howone 0.1.23 → 0.1.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (36) hide show
  1. package/package.json +1 -1
  2. package/templates/vite/.howone/skills/howone/01-architect/01-app-generation.md +215 -0
  3. package/templates/vite/.howone/skills/{howone-sdk → howone}/01-architect/02-manifest-codegen.md +67 -4
  4. package/templates/vite/.howone/skills/howone/02-database/01-schema-design.md +541 -0
  5. package/templates/vite/.howone/skills/howone/02-database/02-schema-operations.md +398 -0
  6. package/templates/vite/.howone/skills/howone/02-database/03-data-access-patterns.md +309 -0
  7. package/templates/vite/.howone/skills/howone/02-database/04-query-dsl-and-responses.md +237 -0
  8. package/templates/vite/.howone/skills/howone/02-database/05-ai-persistence-patterns.md +372 -0
  9. package/templates/vite/.howone/skills/{howone-sdk → howone}/03-sdk/01-client-setup.md +58 -36
  10. package/templates/vite/.howone/skills/{howone-sdk → howone}/03-sdk/02-entity-operations.md +67 -0
  11. package/templates/vite/.howone/skills/howone/03-sdk/03-auth.md +414 -0
  12. package/templates/vite/.howone/skills/howone/03-sdk/04-react-integration.md +191 -0
  13. package/templates/vite/.howone/skills/{howone-sdk → howone}/03-sdk/07-ai-action-calls.md +168 -64
  14. package/templates/vite/.howone/skills/howone/03-sdk/08-extension-boundaries.md +226 -0
  15. package/templates/vite/.howone/skills/howone/04-ai/01-ai-capability-architecture.md +205 -0
  16. package/templates/vite/.howone/skills/howone/04-ai/02-workflow-contract-rules.md +426 -0
  17. package/templates/vite/.howone/skills/howone/04-ai/03-ai-sdk-handoff.md +234 -0
  18. package/templates/vite/.howone/skills/howone/04-ai/04-service-capability-catalog.md +281 -0
  19. package/templates/vite/.howone/skills/howone/04-ai/05-workflow-operations.md +256 -0
  20. package/templates/vite/.howone/skills/howone/04-ai/06-ai-feature-playbooks.md +296 -0
  21. package/templates/vite/.howone/skills/{howone-sdk → howone}/SKILL.md +29 -12
  22. package/templates/vite/.howone/skills/howone/agents/openai.yaml +4 -0
  23. package/templates/vite/package.json +1 -1
  24. package/templates/vite/.howone/skills/howone-sdk/01-architect/01-app-generation.md +0 -126
  25. package/templates/vite/.howone/skills/howone-sdk/02-database/01-schema-design.md +0 -147
  26. package/templates/vite/.howone/skills/howone-sdk/02-database/02-schema-operations.md +0 -96
  27. package/templates/vite/.howone/skills/howone-sdk/02-database/03-data-access-patterns.md +0 -172
  28. package/templates/vite/.howone/skills/howone-sdk/03-sdk/03-auth.md +0 -616
  29. package/templates/vite/.howone/skills/howone-sdk/03-sdk/04-react-integration.md +0 -398
  30. package/templates/vite/.howone/skills/howone-sdk/04-ai/.gitkeep +0 -1
  31. package/templates/vite/.howone/skills/howone-sdk/04-ai/01-ai-capability-architecture.md +0 -142
  32. package/templates/vite/.howone/skills/howone-sdk/04-ai/02-workflow-contract-rules.md +0 -169
  33. package/templates/vite/.howone/skills/howone-sdk/04-ai/03-ai-sdk-handoff.md +0 -80
  34. package/templates/vite/.howone/skills/howone-sdk/agents/openai.yaml +0 -4
  35. /package/templates/vite/.howone/skills/{howone-sdk → howone}/03-sdk/05-file-upload.md +0 -0
  36. /package/templates/vite/.howone/skills/{howone-sdk → howone}/03-sdk/06-raw-http.md +0 -0
@@ -0,0 +1,296 @@
1
+ # AI Feature Playbooks
2
+
3
+ Use this reference when turning a user request into concrete HowOne AI capabilities, database
4
+ entities, and SDK calls.
5
+
6
+ ## Playbook: Document Summary
7
+
8
+ Use when user uploads or links a document and wants a summary.
9
+
10
+ Capability:
11
+
12
+ ```json
13
+ {
14
+ "name": "summarizeDocument",
15
+ "description": "Reads an uploaded document and produces a concise summary highlighting the key points.",
16
+ "inputSchema": {
17
+ "type": "object",
18
+ "properties": {
19
+ "document_url": {
20
+ "type": "string",
21
+ "format": "uri",
22
+ "description": "Supabase Storage URL of the uploaded document."
23
+ },
24
+ "summary_length": {
25
+ "type": "string",
26
+ "description": "Desired summary length, e.g. short, medium, long, or a specific sentence count."
27
+ }
28
+ },
29
+ "required": ["document_url"]
30
+ },
31
+ "outputSchema": {
32
+ "type": "object",
33
+ "properties": {
34
+ "summary": {
35
+ "type": "string",
36
+ "description": "Summary in the same language as the source document."
37
+ }
38
+ },
39
+ "required": ["summary"]
40
+ },
41
+ "outputEntityName": "DocumentSummary"
42
+ }
43
+ ```
44
+
45
+ Persistence:
46
+
47
+ - private `DocumentSummary` if user history is needed;
48
+ - fields: `documentUrl`, `summary`, `status`, `errorMessage`, `requestedAt`, `completedAt`.
49
+
50
+ SDK:
51
+
52
+ ```ts
53
+ const output = await howone.ai.summarizeDocument.run({ document_url: fileUrl })
54
+ ```
55
+
56
+ ## Playbook: Image Generator
57
+
58
+ Use for prompt-to-image products.
59
+
60
+ Capability:
61
+
62
+ ```json
63
+ {
64
+ "name": "generateImage",
65
+ "description": "Generates an image based on a natural language description provided by the user.",
66
+ "inputSchema": {
67
+ "type": "object",
68
+ "properties": {
69
+ "image_description": {
70
+ "type": "string",
71
+ "description": "Detailed description of the image to generate, including subject, style, mood, and composition."
72
+ },
73
+ "style_preference": {
74
+ "type": "string",
75
+ "description": "Optional style preference such as watercolor, photorealistic, anime, or flat design."
76
+ }
77
+ },
78
+ "required": ["image_description"]
79
+ },
80
+ "outputSchema": {
81
+ "type": "object",
82
+ "properties": {
83
+ "generated_image_url": {
84
+ "type": "string",
85
+ "format": "uri",
86
+ "description": "Public URL of the generated image."
87
+ }
88
+ },
89
+ "required": ["generated_image_url"]
90
+ },
91
+ "outputEntityName": "GeneratedImage"
92
+ }
93
+ ```
94
+
95
+ Persistence:
96
+
97
+ - use `Generation` for private history;
98
+ - public share requires separate `SharedGeneration`.
99
+
100
+ SDK:
101
+
102
+ ```ts
103
+ await runAiActionAndPersist({
104
+ entity: howone.entities.Generation,
105
+ input: { image_description, style_preference },
106
+ createPending: (input) => ({
107
+ prompt: input.image_description,
108
+ style: input.style_preference ?? null,
109
+ status: 'pending',
110
+ requestedAt: new Date().toISOString(),
111
+ }),
112
+ run: (input) => howone.ai.generateImage.run(input),
113
+ mapCompleted: ({ output }) => ({
114
+ status: 'completed',
115
+ resultUrl: output.generated_image_url,
116
+ completedAt: new Date().toISOString(),
117
+ }),
118
+ })
119
+ ```
120
+
121
+ ## Playbook: Image Editor
122
+
123
+ Use when user uploads/selects an image and describes edits.
124
+
125
+ Inputs:
126
+
127
+ - `source_image_url`;
128
+ - `edit_instruction`.
129
+
130
+ Output:
131
+
132
+ - `edited_image_url`.
133
+
134
+ Rules:
135
+
136
+ - app uploads source file first;
137
+ - workflow receives URL only;
138
+ - keep edit instruction focused;
139
+ - persist both original and edited URLs if history matters.
140
+
141
+ ## Playbook: News/Research Briefing
142
+
143
+ Use for latest info or source-backed research.
144
+
145
+ Inputs:
146
+
147
+ - `topic`;
148
+ - optional `language`;
149
+ - optional `depth` as loose string, not strict enum unless UI really has fixed modes.
150
+
151
+ Output:
152
+
153
+ - structured `briefing` object with `summary` and `sources`.
154
+
155
+ Rules:
156
+
157
+ - use web search/crawling capability;
158
+ - include source URLs;
159
+ - output descriptions must specify language;
160
+ - if user asks for latest/current, this workflow must retrieve data internally.
161
+
162
+ ## Playbook: Stock Analysis
163
+
164
+ Use for historical price analysis.
165
+
166
+ Inputs:
167
+
168
+ - `trading_symbol`;
169
+ - `start`;
170
+ - `end`;
171
+ - `unit`: daily/minute when UI exposes it.
172
+
173
+ Output:
174
+
175
+ - `analysis`;
176
+ - optional `price_history` only if app renders chart from workflow output.
177
+
178
+ Rules:
179
+
180
+ - do not ask user for CSV unless they explicitly have data;
181
+ - historical only, no real-time streaming;
182
+ - combine with web search only if user asks for news/context.
183
+
184
+ ## Playbook: Academic Literature Review
185
+
186
+ Use for paper search and bibliography.
187
+
188
+ Inputs:
189
+
190
+ - `query`;
191
+ - optional `language` for synthesized review;
192
+ - optional `citation_style`.
193
+
194
+ Outputs:
195
+
196
+ - `papers`;
197
+ - `review_summary`;
198
+ - `bibtex` if citations are needed.
199
+
200
+ Rules:
201
+
202
+ - do not promise full PDF availability;
203
+ - keep paper metadata fields useful and minimal;
204
+ - use source URLs/DOIs when returned.
205
+
206
+ ## Playbook: Audio Transcription
207
+
208
+ Use for speech-to-text.
209
+
210
+ Inputs:
211
+
212
+ - `source_audio_url`;
213
+ - optional `language`;
214
+ - optional `with_speaker_info`.
215
+
216
+ Outputs:
217
+
218
+ - `transcript_text`;
219
+ - optional `utterances`.
220
+
221
+ Rules:
222
+
223
+ - app uploads audio first;
224
+ - workflow receives URL;
225
+ - if speaker diarization is not required, do not add utterances.
226
+
227
+ ## Playbook: Text To Speech
228
+
229
+ Use for generating spoken audio from text.
230
+
231
+ Inputs:
232
+
233
+ - `text_to_generate`;
234
+ - `language`;
235
+ - optional `gender`;
236
+ - optional `audio_hint`.
237
+
238
+ Output:
239
+
240
+ - `audio_url`.
241
+
242
+ Rules:
243
+
244
+ - single speaker per call;
245
+ - dialogue should generate multiple clips and merge;
246
+ - persist audio URL through entity if user needs library/history.
247
+
248
+ ## Playbook: Video Generator
249
+
250
+ Use for short video creation.
251
+
252
+ Inputs:
253
+
254
+ - `video_prompt`;
255
+ - optional `first_frame_url`;
256
+ - optional `aspect_ratio`;
257
+ - optional `duration`.
258
+
259
+ Output:
260
+
261
+ - `video_url`.
262
+
263
+ Rules:
264
+
265
+ - keep one clip short;
266
+ - for longer output, compose multiple clips and concatenate;
267
+ - first-frame image helps consistency.
268
+
269
+ ## RAG Playbook
270
+
271
+ Use only when app needs question answering over user/project documents.
272
+
273
+ Workflows:
274
+
275
+ 1. `indexDocuments`
276
+ - input: document URLs or collection reference;
277
+ - output: indexing result/status.
278
+ 2. `queryKnowledgeBase`
279
+ - input: question + knowledge base reference;
280
+ - output: answer + sources.
281
+
282
+ Rules:
283
+
284
+ - RAG is the only standard two-workflow exception.
285
+ - Do not re-index on every question.
286
+ - Persist document/index status in entities if app needs history or dashboard.
287
+
288
+ ## Feature Design Checklist
289
+
290
+ - Choose one playbook or clearly combine compatible playbooks.
291
+ - Verify capability exists in `04-service-capability-catalog.md`.
292
+ - Use URL inputs for files/media.
293
+ - Keep outputs minimal and product-facing.
294
+ - Decide persistence separately.
295
+ - Generate SDK bindings only after manifest sync.
296
+ - Use app-owned UI for progress/errors.
@@ -18,9 +18,9 @@ that app code must follow.
18
18
  | Track | Folder | Use For |
19
19
  |---|---|---|
20
20
  | `01-architect/` | App generation + manifest flow | End-to-end HowOne app generation flow: when to design backend, when to sync manifests, when to update SDK bindings, and how to choose auth/data posture. |
21
- | `02-database/` | Backend schema + data access design | Entity schema contract, schema operations, access modes, owner/public data posture, indexes, versions, and guardrails. |
21
+ | `02-database/` | Backend schema + data access design | Entity schema contract, schema operations, access modes, owner/public data posture, indexes, query DSL, AI output persistence, versions, and guardrails. |
22
22
  | `03-sdk/` | Frontend SDK usage | `src/lib/sdk.ts`, auth, React provider, entity calls, public data, uploads, raw HTTP, AI action calls. |
23
- | `04-ai/` | AI capability + workflow design | HowOne AI capability contracts, external workflow create/update submission, workflow schema rules, persistence boundaries, and SDK handoff. |
23
+ | `04-ai/` | AI capability + workflow design | HowOne AI capability contracts, service capability selection, workflow create/update/status, schema rules, playbooks, persistence boundaries, and SDK handoff. |
24
24
 
25
25
  ## Routing
26
26
 
@@ -32,14 +32,17 @@ Read references by task shape. Prefer exact references over generic examples.
32
32
  - Any feature touching AI generation, AI workflow behavior, or AI outputs: read the AI references
33
33
  first, then the SDK handoff/action-call references.
34
34
  - AI capability, AI workflow generation/editing, or full-stack AI feature planning: read
35
- `04-ai/01-ai-capability-architecture.md` and `04-ai/02-workflow-contract-rules.md`.
35
+ `04-ai/01-ai-capability-architecture.md`, `04-ai/04-service-capability-catalog.md`, and
36
+ `04-ai/02-workflow-contract-rules.md`.
36
37
  - Backend database/schema creation or change: read `02-database/01-schema-design.md` and
37
38
  `02-database/02-schema-operations.md`.
38
- - AI output persistence: read the `04-ai/` files first, then `02-database/01-schema-design.md`.
39
+ - AI output persistence, generation history, retry/resume, or saved AI results: read the `04-ai/`
40
+ files first, then `02-database/05-ai-persistence-patterns.md` and
41
+ `02-database/01-schema-design.md`.
39
42
  - After schema sync, when app code must call the entity: read
40
43
  `01-architect/02-manifest-codegen.md` and `03-sdk/02-entity-operations.md`.
41
- - Custom login page, Email OTP, Phone OTP, Google, GitHub, token persistence, repeated login,
42
- or missing token: read `03-sdk/03-auth.md` and `03-sdk/04-react-integration.md`.
44
+ - Custom login page (your UI, HowOne APIs): `auth: 'custom'` in `createClient` (see `03-sdk/03-auth.md`),
45
+ `HowOneProvider auth="none"` and keep the default bottom-right HowOne logo unless explicitly hidden. Default without `auth` = hosted HowOne login.
43
46
  - `src/lib/sdk.ts`, `createClient`, env vars, or generated bindings: read
44
47
  `03-sdk/01-client-setup.md` and `01-architect/02-manifest-codegen.md`.
45
48
  - Public landing pages or share URLs: read `02-database/03-data-access-patterns.md`,
@@ -48,6 +51,8 @@ Read references by task shape. Prefer exact references over generic examples.
48
51
  - Raw HTTP escape hatch: read `03-sdk/06-raw-http.md`.
49
52
  - App-side AI action calls after `.howone/ai/manifest.json` exists: read
50
53
  `03-sdk/07-ai-action-calls.md`.
54
+ - External workflow create/update/status: read `04-ai/05-workflow-operations.md`.
55
+ - Common AI feature templates: read `04-ai/06-ai-feature-playbooks.md`.
51
56
 
52
57
  ## Reference Selection Protocol
53
58
 
@@ -60,11 +65,16 @@ Before writing code, classify the touched surfaces:
60
65
  | Existing synced manifest to TypeScript bindings | `01-architect/02-manifest-codegen.md` |
61
66
  | UI reads/writes entities | `03-sdk/01-client-setup.md`, `03-sdk/02-entity-operations.md` |
62
67
  | Public read/share flow | `02-database/03-data-access-patterns.md`, `03-sdk/02-entity-operations.md` |
68
+ | Query filters/sort/pagination/response mapping | `02-database/04-query-dsl-and-responses.md` |
69
+ | AI output persistence / generation history | `02-database/05-ai-persistence-patterns.md`, `04-ai/01-ai-capability-architecture.md` |
63
70
  | Auth/session/login behavior | `03-sdk/03-auth.md`, `03-sdk/04-react-integration.md` |
64
- | AI capability or workflow design | `04-ai/01-ai-capability-architecture.md`, `04-ai/02-workflow-contract-rules.md` |
71
+ | AI capability or workflow design | `04-ai/01-ai-capability-architecture.md`, `04-ai/04-service-capability-catalog.md`, `04-ai/02-workflow-contract-rules.md` |
72
+ | External workflow create/update/status | `04-ai/05-workflow-operations.md` |
73
+ | Common AI feature examples | `04-ai/06-ai-feature-playbooks.md` |
65
74
  | AI manifest handoff to app code | `04-ai/03-ai-sdk-handoff.md`, `03-sdk/07-ai-action-calls.md` |
66
75
  | File upload | `03-sdk/05-file-upload.md` |
67
76
  | Raw HTTP escape hatch | `03-sdk/06-raw-http.md` |
77
+ | SDK extensibility / adapter boundaries | `03-sdk/08-extension-boundaries.md` |
68
78
 
69
79
  If a task spans multiple surfaces, read one reference from each surface before editing. Do not
70
80
  invent API parameters, response shapes, owner fields, workflow IDs, or output paths from memory.
@@ -93,8 +103,8 @@ For app features that touch AI:
93
103
  6. Read `.howone/ai/manifest.json`.
94
104
  7. Generate or update app SDK bindings from the manifest.
95
105
  8. Implement frontend calls using `howone.ai.*`.
96
- 9. If outputs are saved, derive entity fields from the AI `outputSchema`, then follow the database
97
- workflow.
106
+ 9. If outputs are saved, map only durable product fields from the AI result into an entity schema,
107
+ then follow the database workflow.
98
108
 
99
109
  For frontend-only SDK work:
100
110
 
@@ -107,7 +117,8 @@ For frontend-only SDK work:
107
117
 
108
118
  - Generate SDK bindings from synced manifests, not from memory.
109
119
  - Keep `.howone/` as manifest storage only; do not write generated source files there.
110
- - Configure `projectId` and `env` only in `createClient`.
120
+ - Configure `projectId` and `env` only in `createClient`. Auth APIs follow the same `env` (dev → `api.howone.dev`, not `api.howone.ai`).
121
+ - Import `src/lib/sdk.ts` before any `@howone/sdk` auth call so environment is pinned.
111
122
  - Use `import.meta.env.VITE_HOWONE_PROJECT_ID` and `import.meta.env.VITE_HOWONE_ENV`; do not
112
123
  hardcode project IDs or add fallback env values.
113
124
  - For private user-owned data, authenticated APIs derive owner from JWT. Do not pass
@@ -115,8 +126,14 @@ For frontend-only SDK work:
115
126
  - For `access.authenticated.read = "own"`, prefer `howone.entities.Entity.query.mine(...)`.
116
127
  - Public pages use `howone.public.entities.*` only when manifest access explicitly allows public
117
128
  reads or writes.
118
- - For custom in-app login, use `HowOneProvider auth="none"`, call
119
- `howone.auth.setToken(token)` on success, and verify startup session with `await howone.me()`.
129
+ - Default `createClient({ projectId, env })` uses **HowOne hosted login**. For a custom `/login` UI
130
+ that still calls HowOne OTP/OAuth APIs, add `auth: 'custom'` and `HowOneProvider auth="none"`.
131
+ - `HowOneProvider` may render the bottom-right HowOne `FloatingButton` logo by default. Do not remove
132
+ it unless the user explicitly asks for `brand="hidden"` or `showBrandButton={false}`.
133
+ - Do not add SDK-owned toast APIs, redirect overlays, or app-specific UI. Expose data, state, events,
134
+ and callbacks; implement visible feedback in the generated frontend app.
135
+ - SDK extensibility rule: default behavior must work without configuration, and custom behavior must
136
+ enter through typed adapters/callbacks instead of hardcoded app UI or provider-specific branches.
120
137
  - AI workflows are implementation, not persistence. Never put CRUD, auth, upload handling, or app
121
138
  state management into the workflow capability contract.
122
139
  - For external workflow edits, pass `workflowConfigID` from a confirmed workflow status result; do
@@ -0,0 +1,4 @@
1
+ interface:
2
+ display_name: "HowOne App Architecture"
3
+ short_description: "Design HowOne database schemas, AI workflows, SDK bindings, auth, and app integration."
4
+ default_prompt: "Use this skill to choose the right HowOne architecture track, then implement database schema, AI capability/workflow, SDK bindings, auth, or frontend SDK calls from synced manifests."
@@ -14,7 +14,7 @@
14
14
  "dependencies": {
15
15
  "@base-ui/react": "^1.4.1",
16
16
  "@fontsource-variable/inter": "^5.2.8",
17
- "@howone/sdk": "2.0.0-beta.17",
17
+ "@howone/sdk": "2.0.0-beta.19",
18
18
  "@tailwindcss/vite": "^4.2.1",
19
19
  "class-variance-authority": "^0.7.1",
20
20
  "clsx": "^2.1.1",
@@ -1,126 +0,0 @@
1
- # App Generation Architect
2
-
3
- Use this file to decide the HowOne app implementation path before reading low-level SDK or
4
- database references.
5
-
6
- ## Responsibility Split
7
-
8
- HowOne generated apps have three layers:
9
-
10
- 1. **Backend contract**: dynamic entities, access rules, indexes, schema versions, and synced
11
- manifests.
12
- 2. **AI contract + workflow implementation**: AI capability contracts are versioned by HowOne;
13
- external workflow create/update is submitted from synced AI manifests.
14
- 3. **SDK binding**: `src/lib/sdk.ts` converts manifests into typed entity and AI clients.
15
- 4. **Frontend experience**: React/UI code calls the SDK and owns app-specific interaction design.
16
-
17
- Do not skip the binding layer. The UI should call `src/lib/sdk.ts`, not raw entity names guessed
18
- from the user prompt.
19
-
20
- Core source-of-truth rule from the HowOne docs:
21
-
22
- ```text
23
- agent proposal != source of truth
24
- validated backend manifest = source of truth
25
- generated files = compiler/binding output
26
- ```
27
-
28
- The agent proposes structured changes and writes app code. The runtime/schema tools validate,
29
- apply, version, and sync manifest facts.
30
-
31
- ## Choose Data Posture First
32
-
33
- Before designing schema or UI calls, classify the data:
34
-
35
- | Posture | Backend Access | Frontend Read |
36
- |---|---|---|
37
- | Private user data | `authenticated: own`, `public: none` | `howone.entities.Entity.query.mine(...)` |
38
- | Authenticated shared app data | `authenticated: all`, `public: none` | `howone.entities.Entity.query(...)` |
39
- | Public list data | `authenticated: all`, `public: list` | `howone.public.entities.Entity.query(...)` |
40
- | Public scoped share data | usually `authenticated: own`, `public: scoped` | `howone.public.entities.Entity.queryScoped(...)` |
41
-
42
- If the user says "my todos", "my notes", "per user", "login required", or "data isolation",
43
- default to private user data.
44
-
45
- ## Backend Feature Workflow
46
-
47
- When a request adds persistence or changes data shape:
48
-
49
- 1. Read `02-database/01-schema-design.md` and `02-database/02-schema-operations.md`.
50
- 2. Inspect the current schema/manifest.
51
- 3. Design one complete schema patch for the feature.
52
- 4. Preview the schema patch.
53
- 5. Apply the exact previewed operations if risk is acceptable.
54
- 6. Sync schema artifacts using the returned `next.versionId`.
55
- 7. Read `.howone/database/manifest.json`.
56
- 8. Read `01-architect/02-manifest-codegen.md`.
57
- 9. Update `src/lib/sdk.ts`.
58
- 10. Read the needed SDK file, usually `03-sdk/02-entity-operations.md` and sometimes `03-sdk/03-auth.md`.
59
- 11. Update the UI.
60
- 12. Validate.
61
-
62
- Do not preview a patch and then execute different single operations. Related schema changes for
63
- one feature should be grouped into one preview/apply cycle.
64
-
65
- ## AI Feature Workflow
66
-
67
- When a request adds an AI capability or changes an AI workflow:
68
-
69
- 1. Read `04-ai/01-ai-capability-architecture.md` and
70
- `04-ai/02-workflow-contract-rules.md`.
71
- 2. Inspect current AI capability state.
72
- 3. Design one complete AI capability patch for the feature.
73
- 4. Preview the AI patch.
74
- 5. Apply the exact previewed operations.
75
- 6. Sync AI artifacts.
76
- 7. Read `.howone/ai/manifest.json`.
77
- 8. Submit external workflow create/update with `external-ai-capability`.
78
- 9. Preserve returned request IDs for the status/background-task layer.
79
- 10. Read `04-ai/03-ai-sdk-handoff.md`, `01-architect/02-manifest-codegen.md`, and
80
- `03-sdk/07-ai-action-calls.md`.
81
- 11. Update `src/lib/sdk.ts` from the synced manifest.
82
- 12. Update the UI.
83
- 13. Validate.
84
-
85
- If generated output must be saved, design the AI capability first. Then derive persistence entities
86
- from the synced AI `outputSchema`, plus only necessary request metadata.
87
-
88
- ## Auth Decision
89
-
90
- Use hosted auth when the app just needs login:
91
-
92
- ```tsx
93
- <HowOneProvider auth="required">
94
- <App />
95
- </HowOneProvider>
96
- ```
97
-
98
- Use custom in-app auth when the user asks for a designed login page or multiple login methods:
99
-
100
- ```tsx
101
- <HowOneProvider auth="none" brand="hidden">
102
- <App />
103
- </HowOneProvider>
104
- ```
105
-
106
- Custom login must call `howone.auth.setToken(token)` after Email OTP, Phone OTP, Google, or
107
- GitHub succeeds, then verify the session with `await howone.me({ refresh: true })`.
108
-
109
- ## Generated Binding Rules
110
-
111
- - Read manifests after sync, not before.
112
- - Preserve existing bindings unless the manifest changed.
113
- - Export explicit `Record`, `Create`, and `Update` types.
114
- - Do not include system fields in create/update payloads.
115
- - Do not infer public access from `visibility` alone; inspect `access.public`.
116
-
117
- ## Common Failure Modes
118
-
119
- - Repeated login after refresh: app used `auth.isAuthenticated()` as first-load truth or stored
120
- token outside SDK. Read `03-sdk/03-auth.md`.
121
- - Data is not isolated: app used `query()` instead of `query.mine()` for `authenticated.read =
122
- "own"`, or wrote owner fields manually.
123
- - Public page 401/403: app used authenticated namespace for public content or schema does not
124
- allow public access.
125
- - Generated types drift from backend: app edited `src/lib/sdk.ts` from memory instead of synced
126
- manifest.
@@ -1,147 +0,0 @@
1
- # Database Architecture Design
2
-
3
- Use this reference when designing or changing HowOne backend entity schemas. It summarizes
4
- the contract in `docs/dynamic-entity-architecture.zh.md` for app-building agents.
5
-
6
- This reference is for **backend entity design**. For schema tool flow, read
7
- `02-database/02-schema-operations.md`. For frontend read/write calls, read
8
- `02-database/03-data-access-patterns.md` and `03-sdk/02-entity-operations.md` after schema
9
- artifacts have been synced.
10
-
11
- ## Core Model
12
-
13
- An entity is a versioned database contract, not a loose JSON form. Design all relevant parts:
14
-
15
- ```ts
16
- type EntityContract = {
17
- name: string
18
- type: 'object'
19
- description?: string
20
- visibility: 'private' | 'public'
21
- properties: Record<string, EntityField>
22
- required?: string[]
23
- access: {
24
- authenticated?: AuthenticatedAccess
25
- public?: PublicAccess
26
- }
27
- indexes?: EntityIndex[]
28
- relations?: Record<string, EntityRelation>
29
- presentation?: EntityPresentation
30
- lifecycle?: EntityLifecycle
31
- performance?: EntityPerformance
32
- }
33
- ```
34
-
35
- Every schema change should preserve this mental split:
36
-
37
- - `properties` and `required` define payload validation.
38
- - `access` defines who can read/write and how ownership is derived.
39
- - `indexes` and `performance` define expected query paths.
40
- - `relations` defines valid `include` names.
41
- - `presentation` helps admin UI and SDK generation.
42
- - schema versions track the contract applied when future records are written.
43
-
44
- ## Access Contract
45
-
46
- Every entity should explicitly define both authenticated and public access. Choose the data posture
47
- in `02-database/03-data-access-patterns.md`, then encode it in the `access` block here.
48
-
49
- ## Field Design Rules
50
-
51
- - Entity and field names must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.
52
- - Do not define system fields as business fields: `id`, `_id`, `created_date`, `updated_date`,
53
- `created_by_id`, `schema_version_id`, `schema_version_number`, `is_sample`.
54
- - Required fields must be supplied on create unless the field has `default`, `defaultValue`, or
55
- `autoGenerate`.
56
- - Use explicit enum fields for UI status values instead of free-form strings when choices are known.
57
- - Use ISO strings for date/datetime fields at the SDK boundary.
58
- - Complex JSON Schema validation may need frontend validation too; do not assume every nested
59
- constraint is fully enforced by backend runtime.
60
-
61
- ## Index and Performance Rules
62
-
63
- Add indexes for the query paths the UI will actually use:
64
-
65
- ```json
66
- {
67
- "indexes": [
68
- {
69
- "name": "owner_status_updated",
70
- "fields": ["status", "updatedDate"],
71
- "scope": "owner",
72
- "order": { "updatedDate": "desc" }
73
- }
74
- ],
75
- "performance": {
76
- "defaultLimit": 20,
77
- "maxLimit": 100,
78
- "allowedSorts": ["createdDate", "updatedDate"]
79
- }
80
- }
81
- ```
82
-
83
- Guidelines:
84
-
85
- - Private user lists usually need owner-scoped indexes.
86
- - Public list pages need `access.public.allowedFilters` and `access.public.allowedSorts`.
87
- - `performance.allowedSorts` informs SDK/admin generation; public sort enforcement comes from
88
- `access.public.allowedSorts`.
89
-
90
- ## Todo Example
91
-
92
- For a personal Todo app:
93
-
94
- ```json
95
- {
96
- "name": "Todo",
97
- "type": "object",
98
- "description": "User-owned todo item",
99
- "visibility": "private",
100
- "properties": {
101
- "text": { "type": "string" },
102
- "completed": { "type": "boolean", "default": false }
103
- },
104
- "required": ["text"],
105
- "access": {
106
- "authenticated": {
107
- "read": "own",
108
- "create": "own",
109
- "update": "own",
110
- "delete": "own"
111
- },
112
- "public": {
113
- "read": "none",
114
- "create": "none",
115
- "update": "none",
116
- "delete": "none"
117
- }
118
- },
119
- "indexes": [
120
- {
121
- "name": "owner_updated",
122
- "fields": ["updatedDate"],
123
- "scope": "owner",
124
- "order": { "updatedDate": "desc" }
125
- }
126
- ],
127
- "performance": {
128
- "defaultLimit": 50,
129
- "maxLimit": 100,
130
- "allowedSorts": ["createdDate", "updatedDate"]
131
- },
132
- "presentation": {
133
- "titleField": "text",
134
- "defaultSort": { "field": "updatedDate", "order": "desc" },
135
- "listFields": ["text", "completed", "updatedDate"]
136
- }
137
- }
138
- ```
139
-
140
- Corresponding frontend read:
141
-
142
- ```ts
143
- const result = await howone.entities.Todo.query.mine({
144
- page: { number: 1, size: 50 },
145
- orderBy: { updatedDate: 'desc' },
146
- })
147
- ```