create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/bin/deliverable-upload.ts

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; mirrors abandon-sweep.ts's coverage-ignore
+   rationale — real entry-point semantics run the compiled dist directly, and
+   the DB write it performs (prisma.deliverableAsset.upsert) is exercised
+   through the same mocked-prisma double the service-layer tests already use
+   (apps/api/src/lib/__mocks__/prisma.ts § deliverableAsset). This file is a
+   thin entry: parse args, read the file, refuse the size cap, upsert. */
+/**
+ * Deliverable-asset upload CLI (#3961 D6).
+ *
+ * Dev: `pnpm --filter @working-theory/api deliverable:upload -- --site <siteId>
+ * --key <key> --file <path> [--content-type <ct>] [--filename <name>]`.
+ * Production: `node dist/bin/deliverable-upload.js <same flags>`.
+ *
+ * No HTTP upload route exists (spec §2.2) — this CLI is the sole write path
+ * for `DeliverableAsset` rows, run by the operator on their own machine/CI,
+ * never by a customer or agent request. Re-upload (same siteId + key)
+ * REPLACES the stored bytes (upsert) — the config's `assetKey` reference
+ * never changes, so a content update is a re-run of this command.
+ *
+ * The 20 MB cap is a CLI guard, not a schema constraint (Postgres `bytea`
+ * has no practical limit at launch volumes) — it keeps the DB-storage
+ * choice (D1) honest until the blob-storage upgrade path is taken.
+ */
+import { readFileSync, statSync } from "node:fs";
+import { basename } from "node:path";
+
+import { prisma } from "../lib/prisma.js";
+
+const MAX_BYTES = 20 * 1024 * 1024; // 20 MB (D6)
+const DEFAULT_CONTENT_TYPE = "application/octet-stream";
+
+type ParsedArgs = {
+  siteId?: string | undefined;
+  key?: string | undefined;
+  file?: string | undefined;
+  contentType?: string | undefined;
+  filename?: string | undefined;
+};
+
+/** Minimal `--flag value` parser — no external dependency for a 5-flag CLI. */
+function parseArgs(argv: string[]): ParsedArgs {
+  const out: ParsedArgs = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const flag = argv[i];
+    const value = argv[i + 1];
+    if (flag === "--site") out.siteId = value;
+    else if (flag === "--key") out.key = value;
+    else if (flag === "--file") out.file = value;
+    else if (flag === "--content-type") out.contentType = value;
+    else if (flag === "--filename") out.filename = value;
+    else continue;
+    i += 1;
+  }
+  return out;
+}
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2));
+
+  if (!args.siteId || !args.key || !args.file) {
+    console.error(
+      "[deliverable-upload] usage: --site <siteId> --key <key> --file <path> " +
+        "[--content-type <ct>] [--filename <name>]",
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const stat = statSync(args.file);
+  if (stat.size > MAX_BYTES) {
+    console.error(
+      `[deliverable-upload] refused: ${args.file} is ${stat.size} bytes, ` +
+        `exceeds the ${MAX_BYTES}-byte (20 MB) cap`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const bytes = readFileSync(args.file);
+  const filename = args.filename ?? basename(args.file);
+  const contentType = args.contentType ?? DEFAULT_CONTENT_TYPE;
+
+  const row = await prisma.deliverableAsset.upsert({
+    where: { siteId_key: { siteId: args.siteId, key: args.key } },
+    create: {
+      siteId: args.siteId,
+      key: args.key,
+      filename,
+      contentType,
+      bytes,
+      size: stat.size,
+    },
+    update: {
+      filename,
+      contentType,
+      bytes,
+      size: stat.size,
+    },
+    select: { key: true },
+  });
+
+  console.log(`[deliverable-upload] uploaded key="${row.key}"`);
+}
+
+main().catch((err: unknown) => {
+  // Belt-and-suspenders (mirrors abandon-sweep.ts) — main() has no
+  // internal catch of its own, so an unexpected throw (a bad DB
+  // connection, a filesystem error mid-read) still exits non-zero with a
+  // structured message rather than an unhandled-rejection crash.
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[deliverable-upload] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/bin/followup-sweep.ts

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; the underlying
+   runWaitlistFollowUpSweep logic is unit-tested in
+   services/__tests__/waitlist-followup.test.ts. Mirrors abandon-sweep.ts's
+   coverage-ignore rationale — real entry-point semantics run the compiled
+   dist directly, on the operator's own cron/scheduler cadence (D1: no
+   queue/timer infrastructure in this repo — an external scheduler runs this
+   command on whatever cadence the deployment chooses). */
+/**
+ * Waitlist follow-up sweep CLI entry (#4732 D1).
+ *
+ * Dev: `pnpm --filter @working-theory/api followup:sweep` (tsx, this file).
+ * Production: `node dist/bin/followup-sweep.js` (the compiled entry, run by
+ * any external scheduler — Vercel Cron, GitHub Actions cron, plain crontab).
+ * The sweep is stateless and idempotent (the `waitlist_followup_sends`
+ * `@@unique([leadId, followUpKey])` guarantee), so overlap or a missed tick
+ * is harmless — the offset window is data, not a timer.
+ */
+import { runWaitlistFollowUpSweep } from "../services/waitlist-followup.js";
+
+async function main(): Promise<void> {
+  const result = await runWaitlistFollowUpSweep();
+
+  if (!result.ok) {
+    console.error(
+      `[followup-sweep] ${result.error.kind}: ${result.error.message}`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(`[followup-sweep] ${JSON.stringify(result.summary)}`);
+}
+
+main().catch((err: unknown) => {
+  // Belt-and-suspenders (mirrors abandon-sweep.ts): runWaitlistFollowUpSweep
+  // already catches internally and returns a structured `unexpected_error`
+  // result, so this path is unreachable in practice — it exists only to
+  // prevent a bare unhandled-rejection crash if `main` itself ever throws
+  // before/around that call.
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[followup-sweep] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/bin/listing-csv-sweep.ts

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; the underlying runListingCsvSweep
+   logic is unit-tested in services/__tests__/listing-csv-sweep.test.ts.
+   Mirrors followup-sweep.ts's coverage-ignore rationale — real entry-point
+   semantics run the compiled dist directly, on the operator's own
+   cron/scheduler cadence (D1: no queue/timer infrastructure in this repo —
+   an external scheduler runs this command on whatever cadence the deployment
+   chooses). */
+/**
+ * Weekly founder-CSV sweep CLI entry (#5001).
+ *
+ * Dev: `pnpm --filter @working-theory/api listing-csv:sweep` (tsx, this file).
+ * Production: `node dist/bin/listing-csv-sweep.js` (the compiled entry, run by
+ * any external scheduler — Vercel Cron, GitHub Actions cron, plain crontab).
+ * The consumer schedules this WEEKLY; this repo adds no cron of its own.
+ *
+ * The sweep is stateless and idempotent: a listing with no `WaitlistScore`
+ * newer than its last `ListingCsvSend` sends nothing, so an extra tick is a
+ * no-op and a missed tick simply widens the next CSV's window.
+ */
+import { runListingCsvSweep } from "../services/listing-csv-sweep.js";
+
+async function main(): Promise<void> {
+  const result = await runListingCsvSweep();
+
+  if (!result.ok) {
+    console.error(
+      `[listing-csv-sweep] ${result.error.kind}: ${result.error.message}`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(`[listing-csv-sweep] ${JSON.stringify(result.summary)}`);
+}
+
+main().catch((err: unknown) => {
+  // Belt-and-suspenders (mirrors followup-sweep.ts): runListingCsvSweep
+  // already catches internally and returns a structured `unexpected_error`
+  // result, so this path is unreachable in practice — it exists only to
+  // prevent a bare unhandled-rejection crash if `main` itself ever throws
+  // before/around that call.
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[listing-csv-sweep] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/bin/seed-presets.ts

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; the underlying seedFlowPresets logic
+   is unit-tested in services/__tests__/flow-engine.test.ts. Mirrors
+   bin/abandon-sweep.ts's coverage-ignore rationale — real entry-point
+   semantics run the compiled dist directly. */
+/**
+ * Flow-preset seed CLI entry (#3958 §3.3).
+ *
+ * Writes the three static capture presets (form, waitlist, lead-magnet —
+ * `@working-theory/database/flows/presets`) through the existing validated
+ * `upsertFlowDefinition` path, for the current site (`currentSiteId()`,
+ * `lib/site.ts`) — the same site id the `/v1/flows/*` routes resolve against,
+ * so a preset is never written somewhere the routes can't find it.
+ *
+ * Dev: `pnpm --filter @working-theory/api seed:presets` (tsx, this file).
+ * Production: `node dist/bin/seed-presets.js` (the compiled entry, run once
+ * per site by the operator — idempotent: `upsertFlowDefinition` upserts on
+ * `[siteId, slug]`, so a re-run overwrites cleanly rather than duplicating).
+ *
+ * This entry point is the placement chosen for #3958's operator-facing
+ * invocation (spec §3.3 / §7 item 1 — the implementer's choice, both
+ * placements bounded and reversible): `apps/api/src/bin/` already hosts
+ * exactly this shape of one-off operator command (`abandon-sweep.ts`), so it
+ * is the closer fit to "the existing apps/api CLI surface" than adding
+ * argv-verb parsing to `cli.ts`, which today does nothing but bootstrap the
+ * long-running server.
+ */
+import { FLOW_PRESETS } from "@working-theory/database/flows/presets";
+
+import { currentSiteId } from "../lib/site.js";
+import { seedFlowPresets } from "../services/flow-engine.js";
+
+async function main(): Promise<void> {
+  const siteId = currentSiteId();
+  const result = await seedFlowPresets(siteId, FLOW_PRESETS);
+
+  if (!result.ok) {
+    console.error(
+      `[seed-presets] ${result.error.kind}: ${result.error.message} (seeded before failure: ${result.seeded.join(", ") || "none"})`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(
+    `[seed-presets] seeded for site "${siteId}": ${result.seeded.join(", ")}`,
+  );
+}
+
+main().catch((err: unknown) => {
+  // Belt-and-suspenders, mirroring abandon-sweep.ts: seedFlowPresets already
+  // returns a structured failure rather than throwing, so this path exists
+  // only to prevent a bare unhandled-rejection crash if `main` itself ever
+  // throws before/around that call.
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[seed-presets] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/bin/seed-waitlist-experiments.ts

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; the underlying seedWaitlistExperiments
+   logic is unit-tested in services/__tests__/waitlist-experiments.test.ts.
+   Mirrors bin/seed-presets.ts's coverage-ignore rationale. */
+/**
+ * Waitlist-experiment seed CLI entry (#4661 D5).
+ *
+ * Reads one or more experiment-config JSON paths from argv, resolves any
+ * `questionSetRef` / `scoringRef` / `sourceTrackingRef` path (relative to the
+ * config file) into the embedded objects, and writes them through the
+ * existing validated `seedWaitlistExperiments` path, for the current site
+ * (`currentSiteId()`, `lib/site.ts`) — the same bootstrap shape as
+ * `seed-presets.ts`.
+ *
+ * `seedWaitlistExperiments` does MORE than write `waitlist_experiments`
+ * (#4726): for each config it also compiles + upserts one `flow_definitions`
+ * row per `waitlists[]` entry (`materializeWaitlistFlows`,
+ * `waitlist-experiments.ts`) — the step `GET /v1/flows/:flowSlug`
+ * (`serveFlow`, `flow-engine.ts`) actually reads. A single run of this bin
+ * is therefore sufficient to make every declared waitlist servable; a
+ * compile failure (`unknown_waitlist` / `unsupported_by_engine`) or a
+ * `flow_definitions` write failure exits this process non-zero, naming the
+ * failing waitlist key, and writes no `flow_definitions` row for it.
+ *
+ * Dev: `pnpm --filter @working-theory/api tsx src/bin/seed-waitlist-experiments.ts <config.json>...`
+ * Production: `node dist/bin/seed-waitlist-experiments.js <config.json>...` —
+ * idempotent (`upsertWaitlistExperiment` upserts on `[siteId, key]`;
+ * `upsertFlowDefinition` upserts on `[siteId, slug]`).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+import { currentSiteId } from "../lib/site.js";
+import { seedWaitlistExperiments } from "../services/waitlist-experiments.js";
+
+/**
+ * A `*Ref` field on the config is a path RELATIVE to the config file (D5),
+ * mapped to the embedded field name `waitlistExperimentConfigSchema`
+ * actually declares. An EXPLICIT map, not a `Ref$` suffix strip —
+ * `sourceTrackingRef` embeds as `tracking` (not `sourceTracking`), which a
+ * generic strip gets wrong (code-review finding, #4661).
+ */
+const REF_FIELD_MAP: Record<string, string> = {
+  questionSetRef: "questionSet",
+  scoringRef: "scoring",
+  sourceTrackingRef: "tracking",
+};
+
+function readJson(path: string): unknown {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+/**
+ * Resolve every `*Ref` path on a raw config object relative to `configPath`
+ * into the embedded object it names, mirroring the site-plan projection's
+ * config-time `*Ref` convention (D5/D7) — the runtime never reads these
+ * paths; this bin resolves them once, at seed time.
+ */
+function resolveConfigRefs(raw: unknown, configPath: string): unknown {
+  if (typeof raw !== "object" || raw === null) return raw;
+  const resolved: Record<string, unknown> = { ...(raw as Record<string, unknown>) };
+  const base = dirname(configPath);
+  for (const [field, embeddedField] of Object.entries(REF_FIELD_MAP)) {
+    const value = resolved[field];
+    if (typeof value === "string") {
+      resolved[embeddedField] = readJson(resolve(base, value));
+      delete resolved[field];
+    }
+  }
+  return resolved;
+}
+
+async function main(): Promise<void> {
+  const configPaths = process.argv.slice(2);
+  if (configPaths.length === 0) {
+    console.error("[seed-waitlist-experiments] usage: <config.json>...");
+    process.exitCode = 1;
+    return;
+  }
+
+  const siteId = currentSiteId();
+  const configs = configPaths.map((path) =>
+    resolveConfigRefs(readJson(path), path),
+  );
+  const result = await seedWaitlistExperiments(siteId, configs);
+
+  if (!result.ok) {
+    console.error(
+      `[seed-waitlist-experiments] ${result.error.kind}: ${result.error.message} (seeded before failure: ${result.seeded.join(", ") || "none"})`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(
+    `[seed-waitlist-experiments] seeded for site "${siteId}": ${result.seeded.join(", ")}`,
+  );
+}
+
+main().catch((err: unknown) => {
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[seed-waitlist-experiments] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/bin/session-retention-sweep.ts

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/* istanbul ignore file -- CLI bootstrap; the underlying cleanupAbandonedSessions
+   logic is unit-tested in services/__tests__/flow-engine.test.ts. Mirrors
+   abandon-sweep.ts's coverage-ignore rationale — real entry-point semantics
+   run the compiled dist directly, on the operator's own cron/scheduler
+   cadence (no queue/timer infrastructure in this repo — an external
+   scheduler runs this command on whatever cadence the deployment
+   chooses). */
+/**
+ * FlowSession retention/cleanup sweep CLI entry (#3974 AC3).
+ *
+ * Dev: `pnpm --filter @working-theory/api retention:sweep` (tsx, this file).
+ * Production: `node dist/bin/session-retention-sweep.js` (the compiled
+ * entry, run by any external scheduler — Vercel Cron, GitHub Actions cron,
+ * plain crontab). Deletes abandoned FlowSession rows past the retention
+ * window (default 90 days) — see `cleanupAbandonedSessions`'s own doc
+ * comment in ../services/flow-engine.ts for the full policy + its #3962
+ * abandon-email coordination.
+ */
+import { cleanupAbandonedSessions } from "../services/flow-engine.js";
+
+async function main(): Promise<void> {
+  const result = await cleanupAbandonedSessions();
+
+  if (!result.ok) {
+    console.error(
+      `[session-retention-sweep] ${result.error.kind}: ${result.error.message}`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(`[session-retention-sweep] deleted=${result.deleted}`);
+}
+
+main().catch((err: unknown) => {
+  // cleanupAbandonedSessions only returns a structured error for the
+  // DB-not-configured case (requireDb's guard) — a genuine prisma/DB
+  // exception propagates as a rejected promise, exactly like every other
+  // flow-engine.ts function (none of them wrap unexpected DB errors
+  // internally). This is that failure's landing spot, so it degrades to a
+  // clean process-exit rather than a bare unhandled-rejection crash.
+  const message = err instanceof Error ? err.message : "Unknown error";
+  console.error(`[session-retention-sweep] unexpected_error: ${message}`);
+  process.exitCode = 1;
+});

package/templates/apps/api/src/cli.ts

@@ -15,16 +15,10 @@ import { start } from './index.js';
 // Only start if this is the main module
 // Check if executed file matches current file using import.meta.url
 if (process.argv[1]) {
-  const isEntryPoint = process.argv[1].endsWith('dist/cli.js') || 
-                       process.argv[1].endsWith('cli.js');
-  
-  if (isEntryPoint) {
-    // ESM-accurate verification using import.meta.url
-    const currentFileUrl = import.meta.url;
-    const executedFileUrl = pathToFileURL(process.argv[1]).href;
-    
-    if (currentFileUrl === executedFileUrl) {
-      void start();
-    }
+  const currentFileUrl = import.meta.url;
+  const executedFileUrl = pathToFileURL(process.argv[1]).href;
+
+  if (currentFileUrl === executedFileUrl) {
+    void start();
   }
 }

package/templates/apps/api/src/config/index.ts

@@ -21,6 +21,24 @@ export interface Config {
   // Stripe — consumed by apps/api/src/lib/stripe.ts via @working-theory/stripe-client wrapper
   STRIPE_SECRET_KEY?: string;
   STRIPE_WEBHOOK_SECRET?: string;
+
+  // Slack — the project-listings approve/reject workflow (#4999). Consumed
+  // by services/slack-notify.ts (bot token + channel) and
+  // routes/slack/actions.ts (signing secret, for X-Slack-Signature
+  // verification). All three optional; absent means "Slack off" — a create
+  // still succeeds, it just skips the notification.
+  AILK_SLACK_BOT_TOKEN?: string;
+  AILK_SLACK_SIGNING_SECRET?: string;
+  AILK_SLACK_CHANNEL_ID?: string;
+
+  // GitHub issue filing — the approve-time build-issue workflow (#5000).
+  // Consumed by services/project-listing-issue.ts: AILK_GITHUB_REPO is the
+  // site's own `owner/name` (never this repo); AILK_GITHUB_TOKEN is a
+  // fine-grained token scoped to `issues:write` on that one repo. Both
+  // optional; absent means "filing off" — approve still succeeds, and the
+  // row's issueUrl stays null for a later retry via the PATCH route.
+  AILK_GITHUB_REPO?: string;
+  AILK_GITHUB_TOKEN?: string;
 }
 
 function validateConfig(): Config {
@@ -50,6 +68,23 @@ function validateConfig(): Config {
     ...(process.env.STRIPE_WEBHOOK_SECRET !== undefined && {
       STRIPE_WEBHOOK_SECRET: process.env.STRIPE_WEBHOOK_SECRET,
     }),
+
+    ...(process.env.AILK_SLACK_BOT_TOKEN !== undefined && {
+      AILK_SLACK_BOT_TOKEN: process.env.AILK_SLACK_BOT_TOKEN,
+    }),
+    ...(process.env.AILK_SLACK_SIGNING_SECRET !== undefined && {
+      AILK_SLACK_SIGNING_SECRET: process.env.AILK_SLACK_SIGNING_SECRET,
+    }),
+    ...(process.env.AILK_SLACK_CHANNEL_ID !== undefined && {
+      AILK_SLACK_CHANNEL_ID: process.env.AILK_SLACK_CHANNEL_ID,
+    }),
+
+    ...(process.env.AILK_GITHUB_REPO !== undefined && {
+      AILK_GITHUB_REPO: process.env.AILK_GITHUB_REPO,
+    }),
+    ...(process.env.AILK_GITHUB_TOKEN !== undefined && {
+      AILK_GITHUB_TOKEN: process.env.AILK_GITHUB_TOKEN,
+    }),
   };
 }
 

package/templates/apps/api/src/config/modules.ts

@@ -0,0 +1,43 @@
+/**
+ * Paid-module presence — the registration-grain signal used by `server.ts`
+ * to decide whether a paid module's routes (and their imports) are wired
+ * into this build (S1, #5088).
+ *
+ * `AILK_ENABLED_MODULES` is a comma-separated allowlist (e.g.
+ * `"multi-tenant,scheduling"`). Unset means "every module on" — today's
+ * behavior, unchanged for every existing deployment; an explicit empty
+ * string (`""`) means "no paid modules" (the OSS-strip build target). This
+ * mirrors `shouldMountTestAuth()`'s fail-open-by-default / explicit-opt-in
+ * shape elsewhere in this file's sibling config.
+ *
+ * Recognized module keys: `docs`, `multi-tenant`, `scheduling` (the
+ * `ModuleName` vocabulary `packages/create-ailk/src/module-architecture.ts`
+ * already models via `MODULE_SLICES`) plus `content-write` — the Pro
+ * content-write surface (`create`/`update`/`delete` under
+ * `apps/api/src/routes/content/`). `content-write` is intentionally NOT a
+ * `MODULE_SLICES` entry: it is not (yet) a `create-ailk --modules`
+ * selector — a customer never opts into it at scaffold time, it is a
+ * license-tier line drawn inside the single `apps/api` app — so it stays a
+ * local registration flag here rather than widening the create-ailk module
+ * vocabulary. This function does not validate its input against that list;
+ * it is a thin string-set reader so `apps/api` has no reason to import
+ * create-ailk's module types (outside its package allowlist anyway).
+ */
+
+function enabledModules(): Set<string> | undefined {
+  const raw = process.env.AILK_ENABLED_MODULES;
+  if (raw === undefined) return undefined; // undefined sentinel = "all enabled"
+  return new Set(
+    raw
+      .split(',')
+      .map((m) => m.trim())
+      .filter(Boolean),
+  );
+}
+
+/** Whether the named paid module's routes should register on this build/boot. */
+export function isModuleEnabled(moduleName: string): boolean {
+  const enabled = enabledModules();
+  if (enabled === undefined) return true;
+  return enabled.has(moduleName);
+}

package/templates/apps/api/src/lib/__mocks__/prisma-client.js

@@ -10,6 +10,17 @@ const MockPrismaClient = jest.fn().mockImplementation((options) => ({
   userData: {},
 }));
 
+// #4663 D6 — flow-engine.ts imports the real `Prisma` runtime namespace (a
+// VALUE, not just a type) to write the `Prisma.JsonNull` sentinel on a
+// nullable Json column reset. Real distinct sentinel objects, matching the
+// generated client's own runtime shape closely enough for identity checks
+// (`toBe(Prisma.JsonNull)`) in tests.
+const Prisma = {
+  JsonNull: Symbol("Prisma.JsonNull"),
+  DbNull: Symbol("Prisma.DbNull"),
+};
+
 module.exports = {
   PrismaClient: MockPrismaClient,
+  Prisma,
 };