ossclip 0.1.33 → 0.1.35

package/src/edit.ts

@@ -1,7 +1,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createReadStream, existsSync, readFileSync, statSync } from "node:fs";
-import { copyFile, mkdir, readFile, readdir, rename, unlink, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { homedir } from "node:os";
 import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -17,10 +17,29 @@ import {
   type YoutubePack,
   ThumbnailConceptApprovedSchema,
   ThumbnailConceptSchema,
+  appendUsageRun,
+  // The SFX plan route's word-space derivation (Phase 4) — the repaired
+  // transcript rebuilt from production.json's own stored pair, which is the
+  // index space `production.sfx.placements[].word` counts in.
+  applyRepairs,
+  ProductionSfxSchema,
   approvedOverlayText,
   buildThumbnailPrompt,
+  captionCap,
   captionForProvider,
+  checkDurationCaps,
   createPostizProvider,
+  createProvider,
+  encodeEta,
+  formatUsageLine,
+  generateCaptionRegen,
+  generateYoutubePack,
+  YOUTUBE_PROMPT_VERSION,
+  deliveryEncodePlan,
+  ensureDeliveryFile,
+  PLATFORM_DURATION_CAPS_SEC,
+  PLATFORM_SIZE_CAP_BYTES,
+  probe,
   alignRestamp,
   emptyOverrideDoc,
   extractAudioSpan,
@@ -29,6 +48,14 @@ import {
   // only when a regenerate actually runs.
   generateThumbnailImage,
   loadConfig,
+  // The SFX palette's one source of sounds (2026-08-29): the same loader
+  // produce plans against, so the dropdown can never offer a sound a render
+  // would not find.
+  loadSfxLibrary,
+  // …and the config gate that decides whether the bundled pack is part of it.
+  // Resolved here too, not just in produce: an editor that offered stock sounds
+  // the config excludes would let a user pick one the next render drops.
+  resolveSfxBundledPack,
   outInsideInputFolderMessage,
   outPathInsideInput,
   PORTRAIT_MIME_TYPES,
@@ -38,8 +65,10 @@ import {
   SegmentSchema,
   spliceTranscript,
   TranscriptSchema,
+  ungroundedTokens,
   whisperPromptFor,
   wordsInSpan,
+  type ModelPrice,
   type Segment,
   thumbnailImageCacheName,
   type CoverProvenance,
@@ -51,7 +80,13 @@ import {
 // drags in @ossclip/core's process runner and llm-detect, worth deferring off
 // server startup — open.ts is node:child_process + node:path and pure command
 // building, with nothing to defer.
+import { loadEnvFiles } from "./env";
+// The identity endpoint's one spelling, shared with the CLI-side probe in
+// edit-port.ts (which imports only the TYPE of this module's server, so there
+// is no cycle and nothing interactive rides in here).
+import { EDIT_HEALTH_PATH, editHealthBody } from "./edit-health";
 import { revealInFileManager } from "./open";
+import { REVIEWED_SCENES_BASENAME, renderReplayArgs } from "./render-replay-args";
 // The recorded-invocation reads live in cover.ts (2026-08-19): `ossclip
 // cover` needs the same out-resolution rule this server's thumbnail dest,
 // youtube markdown and reveal endpoint derive from, and two spellings of it
@@ -81,7 +116,16 @@ import {
   type ResolvedPortrait,
 } from "./portrait-override";
 import { lastFlagValue, thumbnailPanelState } from "./thumbnail-panel";
-import { buildPublishPosts, publishConfigured, publishReceiptPath, readPublishReceipt } from "./publish";
+import { captionRegenProvider } from "./caption-regen-panel";
+import { binOnPath } from "./llm-detect";
+import {
+  attachDeliveryMedia,
+  buildPublishPosts,
+  publishConfigured,
+  publishReceiptPath,
+  readPublishReceipt,
+  sizeCapGroups,
+} from "./publish";
 
 /**
  * Where the built editor page lives (R18 §90b): `editor-dist/` inside this
@@ -108,6 +152,29 @@ export function resolveEditorPageDir(): string | null {
   return candidates[0] ?? null;
 }
 
+/**
+ * This package's version for `/api/health`, read from the manifest exactly as
+ * `--version` does (R22 §113: never a literal, or it reports the number a
+ * developer typed). Memoized because it sits on a request path, and
+ * `undefined` when unreadable — the health body's `version` is optional
+ * precisely so an odd install still identifies itself as ossclip.
+ */
+let cachedVersion: string | undefined | null = null;
+function packageVersion(): string | undefined {
+  if (cachedVersion === null) {
+    try {
+      cachedVersion = (
+        JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as {
+          version: string;
+        }
+      ).version;
+    } catch {
+      cachedVersion = undefined;
+    }
+  }
+  return cachedVersion;
+}
+
 /**
  * The config keys `/api/retranscribe-range` needs. Spelled structurally
  * rather than as `OssclipConfig` so the `loadCfg` seam keeps accepting a test
@@ -244,6 +311,12 @@ const MIME: Record<string, string> = {
   // the type is stated while the change is one line rather than a debugging
   // session.
   ".wav": "audio/wav",
+  // The sound-effect preview (`/api/sfx/audio`) and the staged `sfx/` copies
+  // the workdir serves over `/media/`: the starter pack is mono mp3, and an
+  // `<audio>` element handed an octet-stream is exactly the sniffing-dependent
+  // preview the `.jpg` note below refuses to rely on. Anything else a user
+  // pack ships still falls back to octet-stream rather than being refused.
+  ".mp3": "audio/mpeg",
   // The `--cover-in-video` overlay: produce stages the cover into the workdir
   // as well as the render's public dir, and the Player fetches it through
   // `/media/`. Browsers do sniff an image served as octet-stream, but a
@@ -353,6 +426,16 @@ export async function startEditServer(
       portrait?: unknown;
       thumbnailModel?: unknown;
       postizUrl?: string;
+      /** produce's config fallback for `--audience` — the on-demand pack
+       * generation reads it the same way (typeof, never truthiness). */
+      audience?: unknown;
+      /** The caption-regenerate spend report prices through the same table
+       * produce does — absent in a stub, the defaults apply. */
+      pricing?: Record<string, ModelPrice>;
+      /** Whether the bundled starter pack feeds the SFX routes' library —
+       * `unknown` because it is file-only and typed at the consumer
+       * (`resolveSfxBundledPack`), the `audience` rule. */
+      sfxBundledPack?: unknown;
     } & RetranscribeConfig;
     /** Env seam for the publish endpoints — tests inject their own so the
      * runner's real OSSCLIP_POSTIZ_API_KEY (or its absence) never decides a
@@ -361,10 +444,18 @@ export async function startEditServer(
     /** Fetch seam for the publish endpoints — tests stub Postiz instead of
      * needing an instance on the runner (createPostizProvider's fetchImpl). */
     publishFetch?: typeof fetch;
+    /** The publish endpoints' two ffmpeg-family shell-outs (the sliceAudio/
+     * runWhisper seam pattern) — tests stub a probe and a delivery encode
+     * instead of needing ffmpeg/ffprobe and a real render on the runner. */
+    probeVideo?: typeof probe;
+    ensureDelivery?: typeof ensureDeliveryFile;
     /** File-manager reveal seam (the `generateThumbnail` pattern) — tests
      * observe the revealed path instead of popping a real Finder/Explorer
      * window on the runner. */
     reveal?: (path: string) => void;
+    /** The caption-regenerate LLM seam (the `generateThumbnail` pattern for
+     * text): tests inject a fake provider factory and never touch a model. */
+    makeLlmProvider?: typeof createProvider;
     /**
      * The cover render seam, exactly like `generateThumbnail` above. Without
      * it `regenerateCover` lazily imports @ossclip/renderer and boots a
@@ -380,6 +471,16 @@ export async function startEditServer(
      */
     sliceAudio?: typeof extractAudioSpan;
     runWhisper?: typeof runWhisper;
+    /**
+     * The sound library the SFX routes serve (`loadCfg`'s rule applied to the
+     * pack loader): tests inject a hand-written library over a tmp dir, so the
+     * suite never depends on the bundled pack riding a given runner's checkout
+     * — nor on whatever the developer happens to have in ~/.ossclip/sfx, which
+     * the real loader merges in. It is called with the resolved `includeBundled`
+     * (see `sfxLibrary` below), so a test can assert the config gate reached the
+     * loader rather than only that the routes serve what they were handed.
+     */
+    loadSfx?: typeof loadSfxLibrary;
   } = {},
 ): Promise<EditServer> {
   // MUTABLE since R17 §83: the server can start with no project (the page
@@ -477,6 +578,38 @@ export async function startEditServer(
    * `coverBusy`'s rule with a second reason on top.
    */
   let retranscribeBusy = false;
+  /**
+   * One caption regeneration at a time (`/api/publish/regenerate`) — an LLM
+   * call costs money, and a double-click must not buy two. `thumbnailBusy`'s
+   * rule, its own flag: a caption rewrite must not block a thumbnail.
+   */
+  let captionRegenBusy = false;
+  /**
+   * One pack generation at a time (`/api/youtube/generate`) — an LLM call
+   * costs money, and a double-click must not buy two. `captionRegenBusy`'s
+   * rule, its own flag: generating the pack must not block a caption rewrite
+   * already in flight (they are different buttons in different panels).
+   */
+  let packGenBusy = false;
+  /**
+   * Where the in-flight publish is right now, for the panel's poll
+   * (2026-08-29): the POST runs the delivery encode synchronously — minutes
+   * of x264 behind one fetch — so `GET /api/publish/progress` reads this
+   * instead of the panel staring at a static button. Null whenever no publish
+   * is in flight; a POST's `finally` owns the reset so an error can't leave a
+   * stale "encoding" behind. Per server instance like the busy flags above.
+   */
+  let publishProgress: {
+    phase: "encoding" | "uploading";
+    pct: number | null;
+    etaSec: number | null;
+    speed: number | null;
+    /** The delivery file being encoded (from onStart) — a size-capped
+     * publish runs two sequential encodes, and a bare pct that resets to 0
+     * mid-publish looks like a hang unless the label names which file it
+     * restarted for. Null before the first onStart and while uploading. */
+    file: string | null;
+  } | null = null;
   /** Where the JPEG lives right now: the destination the last cover used,
    * else `<recorded out>.cover.jpg`. Existence is the caller's check — a
    * recorded destination that was never rendered is a real state (the panel
@@ -531,6 +664,54 @@ export async function startEditServer(
   // panel round-trips through youtube-pack-approved.json, which produce's Y2
   // block honors VERBATIM on every replay — an edit persisted there survives
   // into future renders with zero new plumbing.
+  /**
+   * The publish config, resolved FRESH per request — both halves of it.
+   *
+   * `loadConfig()` already re-read `config.json` every time, but the API key
+   * came from the process env, which is populated once at CLI startup: a user
+   * who set up Postiz while the editor was open got "not configured" until a
+   * restart, with `postizUrl` live and the key stale (2026-08-27). Re-running
+   * `loadEnvFiles` costs two small file reads on a button press and keeps the
+   * documented precedence exactly — it never clobbers a key the real
+   * environment already set, so a shell-provided key still wins.
+   *
+   * Skipped entirely when the caller injected `publishEnv` (tests own their
+   * environment, and reading the developer's real `~/.ossclip/.env` into a
+   * test would make the suite depend on the machine it runs on).
+   */
+  const resolvePublishConfig = (): ReturnType<typeof publishConfigured> => {
+    if (opts.publishEnv === undefined) loadEnvFiles();
+    return publishConfigured((opts.loadCfg ?? loadConfig)(), opts.publishEnv ?? process.env);
+  };
+  /** ffmpeg/ffprobe for the publish endpoints' probe + delivery encode —
+   * from the same config read the rest of the panel resolves through. The
+   * `?? "ffmpeg"` legs exist only for the narrowed `loadCfg` seam; the real
+   * `loadConfig()` always fills both. */
+  const publishTools = (): { ffmpegPath: string; ffprobePath: string } => {
+    const cfg = (opts.loadCfg ?? loadConfig)();
+    return { ffmpegPath: cfg.ffmpegPath ?? "ffmpeg", ffprobePath: cfg.ffprobePath ?? "ffprobe" };
+  };
+  /**
+   * The sound library the SFX routes serve, loaded through the SAME config gate
+   * produce's sfx step uses (`sfxBundledPack` → `resolveSfxBundledPack`). One
+   * helper rather than the resolution inline at each route, because /library
+   * and /audio must agree: a menu offering `pop` while /audio 404s it — or
+   * worse, while the next render drops it — is the exact mismatch the gate
+   * exists to avoid.
+   *
+   * Read per request, like every other `loadCfg` consumer here: the server
+   * outlives config edits (R17 §83's mutable-workdir posture), and a user who
+   * flips the key gets it on the next refresh instead of on a restart.
+   *
+   * The malformed-value warning is dropped on purpose — this is a request path
+   * with no console the user is watching, and produce prints it on the run that
+   * actually places effects. The loader's own issues DO reach the panel, which
+   * is where a `~/.ossclip/sfx` author sees them.
+   */
+  const sfxLibrary = (): ReturnType<typeof loadSfxLibrary> =>
+    (opts.loadSfx ?? loadSfxLibrary)({
+      includeBundled: resolveSfxBundledPack((opts.loadCfg ?? loadConfig)().sfxBundledPack).include,
+    });
   const approvedPackPath = (): string => join(workdir!, YOUTUBE_APPROVED_BASENAME);
   /** The pack the panel shows: the approved file first (the user's
    * decision), else the newest valid `youtube-<key>.json` cache (what the
@@ -589,6 +770,18 @@ export async function startEditServer(
       try {
         const url = new URL(req.url ?? "/", "http://localhost");
 
+        if (url.pathname === EDIT_HEALTH_PATH && req.method === "GET") {
+          // Who is on this port (edit-health.ts owns the contract). This is
+          // what makes a second `ossclip edit` on the same project an ATTACH
+          // instead of an EADDRINUSE stack, and it answers with the CURRENT
+          // workdir — mutable since R17 §83, so a server whose project was
+          // switched from the page identifies as the project it is serving now.
+          return send(
+            200,
+            editHealthBody({ version: packageVersion(), workdir, pid: process.pid }),
+          );
+        }
+
         if (url.pathname === "/api/production" && req.method === "GET") {
           if (!workdir) {
             // Not an error — the picker state (R17 §83). Recents ride along
@@ -970,13 +1163,16 @@ export async function startEditServer(
           const chunks: Buffer[] = [];
           for await (const c of req) chunks.push(c as Buffer);
           let customOut: string | undefined;
+          let replan = false;
           try {
             const raw = Buffer.concat(chunks).toString();
             if (raw.trim()) {
-              const body = JSON.parse(raw) as { out?: string };
+              const body = JSON.parse(raw) as { out?: string; replan?: boolean };
               if (typeof body.out === "string" && body.out.trim()) {
                 customOut = body.out.trim();
               }
+              // Opt back into a fresh LLM plan (renderReplayArgs' why).
+              replan = body.replan === true;
             }
           } catch {
             // ignore
@@ -1031,6 +1227,30 @@ export async function startEditServer(
             filteredArgs.push("--out", customOut);
             args = filteredArgs;
           }
+          // THE EDITOR IS THE AUTHORITY for a render started here: pin the
+          // plan the user just reviewed (`production.json`'s scenes) instead
+          // of letting `--produce` plan a fresh one that renumbers scenes and
+          // orphans their edits (renderReplayArgs owns the full why). Written
+          // to its own file rather than reusing `scenes-<key>.json`, which is
+          // keyed to a beat sheet this render may no longer match.
+          let scenesPath: string | undefined;
+          if (!replan) {
+            try {
+              const production = JSON.parse(
+                await readFile(join(workdir!, "production.json"), "utf8"),
+              ) as { scenes?: unknown };
+              if (Array.isArray(production.scenes) && production.scenes.length > 0) {
+                scenesPath = join(workdir!, REVIEWED_SCENES_BASENAME);
+                await writeFile(scenesPath, `${JSON.stringify(production.scenes, null, 2)}\n`);
+              }
+            } catch {
+              // No production.json, an old one without `scenes`, or an
+              // unwritable workdir: replay the recorded command rather than
+              // refuse to render (renderReplayArgs' no-plan case).
+              scenesPath = undefined;
+            }
+          }
+          args = renderReplayArgs(args, { scenesPath, replan });
           renderLines = [];
           renderExit = null;
           renderStartedAt = Date.now();
@@ -1458,6 +1678,205 @@ export async function startEditServer(
           return send(200, { ok: true, mdPath });
         }
 
+        if (url.pathname === "/api/youtube/generate" && req.method === "POST") {
+          // Generate the pack ON DEMAND (2026-08-29): a render produced
+          // without --youtube has no caption pack, and the publish modal
+          // dead-ended on "run produce with --youtube" — a full re-produce
+          // just to buy one LLM call. This writes the same CACHE file
+          // produce's Y2 block would have, never the approved file: approval
+          // stays the user's explicit act (PUT /api/youtube), and the user
+          // still reviews the captions before anything sends.
+          if (!workdir) return send(409, { error: "no workdir open" });
+          // An LLM call costs money — one at a time, a second is a 409 like
+          // a second caption rewrite.
+          if (packGenBusy) {
+            return send(409, { error: "a caption-pack generation is already running" });
+          }
+          // Lenient transcript read but a 412 when it yields nothing — the
+          // /api/publish/regenerate posture, same reason: a pack with no
+          // transcript would be invented metadata. The words joined raw is
+          // the honest input the server has (regenerate made the same call);
+          // produce's stamped transcript needs the cut map, which only a
+          // produce run holds — the prompt tolerates plain text, the model
+          // just gets no measured chapters worth trusting.
+          let words: Array<{ text: string }> = [];
+          let lastWordEnd: number | null = null;
+          try {
+            const raw = JSON.parse(await readFile(join(workdir, "transcript.json"), "utf8")) as {
+              words?: unknown;
+            };
+            if (Array.isArray(raw.words)) {
+              words = raw.words.filter(
+                (w): w is { text: string } =>
+                  typeof (w as { text?: unknown } | null)?.text === "string",
+              );
+              for (const w of raw.words) {
+                const end = (w as { end?: unknown } | null)?.end;
+                if (typeof end === "number" && Number.isFinite(end)) {
+                  lastWordEnd = Math.max(lastWordEnd ?? 0, end);
+                }
+              }
+            }
+          } catch {
+            // absent/corrupt → the 412 below
+          }
+          if (words.length === 0) {
+            return send(412, {
+              error:
+                "no transcript in this workdir — the pack would have nothing to ground " +
+                "against; re-run `ossclip produce`.",
+            });
+          }
+          // The prompt's runtime ceiling: the output duration produce
+          // measured (render-props.json), else the transcript's last word
+          // end — source-clock, but the honest number available, and a
+          // raw-text transcript gets no measured chapters anyway.
+          let durationSec: number | null = null;
+          try {
+            const props = JSON.parse(await readFile(propsPath(), "utf8")) as {
+              outputDurationSec?: unknown;
+            };
+            if (
+              typeof props.outputDurationSec === "number" &&
+              Number.isFinite(props.outputDurationSec) &&
+              props.outputDurationSec > 0
+            ) {
+              durationSec = props.outputDurationSec;
+            }
+          } catch {
+            // corrupt props — the transcript fallback below
+          }
+          if (durationSec === null && lastWordEnd !== null && lastWordEnd > 0) {
+            durationSec = lastWordEnd;
+          }
+          if (durationSec === null) {
+            return send(412, {
+              error: "cannot determine the video's duration — re-run `ossclip produce`.",
+            });
+          }
+          const cmd = await readCommandRecord();
+          const cfg = (opts.loadCfg ?? loadConfig)();
+          // The editorial steer produce would have used: the recorded flags
+          // first, then produce's own defaults when a flag is absent —
+          // intent has none, audience falls back to the config's `audience`
+          // (produce.ts's typed read: typeof, never truthiness).
+          const intent = lastFlagValue(cmd?.args ?? [], ["--intent"]);
+          const audience =
+            lastFlagValue(cmd?.args ?? [], ["--audience"]) ??
+            (typeof cfg.audience === "string" ? cfg.audience : undefined);
+          // hook/coverText come from the beat sheet in produce; a produce
+          // run that planned left its sheet cached in the workdir. The
+          // shipped cover headline (cover.json, possibly the user's own
+          // words) backstops coverText. All optional — buildYoutubePrompt
+          // omits absent lines, exactly as a no-beat-sheet produce does.
+          let hook: string | undefined;
+          let coverText: string | undefined;
+          const beatCache = await newestWorkdirFile(
+            (n) => n.startsWith("beatsheet-") && n.endsWith(".json"),
+          );
+          if (beatCache !== null) {
+            try {
+              const sheet = JSON.parse(await readFile(beatCache, "utf8")) as {
+                hook?: unknown;
+                coverText?: unknown;
+              };
+              if (typeof sheet.hook === "string" && sheet.hook.trim().length > 0) {
+                hook = sheet.hook;
+              }
+              if (typeof sheet.coverText === "string" && sheet.coverText.trim().length > 0) {
+                coverText = sheet.coverText;
+              }
+            } catch {
+              // a corrupt cache loses a steer line, never the generation
+            }
+          }
+          if (coverText === undefined) {
+            const provenance = await readCoverProvenance(workdir);
+            if (provenance !== null && provenance.text.trim().length > 0) {
+              coverText = provenance.text;
+            }
+          }
+          // Env fresh per press, then the caption regenerate's provider
+          // resolution verbatim — the same "which LLM does this project
+          // use" question with the same three-rung answer.
+          if (opts.publishEnv === undefined) loadEnvFiles();
+          const env = opts.publishEnv ?? process.env;
+          const usagePath = join(workdir, "usage.json");
+          let usageLog: unknown = null;
+          try {
+            usageLog = JSON.parse(await readFile(usagePath, "utf8"));
+          } catch {
+            // no log yet — the resolution falls through to the pin/detection
+          }
+          const resolved = captionRegenProvider({
+            usageLog,
+            commandArgs: cmd?.args ?? null,
+            env,
+            hasBin: (bin) => binOnPath(bin, env),
+          });
+          if (resolved.status === "unavailable") {
+            return send(412, { error: resolved.reason });
+          }
+          const provider = (opts.makeLlmProvider ?? createProvider)(resolved.provider);
+          packGenBusy = true;
+          try {
+            let pack: YoutubePack;
+            try {
+              pack = await generateYoutubePack(provider, {
+                transcriptText: words.map((w) => w.text).join(" "),
+                ...(intent !== undefined ? { intent } : {}),
+                ...(hook !== undefined ? { hook } : {}),
+                ...(coverText !== undefined ? { coverText } : {}),
+                ...(audience !== undefined ? { audience } : {}),
+                durationSec,
+              });
+            } catch (err) {
+              // 200 with ok:false, the caption regenerate's posture: a
+              // provider failure is a sentence the panel shows VERBATIM,
+              // never a dead 500. Nothing is cached (§106).
+              return send(200, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+            const pricing = cfg.pricing ?? {};
+            // The spend is real, so it survives the session — the caption
+            // regenerate's append, atomically.
+            const nextLog = appendUsageRun(
+              usageLog,
+              { at: new Date().toISOString(), records: provider.usage },
+              pricing,
+            );
+            const usageTmp = `${usagePath}.tmp`;
+            await writeFile(usageTmp, JSON.stringify(nextLog, null, 2));
+            await rename(usageTmp, usagePath);
+            // A `youtube-<key>.json` cache, keyed on the provider asked like
+            // produce's Y2 write — deliberately NOT produce's exact key: that
+            // key hashes the cut map's spans and the stamped transcript,
+            // which only a produce run holds, and matching it would falsely
+            // claim cache identity with an answer built from different
+            // inputs. mtime is what makes this pack current: both
+            // currentYoutubePack and loadPublishPack sort caches newest
+            // first. Atomic like the approved-pack write.
+            const key = createHash("sha1")
+              .update(
+                JSON.stringify([
+                  YOUTUBE_PROMPT_VERSION,
+                  resolved.provider,
+                  intent ?? "",
+                  audience ?? "",
+                  words.map((w) => w.text),
+                ]),
+              )
+              .digest("hex")
+              .slice(0, 8);
+            const packPath = join(workdir, `youtube-${key}.json`);
+            const packTmp = `${packPath}.tmp`;
+            await writeFile(packTmp, JSON.stringify(pack, null, 2));
+            await rename(packTmp, packPath);
+            return send(200, { ok: true, usage: formatUsageLine(provider.usage, pricing) });
+          } finally {
+            packGenBusy = false;
+          }
+        }
+
         // ---- Publish (2026-08-26) -----------------------------------------
         // The server's FIRST outbound-network endpoints, against the
         // roadmap's "replay-only by deliberate design" posture — allowed
@@ -1468,14 +1887,33 @@ export async function startEditServer(
         // in the user's shell env) does the upload.
         if (url.pathname === "/api/publish" && req.method === "GET") {
           if (!workdir) return send(409, { error: "no workdir open" });
-          const configured = publishConfigured((opts.loadCfg ?? loadConfig)(), opts.publishEnv ?? process.env);
+          const configured = resolvePublishConfig();
           if (!configured.ok) {
             return send(200, { configured: false, reason: configured.message });
           }
           const cmd = await readCommandRecord();
           const out = cmd ? recordedOutPath(cmd) : null;
           const pack = await currentYoutubePack();
-          let integrations: Array<{ id: string; provider: string; name: string; caption: string }> = [];
+          // Pre-flight duration for the panel, read leniently (the
+          // /api/cleanup posture): a missing ffprobe or an unreadable render
+          // degrades to null — the panel loses the gray-out, never the modal —
+          // and POST re-checks the caps authoritatively anyway.
+          let durationSec: number | null = null;
+          if (out !== null && existsSync(out)) {
+            try {
+              durationSec = (await (opts.probeVideo ?? probe)(publishTools(), out)).duration;
+            } catch {
+              // degrade — the caps still apply server-side on POST
+            }
+          }
+          let integrations: Array<{
+            id: string;
+            provider: string;
+            name: string;
+            caption: string;
+            durationCapSec: number | null;
+            sizeCapBytes: number | null;
+          }> = [];
           try {
             const provider = createPostizProvider({
               baseUrl: configured.baseUrl,
@@ -1488,6 +1926,13 @@ export async function startEditServer(
               // The caption the publish WOULD use — authored-else-derived —
               // so the panel previews truth, not a guess of it.
               caption: pack !== null ? captionForProvider(pack, t.provider) : "",
+              // Null = no cap (limits.ts: absence means unlimited) — the
+              // panel grays out a channel only against a cap that exists.
+              durationCapSec: PLATFORM_DURATION_CAPS_SEC[t.provider] ?? null,
+              // The platform's upload byte ceiling, same posture: null means
+              // uncapped, a number means this channel gets its own smaller
+              // delivery encode (limits.ts: Instagram's ~100MB URL-fetch cap).
+              sizeCapBytes: PLATFORM_SIZE_CAP_BYTES[t.provider] ?? null,
             }));
           } catch (err) {
             return send(200, {
@@ -1502,13 +1947,14 @@ export async function startEditServer(
             integrations,
             packAvailable: pack !== null,
             outPathExists: out !== null && existsSync(out),
+            durationSec,
             receipt: await readPublishReceipt(workdir),
           });
         }
 
         if (url.pathname === "/api/publish" && req.method === "POST") {
           if (!workdir) return send(409, { error: "no workdir open" });
-          const configured = publishConfigured((opts.loadCfg ?? loadConfig)(), opts.publishEnv ?? process.env);
+          const configured = resolvePublishConfig();
           if (!configured.ok) return send(412, { error: configured.message });
           const chunks: Buffer[] = [];
           for await (const c of req) chunks.push(c as Buffer);
@@ -1522,6 +1968,9 @@ export async function startEditServer(
               // ids fall back to the pack's authored-else-derived caption.
               captions: z.record(z.string(), z.string()).optional(),
               force: z.boolean().optional(),
+              // What uploads (the CLI's --delivery): auto (default) builds
+              // the cached delivery encode, master sends the untouched render.
+              delivery: z.enum(["auto", "master"]).optional(),
             })
             .safeParse(JSON.parse(Buffer.concat(chunks).toString() || "{}"));
           if (!parsed.success) return send(400, { error: parsed.error.message });
@@ -1555,23 +2004,290 @@ export async function startEditServer(
               fetchImpl: opts.publishFetch,
             });
             const targets = await provider.listTargets();
-            const picked = parsed.data.integrationIds.map((id) => {
+            let picked = parsed.data.integrationIds.map((id) => {
               const hit = targets.find((t) => t.id === id);
               if (!hit) throw new Error(`no integration with id "${id}" in Postiz`);
               return hit;
             });
+            // Same core helpers, same semantics as the CLI (checkDurationCaps
+            // + ensureDeliveryFile — one spelling of the rules): drop the
+            // channels this video can never land on, publish the rest, and
+            // only when EVERY pick is over its cap refuse the whole request.
+            const tools = publishTools();
+            const masterProbe = await (opts.probeVideo ?? probe)(tools, out);
+            const violations = checkDurationCaps(picked, masterProbe.duration);
+            // Duration entries keep their original shape; size entries carry
+            // a `reason` and the cap that doomed them — additive fields only,
+            // so an older panel reading `dropped` keeps working.
+            const dropped: Array<Record<string, unknown>> = violations.map((v) => ({
+              id: v.target.id,
+              provider: v.target.provider,
+              name: v.target.name,
+              capSec: v.capSec,
+            }));
+            if (violations.length > 0) {
+              const over = new Set(violations.map((v) => v.target.id));
+              picked = picked.filter((t) => !over.has(t.id));
+              if (picked.length === 0) {
+                return send(412, {
+                  error:
+                    `every picked channel refuses a ${Math.round(masterProbe.duration)}s video — ` +
+                    "nothing to publish",
+                  dropped,
+                });
+              }
+            }
+            // Size-cap pre-check with the pure plan (the CLI's semantics,
+            // one spelling): an unattainable cap drops the channel BEFORE
+            // any encode — ensureDeliveryFile THROWS on unattainable, and a
+            // 502 with ffmpeg arithmetic in it is not a drop-and-continue.
+            const masterSizeBytes = (await stat(out)).size;
+            const src = {
+              width: masterProbe.width,
+              height: masterProbe.height,
+              fps: masterProbe.fps,
+              duration: masterProbe.duration,
+              sizeBytes: masterSizeBytes,
+            };
+            let capGroups = sizeCapGroups(picked);
+            if (parsed.data.delivery !== "master") {
+              for (const [capBytes, group] of capGroups) {
+                const capped = deliveryEncodePlan(src, { sizeCapBytes: capBytes });
+                if (capped !== null && "unattainable" in capped) {
+                  for (const t of group) {
+                    dropped.push({
+                      id: t.id,
+                      provider: t.provider,
+                      name: t.name,
+                      sizeCapBytes: capBytes,
+                      reason: "size",
+                    });
+                  }
+                  const over = new Set(group.map((t) => t.id));
+                  picked = picked.filter((t) => !over.has(t.id));
+                }
+              }
+              if (picked.length === 0) {
+                return send(412, {
+                  error:
+                    `every picked channel's size cap is unattainable for a ` +
+                    `${Math.round(masterProbe.duration)}s video — nothing to publish`,
+                  dropped,
+                });
+              }
+              capGroups = sizeCapGroups(picked);
+            }
             const posts = buildPublishPosts(pack, picked).map((p) => ({
               ...p,
               caption: parsed.data.captions?.[p.target.id] ?? p.caption,
             }));
-            const result = await provider.publish({ videoPath: out, posts, when });
+            // Synchronous encodes (~1–3 min each, fetch won't time out) — a
+            // job/poll model for the WORK is a noted follow-up, but the
+            // PROGRESS is polled: /api/publish/progress reads the state the
+            // onProgress callback below keeps current. Sequential per cap
+            // group (two ffmpegs racing for cores would slow both), so pct
+            // simply runs 0→100 once per file and `file` names which one.
+            let uploadPath = out;
+            const cappedPaths = new Map<number, string>();
+            if (parsed.data.delivery !== "master") {
+              // `workdir` is a mutable binding, so its non-null narrowing
+              // from the top of the handler doesn't survive into a closure —
+              // capture it while narrowed.
+              const wd = workdir;
+              const runEnsure = async (
+                sizeCapBytes?: number,
+              ): ReturnType<typeof ensureDeliveryFile> => {
+                let currentFile: string | null = null;
+                publishProgress = { phase: "encoding", pct: 0, etaSec: null, speed: null, file: null };
+                return (opts.ensureDelivery ?? ensureDeliveryFile)(tools, wd, out, {
+                  ...(sizeCapBytes !== undefined ? { sizeCapBytes } : {}),
+                  onStart: (name) => {
+                    currentFile = name;
+                    publishProgress = { phase: "encoding", pct: 0, etaSec: null, speed: null, file: name };
+                  },
+                  onProgress: (p) => {
+                    publishProgress = {
+                      phase: "encoding",
+                      // Percent against the MASTER's duration — the delivery
+                      // encode preserves it, so out_time maps 1:1.
+                      pct:
+                        p.outTimeSec !== undefined && masterProbe.duration > 0
+                          ? Math.min(
+                              100,
+                              Math.round((p.outTimeSec / masterProbe.duration) * 100),
+                            )
+                          : null,
+                      etaSec:
+                        p.outTimeSec !== undefined && p.speed !== undefined
+                          ? encodeEta(masterProbe.duration, p.outTimeSec, p.speed)
+                          : null,
+                      speed: p.speed ?? null,
+                      file: currentFile,
+                    };
+                  },
+                });
+              };
+              uploadPath = (await runEnsure()).path;
+              // One encode per DISTINCT cap — the bitrate-bearing filename is
+              // the cache key, so a capped plan that lands on the default
+              // file's name cache-hits instead of re-encoding.
+              for (const capBytes of capGroups.keys()) {
+                cappedPaths.set(capBytes, (await runEnsure(capBytes)).path);
+              }
+            }
+            // No upload ETA — Postiz's multipart upload gives us nothing to
+            // measure, so the phase alone is the signal.
+            publishProgress = { phase: "uploading", pct: null, etaSec: null, speed: null, file: null };
+            const result = await provider.publish({
+              videoPath: uploadPath,
+              posts: attachDeliveryMedia(posts, uploadPath, cappedPaths),
+              when,
+            });
             await writeFile(publishReceiptPath(workdir), `${JSON.stringify(result, null, 2)}\n`);
-            return send(200, { ok: true, receipt: result });
+            return send(200, { ok: true, receipt: result, dropped });
           } catch (err) {
             // Fail loud, verbatim — Postiz's own validation message is the
             // most specific thing anyone has (per-provider settings are its
             // domain, not ours).
             return send(502, { error: err instanceof Error ? err.message : String(err) });
+          } finally {
+            publishProgress = null;
+          }
+        }
+
+        if (url.pathname === "/api/publish/progress" && req.method === "GET") {
+          // Where the in-flight publish is — 200 always, `progress: null`
+          // when idle (a cache hit or a skip-plan publish never enters the
+          // encoding phase, and the panel keeps its static line for that).
+          return send(200, { progress: publishProgress });
+        }
+
+        if (url.pathname === "/api/publish/regenerate" && req.method === "POST") {
+          // Rewrite ONE network's caption with the LLM the produce run used
+          // (handoff 2026-08-29 item 4): the prompt carries the transcript,
+          // the caption AS THE PANEL HOLDS IT and the user's correction, and
+          // the replacement text rides back into the panel's box. Nothing
+          // auto-sends and nothing writes to the pack — the user still
+          // reviews, edits and presses Publish.
+          if (!workdir) return send(409, { error: "no workdir open" });
+          // An LLM call costs money — one at a time, a second is a 409 like
+          // a second thumbnail.
+          if (captionRegenBusy) {
+            return send(409, { error: "a caption regeneration is already running" });
+          }
+          const chunks: Buffer[] = [];
+          for await (const c of req) chunks.push(c as Buffer);
+          // `currentCaption` is deliberately the client's text — the ONE
+          // body-steered value beyond the ask itself, because the box may
+          // hold the user's manual edits and the model must see what the
+          // user sees. It steers only prompt text, never a path or a spawn.
+          const parsed = z
+            .object({
+              network: z.string().min(1),
+              instruction: z.string().min(1),
+              currentCaption: z.string(),
+            })
+            .safeParse(JSON.parse(Buffer.concat(chunks).toString() || "{}"));
+          if (!parsed.success) return send(400, { error: parsed.error.message });
+          // Lenient transcript read (the GET /api/transcript posture), but a
+          // 412 when it yields nothing: a rewrite with no transcript would be
+          // a rewrite with no factual evidence, which is the exact failure
+          // this endpoint exists to repair.
+          let transcript: { language: string; words: Array<{ text: string }> } | null = null;
+          try {
+            const raw = JSON.parse(await readFile(join(workdir, "transcript.json"), "utf8")) as {
+              language?: unknown;
+              words?: unknown;
+            };
+            if (Array.isArray(raw.words)) {
+              transcript = {
+                language: typeof raw.language === "string" ? raw.language : "en",
+                words: raw.words.filter(
+                  (w): w is { text: string } =>
+                    typeof (w as { text?: unknown } | null)?.text === "string",
+                ),
+              };
+            }
+          } catch {
+            // absent/corrupt → the 412 below
+          }
+          if (transcript === null || transcript.words.length === 0) {
+            return send(412, {
+              error:
+                "no transcript in this workdir — the rewrite would have nothing to " +
+                "ground against; re-run `ossclip produce`.",
+            });
+          }
+          // Env fresh per press, resolvePublishConfig's rule: a key set after
+          // startup must count. Skipped when tests own the environment.
+          if (opts.publishEnv === undefined) loadEnvFiles();
+          const env = opts.publishEnv ?? process.env;
+          const usagePath = join(workdir, "usage.json");
+          let usageLog: unknown = null;
+          try {
+            usageLog = JSON.parse(await readFile(usagePath, "utf8"));
+          } catch {
+            // no log yet — the resolution falls through to the pin/detection
+          }
+          const cmd = await readCommandRecord();
+          const resolved = captionRegenProvider({
+            usageLog,
+            commandArgs: cmd?.args ?? null,
+            env,
+            hasBin: (bin) => binOnPath(bin, env),
+          });
+          if (resolved.status === "unavailable") {
+            // Precondition, not a generation failure — 412 like a thumbnail
+            // regenerate on an unavailable project.
+            return send(412, { error: resolved.reason });
+          }
+          const provider = (opts.makeLlmProvider ?? createProvider)(resolved.provider);
+          captionRegenBusy = true;
+          try {
+            let caption: string;
+            try {
+              caption = await generateCaptionRegen(provider, {
+                network: parsed.data.network,
+                currentCaption: parsed.data.currentCaption,
+                instruction: parsed.data.instruction,
+                transcriptText: transcript.words.map((w) => w.text).join(" "),
+                charCap: captionCap(parsed.data.network),
+              });
+            } catch (err) {
+              // 200 with ok:false, the thumbnail regenerate's posture: a
+              // provider failure is a sentence the panel shows VERBATIM,
+              // never a dead 500.
+              return send(200, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+            const pricing = (opts.loadCfg ?? loadConfig)().pricing ?? {};
+            // The spend is real, so it survives the session: appended into
+            // the workdir's usage log the way produce appends its runs.
+            // Atomic like the overrides write — /api/usage may read it at
+            // any moment.
+            const nextLog = appendUsageRun(
+              usageLog,
+              { at: new Date().toISOString(), records: provider.usage },
+              pricing,
+            );
+            const tmp = `${usagePath}.tmp`;
+            await writeFile(tmp, JSON.stringify(nextLog, null, 2));
+            await rename(tmp, usagePath);
+            // Advisory ONLY, never a block: captions legitimately carry
+            // brand and platform words the take never speaks. The `--speaker`
+            // pin counts as spoken vocabulary for checkGrounding's §39
+            // reason — the channel name is in nearly every caption.
+            const speaker = lastFlagValue(cmd?.args ?? [], ["--speaker"]);
+            const notes = [...new Set(ungroundedTokens(caption, transcript, speaker))].map(
+              (token) => `⚠ grounding: "${token}" — not in the take`,
+            );
+            return send(200, {
+              ok: true,
+              caption,
+              usage: formatUsageLine(provider.usage, pricing),
+              notes,
+            });
+          } finally {
+            captionRegenBusy = false;
           }
         }
 
@@ -1772,6 +2488,170 @@ export async function startEditServer(
           }
         }
 
+        if (url.pathname === "/api/sfx/plan" && req.method === "GET") {
+          // The MODEL's placement plan plus the word space it is written in
+          // (Phase 4). Two values, one route, because they are useless apart:
+          // a placement is `{soundId, word}` and `word` is an INDEX, so the
+          // editor can only draw a marker — or write one — against the exact
+          // array produce counted.
+          //
+          // And that array is NOT `transcript.json`, which is what
+          // /api/transcript serves: produce writes that file straight off
+          // whisper (produce.ts, `writeFile(transcriptCache, …)`) and only
+          // THEN applies repairs and the `--clip` slice, planning sound
+          // effects against the result. `applyRepairs` splices, so the two
+          // index spaces need not line up at all — clip.ts's own note on
+          // slicing says it outright ("repairs may change word counts, so raw
+          // and repaired index spaces need not line up"). An editor drawing
+          // this lane off transcript.json would place every marker on the
+          // wrong word the moment one repair changed a word count, and its
+          // drags would WRITE those wrong indices into overrides.json, where
+          // produce reads them in the other space. So the derivation happens
+          // HERE, once, on the server that has the pieces.
+          //
+          // The derivation is `ProductionSchema.repairs`' own stated contract:
+          // `applyRepairs(transcript, repairs.filter(r => r.applied))`
+          // reconstructs exactly what was rendered. No clip windowing on top:
+          // production.json's `transcript` is ALREADY the sliced raw one and
+          // its `repairs` were re-indexed with it (produce.ts's `--clip`
+          // block: `rawTranscript = rawSlice.transcript` / `repairs =
+          // sliceRepairs(…)`), so a second slice here would shift every index
+          // by the clip's offset — the very bug this route exists to avoid.
+          //
+          // Its own route rather than a field on /api/production: that endpoint
+          // is the page's hot load path and reads render-props.json, and this
+          // needs production.json plus a repair replay. Lenient throughout —
+          // any missing or corrupt piece answers `null` and the editor hides
+          // the lane, exactly the /api/cleanup posture. A sound-effect lane is
+          // never worth a 500.
+          if (!workdir) return send(409, { error: "no workdir open" });
+          let production: Record<string, unknown> | null = null;
+          try {
+            production = JSON.parse(
+              await readFile(join(workdir, "production.json"), "utf8"),
+            ) as Record<string, unknown>;
+          } catch {
+            return send(200, { sfx: null, words: null });
+          }
+          // Parsed, never cast (CLAUDE.md) — production.json is a file a user
+          // can hand-edit, and the editor has no zod of its own, so the parse
+          // that guards this payload has to be this one. A `sfx` field that
+          // fails it is the same as none: no lane.
+          const parsedSfx = ProductionSfxSchema.safeParse(production.sfx);
+          const parsedTranscript = TranscriptSchema.safeParse(production.transcript);
+          let words: Array<{ text: string; start: number; end: number }> | null = null;
+          if (parsedTranscript.success) {
+            const stored = Array.isArray(production.repairs)
+              ? (production.repairs as Array<Record<string, unknown>>)
+              : [];
+            const applied = stored.filter((r) => r.applied === true);
+            if (applied.length === 0) {
+              words = parsedTranscript.data.words;
+            } else {
+              // The dictionary rides along for the reason produce's own repair
+              // REPLAY passes it (its cached-repairs block): a
+              // dictionary-vouched correction clears the phonetic gate only
+              // when the vouched set is present, and `applyRepairs` re-decides
+              // every proposal it is handed rather than trusting the stored
+              // verdict.
+              // `dictionary` is `unknown` on the config (file-only, validated
+              // at the consumer — config.ts's posture), narrowed here the same
+              // way `retranscribeSettings` narrows it a few hundred lines up.
+              const rawDict = (opts.loadCfg ?? loadConfig)().dictionary;
+              const dictionary =
+                Array.isArray(rawDict) && rawDict.every((t) => typeof t === "string")
+                  ? (rawDict as string[])
+                  : undefined;
+              const decided = applyRepairs(
+                parsedTranscript.data,
+                applied.map((r) => ({
+                  startWord: Number(r.startWord),
+                  endWord: Number(r.endWord),
+                  heard: String(r.heard),
+                  correction: String(r.correction),
+                })),
+                { dictionary },
+              );
+              // A repair that produce APPLIED but this replay refuses means the
+              // reconstruction is not the array the placements were counted
+              // against — and a refused splice can change the word count, so
+              // every index after it would be off by one with nothing to say
+              // so. Refuse the whole word list rather than serve a plausible
+              // wrong one (§137's never-misapply rule): the lane hides, and no
+              // gesture can write an index into the wrong space.
+              words = decided.applied.every((r) => r.applied)
+                ? decided.transcript.words
+                : null;
+            }
+          }
+          return send(200, {
+            sfx: parsedSfx.success ? parsedSfx.data : null,
+            // METADATA only, like the library route: text and SOURCE seconds,
+            // which is all the client needs to map an index through its own
+            // live TimeMap.
+            words:
+              words === null
+                ? null
+                : words.map((w) => ({ text: w.text, start: w.start, end: w.end })),
+          });
+        }
+
+        if (url.pathname === "/api/sfx/library" && req.method === "GET") {
+          // The sound palette: what the swap dropdown offers and what a
+          // click-to-preview can play. NO workdir guard, unlike its siblings —
+          // the library is machine-global (every pack in ~/.ossclip/sfx, plus
+          // the bundled one unless `sfxBundledPack` excludes it), so it has
+          // nothing to do with which project is open, and the panel can render
+          // its menu before one is.
+          const library = sfxLibrary();
+          return send(200, {
+            // METADATA only: `absPath` stays server-side. The client addresses
+            // a sound by id through /api/sfx/audio, which is what keeps the
+            // filesystem out of a value the page could ever hand back (the
+            // audio route's path rule is the other half of the same decision).
+            sounds: library.sounds.map((s) => ({
+              id: s.id,
+              whenToUse: s.whenToUse,
+              tags: s.tags,
+              gain: s.gain,
+              ...(s.durationSec !== undefined ? { durationSec: s.durationSec } : {}),
+              packName: s.packName,
+            })),
+            // A user pack with a typo is a thing to SHOW, not to swallow: the
+            // loader already degraded rather than throwing, and the panel is
+            // the only surface a `~/.ossclip/sfx` author ever sees.
+            issues: library.issues,
+          });
+        }
+
+        if (url.pathname === "/api/sfx/audio" && req.method === "GET") {
+          // Click-to-preview. The path comes from the LOADED LIBRARY, never
+          // from the client: the query carries an id, the id is looked up, and
+          // the file that answers is whatever `loadSfxLibrary` resolved for it.
+          // A traversal attempt is therefore not a path to reject but an id
+          // nothing answers to — a plain 404, the same as any other unknown id
+          // (and `SfxSoundSchema.id` is a slug, so no id can ever spell a path
+          // in the first place).
+          const id = url.searchParams.get("id") ?? "";
+          const sound = sfxLibrary().sounds.find((s) => s.id === id);
+          // Existence is re-checked here for `resolveSfxCues`' reason: a pack
+          // deleted since the library was read must be a 404, not a 500 out of
+          // `statSync` inside `sendFile`.
+          if (sound === undefined || !existsSync(sound.absPath)) {
+            return send(404, { error: `no sound "${id}" in the library` });
+          }
+          // No range support: these are sub-second files an `<audio>` element
+          // plays whole, and a preview has nothing to seek through.
+          sendFile(
+            req,
+            res,
+            sound.absPath,
+            MIME[extname(sound.absPath).toLowerCase()] ?? "application/octet-stream",
+            false,
+          );
+          return;
+        }
+
         if (url.pathname.startsWith("/media/")) {
           if (!workdir) return send(409, { error: "no workdir open" });
           const file = join(workdir, decodeURIComponent(url.pathname.slice("/media/".length)));
@@ -1797,7 +2677,22 @@ export async function startEditServer(
     })();
   });
 
-  await new Promise<void>((r) => server.listen(opts.port ?? 5174, "127.0.0.1", r));
+  // REJECT on a failed bind, don't crash. Without the error listener an
+  // EADDRINUSE is an unhandled 'error' event on the server object, which is
+  // fatal to the whole process — that raw Node stack (plus the package
+  // manager's ELIFECYCLE after it) is exactly what a busy 5174 printed at
+  // users, and `openEditServer` (edit-port.ts) cannot offer to attach to the
+  // editor already running there unless the failure comes back as a rejection
+  // it can catch. The listener is removed on success so a LATER runtime error
+  // (a client resetting a connection) keeps whatever handling http gives it.
+  await new Promise<void>((res, rej) => {
+    const onError = (err: Error): void => rej(err);
+    server.once("error", onError);
+    server.listen(opts.port ?? 5174, "127.0.0.1", () => {
+      server.off("error", onError);
+      res();
+    });
+  });
   const addr = server.address();
   const port = typeof addr === "object" && addr ? addr.port : (opts.port ?? 5174);
   return {