create-ailk 0.14.0 → 0.15.0

package/templates/database/auth/schema.prisma

@@ -106,6 +106,9 @@ model Workspace {
   spokes       Spoke[]
   // #3591 — the agents bound to this workspace.
   agents       Agent[]
+  // #7803 — the people who last activated this workspace (User.lastWorkspaceId).
+  // Read and written only by apps/api/src/services/tenant-context.ts.
+  lastActiveUsers User[] @relation("UserLastWorkspace")
 
   @@unique([organizationId, slug])
   @@index([organizationId])
@@ -167,6 +170,16 @@ enum AgentPermissionLevel {
 /// deleting the creator does not delete the agents they made for others.
 /// `apps/api/src/lib/agent-store.ts` is the only file that names
 /// `prisma.agent`.
+///
+/// `grants` (#7864, spec docs/specs/7864-agent-key-grants-spec.md D2, D3)
+/// lists the permissions an owner or admin granted this agent one by one —
+/// only the five `@working-theory/validation` names in
+/// `AGENT_GRANTABLE_PERMISSIONS` (content-edit, content-publish, assets-write,
+/// magnets-manage, meeting-types-manage), held to that set by the
+/// `agents_grants_allowed` CHECK. A grant never raises the ceiling above. The
+/// agent holds a stored grant only while its person's own role holds it too:
+/// the tenant guards clamp it on every request, so a demoted person's agent
+/// keeps the row but loses the permission.
 model Agent {
   id                      String               @id @default(dbgenerated("('agent_'::text || (uuidv7())::text)")) @db.Text
   organizationId          String               @map("organization_id")
@@ -174,6 +187,7 @@ model Agent {
   responsibleMembershipId String               @map("responsible_membership_id")
   name                    String               @db.VarChar(80)
   permissionLevel         AgentPermissionLevel @default(member) @map("permission_level")
+  grants                  String[]             @default([]) @map("grants")
   enabled                 Boolean              @default(true)
   credentialHash          String               @unique @map("credential_hash") @db.Char(64)
   credentialPrefix        String               @map("credential_prefix") @db.VarChar(24)
@@ -374,7 +388,16 @@ model User {
   memberships     Membership[]
   sentInvitations Invitation[] @relation("sent_invitations")
 
+  // #7803 — the workspace this person last activated, so a new sign-in lands
+  // there. Written only by activateWorkspace after its membership grant; read
+  // only by listTenancy, which reports it only when the workspace is in the
+  // caller's own listing (apps/api/src/services/tenant-context.ts). Deleting
+  // the workspace clears it. Never a Better Auth field, so no client can set it.
+  lastWorkspaceId String?    @map("last_workspace_id")
+  lastWorkspace   Workspace? @relation("UserLastWorkspace", fields: [lastWorkspaceId], references: [id], onDelete: SetNull)
+
   @@unique([billingProvider, billingCustomerId])
+  @@index([lastWorkspaceId])
   @@map("users")
 }
 

package/templates/database/inbox/schema.prisma

@@ -63,6 +63,19 @@ model Lead {
   promotedUserId String?   @map("promoted_user_id")
   promotedAt     DateTime? @map("promoted_at")
 
+  // #7869 (roadmap D5) — the caller's `Idempotency-Key` header on
+  // `POST /v1/leads/submit`, stored verbatim so a retried write finds the
+  // first lead. Written only by `apps/api/src/services/lead-routing.ts`'s
+  // submit branch and read only by its two scoped lookups. Untrusted,
+  // client-supplied text — never echo it. Nullable, no default: every
+  // pre-#7869 row and every keyless lead reads NULL, and Postgres treats
+  // NULLs as distinct under the unique below. Same shape as
+  // `FlowCheckout.idempotencyKey` (#4912).
+  idempotencyKey String? @map("idempotency_key")
+
+  // #7869 — the idempotency guarantee, scoped per workspace so a key can
+  // never reach another tenant's row.
+  @@unique([workspaceId, idempotencyKey])
   @@index([siteId])
   @@index([createdAt])
   @@index([email])

package/templates/database/jest.config.cjs

@@ -6,26 +6,22 @@ module.exports = {
   testPathIgnorePatterns: ["/node_modules/", "/generated/"],
   moduleFileExtensions: ["ts", "js", "json"],
   moduleNameMapper: {
-    // Map the validation workspace package to its TypeScript source so
-    // ts-jest compiles it directly (#3958) — mirrors apps/api/jest.config.cjs's
-    // identical mapping. The published dist is ESM-only and this package's
-    // CJS ts-jest transform can't load it; database/flows/presets.ts's test
-    // needs the real flowConfigSchema value at runtime.
-    "^@working-theory/validation$": "<rootDir>/../packages/validation/src/index.ts",
-    // ../tenancy.ts's `isSentinel` import from @working-theory/ids became a
-    // VALUE import (#5876 spec D2/D11) — no longer type-only, so it DOES need
-    // a mapping now, same reason as the validation mapping above.
-    "^@working-theory/ids$": "<rootDir>/../packages/ids/src/index.ts",
+    // @working-theory/validation and @working-theory/ids resolve from the
+    // installed packages; their ESM dist is converted by the transform below.
     "^(\\.{1,2}/.*)\\.js$": "$1",
   },
+  transformIgnorePatterns: [
+    "/node_modules/(?!(\\.pnpm/)?@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))",
+  ],
   transform: {
-    "^.+\\.tsx?$": [
+    "^.+\\.[cm]?[tj]sx?$": [
       "ts-jest",
       {
         tsconfig: {
           target: "ES2020",
           module: "commonjs",
           lib: ["ES2020"],
+          allowJs: true,
           declaration: false,
           strict: true,
           esModuleInterop: true,

package/templates/database/migrations/20261008120000_user_last_workspace/migration.sql

@@ -0,0 +1,35 @@
+-- #7803 — sign-in lands in the user's last workspace (spec
+-- docs/specs/7803-sign-in-last-workspace-spec.md D1).
+--
+--   users.last_workspace_id (auth) — the workspace this person last activated.
+--                   Written only by activateWorkspace after its membership
+--                   grant; read only by listTenancy, which reports it only
+--                   when the workspace is in the caller's own listing
+--                   (apps/api/src/services/tenant-context.ts). Deleting the
+--                   workspace sets it null.
+--
+-- PURELY ADDITIVE: one nullable column with no default, its index, one FK to
+-- "workspaces" and the ADR-0031 format CHECK on the new reference column. No
+-- backfill runs and no existing row changes, so there is no pre-assertion
+-- block — this migration cannot lose a row. A NULL passes the CHECK.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column
+-- (SEC-7803-3). Being nullable, it is safe to apply ahead of the code.
+--
+-- Rollback: ALTER TABLE "users" DROP COLUMN "last_workspace_id"; (this drops
+-- the index, the FK and the CHECK with it). Safe while nothing but #7803's own
+-- code reads it.
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN "last_workspace_id" TEXT;
+
+-- CreateIndex
+CREATE INDEX "users_last_workspace_id_idx" ON "users"("last_workspace_id");
+
+-- AddForeignKey
+-- A deleted workspace clears every pointer to it.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_fkey" FOREIGN KEY ("last_workspace_id") REFERENCES "workspaces"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — the reference column carries the format CHECK of the
+-- entity it names (wksp_), in the exact pattern the agents migration uses.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_format" CHECK ("last_workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261008130000_lead_idempotency_key/migration.sql

@@ -0,0 +1,20 @@
+-- #7869 (spoke-pattern roadmap Phase 1, D5) — Lead idempotency key: the
+-- caller's optional `Idempotency-Key` header on POST /v1/leads/submit, so a
+-- retried lead write (a client retry, a spoke's fulfilment replay) finds the
+-- first lead instead of writing a second. Mirrors the column-add shape of
+-- 20260906000000_add_flow_checkout_idempotency (one AlterTable, one unique
+-- index under the Prisma section headers).
+--
+-- The column is nullable with no default, so no pre-existing row needs a
+-- backfill and none collides on the new unique — Postgres treats NULLs as
+-- distinct. The unique is scoped by workspace_id: one key in two workspaces
+-- is two leads.
+--
+-- Rollback: ALTER TABLE "leads" DROP COLUMN "idempotency_key"; (the index
+-- goes with it).
+
+-- AlterTable
+ALTER TABLE "leads" ADD COLUMN     "idempotency_key" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "leads_workspace_id_idempotency_key_key" ON "leads"("workspace_id", "idempotency_key");

package/templates/database/migrations/20261009120000_agent_grants/migration.sql

@@ -0,0 +1,33 @@
+-- #7864 — grant an agent key five named abilities (spec
+-- docs/specs/7864-agent-key-grants-spec.md D2).
+--
+--   agents.grants (auth) — the permissions an owner or admin granted this
+--                   agent one by one. Written only by setServedAgentGrants
+--                   (apps/api/src/lib/agent-store.ts, the PUT
+--                   …/agents/:agentId/grants route); read by the auth
+--                   preHandler's key lookup and the agent list. The tenant
+--                   guards hold an agent to the grants its person's own role
+--                   also holds, so a stored grant never outranks the person.
+--
+-- The CHECK names the same five permissions as @working-theory/validation's
+-- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
+-- this file and fails if the two lists differ (SEC-7864-G).
+--
+-- PURELY ADDITIVE: one NOT NULL column with an empty-array default and its
+-- CHECK. No backfill runs: every existing agent takes the default, no
+-- grants, and so behaves exactly as before. No existing row changes beyond
+-- the default fill, so there is no pre-assertion block.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column.
+-- Code without the column fails closed — its key lookup errors and every
+-- agent is answered 401 (SEC-7864-F).
+--
+-- Rollback: ALTER TABLE "agents" DROP COLUMN "grants"; (this drops the CHECK
+-- with it). Safe while nothing but #7864's own code reads it.
+
+-- AlterTable
+ALTER TABLE "agents" ADD COLUMN "grants" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
+
+-- Only the five grantable permissions may be stored.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
+  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage']::TEXT[]);

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/versions.json

@@ -1,52 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.36.0",
-  "@working-theory/aeo": "0.36.0",
-  "@working-theory/agent-context": "0.36.0",
+  "@working-theory/admin-ui": "0.37.0",
+  "@working-theory/aeo": "0.37.0",
+  "@working-theory/agent-context": "0.37.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.36.0",
-  "@working-theory/api-client": "0.36.0",
+  "@working-theory/analytics": "0.37.0",
+  "@working-theory/api-client": "0.37.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.36.0",
-  "@working-theory/common": "0.36.0",
+  "@working-theory/cli": "0.37.0",
+  "@working-theory/common": "0.37.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.36.0",
-  "@working-theory/content-projection": "0.36.0",
-  "@working-theory/email": "0.36.0",
+  "@working-theory/content-adapters": "0.37.0",
+  "@working-theory/content-projection": "0.37.0",
+  "@working-theory/email": "0.37.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.36.0",
-  "@working-theory/fumadocs-schema": "0.36.0",
+  "@working-theory/eslint-config": "0.37.0",
+  "@working-theory/fumadocs-schema": "0.37.0",
   "@working-theory/ids": "0.10.0",
-  "@working-theory/jsonld": "0.36.0",
-  "@working-theory/license": "0.36.0",
-  "@working-theory/metadata": "0.36.0",
-  "@working-theory/observability": "0.36.0",
-  "@working-theory/page-renderer": "0.36.0",
+  "@working-theory/jsonld": "0.37.0",
+  "@working-theory/license": "0.37.0",
+  "@working-theory/metadata": "0.37.0",
+  "@working-theory/observability": "0.37.0",
+  "@working-theory/page-renderer": "0.37.0",
   "@working-theory/plugin-mcp": "0.1.2",
-  "@working-theory/schema": "0.36.0",
-  "@working-theory/schema-pack-registry": "0.36.0",
-  "@working-theory/schema-validator": "0.36.0",
-  "@working-theory/sections-registry": "0.36.0",
-  "@working-theory/site-config": "0.36.0",
-  "@working-theory/stripe-client": "0.36.0",
-  "@working-theory/templates": "0.36.0",
-  "@working-theory/theme": "0.36.0",
-  "@working-theory/ui": "0.36.0",
-  "@working-theory/validation": "0.36.0",
-  "@working-theory/web-i18n": "0.36.0",
+  "@working-theory/schema": "0.37.0",
+  "@working-theory/schema-pack-registry": "0.37.0",
+  "@working-theory/schema-validator": "0.37.0",
+  "@working-theory/sections-registry": "0.37.0",
+  "@working-theory/site-config": "0.37.0",
+  "@working-theory/spoke-checkout": "0.2.0",
+  "@working-theory/stripe-client": "0.37.0",
+  "@working-theory/templates": "0.37.0",
+  "@working-theory/theme": "0.37.0",
+  "@working-theory/ui": "0.37.0",
+  "@working-theory/validation": "0.37.0",
+  "@working-theory/web-i18n": "0.37.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.14",
-  "@working-theory/ui-docs-blog": "0.23.14",
-  "@working-theory/ui-scheduling": "0.23.14",
-  "@working-theory/ui-signal-collectors": "0.25.3",
+  "@working-theory/ui-commerce": "0.23.15",
+  "@working-theory/ui-docs-blog": "0.23.15",
+  "@working-theory/ui-scheduling": "0.23.15",
+  "@working-theory/ui-signal-collectors": "0.25.4",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.36.0"
+  "@working-theory/database": "0.37.0"
 }