create-ailk 0.5.0 → 0.6.0

package/templates/database/CHANGELOG.md

@@ -1,5 +1,147 @@
 # @working-theory/database
 
+## 0.25.0
+
+### Minor Changes
+
+- [#5813](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5813) [`518c590`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/518c59023876a0212504ace9a683084df0168be6) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Generalize `Artifact` into the workspace's content store, and add `Asset` ([#5800](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5800), roadmap D1/D7).
+
+  `artifacts.session_id` was `NOT NULL` behind an `ON DELETE CASCADE`, so deleting an agent session deleted every artifact it had produced. It is now nullable behind `ON DELETE SET NULL`: the session is provenance, the workspace owns the artifact. Beside it, four columns the content store needs — `content_type` (the discriminator; `text/page` is what the editor writes), `locale` (defaulting to ADR 0019's `product.default_locale`), `slug` (NULL until publish) and `published_version_id`. `(workspace_id, content_type, locale, slug)` is unique and `(workspace_id, content_type, updated_at)` is the list index. `published_version_id` is a plain pointer, never a relation and never `is_current`, which remains the draft tip and is never the publish mechanism.
+
+  `content_type` is ADDITIVE beside the existing `type` column rather than a rename: `apps/api/src/routes/workspaces/sessions.ts` reads `type` and keeps working unchanged. The migration backfills `content_type` from `type`, so the two agree row-for-row; new code reads `content_type`.
+
+  `Asset { workspaceId, key, filename, contentType, bytes, size }` follows the inbox namespace's `DeliverableAsset` precedent — bytes in the row, no new infrastructure — with `(workspace_id, key)` unique and a relation-free `workspaceId` (ADR 0009 invariant 1). `@working-theory/ids` registers its `asset_` prefix (ADR 0031 rule 3) and exports `zAssetId`.
+
+  The migration brackets the FK relaxation with zero-row assertions — no row already NULL and no orphan before the swap; no row lost, no row nulled and no `content_type`/`type` drift after it — so it applies to an empty database and to a populated one, and aborts rather than backfilling past a surprise.
+
+- [#6139](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6139) [`9f45297`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/9f4529701aaf2f56acbd2be416e8a8c17358e1aa) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Appointments from Cal.com webhooks ([#6085](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6085), brief H7).
+
+  Adds `POST /v1/webhooks/calcom` — a signed receiver (HMAC-SHA256 over the raw
+  body, `x-cal-signature-256`) that normalizes six `BOOKING_*` trigger events
+  into a new `Appointment` row, guarded by three independent per-family
+  watermarks (lifecycle / payment / no-show) and a 15-minute replay window —
+  and `GET /v1/schedule/appointments`, a tenant-guarded, `owner|admin`-floored
+  read of the site's own appointments, scoped strictly to
+  `tenant.workspaceId` (never `currentSiteId()`, never a platform-operator
+  escape hatch).
+
+  `@working-theory/database` gains the `Appointment` model
+  (`database/inbox/schema.prisma`) and its migration.
+  `@working-theory/ids` registers the `appointment` → `appt` prefix (ADR-0031
+  rule 3). `@working-theory/validation` gains `AppointmentSchema`,
+  `AppointmentListSchema`, `listAppointmentsInputSchema` /
+  `listAppointmentsOutputSchema`, and the inbound Cal.com webhook envelope
+  schemas. `@working-theory/api-client` gains `schedule.appointments()`.
+  `create-ailk` adds the receiver + read + service files (and their tests) to
+  the `scheduling` module's `ownedFiles` — a keyless scaffold is unaffected;
+  a `--modules scheduling` scaffold now carries the new surface.
+
+- [#6118](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6118) [`8b20866`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8b20866470f5aa3ef9fbbba1d11e4fc3b998da86) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `Asset` gains three columns the lightbox edits in place ([#6092](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6092), S4/D10): `title String?`, `description String?`, `tags String[] @default([])`.
+
+  `title` and `description` are nullable with no default — `NULL` means the owner has not written one, distinct from an empty string meaning they cleared it, and neither is backfilled from `filename`. `tags` is non-null with an empty-array default: an untagged asset is an empty set, not an unknown one. The column stores tag SLUGS (`ad-creative`, `workspace-memory`, …), never the human labels a surface renders them as, and is deliberately unconstrained — the asset vocabulary and the document vocabulary (a document is a row in this same store) ride the one column, and a fixed set is a UI affordance, not a database constraint.
+
+  Delivered by one additive migration, `20260918120000_asset_metadata_columns` — no column dropped or renamed, no value backfilled, the `(workspace_id, key)` identity and the `asset_` UUIDv7 CHECK untouched. An `INSERT` naming none of the three columns still succeeds.
+
+- [#6202](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6202) [`b85e147`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/b85e147d0d26150eb1a00e1933df138087727628) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `FlowDefinition` and `FlowSession` gain a nullable `workspaceId` column, backfilled 1:1 from `siteId` ([#6155](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6155)).
+
+  The literal alias `"default"` resolves to the seeded sentinel workspace; every other alias resolves only by exact `workspaces.id` equality. A row whose `siteId` matches no workspace is left `NULL` — unset, never guessed — and stays invisible to every tenant-scoped read rather than visible to the wrong one. `siteId` is unchanged and the public flow engine keeps resolving it; nothing about the request or response shape of `/v1/flows/*` or either MCP flow tool changes.
+
+  `database/tenancy.ts` also gains `resolveSentinelWorkspaceRow(prisma)` — the sentinel-existence sibling of `resolveDefaultWorkspaceRow`, carrying no `workspace.count()` gate, so a correctly-configured multi-workspace deployment that has not pinned `AILK_SITE_ID` still resolves the `"default"` alias.
+
+- [#6218](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6218) [`80f498e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/80f498e3dcd3d70931045dc376c293c0c9a88c65) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `FlowDefinition` gains four operator-facing columns — `kind`, `title`, `landingPage`, `status` ([#6156](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6156)) — backfilled for every existing row by a structural rule (never from slug), with the visitor-facing `config` left byte-identical.
+
+  `status` (`draft` | `live`) carries NO column default and is backfilled `'live'` — every row that exists today is already serving, and a silent default would make publication the thing that happens when a future writer says nothing. `title` is likewise `NOT NULL` with no default, backfilled from `slug`. `kind` (`special-report` | `diagnostic` | `listicle` | `waitlist` | `contact` | `newsletter`) keeps its column default (`'contact'`) and is reclassified only where the row's own structure (a projected listing, a recommending-mode config, a `deliverables` block) says otherwise. `landingPage` is nullable with no backfill — a magnet has three public addresses, and NULL means the canonical route serves it.
+
+  `@working-theory/validation`'s `flow.ts` gains `flowKindSchema` / `flowStatusSchema` / `flowLandingPageSchema` as standalone exports — never members of `flowConfigShapeSchema`, which stays `.strict()` and gains none of the four keys, so every stored `configSnapshot` keeps parsing unchanged.
+
+  A `status` of `draft` refuses a NEW walk from starting (`resolveSession`'s definition branch) while a walk already in progress finishes on its pinned snapshot — the `sessionId` branch never re-reads the definition. `upsertFlowDefinition` supplies `kind`/`title`/`status` on CREATE only, never on UPDATE, so a re-seed or re-materialize can never overwrite what an operator later sets. The public routes and both MCP flow tools are unchanged.
+
+- [#6274](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6274) [`3bd8785`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3bd87854c6589556426894720c85f54bf2daa801) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `ProjectListing` and `Lead` gain a nullable `workspaceId` column (`workspace_id`), indexed for a per-workspace list and backfilled from `siteId` for any existing row whose alias resolves to a real workspace ([#6203](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6203)). `tenantDb(tenant)` gains `projectListings` and `leads` read accessors, scoped by the injected `workspaceId` and never returning a row from another workspace. `siteId` stays the legacy alias, unchanged, on both models.
+
+- [#6280](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6280) [`2e7b0d2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2e7b0d2411944002104d5105edb6e8d59c8434c5) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `Lead` gains a nullable triage stamp — `handledAt` (`handled_at`) and `handledBy` (`handled_by`), the actor — plus a `(workspaceId, handledAt)` index for the Needs-you read ([#6204](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6204)). Existing rows are unaffected by the purely-additive migration and read as unhandled. `@working-theory/validation` gains `MESSAGE_LEAD_SOURCES` / `MESSAGE_LEAD_SOURCE_LIST` and `isMessageSource()` — the one closed allowlist declaring which `Lead.source` values are messages (a lead that needs an answer, operator decision Q1(a)), never a denylist and never a pattern test. `tenantDb(tenant).leads` gains `listUnhandledMessages` (bounded, workspace-scoped) and `markHandled` (an idempotent compare-and-swap), and `leads-inbox.ts` exposes the role-floored service pair over them. No route and no MCP tool — nothing new is reachable from this unit.
+
+- [#6360](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6360) [`2809d30`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2809d307d4d130541cb29ea7176b4af17e58679c) Thanks [@claudio-planck](https://github.com/claudio-planck)! - `Lead`, `ProjectListing`, `FlowDefinition`, `FlowSession` gain NOT NULL `workspaceId` plus a `CHECK (workspace_id = site_id)` equality constraint, and `WorkspaceSiteIdentity` gains `@@unique([id, workspaceId])` ([#6254](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6254), the tenancy-fence keystone).
+
+  The issue's literal ask — a composite foreign key from the four fenced models to `WorkspaceSiteIdentity` — is not buildable against this tree: it crosses the `inbox` → `config` namespace boundary ADR-0009 forbids, `siteId` never holds a `WorkspaceSiteIdentity.id` (it holds the workspace id), and `WorkspaceSiteIdentity` is an optional per-workspace config blob whose required existence would break anonymous lead capture, a never-gate surface. The equality CHECK delivers the same guarantee — Postgres rejects a row whose `workspaceId` disagrees with its site — without a relation and without crossing the boundary; it is strictly tighter than the FK would have been. `docs/database/namespaces.md` documents the pattern for the fan-out ([#6255](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6255)–[#6260](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6260), [#6171](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6171), [#6314](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6314)), which land their own model changes into this same migration, `database/migrations/20260922120000_tenancy_fence`.
+
+  `DeliverableGrant` (the fifth already-keyed model) is deliberately NOT touched — its `workspaceId` has no source column to derive from and `NULL` is the serve path's fail-closed sentinel; [#6257](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6257) fences it separately, at mint grain.
+
+  Every write site that creates a `Lead`, `ProjectListing`, `FlowDefinition` or `FlowSession` row now derives `workspaceId` server-side from the resolved site alias (`apps/api/src/lib/site.ts`'s `resolveSiteWorkspaceId()` / `resolveWorkspaceIdForAlias()`), never from a request body. `routeLead`'s file-fallback no longer swallows a constraint violation into a silent success — it re-raises as a `persist_failed` error, while a genuine infrastructure outage still takes the file fallback unchanged.
+
+- [#6418](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6418) [`14dcb0f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/14dcb0fe7864a13f3fb9d573c303ddb8780dbdf5) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `ProjectListing` records the listicle magnet that captured it, so a magnet's Applications list can be scoped to its own submissions ([#6314](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6314)).
+
+  Nothing constrains a workspace to one listicle-kind `FlowDefinition` — the model carries `@@unique([siteId, slug])` and no `@@unique([siteId, kind])` — so a workspace-only Applications list would silently show two listicle magnets' applications on both of their detail pages, with nothing to notice it. `ProjectListing` carried no reverse link to the magnet that captured it: the two pointers that existed (`FlowDefinition.listingId` and `ProjectListing.experimentKey`) are both written at APPROVAL time, when an approved listing is projected into its own diagnostic sub-flow, and name a different flow entirely.
+
+  **`@working-theory/database`** — `ProjectListing` gains `capturedByFlowId String? @map("captured_by_flow_id")` and `@@index([workspaceId, capturedByFlowId])`. A plain scalar ref: no `@relation`, no foreign key, no `onDelete`, matching the intra-`inbox` convention every sibling reference on this model already follows (`leadId`, `listingId`, `grantId`, `flowSessionId` carry none, and all 24 foreign keys in the migration history target `auth`). Integrity rests on the server-side resolve and on the read carrying both scope terms; the column's own schema comment states that cost rather than arguing it away. Permanently nullable and **not** a backfill target — no existing row carries evidence naming the magnet that captured it, so every row written before this reads `NULL` for the life of the row: unattributed, absent from every per-magnet list, and unchanged in the workspace Inbox. `NULL` means "not attributed", never "attribution failed" and never "captured directly".
+
+  **`@working-theory/validation`** — `projectListingStartSchema` gains one optional key, `capturedByFlowSlug: flowSlugSchema.optional()`. Additive on a `.strict()` schema, so every existing caller (the agent channel included) is accepted unchanged. It is a slug rather than an id because no public surface hands a visitor a `flow_<uuidv7>`; the server resolves it against the already-resolved `siteId`/`workspaceId` plus `kind: "listicle"` and stores the id it finds. A slug that resolves to nothing — naming no magnet, another workspace's magnet, or a non-listicle magnet — writes `NULL` and still returns `201`: this is a never-gate anonymous route where a refused body is a lost application, and a distinguishable error would make it a cross-workspace magnet-slug oracle. The operator's signal is a PII-safe server-side log line instead.
+
+- [#6383](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6383) [`e71eb5d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e71eb5d0d5796732e19dfab7768048a1009ef66d) Thanks [@claudio-planck](https://github.com/claudio-planck)! - **breaking** — the tenancy fence fan-out: thirteen models gain a required `workspace_id`.
+
+  `Subscriber`, `Callback`, `ConsentGrant`, `Appointment`, `DeliverableAsset`,
+  `FlowCheckout`, `WaitlistExperiment`, `WaitlistScore`, `WaitlistFollowUpSend`,
+  `PlaybookInstance` and `SiteListingConfig` each gain a NOT NULL
+  `workspaceId String @map("workspace_id")`, an `@@index([workspaceId])`, a
+  `<table>_workspace_id_format` CHECK and a
+  `<table>_workspace_site_agree CHECK (workspace_id = site_id)`. Every
+  `create`/`upsert` of these models must now supply `workspaceId`, and it must
+  equal the row's `site_id` — a server-resolved workspace id, never a value read
+  from a request body.
+
+  Two models carry no `site_id` and take a different shape:
+
+  - `ListingCsvSend` gains NOT NULL `workspace_id` plus the format CHECK only —
+    no equality CHECK and no foreign key. It is backfilled and stamped from the
+    parent `ProjectListing`.
+  - `SiteSetting` gains NOT NULL `workspace_id`, and **its unique key moves from
+    `key` to `(workspaceId, key)`** — `key` alone is no longer unique, so
+    `siteSetting.findUnique`/`upsert` must pass the compound
+    `workspaceId_key` selector. Existing rows backfill to the sentinel
+    workspace, and every `key` string is left verbatim.
+
+  `DeliverableGrant.workspaceId` stays **nullable** — NULL remains the serve
+  path's fail-closed sentinel for a legacy grant — but gains a NULL-tolerant
+  `CHECK (workspace_id IS NULL OR workspace_id = site_id)`, and both mint sites
+  now stamp it.
+
+  Per [#6254](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6254) AC-1 this lands as an amendment to the single M32 migration
+  `20260922120000_tenancy_fence` rather than a new migration directory. The
+  amendment is a no-op on a database that already applied that migration, which
+  is safe here under the operator's 2026-09-20 disposition that no persistent
+  database carries state that must survive (spec § 1.5); if that ever stops
+  holding, the SQL moves verbatim into a new migration directory and nothing
+  else changes.
+
+- [#5939](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5939) [`0d2a2b5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/0d2a2b54eb622a904d4a8b80c31a495651ef19e7) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add the shared one-workspace resolution predicate to the `./tenancy` subpath ([#5876](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5876)).
+
+  `resolveDefaultWorkspaceRow(prisma)` and its structural `WorkspacePredicateClient` type join the sentinel constants already exported there — the deployment-level predicate `apps/api/src/services/default-tenant.ts` and `apps/mcp`'s new tenant resolution both delegate to, so the one-workspace check exists exactly once in the repository (NFR-7). Additive: no existing export changes shape.
+
+### Patch Changes
+
+- [#6172](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6172) [`20bab3b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/20bab3ba318e4ecb8ae7489e4ad638808a3a165d) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Fix `Appointment.noShow` — restore its `@map("no_show")`, matching every sibling field on the model and the column the `20260918120000_add_appointment` migration actually creates ([#6162](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6162)).
+
+  Without the mapping, Prisma's generated client targeted the literal column `noShow`, which the live database does not have — every `prisma.appointment.create()` (and any other read/write touching this field) failed at runtime with `The column noShow of relation appointments does not exist in the current database.` No schema shape changed and no migration is added; this restores the field's intended, already-migrated column target. A new `database/__tests__/appointment.db.test.ts` proves the round trip against a live migrated database, and `tools/check-prisma-migration-drift.ts` — a new preflight check — fails when a Prisma schema field/model's implied column/table name disagrees with what the migration history actually creates, catching this exact class before merge.
+
+- [#6367](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6367) [`d3f599e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d3f599e1f1cadd3d998b92514231b0b4b7b7f77c) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `ProjectListing.consentAt` now declares `@db.Timestamptz(3)`, matching the `TIMESTAMPTZ` column its migration (`20260909180000_listing_draft_and_fields`) actually created ([#6171](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6171)). The Prisma schema previously declared this legal-consent timestamp as a plain, timezone-naive `DateTime`, which Prisma defaults to `TIMESTAMP(3)` on Postgres — a drift between the schema's declared type and the live column's real type. No migration is needed; the column already exists as `TIMESTAMPTZ`.
+
+- [#6224](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6224) [`454edc7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/454edc7bb960666c57b7f2651f644b3788194698) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add the enabled-meeting-slugs gate ([#6183](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6183) S9b) — the operator's control over which meeting types the site's OWN PAGES publish.
+
+  A fourth workspace site-config blob, `MeetingsSchema` (`enabledSlugs`, beside `ThemeSchema`/`SiteIdentitySchema`/`SEOSchema`), reads and writes through a new route, `GET|PUT /v1/workspaces/:workspaceId/meetings` (`apps/api/src/routes/workspaces/meetings.ts`) — a new route file and a new handler, but the SAME path shape, tenant guard and `{ok,data}` envelope as its three siblings, registered in its own scope gated on the `scheduling` module alone (its GET needs the scheduling provider seam, which a `workspace`/`multi-tenant`-only build does not carry). The write floor is `owner|admin`, matching every other publication-affecting write in this route family; the GET carries the SAME floor, since it echoes the deployment's provider catalog joined with which rows are enabled — a plain member should not read that. The GET also lists the scheduling provider's own bookable event types (`listEventTypes`, [#6182](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6182)), joined with `enabled: boolean`, so the Admin Meetings page can render a toggle list.
+
+  A new anonymous route, `GET /v1/schedule/meeting-types`, is what lets the public `/meet` surface — which holds no session — honour the gate at request time for its OWN two pages: `/meet/[slug]` now 404s a disabled slug (gating both the page and `generateMetadata`, so a disabled event's title/description never reach the document head), and `/meet` lists the enabled set rather than a single configured link, titled from one batched `event-meta` read. An unconfigured deployment falls back to the singleton `SCHEDULING_CAL_LINK` already advertises, so no shipped page goes dark on upgrade. Both pages are `force-dynamic`: enabling or disabling a slug takes effect on the next request, no deploy.
+
+  **This is a publication gate on this site's own pages, not an authorization boundary on the provider.** The three anonymous scheduling routes — `POST /v1/schedule/book`, `GET /v1/schedule/availability`, `GET /v1/schedule/event-meta` — are unchanged and still accept any `calLink` naming ANY event the provider knows about, disabled or not; none of them consults `enabledSlugs`. A disabled event's own page on this site 404s, but the event is still bookable at the provider's own public page and through those three routes directly, and nothing this repo can change alters that. Gating them would change a fenced scheduling-route contract this unit does not touch, and would not close the provider's own page regardless.
+
+- [#6407](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/6407) [`87535c1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/87535c162654d76af314395eb55e87bd0ef96021) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `database/inbox/schema.prisma` drops the 'PLACEMENT IS A HARD REQUIREMENT' comment blocks ([#6261](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/6261)).
+
+  Comment-only: no model, field, mapping, index or migration changes, so the generated client is byte-identical. The blocks documented a workaround for the tenant-scope drift guard's old model-body collector, which matched `/model\s+(\w+)\s+\{([^}]*)\}/` and stopped at the first closing-curly CHARACTER — including one written inside a doc comment — and so forced `workspaceId` to be declared above any comment that might contain one.
+
+  The reader behind that guard now lives in `tools/lib/tenant-scope-schema.ts` and parses model bodies by brace DEPTH, outside `//` and `///` comments and outside double-quoted strings. Field placement no longer carries meaning for it, so the per-field 'DO NOT MOVE this field' clauses that referenced the blocks go with them. No field moved.
+
+- Updated dependencies [[`8eadc43`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8eadc437285a0c0121c9f4750ff83dac9591729e), [`2666bf3`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2666bf3ed24324a37a51cfc5c68019ad5d26403e), [`94ebca8`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/94ebca8f3c1c9f3b744182c720e91417012ecc9b), [`518c590`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/518c59023876a0212504ace9a683084df0168be6), [`8f931f1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8f931f1af0d170fb743bf027634154cd53aa1db9), [`ecab283`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ecab283284d5f6a6ba4a2a08b018b077257de288), [`3bb6a93`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3bb6a93f41c7dfd8d24ea017f5c403edaae03fcf), [`ab6b792`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ab6b79258a369ff909fa62d7bffca7fe264fe532), [`9e7df0d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/9e7df0d93343e126c7b058a66b71ad4dda8ae9e4), [`28f14b5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/28f14b50dfe29d2d9bf8e75aa368eb1ef3767d47), [`9f45297`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/9f4529701aaf2f56acbd2be416e8a8c17358e1aa), [`80f498e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/80f498e3dcd3d70931045dc376c293c0c9a88c65), [`454edc7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/454edc7bb960666c57b7f2651f644b3788194698), [`2e7b0d2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2e7b0d2411944002104d5105edb6e8d59c8434c5), [`6d061a0`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6d061a0cd48baec20899cec2962ff6877addaa85), [`14dcb0f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/14dcb0fe7864a13f3fb9d573c303ddb8780dbdf5), [`f917f0b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f917f0b182ea8daf657b4762551ea5e86fc90616)]:
+  - @working-theory/validation@0.25.0
+  - @working-theory/ids@0.8.0
+
 ## 0.24.0
 
 ### Patch Changes

package/templates/database/README.md

@@ -143,11 +143,18 @@ await prisma.userData.upsert({
   create: { userId, key: "preferences", value: { theme: "dark" } },
 });
 
-// Store site-wide cache
+// Store a per-workspace setting.
+//
+// #6374 D3 — `SiteSetting` is keyed by (workspaceId, key), NOT by `key`
+// alone: `key` lost its global @unique so two workspaces may each hold a
+// `cached_config` row. `workspaceId` is resolved SERVER-SIDE (see
+// apps/api/src/lib/site.ts's `resolveWorkspaceIdForAlias`) and never read
+// from a request body — `site_settings.workspace_id` is NOT NULL with a
+// format CHECK, so a raw site alias is refused by Postgres.
 await prisma.siteSetting.upsert({
-  where: { key: "cached_config" },
+  where: { workspaceId_key: { workspaceId, key: "cached_config" } },
   update: { value: platformConfig },
-  create: { key: "cached_config", value: platformConfig },
+  create: { workspaceId, key: "cached_config", value: platformConfig },
 });
 ```
 

package/templates/database/__tests__/appointment.db.test.ts

@@ -0,0 +1,106 @@
+/**
+ * @file appointment.db.test.ts
+ *
+ * LIVE-DATABASE proof that `Appointment.noShow` correctly targets the
+ * `no_show` column (#6162). Requires DATABASE_URL pointing at a Postgres with
+ * the migrations applied (`prisma migrate deploy`) — the whole suite SKIPS
+ * when DATABASE_URL is unset, keeping the workspace Jest run DB-free (the
+ * repo convention — see `prefixed-ids.db.test.ts`; the `apps/api Route Tests
+ * (Postgres)` workflow runs this file with a real DB, per its own explicit
+ * `pnpm --filter @working-theory/database test` step's precedent).
+ *
+ * The bug this guards: `Appointment.noShow` carried no `@map("no_show")` —
+ * every sibling field on the model does — while the migration that creates
+ * the table (`20260918120000_add_appointment`) names the column `no_show`.
+ * Prisma's generated client then targets the literal column `noShow`, which
+ * does not exist, and every `prisma.appointment.create()` (or any other
+ * write/read touching this field) fails at runtime.
+ *
+ * Spawns `appointment-create-probe.ts` via `tsx` (a real ESM process) rather
+ * than importing the generated client directly in this file — the generated
+ * client (`generated/client/client.ts`) uses `import.meta.url` and cannot
+ * load under this package's CJS `ts-jest` transform (the same constraint
+ * `prefixed-ids.db.test.ts` documents; see that file's header for why THAT
+ * test uses raw `pg` instead — this one needs the real Prisma runtime
+ * specifically to prove the `@map` targets the right column, which a raw-SQL
+ * probe cannot exercise since it never goes through Prisma's own column-name
+ * resolution).
+ *
+ * RED, reproduced by hand against this exact fixture before the fix (`git
+ * stash` the `@map("no_show")` line, `prisma generate`, re-run):
+ *
+ *   PrismaClientKnownRequestError: The column `noShow of relation
+ *   appointments` does not exist in the current database.
+ *
+ * GREEN, after `@map("no_show")` is restored: the probe's stdout is the
+ * created row, `noShow: true` included, and the process exits 0. Both runs
+ * are logged in this PR's Verification section.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const DATABASE_DIR = join(__dirname, "..");
+const PROBE_SCRIPT = join(__dirname, "fixtures", "appointment-create-probe.ts");
+
+/** Walk up from DATABASE_DIR to find node_modules/.bin/tsx (worktree-safe —
+ * mirrors `database/inbox/__tests__/schema.test.ts`'s own tsx-via-pnpm-exec
+ * invocation, but resolves the binary directly since this call needs a
+ * scoped `env` — including a possibly-overridden DATABASE_URL — that `pnpm
+ * exec` would otherwise have to re-derive). */
+function findTsxBin(): string {
+  let dir = DATABASE_DIR;
+  for (let i = 0; i < 5; i++) {
+    const candidate = join(dir, "node_modules", ".bin", "tsx");
+    if (existsSync(candidate)) return candidate;
+    dir = join(dir, "..");
+  }
+  throw new Error(`tsx binary not found searching up from ${DATABASE_DIR}.`);
+}
+
+describeDb(
+  "Appointment.noShow — live DB round trip via prisma.appointment.create() (#6162)",
+  () => {
+    it("creates and reads back an Appointment row, including noShow", () => {
+      const tsxBin = findTsxBin();
+      const result = spawnSync(tsxBin, [PROBE_SCRIPT], {
+        cwd: DATABASE_DIR,
+        encoding: "utf-8",
+        env: process.env,
+      });
+
+      // Asserting on exit status + a successful parse of stdout — rather
+      // than requiring empty stderr — is the full signal: a stray Node/tsx
+      // diagnostic (an experimental-feature banner, a deprecation warning)
+      // on an otherwise-successful run must not fail this test (code review
+      // on #6162). A genuine failure still surfaces loudly: `status` carries
+      // the exit code and `stderr` the probe's own logged message.
+      if (result.status !== 0) {
+        throw new Error(
+          `probe exited ${result.status}: ${result.stderr || "(no stderr)"}`,
+        );
+      }
+
+      const row = JSON.parse(result.stdout) as {
+        siteId: string;
+        workspaceId: string;
+        attendeeEmail: string;
+        status: string;
+        noShow: boolean;
+        noShowEventAt: string | null;
+      };
+      expect(row.siteId).toBe("wksp_00000000-0000-7000-8000-00000000f1f1");
+      // #6374 — the probe row is fenced like every other appointments row:
+      // `workspace_id` is NOT NULL and must EQUAL `site_id`. A probe that
+      // still wrote the pre-fence free-form site id would be rejected by
+      // `appointments_workspace_id_format` before this assertion ran.
+      expect(row.workspaceId).toBe(row.siteId);
+      expect(row.attendeeEmail).toBe("appointment-probe@example.invalid");
+      expect(row.status).toBe("confirmed");
+      expect(row.noShow).toBe(true);
+      expect(row.noShowEventAt).not.toBeNull();
+    });
+  },
+);

package/templates/database/__tests__/artifact-content-store.db.test.ts

@@ -0,0 +1,316 @@
+/**
+ * @file artifact-content-store.db.test.ts
+ *
+ * LIVE-DATABASE proof of roadmap D1/D7 (#5800) — the generalized `Artifact` and
+ * the workspace-scoped `Asset`. Requires DATABASE_URL pointing at a Postgres
+ * with the migrations applied (`prisma migrate deploy`); the whole suite SKIPS
+ * when DATABASE_URL is unset, matching `prefixed-ids.db.test.ts` and keeping the
+ * workspace Jest run DB-free.
+ *
+ * Raw SQL through `pg` for the same reason that file gives: the generated Prisma
+ * client is ESM-only and cannot load under this package's CJS ts-jest transform,
+ * and raw SQL is the sharper proof anyway — a constraint must hold on the path
+ * no application helper can guard.
+ *
+ * What it proves:
+ *   1. THE SURVIVAL PROPERTY (D1). An artifact produced inside an agent session
+ *      outlives that session: deleting the session sets `session_id` to NULL and
+ *      leaves the row, its versions, and its publish pointer intact. Before this
+ *      migration the FK was `ON DELETE CASCADE` on a NOT NULL column, so the
+ *      same delete destroyed the workspace's content. This is the whole point of
+ *      "the session becomes provenance, the workspace owns the artifact".
+ *   2. The identity of a published page — `(workspace_id, content_type, locale,
+ *      slug)` is unique, while unpublished drafts (slug NULL) are unconstrained,
+ *      because NULLs never collide in a Postgres unique index.
+ *   3. `published_version_id` is an independent pointer: it is NOT `is_current`,
+ *      and appending a newer draft tip does not move it.
+ *   4. `assets` is workspace-scoped with a unique `(workspace_id, key)` and a
+ *      DB-minted `asset_` UUIDv7 id (ADR-0031).
+ */
+import { randomUUID } from "node:crypto";
+
+import { Client } from "pg";
+
+import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const V7_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/** A run-unique suffix so repeated local runs never collide on the unique key. */
+const RUN = randomUUID().slice(0, 8);
+
+describeDb("Artifact content store (roadmap D1/D7, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+  });
+
+  afterAll(async () => {
+    await db.query(
+      `DELETE FROM "artifacts" WHERE "title" LIKE $1`,
+      [`5800-${RUN}%`],
+    );
+    await db.query(`DELETE FROM "agent_sessions" WHERE "title" LIKE $1`, [
+      `5800-${RUN}%`,
+    ]);
+    await db.query(`DELETE FROM "assets" WHERE "key" LIKE $1`, [
+      `5800-${RUN}%`,
+    ]);
+    await db.end();
+  });
+
+  describe("the session is provenance — deleting it never destroys content", () => {
+    it("sets session_id NULL and leaves the artifact, its versions and its publish pointer", async () => {
+      const sessionId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "agent_sessions" ("workspace_id", "title", "updated_at")
+           VALUES ($1, $2, now()) RETURNING "id"`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} session`],
+        )
+      ).rows[0]!.id;
+
+      const artifactId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifacts" ("session_id", "workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, $3, 'text/page', 'en', $4, now()) RETURNING "id"`,
+          [
+            sessionId,
+            DEFAULT_WORKSPACE_ID,
+            `5800-${RUN} page`,
+            `5800-${RUN}-survivor`,
+          ],
+        )
+      ).rows[0]!.id;
+
+      const versionId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"v1"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      await db.query(
+        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
+        [versionId, artifactId],
+      );
+
+      // The act under test: the producing session is deleted outright.
+      await db.query(`DELETE FROM "agent_sessions" WHERE "id" = $1`, [
+        sessionId,
+      ]);
+
+      const { rows } = await db.query<{
+        session_id: string | null;
+        workspace_id: string;
+        published_version_id: string | null;
+      }>(
+        `SELECT "session_id", "workspace_id", "published_version_id"
+         FROM "artifacts" WHERE "id" = $1`,
+        [artifactId],
+      );
+
+      expect(rows).toHaveLength(1);
+      expect(rows[0]!.session_id).toBeNull();
+      expect(rows[0]!.workspace_id).toBe(DEFAULT_WORKSPACE_ID);
+      expect(rows[0]!.published_version_id).toBe(versionId);
+
+      const versions = await db.query(
+        `SELECT "id" FROM "artifact_versions" WHERE "artifact_id" = $1`,
+        [artifactId],
+      );
+      expect(versions.rows).toHaveLength(1);
+    });
+
+    it("accepts an artifact with no session at all — the workspace owns it", async () => {
+      const { rows } = await db.query<{ id: string; session_id: string | null }>(
+        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+         VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id", "session_id"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN} sessionless`],
+      );
+
+      expect(rows[0]!.session_id).toBeNull();
+      expect(rows[0]!.id).toMatch(/^artif_/);
+    });
+  });
+
+  describe("published identity", () => {
+    it("rejects a second artifact with the same (workspace, contentType, locale, slug)", async () => {
+      const slug = `5800-${RUN}-dupe`;
+      await db.query(
+        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+         VALUES ($1, $2, 'text/page', 'en', $3, now())`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN} first`, slug],
+      );
+
+      await expect(
+        db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', $3, now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} second`, slug],
+        ),
+      ).rejects.toThrow(/duplicate key|unique/i);
+    });
+
+    it("admits many unpublished drafts — a NULL slug never collides", async () => {
+      for (const n of [1, 2, 3]) {
+        await db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} draft ${n}`],
+        );
+      }
+
+      const { rows } = await db.query<{ count: string }>(
+        `SELECT count(*)::text AS count FROM "artifacts"
+         WHERE "title" LIKE $1 AND "slug" IS NULL`,
+        [`5800-${RUN} draft %`],
+      );
+      expect(rows[0]!.count).toBe("3");
+    });
+
+    it("separates the same slug across locales", async () => {
+      const slug = `5800-${RUN}-locale`;
+      for (const locale of ["en", "fr"]) {
+        await db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, 'text/page', $3, $4, now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} ${locale}`, locale, slug],
+        );
+      }
+
+      const { rows } = await db.query<{ count: string }>(
+        `SELECT count(*)::text AS count FROM "artifacts" WHERE "slug" = $1`,
+        [slug],
+      );
+      expect(rows[0]!.count).toBe("2");
+    });
+  });
+
+  describe("the publish pointer is not the draft tip", () => {
+    it("survives a newer is_current version", async () => {
+      const artifactId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id"`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} pointer`],
+        )
+      ).rows[0]!.id;
+
+      const published = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"published"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      await db.query(
+        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
+        [published, artifactId],
+      );
+
+      // A newer draft tip lands; the publish pointer must NOT follow it.
+      await db.query(
+        `UPDATE "artifact_versions" SET "is_current" = FALSE WHERE "artifact_id" = $1`,
+        [artifactId],
+      );
+      const draft = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"draft"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      const { rows } = await db.query<{ published_version_id: string | null }>(
+        `SELECT "published_version_id" FROM "artifacts" WHERE "id" = $1`,
+        [artifactId],
+      );
+      expect(rows[0]!.published_version_id).toBe(published);
+      expect(rows[0]!.published_version_id).not.toBe(draft);
+    });
+  });
+
+  describe("Asset (D7)", () => {
+    it("mints an asset_ UUIDv7 id and stores the bytes", async () => {
+      const { rows } = await db.query<{ id: string; size: number }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'logo.png', 'image/png', $3, 4) RETURNING "id", "size"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-logo`, Buffer.from([1, 2, 3, 4])],
+      );
+
+      expect(rows[0]!.id).toMatch(/^asset_/);
+      expect(rows[0]!.id.slice("asset_".length)).toMatch(V7_RE);
+      expect(rows[0]!.size).toBe(4);
+    });
+
+    it("rejects a second asset with the same (workspace, key)", async () => {
+      const key = `5800-${RUN}-dupe-key`;
+      await db.query(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'a.png', 'image/png', $3, 1)`,
+        [DEFAULT_WORKSPACE_ID, key, Buffer.from([1])],
+      );
+
+      await expect(
+        db.query(
+          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+           VALUES ($1, $2, 'b.png', 'image/png', $3, 1)`,
+          [DEFAULT_WORKSPACE_ID, key, Buffer.from([2])],
+        ),
+      ).rejects.toThrow(/duplicate key|unique/i);
+    });
+
+    it("rejects a malformed workspace_id (ADR-0031 CHECK)", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+           VALUES ('not-a-workspace-id', $1, 'a.png', 'image/png', $2, 1)`,
+          [`5800-${RUN}-bad-scope`, Buffer.from([1])],
+        ),
+      ).rejects.toThrow(/assets_workspace_id_format|check constraint/i);
+    });
+
+    // #6092 (S4/D10) — title, description and tags. `tags` stores SLUGS, never
+    // the human labels the lightbox renders (D3): 'ad-creative' and
+    // 'user-uploaded' are the exact pair the demo's first asset carries
+    // (demo.html:357).
+    it("stores and returns two tags", async () => {
+      const { rows } = await db.query<{ tags: string[] }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size", "tags")
+         VALUES ($1, $2, 'tagged.png', 'image/png', $3, 1, $4) RETURNING "tags"`,
+        [
+          DEFAULT_WORKSPACE_ID,
+          `5800-${RUN}-tagged`,
+          Buffer.from([1]),
+          ["ad-creative", "user-uploaded"],
+        ],
+      );
+
+      expect(rows[0]!.tags).toEqual(["ad-creative", "user-uploaded"]);
+      expect(rows[0]!.tags).toHaveLength(2);
+    });
+
+    it("defaults title, description and tags when none of the three columns is named", async () => {
+      const { rows } = await db.query<{
+        title: string | null;
+        description: string | null;
+        tags: string[];
+      }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'untagged.png', 'image/png', $3, 1)
+         RETURNING "title", "description", "tags"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-untagged`, Buffer.from([1])],
+      );
+
+      expect(rows[0]!.title).toBeNull();
+      expect(rows[0]!.description).toBeNull();
+      expect(rows[0]!.tags).toEqual([]);
+    });
+  });
+});