@render-harness/ui 0.1.1 → 0.1.2

package/dist/index.d.ts

@@ -41,18 +41,18 @@ declare function wrapWithSession(upstream: AuthResolver, opts?: {
  *
  * The UI package owns the *browser-facing* surface only:
  *
- *   GET  /ui/                  serves the SPA shell (HTML)
- *   GET  /ui/assets/*          serves the SPA's static bundle (JS/CSS/etc.)
- *   GET  /ui/login             login form (HTML)
- *   POST /ui/login             validate API key, set session cookie, redirect
- *   POST /ui/logout            clear the session cookie
+ *   GET  <path>/               serves the SPA shell (HTML)
+ *   GET  <path>/assets/*       serves the SPA's static bundle (JS/CSS/etc.)
+ *   GET  <path>/login          login form (HTML)
+ *   POST <path>/login          validate API key, set session cookie, redirect
+ *   POST <path>/logout         clear the session cookie
  *
  * Every JSON+SSE endpoint the SPA talks to (`/runs`, `/runs/:id`,
  * `/runs/:id/tool-calls`, `/runs/:id/stream`, `/runs/:id/cancel`,
  * `/runs/:id/input`, `/agents`, `/usage`) is owned by `@render-harness/web`.
  * This package doesn't redefine any of them.
  *
- * The session cookie set by `/ui/login` is honoured by web's auth resolver
+ * The session cookie set by the login route is honoured by web's auth resolver
  * because `serveWeb({ ui: true })` wraps `auth()` with {@link wrapWithSession}.
  */
 

package/dist/index.js

@@ -69,7 +69,7 @@ var DEFAULT_STATIC_DIR = resolve(HERE, "..", "dist", "static");
 var FALLBACK_STATIC_DIR = resolve(HERE, "static");
 var SPA_INDEX = "index.html";
 function mountUi(opts) {
-  const path = (opts.path ?? "/ui").replace(/\/+$/, "");
+  const path = normalizeMountPath(opts.path ?? "/ui");
   const cookie = buildCookieConfig({
     ...opts.cookieName !== void 0 ? { cookieName: opts.cookieName } : {},
     ...opts.cookieSecret !== void 0 ? { secret: opts.cookieSecret } : {},
@@ -112,21 +112,27 @@ function mountUi(opts) {
     c.header("cache-control", "no-cache, must-revalidate");
     return c.html(html);
   };
-  opts.app.get(path, serveSpaShell);
+  const serveAsset = async (c, rel) => {
+    const buf = await readBundleAsset(staticDir, join("assets", rel));
+    if (!buf) return c.notFound();
+    const bytes = new Uint8Array(new ArrayBuffer(buf.byteLength));
+    bytes.set(buf);
+    return c.body(bytes, 200, {
+      "content-type": guessContentType(rel),
+      // Vite emits hash-named asset files; safe to cache aggressively.
+      "cache-control": "public, max-age=31536000, immutable"
+    });
+  };
+  if (path === "") {
+    opts.app.get("/assets/*", async (c) => serveAsset(c, c.req.path.replace(/^\/assets\//, "")));
+  }
+  opts.app.get(path || "/", serveSpaShell);
   opts.app.get(`${path}/`, serveSpaShell);
   opts.app.get(`${path}/*`, async (c, next) => {
     const sub = c.req.path.slice(path.length);
     if (sub.startsWith("/assets/")) {
       const rel = sub.replace(/^\/assets\//, "");
-      const buf = await readBundleAsset(staticDir, join("assets", rel));
-      if (!buf) return c.notFound();
-      const bytes = new Uint8Array(new ArrayBuffer(buf.byteLength));
-      bytes.set(buf);
-      return c.body(bytes, 200, {
-        "content-type": guessContentType(rel),
-        // Vite emits hash-named asset files; safe to cache aggressively.
-        "cache-control": "public, max-age=31536000, immutable"
-      });
+      return serveAsset(c, rel);
     }
     if (sub === "/login" || sub.startsWith("/login?")) {
       return next();
@@ -134,6 +140,11 @@ function mountUi(opts) {
     return serveSpaShell(c);
   });
 }
+function normalizeMountPath(raw) {
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed === "" ? "" : trimmed;
+}
 async function readBundleHtml(staticDir, relPath) {
   const buf = await readBundleBytes(staticDir, relPath);
   return buf ? buf.toString("utf8") : null;
@@ -179,12 +190,12 @@ var INLINE_THEME_CSS = `
 :root {
   color-scheme: light dark;
   --bg: #fff; --fg: #000; --muted: #555; --line: #000;
-  --accent: #d97706; --err: #b40000;
+  --accent: #a855f7; --err: #b40000;
 }
 @media (prefers-color-scheme: dark) {
   :root {
-    --bg: #000; --fg: #fff; --muted: #999; --line: #fff;
-    --accent: #fbbf24; --err: #ff5555;
+    --bg: #000; --fg: #fff; --muted: #8a8a8a; --line: #2a2a2a;
+    --accent: #c084fc; --err: #ff5555;
   }
 }
 * { box-sizing: border-box; border-radius: 0 !important; }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts","../src/server.ts"],"names":[],"mappings":";;;;;;AAoCA,IAAM,mBAAA,GAAsB,eAAA;AAC5B,IAAM,uBAAA,GAA0B,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA;AAEvC,SAAS,kBAAkB,IAAA,EAKV;AACtB,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,gBAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,SAAA,IAAa,uBAAA,EAAwB;AACnE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AACvC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,KAAK,UAAA,IAAc,mBAAA;AAAA,IAC/B,MAAA;AAAA,IACA,MAAA,EAAQ,KAAK,MAAA,IAAU,uBAAA;AAAA,IACvB,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,CAAC;AAAA,GAC1B;AACF;AAWA,eAAsB,iBAAA,CACpB,KACA,GAAA,EACwB;AACxB,EAAA,MAAM,OAAO,EAAE,GAAA,EAAK,EAAE,GAAA,EAAK,KAAI,EAAE;AACjC,EAAA,MAAM,QAAQ,MAAM,eAAA,CAAgB,MAAM,GAAA,CAAI,MAAA,EAAQ,IAAI,UAAU,CAAA;AACpE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,GAAS,IAAI,KAAA,GAAQ,IAAA;AACjE;AAuBO,SAAS,eAAA,CACd,QAAA,EACA,IAAA,GAKI,EAAC,EACS;AACd,EAAA,MAAM,MAAM,iBAAA,CAAkB;AAAA,IAC5B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC,GACxE,CAAA;AACD,EAAA,OAAO,OAAO,GAAA,KAAiB;AAC7B,IAAA,MAAM,UAAA,GAAa,MAAM,iBAAA,CAAkB,GAAA,EAAK,GAAG,CAAA;AACnD,IAAA,IAAI,YAAY,OAAO,UAAA;AACvB,IAAA,OAAO,SAAS,GAAG,CAAA;AAAA,EACrB,CAAA;AACF;AAMA,eAAsB,YAAA,CACpB,CAAA,EACA,GAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,gBAAgB,CAAA,EAAG,GAAA,CAAI,UAAA,EAAY,MAAA,EAAQ,IAAI,MAAA,EAAQ;AAAA,IAC3D,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA,IACV,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,QAAQ,GAAA,CAAI;AAAA,GACb,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,GAAY,GAAA,EAAgC;AACvE,EAAA,YAAA,CAAa,GAAG,GAAA,CAAI,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AAC/C;AAOO,SAAS,qBAAqB,MAAA,EAAyB;AAC5D,EAAA,OAAO,IAAI,QAAQ,gCAAA,EAAkC;AAAA,IACnD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AAAG,GAC9C,CAAA;AACH;AAEA,SAAS,uBAAA,GAAkC;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AACvC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,IAAK,CAAA;AACtB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AC9FA,IAAM,IAAA,GAAO,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAGnD,IAAM,kBAAA,GAAqB,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM,QAAQ,QAAQ,CAAA;AAC/D,IAAM,mBAAA,GAAsB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA;AAElD,IAAM,SAAA,GAAY,YAAA;AAEX,SAAS,QAAQ,IAAA,EAAyB;AAC/C,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,IAAQ,KAAA,EAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACpD,EAAA,MAAM,SAAS,iBAAA,CAAkB;AAAA,IAC/B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC,GACxE,CAAA;AAED,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,kBAAA;AAGpC,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA;AAAA,IAAI,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,IAAU,CAAC,CAAA,KAC7B,CAAA,CAAE,IAAA,CAAK,eAAA,CAAgB,EAAE,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,CAAA,IAAK,IAAA,EAAM,CAAC;AAAA,GAC/E;AAEA,EAAA,IAAA,CAAK,IAAI,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAU,OAAO,CAAA,KAAM;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,UAAS,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAM,GAAA,CAAI,QAAQ,MAAM,QAAA,GAAY,IAAA,EAAM,GAAA,CAAI,QAAQ,CAAA,GAAe,EAAA;AAC3F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,wBAAwB,GAAG,CAAA;AAAA,IACtD;AACA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAC,CAAA;AAC3D,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,wBAAwB,GAAG,CAAA;AAAA,IACtD;AACA,IAAA,MAAM,YAAA,CAAa,CAAA,EAAG,MAAA,EAAQ,MAAM,CAAA;AACpC,IAAA,MAAM,OAAO,CAAA,CAAE,GAAA,CAAI,MAAM,MAAM,CAAA,IAAK,GAAG,IAAI,CAAA,CAAA,CAAA;AAC3C,IAAA,OAAO,EAAE,QAAA,CAAS,YAAA,CAAa,IAAA,EAAM,IAAI,GAAG,GAAG,CAAA;AAAA,EACjD,CAAC,CAAA;AAED,EAAA,IAAA,CAAK,IAAI,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,CAAC,CAAA,KAAM;AACrC,IAAA,YAAA,CAAa,GAAG,MAAM,CAAA;AACtB,IAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,GAAG,CAAA;AAAA,EACxC,CAAC,CAAA;AAID,EAAA,MAAM,aAAA,GAAgB,OAAO,CAAA,KAAe;AAC1C,IAAA,MAAM,SAAS,MAAM,iBAAA,CAAkB,CAAA,CAAE,GAAA,CAAI,KAAK,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC1C,MAAA,OAAO,EAAE,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,IAAI,IAAI,GAAG,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,SAAA,EAAW,SAAS,CAAA;AACtD,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,OAAO,CAAA,CAAE,KAAK,sBAAA,CAAuB,EAAE,QAAQ,IAAA,EAAM,GAAG,GAAG,CAAA;AAAA,IAC7D;AAKA,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,2BAA2B,CAAA;AACrD,IAAA,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACpB,CAAA;AAEA,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,aAAa,CAAA;AAChC,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,IAAI,KAAK,aAAa,CAAA;AACtC,EAAA,IAAA,CAAK,IAAI,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,EAAA,CAAA,EAAM,OAAO,GAAG,IAAA,KAAS;AAC3C,IAAA,MAAM,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AACxC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9B,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AACzC,MAAA,MAAM,MAAM,MAAM,eAAA,CAAgB,WAAW,IAAA,CAAK,QAAA,EAAU,GAAG,CAAC,CAAA;AAChE,MAAA,IAAI,CAAC,GAAA,EAAK,OAAO,CAAA,CAAE,QAAA,EAAS;AAI5B,MAAA,MAAM,QAAQ,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAC5D,MAAA,KAAA,CAAM,IAAI,GAAG,CAAA;AACb,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK;AAAA,QACxB,cAAA,EAAgB,iBAAiB,GAAG,CAAA;AAAA;AAAA,QAEpC,eAAA,EAAiB;AAAA,OAClB,CAAA;AAAA,IACH;AACA,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,OAAO,cAAc,CAAC,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAMA,eAAe,cAAA,CAAe,WAAmB,OAAA,EAAyC;AACxF,EAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,SAAA,EAAW,OAAO,CAAA;AACpD,EAAA,OAAO,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,GAAI,IAAA;AACtC;AAEA,eAAe,eAAA,CAAgB,WAAmB,OAAA,EAAyC;AACzF,EAAA,OAAO,eAAA,CAAgB,WAAW,OAAO,CAAA;AAC3C;AAEA,eAAe,eAAA,CAAgB,WAAmB,OAAA,EAAyC;AACzF,EAAA,MAAM,UAAA,GAAa,CAAC,SAAA,EAAW,mBAAmB,CAAA;AAClD,EAAA,KAAA,MAAW,OAAO,UAAA,EAAY;AAC5B,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA;AACzB,MAAA,IAAI,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG;AACjB,MAAA,OAAO,MAAM,SAAS,IAAI,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,QAAA,CAAS,MAAc,GAAA,EAA4B;AAC1D,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,GAAG,CAAC,CAAA;AAC1C,EAAA,MAAM,YAAA,GAAe,GAAG,SAAA,CAAU,IAAI,CAAC,CAAA,CAAA,CAAA,CAAI,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAC9D,EAAA,OAAO,QAAA,CAAS,WAAW,YAAY,CAAA,IAAK,aAAa,SAAA,CAAU,IAAI,IAAI,QAAA,GAAW,IAAA;AACxF;AAEA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI,GAAA,CAAI,SAAS,KAAK,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,GAAG,OAAO,uCAAA;AACxD,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,yBAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,eAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,WAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA;AACnC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,iCAAA;AAClC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,iCAAA;AACjC,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,YAAA,CAAa,MAAc,MAAA,EAAwB;AAG1D,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,GAAG,MAAM,CAAA,CAAA,CAAA;AAC3C,EAAA,IAAI,KAAK,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,GAAG,MAAM,CAAA,CAAA,CAAA;AAC3C,EAAA,OAAO,IAAA;AACT;AAaA,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgEzB,SAAS,gBAAgB,IAAA,EAAwD;AAC/E,EAAA,MAAM,SAAA,GACJ,KAAK,KAAA,KAAU,SAAA,GACX,0CACA,IAAA,CAAK,KAAA,KAAU,YACb,gFAAA,GACA,EAAA;AACR,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAA,EAOD,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qDAAA,EA2B+B,UAAA,CAAW,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAAA,EAcpE,SAAS;AAAA;AAAA;AAAA;AAAA,OAAA,CAAA;AAKnB;AAEA,SAAS,uBAAuB,IAAA,EAAkC;AAChE,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAA,EAMD,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4CAAA,EAasB,UAAA,CAAW,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA,OAAA,CAAA;AAKrE;AAEA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,CAAC,EAAA,KAAO;AACnC,IAAA,QAAQ,EAAA;AAAI,MACV,KAAK,GAAA;AACH,QAAA,OAAO,OAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,MAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,MAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,QAAA;AAAA,MACT;AACE,QAAA,OAAO,OAAA;AAAA;AACX,EACF,CAAC,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * Cookie-session helpers for the operator UI.\n *\n * `@render-harness/web` accepts a `Bearer <api-key>` header and resolves\n * it to a `UserId`. A browser UI needs the same identity but without\n * making the user paste the bearer on every request, so we layer a signed\n * cookie on top:\n *\n *   1. Browser visits `<ui>/login`, posts the API key.\n *   2. We call the existing auth resolver with a synthetic\n *      `Authorization: Bearer ...` request to validate the key.\n *   3. On success we set a signed cookie carrying the resolved `userId`.\n *   4. {@link wrapWithSession} is plugged into `serveWeb` so all routes\n *      accept either the cookie OR the original bearer header. curl-based\n *      ops still work; browsers stay logged in.\n *\n * The signing secret comes from `UI_COOKIE_SECRET` (env). If unset we\n * generate a random per-process secret and warn — fine for local dev,\n * means cookies don't survive a restart.\n */\n\nimport type { UserId } from \"@render-harness/core\";\nimport type { Context } from \"hono\";\nimport { deleteCookie, getSignedCookie, setSignedCookie } from \"hono/cookie\";\n\nexport type AuthResolver = (req: Request) => Promise<UserId | null>;\n\nexport interface CookieSessionConfig {\n  cookieName: string;\n  secret: string;\n  /** Lifetime in seconds. Default: 7 days. */\n  maxAge: number;\n  /** Set Secure flag on the cookie. Default: true outside dev. */\n  secure: boolean;\n}\n\nconst DEFAULT_COOKIE_NAME = \"rh_ui_session\";\nconst DEFAULT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\n\nexport function buildCookieConfig(opts: {\n  cookieName?: string;\n  secret?: string;\n  maxAge?: number;\n  secure?: boolean;\n}): CookieSessionConfig {\n  const envSecret = process.env.UI_COOKIE_SECRET;\n  const secret = opts.secret ?? envSecret ?? generateEphemeralSecret();\n  const isDev = process.env.NODE_ENV !== \"production\";\n  return {\n    cookieName: opts.cookieName ?? DEFAULT_COOKIE_NAME,\n    secret,\n    maxAge: opts.maxAge ?? DEFAULT_MAX_AGE_SECONDS,\n    secure: opts.secure ?? !isDev,\n  };\n}\n\n/**\n * Read the signed session cookie from a `Request`, returning the userId\n * encoded in it or `null` if the cookie is missing/invalid.\n *\n * Hono's cookie helpers want a {@link Context}, but they only ever read\n * `c.req.raw.headers.get(\"Cookie\")` under the hood — so we pass a minimal\n * shim. Keeps verification in Hono's well-tested code without taking on\n * an internal dependency.\n */\nexport async function readSessionCookie(\n  req: Request,\n  cfg: CookieSessionConfig,\n): Promise<UserId | null> {\n  const shim = { req: { raw: req } } as unknown as Context;\n  const value = await getSignedCookie(shim, cfg.secret, cfg.cookieName);\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n/**\n * Resolve the request to a `UserId`, accepting either the cookie session\n * or a bearer header. Returns `null` if neither validates. Used inside\n * `/ui/*` handlers where we already have the Hono Context.\n */\nexport async function resolveSession(\n  c: Context,\n  cfg: CookieSessionConfig,\n  upstreamAuth: AuthResolver,\n): Promise<UserId | null> {\n  const fromCookie = await readSessionCookie(c.req.raw, cfg);\n  if (fromCookie) return fromCookie;\n  return upstreamAuth(c.req.raw);\n}\n\n/**\n * Wrap an existing `(Request) => Promise<UserId | null>` resolver so it\n * also accepts the signed UI session cookie. The web service plugs the\n * wrapped resolver into all of its routes when `serveWeb({ ui: true })`,\n * so JSON+SSE callers can use either bearer or cookie.\n */\nexport function wrapWithSession(\n  upstream: AuthResolver,\n  opts: {\n    cookieSecret?: string;\n    cookieName?: string;\n    cookieMaxAge?: number;\n    cookieSecure?: boolean;\n  } = {},\n): AuthResolver {\n  const cfg = buildCookieConfig({\n    ...(opts.cookieName !== undefined ? { cookieName: opts.cookieName } : {}),\n    ...(opts.cookieSecret !== undefined ? { secret: opts.cookieSecret } : {}),\n    ...(opts.cookieMaxAge !== undefined ? { maxAge: opts.cookieMaxAge } : {}),\n    ...(opts.cookieSecure !== undefined ? { secure: opts.cookieSecure } : {}),\n  });\n  return async (req: Request) => {\n    const fromCookie = await readSessionCookie(req, cfg);\n    if (fromCookie) return fromCookie;\n    return upstream(req);\n  };\n}\n\n/**\n * Mint a signed session cookie for the given `userId`. Caller is expected\n * to have already validated the user.\n */\nexport async function issueSession(\n  c: Context,\n  cfg: CookieSessionConfig,\n  userId: UserId,\n): Promise<void> {\n  await setSignedCookie(c, cfg.cookieName, userId, cfg.secret, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"Lax\",\n    secure: cfg.secure,\n    maxAge: cfg.maxAge,\n  });\n}\n\nexport function clearSession(c: Context, cfg: CookieSessionConfig): void {\n  deleteCookie(c, cfg.cookieName, { path: \"/\" });\n}\n\n/**\n * Forge a `Request` carrying `Authorization: Bearer <apiKey>` so we can\n * reuse the upstream resolver (which only knows how to read headers) for\n * the login form path.\n */\nexport function authRequestForBearer(apiKey: string): Request {\n  return new Request(\"https://internal.invalid/login\", {\n    headers: { authorization: `Bearer ${apiKey}` },\n  });\n}\n\nfunction generateEphemeralSecret(): string {\n  const bytes = new Uint8Array(32);\n  globalThis.crypto.getRandomValues(bytes);\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    const b = bytes[i] ?? 0;\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","/**\n * `mountUi(opts)` — attach the operator UI to an existing Hono app.\n *\n * The UI package owns the *browser-facing* surface only:\n *\n *   GET  /ui/                  serves the SPA shell (HTML)\n *   GET  /ui/assets/*          serves the SPA's static bundle (JS/CSS/etc.)\n *   GET  /ui/login             login form (HTML)\n *   POST /ui/login             validate API key, set session cookie, redirect\n *   POST /ui/logout            clear the session cookie\n *\n * Every JSON+SSE endpoint the SPA talks to (`/runs`, `/runs/:id`,\n * `/runs/:id/tool-calls`, `/runs/:id/stream`, `/runs/:id/cancel`,\n * `/runs/:id/input`, `/agents`, `/usage`) is owned by `@render-harness/web`.\n * This package doesn't redefine any of them.\n *\n * The session cookie set by `/ui/login` is honoured by web's auth resolver\n * because `serveWeb({ ui: true })` wraps `auth()` with {@link wrapWithSession}.\n */\n\nimport { readFile, stat } from \"node:fs/promises\";\nimport { dirname, join, normalize, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { Context, Hono } from \"hono\";\nimport {\n  type AuthResolver,\n  authRequestForBearer,\n  buildCookieConfig,\n  clearSession,\n  issueSession,\n  readSessionCookie,\n} from \"./auth.js\";\n\nexport type { AuthResolver } from \"./auth.js\";\nexport { wrapWithSession } from \"./auth.js\";\n\nexport interface MountUiOpts {\n  /** Hono app the harness web service already built. */\n  app: Hono;\n  /**\n   * Auth resolver from the parent. Used as the upstream check for the\n   * login form; web's main `auth` already accepts the session cookie via\n   * `wrapWithSession`, so we don't re-implement that here.\n   */\n  auth: AuthResolver;\n  /** Mount path. Defaults to \"/ui\". */\n  path?: string;\n  /**\n   * Cookie session secret. Falls back to `UI_COOKIE_SECRET` env, then to a\n   * per-process random value (won't survive a restart — fine for dev).\n   */\n  cookieSecret?: string;\n  /** Cookie name. Defaults to \"rh_ui_session\". */\n  cookieName?: string;\n  /** Cookie max age in seconds. Defaults to 7 days. */\n  cookieMaxAge?: number;\n  /** Force the Secure cookie flag. Defaults: true in production, false otherwise. */\n  cookieSecure?: boolean;\n  /**\n   * Override the directory we serve the SPA bundle from. Defaults to the\n   * `dist/static` shipped alongside this package's compiled JS.\n   */\n  staticDir?: string;\n}\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\n// dist/index.js → dist/static. In dev (src/server.ts → src/../dist/static)\n// we still resolve up one level; we ship a built copy with the package.\nconst DEFAULT_STATIC_DIR = resolve(HERE, \"..\", \"dist\", \"static\");\nconst FALLBACK_STATIC_DIR = resolve(HERE, \"static\");\n\nconst SPA_INDEX = \"index.html\";\n\nexport function mountUi(opts: MountUiOpts): void {\n  const path = (opts.path ?? \"/ui\").replace(/\\/+$/, \"\");\n  const cookie = buildCookieConfig({\n    ...(opts.cookieName !== undefined ? { cookieName: opts.cookieName } : {}),\n    ...(opts.cookieSecret !== undefined ? { secret: opts.cookieSecret } : {}),\n    ...(opts.cookieMaxAge !== undefined ? { maxAge: opts.cookieMaxAge } : {}),\n    ...(opts.cookieSecure !== undefined ? { secure: opts.cookieSecure } : {}),\n  });\n\n  const staticDir = opts.staticDir ?? DEFAULT_STATIC_DIR;\n\n  // Login / logout\n  opts.app.get(`${path}/login`, (c) =>\n    c.html(renderLoginPage({ uiPath: path, error: c.req.query(\"error\") ?? null })),\n  );\n\n  opts.app.post(`${path}/login`, async (c) => {\n    const form = await c.req.formData().catch(() => null);\n    const apiKey = typeof form?.get(\"apiKey\") === \"string\" ? (form?.get(\"apiKey\") as string) : \"\";\n    if (!apiKey) {\n      return c.redirect(`${path}/login?error=missing`, 303);\n    }\n    const userId = await opts.auth(authRequestForBearer(apiKey));\n    if (!userId) {\n      return c.redirect(`${path}/login?error=invalid`, 303);\n    }\n    await issueSession(c, cookie, userId);\n    const next = c.req.query(\"next\") ?? `${path}/`;\n    return c.redirect(safeNextPath(next, path), 303);\n  });\n\n  opts.app.post(`${path}/logout`, (c) => {\n    clearSession(c, cookie);\n    return c.redirect(`${path}/login`, 303);\n  });\n\n  // SPA shell + assets. The shell itself is gated by the cookie session;\n  // assets are not (they're cacheable static files).\n  const serveSpaShell = async (c: Context) => {\n    const userId = await readSessionCookie(c.req.raw, cookie);\n    if (!userId) {\n      const next = encodeURIComponent(c.req.path);\n      return c.redirect(`${path}/login?next=${next}`, 303);\n    }\n    const html = await readBundleHtml(staticDir, SPA_INDEX);\n    if (html === null) {\n      return c.html(renderBuildMissingPage({ uiPath: path }), 503);\n    }\n    // The SPA shell is tiny and references hash-named asset bundles. We\n    // don't want stale cached HTML pointing at deleted asset hashes, so\n    // browsers must revalidate every load. Asset files (under\n    // /ui/assets/*) are content-addressed and stay cacheable.\n    c.header(\"cache-control\", \"no-cache, must-revalidate\");\n    return c.html(html);\n  };\n\n  opts.app.get(path, serveSpaShell);\n  opts.app.get(`${path}/`, serveSpaShell);\n  opts.app.get(`${path}/*`, async (c, next) => {\n    const sub = c.req.path.slice(path.length);\n    if (sub.startsWith(\"/assets/\")) {\n      const rel = sub.replace(/^\\/assets\\//, \"\");\n      const buf = await readBundleAsset(staticDir, join(\"assets\", rel));\n      if (!buf) return c.notFound();\n      // Hono's typed body() wants `Uint8Array<ArrayBuffer>`, not Node's\n      // `Buffer<ArrayBufferLike>`. Copy into a fresh ArrayBuffer-backed\n      // view so the type matches without resorting to `any`.\n      const bytes = new Uint8Array(new ArrayBuffer(buf.byteLength));\n      bytes.set(buf);\n      return c.body(bytes, 200, {\n        \"content-type\": guessContentType(rel),\n        // Vite emits hash-named asset files; safe to cache aggressively.\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      });\n    }\n    if (sub === \"/login\" || sub.startsWith(\"/login?\")) {\n      return next();\n    }\n    return serveSpaShell(c);\n  });\n}\n\n// --------------------------------------------------------------------\n// Static file helpers\n// --------------------------------------------------------------------\n\nasync function readBundleHtml(staticDir: string, relPath: string): Promise<string | null> {\n  const buf = await readBundleBytes(staticDir, relPath);\n  return buf ? buf.toString(\"utf8\") : null;\n}\n\nasync function readBundleAsset(staticDir: string, relPath: string): Promise<Buffer | null> {\n  return readBundleBytes(staticDir, relPath);\n}\n\nasync function readBundleBytes(staticDir: string, relPath: string): Promise<Buffer | null> {\n  const candidates = [staticDir, FALLBACK_STATIC_DIR];\n  for (const dir of candidates) {\n    const safe = safeJoin(dir, relPath);\n    if (!safe) continue;\n    try {\n      const s = await stat(safe);\n      if (!s.isFile()) continue;\n      return await readFile(safe);\n    } catch {\n      // try the next candidate directory\n    }\n  }\n  return null;\n}\n\nfunction safeJoin(root: string, rel: string): string | null {\n  const resolved = normalize(join(root, rel));\n  const rootResolved = `${normalize(root)}/`.replace(/\\/+$/, \"/\");\n  return resolved.startsWith(rootResolved) || resolved === normalize(root) ? resolved : null;\n}\n\nfunction guessContentType(rel: string): string {\n  if (rel.endsWith(\".js\") || rel.endsWith(\".mjs\")) return \"application/javascript; charset=utf-8\";\n  if (rel.endsWith(\".css\")) return \"text/css; charset=utf-8\";\n  if (rel.endsWith(\".svg\")) return \"image/svg+xml\";\n  if (rel.endsWith(\".png\")) return \"image/png\";\n  if (rel.endsWith(\".woff2\")) return \"font/woff2\";\n  if (rel.endsWith(\".json\")) return \"application/json; charset=utf-8\";\n  if (rel.endsWith(\".map\")) return \"application/json; charset=utf-8\";\n  return \"application/octet-stream\";\n}\n\nfunction safeNextPath(next: string, uiPath: string): string {\n  // Only allow same-origin redirects under the UI path prefix to avoid\n  // open-redirects via the `next` query param.\n  if (!next.startsWith(\"/\")) return `${uiPath}/`;\n  if (next.startsWith(\"//\")) return `${uiPath}/`;\n  return next;\n}\n\n// --------------------------------------------------------------------\n// Inline HTML helpers (login + the \"build missing\" fallback)\n// --------------------------------------------------------------------\n\n// Brutalist black-and-white CSS shared by the inline pages we render\n// outside the SPA bundle (login form, \"build missing\" fallback). Kept\n// here so server-only routes don't depend on the Tailwind output.\n//\n// Single accent: amber. Used for active states, focus, selection, and\n// the blinking input caret. Same palette as the SPA so the visual\n// transition into the dashboard is seamless.\nconst INLINE_THEME_CSS = `\n:root {\n  color-scheme: light dark;\n  --bg: #fff; --fg: #000; --muted: #555; --line: #000;\n  --accent: #d97706; --err: #b40000;\n}\n@media (prefers-color-scheme: dark) {\n  :root {\n    --bg: #000; --fg: #fff; --muted: #999; --line: #fff;\n    --accent: #fbbf24; --err: #ff5555;\n  }\n}\n* { box-sizing: border-box; border-radius: 0 !important; }\nhtml, body { height: 100%; }\nbody {\n  margin: 0; background: var(--bg); color: var(--fg);\n  font: 14px/1.45 ui-monospace, \"JetBrains Mono\", \"IBM Plex Mono\", \"SF Mono\", Menlo, Consolas, monospace;\n  -webkit-font-smoothing: antialiased;\n}\n::selection { background: var(--accent); color: var(--bg); }\n.label {\n  text-transform: uppercase; letter-spacing: 0.08em;\n  font-size: 0.72rem; color: var(--muted);\n}\n.panel { border: 1px solid var(--line); background: var(--bg); }\n.hr-section {\n  display: flex; align-items: center; gap: 0.6rem;\n  text-transform: uppercase; letter-spacing: 0.1em;\n  font-size: 0.72rem; color: var(--muted);\n  margin: 0 0 1rem;\n}\n.hr-section::after {\n  content: \"\"; flex: 1; border-top: 1px solid var(--line);\n}\n.btn {\n  display: inline-flex; align-items: center; justify-content: center;\n  width: 100%; padding: 0.6rem 0.7rem; border: 1px solid var(--accent);\n  background: var(--accent); color: var(--bg); cursor: pointer;\n  font: inherit; text-transform: uppercase; letter-spacing: 0.06em; font-size: 0.78rem;\n}\n.btn:hover { background: var(--bg); color: var(--accent); }\ninput {\n  width: 100%; padding: 0.55rem 0.65rem; font: inherit; color: inherit;\n  background: var(--bg); border: 1px solid var(--line);\n  caret-color: var(--accent);\n}\ninput:focus-visible {\n  outline: 1px solid var(--accent); outline-offset: 0;\n  border-color: var(--accent);\n  animation: rh-caret-blink 1.06s steps(2, jump-none) infinite;\n}\n@keyframes rh-caret-blink {\n  0%, 50% { caret-color: var(--accent); }\n  51%, 100% { caret-color: transparent; }\n}\n.blink { animation: rh-block-blink 1.06s steps(2, jump-none) infinite; }\n@keyframes rh-block-blink {\n  0%, 50% { opacity: 1; }\n  51%, 100% { opacity: 0; }\n}\n.cursor { color: var(--accent); }\ncode { font-family: inherit; }\n`;\n\nfunction renderLoginPage(args: { uiPath: string; error: string | null }): string {\n  const errorHtml =\n    args.error === \"invalid\"\n      ? '<p class=\"err\">// invalid api key</p>'\n      : args.error === \"missing\"\n        ? '<p class=\"err\">// enter the api key configured as <code>WEB_API_KEY</code></p>'\n        : \"\";\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>render-harness / operator / sign-in</title>\n    <style>\n      ${INLINE_THEME_CSS}\n      main { min-height: 100vh; display: grid; place-items: center; padding: 2rem 1rem; }\n      .card { width: min(440px, 100%); padding: 1.75rem; }\n      .card h1 {\n        margin: 0; font-size: 0.85rem; text-transform: uppercase;\n        letter-spacing: 0.1em;\n      }\n      .card h1 .muted { color: var(--muted); }\n      .card .sub {\n        margin: 0.25rem 0 1.5rem; color: var(--muted);\n        font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.08em;\n      }\n      .card p.help { margin: 0 0 1.25rem; color: var(--muted); font-size: 0.78rem; }\n      .field { margin-bottom: 0.9rem; }\n      .field label { display: block; margin-bottom: 0.35rem; }\n      .prompt {\n        display: flex; align-items: stretch; gap: 0.5rem;\n      }\n      .prompt .gutter {\n        display: flex; align-items: center;\n        color: var(--accent); font-size: 0.85rem;\n      }\n      .err { margin: 0.6rem 0 0; color: var(--err); font-size: 0.78rem; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <form class=\"panel card\" method=\"post\" action=\"${escapeHtml(args.uiPath)}/login\">\n        <h1>\n          <span class=\"muted\">render-harness</span> / operator<span class=\"cursor blink\" aria-hidden=\"true\">▊</span>\n        </h1>\n        <p class=\"sub\">/sign-in</p>\n        <p class=\"help\">// enter the api key configured for this service (<code>WEB_API_KEY</code>)</p>\n        <div class=\"field\">\n          <label class=\"label\" for=\"apiKey\">api key</label>\n          <div class=\"prompt\">\n            <span class=\"gutter\" aria-hidden=\"true\">$</span>\n            <input id=\"apiKey\" name=\"apiKey\" type=\"password\" autocomplete=\"current-password\" required autofocus />\n          </div>\n        </div>\n        <button class=\"btn\" type=\"submit\">[ continue ]</button>\n        ${errorHtml}\n      </form>\n    </main>\n  </body>\n</html>`;\n}\n\nfunction renderBuildMissingPage(args: { uiPath: string }): string {\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <title>render-harness / operator / build-missing</title>\n    <style>\n      ${INLINE_THEME_CSS}\n      main { max-width: 60ch; margin: 4rem auto; padding: 0 1.5rem; }\n      h1 { font-size: 0.95rem; text-transform: uppercase; letter-spacing: 0.08em; margin: 0 0 1rem; }\n      .box { padding: 1rem; }\n      code { padding: 0.05rem 0.3rem; border: 1px solid var(--line); }\n    </style>\n  </head>\n  <body>\n    <main>\n      <h1>// operator ui bundle missing</h1>\n      <div class=\"panel box\">\n        <p>The SPA bundle for <code>@render-harness/ui</code> hasn't been built. Run</p>\n        <p><code>pnpm --filter @render-harness/ui build</code></p>\n        <p>to compile it, then reload <code>${escapeHtml(args.uiPath)}/</code>.</p>\n      </div>\n    </main>\n  </body>\n</html>`;\n}\n\nfunction escapeHtml(s: string): string {\n  return s.replace(/[&<>\"']/g, (ch) => {\n    switch (ch) {\n      case \"&\":\n        return \"&amp;\";\n      case \"<\":\n        return \"&lt;\";\n      case \">\":\n        return \"&gt;\";\n      case '\"':\n        return \"&quot;\";\n      default:\n        return \"&#39;\";\n    }\n  });\n}\n"]}
+{"version":3,"sources":["../src/auth.ts","../src/server.ts"],"names":[],"mappings":";;;;;;AAoCA,IAAM,mBAAA,GAAsB,eAAA;AAC5B,IAAM,uBAAA,GAA0B,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA;AAEvC,SAAS,kBAAkB,IAAA,EAKV;AACtB,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,gBAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,SAAA,IAAa,uBAAA,EAAwB;AACnE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AACvC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,KAAK,UAAA,IAAc,mBAAA;AAAA,IAC/B,MAAA;AAAA,IACA,MAAA,EAAQ,KAAK,MAAA,IAAU,uBAAA;AAAA,IACvB,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,CAAC;AAAA,GAC1B;AACF;AAWA,eAAsB,iBAAA,CACpB,KACA,GAAA,EACwB;AACxB,EAAA,MAAM,OAAO,EAAE,GAAA,EAAK,EAAE,GAAA,EAAK,KAAI,EAAE;AACjC,EAAA,MAAM,QAAQ,MAAM,eAAA,CAAgB,MAAM,GAAA,CAAI,MAAA,EAAQ,IAAI,UAAU,CAAA;AACpE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,GAAS,IAAI,KAAA,GAAQ,IAAA;AACjE;AAuBO,SAAS,eAAA,CACd,QAAA,EACA,IAAA,GAKI,EAAC,EACS;AACd,EAAA,MAAM,MAAM,iBAAA,CAAkB;AAAA,IAC5B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC,GACxE,CAAA;AACD,EAAA,OAAO,OAAO,GAAA,KAAiB;AAC7B,IAAA,MAAM,UAAA,GAAa,MAAM,iBAAA,CAAkB,GAAA,EAAK,GAAG,CAAA;AACnD,IAAA,IAAI,YAAY,OAAO,UAAA;AACvB,IAAA,OAAO,SAAS,GAAG,CAAA;AAAA,EACrB,CAAA;AACF;AAMA,eAAsB,YAAA,CACpB,CAAA,EACA,GAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,gBAAgB,CAAA,EAAG,GAAA,CAAI,UAAA,EAAY,MAAA,EAAQ,IAAI,MAAA,EAAQ;AAAA,IAC3D,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA,IACV,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,QAAQ,GAAA,CAAI;AAAA,GACb,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,GAAY,GAAA,EAAgC;AACvE,EAAA,YAAA,CAAa,GAAG,GAAA,CAAI,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AAC/C;AAOO,SAAS,qBAAqB,MAAA,EAAyB;AAC5D,EAAA,OAAO,IAAI,QAAQ,gCAAA,EAAkC;AAAA,IACnD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AAAG,GAC9C,CAAA;AACH;AAEA,SAAS,uBAAA,GAAkC;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AACvC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,IAAK,CAAA;AACtB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AC9FA,IAAM,IAAA,GAAO,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAGnD,IAAM,kBAAA,GAAqB,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM,QAAQ,QAAQ,CAAA;AAC/D,IAAM,mBAAA,GAAsB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA;AAElD,IAAM,SAAA,GAAY,YAAA;AAEX,SAAS,QAAQ,IAAA,EAAyB;AAC/C,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,IAAA,CAAK,IAAA,IAAQ,KAAK,CAAA;AAClD,EAAA,MAAM,SAAS,iBAAA,CAAkB;AAAA,IAC/B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,YAAA,KAAiB,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC,GACxE,CAAA;AAED,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,kBAAA;AAGpC,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA;AAAA,IAAI,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,IAAU,CAAC,CAAA,KAC7B,CAAA,CAAE,IAAA,CAAK,eAAA,CAAgB,EAAE,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,CAAA,IAAK,IAAA,EAAM,CAAC;AAAA,GAC/E;AAEA,EAAA,IAAA,CAAK,IAAI,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAU,OAAO,CAAA,KAAM;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,UAAS,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAM,GAAA,CAAI,QAAQ,MAAM,QAAA,GAAY,IAAA,EAAM,GAAA,CAAI,QAAQ,CAAA,GAAe,EAAA;AAC3F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,wBAAwB,GAAG,CAAA;AAAA,IACtD;AACA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAC,CAAA;AAC3D,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,wBAAwB,GAAG,CAAA;AAAA,IACtD;AACA,IAAA,MAAM,YAAA,CAAa,CAAA,EAAG,MAAA,EAAQ,MAAM,CAAA;AACpC,IAAA,MAAM,OAAO,CAAA,CAAE,GAAA,CAAI,MAAM,MAAM,CAAA,IAAK,GAAG,IAAI,CAAA,CAAA,CAAA;AAC3C,IAAA,OAAO,EAAE,QAAA,CAAS,YAAA,CAAa,IAAA,EAAM,IAAI,GAAG,GAAG,CAAA;AAAA,EACjD,CAAC,CAAA;AAED,EAAA,IAAA,CAAK,IAAI,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,CAAC,CAAA,KAAM;AACrC,IAAA,YAAA,CAAa,GAAG,MAAM,CAAA;AACtB,IAAA,OAAO,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,GAAG,CAAA;AAAA,EACxC,CAAC,CAAA;AAID,EAAA,MAAM,aAAA,GAAgB,OAAO,CAAA,KAAe;AAC1C,IAAA,MAAM,SAAS,MAAM,iBAAA,CAAkB,CAAA,CAAE,GAAA,CAAI,KAAK,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC1C,MAAA,OAAO,EAAE,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,IAAI,IAAI,GAAG,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,SAAA,EAAW,SAAS,CAAA;AACtD,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,OAAO,CAAA,CAAE,KAAK,sBAAA,CAAuB,EAAE,QAAQ,IAAA,EAAM,GAAG,GAAG,CAAA;AAAA,IAC7D;AAKA,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,2BAA2B,CAAA;AACrD,IAAA,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACpB,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,CAAA,EAAY,GAAA,KAAgB;AACpD,IAAA,MAAM,MAAM,MAAM,eAAA,CAAgB,WAAW,IAAA,CAAK,QAAA,EAAU,GAAG,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,CAAA,CAAE,QAAA,EAAS;AAI5B,IAAA,MAAM,QAAQ,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAC5D,IAAA,KAAA,CAAM,IAAI,GAAG,CAAA;AACb,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK;AAAA,MACxB,cAAA,EAAgB,iBAAiB,GAAG,CAAA;AAAA;AAAA,MAEpC,eAAA,EAAiB;AAAA,KAClB,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,OAAO,MAAM,UAAA,CAAW,CAAA,EAAG,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAC,CAAC,CAAA;AAAA,EAC7F;AAEA,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,IAAA,IAAQ,GAAA,EAAK,aAAa,CAAA;AACvC,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,IAAI,KAAK,aAAa,CAAA;AACtC,EAAA,IAAA,CAAK,IAAI,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,EAAA,CAAA,EAAM,OAAO,GAAG,IAAA,KAAS;AAC3C,IAAA,MAAM,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AACxC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9B,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AACzC,MAAA,OAAO,UAAA,CAAW,GAAG,GAAG,CAAA;AAAA,IAC1B;AACA,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,OAAO,cAAc,CAAC,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEA,SAAS,mBAAmB,GAAA,EAAqB;AAC/C,EAAA,MAAM,YAAY,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA,GAAM,IAAI,GAAG,CAAA,CAAA;AACrD,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC5C,EAAA,OAAO,OAAA,KAAY,KAAK,EAAA,GAAK,OAAA;AAC/B;AAMA,eAAe,cAAA,CAAe,WAAmB,OAAA,EAAyC;AACxF,EAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,SAAA,EAAW,OAAO,CAAA;AACpD,EAAA,OAAO,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,GAAI,IAAA;AACtC;AAEA,eAAe,eAAA,CAAgB,WAAmB,OAAA,EAAyC;AACzF,EAAA,OAAO,eAAA,CAAgB,WAAW,OAAO,CAAA;AAC3C;AAEA,eAAe,eAAA,CAAgB,WAAmB,OAAA,EAAyC;AACzF,EAAA,MAAM,UAAA,GAAa,CAAC,SAAA,EAAW,mBAAmB,CAAA;AAClD,EAAA,KAAA,MAAW,OAAO,UAAA,EAAY;AAC5B,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA;AACzB,MAAA,IAAI,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG;AACjB,MAAA,OAAO,MAAM,SAAS,IAAI,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,QAAA,CAAS,MAAc,GAAA,EAA4B;AAC1D,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,GAAG,CAAC,CAAA;AAC1C,EAAA,MAAM,YAAA,GAAe,GAAG,SAAA,CAAU,IAAI,CAAC,CAAA,CAAA,CAAA,CAAI,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAC9D,EAAA,OAAO,QAAA,CAAS,WAAW,YAAY,CAAA,IAAK,aAAa,SAAA,CAAU,IAAI,IAAI,QAAA,GAAW,IAAA;AACxF;AAEA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI,GAAA,CAAI,SAAS,KAAK,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,GAAG,OAAO,uCAAA;AACxD,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,yBAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,eAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,WAAA;AACjC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA;AACnC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,iCAAA;AAClC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,iCAAA;AACjC,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,YAAA,CAAa,MAAc,MAAA,EAAwB;AAG1D,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,GAAG,MAAM,CAAA,CAAA,CAAA;AAC3C,EAAA,IAAI,KAAK,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,GAAG,MAAM,CAAA,CAAA,CAAA;AAC3C,EAAA,OAAO,IAAA;AACT;AAaA,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgEzB,SAAS,gBAAgB,IAAA,EAAwD;AAC/E,EAAA,MAAM,SAAA,GACJ,KAAK,KAAA,KAAU,SAAA,GACX,0CACA,IAAA,CAAK,KAAA,KAAU,YACb,gFAAA,GACA,EAAA;AACR,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAA,EAOD,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qDAAA,EA2B+B,UAAA,CAAW,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAAA,EAcpE,SAAS;AAAA;AAAA;AAAA;AAAA,OAAA,CAAA;AAKnB;AAEA,SAAS,uBAAuB,IAAA,EAAkC;AAChE,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAA,EAMD,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4CAAA,EAasB,UAAA,CAAW,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA,OAAA,CAAA;AAKrE;AAEA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,CAAC,EAAA,KAAO;AACnC,IAAA,QAAQ,EAAA;AAAI,MACV,KAAK,GAAA;AACH,QAAA,OAAO,OAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,MAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,MAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,QAAA;AAAA,MACT;AACE,QAAA,OAAO,OAAA;AAAA;AACX,EACF,CAAC,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * Cookie-session helpers for the operator UI.\n *\n * `@render-harness/web` accepts a `Bearer <api-key>` header and resolves\n * it to a `UserId`. A browser UI needs the same identity but without\n * making the user paste the bearer on every request, so we layer a signed\n * cookie on top:\n *\n *   1. Browser visits `<ui>/login`, posts the API key.\n *   2. We call the existing auth resolver with a synthetic\n *      `Authorization: Bearer ...` request to validate the key.\n *   3. On success we set a signed cookie carrying the resolved `userId`.\n *   4. {@link wrapWithSession} is plugged into `serveWeb` so all routes\n *      accept either the cookie OR the original bearer header. curl-based\n *      ops still work; browsers stay logged in.\n *\n * The signing secret comes from `UI_COOKIE_SECRET` (env). If unset we\n * generate a random per-process secret and warn — fine for local dev,\n * means cookies don't survive a restart.\n */\n\nimport type { UserId } from \"@render-harness/core\";\nimport type { Context } from \"hono\";\nimport { deleteCookie, getSignedCookie, setSignedCookie } from \"hono/cookie\";\n\nexport type AuthResolver = (req: Request) => Promise<UserId | null>;\n\nexport interface CookieSessionConfig {\n  cookieName: string;\n  secret: string;\n  /** Lifetime in seconds. Default: 7 days. */\n  maxAge: number;\n  /** Set Secure flag on the cookie. Default: true outside dev. */\n  secure: boolean;\n}\n\nconst DEFAULT_COOKIE_NAME = \"rh_ui_session\";\nconst DEFAULT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\n\nexport function buildCookieConfig(opts: {\n  cookieName?: string;\n  secret?: string;\n  maxAge?: number;\n  secure?: boolean;\n}): CookieSessionConfig {\n  const envSecret = process.env.UI_COOKIE_SECRET;\n  const secret = opts.secret ?? envSecret ?? generateEphemeralSecret();\n  const isDev = process.env.NODE_ENV !== \"production\";\n  return {\n    cookieName: opts.cookieName ?? DEFAULT_COOKIE_NAME,\n    secret,\n    maxAge: opts.maxAge ?? DEFAULT_MAX_AGE_SECONDS,\n    secure: opts.secure ?? !isDev,\n  };\n}\n\n/**\n * Read the signed session cookie from a `Request`, returning the userId\n * encoded in it or `null` if the cookie is missing/invalid.\n *\n * Hono's cookie helpers want a {@link Context}, but they only ever read\n * `c.req.raw.headers.get(\"Cookie\")` under the hood — so we pass a minimal\n * shim. Keeps verification in Hono's well-tested code without taking on\n * an internal dependency.\n */\nexport async function readSessionCookie(\n  req: Request,\n  cfg: CookieSessionConfig,\n): Promise<UserId | null> {\n  const shim = { req: { raw: req } } as unknown as Context;\n  const value = await getSignedCookie(shim, cfg.secret, cfg.cookieName);\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n/**\n * Resolve the request to a `UserId`, accepting either the cookie session\n * or a bearer header. Returns `null` if neither validates. Used inside\n * `/ui/*` handlers where we already have the Hono Context.\n */\nexport async function resolveSession(\n  c: Context,\n  cfg: CookieSessionConfig,\n  upstreamAuth: AuthResolver,\n): Promise<UserId | null> {\n  const fromCookie = await readSessionCookie(c.req.raw, cfg);\n  if (fromCookie) return fromCookie;\n  return upstreamAuth(c.req.raw);\n}\n\n/**\n * Wrap an existing `(Request) => Promise<UserId | null>` resolver so it\n * also accepts the signed UI session cookie. The web service plugs the\n * wrapped resolver into all of its routes when `serveWeb({ ui: true })`,\n * so JSON+SSE callers can use either bearer or cookie.\n */\nexport function wrapWithSession(\n  upstream: AuthResolver,\n  opts: {\n    cookieSecret?: string;\n    cookieName?: string;\n    cookieMaxAge?: number;\n    cookieSecure?: boolean;\n  } = {},\n): AuthResolver {\n  const cfg = buildCookieConfig({\n    ...(opts.cookieName !== undefined ? { cookieName: opts.cookieName } : {}),\n    ...(opts.cookieSecret !== undefined ? { secret: opts.cookieSecret } : {}),\n    ...(opts.cookieMaxAge !== undefined ? { maxAge: opts.cookieMaxAge } : {}),\n    ...(opts.cookieSecure !== undefined ? { secure: opts.cookieSecure } : {}),\n  });\n  return async (req: Request) => {\n    const fromCookie = await readSessionCookie(req, cfg);\n    if (fromCookie) return fromCookie;\n    return upstream(req);\n  };\n}\n\n/**\n * Mint a signed session cookie for the given `userId`. Caller is expected\n * to have already validated the user.\n */\nexport async function issueSession(\n  c: Context,\n  cfg: CookieSessionConfig,\n  userId: UserId,\n): Promise<void> {\n  await setSignedCookie(c, cfg.cookieName, userId, cfg.secret, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"Lax\",\n    secure: cfg.secure,\n    maxAge: cfg.maxAge,\n  });\n}\n\nexport function clearSession(c: Context, cfg: CookieSessionConfig): void {\n  deleteCookie(c, cfg.cookieName, { path: \"/\" });\n}\n\n/**\n * Forge a `Request` carrying `Authorization: Bearer <apiKey>` so we can\n * reuse the upstream resolver (which only knows how to read headers) for\n * the login form path.\n */\nexport function authRequestForBearer(apiKey: string): Request {\n  return new Request(\"https://internal.invalid/login\", {\n    headers: { authorization: `Bearer ${apiKey}` },\n  });\n}\n\nfunction generateEphemeralSecret(): string {\n  const bytes = new Uint8Array(32);\n  globalThis.crypto.getRandomValues(bytes);\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    const b = bytes[i] ?? 0;\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","/**\n * `mountUi(opts)` — attach the operator UI to an existing Hono app.\n *\n * The UI package owns the *browser-facing* surface only:\n *\n *   GET  <path>/               serves the SPA shell (HTML)\n *   GET  <path>/assets/*       serves the SPA's static bundle (JS/CSS/etc.)\n *   GET  <path>/login          login form (HTML)\n *   POST <path>/login          validate API key, set session cookie, redirect\n *   POST <path>/logout         clear the session cookie\n *\n * Every JSON+SSE endpoint the SPA talks to (`/runs`, `/runs/:id`,\n * `/runs/:id/tool-calls`, `/runs/:id/stream`, `/runs/:id/cancel`,\n * `/runs/:id/input`, `/agents`, `/usage`) is owned by `@render-harness/web`.\n * This package doesn't redefine any of them.\n *\n * The session cookie set by the login route is honoured by web's auth resolver\n * because `serveWeb({ ui: true })` wraps `auth()` with {@link wrapWithSession}.\n */\n\nimport { readFile, stat } from \"node:fs/promises\";\nimport { dirname, join, normalize, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { Context, Hono } from \"hono\";\nimport {\n  type AuthResolver,\n  authRequestForBearer,\n  buildCookieConfig,\n  clearSession,\n  issueSession,\n  readSessionCookie,\n} from \"./auth.js\";\n\nexport type { AuthResolver } from \"./auth.js\";\nexport { wrapWithSession } from \"./auth.js\";\n\nexport interface MountUiOpts {\n  /** Hono app the harness web service already built. */\n  app: Hono;\n  /**\n   * Auth resolver from the parent. Used as the upstream check for the\n   * login form; web's main `auth` already accepts the session cookie via\n   * `wrapWithSession`, so we don't re-implement that here.\n   */\n  auth: AuthResolver;\n  /** Mount path. Defaults to \"/ui\". */\n  path?: string;\n  /**\n   * Cookie session secret. Falls back to `UI_COOKIE_SECRET` env, then to a\n   * per-process random value (won't survive a restart — fine for dev).\n   */\n  cookieSecret?: string;\n  /** Cookie name. Defaults to \"rh_ui_session\". */\n  cookieName?: string;\n  /** Cookie max age in seconds. Defaults to 7 days. */\n  cookieMaxAge?: number;\n  /** Force the Secure cookie flag. Defaults: true in production, false otherwise. */\n  cookieSecure?: boolean;\n  /**\n   * Override the directory we serve the SPA bundle from. Defaults to the\n   * `dist/static` shipped alongside this package's compiled JS.\n   */\n  staticDir?: string;\n}\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\n// dist/index.js → dist/static. In dev (src/server.ts → src/../dist/static)\n// we still resolve up one level; we ship a built copy with the package.\nconst DEFAULT_STATIC_DIR = resolve(HERE, \"..\", \"dist\", \"static\");\nconst FALLBACK_STATIC_DIR = resolve(HERE, \"static\");\n\nconst SPA_INDEX = \"index.html\";\n\nexport function mountUi(opts: MountUiOpts): void {\n  const path = normalizeMountPath(opts.path ?? \"/ui\");\n  const cookie = buildCookieConfig({\n    ...(opts.cookieName !== undefined ? { cookieName: opts.cookieName } : {}),\n    ...(opts.cookieSecret !== undefined ? { secret: opts.cookieSecret } : {}),\n    ...(opts.cookieMaxAge !== undefined ? { maxAge: opts.cookieMaxAge } : {}),\n    ...(opts.cookieSecure !== undefined ? { secure: opts.cookieSecure } : {}),\n  });\n\n  const staticDir = opts.staticDir ?? DEFAULT_STATIC_DIR;\n\n  // Login / logout\n  opts.app.get(`${path}/login`, (c) =>\n    c.html(renderLoginPage({ uiPath: path, error: c.req.query(\"error\") ?? null })),\n  );\n\n  opts.app.post(`${path}/login`, async (c) => {\n    const form = await c.req.formData().catch(() => null);\n    const apiKey = typeof form?.get(\"apiKey\") === \"string\" ? (form?.get(\"apiKey\") as string) : \"\";\n    if (!apiKey) {\n      return c.redirect(`${path}/login?error=missing`, 303);\n    }\n    const userId = await opts.auth(authRequestForBearer(apiKey));\n    if (!userId) {\n      return c.redirect(`${path}/login?error=invalid`, 303);\n    }\n    await issueSession(c, cookie, userId);\n    const next = c.req.query(\"next\") ?? `${path}/`;\n    return c.redirect(safeNextPath(next, path), 303);\n  });\n\n  opts.app.post(`${path}/logout`, (c) => {\n    clearSession(c, cookie);\n    return c.redirect(`${path}/login`, 303);\n  });\n\n  // SPA shell + assets. The shell itself is gated by the cookie session;\n  // assets are not (they're cacheable static files).\n  const serveSpaShell = async (c: Context) => {\n    const userId = await readSessionCookie(c.req.raw, cookie);\n    if (!userId) {\n      const next = encodeURIComponent(c.req.path);\n      return c.redirect(`${path}/login?next=${next}`, 303);\n    }\n    const html = await readBundleHtml(staticDir, SPA_INDEX);\n    if (html === null) {\n      return c.html(renderBuildMissingPage({ uiPath: path }), 503);\n    }\n    // The SPA shell is tiny and references hash-named asset bundles. We\n    // don't want stale cached HTML pointing at deleted asset hashes, so\n    // browsers must revalidate every load. Asset files (under\n    // <path>/assets/*) are content-addressed and stay cacheable.\n    c.header(\"cache-control\", \"no-cache, must-revalidate\");\n    return c.html(html);\n  };\n\n  const serveAsset = async (c: Context, rel: string) => {\n    const buf = await readBundleAsset(staticDir, join(\"assets\", rel));\n    if (!buf) return c.notFound();\n    // Hono's typed body() wants `Uint8Array<ArrayBuffer>`, not Node's\n    // `Buffer<ArrayBufferLike>`. Copy into a fresh ArrayBuffer-backed\n    // view so the type matches without resorting to `any`.\n    const bytes = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    bytes.set(buf);\n    return c.body(bytes, 200, {\n      \"content-type\": guessContentType(rel),\n      // Vite emits hash-named asset files; safe to cache aggressively.\n      \"cache-control\": \"public, max-age=31536000, immutable\",\n    });\n  };\n\n  if (path === \"\") {\n    opts.app.get(\"/assets/*\", async (c) => serveAsset(c, c.req.path.replace(/^\\/assets\\//, \"\")));\n  }\n\n  opts.app.get(path || \"/\", serveSpaShell);\n  opts.app.get(`${path}/`, serveSpaShell);\n  opts.app.get(`${path}/*`, async (c, next) => {\n    const sub = c.req.path.slice(path.length);\n    if (sub.startsWith(\"/assets/\")) {\n      const rel = sub.replace(/^\\/assets\\//, \"\");\n      return serveAsset(c, rel);\n    }\n    if (sub === \"/login\" || sub.startsWith(\"/login?\")) {\n      return next();\n    }\n    return serveSpaShell(c);\n  });\n}\n\nfunction normalizeMountPath(raw: string): string {\n  const withSlash = raw.startsWith(\"/\") ? raw : `/${raw}`;\n  const trimmed = withSlash.replace(/\\/+$/, \"\");\n  return trimmed === \"\" ? \"\" : trimmed;\n}\n\n// --------------------------------------------------------------------\n// Static file helpers\n// --------------------------------------------------------------------\n\nasync function readBundleHtml(staticDir: string, relPath: string): Promise<string | null> {\n  const buf = await readBundleBytes(staticDir, relPath);\n  return buf ? buf.toString(\"utf8\") : null;\n}\n\nasync function readBundleAsset(staticDir: string, relPath: string): Promise<Buffer | null> {\n  return readBundleBytes(staticDir, relPath);\n}\n\nasync function readBundleBytes(staticDir: string, relPath: string): Promise<Buffer | null> {\n  const candidates = [staticDir, FALLBACK_STATIC_DIR];\n  for (const dir of candidates) {\n    const safe = safeJoin(dir, relPath);\n    if (!safe) continue;\n    try {\n      const s = await stat(safe);\n      if (!s.isFile()) continue;\n      return await readFile(safe);\n    } catch {\n      // try the next candidate directory\n    }\n  }\n  return null;\n}\n\nfunction safeJoin(root: string, rel: string): string | null {\n  const resolved = normalize(join(root, rel));\n  const rootResolved = `${normalize(root)}/`.replace(/\\/+$/, \"/\");\n  return resolved.startsWith(rootResolved) || resolved === normalize(root) ? resolved : null;\n}\n\nfunction guessContentType(rel: string): string {\n  if (rel.endsWith(\".js\") || rel.endsWith(\".mjs\")) return \"application/javascript; charset=utf-8\";\n  if (rel.endsWith(\".css\")) return \"text/css; charset=utf-8\";\n  if (rel.endsWith(\".svg\")) return \"image/svg+xml\";\n  if (rel.endsWith(\".png\")) return \"image/png\";\n  if (rel.endsWith(\".woff2\")) return \"font/woff2\";\n  if (rel.endsWith(\".json\")) return \"application/json; charset=utf-8\";\n  if (rel.endsWith(\".map\")) return \"application/json; charset=utf-8\";\n  return \"application/octet-stream\";\n}\n\nfunction safeNextPath(next: string, uiPath: string): string {\n  // Only allow same-origin redirects under the UI path prefix to avoid\n  // open-redirects via the `next` query param.\n  if (!next.startsWith(\"/\")) return `${uiPath}/`;\n  if (next.startsWith(\"//\")) return `${uiPath}/`;\n  return next;\n}\n\n// --------------------------------------------------------------------\n// Inline HTML helpers (login + the \"build missing\" fallback)\n// --------------------------------------------------------------------\n\n// Brutalist black-and-white CSS shared by the inline pages we render\n// outside the SPA bundle (login form, \"build missing\" fallback). Kept\n// here so server-only routes don't depend on the Tailwind output.\n//\n// Single accent: purple. Used for active states, focus, selection, and\n// the blinking input caret. Same palette as the SPA so the visual\n// transition into the dashboard is seamless.\nconst INLINE_THEME_CSS = `\n:root {\n  color-scheme: light dark;\n  --bg: #fff; --fg: #000; --muted: #555; --line: #000;\n  --accent: #a855f7; --err: #b40000;\n}\n@media (prefers-color-scheme: dark) {\n  :root {\n    --bg: #000; --fg: #fff; --muted: #8a8a8a; --line: #2a2a2a;\n    --accent: #c084fc; --err: #ff5555;\n  }\n}\n* { box-sizing: border-box; border-radius: 0 !important; }\nhtml, body { height: 100%; }\nbody {\n  margin: 0; background: var(--bg); color: var(--fg);\n  font: 14px/1.45 ui-monospace, \"JetBrains Mono\", \"IBM Plex Mono\", \"SF Mono\", Menlo, Consolas, monospace;\n  -webkit-font-smoothing: antialiased;\n}\n::selection { background: var(--accent); color: var(--bg); }\n.label {\n  text-transform: uppercase; letter-spacing: 0.08em;\n  font-size: 0.72rem; color: var(--muted);\n}\n.panel { border: 1px solid var(--line); background: var(--bg); }\n.hr-section {\n  display: flex; align-items: center; gap: 0.6rem;\n  text-transform: uppercase; letter-spacing: 0.1em;\n  font-size: 0.72rem; color: var(--muted);\n  margin: 0 0 1rem;\n}\n.hr-section::after {\n  content: \"\"; flex: 1; border-top: 1px solid var(--line);\n}\n.btn {\n  display: inline-flex; align-items: center; justify-content: center;\n  width: 100%; padding: 0.6rem 0.7rem; border: 1px solid var(--accent);\n  background: var(--accent); color: var(--bg); cursor: pointer;\n  font: inherit; text-transform: uppercase; letter-spacing: 0.06em; font-size: 0.78rem;\n}\n.btn:hover { background: var(--bg); color: var(--accent); }\ninput {\n  width: 100%; padding: 0.55rem 0.65rem; font: inherit; color: inherit;\n  background: var(--bg); border: 1px solid var(--line);\n  caret-color: var(--accent);\n}\ninput:focus-visible {\n  outline: 1px solid var(--accent); outline-offset: 0;\n  border-color: var(--accent);\n  animation: rh-caret-blink 1.06s steps(2, jump-none) infinite;\n}\n@keyframes rh-caret-blink {\n  0%, 50% { caret-color: var(--accent); }\n  51%, 100% { caret-color: transparent; }\n}\n.blink { animation: rh-block-blink 1.06s steps(2, jump-none) infinite; }\n@keyframes rh-block-blink {\n  0%, 50% { opacity: 1; }\n  51%, 100% { opacity: 0; }\n}\n.cursor { color: var(--accent); }\ncode { font-family: inherit; }\n`;\n\nfunction renderLoginPage(args: { uiPath: string; error: string | null }): string {\n  const errorHtml =\n    args.error === \"invalid\"\n      ? '<p class=\"err\">// invalid api key</p>'\n      : args.error === \"missing\"\n        ? '<p class=\"err\">// enter the api key configured as <code>WEB_API_KEY</code></p>'\n        : \"\";\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>render-harness / operator / sign-in</title>\n    <style>\n      ${INLINE_THEME_CSS}\n      main { min-height: 100vh; display: grid; place-items: center; padding: 2rem 1rem; }\n      .card { width: min(440px, 100%); padding: 1.75rem; }\n      .card h1 {\n        margin: 0; font-size: 0.85rem; text-transform: uppercase;\n        letter-spacing: 0.1em;\n      }\n      .card h1 .muted { color: var(--muted); }\n      .card .sub {\n        margin: 0.25rem 0 1.5rem; color: var(--muted);\n        font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.08em;\n      }\n      .card p.help { margin: 0 0 1.25rem; color: var(--muted); font-size: 0.78rem; }\n      .field { margin-bottom: 0.9rem; }\n      .field label { display: block; margin-bottom: 0.35rem; }\n      .prompt {\n        display: flex; align-items: stretch; gap: 0.5rem;\n      }\n      .prompt .gutter {\n        display: flex; align-items: center;\n        color: var(--accent); font-size: 0.85rem;\n      }\n      .err { margin: 0.6rem 0 0; color: var(--err); font-size: 0.78rem; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <form class=\"panel card\" method=\"post\" action=\"${escapeHtml(args.uiPath)}/login\">\n        <h1>\n          <span class=\"muted\">render-harness</span> / operator<span class=\"cursor blink\" aria-hidden=\"true\">▊</span>\n        </h1>\n        <p class=\"sub\">/sign-in</p>\n        <p class=\"help\">// enter the api key configured for this service (<code>WEB_API_KEY</code>)</p>\n        <div class=\"field\">\n          <label class=\"label\" for=\"apiKey\">api key</label>\n          <div class=\"prompt\">\n            <span class=\"gutter\" aria-hidden=\"true\">$</span>\n            <input id=\"apiKey\" name=\"apiKey\" type=\"password\" autocomplete=\"current-password\" required autofocus />\n          </div>\n        </div>\n        <button class=\"btn\" type=\"submit\">[ continue ]</button>\n        ${errorHtml}\n      </form>\n    </main>\n  </body>\n</html>`;\n}\n\nfunction renderBuildMissingPage(args: { uiPath: string }): string {\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <title>render-harness / operator / build-missing</title>\n    <style>\n      ${INLINE_THEME_CSS}\n      main { max-width: 60ch; margin: 4rem auto; padding: 0 1.5rem; }\n      h1 { font-size: 0.95rem; text-transform: uppercase; letter-spacing: 0.08em; margin: 0 0 1rem; }\n      .box { padding: 1rem; }\n      code { padding: 0.05rem 0.3rem; border: 1px solid var(--line); }\n    </style>\n  </head>\n  <body>\n    <main>\n      <h1>// operator ui bundle missing</h1>\n      <div class=\"panel box\">\n        <p>The SPA bundle for <code>@render-harness/ui</code> hasn't been built. Run</p>\n        <p><code>pnpm --filter @render-harness/ui build</code></p>\n        <p>to compile it, then reload <code>${escapeHtml(args.uiPath)}/</code>.</p>\n      </div>\n    </main>\n  </body>\n</html>`;\n}\n\nfunction escapeHtml(s: string): string {\n  return s.replace(/[&<>\"']/g, (ch) => {\n    switch (ch) {\n      case \"&\":\n        return \"&amp;\";\n      case \"<\":\n        return \"&lt;\";\n      case \">\":\n        return \"&gt;\";\n      case '\"':\n        return \"&quot;\";\n      default:\n        return \"&#39;\";\n    }\n  });\n}\n"]}