}
+async function handleRequest(req, res, host, auth) {
+    const rawUrl = req.url ?? "/";
+    const parsed = new URL(rawUrl, "http://localhost");
+    const pathname = parsed.pathname;
+    // 1. Static bundles (editor + public/assets).
+    if (pathname.startsWith("/assets/")) {
+        if (serveAsset(res, pathname))
+            return;
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+    }
+    // 2. Live-reload SSE for open editor tabs (see the live-reload section).
+    if (pathname === "/api/v1/dev/events" && req.method === "GET") {
+        handleDevEventsStream(req, res, host, auth);
+        return;
+    }
+    // Track which forks tabs are using, and pre-seed hashes from saves so a
+    // tab's own PUT never bounces back as a reload.
+    const compositionFile = pathname.match(/^\/api\/v1\/compositions\/([^/]+)\/composition\.html\/?$/);
+    if (compositionFile && (req.method === "PUT" || req.method === "POST")) {
+        const forkId = decodeURIComponent(compositionFile[1]);
+        const bodyBuf = await readBody(req);
+        noteForkSeen(forkId, contentHash(bodyBuf));
+        await proxyToCloud(req, res, host, pathname + parsed.search, auth, bodyBuf);
+        return;
+    }
+    if (compositionFile && req.method === "GET") {
+        noteForkSeen(decodeURIComponent(compositionFile[1]));
+    }
+    const editorForkPage = req.method === "GET" ? pathname.match(/^\/editor\/[^/]+\/fork\/([^/]+)\/?$/) : null;
+    if (editorForkPage)
+        noteForkSeen(decodeURIComponent(editorForkPage[1]));
+    // 3. Render endpoints → run ON THIS MACHINE via the bundled hyperframes CLI
+    // (free), unless the caller explicitly asked for the billed cloud renderer.
+    const renderPost = req.method === "POST" ? pathname.match(/^\/api\/v1\/compositions\/([^/]+)\/render\/?$/) : null;
+    if (renderPost) {
+        const bodyBuf = await readBody(req);
+        let body = {};
+        try {
+            body = JSON.parse(bodyBuf.toString("utf8") || "{}");
+        }
+        catch { /* tolerate empty body */ }
+        const target = body.render_target ?? body.target;
+        if (target === "cloud") {
+            await proxyToCloud(req, res, host, pathname + parsed.search, auth, bodyBuf);
+            return;
+        }
+        try {
+            const renderForkId = decodeURIComponent(renderPost[1]);
+            // The render intercept PUTs the submitted html back to the cloud working
+            // copy — pre-seed the hash so that save doesn't echo back as a reload.
+            if (typeof body.html === "string" && body.html)
+                noteForkSeen(renderForkId, contentHash(body.html));
+            const { renderId, record } = await startLocalRender({ host, auth, forkId: renderForkId, body });
+            sendJson(res, 202, localRenderStatusJson(renderId, record));
+        }
+        catch (error) {
+            sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) });
+        }
+        return;
+    }
+    // Status polls for local renders; unknown render ids (cloud renders) proxy on.
+    const renderPoll = req.method === "GET" ? pathname.match(/^\/api\/v1\/compositions\/[^/]+\/renders\/([^/]+)\/?$/) : null;
+    if (renderPoll) {
+        const renderId = decodeURIComponent(renderPoll[1]);
+        const record = localRenders.get(renderId);
+        if (record) {
+            sendJson(res, 200, localRenderStatusJson(renderId, record));
+            return;
+        }
+    }
+    // Finished local render MP4s.
+    const renderFile = req.method === "GET" ? pathname.match(/^\/local-renders\/([^/]+)\.mp4$/) : null;
+    if (renderFile) {
+        const record = localRenders.get(decodeURIComponent(renderFile[1]));
+        if (!record?.outputPath || !existsSync(record.outputPath)) {
+            res.statusCode = 404;
+            res.end("Render output not found");
+            return;
+        }
+        res.statusCode = 200;
+        res.setHeader("content-type", "video/mp4");
+        res.setHeader("content-length", String(statSync(record.outputPath).size));
+        res.setHeader("content-disposition", `inline; filename="vidfarm-${path.basename(record.outputPath)}"`);
+        createReadStream(record.outputPath).pipe(res);
+        return;
+    }
+    // 4. Data plane → reverse-proxy to the cloud host.
+    if (isProxyPath(pathname)) {
+        await proxyToCloud(req, res, host, pathname + parsed.search, auth);
+        return;
+    }
+    // 5. Bare /editor/<templateId> → mirror the cloud's per-user default-fork
+    // resolution so the SPA lands on /editor/<tid>/fork/<forkId> (the decomposed
+    // fork) instead of the template's raw original composition.
+    if (req.method === "GET") {
+        const forkPath = await resolveEditorForkRedirect(host, pathname, parsed.search, auth);
+        if (forkPath) {
+            res.statusCode = 302;
+            res.setHeader("location", forkPath);
+            res.setHeader("cache-control", "no-store");
+            res.end();
+            return;
+        }
+    }
+    // 6. Locally-served page shells (client-hydrated) → snapshot + boot fill.
+    const shellFile = shellFileForPath(pathname);
+    if (shellFile && req.method === "GET") {
+        const html = readRootFile(`public/serve-shells/${shellFile}`);
+        if (html) {
+            res.statusCode = 200;
+            res.setHeader("content-type", "text/html; charset=utf-8");
+            res.setHeader("cache-control", "no-cache");
+            res.end(fillShell(shellFile, html.toString("utf8"), pathname, parsed.searchParams, auth));
+            return;
+        }
+    }
+    // 7. Everything else lives on the cloud host. Browser page loads get an
+    // explicit interstitial (no confusing silent auto-forward off localhost);
+    // anything programmatic (non-GET, or not asking for HTML) still 302s.
+    const cloudUrl = `${host}${pathname}${parsed.search}`;
+    const wantsHtml = (req.headers.accept ?? "").includes("text/html");
+    if (req.method === "GET" && wantsHtml) {
+        res.statusCode = 200;
+        res.setHeader("content-type", "text/html; charset=utf-8");
+        res.setHeader("cache-control", "no-cache");
+        res.end(renderCloudOnlyPage(cloudUrl, pathname));
+        return;
+    }
+    res.statusCode = 302;
+    res.setHeader("location", cloudUrl);
+    res.end();
+}
+//# sourceMappingURL=local-frontend-server.js.map