create-ailk 0.13.0 → 0.15.0

package/templates/database/__tests__/lead-idempotency-key.db.test.ts

@@ -0,0 +1,92 @@
+/**
+ * @file lead-idempotency-key.db.test.ts
+ *
+ * LIVE-DATABASE proof of the lead idempotency key (#7869, spec
+ * docs/specs/7869-lead-idempotency-key-spec.md D8, D10 cases 15–17; AC-4).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied —
+ * the whole suite SKIPS when DATABASE_URL is unset, keeping the workspace
+ * Jest run DB-free (the repo convention; the `apps/api Route Tests
+ * (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, as `spoke-registry.db.test.ts` does. What it
+ * proves that a mock cannot — the unique index
+ * `leads_workspace_id_idempotency_key_key` itself:
+ *   15. One key twice in one workspace: the second insert fails (23505).
+ *   16. One key in two workspaces: both inserts succeed.
+ *   17. Two keyless (NULL) leads in one workspace: both succeed.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+describeDb("the lead idempotency key (#7869, live DB)", () => {
+  let db: Client;
+  let workspaceA: string;
+  let workspaceB: string;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+
+    const org = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('Lead Idempotency Org', 'idem7869-org', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    const workspace = async (slug: string) =>
+      (
+        await db.query<{ id: string }>(
+          `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+           VALUES ($1, $2, $2, now()) RETURNING "id"`,
+          [org.id, slug],
+        )
+      ).rows[0]!.id;
+    workspaceA = await workspace("idem7869-ws-a");
+    workspaceB = await workspace("idem7869-ws-b");
+  });
+
+  afterAll(async () => {
+    await db.query(`DELETE FROM "leads" WHERE "source" = 'idem7869'`);
+    await db.query(`DELETE FROM "organizations" WHERE "slug" = 'idem7869-org'`);
+    await db.end();
+  });
+
+  /** Insert one lead; the database mints its id. */
+  const insertLead = (workspaceId: string, idempotencyKey: string | null) =>
+    db.query(
+      `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload", "idempotency_key")
+       VALUES ($1, $1, 'idem7869', 'visitor@example.com', '{}', $2)`,
+      [workspaceId, idempotencyKey],
+    );
+
+  it("case 15 — one key twice in one workspace: the second insert fails with 23505", async () => {
+    await insertLead(workspaceA, "idem7869-key-same-workspace");
+    await expect(
+      insertLead(workspaceA, "idem7869-key-same-workspace"),
+    ).rejects.toMatchObject({
+      code: "23505",
+      constraint: "leads_workspace_id_idempotency_key_key",
+    });
+  });
+
+  it("case 16 — the same key in two workspaces: both inserts succeed", async () => {
+    await insertLead(workspaceA, "idem7869-key-two-workspaces");
+    await insertLead(workspaceB, "idem7869-key-two-workspaces");
+    const { rows } = await db.query<{ n: string }>(
+      `SELECT count(*) AS n FROM "leads" WHERE "idempotency_key" = 'idem7869-key-two-workspaces'`,
+    );
+    expect(rows[0]!.n).toBe("2");
+  });
+
+  it("case 17 — two keyless leads in one workspace: both succeed (NULLs are distinct)", async () => {
+    await insertLead(workspaceA, null);
+    await insertLead(workspaceA, null);
+    const { rows } = await db.query<{ n: string }>(
+      `SELECT count(*) AS n FROM "leads"
+       WHERE "source" = 'idem7869' AND "workspace_id" = $1 AND "idempotency_key" IS NULL`,
+      [workspaceA],
+    );
+    expect(rows[0]!.n).toBe("2");
+  });
+});

package/templates/database/auth/schema.prisma

@@ -106,6 +106,9 @@ model Workspace {
   spokes       Spoke[]
   // #3591 — the agents bound to this workspace.
   agents       Agent[]
+  // #7803 — the people who last activated this workspace (User.lastWorkspaceId).
+  // Read and written only by apps/api/src/services/tenant-context.ts.
+  lastActiveUsers User[] @relation("UserLastWorkspace")
 
   @@unique([organizationId, slug])
   @@index([organizationId])
@@ -167,6 +170,16 @@ enum AgentPermissionLevel {
 /// deleting the creator does not delete the agents they made for others.
 /// `apps/api/src/lib/agent-store.ts` is the only file that names
 /// `prisma.agent`.
+///
+/// `grants` (#7864, spec docs/specs/7864-agent-key-grants-spec.md D2, D3)
+/// lists the permissions an owner or admin granted this agent one by one —
+/// only the five `@working-theory/validation` names in
+/// `AGENT_GRANTABLE_PERMISSIONS` (content-edit, content-publish, assets-write,
+/// magnets-manage, meeting-types-manage), held to that set by the
+/// `agents_grants_allowed` CHECK. A grant never raises the ceiling above. The
+/// agent holds a stored grant only while its person's own role holds it too:
+/// the tenant guards clamp it on every request, so a demoted person's agent
+/// keeps the row but loses the permission.
 model Agent {
   id                      String               @id @default(dbgenerated("('agent_'::text || (uuidv7())::text)")) @db.Text
   organizationId          String               @map("organization_id")
@@ -174,6 +187,7 @@ model Agent {
   responsibleMembershipId String               @map("responsible_membership_id")
   name                    String               @db.VarChar(80)
   permissionLevel         AgentPermissionLevel @default(member) @map("permission_level")
+  grants                  String[]             @default([]) @map("grants")
   enabled                 Boolean              @default(true)
   credentialHash          String               @unique @map("credential_hash") @db.Char(64)
   credentialPrefix        String               @map("credential_prefix") @db.VarChar(24)
@@ -374,7 +388,16 @@ model User {
   memberships     Membership[]
   sentInvitations Invitation[] @relation("sent_invitations")
 
+  // #7803 — the workspace this person last activated, so a new sign-in lands
+  // there. Written only by activateWorkspace after its membership grant; read
+  // only by listTenancy, which reports it only when the workspace is in the
+  // caller's own listing (apps/api/src/services/tenant-context.ts). Deleting
+  // the workspace clears it. Never a Better Auth field, so no client can set it.
+  lastWorkspaceId String?    @map("last_workspace_id")
+  lastWorkspace   Workspace? @relation("UserLastWorkspace", fields: [lastWorkspaceId], references: [id], onDelete: SetNull)
+
   @@unique([billingProvider, billingCustomerId])
+  @@index([lastWorkspaceId])
   @@map("users")
 }
 

package/templates/database/inbox/schema.prisma

@@ -63,6 +63,19 @@ model Lead {
   promotedUserId String?   @map("promoted_user_id")
   promotedAt     DateTime? @map("promoted_at")
 
+  // #7869 (roadmap D5) — the caller's `Idempotency-Key` header on
+  // `POST /v1/leads/submit`, stored verbatim so a retried write finds the
+  // first lead. Written only by `apps/api/src/services/lead-routing.ts`'s
+  // submit branch and read only by its two scoped lookups. Untrusted,
+  // client-supplied text — never echo it. Nullable, no default: every
+  // pre-#7869 row and every keyless lead reads NULL, and Postgres treats
+  // NULLs as distinct under the unique below. Same shape as
+  // `FlowCheckout.idempotencyKey` (#4912).
+  idempotencyKey String? @map("idempotency_key")
+
+  // #7869 — the idempotency guarantee, scoped per workspace so a key can
+  // never reach another tenant's row.
+  @@unique([workspaceId, idempotencyKey])
   @@index([siteId])
   @@index([createdAt])
   @@index([email])

package/templates/database/jest.config.cjs

@@ -6,26 +6,22 @@ module.exports = {
   testPathIgnorePatterns: ["/node_modules/", "/generated/"],
   moduleFileExtensions: ["ts", "js", "json"],
   moduleNameMapper: {
-    // Map the validation workspace package to its TypeScript source so
-    // ts-jest compiles it directly (#3958) — mirrors apps/api/jest.config.cjs's
-    // identical mapping. The published dist is ESM-only and this package's
-    // CJS ts-jest transform can't load it; database/flows/presets.ts's test
-    // needs the real flowConfigSchema value at runtime.
-    "^@working-theory/validation$": "<rootDir>/../packages/validation/src/index.ts",
-    // ../tenancy.ts's `isSentinel` import from @working-theory/ids became a
-    // VALUE import (#5876 spec D2/D11) — no longer type-only, so it DOES need
-    // a mapping now, same reason as the validation mapping above.
-    "^@working-theory/ids$": "<rootDir>/../packages/ids/src/index.ts",
+    // @working-theory/validation and @working-theory/ids resolve from the
+    // installed packages; their ESM dist is converted by the transform below.
     "^(\\.{1,2}/.*)\\.js$": "$1",
   },
+  transformIgnorePatterns: [
+    "/node_modules/(?!(\\.pnpm/)?@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))",
+  ],
   transform: {
-    "^.+\\.tsx?$": [
+    "^.+\\.[cm]?[tj]sx?$": [
       "ts-jest",
       {
         tsconfig: {
           target: "ES2020",
           module: "commonjs",
           lib: ["ES2020"],
+          allowJs: true,
           declaration: false,
           strict: true,
           esModuleInterop: true,

package/templates/database/migrations/20261008120000_user_last_workspace/migration.sql

@@ -0,0 +1,35 @@
+-- #7803 — sign-in lands in the user's last workspace (spec
+-- docs/specs/7803-sign-in-last-workspace-spec.md D1).
+--
+--   users.last_workspace_id (auth) — the workspace this person last activated.
+--                   Written only by activateWorkspace after its membership
+--                   grant; read only by listTenancy, which reports it only
+--                   when the workspace is in the caller's own listing
+--                   (apps/api/src/services/tenant-context.ts). Deleting the
+--                   workspace sets it null.
+--
+-- PURELY ADDITIVE: one nullable column with no default, its index, one FK to
+-- "workspaces" and the ADR-0031 format CHECK on the new reference column. No
+-- backfill runs and no existing row changes, so there is no pre-assertion
+-- block — this migration cannot lose a row. A NULL passes the CHECK.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column
+-- (SEC-7803-3). Being nullable, it is safe to apply ahead of the code.
+--
+-- Rollback: ALTER TABLE "users" DROP COLUMN "last_workspace_id"; (this drops
+-- the index, the FK and the CHECK with it). Safe while nothing but #7803's own
+-- code reads it.
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN "last_workspace_id" TEXT;
+
+-- CreateIndex
+CREATE INDEX "users_last_workspace_id_idx" ON "users"("last_workspace_id");
+
+-- AddForeignKey
+-- A deleted workspace clears every pointer to it.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_fkey" FOREIGN KEY ("last_workspace_id") REFERENCES "workspaces"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — the reference column carries the format CHECK of the
+-- entity it names (wksp_), in the exact pattern the agents migration uses.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_format" CHECK ("last_workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261008130000_lead_idempotency_key/migration.sql

@@ -0,0 +1,20 @@
+-- #7869 (spoke-pattern roadmap Phase 1, D5) — Lead idempotency key: the
+-- caller's optional `Idempotency-Key` header on POST /v1/leads/submit, so a
+-- retried lead write (a client retry, a spoke's fulfilment replay) finds the
+-- first lead instead of writing a second. Mirrors the column-add shape of
+-- 20260906000000_add_flow_checkout_idempotency (one AlterTable, one unique
+-- index under the Prisma section headers).
+--
+-- The column is nullable with no default, so no pre-existing row needs a
+-- backfill and none collides on the new unique — Postgres treats NULLs as
+-- distinct. The unique is scoped by workspace_id: one key in two workspaces
+-- is two leads.
+--
+-- Rollback: ALTER TABLE "leads" DROP COLUMN "idempotency_key"; (the index
+-- goes with it).
+
+-- AlterTable
+ALTER TABLE "leads" ADD COLUMN     "idempotency_key" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "leads_workspace_id_idempotency_key_key" ON "leads"("workspace_id", "idempotency_key");

package/templates/database/migrations/20261009120000_agent_grants/migration.sql

@@ -0,0 +1,33 @@
+-- #7864 — grant an agent key five named abilities (spec
+-- docs/specs/7864-agent-key-grants-spec.md D2).
+--
+--   agents.grants (auth) — the permissions an owner or admin granted this
+--                   agent one by one. Written only by setServedAgentGrants
+--                   (apps/api/src/lib/agent-store.ts, the PUT
+--                   …/agents/:agentId/grants route); read by the auth
+--                   preHandler's key lookup and the agent list. The tenant
+--                   guards hold an agent to the grants its person's own role
+--                   also holds, so a stored grant never outranks the person.
+--
+-- The CHECK names the same five permissions as @working-theory/validation's
+-- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
+-- this file and fails if the two lists differ (SEC-7864-G).
+--
+-- PURELY ADDITIVE: one NOT NULL column with an empty-array default and its
+-- CHECK. No backfill runs: every existing agent takes the default, no
+-- grants, and so behaves exactly as before. No existing row changes beyond
+-- the default fill, so there is no pre-assertion block.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column.
+-- Code without the column fails closed — its key lookup errors and every
+-- agent is answered 401 (SEC-7864-F).
+--
+-- Rollback: ALTER TABLE "agents" DROP COLUMN "grants"; (this drops the CHECK
+-- with it). Safe while nothing but #7864's own code reads it.
+
+-- AlterTable
+ALTER TABLE "agents" ADD COLUMN "grants" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
+
+-- Only the five grantable permissions may be stored.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
+  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage']::TEXT[]);

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/versions.json

@@ -1,52 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.35.0",
-  "@working-theory/aeo": "0.35.0",
-  "@working-theory/agent-context": "0.35.0",
+  "@working-theory/admin-ui": "0.37.0",
+  "@working-theory/aeo": "0.37.0",
+  "@working-theory/agent-context": "0.37.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.35.0",
-  "@working-theory/api-client": "0.35.0",
+  "@working-theory/analytics": "0.37.0",
+  "@working-theory/api-client": "0.37.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.35.0",
-  "@working-theory/common": "0.35.0",
+  "@working-theory/cli": "0.37.0",
+  "@working-theory/common": "0.37.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.35.0",
-  "@working-theory/content-projection": "0.35.0",
-  "@working-theory/email": "0.35.0",
+  "@working-theory/content-adapters": "0.37.0",
+  "@working-theory/content-projection": "0.37.0",
+  "@working-theory/email": "0.37.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.35.0",
-  "@working-theory/fumadocs-schema": "0.35.0",
+  "@working-theory/eslint-config": "0.37.0",
+  "@working-theory/fumadocs-schema": "0.37.0",
   "@working-theory/ids": "0.10.0",
-  "@working-theory/jsonld": "0.35.0",
-  "@working-theory/license": "0.35.0",
-  "@working-theory/metadata": "0.35.0",
-  "@working-theory/observability": "0.35.0",
-  "@working-theory/page-renderer": "0.35.0",
-  "@working-theory/plugin-mcp": "0.1.1",
-  "@working-theory/schema": "0.35.0",
-  "@working-theory/schema-pack-registry": "0.35.0",
-  "@working-theory/schema-validator": "0.35.0",
-  "@working-theory/sections-registry": "0.35.0",
-  "@working-theory/site-config": "0.35.0",
-  "@working-theory/stripe-client": "0.35.0",
-  "@working-theory/templates": "0.35.0",
-  "@working-theory/theme": "0.35.0",
-  "@working-theory/ui": "0.35.0",
-  "@working-theory/validation": "0.35.0",
-  "@working-theory/web-i18n": "0.35.0",
+  "@working-theory/jsonld": "0.37.0",
+  "@working-theory/license": "0.37.0",
+  "@working-theory/metadata": "0.37.0",
+  "@working-theory/observability": "0.37.0",
+  "@working-theory/page-renderer": "0.37.0",
+  "@working-theory/plugin-mcp": "0.1.2",
+  "@working-theory/schema": "0.37.0",
+  "@working-theory/schema-pack-registry": "0.37.0",
+  "@working-theory/schema-validator": "0.37.0",
+  "@working-theory/sections-registry": "0.37.0",
+  "@working-theory/site-config": "0.37.0",
+  "@working-theory/spoke-checkout": "0.2.0",
+  "@working-theory/stripe-client": "0.37.0",
+  "@working-theory/templates": "0.37.0",
+  "@working-theory/theme": "0.37.0",
+  "@working-theory/ui": "0.37.0",
+  "@working-theory/validation": "0.37.0",
+  "@working-theory/web-i18n": "0.37.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.13",
-  "@working-theory/ui-docs-blog": "0.23.13",
-  "@working-theory/ui-scheduling": "0.23.13",
-  "@working-theory/ui-signal-collectors": "0.25.2",
+  "@working-theory/ui-commerce": "0.23.15",
+  "@working-theory/ui-docs-blog": "0.23.15",
+  "@working-theory/ui-scheduling": "0.23.15",
+  "@working-theory/ui-signal-collectors": "0.25.4",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.35.0"
+  "@working-theory/database": "0.37.0"
 }

package/site-templates/designs/minimalism/sample/README.md

@@ -1,48 +0,0 @@
-# The `minimalism` design's home-deck sample
-
-> Narrative moved here from the retired minimalism template's `TEMPLATE-MANIFEST.md` when
-> that tree retired (spec 6892 D4/D5) — `minimalism` is a design, not a template, so it
-> carries no generated manifest of its own. This file is NOT installed onto a scaffold
-> (`installDesignSample` copies only `content/**` and `public/**`); it documents the sample for
-> maintainers of this design.
-
-The second Pro template (#5589) that first wore this design was a reports-first site whose home
-is a **nine-slide scroll-snap deck**, shaped after the reference captured in
-`docs/research/bondcap-capture/`. Structure and design are the reference; **the copy is not** —
-every line in `content/en/HomePage/home.mdx` is placeholder English of the same shape and length.
-
-`layout.home: "deck"` (the `minimalism` design's own layout knob) makes every direct section
-child of `home.mdx` one full-viewport snap target, in order. The mark is hidden on slide 1 (the
-deck-hero landing state) and revealed from slide 2 on.
-
-| #   | Slide             | Section                                                        | Ground                   | Action                                                     |
-| --- | ----------------- | -------------------------------------------------------------- | ------------------------ | ---------------------------------------------------------- |
-| 1   | Landing           | `hero` (`backdrop`)                                            | gradient band + backdrop | `{Primary CTA} →` → `/reports`, centered; 44px scroll cue. |
-| 2   | Tagline           | `content-block` (`align: center`, `fill: viewport`)            | light                    | —                                                          |
-| 3   | Our community     | `logoCloud` (`actions`)                                        | light                    | `Refer someone →` → `/referral`, bottom-centered at 44px   |
-| 4   | Reports headline  | `content-block` (`align: center`, `fill: viewport`)            | light                    | —                                                          |
-| 5   | Special reports   | `reports-list` (`list`, `tone: on-dark`)                       | dark (`gradient-dark`)   | four dated titles → `/reports/<slug>`                      |
-| 6   | Favorites         | `reports-list` (`list`, `tone: on-dark`)                       | dark (`gradient-dark`)   | year-only titles → `/reports/<slug>`                       |
-| 7   | Services headline | `content-block` (`align: center`, `fill: viewport`)            | light                    | `Hire me →` → `/meet`                                      |
-| 8   | Partners          | `team` (`with-large-images`, `hoverReveal`, `phoneColumns: 2`) | light                    | `About us →` → `/about`, bottom-centered at 44px           |
-| 9   | Closing           | `cta` (`minimal`)                                              | light                    | `Contact me →` → `/contact`, centered                      |
-
-## The site principle
-
-Every slide's action sits at the bottom, centered, at 44px or larger; grids are 2-up on a phone.
-This is held by bounded section props on the sections above, never by a `className` override or
-hand-rolled markup (`.claude/rules/frontend.md` § Chrome Composes Blocks).
-
-## The 11 SVGs
-
-`public/hero-backdrop.svg`, `public/wordmark-placeholder.svg`, three `public/logo-placeholder-*.svg`
-and six `public/avatar-placeholder-*.svg` — all placeholders, referenced only from this sample's
-`home.mdx` (the avatars are also referenced by the retired bespoke `AboutPage` seed, which did not
-move with this design — its team slide is the only remaining consumer). They ride with the design
-because the deck uses all 11; a shape/design pair that does not install this sample never ships
-them (D4).
-
-## Copy density
-
-This design declares `copy: { density: "sparse" }` in its `DESIGN.md` — its pages, this deck
-included, carry far fewer words than a standard site.