hypertwist/website

HyperTwist Website

First-party hypertwist.app surface for HyperTwist:

• public homepage, about, resources, pricing, support, and legal pages
• browser-facing operator/account dashboard
• shared SuperTokens auth posture reused from the FamiliarOS and ScriptoriumAI website lane
• desktop download posture and desktop-link handshake endpoints
• server-backed release-manifest authority shared by public and protected download surfaces
• Paddle-ready pricing/check-out wiring
• dashboard-side launch-readiness surface for download, checkout, auth, and notice configuration
• public launch-status callouts across pricing, download, and notices surfaces
• route-aware metadata, canonical, Open Graph, Twitter-card, and protected-route noindex posture for the live hypertwist.app surface
• first-party robots.txt plus sitemap.xml for the public crawlable route set while keeping /app, /login, and /register out of crawler posture
• runtime diagnostics that distinguish local, mixed, and public auth deployment posture
• public open-source notices surface required by HyperTwist's MPL distribution doctrine

Why this app exists

HyperTwist already ships an embedded browser runtime inside Unreal under Content/Browser/. That runtime is not the same thing as a public website, checkout surface, or browser account shell.

This website/ directory is the dedicated public and operator-facing web surface for:

• marketing and product positioning
• account/authentication
• billing/pricing posture
• browser dashboard access
• desktop distribution
• public legal and open-source notices

Local development

cd /home/dev/src/HyperTwist/website
npm install
npm run dev

Frontend default URL:

• http://localhost:4273

Environment templates:

• local development: website/.env.example plus website/server/.env.example
• public deployment scaffold: website/.env.production.example plus website/server/.env.production.example

Validation

npm run type-check
npm run test
npm run build
npm run check:runtime-readiness -- --frontend-env .env --server-env server/.env --health-url https://hypertwist.app

Release-manifest authority

The website now treats GET /api/releases/manifest from website/server as the shared runtime authority for desktop release metadata.

• the public /download page reads live version, channel, build, size, checksum, and release-reference metadata from that manifest
• the public marketing page still keeps raw download URLs behind the protected dashboard even when a platform is configured
• the protected /app/downloads surface reads the same manifest but receives session-backed download URLs when the current user is actually entitled
• the protected dashboard launch-readiness panel and the public launch-status callouts now also use that manifest-backed Windows download truth instead of only static frontend config

Relevant server env keys now include:

• RELEASE_MANIFEST_VERSION
• RELEASE_MANIFEST_CHANNEL
• SUPPORT_EMAIL
• PUBLIC_DOCS_URL
• RELEASE_NOTES_URL
• MPL_SOURCE_URL
• OPEN_SOURCE_REPO_URL
• <PLATFORM>_DOWNLOAD_URL
• <PLATFORM>_RELEASE_VERSION
• <PLATFORM>_RELEASE_CHANNEL
• <PLATFORM>_RELEASE_BUILD_ID
• <PLATFORM>_RELEASE_PUBLISHED_AT
• <PLATFORM>_RELEASE_FILE_NAME
• <PLATFORM>_RELEASE_FILE_SIZE_BYTES
• <PLATFORM>_RELEASE_SHA256

Related surfaces

• frontend app: website/src/
• auth server: website/server/
• embedded Unreal browser runtime: Content/Browser/
• HyperTwist feature authority: docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md
• HyperTwist roadmap authority: docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md

Deployment note

Before public launch, configure:

• SuperTokens frontend/backend env vars
• production download URLs
• production Paddle checkout URLs
• the public corresponding-source URL for MPL-covered shipped material

Do not launch the public pricing/download pages without a valid open-source notices and corresponding-source destination.

Recommended production posture is documented in:

• docs/ops/HYPERTWIST_WEBSITE_RUNTIME_CONFIGURATION_GUIDE_2026-06-22.md

Use the runtime-readiness command before public launch or deployment approval:

• it fails if required public launch values are still missing
• it can optionally verify live /api/auth/health posture from the deployed site
• the auth server can now also serve the built website/dist bundle directly for same-origin hypertwist.app deployment when that build output is present
• it now warns when same-origin public deployment leaves static website serving mode ambiguous
• request-level server tests now also pin that same-origin shell behavior instead of relying only on helper-level assertions
• the public pricing/download/notices pages now also surface preview-versus-launch posture directly from the same bounded launch checklist
• the real check-runtime-readiness CLI is now also exercised against the checked-in .env.production.example files so placeholder launch scaffolds cannot silently drift away from the documented command

The repo bootstrap CI now also validates this lane through:

• frontend npm ci, npm run type-check, npm test, and npm run build
• auth-server npm ci, npm run type-check, and npm test

The focused frontend test coverage now also pins:

• route-guard redirect preservation for pathname, query, and hash deep links
• safe next-path normalization across custom auth pages and SuperTokens redirect handoff
• auth-bootstrap normalization when fallback/email sessions are re-hydrated
• login/register page continuation behavior and protected-dashboard download gating on the public download page
• platform-preserving /download -> /app/downloads?platform=... continuation plus requested-target surfacing inside the protected release lane
• support-topic fallback routing for pricing and launch-readiness actions when live checkout is not configured yet
• protected-route loading/redirect behavior plus auth-aware marketing/app shell actions
• real AppRouteTree smoke coverage for /, /pricing, /download, /login, /app, and /app/downloads
• top-level App bootstrap coverage for unknown-route redirect and SuperTokens wrapper on/off posture
• login/register unhappy-path coverage for returned form errors, auth-runtime warning callouts, and OAuth-button visibility/invocation
• dashboard launch-readiness plus desktop-link verify-url behavior
• route-aware metadata behavior for public versus protected surfaces plus richer download-lane guidance on both the public and protected release pages
• spawned website/server bootstrap proof from production-shaped same-origin env into live /health, /api/auth/health, static public/app shell delivery, verified webhook reflection into billing state, and bounded session-backed /api/auth/me plus /api/auth/desktop-link behavior under TEST_MODE=testing