create-spatius-app 0.1.3-beta.1 → 0.1.3

package/templates/layers/agora/pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+allowBuilds:
+  core-js: true
+  esbuild: true
+  workerd: true
+autoInstallPeers: false
+preferFrozenLockfile: true
+saveExact: true
+strictPeerDependencies: true

package/templates/layers/agora/scripts/check-worker.mjs

@@ -0,0 +1,98 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { Miniflare } from 'miniflare';
+
+// Run the production bundle in workerd, with all provider traffic mocked.
+const root = resolve(import.meta.dirname, '..');
+const deploymentPath = resolve(root, '.wrangler/deploy/config.json');
+const deployment = JSON.parse(await readFile(deploymentPath, 'utf8'));
+const configPath = resolve(dirname(deploymentPath), deployment.configPath);
+const config = JSON.parse(await readFile(configPath, 'utf8'));
+const bindings = {
+  ...config.vars,
+  AGORA_APP_ID: 'a'.repeat(32),
+  AGORA_APP_CERTIFICATE: 'b'.repeat(32),
+  AGORA_PIPELINE_ID: 'test-pipeline',
+  SPATIUS_APP_ID: 'test-app',
+  SPATIUS_API_KEY: 'private-test-key',
+  SPATIUS_AVATAR_ID: 'test-avatar',
+};
+const calls = [];
+const outboundService = async (request) => {
+  const url = new URL(request.url);
+  assert.equal(url.origin, 'https://api.agora.io');
+  assert.equal(request.method, 'POST');
+  assert.match(request.headers.get('authorization'), /^agora token=".+"$/);
+  calls.push(url.pathname);
+  if (url.pathname.endsWith('/join')) {
+    const body = await request.json();
+    assert.equal(body.pipeline_id, bindings.AGORA_PIPELINE_ID);
+    assert.equal(
+      body.properties.avatar.params.spatius_api_key,
+      bindings.SPATIUS_API_KEY,
+    );
+    return Response.json({ agent_id: 'test-agent' });
+  }
+  assert.ok(url.pathname.endsWith('/agents/test-agent/leave'));
+  return new Response(null, { status: 404 });
+};
+const worker = new Miniflare({
+  workers: [
+    {
+      config: {
+        name: config.name,
+        type: 'worker',
+        compatibilityDate: config.compatibility_date,
+        compatibilityFlags: config.compatibility_flags,
+        manifest: {
+          mainModule: config.main,
+          modulesRoot: dirname(configPath),
+          modules: {
+            [config.main]: {
+              type: 'esm',
+              contents: await readFile(
+                resolve(dirname(configPath), config.main),
+                'utf8',
+              ),
+            },
+          },
+        },
+        env: Object.fromEntries(
+          Object.entries(bindings).map(([name, value]) => [
+            name,
+            { type: 'text', value },
+          ]),
+        ),
+      },
+      dev: { outboundService: { type: 'fetcher', handler: outboundService } },
+    },
+  ],
+});
+try {
+  const health = await worker.dispatchFetch('https://app.example/api/health');
+  assert.deepEqual(await health.json(), { ok: true });
+  const response = await worker.dispatchFetch(
+    'https://app.example/api/session',
+    { method: 'POST' },
+  );
+  assert.equal(response.status, 201, await response.clone().text());
+  const session = await response.json();
+  assert.equal(typeof session.token, 'string');
+  assert.notEqual(session.uid, session.agentUid);
+  assert.ok(!JSON.stringify(session).includes(bindings.SPATIUS_API_KEY));
+  assert.ok(!JSON.stringify(session).includes(bindings.AGORA_APP_CERTIFICATE));
+  const stop = (capability) =>
+    worker.dispatchFetch('https://app.example/api/session/stop', {
+      method: 'POST',
+      body: JSON.stringify({ capability }),
+    });
+  assert.equal((await stop('invalid')).status, 403);
+  assert.equal((await stop(session.capability)).status, 200);
+  assert.equal(calls.length, 2);
+  console.log(
+    'Cloudflare Worker session startup and cleanup verified with mocked Agora.',
+  );
+} finally {
+  await worker.dispose();
+}

package/templates/layers/agora/tsconfig.worker.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "composite": true,
+    "resolveJsonModule": true,
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.worker.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023", "WebWorker"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "types": ["./worker-configuration.d.ts", "node"],
+    "skipLibCheck": true,
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["worker", "worker-configuration.d.ts"]
+}

package/templates/layers/agora/worker/agora.test.ts

@@ -11,6 +11,8 @@ const env: AgoraEnvironment = {
   SPATIUS_API_KEY: 'private-key',
   SPATIUS_APP_ID: 'test-app',
   SPATIUS_AVATAR_ID: 'test-avatar',
+  SPATIUS_REGION: 'cn-beijing',
+  AGORA_AVATAR_SAMPLE_RATE: '24000',
 };
 describe('hosted Agora sessions', () => {
   it('keeps secrets server-side and authorizes idempotent cleanup', async () => {

package/templates/layers/agora/worker/agora.ts

@@ -2,16 +2,7 @@ import { randomInt, randomUUID } from 'node:crypto';
 import agoraToken from 'agora-token';
 const { RtcTokenBuilder, RtcRole } = agoraToken;
 import { signCapability, verifyCapability } from './capability.js';
-export interface AgoraEnvironment {
-  AGORA_APP_ID: string;
-  AGORA_APP_CERTIFICATE: string;
-  AGORA_PIPELINE_ID: string;
-  SPATIUS_APP_ID: string;
-  SPATIUS_API_KEY: string;
-  SPATIUS_AVATAR_ID: string;
-  SPATIUS_REGION?: string;
-  AGORA_AVATAR_SAMPLE_RATE?: string;
-}
+export type AgoraEnvironment = CloudflareBindings;
 export class ConfigurationError extends Error {}
 function configuration(env: AgoraEnvironment) {
   for (const key of [

package/templates/layers/agora/worker/index.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import worker from './index.js';
+
+const env: CloudflareBindings = {
+  AGORA_APP_ID: 'a'.repeat(32),
+  AGORA_APP_CERTIFICATE: 'b'.repeat(32),
+  AGORA_PIPELINE_ID: 'test-pipeline',
+  SPATIUS_API_KEY: 'private-key',
+  SPATIUS_APP_ID: 'test-app',
+  SPATIUS_AVATAR_ID: 'test-avatar',
+  SPATIUS_REGION: 'cn-beijing',
+  AGORA_AVATAR_SAMPLE_RATE: '24000',
+};
+const request = (path: string, method = 'GET', body?: object) =>
+  new Request(`https://app.example${path}`, {
+    method,
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  });
+afterEach(() => vi.unstubAllGlobals());
+describe('Cloudflare Agora API', () => {
+  it('serves health and rejects unknown routes and unsupported methods', async () => {
+    expect(
+      await (await worker.fetch(request('/api/health'), env)).json(),
+    ).toEqual({ ok: true });
+    expect((await worker.fetch(request('/api/missing'), env)).status).toBe(404);
+    expect((await worker.fetch(request('/api/session'), env)).status).toBe(405);
+    expect(
+      (await worker.fetch(request('/api/health', 'POST'), env)).status,
+    ).toBe(405);
+  });
+  it('uses Worker bindings to create and stop hosted sessions without leaking secrets', async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(Response.json({ agent_id: 'hosted-agent' }))
+      .mockResolvedValueOnce(new Response(null, { status: 404 }));
+    vi.stubGlobal('fetch', fetcher);
+    const response = await worker.fetch(request('/api/session', 'POST'), env);
+    expect(response.status).toBe(201);
+    expect(response.headers.get('cache-control')).toBe('no-store');
+    const session = await response.json<{ capability: string }>();
+    expect(JSON.stringify(session)).not.toContain(env.AGORA_APP_CERTIFICATE);
+    expect(JSON.stringify(session)).not.toContain(env.SPATIUS_API_KEY);
+    expect(
+      (await worker.fetch(request('/api/session/stop', 'POST', session), env))
+        .status,
+    ).toBe(200);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+  it('fails missing configuration and invalid stop authorization before contacting Agora', async () => {
+    const fetcher = vi.fn<typeof fetch>();
+    vi.stubGlobal('fetch', fetcher);
+    expect(
+      (
+        await worker.fetch(request('/api/session', 'POST'), {
+          ...env,
+          AGORA_APP_CERTIFICATE: '',
+        })
+      ).status,
+    ).toBe(503);
+    expect(
+      (await worker.fetch(request('/api/session/stop', 'POST', {}), env))
+        .status,
+    ).toBe(403);
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+});

package/templates/layers/agora/worker/index.ts

@@ -48,3 +48,7 @@ export async function handleRequest(
     );
   }
 }
+
+export default {
+  fetch: handleRequest,
+} satisfies ExportedHandler<CloudflareBindings>;

package/templates/layers/agora/wrangler.jsonc

@@ -0,0 +1,24 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  "name": "spatius-agora-app",
+  "main": "./worker/index.ts",
+  "compatibility_date": "2026-09-11",
+  "compatibility_flags": ["nodejs_compat"],
+  "vars": {
+    "AGORA_APP_ID": "your-agora-app-id",
+    "AGORA_PIPELINE_ID": "your-published-pipeline-id",
+    "SPATIUS_APP_ID": "your-spatius-app-id",
+    "SPATIUS_AVATAR_ID": "your-spatius-avatar-id",
+    "SPATIUS_REGION": "cn-beijing",
+    "AGORA_AVATAR_SAMPLE_RATE": "24000",
+  },
+  "secrets": {
+    "required": ["AGORA_APP_CERTIFICATE", "SPATIUS_API_KEY"],
+  },
+  "assets": {
+    "not_found_handling": "single-page-application",
+    "run_worker_first": ["/api/*"],
+  },
+  "observability": { "enabled": true, "head_sampling_rate": 1 },
+  "upload_source_maps": true,
+}