create-ailk 0.23.0 → 0.25.1

package/templates/database/scripts/db-generate-locked.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-# db-generate-locked.sh — serialise concurrent `pnpm --filter @working-theory/database db:generate`
-# calls so parallel prebuild scripts don't race on database/generated/client/.
-#
-# Background: four apps-paid/* packages each declare a `prebuild` that calls
-# db:generate. When `pnpm -r build` triggers them in parallel the concurrent
-# Prisma invocations race on the shared database/generated/client/ output dir,
-# producing either "directory not empty" rmdir errors or "doesn't look like a
-# generated Prisma Client" sanity-check failures. See issue #1690.
-#
-# Lock mechanism: mkdir(1) is atomic on POSIX filesystems (including macOS APFS).
-# The first caller wins the lock dir and runs the generate; concurrent callers
-# spin-wait. If the winner finishes before they time out, they see the output
-# dir already present and skip. Stale locks are detected via a PID file stored
-# inside the lock dir; if the owning PID is no longer alive the lock is removed
-# and the next caller re-runs the generate.
-
-set -euo pipefail
-
-# Workspace root: two levels up from database/scripts/
-WORKSPACE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-DATABASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-LOCK_DIR="$WORKSPACE_ROOT/.claude/.db-generate.lock"
-TIMEOUT_SECONDS=120
-POLL_INTERVAL=1
-
-# --- Acquire lock via atomic mkdir ---
-acquire_lock() {
-  if mkdir "$LOCK_DIR" 2>/dev/null; then
-    echo "$$" > "$LOCK_DIR/pid"
-    return 0  # acquired
-  fi
-  return 1  # not acquired
-}
-
-# --- Check if a stale lock can be cleared ---
-maybe_clear_stale_lock() {
-  local pid_file="$LOCK_DIR/pid"
-  if [ -f "$pid_file" ]; then
-    local owner_pid
-    owner_pid="$(cat "$pid_file" 2>/dev/null || echo "")"
-    if [ -n "$owner_pid" ] && ! kill -0 "$owner_pid" 2>/dev/null; then
-      # Owner process is gone — lock is stale; remove it
-      rm -rf "$LOCK_DIR"
-    fi
-  fi
-}
-
-# --- Release lock on exit ---
-release_lock() {
-  rm -rf "$LOCK_DIR" 2>/dev/null || true
-}
-
-# --- Main ---
-elapsed=0
-
-while true; do
-  maybe_clear_stale_lock
-  if acquire_lock; then
-    trap release_lock EXIT
-    break
-  fi
-
-  # Another process holds the lock — if it already wrote the output, skip
-  if [ -d "$DATABASE_DIR/generated/client" ]; then
-    echo "db-generate-locked: client already present (written by concurrent process), skipping."
-    exit 0
-  fi
-
-  elapsed=$((elapsed + POLL_INTERVAL))
-  if [ "$elapsed" -ge "$TIMEOUT_SECONDS" ]; then
-    echo "db-generate-locked: timed out waiting for lock after ${TIMEOUT_SECONDS}s; running generate anyway." >&2
-    break
-  fi
-  sleep "$POLL_INTERVAL"
-done
-
-echo "db-generate-locked: running db:generate for @working-theory/database"
-pnpm --filter @working-theory/database db:generate

package/templates/database/scripts/person-backfill.sql

@@ -1,132 +0,0 @@
--- #852 — the Person backfill (spec
--- docs/specs/852-person-the-per-workspace-client-spec.md D2, D4).
---
--- Fills "people" from the rows the hub already holds and stamps
--- leads.person_id and appointments.person_id, so the People list is not
--- empty on the day it ships. Set-based and idempotent: every insert is
--- ON CONFLICT DO NOTHING and every update is guarded by IS NULL, so running
--- this text twice changes nothing the first run wrote.
---
--- THE SAME TEXT, byte for byte, is database/scripts/person-backfill.sql. The
--- previous deployment keeps writing leads and appointments without a
--- person_id between this migration and the cutover to the new code; run
--- that script ONCE against the hub database after the cutover to stamp them.
--- database/__tests__/person.db.test.ts asserts the two files are identical
--- and that a second run changes no row.
---
--- Normalization — the SQL twin of apps/api/src/services/person.ts's
--- normalizePersonEmail / isStorablePersonEmail:
---   N(x)     = lower(btrim(x, E' \t\n\r\f\x0B') COLLATE "C")
---              (\x0B is vertical tab; an E-string has no \v escape — E'\v'
---              is the letter v, which would strip the v of every .dev)
---   VALID(e) = e ~ '^[!-?A-~]+@[!-?A-~]+$' AND length(e) <= 254
---   NAME(x)  = C0/C1 controls and bidi controls removed, trimmed, cut to
---              200 characters; empty → NULL
--- A row whose email is not VALID makes no Person and keeps person_id NULL.
---
--- Sources, in order: leads (oldest first), then completed hub FlowCheckouts
--- through their lead (the customer id, first writer wins), then appointments
--- by attendee email. Subscriber is NOT a source; FlowSession, ProjectListing
--- and DeliverableGrant reach a Person through their lead at read time.
--- The join to "users" reads the auth namespace inside this one-off
--- statement only; it adds no foreign key (ADR 0009 invariant 1).
---
--- Rollback: nothing to undo on its own — dropping 20261010120000_person's
--- table and columns removes everything this wrote.
-
--- 1. Leads, oldest first: one Person per (workspace, normalized email). The
---    name is the oldest lead's payload.name when it is a JSON string.
-INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
-SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-       l."workspace_id",
-       lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-       CASE WHEN jsonb_typeof(l."payload" -> 'name') = 'string'
-            THEN NULLIF(left(btrim(regexp_replace(l."payload" ->> 'name', '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), '')
-       END,
-       l."created_at",
-       now()
-FROM "leads" l
-WHERE lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
-  AND length(lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
-ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"), l."created_at" ASC, l."id" ASC
-ON CONFLICT ("workspace_id", "email") DO NOTHING;
-
--- 2. Hub FlowCheckouts, through their lead (same workspace): the oldest
---    completed checkout with a customer id writes it onto a Person that has
---    none. First writer wins — oldest by completed_at, then created_at, then id.
-UPDATE "people" p
-SET "billing_provider" = 'stripe',
-    "billing_customer_id" = c."stripe_customer_id",
-    "updated_at" = now()
-FROM (
-  SELECT DISTINCT ON (fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-         fc."workspace_id",
-         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
-         fc."stripe_customer_id"
-  FROM "flow_checkouts" fc
-  JOIN "leads" l ON l."id" = fc."lead_id" AND l."workspace_id" = fc."workspace_id"
-  WHERE fc."status" = 'completed'
-    AND fc."stripe_customer_id" IS NOT NULL
-    AND fc."stripe_customer_id" <> ''
-    AND length(fc."stripe_customer_id") <= 255
-  ORDER BY fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-           fc."completed_at" ASC NULLS LAST, fc."created_at" ASC, fc."id" ASC
-) c
-WHERE p."workspace_id" = c."workspace_id"
-  AND p."email" = c."email"
-  AND p."billing_customer_id" IS NULL;
-
--- 3. Appointments, by attendee email: a Person a lead already made keeps its
---    lead-derived name and created_at (ON CONFLICT DO NOTHING).
-INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
-SELECT DISTINCT ON (a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"))
-       a."workspace_id",
-       lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"),
-       NULLIF(left(btrim(regexp_replace(a."attendee_name", '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), ''),
-       a."created_at",
-       now()
-FROM "appointments" a
-WHERE lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
-  AND length(lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
-ORDER BY a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"), a."created_at" ASC, a."id" ASC
-ON CONFLICT ("workspace_id", "email") DO NOTHING;
-
--- 4. Stamps: every lead and appointment with a storable email points at its
---    workspace's Person; a row already stamped is left alone.
-UPDATE "leads"
-SET "person_id" = p."id"
-FROM "people" p
-WHERE "leads"."person_id" IS NULL
-  AND p."workspace_id" = "leads"."workspace_id"
-  AND p."email" = lower(btrim("leads"."email", E' \t\n\r\f\x0B') COLLATE "C");
-
-UPDATE "appointments"
-SET "person_id" = p."id"
-FROM "people" p
-WHERE "appointments"."person_id" IS NULL
-  AND p."workspace_id" = "appointments"."workspace_id"
-  AND p."email" = lower(btrim("appointments"."attendee_email", E' \t\n\r\f\x0B') COLLATE "C");
-
--- 5. user_id, verified only: the oldest promoted lead (by promoted_at, then
---    created_at, then id) whose user is email-verified and whose verified
---    address normalizes to the Person's. An unverified or differing user is
---    never copied — the rule stampPersonUser applies to new rows.
-UPDATE "people" p
-SET "user_id" = c."user_id",
-    "updated_at" = now()
-FROM (
-  SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-         l."workspace_id",
-         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
-         l."promoted_user_id" AS "user_id"
-  FROM "leads" l
-  JOIN "users" u ON u."id" = l."promoted_user_id"
-  WHERE l."promoted_user_id" IS NOT NULL
-    AND u."email_verified" = true
-    AND lower(btrim(u."email", E' \t\n\r\f\x0B') COLLATE "C") = lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")
-  ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-           l."promoted_at" ASC NULLS LAST, l."created_at" ASC, l."id" ASC
-) c
-WHERE p."workspace_id" = c."workspace_id"
-  AND p."email" = c."email"
-  AND p."user_id" IS NULL;

package/templates/database/tenancy.ts

@@ -1,183 +0,0 @@
-/**
- * Default tenancy identity constants — the SINGLE source of truth (spec D3).
- *
- * The well-known default Organization + Workspace ids/slugs that the
- * single-tenant provision seed (Phase 1, #3622 — `database/seed.ts`) creates,
- * and that the session-resolution guard (Phase 2, #3627 —
- * `apps/api/src/services/tenant-context.ts`) binds on to resolve a default
- * scope for a single-tenant deployment. Exported publicly via the
- * `@working-theory/database/tenancy` subpath (see `package.json` `exports`)
- * so `apps/api` can import them across the package boundary without a second,
- * drift-prone declaration of the tenant-isolation identity.
- *
- * See docs/specs/single-tenant-session-workspace-spec.md §3 D3.
- */
-
-// The three constants below are SENTINEL ids from the reserved range of the
-// prefixed-UUIDv7 scheme (ADR-0031 rule 7): zero timestamp bits + version 7 +
-// variant 8 + a small counter suffix. They are valid-shaped v7 ids (the
-// database CHECK constraints admit them), can never collide with a generated
-// id (a real v7's timestamp bits are the current epoch-ms, never zero), and
-// are recognizable via `isSentinel(id)` from `@working-theory/ids` — key on
-// that predicate, never a hardcoded literal. They carry the branded `Id<E>`
-// types so consumers get compile-time entity safety (ADR-0031 rule 5).
-
-import { isSentinel, type Id } from "@working-theory/ids";
-
-/** Well-known default Organization identity — a fixed reserved-range sentinel. */
-export const DEFAULT_ORG_ID =
-  "org_00000000-0000-7000-8000-000000000001" as Id<"organization">;
-export const DEFAULT_ORG_SLUG = "default";
-
-/** Well-known default Workspace identity — a fixed reserved-range sentinel. */
-export const DEFAULT_WORKSPACE_ID =
-  "wksp_00000000-0000-7000-8000-000000000001" as Id<"workspace">;
-export const DEFAULT_WORKSPACE_SLUG = "default";
-
-/**
- * Well-known Membership id the single-tenant owner-pin binds the operator
- * to (docs/specs/single-tenant-owner-pin-spec.md D2). A fixed sentinel id
- * makes the TOFU operator-binding insert race-safe: the `Membership.id`
- * primary-key uniqueness — not application-level "is this the first
- * user?" logic — enforces exactly one owner under concurrent first-logins.
- */
-export const OPERATOR_MEMBERSHIP_ID =
-  "member_00000000-0000-7000-8000-000000000001" as Id<"membership">;
-
-/**
- * The minimal structural client the one-workspace predicate needs — no
- * `@prisma/client` import, so this file stays a leaf `tsconfig.tenancy.json`
- * can build without the generated client (#5876 spec D2). `apps/api` and
- * `apps/mcp` are both `database`-importers (`architecture.yaml`
- * `may_import_from`), and `database/**` is already wholesale-excluded from
- * the tenant-scope `forbidden_pattern` — the only file this predicate could
- * live in without widening that security allowlist.
- */
-export interface WorkspacePredicateClient {
-  workspace: {
-    count(): Promise<number>;
-    findUnique(args: {
-      where: { id: string };
-    }): Promise<{ organizationId: string } | null>;
-  };
-}
-
-/**
- * The one-workspace deployment predicate (#5876 spec D2), shared by every
- * caller across the package boundary: `workspace.count() !== 1 ⇒ null`, then
- * the sole workspace must be the well-known default AND hang off a sentinel
- * Organization, or the deployment is not unambiguously single-tenant.
- *
- * Returns the **row** (`{ id, organizationId }`), not a projection — a
- * caller that needs `organizationId` (as `resolveDefaultTenant` in
- * `apps/api/src/services/default-tenant.ts` does) would otherwise have to
- * run a second `findUnique`, which is the second-predicate drift NFR-7
- * forbids. A caller that only needs the id projects `.id` itself.
- *
- * Carries no authentication — it answers "is this deployment one-workspace,
- * and which workspace is it," nothing about the caller.
- */
-export async function resolveDefaultWorkspaceRow(
-  prisma: WorkspacePredicateClient,
-): Promise<{ id: Id<"workspace">; organizationId: string } | null> {
-  const workspaceCount = await prisma.workspace.count();
-  if (workspaceCount !== 1) {
-    return null;
-  }
-  const workspace = await prisma.workspace.findUnique({
-    where: { id: DEFAULT_WORKSPACE_ID },
-  });
-  // The default workspace must hang off the sentinel default Organization
-  // (ADR-0031 rule 7): keyed on the reserved-range predicate, not a literal.
-  if (!workspace || !isSentinel(workspace.organizationId)) {
-    return null;
-  }
-  return { id: DEFAULT_WORKSPACE_ID, organizationId: workspace.organizationId };
-}
-
-/**
- * The sentinel-EXISTENCE predicate (#6155 spec D2 rule 2), a SIBLING of
- * {@link resolveDefaultWorkspaceRow}, not a replacement for it: it answers
- * "does the well-known default workspace exist", never "is this deployment
- * unambiguously single-tenant" — so it carries NO `workspace.count()` gate.
- *
- * The two questions coincide on a one-workspace deployment and diverge on a
- * correctly-configured MULTI-workspace one: there,
- * `resolveDefaultWorkspaceRow`'s count gate returns `null` even though the
- * seeded sentinel workspace is present and resolvable. The site-alias
- * resolver (`apps/api/src/lib/site.ts`) needs the sentinel-existence answer
- * — the literal alias `"default"` names the seeded sentinel workspace on
- * EVERY database, single- or multi-tenant (`database/seed.ts` upserts it
- * unconditionally) — so it calls this function, not
- * `resolveDefaultWorkspaceRow`.
- *
- * `resolveDefaultWorkspaceRow` is deliberately NOT modified or loosened:
- * `resolveDefaultTenant` (`apps/api/src/services/default-tenant.ts`) depends
- * on its single-tenancy meaning, so widening it would silently widen
- * single-tenant detection for callers that are correct today. One function,
- * one question.
- */
-export async function resolveSentinelWorkspaceRow(
-  prisma: WorkspacePredicateClient,
-): Promise<{ id: Id<"workspace">; organizationId: string } | null> {
-  const workspace = await prisma.workspace.findUnique({
-    where: { id: DEFAULT_WORKSPACE_ID },
-  });
-  if (!workspace || !isSentinel(workspace.organizationId)) {
-    return null;
-  }
-  return { id: DEFAULT_WORKSPACE_ID, organizationId: workspace.organizationId };
-}
-
-// ---------------------------------------------------------------------------
-// #852 D7 — the Person timeline's pre-migration email fallback.
-//
-// A FlowSession or ProjectListing written before the Person backfill and
-// never tied to a lead (`lead_id IS NULL`) reaches its Person only by email.
-// These three SQL texts are the ONLY way that match is made: run by
-// `apps/api/src/lib/tenant-db.ts`'s `people.timeline` through
-// `$queryRawUnsafe(SQL, email, workspaceId, cutoff)`, and executed verbatim
-// against live Postgres by `database/__tests__/person.db.test.ts` — one
-// string, proven where it runs. `$n` placeholders only, never interpolation.
-//
-// The match is EXACT equality of the normalized column against the Person's
-// stored (already-normalized) email — never Prisma's `mode: "insensitive"`,
-// which compiles to ILIKE: `_`/`%` would act as wildcards and non-ASCII case
-// would fold, joining another client's rows (SEC-852-B). The normalization is
-// the backfill's N(x) (database/migrations/20261010121000_person_backfill).
-//
-// `$3` is the cutoff: `finished_at` of the backfill migration's
-// `_prisma_migrations` row (`PERSON_CUTOFF_SQL`). That column is timestamptz;
-// the inbox `created_at` columns are timestamp(3) holding UTC (Prisma's
-// convention), so the comparison converts the cutoff to UTC wall time. Only
-// rows strictly older than the cutoff qualify. Each returns ids only, at most
-// 50, newest first; the caller re-reads them through its scoped findMany.
-// ---------------------------------------------------------------------------
-
-/** The `_prisma_migrations` key whose `finished_at` is the fallback cutoff. */
-export const PERSON_BACKFILL_MIGRATION = "20261010121000_person_backfill";
-
-/** `$1` = the Person's email, `$2` = workspace id, `$3` = the cutoff. */
-export const PERSON_FALLBACK_FLOW_SESSIONS_SQL = String.raw`SELECT "id" FROM "flow_sessions"
-WHERE "workspace_id" = $2::text
-  AND "lead_id" IS NULL
-  AND "created_at" < ($3::timestamptz AT TIME ZONE 'UTC')
-  AND lower(btrim("email", E' \t\n\r\f\x0B') COLLATE "C") = $1::text
-ORDER BY "created_at" DESC, "id" DESC
-LIMIT 50`;
-
-/** `$1` = the Person's email, `$2` = workspace id, `$3` = the cutoff. */
-export const PERSON_FALLBACK_PROJECT_LISTINGS_SQL = String.raw`SELECT "id" FROM "project_listings"
-WHERE "workspace_id" = $2::text
-  AND "lead_id" IS NULL
-  AND "created_at" < ($3::timestamptz AT TIME ZONE 'UTC')
-  AND lower(btrim("founder_email", E' \t\n\r\f\x0B') COLLATE "C") = $1::text
-ORDER BY "created_at" DESC, "id" DESC
-LIMIT 50`;
-
-/** The cutoff read: the backfill's `finished_at`, or no row when it has not run. */
-export const PERSON_CUTOFF_SQL = `SELECT "finished_at" FROM "_prisma_migrations"
-WHERE "migration_name" = '20261010121000_person_backfill'
-  AND "finished_at" IS NOT NULL
-  AND "rolled_back_at" IS NULL
-LIMIT 1`;

package/templates/database/tsconfig.build.json

@@ -1,16 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "outDir": "./dist",
-    "rootDir": "./generated",
-    "declaration": true,
-    "composite": true,
-    "noEmit": false,
-    "skipLibCheck": true,
-    "types": ["node"]
-  },
-  "include": ["generated/**/*.ts"],
-  "exclude": ["node_modules", "dist", "__tests__"]
-}

package/templates/database/tsconfig.flows.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "outDir": "./dist",
-    "rootDir": ".",
-    "declaration": true,
-    "noEmit": false,
-    "skipLibCheck": true,
-    "types": ["node"]
-  },
-  "include": ["flows/**/*.ts"],
-  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/__tests__/**"]
-}

package/templates/database/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "noEmit": true,
-    "rootDir": ".",
-    "types": ["node"]
-  },
-  "include": [
-    "prisma.config.ts",
-    "seed.ts",
-    "seed-test.ts",
-    "tenancy.ts",
-    "__tests__/fixtures/appointment-create-probe.ts",
-    "flows/**/*.ts"
-  ]
-}

package/templates/database/tsconfig.tenancy.json

@@ -1,14 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "outDir": "./dist",
-    "rootDir": ".",
-    "declaration": true,
-    "noEmit": false,
-    "skipLibCheck": true,
-    "types": ["node"]
-  },
-  "include": ["tenancy.ts"]
-}