CURRENT_STATE.md — Repository State (Confluence expansion, Phase 0)
Snapshot date: 2026-10-11. Verified against the working tree (branch
main),prisma/schema.prisma,ROADMAP.md, and test inventory. This file is the Phase-0 discovery deliverable required byConfluence-new-feature.md§3.
1. System overview
ai-software-factory is a pnpm + Turborepo monorepo implementing a
Notion-inspired, multi-tenant, self-hostable collaboration platform. It is a
mature production-oriented codebase, not a skeleton: the internal
16-phase roadmap (ROADMAP.md) is ~95% complete with committed test evidence.
| App / package | Runtime | Responsibility (as built) |
|---|---|---|
apps/web |
Next.js 14 (App Router), React, Tiptap, dnd-kit, TanStack Query, Zustand | Block editor, database views, sidebar/tree, search UI, settings, admin console, command palette |
apps/api |
NestJS modular monolith | REST API v1 (/api/v1/...), auth (JWT + refresh rotation, SAML/OIDC SSO, SCIM), all domain modules, domain event bus → Redis streams |
apps/worker |
Node + BullMQ | Search indexing, file pipeline (ClamAV scan → metadata → thumbnails), webhooks, automations, email, AI jobs |
apps/realtime |
Node + ws | Yjs doc sync (page/database rooms), presence + cursors, comment/notification fan-out, heartbeat + resume |
packages/editor |
TS | Tiptap extensions, fractional (LexoRank) positioning, block tree codec |
packages/database-engine |
TS | Property types, filter/sort/group query engine, relations, rollups, safe-AST formula evaluator |
packages/permissions |
TS | RBAC (Owner/Admin/Member/Guest) + resource-level grants (None/View/Comment/Edit/Full Access), inheritance |
packages/collaboration |
TS | Yjs doc ↔ block-tree codec, LWW offline conflict policy, outbox queue types |
packages/search |
TS | OpenSearch client, indexer, hybrid BM25 + vector (RRF) query |
packages/ai |
TS | Provider-agnostic AI gateway (OpenAI/Anthropic/Google/OSS/custom), chat, RAG, structured tool-call generation |
packages/storage |
TS | S3-compatible client (MinIO in dev), presigned URLs, file versions |
packages/shared |
TS | Zod DTOs shared FE/BE, event catalog, error types |
packages/ui |
TSX | shadcn/ui design system + theme tokens |
prisma/ |
Prisma + PostgreSQL 16 | Single schema (74 models), 11 migrations, seed |
2. What is implemented and production-ready (verified)
Verified by inspecting source, Prisma models, API routes, and test suites.
Content
- Page tree: fractional ordering, cycle guard on move (
page.service.tsL419), recursive trash/restore, favorites,PageVersionsnapshots with create/restore endpoints. Blocks: ~30 types (paragraph, headings, lists, todo, quote, callout, code w/ language, image/video/audio/file, bookmark, embed, equation, columns, divider, spacer, table, database, linked_database, chart, form, synced_block, child_page, child_database). - Databases: typed
DatabasePropertyschema, records 1:1 with pages, table/board/calendar/gallery/timeline/list/chart/dashboard/form views, relations + relation links, rollups, formulas (safe AST, no eval), database buttons, CSV export (GET …/export/csv). No CSV import. - Files: presigned S3 upload, worker pipeline (ClamAV, metadata, thumbnails), versions, quotas, web Files page.
Collaboration
- Realtime: Yjs CRDT codec (200-forest lossless property tests), presence avatars + cursors, heartbeat/prune, resume with update log, block-edit convergence, realtime comment + notification push, offline IndexedDB outbox with idempotency keys.
- Comments: page/block/record threads, replies, reactions, resolve/reopen,
mentionIds(stable user ids) +pageMentionIds, mention popup in editor and comment composer, deep-link route…/page/[id]/[block]. - Notifications: in-app bell (unread/list/read/read-all), email channel
(worker, actor suppression, idempotency), webhook channel (HMAC-signed),
per-type email preferences (
NotificationTypeenum includesTASK_ASSIGNED,ASSIGNMENT,DATABASE_CHANGE,AUTOMATION,INTEGRATION).
Permissions & sharing
- Server-side permission guard on every handler (
packages/permissions), RBAC + resource grants at org/workspace/team/page/database/record/file,Sharelinks (scope, password hash, expiry, allow-comments/duplicate/search-indexing). - Public REST API v1 + API keys (scoped, hashed) + OAuth2 (auth code + PKCE) + signed webhooks (13-event catalog, backoff → DLQ) + OpenAPI spec with bidirectional contract test.
Search
- OpenSearch indexer (event-driven + 15-min reconcile), permission snapshots
per document, full-text + prefix + fuzzy, filters (type/workspace/team/date/creator),
highlights, cursor pagination, ⌘K palette +
/searchpage, recent searches. Performance-proven (p95 ~50 ms on 100k fixture).
Enterprise / ops
- SAML + OIDC SSO, SCIM provisioning, org policies, retention policies (auto-purge, hold), audit log + viewer + S3 export, admin console (org overview, usage, members, policies, API keys, webhooks, integrations).
- Caching (Redis: page trees, permissions TTL, search), perf profiles, k6 load tests, backup/DR runbook + drill tooling, OTel/Prometheus/Grafana/Loki.
Forms — builder, public pages, submissions → records + automation trigger.
3. Test inventory (current)
- Unit: 171
*.test.tsacrosspackages/+apps/(Vitest/Jest). - Integration: 33 suites in
tests/integration/(Testcontainers: PG, Redis, OpenSearch, MinIO), incl. auth, comments, databases, files pipeline/security, automation pipeline, AI (chat/rag/generate/writing/database), oauth, webhooks, audit completeness/export, cache invalidation. - E2E: 34 Playwright specs in
tests/e2e/specs/(desktop + mobile), incl. auth, pages, editor, databases, comments, search, sharing, SSO/SCIM, org-admin, automation, AI, realtime presence, forms, files, final-flow. - Security:
tests/security/(OWASP ASVS L2 suite, TASK-0134). - Performance:
tests/performance/k6 matrix + 100k seed.
4. Operational state
Docker dev environment is up: postgres:16, redis:7, minio, opensearch:2.15, clamav, firefox-vnc (for Playwright). Node ≥ 20, pnpm ≥ 9.
5. Known technical debt / gaps relevant to the Confluence expansion
- No whiteboard content type (0% — see
FEATURE_GAP_ANALYSIS.md§I). - No first-class tasks (no
Taskmodel; onlyNotificationType.TASK_ASSIGNEDenum placeholder and form/automation-driven status changes). - No review/approval workflow (page lifecycle has archive/trash only; no draft/in-review/approved states).
- Templates exist (model + routes + web page + template dialog) but have no categories/descriptions, no variables, no version history, no built-in catalog (seed contains none), no search/preview.
- Version history stores snapshots + restore, but has no compare/diff API or UI, no change-summary capture on auto-saves, no retention policy.
- Spaces: workspaces have
slug+isPersonal+settings, but notype/key/directory/stats; "space" semantics are implicit. - Pages: no duplicate, no bulk actions, no backlinks/related pages.
- Search: no saved searches, no recently viewed/updated, no related-pages results section, no admin reindex trigger (reconcile backstop exists only).
- Databases: CSV import missing; saved views exist but no user management surface; pagination controls minimal.
- Editor: table block has no row/column operations; no TOC block / heading anchors; callout has no variants; no inline status/date/label elements.
- Notifications: no watchlist, no user/space activity feeds (events exist
on the bus and are recorded in
AuditLog— feeds are the missing surface). - AI: gateway/chat/RAG/generation done; missing the Confluence assistant capabilities (action-item extraction, FAQ generation, stale/duplicate detection, owner/tag/review-date suggestions).
- Admin console lacks queue/job health, search index health, and notification delivery health views.
- Comment anchors store
selection Jsonbut anchor re-attachment after edits is not spec'd/tested (deleted/replaced text behavior undefined). - Realtime whiteboard sync is not part of the Yjs room model (single-user whiteboard editing first; see DECISIONS.md A-004).
6. Constraints inherited (binding)
- Layering: Editor Model → Domain → Service → Repository → PostgreSQL.
- Fractional ordering for all tree/list positions.
- Server-side authorization on every operation; deny-by-default.
- Events (Redis streams) for side effects, never synchronous cross-module calls.
- No
eval; safe AST evaluators only. - Reversible, additive migrations; preserve existing ids and data.
- No commercial/paid dependencies; OSS only, licenses reviewed.