Add authenticated shared web UI

.github/workflows/deploy.yml

@@ -1,9 +1,9 @@
 name: deploy
 
-# Autodeploy the edge Worker + Durable Objects (session/device rooms, R2,
-# WorkOS auth routes) on every push to main that touches edge/. Skips
+# Autodeploy the edge Worker + Durable Objects and web.zeron.sh assets
+# on every push to main that touches edge or web build inputs. Skips
 # gracefully until the CLOUDFLARE_API_TOKEN secret is configured (until then:
-# `npm -C edge run deploy` from a wrangler-authenticated machine).
+# build apps/web with the pinned toolchain below, then `npm -C edge run deploy`).
 #
 # The token needs: Workers Scripts (edit), Workers Routes (edit) on zeron.sh,
 # Workers R2 Storage (edit). Account id is pinned in edge/wrangler.jsonc.
@@ -20,6 +20,7 @@ concurrency:
 jobs:
   edge:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     env:
       # `secrets` is not a valid context in step `if:` expressions — surface
       # the token through job env and gate on that instead.
@@ -38,7 +39,7 @@ jobs:
             || [ -z "$before" ] || ! git cat-file -e "$before" 2>/dev/null; then
             echo "changed=true" >> "$GITHUB_OUTPUT"; exit 0
           fi
-          if git diff --name-only "$before" "$GITHUB_SHA" | grep -qE "^(edge/|\.github/workflows/deploy\.yml)"; then
+          if git diff --name-only "$before" "$GITHUB_SHA" | grep -E '^(edge/|apps/web/|crates/|vendor/|\.cargo/|Cargo\.(toml|lock)$|rust-toolchain(\.toml)?$|\.github/workflows/(deploy|web-validation)\.yml$)' > /dev/null; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
@@ -61,10 +62,55 @@ jobs:
         if: steps.changed.outputs.changed == 'true'
         working-directory: edge
         run: npm test
+      - name: Rust toolchain
+        if: steps.changed.outputs.changed == 'true'
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: nightly-2026-09-08
+          targets: wasm32-unknown-unknown
+          components: rust-src
+      - uses: Swatinem/rust-cache@v2
+        if: steps.changed.outputs.changed == 'true'
+        with:
+          workspaces: apps/web
+          cache-on-failure: true
+      - name: Install Trunk
+        if: steps.changed.outputs.changed == 'true'
+        run: cargo install trunk --locked --version 0.21.14
+      - name: Build web bundle
+        if: steps.changed.outputs.changed == 'true'
+        working-directory: apps/web
+        env:
+          RUSTUP_TOOLCHAIN: nightly-2026-09-08
+          CARGO_BUILD_JOBS: 2
+        run: env -u NO_COLOR trunk build --release --locked
+      - name: Check web assets
+        if: steps.changed.outputs.changed == 'true'
+        run: |
+          test -s apps/web/dist/index.html
+          cmp apps/web/_headers apps/web/dist/_headers
+          find apps/web/dist -name '*.wasm' -size +0c | grep .
+          oversized=$(find apps/web/dist -type f -size +26214400c)
+          if [ -n "$oversized" ]; then
+            printf 'Assets exceed the 25 MiB limit:\n%s\n' "$oversized"
+            exit 1
+          fi
+
+      - name: Local production routing preflight
+        if: steps.changed.outputs.changed == 'true'
+        working-directory: edge
+        timeout-minutes: 5
+        run: node scripts/production-routing.mjs
+
       - name: deploy
         if: steps.changed.outputs.changed == 'true' && env.CLOUDFLARE_API_TOKEN != ''
         working-directory: edge
         run: npx wrangler deploy
+      - name: Smoke test web.zeron.sh
+        if: steps.changed.outputs.changed == 'true' && env.CLOUDFLARE_API_TOKEN != ''
+        working-directory: edge
+        timeout-minutes: 5
+        run: node scripts/production-smoke.mjs https://web.zeron.sh
 
   # Static landing page (zeron.sh) — assets-only worker, no build step.
   landing:

.github/workflows/ui-tests.yml

@@ -71,6 +71,8 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: UI and headless layout regressions
         run: cargo test --release --locked -p zeron-ui --lib -- --test-threads=1
+      - name: Browser terminal input regressions
+        run: cargo test --release --locked -p zeron-ui --features web-input-tests --lib terminal::panel::input_tests -- --test-threads=1
 
   macos-frame-recovery:
     runs-on: macos-latest

.github/workflows/web-validation.yml

@@ -0,0 +1,125 @@
+name: Web validation
+
+on:
+  pull_request:
+    paths:
+      - 'apps/web/**'
+      - 'crates/**'
+      - 'vendor/**'
+      - '.cargo/**'
+      - 'edge/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - 'rust-toolchain'
+      - '.github/workflows/deploy.yml'
+      - '.github/workflows/web-validation.yml'
+  push:
+    paths:
+      - 'apps/web/**'
+      - 'crates/**'
+      - 'vendor/**'
+      - '.cargo/**'
+      - 'edge/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - 'rust-toolchain'
+      - '.github/workflows/deploy.yml'
+      - '.github/workflows/web-validation.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: web-validation-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  wasm:
+    name: Locked WASM build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - name: Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: nightly-2026-09-08
+          targets: wasm32-unknown-unknown
+          components: rust-src
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/web
+          cache-on-failure: true
+      - name: Install Trunk
+        run: cargo install trunk --locked --version 0.21.14
+      - name: Build web bundle
+        working-directory: apps/web
+        env:
+          RUSTUP_TOOLCHAIN: nightly-2026-09-08
+          CARGO_BUILD_JOBS: 2
+        run: env -u NO_COLOR trunk build --release --locked
+      - name: Check web assets
+        run: |
+          test -s apps/web/dist/index.html
+          cmp apps/web/_headers apps/web/dist/_headers
+          find apps/web/dist -name '*.wasm' -size +0c | grep .
+          oversized=$(find apps/web/dist -type f -size +26214400c)
+          if [ -n "$oversized" ]; then
+            printf 'Assets exceed the 25 MiB limit:\n%s\n' "$oversized"
+            exit 1
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: edge/package-lock.json
+      - name: Install edge packaging tools
+        working-directory: edge
+        run: npm ci
+      # Uses the production config without credentials or remote mutations.
+      - name: Package production Worker and web assets (dry run)
+        working-directory: edge
+        run: npx wrangler deploy --config wrangler.jsonc --dry-run --outdir dist
+      - name: Local production routing integration
+        working-directory: edge
+        timeout-minutes: 5
+        run: node scripts/production-routing.mjs
+
+  lifecycle:
+    name: Browser lifecycle tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/web/tests/lifecycle
+          cache-on-failure: true
+      - name: Run lifecycle tests
+        run: cargo test --locked --manifest-path apps/web/tests/lifecycle/Cargo.toml
+
+  edge:
+    name: Focused edge auth and device tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: edge
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: edge/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - name: Unit auth and frame tests
+        run: npm run test:unit -- src/browser-routes.test.ts src/device-frame.test.ts src/forwarded-headers.test.ts
+      - name: Workerd session and DeviceRoom tests
+        run: npm run test:workerd -- test/workerd/browser-discovery.workerd.test.ts test/workerd/browser-sessions.workerd.test.ts test/workerd/device-browser.workerd.test.ts test/workerd/browser-multi-user.workerd.test.ts