Numeracode · messagesgoel-blip · Aug 7, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -210,3 +210,39 @@ jobs:
           if [ -f /tmp/verilink-trust-engine.pid ]; then
             kill "$(cat /tmp/verilink-trust-engine.pid)" || true
           fi
+
+  dashboard:
+    name: Dashboard
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    defaults:
+      run:
+        working-directory: dashboard
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Build
+        run: npm run build
+        env:
+          VITE_AUTH_MODE: apikey
diff --git a/.gitignore b/.gitignore
@@ -2,3 +2,10 @@ auto_merge.log
 .codero/
 *.log
 /edge-verifier
+
+# Node / build artifacts
+node_modules/
+**/node_modules/
+control-plane/dist/
+dashboard/dist/
+*.tsbuildinfo
diff --git a/control-plane/src/app.ts b/control-plane/src/app.ts
@@ -14,6 +14,7 @@ import attestationsRouter from './routes/attestations.js';
 import syncRouter from './routes/sync.js';
 import adminRouter from './routes/admin.js';
 import decisionsRouter from './routes/decisions.js';
+import { mountDashboardSpa } from './dashboard/spaServe.js';
 
 export function createApp() {
   const app = express();
@@ -52,6 +53,9 @@ export function createApp() {
   // app.use('/v1/edge-nodes', edgenodesRouter);
   // app.use('/v1/tenants', tenantsRouter);
 
+  // Dashboard SPA (after API routes; skips /v1, /webhooks, /healthz)
+  mountDashboardSpa(app);
+
   // 404 catch-all
   app.use((_req, res) => {
     error(res, new AppError(CODES.NOT_FOUND, 'Route not found'));

diff --git a/control-plane/src/config.ts b/control-plane/src/config.ts
@@ -68,6 +68,10 @@ export const config = Object.freeze({
   apiKey: Object.freeze({
     hmacSecret: optional('API_KEY_HMAC_SECRET'),
   }),
+  dashboard: Object.freeze({
+    // Absolute or relative path to Vite build output. Empty → try ../dashboard/dist.
+    distPath: optional('DASHBOARD_DIST_PATH'),
+  }),
 });
 
 export function assertDatabaseConfigured(): void {

diff --git a/control-plane/src/dashboard/spaServe.test.ts b/control-plane/src/dashboard/spaServe.test.ts
@@ -0,0 +1,75 @@
+/**
+ * Dashboard SPA static mount (no DB required).
+ */
+process.env.API_KEY_HMAC_SECRET ||= 'test-hmac-secret-for-unit';
+
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createServer, type Server } from 'node:http';
+import type { Express } from 'express';
+
+describe('dashboard SPA serve', () => {
+  let distDir: string;
+  let server: Server;
+  let baseUrl: string;
+
+  before(async () => {
+    distDir = await mkdtemp(path.join(tmpdir(), 'verilink-dash-'));
+    await writeFile(
+      path.join(distDir, 'index.html'),
+      '<!doctype html><html><body><div id="root">VeriLink SPA</div></body></html>\n',
+      'utf8'
+    );
+    await writeFile(path.join(distDir, 'asset.txt'), 'static-ok\n', 'utf8');
+    process.env.DASHBOARD_DIST_PATH = distDir;
+
+    const { createApp } = await import('../app.js');
+    const app: Express = createApp();
+    server = createServer(app);
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const addr = server.address();
+    const port = typeof addr === 'object' && addr ? addr.port : 0;
+    baseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  after(async () => {
+    await new Promise<void>((resolve, reject) => {
+      server.close((err) => (err ? reject(err) : resolve()));
+    });
+    await rm(distDir, { recursive: true, force: true });
+    delete process.env.DASHBOARD_DIST_PATH;
+  });
+
+  it('serves index.html for SPA paths', async () => {
+    const res = await fetch(`${baseUrl}/provider`);
+    assert.equal(res.status, 200);
+    const html = await res.text();
+    assert.match(html, /VeriLink SPA/);
+  });
+
+  it('serves static assets from dist', async () => {
+    const res = await fetch(`${baseUrl}/asset.txt`);
+    assert.equal(res.status, 200);
+    assert.equal((await res.text()).trim(), 'static-ok');
+  });
+
+  it('keeps /healthz as JSON', async () => {
+    const res = await fetch(`${baseUrl}/healthz`);
+    assert.equal(res.status, 200);
+    const body = (await res.json()) as { ok: boolean };
+    assert.equal(body.ok, true);
+  });
+
+  it('keeps unknown /v1 routes as API 404 JSON', async () => {
+    const res = await fetch(`${baseUrl}/v1/does-not-exist`);
+    assert.equal(res.status, 404);
+    const body = (await res.json()) as { ok?: boolean };
+    assert.notEqual(body.ok, true);
+  });
+});
diff --git a/control-plane/src/dashboard/spaServe.ts b/control-plane/src/dashboard/spaServe.ts
@@ -0,0 +1,61 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import type { Express, NextFunction, Request, Response } from 'express';
+import express from 'express';
+import { config } from '../config.js';
+import { logger } from '../shared/logger.js';
+
+/** Resolve dashboard dist directory; empty string means "do not mount". */
+export function resolveDashboardDistPath(): string {
+  // Prefer live env so tests can set DASHBOARD_DIST_PATH after config freeze.
+  const fromEnv = (process.env.DASHBOARD_DIST_PATH || config.dashboard.distPath || '').trim();
+  if (fromEnv) return path.resolve(fromEnv);
+  return path.resolve(process.cwd(), '../dashboard/dist');
+}
+
+function isSpaBypassPath(reqPath: string): boolean {
+  return (
+    reqPath === '/healthz' ||
+    reqPath.startsWith('/v1/') ||
+    reqPath.startsWith('/webhooks/')
+  );
+}
+
+/**
+ * Serve the Vite dashboard build (static assets + SPA fallback).
+ * Must be mounted after API routes; never shadows /v1, /webhooks, /healthz.
+ * No-ops when index.html is missing (local CP without a dashboard build).
+ */
+export function mountDashboardSpa(app: Express): void {
+  const dist = resolveDashboardDistPath();
+  const indexHtml = path.join(dist, 'index.html');
+  if (!fs.existsSync(indexHtml)) {
+    logger.info({ dist }, 'dashboard dist not found; SPA not mounted');
+    return;
+  }
+
+  app.use(
+    express.static(dist, {
+      index: false,
+      fallthrough: true,
+      // Hashed assets can be cached; HTML stays no-store via earlier middleware.
+      maxAge: '1h',
+    })
+  );
+
+  app.use((req: Request, res: Response, next: NextFunction) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      next();
+      return;
+    }
+    if (isSpaBypassPath(req.path)) {
+      next();
+      return;
+    }
+    res.sendFile(indexHtml, (err) => {
+      if (err) next(err);
+    });
+  });
+
+  logger.info({ dist }, 'dashboard SPA mounted');
+}
diff --git a/dashboard/README.md b/dashboard/README.md
@@ -0,0 +1,38 @@
+# VeriLink Dashboard
+
+Vite + React SPA for provider, agent-builder, and admin views (Plan 9).
+
+## Dev
+
+```bash
+# Terminal 1 — control plane
+cd control-plane && npm run dev
+
+# Terminal 2 — dashboard (proxies /v1 to CP)
+cd dashboard && npm install && npm run dev
+```
+
+Env (`.env.local`):
+
+| Variable | Notes |
+|----------|--------|
+| `VITE_API_BASE_URL` | Empty in dev (use Vite proxy). Absolute CP origin in production builds if not same-origin. |
+| `VITE_AUTH_MODE` | `apikey` (CI/local) or `oidc` (Clerk PKCE — production). |
+| `VITE_OIDC_ISSUER_URL` / `VITE_OIDC_CLIENT_ID` | Required when `oidc`. |
+| `VITE_DEV_PROXY_TARGET` | Default `http://127.0.0.1:3000`. |
+
+## Production
+
+```bash
+cd dashboard && npm ci && npm run build
+# Serve via control plane:
+DASHBOARD_DIST_PATH=/absolute/path/to/dashboard/dist npm start  # in control-plane
+```
+
+Default resolve: `control-plane` looks for `../dashboard/dist` relative to cwd when `DASHBOARD_DIST_PATH` is unset.
+
+## Auth
+
+- **apikey:** paste a `vrl_` key; stored in `sessionStorage`; sent as `Authorization: Bearer`.
+- **oidc:** Authorization Code + PKCE against Clerk generic OIDC (no Clerk session SDK).
+- Active tenant: `X-Tenant-Id` on all API calls (selector in shell).
diff --git a/dashboard/index.html b/dashboard/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>VeriLink</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>