Skip to content

Rebuild fork on upstream v0.6.1: Foundry via isolated seam, DeepSeek docs-chat, Vercel-ready apps/web - #26

Merged
anandpant merged 87 commits into
mainfrom
feat/foundry-vercel-clean
Jun 14, 2026
Merged

Rebuild fork on upstream v0.6.1: Foundry via isolated seam, DeepSeek docs-chat, Vercel-ready apps/web#26
anandpant merged 87 commits into
mainfrom
feat/foundry-vercel-clean

Conversation

@anandpant

Copy link
Copy Markdown

Clean rebuild of the fork on top of upstream vercel-labs/emulate v0.6.1, replacing the abandoned vinext/Cloudflare experiment with stock Next.js targeting Vercel. Goal: keep all fork value (Foundry emulator, FoundryCI branding, docs) while shrinking the fork's permanent delta and upstream-merge friction.

What changed (5 commits off upstream/main)

  • Foundry via an isolated seam — registered through one fork-owned file packages/emulate/src/fork-services.ts that composes upstream's SERVICE_REGISTRY, wraps createServer to inject the fork docs URL via the existing options.docsUrl, and folds api:admin-read into the default admin token only when Foundry is enabled. registry.ts and all of @emulators/core stay byte-identical to upstream, so upstream syncs never conflict on them.
  • docs-chatdeepseek/deepseek-v4-flash via Vercel AI Gateway (OIDC auth, no static key in code); Upstash per-request rate limiter removed (spend capped by the gateway budget); AI SDK bumped.
  • CIturbo run build type-check lint test --affected on PRs (fetch-depth 0, .turbo cache); full graph on main.
  • apps/web rebuilt on stock Next — FoundryCI branding via lib/site.ts, 26 Foundry MDX docs, a shared lib/docs-sections.ts sidebar source used by both navs, legacy /foundry redirects. Verified via next start: branding, docs with highlighting, sidebar, /foundry redirect, and /og PNG all work.
  • Foundry type-check/lint wired into CI; workspace version synced to 0.6.1.

Maintenance win

Fork delta vs upstream: ~85 files / 7K lines, down from the old fork's 236 files / 23K lines. rg foundry packages/emulate/src matches only the seam and its tests.

Review

Reviewed by Codex (gpt-5.5, read-only): confirmed the seam is structurally sound, the byte-identical invariant holds, and there is no vinext/Cloudflare baggage in apps/web. It also caught that the Foundry package was not type-checked in CI, which hid a real type error — both the coverage gap and the error are fixed in this PR.

CI

Locally green: build / test / type-check / lint / format / sync-versions.

Deploy (follow-up)

Vercel project to be created from the dashboard + GitHub integration (not CLI). Gateway uses OIDC; the $10/mo cap is set as a project budget in the dashboard.

ctate and others added 30 commits April 9, 2026 02:23
* Add dynamic GitHub star count to docs header

Fetch stargazers_count from the GitHub API with 24h ISR revalidation
and display it next to the GitHub icon in the site header.

* Fix prettier formatting in github.ts

* Fix prettier formatting across repo

* Fix lint: use next/link for internal navigation in resend example
…at (vercel-labs#65)

S3 routes now use root paths (GET /, PUT /:bucket, GET /:bucket/:key)
matching the real S3 wire protocol, so @aws-sdk/client-s3 works out of
the box with forcePathStyle. Legacy /s3/ prefixed paths are preserved as
backward-compatible aliases.

Also adds presigned POST uploads (POST /:bucket) with policy validation,
ListObjectsV2 pagination via continuation-token/start-after, and moves
the inspector UI to /_inspector so GET / is free for ListBuckets.
* fix(aws): harden S3 emulator for official AWS SDK

Adds a real-SDK E2E test suite (boots a loopback server, drives every
S3 op through @aws-sdk/client-s3 with forcePathStyle, supports
AWS_EMULATOR_E2E_URL to target any running emulator). The suite caught
three issues this PR also fixes:

- Bucket-level routes now accept a trailing slash so HeadBucket,
  CreateBucket, DeleteBucket, ListObjectsV2 and presigned POST work
  against the real SDK wire format (GET /bucket/, PUT /bucket/, etc.).
- Last-Modified response header is emitted as RFC 7231 HTTP-date instead
  of ISO-8601, so GetObject / HeadObject / CopyObject deserialize.
- Replaced `any` annotations in routes/s3.ts (introduced by the recent
  handler extraction) with Context<AppEnv> parameterized on the path
  pattern plus the existing entity types.

Shared createTestApp() helper extracted to __tests__/helpers.ts so the
legacy Hono-request tests and the new real-SDK E2E tests use the same
wiring.

* fix(aws): address review feedback on S3 hardening PR

- Remove `as never` cast in test helpers by typing app as Hono<AppEnv>
- Add Last-Modified HTTP header (RFC 7231) to CopyObject response
- Parallelize PutObject calls in pagination test with Promise.all()
…l-labs#76)

* Add release workflow with npm trusted publisher and provenance

Single-PR release process: bump version in packages/emulate, run
pnpm sync-versions, write changelog with release markers, merge to
main. CI compares versions to npm, publishes with --provenance
(id-token: write), and creates a GitHub release from the changelog.

* Deduplicate package list, fix concurrency syntax, add version sync check to CI
…abs#77)

`npm publish` leaves `workspace:*` literals in the published tarball,
which npm consumers cannot resolve. Switch to `pnpm publish` so the
protocol is rewritten to the resolved version. Also pass
`--no-git-checks` (publish runs from a built tree) and `--access public`
defensively (already in publishConfig but explicit on the CLI is safer).
Adds support for the Google Workspace `hd` (hosted domain) claim on
issued ID tokens and the `/oauth2/v2/userinfo` response, and advertises
it in the OIDC discovery document.

By default the claim is derived from the user's email domain, matching
real Google behavior for Workspace accounts. Consumer domains
(`gmail.com`, `googlemail.com`) are treated as non-Workspace and omit
the claim. Configs can override the derived value by setting `hd` on a
seeded user, or disable the claim by setting it to an empty string.

Co-authored-by: Claude <noreply@anthropic.com>
Follow-up to vercel-labs#73. Adds the hd field to Google seed config
examples and explains the auto-derivation behavior for
Workspace vs consumer domains.
…-labs#78)

* feat(emulate): add portless integration and base URL override

Add --portless flag that auto-registers portless aliases for each
service, giving every emulator a trusted HTTPS URL
(e.g. https://github.emulate.localhost) with no cert management.
If portless is not installed, the user is prompted to install it.

Also add a generic --base-url flag and EMULATE_BASE_URL env var
(with {service} template support) for use with any reverse proxy.
Per-service baseUrl in seed config is supported as well. The
programmatic API gains a baseUrl option with PORTLESS_URL fallback.

This fixes the core issue where emulate hardcodes
http://localhost:<port> as the advertised URL, causing OAuth
redirects, webhook URLs, and OIDC discovery to use the wrong origin
when behind a proxy.

* fix(portless): clean up registered aliases on partial failure

* fixes

* fixes

* fixes

* fixes

* fixes
) (vercel-labs#80)

The email preview iframe used sandbox="" which blocked all navigation,
making buttons and links unclickable. Add allow-popups and
allow-popups-to-escape-sandbox so links open in new tabs, and inject
<base target="_blank"> so links without an explicit target also work.
* feat(web): add landing page, move docs to /docs

* style: format landing page files
* feat: add Stripe Checkout example with enriched API coverage

Add a full Stripe Checkout example (Next.js App Router, embedded emulator)
that exercises 7 SDK methods and handles 4 webhook event types: customer
creation before checkout, wildcard webhook subscription, multi-event webhook
handler, and customer retrieval on the success page.

Also adds deterministic seed IDs for products/prices/customers in the Stripe
emulator so cart state survives dev server restarts, webhook seed support in
the adapter-next and CLI flows, and {CHECKOUT_SESSION_ID} template variable
substitution in checkout session redirects.

* fixes

* fixes

* fix: format 6 files to pass CI prettier check
Replace <a> tags with next/link <Link> for internal navigation and
remove unnecessary `as any` cast in the Stripe proxy route.
* fix(stripe-checkout): resolve lint errors breaking CI

Replace <a> tags with next/link <Link> for internal navigation and
remove unnecessary `as any` cast in the Stripe proxy route.

* prepare v0.5.0 release

Bump all packages to 0.5.0 and add changelog entry.
…-labs#85)

pnpm publish does not pass the OIDC token needed for npm trusted
publishers, causing 404 errors on every package. Switch to pnpm pack
(to resolve workspace:* protocols) followed by npm publish (which
supports OIDC auth via --provenance).
…ing (vercel-labs#86)

Trusted publishing requires npm 11.5.1+ (Node 24). The registry-url
config in setup-node injects a NODE_AUTH_TOKEN that overrides the OIDC
flow, causing 404 errors on every package.
`emulate` is a zsh built-in command, so bare `emulate` invokes the
shell built-in instead of the npm binary. Update all user-facing CLI
examples, help output, and system prompts to use `npx emulate`. Add
an AGENTS.md rule to prevent regressions.
* Remove Hono dependency

* docs: remove stale hono references

* Fix HEAD route precedence
* Add native Go CLI foundation

- Add an experimental Go CLI shell with list, init, and start validation.

- Seed the Go service registry from the current TypeScript runtime contract.

- Cover the initial CLI and registry behavior with Go tests.

* Fix native Go foundation review issues

* Fix Go subcommand help exit codes

* Reject unexpected Go CLI arguments

* Fix native list service formatting

* Fix native Go CLI review issues

* Fix native Go CLI help output
* Add Go HTTP and store foundation

- Add a dependency-free Go router with response helpers and prefix mounting.

- Add an in-memory store with indexed collections, snapshots, restore, and reset.

- Wire native start to the reusable runtime handler and health endpoint.

* Fix Go router matching parity

* Fix Go router and store edge cases
- Add shared Go UI renderers with embedded placeholder assets and asset routes.

- Add config discovery and JSON loading with explicit YAML handling.

- Reuse shared config discovery in the native CLI and serve UI assets from the runtime handler.
* Add JS SDK conformance harness skeleton

- Adds a dependency-free Node harness for TypeScript, Go, and external runtime targets with random ports, readiness polling, and captured logs.

- Adds lifecycle smoke coverage that starts the TypeScript CLI and verifies GitHub rate-limit readiness.

- Keeps SDK conformance isolated under tests/sdk-js so future official SDK suites can be added as dev-only test dependencies.

* Fix SDK conformance harness wiring

* Fix SDK conformance harness scheduling
* Add Go AWS gateway parsing foundation

- Adds a normalized AWS request context with request ids, region/account defaults, credential-scope parsing, and service/action detection across host, path, query, and target metadata.

- Adds dependency-free AWS Query, JSON RPC, and S3 REST route parsers for future native service handlers.

- Covers representative S3, SQS, IAM, STS, and JSON RPC requests in Go unit tests.

* Fix S3 multipart upload action detection
* Add AWS auth and error foundations

- Adds dependency-free SigV4 parsing, known-key auth modes, explicit missing and unknown auth states, and gateway identity context.

- Adds AWS XML, S3 REST XML, and JSON error serializers for SDK-compatible service failures.

- Covers header, presigned, relaxed, known-key, strict, gateway, and error serialization behavior in Go tests.

* Harden AWS auth resolution

* Fix AWS auth and error defaults
* Add Go binary asset store foundation

- Adds a dependency-free in-memory asset store with binary-safe byte storage, streaming helpers, metadata, checksums, ETags, and snapshot references.

- Adds stable AWS asset identifiers for S3 objects, Lambda packages, Lambda layers, and CloudFormation templates.

- Covers binary round trips, metadata cloning, defaults, stable snapshots, and AWS asset id behavior in Go tests.

* Fix AWS asset purpose constants
* Add Go AWS service shell

- Mounts the native AWS service through the Go runtime when the aws service is enabled.

- Adds protocol-shaped not-implemented responses for S3 REST XML, AWS Query, and JSON RPC requests.

- Adds an AWS inspector shell backed by shared UI helpers and empty native AWS store collections.

* Fix AWS fallback routing

* Fix AWS shell fallback routing

* Fix AWS fallback routing

* Tighten AWS S3 fallback detection

* Fix AWS service fallback classification

* Fix AWS fallback service path classification

* Fix AWS fallback routing edge cases
* Add native Go S3 current parity

- Implements S3 bucket and object operations in the native AWS service with binary-safe asset storage.

- Supports list pagination, copy object, metadata, ETags, last-modified headers, and presigned POST uploads.

- Extends Go service and runtime tests and validates against the AWS SDK v3 S3 E2E suite.

* Fix native S3 edge cases
* Add native Go SQS current parity

- Implements native Go SQS queue and message operations for Query and current JSON SDK protocols.

- Seeds the default SQS queue and routes SQS through the AWS service with queue attributes, visibility, purge, and delete behavior.

- Adds Go coverage and JS SDK v3 SQS E2E coverage against the Go runtime.

* Fix native SQS delay and message attributes

* Fix native SQS receive races

* Fix native SQS receive metadata parity

* Document SQS SDK JSON protocol

* Clarify native SQS JSON docs
- Implements native IAM users, roles, access keys, and STS caller identity and assume role with credential mapping.

- Seeds default admin IAM credentials and routes IAM and STS Query requests through the Go AWS service.

- Adds JS SDK v3 IAM and STS conformance coverage plus docs for native SDK endpoints.
* Add native Go Resend current parity

- Implements native Resend emails, domains, API keys, audiences, contacts, inbox UI, and explicit JSON seed handling in the Go runtime.

- Adds official Resend SDK external E2E coverage plus CI wiring for the native Go service.

- Updates Resend docs, skills, and service listings for native runtime support.

* Reject unsupported native seed configs
- Pins the workspace package manager to pnpm 11 and enables strict Node engine enforcement.

- Adds fnm/nvm Node 24 version files and points CI/release workflows at the shared version file.

- Uses Corepack in CI to activate pnpm 11 under the configured Node runtime.

- Tolerates Node 24 socket reset behavior in the SDK conformance timeout fixture.
ctate and others added 27 commits May 22, 2026 19:57
* Add API Gateway v2 Lambda proxy foundation

Adds native Go API Gateway v2 HTTP API, integration, route, and stage metadata handling with SDK-compatible REST JSON responses.

Adds local HTTP API invoke URLs that route AWS_PROXY integrations through the Lambda engine, including proxy event and response mapping.

Covers API Gateway v2 control-plane and Lambda proxy routing with Go tests, official JS SDK E2E coverage, compatibility facade types, and docs updates.

* Fix API Gateway Lambda proxy edge cases

* Fix API Gateway v2 Lambda proxy edge cases

* Fix API Gateway v2 Lambda proxy review issues

* Fix API Gateway v2 proxy event shape

* Fix API Gateway v2 route matching
- Add pnpm minimumReleaseAge of 2880 minutes and deny reviewed dependency build scripts by default.

- Require Node 24 and pnpm 11 in project metadata, version files, and CI.

- Let GitHub Actions read the pnpm version from packageManager to avoid setup conflicts.
* Add Slack parity baseline tests

- Add shared Slack test helpers and a baseline coverage matrix.

- Add Slack WebClient conformance and event dispatch baseline tests.

- Alias Slack Vitest runs to the TypeScript core runtime.

* Cover Slack OAuth callback route

* Make Slack SDK tests bind loopback
* Add Slack rich message parity

- Preserve rich chat and webhook payloads through storage and reads.

- Add route, event, and Slack SDK coverage for rich message round trips.

- Update Slack docs and coverage notes for the supported surface.

* Fix Slack rich message review issues
* Add Slack message event parity

- Add deterministic chat permalinks for posted messages and threaded replies.

- Dispatch Slack-shaped message_changed and message_deleted events.

- Cover permalink and event flows across route, SDK, and docs.

* Add Slack event timestamps

* Format Slack chat route

* Fix Slack coverage note
* Add Slack ephemeral and scheduled messages

- Store ephemeral messages outside channel history and surface them in the inspector.

- Add scheduled message create, list, and delete APIs with SDK coverage.

- Update Slack docs, skill examples, and coverage notes for the new chat surface.

* Fix Slack scheduled message review issues

* Fix Slack ephemeral membership check

* Fix Slack scheduled cursor handling

* Fix Slack scheduled message review issues

* Fix Slack scheduled message formatting
* Add Slack conversation lifecycle writes

- Implement archive, unarchive, rename, topic, and purpose mutations.

- Dispatch lifecycle events and message subtype events for supported writes.

- Cover routes, Slack SDK calls, docs, and coverage matrix.

* Fix Slack conversation lifecycle review issues

* Fix private Slack lifecycle events
* Add Slack membership and DM writes

- Implement invite, kick, open, close, mark, and conversation type filtering.

- Model IM and MPIM conversations and support DM posting by user ID.

- Cover routes, Slack SDK calls, events, docs, and coverage matrix.

* Address Slack DM review findings

* Fix Slack direct conversation visibility

* Fix Slack direct conversation write guards

* Fix Slack private conversation guards

* Fix Slack membership review issues

* Fix Slack scheduled and legacy membership guards

* Fix Slack skill DM examples

* Fix Slack reaction access guards

* Fix Slack DM events and leave guards
* Add Slack OAuth install and scope parity

- Model app installs, bot users, and Slack token records for OAuth and seeded apps.
- Add relaxed and strict scope checks across Slack Web API routes.
- Cover OAuth-generated tokens with route, SDK, docs, and init config updates.

* Address Slack scope review findings

* Fix Slack strict scope parity

* Fix Slack email lookup strict scope

* Fix Slack user scope token issuance

* Fix Slack OAuth formatting
* Add Slack user profile and presence parity

- Add stateful Slack profile get/set and presence get/set APIs.

- Expand seeded profile and presence data with OAuth bot defaults.

- Cover route, SDK, event, docs, and coverage surfaces.

* Format Slack coverage matrix
* Add Slack modern file upload parity

- Add stateful Slack external upload sessions, file records, reads, lists, and deletes.

- Share uploaded files as Slack file_share messages with file events and inspector visibility.

- Cover SDK uploadV2, binary upload, routes, docs, and coverage matrix updates.

* Fix Slack file upload access regressions

* Fix Slack file upload edge cases

* Fix Slack file visibility in history

* Fix Slack deleted file share history

* Fix Slack file upload review issues

* Fix Slack file upload review issues

* Format Slack file upload routes
* Add Slack pins and bookmarks parity

- Add stateful pins and link bookmark APIs with scope checks and inspector visibility

- Cover route, SDK, event, coverage matrix, docs, and skill updates

* Fix Slack orphaned pins

* Fix Slack bookmark ordering

Sort bookmarks by rank with stable fallbacks and avoid rank reuse after deletion.

* Fix Slack seeded token identity handling
* Add Slack views parity

- Add stateful Slack views storage and Web API routes for App Home and modals.

- Surface views in the inspector and coverage matrix.

- Update Slack docs, registry, and skill guidance.

* Fix Slack view trigger parity

* Scope Slack view ownership

* Fix Slack views parity gaps
* Expand Slack inspector audit

- Add tabbed inspector views for Slack conversations, files, views, auth state, and events.

- Cover expanded inspector state with route tests and coverage notes.

- Update Slack docs and skill guidance for the local inspector.

* Fix Slack inspector review findings

* Restore Slack inspector reactions
- Align public Slack docs and skill with the implemented supported surface, strict scopes, and OAuth callback route.

- Update CLI service metadata and generated Slack seed scopes for current parity coverage.

- Record deferred Slack families in the coverage matrix and public docs.
- Bump emulate and @emulators packages to 0.6.0.

- Add the v0.6.0 changelog entry for expanded Slack emulator support.

- Move release markers from v0.5.0 to v0.6.0.
* Add Vercel Blob emulator support

- Add stateful Vercel Blob emulation for put, head, list, delete, and public object serving

- Cover Blob SDK behavior with @vercel/blob tests and register blob storage in service metadata

- Document Blob configuration and make seeded Vercel user IDs stable

* Fix Vercel Blob OIDC store resolution

* Fix Vercel Blob copy and store scoping
* Add Vercel Blob sharing example

* Add a Next.js file-sharing example wired to the embedded Vercel Blob emulator.

* Resolve prefixed Blob URLs for head, copy, and delete operations.

* Cover prefixed Blob URL resolution with Vercel emulator tests.

* Fix Vercel Blob sharing URL handling
* Add Vercel Blob sharing example

* Add a Next.js file-sharing example wired to the embedded Vercel Blob emulator.

* Resolve prefixed Blob URLs for head, copy, and delete operations.

* Cover prefixed Blob URL resolution with Vercel emulator tests.

* Fix Vercel Blob sharing URL handling

* Prepare v0.6.1 release
Register Foundry through a single fork-owned file
(packages/emulate/src/fork-services.ts) that composes upstream's
SERVICE_REGISTRY, wraps createServer to default the docs link to the fork
docs site, and folds api:admin-read into the default admin token only when
Foundry is enabled. registry.ts and @emulators/core stay byte-identical to
upstream, so upstream syncs never conflict on them: `rg foundry
packages/emulate/src` matches only the seam and its tests. The four CLI/API
consumers (api, start, list, init) import the registry and createServer from
the seam instead of upstream.

Includes the @emulators/foundry package (OAuth, admin identity,
connectivity, ontologies, compute modules) and its agent skill.
…ed graph

- docs-chat: model deepseek/deepseek-v4-flash via AI Gateway (was Haiku).
  Remove the per-request Upstash rate limiter and the Anthropic cache-control
  pass; spend is capped by the gateway key's budget and V4 Flash caches input
  prefixes implicitly. The bash/grep-over-docs tool approach is unchanged.
- Drop @upstash/ratelimit + @upstash/redis and lib/rate-limit.ts.
- Bump the AI SDK to the newest release allowed by minimumReleaseAge (6.2.x).
- CI: fetch full history, cache .turbo, and run build/type-check/lint/test
  through one turbo invocation that is --affected on PRs and full on main.
- Foundry docs: 26 MDX pages under app/docs/foundry/** (docs-gen markers
  stripped; no generator on this branch).
- Branding via lib/site.ts (single source) wired through the layout metadata,
  landing page, OG image, and chat label; Nyrra logo + favicon.
- Sidebar extracted to lib/docs-sections.ts and shared by both the desktop and
  mobile nav (single source, includes Foundry sections); the search index and
  page titles get the Foundry entries.
- next.config: redirect legacy root-level /foundry/* URLs to /docs/foundry/*.
- Kept upstream's code.tsx (no workerd shiki swap), tsconfig, eslint, and the
  v0.6.1 vercel/page.mdx (Blob docs).
- Add type-check + lint scripts to @emulators/foundry so `turbo run
  type-check lint` actually covers it (it was silently skipped, matching
  every other @emulators package now).
- Fix the type error that gap hid: narrow authUser with `!` in the getCurrent
  route, matching the /multipass/api/me handler in the same file.
- Landing terminal version: v0.6.0 -> v0.6.1.
Old fork main (web-svelte, vinext history, Foundry-woven-into-registry) is
recorded as an ancestor for traceability but contributes no files: the tree
is exactly the clean rebase. Makes the replacement land through the required PR.
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​vercel/​blob@​2.4.0751009797100
Updatedhono@​4.12.12 ⏵ 4.12.2599 +1100 +3197 +196100

View full report

@anandpant
anandpant merged commit 6a15c3d into main Jun 14, 2026
3 checks passed
@anandpant
anandpant deleted the feat/foundry-vercel-clean branch June 14, 2026 20:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants