@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/migrations/0007_messaging.sql

@@ -0,0 +1,52 @@
+-- Shared storage for the opt-in cf-genai-base messaging feature.
+CREATE TABLE IF NOT EXISTS messaging_conversations (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL REFERENCES auth_tenants(id) ON DELETE CASCADE,
+  context TEXT NOT NULL,
+  title TEXT,
+  created_by_type TEXT,
+  created_by_key TEXT,
+  created_by_name TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE(tenant_id, context),
+  UNIQUE(tenant_id, id),
+  UNIQUE(tenant_id, id, context)
+);
+
+CREATE TABLE IF NOT EXISTS messaging_conversation_participants (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL REFERENCES auth_tenants(id) ON DELETE CASCADE,
+  conversation_id INTEGER NOT NULL,
+  participant_type TEXT NOT NULL,
+  participant_key TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE(tenant_id, conversation_id, participant_type, participant_key),
+  FOREIGN KEY (tenant_id, conversation_id)
+    REFERENCES messaging_conversations(tenant_id, id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS messaging_messages (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL REFERENCES auth_tenants(id) ON DELETE CASCADE,
+  conversation_id INTEGER NOT NULL,
+  context TEXT NOT NULL,
+  sender_type TEXT NOT NULL,
+  sender_key TEXT NOT NULL,
+  sender_name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  message_type TEXT NOT NULL DEFAULT 'text',
+  response_type TEXT,
+  audience_json TEXT NOT NULL DEFAULT '[]',
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  FOREIGN KEY (tenant_id, conversation_id, context)
+    REFERENCES messaging_conversations(tenant_id, id, context) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_messaging_conversations_context
+  ON messaging_conversations(tenant_id, context);
+CREATE INDEX IF NOT EXISTS idx_messaging_messages_thread
+  ON messaging_messages(tenant_id, conversation_id, id);

package/migrations/0008_messaging_tenant_integrity.sql

@@ -0,0 +1,44 @@
+-- Backstop existing databases created before messaging used composite foreign keys.
+CREATE TRIGGER IF NOT EXISTS messaging_participants_tenant_insert
+BEFORE INSERT ON messaging_conversation_participants
+WHEN NOT EXISTS (
+  SELECT 1 FROM messaging_conversations
+  WHERE id=NEW.conversation_id AND tenant_id=NEW.tenant_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'conversation tenant mismatch');
+END;
+
+CREATE TRIGGER IF NOT EXISTS messaging_participants_tenant_update
+BEFORE UPDATE OF tenant_id, conversation_id ON messaging_conversation_participants
+WHEN NOT EXISTS (
+  SELECT 1 FROM messaging_conversations
+  WHERE id=NEW.conversation_id AND tenant_id=NEW.tenant_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'conversation tenant mismatch');
+END;
+
+CREATE TRIGGER IF NOT EXISTS messaging_messages_context_insert
+BEFORE INSERT ON messaging_messages
+WHEN NOT EXISTS (
+  SELECT 1 FROM messaging_conversations
+  WHERE id=NEW.conversation_id
+    AND tenant_id=NEW.tenant_id
+    AND context=NEW.context
+)
+BEGIN
+  SELECT RAISE(ABORT, 'conversation tenant or context mismatch');
+END;
+
+CREATE TRIGGER IF NOT EXISTS messaging_messages_context_update
+BEFORE UPDATE OF tenant_id, conversation_id, context ON messaging_messages
+WHEN NOT EXISTS (
+  SELECT 1 FROM messaging_conversations
+  WHERE id=NEW.conversation_id
+    AND tenant_id=NEW.tenant_id
+    AND context=NEW.context
+)
+BEGIN
+  SELECT RAISE(ABORT, 'conversation tenant or context mismatch');
+END;

package/migrations/0009_healthcheck_measurements.sql

@@ -0,0 +1,3 @@
+-- Track the last persisted health measurement separately from manifest updates.
+ALTER TABLE core_healthchecks ADD COLUMN checked_at TEXT;
+CREATE INDEX IF NOT EXISTS core_healthchecks_checked_idx ON core_healthchecks(checked_at);

package/migrations/0010_admin_dashboard_refinements.sql

@@ -0,0 +1,24 @@
+ALTER TABLE auth_users ADD COLUMN active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0,1));
+ALTER TABLE auth_tenants ADD COLUMN active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0,1));
+ALTER TABLE auth_groups ADD COLUMN active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0,1));
+ALTER TABLE auth_scopes ADD COLUMN active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0,1));
+
+CREATE TABLE IF NOT EXISTS auth_group_scopes (
+  group_name TEXT NOT NULL REFERENCES auth_groups(name) ON DELETE CASCADE,
+  scope_name TEXT NOT NULL REFERENCES auth_scopes(name) ON DELETE CASCADE,
+  granted_by TEXT,
+  granted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (group_name, scope_name)
+);
+CREATE INDEX IF NOT EXISTS auth_group_scopes_scope_idx ON auth_group_scopes(scope_name);
+
+CREATE TABLE IF NOT EXISTS core_audit_log (
+  id TEXT PRIMARY KEY,
+  who TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  resource TEXT NOT NULL,
+  details_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS core_audit_log_created_idx ON core_audit_log(created_at DESC);
+CREATE INDEX IF NOT EXISTS core_audit_log_who_idx ON core_audit_log(who);

package/package.json

@@ -1,25 +1,142 @@
 {
   "name": "@agilesyndrome/cf-genai-base",
-  "version": "5.0.2",
+  "version": "6.0.0",
   "type": "module",
   "bin": {
     "cf-genai": "bin/cf-genai.js"
   },
   "exports": {
-    ".": "./src/index.js",
-    "./auth": "./src/auth/index.js",
-    "./data": "./src/data/index.js",
-    "./api": "./src/api/index.js",
-    "./event-hub": "./src/core/event-hub.js",
-    "./repository": "./src/repository.js",
-    "./app": "./src/app.js",
-    "./admin": "./src/admin/index.js",
-    "./core": "./src/core/index.js",
-    "./ui": "./src/ui/index.js",
-    "./ui/react": "./src/ui/react/index.jsx",
-    "./ui/styles.css": "./src/ui/styles.css",
-    "./cli": "./src/cli/cli.js",
-    "./cli/*": "./src/cli/*.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js",
+      "default": "./dist/auth/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "import": "./dist/admin/index.js",
+      "default": "./dist/admin/index.js"
+    },
+    "./data": {
+      "types": "./dist/data/index.d.ts",
+      "import": "./dist/data/index.js",
+      "default": "./dist/data/index.js"
+    },
+    "./api": {
+      "types": "./dist/api/index.d.ts",
+      "import": "./dist/api/index.js",
+      "default": "./dist/api/index.js"
+    },
+    "./event-hub": {
+      "types": "./dist/core/events/hub.d.ts",
+      "import": "./dist/core/events/hub.js",
+      "default": "./dist/core/events/hub.js"
+    },
+    "./repository": {
+      "types": "./dist/repository.d.ts",
+      "import": "./dist/repository.js",
+      "default": "./dist/repository.js"
+    },
+    "./app": {
+      "types": "./dist/app.d.ts",
+      "import": "./dist/app.js",
+      "default": "./dist/app.js"
+    },
+    "./domain": {
+      "types": "./dist/domain/index.d.ts",
+      "import": "./dist/domain/index.js",
+      "default": "./dist/domain/index.js"
+    },
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "default": "./dist/core/index.js"
+    },
+    "./core/circuits": {
+      "types": "./dist/core/circuits/index.d.ts",
+      "import": "./dist/core/circuits/index.js",
+      "default": "./dist/core/circuits/index.js"
+    },
+    "./core/database": {
+      "types": "./dist/core/database/index.d.ts",
+      "import": "./dist/core/database/index.js",
+      "default": "./dist/core/database/index.js"
+    },
+    "./core/events": {
+      "types": "./dist/core/events/index.d.ts",
+      "import": "./dist/core/events/index.js",
+      "default": "./dist/core/events/index.js"
+    },
+    "./core/healthchecks": {
+      "types": "./dist/core/healthchecks/index.d.ts",
+      "import": "./dist/core/healthchecks/index.js",
+      "default": "./dist/core/healthchecks/index.js"
+    },
+    "./core/jobs": {
+      "types": "./dist/core/jobs/index.d.ts",
+      "import": "./dist/core/jobs/index.js",
+      "default": "./dist/core/jobs/index.js"
+    },
+    "./core/security": {
+      "types": "./dist/core/security/index.d.ts",
+      "import": "./dist/core/security/index.js",
+      "default": "./dist/core/security/index.js"
+    },
+    "./auth/identity": {
+      "types": "./dist/auth/identity/index.d.ts",
+      "import": "./dist/auth/identity/index.js",
+      "default": "./dist/auth/identity/index.js"
+    },
+    "./ui": {
+      "types": "./dist/ui/index.d.ts",
+      "import": "./dist/ui/index.js",
+      "default": "./dist/ui/index.js"
+    },
+    "./ui/ssr": {
+      "types": "./dist/ui/ssr.d.ts",
+      "import": "./dist/ui/ssr.js",
+      "default": "./dist/ui/ssr.js"
+    },
+    "./ui/react": {
+      "types": "./dist/ui/react/index.d.ts",
+      "import": "./dist/ui/react/index.js",
+      "default": "./dist/ui/react/index.js"
+    },
+    "./ui/styles.css": "./dist/ui/styles.css",
+    "./features": {
+      "types": "./dist/features/index.d.ts",
+      "import": "./dist/features/index.js",
+      "default": "./dist/features/index.js"
+    },
+    "./features/llm": {
+      "types": "./dist/features/llm/index.d.ts",
+      "import": "./dist/features/llm/index.js",
+      "default": "./dist/features/llm/index.js"
+    },
+    "./input": {
+      "types": "./dist/input.d.ts",
+      "import": "./dist/input.js",
+      "default": "./dist/input.js"
+    },
+    "./features/messaging": {
+      "types": "./dist/features/messaging/index.d.ts",
+      "import": "./dist/features/messaging/index.js",
+      "default": "./dist/features/messaging/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/cli.d.ts",
+      "import": "./dist/cli/cli.js",
+      "default": "./dist/cli/cli.js"
+    },
+    "./cli/*": {
+      "types": "./dist/cli/*.d.ts",
+      "import": "./dist/cli/*.js",
+      "default": "./dist/cli/*.js"
+    }
   },
   "description": "Cloudflare Worker lifecycle, security, administration, and operational CLI helpers.",
   "engines": {
@@ -27,7 +144,8 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "react": "^19.0.0"
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -35,11 +153,11 @@
   },
   "files": [
     "bin",
-    "src",
+    "dist",
     "migrations",
     "README.md",
     "CLI.md",
-    "changelog.md",
+    "CHANGELOG.md",
     "CONTRACT.md",
     "LICENSE"
   ],
@@ -49,8 +167,31 @@
   },
   "homepage": "https://github.com/agilesyndrome/cf-genai-base#readme",
   "scripts": {
-    "check": "node --check bin/cf-genai.js && node --check src/index.js && node --check src/core/index.js && node --check src/core/jobs.js && node --check src/core/event-hub.js && node --check src/auth/index.js && node --check src/auth/oauth-single.js && node --check src/runtime/worker.js && node --check src/runtime/features.js && node --check src/runtime/health.js && node --check src/admin/index.js && node --check src/admin/routes.js && node --check src/data/index.js && node --check src/data/resources.js && node --check src/data/reader.js && node --check src/data/context.js && node --check src/api/index.js && node --check src/api/contracts.js && node --check src/api/client.js && node --check src/api/jobs.js && node --check src/ui/index.js && node --check src/cli/cli.js && node --check src/cli/d1.js && node --check src/cli/operations.js && node --check src/cli/project.js && node --check src/cli/status.js && node --check src/cli/tenants.js && node --check src/cli/users.js && node --check src/cli/version.js",
-    "test": "node --test tests/*.test.mjs",
-    "build": "npm run check && npm test && npm pack --dry-run"
+    "prepare": "node scripts/setup-git-hooks.mjs",
+    "clean": "node scripts/clean-dist.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "check": "npm run typecheck && npm run format:check && npm run lint:source",
+    "lint:source": "node scripts/lint-source.mjs",
+    "format": "node scripts/format-source.mjs --write",
+    "format:check": "node scripts/format-source.mjs && npm run lint:source -- --format-only",
+    "compile": "tsc -p tsconfig.build.json",
+    "assets": "node scripts/copy-build-assets.mjs",
+    "prepack": "npm run clean && npm run compile && npm run assets",
+    "verify:build": "node scripts/verify-build.mjs",
+    "test": "node --import tsx --test tests/*.test.mjs",
+    "test:integration": "node --import tsx --test examples/todo-list/test/integration.test.mjs",
+    "build": "npm run check && npm run prepack && npm test && npm run test:integration && npm run verify:build && npm pack --dry-run --ignore-scripts --loglevel=error"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260917.1",
+    "@types/node": "^22.20.3",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.1.9",
+    "react-dom": "^19.0.0",
+    "tsx": "^4.23.13",
+    "typescript": "^7.0.2"
+  },
+  "dependencies": {
+    "hono": "^4.13.8"
   }
 }

package/changelog.md

@@ -1,25 +0,0 @@
-# Changelog
-
-## Unreleased
-
-- Fold the complete `cf-genai` operational CLI into this package so Worker,
-  admin, healthcheck, circuit-breaker, D1, project, and release tooling share a
-  single version and installation.
-- Publish the `cf-genai` executable and the programmatic `/cli` entrypoint from
-  `@agilesyndrome/cf-genai-base`.
-- Make base CI validate the bundled CLI directly instead of downloading the
-  retired `@agilesyndrome/cf-genai-cli` package.
-
-## 5.0.0
-
-- Replace `@agilesyndrome/cf-genai-base/authorization` imports with `/auth`.
-- Replace direct `src/core.js` imports with `src/core/index.js` or the package `/core` entrypoint.
-- Replace direct `src/data.js` imports with `src/data/index.js` or the package `/data` entrypoint.
-- Replace direct `src/api/router.js` imports with `src/api/contracts.js` for route definitions and dispatch.
-- Update internal imports to the canonical folder modules; the old facade files are removed.
-- Update package consumers and lockfiles to version `5.0.0`.
-- Replace server-rendered admin HTML and custom elements with the React UI entrypoint; apps own the shell and theme around base's admin components.
-- Apply `migrations/0006_jobs.sql`; features now use generic durable job helpers and `GET /api/jobs` instead of inventing job tables and status endpoints.
-- Configure an `EVENT_HUB` Durable Object and export `EventHub` from `@agilesyndrome/cf-genai-base/event-hub` to enable authenticated live job events over WebSockets.
-- Dispatch long-running work through a Cloudflare Workflow with `dispatchJob`; execute its durable lifecycle with `executeJob` instead of relying on request-lifetime background work.
-- Remove the lowercase `admin_token` environment alias; use `ADMIN_TOKEN` only.

package/src/admin/index.js

@@ -1 +0,0 @@
-export * from "./routes.js";

package/src/admin/routes.js

@@ -1,64 +0,0 @@
-import { createAuthorizationTenant, createImpersonationToken, ensureScopes, ensureUser, getAuthorizationTenant, getAuthorizationUser, hasScope, listAuthorizationScopes, listAuthorizationTenants, listAuthorizationUsers, listGroups, listUserGroups, listUserGrants, listUserTenants, replaceUserGroups, replaceUserTenants, replaceUserGrants, updateAuthorizationTenant } from "../auth/index.js";
-import { getCircuitBreaker, listCircuitBreakers, listFeatureCatalog, listFeatureHealth, listHealthchecks, requestActor, setCircuitBreaker, updateHealthcheck } from "../core/index.js";
-
-export async function adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes, scopeRoutes, features }) {
-  const url = new URL(request.url);
-  if (!isAdminPath(url.pathname)) return next(request);
-  const strategy = String(env?.AUTH_STRATEGY || "http_basic").trim().toLowerCase();
-  if (strategy === "http_basic") { const user = basicUser(request, env); if (!user) return adminUnauthorized(request); state.user = user; }
-  else if (strategy === "oauth") { const user = Object.hasOwn(state, "user") ? state.user : provider?.getUser ? await provider.getUser(request, env) : null; if (!user) return oauthUnauthorized(request, url); state.user = user; }
-  else return new Response("Unsupported AUTH_STRATEGY", { status: 500, headers: { "Cache-Control": "no-store" } });
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(request.method) && url.pathname.startsWith("/api/")) { const origin = request.headers.get("Origin"); if (!origin || (() => { try { return new URL(origin).origin !== url.origin; } catch { return true; } })()) return Response.json({ error: "A same-origin request is required." }, { status: 403, headers: { "Cache-Control": "no-store" } }); }
-  const who = state.user?.auth_strategy === "http_basic" ? "user:admin" : `user:${state.user?.sub || "unknown"}`;
-  await ensureScopes(env, scopes, { who });
-  state.authUser = state.user?.authUser || await ensureUser(env, state.user, { who }); state.requestedBy = requestActor(state);
-  const requiredScope = requiredScopeFor(url.pathname, scopeRoutes); const scopeAllowed = !requiredScope || await hasScope(env, state.user, requiredScope, { who: requestActor(state) });
-  if (!scopeAllowed || (authorize && state.user.auth_strategy !== "http_basic" && !(await authorize({ request, url, user: state.user, env, ctx, state })))) return url.pathname.startsWith("/api/") ? Response.json({ error: "Administrator access is required." }, { status: 403, headers: { "Cache-Control": "no-store" } }) : new Response("Administrator access is required.", { status: 403, headers: { "Cache-Control": "no-store" } });
-  const platformResponse = await authorizationApi(request, env, url, state, features); if (platformResponse) return platformResponse;
-  return next(request);
-}
-
-async function authorizationApi(request, env, url, state, features = []) {
-  const grantsMatch = url.pathname.match(/\/api\/admin\/users\/([^/]+)\/scopes$/);
-  const platformPath = url.pathname === "/api/admin/users" || url.pathname === "/api/admin/tenants" || url.pathname.startsWith("/api/admin/tenants/") || url.pathname === "/api/admin/scopes" || url.pathname === "/api/admin/groups" || url.pathname.startsWith("/api/admin/users/") || url.pathname.startsWith("/api/admin/impersonate") || url.pathname === "/api/admin/status" || url.pathname === "/api/admin/features" || url.pathname === "/api/admin/healthchecks" || url.pathname === "/api/admin/circuit-breakers" || url.pathname.startsWith("/api/admin/healthchecks/") || url.pathname.startsWith("/api/admin/circuit-breakers/") || Boolean(grantsMatch);
-  if (!platformPath) return null;
-  if (!(state.user.auth_strategy === "http_basic" || (state.authUser && state.authUser.is_admin))) return Response.json({ error: "Administrator access is required." }, { status: 403, headers: { "Cache-Control": "no-store" } });
-  const who = { who: requestActor(state) };
-  if (url.pathname === "/api/admin/impersonate/clear" && request.method === "POST") return new Response(JSON.stringify({ ok: true }), { headers: { "content-type": "application/json; charset=utf-8", "Set-Cookie": "__Host-cfgenai_impersonation=; Max-Age=0; Path=/; Secure; HttpOnly; SameSite=Lax" } });
-  if (url.pathname === "/api/admin/users" && request.method === "GET") return Response.json({ users: await listAuthorizationUsers(env, who) });
-  if (url.pathname === "/api/admin/tenants" && request.method === "GET") return Response.json({ tenants: await listAuthorizationTenants(env, who) });
-  if (url.pathname === "/api/admin/tenants" && request.method === "POST") { const body = await request.json().catch(() => null); if (!body?.id || !body?.name) return Response.json({ error: "id and name are required" }, { status: 400 }); try { return Response.json({ tenant: await createAuthorizationTenant(env, body.id, body.name, who) }, { status: 201 }); } catch (error) { return Response.json({ error: error.message }, { status: 400 }); } }
-  const tenantMatch = url.pathname.match(/^\/api\/admin\/tenants\/([^/]+)$/);
-  if (tenantMatch && request.method === "GET") return Response.json({ tenant: await getAuthorizationTenant(env, decodeURIComponent(tenantMatch[1]), who) });
-  if (tenantMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body?.name) return Response.json({ error: "name is required" }, { status: 400 }); return Response.json({ tenant: await updateAuthorizationTenant(env, decodeURIComponent(tenantMatch[1]), body.name, who) }); }
-  const impersonateMatch = url.pathname.match(/^\/api\/admin\/users\/([^/]+)\/impersonate$/);
-  if (impersonateMatch && request.method === "POST") { const targetUser = await getAuthorizationUser(env, decodeURIComponent(impersonateMatch[1]), who); if (!targetUser) return Response.json({ error: "User not found." }, { status: 404 }); const token = await createImpersonationToken(env, state.authUser?.id || state.user?.sub || "admin", targetUser.id); return new Response(JSON.stringify({ ok: true, user: { id: targetUser.id, email: targetUser.email, display_name: targetUser.display_name }, expires_in: 900 }), { headers: { "content-type": "application/json; charset=utf-8", "Set-Cookie": `__Host-cfgenai_impersonation=${token}; Max-Age=900; Path=/; Secure; HttpOnly; SameSite=Lax` } }); }
-  if (url.pathname === "/api/admin/scopes" && request.method === "GET") return Response.json({ scopes: await listAuthorizationScopes(env, who) });
-  if (url.pathname === "/api/admin/status" && request.method === "GET") return Response.json({ features: await listFeatureHealth(env, who) });
-  if (url.pathname === "/api/admin/features" && request.method === "GET") return Response.json({ features: await listFeatureCatalog(env, features, who) });
-  if (url.pathname === "/api/admin/groups" && request.method === "GET") return Response.json({ groups: await listGroups(env, who) });
-  if (url.pathname === "/api/admin/healthchecks" && request.method === "GET") return Response.json({ healthchecks: await listHealthchecks(env, who) });
-  if (url.pathname === "/api/admin/circuit-breakers" && request.method === "GET") return Response.json({ circuit_breakers: await listCircuitBreakers(env, who) });
-  const healthcheckMatch = url.pathname.match(/\/api\/admin\/healthchecks\/([^/]+)$/);
-  if (healthcheckMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body?.state) return Response.json({ error: "state is required" }, { status: 400 }); const healthcheck = await updateHealthcheck(env, decodeURIComponent(healthcheckMatch[1]), body.state, who); return healthcheck ? Response.json({ healthcheck }) : Response.json({ error: "Healthcheck not found" }, { status: 404 }); }
-  const breakerMatch = url.pathname.match(/\/api\/admin\/circuit-breakers\/([^/]+)$/);
-  if (breakerMatch && request.method === "GET") return Response.json({ circuit_breaker: await getCircuitBreaker(env, decodeURIComponent(breakerMatch[1]), who) });
-  if (breakerMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body?.state) return Response.json({ error: "state is required" }, { status: 400 }); const breaker = await setCircuitBreaker(env, decodeURIComponent(breakerMatch[1]), body.state, who); return breaker ? Response.json({ circuit_breaker: breaker }) : Response.json({ error: "Circuit breaker not found" }, { status: 404 }); }
-  const groupsMatch = url.pathname.match(/\/api\/admin\/users\/([^/]+)\/groups$/);
-  if (groupsMatch && request.method === "GET") return Response.json({ groups: await listUserGroups(env, decodeURIComponent(groupsMatch[1]), who) });
-  if (groupsMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body || !Array.isArray(body.groups)) return Response.json({ error: "groups must be an array" }, { status: 400 }); return Response.json({ groups: await replaceUserGroups(env, decodeURIComponent(groupsMatch[1]), body.groups, state.authUser && state.authUser.id, who) }); }
-  const tenantsMatch = url.pathname.match(/\/api\/admin\/users\/([^/]+)\/tenants$/);
-  if (tenantsMatch && request.method === "GET") return Response.json({ tenants: await listUserTenants(env, decodeURIComponent(tenantsMatch[1]), who) });
-  if (tenantsMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body || !Array.isArray(body.tenants)) return Response.json({ error: "tenants must be an array" }, { status: 400 }); return Response.json({ tenants: await replaceUserTenants(env, decodeURIComponent(tenantsMatch[1]), body.tenants, who) }); }
-  if (grantsMatch && request.method === "GET") return Response.json({ grants: await listUserGrants(env, decodeURIComponent(grantsMatch[1]), who) });
-  if (grantsMatch && request.method === "PUT") { const body = await request.json().catch(() => null); if (!body || !Array.isArray(body.scopes)) return Response.json({ error: "scopes must be an array" }, { status: 400 }); const grants = await replaceUserGrants(env, decodeURIComponent(grantsMatch[1]), body.scopes, state.authUser && state.authUser.id, who); return Response.json({ grants }); }
-  return null;
-}
-
-function isAdminPath(pathname) { return pathname === "/admin" || pathname.startsWith("/admin/") || pathname === "/api/admin" || pathname.startsWith("/api/admin/"); }
-function requiredScopeFor(pathname, routes) { const route = routes.find((entry) => typeof entry.match === "function" ? entry.match(pathname) : pathname === entry.path || pathname.startsWith(String(entry.path || "") + "/")); return route && route.scope ? route.scope : null; }
-function basicUser(request, env) { const token = String(env?.ADMIN_TOKEN || ""); if (!token) return null; const header = request.headers.get("Authorization") || ""; if (!header.toLowerCase().startsWith("basic ")) return null; let decoded; try { decoded = atob(header.slice(6).trim()); } catch { return null; } const separator = decoded.indexOf(":"); if (separator < 0 || !constantTimeEqual(decoded.slice(0, separator), "admin") || !constantTimeEqual(decoded.slice(separator + 1), token)) return null; return { sub: "basic:admin", email: "", name: "admin", roles: ["admin"], auth_strategy: "http_basic" }; }
-function adminUnauthorized(request) { const headers = { "Cache-Control": "no-store", "WWW-Authenticate": "Basic realm=\"admin\", charset=\"UTF-8\"" }; return new URL(request.url).pathname.startsWith("/api/") ? Response.json({ error: "Authentication is required." }, { status: 401, headers }) : new Response("Authentication is required.", { status: 401, headers }); }
-function oauthUnauthorized(request, url) { if (url.pathname.startsWith("/api/")) return Response.json({ error: "Authentication is required." }, { status: 401, headers: { "Cache-Control": "no-store" } }); return Response.redirect(url.origin + "/auth/login?return_to=" + encodeURIComponent(safeReturnTo(url.pathname + url.search)), 302); }
-function safeReturnTo(value) { return value?.startsWith("/") && !value.startsWith("//") && !value.startsWith("/auth/") ? value : "/"; }
-function constantTimeEqual(a, b) { const aa = new TextEncoder().encode(a), bb = new TextEncoder().encode(b); let n = aa.length ^ bb.length; for (let i = 0; i < Math.max(aa.length, bb.length); i++) n |= (aa[i] || 0) ^ (bb[i] || 0); return n === 0; }

package/src/api/client.js

@@ -1,8 +0,0 @@
-export async function apiFetch(input, options = {}) {
-  const response = await fetch(input, { credentials: "same-origin", headers: { Accept: "application/json", ...(options.body ? { "Content-Type": "application/json" } : {}), ...(options.headers || {}) }, ...options });
-  const payload = await response.clone().json().catch(() => null);
-  if (!response.ok) { const error = new Error(payload?.error || `Request failed (${response.status})`); error.status = response.status; error.requestId = response.headers.get("X-Request-ID") || payload?.request_id || null; throw error; }
-  return payload === null ? response : payload;
-}
-
-export function apiJson(input, payload, options = {}) { return apiFetch(input, { ...options, method: options.method || "POST", body: JSON.stringify(payload) }); }

package/src/api/contracts.js

@@ -1,24 +0,0 @@
-import { json, requestIdentity, sameOrigin } from "../core/index.js";
-import { hasScope } from "../auth/index.js";
-
-export function defineRoute({ method = "GET", path, auth = "public", scope = null, csrf = false, handler } = {}) {
-  if (!path || typeof handler !== "function") throw new TypeError("API routes require path and handler");
-  return { method: String(method).toUpperCase(), path: String(path), auth, scope, csrf, handler };
-}
-
-export function matchRoute(request, route) {
-  const url = new URL(request.url); const methods = Array.isArray(route.method) ? route.method : [route.method];
-  return methods.map((method) => String(method).toUpperCase()).includes(request.method.toUpperCase()) && (typeof route.path === "function" ? route.path(url.pathname, request) : route.path === url.pathname);
-}
-
-export async function dispatchRoutes(request, env, ctx, state, routes = []) {
-  for (const route of routes) if (matchRoute(request, route)) {
-    const identity = requestIdentity(state);
-    if (route.auth === "user" && !identity.isAuthenticated) return json({ error: "Authentication is required." }, 401);
-    if (route.auth === "admin" && !identity.isAdmin) return json({ error: "Administrator access is required." }, 403);
-    if (route.csrf && !sameOrigin(request)) return json({ error: "A same-origin request is required." }, 403);
-    if (route.scope && !(await hasScope(env, state?.user || state?.authUser, route.scope, { who: identity.who }))) return json({ error: "Required scope is missing." }, 403);
-    return route.handler({ request, env, ctx, state, route, identity });
-  }
-  return null;
-}

package/src/api/index.js

@@ -1,7 +0,0 @@
-export { Event, emitEvent, json, readJson, readJsonClone, requireAdmin, requireFeatureCircuit, requireUser, sameOrigin, secureJson, secureText, userId, requestContext, requestIdentity } from "../core/index.js";
-export { defineRepository, createRepositories, RepositoryError } from "../repository.js";
-export { defineRoute, matchRoute, dispatchRoutes } from "./contracts.js";
-export { apiFetch, apiJson } from "./client.js";
-export { jobResponse, liveEventsResponse } from "./jobs.js";
-export { defineApp } from "../app.js";
-export { assertSecurityHeaders, assertJsonError } from "./testing.js";

package/src/api/jobs.js

@@ -1,37 +0,0 @@
-import { getJob, listJobEvents, listJobs } from "../core/jobs.js";
-import { requestIdentity } from "../core/identity.js";
-import { secureJson } from "../core/security.js";
-
-export async function jobResponse(request, env, state) {
-  const pathname = new URL(request.url).pathname;
-  if (pathname !== "/api/jobs" && !pathname.startsWith("/api/jobs/")) return null;
-  if (request.method !== "GET") return secureJson({ error: "Method not allowed" }, 405, { Allow: "GET" });
-  const identity = requestIdentity(state);
-  const ownerId = identity.authUser?.id || state?.user?.sub || (state?.user?.auth_strategy === "http_basic" ? "basic:admin" : null);
-  if (!ownerId) return secureJson({ error: "Authentication is required." }, 401);
-  const url = new URL(request.url);
-  const match = url.pathname.match(/^\/api\/jobs\/([^/]+)(?:\/events)?$/);
-  const isEvents = url.pathname.endsWith("/events");
-  if (!match) {
-    const jobs = await listJobs(env, { ownerId, type: url.searchParams.get("type") || undefined, status: url.searchParams.get("status") || undefined, limit: url.searchParams.get("limit") || 50 }, { who: identity.who });
-    return secureJson({ jobs });
-  }
-  const job = await getJob(env, decodeURIComponent(match[1]), { who: identity.who });
-  if (!job || (job.ownerId !== ownerId && !identity.isAdmin)) return secureJson({ error: "Job not found" }, 404);
-  if (isEvents) return secureJson({ events: await listJobEvents(env, job.id, { who: identity.who }) });
-  return secureJson({ job });
-}
-
-export async function liveEventsResponse(request, env, state, bindingName = "EVENT_HUB") {
-  const url = new URL(request.url);
-  if (url.pathname !== "/api/events") return null;
-  const identity = requestIdentity(state);
-  const ownerId = identity.authUser?.id || state?.user?.sub || (state?.user?.auth_strategy === "http_basic" ? "basic:admin" : null);
-  if (!ownerId) return secureJson({ error: "Authentication is required." }, 401);
-  const namespace = env?.[bindingName];
-  if (!namespace || typeof namespace.idFromName !== "function") return secureJson({ error: "Live events are not configured." }, 501);
-  if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return secureJson({ error: "WebSocket upgrade required." }, 426, { Upgrade: "websocket" });
-  const room = `user:${ownerId}`;
-  const stub = namespace.get(namespace.idFromName(room));
-  return stub.fetch("https://cf-genai-event-hub/connect", { headers: { Upgrade: "websocket" } });
-}

package/src/api/testing.js

@@ -1,13 +0,0 @@
-export function assertSecurityHeaders(response) {
-  for (const header of ["Content-Security-Policy", "X-Content-Type-Options", "X-Frame-Options", "Referrer-Policy", "Permissions-Policy", "Strict-Transport-Security"]) {
-    if (!response?.headers?.get(header)) throw new Error(`Missing security header: ${header}`);
-  }
-  return response;
-}
-
-export async function assertJsonError(response, status) {
-  if (response.status !== status) throw new Error(`Expected ${status}, received ${response.status}`);
-  const payload = await response.clone().json();
-  if (!payload?.error) throw new Error("Expected a JSON error envelope");
-  return payload;
-}

package/src/app.js

@@ -1,5 +0,0 @@
-export function defineApp({ name, ui = true, api = true, admin = true, features = [], repositories = [] } = {}) {
-  if (!/^[a-z][a-z0-9-]*$/.test(String(name || ""))) throw new TypeError("Apps require a safe name");
-  if (!ui && !api) throw new TypeError("An app must expose ui or api");
-  return { name: String(name), ui: Boolean(ui), api: Boolean(api), admin: Boolean(admin), features: [...features], repositories: [...repositories] };
-}

package/src/auth/encoding.js

@@ -1,6 +0,0 @@
-export function parseJsonValue(value) { try { return JSON.parse(value); } catch { return value; } }
-export function deepEqual(left, right) { return JSON.stringify(left) === JSON.stringify(right); }
-export async function signValue(value, secret) { const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(String(secret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]); const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value)); return base64url(new Uint8Array(signature)); }
-export function base64url(bytes) { return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", ""); }
-export function base64urlDecode(value) { const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4); return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0)); }
-export function constantTimeEqual(left, right) { const a = new TextEncoder().encode(String(left)), b = new TextEncoder().encode(String(right)); let result = a.length ^ b.length; for (let index = 0; index < Math.max(a.length, b.length); index += 1) result |= (a[index] || 0) ^ (b[index] || 0); return result === 0; }

package/src/auth/groups.js

@@ -1,5 +0,0 @@
-import { createD1 } from "../core/d1.js";
-
-export async function listGroups(env, { who = "system:read" } = {}) { const result = await createD1(env, { who }).prepare("SELECT name,display_name,description,created_at,updated_at FROM auth_groups ORDER BY display_name COLLATE NOCASE").all(); return result.results || []; }
-export async function listUserGroups(env, userId, { who = "system:read" } = {}) { const result = await createD1(env, { who }).prepare("SELECT group_name,granted_at FROM auth_user_groups WHERE user_id=? ORDER BY group_name").bind(userId).all(); return result.results || []; }
-export async function replaceUserGroups(env, userId, groups, grantedBy, { who = "system:read" } = {}) { const db = createD1(env, { who }); await db.batch([db.prepare("DELETE FROM auth_user_groups WHERE user_id=?").bind(userId), ...[...new Set(groups)].map((group) => db.prepare("INSERT INTO auth_user_groups (user_id,group_name,granted_by) VALUES (?,?,?)").bind(userId, group, grantedBy || null))]); return listUserGroups(env, userId, { who }); }

package/src/auth/impersonation.js

@@ -1,15 +0,0 @@
-import { base64url, base64urlDecode, constantTimeEqual, signValue } from "./encoding.js";
-
-export async function createImpersonationToken(env, adminUserId, targetUserId, { ttlSeconds = 900 } = {}) {
-  if (!env?.AUTH_SESSION_SECRET) throw new Error("AUTH_SESSION_SECRET is required for impersonation.");
-  const payload = { adminUserId: String(adminUserId || "admin"), targetUserId: String(targetUserId), exp: Math.floor(Date.now() / 1000) + Math.min(Math.max(Number(ttlSeconds) || 900, 60), 3600) };
-  const encoded = base64url(new TextEncoder().encode(JSON.stringify(payload)));
-  return `${encoded}.${await signValue(encoded, env?.AUTH_SESSION_SECRET || "")}`;
-}
-
-export async function verifyImpersonationToken(token, env) {
-  if (!env?.AUTH_SESSION_SECRET) return null;
-  const [encoded, signature] = String(token || "").split(".");
-  if (!encoded || !signature || !constantTimeEqual(signature, await signValue(encoded, env?.AUTH_SESSION_SECRET || ""))) return null;
-  try { const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(encoded))); return payload.exp > Date.now() / 1000 && payload.targetUserId ? payload : null; } catch { return null; }
-}

package/src/auth/index.js

@@ -1,8 +0,0 @@
-export * from "./constants.js";
-export * from "./scopes.js";
-export * from "./users.js";
-export * from "./tenants.js";
-export * from "./groups.js";
-export * from "./subscriptions.js";
-export * from "./impersonation.js";
-export * from "./oauth-single.js";