chore: add WARP developer guide and update dependencies across all packages #26
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Walkthrough本次提交包含大量文档与依赖版本更新，新增 WARP.md 并重写 AGENTS.md；多处 package.json、CHANGELOG.md 升级补丁版本；以及对 Cloudflare Worker typings 的大规模扩展与签名/类型变更（新增 cloudflare:node、消息通道、Images/AI/Gateway 等类型）。 Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as 开发者
participant HTTP as cloudflare:node.httpServerHandler
participant Default as DefaultHandler
participant Worker as Worker runtime
Dev->>HTTP: 调用 httpServerHandler(options, handlers)
HTTP->>Default: 创建 DefaultHandler (fetch, tail, scheduled, queue, test)
Default->>Worker: fetch -> handler.fetch(request)
Default->>Worker: tail -> handler.tail(event)
Note over Default,Worker: 新增 MessagePort/MessageEvent、waitUntil 和 TailStream/Images 等类型供处理器使用
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 分钟 Poem
✨ Finishing Touches🧪 Generate unit tests
Comment |
There was a problem hiding this comment.
Pull Request Overview
This PR performs a comprehensive dependency update across all packages in the monorepo and adds a new WARP developer guide. The update includes version bumps for multiple libraries, development tools, and framework dependencies while maintaining compatibility across the stack.
Key changes:
- Comprehensive dependency updates across all packages and applications
- Addition of WARP.md developer guide providing detailed setup and development instructions
- Minor updates to AGENTS.md documentation format
Reviewed Changes
Copilot reviewed 31 out of 32 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| WARP.md | New comprehensive developer guide for WARP IDE with setup, architecture, and troubleshooting |
| AGENTS.md | Minor formatting improvements and content consolidation |
| package.json | Root-level dependency updates including Babel, Biome, Node types, and Cloudflare tools |
| packages/*/package.json | Version bumps and dependency updates for all workspace packages |
| apps/*/package.json | Application-level dependency updates including AI SDK, React Query, and Cloudflare tools |
| */CHANGELOG.md | Version bump entries documenting the dependency updates |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/web/package.json (1)
9-9: clean 脚本存在风险/无效：rm -rf空参数会报错当前为空参数的 rm -rf 将直接失败（缺少操作数）。建议显式列出需清理目录或移除该脚本：
- "clean": "rm -rf ", + "clean": "rm -rf .next .turbo node_modules bun.lockb paraglide",或将清理交由 turbo pipeline。
🧹 Nitpick comments (38)
apps/cdn/CHANGELOG.md (1)
3-3: 在标题中加入发布日期，便于追溯建议使用 “版本号 — 日期” 的格式，统一各包的记录。
-## 1.0.6 +## 1.0.6 — 2025-09-06apps/dispatcher/CHANGELOG.md (2)
3-3: 补充发布日期以统一风格与其它包保持一致，建议在版本标题追加日期。
-## 1.0.11 +## 1.0.11 — 2025-09-06
7-10: 合并重复依赖更新条目：将第 7–10 行的- update deps - Updated dependencies - @libra/common@1.0.3合并为：
- Update dependencies: - @libra/common@1.0.3无需补充
@libra/auth，apps/dispatcher/package.json中并未声明此依赖。packages/ui/CHANGELOG.md (2)
3-3: 为版本标题添加日期便于快速定位发布时间点。
-## 1.0.4 +## 1.0.4 — 2025-09-06
7-7: 统一措辞并可补充关键依赖名将 “update deps” 改为更清晰的 “Update dependencies”，并（可选）列出关键依赖如 tailwindcss、@tailwindcss/postcss、tw-animate-css 的具体版本，提升可读性。
- - update deps + - Update dependencies: + # 例如（如本次确有变更） + # - tailwindcss@^4.1.13 (dev) + # - @tailwindcss/postcss@^4.1.13 + # - tw-animate-css@^1.3.8apps/builder/CHANGELOG.md (2)
3-3: 加入版本发布日期与仓库其它 changelog 风格保持一致。
-## 1.0.11 +## 1.0.11 — 2025-09-06
7-7: 在 apps/builder/CHANGELOG.md 展开依赖更新条目
“update deps” 过于笼统，建议列出关键依赖版本，例如 wrangler@^4.34.0 (dev)、@cloudflare/workers-types@^4.20250906.0 (dev)、tailwindcss@^4.1.13 (dev)、@tanstack/react-query@^5.87.1，以便评估影响。packages/better-auth-cloudflare/CHANGELOG.md (2)
3-3: 补充发布日期按统一规范记录发布时间。
-## 1.0.9 +## 1.0.9 — 2025-09-06
7-7: 补充 CHANGELOG 中依赖更新列表
在 patch 条目下，明确列出依赖和 peerDependencies 的具体版本号：- update deps + Update dependencies: + - better-auth@^1.3.8 + Update peerDependencies: + - @cloudflare/workers-types@^4.20250906.0 + - @opennextjs/cloudflare@^1.8.0apps/deploy/package.json (1)
30-30: wrangler 使用插入号版本可能降低可重复性从固定 4.27.0 升到 ^4.34.0 会持续拿到后续次/补丁版本，CI 与本地构建结果可能漂移。建议视团队策略改为 ~4.34.0 或通过锁文件/CI 缓存严格固定。
apps/docs/CHANGELOG.md (1)
3-8: 为变更条目补充日期与参考链接提高可追溯性建议在 “1.0.8” 下追加发布日期（UTC）与关联 PR/commit，便于定位具体差异。
示例：
- 2025-09-06 (#26) – update deps
apps/dispatcher/package.json (2)
25-25: 同上：插入号版本的可重复性权衡若团队希望完全可复现构建，考虑改为 ~4.34.0 或固定版本，并依赖锁文件保障一致性。
2-12: 在 apps/dispatcher/package.json 中添加 engines.node 并与根级 package.json 保持一致
将 engines.node 版本与仓库根目录已有的"node": ">=24"对齐，统一本地与 CI 运行环境{ "name": "@libra/dispatcher", "version": "1.0.11", "type": "module", + "engines": { + "node": ">=24" + }, "scripts": { "dev": "wrangler dev --port 3007 --persist-to=../web/.wrangler/state", …apps/vite-shadcn-template/CHANGELOG.md (1)
3-8: 补充发布元信息以提升可读性建议在 1.0.1 条目加入发布日期与关联 PR/commit，保持与其他包一致的格式。
packages/better-auth-stripe/CHANGELOG.md (1)
3-8: 变更描述可更具体一点“update deps” 建议列出关键升级（如 better-auth ^1.3.8、better-call ^1.0.18）及潜在影响/迁移注意，便于消费者评估风险。
apps/deploy/CHANGELOG.md (1)
3-11: 为版本标题补充日期并统一措辞（微调）建议为版本标题添加发布日期，措辞由“update deps”改为更规范的“deps: update”或“deps: updated”，提高可读性与一致性。
应用示例：
-## 1.0.9 +## 1.0.9 - 2025-09-06 @@ -### Patch Changes +### Patch Changes - - update deps + - deps: updatedapps/screenshot/CHANGELOG.md (1)
3-11: 同上：添加发布日期并统一“更新依赖”措辞为 1.0.8 条目补充日期，并将“update deps”微调为“deps: updated”以对齐其他条目风格。
参考修改：
-## 1.0.8 +## 1.0.8 - 2025-09-06 @@ - - update deps + - deps: updatedpackages/ui/package.json (1)
28-28: 仓库内依赖版本一致性建议
tw-animate-css已升到^1.3.8，请确认各 apps 使用的版本也一致，避免多版本重复安装导致包体增大。可跑工作区去重检查：
pnpm -w dedupe或用npm ls tw-animate-css查看树。apps/vite-shadcn-template/package.json (2)
4-4: 版本号已从 1.0.0 → 1.0.1，但构建/快照脚本仍硬编码 1.0.0为避免遗忘更新，建议用包版本变量替代硬编码。示例（仅供参考）：
{ "scripts": { "daytona:build": "docker buildx build --platform linux/amd64 -t vite-shadcn-template-libra:$npm_package_version -f Dockerfile .", "daytona:push": "daytona snapshot push vite-shadcn-template-libra:$npm_package_version --entrypoint 'bun dev --host 0.0.0.0' --name vite-shadcn-template-libra:$npm_package_version --cpu 1 --memory 1 --disk 3" } }
76-76: 将 @cloudflare/workers-types 升级至 ^4.20250906.0
@cloudflare/workers-types 当前锁定为 ^4.20250803.0，最新版本为 4.20250906.0，建议将依赖更新至 ^4.20250906.0，以匹配 Wrangler CLI ^4.34.0，确保类型定义与 CLI 行为一致。apps/deploy-workflow/CHANGELOG.md (1)
3-11: 变更说明过于笼统，建议列出关键依赖与影响范围将“update deps”细化（例如：wrangler → ^4.34.0、内部包版本对齐），并注明“无破坏性变更/无 API 变更”，提升可读性与审计价值。
packages/common/CHANGELOG.md (1)
3-8: 建议补充关键依赖版本号，提升可追溯性在
1.0.3“Patch Changes” 中补充主要升级（如@trpc/* → ^11.5.1），并注明“无 API 变化”。apps/deploy-workflow/package.json (1)
24-24: 建议锁定 Wrangler 版本并添加一致性检查
- 可选：将
wrangler依赖从改为精确锁定，以降低 CLI 行为突变风险。- "wrangler": "^4.34.0" + "wrangler": "4.34.0"- 在 CI 中统一检查所有 package.json 中的 wrangler 版本：
若输出多于一行则表示版本不一致，请对应调整。find . -name package.json -print0 \ | xargs -0 -n1 jq -r '.devDependencies.wrangler? // empty' \ | sort -uapps/web/CHANGELOG.md (1)
3-14: 确认依赖版本一致，建议添加变更动机描述（可选）
- 已使用脚本校验 apps/web/CHANGELOG.md 中列出的 @libra/* 依赖版本，与各自 packages/**/package.json 中的 version 完全匹配（均为 OK）。
- 建议在本次发布说明中再补充一句，简要说明此次依赖更新的动机，例如“对齐 Cloudflare Workers 工具链版本”或“配合 WARP 文档更新需求”。
apps/builder/package.json (1)
59-59: @types/node 版本与运行时对齐根工程 engines.node 为 >=24，而此处类型为 ^22.18.1。为减少类型分歧，建议与根对齐到 24.x。
应用示例：
- "@types/node": "^22.18.1" + "@types/node": "^24.3.1"package.json (1)
31-32: Babel 8 beta 兼容性风险
经确认，当前稳定/RC 版 babel-plugin-react-compiler 未声明兼容 @babel/core/@babel/runtime 8.x，升级到 ^8.0.0-beta.2 可能导致不兼容问题。建议暂时保持 @babel/runtime 在 ^7.25.7 稳定版，待插件官方支持后再切换。可选回退示例：
- "@babel/runtime": "^8.0.0-beta.2" + "@babel/runtime": "^7.25.7"packages/common/package.json (1)
26-29: tRPC 次版本升级对齐良好，建议补充 engines 或 packageManager 约束已统一到 ^11.5.1，无 API 破坏的已知风险。建议在仓库根或该包添加运行时约束，避免团队机器版本漂移：
{ "name": "@libra/common", + "engines": { "bun": ">=1.1.0" }, + "packageManager": "bun@1.2.19", ... }WARP.md (2)
170-180: 修复 markdownlint MD034（裸露 URL）以通过文档检查将本段 localhost 链接用尖括号或显式链接包裹：
-- Main App: http://localhost:3000 +- Main App: <http://localhost:3000> -- Email Preview: http://localhost:3001 +- Email Preview: <http://localhost:3001> -- Auth Studio: http://localhost:3002 +- Auth Studio: <http://localhost:3002> -- Documentation: http://localhost:3003 +- Documentation: <http://localhost:3003> -- CDN Service: http://localhost:3004 +- CDN Service: <http://localhost:3004> -- Build Service: http://localhost:5173 +- Build Service: <http://localhost:5173> -- Dispatcher: http://localhost:3007 +- Dispatcher: <http://localhost:3007> -- Deploy Service: http://localhost:3008 +- Deploy Service: <http://localhost:3008> -- Screenshot Service: http://localhost:3009 +- Screenshot Service: <http://localhost:3009>
52-58: “无根级测试脚本”的表述请核对如果仓库后续新增了根级聚合测试脚本（例如 turbo/biome 驱动），该表述需更新。
apps/web/package.json (2)
28-31: 依赖升级与 DevTools 对齐良好；建议顺手对齐 bundle-analyzer 版本与 Next ^15.5.x 搭配，建议将 @next/bundle-analyzer 对齐到同一次要版本，以减少潜在 peer 警告：
- "@next/bundle-analyzer": "15.4.2" + "@next/bundle-analyzer": "^15.5.2"Also applies to: 47-55, 63-64, 78-78
3-4: 版本提升到 1.0.16：请同步更新 WARP.md 的技术栈版本表述为避免文档漂移，建议在 WARP.md 改为非硬编码版本描述（已在对应评论提供 diff）。
AGENTS.md (7)
4-8: 确认目录命名与示例路径一致，并链接到新增的 WARP.md
- 请核对实际存在的工作区：是否确有
apps/opennext-cache、tooling/*、scripts/*等目录，避免文档与仓库结构漂移。- 建议在此处加一行，指向根目录新增的 WARP 开发指南，便于新人从“结构 → 实践命令”的连续阅读。
可以考虑如下补丁：
- Monorepo managed by Turborepo. Workspaces live in `apps/*`, `packages/*`, `tooling/*`, and `scripts/*`. - Apps: web and workers in `apps/` (e.g., `apps/web`, `apps/opennext-cache`). + Monorepo managed by Turborepo. Workspaces live in `apps/*`, `packages/*`, `tooling/*`, and `scripts/*` (verify these folders exist). + Apps: web and workers in `apps/` (e.g., `apps/web`, `apps/opennext-cache`) — ensure paths match repo. + See also: WARP developer guide (WARP.md) for end-to-end dev workflow.
11-18: 固定 Node/Bun 版本与 Turbo 调用方式，避免环境漂移
- 建议在仓库根添加版本钉死文件（如
.tool-versions/.bun-version或mise/volta配置），并在 CI 校验 Node/Bun 版本。- Turbo 常见用法是
turbo run <task>；文档里的turbo test可能等价但易混淆，建议统一为turbo run test。- DB 命令请注明所用工具（Prisma/Drizzle 等）与回滚/下线流程；Cloudflare 发布前置步骤（Wrangler 登录/账户绑定）也可补充一行。
- Install deps: `bun install` (Node >= 24, Bun 1.2+). + Install deps: `bun install` (pin Node/Bun via `.tool-versions`/`.bun-version`; CI enforces versions). - Tests: `turbo test` (all) or `bun test` in a workspace. + Tests: `turbo run test` (all) or `bun test` in a workspace. - DB: `bun run migration:generate`, `bun run migration:local`, `bun run studio:dev`. + DB (specify tool, e.g., Prisma/Drizzle): `bun run migration:generate`, `bun run migration:local`, `bun run studio:dev`. Document rollback steps. - Cloudflare: `bun run preview`, `bun run deploy`. + Cloudflare: `bun run preview`, `bun run deploy` (ensure Wrangler auth, e.g., `bun run cf:login`).
21-21: 澄清分号与尾随逗号规则，消除歧义“semicolons as needed” 容易产生不同理解；建议写死为 “always” 或 “never”，并与 Biome 配置一致。
- Formatter/Linter: Biome (`biome.json`). Use 2-space indent, 100-char width, single quotes, semicolons as needed, ES5 trailing commas. + Formatter/Linter: Biome (`biome.json`). 2-space indent, 100-char width, single quotes, trailing commas: es5; semicolons: always.
23-23: Zod 引用路径与版本建议多数场景直接从
'zod'引入。'zod/v4'子路径可能不稳定/与当前依赖不符。建议改为常规导入，并在 package.json 固定主版本。- Zod v4 only: `import { z } from 'zod/v4'`. + Zod: `import { z } from 'zod'`（在 package.json 固定主版本；避免使用不稳定子路径）。
26-29: 测试章节可补充覆盖率与隔离实践可加入覆盖率命令、watch 模式与最小化跨包耦合的建议（mock 外部服务、避免跨 workspace 状态共享）。
- Framework: Vitest. Name files `*.test.ts` and keep tests isolated. + Framework: Vitest. Name files `*.test.ts` and keep tests isolated; use `bun test --coverage` for coverage and `bun test --watch` locally.
31-33: 版本管理与变更记录流程建议（Changesets/发布检查表）此 PR 涉及依赖升级与多包版本提升，建议明确使用 Changesets（或等价流程）并在 PR 模板中勾选发布前检查项（build/typecheck/lint/test/changeset）。
- PRs: clear description, linked issues (e.g., `#123`), screenshots for UI changes, and passing build, typecheck, lint, and tests. + PRs: clear description, linked issues (e.g., `#123`), screenshots for UI changes, and passing build/typecheck/lint/tests. Use Changesets for version bumps across packages.
36-39: 补充密钥防泄漏与 DB 变更守则
- 增加预提交/CI 秘密扫描（secretlint/git-secrets/GHA secret scanning）。
.env.example不放真实令牌形状；Cloudflare/1Password/Secrets Manager 统一管理。- 对 DB 变更强制本地回滚演练和下线步骤，避免热路径事故。
- Do not commit secrets; keep local-only config in `.env.local`. + Do not commit secrets; keep local-only config in `.env.local`. Enable secret scanning in CI (e.g., secretlint/GitHub secret scanning) and store secrets in Cloudflare/1Password. - For DB changes, always generate migrations and run them locally before opening a PR. + For DB changes, always generate migrations, validate forward & rollback locally, and document downgrade steps in the PR.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (31)
AGENTS.md(1 hunks)WARP.md(1 hunks)apps/builder/CHANGELOG.md(1 hunks)apps/builder/package.json(4 hunks)apps/cdn/CHANGELOG.md(1 hunks)apps/cdn/package.json(2 hunks)apps/deploy-workflow/CHANGELOG.md(1 hunks)apps/deploy-workflow/package.json(2 hunks)apps/deploy/CHANGELOG.md(1 hunks)apps/deploy/package.json(2 hunks)apps/dispatcher/CHANGELOG.md(1 hunks)apps/dispatcher/package.json(2 hunks)apps/docs/CHANGELOG.md(1 hunks)apps/docs/package.json(2 hunks)apps/screenshot/CHANGELOG.md(1 hunks)apps/screenshot/package.json(2 hunks)apps/vite-shadcn-template/CHANGELOG.md(1 hunks)apps/vite-shadcn-template/package.json(2 hunks)apps/web/CHANGELOG.md(1 hunks)apps/web/package.json(5 hunks)package.json(2 hunks)packages/auth/CHANGELOG.md(1 hunks)packages/auth/package.json(2 hunks)packages/better-auth-cloudflare/CHANGELOG.md(1 hunks)packages/better-auth-cloudflare/package.json(2 hunks)packages/better-auth-stripe/CHANGELOG.md(1 hunks)packages/better-auth-stripe/package.json(2 hunks)packages/common/CHANGELOG.md(1 hunks)packages/common/package.json(2 hunks)packages/ui/CHANGELOG.md(1 hunks)packages/ui/package.json(4 hunks)
🧰 Additional context used
🪛 LanguageTool
apps/dispatcher/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ...1.0.11 ### Patch Changes - update deps - Updated dependencies - @libra/common@1...
(QB_NEW_EN)
apps/deploy/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.9 ### Patch Changes - update deps - Updated dependencies - @libra/common@1...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ...ted dependencies - @libra/common@1.0.3 - @libra/auth@1.0.5 ## 1.0.8 ### Patch C...
(QB_NEW_EN)
apps/cdn/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.6 ### Patch Changes - update deps - Updated dependencies - @libra/auth@1.0...
(QB_NEW_EN)
apps/screenshot/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.8 ### Patch Changes - update deps - Updated dependencies - @libra/common@1...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ...ted dependencies - @libra/common@1.0.3 - @libra/auth@1.0.5 ## 1.0.7 ### Patch C...
(QB_NEW_EN)
apps/web/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ...1.0.16 ### Patch Changes - update deps - Updated dependencies - @libra/better-a...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ... - @libra/better-auth-cloudflare@1.0.9 - @libra/better-auth-stripe@1.0.4 - @lib...
(QB_NEW_EN)
[grammar] ~10-~10: There might be a mistake here.
Context: ....0.9 - @libra/better-auth-stripe@1.0.4 - @libra/common@1.0.3 - @libra/auth@1.0....
(QB_NEW_EN)
[grammar] ~11-~11: There might be a mistake here.
Context: ...uth-stripe@1.0.4 - @libra/common@1.0.3 - @libra/auth@1.0.5 - @libra/ui@1.0.4 #...
(QB_NEW_EN)
[grammar] ~12-~12: There might be a mistake here.
Context: ...libra/common@1.0.3 - @libra/auth@1.0.5 - @libra/ui@1.0.4 ## 1.0.15 ### Patch Ch...
(QB_NEW_EN)
WARP.md
[grammar] ~92-~92: There might be a mistake here.
Context: ... (React 19) - the primary user interface - apps/builder: Vite build service for c...
(QB_NEW_EN)
[grammar] ~93-~93: There might be a mistake here.
Context: ...uild service for compiling user projects - apps/cdn: Hono-based CDN service for s...
(QB_NEW_EN)
[grammar] ~94-~94: There might be a mistake here.
Context: ...ce for static assets and file management - apps/deploy: Deployment service V2 usi...
(QB_NEW_EN)
[grammar] ~95-~95: There might be a mistake here.
Context: ...g Cloudflare Queues for async deployment - apps/dispatcher: Request routing servi...
(QB_NEW_EN)
[grammar] ~96-~96: There might be a mistake here.
Context: ...ting service using Workers for Platforms - apps/auth-studio: Database management ...
(QB_NEW_EN)
[grammar] ~97-~97: There might be a mistake here.
Context: ...nagement console for authentication data - apps/screenshot: Screenshot generation...
(QB_NEW_EN)
[grammar] ~100-~100: There might be a mistake here.
Context: ...dflare Queues ### Core Technology Stack - Runtime: Bun 1.2.19+ for package manag...
(QB_NEW_EN)
[grammar] ~101-~101: There might be a mistake here.
Context: ...2.19+ for package management and runtime - Frontend: Next.js 15.3.5 with React 19...
(QB_NEW_EN)
[grammar] ~102-~102: There might be a mistake here.
Context: ...ith React 19, Tailwind CSS v4, shadcn/ui - Backend: Hono web framework for Cloudf...
(QB_NEW_EN)
[grammar] ~103-~103: There might be a mistake here.
Context: ...ono web framework for Cloudflare Workers - Database: Dual setup - PostgreSQL (Neo...
(QB_NEW_EN)
[grammar] ~104-~104: There might be a mistake here.
Context: ...or business data, Cloudflare D1 for auth - API: tRPC 11.4.3+ for type-safe APIs -...
(QB_NEW_EN)
[grammar] ~105-~105: There might be a mistake here.
Context: ...API: tRPC 11.4.3+ for type-safe APIs - Auth: better-auth 1.3.3 with Cloudflar...
(QB_NEW_EN)
[grammar] ~106-~106: There might be a mistake here.
Context: ...1.3.3 with Cloudflare and Stripe plugins - AI: AI SDK 4.3.19 supporting Claude, O...
(QB_NEW_EN)
[grammar] ~109-~109: There might be a mistake here.
Context: ...ini, DeepSeek ### Database Architecture The project uses a dual database arc...
(QB_NEW_EN)
[grammar] ~113-~113: There might be a mistake here.
Context: ...ts, organizations, etc.) - Schema in packages/db/src/schema/ - Migrations in packages/db/migrations/ ...
(QB_NEW_EN)
[grammar] ~114-~114: There might be a mistake here.
Context: ...ages/db/src/schema/ - Migrations inpackages/db/migrations/` - Connection via Hyperdrive for pooling 2...
(QB_NEW_EN)
[grammar] ~117-~117: There might be a mistake here.
Context: ...flare D1** (SQLite): Authentication data - Schema in packages/auth/src/schema.ts ...
(QB_NEW_EN)
[grammar] ~118-~118: There might be a mistake here.
Context: ...te): Authentication data - Schema in packages/auth/src/schema.ts - Migrations in `packages/auth/migrations/...
(QB_NEW_EN)
[grammar] ~119-~119: There might be a mistake here.
Context: .../auth/src/schema.ts - Migrations inpackages/auth/migrations/` - Local testing with Wrangler D1 ### API ...
(QB_NEW_EN)
[grammar] ~122-~122: There might be a mistake here.
Context: ...g with Wrangler D1 ### API Layer (tRPC) API routes are in `packages/api/src/rout...
(QB_NEW_EN)
[grammar] ~123-~123: There might be a mistake here.
Context: ...outes are in packages/api/src/router/: - Type-safe from database to client - Zod ...
(QB_NEW_EN)
[grammar] ~124-~124: There might be a mistake here.
Context: ...r/`: - Type-safe from database to client - Zod validation for inputs - Organized by...
(QB_NEW_EN)
[grammar] ~125-~125: There might be a mistake here.
Context: ...se to client - Zod validation for inputs - Organized by feature (auth, projects, or...
(QB_NEW_EN)
[grammar] ~128-~128: There might be a mistake here.
Context: ...zation, etc.) ### Authentication System Uses better-auth with: - GitHub OAuth an...
(QB_NEW_EN)
[grammar] ~129-~129: There might be a mistake here.
Context: ...entication System Uses better-auth with: - GitHub OAuth and email/magic code authen...
(QB_NEW_EN)
[grammar] ~130-~130: There might be a mistake here.
Context: ...Auth and email/magic code authentication - Organization and permission management -...
(QB_NEW_EN)
[grammar] ~131-~131: There might be a mistake here.
Context: ...- Organization and permission management - Stripe integration for subscriptions - S...
(QB_NEW_EN)
[grammar] ~132-~132: There might be a mistake here.
Context: ...t - Stripe integration for subscriptions - Session management with D1 storage ### ...
(QB_NEW_EN)
[grammar] ~135-~135: There might be a mistake here.
Context: ...ment with D1 storage ### AI Integration Multi-model support through AI SDK: - Pr...
(QB_NEW_EN)
[grammar] ~136-~136: There might be a mistake here.
Context: ...tion Multi-model support through AI SDK: - Providers: Claude, OpenAI, Azure AI, Gem...
(QB_NEW_EN)
[grammar] ~137-~137: There might be a mistake here.
Context: ...re AI, Gemini, DeepSeek, xAI, OpenRouter - Sandbox execution via E2B and Daytona - ...
(QB_NEW_EN)
[grammar] ~138-~138: There might be a mistake here.
Context: ... - Sandbox execution via E2B and Daytona - Quota management and billing integration...
(QB_NEW_EN)
[grammar] ~139-~139: There might be a mistake here.
Context: ...Quota management and billing integration - Context-aware code generation ### Deplo...
(QB_NEW_EN)
[grammar] ~142-~142: There might be a mistake here.
Context: ... generation ### Deployment Architecture All services deploy to Cloudflare Worker...
(QB_NEW_EN)
[grammar] ~143-~143: There might be a mistake here.
Context: ...l services deploy to Cloudflare Workers: - Workers for Platforms: Multi-tenant pr...
(QB_NEW_EN)
[grammar] ~144-~144: There might be a mistake here.
Context: ...forms**: Multi-tenant project deployment - Deployment Service V2 (apps/deploy):...
(QB_NEW_EN)
[grammar] ~145-~145: There might be a mistake here.
Context: ...s/deploy): Queue-based async deployment - **Dispatcher** (apps/dispatcher`): Routes...
(QB_NEW_EN)
[grammar] ~146-~146: There might be a mistake here.
Context: ...Routes requests to user Worker instances - Custom Domains: Via Cloudflare SaaS fo...
(QB_NEW_EN)
[grammar] ~151-~151: There might be a mistake here.
Context: ...ild configuration and task orchestration - biome.json: Code formatting and lintin...
(QB_NEW_EN)
[grammar] ~152-~152: There might be a mistake here.
Context: ...g and linting (replaces ESLint/Prettier) - wrangler.jsonc: Cloudflare Workers con...
(QB_NEW_EN)
[grammar] ~153-~153: There might be a mistake here.
Context: ...oudflare Workers configuration (per app) - .env: Environment variables (copy from...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...nment variables (copy from .env.example) - drizzle.config.ts: Database configurat...
(QB_NEW_EN)
[grammar] ~159-~159: There might be a mistake here.
Context: ...environment variables (see .env.example for full list): - NEXT_PUBLIC_APP_URL: Ma...
(QB_NEW_EN)
[grammar] ~159-~159: There might be a mistake here.
Context: ...iables (see .env.example for full list): - NEXT_PUBLIC_APP_URL: Main application URL - POSTGRES_URL:...
(QB_NEW_EN)
[grammar] ~160-~160: There might be a mistake here.
Context: ...XT_PUBLIC_APP_URL: Main application URL - POSTGRES_URL: PostgreSQL connection string - BETTER...
(QB_NEW_EN)
[grammar] ~161-~161: There might be a mistake here.
Context: ...TGRES_URL: PostgreSQL connection string - BETTER_AUTH_SECRET: Authentication secret - CLOUDFLARE_AC...
(QB_NEW_EN)
[grammar] ~162-~162: There might be a mistake here.
Context: ...TTER_AUTH_SECRET: Authentication secret - CLOUDFLARE_ACCOUNT_ID: Cloudflare account for deployments - ...
(QB_NEW_EN)
[grammar] ~163-~163: There might be a mistake here.
Context: ..._ID: Cloudflare account for deployments - CLOUDFLARE_API_TOKEN`: Cloudflare API access - AI provider ke...
(QB_NEW_EN)
[grammar] ~164-~164: There might be a mistake here.
Context: ...DFLARE_API_TOKEN: Cloudflare API access - AI provider keys: ANTHROPIC_API_KEY, ...
(QB_NEW_EN)
[grammar] ~170-~170: There might be a mistake here.
Context: ...ng bun dev, services are available at: - Main App: http://localhost:3000 - Email ...
(QB_NEW_EN)
[grammar] ~171-~171: There might be a mistake here.
Context: ...le at: - Main App: http://localhost:3000 - Email Preview: http://localhost:3001 - A...
(QB_NEW_EN)
[grammar] ~172-~172: There might be a mistake here.
Context: ...0 - Email Preview: http://localhost:3001 - Auth Studio: http://localhost:3002 - Doc...
(QB_NEW_EN)
[grammar] ~173-~173: There might be a mistake here.
Context: ...001 - Auth Studio: http://localhost:3002 - Documentation: http://localhost:3003 - C...
(QB_NEW_EN)
[grammar] ~174-~174: There might be a mistake here.
Context: ...2 - Documentation: http://localhost:3003 - CDN Service: http://localhost:3004 - Bui...
(QB_NEW_EN)
[grammar] ~175-~175: There might be a mistake here.
Context: ...003 - CDN Service: http://localhost:3004 - Build Service: http://localhost:5173 - D...
(QB_NEW_EN)
[grammar] ~176-~176: There might be a mistake here.
Context: ...4 - Build Service: http://localhost:5173 - Dispatcher: http://localhost:3007 - Depl...
(QB_NEW_EN)
[grammar] ~177-~177: There might be a mistake here.
Context: ...5173 - Dispatcher: http://localhost:3007 - Deploy Service: http://localhost:3008 - ...
(QB_NEW_EN)
[grammar] ~178-~178: There might be a mistake here.
Context: ... - Deploy Service: http://localhost:3008 - Screenshot Service: http://localhost:300...
(QB_NEW_EN)
[grammar] ~183-~183: There might be a mistake here.
Context: ...roject heavily uses Cloudflare services: - Workers: Serverless compute for all se...
(QB_NEW_EN)
[grammar] ~184-~184: There might be a mistake here.
Context: ...s**: Serverless compute for all services - D1: SQLite database for authentication...
(QB_NEW_EN)
[grammar] ~185-~185: There might be a mistake here.
Context: ...D1**: SQLite database for authentication - KV: Key-value storage for caching - **...
(QB_NEW_EN)
[grammar] ~186-~186: There might be a mistake here.
Context: ... - KV: Key-value storage for caching - R2: Object storage for files and build...
(QB_NEW_EN)
[grammar] ~187-~187: There might be a mistake here.
Context: ...2**: Object storage for files and builds - Queues: Async task processing for depl...
(QB_NEW_EN)
[grammar] ~188-~188: There might be a mistake here.
Context: ...*: Async task processing for deployments - Durable Objects: State management and ...
(QB_NEW_EN)
[grammar] ~189-~189: There might be a mistake here.
Context: ...Objects**: State management and sessions - Hyperdrive: PostgreSQL connection pool...
(QB_NEW_EN)
[grammar] ~203-~203: There might be a mistake here.
Context: ...ent Tasks ### Adding a New API Endpoint 1. Add route in `packages/api/src/router/[f...
(QB_NEW_EN)
[grammar] ~204-~204: There might be a mistake here.
Context: ...ding a New API Endpoint 1. Add route in packages/api/src/router/[feature].ts 2. Define Zod schema for input validation 3...
(QB_NEW_EN)
[grammar] ~207-~207: There might be a mistake here.
Context: ...logic with proper error handling 4. Use in frontend with tRPC client hooks ### Mo...
(QB_NEW_EN)
[grammar] ~224-~224: There might be a mistake here.
Context: ...igrate ``` ### Working with AI Features - AI providers configured in `apps/web/lib...
(QB_NEW_EN)
[grammar] ~225-~225: There might be a mistake here.
Context: ...I Features - AI providers configured in apps/web/lib/models/ - Streaming responses handled via AI SDK -...
(QB_NEW_EN)
[grammar] ~226-~226: There might be a mistake here.
Context: ...- Streaming responses handled via AI SDK - Sandbox execution through `packages/sand...
(QB_NEW_EN)
[grammar] ~227-~227: There might be a mistake here.
Context: ... via AI SDK - Sandbox execution through packages/sandbox/ - Context management in conversation handl...
(QB_NEW_EN)
[grammar] ~230-~230: There might be a mistake here.
Context: ...onversation handlers ### Debugging Tips - Use browser DevTools for frontend debugg...
(QB_NEW_EN)
[grammar] ~234-~234: There might be a mistake here.
Context: ...dev` in auth package - tRPC errors show in Network tab with full stack traces - Re...
(QB_NEW_EN)
[uncategorized] ~234-~234: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ... - tRPC errors show in Network tab with full stack traces - React Query DevTools available...
(EN_COMPOUND_ADJECTIVE_INTERNAL)
[grammar] ~239-~239: There might be a mistake here.
Context: ...tions workflows in .github/workflows/: - web.yml: Deploy main application - **c...
(QB_NEW_EN)
[grammar] ~240-~240: There might be a mistake here.
Context: ...: - web.yml: Deploy main application - cdn.yml: Deploy CDN service - **deploy...
(QB_NEW_EN)
[grammar] ~241-~241: There might be a mistake here.
Context: ...cation - cdn.yml: Deploy CDN service - deploy.yml: Deploy deployment service ...
(QB_NEW_EN)
[grammar] ~242-~242: There might be a mistake here.
Context: ...deploy.yml*: Deploy deployment service - dispatcher.yml: Deploy routing service...
(QB_NEW_EN)
[grammar] ~243-~243: There might be a mistake here.
Context: ...dispatcher.yml**: Deploy routing service - screenshot.yml: Deploy screenshot serv...
(QB_NEW_EN)
[grammar] ~244-~244: There might be a mistake here.
Context: ...eenshot.yml**: Deploy screenshot service - docs.yml: Deploy documentation ### Ma...
(QB_NEW_EN)
[grammar] ~283-~283: There might be a mistake here.
Context: ...# Important Patterns ### Error Handling - Use custom error classes in `packages/co...
(QB_NEW_EN)
[grammar] ~288-~288: There might be a mistake here.
Context: ... graceful failures ### State Management - Server state: React Query with tRPC - Cl...
(QB_NEW_EN)
[grammar] ~289-~289: There might be a mistake here.
Context: ...nt - Server state: React Query with tRPC - Client state: Zustand stores in `apps/we...
(QB_NEW_EN)
[grammar] ~293-~293: There might be a mistake here.
Context: ...od validation ### Component Development - Use components from packages/ui/ desig...
(QB_NEW_EN)
apps/deploy-workflow/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.5 ### Patch Changes - update deps - Updated dependencies - @libra/common@1...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ...ted dependencies - @libra/common@1.0.3 - @libra/auth@1.0.5 ## 1.0.4 ### Patch C...
(QB_NEW_EN)
packages/auth/CHANGELOG.md
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.5 ### Patch Changes - update deps - Updated dependencies - @libra/better-a...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ... - @libra/better-auth-cloudflare@1.0.9 - @libra/better-auth-stripe@1.0.4 - @lib...
(QB_NEW_EN)
[grammar] ~10-~10: There might be a mistake here.
Context: ....0.9 - @libra/better-auth-stripe@1.0.4 - @libra/common@1.0.3 - @libra/ui@1.0.4 ...
(QB_NEW_EN)
[grammar] ~11-~11: There might be a mistake here.
Context: ...uth-stripe@1.0.4 - @libra/common@1.0.3 - @libra/ui@1.0.4 ## 1.0.4 ### Patch Cha...
(QB_NEW_EN)
AGENTS.md
[grammar] ~21-~21: There might be a mistake here.
Context: ...micolons as needed, ES5 trailing commas. - TypeScript-first with strict types and m...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
WARP.md
171-171: Bare URL used
(MD034, no-bare-urls)
172-172: Bare URL used
(MD034, no-bare-urls)
173-173: Bare URL used
(MD034, no-bare-urls)
174-174: Bare URL used
(MD034, no-bare-urls)
175-175: Bare URL used
(MD034, no-bare-urls)
176-176: Bare URL used
(MD034, no-bare-urls)
177-177: Bare URL used
(MD034, no-bare-urls)
178-178: Bare URL used
(MD034, no-bare-urls)
179-179: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: cubic · AI code reviewer
🔇 Additional comments (24)
apps/deploy/package.json (1)
11-11: 确认 wrangler types 产物纳入类型检查链路已有脚本 cf-typegen，但请确认 tsconfig 中包含生成的 d.ts（或通过 types 字段显式声明），避免编辑器与 CI 结果不一致。
apps/dispatcher/package.json (1)
24-27: 依赖更新 LGTMwrangler 与 @cloudflare/workers-types 升级合理，未见破坏性脚本变更。
packages/auth/package.json (1)
3-3: 版本号补丁升级与变更记录一致性检查通过与 packages/auth/CHANGELOG.md 的 1.0.5 条目一致。无进一步意见。
packages/better-auth-cloudflare/package.json (3)
3-3: 版本号补丁升级 OK仅为 patch bump，符合“更新依赖”的范围。
34-34: 完成最小集成路径的 e2e 冒烟测试以验证 better-auth ^1.3.8 的运行时兼容性
- Monorepo 内所有依赖已统一为 ^1.3.8，无 1.3.7 混用
- 在最小集成路径上执行一次 e2e 冒烟测试（auth 初始化、典型请求流程）
40-42: peerDependencies 升级检查
- 本地先安装依赖（如
npm install/pnpm install），再执行全仓 TypeScript 类型检查（例如pnpm turbo run typecheck），确保升级至@cloudflare/workers-types@^4.20250906.0与@opennextjs/cloudflare@^1.8.0后无类型报错。- 核实所有消费方应用的
peerDependencies中已显式声明并满足以上新范围。- 当前
main: "./index.js"与exports指向 TS 源码存在入口不一致，建议统一指向构建产物或源码并由打包器处理，避免非 Bun 环境下直接依赖main出现差异。packages/better-auth-stripe/package.json (3)
3-3: 版本号补丁升级 OKCHANGELOG 已包含 1.0.4，匹配本改动。
46-46: 无需验证 better-call 脚本兼容性
未在代码或脚本中检测到对 better-call 的引用，可放心升级。
42-42: 确认已升级 better-auth 至 ^1.3.8 并运行最小用例测试
重点验证 Stripe 客户端/服务端初始化及 webhook 校验的类型和行为是否与之前兼容。packages/ui/package.json (2)
18-18: Tailwind v4 升级一致性良好（通过）
@tailwindcss/postcss@^4.1.13与tailwindcss@^4.1.13版本对齐，预期可避免 peer 冲突。无需改动。Also applies to: 37-37
3-3: 版本号提升后，请同步更新对应 CHANGELOG建议在
packages/ui/CHANGELOG.md增加1.0.4的条目（至少注明“update deps”），方便审计。apps/cdn/package.json (2)
3-3: 版本号提升（通过）元数据变更合理，与仓库整体补丁升级一致。
21-21: Wrangler 升级后请跑一次本地/CI 兼容性检查关注：
wrangler types --env-interface CloudflareBindings是否仍输出一致- Dev
persist-to的路径行为是否有变化apps/deploy-workflow/package.json (1)
3-3: CHANGELOG 与 package.json 版本一致
已确认 apps/deploy-workflow/CHANGELOG.md 已包含1.0.5条目，请在发布流程中生成并提交相应 changeset。packages/auth/CHANGELOG.md (1)
3-13: 依赖版本已验证一致，建议可选增强变更日志可读性
依赖版本与对应的 package.json 完全一致。可选：为 1.0.5 添加发布日期及更详细的变更说明以提升可读性。apps/builder/package.json (1)
72-75: 保持 Cloudflare 工具链版本一致并本地验证
- 确保
@cloudflare/vite-plugin、wrangler和@cloudflare/workers-types三者版本在同一 PR 中保持同步；在apps/builder下安装完依赖后，手动运行npx tsc --noEmit进行类型检查，并通过node -e "import('./vite.config.ts').then(()=>console.log('vite config loaded'))"验证 Vite 配置加载，以避免 types 与 CLI 不匹配。package.json (2)
34-34: Workers Types 提升到 ^4.20250906.0 的影响确认该版本通常与当日 wrangler/types 发布节奏耦合。请确认所有使用 Cloudflare Workers 的子包均已同步升级且类型检查通过（见上方一致性脚本）。
54-55: 更新冒烟验证脚本：
- @opennextjs/cloudflare 升级到 ^1.8.0，需在本地执行 preview 与 deploy dry-run 验证。可使用：
#!/usr/bin/env bash set -euo pipefail echo "OpenNext CLI 版本：" npx -y @opennextjs/cloudflare --version || true echo "构建 · 预览 · 干跑部署：" ( cd apps/web npx -y @opennextjs/cloudflare build npx -y @opennextjs/cloudflare preview npx -y @opennextjs/cloudflare deploy --dry-run ) || true- better-auth 升级到 ^1.3.8，packages/better-auth-cloudflare 中已同步
"better-auth": "^1.3.8"，无需额外调整。packages/common/package.json (1)
3-3: 版本提升 OK，但请同步校验依赖树与锁文件补丁版升级到 1.0.3 看起来合理。请确认已运行 bun update 并提交 bun.lockb，以避免 CI/本地解析差异。
apps/screenshot/package.json (1)
31-32: 升级 wrangler 到 ^4.34.0：请确认本包与其他 Apps 的 Cloudflare 类型与兼容性一致Workers 项目常见问题是各包 wrangler/CF types 版本不一致导致类型或本地运行异常。请在根/CI 中统一 wrangler 版本，并验证本包 cf-typegen 产物是否无差异。
apps/docs/package.json (1)
12-19: 文档依赖小版本升级 LGTM；请检查与 WARP.md 技术栈版本描述是否一致fumadocs 与 orama 补丁升级问题不大。当前 WARP.md 中的版本描述与此处依赖可能不一致（见“Core Technology Stack”段落），建议统一。
WARP.md (2)
40-48: 确认脚本是否存在：bun dev / bun dev:web / bun build 等文档引用了根级脚本名；请确认根 package.json 中确有这些脚本，避免新手按文档操作失败。
123-128: tRPC 路由目录与实际仓库结构核对文档指向
packages/api/src/router/；若项目确实以 @libra/api 暴露路由，请确认该路径存在并与最新结构一致（有的项目将路由细分到 feature 目录或 monorepo 包名不同）。AGENTS.md (1)
1-40: 整体 LGTM，文档价值高新增/细化的工程指南基本完善，可读性好。合并上述小修即可上线。
| - update deps | ||
| - Updated dependencies | ||
| - @libra/auth@1.0.5 |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
消除重复表述并明确依赖列表
当前同时存在 “update deps” 与 “Updated dependencies” 两个要点，信息重复。建议合并为一条，并在子项中列出具体更新；如本应用确有 wrangler 等开发依赖升级，也可一并注明以提升可见性。
- - update deps
- - Updated dependencies
- - @libra/auth@1.0.5
+ - Update dependencies:
+ - @libra/auth@1.0.5
+ # 如适用，也可补充开发依赖
+ # - wrangler@^4.34.0 (dev)可运行脚本核对 package.json 与 changelog 是否一致，并检测 wrangler 是否升级：
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "apps/cdn/package.json -> wrangler version & @libra/auth version"
jq -r '.devDependencies.wrangler, .dependencies["@libra/auth"] // .devDependencies["@libra/auth"]' apps/cdn/package.json
echo "CHANGELOG mentions:"
rg -n "wrangler|@libra/auth" apps/cdn/CHANGELOG.md || trueLength of output: 490
合并重复依赖更新条目并同步版本
apps/cdn/CHANGELOG.md 中 update deps 与 Updated dependencies 冗余，合并为：
- Update dependencies:
- @libra/auth@1.0.5
- wrangler@^4.34.0 (dev)
同时将 apps/cdn/package.json 中 @libra/auth 版本由 * 更新至 1.0.5，与 CHANGELOG 保持一致。
🧰 Tools
🪛 LanguageTool
[grammar] ~7-~7: There might be a mistake here.
Context: ... 1.0.6 ### Patch Changes - update deps - Updated dependencies - @libra/auth@1.0...
(QB_NEW_EN)
🤖 Prompt for AI Agents
In apps/cdn/CHANGELOG.md around lines 7-9 there are redundant entries "update
deps" and "Updated dependencies" that should be consolidated into a single
"Update dependencies:" entry listing both @libra/auth@1.0.5 and wrangler@^4.34.0
(dev); also update apps/cdn/package.json to change the @libra/auth dependency
version from "*" to "1.0.5" so the package.json and CHANGELOG remain in sync.
Ensure formatting matches existing changelog style and commit both files
together.
| "wrangler": "^4.34.0", | ||
| "@types/node": "^24.3.1", | ||
| "typescript": "^5.9.2", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
在 Workers 项目中引入 @types/node 可能导致类型污染与误用 Node API
Cloudflare Workers 非 Node 运行时；全局 Node 类型会让 TS 静态检查误放行如 fs/path/process 等 API，增加运行时风险。建议移除，或仅在测试/脚本专用 tsconfig 中声明 Node 类型。
可选修复（直接移除）：
"devDependencies": {
- "wrangler": "^4.34.0",
- "@types/node": "^24.3.1",
+ "wrangler": "^4.34.0",
"typescript": "^5.9.2",
"vitest": "^3.2.4",
"@vitest/coverage-v8": "^3.2.4"
},若确实需要 Node 类型，仅在测试 tsconfig 中限定：
{
"compilerOptions": {
"types": ["@cloudflare/workers-types", "vitest"]
}
}快速自检脚本（扫描潜在 Node 内置依赖）：
🏁 Script executed:
#!/bin/bash
rg -nP -C2 '(from\s+[\'"](fs|path|os|net|tls|child_process|cluster|dgram|readline|stream|zlib)[\'"])|(\bprocess\.env\b)|\bBuffer\b' apps/deployLength of output: 326
下面脚本修正了之前正则中的引号和转义问题，请重新执行以扫描 apps/deploy 目录中对 Node 内置模块或全局对象的引用：
🏁 Script executed:
#!/bin/bash
rg -nP -C2 "(from\\s+['\"](fs|path|os|net|tls|child_process|cluster|dgram|readline|stream|zlib)['\"])|(require\\(['\"](fs|path|os|net|tls|child_process|cluster|dgram|readline|stream|zlib)['\"]\\))|(\\bprocess\\.env\\b)|(\\bBuffer\\b)" apps/deployLength of output: 553
移除 @types/node 并替换 Worker 运行时不支持的 Node API
- package.json：从 devDependencies 中删除
"@types/node" - apps/deploy/src/utils/common.ts（第 243 行）：将
process.env[key]改为通过 Cloudflare Workers 环境绑定（env.VAR）获取，或将此工具函数仅保留在本地脚本/测试中使用 Node 类型
🤖 Prompt for AI Agents
In apps/deploy/package.json around lines 30-32 and
apps/deploy/src/utils/common.ts at line 243, remove "@types/node" from
devDependencies in package.json and replace usages of process.env[key] in
common.ts with the Cloudflare Workers environment binding pattern (access via
the env object passed to the worker, e.g., env.VAR), or limit that utility
function to Node-only scripts/tests; update imports/types if needed to avoid
Node globals, and ensure runtime environment variables are read from the
worker's env parameter rather than process.env.
| "drizzle-kit": "^0.31.4", | ||
| "drizzle-seed": "^0.3.1", | ||
| "knip": "^5.63.0", | ||
| "knip": "^5.63.1", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
knip 升级后的检查范围变化
knip 版本微升后规则可能稍有变动。建议在 CI 增加一次 knip 全仓扫描并将结果缓存到工件，避免误报阻塞。
🏁 Script executed:
#!/bin/bash
set -euo pipefail
npx -y knip --include dev --ignore "apps/**/dist/**" -n -s || trueLength of output: 4070
修正 CI 脚本，移除不支持的 --ignore 参数，并通过 .gitignore 或 .knip.json 配置文件进行文件忽略
knip CLI 并不识别 --ignore，请将 apps/**/dist/** 等输出目录添加到仓库的 .gitignore 中，或在根目录新增 .knip.json：
{
"ignore": ["apps/**/dist/**"]
}然后在 CI 中使用：
npx -y knip --include dependencies,files --production --cache -n || true🤖 Prompt for AI Agents
package.json around line 47: the CI currently passes an unsupported `--ignore`
flag to the knip CLI; remove that flag from the CI script, add the build output
patterns like apps/**/dist/** to the repository .gitignore or create a root
.knip.json containing an "ignore" array with those patterns, and update the CI
invocation to call knip without --ignore (for example use npx knip --include
dependencies,files --production --cache -n || true) so knip uses the ignore
config file instead of an unsupported CLI flag.
| "devDependencies": { | ||
| "@libra/typescript-config": "*", | ||
| "@better-auth/cli": "^1.3.7" | ||
| "@better-auth/cli": "^1.3.8" |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
确认 @better-auth/cli 升级无破坏性变更并验证现有命令
建议在本仓库验证 auth:generate 命令在 1.3.8 下输出一致，避免 CLI 选项或默认行为变更导致生成物差异。
可运行以下脚本做最小验证与版本一致性检查：
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) 检查 repo 内是否仍有 ^1.3.7 残留（应为 0）"
rg -nP '"@?better-auth[^"]*":\s*"\^?1\.3\.7"' -g '!**/dist/**' || true
echo "2) 打印 CLI 版本并查看帮助"
npx -y @better-auth/cli@1.3.8 --version
npx -y @better-auth/cli@1.3.8 --help | head -n 30Length of output: 739
修复 @better-auth/cli 版本输出并验证 generate 命令一致性
- CLI 版本输出异常：执行
npx -y @better-auth/cli@1.3.8 --version显示0.0.0，与依赖声明的1.3.8不符，请在 CLI 包的package.json中将version字段修正为1.3.8。 - 完整验证
auth:generate命令：在本仓库根目录运行npx -y @better-auth/cli@1.3.8 generate [options]，并与 1.3.7 版本输出逐项对比，确保生成产物和默认选项无破坏性变化。
🤖 Prompt for AI Agents
In packages/auth/package.json around line 31, the CLI dependency is ^1.3.8 but
the CLI package's own package.json version field is incorrectly 0.0.0; update
that package's "version" to "1.3.8" to match the dependency declaration. After
updating, run from the repo root: npx -y @better-auth/cli@1.3.8 --version to
confirm it prints 1.3.8, then run npx -y @better-auth/cli@1.3.8 generate
[options] and compare its generated output and default options against the 1.3.7
invocation to ensure no breaking changes; if differences appear, adjust the CLI
code or defaults to restore consistency or document intentional changes.
| ### Core Technology Stack | ||
| - **Runtime**: Bun 1.2.19+ for package management and runtime | ||
| - **Frontend**: Next.js 15.3.5 with React 19, Tailwind CSS v4, shadcn/ui | ||
| - **Backend**: Hono web framework for Cloudflare Workers | ||
| - **Database**: Dual setup - PostgreSQL (Neon + Hyperdrive) for business data, Cloudflare D1 for auth | ||
| - **API**: tRPC 11.4.3+ for type-safe APIs | ||
| - **Auth**: better-auth 1.3.3 with Cloudflare and Stripe plugins | ||
| - **AI**: AI SDK 4.3.19 supporting Claude, OpenAI, Gemini, DeepSeek | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
技术栈版本描述与实际依赖不一致，建议改为“非硬编码”表述
apps/web/package.json 使用 next ^15.5.x、react ^19.1.x、ai ^5.x、@ai-sdk/* ^2.x、tRPC ^11.5.x；而本段仍写 Next.js 15.3.5 / tRPC 11.4.3+ / AI SDK 4.3.19。为避免文档与代码漂移，建议去除具体补丁号或改为“参见各 package.json”：
-- **Frontend**: Next.js 15.3.5 with React 19, Tailwind CSS v4, shadcn/ui
-...
-- **API**: tRPC 11.4.3+ for type-safe APIs
-- **AI**: AI SDK 4.3.19 supporting Claude, OpenAI, Gemini, DeepSeek
+- **Frontend**: Next.js 15 + React 19（具体版本以 apps/web/package.json 为准）
+...
+- **API**: tRPC 11（以各 package.json 为准）
+- **AI**: Vercel AI SDK v5 + @ai-sdk/* v2（以 apps/web/package.json 为准）为了验证 apps/web/package.json 中各项依赖的实际版本，执行以下脚本：
🏁 Script executed:
#!/bin/bash
# 输出 apps/web/package.json 中核心依赖版本
echo "Next.js 版本：" $(jq -r '.dependencies.next' apps/web/package.json)
echo "React 版本：" $(jq -r '.dependencies.react' apps/web/package.json)
echo "Vercel AI SDK (ai) 版本：" $(jq -r '.dependencies.ai' apps/web/package.json)
echo "所有 @ai-sdk/* 包版本："
jq -r '.dependencies | to_entries | map(select(.key|startswith("@ai-sdk/"))) | .[] | " \(.key): \(.value)"' apps/web/package.json
echo "tRPC 相关包版本："
jq -r '.dependencies | to_entries | map(select(.key|test("@trpc"))) | .[] | " \(.key): \(.value)"' apps/web/package.jsonLength of output: 731
🏁 Script executed:
#!/bin/bash
echo "搜索 apps/web/package.json 中所有依赖部分的 tRPC 版本："
jq -r 'to_entries[]
| select(.key=="dependencies" or .key=="devDependencies" or .key=="peerDependencies")
| .key as $section
| .value
| to_entries[]?
| select(.key | test("trpc"))
| "\($section) \(.key): \(.value)"' apps/web/package.jsonLength of output: 364
🏁 Script executed:
#!/bin/bash
# 在所有 package.json 文件中搜索 tRPC 相关依赖
rg -nH '"@trpc' -g '*.json'Length of output: 299
更新文档中技术栈版本描述
文档中列出的版本（Next.js 15.3.5、tRPC 11.4.3+、AI SDK 4.3.19）与实际依赖（Next.js ^15.5.2、React ^19.1.1、ai ^5.0.33、@ai-sdk/* ^2.x、@trpc/* ^11.5.1）不符，建议移除具体补丁号或统一指出“以 package.json 为准”。
建议修改：
- **Frontend**: Next.js 15.3.5 with React 19, Tailwind CSS v4, shadcn/ui
+ **Frontend**: Next.js 15 + React 19（具体版本见 apps/web/package.json）
…
- **API**: tRPC 11.4.3+ for type-safe APIs
+ **API**: tRPC 11（具体版本见 packages/common/package.json）
- **AI**: AI SDK 4.3.19 supporting Claude, OpenAI, Gemini, DeepSeek
+ **AI**: Vercel AI SDK v5 + @ai-sdk/* v2（具体版本见 apps/web/package.json）📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ### Core Technology Stack | |
| - **Runtime**: Bun 1.2.19+ for package management and runtime | |
| - **Frontend**: Next.js 15.3.5 with React 19, Tailwind CSS v4, shadcn/ui | |
| - **Backend**: Hono web framework for Cloudflare Workers | |
| - **Database**: Dual setup - PostgreSQL (Neon + Hyperdrive) for business data, Cloudflare D1 for auth | |
| - **API**: tRPC 11.4.3+ for type-safe APIs | |
| - **Auth**: better-auth 1.3.3 with Cloudflare and Stripe plugins | |
| - **AI**: AI SDK 4.3.19 supporting Claude, OpenAI, Gemini, DeepSeek | |
| ### Core Technology Stack | |
| - **Runtime**: Bun 1.2.19+ for package management and runtime | |
| - **Frontend**: Next.js 15 + React 19（具体版本见 apps/web/package.json） | |
| - **Backend**: Hono web framework for Cloudflare Workers | |
| - **Database**: Dual setup – PostgreSQL (Neon + Hyperdrive) for business data, Cloudflare D1 for auth | |
| - **API**: tRPC 11（具体版本见 packages/common/package.json） | |
| - **Auth**: better-auth 1.3.3 with Cloudflare and Stripe plugins | |
| - **AI**: Vercel AI SDK v5 + @ai-sdk/* v2（具体版本见 apps/web/package.json） |
🧰 Tools
🪛 LanguageTool
[grammar] ~100-~100: There might be a mistake here.
Context: ...dflare Queues ### Core Technology Stack - Runtime: Bun 1.2.19+ for package manag...
(QB_NEW_EN)
[grammar] ~101-~101: There might be a mistake here.
Context: ...2.19+ for package management and runtime - Frontend: Next.js 15.3.5 with React 19...
(QB_NEW_EN)
[grammar] ~102-~102: There might be a mistake here.
Context: ...ith React 19, Tailwind CSS v4, shadcn/ui - Backend: Hono web framework for Cloudf...
(QB_NEW_EN)
[grammar] ~103-~103: There might be a mistake here.
Context: ...ono web framework for Cloudflare Workers - Database: Dual setup - PostgreSQL (Neo...
(QB_NEW_EN)
[grammar] ~104-~104: There might be a mistake here.
Context: ...or business data, Cloudflare D1 for auth - API: tRPC 11.4.3+ for type-safe APIs -...
(QB_NEW_EN)
[grammar] ~105-~105: There might be a mistake here.
Context: ...API: tRPC 11.4.3+ for type-safe APIs - Auth: better-auth 1.3.3 with Cloudflar...
(QB_NEW_EN)
[grammar] ~106-~106: There might be a mistake here.
Context: ...1.3.3 with Cloudflare and Stripe plugins - AI: AI SDK 4.3.19 supporting Claude, O...
(QB_NEW_EN)
🤖 Prompt for AI Agents
WARP.md around lines 100 to 108: the listed specific dependency patch versions
(e.g. Next.js 15.3.5, tRPC 11.4.3+, AI SDK 4.3.19) are inconsistent with
package.json; update this section to avoid hardcoding patch numbers by either
removing exact patch versions (keep major/minor ranges only) or replace the line
with a single statement like "Refer to package.json for exact versions" and
optionally list major version ranges that match package.json (e.g. Next.js
^15.5, React ^19.1, ai ^5.0, @ai-sdk/* ^2.x, @trpc/* ^11.5) so the doc stays
accurate and easy to maintain.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
| "name": "vite-shadcn-template-libra", | ||
| "private": true, | ||
| "version": "1.0.0", | ||
| "version": "1.0.1", |
There was a problem hiding this comment.
Version bumped to 1.0.1 but build/publish scripts still tag and reference 1.0.0, causing inconsistent artifact names and potential confusion in CI/CD.
Prompt for AI agents
Address the following comment on apps/vite-shadcn-template/package.json at line 4:
<comment>Version bumped to 1.0.1 but build/publish scripts still tag and reference 1.0.0, causing inconsistent artifact names and potential confusion in CI/CD.</comment>
<file context>
@@ -1,7 +1,7 @@
"name": "vite-shadcn-template-libra",
"private": true,
- "version": "1.0.0",
+ "version": "1.0.1",
"type": "module",
"scripts": {
</file context>
| "@trpc/tanstack-react-query": "^11.5.0" | ||
| "@trpc/client": "^11.5.1", | ||
| "@trpc/react-query": "^11.5.1", | ||
| "@trpc/server": "^11.5.1", |
There was a problem hiding this comment.
Rule violated: Check System Design and Architectural Patterns
Common package depends on server-only and React-specific TRPC libraries, violating environment-agnostic design and separation of concerns.
Prompt for AI agents
Address the following comment on packages/common/package.json at line 28:
<comment>Common package depends on server-only and React-specific TRPC libraries, violating environment-agnostic design and separation of concerns.</comment>
<file context>
@@ -23,10 +23,10 @@
- "@trpc/tanstack-react-query": "^11.5.0"
+ "@trpc/client": "^11.5.1",
+ "@trpc/react-query": "^11.5.1",
+ "@trpc/server": "^11.5.1",
+ "@trpc/tanstack-react-query": "^11.5.1"
},
</file context>
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (6)
apps/screenshot/package.json (1)
32-32: 在 Workers 项目中引入 @types/node：建议仅限测试/工具链作用域Workers 运行时是 WebWorker/Service Worker 环境，Node 全局类型容易与 DOM/Workers 类型冲突。建议：
- 将 Node 类型限定到 Vitest 配置或单独 tsconfig（如 tsconfig.vitest.json）中，只对测试生效；
- 或在主 tsconfig 中通过
types精确声明 Workers 类型，避免全局引入 Node。示例（新增 tsconfig.vitest.json，并在 vitest.config.ts 指向它）：
{ "extends": "./tsconfig.json", "compilerOptions": { "types": ["vitest/globals", "@types/node"] }, "include": ["src/**/*.test.ts", "src/**/*.spec.ts"] }apps/cdn/worker-configuration.d.ts (2)
2576-2607: 留意MessagePort类型与内置类型冲突及transfer参数宽松
- 在
apps/*/worker-configuration.d.ts中新增了全局interface MessagePort，可能与 TypeScript DOM 库的MessagePort或 Node.jsworker_threads.MessagePort重名，导致声明合并或 “重复标识符” 错误。postMessage(data?, options?: { transfer?: any[] })中transfer使用了any[]，无法在编译期校验是否为真正的可传输对象，存在传入非Transferable值的风险；建议上游类型定义中改为Transferable[]以增强类型安全。这些定义由自动生成流程维护，暂不建议手动修改；可作为后续上游改进的跟踪记录。
5492-5499: 统一 AiOptions.gateway 为 UniversalGatewayOptions
保持AiGateway.run与AiOptions中gateway配置类型一致，建议将所有gateway?: GatewayOptions更新为gateway?: UniversalGatewayOptions。apps/deploy/worker-configuration.d.ts (2)
2591-2621: MessagePort.postMessage 的 transfer 类型过宽（any[]）建议把
transfer明确为可传输对象联合，提升类型精准度并减少误用；同时允许直接传入数组形式或 options 对象。-interface MessagePort extends EventTarget { - postMessage(data?: any, options?: (any[] | MessagePortPostMessageOptions)): void; +interface MessagePort extends EventTarget { + postMessage( + data?: any, + options?: MessagePortPostMessageOptions | (ArrayBuffer | MessagePort)[] + ): void; ... -} -interface MessagePortPostMessageOptions { - transfer?: any[]; -} +} +interface MessagePortPostMessageOptions { + transfer?: (ArrayBuffer | MessagePort)[]; +}
5620-5638: 图像变换新增segment与gravity: 'face'支持建议补一行 JSDoc 说明可用性（例如需要开启/计费的前提）以便调用方预期一致；类型本身 LGTM。
apps/deploy-workflow/worker-configuration.d.ts (1)
6478-6492: 示例绑定 HelloWorldBinding 建议移出生产类型面作为“DO NOT USE”的示例，放在主类型文件中可能引起 IDE 智能提示混淆。可考虑移动到文档或
*.example.d.ts。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
apps/cdn/package.json(2 hunks)apps/cdn/worker-configuration.d.ts(24 hunks)apps/deploy-workflow/package.json(2 hunks)apps/deploy-workflow/worker-configuration.d.ts(27 hunks)apps/deploy/package.json(2 hunks)apps/deploy/worker-configuration.d.ts(24 hunks)apps/dispatcher/package.json(2 hunks)apps/screenshot/package.json(2 hunks)
🚧 Files skipped from review as they are similar to previous changes (4)
- apps/deploy/package.json
- apps/dispatcher/package.json
- apps/cdn/package.json
- apps/deploy-workflow/package.json
🧰 Additional context used
🧬 Code graph analysis (3)
apps/cdn/worker-configuration.d.ts (1)
apps/deploy-workflow/worker-configuration.d.ts (3)
WorkerEntrypointBranded(6796-6798)EntrypointBranded(6805-6805)DefaultHandler(6885-6892)
apps/deploy/worker-configuration.d.ts (1)
apps/cdn/worker-configuration.d.ts (3)
WorkerEntrypointBranded(6785-6787)EntrypointBranded(6794-6794)DefaultHandler(6874-6881)
apps/deploy-workflow/worker-configuration.d.ts (4)
apps/cdn/worker-configuration.d.ts (2)
env(6960-6960)DefaultHandler(6874-6881)apps/deploy/worker-configuration.d.ts (2)
env(6974-6974)DefaultHandler(6888-6895)apps/screenshot/worker-configuration.d.ts (2)
env(6958-6958)DefaultHandler(6872-6879)apps/dispatcher/worker-configuration.d.ts (2)
env(6941-6941)DefaultHandler(6855-6862)
🔇 Additional comments (30)
apps/screenshot/package.json (4)
3-3: 版本号小幅提升与 PR 目标一致无功能风险，符合整仓依赖对齐策略。
35-35: Vitest 覆盖率插件版本与 vitest 主版本匹配
@vitest/coverage-v8@^3.2.4与vitest@^3.2.4对齐，良好。
31-31: 确认 dev 脚本的 --persist-to 行为一致已验证 cf-typegen（
wrangler types --env-interface CloudflareBindings）在 4.34.0 下仍生成同名 CloudflareBindings 接口，无需调整类型生成部分；请在本地执行包含 --persist-to 的 dev 脚本，确认在 4.34.0 下持久化行为与之前一致，并将运行输出记录到 gitignored 文件中。
36-36: 无需更改：zod-v3 仅在测试/脚本中使用，无运行时代码引用，且 @hono/zod-openapi 未声明对 zod v3 的 peer 依赖apps/cdn/worker-configuration.d.ts (11)
64-64: LGTM：新增 CloudflareBindings 公共别名将 Env 暴露为 CloudflareBindings 便于跨包消费，与 PR 其它子应用保持一致。
1515-1515: Service 泛型支持 ExportedHandler：赞放宽以适配
ExportedHandler形态的入口，能覆盖更多使用场景。
5421-5426: Ai Gateway：UniversalGatewayOptions 让 id 可选该类型对齐“可从环境或默认网关解析”的用法，类型层面更灵活。
5604-5624: Images：新增 segment/gravity 扩展项
segment: "foreground"与扩展的gravity枚举/坐标对齐最新运行时能力，变更合理。
6959-6961: LGTM：导出 cloudflare:workers.waitUntil便于在模块上下文显式使用
waitUntil。
481-481: 确认 Wrangler 已升级至 ≥4.34.0
apps/cdn/package.json 中"wrangler": "^4.34.0"已满足 ≥4.34.0 要求，无需调整。
6591-6611: ImagesBinding：新增 encoding 选项，核查调用兼容性ImageInputOptions 与 ImageTransformationOutputOptions 增加了 encoding 属性，检查所有 IMAGES.info 与 IMAGES.input 调用是否需显式传入 encoding，确保不破坏现有逻辑。
1166-1206: 可能冲突：MessageEvent 全局声明重复
已在 apps/dispatcher、cdn、deploy、deploy-workflow、screenshot 等多个项目的 worker-configuration.d.ts 中各自定义了 declare class MessageEvent extends Event ；若某编译单元同时引入了 DOM 或其他包含 MessageEvent 的库，将导致重复标识符或不兼容合并错误。请确认对应 tsconfig 的 lib 配置仅包含 Worker 运行时类型且不含 DOM / WebWorker 库，或在必要时开启 skipLibCheck 以规避冲突。
6873-6885: 确认虚拟模块 cloudflare:node 和 cloudflare:workers 的打包处理
在 apps/deploy-workflow/src/index.ts 第 21 行检测到import { WorkflowEntrypoint, WorkflowStep, type WorkflowEvent } from 'cloudflare:workers';但未发现
cloudflare:node的直接导入。请确保前端/Edge 打包器将这两个虚拟模块标记为外部（external）或通过别名（alias）处理，以避免将它们打包进浏览器产物中。
69-70: 谨慎：全局合并 ProcessEnv 可能污染 NodeJS 类型
由于在 apps/dispatcher、apps/deploy、apps/deploy-workflow、apps/screenshot、apps/cdn 的worker-configuration.d.ts中，interface ProcessEnv extends StringifyValues<…>会把process.env.FOO收窄为必填string，若同时加载了@types/node，将会影响 Node 端包的原生process.env类型。请确认：
- 各 Worker 项目（apps/dispatcher、apps/deploy、apps/deploy-workflow、apps/screenshot、apps/cdn）的 tsconfig.json 仅引入
@cloudflare/workers-types或置空"types"，不包含@types/node；- Node 运行项目（如 apps/builder、apps/web 等）未意外纳入上述 ambient 声明文件；
- 所有 tsconfig.json 的 include/exclude 配置已正确隔离不同编译单元。
5910-5916: 请验证并更新对 req.cf.asn、req.cf.asOrganization 和 req.cf.hostMetadata 的访问由于这三个属性已改为可选（
?），直接访问会导致编译期类型错误或运行时拿到undefined。请手动检查所有调用点，在取值处添加可选链或提供默认值，例如：const asn = req.cf?.asn ?? 0 const org = req.cf?.asOrganization ?? 'unknown' const meta = req.cf?.hostMetadata ?? {}Also applies to lines 6039–6041 in
worker-configuration.d.ts.apps/deploy/worker-configuration.d.ts (8)
495-496: 新增 DurableObjectNamespace.getByName 对齐最新 runtime，LGTM
1529-1533: 新增 Service 泛型工具类型映射 entrypoint→Fetcher，LGTM
5435-5440: UniversalGatewayOptions 定义兼容（去 id 化并保留可选 id 作兼容），LGTM
5509-5511: AiGateway.run 支持gateway?: UniversalGatewayOptions，LGTM
5543-5547: AutoRagAiSearchRequest 新增system_prompt，LGTM
6996-6998: TailStream 细节更新 LGTM（cfJson 可选 object、Onset.attributes 新增、info 联合收敛）Also applies to: 7062-7071
6605-6607: ImagesBinding 输入/输出选项扩展（base64 编码、输出选项）LGTM
ImageInputOptions.encoding?: 'base64'ImagesBinding.info/input(..., options?)ImageTransformationResult.image(options?)这有助于简化无损的字节传递/序列化流程，类型设计合理。
Also applies to: 6618-6625, 6648-6663
6888-6899: 无需变更DefaultHandler在所有worker-configuration.d.ts文件中的声明和结构完全一致，无需额外调整。apps/deploy-workflow/worker-configuration.d.ts (7)
492-494: 新增能力：DurableObjectNamespace.getByName补充的
getByName(name, options?)与 Cloudflare 最新接口对齐，向后兼容，无需变更现有调用。
6885-6896: 与 Cloudflare SDK 对齐的模块增强（cloudflare:node/httpServerHandler 与 waitUntil 导出）这些导出与其它包保持一致，便于本地 Node 运行/测试与类型统一。
Also applies to: 6971-6972
5921-5928: 无需修改： 已搜索整个代码库，未发现对 request.cf.asn、request.cf.asOrganization 或 request.cf.hostMetadata 的直接访问，无需添加可选链或存在性检查。
5617-5635: 请验证新增的 base64 编码选项对现有图片调用无影响已在以下位置定位到
ImageTransformer.input(stream, options?)和.image(options?)的调用，请回归测试确认默认行为（纯二进制输出）未被改变：
- apps/web/ai/providers.ts:110
- 各
apps/*/worker-configuration.d.ts（如 apps/screenshot…, apps/dispatcher…, apps/deploy-workflow… 行号约 66xx）
36-46: 确认新增的环境变量已同步到所有配置
- 在本地
.dev.vars（或等效的开发环境变量文件）中声明 DATABRICKS_BASE_URL、DATABRICKS_TOKEN、DAYTONA_API_KEY、DAYTONA_API_URL、SANDBOX_DEFAULT_PROVIDER、SANDBOX_BUILDER_DEFAULT_PROVIDER、CLOUDFLARE_ZONE_ID、CLOUDFLARE_SAAS_ZONE_ID、HYPERDRIVE_ID、KV_NAMESPACE_ID、NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS 等新增变量- 各环境的 wrangler.jsonc（或 toml）配置已注入上述变量，且名称与
apps/deploy-workflow/worker-configuration.d.ts中的声明保持一致- CI/CD 密钥库（Cloudflare Secrets、GitHub 仓库 Secrets 等）已创建对应的密钥项
80-81: 验证 TypeScript 编译及环境变量完整性
请在项目根目录运行tsc --noEmit，确保 apps/deploy-workflow/worker-configuration.d.ts 中的 ProcessEnv 声明可编译通过；并对照 Cloudflare.Env 定义，确认 Pick 列表已包含所有新增的环境变量键。
421-431: 移除关于 tailStream 签名的破坏性变更警告
仓库中未发现任何自定义tailStream实现，仅在.d.ts中声明类型，无实际使用，签名调整不会带来破坏性影响，可忽略此检查。Likely an incorrect or invalid review comment.
| readonly cfJson?: object; | ||
| readonly headers: Header[]; |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Breaking：TailStream 事件模型调整（cfJson 可选、Onset.attributes 引入、Log.message 由 string→object、事件联合变更）
如有自定义 tail/trace 处理逻辑，请同步适配新结构，特别是 log.message 类型变化和移除的事件类型（hibernate/link）。
Also applies to: 7048-7057, 7087-7088, 7101-7101
🏁 Script executed:
#!/bin/bash
# 定位 tail/trace 相关使用，检查对 message/string 的假设与已移除的事件
rg -nP "TailStream\.(Log|Onset|EventType)|hibernate|link|\.message\b" -g "apps/**" --type=ts --type=tsxLength of output: 133
请移除 --type=tsx，改为使用 glob 过滤 .ts/.tsx/.d.ts 文件，重新定位 TailStream 相关使用：
🏁 Script executed:
#!/bin/bash
rg -nP "TailStream\\.(Log|Onset|EventType)|hibernate|link|\\.message\\b" \
-g "apps/**/*.ts" \
-g "apps/**/*.tsx" \
-g "apps/**/*.d.ts" -nLength of output: 63880
🏁 Script executed:
#!/bin/bash
sed -n '7030,7160p' apps/cdn/worker-configuration.d.tsLength of output: 4905
更新 TailStream 事件模型适配
TailStream 事件模型已更新：
cfJson由必填改为可选Onset新增attributes字段Log.message类型由string改为object- 移除了
hibernate与link事件类型
请检查并更新所有自定义 tail/trace 处理逻辑以适配以上结构变更。
| ENVIRONMENT: "{{ENVIRONMENT}}"; | ||
| ADMIN_USER_IDS: "{{ADMIN_USER_IDS}}"; | ||
| NEXT_PUBLIC_DISPATCHER_URL: "{{NEXT_PUBLIC_DISPATCHER_URL}}"; | ||
| DISPATCH_NAMESPACE_NAME: "{{DISPATCH_NAMESPACE_NAME}}"; | ||
| NEXT_PUBLIC_APP_URL: string; | ||
| NEXT_PUBLIC_DEPLOY_URL: string; | ||
| BETTER_AUTH_SECRET: string; |
There was a problem hiding this comment.
修正：ENV 占位符被错误地生成为字面量类型，导致下游类型过度收窄
这些变量被声明为字面量 "{{...}}"，会使 env.ENVIRONMENT 等只能是这一固定字符串，破坏正常的字符串赋值与比较。应统一为 string。
建议补丁：
- ENVIRONMENT: "{{ENVIRONMENT}}";
- ADMIN_USER_IDS: "{{ADMIN_USER_IDS}}";
- NEXT_PUBLIC_DISPATCHER_URL: "{{NEXT_PUBLIC_DISPATCHER_URL}}";
- DISPATCH_NAMESPACE_NAME: "{{DISPATCH_NAMESPACE_NAME}}";
+ ENVIRONMENT: string;
+ ADMIN_USER_IDS: string;
+ NEXT_PUBLIC_DISPATCHER_URL: string;
+ DISPATCH_NAMESPACE_NAME: string;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ENVIRONMENT: "{{ENVIRONMENT}}"; | |
| ADMIN_USER_IDS: "{{ADMIN_USER_IDS}}"; | |
| NEXT_PUBLIC_DISPATCHER_URL: "{{NEXT_PUBLIC_DISPATCHER_URL}}"; | |
| DISPATCH_NAMESPACE_NAME: "{{DISPATCH_NAMESPACE_NAME}}"; | |
| NEXT_PUBLIC_APP_URL: string; | |
| NEXT_PUBLIC_DEPLOY_URL: string; | |
| BETTER_AUTH_SECRET: string; | |
| ENVIRONMENT: string; | |
| ADMIN_USER_IDS: string; | |
| NEXT_PUBLIC_DISPATCHER_URL: string; | |
| DISPATCH_NAMESPACE_NAME: string; | |
| NEXT_PUBLIC_APP_URL: string; | |
| NEXT_PUBLIC_DEPLOY_URL: string; | |
| BETTER_AUTH_SECRET: string; |
🤖 Prompt for AI Agents
In apps/deploy-workflow/worker-configuration.d.ts around lines 7 to 13, several
ENV variables are typed as literal strings like "{{ENVIRONMENT}}" which
incorrectly narrows their types; change each of these literal types
(ENVIRONMENT, ADMIN_USER_IDS, NEXT_PUBLIC_DISPATCHER_URL,
DISPATCH_NAMESPACE_NAME) to string (i.e., use string for each ENV declaration)
so downstream code can accept any string value and comparisons/assignments work
correctly.
| /** | ||
| * A message received by a target object. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent) | ||
| */ | ||
| declare class MessageEvent extends Event { | ||
| constructor(type: string, initializer: MessageEventInit); | ||
| /** | ||
| * Returns the data of the message. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/data) | ||
| */ | ||
| readonly data: any; | ||
| /** | ||
| * Returns the origin of the message, for server-sent events and cross-document messaging. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/origin) | ||
| */ | ||
| readonly origin: string | null; | ||
| /** | ||
| * Returns the last event ID string, for server-sent events. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/lastEventId) | ||
| */ | ||
| readonly lastEventId: string; | ||
| /** | ||
| * Returns the WindowProxy of the source window, for cross-document messaging, and the MessagePort being attached, in the connect event fired at SharedWorkerGlobalScope objects. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/source) | ||
| */ | ||
| readonly source: MessagePort | null; | ||
| /** | ||
| * Returns the MessagePort array sent with the message, for cross-document messaging and channel messaging. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/ports) | ||
| */ | ||
| readonly ports: MessagePort[]; | ||
| } | ||
| interface MessageEventInit { | ||
| data: ArrayBuffer | string; | ||
| } | ||
| /** |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
确认：MessageEvent/MessagePort 的全局声明与 TS lib 冲突风险
该文件内定义了 MessageEvent/MessagePort，若 tsconfig 还启用了 dom/webworker libs，可能出现重复声明差异导致编译告警。请确认各包的 tsconfig lib 设置与此 d.ts 一致。
Also applies to: 2587-2618
🏁 Script executed:
#!/bin/bash
set -euo pipefail
fd -a -t f -g "tsconfig*.json" | while read f; do
echo "---- $f ----"
jq -r '.compilerOptions.lib // empty' "$f" || true
doneLength of output: 6718
确认并统一 tsconfig.json 中的 lib 设置以避免 MessageEvent/MessagePort 全局声明冲突
在 apps/deploy-workflow/worker-configuration.d.ts（1177–1218）中新增了对 MessageEvent/MessagePort 的全局声明，但 apps/deploy-workflow/tsconfig.json 未显式配置 compilerOptions.lib，默认会引入 DOM（含已有同名类型），会导致重复声明警告。请在该 tsconfig 中显式设置 lib，例如仅保留 ["ES2024"]（或添加 WebWorker 库如 "WebWorker" 但排除 DOM），以避免冲突。
🤖 Prompt for AI Agents
In apps/deploy-workflow/tsconfig.json (affects declarations around
worker-configuration.d.ts lines 1177–1218), explicitly set compilerOptions.lib
to avoid pulling in the DOM lib which conflicts with the custom
MessageEvent/MessagePort declarations; edit the tsconfig to include only the
needed libs (e.g. ["ES2024"] or ["ES2024","WebWorker"] if worker globals are
required) and remove "DOM"/omit it, then save and recompile to verify the
duplicate declaration warnings are resolved.
| type UniversalGatewayOptions = Exclude<GatewayOptions, 'id'> & { | ||
| /** | ||
| ** @deprecated | ||
| */ | ||
| id?: string; | ||
| }; |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
网关选项改动：UniversalGatewayOptions 使 id 可选且标记弃用
AiGateway.run({ gateway }) 现期望 gateway?: UniversalGatewayOptions（id 可选/deprecated）。请检查任何构造 gateway: { id: ... } 的代码路径与类型断言。
Also applies to: 5505-5509, 5394-5395
🏁 Script executed:
#!/bin/bash
# 查找对 gateway.id 的显式依赖
rg -nP 'gateway\s*:\s*\{[^}]*\bid\b' -S -g '!**/dist/**' -g '!**/build/**' || true
# autorag 新签名（可选 id）
rg -nP '\bautorag\s*\(' -n || trueLength of output: 703
统一 autoragId 签名为可选
apps/docs/cloudflare-env.d.ts第 3739 行的应改为autorag(autoragId: string): AutoRAG;
并同步添加autorag(autoragId?: string): AutoRAG;
@deprecated注释。
🤖 Prompt for AI Agents
In apps/docs/cloudflare-env.d.ts around line 3739, the autorag function
signature currently requires autoragId (autorag(autoragId: string): AutoRAG;) —
change the parameter to optional (autorag(autoragId?: string): AutoRAG;) and add
a JSDoc @deprecated annotation on that overload/signature; ensure the exported
type/signature and any related declarations are updated consistently so callers
can omit the id while the deprecation note is preserved for tooling and docs.
| readonly level: "debug" | "error" | "info" | "log" | "warn"; | ||
| readonly message: string; | ||
| readonly message: object; | ||
| } | ||
| interface Return { |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
潜在破坏性变更：TailStream.Log.message 从 string 改为 object
若日志聚合/格式化代码假设为字符串，将导致类型或运行期错误。建议统一走 JSON.stringify(message)（有字符串时原样输出）。
🏁 Script executed:
#!/bin/bash
# 搜索对 TailStream 日志事件 message 的处理
rg -nP '\btype\s*:\s*"log"|TailStream\.' -n -C3 || trueLength of output: 13531
在日志格式化中对 TailStream.Log.message 调用 JSON.stringify
apps/deploy-workflow/worker-configuration.d.ts 的 Log.message 类型已由 string 变为 object（第 7098 行），若直接拼接会触发运行时错误。统一通过 JSON.stringify(message) 处理（字符串原样输出）。
🤖 Prompt for AI Agents
在 apps/deploy-workflow/worker-configuration.d.ts 第 7097 到 7100
行附近，TailStream.Log.message 的类型已从 string 改为 object，导致直接拼接可能在运行时抛错；在日志格式化处将
message 统一处理：如果 message 是字符串则原样输出，否则使用
JSON.stringify(message)（确保对象被序列化为字符串），并用该结果进行拼接/返回。
| CLOUDFLARE_SAAS_ZONE_ID: string; | ||
| HYPERDRIVE_ID: string; | ||
| KV_NAMESPACE_ID: string; | ||
| NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS: string; |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
警惕隐私泄露：避免将客户 IP 类数据以 “NEXT_PUBLIC_*” 公开变量暴露到前端
NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS 名称表明可能包含 PII。NEXT_PUBLIC_* 变量会被打包进客户端代码，极易造成误用与泄露风险。建议改为服务端专用变量（去掉 NEXT_PUBLIC 前缀或改名），并确保不在客户端路径被读取。
请在仓库内核查是否在客户端组件/浏览器端路径直接使用了该变量：
🏁 Script executed:
#!/bin/bash
# 查找变量使用位置，并标出是否在 Next.js 客户端组件或浏览端入口中被引用
rg -nP -C3 'NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS' \
&& rg -nP -C2 '["'\'']use client["'\'']|client-only' --type=ts --type=tsxLength of output: 9286
🏁 Script executed:
#!/bin/bash
# 搜索项目中所有文件的 'use client' 指令，定位客户端组件
rg -n "'use client'" -C2
# 查找 .tsx 文件中对 useDnsRecords 的引用，判断是否在客户端组件中被使用
rg -n "useDnsRecords" -C2 --glob '*.tsx'
# 检查自定义 hook 文件本身是否包含 'use client' 指令
rg -n "'use client'" -C2 apps/web/components/ide/libra/navbar/components/deployment/hooks/use-dns-records.tsLength of output: 103044
移除 NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS 公共前缀并仅在服务端使用
在客户端 Hook 文件 apps/web/components/ide/libra/navbar/components/deployment/hooks/use-dns-records.ts （含 'use client' 指令）中第 109 行通过 process.env.NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS 暴露了客户 IP，存在 PII 泄露风险。
- 将该环境变量重命名为不含
NEXT_PUBLIC_*前缀的服务端专用变量（如CUSTOMERS_IP_ADDRESS），并在 wrangler.jsonc、worker-configuration.d.ts 中同步更新绑定名。 - 在所有客户端路径（包括上述 Hook 和引用该 Hook 的组件）中移除对该变量的引用，改为通过后端接口获取所需 IP 信息。
🤖 Prompt for AI Agents
In apps/deploy/worker-configuration.d.ts around line 71, the environment binding
NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS must be renamed to a server-only name (e.g.,
CUSTOMERS_IP_ADDRESS) and removed from client exposure; update the binding name
in worker-configuration.d.ts and wrangler.jsonc to the new server-only key,
change all TypeScript types accordingly, remove any usages of
process.env.NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS from client files (including
apps/web/components/ide/libra/navbar/components/deployment/hooks/use-dns-records.ts
and any components that import that hook), and implement a backend endpoint that
reads the new CUSTOMERS_IP_ADDRESS from the environment and returns the IP to
authenticated clients so client code fetches it via that API instead of reading
process.env directly.
| }; | ||
| declare namespace NodeJS { | ||
| interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "LOG_LEVEL" | "NODE_ENV" | "CLOUDFLARE_ACCOUNT_ID" | "CLOUDFLARE_API_TOKEN" | "CLOUDFLARE_ZONE_ID" | "CLOUDFLARE_AIGATEWAY_NAME" | "BETTER_GITHUB_CLIENT_ID" | "BETTER_GITHUB_CLIENT_SECRET" | "TURNSTILE_SECRET_KEY" | "STRIPE_SECRET_KEY" | "STRIPE_WEBHOOK_SECRET" | "DATABASE_ID" | "POSTGRES_URL" | "E2B_API_KEY" | "DAYTONA_API_KEY" | "SANDBOX_BUILDER_DEFAULT_PROVIDER" | "NEXT_PUBLIC_DISPATCHER_URL" | "DISPATCH_NAMESPACE_NAME" | "DEPLOYMENT_QUEUE_NAME" | "DEPLOYMENT_DLQ_NAME" | "MAX_DEPLOYMENT_TIMEOUT" | "MAX_CONCURRENT_DEPLOYMENTS">> {} | ||
| interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ENVIRONMENT" | "NODE_ENV" | "NEXT_PUBLIC_DISPATCHER_URL" | "DISPATCH_NAMESPACE_NAME" | "DEPLOYMENT_QUEUE_NAME" | "DEPLOYMENT_DLQ_NAME" | "MAX_DEPLOYMENT_TIMEOUT" | "MAX_CONCURRENT_DEPLOYMENTS" | "NEXT_PUBLIC_APP_URL" | "NEXT_PUBLIC_DEPLOY_URL" | "BETTER_AUTH_SECRET" | "POSTGRES_URL" | "BETTER_GITHUB_CLIENT_ID" | "BETTER_GITHUB_CLIENT_SECRET" | "RESEND_API_KEY" | "RESEND_FROM" | "STRIPE_WEBHOOK_SECRET" | "STRIPE_SECRET_KEY" | "CLOUDFLARE_ACCOUNT_ID" | "DATABASE_ID" | "CLOUDFLARE_API_TOKEN" | "CLOUDFLARE_AIGATEWAY_NAME" | "ANTHROPIC_API_KEY" | "OPENAI_API_KEY" | "GEMINI_API_KEY" | "XAI_API_KEY" | "DEEPSEEK_API_KEY" | "OPENROUTER_API_KEY" | "CUSTOM_API_KEY" | "AZURE_DEPLOYMENT_NAME" | "AZURE_RESOURCE_NAME" | "AZURE_API_KEY" | "AZURE_BASE_URL" | "DATABRICKS_BASE_URL" | "DATABRICKS_TOKEN" | "REASONING_ENABLED" | "E2B_API_KEY" | "DAYTONA_API_KEY" | "DAYTONA_API_URL" | "SANDBOX_DEFAULT_PROVIDER" | "SANDBOX_BUILDER_DEFAULT_PROVIDER" | "LIBRA_GITHUB_TOKEN" | "CLOUDFLARE_ZONE_ID" | "TURNSTILE_SECRET_KEY" | "NEXT_PUBLIC_TURNSTILE_SITE_KEY" | "LOG_LEVEL" | "ENHANCED_PROMPT" | "NEXT_PUBLIC_SCAN" | "LIBRA_GITHUB_OWNER" | "LIBRA_GITHUB_REPO" | "NEXT_PUBLIC_CDN_URL" | "NEXT_PUBLIC_POSTHOG_KEY" | "NEXT_PUBLIC_POSTHOG_HOST" | "NEXT_PUBLIC_GA_ID" | "GITHUB_APP_SLUG" | "GITHUB_APP_ID" | "GITHUB_APP_PRIVATE_KEY" | "GITHUB_APP_CLIENT_ID" | "GITHUB_APP_CLIENT_SECRET" | "NEXT_PUBLIC_GITHUB_APP_URL" | "GITHUB_WEBHOOK_SECRET" | "NEXT_PUBLIC_CLOUDFLARE_DCV_VERIFICATION_ID" | "CLOUDFLARE_SAAS_ZONE_ID" | "HYPERDRIVE_ID" | "KV_NAMESPACE_ID" | "NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS">> {} |
There was a problem hiding this comment.
🛠️ Refactor suggestion
将 ProcessEnv 的映射改为可选，避免“必有配置”的错误假设
当前把 Pick 的所有键并入为“必填”，会让 process.env.X 在类型层面被视为永远存在，掩盖缺失配置的运行时风险，也不符合 Node 的常规（所有 env 都应视为可选）。建议改为 Partial，维持真实世界的可选语义。
-declare namespace NodeJS {
- interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "...">> {}
-}
+declare namespace NodeJS {
+ interface ProcessEnv extends Partial<StringifyValues<Pick<Cloudflare.Env, "...">>> {}
+}🤖 Prompt for AI Agents
In apps/deploy/worker-configuration.d.ts around line 83, the ProcessEnv mapping
currently makes every picked env key required which hides missing-config runtime
errors; change the mapping to make those keys optional by wrapping the Pick in
Partial (e.g. StringifyValues<Partial<Pick<Cloudflare.Env, ...>>>), so
process.env.X is typed as possibly undefined and reflects real-world optional
environment variables.
| /** | ||
| * A message received by a target object. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent) | ||
| */ | ||
| declare class MessageEvent extends Event { | ||
| constructor(type: string, initializer: MessageEventInit); | ||
| /** | ||
| * Returns the data of the message. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/data) | ||
| */ | ||
| readonly data: any; | ||
| /** | ||
| * Returns the origin of the message, for server-sent events and cross-document messaging. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/origin) | ||
| */ | ||
| readonly origin: string | null; | ||
| /** | ||
| * Returns the last event ID string, for server-sent events. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/lastEventId) | ||
| */ | ||
| readonly lastEventId: string; | ||
| /** | ||
| * Returns the WindowProxy of the source window, for cross-document messaging, and the MessagePort being attached, in the connect event fired at SharedWorkerGlobalScope objects. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/source) | ||
| */ | ||
| readonly source: MessagePort | null; | ||
| /** | ||
| * Returns the MessagePort array sent with the message, for cross-document messaging and channel messaging. | ||
| * | ||
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/ports) | ||
| */ | ||
| readonly ports: MessagePort[]; | ||
| } | ||
| interface MessageEventInit { | ||
| data: ArrayBuffer | string; | ||
| } | ||
| /** |
There was a problem hiding this comment.
🛠️ Refactor suggestion
MessageEventInit 类型过窄，可能引起不兼容
目前仅允许 { data: ArrayBuffer | string }，与标准/浏览器 DOM 的 MessageEventInit 存在差异（应包含 origin/lastEventId/source/ports，且 data 应为可选的 any）。建议放宽以避免三方库或未来 API 变更带来的类型不兼容。
-interface MessageEventInit {
- data: ArrayBuffer | string;
-}
+interface MessageEventInit {
+ data?: any;
+ origin?: string;
+ lastEventId?: string;
+ source?: MessagePort | null;
+ ports?: MessagePort[];
+}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| /** | |
| * A message received by a target object. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent) | |
| */ | |
| declare class MessageEvent extends Event { | |
| constructor(type: string, initializer: MessageEventInit); | |
| /** | |
| * Returns the data of the message. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/data) | |
| */ | |
| readonly data: any; | |
| /** | |
| * Returns the origin of the message, for server-sent events and cross-document messaging. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/origin) | |
| */ | |
| readonly origin: string | null; | |
| /** | |
| * Returns the last event ID string, for server-sent events. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/lastEventId) | |
| */ | |
| readonly lastEventId: string; | |
| /** | |
| * Returns the WindowProxy of the source window, for cross-document messaging, and the MessagePort being attached, in the connect event fired at SharedWorkerGlobalScope objects. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/source) | |
| */ | |
| readonly source: MessagePort | null; | |
| /** | |
| * Returns the MessagePort array sent with the message, for cross-document messaging and channel messaging. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/ports) | |
| */ | |
| readonly ports: MessagePort[]; | |
| } | |
| interface MessageEventInit { | |
| data: ArrayBuffer | string; | |
| } | |
| /** | |
| // apps/deploy/worker-configuration.d.ts | |
| /** | |
| * A message received by a target object. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent) | |
| */ | |
| declare class MessageEvent extends Event { | |
| constructor(type: string, initializer: MessageEventInit); | |
| /** | |
| * Returns the data of the message. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/data) | |
| */ | |
| readonly data: any; | |
| /** | |
| * Returns the origin of the message, for server-sent events and cross-document messaging. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/origin) | |
| */ | |
| readonly origin: string | null; | |
| /** | |
| * Returns the last event ID string, for server-sent events. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/lastEventId) | |
| */ | |
| readonly lastEventId: string; | |
| /** | |
| * Returns the WindowProxy of the source window, for cross-document messaging, and the MessagePort being attached, in the connect event fired at SharedWorkerGlobalScope objects. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/source) | |
| */ | |
| readonly source: MessagePort | null; | |
| /** | |
| * Returns the MessagePort array sent with the message, for cross-document messaging and channel messaging. | |
| * | |
| * [MDN Reference](https://developer.mozilla.org/docs/Web/API/MessageEvent/ports) | |
| */ | |
| readonly ports: MessagePort[]; | |
| } | |
| interface MessageEventInit { | |
| data?: any; | |
| origin?: string; | |
| lastEventId?: string; | |
| source?: MessagePort | null; | |
| ports?: MessagePort[]; | |
| } | |
| /** | |
| * …rest of file… | |
| */ |
🤖 Prompt for AI Agents
In apps/deploy/worker-configuration.d.ts around lines 1180 to 1221, the
MessageEventInit type is too narrow (currently data: ArrayBuffer | string) and
omits standard fields; update the interface to match DOM expectations by making
data optional and type any (data?: any) and add optional properties origin?:
string, lastEventId?: string, source?: MessageEventSource | null (or appropriate
union for WindowProxy/MessagePort), and ports?: MessagePort[]; adjust any
dependent types/imports to align with these broader, optional fields so
third‑party code and browser APIs are compatible.
| readonly type: "log"; | ||
| readonly level: "debug" | "error" | "info" | "log" | "warn"; | ||
| readonly message: string; | ||
| readonly message: object; | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
TailStream.Log.message 从 any 收窄为 object 可能破坏兼容
很多日志管道/消费方仍会写入字符串或基本类型，直接收窄为 object 会在调用侧触发 TS 报错。建议改为 unknown（调用侧自行收窄）或联合 string | object 以平滑过渡。
- readonly message: object;
+ readonly message: unknown;或
- readonly message: object;
+ readonly message: string | object;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| readonly type: "log"; | |
| readonly level: "debug" | "error" | "info" | "log" | "warn"; | |
| readonly message: string; | |
| readonly message: object; | |
| } | |
| readonly type: "log"; | |
| readonly level: "debug" | "error" | "info" | "log" | "warn"; | |
| readonly message: unknown; | |
| } |
🤖 Prompt for AI Agents
In apps/deploy/worker-configuration.d.ts around lines 7099 to 7102, the
TailStream.Log.message type was narrowed to object which breaks callers that log
strings/primitives; change the type to either unknown or a union (e.g. string |
object) so consumers can perform their own narrowing, update any related
exported types/interfaces in this file to use the new type, and run TS
build/tests to ensure no remaining type errors.
nextify2025
temporarily deployed
to
production
GitHub Actions
Inactive
nextify2025
temporarily deployed
to
production
GitHub Actions
Inactive
nextify2025
temporarily deployed
to
production
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (9)
.github/workflows/dispatcher.yml (3)
108-117: 阻止在 Pull Request 事件上进行真实部署当前 deploy 作业会在 pull_request 触发时同样执行（工作流触发器包含 pull_request，作业未加条件），存在误发生产/预发的高风险。建议为 deploy 作业增加条件，禁止 PR 场景执行部署。
应用如下补丁在作业层面加条件：
deploy: name: Build & Deploy to Cloudflare Workers + if: github.event_name != 'pull_request' runs-on: blacksmith-2vcpu-ubuntu-2204
210-213: 多行私钥通过环境变量传递易损坏且风险高，改为写入临时文件PEM 格式的 GITHUB_APP_PRIVATE_KEY 直接 export 可能因换行/编码被破坏，也放大泄露面。建议改为写入文件并传递路径。
参考补丁（并移除原 export GITHUB_APP_PRIVATE_KEY 行）：
- export GITHUB_APP_PRIVATE_KEY="${{ secrets.GITHUB_APP_PRIVATE_KEY }}" + # Write multiline PEM safely + printf '%s' "${{ secrets.GITHUB_APP_PRIVATE_KEY }}" > "$RUNNER_TEMP/github-app-private-key.pem" + chmod 600 "$RUNNER_TEMP/github-app-private-key.pem" + export GITHUB_APP_PRIVATE_KEY_PATH="$RUNNER_TEMP/github-app-private-key.pem"如应用代码必须从 env 读取，可同时提供 base64 版本的密钥（新建 secret: GITHUB_APP_PRIVATE_KEY_B64）并在步骤中解码。
1-331: 修复并强化部署流程：完善检测脚本并禁用 PR 触发部署
修正一键校验脚本，确保能遍历
.github/workflows下所有.yml/.yaml文件并准确输出在pull_request事件下执行deploy作业的工作流：#!/usr/bin/env bash set -Eeuo pipefail echo "检测存在在 pull_request 事件上运行 deploy 作业的工作流：" for wf in .github/workflows/*.{yml,yaml}; do [[ -f "$wf" ]] || continue if grep -Pq '^on:\s*\n(?:\s+.*\n)*\s+pull_request:' "$wf"; then if grep -Pq '^\s*jobs:' "$wf" && grep -Pq '^\s* deploy:' "$wf"; then # 检查 deploy 作业是否缺少 if: github.event_name != 'pull_request' if ! grep -Pq '^\s* deploy:\s*\n(?:[ \t].*\n)*\s* if:\s*github\.event_name\s*!=\s*'"'"'pull_request'"'"'' "$wf"; then echo " - $wf" fi fi fi done在
.github/workflows/dispatcher.yml的deploy作业中添加条件过滤，避免在 PR 事件下执行真实部署：jobs: deploy:
if: ${{ github.event_name != 'pull_request' }} name: Build & Deploy to Cloudflare Workers.github/workflows/screenshot.yml (2)
111-120: 阻止 PR 事件触发部署同样建议在 deploy 作业加条件，避免 PR 场景部署。
deploy: name: Build & Deploy to Cloudflare Workers + if: github.event_name != 'pull_request' runs-on: blacksmith-2vcpu-ubuntu-2204
210-214: 安全写入 GitHub App 私钥，避免多行 env 破坏与其它工作流一致，建议改为写入临时文件并传递路径。
- export GITHUB_APP_PRIVATE_KEY="${{ secrets.GITHUB_APP_PRIVATE_KEY }}" + printf '%s' "${{ secrets.GITHUB_APP_PRIVATE_KEY }}" > "$RUNNER_TEMP/github-app-private-key.pem" + chmod 600 "$RUNNER_TEMP/github-app-private-key.pem" + export GITHUB_APP_PRIVATE_KEY_PATH="$RUNNER_TEMP/github-app-private-key.pem".github/workflows/deploy.yml (2)
119-132: 为 deploy 作业添加 PR 保护条件避免在 pull_request 上执行真实部署。
deploy: name: Build & Deploy to Cloudflare Workers + if: github.event_name != 'pull_request' runs-on: blacksmith-2vcpu-ubuntu-2204
223-225: GitHub App 私钥处理方式需加固同前两个工作流，避免直接 export 多行私钥。
- export GITHUB_APP_PRIVATE_KEY="${{ secrets.GITHUB_APP_PRIVATE_KEY }}" + printf '%s' "${{ secrets.GITHUB_APP_PRIVATE_KEY }}" > "$RUNNER_TEMP/github-app-private-key.pem" + chmod 600 "$RUNNER_TEMP/github-app-private-key.pem" + export GITHUB_APP_PRIVATE_KEY_PATH="$RUNNER_TEMP/github-app-private-key.pem".github/workflows/cdn.yml (2)
111-124: 部署作业禁止在 PR 事件执行同样建议增加条件。
deploy: name: Build & Deploy to Cloudflare Workers + if: github.event_name != 'pull_request' runs-on: blacksmith-2vcpu-ubuntu-2204
213-217: 私钥安全写入文件，避免直接 export保持与其它工作流一致的安全做法。
- export GITHUB_APP_PRIVATE_KEY="${{ secrets.GITHUB_APP_PRIVATE_KEY }}" + printf '%s' "${{ secrets.GITHUB_APP_PRIVATE_KEY }}" > "$RUNNER_TEMP/github-app-private-key.pem" + chmod 600 "$RUNNER_TEMP/github-app-private-key.pem" + export GITHUB_APP_PRIVATE_KEY_PATH="$RUNNER_TEMP/github-app-private-key.pem"
🧹 Nitpick comments (17)
.github/workflows/dispatcher.yml (5)
171-227: 给类型生成步骤最小化注入环境变量“Generate Cloudflare Workers types” 仅需要极少量上下文。当前注入了大量生产密钥，扩大了风险面。建议仅传递必要变量（例如 account/token/必要的 NEXT_PUBLIC_*），其余放在部署步骤或以 mock 值运行。
234-311: 为多行脚本启用严格模式并统一失败行为在包含多条命令的 run: | 脚本顶部加入严格模式，避免中间步骤失败被忽略。
应用补丁：
run: | + set -Eeuo pipefail cd apps/dispatcher # Set environment variables securely (hidden from logs) echo "Setting up environment variables..."
313-321: 健康检查增加 -S 输出错误细节curl 目前使用 -f -s，失败时没有错误输出。建议追加 -S 便于排障（仍保持静默成功）。
- curl -f -s "$HEALTH_URL" > /dev/null + curl -f -sS "$HEALTH_URL" > /dev/null
62-67: 可选：CI 安装添加无交互/安静模式bun install 已固定 lockfile。可考虑添加 --silent 降噪以减少日志体积。
- - name: Install dependencies - run: bun install --frozen-lockfile + - name: Install dependencies + run: bun install --frozen-lockfile --silentAlso applies to: 86-88, 158-160
113-117: 最小权限原则：如未使用 OIDC，可移除 id-token: write当前使用的是 API Token 调 Cloudflare，未见 OIDC 使用处。可去掉 id-token: write 以缩小权限面。
permissions: contents: read - deployments: write - id-token: write + deployments: write.github/workflows/screenshot.yml (4)
175-222: 类型生成阶段缩减环境变量范围为“Generate Cloudflare Workers types”仅注入必要变量，减少生产密钥暴露面。
239-309: 启用严格模式并减少日志噪音为部署脚本加 set -Eeuo pipefail；另外建议将硬编码的 CDN 域名提取为由环境决定的变量，以支持 staging。
run: | + set -Eeuo pipefail cd apps/screenshot @@ - export NEXT_PUBLIC_CDN_URL="https://cdn.libra.dev" + export NEXT_PUBLIC_CDN_URL="${{ secrets.NEXT_PUBLIC_CDN_URL || 'https://cdn.libra.dev' }}"
311-319: 健康检查增加 -S与其它工作流一致，追加 -S 便于排障。
- curl -f -s "$HEALTH_URL" > /dev/null + curl -f -sS "$HEALTH_URL" > /dev/null
116-120: 最小权限原则：未使用 OIDC 可去掉 id-token: write减少不必要权限。
permissions: contents: read - deployments: write - id-token: write + deployments: write.github/workflows/deploy.yml (4)
183-235: 类型生成步骤仅传必须变量建议减少注入的生产密钥，最小化暴露。
248-323: 脚本严格模式 + 可配置化公共域名同样建议开启 set -Eeuo pipefail，并将 NEXT_PUBLIC_CDN_URL 从硬编码改为由 secrets/inputs 控制。
run: | + set -Eeuo pipefail cd apps/deploy @@ - export NEXT_PUBLIC_CDN_URL="https://cdn.libra.dev" + export NEXT_PUBLIC_CDN_URL="${{ secrets.NEXT_PUBLIC_CDN_URL || 'https://cdn.libra.dev' }}"
325-333: 健康检查追加 -S 输出提升失败时的可观测性。
- curl -f -s "$HEALTH_URL" > /dev/null + curl -f -sS "$HEALTH_URL" > /dev/null
124-128: 权限收敛：移除 id-token: write（如未使用 OIDC）减少权限暴露面。
permissions: contents: read deployments: write - id-token: write.github/workflows/cdn.yml (4)
175-225: 类型生成步骤缩小环境变量范围仅保留必需项，减少生产密钥在日志/进程环境中的驻留。
237-306: 脚本严格模式 + 统一失败处理建议在多行脚本顶部加入 set -Eeuo pipefail。
run: | + set -Eeuo pipefail cd apps/cdn
309-316: 健康检查追加 -S与其它工作流一致。
- curl -f -s "$HEALTH_URL" > /dev/null + curl -f -sS "$HEALTH_URL" > /dev/null
117-120: 权限精简：如未使用 OIDC，移除 id-token: write遵循最小权限原则。
permissions: contents: read - deployments: write - id-token: write + deployments: write
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
.github/workflows/cdn.yml(2 hunks).github/workflows/deploy.yml(2 hunks).github/workflows/dispatcher.yml(2 hunks).github/workflows/screenshot.yml(2 hunks)package.json(3 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
🔇 Additional comments (4)
.github/workflows/dispatcher.yml (1)
76-76: Bun 升级与缓存策略变更看起来稳健
- 升级到 bun 1.2.21、一致化缓存 key/restore-keys、仅缓存 ~/.bun/install/cache 均合理，有助于稳定与可重复性。
Also applies to: 78-85, 136-136, 138-145
.github/workflows/screenshot.yml (1)
79-79: Bun 与缓存调整一致且合理与其他工作流保持一致化，利于可维护性与跑批稳定。
Also applies to: 81-88, 139-139, 141-148
.github/workflows/deploy.yml (1)
87-87: Bun 版本与缓存参数更新 OK一致化到 1.2.21 与 bun-cache key 命名良好。
Also applies to: 89-96, 147-147, 149-156
.github/workflows/cdn.yml (1)
79-79: Bun 与缓存配置一致化良好与其它工作流同步，便于维护与缓存命中。
Also applies to: 81-88, 139-139, 141-148
Summary by cubic
Adds a WARP (warp.dev) developer guide (WARP.md) with setup, dev, and deploy instructions. Updates dependencies and tooling across all apps/packages; also cleans up AGENTS.md.
Dependencies
Migration
Summary by CodeRabbit