refactor: move repository tooling into Rust

.cargo/config.toml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 [alias]
-xtask = "run --quiet --release --package xtask --"
+xtask = "run --quiet --release --locked --package xtask --"
 
 # The browser app's Leptos views are type-erased (`--cfg erase_components`):
 # each reactive closure is boxed instead of monomorphizing the view code for

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
     name: performance budget (allthing.social)
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
-    # Up to 30 minutes waiting for the deploy (scripts/wait-for-deploy.mjs),
+    # Up to 30 minutes waiting for the deploy (cargo xtask wait-for-deploy),
     # then the measurements.
     timeout-minutes: 45
     steps:
@@ -79,14 +79,17 @@ jobs:
           # The history the deploy wait needs to tell whether a later live
           # commit includes this one.
           fetch-depth: 0
+      - name: Install the pinned Rust toolchain
+        run: rustup toolchain install
+      - uses: Swatinem/rust-cache@v2
       - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npx playwright install --with-deps chromium
       - name: Wait for the intended deployment
-        run: node scripts/wait-for-deploy.mjs https://allthing.social "$(git rev-parse HEAD)"
+        run: cargo xtask wait-for-deploy https://allthing.social "$(git rev-parse HEAD)"
       - run: npx playwright test e2e/perf.spec.ts
         env:
           E2E_BASE_URL: https://allthing.social
@@ -147,12 +150,12 @@ jobs:
             ~/.cache/worker-build
           key: browser-tools-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
       - run: npm ci
-      - run: node scripts/npm-audit.mjs
+      - run: cargo xtask npm-audit
       - run: npm run test:tools
       - run: npx playwright install --with-deps chromium
       - run: bash scripts/build.sh
       - name: Test the local build without live data
-        run: sh scripts/test-browser-fixtures.sh
+        run: cargo xtask browser-fixtures
       - name: Test the static copy
         run: |
           bash scripts/build-pages.sh

.gitignore

@@ -1,5 +1,6 @@
 # Rust and build output
 /target/
+/spacetime/spacetimedb/target/
 /dist/
 /dist-pages/
 /crates/allthing-worker/build/

AGENTS.md

@@ -5,6 +5,7 @@ Allthing is a Farcaster client for reading, written in Rust: a Leptos WebAssembl
 
 - **One QR flow: sign in, and write, with a key the reader approves once.** By the owner's decision, where the Worker endorses keys there is one approval and one dialog: the reader approves Allthing's key request in the Farcaster app (a QR code on a computer, a link to the app on a phone), which signs them in (`POST /api/v1/auth/key`) and lets them cast, reply, quote, like, recast, follow and delete from here, with no second scan or separate grant step. A reader signed in without a key in this browser (signed in before keys, after Revoke permissions, or with its storage cleared) meets the same dialog, in its approve form, on their first write (`Session::grant`), never by itself on a page load. Never add a second approval dialog or QR flow. Sign In With Farcaster by QR code is only the fallback where the Worker endorses no keys, and makes no relay request where it does (`allthing-worker/src/auth.rs`, `allthing-core/src/siwf.rs`, `allthing-web/src/components/signin.rs`; see `docs/ARCHITECTURE.md#sign-in`). Once a reader has approved Allthing in the Farcaster app, casts, replies, quotes, likes, recasts, follows and deletes go from Allthing: the browser makes and keeps the key and signs (`allthing-core/src/app_key.rs` and `message.rs`, `allthing-web/src/keys.rs` and `components/writer.rs`; see `docs/ARCHITECTURE.md#liking-and-recasting`), and the Worker keeps scheduled casts the browser signed until their time (`allthing-worker/src/scheduled_casts.rs`, `allthing-data/src/scheduled.rs`). Allthing asks for those keys as its own Farcaster account, @allthingapp (FID 3356318, `ALLTHING_FID` in `wrangler.toml`), which its owner registered for it, and shows the casts "via Allthing" (`allthing-core/src/clients.rs`). By the owner's decision that is Allthing's only account: never add another, a seed phrase import or a wallet connection. The Worker endorses readers' keys with that account's custody key, the `ALLTHING_CUSTODY_KEY` secret, set in Cloudflare only (`allthing-worker/src/app_key.rs`; see `docs/DEPLOY.md#secrets`), and uses it for nothing else; it never holds a reader's key or signs as a reader. Until the secret is set (`writes.ready` in `/api/v1/status`), and for a reader signed out, a write opens the cast, the profile or a draft ready to post in the Farcaster app instead (`allthing-web/src/components/handoff.rs`, `allthing-core/src/compose.rs`; see `docs/ARCHITECTURE.md#handing-writes-to-the-farcaster-app`). Never add other login methods, wallet connections or write paths unless asked to. Messages (`/messages`) is Allthing's own, on SpacetimeDB (`allthing-web/src/pages/messages`, `spacetime/`; see `docs/ARCHITECTURE.md#messages-on-spacetimedb`): never add Farcaster Direct Cast API calls or an API-key paste step to it unless asked.
 - **Never hide content** because of who posted it. Allthing shows no account labels; spam is judged by a cast's content (see Mini apps and spam below).
+- **Rust first.** The owner prefers Rust for application behavior and native tooling. Put pure shared rules in `allthing-core`, interactive UI in `allthing-web`, and native build/check policy in `xtask`. Keep `web/paint.js`'s inert first-card renderer: the owner chose it after a paired cold-load comparison beat the Rust prototype (see `docs/PERFORMANCE.md#measured-exception-the-javascript-first-card-renderer`). Retain the existing Node static test server (`e2e/pages-server.mjs`) after an unresolved pre-mount stall in migration CI; the server's role in that stall was not established (see `docs/PERFORMANCE.md#retained-node-static-test-server`). Keep the small JavaScript loader and inline preload/data hints, the SpacetimeDB TypeScript SDK adapter/generated bindings, and official Playwright browser tests at their platform boundaries. CSS, SQL, HTML and config remain platform data. Preserve measured performance, license rules and independent test oracles; do not mask handwritten files with Linguist attributes.
 - **Where code goes.**
   - Pure logic and data types, with unit tests, go in `crates/allthing-core`.
   - Provider quirks go in `crates/allthing-data/src/hypersnap.rs` and `crates/allthing-core/src/normalize.rs`.
@@ -19,7 +20,8 @@ Allthing is a Farcaster client for reading, written in Rust: a Leptos WebAssembl
 - **Licensing.** Licensing is AGPL-3.0-or-later. Start new files with an SPDX header. New dependencies must pass `cargo deny check licenses`.
 - **Secrets.** Never commit secrets, tokens, `.dev.vars` or `.env` files, or session URLs. The Worker's secrets (`SESSION_SECRET`, `SOLANA_RPC_URL`) are set in Cloudflare; see `docs/DEPLOY.md#secrets`.
 - **Checks.**
-  - Run `bash scripts/check.sh` (fmt, Clippy native and wasm32, tests, license audit).
+  - Run `cargo xtask check` (fmt, Clippy native and wasm32, tests, license audit).
+  - Run `cargo xtask module-check` for the isolated SpacetimeDB crate (fmt, native/Wasm Clippy, tests, release Wasm build and license audit); `spacetime/check.sh` is a thin compatibility wrapper.
   - End to end: `bash scripts/build.sh && npx playwright test`. Playwright starts `wrangler dev` on port 8787.
   - Against production: `E2E_BASE_URL=https://allthing.social npx playwright test`.
   - The static copy: `bash scripts/build-pages.sh && E2E_PAGES=1 npx playwright test`.
@@ -32,3 +34,12 @@ Allthing is a Farcaster client for reading, written in Rust: a Leptos WebAssembl
 - **Speed.** Keep within `docs/PERFORMANCE.md`. Prefetches go through `api::prefetch`, which caps and dedupes them.
 - **Mini apps and spam.** Spam by the rules in `allthing-core/src/spam.rs` is filtered out server-side (`thread::without_spam`, `thread::prune_spam`). Casts with mini app or frame links are marked (`Cast.mini_app`) and kept in feed, profile, channel and thread payloads; the browser hides them unless the reader turned on Show mini app casts (`allthing-web/src/miniapps.rs`, `Cast::hidden_for`), the default being hidden, and never runs them. Search, reply previews and notifications still drop both (`Cast::hidden`). Keep new list endpoints doing one or the other.
 - **Deploying.** Cloudflare Workers Builds deploys `main` with `bash scripts/build.sh` and `npx wrangler deploy`; see `docs/DEPLOY.md`.
+
+## Conservative GitHub Actions use
+
+- Follow the current user approval policy for GitHub Actions budgets and exceptions. Preserve stricter project pauses and required release evidence.
+- Run proportionate validation locally first, inspect the diff, and batch coherent changes before remote CI. Avoid repeated dispatch or rerun loops.
+- Before any dispatch, rerun, push, pull-request creation or update, merge, or trigger change that can start Actions, inspect repository run history for the current UTC day using read-only tools. Check every workflow, branch and actor, including queued, in-progress and completed runs, all rerun attempts, and attempts of older runs. Account for duplicate push/PR events, downstream `workflow_run` chains, scheduled services and GitHub-generated workflows. Estimate the resulting runs and runner minutes; a skipped job or cancelled run is not a daily cap. Coordinate parallel agents because a read-only check is only a snapshot.
+- Escalate exception requests, unknown monthly usage, and CI or release conflicts to the coordinating assistant under the current user approval policy before triggering remote work. Report unavailable usage as unknown; do not expand billing permissions to obtain it.
+- Checkpoint and source-publication instructions remain subject to this preflight and the current user approval policy. If publication is blocked, retain durable work locally and report the precise blocker. Preserve required checks and service/deployment behavior; do not bypass checks or alter triggers to fit a budget.
+- Include this operational guidance in delegated tasks. Apply the current user approval policy to each proposed action; do not copy permission grants or numeric approval thresholds into repository instructions or memory.

CHANGELOG.md

@@ -16,6 +16,8 @@ All notable changes to Allthing are recorded here. The format follows [Keep a Ch
 
 ### Development
 
+- Move build orchestration, Brotli compression, repository validation, asset-credit checks, deployment waiting, isolated database-module checks, audit handling and browser fixture orchestration into native Rust `xtask` commands. Retain official Playwright tests and independent cryptography, SQL and SDK codec checks.
+
 - Live layout and interaction checks wait for loaded app content instead of loading placeholders or inert early cards; first-paint and navigation timing limits remain unchanged.
 - Browser checks wait for app handover after measuring the first painted card, compare Back with the position at the actual click, and await exact page-load counts. Local media checks run database commands asynchronously so CI's Node 22 client can retire closed connections, and retain bounded Worker diagnostics on failure. Existing timing limits, request counts and upload assertions remain.
 

CONTRIBUTING.md

@@ -32,7 +32,7 @@ Everyone taking part is expected to follow the [code of conduct](CODE_OF_CONDUCT
   - `npx playwright test`: the whole suite, including `e2e/allthing.spec.ts` against live Farcaster data. Playwright starts `wrangler dev` on port 8787. Tests run at 1280×900; the phone-width tests and some fixture tests run at 390×844.
   - `npx playwright test e2e/perf.spec.ts`, for anything on the reading path.
   - `bash scripts/build-pages.sh && E2E_PAGES=1 npx playwright test`, if you touched the static copy.
-- `npm run test:tools`, if you changed the static test server (`e2e/pages-server.mjs`).
+- `cargo test --locked -p xtask`, if you changed native build/check tooling. Run `npm run test:tools` for the static test server and the independent cryptography, SQL and SDK codec checks.
 - For UI changes, attach before-and-after screenshots at both widths to the pull request.
 
 The live-data suite saves screenshots in `docs/screenshots/` (set `E2E_SCREENSHOT_DIR` to save them elsewhere). Only the WebP images the README shows (`home.webp`, `profile.webp`, `dau.webp`) are tracked; replace one only when the README should change.