create-feltdb 0.5.7 → 0.6.0

package/dist/cli.js

@@ -307,7 +307,7 @@ Learn more: https://github.com/rkendel1/feltdb`);
         await createProject({
             projectName,
             autoYes: shouldAutoYes,
-            templatesDir: path.join(__dirname, '../templates'),
+            templatesDir: path.join(__dirname, '../template'),
             runtime: options.runtime,
             framework: options.framework,
             distributed: options.distributed,

package/dist/create.js

@@ -6,6 +6,7 @@ import path from 'path';
 import { randomBytes } from 'crypto';
 import { feltdbPackageRange } from './package-versions.js';
 import { generateDockerCompose, generateDockerfile, generateDockerIgnore, generateDotEnvLocal, generateFeltDBDockerfile, generateStudioDockerfile, } from './docker-compose-generator.js';
+import { initializeWorkspace, appendWorkspaceGitignore, } from './workspace-initialization.js';
 export async function createProject(options) {
     const { projectName, templatesDir } = options;
     const projectDir = path.resolve(process.cwd(), projectName);
@@ -1759,4 +1760,24 @@ If port 5173 is in use:
 MIT
 `;
     fs.writeFileSync(path.join(projectDir, 'README.md'), readme);
+    // Initialize Development Workspace
+    // This creates .feltdb/workspace.json which enables all FeltDB-aware tools
+    // (CLI, IDE, agents, browser extensions) to discover and connect to the
+    // same workspace without manual configuration.
+    const workspaceDiscovery = initializeWorkspace(projectDir, applicationName);
+    appendWorkspaceGitignore(projectDir);
+    // Copy .feltdb README from template
+    const templateReadmePath = path.join(templatesDir, 'dot-feltdb-README.md');
+    const targetReadmePath = path.join(projectDir, '.feltdb', 'README.md');
+    if (fs.existsSync(templateReadmePath)) {
+        fs.copyFileSync(templateReadmePath, targetReadmePath);
+    }
+    console.log(`\n✓ Development Workspace initialized`);
+    console.log(`  Workspace ID: ${workspaceDiscovery.workspaceId}`);
+    console.log(`  Location: ${path.join(projectName, '.feltdb/workspace.json')}`);
+    console.log(`\nNext steps:`);
+    console.log(`  cd ${projectName}`);
+    console.log(`  npm install`);
+    console.log(`  npm run dev`);
+    console.log(`\nYour Development Workspace is ready for use!`);
 }

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.7';
+export const FELTDB_PACKAGE_VERSION = '0.6.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -104,12 +104,18 @@ struct ApiError(StatusCode, String);
 
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
-        let body =
-            serde_json::from_str::<Value>(&self.1).unwrap_or_else(|_| json!({ "error": self.1 }));
+        let body = api_error_body(self.0, self.1);
         (self.0, Json(body)).into_response()
     }
 }
 
+fn api_error_body(status: StatusCode, message: String) -> Value {
+    if status == StatusCode::FORBIDDEN {
+        return json!({ "error": "AUTHORIZATION_DENIED" });
+    }
+    serde_json::from_str::<Value>(&message).unwrap_or_else(|_| json!({ "error": message }))
+}
+
 impl From<feltdb::FlowError> for ApiError {
     fn from(error: feltdb::FlowError) -> Self {
         Self(StatusCode::INTERNAL_SERVER_ERROR, error.to_string())
@@ -2199,6 +2205,38 @@ async fn delete_application_control(
         .map_err(control_error)?;
     Ok(StatusCode::NO_CONTENT)
 }
+
+async fn delete_certification_fixture(
+    State(state): State<AppState>,
+    Path(application_id): Path<String>,
+    headers: HeaderMap,
+) -> Result<Json<Value>, ApiError> {
+    let expected = std::env::var("FELTDB_CERTIFICATION_RECOVERY_TOKEN").map_err(|_| {
+        ApiError(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "certification recovery is not configured".into(),
+        )
+    })?;
+    let provided = headers
+        .get("x-feltdb-certification-recovery")
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default();
+    if expected.len() < 32
+        || ring::constant_time::verify_slices_are_equal(expected.as_bytes(), provided.as_bytes())
+            .is_err()
+    {
+        return Err(ApiError(StatusCode::FORBIDDEN, "certification recovery denied".into()));
+    }
+    let tenant_id = state
+        .tenancy
+        .delete_certification_fixture(&application_id)
+        .map_err(control_error)?;
+    Ok(Json(json!({
+        "deleted": true,
+        "tenant_id": tenant_id,
+        "application_id": application_id,
+    })))
+}
 async fn update_application_control(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
@@ -3814,7 +3852,36 @@ async fn commit_application_draft(
         .applications
         .commit(&tenant, &application_id, &draft_id, &principal.key_id)
         .map_err(manifest_error)?;
-    Ok((StatusCode::CREATED, Json(json!(revision))))
+    let encoded_revision = percent_encode_path_segment(&revision.revision_id);
+    let mut response = serde_json::to_value(revision).map_err(|error| {
+        ApiError(StatusCode::INTERNAL_SERVER_ERROR, error.to_string())
+    })?;
+    response
+        .as_object_mut()
+        .expect("application revisions serialize as objects")
+        .insert(
+            "promotion".into(),
+            json!({
+                "status": "ready",
+                "url": format!(
+                    "/api/applications/{application_id}/revisions/{encoded_revision}/promote"
+                ),
+            }),
+        );
+    Ok((StatusCode::CREATED, Json(response)))
+}
+
+fn percent_encode_path_segment(value: &str) -> String {
+    value
+        .bytes()
+        .flat_map(|byte| {
+            if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b'~') {
+                vec![byte as char]
+            } else {
+                format!("%{byte:02X}").chars().collect()
+            }
+        })
+        .collect()
 }
 async fn list_application_revisions(
     State(state): State<AppState>,
@@ -5789,6 +5856,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             axum::routing::patch(platform_update_application_member),
         )
         .route("/api/tenants/{tenant_id}", get(get_tenant))
+        .route(
+            "/api/certification/fixtures/{application_id}",
+            axum::routing::delete(delete_certification_fixture),
+        )
         .route("/api/keys", get(list_keys).post(create_key))
         .route("/api/keys/{id}", axum::routing::delete(revoke_key))
         .route(
@@ -6314,6 +6385,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .route("/ready", get(readiness))
         .route("/runtime", get(runtime))
         .route("/metrics", get(network_metrics))
+        .route(
+            "/api/certification/fixtures/{application_id}",
+            axum::routing::delete(delete_certification_fixture),
+        )
         .merge(protected)
         .layer(middleware::from_fn(protocol_version))
         .layer(middleware::from_fn_with_state(state.clone(), count_request))
@@ -9171,7 +9246,8 @@ async fn shutdown_signal() {
 
 #[cfg(test)]
 mod authority_gate_tests {
-    use super::{authorize_transaction_collections, state_authorization};
+    use super::{api_error_body, authorize_transaction_collections, state_authorization};
+    use axum::http::StatusCode;
     use feltdb::{
         application::{manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition, RevisionStatus},
         application_runtime::{resolve_runtime, ApplicationRuntimeContract, RuntimeInventory},
@@ -9256,4 +9332,19 @@ mod authority_gate_tests {
         );
         assert!(!allowed);
     }
+
+    #[test]
+    fn every_forbidden_error_uses_the_canonical_wire_contract() {
+        for internal_message in [
+            "forbidden",
+            "tenant access denied",
+            "missing scope: state:read",
+            r#"{"code":"AUTHORIZATION_DENIED","message":"policy denied"}"#,
+        ] {
+            assert_eq!(
+                api_error_body(StatusCode::FORBIDDEN, internal_message.into()),
+                serde_json::json!({ "error": "AUTHORIZATION_DENIED" })
+            );
+        }
+    }
 }

package/dist/server-source/crates/feltdb-server/src/tenancy.rs

@@ -1,4 +1,5 @@
 use std::{
+    collections::BTreeSet,
     fs,
     path::PathBuf,
     sync::{Arc, RwLock},
@@ -578,6 +579,54 @@ impl TenancyStore {
         Ok(tenant)
     }
 
+    /// Removes an isolated certification tenant selected by an exact application ID.
+    /// This deliberately refuses non-certification resources and avoids global inventory access.
+    pub fn delete_certification_fixture(&self, application_id: &str) -> Result<String, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let application = records
+            .applications
+            .iter()
+            .find(|application| application.id == application_id)
+            .cloned()
+            .ok_or("application not found")?;
+        let tenant = records
+            .tenants
+            .iter()
+            .find(|tenant| tenant.id == application.tenant_id)
+            .cloned()
+            .ok_or("tenant not found")?;
+        if !application.name.to_lowercase().contains("certification")
+            || !tenant.name.to_lowercase().contains("certification")
+        {
+            return Err("refusing to delete a non-certification fixture".into());
+        }
+        let tenant_id = tenant.id.clone();
+        let application_ids = records
+            .applications
+            .iter()
+            .filter(|candidate| candidate.tenant_id == tenant_id)
+            .map(|candidate| candidate.id.clone())
+            .collect::<BTreeSet<_>>();
+        records
+            .applications
+            .retain(|candidate| candidate.tenant_id != tenant_id);
+        records
+            .application_memberships
+            .retain(|membership| !application_ids.contains(&membership.application_id));
+        records
+            .tenant_memberships
+            .retain(|membership| membership.tenant_id != tenant_id);
+        records
+            .invitations
+            .retain(|invitation| invitation.tenant_id != tenant_id);
+        records.tenants.retain(|candidate| candidate.id != tenant_id);
+        self.persist(&records)?;
+        Ok(tenant_id)
+    }
+
     pub fn create_application(
         &self,
         actor: &str,

package/dist/template/dot-feltdb-README.md

@@ -0,0 +1,58 @@
+# FeltDB Development Workspace
+
+This directory contains the development workspace configuration for your FeltDB project.
+
+## workspace.json
+
+**Purpose:** Durable pairing identity for your project's development workspace.
+
+**Contents:**
+- `workspaceId` — Unique identifier for this workspace (format: `ws_*`)
+- `projectId` — Your project name
+- `version` — Configuration version
+
+**Usage:**
+- Committed to version control (this is your project's identity)
+- Used by CLI, IDE, agents, and browser extensions to discover the workspace
+- DO NOT edit manually unless you know what you're doing
+
+**Discovery:**
+When any FeltDB tool (VS Code, Claude agent, CLI, browser extension) opens your project, it reads this file to automatically connect to the correct workspace.
+
+## Runtime Files (not committed)
+
+- `pairing.json` — Short-lived pairing token for browser discovery (gitignored)
+- `state.json` — Local workspace state (gitignored)
+- `*.log` — Development logs (gitignored)
+
+## Commands
+
+```bash
+# Check workspace status
+npm run feltdb:status
+
+# Or use the CLI directly
+feltdb workspace status
+
+# Launch development environment (includes workspace authority)
+npm run dev
+```
+
+## Development Workspace Architecture
+
+```
+Your Project
+    ↓
+.feltdb/workspace.json  (pairing identity)
+    ↓
+feltdb dev (workspace authority)
+    ↓
+Browser, IDE, Agent clients
+```
+
+All tools automatically discover your workspace using `workspace.json` and connect to the local development environment started by `npm run dev`.
+
+## Learn More
+
+- [Development Workspaces Documentation](https://github.com/rkendel1/feltdb/blob/main/packages/core/docs/development-workspaces.md)
+- [FeltDB Documentation](https://github.com/rkendel1/feltdb)

package/dist/workspace-initialization.js

@@ -0,0 +1,77 @@
+/**
+ * Workspace Initialization
+ *
+ * Initializes a FeltDB Development Workspace for newly created projects.
+ * This is the bootstrap mechanism that enables all FeltDB-aware tools
+ * to discover and connect to the same workspace.
+ */
+import fs from 'fs';
+import path from 'path';
+/**
+ * Generate a unique workspace ID
+ * Format: ws_<projectId>_<timestamp>_<random>
+ */
+export function generateWorkspaceId(projectId) {
+    const timestamp = Date.now();
+    const random = Math.random().toString(36).substring(2, 9);
+    return `ws_${projectId}_${timestamp}_${random}`;
+}
+/**
+ * Initialize development workspace for a new project
+ *
+ * Creates .feltdb/workspace.json with the workspace discovery information.
+ * This file is committed to the repository and used by all development tools
+ * (CLI, IDE, agents, browser extensions) to discover and connect to the
+ * same workspace.
+ */
+export function initializeWorkspace(projectDir, projectId) {
+    const feltdbDir = path.join(projectDir, '.feltdb');
+    // Ensure .feltdb directory exists
+    if (!fs.existsSync(feltdbDir)) {
+        fs.mkdirSync(feltdbDir, { recursive: true });
+    }
+    // Create workspace discovery
+    const workspaceId = generateWorkspaceId(projectId);
+    const discovery = {
+        workspaceId,
+        projectId,
+        version: 1,
+    };
+    // Write workspace.json
+    const workspacePath = path.join(feltdbDir, 'workspace.json');
+    fs.writeFileSync(workspacePath, JSON.stringify(discovery, null, 2) + '\n');
+    return discovery;
+}
+/**
+ * Create .gitignore entry for workspace runtime files
+ *
+ * The .feltdb/workspace.json is committed (pairing identity).
+ * But runtime files like pairing tokens should not be committed.
+ */
+export function appendWorkspaceGitignore(projectDir) {
+    const gitignorePath = path.join(projectDir, '.gitignore');
+    const workspaceGitignoreEntries = [
+        '',
+        '# FeltDB Development Workspace',
+        '.feltdb/pairing.json',
+        '.feltdb/state.json',
+        '.feltdb/*.log',
+        '',
+    ].join('\n');
+    if (fs.existsSync(gitignorePath)) {
+        const existing = fs.readFileSync(gitignorePath, 'utf-8');
+        if (!existing.includes('.feltdb/pairing.json')) {
+            fs.appendFileSync(gitignorePath, workspaceGitignoreEntries);
+        }
+    }
+    else {
+        const content = [
+            'node_modules/',
+            'dist/',
+            'build/',
+            '.env.local',
+            workspaceGitignoreEntries,
+        ].join('\n');
+        fs.writeFileSync(gitignorePath, content);
+    }
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"