create-ailk 0.12.0 → 0.13.0

package/templates/database/__tests__/build.test.ts

@@ -0,0 +1,131 @@
+/**
+ * @file build.test.ts
+ * @description The package `build` cannot emit a stale generated client
+ * (#7565). `build` used to be `tsc -b` alone: it never ran `prisma generate`,
+ * and `tsc -b` trusts `tsconfig.build.tsbuildinfo`, so a checkout whose
+ * generated client predated a schema change built — and reported as built —
+ * a dist missing the new models (database@0.14.0 shipped without
+ * FlowCheckout, database@0.34.0 without Spoke).
+ *
+ * The suite runs the package's REAL scripts and tsconfigs against a copy of
+ * the package in a temp dir, so it never touches this package's generated
+ * client or dist (the tenancy/flows configs still build `packages/ids` and
+ * `packages/validation` in place when those are stale, as any database build
+ * does). The copy keeps the real model-free `schema.prisma`
+ * (generator + datasource) and swaps the namespace schemas for one probe
+ * model, which keeps both builds to seconds. `node_modules` and the sibling
+ * `packages/` the tenancy/flows configs reference are symlinked in, and the
+ * root `tsconfig.base.json` is copied to where `extends` expects it.
+ */
+
+import { execFileSync } from "node:child_process";
+import {
+  cpSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PACKAGE_DIR = join(__dirname, "..");
+const REPO_ROOT = join(PACKAGE_DIR, "..");
+
+const PACKAGE_FILES = [
+  "package.json",
+  "prisma.config.ts",
+  "schema.prisma",
+  "tenancy.ts",
+  "tsconfig.build.json",
+  "tsconfig.tenancy.json",
+  "tsconfig.flows.json",
+];
+
+const BUILD_TIMEOUT_MS = 180_000;
+
+let root: string;
+let db: string;
+
+function run(script: string): void {
+  try {
+    execFileSync("pnpm", ["run", script], { cwd: db, stdio: "pipe" });
+  } catch (error) {
+    // tsc reports type errors on stdout, which execFileSync's message omits.
+    const { stdout } = error as { stdout?: Buffer };
+    throw new Error(`pnpm run ${script} failed:\n${stdout?.toString() ?? ""}`, {
+      cause: error,
+    });
+  }
+}
+
+function addModel(name: string): void {
+  writeFileSync(
+    join(db, `${name}.prisma`),
+    `model ${name} {\n  id String @id\n}\n`,
+  );
+}
+
+function emitted(file: string): string {
+  return readFileSync(join(db, "dist", "client", "internal", file), "utf8");
+}
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), "ailk-database-build-"));
+  db = join(root, "database");
+  cpSync(
+    join(REPO_ROOT, "tsconfig.base.json"),
+    join(root, "tsconfig.base.json"),
+  );
+  symlinkSync(join(REPO_ROOT, "packages"), join(root, "packages"), "dir");
+  for (const file of PACKAGE_FILES) {
+    cpSync(join(PACKAGE_DIR, file), join(db, file));
+  }
+  cpSync(join(PACKAGE_DIR, "flows"), join(db, "flows"), { recursive: true });
+  symlinkSync(
+    join(PACKAGE_DIR, "node_modules"),
+    join(db, "node_modules"),
+    "dir",
+  );
+
+  // The state every release that shipped a stale client started from: the
+  // client was generated and built once, and tsc -b recorded it as built.
+  addModel("BuildProbeAlpha");
+  run("db:generate");
+}, BUILD_TIMEOUT_MS);
+
+afterAll(() => {
+  if (root) rmSync(root, { recursive: true, force: true });
+});
+
+describe("@working-theory/database build", () => {
+  it(
+    "emits a model added to the schema after the last build, despite an existing tsconfig.build.tsbuildinfo",
+    () => {
+      expect(existsSync(join(db, "tsconfig.build.tsbuildinfo"))).toBe(true);
+      expect(emitted("class.d.ts")).not.toContain("buildProbeBravo");
+
+      addModel("BuildProbeBravo");
+      run("build");
+
+      expect(emitted("class.d.ts")).toContain("get buildProbeBravo()");
+      expect(emitted("class.js")).toContain("BuildProbeBravo");
+    },
+    BUILD_TIMEOUT_MS,
+  );
+
+  it(
+    "re-emits a deleted dist/client although the generated sources did not change",
+    () => {
+      rmSync(join(db, "dist", "client"), { recursive: true, force: true });
+
+      run("build");
+
+      expect(emitted("class.d.ts")).toContain("get buildProbeAlpha()");
+      expect(emitted("class.js")).toContain("BuildProbeAlpha");
+    },
+    BUILD_TIMEOUT_MS,
+  );
+});

package/templates/database/auth/schema.prisma

@@ -82,6 +82,8 @@ model Organization {
   memberships Membership[]
   invitations Invitation[]
   workspaces  Workspace[]
+  // #3591 — the agents (delegates) of this organization's members.
+  agents      Agent[]
 
   @@unique([billingProvider, billingCustomerId])
   @@map("organizations")
@@ -102,6 +104,8 @@ model Workspace {
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   // #7532 — the hub's spoke registry rows bound to this workspace.
   spokes       Spoke[]
+  // #3591 — the agents bound to this workspace.
+  agents       Agent[]
 
   @@unique([organizationId, slug])
   @@index([organizationId])
@@ -137,6 +141,59 @@ model Spoke {
   @@map("spokes")
 }
 
+/// AgentPermissionLevel — an agent's ceiling (#3591, spec
+/// docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D5). The agent
+/// acts with the LOWER of its person's `Role` and this. One value in v1;
+/// raising the ceiling later is a new value here and in
+/// `@working-theory/validation`'s `AGENT_PERMISSION_LEVELS`.
+enum AgentPermissionLevel {
+  member
+}
+
+/// Agent — a stored delegate of ONE person, bound to ONE workspace (#3591,
+/// spec docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D2).
+///
+/// The agent signs in with a key (`ailk_agt_…`, shown once) and passes the
+/// same tenant guard a browser session does, through its person's live
+/// `Membership` (`responsibleMembershipId`). Removing that membership deletes
+/// the agent (the FK below), so a re-invite cannot revive it.
+///
+/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
+/// recognisable `credentialPrefix`; the key itself never is.
+/// `keyIssuedToMembershipId` is the owner or admin who created or last
+/// re-keyed the agent — the only person who has seen its key. Removing that
+/// membership sets the column null and the guard refuses the agent until it
+/// is re-keyed. `createdByUserId` is a plain column with no relation, so
+/// deleting the creator does not delete the agents they made for others.
+/// `apps/api/src/lib/agent-store.ts` is the only file that names
+/// `prisma.agent`.
+model Agent {
+  id                      String               @id @default(dbgenerated("('agent_'::text || (uuidv7())::text)")) @db.Text
+  organizationId          String               @map("organization_id")
+  workspaceId             String               @map("workspace_id")
+  responsibleMembershipId String               @map("responsible_membership_id")
+  name                    String               @db.VarChar(80)
+  permissionLevel         AgentPermissionLevel @default(member) @map("permission_level")
+  enabled                 Boolean              @default(true)
+  credentialHash          String               @unique @map("credential_hash") @db.Char(64)
+  credentialPrefix        String               @map("credential_prefix") @db.VarChar(24)
+  lastActiveAt            DateTime?            @map("last_active_at")
+  createdByUserId         String               @map("created_by_user_id")
+  keyIssuedToMembershipId String?              @map("key_issued_to_membership_id")
+  createdAt               DateTime             @default(now()) @map("created_at")
+  updatedAt               DateTime             @updatedAt @map("updated_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  workspace    Workspace    @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  responsible  Membership   @relation("AgentResponsible", fields: [responsibleMembershipId], references: [id], onDelete: Cascade)
+  keyIssuedTo  Membership?  @relation("AgentKeyIssuedTo", fields: [keyIssuedToMembershipId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+  @@index([workspaceId])
+  @@index([responsibleMembershipId])
+  @@map("agents")
+}
+
 /// Membership — User ↔ Organization with a Role. Managed by the Better Auth
 /// organization plugin (modelName "membership"). Org-level: grants visibility
 /// into every workspace of the organization.
@@ -149,6 +206,10 @@ model Membership {
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)
+  // #3591 — the agents this person is responsible for, and the agents whose
+  // current key this person was the one shown.
+  agents          Agent[] @relation("AgentResponsible")
+  agentKeysIssued Agent[] @relation("AgentKeyIssuedTo")
 
   @@unique([organizationId, userId])
   @@index([userId])

package/templates/database/migrations/20261005120000_agents/migration.sql

@@ -0,0 +1,84 @@
+-- #3591 — the agent seat, step A (spec
+-- docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1).
+--
+--   agents (auth) — one row per agent: a stored delegate of ONE person (its
+--                   responsible Membership), bound to ONE workspace. It stores
+--                   the SHA-256 digest of the agent's key, never the key.
+--                   Deleting the organization, the workspace or the person's
+--                   membership deletes the agent; deleting the membership of
+--                   the person who was last shown its key sets
+--                   key_issued_to_membership_id null, which the guard refuses
+--                   until the agent is re-keyed. created_by_user_id is a plain
+--                   column with no foreign key, so deleting the creator does
+--                   not delete the agents they made for someone else.
+--
+-- PURELY ADDITIVE: one new enum, one new table, its indexes and four FKs (to
+-- "organizations", "workspaces" and twice to "memberships"). No statement
+-- touches an existing table's rows or columns, so there is no pre-assertion
+-- block — this migration cannot lose a row.
+--
+-- Rollback: DROP TABLE "agents"; DROP TYPE "AgentPermissionLevel". Safe while
+-- nothing but #3591's own code reads them.
+
+-- CreateEnum
+CREATE TYPE "AgentPermissionLevel" AS ENUM ('member');
+
+-- CreateTable
+CREATE TABLE "agents" (
+    "id" TEXT NOT NULL DEFAULT ('agent_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "responsible_membership_id" TEXT NOT NULL,
+    "name" VARCHAR(80) NOT NULL,
+    "permission_level" "AgentPermissionLevel" NOT NULL DEFAULT 'member',
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "credential_hash" CHAR(64) NOT NULL,
+    "credential_prefix" VARCHAR(24) NOT NULL,
+    "last_active_at" TIMESTAMP(3),
+    "created_by_user_id" TEXT NOT NULL,
+    "key_issued_to_membership_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "agents_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+-- The lookup an agent's every request makes (`findAgentByKeyHash`).
+CREATE UNIQUE INDEX "agents_credential_hash_key" ON "agents"("credential_hash");
+
+-- CreateIndex
+CREATE INDEX "agents_organization_id_idx" ON "agents"("organization_id");
+
+-- CreateIndex
+CREATE INDEX "agents_workspace_id_idx" ON "agents"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "agents_responsible_membership_id_idx" ON "agents"("responsible_membership_id");
+
+-- AddForeignKey
+ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_fkey" FOREIGN KEY ("organization_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+-- Leaving stops the agent: removing the person's membership deletes it.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_fkey" FOREIGN KEY ("responsible_membership_id") REFERENCES "memberships"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+-- A key dies with the person who received it: SET NULL, which the guard refuses.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_fkey" FOREIGN KEY ("key_issued_to_membership_id") REFERENCES "memberships"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — agents: agent_ (registered in packages/ids/src/registry.ts;
+-- this migration's path is added to migration-sync.test.ts's
+-- PK_CHECK_MIGRATIONS). Each reference column carries the format CHECK of the
+-- entity it names, in the exact pattern the spoke migration uses.
+ALTER TABLE "agents" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "agents" ALTER COLUMN "id" SET DEFAULT ('agent_'::text || (uuidv7())::text);
+ALTER TABLE "agents" ADD CONSTRAINT "agents_id_format" CHECK ("id" ~ '^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_format" CHECK ("responsible_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_format" CHECK ("key_issued_to_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_created_by_user_id_format" CHECK ("created_by_user_id" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"
@@ -51,8 +51,8 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "build": "tsc -b tsconfig.build.json && tsc -b tsconfig.tenancy.json && tsc -b tsconfig.flows.json",
-    "db:generate": "prisma generate && pnpm run build",
+    "build": "prisma generate && tsc -b tsconfig.build.json --force && tsc -b tsconfig.tenancy.json && tsc -b tsconfig.flows.json",
+    "db:generate": "pnpm run build",
     "db:migrate": "prisma migrate dev",
     "db:migrate:deploy": "prisma migrate deploy",
     "db:push": "prisma db push",

package/versions.json

@@ -1,52 +1,52 @@
 {
-  "@working-theory/admin-ui": "0.34.0",
-  "@working-theory/aeo": "0.34.0",
-  "@working-theory/agent-context": "0.34.0",
+  "@working-theory/admin-ui": "0.35.0",
+  "@working-theory/aeo": "0.35.0",
+  "@working-theory/agent-context": "0.35.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.34.0",
-  "@working-theory/api-client": "0.34.0",
+  "@working-theory/analytics": "0.35.0",
+  "@working-theory/api-client": "0.35.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.34.0",
-  "@working-theory/common": "0.34.0",
+  "@working-theory/cli": "0.35.0",
+  "@working-theory/common": "0.35.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.34.0",
-  "@working-theory/content-projection": "0.34.0",
-  "@working-theory/email": "0.34.0",
+  "@working-theory/content-adapters": "0.35.0",
+  "@working-theory/content-projection": "0.35.0",
+  "@working-theory/email": "0.35.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.34.0",
-  "@working-theory/fumadocs-schema": "0.34.0",
-  "@working-theory/ids": "0.9.0",
-  "@working-theory/jsonld": "0.34.0",
-  "@working-theory/license": "0.34.0",
-  "@working-theory/metadata": "0.34.0",
-  "@working-theory/observability": "0.34.0",
-  "@working-theory/page-renderer": "0.34.0",
+  "@working-theory/eslint-config": "0.35.0",
+  "@working-theory/fumadocs-schema": "0.35.0",
+  "@working-theory/ids": "0.10.0",
+  "@working-theory/jsonld": "0.35.0",
+  "@working-theory/license": "0.35.0",
+  "@working-theory/metadata": "0.35.0",
+  "@working-theory/observability": "0.35.0",
+  "@working-theory/page-renderer": "0.35.0",
   "@working-theory/plugin-mcp": "0.1.1",
-  "@working-theory/schema": "0.34.0",
-  "@working-theory/schema-pack-registry": "0.34.0",
-  "@working-theory/schema-validator": "0.34.0",
-  "@working-theory/sections-registry": "0.34.0",
-  "@working-theory/site-config": "0.34.0",
-  "@working-theory/stripe-client": "0.34.0",
-  "@working-theory/templates": "0.34.0",
-  "@working-theory/theme": "0.34.0",
-  "@working-theory/ui": "0.34.0",
-  "@working-theory/validation": "0.34.0",
-  "@working-theory/web-i18n": "0.34.0",
+  "@working-theory/schema": "0.35.0",
+  "@working-theory/schema-pack-registry": "0.35.0",
+  "@working-theory/schema-validator": "0.35.0",
+  "@working-theory/sections-registry": "0.35.0",
+  "@working-theory/site-config": "0.35.0",
+  "@working-theory/stripe-client": "0.35.0",
+  "@working-theory/templates": "0.35.0",
+  "@working-theory/theme": "0.35.0",
+  "@working-theory/ui": "0.35.0",
+  "@working-theory/validation": "0.35.0",
+  "@working-theory/web-i18n": "0.35.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.11",
-  "@working-theory/ui-docs-blog": "0.23.11",
-  "@working-theory/ui-scheduling": "0.23.11",
-  "@working-theory/ui-signal-collectors": "0.25.0",
+  "@working-theory/ui-commerce": "0.23.13",
+  "@working-theory/ui-docs-blog": "0.23.13",
+  "@working-theory/ui-scheduling": "0.23.13",
+  "@working-theory/ui-signal-collectors": "0.25.2",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.34.0"
+  "@working-theory/database": "0.35.0"
 }