create-feltdb 0.7.2 → 0.7.4

package/dist/cli.js

@@ -308,7 +308,7 @@ Learn more: https://github.com/rkendel1/feltdb`);
         await createProject({
             projectName,
             autoYes: shouldAutoYes,
-            templatesDir: path.join(__dirname, '../template'),
+            templatesDir: path.join(__dirname, 'template'),
             runtime: options.runtime,
             framework: options.framework,
             distributed: options.distributed,

package/dist/create.js

@@ -49,9 +49,12 @@ export async function createProject(options) {
             test: 'node --test',
             feltdb: 'feltdb',
             'feltdb:server': 'feltdb server',
-            'feltdb:connect': 'feltdb connect http://localhost:7700',
+            'feltdb:connect': 'feltdb connect',
             'feltdb:status': 'feltdb status',
             'feltdb:studio': 'feltdb studio',
+            'feltdb:publish': 'feltdb publish',
+            'feltdb:ai': 'feltdb ai',
+            'feltdb:sync': 'feltdb sync',
             'feltdb:validate': 'feltdb validate',
             'feltdb:diff': 'feltdb diff',
             'feltdb:deploy': 'feltdb deploy',
@@ -176,25 +179,26 @@ ${hasAgents ? `  agent WorkspaceAssistant {
             lib: ['ES2020', 'DOM'],
             declaration: true,
             outDir: './dist',
-            rootDir: './src',
+            rootDir: '.',
             strict: true,
             esModuleInterop: true,
             skipLibCheck: true,
             forceConsistentCasingInFileNames: true,
-            moduleResolution: 'node',
+            moduleResolution: 'bundler',
         },
-        include: ['src/**/*'],
+        include: framework === 'react' ? ['src/**/*', 'agents/**/*', 'capabilities/**/*', 'workflows/**/*'] : ['src/**/*'],
         exclude: ['node_modules'],
     };
     if (framework === 'react') {
         tsconfig.compilerOptions.jsx = 'react-jsx';
+        tsconfig.compilerOptions.types = ['vite/client'];
     }
     fs.writeFileSync(path.join(projectDir, 'tsconfig.json'), JSON.stringify(tsconfig, null, 2));
     // Create main application files
     const runtimeOptions = runtime === 'browser'
         ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', browser: true }"
         : runtime === 'managed'
-            ? "{ namespace: import.meta.env.VITE_FELTDB_MANAGED_NAMESPACE || import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || import.meta.env.VITE_FELTDB_URL || '', token: import.meta.env.VITE_FELTDB_MANAGED_API_KEY || import.meta.env.VITE_FELTDB_API_KEY || '' } }"
+            ? "{ namespace: import.meta.env.VITE_FELTDB_MANAGED_NAMESPACE || import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || import.meta.env.VITE_FELTDB_URL || '', token: import.meta.env.VITE_FELTDB_MANAGED_API_KEY || import.meta.env.VITE_FELTDB_API_KEY || '', applicationId: import.meta.env.VITE_FELTDB_MANAGED_APPLICATION_ID, environment: import.meta.env.VITE_FELTDB_MANAGED_ENVIRONMENT || 'production' } }"
             : runtime === 'self-hosted'
                 ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_URL || 'http://localhost:7700', token: import.meta.env.VITE_FELTDB_API_KEY || '' } }"
                 : "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', memory: true }";
@@ -365,7 +369,7 @@ async function logActivity(event: Omit<ActivityEvent, 'id' | 'timestamp'>): Prom
 `;
     fs.writeFileSync(path.join(srcDir, 'feltdb.ts'), feltdbTs);
     // Create a real local-inference agent for browser projects.
-    if (hasAgents && hasWebLLM) {
+    if (hasAgents && hasWebLLM && framework !== 'react') {
         const agentTs = `import { WebLLMProvider } from '@feltdb/webllm';
 import { db, reports } from '../../src/feltdb';
 
@@ -1185,6 +1189,17 @@ root.render(
 );
 `;
         fs.writeFileSync(path.join(srcDir, 'index.tsx'), indexTsx);
+        const canonicalTemplate = path.join(templatesDir, 'default-project');
+        if (fs.existsSync(canonicalTemplate)) {
+            fs.cpSync(path.join(canonicalTemplate, 'src'), srcDir, { recursive: true });
+            for (const directory of ['agents', 'capabilities', 'workflows']) {
+                fs.cpSync(path.join(canonicalTemplate, directory), path.join(projectDir, directory), { recursive: true });
+                fs.rmSync(path.join(feltdbDir, directory), { recursive: true, force: true });
+            }
+            fs.writeFileSync(path.join(projectDir, 'feltdb.flow'), fs.readFileSync(path.join(canonicalTemplate, 'feltdb.flow'), 'utf8').replace('app FeltDBStarter', `app ${appName}`));
+            const databasePath = path.join(srcDir, 'feltdb.ts');
+            fs.writeFileSync(databasePath, fs.readFileSync(databasePath, 'utf8').replace(/export const managedRuntime[\s\S]*?\n\} : \{ namespace: import\.meta\.env\.VITE_FELTDB_NAMESPACE \|\| 'feltdb-starter', browser: true \}\);/, `export const managedRuntime = ${runtime === 'managed'};\nexport const db = createFeltDB(${runtimeOptions});`));
+        }
     }
     else {
         // Create vanilla JS app
@@ -1229,6 +1244,8 @@ VITE_FELTDB_URL=http://localhost:7700
 # Managed example: https://runtime.your-app.feltdb.com
 VITE_FELTDB_MANAGED_URL=
 VITE_FELTDB_MANAGED_API_KEY=
+# Server/control-plane only. Never rename with a VITE_ prefix.
+FELTDB_MANAGED_CONTROL_API_KEY=
 VITE_FELTDB_MANAGED_TENANT_ID=
 VITE_FELTDB_MANAGED_APPLICATION_ID=
 VITE_FELTDB_MANAGED_NAMESPACE=
@@ -1524,6 +1541,7 @@ build/
 *.log
 .DS_Store
 .feltdb/
+.feltdb-data/
 `;
     fs.writeFileSync(path.join(projectDir, '.gitignore'), gitignore);
     // Create README
@@ -1795,6 +1813,12 @@ If port 5173 is in use:
 MIT
 `;
     fs.writeFileSync(path.join(projectDir, 'README.md'), readme);
+    if (framework === 'react') {
+        const canonicalReadme = path.join(templatesDir, 'default-project', 'README.md');
+        if (fs.existsSync(canonicalReadme)) {
+            fs.writeFileSync(path.join(projectDir, 'README.md'), fs.readFileSync(canonicalReadme, 'utf8').replace('# My FeltDB App', `# ${applicationName}`));
+        }
+    }
     // Initialize Development Workspace
     // This creates .feltdb/workspace.json which enables all FeltDB-aware tools
     // (CLI, IDE, agents, browser extensions) to discover and connect to the

package/dist/managed-account.js

@@ -43,20 +43,27 @@ export async function configureManagedAccount(options) {
     // Provision through the account origin that issued the human session. The
     // resulting key is still used against apiUrl, but setup must not require a
     // browser session to be trusted by every managed data-plane hostname.
-    const key = await responseJson(await request(`${sessionOrigin}/api/keys`, {
+    const controlKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
         method: 'POST', headers,
         body: JSON.stringify({
-            id: `${options.applicationName}-cli`,
+            id: `${options.applicationName}-control`,
             namespace: options.namespace,
-            scopes: ['state:read', 'state:write', 'events:read'],
+            scopes: [
+                'application:read', 'application:write', 'application:revision:create',
+                'application:revision:read', 'application:revision:promote',
+                'application:environment:read', 'application:environment:write',
+            ],
         }),
-    }), 'Could not create the managed application key');
-    if (!key.secret)
-        throw new Error('Managed key service did not return an application secret');
+    }), 'Could not create the managed control-plane key');
+    if (!controlKey.secret)
+        throw new Error('Managed key service did not return the control-plane credential');
     const environment = [
         '# Generated by create-feltdb managed setup. Do not commit this file.',
         `VITE_FELTDB_MANAGED_URL=${apiUrl}`,
-        `VITE_FELTDB_MANAGED_API_KEY=${key.secret}`,
+        '# Browser authentication uses short-lived actor sessions; no long-lived data key is embedded.',
+        'VITE_FELTDB_MANAGED_API_KEY=',
+        '# Control-plane credential. Never prefix this with VITE_ or expose it to browser code.',
+        `FELTDB_MANAGED_CONTROL_API_KEY=${controlKey.secret}`,
         `VITE_FELTDB_MANAGED_TENANT_ID=${tenant.id}`,
         `VITE_FELTDB_MANAGED_APPLICATION_ID=${application.id}`,
         `VITE_FELTDB_MANAGED_NAMESPACE=${application.namespace || options.namespace}`,

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.7.2';
+export const FELTDB_PACKAGE_VERSION = '0.7.4';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/application.rs

@@ -132,7 +132,10 @@ pub struct CapabilityBinding {
     pub name: String,
     #[serde(default)]
     pub provider: Option<String>,
+    #[serde(default = "public_capability_visibility")]
+    pub visibility: String,
 }
+fn public_capability_visibility() -> String { "public".into() }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct SecretReference {
     pub binding: String,
@@ -368,7 +371,14 @@ pub struct ValidationReport {
 }
 
 fn is_valid_policy_subject(subject: &str) -> bool {
-    matches!(subject, "authenticated" | "owner" | "member")
+    subject.split('|').map(str::trim).all(|term| {
+        matches!(term, "authenticated" | "owner" | "member")
+            || term.strip_prefix("self(").and_then(|value| value.strip_suffix(')')).is_some_and(|field| {
+                let mut characters = field.chars();
+                characters.next().is_some_and(|value| value == '_' || value.is_ascii_alphabetic())
+                    && characters.all(|value| value == '_' || value.is_ascii_alphanumeric())
+            })
+    })
 }
 
 fn unique(
@@ -540,6 +550,11 @@ pub fn validate_manifest(
         .iter()
         .map(|v| v.name.as_str())
         .collect();
+    for capability in &manifest.capabilities {
+        if !matches!(capability.visibility.as_str(), "public" | "agent" | "workflow" | "internal") {
+            issues.push(issue("semantic", format!("capabilities.{}.visibility", capability.name), "visibility must be public, agent, workflow, or internal"));
+        }
+    }
     let workflows: BTreeSet<_> = manifest.workflows.iter().map(|v| v.name.as_str()).collect();
     let queries: BTreeSet<_> = manifest.queries.iter().map(|v| v.name.as_str()).collect();
     let bindings: BTreeSet<_> = manifest
@@ -2468,6 +2483,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn policy_with_identity_and_membership_composition_is_valid() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "InvitationPolicy".into(),
+            resource: "Invitation".into(),
+            read: Some("self(user) | member".into()),
+            write: Some("member".into()),
+            capabilities: vec![],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(report.valid, "composed identity policy should be valid: {:?}", report.issues);
+    }
+
     #[test]
     fn policy_with_invalid_subject_rejected() {
         let mut manifest = ApplicationManifest::empty("tenant", "app", "test");