store-scraper-bot/plans/260426-2015-cloudflare-worker-code-port/phase-01-wrangler-config-deps-lint.md

Phase 01 — Wrangler Config + Deps Swap + Lint Scaffolding

Context Links

• miti99bot wrangler.toml: /config/workspace/tiennm99/miti99bot/wrangler.toml
• miti99bot secret-leak lint: /config/workspace/tiennm99/miti99bot/scripts/check-secret-leaks.js
• Existing package.json: /config/workspace/tiennm99/js-store-scraper-bot/package.json

Overview

• Priority: P0
• Status: pending
• Description: Pure config + dependency changes. No application code touched. After this, npm install succeeds with the new dep set; wrangler.toml is in place; lint runs.

Key Insights

• Workers cron is UTC: 0 0 * * * UTC = 7am Asia/Ho_Chi_Minh.
• nodejs_compat_v2 is the lever that gives node:net/node:tls (needed by mongodb driver).
• Secret-leak lint added now so subsequent phases can't sneak in a console.log(env.MONGODB_URI).
• Removing Node-only deps in this phase causes src/index.js to fail to load — that's expected and fine; Phase 04 rewrites the entry. Until then, npm start is broken (acceptable; we're refactoring).

Requirements

Functional

• wrangler.toml written with nodejs_compat_v2, cron 0 0 * * *, observability block.
• package.json:
  • Add: mongodb@^6.7.0
  • Remove: node-telegram-bot-api, node-cron, dotenv, pino, pino-pretty
  • Dev-add: wrangler@^3
  • Scripts: dev, deploy, register, register:dry, lint
  • engines.node stays >=20
  • Drop type: module is not needed — Workers ESM is the same syntax.
• scripts/check-secret-leaks.js written.
• .dev.vars.example written.
• .env.deploy.example written.
• .gitignore adds .dev.vars, .env.deploy, .tmp-deploy/, .wrangler/.

Non-functional

• npm install succeeds.
• npm run lint succeeds (only secret-leak check at this point; will gain node --check in later phases).

Architecture

js-store-scraper-bot/
├── wrangler.toml                       (NEW)
├── package.json                         (MODIFIED — deps swap)
├── .gitignore                           (MODIFIED — Worker artifacts)
├── .dev.vars.example                    (NEW)
├── .env.deploy.example                  (NEW)
├── scripts/
│   └── check-secret-leaks.js           (NEW)
└── src/                                  (UNTOUCHED in this phase)

Related Code Files

CREATE

• wrangler.toml
• scripts/check-secret-leaks.js
• .dev.vars.example
• .env.deploy.example

MODIFY

• package.json — full rewrite of dependencies, devDependencies, scripts.
• .gitignore — append Worker artifact patterns.

DELETE

• (none in this phase)

Implementation Steps

1. Write wrangler.toml:

   name = "js-store-scraper-bot"
   main = "src/index.js"
   compatibility_date = "2025-10-01"
   compatibility_flags = ["nodejs_compat_v2"]
   
   [vars]
   APP_CACHE_SECONDS = "600"
   NUM_DAYS_WARNING_NOT_UPDATED = "30"
   
   # 0 UTC = 7am Asia/Ho_Chi_Minh
   [triggers]
   crons = ["0 0 * * *"]
   
   [observability]
   enabled = true
   head_sampling_rate = 1
   
   [observability.logs]
   enabled = true
   invocation_logs = true
   
   # Secrets (set via `wrangler secret put`, NOT here):
   #   TELEGRAM_BOT_TOKEN
   #   TELEGRAM_BOT_USERNAME
   #   TELEGRAM_WEBHOOK_SECRET
   #   MONGODB_URI
   #   ADMIN_IDS
   

2. Rewrite package.json:

   {
     "name": "js-store-scraper-bot",
     "version": "0.2.0",
     "description": "JavaScript port of store-scraper-bot, deployable to Cloudflare Workers.",
     "type": "module",
     "private": true,
     "engines": { "node": ">=20" },
     "main": "src/index.js",
     "scripts": {
       "dev": "wrangler dev",
       "deploy": "wrangler deploy && npm run register",
       "register": "node --env-file=.env.deploy scripts/register-webhook.js",
       "register:dry": "node --env-file=.env.deploy scripts/register-webhook.js --dry-run",
       "lint": "node scripts/check-secret-leaks.js"
     },
     "dependencies": { "mongodb": "^6.7.0" },
     "devDependencies": { "wrangler": "^3" },
     "license": "Apache-2.0"
   }
   

3. Write scripts/check-secret-leaks.js:

   #!/usr/bin/env node
   // Fails CI if any source file logs a secret.
   import { readdirSync, readFileSync, statSync } from 'node:fs';
   import { join } from 'node:path';
   
   const SECRETS = ['MONGODB_URI', 'TELEGRAM_BOT_TOKEN', 'TELEGRAM_WEBHOOK_SECRET', 'ADMIN_IDS'];
   const ROOTS = ['src', 'scripts'];
   
   function* walk(dir) {
     for (const entry of readdirSync(dir)) {
       const p = join(dir, entry);
       const s = statSync(p);
       if (s.isDirectory()) yield* walk(p);
       else if (/\.(js|mjs|ts)$/.test(p)) yield p;
     }
   }
   
   const violations = [];
   for (const root of ROOTS) {
     try {
       for (const file of walk(root)) {
         const text = readFileSync(file, 'utf8');
         for (const sec of SECRETS) {
           const re = new RegExp(`console\\.(log|info|warn|error|debug)\\([^)]*\\benv\\.${sec}\\b`);
           if (re.test(text)) violations.push({ file, secret: sec });
         }
       }
     } catch { /* ignore missing root */ }
   }
   
   if (violations.length) {
     console.error('Secret-leak violations:');
     for (const v of violations) console.error(`  ${v.file}: env.${v.secret} in console.*`);
     process.exit(1);
   }
   console.log('check-secret-leaks: clean');
   

4. Write .dev.vars.example:

   TELEGRAM_BOT_TOKEN=
   TELEGRAM_BOT_USERNAME=
   TELEGRAM_WEBHOOK_SECRET=
   MONGODB_URI=
   ADMIN_IDS=
   

5. Write .env.deploy.example:

   TELEGRAM_BOT_TOKEN=
   TELEGRAM_WEBHOOK_SECRET=
   WORKER_URL=https://js-store-scraper-bot.<account>.workers.dev
   

6. Append to .gitignore:

   .dev.vars
   .env.deploy
   .tmp-deploy/
   .wrangler/
   

7. Reinstall:

   rm -rf node_modules package-lock.json
   npm install
   

8. Smoke: npm run lint — must print check-secret-leaks: clean.

Todo List

• wrangler.toml written
• package.json updated (deps swap + scripts)
• scripts/check-secret-leaks.js written
• .dev.vars.example written
• .env.deploy.example written
• .gitignore updated
• npm install succeeds with new deps
• npm run lint passes

Success Criteria

• All 4 new files exist; package.json reflects new dep set; npm install clean.
• Lint script runs even though src/ is unchanged (no false positives).

Risk Assessment

Risk	Likelihood	Impact	Mitigation
mongodb install fails on this Node version	L	Medium	Node 20+ supported by mongodb 6.7
wrangler install pulls huge tree	L	Low	Dev-only; not bundled
src/index.js no longer runs after deps removed	H	None	Expected — Phase 04 rewrites entry

Next Steps

• Blocks: Phase 02 (telegram-api.js relies on Worker-style fetch; doesn't depend on this phase's files but conceptually starts here), Phase 03.
• Unblocks: Phase 02, Phase 03 (parallel-safe).