@timqi/pier 0.0.1

package/dist/tasks/tool.js

@@ -0,0 +1,281 @@
+import { Type } from "typebox";
+import { TaskDefinitions, record, requiredString } from "./definitions.js";
+import { TaskMessenger } from "./messages.js";
+import { TaskStore } from "./store.js";
+// JSON-Schema enum emits ~1/3 the tokens of typebox's anyOf-of-consts.
+const strEnum = (...values) => Type.Unsafe({ type: "string", enum: [...values] });
+/**
+ * Drop the fields with nothing in them instead of sending `null`.
+ *
+ * A run summary has eighteen fields and most are empty for most of a run's
+ * life; a model reads "absent" and "null" the same way. On a `get` that lists
+ * several runs this is a third of the payload.
+ *
+ * The input names every field — a summary that forgot one would otherwise pass
+ * as "that field was empty" — and the result is the type with the empty ones
+ * gone, which is why those are declared optional above.
+ */
+const defined = (value) => Object.fromEntries(Object.entries(value).filter(([, v]) => v !== null && v !== undefined));
+const summarize = (run, pendingDecisionId) => defined({
+    runId: run.id,
+    taskId: run.taskId,
+    taskName: run.context.definition.name,
+    state: run.state,
+    triggerSource: run.triggerSource,
+    groupId: run.groupId,
+    sessionMode: run.sessionMode,
+    targetSessionId: run.targetSessionId,
+    callbackSessionId: run.callbackSessionId,
+    callbackState: run.callbackState,
+    pendingDecisionId,
+    depth: run.depth,
+    queuedAt: run.queuedAt,
+    startedAt: run.startedAt,
+    finishedAt: run.finishedAt,
+    result: run.result,
+    error: run.error,
+    skipReason: run.skipReason,
+});
+const summarizeGroup = (group, members, messages) => defined({
+    groupId: group.id,
+    join: group.join,
+    state: group.finishedAt ? "finished" : "running",
+    callbackState: group.callbackState,
+    winnerRunId: group.winnerRunId,
+    members: members.map((run) => summarize(run, messages.openDecisionId(run.id))),
+});
+// Model-facing draft shape. Guidance only: runtime truth stays in parseDraft,
+// so schema drift can never loosen boundary validation.
+const DraftSchema = Type.Object({
+    name: Type.String(),
+    description: Type.Optional(Type.String()),
+    trigger: Type.Optional(Type.Union([
+        Type.Object({ type: Type.Literal("manual") }),
+        Type.Object({ type: Type.Literal("cron"), expression: Type.String(), timezone: Type.String() }),
+        Type.Object({
+            type: Type.Literal("watch"),
+            script: Type.String(),
+            cwd: Type.String(),
+            intervalSeconds: Type.Number(),
+            mode: strEnum("once", "repeat"),
+        }),
+    ])),
+    action: Type.Union([
+        Type.Object({
+            type: Type.Literal("agent"),
+            session: Type.Union([
+                Type.Object({ mode: Type.Literal("fresh"), cwd: Type.String() }),
+                Type.Object({ mode: Type.Literal("fork"), cwd: Type.Optional(Type.String()) }),
+                Type.Object({ mode: Type.Literal("reuse"), sessionId: Type.String() }),
+            ]),
+            prompt: Type.String(),
+            // No `capabilities` here on purpose: a child gets the same tools as any
+            // Pier session, so the model never spends a decision on it. Read-only
+            // children stay configurable through the Console and HTTP.
+            launch: Type.Optional(Type.Object({
+                model: Type.Optional(Type.Object({ provider: Type.String(), id: Type.String() })),
+                thinking: Type.Optional(Type.String()),
+            })),
+        }),
+        Type.Object({ type: Type.Literal("bash"), script: Type.String(), cwd: Type.String() }),
+        Type.Object({ type: Type.Literal("task"), taskId: Type.String() }),
+    ]),
+    callback: Type.Optional(Type.Union([
+        Type.Object({ type: Type.Literal("none") }),
+        Type.Object({ type: Type.Literal("origin") }),
+        Type.Object({ type: Type.Literal("session"), sessionId: Type.String() }),
+    ])),
+    timeoutSeconds: Type.Optional(Type.Number()),
+});
+/** The model-facing `task` tool contract, injected into the agent seam as data. */
+export function taskToolSpec(execute) {
+    return {
+        name: "task",
+        label: "Pier Task",
+        description: "Manage durable Pier tasks and subagents. Agent tasks support reused, fresh, or forked sessions. Run executes a stored task by task_id, a one-shot subagent from an inline task draft, or a core-joined fan-out via tasks[] with join all|first. Get accepts run_id, group_id, or task_id for that task's recent runs. Every operation returns immediately: results, group joins, and decision replies arrive as callback messages. Use steer/follow_up/resume for child control and contact/reply for supervisor decisions.",
+        parameters: Type.Object({
+            operation: strEnum("list", "create", "update", "run", "get", "cancel", "steer", "follow_up", "resume", "contact", "reply"),
+            task_id: Type.Optional(Type.String()),
+            run_id: Type.Optional(Type.String()),
+            group_id: Type.Optional(Type.String()),
+            message_id: Type.Optional(Type.String()),
+            message: Type.Optional(Type.String()),
+            reason: Type.Optional(strEnum("progress", "decision")),
+            session_mode: Type.Optional(strEnum("fresh", "fork")),
+            task: Type.Optional(DraftSchema),
+            // The same draft again, spelled out, cost more tokens in every session
+            // than the whole rest of this contract. One copy is the guidance; this
+            // one points at it, and `parseDraft` is what actually validates either.
+            tasks: Type.Optional(Type.Unsafe({
+                type: "array",
+                description: "2+ entries, each either a task draft shaped exactly like `task`, or {task_id}.",
+                items: { type: "object" },
+            })),
+            join: Type.Optional(strEnum("all", "first")),
+            input: Type.Optional(Type.Unknown()),
+            callback: Type.Optional(strEnum("origin", "none")),
+            callback_session_id: Type.Optional(Type.String()),
+        }),
+        execute,
+    };
+}
+export async function handleTaskTool(host, definitions, store, messages, raw, callerSessionId) {
+    const input = record(raw);
+    if (!input)
+        throw new Error("task tool parameters required");
+    const active = store.findActiveRunForTarget(callerSessionId);
+    if (input.operation === "list")
+        return definitions.list().filter((task) => task.kind !== "subagent");
+    if (input.operation === "create") {
+        if (active)
+            throw new Error("subagents cannot create task definitions");
+        return definitions.create(input.task, `session:${callerSessionId}`);
+    }
+    if (input.operation === "update") {
+        if (active)
+            throw new Error("subagents cannot update task definitions");
+        return definitions.update(requiredString(input.task_id, "task_id"), input.task);
+    }
+    if (input.operation === "run") {
+        if (active && active.context.definition.action.type === "agent" && active.context.definition.action.launch?.capabilities === "read") {
+            throw new Error("read-only subagents cannot delegate nested work");
+        }
+        if (Array.isArray(input.tasks)) {
+            // Core-joined fan-out: members run detached, one aggregated callback.
+            if (input.task !== undefined || input.task_id !== undefined)
+                throw new Error("use either task/task_id or tasks[]");
+            if (input.session_mode !== undefined)
+                throw new Error("session_mode applies to a single run only");
+            if (input.tasks.length < 2)
+                throw new Error("tasks[] needs at least 2 entries; use task for a single run");
+            const resolved = [];
+            for (const rawEntry of input.tasks) {
+                const entry = record(rawEntry);
+                if (!entry)
+                    throw new Error("invalid tasks[] entry");
+                resolved.push(entry.task_id === undefined
+                    ? await resolveDraft(definitions, entry, active, callerSessionId)
+                    : resolveStored(definitions, entry.task_id, active));
+            }
+            const { group, runs } = host.runGroup(resolved, input.join === "first" ? "first" : "all", callerSessionId, active?.id ?? null, input.callback === "none" ? null : callerSessionId);
+            return summarizeGroup(group, runs, messages);
+        }
+        const draft = input.task_id === undefined ? record(input.task) : undefined;
+        const task = draft
+            ? await resolveDraft(definitions, draft, active, callerSessionId)
+            : resolveStored(definitions, input.task_id, active);
+        const sessionMode = input.session_mode === "fresh" || input.session_mode === "fork" ? input.session_mode : undefined;
+        let callbackSessionId = input.callback === "none" ? null : callerSessionId;
+        if (!active && callbackSessionId && typeof input.callback_session_id === "string") {
+            callbackSessionId = requiredString(input.callback_session_id, "callback_session_id");
+            if (!(await definitions.sessionExists(callbackSessionId)))
+                throw new Error(`unknown session: ${callbackSessionId}`);
+        }
+        const run = host.run(task.id, input.input, "agent", active?.id ?? null, {
+            invokedBySessionId: callerSessionId,
+            sourceSessionId: callerSessionId,
+            callbackSessionId,
+            background: true,
+            sessionMode,
+        });
+        return summarize(run, null);
+    }
+    if (input.operation === "get") {
+        if (typeof input.group_id === "string") {
+            const { group, members } = host.getGroup(input.group_id);
+            return summarizeGroup(group, members, messages);
+        }
+        // Run history by task: without it, checking what a task did (or whether a
+        // cascade landed) means leaving the tool for the database.
+        if (input.run_id === undefined && typeof input.task_id === "string") {
+            return host.listRuns(input.task_id, 10).map((run) => summarize(run, messages.openDecisionId(run.id)));
+        }
+        const run = host.getRun(requiredString(input.run_id, "run_id"));
+        return summarize(run, messages.openDecisionId(run.id));
+    }
+    if (input.operation === "cancel") {
+        if (typeof input.group_id === "string") {
+            const { group, members } = host.getGroup(input.group_id);
+            for (const member of members)
+                assertOwns(store, callerSessionId, active, member);
+            const cancelled = host.cancelGroup(group.id);
+            return summarizeGroup(cancelled, cancelled.memberRunIds.map((id) => host.getRun(id)), messages);
+        }
+        const run = host.getRun(requiredString(input.run_id, "run_id"));
+        assertOwns(store, callerSessionId, active, run);
+        const cancelled = host.cancel(run.id);
+        return summarize(cancelled, messages.openDecisionId(cancelled.id));
+    }
+    if (input.operation === "steer" || input.operation === "follow_up") {
+        const run = host.getRun(requiredString(input.run_id, "run_id"));
+        assertOwns(store, callerSessionId, active, run);
+        return host.control(run.id, callerSessionId, input.operation, requiredString(input.message, "message"));
+    }
+    if (input.operation === "resume") {
+        const prior = host.getRun(requiredString(input.run_id, "run_id"));
+        assertOwns(store, callerSessionId, active, prior);
+        const run = host.resume(prior.id, requiredString(input.message, "message"), {
+            invokedBySessionId: callerSessionId,
+            callbackSessionId: input.callback === "none" ? null : callerSessionId,
+            background: true,
+        });
+        return summarize(run, null);
+    }
+    if (input.operation === "contact") {
+        if (!active)
+            throw new Error("contact is only available inside an active Agent run");
+        const reason = input.reason === "decision" ? "decision" : "progress";
+        return messages.contact(active, callerSessionId, reason, requiredString(input.message, "message"));
+    }
+    if (input.operation === "reply") {
+        return messages.reply(requiredString(input.message_id, "message_id"), callerSessionId, requiredString(input.message, "message"));
+    }
+    throw new Error("unknown task operation");
+}
+/** Inline one-shot subagent: persisted like any task (kind "subagent",
+ * filtered from default lists) so runs stay auditable and resumable. */
+async function resolveDraft(definitions, draft, active, callerSessionId) {
+    if (draft.trigger !== undefined && record(draft.trigger)?.type !== "manual") {
+        throw new Error("inline subagent tasks must use a manual trigger");
+    }
+    // The draft parser accepts `capabilities` for Console/HTTP definitions; from
+    // the tool it is rejected rather than silently honoured, so a model working
+    // from stale memory learns the field is gone.
+    if (record(record(draft.action)?.launch)?.capabilities !== undefined) {
+        throw new Error("launch.capabilities is configured in Console or HTTP, not by the task tool");
+    }
+    if (active) {
+        const action = record(draft.action);
+        if (action?.type !== "agent")
+            throw new Error("subagents may only inline Agent tasks");
+        if (record(action.session)?.mode === "reuse")
+            throw new Error("subagent inline tasks cannot reuse an existing session");
+    }
+    return definitions.create({ ...draft, trigger: { type: "manual" } }, `session:${callerSessionId}`, "subagent");
+}
+function resolveStored(definitions, taskId, active) {
+    const task = definitions.get(requiredString(taskId, "task_id"));
+    if (active && task.action.type !== "agent")
+        throw new Error("subagents may only invoke Agent tasks");
+    return task;
+}
+function assertOwns(store, callerSessionId, active, target) {
+    if (active) {
+        let cursor = target;
+        while (cursor?.parentRunId) {
+            if (cursor.parentRunId === active.id)
+                return;
+            cursor = store.getRun(cursor.parentRunId);
+        }
+        throw new Error("subagent may only control descendant runs");
+    }
+    let root = target;
+    while (root.parentRunId) {
+        const parent = store.getRun(root.parentRunId);
+        if (!parent)
+            throw new Error(`unknown parent run: ${root.parentRunId}`);
+        root = parent;
+    }
+    if (root.invokedBySessionId !== callerSessionId)
+        throw new Error("session does not own this run");
+}

package/dist/tasks/types.js

@@ -0,0 +1,5 @@
+export const isTerminal = (state) => state === "succeeded" ||
+    state === "failed" ||
+    state === "cancelled" ||
+    state === "interrupted" ||
+    state === "skipped";

package/dist/web/auth.js

@@ -0,0 +1,280 @@
+// The boundary in front of every HTTP surface: one shared password.
+//
+// Single-account on purpose. Pier has one workspace, so there is nobody to
+// tell apart — an internet-facing deployment needs a *boundary*, not
+// identities. Multiple people using it share the page, and share the password.
+//
+// Nothing to configure before first run: the store generates a password on an
+// empty database, keeps only its scrypt hash, and prints the plaintext once to
+// the log. There is no window where the port is open and unclaimed — the
+// password exists before the listener does — and no env var for an operator to
+// get wrong. Forgot it? Delete the row and restart; a new one is printed.
+//
+// The cookie is a signed expiry, not a stored session id: an HMAC keyed by the
+// stored hash. No session table, no pruning — and changing the password
+// changes the key, so every cookie already out there dies with it. That is the
+// whole revocation story a single-user system needs. A cookie (not a bearer
+// header) because the workbench lives on SSE, and EventSource sends no headers.
+import { createHash, createHmac, randomBytes, randomInt, scryptSync, timingSafeEqual, } from "node:crypto";
+import { getCookie, setCookie } from "hono/cookie";
+import { pierDb } from "../db.js";
+import { logger } from "../log.js";
+const log = logger("auth");
+const COOKIE = "pier_session";
+const TTL_MS = 90 * 24 * 60 * 60_000;
+/** Failed attempts one client may make before it has to wait out the window. */
+const MAX_FAILURES = 10;
+const WINDOW_MS = 15 * 60_000;
+/** Shortest password a human may choose. The generated one is longer; this is
+ *  the floor under which the throttle above stops being enough. */
+const MIN_LENGTH = 10;
+// scrypt at Node's defaults (N=16384): ~50ms per attempt, which is the point.
+const KEY_BYTES = 32;
+/**
+ * Human-readable and unambiguous: no 0/O, 1/l/I, so it survives being read off
+ * a terminal and typed into a phone. 15 characters from a 31-symbol alphabet is
+ * ~74 bits — this is the only thing between the internet and a shell.
+ *
+ * `randomInt` rejection-samples. Folding a random byte with `% 31` would have
+ * quietly favoured the first eight symbols, which is the kind of bias nothing
+ * ever reports.
+ */
+function generatePassword() {
+    const alphabet = "abcdefghjkmnpqrstuvwxyz23456789";
+    const chars = Array.from({ length: 15 }, () => alphabet[randomInt(alphabet.length)]).join("");
+    return `${chars.slice(0, 5)}-${chars.slice(5, 10)}-${chars.slice(10)}`;
+}
+/**
+ * The stored credential: one row, one password, hashed.
+ *
+ * Generation happens in the constructor because "no password" is not a state
+ * Pier may ever serve in — a boot that cannot print the password it just made
+ * should fail at boot, not open a door.
+ */
+export class AuthStore {
+    #db;
+    /** HMAC key for cookies: the hash, so rotating the password expires them. */
+    #key;
+    constructor(db = pierDb(), print = (m) => log.info(m)) {
+        this.#db = db;
+        let row = this.#row();
+        if (!row) {
+            const password = generatePassword();
+            const salt = randomBytes(16).toString("hex");
+            row = { salt, hash: hash(password, salt), createdAt: Date.now() };
+            this.#db
+                .prepare("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
+                .run(row.salt, row.hash, row.createdAt);
+            print(`\nthis instance had no password, so one was generated:\n\n    ${password}\n\n` +
+                `only its hash is stored — it is not printed again. ` +
+                `Lost it? "DELETE FROM auth" in the database, then restart.\n`);
+        }
+        this.#key = row.hash;
+    }
+    #row() {
+        return this.#db
+            .prepare("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
+            .get();
+    }
+    /** Whether this is the password, compared in constant time. */
+    verify(password) {
+        const row = this.#row();
+        return row ? sameSecret(hash(password, row.salt), row.hash) : false;
+    }
+    /**
+     * Replace the password, salt and all.
+     *
+     * The new hash becomes the cookie key, so every cookie signed with the old
+     * one — every other browser, and the caller's own — stops verifying. That is
+     * the point: a password is changed because the old one may be known.
+     */
+    setPassword(password) {
+        const salt = randomBytes(16).toString("hex");
+        const next = hash(password, salt);
+        this.#db
+            .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
+            .run(salt, next, Date.now());
+        this.#key = next;
+    }
+    /** Cookie signing key. Never the password: that is not stored anywhere. */
+    get cookieKey() {
+        return this.#key;
+    }
+}
+const hash = (password, salt) => scryptSync(password, salt, KEY_BYTES).toString("hex");
+/**
+ * What a logged-out visitor must still reach: the login form, published
+ * boards, and the stylesheet those boards link — a published board rendering
+ * unstyled for the person it was published to is the same bug as not serving
+ * it. `/boards/*` stays behind the boundary; `/p/*` is the published mirror,
+ * the single exempt prefix `docs/architecture.md` reserved for this.
+ */
+function isPublic(path) {
+    return (path === "/login" ||
+        path === "/p" ||
+        path.startsWith("/p/") ||
+        path === "/boards/_assets/pier.css");
+}
+const sign = (secret, expiresAt) => createHmac("sha256", secret).update(String(expiresAt)).digest("base64url");
+/** Constant-time equality that also hides length: both sides are digested. */
+function sameSecret(a, b) {
+    const digest = (s) => createHash("sha256").update(s).digest();
+    return timingSafeEqual(digest(a), digest(b));
+}
+function valid(secret, cookie) {
+    const [exp, sig] = (cookie ?? "").split(".");
+    const expiresAt = Number(exp);
+    if (!sig || !Number.isSafeInteger(expiresAt) || expiresAt <= Date.now())
+        return false;
+    return sameSecret(sig, sign(secret, expiresAt));
+}
+/**
+ * Only a same-origin path may be returned to after login. `//evil.example` is a
+ * protocol-relative URL rather than a path, and browsers normalize a backslash
+ * to a slash, so `/\evil.example` is the same trick spelled differently — both
+ * are what a `startsWith("/")` check alone hands an open redirect to.
+ */
+const safeNext = (raw) => typeof raw === "string" && /^\/(?![/\\])/.test(raw) ? raw : "/";
+// Failed logins per client, in memory: a restart clearing them is fine, since
+// the window is minutes and the point is to make guessing slow, not to keep
+// books. Bounded by pruning every expired entry on each check.
+const failures = new Map();
+/**
+ * Behind a reverse proxy every request shares one socket address, so the
+ * forwarded hop is the only thing separating two clients. It is spoofable when
+ * Pier is exposed directly — that is an argument for the proxy, not against
+ * the limit: a password is the thing being protected here, the counter only
+ * decides how fast someone may guess.
+ */
+function clientOf(c) {
+    return c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || "local";
+}
+function throttled(client) {
+    const now = Date.now();
+    for (const [id, entry] of failures)
+        if (entry.resetAt <= now)
+            failures.delete(id);
+    return (failures.get(client)?.count ?? 0) >= MAX_FAILURES;
+}
+function noteFailure(client) {
+    const entry = failures.get(client);
+    if (entry && entry.resetAt > Date.now())
+        entry.count += 1;
+    else
+        failures.set(client, { count: 1, resetAt: Date.now() + WINDOW_MS });
+}
+/** Every route, in one place — no per-route opt-in to forget on the next one. */
+export function requireAuth(store) {
+    return async (c, next) => {
+        if (isPublic(c.req.path) || valid(store.cookieKey, getCookie(c, COOKIE)))
+            return next();
+        // An API caller gets a status it can act on; a navigation gets the form.
+        // Anything non-GET is a client call too — never a link worth redirecting.
+        if (c.req.path.startsWith("/api/") || c.req.method !== "GET") {
+            return c.json({ error: "unauthorized" }, 401);
+        }
+        return c.redirect(`/login?next=${encodeURIComponent(c.req.path)}`);
+    };
+}
+export function registerAuthRoutes(app, store) {
+    app.get("/login", (c) => c.html(loginPage(safeNext(c.req.query("next")))));
+    app.post("/login", async (c) => {
+        const client = clientOf(c);
+        const form = await c.req.parseBody();
+        const next = safeNext(form.next);
+        if (throttled(client)) {
+            // The one surface strangers can reach: a burst here is the only warning
+            // an operator gets that the port is being knocked on.
+            log.warn(`login throttled for ${client}`);
+            return c.html(loginPage(next, "Too many attempts. Wait a few minutes."), 429);
+        }
+        if (!store.verify(typeof form.password === "string" ? form.password : "")) {
+            noteFailure(client);
+            log.warn(`wrong password from ${client}`);
+            return c.html(loginPage(next, "Wrong password."), 401);
+        }
+        failures.delete(client);
+        log.info(`login from ${client}`);
+        issueCookie(c, store);
+        return c.redirect(next);
+    });
+    // Changing the password is a login — it takes the current one, and it is
+    // throttled by the same counter, because "change" answers the same guess
+    // "sign in" does. So it needs no cookie of its own: whoever knows the current
+    // password can already get one.
+    app.post("/api/password", async (c) => {
+        const client = clientOf(c);
+        const body = (await c.req.json().catch(() => null));
+        const current = typeof body?.current === "string" ? body.current : "";
+        const next = typeof body?.next === "string" ? body.next : "";
+        if (throttled(client))
+            return c.json({ error: "Too many attempts. Wait a few minutes." }, 429);
+        if (!store.verify(current)) {
+            noteFailure(client);
+            return c.json({ error: "Wrong current password." }, 401);
+        }
+        if (next.length < MIN_LENGTH) {
+            return c.json({ error: `Use at least ${MIN_LENGTH} characters.` }, 400);
+        }
+        failures.delete(client);
+        store.setPassword(next);
+        // The rotation just killed this caller's cookie too; re-issue rather than
+        // bounce the person who is holding the new password to the login form.
+        issueCookie(c, store);
+        return c.json({ ok: true });
+    });
+}
+/** The signed-in cookie, set the same way by login and by a password change. */
+function issueCookie(c, store) {
+    const expiresAt = Date.now() + TTL_MS;
+    setCookie(c, COOKIE, `${expiresAt}.${sign(store.cookieKey, expiresAt)}`, {
+        path: "/",
+        httpOnly: true,
+        sameSite: "Lax",
+        // Set only over TLS: a Secure cookie on plain http is dropped, which
+        // would lock out the loopback and SSH-tunnel setups.
+        secure: c.req.header("x-forwarded-proto") === "https" ||
+            new URL(c.req.url).protocol === "https:",
+        maxAge: TTL_MS / 1000,
+    });
+}
+/**
+ * Self-contained HTML: the login page must render before the workbench bundle
+ * is reachable, so it links nothing the boundary would refuse to serve.
+ */
+function loginPage(next, error) {
+    const attr = (s) => s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="theme-color" content="#fafafa" />
+<title>Pier</title>
+<style>
+  :root { color-scheme: light }
+  body { margin: 0; height: 100dvh; display: grid; place-items: center; background: #fafafa;
+    color: #262626; font: 16px/1.45 ui-sans-serif, system-ui, sans-serif }
+  form { display: grid; gap: .75rem; width: min(20rem, 88vw) }
+  h1 { margin: 0; font-size: 1rem; font-weight: 600; letter-spacing: .01em }
+  input { padding: .5rem .625rem; font-size: 1rem; color: inherit; background: #fff;
+    border: 1px solid #d4d4d4; border-radius: .5rem }
+  input:focus { outline: 2px solid #a3a3a3; outline-offset: -1px }
+  button { padding: .5rem; font: inherit; font-weight: 500; color: #fafafa; background: #262626;
+    border: 0; border-radius: .5rem; cursor: pointer }
+  p { margin: 0; font-size: .8125rem; color: #dc2626 }
+</style>
+</head>
+<body>
+  <form method="post" action="/login">
+    <h1>Pier</h1>
+    ${error ? `<p>${attr(error)}</p>` : ""}
+    <input type="password" name="password" placeholder="Password" autocomplete="current-password"
+      autofocus required />
+    <input type="hidden" name="next" value="${attr(next)}" />
+    <button type="submit">Sign in</button>
+  </form>
+</body>
+</html>
+`;
+}