@assembly-js/app-foundation 0.0.27 → 0.0.28

package/CLAUDE.md

@@ -52,6 +52,7 @@ Assembly-specific gotchas live in `.claude/skills/<name>/SKILL.md`. Invoke them
 - `assembly-semantic-colors` — semantic color variants (info, success, warning, destructive) for Badge and Alert
 - `assembly-workspace-labels` — workspace-customized display labels for clients/companies. The server helper comes from `@assembly-js/app-foundation/server`, the `useLabels()` hook from the repo — import them, don't rewrite them.
 - `assembly-db-transactions` — REQUIRED when a route makes more than one DB write: `db.transaction()` is unsupported on neon-http and 500s. Use `db.batch([...])` for atomic multi-writes, sequential awaits otherwise.
+- `assembly-record-writes` — REQUIRED when a form creates a record that a later save also writes, especially with nested rows (packages, add-ons, line items, blocks): create and save call one writer so create cannot drop submitted fields.
 - `assembly-session-token` — the bearer lifecycle and how to read identity or fetch data: `getSessionIdentity()`/`useAssembly()`, `useServerAction`/`callAction`, `authFetch`. You never handle a token yourself.
 - `assembly-route-auth` — REQUIRED on every `app/api/.../[id]/route.ts` handler: `requireAuth` + `requireCompanyScope` before returning or mutating data.
 - `assembly-scheduled-work` — REQUIRED when the prompt implies anything on a schedule or while nobody has the app open (remind, daily digest, every week, follow up in N days, at a specific time): one `*/30 * * * *` Vercel cron in `vercel.json` hitting one dispatcher route, every scheduled action a row in a schedule table, `CRON_SECRET` declared in `requiredSecrets` and verified on every tick, `getOfflineAssembly()` for platform calls. Checking for due work on page load ships a schedule that never fires.
@@ -349,6 +350,7 @@ export const items = pgTable('items', {
 - Use `drizzle-kit push` (not `migrate`) — no migration files; schema is pushed directly.
 - Use `@neondatabase/serverless` with `drizzle-orm/neon-http` — not `pg` or `postgres.js`. It's the standard driver for the Vercel serverless (Node) runtime this app deploys to; `lib/db.ts` already wires it up.
 - **No interactive transactions.** `db.transaction(async (tx) => …)` is unsupported on neon-http and throws (a 500). For atomic multi-writes use `db.batch([...])`; otherwise sequential `await`s. See the `assembly-db-transactions` skill.
+- **Create writes every field the create form submits.** If a later save writes nested rows (packages, add-ons, blocks), create calls that same writer with the submitted payload. A success toast and a redirect to the editor do not save. See `assembly-record-writes`.
 - `DATABASE_URL` is already in the shell env. Do NOT hardcode it or write it to `.env.local`.
 - Use `db` from `lib/db.ts` in **server components, server actions, and route handlers only** — never in client components. This is enforced: `lib/db.ts` imports `server-only`, so pulling it (or anything that imports it, e.g. a lib file re-exporting constants) into a `'use client'` module fails `bun run build`. Keep client-shared constants/types in their own file, not next to server queries.
 - **Validate values before they hit typed columns — not because they arrived as route params.** Route segments can be slugs or external ids. When the next step is a uuid-column lookup, use `parseUuid` / `isUuid` from `@assembly-js/app-foundation/server` so a bad value 400/404s instead of Postgres throwing `invalid input syntax for type uuid`. In server components/pages: `if (!isUuid(id)) notFound()` before the query.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.27",
+  "version": "0.0.28",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [

package/skills/assembly-record-writes/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: assembly-record-writes
+description: REQUIRED when a form creates a persisted record that a later save or update also writes, especially when the payload includes nested rows (packages, add-ons, line items, blocks, children). Create and save must call one writer so create cannot drop fields the form submitted. A success toast after create does not mean those rows were stored.
+---
+
+A create form often submits the same payload a later edit form saves: parent columns plus nested collections. If create inserts only the parent (and maybe one child table and an audit event) while save writes the rest, the first submit looks successful and the editor opens empty. The redirect after create does not call save.
+
+## The rule
+
+One function writes the submitted payload. Create calls it for a new id; save calls it for an existing id.
+
+```ts
+async function writeProposal(id: string, input: ProposalInput) {
+  await db.insert(proposals).values({ id, title: input.title, intro: input.intro })
+    .onConflictDoUpdate({ target: proposals.id, set: { title: input.title, intro: input.intro } });
+  await replaceRows(packages, id, input.packages);
+  await replaceRows(addOns, id, input.addOns);
+  await replaceRows(blocks, id, input.blocks);
+}
+
+export async function createProposal(input: ProposalInput) {
+  const id = crypto.randomUUID();
+  await writeProposal(id, input);
+  await recordEvent(id, 'draft_created');
+  return id;
+}
+
+export async function saveProposal(id: string, input: ProposalInput) {
+  await writeProposal(id, input);
+}
+```
+
+Leave these off the shared payload. They belong to the path that owns them:
+
+- ids, timestamps, a draft status, an audit-event row
+- a control flag that chooses an action (for example "send immediately") and is not itself stored, unless save stores that same flag
+- fields that appear only on a later edit form
+
+If the form submits it, the create call chain writes it, including by calling the shared writer.