create-ailk 0.23.0 → 0.25.1

package/templates/database/__tests__/artifact-content-store.db.test.ts

@@ -1,316 +0,0 @@
-/**
- * @file artifact-content-store.db.test.ts
- *
- * LIVE-DATABASE proof of roadmap D1/D7 (#5800) — the generalized `Artifact` and
- * the workspace-scoped `Asset`. Requires DATABASE_URL pointing at a Postgres
- * with the migrations applied (`prisma migrate deploy`); the whole suite SKIPS
- * when DATABASE_URL is unset, matching `prefixed-ids.db.test.ts` and keeping the
- * workspace Jest run DB-free.
- *
- * Raw SQL through `pg` for the same reason that file gives: the generated Prisma
- * client is ESM-only and cannot load under this package's CJS ts-jest transform,
- * and raw SQL is the sharper proof anyway — a constraint must hold on the path
- * no application helper can guard.
- *
- * What it proves:
- *   1. THE SURVIVAL PROPERTY (D1). An artifact produced inside an agent session
- *      outlives that session: deleting the session sets `session_id` to NULL and
- *      leaves the row, its versions, and its publish pointer intact. Before this
- *      migration the FK was `ON DELETE CASCADE` on a NOT NULL column, so the
- *      same delete destroyed the workspace's content. This is the whole point of
- *      "the session becomes provenance, the workspace owns the artifact".
- *   2. The identity of a published page — `(workspace_id, content_type, locale,
- *      slug)` is unique, while unpublished drafts (slug NULL) are unconstrained,
- *      because NULLs never collide in a Postgres unique index.
- *   3. `published_version_id` is an independent pointer: it is NOT `is_current`,
- *      and appending a newer draft tip does not move it.
- *   4. `assets` is workspace-scoped with a unique `(workspace_id, key)` and a
- *      DB-minted `asset_` UUIDv7 id (ADR-0031).
- */
-import { randomUUID } from "node:crypto";
-
-import { Client } from "pg";
-
-import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
-
-const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
-
-const V7_RE =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-
-/** A run-unique suffix so repeated local runs never collide on the unique key. */
-const RUN = randomUUID().slice(0, 8);
-
-describeDb("Artifact content store (roadmap D1/D7, live DB)", () => {
-  let db: Client;
-
-  beforeAll(async () => {
-    db = new Client({ connectionString: process.env.DATABASE_URL });
-    await db.connect();
-  });
-
-  afterAll(async () => {
-    await db.query(
-      `DELETE FROM "artifacts" WHERE "title" LIKE $1`,
-      [`5800-${RUN}%`],
-    );
-    await db.query(`DELETE FROM "agent_sessions" WHERE "title" LIKE $1`, [
-      `5800-${RUN}%`,
-    ]);
-    await db.query(`DELETE FROM "assets" WHERE "key" LIKE $1`, [
-      `5800-${RUN}%`,
-    ]);
-    await db.end();
-  });
-
-  describe("the session is provenance — deleting it never destroys content", () => {
-    it("sets session_id NULL and leaves the artifact, its versions and its publish pointer", async () => {
-      const sessionId = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "agent_sessions" ("workspace_id", "title", "updated_at")
-           VALUES ($1, $2, now()) RETURNING "id"`,
-          [DEFAULT_WORKSPACE_ID, `5800-${RUN} session`],
-        )
-      ).rows[0]!.id;
-
-      const artifactId = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "artifacts" ("session_id", "workspace_id", "title", "content_type", "locale", "slug", "updated_at")
-           VALUES ($1, $2, $3, 'text/page', 'en', $4, now()) RETURNING "id"`,
-          [
-            sessionId,
-            DEFAULT_WORKSPACE_ID,
-            `5800-${RUN} page`,
-            `5800-${RUN}-survivor`,
-          ],
-        )
-      ).rows[0]!.id;
-
-      const versionId = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
-           VALUES ($1, $2, '{"body":"v1"}'::jsonb, TRUE) RETURNING "id"`,
-          [artifactId, DEFAULT_WORKSPACE_ID],
-        )
-      ).rows[0]!.id;
-
-      await db.query(
-        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
-        [versionId, artifactId],
-      );
-
-      // The act under test: the producing session is deleted outright.
-      await db.query(`DELETE FROM "agent_sessions" WHERE "id" = $1`, [
-        sessionId,
-      ]);
-
-      const { rows } = await db.query<{
-        session_id: string | null;
-        workspace_id: string;
-        published_version_id: string | null;
-      }>(
-        `SELECT "session_id", "workspace_id", "published_version_id"
-         FROM "artifacts" WHERE "id" = $1`,
-        [artifactId],
-      );
-
-      expect(rows).toHaveLength(1);
-      expect(rows[0]!.session_id).toBeNull();
-      expect(rows[0]!.workspace_id).toBe(DEFAULT_WORKSPACE_ID);
-      expect(rows[0]!.published_version_id).toBe(versionId);
-
-      const versions = await db.query(
-        `SELECT "id" FROM "artifact_versions" WHERE "artifact_id" = $1`,
-        [artifactId],
-      );
-      expect(versions.rows).toHaveLength(1);
-    });
-
-    it("accepts an artifact with no session at all — the workspace owns it", async () => {
-      const { rows } = await db.query<{ id: string; session_id: string | null }>(
-        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
-         VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id", "session_id"`,
-        [DEFAULT_WORKSPACE_ID, `5800-${RUN} sessionless`],
-      );
-
-      expect(rows[0]!.session_id).toBeNull();
-      expect(rows[0]!.id).toMatch(/^artif_/);
-    });
-  });
-
-  describe("published identity", () => {
-    it("rejects a second artifact with the same (workspace, contentType, locale, slug)", async () => {
-      const slug = `5800-${RUN}-dupe`;
-      await db.query(
-        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
-         VALUES ($1, $2, 'text/page', 'en', $3, now())`,
-        [DEFAULT_WORKSPACE_ID, `5800-${RUN} first`, slug],
-      );
-
-      await expect(
-        db.query(
-          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
-           VALUES ($1, $2, 'text/page', 'en', $3, now())`,
-          [DEFAULT_WORKSPACE_ID, `5800-${RUN} second`, slug],
-        ),
-      ).rejects.toThrow(/duplicate key|unique/i);
-    });
-
-    it("admits many unpublished drafts — a NULL slug never collides", async () => {
-      for (const n of [1, 2, 3]) {
-        await db.query(
-          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
-           VALUES ($1, $2, 'text/page', 'en', now())`,
-          [DEFAULT_WORKSPACE_ID, `5800-${RUN} draft ${n}`],
-        );
-      }
-
-      const { rows } = await db.query<{ count: string }>(
-        `SELECT count(*)::text AS count FROM "artifacts"
-         WHERE "title" LIKE $1 AND "slug" IS NULL`,
-        [`5800-${RUN} draft %`],
-      );
-      expect(rows[0]!.count).toBe("3");
-    });
-
-    it("separates the same slug across locales", async () => {
-      const slug = `5800-${RUN}-locale`;
-      for (const locale of ["en", "fr"]) {
-        await db.query(
-          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
-           VALUES ($1, $2, 'text/page', $3, $4, now())`,
-          [DEFAULT_WORKSPACE_ID, `5800-${RUN} ${locale}`, locale, slug],
-        );
-      }
-
-      const { rows } = await db.query<{ count: string }>(
-        `SELECT count(*)::text AS count FROM "artifacts" WHERE "slug" = $1`,
-        [slug],
-      );
-      expect(rows[0]!.count).toBe("2");
-    });
-  });
-
-  describe("the publish pointer is not the draft tip", () => {
-    it("survives a newer is_current version", async () => {
-      const artifactId = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
-           VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id"`,
-          [DEFAULT_WORKSPACE_ID, `5800-${RUN} pointer`],
-        )
-      ).rows[0]!.id;
-
-      const published = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
-           VALUES ($1, $2, '{"body":"published"}'::jsonb, TRUE) RETURNING "id"`,
-          [artifactId, DEFAULT_WORKSPACE_ID],
-        )
-      ).rows[0]!.id;
-
-      await db.query(
-        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
-        [published, artifactId],
-      );
-
-      // A newer draft tip lands; the publish pointer must NOT follow it.
-      await db.query(
-        `UPDATE "artifact_versions" SET "is_current" = FALSE WHERE "artifact_id" = $1`,
-        [artifactId],
-      );
-      const draft = (
-        await db.query<{ id: string }>(
-          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
-           VALUES ($1, $2, '{"body":"draft"}'::jsonb, TRUE) RETURNING "id"`,
-          [artifactId, DEFAULT_WORKSPACE_ID],
-        )
-      ).rows[0]!.id;
-
-      const { rows } = await db.query<{ published_version_id: string | null }>(
-        `SELECT "published_version_id" FROM "artifacts" WHERE "id" = $1`,
-        [artifactId],
-      );
-      expect(rows[0]!.published_version_id).toBe(published);
-      expect(rows[0]!.published_version_id).not.toBe(draft);
-    });
-  });
-
-  describe("Asset (D7)", () => {
-    it("mints an asset_ UUIDv7 id and stores the bytes", async () => {
-      const { rows } = await db.query<{ id: string; size: number }>(
-        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
-         VALUES ($1, $2, 'logo.png', 'image/png', $3, 4) RETURNING "id", "size"`,
-        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-logo`, Buffer.from([1, 2, 3, 4])],
-      );
-
-      expect(rows[0]!.id).toMatch(/^asset_/);
-      expect(rows[0]!.id.slice("asset_".length)).toMatch(V7_RE);
-      expect(rows[0]!.size).toBe(4);
-    });
-
-    it("rejects a second asset with the same (workspace, key)", async () => {
-      const key = `5800-${RUN}-dupe-key`;
-      await db.query(
-        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
-         VALUES ($1, $2, 'a.png', 'image/png', $3, 1)`,
-        [DEFAULT_WORKSPACE_ID, key, Buffer.from([1])],
-      );
-
-      await expect(
-        db.query(
-          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
-           VALUES ($1, $2, 'b.png', 'image/png', $3, 1)`,
-          [DEFAULT_WORKSPACE_ID, key, Buffer.from([2])],
-        ),
-      ).rejects.toThrow(/duplicate key|unique/i);
-    });
-
-    it("rejects a malformed workspace_id (ADR-0031 CHECK)", async () => {
-      await expect(
-        db.query(
-          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
-           VALUES ('not-a-workspace-id', $1, 'a.png', 'image/png', $2, 1)`,
-          [`5800-${RUN}-bad-scope`, Buffer.from([1])],
-        ),
-      ).rejects.toThrow(/assets_workspace_id_format|check constraint/i);
-    });
-
-    // #6092 (S4/D10) — title, description and tags. `tags` stores SLUGS, never
-    // the human labels the lightbox renders (D3): 'ad-creative' and
-    // 'user-uploaded' are the exact pair the demo's first asset carries
-    // (demo.html:357).
-    it("stores and returns two tags", async () => {
-      const { rows } = await db.query<{ tags: string[] }>(
-        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size", "tags")
-         VALUES ($1, $2, 'tagged.png', 'image/png', $3, 1, $4) RETURNING "tags"`,
-        [
-          DEFAULT_WORKSPACE_ID,
-          `5800-${RUN}-tagged`,
-          Buffer.from([1]),
-          ["ad-creative", "user-uploaded"],
-        ],
-      );
-
-      expect(rows[0]!.tags).toEqual(["ad-creative", "user-uploaded"]);
-      expect(rows[0]!.tags).toHaveLength(2);
-    });
-
-    it("defaults title, description and tags when none of the three columns is named", async () => {
-      const { rows } = await db.query<{
-        title: string | null;
-        description: string | null;
-        tags: string[];
-      }>(
-        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
-         VALUES ($1, $2, 'untagged.png', 'image/png', $3, 1)
-         RETURNING "title", "description", "tags"`,
-        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-untagged`, Buffer.from([1])],
-      );
-
-      expect(rows[0]!.title).toBeNull();
-      expect(rows[0]!.description).toBeNull();
-      expect(rows[0]!.tags).toEqual([]);
-    });
-  });
-});

package/templates/database/__tests__/composite-fence.db.test.ts

@@ -1,206 +0,0 @@
-/**
- * @file composite-fence.db.test.ts
- *
- * LIVE-DATABASE proof of the #6254 keystone constraints (AC-2, AC-5, AC-7).
- * Requires DATABASE_URL pointing at a Postgres with the migrations applied
- * (`prisma migrate deploy`); the whole suite SKIPS when DATABASE_URL is
- * unset, matching `flow-workspace-key.db.test.ts` / `prefixed-ids.db.test.ts`
- * and keeping the workspace Jest run DB-free.
- *
- * Raw SQL through `pg`, for the same reason those files give: the generated
- * Prisma client is ESM-only and cannot load under this package's CJS ts-jest
- * transform.
- *
- * This suite proves the CONSTRAINTS database/migrations/
- * 20260922120000_tenancy_fence adds — it does not re-prove that migration's
- * own backfill (that is `flow-workspace-key.db.test.ts`'s job for its two
- * models, and this migration's backfill is largely a defensive re-run of
- * work the #6155/#6203 precedent migrations already did — see this
- * migration's own header comment). What it proves (spec § 8.2):
- *
- *   1. `Lead` rejects a row whose `workspaceId` disagrees with its `siteId`
- *      — SQLSTATE 23514 (AC-5's core).
- *   2. `Lead` accepts a row whose `workspaceId` AGREES with its `siteId` —
- *      without this, assertion 1 would also pass against a table that
- *      rejects everything.
- *   3. `FlowDefinition` rejects the same disagreement — AC-5's "at least
- *      one retrofit model besides Lead".
- *   4. NULL is unstorable on `Lead` and `FlowDefinition` — SQLSTATE 23502
- *      (not_null_violation) — AC-7.
- *   5. `WorkspaceSiteIdentity` carries the AC-2 composite unique constraint,
- *      proven at the database, not just in the schema file.
- *   6. The migration's own literal sentinel id equals `DEFAULT_WORKSPACE_ID`
- *      — the two cannot drift apart (the #6155/#6203 precedents' own
- *      technique).
- */
-import { randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { Client } from "pg";
-
-import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
-
-const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
-
-/** A run-unique suffix so repeated local runs never collide. */
-const RUN = randomUUID().slice(0, 8);
-
-const MIGRATION_SQL_PATH = join(
-  __dirname,
-  "..",
-  "migrations",
-  "20260922120000_tenancy_fence",
-  "migration.sql",
-);
-const MIGRATION_SQL = readFileSync(MIGRATION_SQL_PATH, "utf-8");
-
-/** Postgres's own error shape carries `code` as a 5-character SQLSTATE. */
-type PgError = { code?: string };
-
-describeDb("the #6254 tenancy-fence constraints (live DB)", () => {
-  let db: Client;
-  let workspaceAId: string;
-  let workspaceBId: string;
-
-  beforeAll(async () => {
-    db = new Client({ connectionString: process.env.DATABASE_URL });
-    await db.connect();
-
-    // Two REAL, distinct workspaces — A and B — so a "disagreement" insert
-    // names two values that both actually exist, not a real one versus
-    // garbage (which the format CHECK, not the equality CHECK, would catch).
-    const org = (
-      await db.query<{ id: string }>(
-        `INSERT INTO "organizations" ("name", "slug", "updated_at")
-         VALUES ($1, $2, now()) RETURNING "id"`,
-        [`6254 Org ${RUN}`, `6254-org-${RUN}`],
-      )
-    ).rows[0]!;
-
-    workspaceAId = (
-      await db.query<{ id: string }>(
-        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
-         VALUES ($1, $2, $3, now()) RETURNING "id"`,
-        [org.id, `6254 Workspace A ${RUN}`, `6254-ws-a-${RUN}`],
-      )
-    ).rows[0]!.id;
-
-    workspaceBId = (
-      await db.query<{ id: string }>(
-        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
-         VALUES ($1, $2, $3, now()) RETURNING "id"`,
-        [org.id, `6254 Workspace B ${RUN}`, `6254-ws-b-${RUN}`],
-      )
-    ).rows[0]!.id;
-  });
-
-  afterAll(async () => {
-    await db.query(`DELETE FROM "flow_definitions" WHERE "slug" LIKE $1`, [
-      `6254-${RUN}-%`,
-    ]);
-    await db.query(`DELETE FROM "leads" WHERE "source" = $1`, [
-      `6254-test-${RUN}`,
-    ]);
-    await db.query(`DELETE FROM "workspaces" WHERE "slug" LIKE $1`, [
-      `6254-ws-%-${RUN}`,
-    ]);
-    await db.query(`DELETE FROM "organizations" WHERE "slug" = $1`, [
-      `6254-org-${RUN}`,
-    ]);
-    await db.end();
-  });
-
-  describe("AC-5 — the equality CHECK rejects a site<->workspace disagreement", () => {
-    it("Lead: workspace_id disagreeing with site_id raises 23514", async () => {
-      await expect(
-        db.query(
-          `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload")
-           VALUES ($1, $2, $3, $4, '{}'::jsonb)`,
-          [workspaceAId, workspaceBId, `6254-test-${RUN}`, "disagree@example.com"],
-        ),
-      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23514" });
-    });
-
-    it("Lead: workspace_id AGREEING with site_id succeeds", async () => {
-      const result = await db.query<{ id: string }>(
-        `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload")
-         VALUES ($1, $1, $2, $3, '{}'::jsonb) RETURNING "id"`,
-        [workspaceAId, `6254-test-${RUN}`, "agree@example.com"],
-      );
-      expect(result.rows).toHaveLength(1);
-    });
-
-    it("FlowDefinition (the second retrofit model, AC-5's own requirement): workspace_id disagreeing with site_id raises 23514", async () => {
-      await expect(
-        db.query(
-          `INSERT INTO "flow_definitions"
-             ("site_id", "workspace_id", "slug", "config", "title", "status", "updated_at")
-           VALUES ($1, $2, $3, '{}'::jsonb, 'Test', 'live', now())`,
-          [workspaceAId, workspaceBId, `6254-${RUN}-disagree`],
-        ),
-      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23514" });
-    });
-
-    it("FlowDefinition: workspace_id AGREEING with site_id succeeds", async () => {
-      const result = await db.query<{ id: string }>(
-        `INSERT INTO "flow_definitions"
-           ("site_id", "workspace_id", "slug", "config", "title", "status", "updated_at")
-         VALUES ($1, $1, $2, '{}'::jsonb, 'Test', 'live', now()) RETURNING "id"`,
-        [workspaceAId, `6254-${RUN}-agree`],
-      );
-      expect(result.rows).toHaveLength(1);
-    });
-  });
-
-  describe("AC-7 — NOT NULL: no row can exist with workspace_id IS NULL", () => {
-    it("Lead: omitting workspace_id raises 23502 (not_null_violation)", async () => {
-      await expect(
-        db.query(
-          `INSERT INTO "leads" ("site_id", "source", "email", "payload")
-           VALUES ($1, $2, $3, '{}'::jsonb)`,
-          [workspaceAId, `6254-test-${RUN}`, "null@example.com"],
-        ),
-      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23502" });
-    });
-
-    it("FlowDefinition: omitting workspace_id raises 23502 (not_null_violation)", async () => {
-      await expect(
-        db.query(
-          `INSERT INTO "flow_definitions" ("site_id", "slug", "config", "title", "status", "updated_at")
-           VALUES ($1, $2, '{}'::jsonb, 'Test', 'live', now())`,
-          [workspaceAId, `6254-${RUN}-null`],
-        ),
-      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23502" });
-    });
-  });
-
-  describe("AC-2 — WorkspaceSiteIdentity's composite unique exists at the database", () => {
-    it("pg_constraint reports a UNIQUE constraint over (id, workspace_id)", async () => {
-      const result = await db.query<{ contype: string; conkey_count: number }>(
-        `SELECT c.contype, array_length(c.conkey, 1) AS conkey_count
-           FROM pg_constraint c
-           JOIN pg_class t ON t.oid = c.conrelid
-          WHERE t.relname = 'workspace_site_identities'
-            AND c.conname = 'workspace_site_identities_id_workspace_id_key'`,
-      );
-      expect(result.rows).toHaveLength(1);
-      expect(result.rows[0]!.contype).toBe("u");
-      expect(result.rows[0]!.conkey_count).toBe(2);
-    });
-  });
-
-  describe("the migration's own literal sentinel id equals DEFAULT_WORKSPACE_ID", () => {
-    it("cannot drift apart — read from the shipped file, not a re-typed copy", () => {
-      // SQL cannot import database/tenancy.ts (spec § 5.3 step 5), so the
-      // migration carries the sentinel as a literal. Pin it against the
-      // exported constant by reading the shipped file, exactly as the
-      // #6155/#6203 precedents do.
-      const occurrences = MIGRATION_SQL.match(/'wksp_[0-9a-f-]+'/g) ?? [];
-      expect(occurrences.length).toBeGreaterThan(0);
-      for (const literal of occurrences) {
-        expect(literal).toBe(`'${DEFAULT_WORKSPACE_ID}'`);
-      }
-    });
-  });
-});