@frockbot/cloudflare 0.0.0 → 0.7.291

package/src/bot-template-cleanup.ts

@@ -0,0 +1,98 @@
+// Disposable pre-user cleanup for the removed Bot templates.
+//
+// Bot templates were removed. Their share ledger, import records and command
+// receipts lived in the User Durable Object under `bot-template:`, each shared
+// recipe was a content-addressed blob at `templates/<hash>.json` in the
+// artifact bucket, and every account was seeded an installation row for the
+// `bot-template` Package. This deletes the blob each share record names, then
+// every `bot-template:` key, then that row. A blob is only ever written beside
+// its share record, so the records are the whole index of what to delete. The
+// receipt makes a second load free.
+
+const RECEIPT = "maintenance:bot-template-removal:2026-09-25";
+const PREFIX = "bot-template:";
+const SHARE_PREFIX = `${PREFIX}share:`;
+const USER_CONFIGURATION_KEY = "user-configuration";
+const PACKAGE_ID = "bot-template";
+const PAGE = 50;
+
+interface CleanupStorage {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list(options: {
+    prefix: string;
+    limit: number;
+  }): Promise<Map<string, unknown>>;
+}
+
+interface CleanupBucket {
+  delete(key: string): Promise<void>;
+}
+
+type Stored = Record<string, unknown>;
+
+function record(value: unknown): Stored | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Stored;
+}
+
+/** The settings without the retired Package row, or `undefined` to keep them. */
+export function withoutBotTemplatePackageV1(
+  stored: unknown,
+): Stored | undefined {
+  const settings = record(stored);
+  if (!settings || !Array.isArray(settings.packages)) return undefined;
+  const packages = settings.packages.filter(
+    (entry) => record(entry)?.packageId !== PACKAGE_ID,
+  );
+  return packages.length === settings.packages.length
+    ? undefined
+    : { ...settings, packages };
+}
+
+export async function cleanRetiredBotTemplatesV1(
+  storage: CleanupStorage,
+  bucket?: CleanupBucket,
+  now: Date = new Date(),
+): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let blobs = 0;
+  if (bucket) {
+    // Blobs go before their records: a wake cut short between the two finds
+    // the records still there and deletes the same keys again.
+    const hashes = new Set<string>();
+    for (const share of (
+      await storage.list({ prefix: SHARE_PREFIX, limit: 1_000 })
+    ).values()) {
+      const hash = record(share)?.hash;
+      if (typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)) {
+        hashes.add(hash);
+      }
+    }
+    for (const hash of hashes) {
+      await bucket.delete(`templates/${hash}.json`);
+      blobs += 1;
+    }
+  }
+  let keys = 0;
+  for (;;) {
+    const listed = await storage.list({ prefix: PREFIX, limit: PAGE });
+    for (const key of listed.keys()) {
+      await storage.delete(key);
+      keys += 1;
+    }
+    if (listed.size < PAGE) break;
+  }
+  const settings = withoutBotTemplatePackageV1(
+    await storage.get(USER_CONFIGURATION_KEY),
+  );
+  if (settings) await storage.put(USER_CONFIGURATION_KEY, settings);
+  await storage.put(RECEIPT, {
+    at: now.toISOString(),
+    keys,
+    blobs,
+    packageRow: settings !== undefined,
+  });
+}

package/src/bot-title-cleanup.ts

@@ -0,0 +1,104 @@
+// Disposable cleanup for the retired Bot title.
+//
+// A Bot's profile no longer has a `title`, and its exact decoder refuses one.
+// The Bot's settings record loses it, with the revision moved so an open
+// settings surface fences on the record it now reads. Every run keeps the
+// settings it was admitted under twice — the configuration snapshot and the
+// prepared inputs — and both are decoded whenever the run is read, so each
+// loses the title too. The run walk pages rather than loading the archive
+// into one value, and the receipt makes a second load free.
+
+import { BOT_CONFIGURATION_KEY } from "@frockbot/app/settings/bot";
+import { RUN_PREFIX } from "@frockbot/core/durable";
+
+const RECEIPT = "maintenance:bot-title-removal:2026-09-25";
+const PAGE = 50;
+
+interface CleanupStorage {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+  list(options: {
+    prefix?: string;
+    limit?: number;
+    start?: string;
+  }): Promise<Map<string, unknown>>;
+}
+
+type Plain = Record<string, unknown>;
+
+function record(value: unknown): Plain | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Plain;
+}
+
+/** `value` with `title` gone from the profile at `path`, or undefined. */
+function withoutTitleAt(value: unknown, path: readonly string[]): unknown {
+  const outer = record(value);
+  if (!outer) return undefined;
+  if (path.length === 0) {
+    if (!Object.hasOwn(outer, "title")) return undefined;
+    const { title: _retired, ...rest } = outer;
+    return rest;
+  }
+  const [head, ...tail] = path as [string, ...string[]];
+  const inner = withoutTitleAt(outer[head], tail);
+  return inner === undefined ? undefined : { ...outer, [head]: inner };
+}
+
+const RUN_SETTINGS_PATHS = [
+  ["configurationSnapshot", "profile"],
+  ["preparedInputs", "bot", "settings", "profile"],
+] as const;
+
+/** The run without either copy of the title; undefined when it had none. */
+function runWithoutTitle(value: unknown): unknown {
+  let current = value;
+  let changed = false;
+  for (const path of RUN_SETTINGS_PATHS) {
+    const next = withoutTitleAt(current, path);
+    if (next === undefined) continue;
+    current = next;
+    changed = true;
+  }
+  return changed ? current : undefined;
+}
+
+export async function cleanBotTitleV1(storage: CleanupStorage): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let settings = false;
+  const stored = record(await storage.get(BOT_CONFIGURATION_KEY));
+  const cleaned = record(withoutTitleAt(stored, ["profile"]));
+  if (stored && cleaned && typeof stored.revision === "number") {
+    await storage.put(BOT_CONFIGURATION_KEY, {
+      ...cleaned,
+      revision: stored.revision + 1,
+    });
+    settings = true;
+  }
+  let runs = 0;
+  let start: string | undefined;
+  for (;;) {
+    const listed = await storage.list({
+      prefix: RUN_PREFIX,
+      limit: PAGE,
+      ...(start ? { start } : {}),
+    });
+    let last = "";
+    for (const [key, value] of listed) {
+      last = key;
+      const run = runWithoutTitle(value);
+      if (run === undefined) continue;
+      runs += 1;
+      await storage.put(key, run);
+    }
+    if (listed.size < PAGE) break;
+    start = `${last}\0`;
+  }
+  await storage.put(RECEIPT, {
+    schemaVersion: 1,
+    settings,
+    runs,
+    completedAt: new Date().toISOString(),
+  });
+}

package/src/brand-logo.ts

@@ -0,0 +1,2 @@
+export const FROCKBOT_PAGE_LOGO_V1 =
+  "data:image/webp;base64,UklGRrYqAABXRUJQVlA4WAoAAAAwAAAAjwAAjwAASUNDUMgBAAAAAAHIAAAAAAQwAABtbnRyUkdCIFhZWiAH4AABAAEAAAAAAABhY3NwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA9tYAAQAAAADTLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlkZXNjAAAA8AAAACRyWFlaAAABFAAAABRnWFlaAAABKAAAABRiWFlaAAABPAAAABR3dHB0AAABUAAAABRyVFJDAAABZAAAAChnVFJDAAABZAAAAChiVFJDAAABZAAAAChjcHJ0AAABjAAAADxtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAgAAAAcAHMAUgBHAEJYWVogAAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAAts9YWVogAAAAAAAA9tYAAQAAAADTLXBhcmEAAAAAAAQAAAACZmYAAPKnAAANWQAAE9AAAApbAAAAAAAAAABtbHVjAAAAAAAAAAEAAAAMZW5VUwAAACAAAAAcAEcAbwBvAGcAbABlACAASQBuAGMALgAgADIAMAAxADZBTFBI5g4AAA3wRdu2aWu3baXUvn96zmUb27Zt27Zt27Zt27Zt297Tc/5fb+mhorUx5r/eI2ICeErjsnxAB0J8AMcTBt6RNJgXmgDxWhsgBBBuNRDTyFkgr/Wx3ep6DgG95u3Gkza8Fh9v+uAP/rAP+5A3vf5AkccLhZOjUE44eZEQYJjw4jwPOAUhLHv56nv////+P29/+ztffkB9+Ff5Bp/rzdB5nidFvDgLDk6lOODgNBDoqOOEx/HihCMIJM1XXvfGD/mID3tL//5P/95/2gfIF/6OX/4Nrz4ejwcKxnXjqkmGQNxYvPjgz/lVv9bH/P1f8wff9+ze/HW//Svn4/E4kQDymtlKwpgKhJO2JMbXfejn+7af4/f/qv/0rN70Db/L+Xg8BCyHO0MAiblNAiEwDmgwCCfAi0//pl/7D/7q//Js/LSf+3g8NICQTQOkCSQQAmkAIRhjEjgk+9ZHf4+v8RP/6Mvn8fof9k1fPoAcLiZ3p3HReMqEPvaX8p3/13P4hJ/36uMRTxlu2bBpSEk+CRLw1X/4D//LT/clf9zjcfLcBZphAMnz/Cw//ff9hp7GL/qDHw+7z7YEAiHmIUBo9jThwIf91L/6m14+yZf6GY+HcbOxaRggsZmEYAbSU2y+8sv/4q97iq/23R8H4U1ALm5NxgTjGZ+/+G/9+vs+x/d/PLjd2Jcg3JkbmwI9Ha/7KX/kz971IT/38bDbsL2LgZlABhjIs/2wn/Gj/+s9L37J40FeslngLRkICcYyWUpPxyf//G/23lu+7Ic9uNUmawkMQoPkViOHZ/oFP9evv+PjftLjvCWllRBCzI1w4ak0w1jaM+Cn/pZ/eMP3fjy4OZxJrEOSPDhtsh+SE4Sexvig7/Ezzkuf9hUePMdwNk1IE5okSCyTEJCeIuHr/de/ful7nw+wG2xlJAEu5iGAgVm4yJDkOb7hu/+8Kx/1ZR9yq6crQAIITCAhSUaJW/M59JX//b+88F0eDyAvSJkzg0RiNHZDgAANaYtAgSZ2ix/0nX/WhW/y4M4QbJZhJk/dQdjCGBvmeQt87T/xvq2Pfss90wQBThk72jCEBgMnIbnAIUYbbv/wj/jnW9/25ROsk3kuJAhZhpAQAgIBgRPsKV58u1+98/qv/+g+gROTMZBlINDREBIyN0/JkOf69f70OzY+/GMePGVI2iCBTdYJJPuZIXgK2DP4+P7LxsfyNMa2Gbm1n7O5ENtC9x2f9q82PlPeJoHDKRAyGkg22M7aBiBBTgxkKXTt/Gz/YuNTHsdtdxsYnmIsbWLDjQkJBhBe47P/041PfXC3XZEgO+A0xCAxwDBySJAGi4MgBCSSOz/pP2x89Nld0MzZPIPjlNGADkqMpUQgEpthIDd/xP97uTje9vA+SDCkmQSQACGAIRmjBDhMzTCOAom7P+Td71+8ePODXbsyT+aeODxrY+wIwO5608tXFx5bZhcMyHAwLgu0EggLEZqMCUhM7Y7XcVPgTIh5cn8gYYBAMhoh05BtIbvh8LGKG41bpbxikMY6TDIBQiAOoJClXZJY2w1IEEeANJsbtuogto1pYgApMZWGTOxKuJIbjKUxzY0EW0xtkUgDGGAAluxm8qTeAIQYGGAmRAISm4mBQJCsA7keInDiJT0Xet4CgSzNSOY5kRhD9m2YS4CcOECT0fZ29bQryTxnGFiCJUuBE1lbIIbNpqE0CJw4uZgrO07utOFOY2k8oQG22E+WubXd+SJvWIaECyGmQsyFVgKBp0DgzDbMQOKiNTG2TQIMBOJWY9+418FIsFyFBtiFdcT5YtURAgEho0B7SFs3G/MEyHBmzKULTUZbGZtyIs8y75gaQIJAs23bs4WeC2M7QdrJmwwavIRhJGMI4Q62kRvkYh4IJBi2iKObQsbw0mhAyNqGJtKCWMdMmgDJMhMIgRBIIDcgh9slRgkkSHIApImeKz0na5NAoMxknozGzRIEDgkJhACBXDZClse5IC9Asp+DcbdNJLaTy4ErM2M/lgkGubItISSkIQfbQBJiFBosjlOQQCCmgYCnCdZBQ6z1BCGWxlqITQkI5MZw2BQCQiABIZAgE5LdXJGW2CRAAuRyYHI1J/sBGHKvRGIAUgfBUSsDY55AAuSl0YBwwybSxjTZNCBngGESQIKx3RGEk3kChKsGgWTM1diwmWAITQJMtuUEHJa2cZzs2gAGcjrLWcmtZuQsGY3RMEgIw8nUBjkdaDWVJnMJCHMyNYyptIcBOTEwgMRYGtsJCQnkHdtC4IBNTAiwSTLm4noakIwOCQ0h89DAErySC4lpHBBPa9dCjGdoXDWWHidAzuaBJGtb2GCTqwaWCBFaXrEFBlgIErnBKUh7MgaB7DvEdkJihBJjAtIVDIldg2S7juTukFvDVSBAErIrcXMyNcMAs63HK9yegG3lALkwic1cGFcDJwYkGJu2wRFB3vFMM3NxY84Scpgn+7lhjDYLNwxszwahSaCRrPOKzUA4XQntPceQ3ZxdTbDEAAPIC2s5wXB2OW0VuAqcJZGSEHJrIgEkkMOzziEQTlecB3caBAIkTyuxFrrNhsAhwZLliS1slRsYYJCG5bU0QsBIgbg1ZJkskzQwEogVzdKAHBIkICHkzsQAEwJidCchCcEYbZATA+wIks0kBwmEgGQ0IDEuh0hshozGrpGAJYCRQ8joaZKnqzCTqcSugQRgl0DiskAGOZtLEDJ6ghijMd/BGJPdQAw8cbjeQYO2tU7CjRDAQGItxFRodfgQwnDjetpGwBFPaslSYmoSYDMLZ/t18MwTOAUOCAihgzYQaAYSyIlYcHCihYST2nm8YjdIQ94xJrtSHIUb15NkGbJpA7nRkYucJEtbhHsYEMgyIYEGVwkkIUDIRWP0xaPF2khulQByloAxSiswRmM3gWRtgEE4CYdtm+1nBhISItlsLbFtOcFCQkgDwwQCgYzrubDjXAgBIZAY6zQuGtsSNgOJZQKYsQ68QZqYLx6TZC0hxL3OStuYShMJIBEKydyYShcOzsHAJpATKY0bc1hmklshSwNoIqMtwiGOFgZIQ0hHE2kCSV4wyNxITJoEsh8IkCmxDLkuGZwyz2SahECCTSTAIATISUJyUQonm0koASHkqqMhQLAFhBNCQrbjCCAECENI5iHhZJqDQAgBBAIGmDQB415jamCkDYFADjdnclFogNBYG/M0nrqO2TqN0RilldBgAwkhYJOLITYYo0Q4GIQ7tto1MCwBiWm4yg4ijgYhkMgbhBMZM2RTOOXq6Q0pITGXJoDNgAQ5xQCEuFUCTAJjLQHJUyQglEA4SeZCrJOpgcTcLNybJwlx0Ow5ejwYk0AgIQkHwpkBNIEECAFPZJ2LJA0g8KmyBQEhywQk5kkcgQkxTTwHSULGBg0CBIiDQGiSBEd25ZS5J7ItsTRIxmSaE2OdpAAnDiT3BhohdCRtddAsBluB0GQ0hLhoYA5BkmxmItEBDUJshwC2keyeB5vGc7QkkMQAQsCYJkgJkAC5Iw23P87X08ITBKSZQeAkELBk2cFklFMbSKYdQQgkxBESRuaGvLpxvvdNmJOEBBLo4DxiacxDpiklGJ6AJIYFSCZAIOsQyGT7/W68+61cDGSeOTPuDJlasptct5kxJlff88rG//7IPYecGWvDFgYYU+NiBzSRVgYGIEHalbdv8F8/dm8/WSdkTkZPZ3llNMDYDMGM2/87m//uU9sKBwPIFSFYiElpk6m0t2sggYQn5iQv+O92/tVn3pubsbQBOgIMIAEbjAQDHIIEGzDAmEp0xJ3/aOfff3KC0A5gi5yRYBKEpIQBhNwqIYE0TPMO/8nO/3rjW7lsgM3AJvPkqgEk2BACBpCMmbPk1l7+553//8+/aBC4kBgFwsgtAqUhBCRAiKUQkECYGCEJSJf4x2/Yefmbv41cDmSe3JgAIfOEEALZTW4N7UK/nu0/+BXffCEZQxJACHBo2G0iYyYXJeSUMFdAB229+gf2/t//+bQL87RkTDalLWcIQTINh0yuSpPL/+GVPX7ld75lPwQCk6k0rAOZJxdDg44YhYbc6Rdw8Td9iU/1npwJMU3mKQHSsCkQhCTG2iSABDxls//4l668/Q99y/bCISWMXWkGJJvSjMSAEBKEMKaZyVV/M5d/9df78JWxaUgQ2mAACSRjCBijkYDMI4EQGzIBbO+//a5r//F3f/8WOdiwNnIIQC5LzA2SWxNC5uGOP4cbf/VX+NTFvCMgB8lTdm1HoBDDAGyVQwgdAUhIXPxHf+uO//Ejf9mLLUvAhkDWxpiDxCCABEJsG/McUk688Piu3PoX/uc3cCcZk0BIkIAOCMyAwJCL4RBC5sRCSC4/fqb3PL7Dj/isO5sJYKyNq8l2mIwJWAJIABK5l3/mz3Pzq9/8l37kBcNsyIlATC2czDOBJCFJRmM7PeXi3/mZ3P7Pft7PfNuOJIExtTAQEjoCA4SAZJoAaUMIyAkahGzHf/jxPOHv//2/7PUb15NpJkACCaQBhJDME4dticv/8/vypL/3t/yat61yYYABJJhMk1PGcIBQAuQUMic5ubH/8Y154j/8c37Txy7I2dK4agkYS+P+jiCv/eNvw5P/nR/wI75qs3WCmQESEJiMlhNjNxxyMQ8v/LrfxDP81z/sk3/Uh8waTCESg5BphmBMJXJj1yZJcvG//4g38Czf9St+x4/+Cm8cpsnUQoAAWQdHQCD35uSiwbv+8E/n2f7LH/jyZ3+uxwJInjaZ2y335vHXfhDP+i/8gJc/4Bu8rQWB4W2b+WTScPz/3/szX88zf98/+wV/5wt/jS/y0a80AMnTGs8y9OV//6t/+O/KB2D/7s/80X/2UV/oc3/qx3zQm1734hDsBlvkwm4qHu9/z///n//67/69/8EH8Nv/4V/7R//2f7x83Zve9IY3HMeLIwU5gxcP8OABEqfyggcenI8XcDw8OcIz88XLHu9/33vf8erBa+L57re//Z3vee95voyCGB9AZ0AAxQPoDB5wEpwQRA8+45TYNi4LxGu1Q3vGxWzDSYC9RtlgW3E5MEBoMrXXJGMqBBg3G2CQq3htTojNuDuMMJIG+QxTugMCCIhpzwxWUDgg2hkAALBeAJ0BKpAAkAA+KRCGQiGhC41XggwBQlsAMAfQoa/pf4u/ld8qla/vH3//bb/P9ILWHmEc1f5/+7/uR/h/mv/xvUz+lv+h7g36Tf4b+5fuD/ke7Z5hP5l/Vf9V/bvd99Lv9s9QP+if2D/ser37InoAfsH6Zv+3/y3we/tR+x3/X+Qb+Wf0n/e/nr8gHoAeo//ANof/K+EPjU9d/uf7f/3b25c3fU7/j+iH8p++X63+1f3r1W/53iT8ZP7/1CPx3+df57z34WPMH6b0F/a37T/yfDx1X/FPsBfz7+r/9PjyvTPYE/Uvqz/4/7Z+gz6s/9PuEfzX+1/97sU/u77J/68OZP4EYq5XDZS79AONE/mQ+NhSJ0TeXxxS4B3qVpF0MfxkT8E5hjIWtjcAsrQpjLhL9euJwBCv1D9y7YCT7RLGn0FQL2/i04Pz7TF8MvIydCxlq8ikBFOVnjUgXcXDc+1ZSNYGJtstME2BfRUXwBwjstaKXA+xZnngS3fOcrucN1JUS6oS6c/aeruNsngqerEAp9F0zRiYVvN4lcK4UE4IP8z+Of1Bz7wv8bb8zbjWOmDTGKMK8tICVYyml4sT1+O3SL9j2Lu21Z7C3xZXi7sMR5+1DGc94GM5hj7EV98BI145OXNIHHdLMb86Bl+PF5dF2c6B74lDS0MjBN02mA1N+OTR2QDWVVk5L+QD1PWFv8Ww/Ut8HO0gW/xB/T+ESDbO3vouUtFaj4/W9zBXXc4JkZTgA0Kv6ogP9n3NWLTyiuEJXhgw2sYTjtzlOhL03hCMbQIENlxLkRmXIoez1p9FTj/cDJNxRDHBxuQ6zzuLR1hGLO+iPzub0YYQuWMgL7dmsbKPUuea4tn9J+z+mmFte1Rjd/cYLvWuBXeUUJDPAAQDw0iRVH8+wOY4CY+3W9y4cSVgb4VrvDmT2NbZvZkuogbcCelsjvAI9epPBL9SIUs4oDqKsHlzhTIw14MWrJJtrwDCJl6SdSs9AmVvcMsC7a/9VruB3MyaTv/b7AAA/v//FsFB//4N6E7kyrryyVflBaHjizTNKyIMvidaMkmO+QJ5viWvLeh0TP+FIJKkk3vbQt3UoAtuRW+2ioqrAhtDuEZOjiK67NoseeTikbw7jZgkvpl1ULY2uMeXnyXwBf0fVstMrMqOdhfFM0BGAu+Q6CbvreA5zfkrdlvLr3HLwJnC9W0d1ANnPH6JK6ezk5vhhXJFUUh3YJHECb++Ne4w38onUK6rXqvM5tXtGqa/zorwmOrAygWCV0lGVeiiH1h3B+olyCqu0Mw5ZhtQoUljHkEmb9QFtBStoLlSaKxJrv6vF4Bml+X527dNvn6vwzaRHaF2AB4d4HORFO/uu/AVRG/0Pc2ycrkl0cMe9lfrH0610qG1osknj53B0QR0hXeDKIP7xpvH9xjShKfgUGfZw5RIgCz1cRy7mXLOGJsuX8KRXehiTOyzgFuMiRltUjWKucqf/XLEkQxKivXizJb3K7+a5F4y/Pgz+oCb/IUNg0lcprfGB+AQ/2PSiEMm9QKsDtZTUxqs+/xHEkyKapyCTNwfrBo4UTMz1ofodZ7sp/mCWkr7G8VMiexXkTZnnHOJjiwmELv/V+EQBF1fHHl7rknYCkjfM/beCLxJJPkuc5L3Xe2sOuDAiKXvdEQDJwJXz80n0T/2wyZFsUmjEwmXAIx489rxD70S+i/b6tJBGGyoPHhnoWfQozubfAGaPdWJc0Qf8T/yKFKMoQ+t7P+ePWCGwCLh7gqr0Mc4b4DFiiCBe1byUpEzMOhFu1QEBcCOo1ys4LuEOX/VgIWWkoS7WunOn1wk/7n1q9WIb7YP1SQFUerU//SD3eDyDAJDdwUl0g+wrlhZUncd0j8jqTeZCtWdFjyMtJnUYY66serQ+0Op43KUf6OP9QtgflHYT8Mx3Eyux6XJuerPNEtjvafFVL6qtgQiBBsIWgjifMsMuhLcm0A79pdBoWhUsEWwqkkcNisGriISGxZ/OZJ7y/NhTi4u2CM+UqDCERuwnzJA2ubjC5x3vLC8z7kfyqY8mZcIq/2ntuX125CV/3VRAjeQFbdla10XzVn/6Qfyy3RTK2L0Iet0HHgB0XOSxFaVYXtc6LpuPcwn95kjbu4mwZ8qg5Jwc2mJPdfL56gwlPLkQ9r4UHecVPDKi4I0mwlV2/wxkAT2EGW7t46I+0GmjDS/s+1ZfchT+d2pLlQy012oUTCU3W8l9CKE2CUvv88qU3WD6gM8bF+UyQ88Abf8Z+hHc0OEW5IU/DErRBwQG1XCLC54XGrGn4ffPdk//pHh1Sif8qy8DIs8wjAlyDrc9K6bb4qzYLfN8aA9KFIFsvgHcdzMbBuJEXHOH/A8o8NLgYEGUUMmtseoQ067jhoGGHRImv2vH9uwMn1OiQaG2HLlcGxzm4Kr7kpYZMVdODeCuDKgLrWQjkb094URmPxa9lxIpa7pup+reRuz1FXpVSG6c/1/0AsYqJKSeP4LWPobc//vA1C7TW1hJzdQuMG4SosJTDtcxmKfFYdsX0Iv/98aX3Nwdye9EhANLFUwq/18BVLypN6ZJ5yJVH4DBgNtMf7a+yycYRkQOKHafhN3z8TiHAQsnSUhzPuNUR3msnCZU0yA6u+N/Im+bnNeX6v+/ZKNNewclB3xD7qITXWd1fXlnAYhZuijaT6iFztnudbG0I4vGSI8jfMoNgB6/pWvEDHM5adWL4+qFMq/fSsOgRnwA9ijTVcgIWpS9I3hM6zBRXltENSl8WCqiPjJ1L2Yq0RXRexHKPLMG5Gt0j0fQgZNvDJIpJQIQQjMRL42aeadgo3auwb255BIF2JsrhtijWf8inofrPoASRSHducp4vBk2X0Czt48vh4L0wCkVPBBNwZYW1Y9XtbCNfDmTO40T/RMM0xZc3/cF7Le3nk+TwQOohgvw7tqXFKRvxPdsPG94//7eoJUXDldnzMwcTtmCISR0U6zL3stD94vERBX5+Dl5XAFw/RucnZ7Nv6UbSkevEw22ixTBuQ9BPydxVJsPqP2JayQWdA9HrRan5uBrgBCXPDbudeYPR3U/zWxCpJYMSmwUfPdo9IXY3ZYxcCH5vdsGgMNZqR6iudiaQOzbEDJ4IyzMHOVwvv92BBJEBtAEbAKVARX+FzFVDDSNFkQU+tdhzmddNPukgIWBgKCVzPVSh/eXGY/vdkD0SAj9C/7f84XH94INOKZfFtfoMGwkL+R2DVQiXxwmXxQVL/fcD9glQ+cB9fq/yt8PzgCT+XalB2OJAhzLwvjOnrsVmPhDMOkRd++vKakpg1rsh2VZ0o0YrdqyZeCHxegWno0kHnTiSfiH3bQDYeV3ui06Gt4J46R1h7w85HdDAJxqqRnAsex2gXWXlapPxe1YlXfJisVmZz77BaXXdyXBp/A2eJFaWqeNQtVeJK23bt41aGGC0SuhuJpg0/iHxMYuP5xO62qgFjzGseH+vn2KjMksudgWcmHvgI53Y/2ePsgsqLTRkg5pJWWeC16yuonzGWDxJrhOZcUJ4navKDjRVgjUkPO4S7Tl3mU5o+YTVg0fZ3TY76p9mqqCh3g/uaw0tWhoQXMlnloCrpB4Zbc6+ptq23/9DxTaTHurei9M/8HxW1wuHPsgyGHSoQ6l96WD8RYPqFg1KAdbjEsEz07rEyaxM/s4OQzMJYKRM+W2/pK/hH6sAUg0gmp7D7SRdqO/fTYs9TnVVxFApDI9k59ly4eZu7caWtbFfatLQjMtGrm81Fk65kwEnLFnCYT413m6ouPlffnsb7/LQ7FntyihiywWR3FYK7/5xSkP6GKhdj2Z/pGgonnCgVWXiWjhlYFbsR/06bdgEL5qLgnn1gF7Z2/2zYRbcE+41EBq/fAunNxsAQ6k1JFBcylQixeiaM8cqF4hsV+dFo9wyneVGTGeZglnh1aYpARb57BIoJ9cB1Jqx46afTdNFc9fcGPaDymHv5f1LGCxTNxDd0cGQENau5rn70i8LtFH1mmtoK5sNj1ZZeVWQS6/pSr51DGpHccqN4nRS8EL6EWtkNx+kA4slczU+F4eTLzv9BjLM54YDaugJk38AqB73CfbXvW1kaXWzdlb6ye0vaPrP/HeSdcUeIy2nBpgx8HTzNvfQX+80G5NCemXR8qAqkXmU/AvOSPeC7NqbxzGPnP+NPnyTbqM+sjtZZKvkzdp3oM5Sjm+7M3+Add6nn4pDq0/r5tMtilvwPMG6Eu3aOPuHtoZp0LJVxxZ9Rf9pPhCa4xTFa0473V+bw41w9FrDW1ltL577n37381c4BF5EvUASVmpNx/LFwTKOeQzRGWLCe1DUHdnXAZDzBGkGRNqNcppUQMy90ZXJ1Qv+SIg0jsZIl1/dwKCMnA7GdMuyLbFy3LiIgsqKvK7jCdyHkC/7Td9c44vuS78RXeTgkGUjSBtSgyBUbT6oKFLDVKQOw2HdccdLW5nyLmRZe82GPfNW44YVMKwyIpkGsDxdPMO+SzyIhI3BGk6BL1imEiE4Xhc6mM9seuyosz/LFNM3OmtPW+vb5hovui6kRZ80KIrmVq5ufZ2Zq5ApsCdNoyctvwEcv1pYbvJsg/84EzmtIPQhx/Tl9XI0E4DGhHHt872iUAB2Hvjw2/M7Uc+kaLYEZ+SAm9604kOWa0PEEH75t4jwTJnvAQfddzRmEEiLCjVwI6zKMntGx03l59EmOvRRebx9NlsgGQ9sc/jmTVL/+/8H8vw2JfSg76zqynU+vxGDuUSRVm1TlI7pkOdqFyPBfxDbW54gwjYzG8yiSHHixsXHPCOotlG0W7aiDDxtv3j9A3C2Z3jira4f4dXKBg20/r1RiGNhpkhUq1vYBN8h5/1tZb61Ph8r/udYY1NGdCBiX1AQnuy+XpWRYJzhUwvqDHId8PTrw1ajn8ddK7McdOCv8AOYEnAuq044eXC1JyIE6AcBl1MGQaT6341b98Oi33G9CEtmeZXOWzPPmwJIqnttqvAPxPTzr3g7ynBA96S0bHYn53WstOlr6YdFCkknWO6v1Mc4UP4Ii7YNP1p/iUeA2Qv911d7X05/yIdb/OuqbrHp/jGgOwHDjj4skEhSdb9t1dC+gXCCY9KzddvmiBtsJ5ZAAPKWWUVDJXXAarcxgy5Q2zD8KjPL+jTQ92PS6hov38s/QwFkEmz7/67wJFVlN8OwzW0nD6bUbmAnfvw2RX95aOKKQFY6HUC/l+nTCm1VT0mJqZlH+gvsJd4+cmrdSdepBg0Yilb9Yr6yXyDuuaFMh4vC9qzxY2OBVuR9jsrXK9fnMuktP0qbMM9/vcI/gP+WJCdMbtvM7YqgTDE6diEQ87Zml1KGzY5McTWz0ovuhO1FpBM/Yuy4kYYyQHY5NF7m/fTmldQTC2JgDgXySu7qpUz406j92r6xEipyFfeJxDvRGvchjxZQnTGEVbTP2xqqJLIZJUmgbAst7ereCD9i6A8bRbeokgSk+4CWnyQIqTExHYPGHEG6ZCUqKl6u0Jk7R1nalSnKbzHMNFHit6SnfKXgSs9a2J6AufoVVgvdHYC/nP+cFHGSP8/+kmOGrDfCtPtpXMwaz1zI55JQ3o1NAgPj1WkVfb9zlB90YN6iUNPCQ8EinkX5rJQp42ZgeG325f8L5+f05eY5PC0d02VensE7jfv5dbOZ7NT3P62RT5f1n8Ld9WQqTqlSOBu6E8D4PZmmKY7MHkEZ65azkIjMq5zC1uyTKLRuwDKOK3qnxIpa7oyvc81naAtIKE0qDzLjOX1f0QSVl8173EQFO1uBeMRg1bAITpunvqL4cq7MWLLrgA6NvK+Aekbpc2OjoOZ1KrWqL79nHWD1QGWAqR36Qozo0Kmbk2fFDlNW1We2RP0iVrR7fD44hmIoBkDWiMgLJ2jmMv2q5EzX6yeYf8six9LEV+7S2+I4qA7SkY2Baa243khVhCbB8NQZzvbSWxQlo1rtapPsFlxyyDZfELEoM+1CRcaUFksLgh6BXOJqR7OWfJiNwR/cNDC8CuyQbBvYZ+of7eEFvGdivxnlHcaun+tTNHiS2tMIzb2v8UKJnfAVeiTvEDLtujpcBtp1eu0OZPMMjf3eBt+FRNbVSI20UM5dWxdlMa6H8+/NonJ0ZjmgvLdyOVH1Mz6XsD/WOwcctKuruhACGIGZ8XU/AVBesWsWSWw8fAYFGdR+1G9Q+ybLY3awZIkoF9wGGf6cy/04fN/qSDv9NVuTv6j0GSL2oRjBqcsEfRqYontBOyGgkF4qcPPt5lNJkXhl6n0YV79uRe2p1EYl/LdAHXjIxgR+hJ6DjPPII0uYdv/4fwd+2ERzpSqpS1Y8PBiUSwueAUG272DFx1RT/99g6FPlQ97AZj8q0Xb1m3DTKhJnv55Mhy23+66iRUWULqS4J+KAcRIvrnPn+DNO+Z+kH1ajSntRSqaQTJlmOw/NkrBasP8ng9+1/YwJ7bL4VsfdeFVioBpvLKGGC31ZNW4v2HUgpEt0y8xY1PQd/udpnLc25V1PZCUlbf98uj/p/Dy/1qOqK3eP5YrLm3+EY+vHVKmxEzdOOcipI8765BrSq070rzLfvL12RA1/EyKJrCBaf0QM0WxN7CRAgI1nnOaIEbmu40327F+jr6jEG2mw5CtIzTIRp6eMmf1W4GYH277T6G1Ya5B/8uAa4JO+/ya+3GbzBWxgiG6sw/NxpzQqovnT6fZhninI3XyHlxN/LVAy3LWmJMZJcwjlUG0rbcZQ1YLPsc0sReu1xlwZy3kVRIuycB04x+PnU9krjDZ958liwhjlE56Xo6GA5gVm6aBHMUjBr/LvfnumFkGtVtw8yN9TYyXdXToaiJ9/l1rb6/vWEonr2WNDpqnEpJDTzwhknO8V58y0txjJ8Oy2vZ/hi6ONmDiQ3ekuoXe36MitcH0X3anH8jWgk3+HN+4moeX6C6t09tvDZBCKJ1GvxBtscKJF1i3uqoNU3EVFqkwzjfQwZ66Enht1Vl1QsX+ijLmZ+moRYQi+uvr6N8CYvbZb/RWwq08Vtg2SQhTvp4KuhulMZrGrMy813E18U35WGqFykxxuYG9S/k4On5y3Eeccp8xqvyFH98xgXQJN4jzFBQz3cPLbipv4PLPPliXbAPB6S++387V3vW4fgbhBG3+E1zZlnDsJsukfCjhzk4vgkawbPR45U2fp+iVs48FbtqsCD4+Y5ar9AWo2ZzoxtEwY3gO3HUkkyn4ifuTpGHe0wLQtrhfEE1BafA865EXazJnZZQGWxgRfVOHg8Havm/+Sy1hBM49P0xlqCWB0O/sftcJb1eDDsyq8m35w+Wxt7rQ75LnZE66ezKEllnol53/44jy9EhlJ0O1DqX7O1EY0FsW8fJ5+AvaM3bJRM8XOJhZ2sogaXqczSF0l3mphLqOxEkAKbRcRiW4sw0d/+FBJquYJQgLCPSdyOqYchFgdpgyuwNwL0ZurfHnDs8lOPO3T36BDa8nTDPKexKWtxKZbvnj8RQCIfARTQp3WKxfNdStcqWf+Wo18i3TaiA3gZ/lHIYOy1BYe8g18J0q9Tbhq1/ehJIVD6vTT//58XLq0sOnQz+bTG/hBTElgdXwW6Mu/VbV6vf2WxTn+SNZu20/JJuPACPsE/Ec3bGyaTOXSzxXVXBjlwnjXYAEpifNfXGZq9AcvCloV+nxAV1sOzPjm4FC/DLwdNe6WVTeoBoSptU6M/C2N3orytugHHU+CYC9dcBZLhhWZLkt0kLM10W7XiSUOF3TJw7B55OfO2ibHrL8W0AE/Y8GcRWrkAiBMWpeS8L4bEILD7yne9liDhGnU1Wli5NxK/x3ftVw54ln2DlL3N6U2bAsCaU6wjgxzs0FwG/ak1DS8i18AQfpIIxZNu5Eefm7I0wqpvEgZd7I4IE23iI3bnFrs+TUJvb1C/2mksBxOjwlUnl7E18MdSIt63ewWzU0/w/4vrM+sOgBKg2EweaO4Ur+8uq3/jZ9iy6yD2I0S6VgbQhOeK0EqXkUP5NDFOMH/ZT2pFaTjD/bthsPUNHkAA044Ifxk6ltCLNICWhDzyYOCHmTHZatZNA9dfdU2Uo6jdmfOCkrKD5ss9LDR7LJMzbWy4H55YtBqn5wVKj8FLia59xjDP6YZtcMzA7GpnanbY3S4dfNN7TgVW0pB8W+7alos9LHzU3PiJV9KT0rhI6kWcE6q/Q9aXu53Sf5KQ/8qmYjJAzwuQS9g7YnjwmRsrnpCjsqTEWhJ0xr+eTlgHkH7hKSYd0zK2dF1QFs269GWmAEbxgeNMy6WgpzrEvf+5LNw7g6+wkgSRv2CJsOYHCvK+IPyeckwxjN7aia4Gnc1/z8tpEb819orku5hUfvTEUVt4267Bz8TA+K97poSTHdFPN/+RX6IvjaW5jtyiJfCc2uhmAbrGxOlGx66FXh+ZNO+x3yj6m1gOHEB1Dpw8GcajM+4tuQPzs0jsQUrgBBbNXo3Wz30zWaG+fm8GtfFuPsaqJvUSwp+5uEC4Xq3IR1EYmUB5fHMD5zzatn/EIX8886mwF904U/Jw7qXs/bqJoK/nNjMtpHptifC3mtUkVB44AFgEkTKZ+kGv4eAvDLK1rOzJ5eOs7MnmOxf3P2L2cohR/c21bzlnrx1Ful5N8zb8HlerXrtDOupAJFNIif5BxrTpmGW9schiAzt+Vm/vqoWmmiI/xrdHr6WlHXwq/851ICjUUQp2aZW4dRWJhnvtRw2pU6ftI5wN4G/n2t7jQnbxh5oKPqc//Vg1kM6m5HIIah1Jh/pRDEot22pLWgIPxg1mX+33mXPpOfNLICRMUDnWDVV/59QARKeP0eWOUIaAth/cs4LJ3mBFAUn/jL4INXVdV02AAAA==";

package/src/brand.ts

@@ -0,0 +1,36 @@
+/**
+ * FrockBot's brand: what the hosted deployment and every suite show a person.
+ *
+ * The Worker reaches it through `#brand`, which `apps/cloudflare/package.json`
+ * maps here. A profile that names its own brand module gets a generated
+ * wrangler config aliasing `#brand` to that file instead, the way `access`
+ * profiles alias `#auth-package` ([ADR 0038](../../../docs/adr/0038-white-label-deployments.md)).
+ * Only the Worker imports this; app code is handed the brand as data.
+ */
+import type { BrandV1 } from "@frockbot/core/contracts";
+import {
+  INK_DOCUMENT_V1,
+  PAPER_DOCUMENT_V1,
+  STUDIO_DOCUMENT_V1,
+} from "@frockbot/core/theme";
+import { FROCKBOT_PAGE_LOGO_V1 } from "./brand-logo.js";
+
+export const BRAND_V1: BrandV1 = {
+  schemaVersion: 1,
+  productName: "FrockBot",
+  homepage: "https://frockbot.com",
+  builtInModelName: "Frock AI",
+  emailSenderName: "FrockBot",
+  // A copy of the canonical `assets/marketing/app-icon/frockbot-icon-64.png`,
+  // kept inside the package so the published `@frockbot/cloudflare` builds
+  // its default brand too; `brand.test.ts` holds the two to the same bytes.
+  iconPng: "./brand-icon.png",
+  pageLogo: FROCKBOT_PAGE_LOGO_V1,
+  nativeScheme: "frockbot",
+  looks: {
+    ink: INK_DOCUMENT_V1,
+    paper: PAPER_DOCUMENT_V1,
+    studio: STUDIO_DOCUMENT_V1,
+  },
+  whatsNew: true,
+};

package/src/client-compatibility.ts

@@ -0,0 +1,51 @@
+import {
+  CLIENT_COMPATIBILITY,
+  SUPPORTED_PROTOCOL_MAX,
+  SUPPORTED_PROTOCOL_MIN,
+  isProtocolValue,
+} from "@frockbot/core/protocol-schemas";
+import { BRAND_V1 } from "#brand";
+
+export const CLIENT_HELLO_HEADER = "x-frockbot-client";
+export const UPDATE_APP_MESSAGE = `Update the app to continue using ${BRAND_V1.productName}.`;
+
+/** Version selection is compatibility, never authentication or a capability grant. */
+export function clientCompatibilityResponse(
+  request: Request,
+  url: URL,
+): Response | undefined {
+  const header = request.headers.get(CLIENT_HELLO_HEADER);
+  const nativeRoute =
+    url.pathname.startsWith("/api/auth/native/") ||
+    url.pathname.startsWith("/api/native/");
+  if (header !== null || nativeRoute) {
+    let hello: unknown;
+    try {
+      hello = header && header.length <= 4096 ? JSON.parse(header) : undefined;
+    } catch {
+      hello = undefined;
+    }
+    if (
+      !isProtocolValue("ClientHello", hello) ||
+      hello.protocolVersion < SUPPORTED_PROTOCOL_MIN ||
+      hello.protocolVersion > SUPPORTED_PROTOCOL_MAX
+    ) {
+      return new Response(UPDATE_APP_MESSAGE, {
+        status: 426,
+        headers: {
+          "content-type": "text/plain; charset=utf-8",
+          "cache-control": "no-store",
+        },
+      });
+    }
+  }
+  if (
+    url.pathname === "/api/client-compatibility" &&
+    request.method === "GET"
+  ) {
+    return Response.json(CLIENT_COMPATIBILITY, {
+      headers: { "cache-control": "no-store" },
+    });
+  }
+  return undefined;
+}

package/src/compaction-announcement-cleanup.ts

@@ -0,0 +1,113 @@
+// Disposable cleanup for the compaction lines the conversation used to
+// publish. The wire no longer has a `conversation/compacted` announcement, so
+// a stored row or replayed update carrying one fails a current client's
+// schema and breaks its state channel.
+//
+// The replay log cannot lose an entry in the middle without a gap, so it is
+// trimmed through the newest compaction update instead: a client behind that
+// point gets the ordinary gap reset and reads the cleaned snapshot.
+
+import {
+  CONVERSATION_VISIBLE_INDEX_KEY,
+  PUBLICATION_HEAD_KEY,
+  PUBLICATION_PENDING_PREFIX,
+  conversationRowKeyV1,
+  conversationUpdateKeyV1,
+  readPublicationHeadV1,
+  readVisibleIndexV1,
+} from "@frockbot/core/durable";
+
+const RECEIPT = "maintenance:compaction-announcements:2026-09-25";
+const COMPACTION_ENTITY_PREFIX = "ann:compaction-";
+// Durable Object storage deletes at most 128 keys per call, and this runs in
+// the Bot's constructor, where a throw keeps the Bot from starting.
+const DELETE_BATCH = 128;
+
+interface CleanupStorage {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string | string[]): Promise<boolean | number | void>;
+  list<T = unknown>(options: { prefix?: string }): Promise<Map<string, T>>;
+}
+
+async function deleteAll(
+  storage: CleanupStorage,
+  keys: string[],
+): Promise<void> {
+  for (let start = 0; start < keys.length; start += DELETE_BATCH) {
+    await storage.delete(keys.slice(start, start + DELETE_BATCH));
+  }
+}
+
+function isCompactionEntity(value: unknown): boolean {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "entityId" in value &&
+    typeof value.entityId === "string" &&
+    value.entityId.startsWith(COMPACTION_ENTITY_PREFIX)
+  );
+}
+
+export async function cleanCompactionAnnouncementsV1(
+  storage: CleanupStorage,
+): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let removed = 0;
+
+  const index = await readVisibleIndexV1(storage);
+  const compactions = index.announcementEntityIds.filter((id) =>
+    id.startsWith(COMPACTION_ENTITY_PREFIX),
+  );
+  if (compactions.length > 0) {
+    await storage.put(CONVERSATION_VISIBLE_INDEX_KEY, {
+      ...index,
+      announcementEntityIds: index.announcementEntityIds.filter(
+        (id) => !id.startsWith(COMPACTION_ENTITY_PREFIX),
+      ),
+    });
+    await deleteAll(storage, compactions.map(conversationRowKeyV1));
+    removed += compactions.length;
+  }
+
+  const head = await readPublicationHeadV1(storage);
+  let through = 0;
+  for (
+    let cursor = head.firstRetainedCursor;
+    cursor <= head.lastCursor;
+    cursor += 1
+  ) {
+    const update = await storage.get(conversationUpdateKeyV1(cursor));
+    if (isCompactionEntity(update)) through = cursor;
+  }
+  if (through > 0) {
+    const expired: string[] = [];
+    for (let cursor = head.firstRetainedCursor; cursor <= through; cursor++) {
+      expired.push(conversationUpdateKeyV1(cursor));
+    }
+    await deleteAll(storage, expired);
+    // An undrained broadcast at or before the trim point is either a
+    // compaction nobody should see or an update the snapshot now carries.
+    const pending = await storage.list({ prefix: PUBLICATION_PENDING_PREFIX });
+    const stale = [...pending].filter(
+      ([, value]) =>
+        typeof value === "object" &&
+        value !== null &&
+        "cursor" in value &&
+        typeof value.cursor === "number" &&
+        value.cursor <= through,
+    );
+    await deleteAll(
+      storage,
+      stale.map(([key]) => key),
+    );
+    await storage.put(PUBLICATION_HEAD_KEY, {
+      ...head,
+      firstRetainedCursor: through + 1,
+      broadcastThrough: Math.max(head.broadcastThrough, through),
+    });
+    removed += expired.length;
+  }
+
+  await storage.put(RECEIPT, { schemaVersion: 1, removed });
+}

package/src/computer-egress.ts

@@ -0,0 +1,110 @@
+// The door the Computer's connected-account proxy posts to. It is on the open
+// internet, so the token is verified before any object is addressed: only a
+// token this deployment signed names one.
+import {
+  COMPUTER_EGRESS_PATH_V1,
+  decodeComputerEgressRequestV1,
+  decodeComputerEgressResponseV1,
+  verifyComputerEgressTokenV1,
+  type ComputerEgressRequestV1,
+} from "@frockbot/computer/egress";
+
+export { COMPUTER_EGRESS_PATH_V1 };
+
+/** A forwarded request: a 1 MB body in base64 plus its headers and URL. */
+const MAX_BODY_BYTES = 1_500_000;
+
+export interface ComputerEgressAnswerInputV1 {
+  schemaVersion: 1;
+  object: string;
+  nonce: string;
+  request: ComputerEgressRequestV1;
+}
+
+export function decodeComputerEgressAnswerInputV1(
+  value: unknown,
+): ComputerEgressAnswerInputV1 {
+  const record =
+    value && typeof value === "object"
+      ? (value as Record<string, unknown>)
+      : {};
+  const request = decodeComputerEgressRequestV1(record.request);
+  if (
+    record.schemaVersion !== 1 ||
+    typeof record.object !== "string" ||
+    typeof record.nonce !== "string" ||
+    !request
+  ) {
+    throw new Error("computer egress input is invalid");
+  }
+  return {
+    schemaVersion: 1,
+    object: record.object,
+    nonce: record.nonce,
+    request,
+  };
+}
+
+function refuse(status: number, error: string): Response {
+  return Response.json(
+    { error },
+    { status, headers: { "cache-control": "no-store" } },
+  );
+}
+
+export async function routeComputerEgressV1(
+  request: Request,
+  dependencies: {
+    /** The signing secret; absent, the door is closed. */
+    secret?: string;
+    answer(input: ComputerEgressAnswerInputV1): Promise<unknown>;
+    now?: number;
+  },
+): Promise<Response> {
+  if (request.method !== "POST") return refuse(405, "method not allowed");
+  if (!dependencies.secret) return refuse(503, "computer egress is off");
+  const authorization = request.headers.get("authorization") ?? "";
+  const token = authorization.startsWith("Bearer ")
+    ? await verifyComputerEgressTokenV1(
+        dependencies.secret,
+        authorization.slice(7).trim(),
+        dependencies.now,
+      )
+    : undefined;
+  if (!token) return refuse(401, "token is invalid or expired");
+  const length = Number(request.headers.get("content-length") ?? "0");
+  if (length > MAX_BODY_BYTES) return refuse(413, "request is too large");
+  let text: string;
+  try {
+    text = await request.text();
+  } catch {
+    return refuse(400, "request could not be read");
+  }
+  if (new TextEncoder().encode(text).byteLength > MAX_BODY_BYTES) {
+    return refuse(413, "request is too large");
+  }
+  let forwarded: ComputerEgressRequestV1 | undefined;
+  try {
+    forwarded = decodeComputerEgressRequestV1(JSON.parse(text));
+  } catch {
+    forwarded = undefined;
+  }
+  if (!forwarded) return refuse(400, "request is invalid");
+  let answer: unknown;
+  try {
+    answer = await dependencies.answer({
+      schemaVersion: 1,
+      object: token.o,
+      nonce: token.n,
+      request: forwarded,
+    });
+  } catch (error) {
+    console.error("computer egress failed", error);
+    return refuse(502, "the request could not be answered");
+  }
+  const response = decodeComputerEgressResponseV1(answer);
+  if (!response) return refuse(502, "the request could not be answered");
+  return Response.json(response, {
+    headers: { "cache-control": "no-store" },
+  });
+}

package/src/computer-host.ts

@@ -0,0 +1,92 @@
+/**
+ * The one place this deployment chooses its Computer host.
+ *
+ * `ComputerHostV1` is the interface everything above the Computer speaks
+ * (`computer/core/host.ts`); Fly is one implementation of it and the in-memory
+ * host in `computer/fake` is another. Which one this Worker runs is a
+ * deployment decision, not an application one, so it is made here — beside the
+ * bindings the choice depends on — and handed to the app as a factory.
+ *
+ * `scripts/check-computer-host-imports.ts` rule 2 admits `@frockbot/computer/fly`
+ * into this file, `computer/fly/**`, `apps/computer-host/**` and the two test
+ * rigs that prove the implementation. Substituting a k8s host is this file and
+ * nothing else.
+ */
+import type { ShellComputerHostOptionsV1 } from "@frockbot/app/shell/backend-runtime";
+import type {
+  ComputerHostCapabilitiesV1,
+  ComputerHostV1,
+} from "@frockbot/computer/core/host";
+import { FlyHostTransportV1 } from "@frockbot/computer/fly/host-client";
+import {
+  FLY_HOST_CAPABILITIES_V1,
+  FlyComputerHostV1,
+} from "@frockbot/computer/fly/provider";
+
+/**
+ * What this deployment's Computer host is, for the surfaces that must know
+ * before a Bot is running — the app's `frame-src` above all, which is built
+ * from `viewerFrameOrigins` while no Computer is open.
+ */
+export const COMPUTER_HOST_CAPABILITIES_V1: ComputerHostCapabilitiesV1 =
+  FLY_HOST_CAPABILITIES_V1;
+
+/**
+ * The `COMPUTER_HOST` service binding and the secret presented on it.
+ *
+ * Both or neither: a binding with no token reaches a host that refuses every
+ * call, which would surface as a 401 on each Turn rather than as a Computer
+ * that is not configured.
+ */
+export interface ComputerHostBindingV1 {
+  fetcher: { fetch(request: Request): Promise<Response> };
+  hostToken: string;
+}
+
+/** What this deployment's Worker needs before it has a Computer at all. */
+export interface ComputerHostEnvV1 {
+  COMPUTER_HOST?: { fetch(request: Request): Promise<Response> };
+  COMPUTER_HOST_TOKEN?: string;
+}
+
+/**
+ * The binding this deployment reaches its Computer host on, when it has one.
+ *
+ * This is the whole of "is a Computer configured", and it is derived here so
+ * that the app above can answer the question by the presence of a host and
+ * never by the name of a credential. The vendor's own token is the host app's:
+ * it reaches `apps/computer-host` and never this Worker, which could not use
+ * one if it had it.
+ */
+export function computerHostBindingV1(
+  env: ComputerHostEnvV1,
+): ComputerHostBindingV1 | undefined {
+  const fetcher = env.COMPUTER_HOST;
+  const hostToken = env.COMPUTER_HOST_TOKEN?.trim();
+  return fetcher && hostToken ? { fetcher, hostToken } : undefined;
+}
+
+/**
+ * The Computer host, over one binding.
+ *
+ * The Fly implementation holds no credential of its own — the Computer host
+ * app holds the only copy — so the whole of what a caller supplies here is the
+ * binding to send a call over and the seams the Turn owns.
+ */
+export function createComputerHostV1(
+  binding: ComputerHostBindingV1,
+  options: ShellComputerHostOptionsV1 = {},
+): ComputerHostV1 {
+  return new FlyComputerHostV1(
+    undefined,
+    (identity, tenant) =>
+      new FlyHostTransportV1({
+        fetcher: binding.fetcher,
+        hostToken: binding.hostToken,
+        identity,
+        tenant,
+      }),
+    options.sync,
+    options.agentControlOwnerId,
+  );
+}