.github/9
ISSUE_TEMPLATE/3bug_report.md config.yml feature_request.md
workflows/3ci.yml clean-clone.yml release.yml
CODEOWNERS dependabot.yml pull_request_template.md
apps/630
api/250
src/243
common/30
__tests__/3authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts
filters/1all-exceptions.filter.ts
guards/3auth.guard.ts internal-service.guard.ts rate-limit.guard.ts
interceptors/2actor-context.interceptor.ts bigint-serialization.interceptor.ts
middleware/2idempotency.test.ts idempotency.ts
pipes/1zod-validation.pipe.ts
actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts
config/1env.ts
lib/11
__tests__/5crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts
authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts
modules/197
ai/28
__tests__/4ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts
generator/4executor.ts generate.controller.ts generate.dto.ts generate.service.ts
ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts
api-keys/3api-keys.controller.ts api-keys.module.ts api-keys.service.ts
audit/2audit-log.controller.ts audit.module.ts
auth/4auth.controller.ts auth.module.ts auth.service.ts dto.ts
automations/5automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts
blocks/5
__tests__/1batch-version-cas.test.ts
block.service.ts blocks.controller.ts blocks.module.ts dto.ts
comments/4comments.controller.ts comments.module.ts comments.service.ts dto.ts
databases/9
__tests__/3normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts
database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts
docs/2docs.controller.ts docs.module.ts
files/10
__tests__/1quota.test.ts
dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts
forms/18debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts
health/3health.controller.ts health.module.ts health.service.ts
integrations/3integrations.controller.ts integrations.module.ts integrations.service.ts
internal/12
__tests__/2flush-query-shape.test.ts internal.endpoints.test.ts
ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts
notifications/3notifications.controller.ts notifications.module.ts notifications.service.ts
oauth/6
__tests__/1oauth.scopes.test.ts
oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts
org/15audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts
orgs/5dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts
pages/4dto.ts page.service.ts pages.controller.ts pages.module.ts
scim/15
__tests__/3email-mapping.test.ts etag.test.ts filters.test.ts
etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts
search/4
__tests__/1search.service.test.ts
search.controller.ts search.module.ts search.service.ts
sessions/3sessions.controller.ts sessions.module.ts sessions.service.ts
share/3share.controller.ts share.module.ts share.service.ts
sso/16
__tests__/4enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts
enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts
teams/4dto.ts teams.controller.ts teams.module.ts teams.service.ts
users/4dto.ts users.controller.ts users.module.ts users.service.ts
webhooks/3webhooks.controller.ts webhooks.module.ts webhooks.service.ts
workspaces/4dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts
types/1xmldom.d.ts
app.module.ts constants.ts main.ts
_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts
realtime/33
src/17auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts
test/11auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts
.env.example Dockerfile package.json README.md tsconfig.json
web/255
src/244
app/45
__tests__/1theme-tokens.test.ts
(app)/26
w/25
[workspace]/25
ask/1page.tsx
databases/1
[id]/1page.tsx
favorites/1page.tsx
files/1page.tsx
notifications/1page.tsx
page/4
[id]/4
[block]/1page.tsx
share/1page.tsx
layout.tsx page.tsx
search/1page.tsx
settings/10
appearance/1page.tsx
automations/3
[id]/1page.tsx
new/1page.tsx
page.tsx
billing/1page.tsx
developers/1page.tsx
members/1page.tsx
permissions/1page.tsx
teams/1page.tsx
page.tsx
shared/1page.tsx
templates/1page.tsx
trash/1page.tsx
layout.tsx page.tsx
layout.tsx
(auth)/4
login/1page.tsx
register/1page.tsx
reset-password/1page.tsx
layout.tsx
api/2
metrics/1route.ts
v1/1
health/1route.ts
f/1
[slug]/1page.tsx
health/1
ready/1route.ts
org/2
[orgId]/2
admin/2
integrations/1page.tsx
page.tsx
share/1
[id]/1page.tsx
error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx
components/118
admin/10
org-admin/8ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx
ScimCard.tsx SsoTabs.tsx
ai/6ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx
automations/5action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx
collaboration/6CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx
comments/3comment-panel.tsx comment-thread.tsx mention-input.tsx
database/27
__tests__/2cell-editor.test.tsx cell-renderer.test.tsx
AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx
dialogs/7
__tests__/1move-to-dialog.test.tsx
create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx
editor/19
__tests__/3code-block-text.test.ts code-block.test.tsx expandable.test.tsx
block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx
files/4FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx
form/4form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx
layout/8
__tests__/1page-tree-icon.test.tsx
command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx
mentions/3
__tests__/1mention-model.test.ts
mention-model.ts MentionPopup.tsx
search/3ask-ai-search.tsx results-list.tsx search-dialog.tsx
settings/10
api-keys/4ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx
webhooks/5CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx
settings-shell.tsx
ui/3confirm-dialog.tsx form.tsx toaster.tsx
hooks/21
__tests__/4realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx
realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts
lib/50
__tests__/21ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts
files/7
__tests__/2picker.test.ts upload.test.ts
api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts
ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts
stores/8
__tests__/1block-patch-store.test.ts
block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts
instrumentation.ts middleware.ts
.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts
worker/92
src/87
__tests__/13ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts
health/1server.ts
lib/12
__tests__/1clamav.test.ts
clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts
processors/56
automations/28
__tests__/3condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts
executors/17assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts
condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts
files/15
__tests__/4errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts
steps/4finalize.ts metadata.ts scan.ts thumbnails.ts
cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts
search-index/4builders.ts grants.ts index.ts processor.ts
ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts
config.ts events.ts index.ts logger.ts queues.ts
.env.example Dockerfile package.json README.md tsconfig.json
docs/73
api/17ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md
architecture/10ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md
database/2database-architecture.md redis-keys.md
development/8admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md
product/4functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md
requirements/1requirements-matrix.md
security/5audit-report.md files.md forms.md license-allowlist.md security-architecture.md
tasks/16phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md
ui/9ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md
support-matrix.md
infrastructure/71
caddy/1Caddyfile
docker/6
init/101-extensions.sql
opensearch/1init-indices.json
.env.docker docker-compose.yml opensearch-init.sh README.md
kubernetes/40
observability/20
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1sync-sources.mjs
alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml
postgres/7configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml
api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml
nginx/2nginx.conf README.md
observability/14
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1dashboard-completeness.mjs
README.md
terraform/8compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf
packages/289
ai/24
src/20
providers/7anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts
schemas/2database.ts generate.ts
adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts
package.json README.md tsconfig.json vitest.config.ts
auth/11
src/7index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
collaboration/17
src/13awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
config/7
src/4eslint.base.js index.ts prettier.base.json tsconfig.base.json
package.json README.md tsconfig.json
database-client/5
src/2index.test.ts index.ts
package.json README.md tsconfig.json
database-engine/33
src/29
filter/2filter.test.ts index.ts
formula/8evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts
query/6group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts
relations/2index.ts relations.test.ts
rollups/2index.ts rollups.test.ts
values/5dates.ts index.ts registry.ts types.ts values.test.ts
views/3buttons.ts index.ts views.test.ts
index.ts
package.json README.md tsconfig.json vitest.config.ts
editor/25
src/21
marks/1highlight.ts
nodes/2equation.ts mention.ts
autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
observability/20
src/16
__tests__/8db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts
index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts
package.json README.md tsconfig.json vitest.config.ts
permissions/11
src/7index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts
package.json README.md tsconfig.json vitest.config.ts
search/22
src/18chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
shared/61
src/57
dto/17ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts
events/8audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts
realtime/6comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts
automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts
package.json README.md tsconfig.json vitest.config.ts
storage/16
src/12client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
ui/37
src/33
components/19avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx
color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
prisma/16
migrations/13
20260927000000_init/1migration.sql
20260928000000_search_documents_content_hash/1migration.sql
20260929000000_workspace_usage_storage_bytes/1migration.sql
20260930000000_form_submitted_notification_type/1migration.sql
20261001000000_ai_phase12/1migration.sql
20261002000000_webhooks_secret_encrypted_dlq/1migration.sql
20261002111436_webhook_delivery_latency/1migration.sql
20261002120000_org_admin_2fa_retention_unique/1migration.sql
20261002215124_audit_export/1migration.sql
20261003210000_perf_indexes_hot_paths/1migration.sql
20261004004500_perf_indexes_hot_paths_2/1migration.sql
migration_lock.toml README.md
schema.prisma seed.ts verify.ts
scripts/7backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh
tests/169
e2e/63
.auth/1user.json
fixtures/7
files/6clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt
realtime.ts
mocks/2oidc-issuer.ts saml-idp.ts
playwright-report/3
data/2a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm
index.html
reports/1files-security.json
specs/34ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts
test-results-final-flow/3
final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2test-failed-1.png trace.zip
.last-run.json
utils/4api.ts dnd.ts search-lag.ts wait.ts
.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json
fixtures/1
files/1make-sparse.ts
integration/60
ai-capability/2ai-app.capability.test.ts gateway.capability.test.ts
drill/2seed-drill.mjs verify-restore.mjs
fixtures/5
files/5clip.mp4 clip.wav doc.pdf hero-1400.png note.txt
helpers/3api.ts containers.ts seed.ts
realtime/11control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts
ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts
performance/28
fixtures/1search-100k.ts
helpers/2seed-100k.mjs seed-1k-load.mjs
reports/7api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json
api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs
security/16
helpers/1app.ts
audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts
README.md
.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json
opensearch-reindex.tsscripts/opensearch-reindex.tsraw← scripts18,180 B← Back to the app
1/**
2 * AI Software Factory — OpenSearch content-index reindex/rollover (TASK-0099 §5).
3 *
4 * Rolls the `factory-content` alias to a NEW index (`factory-content-<to>`,
5 * default: the next version after the current alias target) with a fresh
6 * mapping (knn_vector `vector` — faiss/l2 on OpenSearch 2.15, see below —
7 * dimension/m/efConstruction tunable),
8 * backfills it from the `search_documents` Postgres mirror in 500-doc
9 * `_bulk` batches, asserts the count equality, then ATOMICALLY swaps the
10 * alias (`POST /_aliases`) and optionally deletes the old index.
11 *
12 * Why: `dense_vector` dimensions are IMMUTABLE per index — a model change
13 * (1536 → 3072, …) cannot re-map in place; it must roll a new index forward
14 * through the alias. This script is the runbook for that (and for the v1 →
15 * v2 hybrid-foundation mapping change, TASK-0099).
16 *
17 * Self-contained by design (recorded decision): the root has no
18 * `@factory/*` hoist and the repo allows no new dependencies, so the
19 * mapping is re-declared below (mirror of packages/search mapping.ts —
20 * keep the two in sync) and OpenSearch is driven with raw `fetch`.
21 * Postgres uses the repo's existing `@prisma/client` (no new dep).
22 *
23 *   pnpm search:reindex --i-know-this-swaps-the-alias [--to v2]
24 *       [--dimension 1536] [--dry-run] [--strict-equal] [--cleanup-v1]
25 *
26 * Flags:
27 *   --i-know-this-swaps-the-alias  required (unless --dry-run): this command
28 *                                  re-points the LIVE search alias.
29 *   --to <ver>        target version suffix (default: current+1, or v1 fresh).
30 *   --dimension <n>   dense_vector dimension (default 1536).
31 *   --dry-run         read-only: print the plan, create/write nothing.
32 *   --strict-equal    fail (exit 1) if target count != mirror count
33 *                     (default: warn only).
34 *   --cleanup-v1      delete the OLD index after a successful swap.
35 *
36 * Env: SEARCH_URL (http://localhost:9200), SEARCH_USERNAME (admin),
37 *      SEARCH_PASSWORD (changeme), DATABASE_URL
38 *      (postgresql://factory:factory@localhost:5432/factory),
39 *      SEARCH_KNN_M (16), SEARCH_KNN_EF_CONSTRUCTION (100).
40 *
41 * Backfill source: the `search_documents` MIRROR (whole docs only — chunk
42 * docs have no mirror rows). Phase-12 loose end: backfill from the SOURCE
43 * tables (url/grants/createdByName) instead of the mirror; until then a
44 * fresh v2 index contains whole docs only, and chunk docs reappear as the
45 * worker re-indexes pages/records (or on the next content event).
46 */
47import { PrismaClient } from "@prisma/client";
48 
49// ---------------------------------------------------------------------------
50// Flags + env
51// ---------------------------------------------------------------------------
52 
53const ALIAS = "factory-content";
54const BULK_BATCH = 500; // _bulk line batch (mirrors the worker's BATCH)
55 
56interface Flags {
57  guard: boolean;
58  to: string | null;
59  dimension: number;
60  dryRun: boolean;
61  strictEqual: boolean;
62  cleanupV1: boolean;
63}
64 
65function fail(msg: string): never {
66  console.error(`✖ ${msg}`);
67  process.exit(1);
68}
69 
70function parseFlags(argv: string[]): Flags {
71  const f: Flags = {
72    guard: false,
73    to: null,
74    dimension: 1536,
75    dryRun: false,
76    strictEqual: false,
77    cleanupV1: false,
78  };
79  for (let i = 0; i < argv.length; i++) {
80    const a = argv[i]!;
81    switch (a) {
82      case "--i-know-this-swaps-the-alias":
83        f.guard = true;
84        break;
85      case "--to": {
86        const v = argv[++i];
87        if (!v || !/^v[0-9]+$/.test(v))
88          fail(`--to expects a version like "v2", got: ${v ?? "<none>"}`);
89        f.to = v;
90        break;
91      }
92      case "--dimension": {
93        const v = argv[++i];
94        const n = v ? Number.parseInt(v, 10) : NaN;
95        if (!v || !Number.isInteger(n) || n <= 0)
96          fail(`--dimension expects a positive integer, got: ${v ?? "<none>"}`);
97        f.dimension = n;
98        break;
99      }
100      case "--dry-run":
101        f.dryRun = true;
102        break;
103      case "--strict-equal":
104        f.strictEqual = true;
105        break;
106      case "--cleanup-v1":
107        f.cleanupV1 = true;
108        break;
109      default:
110        fail(`unknown flag: ${a} (see header of scripts/opensearch-reindex.ts)`);
111    }
112  }
113  return f;
114}
115 
116// ---------------------------------------------------------------------------
117// OpenSearch (raw fetch — no SDK dependency)
118// ---------------------------------------------------------------------------
119 
120interface Os {
121  base: string;
122  user: string;
123  pass: string;
124}
125 
126async function os(osCfg: Os, path: string, init?: RequestInit): Promise<unknown> {
127  const headers: Record<string, string> = {
128    "content-type": "application/json",
129    authorization: "Basic " + Buffer.from(`${osCfg.user}:${osCfg.pass}`).toString("base64"),
130  };
131  const res = await fetch(osCfg.base.replace(/\/+$/, "") + path, { ...init, headers });
132  const text = await res.text();
133  if (!res.ok) {
134    throw new Error(
135      `OpenSearch ${init?.method ?? "GET"} ${path} → HTTP ${res.status}: ${text.slice(0, 500)}`,
136    );
137  }
138  return text ? (JSON.parse(text) as unknown) : null;
139}
140 
141async function osCurrentAliasTarget(osCfg: Os): Promise<string | null> {
142  const res = await os(osCfg, `/_alias/${ALIAS}`);
143  const idxs = Object.keys((res as Record<string, unknown>) ?? {});
144  return idxs.length > 0 ? idxs[0]! : null;
145}
146 
147interface IndexInfo {
148  dimension: number | null;
149  count: number | null;
150}
151 
152async function osIndexInfo(osCfg: Os, index: string): Promise<IndexInfo> {
153  const mapping = (await os(osCfg, `/${index}/_mapping`)) as Record<
154    string,
155    { mappings?: Record<string, unknown> }
156  >;
157  const m = mapping[index]?.mappings as
158    { properties?: { vector?: { dimension?: number } } } | undefined;
159  const dimension = m?.properties?.vector?.dimension ?? null;
160  const countRes = (await os(osCfg, `/${index}/_count`)) as { count: number };
161  return { dimension, count: countRes.count ?? 0 };
162}
163 
164// ---------------------------------------------------------------------------
165// Mapping (MIRROR of packages/search/src/mapping.ts contentMapping — keep in
166// sync; re-declared here because the script must stay dependency-free).
167// ---------------------------------------------------------------------------
168 
169function contentMapping(
170  dimension: number,
171  m: number,
172  efConstruction: number,
173): Record<string, unknown> {
174  return {
175    settings: {
176      index: {
177        refresh_interval: "1s", // lag SLA: keep 1 s (search §1.4)
178        number_of_replicas: 1,
179        knn: true,
180        "knn.algo_param.ef_search": 100,
181      },
182    },
183    mappings: {
184      properties: {
185        docId: { type: "keyword" },
186        // MIRRORS packages/search contentMapping: plain keyword — the
187        // OpenSearch in docker/CI (2.15) rejects a mapping-level `enum` on
188        // keyword mappers; the allowed set is enforced at the application
189        // layer (the client only indexes known SearchDocType values).
190        type: { type: "keyword" },
191        id: { type: "keyword" },
192        workspaceId: { type: "keyword" },
193        teamId: { type: "keyword" },
194        title: {
195          type: "text",
196          fields: { keyword: { type: "keyword", ignore_above: 512 } },
197        },
198        body: { type: "text" },
199        chunkId: { type: "keyword" },
200        chunkIndex: { type: "integer" },
201        parentDocId: { type: "keyword" },
202        vectorModel: { type: "keyword" },
203        vector: {
204          // MIRRORS the package (packages/search/src/mapping.ts — keep in
205          // sync): OpenSearch 2.15 has the 1.x `knn_vector` + `method` HNSW
206          // form — NO `dense_vector` handler. TASK-0125 (verified live):
207          // engine = faiss (nmslib hard-rejects the kNN pre-filter that the
208          // hybrid leg needs) and space_type = l2 (FAISS 2.15 rejects
209          // cosinesimil/inner_product; l2 ranks identically to cosine for
210          // L2-normalized real embeddings).
211          type: "knn_vector",
212          dimension,
213          method: {
214            name: "hnsw",
215            space_type: "l2",
216            engine: "faiss",
217            parameters: { m, ef_construction: efConstruction },
218          },
219        },
220        grants: {
221          properties: {
222            public: { type: "boolean" },
223            workspace: { type: "boolean" },
224            user: { type: "boolean" },
225            teams: { type: "keyword" },
226            users: { type: "keyword" },
227          },
228        },
229        archived: { type: "boolean" },
230        pageId: { type: "keyword" },
231        blockId: { type: "keyword" },
232        databaseId: { type: "keyword" },
233        recordId: { type: "keyword" },
234        createdBy: { type: "keyword" },
235        createdByName: { type: "keyword" },
236        icon: { type: "keyword", index: false },
237        url: { type: "keyword", index: false },
238        size: { type: "long" },
239        mimeType: { type: "keyword" },
240        createdAt: { type: "date" },
241        updatedAt: { type: "date" },
242      },
243    },
244  };
245}
246 
247// ---------------------------------------------------------------------------
248// Mirror → index doc (whole docs only; chunk docs have no mirror rows)
249// ---------------------------------------------------------------------------
250 
251interface MirrorRow {
252  id: string;
253  workspaceId: string;
254  type: string;
255  refId: string;
256  title: string;
257  body: string | null;
258  permissions: unknown;
259  metadata: unknown;
260  indexedAt: Date;
261}
262 
263/** The index `_id` / `docId`: `<type>:<mirror refId>` (user refId is already
264 *  workspace-scoped: `user:<ws>:<uid>`). */
265function docIdFor(row: MirrorRow): string {
266  return `${row.type}:${row.refId}`;
267}
268 
269/** Rebuild the wire-form index doc from a mirror row (metadata = the
270 *  deep-link facet snapshot the worker stored in upsertMirror). */
271function mirrorToDoc(row: MirrorRow): Record<string, unknown> {
272  const meta = (row.metadata ?? {}) as Record<string, unknown>;
273  const str = (k: string): string | undefined =>
274    typeof meta[k] === "string" ? (meta[k] as string) : undefined;
275  const doc: Record<string, unknown> = {
276    docId: docIdFor(row),
277    type: row.type,
278    // the doc's `id` is the plain row id (user docs: the bare uid)
279    id: row.type === "user" ? (row.refId.split(":").pop() ?? row.refId) : row.refId,
280    workspaceId: row.workspaceId,
281    title: row.title,
282    body: row.body ?? "",
283    grants: (row.permissions ?? {}) as Record<string, unknown>,
284    archived: typeof meta.archived === "boolean" ? meta.archived : false,
285    url: str("url") ?? "",
286    createdAt: str("createdAt") ?? row.indexedAt.toISOString(),
287    updatedAt: str("updatedAt") ?? row.indexedAt.toISOString(),
288  };
289  // facet fields — only present when the mirror recorded them
290  for (const k of [
291    "teamId",
292    "pageId",
293    "blockId",
294    "databaseId",
295    "recordId",
296    "createdBy",
297    "icon",
298    "size",
299    "mimeType",
300  ] as const) {
301    const v = meta[k];
302    if (v !== null && v !== undefined) doc[k] = v;
303  }
304  return doc;
305}
306 
307// ---------------------------------------------------------------------------
308// Main
309// ---------------------------------------------------------------------------
310 
311async function main(): Promise<void> {
312  const flags = parseFlags(process.argv.slice(2));
313  if (!flags.guard && !flags.dryRun) {
314    fail(
315      "refusing to reindex without the guard flag — this command re-points the LIVE " +
316        `"${ALIAS}" alias.\n  Re-run with --i-know-this-swaps-the-alias (or --dry-run to inspect only).`,
317    );
318  }
319 
320  const osCfg: Os = {
321    base: process.env.SEARCH_URL ?? "http://localhost:9200",
322    user: process.env.SEARCH_USERNAME ?? "admin",
323    pass: process.env.SEARCH_PASSWORD ?? "changeme",
324  };
325  const dimension = flags.dimension;
326  const knnM = Number.parseInt(process.env.SEARCH_KNN_M ?? "16", 10);
327  const efConstruction = Number.parseInt(process.env.SEARCH_KNN_EF_CONSTRUCTION ?? "100", 10);
328 
329  console.log(`▸ reindex plan: alias="${ALIAS}" target-dim=${dimension} dry-run=${flags.dryRun}`);
330 
331  // 1. Resolve the current alias target + live state.
332  const current = await osCurrentAliasTarget(osCfg).catch((e: Error) => {
333    if (/404/.test(e.message)) return null;
334    throw e;
335  });
336  console.log(`  current alias target: ${current ?? "(none — fresh cluster)"}`);
337 
338  // 2. Target version: explicit --to, else next after current (v1 → v2),
339  //    else v1 for a fresh cluster.
340  let target: string;
341  if (flags.to) {
342    target = `${ALIAS}-${flags.to}`;
343  } else if (current) {
344    const m = /-v([0-9]+)$/.exec(current);
345    if (!m) fail(`cannot derive the next version from "${current}" — pass --to explicitly`);
346    target = `${ALIAS}-v${Number.parseInt(m[1]!, 10) + 1}`;
347  } else {
348    target = `${ALIAS}-v1`;
349  }
350  console.log(`  target index: ${target}`);
351 
352  // 3. Read the mirror count (the backfill source of truth).
353  const prisma = new PrismaClient({
354    datasources: {
355      db: {
356        url: process.env.DATABASE_URL ?? "postgresql://factory:factory@localhost:5432/factory",
357      },
358    },
359  });
360  let mirrorCount = 0;
361  try {
362    mirrorCount = await prisma.searchDocument.count();
363  } finally {
364    if (flags.dryRun) await prisma.$disconnect();
365  }
366  console.log(`  mirror rows (search_documents, whole docs): ${mirrorCount}`);
367 
368  // 4. Existing target index? (idempotent re-run: same --to re-bakes + re-swaps)
369  let targetInfo: IndexInfo | null = null;
370  try {
371    targetInfo = await osIndexInfo(osCfg, target);
372  } catch (e) {
373    if (!/404/.test((e as Error).message)) throw e;
374  }
375  if (targetInfo) {
376    console.log(`  target already exists: dim=${targetInfo.dimension} docs=${targetInfo.count}`);
377    if (targetInfo.dimension !== null && targetInfo.dimension !== dimension) {
378      fail(
379        `target "${target}" exists with dimension ${targetInfo.dimension} ≠ requested ${dimension} — ` +
380          `dense_vector dimensions are immutable. Pick another --to (or delete the index).`,
381      );
382    }
383  }
384 
385  if (flags.dryRun) {
386    console.log(
387      `\n[dry-run] plan only — would:\n` +
388        `  1. ${targetInfo ? "reuse" : "create"} ${target} (dim=${dimension}, m=${knnM}, ef_construction=${efConstruction})\n` +
389        `  2. bulk-index ${mirrorCount} mirror docs in ${BULK_BATCH}-doc batches\n` +
390        `  3. refresh + count check (strict=${flags.strictEqual})\n` +
391        `  4. atomically move "${ALIAS}": ${current ?? "(none)"} → ${target}\n` +
392        `  ${flags.cleanupV1 && current ? `5. delete old index ${current}\n` : ""}` +
393        `No writes were made.`,
394    );
395    return;
396  }
397 
398  // 5. Create the target index (idempotent — only when missing).
399  if (!targetInfo) {
400    await os(osCfg, `/${target}`, {
401      method: "PUT",
402      body: JSON.stringify(contentMapping(dimension, knnM, efConstruction)),
403    });
404    console.log(
405      `  created ${target} (dim=${dimension}, m=${knnM}, ef_construction=${efConstruction})`,
406    );
407  }
408 
409  // 6. Backfill from the mirror (cursor-paged reads, 500-doc _bulk writes).
410  let written = 0;
411  let cursor: string | null = null;
412  const PAGE = 1000;
413  for (;;) {
414    // exactOptionalPropertyTypes: `where?: X` does not accept `X | undefined`,
415    // so the cursor-paged read is a plain conditional (no `| undefined`).
416    const rows: MirrorRow[] = cursor
417      ? ((await prisma.searchDocument.findMany({
418          where: { id: { gt: cursor } },
419          orderBy: { id: "asc" },
420          take: PAGE,
421        })) as MirrorRow[])
422      : ((await prisma.searchDocument.findMany({
423          orderBy: { id: "asc" },
424          take: PAGE,
425        })) as MirrorRow[]);
426    if (rows.length === 0) break;
427    const line: string[] = [];
428    for (const row of rows) {
429      line.push(`{"index":{"_index":"${target}","_id":"${docIdFor(row)}"}}`);
430      line.push(JSON.stringify(mirrorToDoc(row)));
431    }
432    const docCount = line.length / 2;
433    for (let i = 0; i < line.length; i += BULK_BATCH * 2) {
434      const batchDocs = Math.min(BULK_BATCH, docCount - i / 2);
435      const body = line.slice(i, i + BULK_BATCH * 2).join("\n") + "\n";
436      const res = (await os(osCfg, `/${target}/_bulk`, { method: "POST", body })) as {
437        errors?: boolean;
438        items?: { index?: { error?: { type?: string; reason?: string }; status?: number } }[];
439      };
440      if (res.errors) {
441        const bad = res.items?.find((it) => it.index?.error) ?? null;
442        throw new Error(`_bulk errors on ${target}: ${JSON.stringify(bad?.index?.error ?? {})}`);
443      }
444      written += batchDocs;
445    }
446    cursor = rows[rows.length - 1]!.id;
447    if (rows.length < PAGE) break;
448  }
449  await prisma.$disconnect();
450  console.log(`  bulk-indexed ${written} docs (mirror rows read: ${written})`);
451 
452  // 7. Refresh + count check (idempotent docs: the target holds exactly the
453  //    mirror's whole docs — chunk docs have no mirror rows, see header).
454  await os(osCfg, `/${target}/_refresh`, { method: "POST" });
455  const after = await osIndexInfo(osCfg, target);
456  console.log(`  target count after backfill: ${after.count} (mirror: ${mirrorCount})`);
457  const equal = after.count === mirrorCount;
458  if (!equal) {
459    const msg = `count mismatch: target ${after.count} ≠ mirror ${mirrorCount}`;
460    if (flags.strictEqual) fail(msg);
461    console.warn(`  ⚠ ${msg} (continue — pass --strict-equal to hard-fail)`);
462  } else {
463    console.log(`  ✓ count equality holds (${mirrorCount})`);
464  }
465 
466  // 8. Atomic alias swap (one /_aliases call — never remove-then-add).
467  const actions: Record<string, unknown>[] = [{ add: { index: target, alias: ALIAS } }];
468  if (current) actions.unshift({ remove: { index: current, alias: ALIAS } });
469  await os(osCfg, "/_aliases", { method: "POST", body: JSON.stringify({ actions }) });
470  console.log(`  ✓ alias "${ALIAS}" now → ${target}${current ? ` (was ${current})` : ""}`);
471 
472  // 9. Optional cleanup of the old index.
473  if (flags.cleanupV1 && current) {
474    await os(osCfg, `/${current}`, { method: "DELETE" });
475    console.log(`  ✓ deleted old index ${current}`);
476  } else if (current) {
477    console.log(`  (kept ${current} — pass --cleanup-v1 to delete it after verifying)`);
478  }
479 
480  console.log("✔ reindex complete");
481}
482 
483main().catch((e: Error) => fail(e.message));
484