create-ailk 0.19.1 → 0.20.0

package/templates/database/__tests__/piece-kind.db.test.ts

@@ -0,0 +1,208 @@
+/**
+ * @file piece-kind.db.test.ts
+ *
+ * LIVE-DATABASE proof of the piece kind and a proposal's price and payment
+ * columns (#8516, spec docs/specs/8516-proposals-as-an-artifact-kind-spec.md
+ * D1, D2, AC-1). Requires DATABASE_URL pointing at a Postgres with the
+ * migrations applied — SKIPS when DATABASE_URL is unset (the repo convention;
+ * the `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so
+ * dropping and re-adding the columns never outlives the suite. What it proves
+ * that a mock cannot:
+ *   1. Re-running the migration's own text over a piece written with the
+ *      pre-#8516 column set reads it back as a `deliverable`, the seven other
+ *      columns NULL and every pre-existing column (`updated_at` included)
+ *      byte-equal — no row is rewritten.
+ *   2. Each CHECK and the unique index refuse what they name.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const MIGRATION = join(__dirname, "..", "migrations", "20261016120000_piece_kind", "migration.sql");
+
+const WS = "wksp_01920000-8516-7000-8000-0000000000c1";
+const USER = "user_01920000-8516-7000-8000-0000000000a1";
+const NEW_COLUMNS = [
+  "kind",
+  "price_amount",
+  "price_currency",
+  "checkout_session_id",
+  "checkout_url",
+  "checkout_expires_at",
+  "paid_at",
+  "paid_session_id",
+] as const;
+
+describeDb("the piece kind columns (#8516 D1, D2, AC-1, live DB)", () => {
+  let db: Client;
+  let personId: string;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    await db.query("BEGIN");
+    personId = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "people" ("workspace_id", "email", "updated_at") VALUES ($1, $2, now()) RETURNING "id"`,
+        [WS, "p8516@example.com"],
+      )
+    ).rows[0]!.id;
+  });
+
+  afterAll(async () => {
+    await db.query("ROLLBACK");
+    await db.end();
+  });
+
+  /** Insert one piece with the pre-#8516 column set plus any of the new ones. */
+  const insertPiece = (cols: Record<string, unknown> = {}) => {
+    const all: Record<string, unknown> = {
+      workspace_id: WS,
+      person_id: personId,
+      title: "Site redesign",
+      stage: "requested",
+      updated_by: USER,
+      updated_at: new Date("2026-10-01T09:00:00.000Z"),
+      ...cols,
+    };
+    const names = Object.keys(all);
+    return db.query<{ id: string }>(
+      `INSERT INTO "pieces" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+      names.map((n) => all[n]),
+    );
+  };
+
+  /** Run `sql` inside a savepoint; resolve to the violated constraint's name, or null. */
+  const violation = async (run: () => Promise<unknown>): Promise<string | null> => {
+    await db.query("SAVEPOINT attempt");
+    try {
+      await run();
+      await db.query("RELEASE SAVEPOINT attempt");
+      return null;
+    } catch (err) {
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return (err as { constraint?: string }).constraint ?? String(err);
+    }
+  };
+
+  it("re-running the migration over a pre-#8516 row reads it as a deliverable, nothing else changed", async () => {
+    await db.query(
+      `ALTER TABLE "pieces" ${NEW_COLUMNS.map((c) => `DROP COLUMN "${c}"`).join(", ")}`,
+    );
+    const pieceId = (await insertPiece()).rows[0]!.id;
+    await db.query(
+      `INSERT INTO "piece_versions" ("workspace_id", "person_id", "piece_id", "version", "link", "delivered_by")
+       VALUES ($1, $2, $3, 1, 'https://example.com/v1.pdf', $4)`,
+      [WS, personId, pieceId, USER],
+    );
+    const before = (
+      await db.query<{ row: Record<string, unknown> }>(
+        `SELECT row_to_json(p) AS row FROM "pieces" p WHERE "id" = $1`,
+        [pieceId],
+      )
+    ).rows[0]!.row;
+
+    await db.query(readFileSync(MIGRATION, "utf8"));
+
+    const after = (
+      await db.query<{ row: Record<string, unknown> }>(
+        `SELECT row_to_json(p) AS row FROM "pieces" p WHERE "id" = $1`,
+        [pieceId],
+      )
+    ).rows[0]!.row;
+    expect(after.kind).toBe("deliverable");
+    for (const column of NEW_COLUMNS.slice(1)) expect(after[column]).toBeNull();
+    const kept = Object.fromEntries(
+      Object.entries(after).filter(([key]) => !(NEW_COLUMNS as readonly string[]).includes(key)),
+    );
+    expect(kept).toEqual(before);
+  });
+
+  it("refuses a kind outside the two", async () => {
+    expect(await violation(() => insertPiece({ kind: "other" }))).toBe("pieces_kind_allowed");
+  });
+
+  it("refuses a price on a deliverable, half a price, and an amount out of range", async () => {
+    expect(
+      await violation(() => insertPiece({ price_amount: 1000, price_currency: "usd" })),
+    ).toBe("pieces_price_proposal_only");
+    expect(await violation(() => insertPiece({ kind: "proposal", price_amount: 1000 }))).toBe(
+      "pieces_price_pair",
+    );
+    for (const amount of [0, 100000001]) {
+      expect(
+        await violation(() =>
+          insertPiece({ kind: "proposal", price_amount: amount, price_currency: "usd" }),
+        ),
+      ).toBe("pieces_price_range");
+    }
+    expect(
+      await violation(() =>
+        insertPiece({ kind: "proposal", price_amount: 1, price_currency: "usd" }),
+      ),
+    ).toBeNull();
+  });
+
+  const SESSION = {
+    checkout_session_id: "cs_test_a1",
+    checkout_url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+    checkout_expires_at: new Date("2026-10-16T13:00:00.000Z"),
+  };
+
+  it("refuses a checkout session on an unapproved or unpriced piece, and a partial session", async () => {
+    expect(
+      await violation(() =>
+        insertPiece({ kind: "proposal", price_amount: 5000, price_currency: "usd", ...SESSION }),
+      ),
+    ).toBe("pieces_checkout_needs_approved_price");
+    expect(
+      await violation(() => insertPiece({ kind: "proposal", approved_at: new Date(), ...SESSION })),
+    ).toBe("pieces_checkout_needs_approved_price");
+    expect(
+      await violation(() =>
+        insertPiece({
+          kind: "proposal",
+          price_amount: 5000,
+          price_currency: "usd",
+          approved_at: new Date(),
+          checkout_session_id: "cs_test_a2",
+        }),
+      ),
+    ).toBe("pieces_checkout_triple");
+  });
+
+  it("refuses paid_at without the session that paid it", async () => {
+    expect(
+      await violation(() =>
+        insertPiece({
+          kind: "proposal",
+          price_amount: 5000,
+          price_currency: "usd",
+          approved_at: new Date(),
+          paid_at: new Date(),
+        }),
+      ),
+    ).toBe("pieces_paid_pair");
+  });
+
+  it("refuses two pieces holding one checkout session", async () => {
+    const approvedPriced = {
+      kind: "proposal",
+      price_amount: 5000,
+      price_currency: "usd",
+      approved_at: new Date(),
+      ...SESSION,
+      checkout_session_id: "cs_test_dup",
+    };
+    expect(await violation(() => insertPiece(approvedPriced))).toBeNull();
+    expect(await violation(() => insertPiece(approvedPriced))).toBe(
+      "pieces_checkout_session_id_key",
+    );
+  });
+});

package/templates/database/_gitignore

@@ -0,0 +1,8 @@
+# Generated Prisma Client
+generated/
+
+# Compiled output (tsc emit from generated/)
+dist/
+
+# Node modules
+node_modules/

package/templates/database/inbox/schema.prisma

@@ -155,6 +155,14 @@ model Person {
   // NULL and `userId` is NULL, a capture may fill a blank field (D4).
   contactConfirmedAt DateTime? @map("contact_confirmed_at")
   contactConfirmedBy String?   @map("contact_confirmed_by") @db.VarChar(16)
+  // #8514 D1 — the team's private note on this client: one per Person, never
+  // served to the client. Who last saved it (a user id of the auth namespace,
+  // no foreign key — ADR 0009) and when; both NULL until the first save.
+  // When an agent saved it, which agent (its person is notesUpdatedBy).
+  notes               String?   @db.VarChar(5000)
+  notesUpdatedAt      DateTime? @map("notes_updated_at")
+  notesUpdatedBy      String?   @map("notes_updated_by")
+  notesUpdatedByAgent String?   @map("notes_updated_by_agent")
   createdAt          DateTime  @default(now()) @map("created_at")
   updatedAt          DateTime  @updatedAt @map("updated_at")
 
@@ -174,7 +182,7 @@ model Person {
   @@map("people")
 }
 
-/// Piece — one deliverable for one client (#7877). Written only through
+/// Piece — one deliverable or proposal for one client (#7877, #8516). Written only through
 /// tenantDb(tenant).memberArea; read by a client only through
 /// lib/member-store.ts. `stage` is one of the workspace's declared stages
 /// (WorkspacePieceStages), checked at write time, never an enum.
@@ -184,16 +192,32 @@ model Person {
 /// review lands. Approval is a piece-level fact; the version's own `review`
 /// records which version was approved.
 model Piece {
-  id          String    @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String    @map("workspace_id")
-  personId    String    @map("person_id")
-  title       String    @db.VarChar(200)
-  stage       String    @db.VarChar(40)
-  needsClient Boolean   @default(false) @map("needs_client")
-  updatedBy   String    @map("updated_by")
-  approvedAt  DateTime? @map("approved_at")
-  createdAt   DateTime  @default(now()) @map("created_at")
-  updatedAt   DateTime  @updatedAt @map("updated_at")
+  id                String    @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId       String    @map("workspace_id")
+  personId          String    @map("person_id")
+  title             String    @db.VarChar(200)
+  stage             String    @db.VarChar(40)
+  needsClient       Boolean   @default(false) @map("needs_client")
+  updatedBy         String    @map("updated_by")
+  approvedAt        DateTime? @map("approved_at")
+  // #8516 D1 — what the piece is: a `deliverable` (every row before #8516) or a
+  // `proposal` the client approves or sends back. Never changes after create.
+  kind              String    @default("deliverable") @db.VarChar(16)
+  // A proposal's price, in minor units of a two-decimal currency; both or
+  // neither, and only on a proposal.
+  priceAmount       Int?      @map("price_amount")
+  priceCurrency     String?   @map("price_currency") @db.Char(3)
+  // The client's current Stripe Checkout Session (#8516 D11) — its id, URL and
+  // expiry. Never served to the operator. Replaced once five minutes or less
+  // remain; the replaced session is expired at Stripe.
+  checkoutSessionId String?   @unique @map("checkout_session_id")
+  checkoutUrl       String?   @map("checkout_url") @db.VarChar(2048)
+  checkoutExpiresAt DateTime? @map("checkout_expires_at")
+  // When Stripe reported the proposal paid, and the session that paid it (D13).
+  paidAt            DateTime? @map("paid_at")
+  paidSessionId     String?   @map("paid_session_id")
+  createdAt         DateTime  @default(now()) @map("created_at")
+  updatedAt         DateTime  @updatedAt @map("updated_at")
 
   person   Person         @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "pieces_person_fk")
   versions PieceVersion[]
@@ -249,7 +273,9 @@ model PieceVersion {
 ///
 /// #8168 D3/D4 — `direction` is `outbound` (an operator's message, #7877) or
 /// `inbound` (a client's own write); `kind` is `message`, `quote` or
-/// `review`. An outbound row is always a `message` with no `payload`
+/// `review`. An outbound row is always a `message` whose `payload` is null
+/// or, since #8515 D6, exactly `{ "action": "onboarding" }` — the one outbound
+/// action, rendered by the client's site as a link to `/account/onboarding`
 /// (`interactions_outbound_shape`); a `quote` or `review` row carries the
 /// stored payload `packages/validation`'s member.ts types. Every existing
 /// reader filters to `direction: "outbound"`, so an inbound row is invisible

package/templates/database/migrations/20261015120000_person_notes/migration.sql

@@ -0,0 +1,77 @@
+-- #8514 — the client record's private notes (spec
+-- docs/specs/8514-redesign-the-person-record-page-spec.md D1, D2).
+--
+--   people (4 columns) — the team's one note on a client (never served to the
+--                    client), who last saved it (a user id of the auth
+--                    namespace, no foreign key — ADR 0009, the
+--                    piece_versions.delivered_by precedent), when, and which
+--                    agent when an agent saved it. Every column is nullable
+--                    and has no default, so Postgres changes only the catalog.
+--
+-- DDL first, then one data statement (D2b, below the marker): the DDL adds
+-- columns and CHECKs only; the data half removes inert client grants from
+-- agents of members. One directory, per the one-migration-per-milestone
+-- check (the #8435 person_contact shape). Prisma runs this file as one
+-- transaction; each CHECK below is added NOT VALID and then VALIDATEd over an
+-- all-NULL column, and the data half touches "agents" alone.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- notes and gives members the client rows; code without the columns fails
+-- every notes read, and code before the grant reset would switch the inert
+-- grants on (SEC-8514-B).
+--
+-- Rollback: ALTER TABLE "people" DROP COLUMN "notes", DROP COLUMN
+-- "notes_updated_at", DROP COLUMN "notes_updated_by", DROP COLUMN
+-- "notes_updated_by_agent"; (the CHECKs go with them). The grant reset needs
+-- none: every grant it removes was inert.
+
+-- AlterTable
+ALTER TABLE "people" ADD COLUMN     "notes" VARCHAR(5000),
+ADD COLUMN     "notes_updated_at" TIMESTAMP(3),
+ADD COLUMN     "notes_updated_by" TEXT,
+ADD COLUMN     "notes_updated_by_agent" TEXT;
+
+-- The editor is a user id of the auth namespace (the delivered_by shape).
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_updated_by_format"
+  CHECK ("notes_updated_by" IS NULL OR "notes_updated_by" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_updated_by_format";
+
+-- The agent, when one saved it, is an agent id (the agents_id_format shape).
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_updated_by_agent_format"
+  CHECK ("notes_updated_by_agent" IS NULL OR "notes_updated_by_agent" ~ '^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_updated_by_agent_format";
+
+-- Who and when are written together.
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_edit_pair"
+  CHECK (("notes_updated_at" IS NULL) = ("notes_updated_by" IS NULL)) NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_edit_pair";
+
+-- An agent's save always names the agent's person.
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_agent_has_person"
+  CHECK ("notes_updated_by_agent" IS NULL OR "notes_updated_by" IS NOT NULL) NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_agent_has_person";
+
+-- ===== #8514 D2b member agent grant reset (data only; runs after the DDL above) =====
+-- #8514 — dormant client grants cleared from agents of members (spec
+-- docs/specs/8514-redesign-the-person-record-page-spec.md D2b, SEC-8514-B).
+--
+-- Until #8514 a member held neither people-read nor member-pieces-manage, so
+-- the agent clamp (`can(personTenant.role, p)`) dropped either grant stored on
+-- a member's agent: it was inert. #8514 gives members both by role, and the
+-- clamp would then switch those stored grants on with no admin action. This
+-- removes them first, so a member's agent holds either only once an owner or
+-- admin grants it after the deploy.
+--
+-- DATA ONLY. Changes no effective permission at the time it runs (every grant
+-- it removes is inert). Idempotent: a second run matches no row.
+--
+-- Rollout: in the same deploy as, and BEFORE, the #8514 API code.
+--
+-- Rollback: none needed — every removed grant was inert.
+
+UPDATE "agents" a
+SET "grants" = array_remove(array_remove(a."grants", 'people-read'), 'member-pieces-manage')
+FROM "memberships" m
+WHERE m."id" = a."responsible_membership_id"
+  AND m."role" = 'member'
+  AND a."grants" && ARRAY['people-read', 'member-pieces-manage']::text[];

package/templates/database/migrations/20261015120000_rate_limit_counters/migration.sql

@@ -0,0 +1,43 @@
+-- #5040 — the rate limiter's shared database store (spec
+-- docs/specs/5040-the-api-s-rate-limiter-spec.md D2/D3). One row per bucket
+-- key hash; the middleware's database store (`apps/api/src/lib/rate-limit-store.ts`)
+-- is the only reader or writer. Belongs to the deployment, not a tenant: no
+-- workspace_id, no tenancy fence. Rows are disposable — a lost counter only
+-- resets a window.
+--
+-- Rollback (safe while no code selects the database store, i.e. deploy this
+-- migration before the code that reads AILK_RATE_LIMIT_STORE=database or
+-- defaults to it with DATABASE_URL set):
+--   DROP TABLE "rate_limit_counters";
+
+-- CreateTable
+CREATE TABLE "rate_limit_counters" (
+    "id" TEXT NOT NULL DEFAULT ('rlc_'::text || (uuidv7())::text),
+    "key_hash" TEXT NOT NULL,
+    "window_start_ms" BIGINT NOT NULL,
+    "window_ms" INTEGER NOT NULL,
+    "count" INTEGER NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+    CONSTRAINT "rate_limit_counters_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "rate_limit_counters_key_hash_key" ON "rate_limit_counters"("key_hash");
+
+-- CreateIndex
+-- The sweep: DELETE WHERE window_start_ms + window_ms <= now.
+CREATE INDEX "rate_limit_counters_window_start_ms_idx" ON "rate_limit_counters"("window_start_ms");
+
+-- ADR-0031 rule 3 — rate_limit_counters: rlc_ (registered in
+-- packages/ids/src/registry.ts; this migration's path is added to
+-- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "rate_limit_counters" ALTER COLUMN "id" SET DEFAULT ('rlc_'::text || (uuidv7())::text);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_id_format" CHECK ("id" ~ '^rlc_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- D2 — key_hash is always a sha256 hex digest, never the raw bucket key.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_key_hash_hex" CHECK ("key_hash" ~ '^[0-9a-f]{64}$');
+
+-- D2 — window_ms > 0, count >= 1.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_window_ms_positive" CHECK ("window_ms" > 0);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_count_positive" CHECK ("count" >= 1);

package/templates/database/migrations/20261016120000_piece_kind/migration.sql

@@ -0,0 +1,95 @@
+-- #8516 — proposals as an artifact kind (spec
+-- docs/specs/8516-proposals-as-an-artifact-kind-spec.md D1, D2).
+--
+--   pieces (8 columns) — what a piece is (`kind`: `deliverable` or
+--                    `proposal`), a proposal's optional price (minor units
+--                    of a two-decimal currency), the client's current Stripe
+--                    Checkout Session (id, URL, expiry) and when Stripe
+--                    reported the proposal paid, with the session that paid
+--                    it. Stripe objects are named by plain columns with a
+--                    format CHECK and no foreign key (ADR 0009).
+--
+-- DDL only. Every existing row reads `kind = 'deliverable'` from the constant
+-- default — Postgres stores the default in the catalog and rewrites no row, so
+-- `updated_at` and every other column of an existing piece are unchanged. The
+-- seven other columns are nullable with no default. Each CHECK below is added
+-- NOT VALID and then VALIDATEd; every existing row passes each one (a
+-- deliverable with every new column NULL).
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- columns; code without them fails every piece read.
+--
+-- Rollback: DROP INDEX "pieces_checkout_session_id_key"; ALTER TABLE "pieces"
+-- DROP COLUMN "kind", DROP COLUMN "price_amount", DROP COLUMN
+-- "price_currency", DROP COLUMN "checkout_session_id", DROP COLUMN
+-- "checkout_url", DROP COLUMN "checkout_expires_at", DROP COLUMN "paid_at",
+-- DROP COLUMN "paid_session_id"; (the CHECKs go with them).
+
+-- AlterTable
+ALTER TABLE "pieces" ADD COLUMN     "kind" VARCHAR(16) NOT NULL DEFAULT 'deliverable',
+ADD COLUMN     "price_amount" INTEGER,
+ADD COLUMN     "price_currency" CHAR(3),
+ADD COLUMN     "checkout_session_id" TEXT,
+ADD COLUMN     "checkout_url" VARCHAR(2048),
+ADD COLUMN     "checkout_expires_at" TIMESTAMP(3),
+ADD COLUMN     "paid_at" TIMESTAMP(3),
+ADD COLUMN     "paid_session_id" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "pieces_checkout_session_id_key" ON "pieces"("checkout_session_id");
+
+-- A piece is a deliverable or a proposal, nothing else.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_kind_allowed"
+  CHECK ("kind" IN ('deliverable', 'proposal')) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_kind_allowed";
+
+-- An amount and its currency are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_pair"
+  CHECK (("price_amount" IS NULL) = ("price_currency" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_pair";
+
+-- 1 to 100,000,000 minor units (PROPOSAL_PRICE_MAX_MINOR).
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_range"
+  CHECK ("price_amount" IS NULL OR "price_amount" BETWEEN 1 AND 100000000) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_range";
+
+-- A lower-case ISO-4217 code.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_currency_format"
+  CHECK ("price_currency" IS NULL OR "price_currency" ~ '^[a-z]{3}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_currency_format";
+
+-- Only a proposal carries a price.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_proposal_only"
+  CHECK ("price_amount" IS NULL OR "kind" = 'proposal') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_proposal_only";
+
+-- A Checkout Session's id, URL and expiry are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_triple"
+  CHECK (("checkout_session_id" IS NULL) = ("checkout_url" IS NULL)
+     AND ("checkout_session_id" IS NULL) = ("checkout_expires_at" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_triple";
+
+-- A Stripe Checkout Session id.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_session_format"
+  CHECK ("checkout_session_id" IS NULL OR "checkout_session_id" ~ '^cs_(test|live)_[A-Za-z0-9]{1,250}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_session_format";
+
+-- A Checkout URL is https.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_url_https"
+  CHECK ("checkout_url" IS NULL OR "checkout_url" ~ '^https://') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_url_https";
+
+-- A Checkout Session opens only for an approved, priced proposal.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_needs_approved_price"
+  CHECK ("checkout_session_id" IS NULL OR ("price_amount" IS NOT NULL AND "approved_at" IS NOT NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_needs_approved_price";
+
+-- When paid and the session that paid are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_pair"
+  CHECK (("paid_at" IS NULL) = ("paid_session_id" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_pair";
+
+-- Only a priced proposal is paid.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_needs_price"
+  CHECK ("paid_at" IS NULL OR "price_amount" IS NOT NULL) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_needs_price";

package/templates/database/migrations/20261017120000_outbound_message_action/migration.sql

@@ -0,0 +1,30 @@
+-- #8515 — an outbound message may carry the onboarding action (spec
+-- docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md D6).
+--
+-- `interactions_outbound_shape` (20261012120000_member_contract) admitted an
+-- outbound row only as a payload-free `message`. Start onboarding writes an
+-- outbound `message` whose `payload` is exactly `{"action": "onboarding"}`,
+-- which the client's own site renders as a link to its `/account/onboarding`.
+-- The CHECK is replaced in place, under the same name, admitting that one
+-- payload and nothing else; no other constraint changes and no row is
+-- rewritten. The new CHECK is added NOT VALID and then VALIDATEd (the #8516
+-- piece_kind shape). The DROP takes ACCESS EXCLUSIVE and, in the migration's
+-- one transaction, holds it through the VALIDATE scan, so the table is locked
+-- for that scan; in exchange there is no moment without the constraint. Every
+-- existing outbound row is payload-free and passes.
+--
+-- Folder name: the spec named 20261016120000; #8516's 20261016120000_piece_kind
+-- landed first at that timestamp, so this sorts after it (spec §5.3).
+--
+-- Rollback — only AFTER the code is rolled back (running code would write
+-- rows the old CHECK refuses):
+--   UPDATE "interactions" SET "payload" = NULL WHERE "direction" = 'outbound';
+--   ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+--   ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+--     CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND "payload" IS NULL));
+-- Clients then lose the Open onboarding link on those messages; the body stays.
+
+ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+  CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND ("payload" IS NULL OR "payload" = '{"action": "onboarding"}'::jsonb))) NOT VALID;
+ALTER TABLE "interactions" VALIDATE CONSTRAINT "interactions_outbound_shape";

package/templates/database/ops/schema.prisma

@@ -25,3 +25,19 @@ model AuditLog {
   @@index([workspaceId, targetType, targetId])
   @@map("audit_logs")
 }
+
+/// RateLimitCounter — the shared per-bucket counter for `rateLimitMiddleware`'s
+/// database store (#5040 D2). Belongs to the deployment, not a tenant: no
+/// workspaceId, no tenancy fence. Rows are disposable — a lost counter only
+/// resets a window. `key_hash` is sha256(bucketKey) hex, never the raw key.
+model RateLimitCounter {
+  id            String   @id @default(dbgenerated("('rlc_'::text || (uuidv7())::text)")) @db.Text
+  keyHash       String   @unique @map("key_hash") @db.Text // sha256(bucketKey) hex
+  windowStartMs BigInt   @map("window_start_ms")
+  windowMs      Int      @map("window_ms")
+  count         Int
+  createdAt     DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@index([windowStartMs], map: "rate_limit_counters_window_start_ms_idx")
+  @@map("rate_limit_counters")
+}

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/project.yaml

@@ -1,7 +1,8 @@
 schema_version: 1
 
 # project.yaml — per-repo configuration consumed by Claude Code skills and
-# global rules. Replace REPLACE_ME values with your repo's actual identity.
+# global rules. Replace every REPLACE_ME value with your repo's own: its
+# identity and its Slack channel.
 #
 # See https://github.com/working-theory-labs/ai-launch-kit/blob/main/project.yaml
 # for AI Launch Kit's own canonical example.
@@ -10,10 +11,13 @@ identity:
   name: REPLACE_ME # your repo slug, kebab-case
   github_repo: REPLACE_ME/REPLACE_ME # owner/repo on GitHub
   npm_scope: "@REPLACE_ME" # e.g. "@yourorg" — replace with your npm scope
-  visibility: private # "oss" | "private"
+  visibility: private # "public" | "private" | "internal"
   default_branch: main
   branching_model: single_trunk
 
+slack:
+  primary_channel: REPLACE_ME # channel name without "#", where this repo's CI and agent reports land
+
 product:
   identity_mode: organization # "organization" | "person" | null
   default_locale: en
@@ -27,7 +31,6 @@ labels:
   blocked: status/blocked
   done: status/done
   needs_spec: status/needs-spec
-  auto_merge: auto-merge-eligible
 
 verification:
   preflight: pnpm preflight