dev-server.js

// dev-server.js — zero-install local dev server (Node ≥18, no npm install needed):
//
//     node dev-server.js          → http://localhost:3000
//
// Serves the static frontend and mounts api/feed.js behind a tiny Vercel-style
// (req, res) adapter, so local behaviour matches the deployed app. On Vercel itself
// this file is ignored — zero-config handles /api/*.js + static files natively.

import http from 'node:http';
import { readFile } from 'node:fs/promises';
import { extname, join, resolve, normalize, sep } from 'node:path';
import { fileURLToPath } from 'node:url';
import feed from './api/feed.js';

const ROOT = fileURLToPath(new URL('.', import.meta.url));
const PORT = Number(process.env.PORT) || 3000;

const MIME = {
  '.html': 'text/html; charset=utf-8',
  '.css': 'text/css; charset=utf-8',
  '.js': 'text/javascript; charset=utf-8',
  '.mjs': 'text/javascript; charset=utf-8',
  '.json': 'application/json; charset=utf-8',
  '.svg': 'image/svg+xml',
  '.png': 'image/png',
  '.ico': 'image/x-icon',
  '.txt': 'text/plain; charset=utf-8',
};

http.createServer(async (req, res) => {
  const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);

  // ── serverless function, Vercel-style adapter ──────────────────────────
  if (url.pathname === '/api/feed') {
    req.query = Object.fromEntries(url.searchParams);
    res.status = (code) => { res.statusCode = code; return res; };
    res.json = (obj) => {
      res.setHeader('Content-Type', 'application/json; charset=utf-8');
      res.end(JSON.stringify(obj));
    };
    try { await feed(req, res); }
    catch (err) {
      res.statusCode = 500;
      res.setHeader('Content-Type', 'application/json');
      res.end(JSON.stringify({ error: String((err && err.message) || err) }));
    }
    return;
  }

  // ── static files ───────────────────────────────────────────────────────
  const rel = url.pathname === '/' ? 'index.html' : url.pathname.slice(1);
  const path = resolve(ROOT, normalize(rel));
  if (!path.startsWith(resolve(ROOT) + sep)) {       // path-traversal guard
    res.statusCode = 403; res.end('forbidden'); return;
  }
  try {
    const body = await readFile(path);
    res.setHeader('Content-Type', MIME[extname(path).toLowerCase()] || 'application/octet-stream');
    res.end(body);
  } catch {
    res.statusCode = 404;
    res.setHeader('Content-Type', 'text/plain');
    res.end('404 — not found');
  }
}).listen(PORT, () => {
  console.log(`dynamicfeed-starter → http://localhost:${PORT}`);
  console.log('   GET /                live dashboard + in-browser signature verification');
  console.log('   GET /api/feed        keyless batch: earthquakes · treasury yields · exploited CVEs');
  console.log('   GET /api/feed?lat=-33.87&lon=151.21   …plus signed nearby hazards');
});