@playdrop/playdrop-cli 0.16.2 → 0.16.11

package/dist/commands/devServer.js

@@ -22,30 +22,27 @@ const node_http_1 = __importDefault(require("node:http"));
 const node_path_1 = require("node:path");
 const npmProcess_1 = require("./npmProcess");
 exports.DEV_ROUTER_PORT = 8888;
-const DEV_ROUTER_HOST = '127.0.0.1';
-const CONTROL_PREFIX = '/_playdrop';
+const DEV_ROUTER_HOST = "127.0.0.1";
+const CONTROL_PREFIX = "/_playdrop";
 const DEV_ROUTER_PROTOCOL_VERSION = 3;
-const APPROVED_PLAYDROP_WEB_ORIGINS = new Set([
-    'https://playdrop.ai',
-    'https://www.playdrop.ai',
-]);
+const APPROVED_PLAYDROP_WEB_ORIGINS = new Set(["https://playdrop.ai", "https://www.playdrop.ai"]);
 const CONTENT_TYPE_BY_EXTENSION = {
-    '.html': 'text/html; charset=utf-8',
-    '.js': 'application/javascript; charset=utf-8',
-    '.mjs': 'application/javascript; charset=utf-8',
-    '.cjs': 'application/javascript; charset=utf-8',
-    '.css': 'text/css; charset=utf-8',
-    '.json': 'application/json; charset=utf-8',
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.svg': 'image/svg+xml',
-    '.webp': 'image/webp',
-    '.glb': 'model/gltf-binary',
-    '.gltf': 'model/gltf+json',
-    '.wasm': 'application/wasm',
-    '.mp4': 'video/mp4',
-    '.webm': 'video/webm',
+    ".html": "text/html; charset=utf-8",
+    ".js": "application/javascript; charset=utf-8",
+    ".mjs": "application/javascript; charset=utf-8",
+    ".cjs": "application/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".glb": "model/gltf-binary",
+    ".gltf": "model/gltf+json",
+    ".wasm": "application/wasm",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
 };
 const routerMountsById = new Map();
 const routerMountIdsByKey = new Map();
@@ -64,37 +61,37 @@ function resolveApprovedDevRouterOrigin(originHeader) {
     if (APPROVED_PLAYDROP_WEB_ORIGINS.has(parsedOrigin.origin)) {
         return parsedOrigin.origin;
     }
-    const isLocalWebOrigin = (parsedOrigin.protocol === 'http:' || parsedOrigin.protocol === 'https:')
-        && (parsedOrigin.hostname === 'localhost' || parsedOrigin.hostname === '127.0.0.1');
+    const isLocalWebOrigin = (parsedOrigin.protocol === "http:" || parsedOrigin.protocol === "https:") &&
+        (parsedOrigin.hostname === "localhost" || parsedOrigin.hostname === "127.0.0.1");
     return isLocalWebOrigin ? parsedOrigin.origin : null;
 }
 function resolveContentType(filePath) {
     const extension = (0, node_path_1.extname)(filePath).toLowerCase();
-    return CONTENT_TYPE_BY_EXTENSION[extension] || 'application/octet-stream';
+    return CONTENT_TYPE_BY_EXTENSION[extension] || "application/octet-stream";
 }
 function getCliEntrypointPath() {
-    return (0, node_path_1.resolve)(__dirname, '..', 'index.js');
+    return (0, node_path_1.resolve)(__dirname, "..", "index.js");
 }
 function buildMountKey(creatorUsername, appType, appName) {
     return `${creatorUsername}:${appType}:${appName}`;
 }
 function encodeMountConflictError(details) {
-    const encoded = Buffer.from(JSON.stringify(details), 'utf8').toString('base64url');
+    const encoded = Buffer.from(JSON.stringify(details), "utf8").toString("base64url");
     return `mount_conflict:${encoded}`;
 }
 function parseMountConflictError(message) {
-    if (!message.startsWith('mount_conflict:')) {
+    if (!message.startsWith("mount_conflict:")) {
         return null;
     }
     try {
-        const decoded = Buffer.from(message.slice('mount_conflict:'.length), 'base64url').toString('utf8');
+        const decoded = Buffer.from(message.slice("mount_conflict:".length), "base64url").toString("utf8");
         const payload = JSON.parse(decoded);
-        if (typeof payload.ref !== 'string'
-            || typeof payload.ownerPid !== 'number'
-            || !Number.isInteger(payload.ownerPid)
-            || payload.ownerPid <= 0
-            || typeof payload.repoRoot !== 'string'
-            || typeof payload.htmlPath !== 'string') {
+        if (typeof payload.ref !== "string" ||
+            typeof payload.ownerPid !== "number" ||
+            !Number.isInteger(payload.ownerPid) ||
+            payload.ownerPid <= 0 ||
+            typeof payload.repoRoot !== "string" ||
+            typeof payload.htmlPath !== "string") {
             return null;
         }
         return {
@@ -114,30 +111,30 @@ function buildLocalDevAppUrl(input) {
 }
 function respondWithBuffer(res, method, statusCode, contentType, payload) {
     res.statusCode = statusCode;
-    res.setHeader('Content-Type', contentType);
-    res.setHeader('Content-Length', String(payload.length));
-    res.setHeader('Cache-Control', 'no-store');
-    if (method === 'HEAD') {
+    res.setHeader("Content-Type", contentType);
+    res.setHeader("Content-Length", String(payload.length));
+    res.setHeader("Cache-Control", "no-store");
+    if (method === "HEAD") {
         res.end();
         return;
     }
     res.end(payload);
 }
 function respondWithText(res, method, statusCode, message) {
-    const payload = Buffer.from(message, 'utf8');
-    respondWithBuffer(res, method, statusCode, 'text/plain; charset=utf-8', payload);
+    const payload = Buffer.from(message, "utf8");
+    respondWithBuffer(res, method, statusCode, "text/plain; charset=utf-8", payload);
 }
 function sendJson(res, statusCode, payload) {
-    const body = Buffer.from(JSON.stringify(payload), 'utf8');
-    respondWithBuffer(res, 'GET', statusCode, 'application/json; charset=utf-8', body);
+    const body = Buffer.from(JSON.stringify(payload), "utf8");
+    respondWithBuffer(res, "GET", statusCode, "application/json; charset=utf-8", body);
 }
 function isPidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0) {
         return false;
     }
-    if (process.platform === 'linux') {
+    if (process.platform === "linux") {
         const info = readLinuxProcessInfo(pid);
-        return info !== null && info.state !== 'Z';
+        return info !== null && info.state !== "Z";
     }
     try {
         process.kill(pid, 0);
@@ -148,25 +145,28 @@ function isPidAlive(pid) {
     }
 }
 function readLinuxProcessInfo(pid) {
-    if (!Number.isInteger(pid) || pid <= 0 || process.platform !== 'linux') {
+    if (!Number.isInteger(pid) || pid <= 0 || process.platform !== "linux") {
         return null;
     }
     try {
-        const raw = (0, node_fs_1.readFileSync)(`/proc/${pid}/stat`, 'utf8');
-        const commandEnd = raw.lastIndexOf(')');
+        const raw = (0, node_fs_1.readFileSync)(`/proc/${pid}/stat`, "utf8");
+        const commandEnd = raw.lastIndexOf(")");
         if (commandEnd < 0) {
             return null;
         }
-        const fields = raw.slice(commandEnd + 2).trim().split(/\s+/u);
+        const fields = raw
+            .slice(commandEnd + 2)
+            .trim()
+            .split(/\s+/u);
         const state = fields[0];
         const groupId = Number(fields[2]);
-        if (typeof state !== 'string' || !Number.isInteger(groupId) || groupId <= 0) {
+        if (typeof state !== "string" || !Number.isInteger(groupId) || groupId <= 0) {
             return null;
         }
         return { state, groupId };
     }
     catch (error) {
-        if (error?.code === 'ENOENT') {
+        if (error?.code === "ENOENT") {
             return null;
         }
         throw error;
@@ -201,8 +201,8 @@ function findRouterMountByCreatorAndApp(creatorUsername, appName) {
     return match;
 }
 function resolveStaticPath(staticRoot, rawRelativePath) {
-    const normalizedRelativePath = (0, node_path_1.normalize)(rawRelativePath.replace(/^\/+/, ''));
-    if (!normalizedRelativePath || normalizedRelativePath === '.' || normalizedRelativePath.startsWith('..')) {
+    const normalizedRelativePath = (0, node_path_1.normalize)(rawRelativePath.replace(/^\/+/, ""));
+    if (!normalizedRelativePath || normalizedRelativePath === "." || normalizedRelativePath.startsWith("..")) {
         return null;
     }
     const absolutePath = (0, node_path_1.resolve)(staticRoot, normalizedRelativePath);
@@ -213,10 +213,10 @@ function resolveStaticPath(staticRoot, rawRelativePath) {
     return absolutePath;
 }
 function parseMountPath(pathname) {
-    if (!pathname.startsWith('/apps/dev/')) {
+    if (!pathname.startsWith("/apps/dev/")) {
         return null;
     }
-    const segments = pathname.split('/').filter(Boolean);
+    const segments = pathname.split("/").filter(Boolean);
     if (segments.length < 6) {
         return null;
     }
@@ -228,7 +228,7 @@ function parseMountPath(pathname) {
     }
     return {
         key: buildMountKey(decodeURIComponent(creatorUsername), decodeURIComponent(appType), decodeURIComponent(appName)),
-        assetPath: rest.map((entry) => decodeURIComponent(entry)).join('/'),
+        assetPath: rest.map((entry) => decodeURIComponent(entry)).join("/"),
     };
 }
 function getOwnedRuntimeAssetFile(mount, ownedAssetName, role) {
@@ -243,19 +243,19 @@ async function readJsonBody(req) {
     for await (const chunk of req) {
         chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     }
-    const raw = Buffer.concat(chunks).toString('utf8').trim();
+    const raw = Buffer.concat(chunks).toString("utf8").trim();
     return raw ? JSON.parse(raw) : {};
 }
 function spawnDevScript(projectInfo) {
-    if (!projectInfo.projectDir || !projectInfo.packageJson || typeof projectInfo.packageJson.scripts?.dev !== 'string') {
+    if (!projectInfo.projectDir || !projectInfo.packageJson || typeof projectInfo.packageJson.scripts?.dev !== "string") {
         return null;
     }
-    const npm = (0, npmProcess_1.resolveNpmInvocation)(['run', 'dev']);
+    const npm = (0, npmProcess_1.resolveNpmInvocation)(["run", "dev"]);
     const child = (0, node_child_process_1.spawn)(npm.command, npm.args, {
         cwd: projectInfo.projectDir,
-        stdio: 'inherit',
+        stdio: "inherit",
         env: { ...process.env },
-        detached: process.platform !== 'win32',
+        detached: process.platform !== "win32",
     });
     return child;
 }
@@ -266,7 +266,7 @@ function signalProcess(pid, signal, useGroup) {
         return true;
     }
     catch (error) {
-        if (error?.code === 'ESRCH') {
+        if (error?.code === "ESRCH") {
             return false;
         }
         throw error;
@@ -276,13 +276,13 @@ function isProcessGroupAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0) {
         return false;
     }
-    if (process.platform === 'linux') {
-        for (const entry of (0, node_fs_1.readdirSync)('/proc', { withFileTypes: true })) {
+    if (process.platform === "linux") {
+        for (const entry of (0, node_fs_1.readdirSync)("/proc", { withFileTypes: true })) {
             if (!entry.isDirectory() || !/^\d+$/u.test(entry.name)) {
                 continue;
             }
             const info = readLinuxProcessInfo(Number(entry.name));
-            if (info && info.groupId === pid && info.state !== 'Z') {
+            if (info && info.groupId === pid && info.state !== "Z") {
                 return true;
             }
         }
@@ -293,10 +293,10 @@ function isProcessGroupAlive(pid) {
         return true;
     }
     catch (error) {
-        if (error?.code === 'ESRCH') {
+        if (error?.code === "ESRCH") {
             return false;
         }
-        if (error?.code === 'EPERM') {
+        if (error?.code === "EPERM") {
             return true;
         }
         throw error;
@@ -315,7 +315,7 @@ async function waitForChildExit(child, timeoutMs) {
             }
             settled = true;
             clearTimeout(timeout);
-            child.off('exit', onExit);
+            child.off("exit", onExit);
             resolvePromise(true);
         };
         const timeout = setTimeout(() => {
@@ -323,11 +323,11 @@ async function waitForChildExit(child, timeoutMs) {
                 return;
             }
             settled = true;
-            child.off('exit', onExit);
+            child.off("exit", onExit);
             resolvePromise(!pid || !isPidAlive(pid));
         }, timeoutMs);
         timeout.unref?.();
-        child.once('exit', onExit);
+        child.once("exit", onExit);
     });
 }
 async function waitForProcessGroupExit(pid, timeoutMs) {
@@ -344,12 +344,12 @@ async function waitForProcessGroupExit(pid, timeoutMs) {
     return !isProcessGroupAlive(pid);
 }
 async function terminateWindowsProcessTree(pid, timeoutMs) {
-    const windowsRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim() || 'C:\\Windows';
-    const taskkillPath = (0, node_path_1.join)(windowsRoot, 'System32', 'taskkill.exe');
+    const windowsRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim() || "C:\\Windows";
+    const taskkillPath = (0, node_path_1.join)(windowsRoot, "System32", "taskkill.exe");
     await new Promise((resolvePromise) => {
         let settled = false;
-        const taskkill = (0, node_child_process_1.spawn)(taskkillPath, ['/PID', String(pid), '/T', '/F'], {
-            stdio: 'ignore',
+        const taskkill = (0, node_child_process_1.spawn)(taskkillPath, ["/PID", String(pid), "/T", "/F"], {
+            stdio: "ignore",
             windowsHide: true,
         });
         const settle = () => {
@@ -365,8 +365,8 @@ async function terminateWindowsProcessTree(pid, timeoutMs) {
             settle();
         }, timeoutMs);
         timeout.unref?.();
-        taskkill.once('error', settle);
-        taskkill.once('close', settle);
+        taskkill.once("error", settle);
+        taskkill.once("close", settle);
     });
 }
 async function terminateChildProcessTree(child, timeoutMs = 2000) {
@@ -374,20 +374,20 @@ async function terminateChildProcessTree(child, timeoutMs = 2000) {
     if (!child || !pid || !isPidAlive(pid)) {
         return;
     }
-    if (process.platform === 'win32') {
+    if (process.platform === "win32") {
         await terminateWindowsProcessTree(pid, timeoutMs);
         if (isPidAlive(pid)) {
-            signalProcess(pid, 'SIGKILL', false);
+            signalProcess(pid, "SIGKILL", false);
             await waitForChildExit(child, timeoutMs);
         }
         return;
     }
-    signalProcess(pid, 'SIGTERM', true);
+    signalProcess(pid, "SIGTERM", true);
     const exited = await waitForProcessGroupExit(pid, timeoutMs);
     if (exited) {
         return;
     }
-    signalProcess(pid, 'SIGKILL', true);
+    signalProcess(pid, "SIGKILL", true);
     await waitForProcessGroupExit(pid, timeoutMs);
 }
 async function fetchRouterJson(path, init = {}, port = exports.DEV_ROUTER_PORT) {
@@ -397,11 +397,11 @@ async function fetchRouterJson(path, init = {}, port = exports.DEV_ROUTER_PORT)
             return null;
         }
         const payload = await response.json().catch(() => null);
-        throw new Error(typeof payload?.error === 'string'
+        throw new Error(typeof payload?.error === "string"
             ? payload.error
             : `router_request_failed:${response.status}`);
     }
-    return await response.json();
+    return (await response.json());
 }
 async function fetchRouterHealth(port = exports.DEV_ROUTER_PORT, timeoutMs = 400) {
     const controller = new AbortController();
@@ -409,14 +409,14 @@ async function fetchRouterHealth(port = exports.DEV_ROUTER_PORT, timeoutMs = 400
     timeout.unref?.();
     try {
         const response = await fetch(`http://${DEV_ROUTER_HOST}:${port}${CONTROL_PREFIX}/health`, {
-            method: 'GET',
+            method: "GET",
             signal: controller.signal,
         });
         if (!response.ok) {
             return null;
         }
         const payload = await response.json().catch(() => null);
-        if (!payload || typeof payload !== 'object' || payload.status !== 'ok') {
+        if (!payload || typeof payload !== "object" || payload.status !== "ok") {
             return null;
         }
         return payload;
@@ -429,9 +429,9 @@ async function fetchRouterHealth(port = exports.DEV_ROUTER_PORT, timeoutMs = 400
     }
 }
 function isCompatibleRouterHealth(health) {
-    return health.protocolVersion === DEV_ROUTER_PROTOCOL_VERSION
-        && health.capabilities?.runtimeAssetManifest === true
-        && health.capabilities?.runtimeAssetManifestLookup === true;
+    return (health.protocolVersion === DEV_ROUTER_PROTOCOL_VERSION &&
+        health.capabilities?.runtimeAssetManifest === true &&
+        health.capabilities?.runtimeAssetManifestLookup === true);
 }
 async function ensureDevRouterRunning(port = exports.DEV_ROUTER_PORT) {
     const existingHealth = await fetchRouterHealth(port);
@@ -444,10 +444,10 @@ async function ensureDevRouterRunning(port = exports.DEV_ROUTER_PORT) {
     const cliEntrypoint = getCliEntrypointPath();
     const childEnv = { ...process.env };
     delete childEnv.PLAYDROP_WORKER_CONTEXT;
-    const child = (0, node_child_process_1.spawn)(process.execPath, [cliEntrypoint, 'project', '_dev-router', 'serve'], {
+    const child = (0, node_child_process_1.spawn)(process.execPath, [cliEntrypoint, "project", "_dev-router", "serve"], {
         cwd: resolveDevRouterWorkingDirectory(cliEntrypoint),
         detached: true,
-        stdio: 'ignore',
+        stdio: "ignore",
         env: {
             ...childEnv,
             PLAYDROP_DEV_ROUTER_PORT: String(port),
@@ -462,22 +462,22 @@ async function ensureDevRouterRunning(port = exports.DEV_ROUTER_PORT) {
         }
         await new Promise((resolveTimeout) => setTimeout(resolveTimeout, 150));
     }
-    throw new Error('dev_router_start_failed');
+    throw new Error("dev_router_start_failed");
 }
 function resolveDevRouterWorkingDirectory(cliEntrypoint) {
     return (0, node_path_1.dirname)((0, node_path_1.resolve)(cliEntrypoint));
 }
 async function registerDevMount(input, port = exports.DEV_ROUTER_PORT) {
     const response = await fetch(`http://${DEV_ROUTER_HOST}:${port}${CONTROL_PREFIX}/mounts`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify(input),
     });
-    const payload = await response.json().catch(() => null);
+    const payload = (await response.json().catch(() => null));
     if (!response.ok || !payload) {
         throw new Error(`mount_register_failed:${response.status}`);
     }
-    if ('error' in payload) {
+    if ("error" in payload) {
         throw new Error(encodeMountConflictError({
             ref: `${payload.creatorUsername}/${payload.appType}/${payload.appName}`,
             ownerPid: payload.ownerPid,
@@ -492,14 +492,14 @@ async function registerDevMount(input, port = exports.DEV_ROUTER_PORT) {
 }
 async function heartbeatDevMount(mountId, ownerPid, port = exports.DEV_ROUTER_PORT) {
     await fetchRouterJson(`${CONTROL_PREFIX}/mounts/${encodeURIComponent(mountId)}/heartbeat`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ ownerPid }),
     }, port);
 }
 async function unregisterDevMount(mountId, port = exports.DEV_ROUTER_PORT) {
     const response = await fetch(`http://${DEV_ROUTER_HOST}:${port}${CONTROL_PREFIX}/mounts/${encodeURIComponent(mountId)}`, {
-        method: 'DELETE',
+        method: "DELETE",
     });
     if (!response.ok && response.status !== 404) {
         throw new Error(`mount_unregister_failed:${response.status}`);
@@ -508,17 +508,15 @@ async function unregisterDevMount(mountId, port = exports.DEV_ROUTER_PORT) {
 async function updateMountedDevRuntimeAssetManifest(input) {
     const port = input.port ?? exports.DEV_ROUTER_PORT;
     const response = await fetch(`http://${DEV_ROUTER_HOST}:${port}${CONTROL_PREFIX}/apps/dev/${encodeURIComponent(input.creatorUsername)}/${encodeURIComponent(input.appName)}/runtime-assets`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
             runtimeAssetManifest: input.runtimeAssetManifest ?? null,
         }),
     });
     if (!response.ok) {
-        const payload = await response.json().catch(() => null);
-        throw new Error(typeof payload?.error === 'string'
-            ? payload.error
-            : `runtime_asset_manifest_update_failed:${response.status}`);
+        const payload = (await response.json().catch(() => null));
+        throw new Error(typeof payload?.error === "string" ? payload.error : `runtime_asset_manifest_update_failed:${response.status}`);
     }
 }
 async function startDevServer(options) {
@@ -527,7 +525,7 @@ async function startDevServer(options) {
     let closing = false;
     const devProcess = spawnDevScript(projectInfo);
     if (devProcess) {
-        devProcess.on('exit', code => {
+        devProcess.on("exit", (code) => {
             if (closing) {
                 return;
             }
@@ -539,8 +537,8 @@ async function startDevServer(options) {
     const startedDevProcess = Boolean(devProcess);
     const staticRoot = (0, node_path_1.resolve)((0, node_path_1.dirname)(htmlPath));
     const repoRoot = (0, node_path_1.resolve)(projectInfo.projectDir ?? (0, node_path_1.dirname)(htmlPath));
-    let mountId = '';
-    let appUrl = '';
+    let mountId = "";
+    let appUrl = "";
     try {
         await ensureDevRouterRunning(port);
         const registeredMount = await registerDevMount({
@@ -600,7 +598,7 @@ async function isDevServerAvailable(input, timeoutMs = 1000) {
             ...input,
             port,
         }), {
-            method: 'GET',
+            method: "GET",
             signal: controller.signal,
         });
         return response.ok;
@@ -615,34 +613,34 @@ async function isDevServerAvailable(input, timeoutMs = 1000) {
 function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
     let activePort = initialPort;
     const handleRequest = async (req, res) => {
-        const method = req.method || 'GET';
-        const allowedOrigin = resolveApprovedDevRouterOrigin(typeof req.headers.origin === 'string' ? req.headers.origin : undefined);
+        const method = req.method || "GET";
+        const allowedOrigin = resolveApprovedDevRouterOrigin(typeof req.headers.origin === "string" ? req.headers.origin : undefined);
         if (allowedOrigin) {
-            res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+            res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
         }
-        res.setHeader('Vary', 'Origin');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Playdrop-Client, X-Playdrop-Client-Version, X-Playdrop-Client-Build, X-Playdrop-Platform, X-Playdrop-Platform-Version');
-        res.setHeader('Access-Control-Allow-Private-Network', 'true');
-        if (method === 'OPTIONS') {
+        res.setHeader("Vary", "Origin");
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Playdrop-Client, X-Playdrop-Client-Version, X-Playdrop-Client-Build, X-Playdrop-Platform, X-Playdrop-Platform-Version");
+        res.setHeader("Access-Control-Allow-Private-Network", "true");
+        if (method === "OPTIONS") {
             res.statusCode = 200;
-            res.setHeader('Access-Control-Max-Age', '600');
+            res.setHeader("Access-Control-Max-Age", "600");
             res.end();
             return;
         }
         let requestUrl;
         try {
-            requestUrl = new URL(req.url || '/', `http://${DEV_ROUTER_HOST}:${activePort}`);
+            requestUrl = new URL(req.url || "/", `http://${DEV_ROUTER_HOST}:${activePort}`);
         }
         catch {
-            respondWithText(res, method, 400, 'Invalid URL path');
+            respondWithText(res, method, 400, "Invalid URL path");
             return;
         }
         const pathname = decodeURIComponent(requestUrl.pathname);
         const searchParams = requestUrl.searchParams;
-        if (pathname === `${CONTROL_PREFIX}/health` && method === 'GET') {
+        if (pathname === `${CONTROL_PREFIX}/health` && method === "GET") {
             sendJson(res, 200, {
-                status: 'ok',
+                status: "ok",
                 protocolVersion: DEV_ROUTER_PROTOCOL_VERSION,
                 capabilities: {
                     runtimeAssetManifest: true,
@@ -651,17 +649,19 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
             });
             return;
         }
-        if (pathname.startsWith(`${CONTROL_PREFIX}/apps/dev/`) && pathname.endsWith('/runtime-assets') && method === 'GET') {
+        if (pathname.startsWith(`${CONTROL_PREFIX}/apps/dev/`) &&
+            pathname.endsWith("/runtime-assets") &&
+            method === "GET") {
             cleanupStaleRouterMounts();
-            const segments = pathname.split('/').filter(Boolean);
+            const segments = pathname.split("/").filter(Boolean);
             if (segments.length !== 6) {
-                sendJson(res, 404, { error: 'runtime_asset_manifest_not_found' });
+                sendJson(res, 404, { error: "runtime_asset_manifest_not_found" });
                 return;
             }
-            const creatorUsername = decodeURIComponent(segments[3] ?? '');
-            const appName = decodeURIComponent(segments[4] ?? '');
+            const creatorUsername = decodeURIComponent(segments[3] ?? "");
+            const appName = decodeURIComponent(segments[4] ?? "");
             if (!creatorUsername || !appName) {
-                sendJson(res, 400, { error: 'invalid_runtime_asset_manifest_lookup' });
+                sendJson(res, 400, { error: "invalid_runtime_asset_manifest_lookup" });
                 return;
             }
             let mount;
@@ -669,28 +669,30 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
                 mount = findRouterMountByCreatorAndApp(creatorUsername, appName);
             }
             catch (error) {
-                const message = error instanceof Error ? error.message : 'ambiguous_mount_lookup';
+                const message = error instanceof Error ? error.message : "ambiguous_mount_lookup";
                 sendJson(res, 409, { error: message });
                 return;
             }
             if (!mount?.runtimeAssetManifest) {
-                sendJson(res, 404, { error: 'runtime_asset_manifest_not_found' });
+                sendJson(res, 404, { error: "runtime_asset_manifest_not_found" });
                 return;
             }
             sendJson(res, 200, mount.runtimeAssetManifest.response);
             return;
         }
-        if (pathname.startsWith(`${CONTROL_PREFIX}/apps/dev/`) && pathname.endsWith('/runtime-assets') && method === 'POST') {
+        if (pathname.startsWith(`${CONTROL_PREFIX}/apps/dev/`) &&
+            pathname.endsWith("/runtime-assets") &&
+            method === "POST") {
             cleanupStaleRouterMounts();
-            const segments = pathname.split('/').filter(Boolean);
+            const segments = pathname.split("/").filter(Boolean);
             if (segments.length !== 6) {
-                sendJson(res, 404, { error: 'runtime_asset_manifest_not_found' });
+                sendJson(res, 404, { error: "runtime_asset_manifest_not_found" });
                 return;
             }
-            const creatorUsername = decodeURIComponent(segments[3] ?? '');
-            const appName = decodeURIComponent(segments[4] ?? '');
+            const creatorUsername = decodeURIComponent(segments[3] ?? "");
+            const appName = decodeURIComponent(segments[4] ?? "");
             if (!creatorUsername || !appName) {
-                sendJson(res, 400, { error: 'invalid_runtime_asset_manifest_lookup' });
+                sendJson(res, 400, { error: "invalid_runtime_asset_manifest_lookup" });
                 return;
             }
             let mount;
@@ -698,12 +700,12 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
                 mount = findRouterMountByCreatorAndApp(creatorUsername, appName);
             }
             catch (error) {
-                const message = error instanceof Error ? error.message : 'ambiguous_mount_lookup';
+                const message = error instanceof Error ? error.message : "ambiguous_mount_lookup";
                 sendJson(res, 409, { error: message });
                 return;
             }
             if (!mount) {
-                sendJson(res, 404, { error: 'runtime_asset_manifest_not_found' });
+                sendJson(res, 404, { error: "runtime_asset_manifest_not_found" });
                 return;
             }
             const body = await readJsonBody(req);
@@ -712,7 +714,7 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (pathname === `${CONTROL_PREFIX}/mounts` && method === 'POST') {
+        if (pathname === `${CONTROL_PREFIX}/mounts` && method === "POST") {
             cleanupStaleRouterMounts();
             const body = await readJsonBody(req);
             const creatorUsername = body.creatorUsername?.trim();
@@ -722,8 +724,15 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
             const staticRoot = body.staticRoot?.trim();
             const repoRoot = body.repoRoot?.trim();
             const ownerPid = Number(body.ownerPid);
-            if (!creatorUsername || !appType || !appName || !htmlPath || !staticRoot || !repoRoot || !Number.isInteger(ownerPid) || ownerPid <= 0) {
-                sendJson(res, 400, { error: 'invalid_mount_request' });
+            if (!creatorUsername ||
+                !appType ||
+                !appName ||
+                !htmlPath ||
+                !staticRoot ||
+                !repoRoot ||
+                !Number.isInteger(ownerPid) ||
+                ownerPid <= 0) {
+                sendJson(res, 400, { error: "invalid_mount_request" });
                 return;
             }
             const key = buildMountKey(creatorUsername, appType, appName);
@@ -733,7 +742,7 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
                 if (existingMount && isPidAlive(existingMount.ownerPid)) {
                     if (existingMount.htmlPath !== htmlPath || existingMount.staticRoot !== staticRoot) {
                         sendJson(res, 409, {
-                            error: 'mount_conflict',
+                            error: "mount_conflict",
                             creatorUsername,
                             appType,
                             appName,
@@ -781,22 +790,22 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
             });
             return;
         }
-        if (pathname.startsWith(`${CONTROL_PREFIX}/mounts/`) && pathname.endsWith('/heartbeat') && method === 'POST') {
+        if (pathname.startsWith(`${CONTROL_PREFIX}/mounts/`) && pathname.endsWith("/heartbeat") && method === "POST") {
             cleanupStaleRouterMounts();
-            const mountId = pathname.slice(`${CONTROL_PREFIX}/mounts/`.length, -'/heartbeat'.length).replace(/\/$/, '');
+            const mountId = pathname.slice(`${CONTROL_PREFIX}/mounts/`.length, -"/heartbeat".length).replace(/\/$/, "");
             const mount = routerMountsById.get(mountId);
             if (!mount) {
-                sendJson(res, 404, { error: 'mount_not_found' });
+                sendJson(res, 404, { error: "mount_not_found" });
                 return;
             }
             const body = await readJsonBody(req);
             const ownerPid = Number(body.ownerPid);
             if (!Number.isInteger(ownerPid) || ownerPid <= 0) {
-                sendJson(res, 400, { error: 'invalid_mount_owner_pid' });
+                sendJson(res, 400, { error: "invalid_mount_owner_pid" });
                 return;
             }
             if (ownerPid !== mount.ownerPid) {
-                sendJson(res, 409, { error: 'mount_owner_pid_mismatch' });
+                sendJson(res, 409, { error: "mount_owner_pid_mismatch" });
                 return;
             }
             mount.ownerPid = ownerPid;
@@ -804,97 +813,97 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (pathname.startsWith(`${CONTROL_PREFIX}/mounts/`) && method === 'DELETE') {
+        if (pathname.startsWith(`${CONTROL_PREFIX}/mounts/`) && method === "DELETE") {
             const mountId = pathname.slice(`${CONTROL_PREFIX}/mounts/`.length);
             removeRouterMount(mountId);
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (method !== 'GET' && method !== 'HEAD') {
-            res.setHeader('Allow', 'GET, HEAD, POST, DELETE, OPTIONS');
-            respondWithText(res, method, 405, 'Method not allowed');
+        if (method !== "GET" && method !== "HEAD") {
+            res.setHeader("Allow", "GET, HEAD, POST, DELETE, OPTIONS");
+            respondWithText(res, method, 405, "Method not allowed");
             return;
         }
         cleanupStaleRouterMounts();
         const parsedMountPath = parseMountPath(pathname);
         if (!parsedMountPath) {
-            respondWithText(res, method, 404, 'Not found');
+            respondWithText(res, method, 404, "Not found");
             return;
         }
         const mountId = routerMountIdsByKey.get(parsedMountPath.key);
         const mount = mountId ? routerMountsById.get(mountId) : null;
         if (!mount) {
-            respondWithText(res, method, 404, 'Not found');
+            respondWithText(res, method, 404, "Not found");
             return;
         }
-        if (parsedMountPath.assetPath === '_playdrop/runtime-assets') {
+        if (parsedMountPath.assetPath === "_playdrop/runtime-assets") {
             if (!mount.runtimeAssetManifest) {
-                sendJson(res, 500, { error: 'runtime_asset_manifest_not_registered' });
+                sendJson(res, 500, { error: "runtime_asset_manifest_not_registered" });
                 return;
             }
             sendJson(res, 200, mount.runtimeAssetManifest.response);
             return;
         }
-        if (parsedMountPath.assetPath.startsWith('_playdrop/runtime-assets/files/')) {
-            const ownedAssetName = parsedMountPath.assetPath.slice('_playdrop/runtime-assets/files/'.length).trim();
-            const role = (searchParams.get('role') || 'primary').trim().toLowerCase();
+        if (parsedMountPath.assetPath.startsWith("_playdrop/runtime-assets/files/")) {
+            const ownedAssetName = parsedMountPath.assetPath.slice("_playdrop/runtime-assets/files/".length).trim();
+            const role = (searchParams.get("role") || "primary").trim().toLowerCase();
             if (!ownedAssetName || !role) {
-                respondWithText(res, method, 400, 'Invalid runtime asset file request');
+                respondWithText(res, method, 400, "Invalid runtime asset file request");
                 return;
             }
             const ownedFile = getOwnedRuntimeAssetFile(mount, ownedAssetName, role);
             if (!ownedFile) {
-                respondWithText(res, method, 404, 'Not found');
+                respondWithText(res, method, 404, "Not found");
                 return;
             }
             try {
                 const stats = (0, node_fs_1.statSync)(ownedFile.absolutePath);
                 if (!stats.isFile()) {
-                    respondWithText(res, method, 404, 'Not found');
+                    respondWithText(res, method, 404, "Not found");
                     return;
                 }
                 const content = (0, node_fs_1.readFileSync)(ownedFile.absolutePath);
                 respondWithBuffer(res, method, 200, ownedFile.contentType || resolveContentType(ownedFile.absolutePath), content);
             }
             catch {
-                respondWithText(res, method, 404, 'Not found');
+                respondWithText(res, method, 404, "Not found");
             }
             return;
         }
-        if (parsedMountPath.assetPath === 'index.html') {
+        if (parsedMountPath.assetPath === "index.html") {
             try {
                 const freshHtml = (0, node_fs_1.readFileSync)(mount.htmlPath);
-                respondWithBuffer(res, method, 200, 'text/html; charset=utf-8', freshHtml);
+                respondWithBuffer(res, method, 200, "text/html; charset=utf-8", freshHtml);
             }
             catch (error) {
-                respondWithText(res, method, 500, `Failed to read app file: ${error?.message || 'unknown error'}`);
+                respondWithText(res, method, 500, `Failed to read app file: ${error?.message || "unknown error"}`);
             }
             return;
         }
         const absolutePath = resolveStaticPath(mount.staticRoot, parsedMountPath.assetPath);
         if (!absolutePath) {
-            respondWithText(res, method, 400, 'Invalid static asset path');
+            respondWithText(res, method, 400, "Invalid static asset path");
             return;
         }
         try {
             const stats = (0, node_fs_1.statSync)(absolutePath);
             if (!stats.isFile()) {
-                respondWithText(res, method, 404, 'Not found');
+                respondWithText(res, method, 404, "Not found");
                 return;
             }
             const content = (0, node_fs_1.readFileSync)(absolutePath);
             respondWithBuffer(res, method, 200, resolveContentType(absolutePath), content);
         }
         catch {
-            respondWithText(res, method, 404, 'Not found');
+            respondWithText(res, method, 404, "Not found");
         }
     };
     const server = node_http_1.default.createServer((req, res) => {
         void handleRequest(req, res);
     });
-    server.on('listening', () => {
+    server.on("listening", () => {
         const address = server.address();
-        if (address && typeof address === 'object' && typeof address.port === 'number') {
+        if (address && typeof address === "object" && typeof address.port === "number") {
             activePort = address.port;
         }
     });
@@ -903,20 +912,20 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
 async function listenDevRouterServer(server, port = exports.DEV_ROUTER_PORT) {
     await new Promise((resolveListen, rejectListen) => {
         const onError = (error) => {
-            server.off('listening', onListening);
+            server.off("listening", onListening);
             rejectListen(error);
         };
         const onListening = () => {
-            server.off('error', onError);
+            server.off("error", onError);
             resolveListen();
         };
-        server.once('error', onError);
-        server.once('listening', onListening);
+        server.once("error", onError);
+        server.once("listening", onListening);
         server.listen(port, DEV_ROUTER_HOST);
     });
     const address = server.address();
-    if (!address || typeof address !== 'object' || typeof address.port !== 'number') {
-        throw new Error('dev_router_port_unavailable');
+    if (!address || typeof address !== "object" || typeof address.port !== "number") {
+        throw new Error("dev_router_port_unavailable");
     }
     return address.port;
 }