Fix/casting bip001 clip urls

.gitignore

@@ -134,3 +134,34 @@ dist
 .yarn/build-state.yml
 .yarn/install-state.gz
 .pnp.*
+.vercel
+.env*
+
+# Author multipacks (regen via scripts/* — do not ship in Vercel)
+public/models/vfx/**/*_src.glb
+public/models/vfx/**/*_src.gltf
+
+# Duplicate override mirror (runtime SSOT is public/skills/production)
+/skills/
+
+# Large local weapon sources until R2 (keep on disk for lab)
+public/models/weapons/t0-flintlock.glb
+
+
+# >100MB — keep local / CDN later
+public/models/fish/species/rare/ocean_creature.glb
+
+# Local QA dumps (never ship)
+_qa_*
+deploy-out*.txt
+tmp/
+.tmp/
+
+# Loose fish extracts (tracked SSOT lives in poles/lures/docks/species)
+public/models/fish/*.glb
+public/models/fish/_bundle/
+
+# WIP scenery / class-form dumps until convert + R2
+public/models/class-forms/
+public/models/island-scenery/
+

api/cdn-proxy.js

@@ -0,0 +1,141 @@
+/**
+ * Same-origin R2 proxy — classic Vercel Node (req, res).
+ * Pattern from Warlords api/cdn-proxy.ts — do not invent a second CDN.
+ *
+ * vercel.json:
+ *   /api/assets/:path* → /api/cdn-proxy?key=:path*
+ *
+ * node:https with same-host Referer. Do not use fetch() — Vercel forwards
+ * the incoming Referer and Cloudflare Hotlink Protection 1011s PNGs.
+ */
+import https from 'node:https';
+
+const CDN_HOST = 'assets.grudge-studio.com';
+const MAX_PATH = 512;
+
+function setCors(res) {
+  res.setHeader('Access-Control-Allow-Origin', '*');
+  res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Range');
+  res.setHeader(
+    'Access-Control-Expose-Headers',
+    'ETag, Accept-Ranges, Content-Length, Content-Type, Content-Range, X-Upstream-Status'
+  );
+  res.setHeader('X-Grudge-Asset-Proxy', 'cdn-proxy');
+}
+
+function sanitizeKey(raw) {
+  let key = String(raw || '').trim();
+  try {
+    key = decodeURIComponent(key);
+  } catch {
+    return null;
+  }
+  key = key.replace(/^\/+/, '');
+  if (!key || key.length > MAX_PATH) return null;
+  if (key.includes('..') || key.includes('\\') || key.includes('://')) return null;
+  if (key.includes('//')) return null;
+  if (!/^[A-Za-z0-9._\-/% ]+$/.test(key)) return null;
+  return key;
+}
+
+function keyFromReq(req) {
+  const host = req.headers.host || 'localhost';
+  const url = new URL(req.url || '/', `http://${host}`);
+  const q = url.searchParams.get('key');
+  if (q) return sanitizeKey(q);
+  const path = url.pathname;
+  for (const prefix of ['/api/cdn-proxy/', '/api/assets/']) {
+    if (path.startsWith(prefix)) return sanitizeKey(path.slice(prefix.length));
+  }
+  return null;
+}
+
+export default function handler(req, res) {
+  setCors(res);
+
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    res.end();
+    return;
+  }
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    res.statusCode = 405;
+    res.end('Method Not Allowed');
+    return;
+  }
+
+  const key = keyFromReq(req);
+  if (!key) {
+    res.statusCode = 400;
+    res.end('Bad Request');
+    return;
+  }
+
+  const host = req.headers.host || 'localhost';
+  const url = new URL(req.url || '/', `http://${host}`);
+  const extra = [...url.searchParams.entries()]
+    .filter(([k]) => k !== 'key')
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+    .join('&');
+  const path = `/${key}${extra ? `?${extra}` : ''}`;
+
+  const headers = {
+    Host: CDN_HOST,
+    Accept: typeof req.headers.accept === 'string' ? req.headers.accept : '*/*',
+    'User-Agent': 'grudge-vercel-asset-proxy',
+    Referer: `https://${CDN_HOST}/`
+  };
+  if (typeof req.headers.range === 'string') headers.Range = req.headers.range;
+  if (typeof req.headers['if-none-match'] === 'string') {
+    headers['If-None-Match'] = req.headers['if-none-match'];
+  }
+
+  const up = https.request(
+    {
+      protocol: 'https:',
+      hostname: CDN_HOST,
+      path,
+      method: req.method,
+      headers
+    },
+    (upRes) => {
+      res.statusCode = upRes.statusCode || 502;
+      res.setHeader('X-Upstream-Status', String(upRes.statusCode || 502));
+      for (const name of [
+        'content-type',
+        'content-length',
+        'content-range',
+        'accept-ranges',
+        'etag',
+        'last-modified',
+        'cache-control'
+      ]) {
+        const v = upRes.headers[name];
+        if (typeof v === 'string') res.setHeader(name, v);
+        else if (Array.isArray(v)) res.setHeader(name, v.join(', '));
+      }
+      if (!res.getHeader('cache-control')) {
+        res.setHeader('Cache-Control', 'public, max-age=86400, stale-while-revalidate=3600');
+      }
+      if (req.method === 'HEAD') {
+        upRes.resume();
+        res.end();
+        return;
+      }
+      upRes.pipe(res);
+    }
+  );
+  up.setTimeout(20000, () => {
+    up.destroy(new Error('cdn timeout'));
+  });
+  up.on('error', () => {
+    if (!res.headersSent) {
+      res.statusCode = 502;
+      res.end('Bad Gateway');
+    } else {
+      res.end();
+    }
+  });
+  up.end();
+}

devnode.html

@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Grudge · Training Room · DevNode</title>
+    <meta
+      name="description"
+      content="Author the Training Room / DevIsland map: biomes, terrain, cliffs, trees, rocks, flowers, ore, animals, PvE — same map as play."
+    />
+    <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
+    <link rel="stylesheet" href="./src/devnode/devnode.css" />
+  </head>
+  <body>
+    <div id="devnode-app">
+      <aside class="dn-panel" id="dn-side">
+        <header class="dn-head">
+          <h1>Training Room</h1>
+          <p class="dn-sub">DevIsland · DevNode · one map</p>
+          <a class="dn-link" href="./index.html">← Play Training Room</a>
+        </header>
+
+        <label class="dn-label">Biome</label>
+        <select id="dn-biome" class="dn-select"></select>
+
+        <label class="dn-label">Family</label>
+        <div id="dn-families" class="dn-chips"></div>
+
+        <label class="dn-label">Palette</label>
+        <div id="dn-palette" class="dn-palette"></div>
+
+        <div class="dn-actions">
+          <button type="button" id="dn-export" class="dn-btn">Export JSON</button>
+          <button type="button" id="dn-import" class="dn-btn dn-btn--ghost">Import JSON</button>
+          <button type="button" id="dn-clear" class="dn-btn dn-btn--ghost">Clear nodes</button>
+          <input type="file" id="dn-file" accept="application/json,.json" hidden />
+        </div>
+
+        <p class="dn-hint" id="dn-hint">
+          LMB place · RMB remove · MMB orbit · Scroll zoom · Shift+LMB skips place
+        </p>
+        <pre class="dn-stats" id="dn-stats">nodes: 0</pre>
+      </aside>
+      <canvas id="dn-canvas"></canvas>
+    </div>
+    <script type="module" src="./src/devnode/main.js"></script>
+  </body>
+</html>

docs/ADMIN_HUB_F1_F5_SSOT.md

@@ -0,0 +1,136 @@
+# Admin Hub F1–F4 · ] World — tools, editors, deployables
+
+**Code:** `src/ui/AdminHub.js` · `src/api/deployableContract.js` · `src/api/prefabDraftStore.js`  
+**Host:** casting.grudge.studio (lab control plane)  
+**Related:** `PREFAB_SCAFFOLD_CONTROL_SSOT.md` · `WEAPON_PREFAB_UUID_SSOT.md` · `GAME_ITEM_PREFAB_PRODUCTION_SSOT.md`
+
+---
+
+## Hotkeys
+
+| Key | Tab | Owns |
+|-----|-----|------|
+| **F1** | Player | Hero session, race kit, controller, equip shortcuts, Foundry/ID links |
+| **F2** | Assets | Buildables · harvestables · vehicles — **scripts + purpose** |
+| **F3** | Creatures | Enemy · ally · boss · NPC · vendor · Grudge race kits · AI brain |
+| **F4** | Prefabs | Weapons · armour · T0 scaffold · craft · export |
+| **]** | World | Stage notes · loot spawn · deploy surface map (**not F5**) |
+| **`** | — | Auto run / freeride sail-row (toggle) |
+| **Esc** | — | Close Admin Hub |
+| **?** / **H** | — | Keyboard help (not F1) |
+
+**F5 is unbound** (browser refresh elsewhere). Same admin key **toggles close** if that tab is already open. Top chips + TightBar **Admin** also open F4.
+
+---
+
+## Product intent
+
+Continue **tools, editors, and systems** for:
+
+1. **Prefab creation + saves** (local drafts → export JSON)
+2. **Buildable assets** — mesh + **script** + **purpose** (structure, camp, craft, storage, harvest node…)
+3. **Everything deployable** — weapons, armour, enemies, Grudge characters, vehicles, props
+
+Do **not** invent a second catalog. Read ObjectStore / info SSOT; mint UUIDs only via ObjectStore pipelines.
+
+---
+
+## Deployable kinds
+
+| Kind | Admin tab | Layers (have) | Jobs (do) |
+|------|-----------|---------------|-----------|
+| weapon | F4 | identity · stats · skills · assets · runtime · loadout | bag · equip · controller · hotbar · combat · craft · export |
+| armour | F4 | identity · stats · assets · runtime · slots | bag · mesh_ids · stats · export |
+| buildable | F2 | identity · **purpose** · **script** · assets · placement · runtime | place · snap · interact · use · save instance · export |
+| harvestable | F2 | + drops | spawn · E harvest · loot · export |
+| vehicle | F2 | + seats | spawn · mount · drive · export |
+| enemy / ally / npc | F3 | identity · kit · anims · ai · combat · assets · runtime | spawn · aggro/follow · skills · loot · export |
+| character_kit | F3 | race · mesh_ids · anims | load kit · equip · export |
+
+Contract API: `createDeployableDraft` · `validateDeployableDraft` · `exportDeployableSnapshot`.
+
+---
+
+## Create + save flow
+
+```
+Admin F2/F3/F4 → Create draft
+       ↓
+  localStorage  grudge.casting.deployableDrafts.v1
+       ↓
+  Export JSON  (deployable-*.json)
+       ↓
+  ObjectStore pipeline / R2 CDN  (real ITEM- / PREFAB- / NPC- uuids)
+       ↓
+  Fleet clients consume catalog
+```
+
+| Store | What |
+|-------|------|
+| **localStorage drafts** | Lab authoring only |
+| **Download JSON** | Handoff pack + validation |
+| **ObjectStore** | Catalog mint (`build:weapon-pipeline`, `generate:master`) |
+| **Railway** | Player instances (bag, equip) — never drafts |
+| **R2 CDN** | GLB / icons binaries only |
+
+---
+
+## Buildable purpose + script
+
+Purpose tags (`BUILDABLE_PURPOSES`): structure · camp · crafting · storage · defense · decoration · resource_node · spawn_pad · transport.
+
+Script stub (not eval’d):
+
+```js
+{
+  id, type, purpose,
+  onPlace, onInteract, onDestroy, tick?, stats?
+}
+```
+
+Interact routes by purpose (craft UI · depot · harvest swing · inspect).
+
+---
+
+## Creatures (F3)
+
+Each entry ties:
+
+- **Model** — grudge6 race GLB (`…/toon-rts-characters/glb/characters/{short}.glb`)
+- **Anims** — pack + roles (idle/walk/attack/death…)
+- **AI brain** — passive · guard · patrol · hunter · boss_phase · ally_follow · vendor_idle
+- **Role** — enemy · monster · boss · ally · commander · npc · vendor · training_dummy
+
+---
+
+## Prefabs (F4)
+
+- Load live T0 / equippable catalog
+- One-click **scaffold pack** (existing `buildItemScaffoldPack`)
+- New weapon/armour drafts
+- Link to Inventory **Prefabs** tab for full browser equip
+
+---
+
+## Agent rules
+
+1. Extend **this** hub + `deployableContract` — do not fork `AdminPanel2` / parallel F-keys.  
+2. Never mint GRUDGE UUIDs in the lab.  
+3. Buildables must declare **purpose + script**, not mesh-only.  
+4. Enemies use grudge6 kits + SI heights (human ~1.8 m).  
+5. Saves are local drafts until ObjectStore register.  
+6. Help stays on **?** — F1 is Player.
+
+---
+
+## Files
+
+| File | Role |
+|------|------|
+| `src/ui/AdminHub.js` | Panel UI |
+| `src/ui/adminHub.css` | Styles + top chips |
+| `src/api/deployableContract.js` | Kinds · layers · create · validate · export |
+| `src/api/prefabDraftStore.js` | localStorage CRUD · import/export |
+| `src/api/prefabScaffold.js` | Weapon scaffold (F4) |
+| `src/input/InputManager.js` | F1–F4 · ] World · ` auto · Esc |
+| `src/core/App.js` | Wire AdminHub |