sea-dev 1.0.0

package/infra/k8s/charts/seadotdev/values.yaml

@@ -0,0 +1,143 @@
+# Default values for seadotdev
+# Override per environment in overlays (values-aws-prod.yaml, values-on-prem.yaml, etc.)
+
+global:
+  # Container registry — override per cloud
+  registry: ""  # e.g., 123456789.dkr.ecr.eu-central-1.amazonaws.com/seadotdev
+  imageTag: "latest"
+  imagePullPolicy: IfNotPresent
+
+  # Domain configuration
+  domain: sea.dev
+  apiDomain: api.sea.dev
+
+  # External secrets backend — "aws", "gcp", "vault"
+  secretsBackend: aws
+
+# ─── Main App (TanStack Start SSR) ───────────────────────────
+mainApp:
+  enabled: true
+  replicaCount: 2
+  image:
+    repository: main-app
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 4Gi
+  port: 3000
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 4
+    targetCPU: 70
+  ingress:
+    enabled: true
+    host: "" # defaults to global.domain
+
+# ─── API v2 (Fastify) ────────────────────────────────────────
+apiV2:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: api-v2
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+  port: 10000
+  healthCheckPath: /health
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 4
+    targetCPU: 70
+  ingress:
+    enabled: true
+    host: "" # defaults to global.apiDomain
+
+# ─── Extraction Worker ───────────────────────────────────────
+extractionWorker:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: extraction-worker
+  command: ["pnpm", "run", "--filter", "@sea/workers", "start"]
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "1"
+      memory: 2Gi
+  autoscaling:
+    enabled: true
+    minReplicas: 0  # scale to zero when idle
+    maxReplicas: 5
+    # KEDA ScaledObject config — scale on Hatchet queue depth
+    keda:
+      enabled: true
+      pollingInterval: 15
+      cooldownPeriod: 300
+
+# ─── Extraction Worker Agentic ────────────────────────────────
+extractionWorkerAgentic:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: extraction-worker-agentic
+  command: ["pnpm", "run", "--filter", "@sea/workers", "start", "agentic"]
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "1"
+      memory: 2Gi
+  autoscaling:
+    enabled: true
+    minReplicas: 0
+    maxReplicas: 5
+    keda:
+      enabled: true
+      pollingInterval: 15
+      cooldownPeriod: 300
+
+# ─── Conversion Worker (LibreOffice) ─────────────────────────
+conversionWorker:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: conversion-worker
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: 500m
+      memory: 1Gi
+  autoscaling:
+    enabled: true
+    minReplicas: 0
+    maxReplicas: 3
+    keda:
+      enabled: true
+      pollingInterval: 30
+      cooldownPeriod: 600
+
+# ─── Static Sites (widget, ph-proxy) ─────────────────────────
+# Deployed via S3/CDN outside K8s — not part of this chart.
+# See GitHub Actions workflow for static site deployment.
+
+# ─── Ingress (ingress-nginx) ─────────────────────────────────
+ingress:
+  className: nginx
+  annotations: {}
+  tls:
+    enabled: true
+    clusterIssuer: letsencrypt-prod

package/infra/terraform/main.tf

@@ -0,0 +1,399 @@
+# ═══════════════════════════════════════════════════════════════
+# Layer 1: Cloud Infrastructure (AWS-specific)
+#
+# This is the ONLY file that changes between cloud providers.
+# Everything above this layer (Helm charts, ArgoCD, app config)
+# is portable and stays the same.
+# ═══════════════════════════════════════════════════════════════
+
+terraform {
+  required_version = ">= 1.5"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "~> 2.12"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.25"
+    }
+  }
+
+  # Uncomment for remote state
+  # backend "s3" {
+  #   bucket         = "seadotdev-terraform-state"
+  #   key            = "prod/terraform.tfstate"
+  #   region         = "eu-central-1"
+  #   dynamodb_table = "terraform-lock"
+  #   encrypt        = true
+  # }
+}
+
+provider "aws" {
+  region = var.aws_region
+  default_tags {
+    tags = {
+      Project     = "seadotdev"
+      Environment = var.environment
+      ManagedBy   = "terraform"
+    }
+  }
+}
+
+provider "kubernetes" {
+  host                   = module.eks.cluster_endpoint
+  cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
+  exec {
+    api_version = "client.authentication.k8s.io/v1beta1"
+    command     = "aws"
+    args        = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
+  }
+}
+
+provider "helm" {
+  kubernetes {
+    host                   = module.eks.cluster_endpoint
+    cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
+    exec {
+      api_version = "client.authentication.k8s.io/v1beta1"
+      command     = "aws"
+      args        = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
+    }
+  }
+}
+
+# ─── Variables ────────────────────────────────────────────────
+
+variable "aws_region" {
+  default = "eu-central-1"
+}
+
+variable "environment" {
+  default = "prod"
+}
+
+variable "domain_name" {
+  default = "sea.dev"
+}
+
+variable "cluster_version" {
+  default = "1.29"
+}
+
+# ─── VPC ──────────────────────────────────────────────────────
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 5.0"
+
+  name = "seadotdev-${var.environment}"
+  cidr = "10.0.0.0/16"
+
+  azs             = ["${var.aws_region}a", "${var.aws_region}b"]
+  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
+  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
+
+  enable_nat_gateway   = true
+  single_nat_gateway   = true
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  # Tags required for EKS auto-discovery of subnets
+  public_subnet_tags = {
+    "kubernetes.io/role/elb" = 1
+  }
+  private_subnet_tags = {
+    "kubernetes.io/role/internal-elb" = 1
+  }
+}
+
+# ─── EKS Cluster ──────────────────────────────────────────────
+
+module "eks" {
+  source  = "terraform-aws-modules/eks/aws"
+  version = "~> 20.0"
+
+  cluster_name    = "seadotdev-${var.environment}"
+  cluster_version = var.cluster_version
+
+  vpc_id     = module.vpc.vpc_id
+  subnet_ids = module.vpc.private_subnets
+
+  # Public endpoint for kubectl access (restrict in production)
+  cluster_endpoint_public_access = true
+
+  # Enable IRSA (IAM Roles for Service Accounts) — critical for
+  # external-secrets and other controllers to access AWS services
+  enable_irsa = true
+
+  # Managed node groups — EC2 instances managed by AWS
+  eks_managed_node_groups = {
+
+    # General purpose nodes — web services run here
+    general = {
+      name           = "general"
+      instance_types = ["t4g.large"] # 2 vCPU, 8GB — ARM for cost savings
+      ami_type       = "AL2023_ARM_64_STANDARD"
+
+      min_size     = 2
+      max_size     = 4
+      desired_size = 2
+
+      labels = {
+        role = "general"
+      }
+    }
+
+    # Spot nodes for workers — 60-70% cheaper, Hatchet handles retries
+    workers = {
+      name           = "workers"
+      instance_types = ["t4g.large", "t4g.xlarge", "m7g.large"]
+      capacity_type  = "SPOT"
+      ami_type       = "AL2023_ARM_64_STANDARD"
+
+      min_size     = 0
+      max_size     = 5
+      desired_size = 1
+
+      labels = {
+        role = "workers"
+      }
+
+      taints = [{
+        key    = "workload"
+        value  = "workers"
+        effect = "NO_SCHEDULE"
+      }]
+    }
+  }
+
+  # Cluster addons
+  cluster_addons = {
+    coredns                = { most_recent = true }
+    kube-proxy             = { most_recent = true }
+    vpc-cni                = { most_recent = true }
+    aws-ebs-csi-driver     = { most_recent = true }
+  }
+}
+
+# ─── ECR Repositories ────────────────────────────────────────
+
+resource "aws_ecr_repository" "services" {
+  for_each = toset([
+    "main-app",
+    "api-v2",
+    "extraction-worker",
+    "extraction-worker-agentic",
+    "conversion-worker",
+  ])
+
+  name                 = "seadotdev/${each.key}"
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+# ─── RDS PostgreSQL ───────────────────────────────────────────
+
+resource "aws_security_group" "rds" {
+  name_prefix = "seadotdev-rds-"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [module.eks.node_security_group_id]
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "seadotdev-${var.environment}"
+  subnet_ids = module.vpc.private_subnets
+}
+
+resource "aws_db_instance" "prod" {
+  identifier     = "seadotdev-prod"
+  engine         = "postgres"
+  engine_version = "16"
+  instance_class = "db.t4g.medium"
+
+  allocated_storage     = 50
+  max_allocated_storage = 200
+  storage_type          = "gp3"
+
+  db_name                     = "prod"
+  username                    = "sea"
+  manage_master_user_password = true
+
+  multi_az               = true
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  backup_retention_period      = 14
+  deletion_protection          = true
+  skip_final_snapshot          = false
+  final_snapshot_identifier    = "seadotdev-prod-final"
+  performance_insights_enabled = true
+}
+
+resource "aws_db_instance" "staging" {
+  identifier     = "seadotdev-staging"
+  engine         = "postgres"
+  engine_version = "16"
+  instance_class = "db.t4g.small"
+
+  allocated_storage = 20
+  storage_type      = "gp3"
+
+  db_name                     = "staging"
+  username                    = "sea"
+  manage_master_user_password = true
+
+  multi_az               = false
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  backup_retention_period = 7
+  deletion_protection     = false
+  skip_final_snapshot     = true
+}
+
+# ─── Cluster Essentials (Helm) ────────────────────────────────
+# These are the portable K8s components installed via Helm.
+# They work identically on any K8s cluster.
+
+resource "helm_release" "ingress_nginx" {
+  name             = "ingress-nginx"
+  repository       = "https://kubernetes.github.io/ingress-nginx"
+  chart            = "ingress-nginx"
+  namespace        = "ingress-nginx"
+  create_namespace = true
+
+  set {
+    name  = "controller.service.type"
+    value = "LoadBalancer"
+  }
+
+  set {
+    name  = "controller.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-type"
+    value = "nlb"
+  }
+
+  set {
+    name  = "controller.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-scheme"
+    value = "internet-facing"
+  }
+}
+
+resource "helm_release" "cert_manager" {
+  name             = "cert-manager"
+  repository       = "https://charts.jetstack.io"
+  chart            = "cert-manager"
+  namespace        = "cert-manager"
+  create_namespace = true
+
+  set {
+    name  = "installCRDs"
+    value = "true"
+  }
+}
+
+resource "helm_release" "external_secrets" {
+  name             = "external-secrets"
+  repository       = "https://charts.external-secrets.io"
+  chart            = "external-secrets"
+  namespace        = "external-secrets"
+  create_namespace = true
+}
+
+resource "helm_release" "keda" {
+  name             = "keda"
+  repository       = "https://kedacore.github.io/charts"
+  chart            = "keda"
+  namespace        = "keda"
+  create_namespace = true
+}
+
+resource "helm_release" "argocd" {
+  name             = "argocd"
+  repository       = "https://argoproj.github.io/argo-helm"
+  chart            = "argo-cd"
+  namespace        = "argocd"
+  create_namespace = true
+
+  set {
+    name  = "server.service.type"
+    value = "ClusterIP"
+  }
+}
+
+# ─── IRSA for external-secrets ────────────────────────────────
+# Allows the external-secrets controller to read from AWS Secrets Manager
+
+module "external_secrets_irsa" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "~> 5.0"
+
+  role_name = "seadotdev-external-secrets"
+
+  attach_external_secrets_policy = true
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["external-secrets:external-secrets"]
+    }
+  }
+}
+
+# ─── S3 for Static Sites ─────────────────────────────────────
+
+resource "aws_s3_bucket" "static_sites" {
+  bucket = "seadotdev-static-${var.environment}"
+}
+
+resource "aws_s3_bucket_public_access_block" "static_sites" {
+  bucket                  = aws_s3_bucket.static_sites.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+# ─── Outputs ──────────────────────────────────────────────────
+
+output "cluster_name" {
+  value = module.eks.cluster_name
+}
+
+output "cluster_endpoint" {
+  value = module.eks.cluster_endpoint
+}
+
+output "ecr_repositories" {
+  value = { for k, v in aws_ecr_repository.services : k => v.repository_url }
+}
+
+output "rds_prod_endpoint" {
+  value = aws_db_instance.prod.endpoint
+}
+
+output "rds_staging_endpoint" {
+  value = aws_db_instance.staging.endpoint
+}
+
+output "configure_kubectl" {
+  value = "aws eks update-kubeconfig --region ${var.aws_region} --name ${module.eks.cluster_name}"
+}

package/libs/ai/.prettierignore

@@ -0,0 +1,2 @@
+dist
+node_modules

package/libs/ai/.prettierrc.js

@@ -0,0 +1,5 @@
+import prettierConfig from "@sea/lint/prettier";
+
+export default {
+  ...prettierConfig,
+};

package/libs/ai/README.md

@@ -0,0 +1,139 @@
+# @sea/ai
+
+LLM utilities and tools for Sea platform.
+
+## Structure
+
+- `generate.ts` - LLM generation functions (chat streams, summarization, feedback analysis)
+- `tools.ts` - LLM tool definitions for forms, submissions, agents, etc.
+- `prompts.ts` - System prompts for different chat types
+- `prepare-tools.ts` - Tool preparation logic based on chat type
+- `types.ts` - Shared types (ChatType, etc.)
+- `agents/` - Agent-specific code (models, prompts, RAG, tools)
+
+## App-Specific Dependencies
+
+The `generate.ts` file requires the following app-specific modules that must be provided by the consuming application:
+
+### 1. PostHog Client (`@/clients/posthog`)
+
+**Required exports:**
+
+- `posthog: PostHog` - PostHog client instance
+
+**Usage:**
+
+- Used in `getChatModel()` for wrapping AI models with tracing via `@posthog/ai`
+
+**Implementation example:**
+
+```typescript
+import { PostHog } from "posthog-node";
+
+export const posthog = new PostHog(apiKey, {
+  host: hostUrl,
+  flushAt: 20,
+  flushInterval: 10000,
+});
+```
+
+### 2. App Configuration (`@/lib/config`)
+
+**Required exports:**
+
+- `getAppConfig(): AppConfig` - Returns app-specific configuration
+
+**Usage:**
+
+- Creating OpenAI client with API keys
+- Getting LLM configuration
+
+**Implementation requirements:**
+
+```typescript
+import { type Config, ConfigFactory } from "@sea/config";
+
+export type AppConfig = Config & {
+  baseUrl: string;
+  encryptionKeys: [string, ...string[]];
+  emailAndPasswordEnabled: boolean;
+};
+
+export function getAppConfig(): AppConfig {
+  // Return config with app-specific fields
+}
+```
+
+### 3. Feedback Cache (`@/lib/feedback-cache`)
+
+**Required exports:**
+
+- `generateCacheKey(params: { organizationId: string; type: "item" | "pattern"; itemId?: string; formId?: string; correctionsHash?: string }): string`
+- `generateCorrectionsHash(corrections: Array<{ id: string; extractedValue: unknown; correctedValue: unknown }>): string`
+- `getCachedFeedbackAnalysis(cacheKey: string): string | null`
+- `setCachedFeedbackAnalysis(cacheKey: string, analysis: string): void`
+
+**Usage:**
+
+- Caching feedback analysis results in `analyzeFeedbackForItem()`, `detectFeedbackPatterns()`, `generateImprovedHint()`
+
+**Implementation example:**
+
+```typescript
+import { createHash } from "crypto";
+import { LRUCache } from "lru-cache";
+
+const feedbackAnalysisCache = new LRUCache<string, AnalysisResult>({
+  max: 1000,
+  ttl: 1000 * 60 * 60, // 1 hour
+});
+
+export function getCachedFeedbackAnalysis(cacheKey: string): string | null {
+  const cached = feedbackAnalysisCache.get(cacheKey);
+  return cached?.analysis || null;
+}
+
+export function setCachedFeedbackAnalysis(cacheKey: string, analysis: string): void {
+  feedbackAnalysisCache.set(cacheKey, { analysis, timestamp: Date.now() });
+}
+
+export function generateCacheKey(params: { ... }): string {
+  // Generate unique cache key
+}
+
+export function generateCorrectionsHash(corrections: Array<...>): string {
+  return createHash("md5").update(JSON.stringify(corrections)).digest("hex");
+}
+```
+
+## Required Dependencies
+
+The package requires these npm dependencies:
+
+- `@ai-sdk/anthropic` - Anthropic AI SDK
+- `@ai-sdk/openai` - OpenAI AI SDK
+- `@posthog/ai` - PostHog AI tracing (for generate.ts)
+- `@tanstack/react-router` - Router utilities (for generate.ts notFound)
+- `@vercel/sandbox` - Vercel sandbox for code execution
+- `ai` - Vercel AI SDK
+- `openai` - OpenAI client
+- `mathjs` - Math utilities
+- `js-tiktoken` - Token counting
+- `nanoid` - ID generation
+- `zod` - Schema validation
+- `drizzle-orm` - Database ORM
+
+## Usage
+
+```typescript
+import { createChatStream, prepareTools, systemPrompt } from "@sea/ai";
+
+// Create a chat stream
+const response = await createChatStream({
+  member,
+  conversationId,
+  message,
+  chatType: "agent",
+  noRespond: false,
+});
+```

package/libs/ai/eslint.config.mjs

@@ -0,0 +1,3 @@
+import eslintConfig from "@sea/lint/eslint";
+
+export default eslintConfig;