create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/services/offerings/source.ts

@@ -1,140 +0,0 @@
-/**
- * The Stripe-backed Offerings catalog source (#8922, spec
- * docs/specs/8922-the-may-sell-product-list-spec.md D2; contract
- * docs/specs/8879-the-offerings-security-contract-key-spec.md C8, T1, T7) —
- * the `OfferingsSourceFor` the routes pass to the read services: one
- * Organization's active Products and Prices, read through its own
- * connection's client (#8907 D12) and paged to the normalizer's caps.
- *
- * `stripeCatalogSourceFor` does no work when called, so it can never throw
- * outside the services' failure memo (#8876 D8). It takes a bare
- * Organization id and checks neither the tenant nor the claim — its callers
- * do — so `architecture.yaml` confines it to the exact files that call it.
- *
- * BOUNDED (SEC-8922-3). Each list is paged by calls, not items: at most
- * `OFFERINGS_CATALOG_PRODUCTS_MAX / 100` product calls and
- * `OFFERINGS_CATALOG_PRICES_MAX / 100` price calls, stopping early on
- * `has_more: false`, an empty page, a page whose last id repeats the cursor
- * it was asked with, or a full count. The whole read is bounded by
- * `OFFERINGS_CATALOG_READ_TIMEOUT_MS`; after it fails, no further call is
- * started.
- *
- * A list cut off at its cap while Stripe still had more is logged as
- * `catalog_truncated` (SEC-8922-7), with the Organization and nothing else.
- *
- * Nothing is filtered or cached here: the client lives only inside
- * one read (C8), and every field is normalized once by `normalizeCatalog`
- * (T1). A disconnected or unusable connection rejects, never reading as an
- * empty catalog; a Stripe error rejects as itself, and the services turn it
- * into `OfferingsSourceError` without its text.
- */
-import { logger } from "@working-theory/observability";
-
-import {
-  OFFERINGS_CATALOG_PRICES_MAX,
-  OFFERINGS_CATALOG_PRODUCTS_MAX,
-  type OfferingsCatalog,
-  type OfferingsCatalogSource,
-} from "./catalog.js";
-import { stripeClientForOrganization } from "./connection.js";
-
-import type { OfferingsSourceFor } from "./index.js";
-
-/** The longest one catalog read may take, connection lookup included. */
-export const OFFERINGS_CATALOG_READ_TIMEOUT_MS = 20_000;
-
-const PAGE_LIMIT = 100;
-
-/** No usable connection, or the read timed out. The message is fixed; there is no cause. */
-export class OfferingsCatalogUnavailableError extends Error {
-  constructor() {
-    super("The Offerings catalog source is unavailable");
-    this.name = "OfferingsCatalogUnavailableError";
-  }
-}
-
-interface ListParams {
-  active: true;
-  limit: number;
-  starting_after?: string;
-}
-
-interface ListPage<T> {
-  data: T[];
-  has_more: boolean;
-}
-
-/**
- * One list paged to `maxItems`, by at most `maxItems / PAGE_LIMIT` calls.
- * `truncated` when the bound stopped it while Stripe still had more.
- */
-async function pageAll<T extends { id?: unknown }>(
-  list: (params: ListParams) => PromiseLike<ListPage<T>>,
-  maxItems: number,
-  aborted: () => boolean,
-): Promise<{ items: T[]; truncated: boolean }> {
-  const items: T[] = [];
-  let after: string | undefined;
-  for (let call = 0; call < maxItems / PAGE_LIMIT && items.length < maxItems; call++) {
-    if (aborted()) throw new OfferingsCatalogUnavailableError();
-    const page = await list({
-      active: true,
-      limit: PAGE_LIMIT,
-      ...(after !== undefined && { starting_after: after }),
-    });
-    items.push(...page.data);
-    const last = page.data.at(-1)?.id;
-    if (!page.has_more || typeof last !== "string" || last === after) return { items, truncated: false };
-    after = last;
-  }
-  return { items, truncated: true };
-}
-
-/** The Organization's catalog source. Builds nothing until it is read. */
-export const stripeCatalogSourceFor: OfferingsSourceFor = (
-  organizationId: string,
-): OfferingsCatalogSource => ({
-  async listActiveCatalog(): Promise<OfferingsCatalog> {
-    let aborted = false;
-    const isAborted = () => aborted;
-    const read = (async (): Promise<OfferingsCatalog> => {
-      const connection = await stripeClientForOrganization(organizationId);
-      if (connection.kind !== "ok") throw new OfferingsCatalogUnavailableError();
-      const { client } = connection;
-      const products = pageAll(
-        (params) => client.products.list(params),
-        OFFERINGS_CATALOG_PRODUCTS_MAX,
-        isAborted,
-      );
-      const prices = pageAll((params) => client.prices.list(params), OFFERINGS_CATALOG_PRICES_MAX, isAborted);
-      // Each loop is caught on its own, so a page that rejects after the
-      // other loop or the timeout has failed the read is never unhandled.
-      products.catch(() => undefined);
-      prices.catch(() => undefined);
-      const [productPages, pricePages] = await Promise.all([products, prices]);
-      if (productPages.truncated || pricePages.truncated) {
-        logger.warn(
-          { organizationId, reason: "catalog_truncated" },
-          "[offerings] catalog over its read cap",
-        );
-      }
-      return { products: productPages.items, prices: pricePages.items };
-    })();
-    read.catch(() => undefined);
-
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    const timeout = new Promise<never>((_resolve, reject) => {
-      timer = setTimeout(() => {
-        aborted = true;
-        reject(new OfferingsCatalogUnavailableError());
-      }, OFFERINGS_CATALOG_READ_TIMEOUT_MS);
-    });
-    try {
-      return await Promise.race([read, timeout]);
-    } finally {
-      clearTimeout(timer);
-      // A loop still running after the other one failed starts no more calls.
-      aborted = true;
-    }
-  },
-});

package/templates/apps/api/src/services/offerings/store.ts

@@ -1,150 +0,0 @@
-/**
- * The Offerings sets and the snapshot (#8876, spec
- * docs/specs/8876-the-offerings-data-model-typed-spec.md D6) — the one file
- * naming the org-enabled set, the workspace selection and its snapshot, and,
- * for this service, the workspace's Organization.
- *
- * Every argument is a server-resolved id, never a request value, except a
- * set or selection handed to a writer, which its caller checked and the
- * writer parses; and no function lists or enumerates. The selection read
- * never names the snapshot, so checkout's allowlist (contract A4) can never
- * read the display copy.
- *
- * This file writes the snapshot, only into a row that exists; for #8922, the
- * org-enabled set; and, for #8926, the workspace selection and Recommended,
- * creating its row.
- */
-import {
-  offeringsProductIdsSchema,
-  workspaceOfferingsSelectionSchema,
-  type OfferingsSnapshot,
-} from "@working-theory/validation";
-
-import { prisma } from "../../lib/prisma.js";
-
-/**
- * An Offerings result, or a set handed to a writer, failed its schema. The
- * message is fixed; there is no cause. Re-exported by `index.ts`.
- */
-export class OfferingsShapeError extends Error {
-  constructor() {
-    super("An Offerings result failed its schema");
-    this.name = "OfferingsShapeError";
-  }
-}
-
-export interface WorkspaceSelection {
-  shownProductIds: string[];
-  /** The shown Prices (#9070 D1); empty for a row saved per Product. */
-  shownPriceIds: string[];
-  recommendedPlanProductId: string | null;
-  recommendedAddonProductId: string | null;
-}
-
-export interface WorkspaceSnapshotRow {
-  snapshot: unknown;
-  snapshotAt: Date | null;
-}
-
-/** The workspace's own Organization, or `null` for no workspace. */
-export async function organizationIdOfWorkspace(workspaceId: string): Promise<string | null> {
-  const row = await prisma.workspace.findUnique({
-    where: { id: workspaceId },
-    select: { organizationId: true },
-  });
-  return row?.organizationId ?? null;
-}
-
-/** The org-enabled set; no row is the empty set. */
-export async function readEnabledProductIds(organizationId: string): Promise<string[]> {
-  const row = await prisma.organizationOfferings.findUnique({
-    where: { organizationId },
-    select: { enabledProductIds: true },
-  });
-  return row?.enabledProductIds ?? [];
-}
-
-/**
- * Replace the org-enabled set (#8922 D4), creating the row on an
- * Organization's first save. Every set is parsed first — at most 100
- * distinct Stripe ids — so the bound holds for every writer.
- */
-export async function writeEnabledProductIds(organizationId: string, productIds: string[]): Promise<void> {
-  const parsed = offeringsProductIdsSchema.safeParse(productIds);
-  if (!parsed.success) throw new OfferingsShapeError();
-  await prisma.organizationOfferings.upsert({
-    where: { organizationId },
-    create: { organizationId, enabledProductIds: parsed.data },
-    update: { enabledProductIds: parsed.data },
-  });
-}
-
-/** The shown set and Recommended, or `null` for no row. Never the snapshot. */
-export async function readWorkspaceSelection(workspaceId: string): Promise<WorkspaceSelection | null> {
-  return prisma.workspaceOfferings.findUnique({
-    where: { workspaceId },
-    select: {
-      shownProductIds: true,
-      shownPriceIds: true,
-      recommendedPlanProductId: true,
-      recommendedAddonProductId: true,
-    },
-  });
-}
-
-/**
- * Replace the workspace's selection (#8926 D5), creating the row on its first
- * save. Every selection is parsed first — at most 100 distinct Product ids
- * and 300 Price ids, Prices exactly when Products (#9070 D4), each
- * Recommended shown — so the database's CHECKs never fire and no new save is
- * at the per-Product grain. Never names the snapshot, so a save keeps the
- * last good copy.
- */
-export async function writeWorkspaceSelection(
-  workspaceId: string,
-  selection: WorkspaceSelection,
-): Promise<void> {
-  const parsed = workspaceOfferingsSelectionSchema.safeParse(selection);
-  if (!parsed.success) throw new OfferingsShapeError();
-  const { shownProductIds, shownPriceIds, recommendedPlanProductId, recommendedAddonProductId } =
-    parsed.data;
-  await prisma.workspaceOfferings.upsert({
-    where: { workspaceId },
-    create: { workspaceId, shownProductIds, shownPriceIds, recommendedPlanProductId, recommendedAddonProductId },
-    update: { shownProductIds, shownPriceIds, recommendedPlanProductId, recommendedAddonProductId },
-  });
-}
-
-/** The last-good snapshot and its time, or `null` for no row. */
-export async function readWorkspaceSnapshot(workspaceId: string): Promise<WorkspaceSnapshotRow | null> {
-  return prisma.workspaceOfferings.findUnique({
-    where: { workspaceId },
-    select: { snapshot: true, snapshotAt: true },
-  });
-}
-
-/**
- * Write a parsed snapshot and its time together (the pairing CHECK). Creates
- * no row, and never replaces a snapshot dated after `at` (unless it is dated
- * more than `futureSkewMs` past it, which no reader serves): `false` when
- * nothing was written.
- */
-export async function writeWorkspaceSnapshot(
-  workspaceId: string,
-  snapshot: OfferingsSnapshot,
-  at: Date,
-  futureSkewMs: number,
-): Promise<boolean> {
-  const { count } = await prisma.workspaceOfferings.updateMany({
-    where: {
-      workspaceId,
-      OR: [
-        { snapshotAt: null },
-        { snapshotAt: { lte: at } },
-        { snapshotAt: { gt: new Date(at.getTime() + futureSkewMs) } },
-      ],
-    },
-    data: { snapshot, snapshotAt: at },
-  });
-  return count > 0;
-}

package/templates/apps/api/src/services/owner-workspaces.ts

@@ -1,132 +0,0 @@
-/**
- * @file owner-workspaces.ts
- * @description The ONE site→workspace resolution in `apps/api`.
- *
- * A `Lead` is keyed on `siteId` and a `Workspace` on `id`, but the two are the
- * SAME value space named per namespace — `database/config/schema.prisma` says
- * as much of `ProjectListing`, "the one keyed on `siteId` rather than
- * `workspaceId`". So ownership is the direct membership test
- * `siteId ∈ workspaceIds`, never a join through a mapping table, and every
- * caller that needs it resolves it here rather than writing a second path: a
- * divergent isolation path across two PII surfaces is exactly the thing that
- * turns into rework when the multi-tenant product arrives.
- *
- * Callers: `lead-promotion.ts` (lead → user promotion, #3586) and
- * `leads-inbox.ts` (the owner's leads read, #5678).
- *
- * ## Why this is its own file rather than a `lead-promotion.ts` export
- *
- * `paidModuleTemplateExclusions()` (`packages/create-ailk/src/module-architecture.ts`)
- * walks the import graph from each paid module's `ownedFiles` to a fixed point
- * and drops every file that reaches one, so that a keyless scaffold carries no
- * paid source. `lead-promotion.ts` is inside that closure and always has been,
- * which means anything importing it is dropped too. Putting this function
- * there and importing it from the leads read would have carried the closure
- * through `leads-inbox.ts` and `routes/leads/list.ts` into `server.ts`, and a
- * scaffold with no server entry point does not build — the same base-breaking
- * cascade `module-architecture.ts` records twice in its own comments, measured
- * here before this file existed. Keeping the resolution in a module that
- * reaches nothing excluded is what lets both callers share it.
- *
- * Nothing in this file may name `tenant-context.js` in an import form,
- * including inside a comment: the closure's scanner is a regular expression
- * over the file's text and does not know which lines are code.
- */
-
-import type { Id } from "@working-theory/ids";
-
-import { isModuleEnabled } from "../config/modules.js";
-import { loadSlice } from "../lib/slice-load.js";
-
-/**
- * The tenant-context module is a multi-tenant SLICE the OSS strip removes
- * (#5182), and `listTenancy` is a VALUE — a runtime call, not an erasable type
- * — so a static import, or a specifier written literally at the call site,
- * would be TS2307 on the public tree: `tsc` resolves a string-literal
- * specifier whether or not the branch containing it can ever run.
- *
- * The remedy is the one `server.ts` and `lead-promotion.ts` already use: gate
- * the call on `isModuleEnabled('multi-tenant')` and read the specifier from
- * this constant, so it is not a literal at the call site. What defeats
- * resolution is the INDIRECTION, not the type of the value. The constant form
- * matters too — `@vercel/nft` constant-propagates a module-level binding into
- * the dynamic call and emits the file, which a table lookup would hide from it
- * (#5304 D3).
- *
- * `apps/api` is a `tsc`-only surface with no bundler, which is the
- * precondition that makes this sound here.
- */
-const TENANT_CONTEXT_SPECIFIER = "./tenant-context.js";
-
-/** The one export this file needs from the multi-tenant slice. */
-interface TenantContextSlice {
-  listTenancy: (params: {
-    userId: Id<"user">;
-    sessionTenant: undefined;
-  }) => Promise<
-    | {
-        ok: true;
-        value: {
-          organizations: Array<{
-            role: string;
-            workspaces: Array<{ id: string }>;
-          }>;
-        };
-      }
-    | { ok: false; error: { message: string } }
-  >;
-}
-
-/**
- * One workspace the caller belongs to, carrying the role they hold in its
- * organization. `role` is the organization-level `Membership.role`
- * (`owner | admin | member`) the tenancy assembler already returns — typed as a
- * plain string here rather than `MembershipRole`, because that type lives in
- * the stripped slice this file may not name.
- */
-export type OwnerWorkspace = { id: string; role: string };
-
-export type ResolveOwnerWorkspacesResult =
-  | { ok: true; value: OwnerWorkspace[] }
-  | { ok: false; error: { message: string } };
-
-/**
- * Resolve the caller's OWN workspaces.
- *
- * Delegates to the sole cross-namespace tenancy assembler — this file never
- * issues a raw membership or workspace model query of its own, which
- * `architecture.yaml`'s tenant-scope forbidden pattern reserves to the
- * tenant-context and tenant-db modules.
- *
- * Module-conditional, and #5677 changed what that MEANS rather than what it
- * does. `services/default-tenant.ts` now resolves the seeded default
- * Workspace on every build, so a module-less deployment does have a
- * resolvable workspace — the empty result below is a deliberate scope limit,
- * not a statement that there is nothing to resolve. Wiring this resolver to
- * that default is a behavior change for BOTH callers at once (promotion would
- * begin stamping `promotedUserId` on single-tenant leads, which
- * `/v1/flow-checkouts/me` and `/v1/waitlist-signups/me` join through), and it
- * needs the deployment to pin `AILK_SITE_ID` to `DEFAULT_WORKSPACE_ID` —
- * `siteId` comes from `lib/site.ts` while `workspaceId` is the sentinel, and
- * `siteId ∈ workspaceIds` only matches when those agree.
- */
-export async function resolveOwnerWorkspaces(
-  userId: Id<"user">,
-): Promise<ResolveOwnerWorkspacesResult> {
-  if (!isModuleEnabled("multi-tenant")) return { ok: true, value: [] };
-
-  const specifier: string = TENANT_CONTEXT_SPECIFIER;
-  const { listTenancy } = (await loadSlice(
-    specifier,
-    () => import(specifier),
-  )) as TenantContextSlice;
-  const tenancy = await listTenancy({ userId, sessionTenant: undefined });
-  if (!tenancy.ok) return { ok: false, error: tenancy.error };
-
-  return {
-    ok: true,
-    value: tenancy.value.organizations.flatMap((org) =>
-      org.workspaces.map((workspace) => ({ id: workspace.id, role: org.role })),
-    ),
-  };
-}