@brutal-ai/server 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,9 @@
-# Temporary Holding Version
+# @brutal-ai/server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[Brutal](https://github.com/cldixon/brutal): feedback from your agents, on your own Cloudflare
+account. This package is the prebuilt Worker, the `defineBrutal` config helper and the
+`brutal-server` CLI. Start with:
+
+```sh
+bun create brutal-ai my-brutal
+```

package/cli.js

@@ -0,0 +1,254 @@
+#!/usr/bin/env bun
+// @bun
+
+// worker/cli/brutal-server.ts
+import { writeFileSync } from "fs";
+import { basename } from "path";
+var {$ } = globalThis.Bun;
+
+// worker/config.ts
+import { existsSync, readFileSync } from "fs";
+import { isAbsolute, join } from "path";
+import { bindings, defineConfig } from "cf/config";
+var CONFIG_FILE = "brutal.config.json";
+var DEFAULTS = { worker: "brutal" };
+var ENV = {
+  worker: "BRUTAL_WORKER",
+  database: "BRUTAL_DATABASE",
+  domain: "BRUTAL_DOMAIN"
+};
+function configPath(dir) {
+  const named = process.env.BRUTAL_CONFIG;
+  return named ? isAbsolute(named) ? named : join(dir, named) : join(dir, CONFIG_FILE);
+}
+function readConfigFile(dir) {
+  const path = configPath(dir);
+  if (!existsSync(path)) {
+    if (process.env.BRUTAL_CONFIG && !process.env.BRUTAL_SETUP) {
+      throw new Error(`BRUTAL_CONFIG points at ${path}, which doesn't exist`);
+    }
+    return null;
+  }
+  return JSON.parse(readFileSync(path, "utf-8"));
+}
+function loadBrutalConfig(dir, { allowDefaults = false } = {}) {
+  const file = readConfigFile(dir);
+  const env = {};
+  for (const [key, name] of Object.entries(ENV)) {
+    const value = process.env[name];
+    if (value !== undefined)
+      env[key] = value || null;
+  }
+  if (!file && !env.worker && !allowDefaults && !process.env.BRUTAL_SETUP) {
+    throw new Error(`No ${CONFIG_FILE} in ${dir}. Run \`bun run setup\` to make one, ` + "or set BRUTAL_WORKER (and BRUTAL_DOMAIN) in the environment.");
+  }
+  const config = { ...DEFAULTS, ...file, ...env };
+  if (!config.worker)
+    throw new Error(`${CONFIG_FILE} needs a worker name`);
+  return config;
+}
+
+// worker/cli/access.ts
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+async function ensureAccess(cf, want, dryRun = false) {
+  const emails = [...new Set(want.emails.map((e) => e.trim().toLowerCase()).filter(Boolean))];
+  if (emails.length === 0 || emails.some((e) => !e.includes("@"))) {
+    throw new Error("Access needs at least one email address to let in.");
+  }
+  const changes = [];
+  const org = await cf(["organization", "get"]);
+  const team = org?.auth_domain ?? "";
+  if (!team) {
+    throw new Error("This Cloudflare account has no Zero Trust organization yet. Open Zero Trust in the " + "Cloudflare dashboard once to create one (the Free plan is enough), then run this again.");
+  }
+  const idps = await cf(["identity-providers", "list"]) ?? [];
+  let otp = idps.find((i) => i.type === "onetimepin");
+  if (!otp) {
+    changes.push("create the one-time PIN login");
+    otp = dryRun ? { id: "(new)", type: "onetimepin" } : await cf(["identity-providers", "create"], {
+      name: "One-time PIN",
+      type: "onetimepin",
+      config: {}
+    });
+  }
+  const policyName = `Brutal ${want.worker}: owners`;
+  const policyBody = {
+    name: policyName,
+    decision: "allow",
+    include: emails.map((email) => ({ email: { email } })),
+    exclude: [],
+    require: []
+  };
+  const policies = await cf(["access", "policies", "list"]) ?? [];
+  let policy = policies.find((p) => p.name === policyName);
+  if (!policy) {
+    changes.push(`create the policy "${policyName}" (allow ${emails.join(", ")})`);
+    policy = dryRun ? { id: "(new)", ...policyBody } : await cf(["access", "policies", "create"], policyBody);
+  } else if (policy.decision !== "allow" || !same(policy.include, policyBody.include)) {
+    changes.push(`correct the policy "${policyName}" (allow ${emails.join(", ")} only)`);
+    if (!dryRun) {
+      policy = await cf(["access", "policies", "update", policy.id], policyBody);
+    }
+  }
+  const domain = `${want.host}/dashboard`;
+  const title = `Brutal (${want.host})`;
+  const appBody = {
+    name: title,
+    domain,
+    type: "self_hosted",
+    session_duration: want.sessionDuration,
+    allowed_idps: [otp.id],
+    auto_redirect_to_identity: true,
+    app_launcher_visible: false,
+    policies: [{ id: policy.id, precedence: 1 }]
+  };
+  const apps = await cf(["access", "applications", "list"]) ?? [];
+  let app = apps.find((a) => a.domain === domain);
+  if (!app) {
+    changes.push(`create the application for ${domain} (${want.sessionDuration} sessions)`);
+    if (!dryRun)
+      app = await cf(["access", "applications", "create"], appBody);
+  } else if (app.name !== title || app.type !== "self_hosted" || app.session_duration !== want.sessionDuration || !same(app.allowed_idps, [otp.id]) || app.auto_redirect_to_identity !== true || !same((app.policies ?? []).map((p) => p.id), [policy.id])) {
+    changes.push(`correct the application for ${domain}`);
+    if (!dryRun)
+      app = await cf(["access", "applications", "update", app.id], appBody);
+  }
+  return { team, aud: app?.aud ?? "", changes };
+}
+function parseCfJson(stdout) {
+  const lines = stdout.split(`
+`);
+  const start = lines.findIndex((l) => l.startsWith("[") || l.startsWith("{"));
+  if (start === -1)
+    return null;
+  return JSON.parse(lines.slice(start).join(`
+`));
+}
+
+// worker/cli/brutal-server.ts
+var root = process.cwd();
+var [command, ...rest] = process.argv.slice(2);
+process.env.CF_SEND_TELEMETRY ??= "false";
+var commands = { setup, deploy, secrets, dev, access };
+var run = command ? commands[command] : undefined;
+if (!run) {
+  console.log("Usage: brutal-server <setup|deploy|secrets|dev|access>");
+  process.exit(command ? 1 : 0);
+}
+await run();
+async function requireAuth() {
+  const whoami = await $`bunx cf auth whoami`.nothrow().quiet();
+  let authenticated = false;
+  try {
+    authenticated = whoami.exitCode === 0 && JSON.parse(whoami.stdout.toString()).authenticated;
+  } catch {}
+  if (!authenticated) {
+    console.error("Not signed in to Cloudflare. Run: bunx cf auth login");
+    process.exit(1);
+  }
+}
+async function setup() {
+  console.log(`
+Brutal setup
+`);
+  process.env.BRUTAL_SETUP = "1";
+  await requireAuth();
+  const current = readConfigFile(root) ?? {};
+  const worker = prompt(`Worker name [${current.worker ?? DEFAULTS.worker}]:`)?.trim();
+  const domainAnswer = prompt(`Custom domain, on a zone in your Cloudflare account (blank for none, "-" to remove) [${current.domain ?? ""}]:`)?.trim();
+  const domain = domainAnswer === "-" ? "" : domainAnswer || current.domain || "";
+  const config = {
+    ...current,
+    worker: worker || current.worker || DEFAULTS.worker,
+    domain: domain || null
+  };
+  writeFileSync(configPath(root), `${JSON.stringify(config, null, 2)}
+`);
+  console.log(`
+\u2713 Wrote ${basename(configPath(root))}`);
+  console.log(domain ? `\u2713 ${domain} will route to this Worker (its zone must be on your account)` : "\u2713 No custom domain: it will be served from *.workers.dev");
+  console.log(`
+Next: bun run deploy
+`);
+}
+async function workerExists(worker) {
+  return (await $`bunx cf workers secrets list --worker ${worker}`.nothrow().quiet()).exitCode === 0;
+}
+async function deploy() {
+  const { worker } = loadBrutalConfig(root);
+  const existed = await workerExists(worker);
+  const code = await interactive(["bunx", "cf", "deploy", ...rest]);
+  if (code !== 0)
+    process.exit(code);
+  if (existed || rest.includes("--dry-run"))
+    return;
+  if (process.env.CI) {
+    console.log(`
+No setup code was set here, since CI logs may be public.`);
+    console.log("Run `bun run secrets` on your own machine for one before you claim it.\n");
+    return;
+  }
+  await secrets();
+}
+async function secrets() {
+  const { worker } = loadBrutalConfig(root);
+  const bytes = crypto.getRandomValues(new Uint8Array(9));
+  const setupCode = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  await $`bunx cf workers secrets update SETUP_CODE --worker ${worker} --type secret_text --text ${setupCode}`.quiet();
+  console.log(`
+\u2713 SETUP_CODE set on ${worker}`);
+  console.log(`
+Setup code: ${setupCode}`);
+  console.log(`Open /setup on your instance and enter it to make your keys.
+`);
+}
+async function access() {
+  const dryRun = rest.includes("--dry-run");
+  await requireAuth();
+  const current = readConfigFile(root);
+  const config = loadBrutalConfig(root);
+  if (!config.domain) {
+    console.error("Access needs a custom domain: run `bun run setup` and give one, deploy, then run this.");
+    process.exit(1);
+  }
+  let emails = config.access?.emails ?? [];
+  if (emails.length === 0) {
+    const answer = prompt("Email(s) allowed to sign in to the dashboard, comma-separated:");
+    emails = (answer ?? "").split(",").map((e) => e.trim()).filter(Boolean);
+  }
+  const cf = async (args, body) => {
+    const extra = body === undefined ? [] : ["--body", JSON.stringify(body)];
+    const out = await $`bunx cf zero-trust ${args} ${extra}`.nothrow().quiet();
+    if (out.exitCode !== 0) {
+      throw new Error(`cf zero-trust ${args.join(" ")} failed: ${out.stderr.toString() || out.stdout.toString()}`);
+    }
+    return parseCfJson(out.stdout.toString());
+  };
+  console.log(`
+Cloudflare Access for https://${config.domain}/dashboard
+`);
+  const ensured = await ensureAccess(cf, { host: config.domain, worker: config.worker, emails, sessionDuration: "24h" }, dryRun);
+  for (const change of ensured.changes)
+    console.log(`${dryRun ? "Would" : "\u2713"} ${change}`);
+  if (ensured.changes.length === 0)
+    console.log("\u2713 Access is already as it should be");
+  if (dryRun)
+    return;
+  const next = {
+    ...current ?? config,
+    worker: current?.worker ?? config.worker,
+    access: { emails, team: ensured.team, aud: ensured.aud }
+  };
+  writeFileSync(configPath(root), `${JSON.stringify(next, null, 2)}
+`);
+  console.log(`\u2713 Wrote the team and application to ${basename(configPath(root))}`);
+  console.log(`
+Next: bun run deploy. The dashboard then signs in with a code mailed to you.
+`);
+}
+async function dev() {
+  process.exit(await interactive(["bunx", "cf", "dev", "--port", "8787", ...rest]));
+}
+function interactive(cmd) {
+  return Bun.spawn(cmd, { cwd: root, stdio: ["inherit", "inherit", "inherit"] }).exited;
+}

package/config.d.ts

@@ -0,0 +1,21 @@
+/** A Brutal instance's settings, as brutal.config.json holds them. */
+export type BrutalConfig = {
+  /** Worker name. Also names the D1 database unless `database` is set. */
+  worker: string;
+  /** D1 database for reports and keys. Defaults to the Worker name. */
+  database?: string;
+  /** Custom domain on a zone in your Cloudflare account. Without one, workers.dev serves it. */
+  domain?: string | null;
+  /** Cloudflare Access in front of /dashboard; `brutal-server access` sets it up. */
+  access?: { emails: string[]; team?: string; aud?: string } | null;
+};
+
+/**
+ * The Brutal Worker's cf config, from the brutal.config.json in `dir`. Use as the default export
+ * of cloudflare.config.ts:
+ *
+ *   export default defineBrutal({ dir: import.meta.dirname });
+ */
+export function defineBrutal(options: { dir: string; entrypoint?: string }): unknown;
+
+export function loadBrutalConfig(dir: string, options?: { allowDefaults?: boolean }): BrutalConfig;

package/config.js

@@ -0,0 +1,79 @@
+// worker/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { bindings, defineConfig } from "cf/config";
+var CONFIG_FILE = "brutal.config.json";
+var DEFAULTS = { worker: "brutal" };
+var ENV = {
+  worker: "BRUTAL_WORKER",
+  database: "BRUTAL_DATABASE",
+  domain: "BRUTAL_DOMAIN"
+};
+function configPath(dir) {
+  const named = process.env.BRUTAL_CONFIG;
+  return named ? isAbsolute(named) ? named : join(dir, named) : join(dir, CONFIG_FILE);
+}
+function readConfigFile(dir) {
+  const path = configPath(dir);
+  if (!existsSync(path)) {
+    if (process.env.BRUTAL_CONFIG && !process.env.BRUTAL_SETUP) {
+      throw new Error(`BRUTAL_CONFIG points at ${path}, which doesn't exist`);
+    }
+    return null;
+  }
+  return JSON.parse(readFileSync(path, "utf-8"));
+}
+function loadBrutalConfig(dir, { allowDefaults = false } = {}) {
+  const file = readConfigFile(dir);
+  const env = {};
+  for (const [key, name] of Object.entries(ENV)) {
+    const value = process.env[name];
+    if (value !== undefined)
+      env[key] = value || null;
+  }
+  if (!file && !env.worker && !allowDefaults && !process.env.BRUTAL_SETUP) {
+    throw new Error(`No ${CONFIG_FILE} in ${dir}. Run \`bun run setup\` to make one, ` + "or set BRUTAL_WORKER (and BRUTAL_DOMAIN) in the environment.");
+  }
+  const config = { ...DEFAULTS, ...file, ...env };
+  if (!config.worker)
+    throw new Error(`${CONFIG_FILE} needs a worker name`);
+  return config;
+}
+function defineBrutal({ dir, entrypoint }) {
+  return defineConfig(() => {
+    const argv = process.argv;
+    const brutal = loadBrutalConfig(dir, {
+      allowDefaults: argv.includes("dev") || argv.includes("types")
+    });
+    const domain = brutal.domain || null;
+    const access = domain && brutal.access?.team && brutal.access.aud ? brutal.access : null;
+    return {
+      worker: {
+        name: brutal.worker,
+        compatibilityDate: "2026-10-01",
+        compatibilityFlags: ["nodejs_compat"],
+        entrypoint: entrypoint ?? join(import.meta.dirname, "worker", "index.js"),
+        observability: { enabled: true },
+        ...domain && { domains: [domain] },
+        workersDev: !domain,
+        previewUrls: false,
+        env: {
+          DB: bindings.d1({ name: brutal.database ?? brutal.worker }),
+          ...access && {
+            ACCESS_TEAM: bindings.text(access.team ?? ""),
+            ACCESS_AUD: bindings.text(access.aud ?? ""),
+            ACCESS_EMAILS: bindings.text(access.emails.join(","))
+          }
+        }
+      }
+    };
+  });
+}
+export {
+  CONFIG_FILE,
+  DEFAULTS,
+  configPath,
+  defineBrutal,
+  loadBrutalConfig,
+  readConfigFile
+};

package/package.json

@@ -1,6 +1,35 @@
 {
+  "version": "0.2.0",
+  "license": "MIT",
   "name": "@brutal-ai/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "description": "Brutal: feedback from your agents, deployed to your own Cloudflare account",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cldixon/brutal.git",
+    "directory": "worker"
+  },
+  "bin": {
+    "brutal-server": "cli.js"
+  },
+  "exports": {
+    "./config": {
+      "types": "./config.d.ts",
+      "default": "./config.js"
+    }
+  },
+  "files": [
+    "cli.js",
+    "config.js",
+    "config.d.ts",
+    "worker",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "cf": "1.0.0-beta.28",
+    "wrangler": "^4.149.0"
+  },
+  "engines": {
+    "bun": ">=1.2.0"
+  }
+}