feat(cloudflare): support explicit APP_PID for shared-identity deployments

[zhuzhuyule]

Summary

Adds an opt-in "shared identity" mode so Media Kit can be deployed as a sibling CF Worker to other components (e.g. `aigne-hub`, `payment-kit`) that share a single Blocklet Server identity, without the three workers stomping on each other's `blocklet-service` instance registration.

• When `env.APP_PID` is set: pass it as the explicit `instanceDid` to `AUTH_SERVICE.registerApp()`, pass the new optional `env.APP_PSK` secret for PSK delegation, and skip `appName`/`appDescription` so we never overwrite the owner component's branding.
• When `env.APP_PID` is unset: fall back to the existing `'auto'` behaviour with Media Kit's own branding. Single-tenant deployments are unchanged.

Background

In a shared-identity deployment, all sibling workers have the same `BLOCKLET_APP_SK` / `BLOCKLET_APP_PSK` secrets but each wants blocklet-service to treat them as components of one `instance_did` (the hub's permanent DID). The current `instanceDid: 'auto'` path causes two concrete problems:

1. Destructive `migrateInstanceDid`: `registerApp()` derives a fresh DID from `APP_SK`, then `findInstancesByAppSk()` matches the sibling component's existing row under a different DID, and blocklet-service UPDATEs all `settings / memberships / security_rules / access_policies / access_keys / audit_logs / invitations` from the original DID to the newly-derived one.
2. `app:name` oscillation: Media Kit always writes `appName="Media Kit"`, overwriting the owner's branding (e.g. `"AIGNE Hub"`). The sibling component's next `registerApp()` call flips it back. On every `scheduled()` run the login page's displayed app name flickers.

Both effects were observed live against a staging deployment where `aigne-hub` + `payment-kit` + `media-kit` share `APP_PID=zNKWm5...`. After this patch the shared row stays stable.

Test plan

• Deploy to staging with `APP_PID` set, `APP_PSK` secret set, and a sibling aigne-hub worker writing the owner branding
• Verify `blocklet-service` D1 `settings` row under the shared `instance_did` retains `app:name` from the owner, not `"Media Kit"`
• Verify `app:psk` row exists under the shared `instance_did` so `buildIdentity()` returns the correct delegated `(appDid, appPid)` pair
• Verify that visiting the media-kit root path and triggering `ensureRegistered()` no longer causes `migrateInstanceDid` (row stays under the original `instance_did`)
• Verify single-tenant deploy (no `APP_PID` env var) still works unchanged

Deployment notes

Add to your wrangler config for shared-identity mode:

```toml
[vars]
APP_PID = "zNK..." # explicit permanent DID of the logical instance
```

```bash

Set the optional PSK secret (64-byte ED25519 expanded hex)

wrangler secret put APP_PSK
```

Leave both unset for single-tenant deployments — existing behaviour is preserved.

[github-actions]

AIGNE CodeSmith

[github-actions]

AIGNE CodeSmith

Commits

Files that changed from the base of the PR and between d525498 and ffe6286 commits.

Files selected (2)

• cloudflare/src/types.ts (1)
• cloudflare/src/worker.ts (1)

Files not summarized due to errors (2)

• cloudflare/src/types.ts (nothing obtained from anthropic)
• cloudflare/src/worker.ts (nothing obtained from anthropic)

Files not reviewed due to errors (2)

• cloudflare/src/types.ts (no response)
• cloudflare/src/worker.ts (no response)

Review comments generated (0)

• Review: 0
• LGTM: 0

---

提示

与 AIGNE CodeSmith (@codesmith) 聊天

• 回复此机器人留下的审查评论以提出后续问题。审查评论是对差异或文件的评论。
• 通过在回复中标记 @codesmith 邀请机器人加入审查评论链。

代码建议

• 机器人可能会提出代码建议，但在提交前请仔细审查它们，因为行号范围可能会不对齐。
• 你可以编辑机器人做出的评论，并在建议稍有偏差时手动调整。

暂停增量审查

• 在 PR 描述中的任何位置添加 @codesmith: ignore 以暂停机器人的进一步审查。