keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
KeiSeiKit-1.0/_blocks/deploy-cloudflare.md
denis 0b901cf2f9 feat: KeiSeiKit v0.1.0 — initial public release 
Generic Constructor-Pattern agent kit for Claude Code. Zero personal data,
fully English, MIT-licensed.

Contents:
- 34 reusable blocks (baseline, rules, stack/deploy/domain/api/scraper)
- 14 cross-project agent manifests (code/ml/infra/researcher/critic/...)
- 6 portable skills (/new-agent, /research, /test-gen, /debug-deep, /pr-review, /refactor)
- Rust assembler (single binary, ~500 KB)
- 3 hooks (auto-reassemble, pre-commit validate, no-hand-edit)
- install.sh (idempotent, cargo-builds on first run)
- MIT LICENSE

All 6 sanity greps pass: 0 Russian text, 0 specific project names,
0 incident numbers, 0 user paths, 0 hardcoded IPs, 0 API keys.

cargo check + assemble --validate: both pass on 14 manifests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 23:58:34 +08:00

1.6 KiB
Raw Blame History

DEPLOY — Cloudflare (Workers / Pages / R2 / KV)

Tooling: wrangler CLI (≥ 3.x). wrangler.toml is source of truth for bindings, NOT dashboard clicks.

Surface map:

  • Workers — edge compute. wrangler deploy. Logs via wrangler tail.
  • Pages — static sites + Pages Functions. Per-branch preview URLs automatic.
  • R2 — S3-compatible object storage. No egress fees.
  • KV — eventually-consistent key-value config store. Reads cached at the edge.
  • D1 — SQLite at edge (beta/GA track).

Secrets (NEVER in wrangler.toml):

wrangler secret put API_KEY      # interactive, encrypted at rest
wrangler secret put --env prod DB_URL

wrangler.toml is committed to git; secrets live in the platform vault only.

Self-sufficiency — CF API token scopes (request ALL up front): Workers KV · Workers R2 · Workers Scripts · Pages · Zone Edit · DNS · Zone Read · Zone Settings · SSL. Missing scope → ask user to add to token, NEVER ask user to click in the dashboard.

HARD RULE — CF ToS forbids proxy-mode traffic forwarding:

  • Worker for signaling, fronting helpers, metadata lookups — OK
  • Worker as a full proxy pipe (upstream ⇆ Worker ⇆ downstream as a tunnel) — FORBIDDEN. Signaling / rendezvous Workers must do metadata only, NEVER arbitrary traffic. Violation → account ban.

Cache strategy: Cache-Control headers authoritative; purge via wrangler pages deployment or API. NEXT_PUBLIC_* / PUBLIC_* vars ship to client — treat as non-secret.

Forbidden: secrets in wrangler.toml, full-proxy Workers (ToS), manual dashboard edits when API token has the scope, committing .dev.vars.