feat(chat-ui): @fuzefront/chat-ui design-system chat frontend + shell integration - #90
Conversation
… integration Squashed onto current master to clear a stale GitHub CONFLICTING flag (compare showed behind_by=0; merge-commit history confused mergeability). Net content unchanged: chat-ui package consumed via file: deps + tsconfig dist paths, CI builds chat-client+chat-ui before frontend type-check/bundle, ignoreDeprecations for tsup DTS (TS 6.0.3 baseUrl), linux-regenerated lockfiles.
CI Fix — branch
|
…named exports
vite build failed: 'ChatServiceClient is not exported by chat-client/dist/index.js'.
Plain tsc emitted CJS (__exportStar(require())) which rollup can't statically
analyse. Switch chat-client to tsup dual-build (esm+cjs+dts) + exports map; the ESM
output keeps 'export { ChatServiceClient }' static. +ignoreDeprecations for the
tsup DTS step (TS 6.0.3 baseUrl). Verified ESM export in a container.
CI Failure Analysis: Playwright sign-in flowRoot cause: The What's happening
"@fuzefront/chat-ui": "file:../packages/chat-ui"
"main": "dist/index.cjs",
"module": "dist/index.js"Vite has no source alias for
- name: Build @fuzefront/chat-client + chat-ui (for frontend type-check)
run: |
npm run -w @fuzefront/chat-client build
npm run -w @fuzefront/chat-ui buildBut The PostgreSQL FixAdd the following step to # @fuzefront/chat-ui (and its dep chat-client) are resolved from their dist/
# directories (no vite source alias) — build them before the frontend bundle.
- name: Build @fuzefront/chat-client + chat-ui (frontend deps)
run: |
npm run -w @fuzefront/chat-client build
npm run -w @fuzefront/chat-ui buildI prepared this fix in branch |
CI Fix — Node.js 24 ESM resolution crashRoot cause: The "Playwright sign-in flow / Build & start backend" step fails because Fix: Branch with fix: To merge the fix into this PR: (A PR from that branch targeting |
…rt resolution Mirror the proven @fuzefront/chat-client fix (#90): billing-ui keeps @fuzefront/billing-client external, so the host vite/rollup bundle must statically resolve its named exports. Plain tsc emitted CJS __exportStar(require()) -> 'X is not exported' at host build. tsup emits static ESM re-exports + .d.ts + .cjs. Adds module/exports map + tsup devDep; tsconfig ignoreDeprecations '6.0' (TS 6.0.3 baseUrl escalation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…caffold (#92) * feat(secrets): credential-free seal-secret.sh + fuzefront-secrets SealedSecret scaffold seal-secret.sh <KEY>: hidden-prompt → fetch current public cert from FuzeInfra (stable URL; handles key rotation) → kubeseal --cert --merge-into the manifest IN PLACE (preserves other keys). Per-repo scope hard-coded (fuzefront/ fuzefront-secrets), --scope/--cert/--in/--manifest overrides. No kubeconfig: only the public cert is needed to seal; FuzeInfra holds the decrypt key. Manifest is the SHARED app secret (Authentik/Permit/DB/OAuth/messaging/LLM + billing) — documented full key inventory + loud warning never to sync it empty (would clobber live keys). Populate every key via the script before Argo-wiring. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(secrets): ASCII-only comments in sealed manifest (avoid cp1252/tool encoding issues) * refactor(secrets): per-service billing-secrets (least privilege) instead of shared blob Billing's 3 sensitive keys (STRIPE_SECRET_KEY/STRIPE_WEBHOOK_SECRET/ BILLING_INTERNAL_TOKEN) now live in their OWN SealedSecret 'billing-secrets'; billing-service Deployment references it (DB_PASSWORD/PERMIT_API_KEY stay shared in fuzefront-secrets). A compromised billing pod can't read Authentik/SMTP/OAuth/LLM secrets, and sealing/rotating billing keys can't clobber other services. Dropped the shared-secret scaffold (operator-owned). seal-secret.sh defaults to scope fuzefront/billing-secrets and is marked an interim copy (canonical tool + cert URL + methodology owned by FuzeInfra, delegated separately). * feat(billing): enable + complete billing deploy (ingress carve-out, billing_svc role, DB, secrets) - values: complete billingService (dbUser=billing_svc, secretName=billing-secrets, meterFlushIntervalSec, permitPdpUrl, dbBootstrap) — template referenced these but they were undefined (billing never actually deployed). - billing-db-bootstrap Job (pre-install, idempotent): creates least-privilege billing_svc role + 'billing' schema + grants via psql as the superuser. billing- service self-migrates its schema on boot as billing_svc. - ingress carve-out: ONLY /api/v1/billing/webhooks/stripe is public (Exact match, Stripe-signature verified); rest of /api/v1/billing stays internal. - billing-secrets gains BILLING_DB_PASSWORD (billing_svc's password); STRIPE/BILLING env always render (dropped the Helm-values guards — SealedSecret provides them). - values-prod: billingService.enabled=true (fixed a duplicate-key bug that clobbered it — billingService was declared twice; merged node-2 affinity into one block). - Verified: helm lint clean + helm template renders all billing artifacts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * build(billing-client): tsup dual-build (ESM+CJS) for host static export resolution Mirror the proven @fuzefront/chat-client fix (#90): billing-ui keeps @fuzefront/billing-client external, so the host vite/rollup bundle must statically resolve its named exports. Plain tsc emitted CJS __exportStar(require()) -> 'X is not exported' at host build. tsup emits static ESM re-exports + .d.ts + .cjs. Adds module/exports map + tsup devDep; tsconfig ignoreDeprecations '6.0' (TS 6.0.3 baseUrl escalation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(deploy): lock path-based service URL convention (/api/v1/<svc>, internal-by-default) Decision: path-based routing under the single app host, not per-service subdomains (one cert, no DNS churn, same-origin/no-CORS, shared cookies). Services internal-only by default; ingress carves out only public paths (billing's Stripe webhook); browser-facing APIs go through host-backend proxy with the service's internal token. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Re-opened from #79 (which hit a stuck GitHub CONFLICTING mergeability cache despite
behind_by:0). Same commit, fresh branch for a clean mergeability/CI computation. Chat-ui consumed via file: deps + tsconfig dist; CI builds chat-client+chat-ui before frontend type-check/bundle; ignoreDeprecations for tsup DTS (TS 6.0.3 baseUrl); linux lockfiles.🤖 Generated with Claude Code