Complete ACoolCOLLECTOR production foundation, Issue #8 ecosystem, Google Cloud, and QuickBooks

.env.example

@@ -0,0 +1,105 @@
+# ACoolCOLLECTOR local configuration template
+# Copy this file to .env.local and add real values locally.
+# Never commit .env.local or paste secrets into issues, pull requests, screenshots, designs, or chat.
+
+# Server and public metadata
+PORT=3000
+APP_BASE_URL=http://localhost:3000
+PUBLIC_SITE_URL=https://acoolcollector.com
+ALLOWED_ORIGINS=http://localhost:3000
+JSON_BODY_LIMIT=12mb
+ACOOL_INVENTORY_PATH=data/processed/ACoolINVENTORY_Master.csv
+
+# SportsCardsPro current-value provider
+SPORTSCARDSPRO_API_TOKEN=
+SPORTSCARDSPRO_BASE_URL=https://www.sportscardspro.com
+ACOOL_API_DELAY_SECONDS=1.1
+ACOOL_PRICE_CACHE_HOURS=24
+
+# Private collection source and generated outputs
+ACoolCOLLECTION_MANIFEST_PATH=
+ACOOL_PRIVATE_OUTPUT_DIR=integrations/sportscardspro_pipeline/private
+
+# Earnings scenario defaults — planning assumptions only
+ACOOL_MARKETPLACE_FEE_RATE=0.13
+ACOOL_PAYMENT_FEE_RATE=0.029
+ACOOL_PAYMENT_FIXED_FEE_CENTS=30
+ACOOL_DEFAULT_SHIPPING_CENTS=500
+ACOOL_DEFAULT_INSURANCE_CENTS=0
+ACOOL_RETURN_RESERVE_RATE=0.05
+
+# Supabase Auth, PostgreSQL REST, RLS, IAM and referrals
+SUPABASE_URL=
+SUPABASE_ANON_KEY=
+SUPABASE_SERVICE_ROLE_KEY=
+
+# Gemini API / Google AI Studio prototype integration
+GEMINI_API_KEY=
+GEMINI_VISION_MODEL=
+GEMINI_AGENT_MODEL=
+GEMINI_MAX_IMAGE_BYTES=8388608
+GOOGLE_GENAI_ENVIRONMENT=developer_api
+GOOGLE_CLOUD_PROJECT_ID=
+GOOGLE_CLOUD_REGION=us-central1
+
+# Google Cloud workload authentication
+# Cloud Run should use its service account. GOOGLE_CLOUD_ACCESS_TOKEN is local-test-only and short-lived.
+GOOGLE_CLOUD_ACCESS_TOKEN=
+
+# Google Cloud Vision and Text-to-Speech
+GOOGLE_CLOUD_VISION_ENABLED=false
+GOOGLE_CLOUD_TTS_ENABLED=false
+GOOGLE_CLOUD_TTS_DEFAULT_LANGUAGE=en-US
+GOOGLE_CLOUD_TTS_DEFAULT_ENCODING=MP3
+
+# Google Maps Platform
+GOOGLE_MAPS_BROWSER_API_KEY=
+GOOGLE_MAPS_SERVER_API_KEY=
+GOOGLE_MAPS_MAP_ID=
+GOOGLE_MAPS_ALLOWED_COUNTRIES=US,CA
+GOOGLE_PLACES_FIELD_MASK=id,displayName,formattedAddress,location,websiteUri,nationalPhoneNumber
+
+# Google OAuth / People and Calendar APIs — user consent required
+GOOGLE_OAUTH_CLIENT_ID=
+GOOGLE_OAUTH_CLIENT_SECRET=
+GOOGLE_OAUTH_REDIRECT_URI=
+GOOGLE_PEOPLE_SYNC_ENABLED=false
+GOOGLE_CALENDAR_SYNC_ENABLED=false
+
+# Google Cloud managed services
+GOOGLE_CLOUD_STORAGE_BUCKET_PRIVATE=
+GOOGLE_CLOUD_STORAGE_BUCKET_PUBLIC=
+GOOGLE_CLOUD_TASKS_QUEUE=
+GOOGLE_CLOUD_PUBSUB_TOPIC=
+GOOGLE_CLOUD_KMS_KEY_NAME=
+GOOGLE_CLOUD_RECAPTCHA_SITE_KEY=
+GOOGLE_CLOUD_RECAPTCHA_PROJECT_ID=
+BIGQUERY_DATASET_ID=
+GA4_MEASUREMENT_ID=
+GOOGLE_SEARCH_CONSOLE_SITE_URL=https://acoolcollector.com/
+
+# QuickBooks Online integration
+INTUIT_CLIENT_ID=
+INTUIT_CLIENT_SECRET=
+INTUIT_REDIRECT_URI=https://api.acoolcollector.com/api/v1/quickbooks/oauth/callback
+INTUIT_ENVIRONMENT=sandbox
+INTUIT_WEBHOOK_VERIFIER_TOKEN=
+QBO_POST_CONNECT_REDIRECT_URI=https://acoolcollector.com/settings/integrations/quickbooks
+# Base64-encoded 32-byte key. Generate outside chat and store through the approved secret manager.
+QBO_TOKEN_ENCRYPTION_KEY=
+QBO_DEFAULT_CLASS_NAME=ACoolCOLLECTOR
+QBO_DEFAULT_LOCATION_NAME=Online
+QBO_AFFILIATE_INCOME_ACCOUNT_NAME=Affiliate and Partner Revenue
+QBO_AFFILIATE_PAYABLE_ACCOUNT_NAME=Affiliate Commissions Payable
+QBO_MERCHANT_FEES_ACCOUNT_NAME=Merchant Processing Fees
+
+# Affiliate and partnership governance
+AFFILIATE_DISCLOSURE_DEFAULT=ACoolCOLLECTOR may earn a commission from qualifying purchases made through clearly labeled links.
+AFFILIATE_REDIRECT_ALLOWLIST=
+AFFILIATE_CLICK_RETENTION_DAYS=90
+AFFILIATE_CONSENT_REQUIRED=true
+
+# Future payment providers — not active until provider onboarding and server integration pass review
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PUBLISHABLE_KEY=

.github/workflows/deploy-google-cloud.yml

@@ -0,0 +1,201 @@
+name: Deploy ACoolCOLLECTOR to Google Cloud
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: GitHub environment and Google Cloud target
+        required: true
+        type: choice
+        options:
+          - development
+          - production
+        default: development
+      apply:
+        description: Apply the reviewed Terraform plan
+        required: true
+        type: boolean
+        default: false
+      production_confirmation:
+        description: Type DEPLOY PRODUCTION only for a production apply
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: acoolcollector-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    env:
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+      GCP_REGION: ${{ vars.GCP_REGION || 'us-central1' }}
+      GCP_TERRAFORM_STATE_BUCKET: ${{ vars.GCP_TERRAFORM_STATE_BUCKET }}
+      PUBLIC_SITE_URL: ${{ vars.PUBLIC_SITE_URL }}
+      TERRAFORM_DIR: infra/google-cloud/terraform
+      TF_STATE_PREFIX: acoolcollector/${{ inputs.environment }}
+      IMAGE_NAME: acoolcollector-api
+      TF_VAR_environment: ${{ inputs.environment }}
+      TF_VAR_allowed_origins: ${{ vars.ALLOWED_ORIGINS_JSON || '[]' }}
+      TF_VAR_alert_email: ${{ vars.ALERT_EMAIL }}
+      TF_VAR_billing_account_id: ${{ vars.GCP_BILLING_ACCOUNT_ID }}
+      TF_VAR_monthly_budget_usd: ${{ vars.MONTHLY_BUDGET_USD || '250' }}
+      TF_VAR_enable_github_oidc: true
+      TF_VAR_github_repository: ACoolNerd/ACoolCOLLECTOR
+      TF_VAR_github_branch: main
+      PRODUCTION_CONFIRMATION: ${{ inputs.production_confirmation }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Authenticate to Google Cloud with OIDC
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOY_SERVICE_ACCOUNT }}
+          create_credentials_file: true
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Validate deployment configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$GCP_PROJECT_ID"
+          test -n "$GCP_TERRAFORM_STATE_BUCKET"
+          test -n "$PUBLIC_SITE_URL"
+          test -n "${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+          test -n "${{ vars.GCP_DEPLOY_SERVICE_ACCOUNT }}"
+          [[ "$PUBLIC_SITE_URL" == https://* ]]
+
+          if [[ "${{ inputs.environment }}" == "production" && "${{ inputs.apply }}" == "true" ]]; then
+            [[ "$PRODUCTION_CONFIRMATION" == "DEPLOY PRODUCTION" ]]
+          fi
+
+          python - <<'PY'
+          import json, os
+          value = json.loads(os.environ['TF_VAR_allowed_origins'])
+          assert isinstance(value, list)
+          assert all(isinstance(item, str) and item.startswith('https://') for item in value)
+          PY
+
+      - name: Configure Artifact Registry authentication
+        run: gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet
+
+      - name: Build immutable container
+        id: image
+        shell: bash
+        run: |
+          set -euo pipefail
+          image="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/acoolcollector/${IMAGE_NAME}:${GITHUB_SHA}"
+          docker build --pull --label "org.opencontainers.image.revision=${GITHUB_SHA}" -t "$image" src/omni-engine
+          docker push "$image"
+          digest="$(gcloud artifacts docker images describe "$image" --format='value(image_summary.digest)')"
+          test -n "$digest"
+          echo "image=$image" >> "$GITHUB_OUTPUT"
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+          echo "immutable_image=${image}@${digest}" >> "$GITHUB_OUTPUT"
+
+      - name: Terraform init and validate
+        working-directory: ${{ env.TERRAFORM_DIR }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          terraform fmt -check -recursive
+          terraform init \
+            -reconfigure \
+            -backend-config="bucket=${GCP_TERRAFORM_STATE_BUCKET}" \
+            -backend-config="prefix=${TF_STATE_PREFIX}"
+          terraform validate
+
+      - name: Build Terraform plan
+        id: plan
+        working-directory: ${{ env.TERRAFORM_DIR }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          terraform plan \
+            -out=tfplan \
+            -var="project_id=${GCP_PROJECT_ID}" \
+            -var="region=${GCP_REGION}" \
+            -var="container_image=${{ steps.image.outputs.immutable_image }}" \
+            -var="public_site_url=${PUBLIC_SITE_URL}"
+          terraform show -json tfplan > tfplan.json
+          terraform show -no-color tfplan > tfplan.txt
+          digest="$(sha256sum tfplan.json | awk '{print $1}')"
+          echo "terraform_plan_digest=$digest" >> "$GITHUB_OUTPUT"
+
+      - name: Enforce Terraform plan safety gates
+        working-directory: ${{ env.TERRAFORM_DIR }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if grep -Eq 'roles/(owner|editor)' tfplan.txt; then
+            echo "Blocked: Terraform plan contains project Owner or Editor role."
+            exit 1
+          fi
+          if grep -q 'allAuthenticatedUsers' tfplan.txt; then
+            echo "Blocked: Terraform plan contains allAuthenticatedUsers."
+            exit 1
+          fi
+          if grep -q 'public_access_prevention = "inherited"' tfplan.txt; then
+            echo "Blocked: a storage bucket does not enforce public access prevention."
+            exit 1
+          fi
+
+      - name: Upload deployment evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: acoolcollector-${{ inputs.environment }}-${{ github.sha }}-deployment-evidence
+          path: |
+            ${{ env.TERRAFORM_DIR }}/tfplan
+            ${{ env.TERRAFORM_DIR }}/tfplan.json
+            ${{ env.TERRAFORM_DIR }}/tfplan.txt
+          retention-days: 30
+
+      - name: Apply reviewed Terraform plan
+        if: ${{ inputs.apply }}
+        working-directory: ${{ env.TERRAFORM_DIR }}
+        run: terraform apply -auto-approve tfplan
+
+      - name: Verify Cloud Run health
+        if: ${{ inputs.apply }}
+        id: health
+        shell: bash
+        run: |
+          set -euo pipefail
+          url="$(gcloud run services describe acoolcollector-api --project "$GCP_PROJECT_ID" --region "$GCP_REGION" --format='value(status.url)')"
+          test -n "$url"
+          for attempt in $(seq 1 12); do
+            if curl --fail --silent --show-error --max-time 10 "${url}/health" > health.json; then
+              break
+            fi
+            sleep 10
+          done
+          test -s health.json
+          grep -q '"status":"ok"' health.json
+          echo "service_url=$url" >> "$GITHUB_OUTPUT"
+
+      - name: Deployment summary
+        shell: bash
+        run: |
+          {
+            echo "## ACoolCOLLECTOR deployment evidence"
+            echo "- Environment: ${{ inputs.environment }}"
+            echo "- Commit: ${GITHUB_SHA}"
+            echo "- Image: ${{ steps.image.outputs.immutable_image }}"
+            echo "- Terraform state: gs://${GCP_TERRAFORM_STATE_BUCKET}/${TF_STATE_PREFIX}"
+            echo "- Terraform plan digest: ${{ steps.plan.outputs.terraform_plan_digest }}"
+            echo "- Applied: ${{ inputs.apply }}"
+            echo "- Service URL: ${{ steps.health.outputs.service_url }}"
+            echo "- Monitoring notification configured: ${{ vars.ALERT_EMAIL != '' }}"
+            echo "- Budget configured: ${{ vars.GCP_BILLING_ACCOUNT_ID != '' }}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/native-app-foundations.yml

@@ -0,0 +1,79 @@
+name: Native App Foundations
+
+on:
+  pull_request:
+    paths:
+      - "apps/android-native/**"
+      - "apps/apple-native/**"
+      - "schemas/acool-profile.schema.json"
+      - ".github/workflows/native-app-foundations.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-app-foundations-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  android-native:
+    name: Android native build and tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - uses: android-actions/setup-android@v3
+
+      - name: Install stable Android API 36
+        shell: bash
+        run: |
+          set -euo pipefail
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager "platforms;android-36" "build-tools;36.0.0" "platform-tools"
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: "9.4.1"
+
+      - name: Build and test Android app
+        shell: bash
+        run: |
+          set -euo pipefail
+          gradle \
+            -p apps/android-native \
+            testDebugUnitTest \
+            assembleDebug \
+            --stacktrace
+
+      - name: Upload Android debug artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: acoolcollector-android-debug-${{ github.sha }}
+          path: apps/android-native/build/outputs/apk/debug/*.apk
+          retention-days: 7
+          if-no-files-found: error
+
+  apple-native:
+    name: Apple native package build and tests
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Record Apple toolchain
+        run: |
+          xcodebuild -version
+          swift --version
+
+      - name: Build Apple native package
+        run: swift build --package-path apps/apple-native
+
+      - name: Test Apple native package
+        run: swift test --package-path apps/apple-native