npm - @tangle-network/create-agent-app - Versions diffs - 0.44.36 - Mend

@tangle-network/create-agent-app 0.44.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (42) hide show

package/README.md +9 -0
package/index.mjs +183 -0
package/package.json +34 -0
package/template/.dev.vars.example +11 -0
package/template/AGENTS.md +67 -0
package/template/CLAUDE.md +6 -0
package/template/CUSTOMIZE.md +83 -0
package/template/KNOWLEDGE.md +73 -0
package/template/README.md +41 -0
package/template/_gitignore +5 -0
package/template/_package.json +33 -0
package/template/_tsconfig.json +16 -0
package/template/_wrangler.toml +22 -0
package/template/agent.config.ts +113 -0
package/template/knowledge/.gitkeep +0 -0
package/template/knowledge/README.md +24 -0
package/template/scripts/knowledge-ingest.mjs +86 -0
package/template/src/agent-app.ts +77 -0
package/template/src/worker.ts +128 -0
package/template/tests/agent-app.test.ts +71 -0
package/template/vitest.config.ts +7 -0
package/template-chat/.dev.vars.example +18 -0
package/template-chat/AGENTS.md +73 -0
package/template-chat/CLAUDE.md +6 -0
package/template-chat/CUSTOMIZE.md +88 -0
package/template-chat/README.md +50 -0
package/template-chat/_gitignore +6 -0
package/template-chat/_package.json +38 -0
package/template-chat/_tsconfig.json +16 -0
package/template-chat/_wrangler.toml +38 -0
package/template-chat/agent.config.ts +73 -0
package/template-chat/declarations.d.ts +9 -0
package/template-chat/migrations/0001_init.sql +109 -0
package/template-chat/prompts/system.md +11 -0
package/template-chat/public/index.html +236 -0
package/template-chat/src/chat.ts +210 -0
package/template-chat/src/db/schema.ts +70 -0
package/template-chat/src/env.ts +33 -0
package/template-chat/src/sandbox.ts +159 -0
package/template-chat/src/worker.ts +58 -0
package/template-chat/tests/chat-turn.e2e.test.ts +277 -0
package/template-chat/vitest.config.ts +22 -0

package/template-chat/public/index.html ADDED Viewed

@@ -0,0 +1,236 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>__PROJECT_NAME__ — dev chat</title>
+<!--
+  The DEV chat page: a dependency-free client for the API this worker ships,
+  good enough to exercise auth, threads, multimodal turns, and streaming from
+  a browser today. It is NOT the product surface — build that in React with
+  @tangle-network/agent-app/web-react (ChatComposer, ChatMessages,
+  streamChatTurn, useChatInteractions), which owns reconnect/replay, question
+  cards, and the typed part renderers. See CUSTOMIZE.md step 5.
+-->
+<style>
+  :root { color-scheme: light dark; --border: #d0d3da; --muted: #6b7280; --accent: #4f46e5; }
+  @media (prefers-color-scheme: dark) { :root { --border: #333842; --muted: #9aa1ad; --accent: #818cf8; } }
+  * { box-sizing: border-box; }
+  body { margin: 0; font: 15px/1.5 system-ui, sans-serif; display: flex; height: 100dvh; }
+  aside { width: 240px; border-right: 1px solid var(--border); padding: 12px; display: flex; flex-direction: column; gap: 8px; }
+  main { flex: 1; display: flex; flex-direction: column; }
+  header { padding: 10px 16px; border-bottom: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+  #transcript { flex: 1; overflow-y: auto; padding: 16px; display: flex; flex-direction: column; gap: 12px; }
+  .msg { max-width: 52rem; white-space: pre-wrap; }
+  .msg.user { align-self: flex-end; background: color-mix(in srgb, var(--accent) 12%, transparent); border-radius: 10px; padding: 8px 12px; }
+  .msg .meta { font-size: 12px; color: var(--muted); }
+  .chip { display: inline-block; font-size: 12px; border: 1px solid var(--border); border-radius: 999px; padding: 1px 8px; margin: 2px 4px 2px 0; color: var(--muted); }
+  .reasoning { color: var(--muted); font-size: 13px; }
+  form.composer { display: flex; gap: 8px; padding: 12px 16px; border-top: 1px solid var(--border); }
+  textarea { flex: 1; resize: none; font: inherit; padding: 8px 10px; border: 1px solid var(--border); border-radius: 8px; background: transparent; color: inherit; }
+  button { font: inherit; border: 1px solid var(--border); background: transparent; color: inherit; border-radius: 8px; padding: 6px 12px; cursor: pointer; }
+  button.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+  .thread { text-align: left; border: none; padding: 6px 8px; border-radius: 6px; width: 100%; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .thread.active { background: color-mix(in srgb, var(--accent) 15%, transparent); }
+  dialog { border: 1px solid var(--border); border-radius: 12px; padding: 20px; min-width: 320px; }
+  dialog form { display: flex; flex-direction: column; gap: 10px; }
+  dialog input { font: inherit; padding: 8px 10px; border: 1px solid var(--border); border-radius: 8px; background: transparent; color: inherit; }
+  #files { padding: 0 16px; }
+  .error { color: #dc2626; font-size: 13px; padding: 0 16px; }
+</style>
+</head>
+<body>
+<aside>
+  <button id="new-thread" class="primary">New thread</button>
+  <nav id="threads" style="overflow-y:auto"></nav>
+</aside>
+<main>
+  <header>
+    <strong>__PROJECT_NAME__ <span style="color:var(--muted);font-weight:400">dev chat</span></strong>
+    <span id="who" style="color:var(--muted);font-size:13px"></span>
+  </header>
+  <div id="transcript"></div>
+  <div id="files"></div>
+  <div id="error" class="error"></div>
+  <form class="composer" id="composer">
+    <button type="button" id="attach" title="Attach files">+</button>
+    <input type="file" id="file-input" multiple hidden />
+    <textarea id="input" rows="2" placeholder="Message the agent…"></textarea>
+    <button type="submit" class="primary">Send</button>
+  </form>
+</main>
+<dialog id="auth">
+  <form method="dialog" id="auth-form">
+    <strong id="auth-title">Sign in</strong>
+    <input id="email" type="email" placeholder="email" required autocomplete="email" />
+    <input id="password" type="password" placeholder="password" required minlength="8" autocomplete="current-password" />
+    <button class="primary" value="submit">Continue</button>
+    <button type="button" id="auth-toggle" style="border:none;color:var(--muted)">No account? Sign up</button>
+    <span id="auth-error" class="error" style="padding:0"></span>
+  </form>
+</dialog>
+<script type="module">
+const $ = (id) => document.getElementById(id)
+const state = { threadId: null, parts: [], signUp: false }
+const api = async (path, init) => {
+  const res = await fetch(path, { headers: { 'content-type': 'application/json' }, ...init })
+  if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error ?? `${res.status} on ${path}`)
+  return res.json()
+}
+// ── auth ────────────────────────────────────────────────────────────────────
+async function ensureSession() {
+  const session = await fetch('/api/auth/get-session').then((r) => r.json()).catch(() => null)
+  if (session?.user) { $('who').textContent = session.user.email; return }
+  $('auth').showModal()
+  await new Promise((resolve) => {
+    $('auth-toggle').onclick = () => {
+      state.signUp = !state.signUp
+      $('auth-title').textContent = state.signUp ? 'Sign up' : 'Sign in'
+      $('auth-toggle').textContent = state.signUp ? 'Have an account? Sign in' : 'No account? Sign up'
+    }
+    $('auth-form').onsubmit = async (e) => {
+      e.preventDefault()
+      const email = $('email').value, password = $('password').value
+      try {
+        await api(`/api/auth/sign-${state.signUp ? 'up' : 'in'}/email`, {
+          method: 'POST',
+          body: JSON.stringify({ email, password, ...(state.signUp ? { name: email.split('@')[0] } : {}) }),
+        })
+        $('who').textContent = email
+        $('auth').close(); resolve()
+      } catch (err) { $('auth-error').textContent = err.message }
+    }
+  })
+}
+// ── threads + transcript ────────────────────────────────────────────────────
+async function loadThreads() {
+  const { threads } = await api('/api/threads')
+  $('threads').replaceChildren(...threads.map((t) => {
+    const b = document.createElement('button')
+    b.className = `thread${t.id === state.threadId ? ' active' : ''}`
+    b.textContent = t.title
+    b.onclick = () => openThread(t.id)
+    return b
+  }))
+}
+function row(role, text = '') {
+  const div = document.createElement('div')
+  div.className = `msg ${role}`
+  div.textContent = text
+  $('transcript').append(div)
+  div.scrollIntoView()
+  return div
+}
+// Chips are built with textContent — part fields are agent-produced strings
+// and must never be interpreted as markup.
+function chip(container, text) {
+  const wrap = document.createElement('div')
+  const span = document.createElement('span')
+  span.className = 'chip'
+  span.textContent = text
+  wrap.append(span)
+  container.append(wrap)
+}
+function renderParts(container, parts = []) {
+  for (const p of parts) {
+    if (p.type === 'tool') chip(container, `${p.tool ?? 'tool'} · ${p.state?.status ?? ''}`)
+    if (p.type === 'file' || p.type === 'image') chip(container, `📎 ${p.filename ?? p.path ?? p.type}`)
+  }
+}
+async function openThread(id) {
+  state.threadId = id
+  const { messages } = await api(`/api/threads/${id}/messages`)
+  $('transcript').replaceChildren()
+  for (const m of messages) {
+    const div = row(m.role, m.content)
+    renderParts(div, m.parts)
+    if (m.role === 'assistant' && m.inputTokens != null) {
+      const meta = document.createElement('div')
+      meta.className = 'meta'
+      meta.textContent = `${m.model ?? ''} · ${m.inputTokens}→${m.outputTokens} tokens`
+      div.append(meta)
+    }
+  }
+  loadThreads()
+}
+// ── uploads → prompt parts ──────────────────────────────────────────────────
+$('attach').onclick = () => $('file-input').click()
+$('file-input').onchange = async () => {
+  const form = new FormData()
+  for (const f of $('file-input').files) form.append('files', f)
+  const res = await fetch('/api/chat/upload', { method: 'POST', body: form })
+  if (!res.ok) { $('error').textContent = (await res.json()).error; return }
+  const { files } = await res.json()
+  state.parts.push(...files.map((f) => f.part))
+  $('files').replaceChildren(...state.parts.map((p) => Object.assign(document.createElement('span'), { className: 'chip', textContent: p.filename ?? p.path ?? p.type })))
+}
+// ── one streamed turn ───────────────────────────────────────────────────────
+// Minimal NDJSON consumer for the dev page. The production client is
+// streamChatTurn from @tangle-network/agent-app/web-react — it also resumes
+// via /api/chat/replay/:turnId after a dropped connection.
+async function runTurn(content, parts) {
+  const res = await fetch('/api/chat', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ threadId: state.threadId, content, parts }),
+  })
+  if (!res.ok) { $('error').textContent = (await res.json()).error; return }
+  const assistant = row('assistant')
+  let text = ''
+  const reader = res.body.getReader()
+  const decoder = new TextDecoder()
+  let buffer = ''
+  const handle = (line) => {
+    if (!line.trim()) return
+    let parsed; try { parsed = JSON.parse(line) } catch { return }
+    const evt = parsed.kind === 'event' ? parsed.event : parsed
+    if (evt.type === 'text') { text += evt.text; assistant.textContent = text }
+    else if (evt.type === 'reasoning') { /* keep the dev page quiet; web-react renders these */ }
+    else if (evt.type === 'tool_call') chip(assistant, `${evt.call?.toolName ?? 'tool'}…`)
+    else if (evt.type === 'error') $('error').textContent = String(evt.details ?? evt.error)
+    assistant.scrollIntoView()
+  }
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) { if (buffer.trim()) handle(buffer); break }
+    buffer += decoder.decode(value, { stream: true })
+    const lines = buffer.split('\n'); buffer = lines.pop() ?? ''
+    lines.forEach(handle)
+  }
+  openThread(state.threadId)
+}
+$('composer').onsubmit = async (e) => {
+  e.preventDefault()
+  const content = $('input').value.trim()
+  const parts = state.parts.splice(0)
+  if (!content && parts.length === 0) return
+  $('error').textContent = ''
+  $('files').replaceChildren()
+  $('input').value = ''
+  if (!state.threadId) {
+    const { thread } = await api('/api/threads', { method: 'POST', body: JSON.stringify({ firstMessage: content || 'New thread' }) })
+    state.threadId = thread.id
+  }
+  row('user', content)
+  await runTurn(content, parts).catch((err) => { $('error').textContent = err.message })
+}
+$('new-thread').onclick = () => { state.threadId = null; $('transcript').replaceChildren() }
+await ensureSession()
+await loadThreads()
+</script>
+</body>
+</html>

package/template-chat/src/chat.ts ADDED Viewed

@@ -0,0 +1,210 @@
+/**
+ * src/chat.ts — the COMPOSER. The whole server chat vertical assembled from
+ * `@tangle-network/agent-app` factories, exactly the `examples/chat-app.md`
+ * assembly made runnable:
+ *
+ *   auth         `createAppAuth` (better-auth over drizzle/D1) + its guards
+ *   persistence  `createChatStore` over the tables in `src/db/schema.ts`
+ *   turn         `createChatTurnRoutes` — body validation, turn identity,
+ *                the default turn-buffer tap (replay after a drop), user and
+ *                assistant rows persisted with typed parts + usage receipt
+ *   producer     the sandbox lane from `src/sandbox.ts`
+ *   uploads      `createUploadRoute` — small files inline (`data:` URI),
+ *                large files into the sandbox workspace by path
+ *   asks         `/interactions` list/answer endpoints over the sidecar
+ *
+ * You extend THIS file (and `src/worker.ts`); you never edit the shell. The
+ * `overrides` seams exist so the e2e test in `tests/` can run the identical
+ * assembly against an in-memory database and a fake sandbox producer — the
+ * production wiring is the zero-override call.
+ *
+ * Workspaces are single-user here (workspace id = user id). Multi-user teams
+ * later: `@tangle-network/agent-app/teams` + `createChatTables({ workspaceTable })`.
+ */
+import { config } from '../agent.config'
+import { createAppAuth, type AppAuth } from '@tangle-network/agent-app/app-auth'
+import {
+  createChatTurnRoutes,
+  createUploadRoute,
+  type ChatTurnAuthorization,
+  type ChatTurnProduceArgs,
+  type ChatTurnRouteProducer,
+  type ChatTurnRoutes,
+  type SandboxUploadSink,
+} from '@tangle-network/agent-app/chat-routes'
+import {
+  createChatStore,
+  type ChatDatabase,
+  type ChatStore,
+} from '@tangle-network/agent-app/chat-store'
+import { guardResolution } from '@tangle-network/agent-app/platform'
+import {
+  createD1TurnEventStore,
+  type TurnEventStore,
+} from '@tangle-network/agent-app/stream'
+import { drizzle } from 'drizzle-orm/d1'
+import { accounts, messages, sessions, threads, users, verifications } from './db/schema'
+import type { AppEnv } from './env'
+import { appSlug, createSandboxProduce, resolveSidecarConnection, resolveUploadSink } from './sandbox'
+export interface ChatAppOverrides {
+  /** Test seam: an in-memory drizzle db (the e2e test runs the REAL
+   *  `migrations/0001_init.sql` into better-sqlite3). Default: `drizzle(env.DB)`. */
+  db?: ChatDatabase
+  /** Test seam: `createMemoryTurnEventStore()`. Default: D1-backed buffer. */
+  turnStore?: TurnEventStore
+  /** Test seam: a fake sandbox producer. Default: the real sandbox lane. */
+  produce?: (args: ChatTurnProduceArgs<void>) => ChatTurnRouteProducer | Promise<ChatTurnRouteProducer>
+  /** Test seam: where large uploads land. Default: the workspace box's fs. */
+  uploadSink?: (scope: { workspaceId: string; userId: string }) => Promise<SandboxUploadSink | null>
+}
+export interface ChatApp {
+  auth: AppAuth
+  store: ChatStore
+  routes: ChatTurnRoutes & {
+    /** POST `{ title?, firstMessage? }` → `{ thread }`. */
+    createThread(request: Request): Promise<Response>
+    /** GET → `{ threads, total, limit, offset }`. */
+    listThreads(request: Request): Promise<Response>
+    /** GET → `{ thread, messages }` — the full typed transcript. */
+    threadMessages(request: Request, params: { threadId: string }): Promise<Response>
+  }
+  upload(request: Request): Promise<Response>
+}
+const notFound = () => Response.json({ error: 'Thread not found' }, { status: 404 })
+export function buildChatApp(env: AppEnv, overrides: ChatAppOverrides = {}): ChatApp {
+  const db = overrides.db ?? (drizzle(env.DB) as unknown as ChatDatabase)
+  const store = createChatStore(db, { threads, messages })
+  const auth = createAppAuth({
+    appName: config.name,
+    baseURL: env.BETTER_AUTH_URL,
+    secret: env.BETTER_AUTH_SECRET,
+    db,
+    schema: { users, sessions, accounts, verifications },
+    // For a throwaway prototype you can swap the drizzle pair for
+    // `database: memoryAdapter({ user: [], session: [], account: [], verification: [] })`
+    // (from 'better-auth/adapters/memory') — nothing survives a restart.
+  })
+  /** Session → identity + thread access, for both routes and seams. Guards
+   *  throw JSON Responses; `guardResolution` adapts them to `{ ok, response }`. */
+  async function requireUser(request: Request) {
+    return guardResolution(() => auth.requireApiUser(request))
+  }
+  /** The one product-supplied access step for turn + replay. Identity comes
+   *  from the SESSION, never from the request body — a client cannot forge
+   *  `userId`/`workspaceId`. */
+  async function authorize(args: {
+    request: Request
+    intent: 'turn' | 'replay' | 'running'
+    body?: Record<string, unknown>
+    threadId?: string
+  }): Promise<ChatTurnAuthorization<void>> {
+    const session = await requireUser(args.request)
+    if (!session.ok) return session
+    const { user } = session.value
+    // `turn` and `running` are thread-scoped and MUST verify ownership: both name
+    // a thread the caller supplies (POST body for turn, `?threadId=` for running,
+    // whose response enumerates that thread's live turn ids). Inaccessible reads
+    // are indistinguishable from missing ones — a cross-workspace probe must not
+    // learn the thread exists.
+    if (args.intent === 'turn' || args.intent === 'running') {
+      const threadId = args.intent === 'turn' ? String(args.body?.threadId ?? '') : args.threadId
+      const thread = threadId ? await store.getThread(threadId) : null
+      if (!thread || thread.workspaceId !== user.id) return { ok: false, response: notFound() }
+    }
+    // Replay authorizes on session only: turn ids are unguessable UUIDs minted
+    // server-side and announced only on the owner's live stream.
+    return { ok: true, tenantId: user.id, userId: user.id, context: undefined }
+  }
+  const routes = createChatTurnRoutes<void>({
+    projectId: appSlug,
+    authorize,
+    store,
+    turnStore: overrides.turnStore ?? createD1TurnEventStore(env.DB),
+    produce: overrides.produce ?? createSandboxProduce(env),
+    interactions: {
+      resolveConnection: async ({ request, intent, body }) => {
+        const session = await requireUser(request)
+        if (!session.ok) return session
+        const { user } = session.value
+        const threadId =
+          intent === 'answer'
+            ? String(body?.threadId ?? '')
+            : (new URL(request.url).searchParams.get('threadId') ?? '')
+        const thread = await store.getThread(threadId)
+        if (!thread || thread.workspaceId !== user.id) return { ok: false, response: notFound() }
+        const connection = await resolveSidecarConnection(env, {
+          workspaceId: user.id,
+          userId: user.id,
+          threadId,
+        })
+        if (!connection) return { ok: false, unavailable: 'SANDBOX_UNAVAILABLE' }
+        return { ok: true, connection }
+      },
+    },
+  })
+  const upload = createUploadRoute({
+    authorize: async ({ request }) => {
+      const session = await requireUser(request)
+      if (!session.ok) return session
+      const { user } = session.value
+      const resolveSink = overrides.uploadSink ?? ((scope) => resolveUploadSink(env, scope))
+      return {
+        ok: true,
+        sink: await resolveSink({ workspaceId: user.id, userId: user.id }),
+      }
+    },
+  })
+  async function createThread(request: Request): Promise<Response> {
+    const session = await requireUser(request)
+    if (!session.ok) return session.response
+    const body = (await request.json().catch(() => null)) as
+      | { title?: string; firstMessage?: string }
+      | null
+    const thread = await store.createThread({
+      workspaceId: session.value.user.id,
+      ...(body?.title ? { title: body.title } : {}),
+      ...(body?.firstMessage ? { firstMessage: body.firstMessage } : {}),
+    })
+    return Response.json({ thread })
+  }
+  async function listThreads(request: Request): Promise<Response> {
+    const session = await requireUser(request)
+    if (!session.ok) return session.response
+    const url = new URL(request.url)
+    const limit = Number(url.searchParams.get('limit')) || undefined
+    const offset = Number(url.searchParams.get('offset')) || undefined
+    const result = await store.listThreads({
+      workspaceId: session.value.user.id,
+      ...(limit !== undefined ? { limit } : {}),
+      ...(offset !== undefined ? { offset } : {}),
+    })
+    return Response.json(result)
+  }
+  async function threadMessages(request: Request, params: { threadId: string }): Promise<Response> {
+    const session = await requireUser(request)
+    if (!session.ok) return session.response
+    const thread = await store.getThread(params.threadId)
+    if (!thread || thread.workspaceId !== session.value.user.id) return notFound()
+    return Response.json({ thread, messages: await store.listMessages(params.threadId) })
+  }
+  return {
+    auth,
+    store,
+    routes: { ...routes, createThread, listThreads, threadMessages },
+    upload,
+  }
+}

package/template-chat/src/db/schema.ts ADDED Viewed

@@ -0,0 +1,70 @@
+/**
+ * src/db/schema.ts — the whole database graph, one drizzle schema.
+ *
+ * Two halves:
+ *   - better-auth's users/sessions/accounts/verifications tables (the standard
+ *     shape its drizzle adapter expects — column names must match
+ *     `migrations/0001_init.sql`, which the e2e test executes for real).
+ *   - the chat thread/message pair from `createChatTables()` (the shell owns
+ *     the columns; you never hand-roll them).
+ *
+ * `workspace_id` on threads is a plain text column here: this template ships
+ * single-user workspaces (workspace = user id). Adopting real teams later
+ * means passing your workspace table as `createChatTables({ workspaceTable })`
+ * — see `@tangle-network/agent-app/teams`.
+ */
+import { createChatTables } from '@tangle-network/agent-app/chat-store'
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+// ── better-auth tables ──────────────────────────────────────────────────────
+export const users = sqliteTable('users', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: integer('email_verified', { mode: 'boolean' }).notNull(),
+  image: text('image'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull(),
+})
+export const sessions = sqliteTable('sessions', {
+  id: text('id').primaryKey(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  token: text('token').notNull().unique(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  userId: text('user_id').notNull(),
+})
+export const accounts = sqliteTable('accounts', {
+  id: text('id').primaryKey(),
+  accountId: text('account_id').notNull(),
+  providerId: text('provider_id').notNull(),
+  userId: text('user_id').notNull(),
+  accessToken: text('access_token'),
+  refreshToken: text('refresh_token'),
+  idToken: text('id_token'),
+  accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp' }),
+  refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp' }),
+  scope: text('scope'),
+  password: text('password'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull(),
+})
+export const verifications = sqliteTable('verifications', {
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull(),
+  value: text('value').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }),
+})
+// ── chat tables (shell-owned columns) ───────────────────────────────────────
+export const { threads, messages } = createChatTables()

package/template-chat/src/env.ts ADDED Viewed

@@ -0,0 +1,33 @@
+/**
+ * src/env.ts — the Cloudflare bindings + vars this worker reads.
+ *
+ * Locally these come from wrangler.toml `[vars]` + `.dev.vars` (secrets); in
+ * production from the dashboard / `wrangler secret put`. See
+ * `.dev.vars.example` for the full list with comments.
+ */
+export interface AppEnv {
+  /** D1 database — run `migrations/` against it before first boot. */
+  DB: D1Database
+  /** Absolute origin better-auth serves from (e.g. http://localhost:8787). */
+  BETTER_AUTH_URL: string
+  /** better-auth HMAC secret (secret; set in .dev.vars / `wrangler secret`). */
+  BETTER_AUTH_SECRET: string
+  /** Overrides `config.model.default` without a redeploy. */
+  MODEL_NAME?: string
+  /** Tangle Router key the harness bills model calls against. */
+  TANGLE_API_KEY?: string
+  /** Tangle Router base URL; omit for the platform default. */
+  TANGLE_ROUTER_URL?: string
+  /** Sandbox gateway credentials. Without them every turn fails loud with a
+   *  clear error — there is no mock fallback. */
+  SANDBOX_API_KEY?: string
+  SANDBOX_GATEWAY_URL?: string
+  // Optional R2 bucket for product artifacts — OFF by default. Uncomment the
+  // `[[r2_buckets]]` block in wrangler.toml and this binding together.
+  // ARTIFACTS: R2Bucket
+}