@frockbot/cloudflare 0.0.0 → 0.7.291

package/deployment-config/profile.schema.json

@@ -0,0 +1,358 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://frockbot.com/schemas/deployment-profile-v1.json",
+  "title": "FrockBot deployment profile",
+  "description": "Who a deployment is: the Cloudflare account, the Worker names, the hostnames, the auth Package and the resources that carry identity. `frockbot-deployment-config` (`bun run deployment:config` in the FrockBot repository) reads one of these and writes the deployable wrangler configs from the tracked ones, which hold bindings and migrations and no identity at all.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "name", "accountId", "prefix", "authPackage"],
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "name": {
+      "description": "The profile's own name. Must match the file name, and names the directory under `.deployment/`.",
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "accountId": {
+      "description": "The Cloudflare account every Worker in this deployment belongs to.",
+      "type": "string",
+      "pattern": "^[0-9a-f]{32}$"
+    },
+    "region": {
+      "description": "Where a fresh deployment's R2 buckets and Vectorize index are created. The installer passes it; no wrangler config carries it, so changing it never moves an existing resource.",
+      "type": "string",
+      "enum": ["wnam", "enam", "weur", "eeur", "apac", "oc"]
+    },
+    "prefix": {
+      "description": "What every unnamed Worker and resource below is named from.",
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "workers": {
+      "description": "One entry per deployable. An entry that is absent is not generated and not deployed, which is how a profile leaves out the hosted-only marketing site and admin portal.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "app": {
+          "$ref": "#/$defs/worker"
+        },
+        "computerHost": {
+          "$ref": "#/$defs/worker"
+        },
+        "appletBuild": {
+          "$ref": "#/$defs/worker"
+        },
+        "marketing": {
+          "$ref": "#/$defs/worker"
+        },
+        "adminPortal": {
+          "$ref": "#/$defs/worker"
+        }
+      }
+    },
+    "images": {
+      "description": "Where the two container Workers get their image. Absent is `dockerfile`: wrangler builds it on the deploying machine, which needs Docker. `registry` pulls the image `release.yml` published for one tag, which is what an installer with no Docker deploys.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source"],
+      "properties": {
+        "source": {
+          "enum": ["dockerfile", "registry"]
+        },
+        "registry": {
+          "description": "The registry and namespace the images were published under, without the image name. It must be one Cloudflare Containers pull from: the managed registry, Docker Hub, Amazon ECR or Google Artifact Registry (see the README).",
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9.-]*(:[0-9]+)?(/[a-z0-9][a-z0-9._-]*)*$"
+        },
+        "tag": {
+          "description": "The image tag, which is the release version the deployment is running.",
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "source": {
+                "const": "registry"
+              }
+            },
+            "required": ["source"]
+          },
+          "then": {
+            "properties": {
+              "registry": true,
+              "tag": true
+            },
+            "required": ["registry", "tag"]
+          }
+        }
+      ]
+    },
+    "authPackage": {
+      "description": "Which sign-in Package this deployment builds: one of the two `@frockbot/cloudflare` ships, or a path, relative to this profile file, to a chooser module a white-label wrote \u2014 a module exporting `AUTH_PACKAGE_V1: AuthPackageBuildV1` and the `AuthPackageEnvironmentV1` type, as `apps/cloudflare/src/auth-package.ts` does (ADR 0038 \u00a73). Written as a wrangler `alias` for `#auth-package` unless it is `better-auth`, which the tracked source already resolves.",
+      "anyOf": [
+        {
+          "enum": ["better-auth", "access"]
+        },
+        {
+          "type": "string",
+          "pattern": "^\\.{1,2}/\\S+\\.(ts|mts|js|mjs)$"
+        }
+      ]
+    },
+    "authEnvironment": {
+      "description": "What a white-label's own auth Package reads off `env`, which this repository cannot know: `secrets` are required by the production-secrets check and carried by the deploy's secrets file, and `vars` are written into the app Worker's `vars`. Together they must name exactly the settings the chooser's `AUTH_PACKAGE_V1.required` lists. Only for an auth Package named by path.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "secrets": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "why"],
+            "properties": {
+              "name": {
+                "$ref": "#/$defs/envName"
+              },
+              "why": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "vars": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/envName"
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "brand": {
+      "description": "The brand module this deployment builds, relative to this profile file: a TypeScript module exporting `BRAND_V1: BrandV1` (`core/contracts/brand.ts`). Written as a wrangler `alias` for `#brand`. Absent, the Worker resolves `#brand` to FrockBot's own, `apps/cloudflare/src/brand.ts`.",
+      "type": "string",
+      "pattern": "^\\S+\\.ts$"
+    },
+    "webClient": {
+      "description": "The directory the app Worker's static assets are uploaded from, relative to this profile file: the web client `build-flutter-web.ts` staged for this deployment's own application. Absent, the package's own `dist/web`, which is where FrockBot's build stages FrockBot's client.",
+      "type": "string",
+      "minLength": 1
+    },
+    "access": {
+      "description": "The Cloudflare Access application the `access` Package verifies against. Written as the `ACCESS_TEAM_DOMAIN` and `ACCESS_AUD` vars.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["teamDomain", "aud"],
+      "properties": {
+        "teamDomain": {
+          "$ref": "#/$defs/hostname"
+        },
+        "aud": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      }
+    },
+    "adminEmails": {
+      "description": "The deployment's admins: they bypass admission, and a debug Turn may act as one of them. The debug surface itself is gated on `DEBUG_TOKEN`. The installer sets it as the Worker secret `FROCKBOT_ADMIN_EMAILS`; no generated config carries it, which is why the hosted profile leaves it to the repository secret it already has.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/email"
+      }
+    },
+    "d1DatabaseId": {
+      "description": "The `AUTH_DB` database. Required by the `better-auth` Package unless the deploy supplies it with `--d1-database-id`, which is how a disposable stage names a database it creates in the same job.",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F-]{36}$"
+    },
+    "aiGateway": {
+      "description": "The AI Gateway that serves the platform model. Absent, the Worker takes the `AI` binding and Auto resolves to a concrete Workers AI model.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["accountId"],
+      "properties": {
+        "accountId": {
+          "description": "The account owning the Gateway. Present with the `FROCK_AI_GATEWAY_TOKEN` secret, requests take the compat HTTP transport \u2014 the only one that accepts a dynamic route.",
+          "type": "string",
+          "pattern": "^[0-9a-f]{32}$"
+        },
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9-]+$"
+        },
+        "autoRoute": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9-]+$"
+        }
+      }
+    },
+    "nativeAuth": {
+      "description": "The native returns this deployment serves: `android`, the released Mac and iPhone apps (`macos`, `ios`), and the FrockBot Dev builds (`macos-dev`, `ios-dev`), each named only where such a build signs in. Nothing is implied by another entry. Absent, the deployment offers no native sign-in at all.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["android", "macos", "macos-dev", "ios", "ios-dev"]
+      }
+    },
+    "nativeApps": {
+      "description": "The signed native apps this deployment's App Links and Universal Links name, in `/.well-known/assetlinks.json` and `/.well-known/apple-app-site-association`. Written as the `NATIVE_APPS` var. Absent, the deployment serves neither file.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "android": {
+          "description": "Each Android app by package name, with the SHA-256 fingerprints of the certificates that sign it.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["packageName", "sha256CertFingerprints"],
+            "properties": {
+              "packageName": {
+                "type": "string",
+                "pattern": "^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$"
+              },
+              "sha256CertFingerprints": {
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "pattern": "^[0-9A-F]{2}(:[0-9A-F]{2}){31}$"
+                }
+              }
+            }
+          }
+        },
+        "apple": {
+          "description": "The Apple app ids (`<team id>.<bundle id>`) the association names for the released Mac and iPhone returns.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Z0-9]{10}\\.[A-Za-z0-9.-]+$"
+          }
+        }
+      }
+    },
+    "email": {
+      "description": "Email to and from Bots, both directions on one domain. Each Bot's address is `<bot-slug>.<username>@<domain>`. The domain becomes the app Worker's `EMAIL_DOMAIN` var, which the `email()` handler receives mail for, and the app Worker gains a `send_email` binding named `SEND_EMAIL`, through which each Bot sends from its own address on that domain and no other. Absent, no Bot has an address, every message is refused and nothing is sent. The domain's Email Routing catch-all and its onboarding for Email Sending are set up in Cloudflare by hand: see `apps/cloudflare/deployment-config/README.md`.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["domain"],
+      "properties": {
+        "domain": {
+          "$ref": "#/$defs/hostname"
+        }
+      }
+    },
+    "resources": {
+      "description": "Names that carry identity. Each is derived from `prefix` when absent.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "applicationArtifactsBucket": {
+          "$ref": "#/$defs/resourceName"
+        },
+        "memoryFilesBucket": {
+          "$ref": "#/$defs/resourceName"
+        },
+        "memoryIndex": {
+          "$ref": "#/$defs/resourceName"
+        },
+        "authDatabaseName": {
+          "$ref": "#/$defs/resourceName"
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "authPackage": {
+            "const": "access"
+          }
+        },
+        "required": ["authPackage"]
+      },
+      "then": {
+        "properties": {
+          "access": true
+        },
+        "required": ["access"]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "authPackage": {
+            "enum": ["better-auth", "access"]
+          }
+        },
+        "required": ["authPackage"]
+      },
+      "then": {
+        "properties": {
+          "authEnvironment": false
+        }
+      },
+      "else": {
+        "properties": {
+          "authEnvironment": true
+        },
+        "required": ["authEnvironment"]
+      }
+    }
+  ],
+  "$defs": {
+    "worker": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/resourceName"
+        },
+        "hostnames": {
+          "description": "Custom domains this Worker answers on. Absent, the Worker takes its `workers.dev` hostname, which is what a deployment with no zone has.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/hostname"
+          }
+        }
+      }
+    },
+    "hostname": {
+      "type": "string",
+      "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$"
+    },
+    "email": {
+      "type": "string",
+      "pattern": "^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$"
+    },
+    "resourceName": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "maxLength": 63
+    },
+    "envName": {
+      "type": "string",
+      "pattern": "^[A-Z][A-Z0-9_]*$"
+    }
+  }
+}

package/deployment-config/profile.ts

@@ -0,0 +1,124 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import Ajv from "ajv";
+import {
+  DEPLOYMENT_PROFILE_SCHEMA_V1,
+  type DeploymentProfileV1 as GeneratedDeploymentProfileV1,
+} from "./profile-schema.generated.ts";
+
+/**
+ * `@frockbot/cloudflare` itself: where the app Worker's tracked wrangler config
+ * is, in this repository and in a consumer's `node_modules` alike.
+ */
+export const PACKAGE_ROOT_V1 = join(import.meta.dirname, "..");
+
+/** The profile contract, shipped beside the generator that enforces it. */
+export const PROFILE_SCHEMA_FILE_V1 = join(
+  import.meta.dirname,
+  "profile.schema.json",
+);
+
+export { DEPLOYMENT_PROFILE_SCHEMA_V1 };
+
+type ProfileWithoutAuthV1 = Omit<
+  GeneratedDeploymentProfileV1,
+  "authPackage" | "access" | "authEnvironment"
+>;
+type AccessApplicationV1 = NonNullable<GeneratedDeploymentProfileV1["access"]>;
+type AuthEnvironmentShapeV1 = NonNullable<
+  GeneratedDeploymentProfileV1["authEnvironment"]
+>;
+
+/**
+ * A deployment profile, as the schema admits one.
+ *
+ * `FromSchema` of the schema, with the auth Package's three cases spelled out:
+ * `authPackage` may be a path, which `FromSchema` can only read as `string`,
+ * and a `string` cannot exclude `"access"` — so the generated type alone would
+ * let an Access profile name no Access application. The schema's `allOf` says
+ * the same thing to ajv, which is what refuses a profile file.
+ */
+export type DeploymentProfileV1 = ProfileWithoutAuthV1 &
+  (
+    | {
+        authPackage: "better-auth";
+        access?: AccessApplicationV1;
+        authEnvironment?: never;
+      }
+    | {
+        authPackage: "access";
+        access: AccessApplicationV1;
+        authEnvironment?: never;
+      }
+    | {
+        authPackage: `./${string}` | `../${string}`;
+        access?: AccessApplicationV1;
+        authEnvironment: AuthEnvironmentShapeV1;
+      }
+  );
+
+export type DeploymentWorkerV1 = NonNullable<
+  NonNullable<DeploymentProfileV1["workers"]>["app"]
+>;
+
+export type DeploymentImagesV1 = NonNullable<DeploymentProfileV1["images"]>;
+export type DeploymentRegionV1 = NonNullable<DeploymentProfileV1["region"]>;
+
+export const DEPLOYMENT_REGIONS_V1 =
+  DEPLOYMENT_PROFILE_SCHEMA_V1.properties.region.enum;
+
+export function deploymentRegionV1(value: string): DeploymentRegionV1 {
+  if ((DEPLOYMENT_REGIONS_V1 as readonly string[]).includes(value)) {
+    return value as DeploymentRegionV1;
+  }
+  throw new Error(
+    `"${value}" is not a deployment region (${DEPLOYMENT_REGIONS_V1.join(", ")})`,
+  );
+}
+
+/**
+ * The schema is the contract, so it is the thing that refuses a bad profile —
+ * not a hand-written check that drifts from it.
+ */
+export function validateProfileV1(value: unknown, what: string): void {
+  const schema: unknown = JSON.parse(
+    readFileSync(PROFILE_SCHEMA_FILE_V1, "utf8"),
+  );
+  // Ajv ships a CommonJS default export; under this project's ESM resolution
+  // the constructor is one property in.
+  const AjvConstructor = ((Ajv as unknown as { default?: typeof Ajv })
+    .default ?? Ajv) as typeof Ajv;
+  const ajv = new AjvConstructor({ allErrors: true, strict: true });
+  const validate = ajv.compile(schema as object);
+  if (validate(value)) return;
+  const detail = (validate.errors ?? [])
+    .map((error) => `${error.instancePath || "/"} ${error.message ?? ""}`)
+    .join("; ");
+  throw new Error(`${what} is not a deployment profile: ${detail}`);
+}
+
+/** `<profileDirectory>/<name>.json`, validated against the schema. */
+export function loadProfileV1(
+  name: string,
+  profileDirectory: string,
+): DeploymentProfileV1 {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+    throw new Error(`"${name}" is not a profile name`);
+  }
+  const file = join(profileDirectory, `${name}.json`);
+  let source: string;
+  try {
+    source = readFileSync(file, "utf8");
+  } catch {
+    throw new Error(`No deployment profile at ${file}`);
+  }
+  const profile: unknown = JSON.parse(source);
+  validateProfileV1(profile, file);
+  const loaded = profile as DeploymentProfileV1;
+  if (loaded.name !== name) {
+    throw new Error(
+      `${file} names the profile "${loaded.name}"; a profile's name is its file name`,
+    );
+  }
+  return loaded;
+}

package/migrations/0001_better_auth.sql

@@ -0,0 +1,15 @@
+create table "user" ("id" text not null primary key, "name" text not null, "email" text not null unique, "emailVerified" integer not null, "image" text, "createdAt" date not null, "updatedAt" date not null);
+
+create table "session" ("id" text not null primary key, "expiresAt" date not null, "token" text not null unique, "createdAt" date not null, "updatedAt" date not null, "ipAddress" text, "userAgent" text, "userId" text not null references "user" ("id") on delete cascade);
+
+create table "account" ("id" text not null primary key, "issuer" text not null, "accountId" text not null, "providerId" text not null, "userId" text not null references "user" ("id") on delete cascade, "accessToken" text, "refreshToken" text, "idToken" text, "accessTokenExpiresAt" date, "refreshTokenExpiresAt" date, "scope" text, "password" text, "createdAt" date not null, "updatedAt" date not null);
+
+create table "verification" ("id" text not null primary key, "identifier" text not null, "value" text not null, "expiresAt" date not null, "createdAt" date not null, "updatedAt" date not null);
+
+create index "session_userId_idx" on "session" ("userId");
+
+create index "account_userId_idx" on "account" ("userId");
+
+create index "verification_identifier_idx" on "verification" ("identifier");
+
+create unique index "account_issuer_accountId_uidx" on "account" ("issuer", "accountId");

package/migrations/0002_drop_account_issuer.sql

@@ -0,0 +1,8 @@
+-- `account.issuer` belonged to Better Auth 1.7.0 through 1.7.2. From 1.7.3 the
+-- library neither writes it nor looks accounts up by it — it keys on
+-- (providerId, accountId) — and it refuses to serve `/api/auth/*` at all while
+-- a column it never writes is `not null`, so the column and its unique index
+-- have to go rather than be kept nullable.
+drop index if exists "account_issuer_accountId_uidx";
+
+alter table "account" drop column "issuer";

package/package.json

@@ -1,14 +1,70 @@
 {
   "name": "@frockbot/cloudflare",
-  "version": "0.0.0",
-  "description": "Placeholder reserving this name for trusted publishing. Superseded by the first release.",
-  "license": "UNLICENSED",
+  "version": "0.7.291",
+  "private": false,
+  "license": "MIT",
+  "type": "module",
+  "imports": {
+    "#auth-package": "./src/auth-package.ts",
+    "#brand": "./src/brand.ts"
+  },
+  "bin": {
+    "frockbot-deployment-config": "./deployment-config/cli.ts"
+  },
+  "scripts": {
+    "client:build": "bun run build-flutter-web.ts",
+    "artifact:build": "bun run client:build && bun run build-artifact.ts",
+    "build": "bun run artifact:build && bun ../../scripts/deployment-config.ts hosted && wrangler deploy --dry-run -c ../../.deployment/hosted/app/wrangler.jsonc --outdir dist/gateway",
+    "dev": "bun run dev.ts",
+    "test": "bun test src && bun run test:workerd",
+    "test:workerd": "vitest run --config vitest.config.ts",
+    "test:integration": "bun run artifact:build && vitest run --config vitest.integration.config.ts",
+    "test:e2e": "playwright test -c e2e/playwright.config.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.access.json && tsc --noEmit -p test/tsconfig.json && tsc --noEmit -p e2e/tsconfig.json"
+  },
+  "dependencies": {
+    "@frockbot/app": "0.7.291",
+    "@frockbot/applets": "0.7.291",
+    "@frockbot/computer": "0.7.291",
+    "@frockbot/core": "0.7.291",
+    "@frockbot/frock-compose": "0.7.291",
+    "@frockbot/providers": "0.7.291",
+    "@rive-app/flutter-native-wasm": "44.0.0",
+    "agents": "0.24.0",
+    "ai": "^7.0.107",
+    "ajv": "8.20.0",
+    "json-schema-to-ts": "^3.1.1"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-plugin": "^1.1.10",
+    "@cloudflare/workers-types": "5.20260920.1",
+    "@playwright/test": "1.63.0",
+    "@types/bun": "1.4.2",
+    "typescript": "npm:typescript-native-bridge@6.0.3-bridge.16.tsgo.7.0.2",
+    "vitest": "^4.1.0",
+    "wrangler": "4.129.0"
+  },
+  "files": [
+    "src",
+    "deployment-config",
+    "migrations",
+    "wrangler.jsonc",
+    "build-artifact.ts",
+    "build-flutter-web.ts",
+    "release-version.ts",
+    "!**/*.test.ts",
+    "!**/*.type-test.ts",
+    "!**/tsconfig*.json"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/timoconnellaus/frockbot.git",
     "directory": "apps/cloudflare"
   },
-  "publishConfig": {
-    "access": "public"
+  "frockbot": {
+    "npm": true
   }
 }

package/release-version.ts

@@ -0,0 +1,20 @@
+/** The pattern `ClientHello.nativeVersion` accepts, so a release can always say its name. */
+const RELEASE =
+  /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(-[0-9A-Za-z.-]{1,20})?$/u;
+
+/**
+ * The version tag `release.yml` builds, without its `v`, from
+ * `FROCKBOT_RELEASE`; null for any other build. Shared by the web client build
+ * here and `scripts/native-metadata.ts`, so the two cannot disagree about what
+ * a release is called.
+ */
+export function releaseVersion(value: string | undefined) {
+  if (value === undefined || value === "") return null;
+  const match = RELEASE.exec(value);
+  if (!match || value.length > 32) {
+    throw new Error(
+      `FROCKBOT_RELEASE must be a version tag without its \`v\`, such as 0.7.163 or 0.8.0-rc.1, not ${JSON.stringify(value)}.`,
+    );
+  }
+  return { release: value, versionName: `${match[1]}.${match[2]}.${match[3]}` };
+}