create-ailk 0.5.0 → 0.6.1

package/templates/database/__tests__/project-listing-consent-at.db.test.ts

@@ -0,0 +1,111 @@
+/**
+ * @file project-listing-consent-at.db.test.ts
+ *
+ * LIVE-DATABASE proof that `ProjectListing.consentAt` round-trips through
+ * the real Prisma Client with timezone information preserved (#6171).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied
+ * (`prisma migrate deploy`) — the whole suite SKIPS when DATABASE_URL is
+ * unset, keeping the workspace Jest run DB-free (the repo convention; see
+ * `prefixed-ids.db.test.ts` / `appointment.db.test.ts`).
+ *
+ * The bug this guards: `database/inbox/schema.prisma`'s `consentAt` field
+ * declared `DateTime @default(now()) @map("consent_at")` with no native-type
+ * annotation, so Prisma treated it as `TIMESTAMP(3)` (no time zone) by
+ * default, while its migration
+ * (`20260909180000_listing_draft_and_fields/migration.sql`) created the
+ * actual column as `TIMESTAMPTZ` — deliberately, since it records a legal
+ * consent timestamp. The fix adds `@db.Timestamptz(3)` so the schema's
+ * declared type agrees with what the column actually is.
+ *
+ * Spawns `project-listing-consent-probe.ts` via `tsx` (a real ESM process)
+ * rather than importing the generated client directly, for the same reason
+ * `appointment.db.test.ts` does: the generated client is ESM-only
+ * (`import.meta.url`) and cannot load under this package's CJS `ts-jest`
+ * transform.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const DATABASE_DIR = join(__dirname, "..");
+const PROBE_SCRIPT = join(
+  __dirname,
+  "fixtures",
+  "project-listing-consent-probe.ts",
+);
+
+// Runs with no DATABASE_URL required — a deterministic guard so the schema
+// declaration can't silently regress even in a DB-free run (the live-DB
+// round trip below still runs whenever DATABASE_URL is set).
+describe("ProjectListing.consentAt — schema declares the real column type (#6171)", () => {
+  it("carries @db.Timestamptz(3), matching the TIMESTAMPTZ column created by 20260909180000_listing_draft_and_fields", () => {
+    const schema = readFileSync(
+      join(DATABASE_DIR, "inbox", "schema.prisma"),
+      "utf-8",
+    );
+    const fieldLine = schema
+      .split("\n")
+      .find((line) => /^\s*consentAt\s+DateTime\b/.test(line));
+    expect(fieldLine).toBeDefined();
+    expect(fieldLine).toMatch(/@db\.Timestamptz\(3\)/);
+  });
+});
+
+/** Walk up from DATABASE_DIR to find node_modules/.bin/tsx (worktree-safe —
+ * mirrors `appointment.db.test.ts`'s own resolution). */
+function findTsxBin(): string {
+  let dir = DATABASE_DIR;
+  for (let i = 0; i < 5; i++) {
+    const candidate = join(dir, "node_modules", ".bin", "tsx");
+    if (existsSync(candidate)) return candidate;
+    dir = join(dir, "..");
+  }
+  throw new Error(`tsx binary not found searching up from ${DATABASE_DIR}.`);
+}
+
+describeDb(
+  "ProjectListing.consentAt — live DB round trip via prisma.projectListing (#6171)",
+  () => {
+    it("preserves the exact instant through create() + a fresh findUniqueOrThrow(), regardless of session timezone", () => {
+      const tsxBin = findTsxBin();
+      const result = spawnSync(tsxBin, [PROBE_SCRIPT], {
+        cwd: DATABASE_DIR,
+        encoding: "utf-8",
+        env: process.env,
+      });
+
+      // Exit status + a successful stdout parse is the full signal (see
+      // appointment.db.test.ts for why this, rather than empty stderr, is
+      // the right assertion — a stray Node/tsx diagnostic must not fail an
+      // otherwise-successful run).
+      if (result.status !== 0) {
+        throw new Error(
+          `probe exited ${result.status}: ${result.stderr || "(no stderr)"}`,
+        );
+      }
+
+      const probe = JSON.parse(result.stdout) as {
+        writtenIso: string;
+        createdConsentAtIso: string;
+        rereadConsentAtIso: string;
+        liveColumnDataType: string | null;
+      };
+
+      // The instant `create()` returns must be exactly what was written —
+      // not shifted by the pinned Asia/Kolkata (+05:30) session timezone.
+      expect(probe.createdConsentAtIso).toBe(probe.writtenIso);
+
+      // A SECOND, independent read (a fresh findUniqueOrThrow, not the
+      // object create() already returned) must agree too — the read path,
+      // not just the write path, preserves the instant.
+      expect(probe.rereadConsentAtIso).toBe(probe.writtenIso);
+
+      // Ground truth: the live column really is timezone-aware, which is
+      // what makes the schema's `@db.Timestamptz(3)` annotation correct
+      // rather than merely quiet.
+      expect(probe.liveColumnDataType).toBe("timestamp with time zone");
+    });
+  },
+);

package/templates/database/__tests__/tenancy.test.ts

@@ -0,0 +1,141 @@
+/**
+ * @file tenancy.test.ts
+ * @description Unit coverage for `resolveDefaultWorkspaceRow` — the shared
+ * one-workspace deployment predicate (#5876 spec D2) — over a structural
+ * `WorkspacePredicateClient` stub. No `@prisma/client` import anywhere in
+ * this file or in `../tenancy.ts`; the four arms below are the same ones
+ * `apps/api/src/services/__tests__/public-site-resolver.test.ts` and
+ * `apps/api/src/middleware/__tests__/default-tenant.test.ts` already pin for
+ * the re-pointed caller — this suite is the predicate's OWN coverage.
+ *
+ * `resolveSentinelWorkspaceRow` (#6155 spec D2 rule 2) is the sibling
+ * sentinel-EXISTENCE predicate, covered below on the SAME three-workspace
+ * mock that `resolveDefaultWorkspaceRow` refuses — the pair is what proves
+ * the two questions ("is this deployment single-tenant" vs "does the
+ * sentinel workspace exist") stay separate rather than re-merging.
+ */
+
+import {
+  DEFAULT_ORG_ID,
+  DEFAULT_WORKSPACE_ID,
+  resolveDefaultWorkspaceRow,
+  resolveSentinelWorkspaceRow,
+  type WorkspacePredicateClient,
+} from "../tenancy";
+
+const NON_SENTINEL_ORG_ID = "org_01930000-0000-7bcd-8000-000000000002";
+
+function makeStub(
+  count: number,
+  found: { organizationId: string } | null,
+): WorkspacePredicateClient {
+  return {
+    workspace: {
+      count: jest.fn().mockResolvedValue(count),
+      findUnique: jest.fn().mockResolvedValue(found),
+    },
+  };
+}
+
+describe("resolveDefaultWorkspaceRow", () => {
+  it("returns null when zero workspaces exist (count() === 0)", async () => {
+    const stub = makeStub(0, null);
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+    // The deployment is ambiguous at the count check alone — findUnique must
+    // never run.
+    expect(stub.workspace.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns null when two or more workspaces exist (count() === 2)", async () => {
+    const stub = makeStub(2, null);
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+    expect(stub.workspace.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns null when the sole workspace hangs off a non-sentinel Organization", async () => {
+    const stub = makeStub(1, { organizationId: NON_SENTINEL_ORG_ID });
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+  });
+
+  it("returns null when the sole workspace is not found at the default id", async () => {
+    const stub = makeStub(1, null);
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+  });
+
+  it("returns the row when the sole workspace is the well-known default hanging off the sentinel Organization", async () => {
+    const stub = makeStub(1, { organizationId: DEFAULT_ORG_ID });
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toEqual({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    expect(stub.workspace.findUnique).toHaveBeenCalledWith({
+      where: { id: DEFAULT_WORKSPACE_ID },
+    });
+  });
+
+  it("returns null on a THREE-workspace deployment even though the sentinel workspace exists — the count gate refuses it before findUnique ever runs", async () => {
+    // A correctly-configured multi-workspace deployment: the sentinel is one
+    // of three, but resolveDefaultWorkspaceRow answers "is this deployment
+    // unambiguously single-tenant", not "does the sentinel exist" — #6155
+    // spec D2/R1, the exact case resolveSentinelWorkspaceRow exists for.
+    const stub = makeStub(3, { organizationId: DEFAULT_ORG_ID });
+
+    const result = await resolveDefaultWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+    expect(stub.workspace.findUnique).not.toHaveBeenCalled();
+  });
+});
+
+describe("resolveSentinelWorkspaceRow", () => {
+  it("resolves the sentinel workspace on a THREE-workspace deployment — no count() gate", async () => {
+    // The SAME three-workspace mock resolveDefaultWorkspaceRow refuses above
+    // — this is the pair that keeps the two questions separate (#6155 D2
+    // rule 2): resolveDefaultWorkspaceRow answers "is this deployment
+    // single-tenant" (no); resolveSentinelWorkspaceRow answers "does the
+    // seeded sentinel workspace exist" (yes), and it never calls count().
+    const stub = makeStub(3, { organizationId: DEFAULT_ORG_ID });
+
+    const result = await resolveSentinelWorkspaceRow(stub);
+
+    expect(result).toEqual({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    expect(stub.workspace.count).not.toHaveBeenCalled();
+    expect(stub.workspace.findUnique).toHaveBeenCalledWith({
+      where: { id: DEFAULT_WORKSPACE_ID },
+    });
+  });
+
+  it("returns null when no workspace carries the sentinel id", async () => {
+    const stub = makeStub(3, null);
+
+    const result = await resolveSentinelWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+  });
+
+  it("returns null when the id resolves but hangs off a non-sentinel Organization", async () => {
+    const stub = makeStub(3, { organizationId: NON_SENTINEL_ORG_ID });
+
+    const result = await resolveSentinelWorkspaceRow(stub);
+
+    expect(result).toBeNull();
+  });
+});

package/templates/database/config/schema.prisma

@@ -9,17 +9,45 @@
 // invariant #1). Cross-namespace integrity + cascade are the service layer's
 // (ADR-0009 D3), delivered by the Phase 4 workspace-scoped write surface. Every
 // model here is fenced by the architecture.yaml tenant-scope forbidden-pattern.
+//
+// SiteSetting and SiteListingConfig also carry the #6374 tenancy fence. The
+// placement rule stated in database/inbox/schema.prisma's header applies
+// here verbatim: `workspaceId` goes on the line immediately after `siteId`
+// (immediately after `id` where there is no `siteId`), and no comment
+// written for it contains a closing curly, because the drift guard's
+// model-body collector stops at the first one.
 
 /// SiteSetting - Key-value settings for the customer site
 /// Use for: feature flags, custom config, cached Platform data
 model SiteSetting {
   id        String   @id @default(dbgenerated("('siteset_'::text || (uuidv7())::text)")) @db.Text
-  key       String   @unique // "feature_flags", "cached_config", "custom_theme"
+  // #6374 D3 — the tenancy fence, in the shape this model's ABSENT site_id
+  // forces (operator disposition, 2026-09-20). This table is keyed BY the
+  // workspace: `key` loses its global @unique and the pair becomes unique
+  // instead, so two sellers may each hold a `feature_flags` row. Existing
+  // rows backfill to the SENTINEL workspace — a pre-fence row belonged to
+  // "the site", which is exactly what the alias `default` resolves to.
+  //
+  // The `key` TEXT itself does NOT change. `dunning-policy.ts` builds
+  // `commerce.dunning_policy:` + siteId from its UNRESOLVED siteId
+  // parameter, because this table never had a site_id column to scope by;
+  // the backfill leaves every key verbatim, so the read keeps building the
+  // key the same way and adds workspaceId from the resolver. Rebuilding the
+  // key from the RESOLVED id would match no row and silently hand every
+  // seller the built-in default policy.
+  //
+  // DO NOT MOVE this field — see the fence-fan-out note in
+  // database/inbox/schema.prisma's header: placement immediately after id is
+  // load-bearing, not cosmetic.
+  workspaceId String @map("workspace_id")
+  key       String   // "feature_flags", "cached_config", "custom_theme"
   value     Json
 
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
 
+  @@unique([workspaceId, key])
+  @@index([workspaceId])
   @@map("site_settings")
 }
 
@@ -50,7 +78,22 @@ model WorkspaceTheme {
   @@map("workspace_themes")
 }
 
-/// WorkspaceSiteIdentity — per-workspace SiteIdentitySchema blob (#3641)
+/// WorkspaceSiteIdentity — per-workspace SiteIdentitySchema blob (#3641).
+///
+/// #6254 AC-2 — carries `@@unique([id, workspaceId])`, a named Postgres
+/// unique constraint over a pair already unique today (`id` is the PK, so
+/// the pair is trivially unique too) — redundant now, load-bearing the
+/// moment `workspaceId` ever drops its own `@unique` above (§2.3 of
+/// docs/specs/6254-the-composite-fk-pattern-workspacesiteidentity-spec.md).
+/// It is NOT the target of a Prisma `@relation` from the inbox-namespace
+/// fenced models (Lead, ProjectListing, FlowDefinition, FlowSession):
+/// ADR-0009 invariant #1 forbids a cross-namespace relation (this model is
+/// `config`, they are `inbox`), and `site_id` never holds this model's
+/// `siteid_<uuidv7>` id — it holds the WORKSPACE id, so a real FK would be
+/// unsatisfiable for every existing row. Those four models enforce
+/// site<->workspace agreement instead via a same-table equality CHECK
+/// (`<table>_workspace_site_agree`) — see database/inbox/schema.prisma and
+/// docs/database/namespaces.md.
 model WorkspaceSiteIdentity {
   id          String   @id @default(dbgenerated("('siteid_'::text || (uuidv7())::text)")) @db.Text
   workspaceId String   @unique @map("workspace_id")
@@ -58,6 +101,7 @@ model WorkspaceSiteIdentity {
   createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
   updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
 
+  @@unique([id, workspaceId])
   @@map("workspace_site_identities")
 }
 
@@ -72,6 +116,26 @@ model WorkspaceSEO {
   @@map("workspace_seos")
 }
 
+/// WorkspaceMeetings — per-workspace MeetingsSchema blob: the operator's
+/// enabled-slug gate for meeting types (#6183 S9b, D1). Structurally
+/// identical to its three siblings above — same `@unique` key, same
+/// Json-column convention, validation at the API layer. The field-level
+/// `@map`s are load-bearing (not merely style, unlike the siblings' own
+/// comment implies): `prisma validate` accepts a model without them, and
+/// only `pnpm check:prisma-migration-drift` catches the resulting
+/// camelCase/snake_case mismatch against a hand-written migration — the
+/// exact class that shipped a P2022 on every `Appointment.noShow` write
+/// (#6162). Keep every `@map` in lockstep with the migration's column names.
+model WorkspaceMeetings {
+  id          String   @id @default(dbgenerated("('meet_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId String   @unique @map("workspace_id")
+  data        Json
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("workspace_meetings")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than
@@ -90,6 +154,18 @@ model WorkspaceSEO {
 model SiteListingConfig {
   id     String @id @default(dbgenerated("('sltcfg_'::text || (uuidv7())::text)")) @db.Text
   siteId String @unique @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // site_listing_configs_workspace_site_agree CHECK (workspace_id = site_id)
+  // — since siteId IS the resolved workspace id, Postgres itself rejects a
+  // row whose two columns disagree. Operator-seeded config: there is no
+  // create/upsert of this model in the tree, and its one read
+  // (apps/api/src/services/listing-config.ts) already resolves the alias.
+  // DO NOT MOVE this field — see the fence-fan-out note in
+  // database/inbox/schema.prisma's header: placement immediately after
+  // siteId is load-bearing, not cosmetic.
+  workspaceId String @map("workspace_id")
 
   /// The site's PUBLIC site key (#5048 D2) — the addressing token an anonymous
   /// application carries in place of a siteId, so the server resolves the site
@@ -106,6 +182,7 @@ model SiteListingConfig {
   createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
   updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
 
+  @@index([workspaceId])
   @@map("site_listing_configs")
 }
 

package/templates/database/content/schema.prisma

@@ -1,5 +1,5 @@
 // content namespace — chat + artifact substrate (AgentSession, ConversationEvent,
-// SessionReadReceipt, Artifact, ArtifactVersion)
+// SessionReadReceipt, Artifact, ArtifactVersion, Asset)
 //
 // Backs the event-sourced conversation transport + artifact persistence in
 // docs/research/ploy-capture/BACKEND-REQUIREMENTS.md (§1 transport R-T1..R-T7,
@@ -75,21 +75,50 @@ model SessionReadReceipt {
   @@map("session_read_receipts")
 }
 
-/// Artifact — a session's produced output (first type: text/document, #3846).
+/// Artifact — a piece of the WORKSPACE's versioned content (#3846, generalized
+/// by #5800 / roadmap D1). Originally "a session's produced output"; a session
+/// is now PROVENANCE, not ownership — `sessionId` is optional and `SetNull`, so
+/// deleting the conversation that produced a page leaves the page standing.
+///
+/// `contentType` is the discriminator the content store reads: `text/page` is
+/// what the editor writes, `text/document` the legacy chat artifact. A page's
+/// public identity is `(workspaceId, contentType, locale, slug)`; `slug` stays
+/// NULL until publish, and NULLs never collide in a Postgres unique index, so a
+/// workspace may hold any number of unpublished drafts.
+///
+/// `publishedVersionId` is a plain pointer at the ArtifactVersion the public
+/// read serves — deliberately NOT a relation (a FK back into `versions` would
+/// make the delete order of an artifact's own history circular), and
+/// deliberately NOT `ArtifactVersion.isCurrent`, which is the DRAFT TIP and is
+/// never the publish mechanism. Saving a draft moves `isCurrent`; only publish
+/// moves this pointer.
+///
+/// `type` is the LEGACY discriminator. It predates `contentType` and is still
+/// read by apps/api/src/routes/workspaces/sessions.ts (the session-artifacts
+/// route, a hard-floor surface), so #5800 added `contentType` beside it and
+/// backfilled it from `type` rather than renaming the column out from under a
+/// live consumer. New code reads `contentType`; retiring `type` belongs to the
+/// card that moves that route.
 model Artifact {
-  id          String   @id @default(dbgenerated("('artif_'::text || (uuidv7())::text)")) @db.Text
-  sessionId   String   @map("session_id")
-  workspaceId String   @map("workspace_id")
-  type        String   @default("text/document")
-  title       String
-  createdAt   DateTime @default(now()) @map("created_at")
-  updatedAt   DateTime @updatedAt @map("updated_at")
-
-  session  AgentSession      @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+  id                 String   @id @default(dbgenerated("('artif_'::text || (uuidv7())::text)")) @db.Text
+  sessionId          String?  @map("session_id")
+  workspaceId        String   @map("workspace_id")
+  type               String   @default("text/document")
+  contentType        String   @default("text/document") @map("content_type")
+  locale             String   @default("en")
+  slug               String?
+  title              String
+  publishedVersionId String?  @map("published_version_id")
+  createdAt          DateTime @default(now()) @map("created_at")
+  updatedAt          DateTime @updatedAt @map("updated_at")
+
+  session  AgentSession?     @relation(fields: [sessionId], references: [id], onDelete: SetNull)
   versions ArtifactVersion[]
 
+  @@unique([workspaceId, contentType, locale, slug])
   @@index([sessionId])
   @@index([workspaceId])
+  @@index([workspaceId, contentType, updatedAt])
   @@map("artifacts")
 }
 
@@ -110,6 +139,53 @@ model ArtifactVersion {
   @@map("artifact_versions")
 }
 
+/// Asset — a workspace's uploaded binary (#5800 / roadmap D7), following the
+/// `DeliverableAsset` precedent in the inbox namespace: the bytes live in the
+/// row, not in object storage. That precedent was deliberate — no new
+/// infrastructure — and only the resolver changes if blob storage arrives later.
+///
+/// `workspaceId` is a plain String stable id with no @relation (ADR 0009
+/// invariant 1), and `(workspaceId, key)` is the addressable identity. Ids are
+/// UUIDv7 (ADR 0031), so a re-upload is a NEW id and a served asset can be
+/// cached immutably. The upload route itself is #5802's scope, not this model's.
+///
+/// Since #6310: this is also the store a magnet's `deliverables.assets[].assetKey`
+/// resolves against FIRST (by `(workspaceId, key)`), ahead of the legacy
+/// `DeliverableAsset` fallback (database/inbox/schema.prisma) — read through
+/// the scoped boundary in apps/api/src/lib/deliverable-asset-store.ts, never
+/// a raw query.
+model Asset {
+  id          String   @id @default(dbgenerated("('asset_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId String   @map("workspace_id")
+  /// The caller-chosen name an artifact's content references the asset by.
+  key         String
+  /// Download filename (Content-Disposition). Stored RAW; sanitize at SERVE
+  /// time, exactly as the DeliverableAsset download route does.
+  filename    String
+  contentType String   @map("content_type")
+  bytes       Bytes
+  size        Int
+  /// Owner-authored display name, shown above the filename in the lightbox
+  /// (#6092, S4/D10). NULL means the owner has not written one — distinct from
+  /// an empty string, which means they cleared it. Never backfilled from
+  /// `filename`: the two are different facts (demo.html:782 renders both).
+  title       String?
+  /// Owner-authored longer description. Same NULL-vs-empty contract as `title`.
+  description String?
+  /// Owner-controlled tag SLUGS (`ad-creative`, `workspace-memory`, …), never
+  /// the human labels — the label is presentation, resolved by the surface from
+  /// its own vocabulary (demo.html:358 `ATAGS`, :794 the Docs set). Free-form
+  /// by design: the asset vocabulary and the document vocabulary (D8/D9) ride
+  /// this one column, and the "fixed set" of D10 is a UI affordance, not a
+  /// database constraint (#6092, D2 of the spec).
+  tags        String[] @default([])
+  createdAt   DateTime @default(now()) @map("created_at")
+
+  @@unique([workspaceId, key])
+  @@index([workspaceId])
+  @@map("assets")
+}
+
 // ============================================================================
 // Usage-billing metering (FEAT-047 P1.S1, #3709 — Epic #3704)
 //