fix(host): extract show-token from packed orionUrl for bundle auth

[ClodoCapeo]

Cause (the last live-finale link)

BUNDLE_FETCH_FAILED: 401 on GET …/orion/api/v1/scenes/{id}/render-bundle?v={hash} → black frame.

The runtime (@lumencast/runtime 0.6.0) is correct end-to-end: mount.ts wires getAuthToken: () => ws.resolveCurrentToken(), which returns MountOptions.token, and the bundle fetcher attaches Authorization: Bearer <token> iff that token is non-empty. The runtime does not mine the WS URL for a token — it relies on the explicit token option.

The bug is purely Solar host-entry. The Pulsar browser source packs everything into one URL:

index.html?orion=wss://zabgate.cyell.dev/orion/api/v1/show/stream.lsdp?token=<SHOW>&mode=broadcast

The show-token lives inside the orion= value's query, not as a top-level ?token=. host-entry.tsx/dev-entry.tsx read params.get("token") → "" → mount({ token: "" }) → empty resolveCurrentToken() → header-less fetch → 401. This is the missing half of the 0.2.6 runtime fix, which assumed Solar already forwarded the token.

Fix — Solar-only (0.2.8), no Lumencast release

New pure helper resolveShowToken(orionUrl, explicitToken): explicit top-level ?token= wins, else the token embedded in orionUrl, else "". Both entries use it and pass the result to mount({ token }). The runtime then attaches Authorization: Bearer <show-token>.

• No @lumencast/runtime change, no new dependency.
• mount() / SolarError public surface unchanged (patch).
• ?token= deliberately stays out of the bundle URL (orion-bundle-url.ts drops the query) — per the proof matrix, query-token = 401; header = 200.

Empirical proof (not "it compiles")

tests/unit/bundle-fetch-auth.test.tsx mounts the real runtime via Solar's mount() against the browser-source URL shape (fake WS + fake fetch), drives a snapshot, and asserts:

• the bundle GET carries Authorization: Bearer <show-token>;
• with no token in the URL, the fetch is header-less (regression guard — the exact old-path failure).

Plus resolve-show-token.test.ts (5 unit cases). Confirmed in the built host bundle: searchParams.get("token") + getAuthToken + Authorization all present.

Verification (run, not asserted)

• npm run lint (src/ + tests/) → clean
• npm run typecheck → clean
• npm test → 29 passed
• npm run build → green (host bundle regenerated)

Release / deploy (Keeper)

Solar = vendored/static-served artifact, no auto-deploy. On merge: tag v0.2.8 → release.yml publishes dist/ (CHANGELOG 0.2.8 entry ready). Then Orion static-serves the new bundle and/or Prism vendors resources/solar/v0.2.8/. The Pulsar browser source needs no change — same packed URL.

🤖 Generated with Claude Code