.github/9

ISSUE_TEMPLATE/3

bug_report.md config.yml feature_request.md

workflows/3

ci.yml clean-clone.yml release.yml

CODEOWNERS dependabot.yml pull_request_template.md

apps/630

api/250

src/243

common/30

__tests__/3

authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts

filters/1

all-exceptions.filter.ts

guards/3

auth.guard.ts internal-service.guard.ts rate-limit.guard.ts

interceptors/2

actor-context.interceptor.ts bigint-serialization.interceptor.ts

middleware/2

idempotency.test.ts idempotency.ts

pipes/1

zod-validation.pipe.ts

actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts

config/1

env.ts

lib/11

__tests__/5

crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts

authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts

modules/197

ai/28

__tests__/4

ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts

generator/4

executor.ts generate.controller.ts generate.dto.ts generate.service.ts

ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts

api-keys/3

api-keys.controller.ts api-keys.module.ts api-keys.service.ts

audit/2

audit-log.controller.ts audit.module.ts

auth/4

auth.controller.ts auth.module.ts auth.service.ts dto.ts

automations/5

automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts

blocks/5

__tests__/1

batch-version-cas.test.ts

block.service.ts blocks.controller.ts blocks.module.ts dto.ts

comments/4

comments.controller.ts comments.module.ts comments.service.ts dto.ts

databases/9

__tests__/3

normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts

database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts

docs/2

docs.controller.ts docs.module.ts

files/10

__tests__/1

quota.test.ts

dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts

forms/18

debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts

health/3

health.controller.ts health.module.ts health.service.ts

integrations/3

integrations.controller.ts integrations.module.ts integrations.service.ts

internal/12

__tests__/2

flush-query-shape.test.ts internal.endpoints.test.ts

ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts

notifications/3

notifications.controller.ts notifications.module.ts notifications.service.ts

oauth/6

__tests__/1

oauth.scopes.test.ts

oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts

org/15

audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts

orgs/5

dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts

pages/4

dto.ts page.service.ts pages.controller.ts pages.module.ts

scim/15

__tests__/3

email-mapping.test.ts etag.test.ts filters.test.ts

etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts

search/4

__tests__/1

search.service.test.ts

search.controller.ts search.module.ts search.service.ts

sessions/3

sessions.controller.ts sessions.module.ts sessions.service.ts

share/3

share.controller.ts share.module.ts share.service.ts

sso/16

__tests__/4

enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts

enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts

teams/4

dto.ts teams.controller.ts teams.module.ts teams.service.ts

users/4

dto.ts users.controller.ts users.module.ts users.service.ts

webhooks/3

webhooks.controller.ts webhooks.module.ts webhooks.service.ts

workspaces/4

dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts

types/1

xmldom.d.ts

app.module.ts constants.ts main.ts

_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts

realtime/33

src/17

auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts

test/11

auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts

.env.example Dockerfile package.json README.md tsconfig.json

web/255

src/244

app/45

__tests__/1

theme-tokens.test.ts

(app)/26

w/25

[workspace]/25

ask/1

page.tsx

databases/1

[id]/1

page.tsx

favorites/1

page.tsx

files/1

page.tsx

notifications/1

page.tsx

page/4

[id]/4

[block]/1

page.tsx

share/1

page.tsx

layout.tsx page.tsx

search/1

page.tsx

settings/10

appearance/1

page.tsx

automations/3

[id]/1

page.tsx

new/1

page.tsx

page.tsx

billing/1

page.tsx

developers/1

page.tsx

members/1

page.tsx

permissions/1

page.tsx

teams/1

page.tsx

page.tsx

shared/1

page.tsx

templates/1

page.tsx

trash/1

page.tsx

layout.tsx page.tsx

layout.tsx

(auth)/4

login/1

page.tsx

register/1

page.tsx

reset-password/1

page.tsx

layout.tsx

api/2

metrics/1

route.ts

v1/1

health/1

route.ts

f/1

[slug]/1

page.tsx

health/1

ready/1

route.ts

org/2

[orgId]/2

admin/2

integrations/1

page.tsx

page.tsx

share/1

[id]/1

page.tsx

error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx

components/118

admin/10

org-admin/8

ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx

ScimCard.tsx SsoTabs.tsx

ai/6

ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx

automations/5

action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx

collaboration/6

CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx

comments/3

comment-panel.tsx comment-thread.tsx mention-input.tsx

database/27

__tests__/2

cell-editor.test.tsx cell-renderer.test.tsx

AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx

dialogs/7

__tests__/1

move-to-dialog.test.tsx

create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx

editor/19

__tests__/3

code-block-text.test.ts code-block.test.tsx expandable.test.tsx

block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx

files/4

FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx

form/4

form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx

layout/8

__tests__/1

page-tree-icon.test.tsx

command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx

mentions/3

__tests__/1

mention-model.test.ts

mention-model.ts MentionPopup.tsx

search/3

ask-ai-search.tsx results-list.tsx search-dialog.tsx

settings/10

api-keys/4

ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx

webhooks/5

CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx

settings-shell.tsx

ui/3

confirm-dialog.tsx form.tsx toaster.tsx

hooks/21

__tests__/4

realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx

realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts

lib/50

__tests__/21

ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts

files/7

__tests__/2

picker.test.ts upload.test.ts

api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts

ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts

stores/8

__tests__/1

block-patch-store.test.ts

block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts

instrumentation.ts middleware.ts

.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts

worker/92

src/87

__tests__/13

ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts

health/1

server.ts

lib/12

__tests__/1

clamav.test.ts

clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts

processors/56

automations/28

__tests__/3

condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts

executors/17

assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts

condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts

files/15

__tests__/4

errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts

steps/4

finalize.ts metadata.ts scan.ts thumbnails.ts

cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts

search-index/4

builders.ts grants.ts index.ts processor.ts

ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts

config.ts events.ts index.ts logger.ts queues.ts

.env.example Dockerfile package.json README.md tsconfig.json

docs/73

api/17

ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md

architecture/10

ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md

database/2

database-architecture.md redis-keys.md

development/8

admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md

product/4

functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md

requirements/1

requirements-matrix.md

security/5

audit-report.md files.md forms.md license-allowlist.md security-architecture.md

tasks/16

phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md

ui/9

ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md

support-matrix.md

infrastructure/71

caddy/1

Caddyfile

docker/6

init/1

01-extensions.sql

opensearch/1

init-indices.json

.env.docker docker-compose.yml opensearch-init.sh README.md

kubernetes/40

observability/20

alertmanager/1

alertmanager.yaml

grafana/8

dashboards/6

ai.json api-overview.json infra.json realtime.json search.json workers-queues.json

provisioning/2

dashboards/1

dashboards.yaml

datasources/1

datasource.yaml

prometheus/3

alerts.yaml recording-rules.yaml scrape.yaml

scripts/1

sync-sources.mjs

alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml

postgres/7

configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml

api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml

nginx/2

nginx.conf README.md

observability/14

alertmanager/1

alertmanager.yaml

grafana/8

dashboards/6

ai.json api-overview.json infra.json realtime.json search.json workers-queues.json

provisioning/2

dashboards/1

dashboards.yaml

datasources/1

datasource.yaml

prometheus/3

alerts.yaml recording-rules.yaml scrape.yaml

scripts/1

dashboard-completeness.mjs

README.md

terraform/8

compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf

packages/289

ai/24

src/20

providers/7

anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts

schemas/2

database.ts generate.ts

adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts

package.json README.md tsconfig.json vitest.config.ts

auth/11

src/7

index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts

package.json README.md tsconfig.json vitest.config.ts

collaboration/17

src/13

awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

config/7

src/4

eslint.base.js index.ts prettier.base.json tsconfig.base.json

package.json README.md tsconfig.json

database-client/5

src/2

index.test.ts index.ts

package.json README.md tsconfig.json

database-engine/33

src/29

filter/2

filter.test.ts index.ts

formula/8

evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts

query/6

group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts

relations/2

index.ts relations.test.ts

rollups/2

index.ts rollups.test.ts

values/5

dates.ts index.ts registry.ts types.ts values.test.ts

views/3

buttons.ts index.ts views.test.ts

index.ts

package.json README.md tsconfig.json vitest.config.ts

editor/25

src/21

marks/1

highlight.ts

nodes/2

equation.ts mention.ts

autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

observability/20

src/16

__tests__/8

db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts

index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts

package.json README.md tsconfig.json vitest.config.ts

permissions/11

src/7

index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts

package.json README.md tsconfig.json vitest.config.ts

search/22

src/18

chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

shared/61

src/57

dto/17

ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts

events/8

audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts

realtime/6

comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts

automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts

package.json README.md tsconfig.json vitest.config.ts

storage/16

src/12

client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

ui/37

src/33

components/19

avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx

color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts

package.json README.md tsconfig.json vitest.config.ts

prisma/16

migrations/13

20260927000000_init/1

migration.sql

20260928000000_search_documents_content_hash/1

migration.sql

20260929000000_workspace_usage_storage_bytes/1

migration.sql

20260930000000_form_submitted_notification_type/1

migration.sql

20261001000000_ai_phase12/1

migration.sql

20261002000000_webhooks_secret_encrypted_dlq/1

migration.sql

20261002111436_webhook_delivery_latency/1

migration.sql

20261002120000_org_admin_2fa_retention_unique/1

migration.sql

20261002215124_audit_export/1

migration.sql

20261003210000_perf_indexes_hot_paths/1

migration.sql

20261004004500_perf_indexes_hot_paths_2/1

migration.sql

migration_lock.toml README.md

schema.prisma seed.ts verify.ts

scripts/7

backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh

tests/169

e2e/63

.auth/1

user.json

fixtures/7

files/6

clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt

realtime.ts

mocks/2

oidc-issuer.ts saml-idp.ts

playwright-report/3

data/2

a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm

index.html

reports/1

files-security.json

specs/34

ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts

test-results-final-flow/3

final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2

test-failed-1.png trace.zip

.last-run.json

utils/4

api.ts dnd.ts search-lag.ts wait.ts

.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json

fixtures/1

files/1

make-sparse.ts

integration/60

ai-capability/2

ai-app.capability.test.ts gateway.capability.test.ts

drill/2

seed-drill.mjs verify-restore.mjs

fixtures/5

files/5

clip.mp4 clip.wav doc.pdf hero-1400.png note.txt

helpers/3

api.ts containers.ts seed.ts

realtime/11

control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts

ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts

performance/28

fixtures/1

search-100k.ts

helpers/2

seed-100k.mjs seed-1k-load.mjs

reports/7

api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json

api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs

security/16

helpers/1

app.ts

audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts

README.md

.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json

generate-openapi.mjsscripts/generate-openapi.mjsraw← scripts21,520 B← Back to the app

1#!/usr/bin/env node
2/**
3 * OpenAPI 3.1 spec generator (TASK-0127).
4 *
5 * Scans `apps/api/src/modules/` (controller base path + method decorators)
6 * and emits `docs/api/openapi.yaml` — the CANONICAL
7 * contract for `/api/v1`. The bidirectional contract test
8 * (`tests/integration/openapi.contract.test.ts`) then verifies:
9 *
10 *   spec paths ⊆ live routes   (every documented path exists, same method)
11 *   live public routes ⊆ spec  (no undocumented public v1 route)
12 *
13 * The scan is intentionally the SAME source the router is built from, so a
14 * controller change regenerates the spec; the contract test fails on a
15 * controller change WITHOUT a regeneration (the CI gate).
16 *
17 * Run: `node scripts/generate-openapi.mjs` (from the repo root).
18 */
19import { createRequire } from "node:module";
20import { readdirSync, readFileSync, writeFileSync, statSync } from "node:fs";
21import { join } from "node:path";
22 
23const require = createRequire(join(process.cwd(), "apps", "api", "package.json"));
24const { stringify } = require("yaml");
25 
26const ROOT = process.cwd();
27const API_SRC = join(ROOT, "apps", "api", "src");
28 
29/** Public v1 surface (no `Authorization` required — mirrors AuthGuard's whitelist). */
30const PUBLIC_PATHS = new Set([
31  "/health",
32  "/health/ready",
33  "/health/deep",
34  "/auth/register",
35  "/auth/login",
36  "/auth/refresh",
37  "/auth/reset-password",
38  "/auth/reset-password/confirm",
39  "/auth/sso/options",
40  "/share/:slug",
41  "/public/forms/:slug",
42  "/public/forms/:slug/submit",
43  "/public/forms/:slug/files",
44  "/public/forms/:slug/files/:fileId/complete",
45  "/debug/events",
46  "/webhooks/incoming/:webhookId",
47  "/docs",
48  "/docs/openapi.yaml",
49  "/docs/assets/:file"
50]);
51 
52/** Self-scoped authenticated routes (no 403/404 data-scope responses). */
53const SELF_SCOPED = new Set([
54  "/auth/me",
55  "/users/me",
56  "/users/me/profile",
57  "/sessions",
58  "/sessions/:id",
59  "/notifications",
60  "/notifications/:id/read",
61  "/notifications/unread-count",
62  "/notifications/read-all",
63  "/notifications/preferences",
64  "/search/recent",
65  "/orgs",
66  "/orgs/:id",
67  "/orgs/:id/members/invites"
68]);
69 
70/** POSTs that create a new resource → 201 (everything else 200). */
71const CREATE_POSTS = new Set([
72  "/workspaces",
73  "/workspaces/:workspaceId/pages",
74  "/workspaces/:workspaceId/api-keys",
75  "/workspaces/:workspaceId/webhooks",
76  "/workspaces/:workspaceId/teams",
77  "/workspaces/:workspaceId/automations",
78  "/workspaces/:workspaceId/integrations",
79  "/orgs",
80  "/shares",
81  "/comments",
82  "/pages/:pageId/blocks",
83  "/blocks/batch",
84  "/databases/:id/properties",
85  "/databases/:id/views",
86  "/databases/:id/records",
87  "/databases/:id/relations",
88  "/databases/:id/formulas",
89  "/databases/:databaseId/forms",
90  "/forms/:formId/questions",
91  "/workspaces/:id/members/invites",
92  "/auth/register",
93  "/files/uploads",
94  "/pages/:id/versions",
95  "/pages/:id/whiteboard/convert",
96  "/workspaces/:workspaceId/ai/conversations"
97]);
98 
99const METHOD_MAP = { Get: "get", Post: "post", Put: "put", Patch: "patch", Delete: "delete" };
100 
101/** Collect controller files. */
102function* walk(dir) {
103  for (const entry of readdirSync(dir)) {
104    const full = join(dir, entry);
105    const st = statSync(full);
106    if (st.isDirectory()) yield* walk(full);
107    else if (entry.endsWith(".controller.ts")) yield full;
108  }
109}
110 
111function pascal(s) {
112  return s
113    .replace(/[^a-zA-Z0-9]+(.)/g, (_, c) => c.toUpperCase())
114    .replace(/^(.)/, (_, c) => c.toUpperCase());
115}
116 
117/**
118 * Yield each `@Controller("base")` class block in a file with its route
119 * decorators. A file may declare MULTIPLE controller classes (e.g.
120 * `oauth.controller.ts` has the public `oauth` surface AND the workspace
121 * `workspaces/:workspaceId/oauth/apps` sub-resource) — pairing every route
122 * in the file with the FIRST base (the old behavior) silently re-homed the
123 * later classes' routes under the wrong prefix. Each route therefore
124 * belongs to the nearest PRECEDING `@Controller` within its class body.
125 */
126function* controllerBlocks(txt) {
127  const re = /@Controller\(\s*(?:"([^"]*)"|([A-Za-z0-9_\/-]+))?\s*\)/g;
128  const heads = [];
129  let m;
130  while ((m = re.exec(txt))) {
131    heads.push({ base: (m[1] ?? m[2] ?? "").replace(/^\/+|\/+$/g, ""), start: m.index });
132  }
133  for (let i = 0; i < heads.length; i++) {
134    const end = i + 1 < heads.length ? heads[i + 1].start : txt.length;
135    yield { base: heads[i].base, body: txt.slice(heads[i].start, end) };
136  }
137}
138 
139// ---- collect routes -----------------------------------------------------------
140 
141/** path → { method: { summary, tag, public, creates } } */
142const table = new Map();
143 
144/** Controllers mounted OUTSIDE the `api/v1` prefix (excluded in
145 *  main.ts) — not part of the v1 contract surface: `internal` (service
146 *  token), `saml` (SAML SP: metadata + start + ACS, browser binding),
147 *  `sso` (OIDC RP: authorize/callback + the anonymous start dispatcher —
148 *  browser redirects, not JSON API). TASK-0131. `scim/v2` — the SCIM 2.0
149 *  protocol surface (third-party IdP binding, bearer-token auth; its own
150 *  contract lives in docs/api/scim.md). TASK-0132. */
151const NON_V1_BASES = new Set(["internal", "saml", "sso", "scim/v2"]);
152 
153for (const file of walk(join(API_SRC, "modules"))) {
154  const txt = readFileSync(file, "utf8");
155  for (const { base, body } of controllerBlocks(txt)) {
156    // `internal` has SUB-BASES (e.g. `internal/workspaces` in the test
157    // seams) — keep the prefix skip for it; the others are exact bases.
158    if (base.startsWith("internal") || NON_V1_BASES.has(base)) continue; // not on the public v1 route table
159    for (const mm of body.matchAll(/@(Get|Post|Put|Patch|Delete)\(\s*(?:"([^"]*)")?\s*\)/g)) {
160      const verb = METHOD_MAP[mm[1]];
161      const arg = (mm[2] ?? "").replace(/^\/+|\/+$/g, "");
162      let full = `/${[base, arg].filter(Boolean).join("/")}`.replace(/\/{2,}/g, "/");
163      full = full.replace(/\/+$/, "");
164      if (full === "") full = "/";
165 
166      const entry = table.get(full) ?? {};
167      entry[verb] = { file };
168      table.set(full, entry);
169    }
170  }
171}
172 
173// ---- tag + summary heuristics -------------------------------------------------
174 
175const TAG_LABEL = {
176  workspaces: "Workspaces",
177  pages: "Pages",
178  blocks: "Blocks",
179  databases: "Databases",
180  records: "Records",
181  comments: "Comments",
182  files: "Files",
183  search: "Search",
184  notifications: "Notifications",
185  sessions: "Sessions",
186  orgs: "Orgs",
187  users: "Users",
188  shares: "Sharing",
189  share: "Sharing",
190  teams: "Teams",
191  "api-keys": "API Keys",
192  webhooks: "Webhooks",
193  automations: "Automations",
194  integrations: "Integrations",
195  forms: "Forms",
196  public: "Public Forms",
197  auth: "Auth",
198  health: "Health",
199  docs: "API Docs",
200  ai: "AI",
201  oauth: "OAuth2"
202};
203 
204function tagFor(path) {
205  const segs = path.split("/").filter(Boolean);
206  if (segs[0] === "workspaces" && segs[1] === ":workspaceId") {
207    const sub = segs[2] ?? "workspaces";
208    return TAG_LABEL[sub] ?? pascal(sub);
209  }
210  if (segs[0] === "workspaces") return "Workspaces";
211  if (segs[0] === "public") return "Public Forms";
212  if (segs[0] === "share") return "Sharing";
213  if (segs[0] === "ai") {
214    // Personal AI conversations (user-identity-only surface).
215    if (segs[1] === "conversations") return "AI Conversations";
216    return "AI";
217  }
218  return TAG_LABEL[segs[0]] ?? pascal(segs[0]);
219}
220 
221const SUMMARY_OVERRIDES = {
222  "get /auth/sso/options": "SSO discovery for the login page (anonymous, minimal-info: org slugs with SSO enabled)",
223  "post /orgs/{orgId}/sso": "Configure the org's SSO provider (SAML or OIDC; secrets are reveal-once, encrypted at rest)",
224  "get /orgs/{orgId}/sso": "Get the org's SSO provider (secrets masked to configured-flags)",
225  "patch /orgs/{orgId}/sso": "Update the SSO provider (config + certificate/secret rotation)",
226  "delete /orgs/{orgId}/sso": "Remove the SSO provider (and its encrypted secrets)",
227  "patch /orgs/{orgId}/sso/enforce": "Toggle SSO enforce mode (mirror-writes Organization.policy.ssoEnforced)",
228  "post /orgs/{orgId}/sso/test": "Test the SSO connection (SAML metadata / OIDC discovery + JWKS probe)",
229  "post /orgs/{orgId}/scim": "Enable SCIM provisioning (generates a scim_… bearer token — reveal-once)",
230  "get /orgs/{orgId}/scim": "Get the org's SCIM config (masked — no raw token)",
231  "patch /orgs/{orgId}/scim": "Update SCIM config / rotate token / disable (disable invalidates immediately)",
232  "post /orgs/{orgId}/scim/test": "Test the SCIM token (browser pastes it back — the server never stores the raw)",
233  "post /auth/register": "Register a new account",
234  "post /auth/login": "Log in (email + password)",
235  "post /auth/refresh": "Refresh the session tokens",
236  "post /auth/logout": "Log out the current session",
237  "post /auth/reset-password": "Request a password reset",
238  "post /auth/reset-password/confirm": "Confirm a password reset",
239  "post /webhooks/incoming/:webhookId": "Receive an incoming automation webhook payload",
240  "get /search": "Search (POST query)",
241  "post /search": "Run a workspace search",
242  "get /users": "List users (workspace context)",
243  "delete /sessions": "End all other sessions",
244  "get /notifications/unread-count": "Get the unread notification count",
245  "post /notifications/read-all": "Mark all notifications read",
246  "get /orgs": "List the caller's organizations",
247  "post /orgs": "Create an organization",
248  "post /share/:slug": "Open a public share link (unauthenticated)",
249  "get /public/forms/:slug": "Open a public form (unauthenticated)",
250  "post /public/forms/:slug/submit": "Submit a public form (unauthenticated)",
251  "post /files/:id/rollback": "Roll a file back to a previous version",
252  "post /files/:id/restore": "Restore a file from the trash",
253  "post /pages/:id/restore": "Restore a page from the trash",
254  "delete /pages/:id/permanent": "Permanently delete a page",
255  "post /pages/:id/templates": "Save a page as a template",
256  "get /blocks/batch": "Batch block operation",
257  "post /blocks/batch": "Batch block operation",
258  "get /workspaces/:workspaceId/templates": "List workspace templates",
259  "post /workspaces/:workspaceId/api-keys": "Create an API key",
260  "get /workspaces/:workspaceId/api-keys": "List the workspace's API keys",
261  "patch /workspaces/:workspaceId/api-keys/:id": "Update an API key (scope / rate limit / expiry / name)",
262  "delete /workspaces/:workspaceId/api-keys/:id": "Revoke an API key",
263  "post /workspaces/:workspaceId/ai/ping": "AI availability ping",
264  "get /workspaces/:workspaceId/ai/conversations": "List AI conversations (user-identity only)",
265  "post /workspaces/:workspaceId/ai/conversations": "Create an AI conversation (user-identity only)",
266  "get /ai/conversations/:id": "Get an AI conversation (user-identity only)",
267  "patch /ai/conversations/:id": "Update an AI conversation (user-identity only)",
268  "delete /ai/conversations/:id": "Delete an AI conversation (user-identity only)",
269  "get /ai/conversations/:id/messages": "List conversation messages (user-identity only)",
270  "post /workspaces/:workspaceId/ai/chat": "AI chat (user-identity only)",
271  "post /workspaces/:workspaceId/ai/conversations/:conversationId/messages": "Send a message in a conversation (user-identity only)"
272};
273 
274function summaryFor(method, path, tag) {
275  const override = SUMMARY_OVERRIDES[`${method} ${path}`];
276  if (override) return override;
277  if (path === "/users/me" && method === "get") return "Get the current user";
278  if (path === "/auth/me") return "Get the authenticated user";
279  if (path === "/health" || path.startsWith("/health")) return "Liveness/readiness probe";
280  if (path === "/docs") return "Interactive API documentation (swagger-ui)";
281  if (path === "/docs/openapi.yaml") return "Download the OpenAPI 3.1 spec (YAML)";
282 
283  const segs = path.split("/").filter(Boolean);
284  const params = segs.filter((s) => s.startsWith(":"));
285  const isList = method === "get" && !params.length;
286  const verb = isList ? "List" : { get: "Get", post: "Create", put: "Replace", patch: "Update", delete: "Delete" }[method];
287  const target = params.length ? ` by ${params.map((p) => p.slice(1)).join(" + ")}` : "";
288  return `${verb} ${tag.toLowerCase()}${target}`;
289}
290 
291// ---- build the document -------------------------------------------------------
292 
293const usedOpIds = new Set();
294function opId(method, path) {
295  const segs = path.split("/").filter(Boolean);
296  const parts = segs.map((s) => (s.startsWith(":") ? "By" + pascal(s.slice(1)) : pascal(s)));
297  let id = method[0].toUpperCase() + method.slice(1) + parts.join("");
298  if (id === method[0].toUpperCase() + method.slice(1)) id += "Root";
299  let unique = id;
300  let n = 2;
301  while (usedOpIds.has(unique)) unique = `${id}${n++}`;
302  usedOpIds.add(unique);
303  return unique;
304}
305 
306const errorResponse = (code, message) => ({
307  $ref: `#/components/responses/Err${code}`,
308  description: message
309});
310 
311const paths = {};
312const tags = new Map();
313 
314/** OpenAPI 3.1 path-template form: `:param` (Express) → `{param}`. */
315const toSpecPath = (p) => p.replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
316 
317for (const [path, methods] of [...table.entries()].sort()) {
318  const tag = tagFor(path);
319  tags.set(tag, { name: tag, description: `${tag} endpoints (v1).` });
320  const obj = {};
321  for (const [method, meta] of Object.entries(methods)) {
322    const isPublic = PUBLIC_PATHS.has(path);
323    const selfScoped = SELF_SCOPED.has(path);
324    const mutating = method !== "get";
325    const create = method === "post" && CREATE_POSTS.has(path);
326    const op = {
327      operationId: opId(method, path),
328      tags: [tag],
329      summary: summaryFor(method, path, tag),
330      security: isPublic ? [] : [{ bearerAuth: [] }],
331      parameters: [],
332      responses: {}
333    };
334 
335    // Path parameters (exact names — the contract test matches on these).
336    for (const m of path.matchAll(/:([a-zA-Z]+)/g)) {
337      op.parameters.push({
338        name: m[1],
339        in: "path",
340        required: true,
341        schema: { type: "string" }
342      });
343    }
344    // The workspace binding header (workspace-scoped data routes).
345    if (/^\/workspaces\/:workspaceId\//.test(path) && !isPublic) {
346      op.parameters.push({ $ref: "#/components/parameters/FactoryWorkspace" });
347    }
348    // The idempotency key (all mutating calls).
349    if (mutating) op.parameters.push({ $ref: "#/components/parameters/IdempotencyKey" });
350 
351    // Success.
352    const success = create ? "201" : "200";
353    op.responses[success] = {
354      description: create ? "The created resource." : "OK.",
355      content: { "application/json": { schema: { type: "object" } } }
356    };
357 
358    // Errors (docs/api/authentication.md §9 canonical codes).
359    if (!isPublic) op.responses["401"] = errorResponse(401, "UNAUTHORIZED — missing/invalid credentials.");
360    if (!isPublic && !selfScoped) {
361      op.responses["403"] = errorResponse(403, "FORBIDDEN — insufficient permission or API-key scope (SCOPE_DENIED).");
362      op.responses["404"] = errorResponse(404, "NOT_FOUND — resource does not exist for this caller.");
363    }
364    if (mutating) {
365      op.responses["400"] = errorResponse(400, "VALIDATION_ERROR — request validation failed.");
366      if (create || method === "patch" || method === "put") op.responses["409"] = errorResponse(409, "CONFLICT — duplicate or state conflict.");
367    }
368    op.responses["429"] = errorResponse(429, "RATE_LIMITED — rate limit exceeded (see X-RateLimit-* headers).");
369    op.responses["500"] = errorResponse(500, "INTERNAL_ERROR — unexpected server error.");
370 
371    obj[method] = op;
372  }
373  // The spec path uses the OpenAPI `{param}` template form (the live
374  // Express route uses `:param` — the contract test normalizes both).
375  paths[toSpecPath(path)] = obj;
376}
377 
378const doc = {
379  openapi: "3.1.0",
380  info: {
381    title: "AI Software Factory — Public API v1",
382    version: "1.0.0",
383    description: [
384      "The public REST API of AI Software Factory. Base URL: `/api/v1`.",
385      "",
386      "## Versioning",
387      "`/api/v1` is the STABLE surface. Breaking changes ship only in a new major (`/api/v2`, side-by-side). A deprecated route carries `Deprecation: true` + `Sunset: <RFC 1123 date>` headers and `deprecated: true` here. See `docs/api/versioning.md`.",
388      "",
389      "## Authentication",
390      "Send `Authorization: Bearer <token>` where `<token>` is either a user JWT (web sessions) or an API key (`fk_live_…`). API keys act as their WORKSPACE (docs §7) and carry scopes `READ` / `WRITE` / `ADMIN`; a scope-insufficient call returns `403 FORBIDDEN` with `error.details[0].reason = \"api_key_scope_write\"` (public alias **SCOPE_DENIED**), a cross-workspace call returns `403 … \"workspace_mismatch\"`. The `:workspaceId` path segment is the authoritative workspace selector; the optional `X-Factory-Workspace` header disambiguates multi-workspace users and MUST equal the key's own workspace when present.",
391      "",
392      "## Rate limits",
393      "Every response carries `X-RateLimit-Limit` / `X-RateLimit-Remaining` / `X-RateLimit-Reset`. Per API key: 600 req/min by default, or the key's own `rateLimit` if set (docs §11).",
394      "",
395      "## Idempotency",
396      "Mutating requests may carry an `Idempotency-Key` header; 2xx responses are memoized for 24 h and replays carry `Idempotency-Replayed: true` (docs §9).",
397      "",
398      "## Errors",
399      "Every non-2xx response is `{ \"error\": { \"code\", \"message\", \"details\"?, \"requestId\" } }` (`details[].reason` is the machine-readable reason). See `docs/api/authentication.md` §9 for the canonical code table."
400    ].join("\n")
401  },
402  servers: [{ url: "/api/v1", description: "Public API v1 (same-origin). Use the absolute URL in deployments." }],
403  tags: [...tags.values()],
404  paths,
405  components: {
406    securitySchemes: {
407      bearerAuth: {
408        type: "http",
409        scheme: "bearer",
410        bearerFormat: "JWT or API key (fk_…)",
411        description: "User session JWT, or an `fk_` API key (the key acts as its workspace; scopes READ/WRITE/ADMIN)."
412      }
413    },
414    parameters: {
415      FactoryWorkspace: {
416        name: "X-Factory-Workspace",
417        in: "header",
418        required: false,
419        description:
420          "Optional workspace context. For API keys: if present, MUST equal the key's own workspace (else 403 workspace_mismatch). For users: if the JWT covers several workspaces, selects the active one (must be a membership). The path's `:workspaceId` segment is the authoritative selector on workspace-scoped routes.",
421        schema: { type: "string" }
422      },
423      IdempotencyKey: {
424        name: "Idempotency-Key",
425        in: "header",
426        required: false,
427        description: "Client-chosen unique key (≤ 128 chars). A repeated key within 24 h replays the stored 2xx response (header `Idempotency-Replayed: true`) instead of re-executing.",
428        schema: { type: "string", maxLength: 128 }
429      }
430    },
431    schemas: {
432      ErrorDetail: {
433        type: "object",
434        properties: {
435          reason: { type: "string", description: "Machine-readable reason (e.g. api_key_scope_write, workspace_mismatch, requires_user_credentials)." },
436          field: { type: "string", description: "Validation: the offending field." },
437          issue: { type: "string", description: "Validation: the issue (required, already_exists, …)." }
438        }
439      },
440      ErrorResponse: {
441        type: "object",
442        required: ["error"],
443        properties: {
444          error: {
445            type: "object",
446            required: ["code", "message", "requestId"],
447            properties: {
448              code: {
449                type: "string",
450                description: "Canonical error code (VALIDATION_ERROR, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT, UNPROCESSABLE_ENTITY, PAYLOAD_TOO_LARGE, RATE_LIMITED, INTERNAL_ERROR, …)."
451              },
452              message: { type: "string" },
453              details: { type: "array", items: { $ref: "#/components/schemas/ErrorDetail" } },
454              requestId: { type: "string" }
455            }
456          }
457        }
458      }
459    },
460    responses: {
461      Err400: { description: "Validation failed.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
462      Err401: { description: "Unauthenticated.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
463      Err403: { description: "Forbidden (permission / API-key scope / workspace mismatch).", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
464      Err404: { description: "Not found.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
465      Err409: { description: "Conflict.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
466      Err422: { description: "Unprocessable (domain validation).", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
467      Err429: { description: "Rate limited.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
468      Err500: { description: "Internal error.", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
469    }
470  }
471};
472 
473const outPath = join(ROOT, "docs", "api", "openapi.yaml");
474writeFileSync(outPath, stringify(doc, { lineWidth: 120 }));
475const nPaths = Object.keys(paths).length;
476const nOps = Object.values(paths).reduce((n, m) => n + Object.keys(m).length, 0);
477console.log(`wrote ${outPath}: ${nPaths} paths, ${nOps} operations`);
478