create-ailk 0.23.0 → 0.25.1

package/templates/tsconfig.json

@@ -3,7 +3,6 @@
   "references": [
     { "path": "./apps/api" },
     { "path": "./apps/mcp" },
-    { "path": "./apps/web" },
-    { "path": "./database/tsconfig.build.json" }
+    { "path": "./apps/web" }
   ]
 }

package/versions.json

@@ -1,53 +1,66 @@
 {
-  "@working-theory/admin-ui": "0.44.0",
-  "@working-theory/aeo": "0.44.0",
-  "@working-theory/agent-context": "0.44.0",
+  "@working-theory/admin-ui": "0.46.0",
+  "@working-theory/aeo": "0.46.0",
+  "@working-theory/agent-context": "0.46.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.44.0",
-  "@working-theory/api-client": "0.44.0",
+  "@working-theory/analytics": "0.46.0",
+  "@working-theory/api": "0.46.0",
+  "@working-theory/api-client": "0.46.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.44.0",
-  "@working-theory/common": "0.44.0",
+  "@working-theory/cli": "0.46.0",
+  "@working-theory/common": "0.46.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.44.0",
-  "@working-theory/content-projection": "0.44.0",
-  "@working-theory/email": "0.44.0",
+  "@working-theory/content-adapters": "0.46.0",
+  "@working-theory/content-projection": "0.46.0",
+  "@working-theory/email": "0.46.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.44.0",
-  "@working-theory/fumadocs-schema": "0.44.0",
+  "@working-theory/eslint-config": "0.46.0",
+  "@working-theory/fumadocs-schema": "0.46.0",
   "@working-theory/ids": "0.15.0",
-  "@working-theory/jsonld": "0.44.0",
-  "@working-theory/license": "0.44.0",
-  "@working-theory/metadata": "0.44.0",
-  "@working-theory/observability": "0.44.0",
-  "@working-theory/page-renderer": "0.44.0",
+  "@working-theory/jsonld": "0.46.0",
+  "@working-theory/license": "0.46.0",
+  "@working-theory/mcp-server": "0.46.0",
+  "@working-theory/metadata": "0.46.0",
+  "@working-theory/observability": "0.46.0",
+  "@working-theory/page-renderer": "0.46.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.44.0",
-  "@working-theory/schema-pack-registry": "0.44.0",
-  "@working-theory/schema-validator": "0.44.0",
-  "@working-theory/sections-registry": "0.44.0",
-  "@working-theory/site-config": "0.44.0",
-  "@working-theory/spoke-checkout": "0.7.0",
-  "@working-theory/stripe-client": "0.44.0",
-  "@working-theory/templates": "0.44.0",
-  "@working-theory/theme": "0.44.0",
-  "@working-theory/ui": "0.44.0",
-  "@working-theory/validation": "0.44.0",
-  "@working-theory/web-i18n": "0.44.0",
+  "@working-theory/schema": "0.46.0",
+  "@working-theory/schema-pack-registry": "0.46.0",
+  "@working-theory/schema-validator": "0.46.0",
+  "@working-theory/sections-registry": "0.46.0",
+  "@working-theory/site-config": "0.46.0",
+  "@working-theory/spoke-checkout": "0.7.2",
+  "@working-theory/stripe-client": "0.46.0",
+  "@working-theory/templates": "0.46.0",
+  "@working-theory/theme": "0.46.0",
+  "@working-theory/ui": "0.46.0",
+  "@working-theory/validation": "0.46.0",
+  "@working-theory/web-i18n": "0.46.0",
+  "@working-theory/admin": "0.3.0",
+  "@working-theory/api-commerce": "0.1.0",
+  "@working-theory/api-content-write": "0.1.0",
+  "@working-theory/api-hub": "0.1.0",
+  "@working-theory/api-multi-tenant": "0.1.0",
+  "@working-theory/api-scheduling": "0.1.0",
+  "@working-theory/api-signal-collectors": "0.1.0",
+  "@working-theory/api-workspace": "0.1.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
+  "@working-theory/mcp-scheduling": "0.2.0",
+  "@working-theory/mcp-signal-collectors": "0.2.0",
+  "@working-theory/mcp-workspace": "0.2.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.22",
-  "@working-theory/ui-docs-blog": "0.23.22",
-  "@working-theory/ui-scheduling": "0.24.2",
-  "@working-theory/ui-signal-collectors": "0.27.0",
+  "@working-theory/ui-commerce": "0.23.24",
+  "@working-theory/ui-docs-blog": "0.23.24",
+  "@working-theory/ui-scheduling": "0.24.4",
+  "@working-theory/ui-signal-collectors": "0.27.2",
   "@working-theory/web": "0.0.0",
-  "@working-theory/api": "1.0.0",
+  "@working-theory/app-api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.44.0"
+  "@working-theory/database": "0.46.0"
 }

package/templates/apps/api/src/__tests__/commerce-claim-registration.test.ts

@@ -1,409 +0,0 @@
-/**
- * @file commerce-claim-registration.test.ts
- * @description The commerce PRIMITIVES serve on the license claim, not the
- * module flag (DECISION-LOG D-64, epic #5770, #5796).
- *
- * `POST /v1/checkout/sessions` (the checkout launcher) and
- * `POST /v1/webhooks/stripe` (the webhook receiver + customer mapping) are
- * registered unconditionally in `server.ts` — no `isModuleEnabled("commerce")`
- * gate. Every case below therefore runs with **no module flag set at all**
- * (`AILK_ENABLED_MODULES` deleted), so a pass cannot be explained by module
- * registration; only the stubbed `checkLicense()` result varies.
- *
- * The four gate cases:
- *
- *   1. keyless (free, no features) → checkout answers the module-disabled 404
- *   2. keyless                     → the webhook answers the module-disabled 404
- *   3. commerce claim              → checkout serves (never 404)
- *   4. commerce claim              → the webhook serves (never 404)
- *
- * Plus D3's webhook order: a **signed** event on an **unclaimed** build is
- * acked 200 and dropped with a structured log line — the signature is settled
- * before the claim is consulted, so Stripe stops retrying against a site that
- * turned commerce off, while an unsigned body on that same build gets the
- * module-disabled 404 (indistinguishable from a build without the module).
- *
- * "Serves" is measured as "not Fastify's own 404 and not the gate's 404" —
- * the same signal `module-exclusion.test.ts` uses. A registered-and-claimed
- * checkout route answers 400 (Zod validation, empty body), never 404.
- *
- * Mirrors `src/__tests__/server.test.ts`'s external-boundary mocks.
- */
-
-jest.mock('@fastify/cors', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@fastify/rate-limit', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@working-theory/email', () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-const mockCheckLicense = jest.fn();
-// `checkLicense` is stubbed (it reaches the network and the clock);
-// `readStoredJwtState` deliberately is NOT — the unreadable-storage case below
-// proves the 503 through the package's REAL filesystem read, pointed at a
-// fixture path via `AILK_LICENSE_STORAGE_PATH` (#5820). Stubbing it here would
-// assert only that the stub was called.
-jest.mock('@working-theory/license', () => ({
-  ...jest.requireActual('@working-theory/license'),
-  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
-}));
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'StripeWebhookSignatureError';
-  }
-}
-// #6084 — GET /v1/checkout/sessions/:id's own retrieve, stubbed with a
-// payload-free default so a claimed request that never called mockReset
-// still answers 200 rather than throwing `undefined`.
-const mockRetrieveCheckoutSession = jest.fn();
-
-jest.mock('@working-theory/stripe-client', () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  retrieveCheckoutSession: (...args: unknown[]) =>
-    mockRetrieveCheckoutSession(...args),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: '2024-06-20',
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  UnknownSessionError: class UnknownSessionError extends Error {},
-  // #6866 — sessions.ts tests `instanceof UnknownCustomerError`.
-  UnknownCustomerError: class UnknownCustomerError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary; __mocks__/prisma.ts is the repo-standard double.
-jest.mock('../lib/prisma.js');
-
-import { promises as fs } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-
-import { __resetBuckets } from '../middleware/rate-limit.js';
-import { prisma } from '../lib/prisma.js';
-import { build } from '../server';
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics
-type App = any;
-
-// The reserved-range sentinel values from database/tenancy.ts (ADR-0031
-// rule 7) — re-declared here as literals so the test pins the WIRE values,
-// the same convention middleware/__tests__/default-tenant.test.ts uses.
-const DEFAULT_ORG_ID = 'org_00000000-0000-7000-8000-000000000001';
-const DEFAULT_WORKSPACE_ID = 'wksp_00000000-0000-7000-8000-000000000001';
-
-const FREE_LICENSE = {
-  tier: 'free' as const,
-  plan: null,
-  features: [] as string[],
-  expiresAt: null,
-  revoked: false,
-};
-
-const COMMERCE_LICENSE = {
-  tier: 'pro' as const,
-  plan: 'pro-monthly',
-  features: ['commerce'] as string[],
-  expiresAt: null,
-  revoked: false,
-};
-
-const CHECKOUT = { method: 'POST' as const, url: '/v1/checkout/sessions' };
-const WEBHOOK = { method: 'POST' as const, url: '/v1/webhooks/stripe' };
-// #6084 — the read half. `cs_test_...` shape-passes the route's own gate so
-// a claim-gate assertion never masquerades as a shape-gate 400.
-const CHECKOUT_SESSION_READ = {
-  method: 'GET' as const,
-  url: '/v1/checkout/sessions/cs_test_commerce_claim_fixture',
-};
-
-/** Build with NO module flag set — the whole point of the matrix. */
-async function buildKeylessModuleSet(): Promise<App> {
-  delete process.env.AILK_ENABLED_MODULES;
-  return build();
-}
-
-describe('Commerce primitives gate on the license claim, not the module flag (D-64, #5796)', () => {
-  let app: App;
-
-  beforeEach(() => {
-    // #6155 D6 — build() now awaits assertSiteAliasResolves(), which reads
-    // prisma.workspace for the unpinned "default" alias every case here
-    // resolves under (no case sets AILK_SITE_ID). None of this file's
-    // assertions are about tenancy, so this stubs the healthy default —
-    // the seeded sentinel workspace resolving cleanly — rather than
-    // widening the shared mock's own default for every OTHER consumer.
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: DEFAULT_ORG_ID,
-    });
-    mockCheckLicense.mockReset();
-    mockVerifyWebhookSignature.mockReset();
-    mockRetrieveCheckoutSession.mockReset();
-    mockRetrieveCheckoutSession.mockResolvedValue({
-      id: 'cs_test_commerce_claim_fixture',
-      status: 'complete',
-      paymentStatus: 'paid',
-      currency: 'usd',
-      amountTotal: 100,
-      lineItems: [],
-    });
-    // The GET's own rate limiter is MODULE-scoped (middleware/rate-limit.ts
-    // § "Module-scoped bucket store") and shared across every `it` in this
-    // file's single module instance.
-    __resetBuckets();
-    delete process.env.AILK_ENABLED_MODULES;
-    // A keyless deployment configures no licence at all — the state the gate
-    // reads as a positive "no". Tests that need the expired case set it.
-    delete process.env.AILK_LICENSE_KEY;
-    // Every case starts from a storage path that does NOT exist — the `absent`
-    // state. The unreadable case below creates a directory at its own path.
-    process.env.AILK_LICENSE_STORAGE_PATH = join(
-      tmpdir(),
-      `ailk-claim-absent-${process.pid}-${Date.now()}.jwt`,
-    );
-  });
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-      app = undefined;
-    }
-    delete process.env.AILK_ENABLED_MODULES;
-    delete process.env.AILK_LICENSE_KEY;
-    delete process.env.AILK_LICENSE_STORAGE_PATH;
-  });
-
-  describe('keyless build (checkLicense stubbed free)', () => {
-    beforeEach(() => {
-      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
-    });
-
-    it('answers the module-disabled response on POST /v1/checkout/sessions', async () => {
-      app = await buildKeylessModuleSet();
-      const res = await app.inject({
-        ...CHECKOUT,
-        payload: { productCode: 'x', successUrl: 'https://a', cancelUrl: 'https://b' },
-      });
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
-    });
-
-    it('answers the module-disabled response on POST /v1/webhooks/stripe', async () => {
-      app = await buildKeylessModuleSet();
-      const res = await app.inject({ ...WEBHOOK, payload: {} });
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
-    });
-
-    // #6084 AC-3/T-5 — the GET inherits the SAME scope preHandler as the
-    // POST above; this harness (a full server build with checkLicense
-    // stubbed) is the one that actually exercises the gate, unlike
-    // sessions.test.ts's/session.test.ts's own bare-registration harness
-    // (§9 SA-4).
-    it('answers the module-disabled response on GET /v1/checkout/sessions/:id', async () => {
-      app = await buildKeylessModuleSet();
-      const res = await app.inject(CHECKOUT_SESSION_READ);
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
-      expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('commerce-claimed build (checkLicense stubbed with the claim)', () => {
-    beforeEach(() => {
-      mockCheckLicense.mockResolvedValue(COMMERCE_LICENSE);
-    });
-
-    it('serves POST /v1/checkout/sessions with no module flag set', async () => {
-      app = await buildKeylessModuleSet();
-      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
-      const res = await app.inject({ ...CHECKOUT, payload: {} });
-      expect(res.statusCode).not.toBe(404);
-      expect(res.statusCode).toBe(400); // Zod validation — the handler ran
-    });
-
-    it('serves POST /v1/webhooks/stripe with no module flag set', async () => {
-      app = await buildKeylessModuleSet();
-      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
-      const res = await app.inject({ ...WEBHOOK, payload: {} });
-      expect(res.statusCode).not.toBe(404);
-      expect(res.statusCode).toBe(400); // signature-missing — the handler ran
-      expect(res.json()).toEqual({ error: 'signature-missing' });
-    });
-
-    // #6084 AC-3/T-5
-    it('serves GET /v1/checkout/sessions/:id with no module flag set', async () => {
-      app = await buildKeylessModuleSet();
-      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
-      const res = await app.inject(CHECKOUT_SESSION_READ);
-      expect(res.statusCode).not.toBe(404);
-      expect(res.statusCode).toBe(200); // the handler ran
-      expect(mockRetrieveCheckoutSession).toHaveBeenCalledWith({
-        sessionId: 'cs_test_commerce_claim_fixture',
-      });
-    });
-  });
-
-  // Security review 2026-09-16, High, as disposed in round 2. The pre-review
-  // gate collapsed "no claim" and "could not read the licence" into one
-  // `false`, so a signed checkout.session.completed on a LIVE commerce site
-  // whose licence read merely failed was acked 200 and lost — Stripe records
-  // success and never redelivers, and the charge is never mapped.
-  //
-  // Round 2 widens `undetermined` past the throw: a REVOKED licence and a
-  // CONFIGURED-but-free (expired/unverifiable) one are both live commerce
-  // deployments mid-window, so neither may be dropped either.
-  describe('undetermined licence — the read established no "no", so nothing may be dropped', () => {
-    const SIGNED_EVENT = {
-      id: 'evt_undetermined_01',
-      type: 'checkout.session.completed',
-      data: { object: { id: 'cs_x', payment_status: 'paid' } },
-    };
-
-    it('holds a SIGNED event with a retryable 503 + Retry-After when the read throws', async () => {
-      mockCheckLicense.mockRejectedValue(new Error('licence read blew up'));
-      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
-      app = await buildKeylessModuleSet();
-
-      const res = await app.inject({
-        ...WEBHOOK,
-        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
-        payload: { any: 'body' },
-      });
-
-      expect(res.statusCode).toBe(503);
-      expect(res.json()).toEqual({ error: 'license-undetermined' });
-      // Stripe reads Retry-After; without it the redelivery schedule is the
-      // default backoff rather than the window this gate intends.
-      expect(res.headers['retry-after']).toBe('300');
-    });
-
-    it('holds a SIGNED event when the licence is REVOKED — a revoked site is still live mid-window', async () => {
-      mockCheckLicense.mockResolvedValue({ ...COMMERCE_LICENSE, revoked: true });
-      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
-      app = await buildKeylessModuleSet();
-
-      const res = await app.inject({
-        ...WEBHOOK,
-        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
-        payload: { any: 'body' },
-      });
-
-      expect(res.statusCode).toBe(503);
-      expect(res.headers['retry-after']).toBe('300');
-    });
-
-    it('holds a SIGNED event when a licence IS configured yet resolves free — the EXPIRED case', async () => {
-      // Presence is the whole test — the gate never parses this value, so it
-      // is deliberately not JWT-shaped (a realistic stub trips the secret
-      // scanner's entropy rule for no benefit).
-      process.env.AILK_LICENSE_KEY = 'fixture';
-      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
-      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
-      app = await buildKeylessModuleSet();
-
-      const res = await app.inject({
-        ...WEBHOOK,
-        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
-        payload: { any: 'body' },
-      });
-
-      expect(res.statusCode).toBe(503);
-      expect(res.headers['retry-after']).toBe('300');
-    });
-
-    // #5820: the read did not throw and nothing is configured in env — the
-    // storage file simply could not be READ. Before this fix `readStoredJwt()`
-    // collapsed that into the same `null` it returns for "no file", so the
-    // event was acked 200 and dropped and the charge was never mapped. Proven
-    // through the package's real filesystem read (a directory at the storage
-    // path), not a stub.
-    it('holds a SIGNED event when the storage file is UNREADABLE — a directory at the licence path', async () => {
-      const tempDir = await fs.mkdtemp(join(tmpdir(), 'ailk-claim-storage-'));
-      const unreadable = join(tempDir, '.ailk-license.jwt');
-      await fs.mkdir(unreadable);
-      process.env.AILK_LICENSE_STORAGE_PATH = unreadable;
-
-      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
-      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
-      app = await buildKeylessModuleSet();
-
-      try {
-        const res = await app.inject({
-          ...WEBHOOK,
-          headers: { 'stripe-signature': 't=1,v1=deadbeef' },
-          payload: { any: 'body' },
-        });
-
-        expect(res.statusCode).toBe(503);
-        expect(res.json()).toEqual({ error: 'license-undetermined' });
-        expect(res.headers['retry-after']).toBe('300');
-      } finally {
-        await fs.rm(tempDir, { recursive: true, force: true });
-      }
-    });
-
-    // Round 2, D1: the CHECKOUT launcher does not hold. A checkout that cannot
-    // be started loses nothing, so both non-serving states answer the same
-    // module-disabled 404 and the route stays indistinguishable from a build
-    // without the module.
-    it('answers the module-disabled 404 on checkout — a checkout that cannot start loses nothing', async () => {
-      mockCheckLicense.mockRejectedValue(new Error('licence read blew up'));
-      app = await buildKeylessModuleSet();
-      const res = await app.inject({ ...CHECKOUT, payload: {} });
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
-    });
-  });
-
-  describe('D3 — the Stripe signature is settled before the claim is consulted', () => {
-    it('acks a signed-but-unclaimed event 200 and drops it', async () => {
-      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
-      mockVerifyWebhookSignature.mockReturnValue({
-        id: 'evt_unclaimed_0001',
-        type: 'customer.created',
-        data: { object: { id: 'cus_x', email: 'a@b.test' } },
-      });
-      app = await buildKeylessModuleSet();
-
-      const res = await app.inject({
-        ...WEBHOOK,
-        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
-        payload: { any: 'body' },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(res.json()).toEqual({ received: true });
-      // The signature was verified BEFORE the claim was consulted.
-      expect(mockVerifyWebhookSignature).toHaveBeenCalledTimes(1);
-    });
-
-    // "Rejected before the claim is read" in the only form AC 1 leaves open:
-    // on a CLAIMED build — where the claim cannot be what refuses it — an
-    // unsigned body is still refused 400 and never dispatched. The claim never
-    // admits an unverified body. (On an UNCLAIMED build the module-disabled
-    // 404 wins instead, which is AC 1 and round-1 D3, unchanged here.)
-    it('refuses an unsigned body on a CLAIMED build — the claim never admits an unverified body', async () => {
-      mockCheckLicense.mockResolvedValue(COMMERCE_LICENSE);
-      app = await buildKeylessModuleSet();
-
-      const res = await app.inject({ ...WEBHOOK, payload: { any: 'body' } });
-
-      expect(res.statusCode).toBe(400);
-      expect(res.json()).toEqual({ error: 'signature-missing' });
-      expect(mockVerifyWebhookSignature).not.toHaveBeenCalled();
-    });
-  });
-});

package/templates/apps/api/src/__tests__/factories/agent-caller.ts

@@ -1,102 +0,0 @@
-/**
- * @file agent-caller.ts
- *
- * An agent caller for route suites that mock `lib/prisma.js` inline (#3591
- * D8): a key minted at run time — never a key-shaped literal in a fixture —
- * plus the two reads the auth preHandler and the multi-tenant guard make for
- * it, so the suite's existing `agent` and `membership` `findUnique` mocks can
- * answer an agent without changing what they answer anyone else.
- *
- * Usage, inside a suite whose inline prisma mock declares
- * `agent: { findUnique: jest.fn(), update: jest.fn() }`: build a caller with
- * `buildAgentCaller({ organizationId, workspaceId })`, give the `agent`
- * delegate's `findUnique` the `agentKeyLookup(caller)` implementation and the
- * `membership` delegate's `findUnique` the `agentMembershipLookup(caller,
- * existingImplementation)` one, then send the request with `caller.headers`.
- * (This docblock names the delegates in prose: the tenant-scope lint in
- * `architecture.yaml` scans comments too.)
- */
-import { hashAgentKey, mintAgentKey } from "../../lib/agent-store.js";
-
-export interface AgentCaller {
-  agentId: string;
-  /** The responsible person's user id — the agent acts on their behalf. */
-  userId: string;
-  membershipId: string;
-  organizationId: string;
-  workspaceId: string;
-  /** The person's own role; the guard clamps the agent to `member`. */
-  role: "owner" | "admin" | "member";
-  /** The agent's stored grants (#7864); the guard keeps those `role` holds. */
-  grants: string[];
-  headers: { authorization: string };
-}
-
-export function buildAgentCaller(
-  scope: { organizationId: string; workspaceId: string },
-  overrides: Partial<
-    Pick<AgentCaller, "agentId" | "userId" | "membershipId" | "role" | "grants">
-  > = {},
-): AgentCaller & { key: string } {
-  const key = mintAgentKey();
-  return {
-    agentId: "agent_00000000-0000-7000-8000-00000000a9e1",
-    userId: "user_00000000-0000-7000-8000-00000000a9e2",
-    membershipId: "member_00000000-0000-7000-8000-00000000a9e3",
-    role: "member",
-    grants: [],
-    ...scope,
-    ...overrides,
-    key,
-    headers: { authorization: `Bearer ${key}` },
-  };
-}
-
-/** The `agent` delegate's `findUnique` for the auth preHandler: the caller's row by its key's digest. */
-export function agentKeyLookup(
-  caller: AgentCaller & { key: string },
-): (args: {
-  where: { credentialHash?: string };
-}) => Promise<Record<string, unknown> | null> {
-  const credentialHash = hashAgentKey(caller.key);
-  return ({ where }) =>
-    Promise.resolve(
-      where.credentialHash === credentialHash
-        ? {
-            id: caller.agentId,
-            workspaceId: caller.workspaceId,
-            organizationId: caller.organizationId,
-            permissionLevel: "member",
-            grants: caller.grants,
-            enabled: true,
-            keyIssuedToMembershipId: caller.membershipId,
-            lastActiveAt: null,
-            responsible: { id: caller.membershipId, userId: caller.userId },
-          }
-        : null,
-    );
-}
-
-type MembershipArgs = {
-  where: { organizationId_userId?: { organizationId: string; userId: string } };
-};
-
-/**
- * The `membership` delegate's `findUnique`, answering the agent's person's membership
- * and deferring every other read to `fallback` (the suite's own mock).
- */
-export function agentMembershipLookup(
-  caller: AgentCaller,
-  fallback: (args: MembershipArgs) => unknown,
-): (args: MembershipArgs) => unknown {
-  return (args) => {
-    const key = args.where.organizationId_userId;
-    if (
-      key?.organizationId === caller.organizationId &&
-      key.userId === caller.userId
-    ) {
-      return Promise.resolve({ id: caller.membershipId, role: caller.role });
-    }
-    return fallback(args);
-  };
-}