- Add .claude/settings.json to 15 submodules enabling:
  - beads@beads-marketplace (issue tracking)
  - ralph-loop@claude-plugins-official (implementation loops)
  - superpowers@superpowers-marketplace (enhanced capabilities)
  - dev-loop@workers-do-marketplace (full dev lifecycle)
- Initialize beads in rewrites/excel (was missing)
- Add Claude Code Cloud setup documentation

Submodules configured:
- primitives, mdxui
- rewrites: gitx, mongo, redis, neo4j, excel, firebase, convex, kafka, nats, turso, fsx
- packages: esm, claude

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Keeping only submodule-based rewrites in this repo:
- convex, excel, firebase, fsx, gitx, kafka, mongo, nats, neo4j, redis, supabase, turso

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Adds automatic bd (beads) installation for Claude Code web environments:
- Creates .claude/hooks/session-start.sh that installs @beads/bd via npm
- Falls back to Go installation if npm fails
- Initializes beads if .beads directory exists
- Updates settings.json with SessionStart hook configuration

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- packages/auth: Add jwks-cache.ts for JWKS caching
- packages/do-core: Add transport handlers, CDC tests, enhanced exports
- packages/drizzle: Consolidate TS implementation, add vitest config
- packages/rate-limiting: Consolidate TS implementation, update tests
- packages/security: Enhance bounded-set implementation
- sdks: Update README files, payments.do fixes, rpc.do improvements
- snippets: Enhanced router with new patterns
- workers/id.org.ai: Expand oauth-do implementation
- Delete deprecated startups.new folder

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- packages/claude: wrangler.toml → wrangler.jsonc
- packages/esm: wrangler migration, worker.ts updates
- rewrites/convex: wrangler migration, ConvexScheduler updates
- rewrites/excel: README updates
- rewrites/firebase: README updates
- rewrites/gitx: README updates
- rewrites/kafka: wrangler migration, new completeness/retention modules
- rewrites/mongo: MCP adapters and local-sqlite updates
- rewrites/nats: wrangler migration, nats-coordinator updates
- rewrites/neo4j: storage adapter updates
- rewrites/redis: README updates
- rewrites/supabase: README updates
- rewrites/turso: README updates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Remove cerner-, research-, procore-, hubspot- prefixed issues.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add the @dotdo/glyphs package with all 11 visual programming glyphs:
- 入/fn (invoke) - Function invocation via tagged templates
- 人/worker - Agent execution
- 巛/on (event) - Event emission and subscription
- 彡/db - Type-safe database access
- 田/c (collection) - Typed collections
- 目/ls (list) - List operations and queries
- 口/T (type) - Schema/type definition
- 回/$ (instance) - Object instance creation
- 亘/www (site) - Page rendering
- ılıl/m (metrics) - Metrics tracking
- 卌/q (queue) - Queue operations

All 70 export tests pass. This completes issue workers-z8jx1.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

… [workers-3tkq]

TDD RED phase: These tests will fail until lazy() is implemented.
- Tests for lazy() export, API, and behavior
- Tests for lazy().preload() method
- Tests for lazy() error handling
- Tests for Suspense integration with lazy components
- Tests for multiple lazy components
- Tests for React compatibility ($$typeof, displayName, internals)

23 tests fail (lazy not implemented), 2 pass (Suspense already exported).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add docs/, examples/, tests/, workers/
- Add packages/glyphs, packages/mdx-worker, packages/rpc-client
- Add sdks for builder.domains, embeddings.do, id.org.ai, startups.new, startups.studio
- Add rewrites/cerner
- Update various packages

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Update packages/auth, do-core, drizzle, rate-limiting, react-compat
- Update sdks (benchmarks.do, events.do, experiments.do, models.do)
- Update workers/cdc
- Add middleware/auth/src
- Add objects/do/errors.ts

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Issue completed with:
- MDX parsing with YAML frontmatter extraction
- Code block extraction with 'export' marker support
- wrangler.json generation from frontmatter
- package.json generation with dependency extraction
- Worker code compilation from exportable code blocks
- Optional documentation generation from prose
- CLI tooling with build, parse, and init commands
- 34 passing tests

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Update beads issues
- Update objects/do, packages (rate-limiting, security)
- Update sdks (models.do, okrs.do, resources.do, verbs.do, workflows.do)
- Update workers/cdc
- Add objects/do/do-rpc.ts, packages/do-core/src/r2-adapter.ts
- Add sdks/embeddings.do/test, tests/types

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Closed workers-4jys: RED phase completed for Component class support tests.
40 failing tests verify Component and PureComponent APIs are not yet exported.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Closed RED phase task for workers/functions delegation tests.
Test file already committed in previous sync.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

The CDC patching scripts (patch-cdc.cjs, fix-cdc.cjs, apply-cdc.cjs,
do-cdc-methods.ts.template) were never created as the proper architecture
was implemented from the start. CDC functionality exists as a standalone
CDCDO class in workers/cdc/src/cdc.ts, avoiding the patching anti-pattern.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add StoryBrand-style opening that addresses the problem of schema design
being a bottleneck for startup founders. Includes:
- Opening hook: "Your database should build itself"
- Problem section about schema design pain points
- Solution showing cascading generation from business description
- Connection to startups.new story

Closes workers-mp80

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…itions

Verified all 33 failing tests for define.code(), define.generative(),
define.agentic(), define.human() methods. Tests confirm methods are not
yet implemented (undefined), which is correct for RED phase TDD.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Implement embeddings.do SDK with intelligent caching to reduce API calls
and improve performance for repeated text embeddings.

Features:
- embed(): Generate single text embedding with caching
- embedBatch(): Batch embeddings with automatic deduplication
- similarity(): Compute similarity between texts or embeddings
- cached(): Check if embedding is cached without API call
- cacheStats(): Get cache hit/miss statistics
- clearCache(): Clear cached embeddings
- models(): List available embedding models

All responses include `cached` flag and `usage.tokens` to track
billing for cached vs fresh API calls.

Closes: workers-y7jey

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Expanded the primitives/ submodule section to comprehensively document:

- Detailed directory structure (19 packages, types/, content/, examples/, site/)
- All packages: ai-functions, ai-database, ai-workflows, ai-providers, etc.
- Business domain types: finance/, hr/, sales/, ops/, legal/, etc.
- Relationship with workers.do:
  - Workspace integration via pnpm-workspace.yaml
  - Type re-exports through @dotdo/types
  - Package naming conventions
- Usage patterns for internal and external consumers
- Rationale for submodule architecture vs npm dependency
- Key dependencies showing bidirectional relationship

Closes workers-i02g

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add classify.test.ts with 68 failing tests for AIDO class methods:
- is() - Boolean classification for spam, urgency, code validation
- summarize() - Text summarization with length/format options
- diagram() - Mermaid/SVG/ASCII diagram generation

Includes test helpers for mocking DO state, storage, and AI bindings.

Closes: workers-2n2tg

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Update mongo submodule to include refactored Iceberg module
with metadata caching, SQL injection protection, typed errors,
and unified API.

Issue: workers-3p3vc

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Adds comprehensive relationship cascade support for Durable Objects:

- RelationshipMixin with all 4 cascade operators
  - `->` hard cascade to (synchronous RPC)
  - `<-` hard cascade from (synchronous RPC)
  - `~>` soft cascade to (queued/eventual)
  - `<~` soft cascade from (queued/eventual)
- Saga pattern for cross-DO transactions (2PC, compensation handlers)
- Cascade Queue Worker for async processing
- Full test coverage (50 + 22 tests)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Prioritize explicit Accept header over result type detection
- Return HTML when client sends Accept: text/html even for object results
- Wrap objects with title/body in proper HTML structure
- Clean up timeout handlers to prevent lingering promises

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add comprehensive failing tests for @dotdo/ai worker:
- generate.test.ts (76 tests): text generation, object generation with schemas,
  streaming support, usage tracking, finish reasons, error handling
- list.test.ts (43 tests): string arrays, object arrays with schema, named arrays
- extract.test.ts (42 tests): schema-based structured extraction
- classify.test.ts (68 tests): is(), summarize(), diagram() methods
- rpc.test.ts (71 tests): RPC interface, HTTP API, HATEOAS discovery

Also add failing tests for workers/functions:
- classify.test.ts (52 tests): auto-classification of function types
- delegation.test.ts: delegation to backend workers (AI, EVAL, AGENTS, HUMANS)
- explicit-type-definitions.test.ts (55 tests): define.code(), define.generative(),
  define.agentic(), define.human() explicit type definition methods

All tests fail as expected (TDD RED phase) because implementations don't exist yet.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Functions with `type: null` (vs undefined) indicate corrupted data from
manual tampering or data corruption. Now throws descriptive error instead
of falling through to legacy function path.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

bashx wraps bash with judgment:
- Intent understanding (natural language → commands)
- Safety classification (before execution)
- Intelligent recovery (auto-fix errors)
- Output parsing (structured extraction)
- 18 MCP tools for AI assistants

Repository: https://github.com/dot-do/bashx
Issues: 67 TDD issues (RED → GREEN → REFACTOR)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Simplified from 18 MCP tools to 1 'bash' tool
- Added AST type system for tree-sitter-bash
- Structural safety analysis instead of regex
- 27 TDD issues (13 RED + 13 GREEN + 1 epic)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…terns

Add 6 documentation files covering payments architecture:
- ARCHITECTURE.md - Core architecture with Polar-inspired patterns
- STRIPE-CONNECT.md - Express accounts, two-step payouts, fee calculation
- SUBSCRIPTIONS.md - State machine, trials, upgrades, dunning
- METERED-BILLING.md - Meters, aggregation, credits, pricing models
- WEBHOOKS.md - Event types, signatures, idempotent processing
- CUSTOMER-PORTAL.md - Sessions, tokens, self-service features

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Refactor WorkersRegistryDO to extend dotdo's DO class
- Add Worker type definition extending Thing schema
- Simplify Hono worker to minimal passthrough
- Add 11 integration tests using vitest-pool-workers
- Configure wrangler.jsonc for custom domain workers.do
- Deploy to production at workers.do

The service provides:
- Worker registration and listing
- Folder linking to workers
- Tracking of created/deployed/accessed timestamps
- Cap'n Web RPC via dotdo's built-in handling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Added full WfP deployment API (deploy, deploy-static, deploy-opennext)
- Added dispatch API for routing to deployed workers
- Added proxy/router for subdomain and path-based routing
- Added capnweb RPC support for CLI compatibility
- Added analytics middleware (optional)
- Added graceful handling of unconfigured WfP bindings (503 errors)
- Updated WorkersRegistryDO to support both CF RPC and capnweb protocol

Migrated from ~/platform/workers/workers to ~/projects/workers/workers/workers.do

Fixes: do-awe (workers.do capnweb RPC returns JSON instead of RPC)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Epic: workers-aeh6n (Workers for Platforms Service)

Components:
- DeploymentsStore (DO-based storage replacing D1)
- Real WfP Deploy (wire up actual WfP infrastructure)
- Dispatch Router (O(1) lookup)
- Security (auth, validation, CORS)
- TypeScript (strict typing)
- WorkersRegistryDO (registry tests)
- Analytics Pipeline

Each component has RED/GREEN/REFACTOR tasks with proper dependencies.
Ready tasks: all RED tests can start in parallel.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

TDD RED phase - tests define the DeploymentsService API contract:
- deployments.create(options) - stores deployment with metadata
- deployments.get(workerId) - retrieves by primary key
- deployments.getByName(name) - O(1) lookup via secondary index
- deployments.list(options) - paginated with cursor support
- deployments.delete(workerId) - removes with index cleanup
- deployments.update(workerId, options) - partial updates

Tests verify isolation between users (each DO instance has separate store)
and proper handling of duplicate names/workerIds.

All 23 tests fail with "The RPC receiver does not implement 'deployments'"
which confirms the DeploymentsService doesn't exist yet.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…ase)

Add comprehensive test suite for O(1) dispatch routing that requires
DeploymentsStore.getByName() instead of O(n) KV scan. Tests verify:

- dispatchById dispatches to workers by ID
- dispatchByName uses secondary index for O(1) lookup (FAILS)
- extractAppId extracts from subdomain/path patterns
- routeRequest adds proper routing headers
- Rate limiting per worker (FAILS - not implemented)
- 404 responses for unknown workers

6 tests fail intentionally as RED phase - implementation pending.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Write TDD RED phase tests defining expected behavior for real Workers for
Platforms deployment. Current deploy.ts is simulated - these tests define
what real deployment to dispatch namespace should do:

1. Deploy worker code to dispatch namespace
2. Worker is callable via dispatch namespace after deploy
3. Deploy with bindings (KV, DO, service)
4. Deploy with environment variables
5. Redeploy updates existing worker
6. Delete removes from dispatch namespace

Tests fail because:
- env.apps (dispatch namespace) not configured in wrangler.jsonc
- deployWorker returns false when esbuild service unavailable
- No real WfP deployment implementation exists yet

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add compile-time type tests using expect-type and vitest to enforce:
- Env interface consistency across all files (currently 6 different definitions)
- Proper input/output types for RPC methods (no any)
- Discriminated unions for error types (Result<T, E> pattern)
- Type narrowing for success/error responses

Current state (RED phase - tests intentionally fail):
- 17 compile-time type errors detected
- DispatchRequest.body and DispatchResponse.data use `any`
- DeployResponse/DispatchResponse are not discriminated unions
- Env interface duplicated with inconsistent required/optional fields

Run type tests:
- Compile-time: npm run typecheck:tests
- Runtime: npm run test:types

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Write TDD RED phase tests for security improvements:
- Authorization header validation (21 tests, 3 pass, 21 fail)
- User ID derivation with cryptographic hashing
- CORS origin restrictions (currently allows all)
- Rate limiting (currently none)
- Input validation on deploy requests
- Content-Type validation

Tests fail because:
- No auth required on /workers (returns 200 vs 401)
- CORS uses '*' instead of specific origins
- No rate limiting implemented
- Input validation runs AFTER WfP check (503 vs 400)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- All 48 tests passing
- RPC methods: list, get, register, link, updateAccessed, updateDeployed
- REST API endpoints: GET /workers, GET /workers/:id, /list, /get/:id
- Storage pattern: worker:{$id} prefix
- Batch RPC request support
- Proper sorting by created/deployed/accessed timestamps
- Added deployment types for future expansion

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add secondary index lookup for name-based dispatch
- Implement dispatchById and dispatchByName
- Add proper routing via extractAppId
- Integrate rate limiting with per-worker limits
- Add rate limit headers to responses

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Enable dispatch_namespaces binding to 'dotdo-public' WfP namespace
- Configure KV namespace 'DEPLOYMENTS' for deployment metadata
- Update vitest.config.ts with test KV binding documentation
- Document required infrastructure for full WfP deployment:
  - esbuild service worker (for compilation)
  - D1 database (for deployment queries)
  - clickhouse service (for logging)

Tests still fail as expected - Miniflare doesn't support WfP dispatch
namespaces. Real deployment testing requires deployed infrastructure.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add auth validation with 401 responses for /workers endpoints
- Implement cryptographic user ID derivation (SHA-256) with X-User-Id header
- Restrict CORS to *.workers.do domains only (no more origin: '*')
- Add rate limiting with X-RateLimit-* headers (30 req/min window)
- Validate deploy request input BEFORE checking WfP configuration
- Add Content-Type validation for POST endpoints (415 for non-JSON)
- Fix XSS vulnerability in serve404() by escaping HTML entities
- Update integration tests to match new secure CORS behavior

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Create SimulatedDispatchNamespace for local testing
  - Stores worker code in memory
  - Evaluates worker modules when fetch is called
  - Supports environment variables and basic bindings
  - Simulated KV namespace for metadata storage

- Update deploy.ts to support both simulated and production modes
  - Detect simulated namespace via duck typing (has 'put' method)
  - Deploy to simulated namespace for local testing
  - Use Cloudflare API for production WfP deployment
  - Support ExtendedDeployRequest with env vars and bindings

- Update tests to use simulated dispatch namespace
  - No longer depends on wrangler.jsonc dispatch_namespaces
  - Tests pass locally without WfP infrastructure
  - Skip tests that require real bindings (KV, DO, service)

Deploy workers to dispatch namespace, support bindings and env vars,
handle redeploy and delete operations.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add deployments RPC service to WorkersRegistryDO
- Implement CRUD operations with DO storage
- Add secondary index for O(1) name lookup (name:{name} -> workerId)
- Add JSON-RPC routing for deployments.* methods
- Support cursor-based pagination with startAfter

Storage pattern:
- Primary: deployment:{workerId} -> Deployment object
- Secondary index: name:{name} -> workerId

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Ensure consistent key patterns with PREFIX constants
- Use atomic batch operations for create (parallel constraint checks)
- Add batch operations: getMany, deleteMany
- Add utility methods: exists, isNameAvailable, count
- Improve pagination documentation
- Add comprehensive storage architecture documentation
- All 36 tests pass

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Consolidate types: Move DeploymentRecord, DeploymentsStore, RateLimitStatus,
  ThingContext, AppIdMatch, RouteMatch, and DispatchEnv to types.ts
- Remove duplicate Env interfaces from dispatch.ts, router.ts, and assets.ts
- Improve type safety: Replace `any` with `unknown` in DispatchRequest/Response
- Add module documentation headers
- Re-export types for backwards compatibility

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Move security logic to src/middleware/security.ts
- Add security headers to responses (X-Content-Type-Options, X-Frame-Options, HSTS)
- Improve rate limiting structure with DistributedRateLimiter class for DO storage
- Add input sanitization for error messages (XSS prevention)
- Consolidate CORS validation and auth handling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Improve error messages to be more actionable
- Add TypeScript types (remove inline type definitions)
- Add comprehensive JSDoc documentation
- Document simulated vs production modes
- Add proper result types for all exported functions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Extract shared storage patterns (static prefixes, consistent key naming)
- Add comprehensive JSDoc documentation for all public methods and interfaces
- Improve error handling with RpcErrorCode constants
- Add utility functions (jsonResponse, now) to reduce duplication
- Maintain service separation (workers vs deployments) for clear responsibilities
- All 84 tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>