arcrun — AI workflow execution engine (clean history)

Self-hosted 開源：WASM 零件 + recipe + cypher-executor，跑在你自己的 Cloudflare。此為重建的乾淨歷史起點（移除曾誤 commit 的 GCP SA 金鑰，舊歷史保留在 richblack/arcrun 與本地 backup 分支）。含： - acr init --self-hosted installer（建 KV/R2 + codeload 拉預編譯 wasm + wrangler deploy + seed recipe） - recipe push 把關（資料外流提醒 + 打通檢查） - 19 個正當零件預編譯 wasm（claude_api/km_writer/kbdb_upsert_block 排除：違反 DECISIONS §1） - CLI / cypher-executor / registry / 完整 SDD Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 15:52:38 +08:00
commit 922a57fe34
485 changed files with 89356 additions and 0 deletions
@@ -0,0 +1,653 @@
+/**
+ * Auth Recipe Seeds
+ *
+ * 平台預建的 auth recipe 定義，部署時寫入 RECIPES KV。
+ * 新增服務 = 在此加一筆，不需改其他程式碼。
+ *
+ * KV key: auth_recipe:{service}
+ */
+
+import type { AuthRecipeDefinition } from '../routes/recipes';
+
+const now = Date.now();
+
+export const AUTH_RECIPE_SEEDS: AuthRecipeDefinition[] = [
+  // ── Static Key 類 ──────────────────────────────────────────────────────────
+
+  {
+    kind: 'auth_recipe',
+    service: 'notion',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.notion.com/v1',
+    display_name: 'Notion',
+    description: 'Notion API — 頁面、資料庫讀寫',
+    required_secrets: [
+      {
+        key: 'notion_token',
+        label: 'Internal Integration Token',
+        help: '至 https://www.notion.so/my-integrations 建立 Integration',
+        help_url: 'https://www.notion.so/my-integrations',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.notion_token}}',
+        'Notion-Version': '2022-06-28',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'slack',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://slack.com/api',
+    display_name: 'Slack',
+    description: 'Slack Bot API — 發訊息、查頻道',
+    required_secrets: [
+      {
+        key: 'slack_bot_token',
+        label: 'Bot User OAuth Token (xoxb-...)',
+        help: '至 https://api.slack.com/apps 建立 App，取得 Bot Token',
+        help_url: 'https://api.slack.com/apps',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.slack_bot_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'github',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.github.com',
+    display_name: 'GitHub',
+    description: 'GitHub REST API — repo、issue、PR 操作',
+    required_secrets: [
+      {
+        key: 'github_token',
+        label: 'Personal Access Token (classic 或 fine-grained)',
+        help: '至 https://github.com/settings/tokens 建立',
+        help_url: 'https://github.com/settings/tokens',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.github_token}}',
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'openai',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.openai.com/v1',
+    display_name: 'OpenAI',
+    description: 'OpenAI API — Chat Completions、Embeddings 等',
+    required_secrets: [
+      {
+        key: 'openai_api_key',
+        label: 'API Key (sk-...)',
+        help: '至 https://platform.openai.com/api-keys 建立',
+        help_url: 'https://platform.openai.com/api-keys',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.openai_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'anthropic',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.anthropic.com/v1',
+    display_name: 'Anthropic (Claude)',
+    description: 'Anthropic API — Claude 模型呼叫',
+    required_secrets: [
+      {
+        key: 'anthropic_api_key',
+        label: 'API Key',
+        help: '至 https://console.anthropic.com/settings/keys 建立',
+        help_url: 'https://console.anthropic.com/settings/keys',
+      },
+    ],
+    inject: {
+      header: {
+        'x-api-key': '{{secret.anthropic_api_key}}',
+        'anthropic-version': '2023-06-01',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'airtable',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.airtable.com/v0',
+    display_name: 'Airtable',
+    description: 'Airtable API — 讀寫 Base 資料',
+    required_secrets: [
+      {
+        key: 'airtable_token',
+        label: 'Personal Access Token',
+        help: '至 https://airtable.com/create/tokens 建立',
+        help_url: 'https://airtable.com/create/tokens',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.airtable_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'discord',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://discord.com/api/v10',
+    display_name: 'Discord',
+    description: 'Discord Bot API — 發訊息、管理伺服器',
+    required_secrets: [
+      {
+        key: 'discord_bot_token',
+        label: 'Bot Token',
+        help: '至 https://discord.com/developers/applications 建立 Bot，取得 Token',
+        help_url: 'https://discord.com/developers/applications',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bot {{secret.discord_bot_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'stripe',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.stripe.com/v1',
+    display_name: 'Stripe',
+    description: 'Stripe API — 支付、客戶、訂閱管理',
+    required_secrets: [
+      {
+        key: 'stripe_secret_key',
+        label: 'Secret Key (sk_live_... 或 sk_test_...)',
+        help: '至 https://dashboard.stripe.com/apikeys 取得',
+        help_url: 'https://dashboard.stripe.com/apikeys',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.stripe_secret_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'twilio',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.twilio.com/2010-04-01',
+    display_name: 'Twilio',
+    description: 'Twilio API — SMS、電話、WhatsApp',
+    required_secrets: [
+      {
+        key: 'twilio_account_sid',
+        label: 'Account SID',
+        help: '至 https://console.twilio.com/ 取得',
+        help_url: 'https://console.twilio.com/',
+      },
+      {
+        key: 'twilio_auth_token',
+        label: 'Auth Token',
+        help: '至 https://console.twilio.com/ 取得',
+        help_url: 'https://console.twilio.com/',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Basic {{secret.twilio_account_sid}}:{{secret.twilio_auth_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'sendgrid',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.sendgrid.com/v3',
+    display_name: 'SendGrid',
+    description: 'SendGrid Email API — 發送交易郵件',
+    required_secrets: [
+      {
+        key: 'sendgrid_api_key',
+        label: 'API Key (SG....)',
+        help: '至 https://app.sendgrid.com/settings/api_keys 建立',
+        help_url: 'https://app.sendgrid.com/settings/api_keys',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.sendgrid_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'hubspot',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.hubapi.com',
+    display_name: 'HubSpot',
+    description: 'HubSpot CRM API — 聯絡人、公司、交易管理',
+    required_secrets: [
+      {
+        key: 'hubspot_token',
+        label: 'Private App Access Token',
+        help: '至 HubSpot Settings → Integrations → Private Apps 建立',
+        help_url: 'https://developers.hubspot.com/docs/api/private-apps',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.hubspot_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'linear',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.linear.app',
+    display_name: 'Linear',
+    description: 'Linear API — Issue、Project 管理',
+    required_secrets: [
+      {
+        key: 'linear_api_key',
+        label: 'Personal API Key',
+        help: '至 https://linear.app/settings/api 建立',
+        help_url: 'https://linear.app/settings/api',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: '{{secret.linear_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'shopify',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://{{secret.shopify_store}}.myshopify.com/admin/api/2024-01',
+    display_name: 'Shopify',
+    description: 'Shopify Admin API — 訂單、商品、客戶管理',
+    required_secrets: [
+      {
+        key: 'shopify_access_token',
+        label: 'Admin API Access Token',
+        help: '至 Shopify Admin → Apps → App and sales channel settings → Private apps',
+        help_url: 'https://shopify.dev/docs/apps/auth/admin-app-access-tokens',
+      },
+      {
+        key: 'shopify_store',
+        label: 'Store subdomain（不含 .myshopify.com）',
+        help: '例如 my-store（對應 my-store.myshopify.com）',
+      },
+    ],
+    inject: {
+      header: {
+        'X-Shopify-Access-Token': '{{secret.shopify_access_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'resend',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.resend.com',
+    display_name: 'Resend',
+    description: 'Resend Email API — 發送交易郵件',
+    required_secrets: [
+      {
+        key: 'resend_api_key',
+        label: 'API Key (re_...)',
+        help: '至 https://resend.com/api-keys 建立',
+        help_url: 'https://resend.com/api-keys',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.resend_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'supabase',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://{{secret.supabase_project_ref}}.supabase.co/rest/v1',
+    display_name: 'Supabase',
+    description: 'Supabase REST API — 資料庫讀寫',
+    required_secrets: [
+      {
+        key: 'supabase_service_key',
+        label: 'Service Role Key (eyJ...)',
+        help: '至 Supabase Project Settings → API → service_role key',
+        help_url: 'https://supabase.com/dashboard',
+      },
+      {
+        key: 'supabase_project_ref',
+        label: 'Project Reference ID（URL 中的 xxx.supabase.co 的 xxx）',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.supabase_service_key}}',
+        apikey: '{{secret.supabase_service_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'typeform',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.typeform.com',
+    display_name: 'Typeform',
+    description: 'Typeform API — 表單、問卷回應讀取',
+    required_secrets: [
+      {
+        key: 'typeform_token',
+        label: 'Personal Access Token',
+        help: '至 https://admin.typeform.com/account#/section/tokens 建立',
+        help_url: 'https://developer.typeform.com/get-started/',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{secret.typeform_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'jira',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://{{secret.jira_domain}}.atlassian.net/rest/api/3',
+    display_name: 'Jira',
+    description: 'Jira API — Issue、Sprint、Project 管理',
+    required_secrets: [
+      {
+        key: 'jira_api_token',
+        label: 'API Token',
+        help: '至 https://id.atlassian.com/manage-profile/security/api-tokens 建立',
+        help_url: 'https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/',
+      },
+      {
+        key: 'jira_email',
+        label: '你的 Atlassian 帳號 Email',
+      },
+      {
+        key: 'jira_domain',
+        label: 'Jira 子網域（xxx.atlassian.net 的 xxx）',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Basic {{secret.jira_email}}:{{secret.jira_api_token}}',
+        Accept: 'application/json',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'gemini',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://generativelanguage.googleapis.com/v1beta',
+    display_name: 'Google Gemini',
+    description: 'Google Gemini API — generateContent / embedContent（使用 API Key）',
+    required_secrets: [
+      {
+        key: 'gemini_api_key',
+        label: 'API Key',
+        help: '至 https://aistudio.google.com/apikey 建立',
+        help_url: 'https://aistudio.google.com/apikey',
+      },
+    ],
+    inject: {
+      header: {
+        'x-goog-api-key': '{{secret.gemini_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'trello',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.trello.com/1',
+    display_name: 'Trello',
+    description: 'Trello API — boards / cards / lists（API key + token 走 query string）',
+    required_secrets: [
+      {
+        key: 'trello_api_key',
+        label: 'API Key',
+        help: '至 https://trello.com/power-ups/admin 建立 Power-Up 後取得',
+        help_url: 'https://trello.com/power-ups/admin',
+      },
+      {
+        key: 'trello_token',
+        label: 'Token',
+        help: '於 Power-Up 頁面點「Generate Token」授權後取得',
+        help_url: 'https://trello.com/power-ups/admin',
+      },
+    ],
+    inject: {
+      query: {
+        key: '{{secret.trello_api_key}}',
+        token: '{{secret.trello_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'mailgun',
+    version: 1,
+    primitive: 'static_key',
+    base_url: 'https://api.mailgun.net/v3',
+    display_name: 'Mailgun',
+    description: 'Mailgun API — 寄信（username 固定 "api"，password 為 Private API Key，走 Basic Auth）',
+    required_secrets: [
+      {
+        key: 'mailgun_api_key',
+        label: 'Private API Key',
+        help: '至 Mailgun Dashboard → API Security → Sending Keys 建立',
+        help_url: 'https://app.mailgun.com/mg/sending/domains',
+      },
+      {
+        key: 'mailgun_domain',
+        label: 'Sending Domain',
+        help: '你在 Mailgun 設定好的 sending domain（例：mg.yourdomain.com）',
+        help_url: 'https://app.mailgun.com/mg/sending/domains',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Basic api:{{secret.mailgun_api_key}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  // ── Service Account 類（Google 家族，共用同一份 service_account_json）────────
+
+  {
+    kind: 'auth_recipe',
+    service: 'google_sheets_sa',
+    version: 1,
+    primitive: 'service_account',
+    service_account_kind: 'google_jwt',
+    base_url: 'https://sheets.googleapis.com/v4',
+    display_name: 'Google Sheets (Service Account)',
+    description: 'Google Sheets API — 試算表讀寫（使用 Service Account）',
+    token_exchange: {
+      endpoint: 'https://oauth2.googleapis.com/token',
+      scopes: ['https://www.googleapis.com/auth/spreadsheets'],
+    },
+    required_secrets: [
+      {
+        key: 'google_service_account',
+        label: 'Service Account JSON（整份貼上）',
+        type: 'json_blob',
+        help: '至 GCP Console → IAM → Service Accounts → Keys → Add Key → JSON，下載後整份貼入',
+        help_url: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{runtime.access_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'google_gmail_sa',
+    version: 1,
+    primitive: 'service_account',
+    service_account_kind: 'google_jwt',
+    base_url: 'https://gmail.googleapis.com/gmail/v1',
+    display_name: 'Gmail (Service Account)',
+    description: 'Gmail API — 發送郵件（使用 Service Account + Domain-Wide Delegation）',
+    token_exchange: {
+      endpoint: 'https://oauth2.googleapis.com/token',
+      scopes: ['https://www.googleapis.com/auth/gmail.send'],
+    },
+    required_secrets: [
+      {
+        key: 'google_service_account',
+        label: 'Service Account JSON（整份貼上）',
+        type: 'json_blob',
+        help: '需要 Domain-Wide Delegation，至 GCP Console → IAM → Service Accounts 設定',
+        help_url: 'https://developers.google.com/workspace/guides/create-credentials#service-account',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{runtime.access_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+
+  {
+    kind: 'auth_recipe',
+    service: 'google_drive_sa',
+    version: 1,
+    primitive: 'service_account',
+    service_account_kind: 'google_jwt',
+    base_url: 'https://www.googleapis.com/drive/v3',
+    display_name: 'Google Drive (Service Account)',
+    description: 'Google Drive API — 檔案上傳、下載、管理（使用 Service Account）',
+    token_exchange: {
+      endpoint: 'https://oauth2.googleapis.com/token',
+      scopes: ['https://www.googleapis.com/auth/drive'],
+    },
+    required_secrets: [
+      {
+        key: 'google_service_account',
+        label: 'Service Account JSON（整份貼上）',
+        type: 'json_blob',
+        help: '至 GCP Console → IAM → Service Accounts → Keys → Add Key → JSON',
+        help_url: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+      },
+    ],
+    inject: {
+      header: {
+        Authorization: 'Bearer {{runtime.access_token}}',
+      },
+    },
+    created_at: now,
+    updated_at: now,
+  },
+];