shorts-maker 0.3.0

package/src/server.ts

@@ -0,0 +1,645 @@
+#!/usr/bin/env bun
+// Web UI server: pick a video + options, watch live logs, browse/delete past jobs.
+
+import { join, basename, extname, dirname } from "node:path";
+import { readdir, mkdir, rm } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { hashtagPool } from "./pipeline/pipeline.ts";
+import { isOverlayPosition, OVERLAY_POSITIONS } from "./pipeline/overlay.ts";
+import * as store from "./jobs/store.ts";
+import * as social from "./social/config.ts";
+import * as facebook from "./social/facebook.ts";
+import { UPLOADS_DIR, OUTPUT_DIR, DIST_DIR } from "./paths.ts";
+import { VIDEO_EXTS, isVideo, safeJoin, uniqueName } from "./files.ts";
+
+
+// Serve the pre-built frontend (dist/, shipped in the published package or made by
+// `bun run build`) when it exists; otherwise fall back to Bun's live bundler for local
+// dev. Explicit NODE_ENV=development forces the dev path even when a build is present.
+const HAS_DIST = existsSync(join(DIST_DIR, "index.html"));
+const DEV = process.env.NODE_ENV === "development" || !HAS_DIST;
+// Static import would trigger Bun's bundler (and its Tailwind plugin) at load time, which
+// isn't available once installed — so only pull in the HTML entry on the dev path.
+const homepage = DEV ? (await import("../frontend/index.html")).default : null;
+
+const json = (data: unknown, status = 200) =>
+  new Response(JSON.stringify(data), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+
+function slugStem(name: string): string {
+  return (
+    basename(name)
+      .replace(/\.[^.]+$/, "")
+      .replace(/[^\p{L}\p{N}]+/gu, "-")
+      .replace(/^-+|-+$/g, "")
+      .toLowerCase() || "video"
+  );
+}
+
+const contentType = (file: string): string => {
+  const ext = extname(file).toLowerCase();
+  return (
+    {
+      ".mp4": "video/mp4",
+      ".txt": "text/plain; charset=utf-8",
+      ".json": "application/json",
+      ".html": "text/html; charset=utf-8",
+    }[ext] ?? "application/octet-stream"
+  );
+};
+
+/** Sanitize an uploaded filename to a bare, safe basename within videos/. */
+function safeName(raw: string): string {
+  const base = basename(raw).replace(/[/\\]/g, "").replace(/[\x00-\x1f]/g, "").trim();
+  return base || "upload.mp4";
+}
+
+/** Stream a raw request body into the uploads/ staging dir, without buffering it in memory. */
+async function handleUpload(req: Request, url: URL): Promise<Response> {
+  const raw = url.searchParams.get("name") || req.headers.get("x-filename") || "";
+  const wanted = safeName(decodeURIComponent(raw));
+  if (!VIDEO_EXTS.has(extname(wanted).toLowerCase())) {
+    return json({ error: `Unsupported video type: ${extname(wanted) || "(none)"}` }, 400);
+  }
+  if (!req.body) return json({ error: "Empty upload." }, 400);
+
+  await mkdir(UPLOADS_DIR, { recursive: true });
+  const name = await uniqueName(UPLOADS_DIR, wanted);
+  const path = join(UPLOADS_DIR, name);
+  const sink = Bun.file(path).writer();
+  try {
+    const reader = req.body.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) sink.write(value);
+    }
+    await sink.end();
+  } catch (err) {
+    await Promise.resolve(sink.end()).catch(() => {});
+    await rm(path, { force: true }).catch(() => {});
+    throw err;
+  }
+  return json({ name, size: Bun.file(path).size }, 201);
+}
+
+// ---- Social settings + publishing -------------------------------------------
+
+async function handleGetSettings(): Promise<Response> {
+  const fb = await social.getFacebook();
+  return json({
+    facebook: {
+      pageId: fb?.pageId ?? "",
+      pageName: fb?.pageName,
+      hasToken: !!fb?.token,
+      connected: !!(fb?.pageId && fb?.token),
+    },
+  });
+}
+
+async function handleSaveSettings(req: Request): Promise<Response> {
+  const body = (await req.json().catch(() => null)) as {
+    facebook?: { pageId?: string; token?: string };
+  } | null;
+  const fbIn = body?.facebook;
+  if (!fbIn?.pageId?.trim()) return json({ error: "A Facebook Page ID is required." }, 400);
+
+  const saved = await social.getFacebook();
+  const pageId = fbIn.pageId.trim();
+  const token = fbIn.token?.trim() ? social.cleanToken(fbIn.token) : saved?.token || "";
+  if (!token) return json({ error: "An access token is required." }, 400);
+
+  // Verify before persisting — only store credentials that actually work.
+  try {
+    const { pageName } = await facebook.verify(pageId, token);
+    await social.saveFacebook({ pageId, token: fbIn.token });
+    await social.setFacebookPageName(pageName);
+    return handleGetSettings();
+  } catch (err) {
+    return json({ error: (err as Error).message }, 400);
+  }
+}
+
+async function handleFbTest(req: Request): Promise<Response> {
+  // Verify only — never writes to disk. Uses the form's values, falling back to whatever
+  // is already saved (so you can re-test a stored config with the token field left blank).
+  const body = (await req.json().catch(() => ({}))) as { pageId?: string; token?: string };
+  const saved = await social.getFacebook();
+  const pageId = body?.pageId?.trim() || saved?.pageId || "";
+  const token = body?.token?.trim() ? social.cleanToken(body.token) : saved?.token || "";
+  if (!pageId || !token) return json({ error: "Enter a Page ID and access token first." }, 400);
+  try {
+    const { pageName, missing } = await facebook.verify(pageId, token);
+    return json({ ok: true, pageName, missing });
+  } catch (err) {
+    return json({ error: (err as Error).message }, 400);
+  }
+}
+
+/**
+ * Keep one "All parts" index comment on every posted part, edited in place as parts are
+ * published or removed. With fewer than two posts an index is noise, so any leftover
+ * index comment is deleted instead.
+ */
+async function syncPartsIndex(
+  job: store.Job,
+  platform: string,
+  token: string,
+): Promise<{ updated: number; warnings: string[] }> {
+  const published = job.parts
+    .filter((p) => p.published?.[platform]?.status === "done" && p.published[platform]!.id)
+    .sort((a, b) => a.part - b.part);
+  const warnings: string[] = [];
+  let updated = 0;
+
+  if (published.length < 2) {
+    for (const p of published) {
+      const pub = p.published![platform]!;
+      if (!pub.indexCommentId) continue;
+      await facebook.deleteComment(pub.indexCommentId, token).catch(() => {});
+      store.setPublishState(job.id, p.file, platform, { ...pub, indexCommentId: undefined });
+    }
+    return { updated, warnings };
+  }
+
+  // Footer flips automatically once the final part lands, since comments are re-edited
+  // on every sync.
+  const complete = published.length === job.parts.length;
+  const footer = complete
+    ? "❤️ Enjoyed the series? Follow us for more content!"
+    : "🔔 Follow us — more parts coming soon!";
+  const message =
+    "📺 All parts:\n" +
+    published
+      .map((p) => {
+        const pub = p.published![platform]!;
+        return `▶ Part ${p.part}: ${pub.url ?? `https://www.facebook.com/${pub.id}`}`;
+      })
+      .join("\n") +
+    `\n\n${footer}`;
+
+  for (const p of published) {
+    const pub = p.published![platform]!;
+    try {
+      if (pub.indexCommentId) {
+        await facebook.updateComment(pub.indexCommentId, message, token);
+      } else {
+        const c = await facebook.postComment(pub.id!, message, token);
+        store.setPublishState(job.id, p.file, platform, { ...pub, indexCommentId: c.id });
+      }
+      updated++;
+    } catch (err) {
+      warnings.push(`Part ${p.part}: ${(err as Error).message}`);
+    }
+  }
+  return { updated, warnings };
+}
+
+async function handlePublish(req: Request): Promise<Response> {
+  const body = (await req.json().catch(() => null)) as {
+    jobId?: string;
+    file?: string;
+    platform?: string;
+    /** Maintain an "All parts" index comment on every posted part of this series. */
+    linkAll?: boolean;
+  } | null;
+  const jobId = body?.jobId ?? "";
+  const file = body?.file ?? "";
+  const platform = body?.platform ?? "facebook";
+  if (platform !== "facebook") return json({ error: `Unsupported platform: ${platform}` }, 400);
+
+  const job = store.get(jobId);
+  if (!job) return json({ error: "No such job." }, 404);
+  const part = job.parts.find((p) => p.file === file);
+  if (!part) return json({ error: "No such part." }, 404);
+  const path = safeJoin(join(job.outDir, "parts"), file);
+  if (!path || !(await Bun.file(path).exists())) return json({ error: "Clip file is missing." }, 404);
+
+  const fb = await social.getFacebook();
+  if (!fb?.pageId || !fb?.token) {
+    return json({ error: "Facebook isn’t configured. Add your Page in Settings." }, 400);
+  }
+
+  // Guard against double-publishing: already done, or another upload in flight.
+  const existing = store.publishState(jobId, file, platform);
+  if (existing?.status === "done") return json({ ok: true, platform, ...existing });
+  if (existing?.status === "pending") return json({ error: "This part is already being published." }, 409);
+
+  // Persist the in-flight state first, so a page refresh (or a second click) sees it.
+  store.setPublishState(jobId, file, platform, { status: "pending", at: Date.now() });
+  try {
+    const res = await facebook.uploadVideo({
+      pageId: fb.pageId,
+      token: fb.token,
+      filePath: path,
+      title: part.title,
+      description: part.caption,
+      // Persist byte progress so the frontend's poll can render a live bar.
+      onProgress: (sent, total) =>
+        store.setPublishState(jobId, file, platform, { status: "pending", sent, total, at: Date.now() }),
+    });
+    const info = { status: "done" as const, id: res.id, url: res.url, at: Date.now() };
+    store.setPublishState(jobId, file, platform, info);
+
+    // Series index: refresh the "All parts" comment across every posted part.
+    // Best-effort — the publish itself already succeeded, so index trouble is reported
+    // as a warning, never as a failed publish.
+    let indexed: number | undefined;
+    let linkWarning: string | undefined;
+    if (body?.linkAll) {
+      const sync = await syncPartsIndex(job, platform, fb.token);
+      indexed = sync.updated;
+      if (sync.warnings.length) linkWarning = `Index comment issues — ${sync.warnings.join("; ")}`;
+    }
+    return json({
+      ok: true,
+      platform,
+      ...info,
+      ...(indexed !== undefined ? { indexed } : {}),
+      ...(linkWarning ? { linkWarning } : {}),
+    });
+  } catch (err) {
+    const msg = (err as Error).message;
+    store.setPublishState(jobId, file, platform, { status: "error", error: msg, at: Date.now() });
+    return json({ error: msg }, 502);
+  }
+}
+
+/** Delete the Facebook post for a part, then forget the local publish record. */
+async function handleUnpublish(req: Request): Promise<Response> {
+  const body = (await req.json().catch(() => null)) as { jobId?: string; file?: string; platform?: string } | null;
+  const jobId = body?.jobId ?? "";
+  const file = body?.file ?? "";
+  const platform = body?.platform ?? "facebook";
+  if (platform !== "facebook") return json({ error: `Unsupported platform: ${platform}` }, 400);
+
+  const pub = store.publishState(jobId, file, platform);
+  if (!pub?.id) return json({ error: "This part isn’t posted." }, 404);
+
+  const fb = await social.getFacebook();
+  if (!fb?.token) return json({ error: "Facebook isn’t configured. Add your Page in Settings." }, 400);
+
+  try {
+    await facebook.deleteVideo(pub.id, fb.token);
+  } catch (err) {
+    // If the post is already gone on Facebook's side, just forget it locally.
+    const msg = (err as Error).message;
+    if (!/does not exist|unsupported|cannot be loaded|missing/i.test(msg)) {
+      return json({ error: msg }, 502);
+    }
+  }
+  store.clearPublishState(jobId, file, platform);
+
+  // If this series maintains "All parts" index comments, scrub the dead link from the
+  // remaining posts (best-effort — the removal itself already succeeded).
+  const job = store.get(jobId);
+  if (job && job.parts.some((p) => p.published?.[platform]?.indexCommentId)) {
+    await syncPartsIndex(job, platform, fb.token).catch(() => {});
+  }
+  return json({ ok: true });
+}
+
+// ---- Reveal a clip in the OS file manager (local machine only) --------------
+
+/**
+ * True only when the request comes from a browser on this same machine. Behind a
+ * tunnel/proxy (e.g. cloudflared) the socket is loopback but forwarding headers are set,
+ * so those requests are treated as remote — a remote user must not pop Finder on the host.
+ */
+function isLocalRequest(req: Request, server: Bun.Server<undefined>): boolean {
+  if (req.headers.get("x-forwarded-for") || req.headers.get("x-forwarded-proto") || req.headers.get("x-forwarded-host")) {
+    return false;
+  }
+  const ip = server.requestIP(req)?.address ?? "";
+  return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+}
+
+/** Open the OS file manager with the clip selected (macOS Finder / Windows Explorer / Linux). */
+function revealInFileManager(filePath: string): void {
+  const cmd =
+    process.platform === "darwin"
+      ? ["open", "-R", filePath]
+      : process.platform === "win32"
+        ? ["explorer", `/select,${filePath}`]
+        : ["xdg-open", dirname(filePath)]; // Linux has no universal "select" — open the folder
+  Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore" });
+}
+
+async function handleReveal(req: Request, server: Bun.Server<undefined>): Promise<Response> {
+  if (!isLocalRequest(req, server)) {
+    return json({ error: "“Reveal” only works when ShortsMaker is open on the same computer as the server." }, 403);
+  }
+  const body = (await req.json().catch(() => null)) as { jobId?: string; file?: string } | null;
+  const job = store.get(body?.jobId ?? "");
+  if (!job) return json({ error: "No such job." }, 404);
+  const path = safeJoin(join(job.outDir, "parts"), body?.file ?? "");
+  if (!path || !(await Bun.file(path).exists())) return json({ error: "Clip file is missing." }, 404);
+  try {
+    revealInFileManager(path);
+    return json({ ok: true });
+  } catch (err) {
+    return json({ error: (err as Error).message }, 500);
+  }
+}
+
+async function handleCreate(req: Request): Promise<Response> {
+  const body = (await req.json().catch(() => null)) as Record<string, unknown> | null;
+  if (!body) return json({ error: "Invalid JSON body." }, 400);
+
+  const title = body.title ? String(body.title).trim() || undefined : undefined;
+  const partLen = body.partLen != null ? Math.max(30, Number(body.partLen)) : undefined;
+  const numHashtags = body.numHashtags != null ? Math.max(0, Number(body.numHashtags)) : undefined;
+  const hashtags = Array.isArray(body.hashtags)
+    ? (body.hashtags as unknown[]).map(String)
+    : typeof body.hashtags === "string"
+      ? (body.hashtags as string).split(/[\n,]/)
+      : undefined;
+
+  // The badge is opt-in; anything but a known position (including null/absent) means off.
+  let overlay: store.CreateOptions["overlay"];
+  if (body.overlay != null && body.overlay !== false && body.overlay !== "") {
+    if (!isOverlayPosition(body.overlay)) {
+      return json({ error: `Overlay position must be one of: ${OVERLAY_POSITIONS.join(", ")}` }, 400);
+    }
+    overlay = body.overlay;
+  }
+
+  // Two source modes: a staged upload (`video`) or a remote link (`url`, fetched by yt-dlp).
+  const rawUrl = typeof body.url === "string" ? body.url.trim() : "";
+  let source: { video?: string; url?: string; videoName: string };
+  if (rawUrl) {
+    let parsed: URL;
+    try {
+      parsed = new URL(rawUrl);
+    } catch {
+      return json({ error: "That doesn’t look like a valid URL." }, 400);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return json({ error: "Only http/https links are supported." }, 400);
+    }
+    // Provisional label until the real title is known post-download.
+    source = { url: rawUrl, videoName: parsed.hostname.replace(/^www\./, "") };
+  } else {
+    const videoName = String(body.video ?? "");
+    // The source is the staged upload in uploads/ — deleted once the job finishes.
+    const src = safeJoin(UPLOADS_DIR, videoName);
+    if (!videoName || !src || !(await Bun.file(src).exists())) {
+      return json({ error: `Uploaded video not found: ${videoName}` }, 400);
+    }
+    source = { video: src, videoName };
+  }
+
+  const outDir = join(OUTPUT_DIR, `${slugStem(source.videoName)}__${store.stamp()}`);
+  const job = await store.create({
+    ...source,
+    outDir,
+    title,
+    partLen,
+    numHashtags,
+    hashtags,
+    overlay,
+  });
+  return json(store.summary(job), 201);
+}
+
+// ---- Uploads library --------------------------------------------------------
+// uploads/ holds every source video (browser uploads + finished URL downloads). Files
+// persist across jobs and restarts; the New split page manages them.
+
+async function handleListUploads(): Promise<Response> {
+  try {
+    const entries = await readdir(UPLOADS_DIR, { withFileTypes: true });
+    const files = await Promise.all(
+      entries
+        .filter((e) => e.isFile() && isVideo(e.name))
+        .map(async (e) => {
+          const f = Bun.file(join(UPLOADS_DIR, e.name));
+          return { name: e.name, size: f.size, mtime: (await f.stat()).mtimeMs };
+        }),
+    );
+    files.sort((a, b) => b.mtime - a.mtime);
+    return json(files);
+  } catch {
+    return json([]); // uploads/ may not exist yet
+  }
+}
+
+async function handleDeleteUpload(name: string): Promise<Response> {
+  const path = safeJoin(UPLOADS_DIR, decodeURIComponent(name));
+  if (!path || !isVideo(path)) return json({ error: "No such upload." }, 404);
+  if (!(await Bun.file(path).exists())) return json({ error: "No such upload." }, 404);
+  await rm(path, { force: true });
+  return json({ ok: true });
+}
+
+/** Delete every source video. Staging dirs and non-video files are left alone. */
+async function handleClearUploads(): Promise<Response> {
+  try {
+    const entries = await readdir(UPLOADS_DIR, { withFileTypes: true });
+    const videos = entries.filter((e) => e.isFile() && isVideo(e.name));
+    await Promise.all(videos.map((e) => rm(join(UPLOADS_DIR, e.name), { force: true }).catch(() => {})));
+    return json({ ok: true, removed: videos.length });
+  } catch {
+    return json({ ok: true, removed: 0 }); // uploads/ may not exist yet
+  }
+}
+
+function streamJob(id: string): Response {
+  const job = store.get(id);
+  if (!job) return json({ error: "No such job." }, 404);
+
+  let unsub: (() => void) | null = null;
+  let closed = false;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const enc = new TextEncoder();
+      const send = (ev: store.JobEvent) => {
+        if (closed) return;
+        try {
+          controller.enqueue(enc.encode(`data: ${JSON.stringify(ev)}\n\n`));
+        } catch {
+          // Client went away — stop and detach so the job keeps running untouched.
+          closed = true;
+          unsub?.();
+        }
+      };
+
+      // Replay what's already happened, then go live.
+      for (const line of job.logs) send({ type: "log", line });
+      if (job.status !== "running") {
+        send({ type: "status", status: job.status, error: job.error, parts: job.parts });
+        closed = true;
+        try {
+          controller.close();
+        } catch {
+          /* already closed */
+        }
+        return;
+      }
+      unsub = store.subscribe(id, (ev) => {
+        send(ev);
+        if (ev.type === "status" && ev.status !== "running") {
+          closed = true;
+          unsub?.();
+          try {
+            controller.close();
+          } catch {
+            /* already closed */
+          }
+        }
+      });
+    },
+    cancel() {
+      // Browser closed the EventSource — unsubscribe so we stop writing.
+      closed = true;
+      unsub?.();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache",
+      connection: "keep-alive",
+    },
+  });
+}
+
+/**
+ * Clear download staging dirs left behind by a crash/restart. The uploaded/downloaded
+ * videos themselves are a persistent library now — never swept.
+ */
+async function sweepStaging(): Promise<void> {
+  try {
+    const entries = await readdir(UPLOADS_DIR, { withFileTypes: true });
+    await Promise.all(
+      entries
+        .filter((e) => e.isDirectory() && e.name.startsWith(".dl_"))
+        .map((e) => rm(join(UPLOADS_DIR, e.name), { recursive: true, force: true }).catch(() => {})),
+    );
+  } catch {
+    /* uploads/ may not exist yet */
+  }
+}
+
+/** Serve the pre-built SPA from dist/: a real file if it exists, else the app shell so
+ *  client routes (/uploads, /jobs/x, …) and hard refreshes resolve. Prod path only. */
+async function serveStatic(pathname: string): Promise<Response> {
+  const rel = pathname === "/" ? "index.html" : pathname.slice(1);
+  const filePath = safeJoin(DIST_DIR, rel);
+  if (filePath) {
+    const f = Bun.file(filePath);
+    if (await f.exists()) return new Response(f);
+  }
+  // A missing asset (has an extension) is a genuine 404; a client route gets the shell.
+  if (extname(pathname)) return new Response("Not found", { status: 404 });
+  return new Response(Bun.file(join(DIST_DIR, "index.html")), {
+    headers: { "content-type": "text/html; charset=utf-8" },
+  });
+}
+
+await store.load();
+await sweepStaging();
+
+// In dev, Bun bundles the React app from this HTML entry (with HMR); every client-side
+// route serves the same shell so deep links / hard refreshes work. In prod these are
+// served from dist/ by serveStatic() instead.
+const spaRoutes = homepage
+  ? {
+      "/": homepage,
+      "/settings": homepage,
+      "/settings/*": homepage,
+      "/jobs/*": homepage,
+    }
+  : undefined;
+
+const server = Bun.serve({
+  port: Number(process.env.PORT ?? 4321),
+  idleTimeout: 0, // keep SSE connections open + allow long uploads
+  maxRequestBodySize: 64 * 1024 ** 3, // 64 GB — video uploads (default is only 128 MB)
+  ...(spaRoutes ? { routes: spaRoutes } : {}),
+  development: DEV ? { hmr: true, console: true } : false,
+  async fetch(req, server) {
+    const url = new URL(req.url);
+    const { pathname } = url;
+
+    try {
+      if (pathname === "/api/hashtags") return json({ hashtags: await hashtagPool() });
+      if (pathname === "/api/env") return json({ platform: process.platform, local: isLocalRequest(req, server) });
+      if (pathname === "/api/upload" && req.method === "PUT") return handleUpload(req, url);
+      if (pathname === "/api/reveal" && req.method === "POST") return handleReveal(req, server);
+
+      if (pathname === "/api/settings") {
+        if (req.method === "PUT") return handleSaveSettings(req);
+        return handleGetSettings();
+      }
+      if (pathname === "/api/settings/facebook/test" && req.method === "POST") return handleFbTest(req);
+      if (pathname === "/api/settings/facebook" && req.method === "DELETE") {
+        await social.clearFacebook();
+        return handleGetSettings();
+      }
+      if (pathname === "/api/publish" && req.method === "POST") return handlePublish(req);
+      if (pathname === "/api/publish" && req.method === "DELETE") return handleUnpublish(req);
+
+      if (pathname === "/api/uploads" && req.method === "GET") return handleListUploads();
+      if (pathname === "/api/uploads" && req.method === "DELETE") return handleClearUploads();
+      const up = pathname.match(/^\/api\/uploads\/(.+)$/);
+      if (up && req.method === "DELETE") return handleDeleteUpload(up[1]!);
+
+      if (pathname === "/api/jobs") {
+        if (req.method === "POST") return handleCreate(req);
+        return json(store.list());
+      }
+
+      const m = pathname.match(/^\/api\/jobs\/([^/]+)(\/(stream|parts))?(\/(.+))?$/);
+      if (m) {
+        const id = m[1]!;
+        const kind = m[3];
+        if (!kind) {
+          if (req.method === "DELETE") {
+            const ok = await store.remove(id);
+            return ok ? json({ ok }) : json({ error: "No such job." }, 404);
+          }
+          const job = store.get(id);
+          return job ? json(job) : json({ error: "No such job." }, 404);
+        }
+        if (kind === "stream") return streamJob(id);
+        if (kind === "parts") {
+          const job = store.get(id);
+          const rel = m[5] ?? "";
+          if (!job || !rel) return json({ error: "Not found." }, 404);
+          if (req.method === "PATCH") {
+            const body = (await req.json().catch(() => null)) as { caption?: string } | null;
+            if (typeof body?.caption !== "string") return json({ error: "A caption string is required." }, 400);
+            const ok = await store.setCaption(id, rel, body.caption);
+            return ok ? json({ ok: true, caption: body.caption }) : json({ error: "No such part." }, 404);
+          }
+          const path = safeJoin(join(job.outDir, "parts"), rel);
+          if (!path || !(await Bun.file(path).exists())) {
+            return json({ error: "Not found." }, 404);
+          }
+          const dl = url.searchParams.has("download");
+          return new Response(Bun.file(path), {
+            headers: {
+              "content-type": contentType(path),
+              ...(dl ? { "content-disposition": `attachment; filename="${basename(path)}"` } : {}),
+            },
+          });
+        }
+      }
+
+      // In prod, serve the built SPA + assets from dist/. In dev, `routes` above already
+      // handled the shell and Bun serves the bundled assets, so anything here is a 404.
+      if (!DEV) return serveStatic(pathname);
+      return new Response("Not found", { status: 404 });
+    } catch (err) {
+      const e = err as Error;
+      return json({ error: `${e.name}: ${e.message}` }, 500);
+    }
+  },
+});
+
+console.log(`\n  shorts-maker  ▸  http://localhost:${server.port}\n`);