.github/9
ISSUE_TEMPLATE/3bug_report.md config.yml feature_request.md
workflows/3ci.yml clean-clone.yml release.yml
CODEOWNERS dependabot.yml pull_request_template.md
apps/630
api/250
src/243
common/30
__tests__/3authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts
filters/1all-exceptions.filter.ts
guards/3auth.guard.ts internal-service.guard.ts rate-limit.guard.ts
interceptors/2actor-context.interceptor.ts bigint-serialization.interceptor.ts
middleware/2idempotency.test.ts idempotency.ts
pipes/1zod-validation.pipe.ts
actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts
config/1env.ts
lib/11
__tests__/5crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts
authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts
modules/197
ai/28
__tests__/4ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts
generator/4executor.ts generate.controller.ts generate.dto.ts generate.service.ts
ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts
api-keys/3api-keys.controller.ts api-keys.module.ts api-keys.service.ts
audit/2audit-log.controller.ts audit.module.ts
auth/4auth.controller.ts auth.module.ts auth.service.ts dto.ts
automations/5automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts
blocks/5
__tests__/1batch-version-cas.test.ts
block.service.ts blocks.controller.ts blocks.module.ts dto.ts
comments/4comments.controller.ts comments.module.ts comments.service.ts dto.ts
databases/9
__tests__/3normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts
database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts
docs/2docs.controller.ts docs.module.ts
files/10
__tests__/1quota.test.ts
dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts
forms/18debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts
health/3health.controller.ts health.module.ts health.service.ts
integrations/3integrations.controller.ts integrations.module.ts integrations.service.ts
internal/12
__tests__/2flush-query-shape.test.ts internal.endpoints.test.ts
ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts
notifications/3notifications.controller.ts notifications.module.ts notifications.service.ts
oauth/6
__tests__/1oauth.scopes.test.ts
oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts
org/15audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts
orgs/5dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts
pages/4dto.ts page.service.ts pages.controller.ts pages.module.ts
scim/15
__tests__/3email-mapping.test.ts etag.test.ts filters.test.ts
etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts
search/4
__tests__/1search.service.test.ts
search.controller.ts search.module.ts search.service.ts
sessions/3sessions.controller.ts sessions.module.ts sessions.service.ts
share/3share.controller.ts share.module.ts share.service.ts
sso/16
__tests__/4enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts
enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts
teams/4dto.ts teams.controller.ts teams.module.ts teams.service.ts
users/4dto.ts users.controller.ts users.module.ts users.service.ts
webhooks/3webhooks.controller.ts webhooks.module.ts webhooks.service.ts
workspaces/4dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts
types/1xmldom.d.ts
app.module.ts constants.ts main.ts
_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts
realtime/33
src/17auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts
test/11auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts
.env.example Dockerfile package.json README.md tsconfig.json
web/255
src/244
app/45
__tests__/1theme-tokens.test.ts
(app)/26
w/25
[workspace]/25
ask/1page.tsx
databases/1
[id]/1page.tsx
favorites/1page.tsx
files/1page.tsx
notifications/1page.tsx
page/4
[id]/4
[block]/1page.tsx
share/1page.tsx
layout.tsx page.tsx
search/1page.tsx
settings/10
appearance/1page.tsx
automations/3
[id]/1page.tsx
new/1page.tsx
page.tsx
billing/1page.tsx
developers/1page.tsx
members/1page.tsx
permissions/1page.tsx
teams/1page.tsx
page.tsx
shared/1page.tsx
templates/1page.tsx
trash/1page.tsx
layout.tsx page.tsx
layout.tsx
(auth)/4
login/1page.tsx
register/1page.tsx
reset-password/1page.tsx
layout.tsx
api/2
metrics/1route.ts
v1/1
health/1route.ts
f/1
[slug]/1page.tsx
health/1
ready/1route.ts
org/2
[orgId]/2
admin/2
integrations/1page.tsx
page.tsx
share/1
[id]/1page.tsx
error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx
components/118
admin/10
org-admin/8ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx
ScimCard.tsx SsoTabs.tsx
ai/6ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx
automations/5action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx
collaboration/6CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx
comments/3comment-panel.tsx comment-thread.tsx mention-input.tsx
database/27
__tests__/2cell-editor.test.tsx cell-renderer.test.tsx
AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx
dialogs/7
__tests__/1move-to-dialog.test.tsx
create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx
editor/19
__tests__/3code-block-text.test.ts code-block.test.tsx expandable.test.tsx
block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx
files/4FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx
form/4form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx
layout/8
__tests__/1page-tree-icon.test.tsx
command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx
mentions/3
__tests__/1mention-model.test.ts
mention-model.ts MentionPopup.tsx
search/3ask-ai-search.tsx results-list.tsx search-dialog.tsx
settings/10
api-keys/4ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx
webhooks/5CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx
settings-shell.tsx
ui/3confirm-dialog.tsx form.tsx toaster.tsx
hooks/21
__tests__/4realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx
realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts
lib/50
__tests__/21ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts
files/7
__tests__/2picker.test.ts upload.test.ts
api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts
ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts
stores/8
__tests__/1block-patch-store.test.ts
block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts
instrumentation.ts middleware.ts
.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts
worker/92
src/87
__tests__/13ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts
health/1server.ts
lib/12
__tests__/1clamav.test.ts
clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts
processors/56
automations/28
__tests__/3condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts
executors/17assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts
condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts
files/15
__tests__/4errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts
steps/4finalize.ts metadata.ts scan.ts thumbnails.ts
cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts
search-index/4builders.ts grants.ts index.ts processor.ts
ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts
config.ts events.ts index.ts logger.ts queues.ts
.env.example Dockerfile package.json README.md tsconfig.json
docs/73
api/17ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md
architecture/10ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md
database/2database-architecture.md redis-keys.md
development/8admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md
product/4functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md
requirements/1requirements-matrix.md
security/5audit-report.md files.md forms.md license-allowlist.md security-architecture.md
tasks/16phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md
ui/9ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md
support-matrix.md
infrastructure/71
caddy/1Caddyfile
docker/6
init/101-extensions.sql
opensearch/1init-indices.json
.env.docker docker-compose.yml opensearch-init.sh README.md
kubernetes/40
observability/20
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1sync-sources.mjs
alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml
postgres/7configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml
api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml
nginx/2nginx.conf README.md
observability/14
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1dashboard-completeness.mjs
README.md
terraform/8compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf
packages/289
ai/24
src/20
providers/7anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts
schemas/2database.ts generate.ts
adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts
package.json README.md tsconfig.json vitest.config.ts
auth/11
src/7index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
collaboration/17
src/13awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
config/7
src/4eslint.base.js index.ts prettier.base.json tsconfig.base.json
package.json README.md tsconfig.json
database-client/5
src/2index.test.ts index.ts
package.json README.md tsconfig.json
database-engine/33
src/29
filter/2filter.test.ts index.ts
formula/8evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts
query/6group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts
relations/2index.ts relations.test.ts
rollups/2index.ts rollups.test.ts
values/5dates.ts index.ts registry.ts types.ts values.test.ts
views/3buttons.ts index.ts views.test.ts
index.ts
package.json README.md tsconfig.json vitest.config.ts
editor/25
src/21
marks/1highlight.ts
nodes/2equation.ts mention.ts
autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
observability/20
src/16
__tests__/8db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts
index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts
package.json README.md tsconfig.json vitest.config.ts
permissions/11
src/7index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts
package.json README.md tsconfig.json vitest.config.ts
search/22
src/18chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
shared/61
src/57
dto/17ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts
events/8audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts
realtime/6comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts
automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts
package.json README.md tsconfig.json vitest.config.ts
storage/16
src/12client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
ui/37
src/33
components/19avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx
color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
prisma/16
migrations/13
20260927000000_init/1migration.sql
20260928000000_search_documents_content_hash/1migration.sql
20260929000000_workspace_usage_storage_bytes/1migration.sql
20260930000000_form_submitted_notification_type/1migration.sql
20261001000000_ai_phase12/1migration.sql
20261002000000_webhooks_secret_encrypted_dlq/1migration.sql
20261002111436_webhook_delivery_latency/1migration.sql
20261002120000_org_admin_2fa_retention_unique/1migration.sql
20261002215124_audit_export/1migration.sql
20261003210000_perf_indexes_hot_paths/1migration.sql
20261004004500_perf_indexes_hot_paths_2/1migration.sql
migration_lock.toml README.md
schema.prisma seed.ts verify.ts
scripts/7backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh
tests/169
e2e/63
.auth/1user.json
fixtures/7
files/6clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt
realtime.ts
mocks/2oidc-issuer.ts saml-idp.ts
playwright-report/3
data/2a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm
index.html
reports/1files-security.json
specs/34ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts
test-results-final-flow/3
final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2test-failed-1.png trace.zip
.last-run.json
utils/4api.ts dnd.ts search-lag.ts wait.ts
.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json
fixtures/1
files/1make-sparse.ts
integration/60
ai-capability/2ai-app.capability.test.ts gateway.capability.test.ts
drill/2seed-drill.mjs verify-restore.mjs
fixtures/5
files/5clip.mp4 clip.wav doc.pdf hero-1400.png note.txt
helpers/3api.ts containers.ts seed.ts
realtime/11control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts
ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts
performance/28
fixtures/1search-100k.ts
helpers/2seed-100k.mjs seed-1k-load.mjs
reports/7api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json
api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs
security/16
helpers/1app.ts
audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts
README.md
.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json
presence-cursors.spec.tstests/e2e/specs/presence-cursors.spec.tsraw← specs19,409 B← Back to the app
1/**
2 * TASK-0093 — 3-client presence + live cursors E2E (the presence half of the
3 * Phase-7 exit criterion + the cursor + a11y suite).
4 *
5 * ── RUNNER GATE (Docker) — NOT RUNNABLE LOCALLY ────────────────────────
6 * This spec needs the full stack (Postgres + Redis + API :4000 +
7 * realtime :4001 + web :3000, the seeded demo user) — a Docker daemon,
8 * which is unavailable in this environment (permission denied; recorded,
9 * never faked). It is CI-ready under the same contract as every other spec
10 * in this package (`pnpm docker:up && pnpm dev`, then the suite). Committed
11 * so the TASK-0093 acceptance mechanic is pinned for CI; it is not a
12 * local-green test here.
13 *
14 * ── WHY THREE DISTINCT USERS ───────────────────────────────────────────
15 * Presence is keyed by userId server-side (the server stamps `user` from the
16 * handshake token + the display-name resolver) and a tab never renders its
17 * OWN peer (the bar shows OTHERS). Three tabs of the SAME user collapse to
18 * one presence entry and are self-excluded → 0 avatars. To assert the DoD's
19 * "3 contexts on one page → all three see the other two's avatars", this
20 * spec uses THREE DISTINCT USERS in one workspace (the seeded demo owner +
21 * two invited members — the exact production scenario).
22 *
23 * ── ROUTE + SELECTORS (verified against the app source) ────────────────
24 * Page route: `/w/:workspace/page/:id` (the [workspace] segment accepts id
25 * or slug; the sidebar links `/w/${slug}/page/${id}`). There is NO `/p/`
26 * route and no middleware rewrite — the older specs' `/w/${id}/p/${id}` URL
27 * would 404 (a pre-existing latent bug in specs that were committed
28 * CI-ready but never run locally; recorded, not repeated here). Blocks are
29 * rows carrying `data-block-id={id}`; the cursor overlay is the
30 * `div[aria-hidden]` inside the block list; the a11y live region is
31 * `role="status"`.
32 *
33 * ── THE < 500 ms BUDGET (honest) ───────────────────────────────────────
34 * The DoD metric is "the other two's avatars < 500 ms of each's join". E2E
35 * measures the join→avatar delta on a 2× flake-superset (1000 ms) and logs
36 * the actual, so a real regression (several seconds) fails while CI jitter
37 * (100–200 ms) does not. The "caret within 4 px of coordsAtPos" sub-assert
38 * is a UNIT concern (lib/presence-cursor.test.ts resolves the geometry
39 * deterministically, including multi-block selections) — the E2E asserts
40 * the observable: the caret + name label render, in the RIGHT BLOCK's
41 * vicinity (a 4 px pixel-diff is not robust against CI font metrics).
42 */
43import { test, expect } from "../fixtures";
44import { DEMO_EMAIL, DEMO_PASSWORD } from "../fixtures";
45import {
46  addMemberViaSeam,
47  register,
48  login,
49  createWorkspace,
50  createPage,
51  createBlock,
52  getBlocks,
53  seamServiceToken,
54} from "../utils/api";
55import type { APIRequestContext, Browser, Page } from "@playwright/test";
56import type { AuthState } from "../fixtures";
57 
58const PRESENCE_BUDGET_MS = 1_000; // 2× the 500 ms DoD metric (flake-superset)
59const LEAVE_BUDGET_MS = 1_500; // the < 500 ms leave metric, flake-superset
60const DEMO_NAME = "Demo User"; // prisma/seed.ts: upsertUser(DEMO, "Demo User")
61 
62const WEB_BASE = process.env.E2E_BASE_URL ?? "http://localhost:3000";
63 
64/** A freshly-registered user with its own authenticated browser context
65 *  (mirrors the `secondUser` fixture's cookie + token storage state). */
66async function newUser(
67  browser: Browser,
68  name: string,
69): Promise<{
70  user: { email: string; password: string };
71  page: Page;
72  close: () => Promise<void>;
73  api: APIRequestContext;
74}> {
75  const email = `e2e-pres-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@factory.local`;
76  const password = `e2e-${Date.now().toString(36)}`;
77  const plain = await browser.newContext();
78  const plainApi = plain.request;
79  await register(plainApi, email, password, name);
80  const { accessToken } = await login(plainApi, email, password);
81  const jar = await plain.cookies();
82  const state: AuthState = {
83    cookies: jar.map((c) => ({
84      name: c.name,
85      value: c.value,
86      domain: c.domain,
87      path: c.path,
88      expires: c.expires,
89      httpOnly: c.httpOnly,
90      secure: c.secure,
91      sameSite: c.sameSite,
92    })),
93    origins: accessToken
94      ? [{ origin: WEB_BASE, localStorage: [{ name: "factory.accessToken", value: accessToken }] }]
95      : [],
96  };
97  await plain.close();
98  const context = await browser.newContext({ storageState: state });
99  const page = await context.newPage();
100  return {
101    user: { email, password },
102    page,
103    api: context.request,
104    close: () => context.close(),
105  };
106}
107 
108/** The seeded demo owner, in its own context (a fresh login — the cookie
109 *  + token storage state). */
110async function ownerTab(browser: Browser) {
111  const plain = await browser.newContext();
112  const plainApi = plain.request;
113  await login(plainApi, DEMO_EMAIL, DEMO_PASSWORD);
114  const jar = await plain.cookies();
115  const state: AuthState = {
116    cookies: jar.map((c) => ({
117      name: c.name,
118      value: c.value,
119      domain: c.domain,
120      path: c.path,
121      expires: c.expires,
122      httpOnly: c.httpOnly,
123      secure: c.secure,
124      sameSite: c.sameSite,
125    })),
126    origins: [],
127  };
128  await plain.close();
129  const context = await browser.newContext({ storageState: state });
130  const page = await context.newPage();
131  return { page, close: () => context.close() };
132}
133 
134/** Seed: workspace + page + 3 paragraph blocks, then 3 distinct users in it. */
135async function seed(browser: Browser, api: APIRequestContext) {
136  const ws = await createWorkspace(api, `Presence ${Date.now()}`);
137  const pg = await createPage(api, ws.id, { title: "Presence page" });
138  for (let i = 0; i < 3; i += 1) {
139    await createBlock(api, pg.id, {
140      type: "paragraph",
141      content: { text: ["alpha", "beta", "gamma"][i] },
142      position: `${i + 1}.0`,
143    });
144  }
145  const owner = await ownerTab(browser);
146  const bob = await newUser(browser, "Bob");
147  const carol = await newUser(browser, "Carol");
148  // Add each new user via the internal test seam (TASK-0095 S9 — the D3
149  // unblock; the public invite flow is email-gated and its token is never in
150  // the response). The seam is service-token guarded and e2e-only.
151  await addMemberViaSeam(seamServiceToken(), ws.id, bob.user.email, "MEMBER");
152  await addMemberViaSeam(seamServiceToken(), ws.id, carol.user.email, "MEMBER");
153  const url = `/w/${ws.id}/page/${pg.id}`;
154  return {
155    wsId: ws.id,
156    pageId: pg.id,
157    url,
158    owner,
159    bob,
160    carol,
161    closeAll: async () => {
162      await owner.close().catch(() => {});
163      await bob.close().catch(() => {});
164      await carol.close().catch(() => {});
165    },
166  };
167}
168 
169/** The OTHERS' avatars in the PresenceBar (role=img; accessible name is
170 *  "{name} is viewing this page" — color is never the sole identifier). */
171function avatars(page: Page) {
172  return page.locator('[role="img"][aria-label$="is viewing this page"]');
173}
174 
175/** A peer's cursor name label (the visible pill in the overlay). */
176function cursorLabel(page: Page, name: string) {
177  return page.locator(`div[aria-hidden="true"] span`, {
178    hasText: new RegExp(`^${name.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}$`),
179  });
180}
181 
182// --- the mechanic -------------------------------------------------------------
183 
184test.describe("TASK-0093 — 3-client presence + live cursors", () => {
185  test("three clients see the other two's avatars within the budget; a leave updates the bars", async ({
186    browser,
187    api,
188  }) => {
189    const s = await seed(browser, api);
190    try {
191      await s.owner.page.goto(s.url);
192      await s.bob.page.goto(s.url);
193      // The 3rd client joins last; its join→avatar delta measures the
194      // re-broadcast catch-up (the server re-sends the peer set on join).
195      const t0 = Date.now();
196      await s.carol.page.goto(s.url);
197      await expect
198        .poll(() => avatars(s.carol.page).count(), {
199          timeout: PRESENCE_BUDGET_MS * 2,
200          message: "the joiner sees the current peer set (re-broadcast)",
201        })
202        .toBe(2);
203      const delta = Date.now() - t0;
204      expect(
205        delta,
206        `join→avatar delta ${delta} ms (DoD metric is 500 ms; this is a 2× flake-superset)`,
207      ).toBeLessThanOrEqual(PRESENCE_BUDGET_MS);
208 
209      // Each client's bar shows the other TWO, with the "2 people are
210      // viewing this page" accessible count.
211      for (const p of [s.owner.page, s.bob.page, s.carol.page]) {
212        await expect.poll(() => avatars(p).count(), { timeout: PRESENCE_BUDGET_MS * 2 }).toBe(2);
213        await expect
214          .poll(
215            async () =>
216              p
217                .locator('div[aria-label*="are viewing this page"]')
218                .first()
219                .getAttribute("aria-label"),
220            {
221              timeout: PRESENCE_BUDGET_MS * 2,
222            },
223          )
224          .toContain("2");
225      }
226 
227      // One leaves: Carol's socket closes → the server announces the
228      // leave → owner + bob see Carol's avatar vanish (3 peers → 2 others).
229      await s.carol.close();
230      for (const p of [s.owner.page, s.bob.page]) {
231        await expect
232          .poll(() => avatars(p).count(), {
233            timeout: LEAVE_BUDGET_MS,
234            message: "the leaver's avatar disappears",
235          })
236          .toBe(1);
237      }
238    } finally {
239      await s.closeAll();
240    }
241  });
242 
243  test("cursors: A types → B and C see A's caret + name label; A hidden → cursor gone, avatar stays; A returns → cursor back", async ({
244    browser,
245    api,
246  }) => {
247    const s = await seed(browser, api);
248    try {
249      await s.owner.page.goto(s.url);
250      await s.bob.page.goto(s.url);
251      await s.carol.page.goto(s.url);
252      await expect
253        .poll(() => avatars(s.bob.page).count(), { timeout: PRESENCE_BUDGET_MS * 2 })
254        .toBe(2);
255 
256      // A (owner) types in block 2 → the caret moves → B and C see A's
257      // cursor: the name label in the overlay, in the right block's
258      // vicinity (the exact 4 px geometry is unit-tested).
259      await s.owner.page
260        .locator("[data-block-id]")
261        .nth(1)
262        .locator('[contenteditable="true"]')
263        .first()
264        .click();
265      await s.owner.page.keyboard.press("End");
266      await s.owner.page.keyboard.type(" hi");
267 
268      await expect
269        .poll(
270          async () => {
271            const label = cursorLabel(s.bob.page, DEMO_NAME).first();
272            if ((await label.count()) === 0) return false;
273            const caretBox = await label.boundingBox();
274            const rowBox = await s.bob.page.locator("[data-block-id]").nth(1).boundingBox();
275            if (!caretBox || !rowBox) return false;
276            // In block 2's vicinity: horizontally within the row's band,
277            // vertically within one row-height above/below (the label sits
278            // just below the caret).
279            return (
280              caretBox.x >= rowBox.x - 8 &&
281              caretBox.x <= rowBox.x + rowBox.width + 8 &&
282              caretBox.y >= rowBox.y - 40 &&
283              caretBox.y <= rowBox.y + rowBox.height + 40
284            );
285          },
286          { timeout: PRESENCE_BUDGET_MS * 2, message: "B sees A's caret in block 2" },
287        )
288        .toBeTruthy();
289      await expect
290        .poll(async () => (await cursorLabel(s.carol.page, DEMO_NAME).count()) > 0, {
291          timeout: PRESENCE_BUDGET_MS * 2,
292          message: "C sees A's caret",
293        })
294        .toBeTruthy();
295 
296      // A's tab goes hidden → viewing:false → A's cursor hides on B/C
297      // within the budget, but A's AVATAR stays (A is still "here").
298      await s.owner.page.evaluate(() => {
299        Object.defineProperty(document, "visibilityState", { configurable: true, value: "hidden" });
300        document.dispatchEvent(new Event("visibilitychange"));
301      });
302      await expect
303        .poll(async () => (await cursorLabel(s.bob.page, DEMO_NAME).count()) === 0, {
304          timeout: LEAVE_BUDGET_MS,
305          message: "A's cursor hides when A's tab is hidden",
306        })
307        .toBeTruthy();
308      expect(await avatars(s.bob.page).count(), "A's avatar stays when A's tab is hidden").toBe(2);
309 
310      // A returns → the cursor reappears.
311      await s.owner.page.evaluate(() => {
312        Object.defineProperty(document, "visibilityState", {
313          configurable: true,
314          value: "visible",
315        });
316        document.dispatchEvent(new Event("visibilitychange"));
317      });
318      await expect
319        .poll(async () => (await cursorLabel(s.bob.page, DEMO_NAME).count()) > 0, {
320          timeout: PRESENCE_BUDGET_MS * 2,
321          message: "A's cursor returns when A's tab is visible",
322        })
323        .toBeTruthy();
324    } finally {
325      await s.closeAll();
326    }
327  });
328 
329  test("stale cursor: B deletes A's block → A's cursor is dropped on B (no orphan node)", async ({
330    browser,
331    api,
332  }) => {
333    const s = await seed(browser, api);
334    try {
335      await s.owner.page.goto(s.url);
336      await s.bob.page.goto(s.url);
337      await s.carol.page.goto(s.url);
338      await expect
339        .poll(() => avatars(s.bob.page).count(), { timeout: PRESENCE_BUDGET_MS * 2 })
340        .toBe(2);
341 
342      // A parks a cursor in block 1 (types once).
343      await s.owner.page
344        .locator("[data-block-id]")
345        .nth(0)
346        .locator('[contenteditable="true"]')
347        .first()
348        .click();
349      await s.owner.page.keyboard.press("End");
350      await s.owner.page.keyboard.type("x");
351      await expect
352        .poll(async () => (await cursorLabel(s.bob.page, DEMO_NAME).count()) > 0, {
353          timeout: PRESENCE_BUDGET_MS * 2,
354          message: "B sees A's cursor in block 1",
355        })
356        .toBeTruthy();
357 
358      // B deletes block 1 via the API (authoritative + deterministic). The
359      // delete publishes `page.updated` → the realtime fan-out sends the
360      // `block:changed` refetch hint → B's overlay refetches (the (b)
361      // mechanic, TASK-0092) → block 1 is gone from B's DOM. A's cursor
362      // still references the deleted blockId → the resolver returns null →
363      // the cursor is DROPPED silently (no orphan node).
364      const blocks = await getBlocks(api, s.pageId);
365      const first = blocks[0];
366      expect(first, "block 1 exists before the delete").toBeTruthy();
367      const del = await api.delete(`/api/v1/blocks/${first.id}`);
368      expect(del.status()).toBeLessThan(300);
369      await expect
370        .poll(async () => s.bob.page.locator("[data-block-id]").count(), { timeout: 3_000 })
371        .toBe(2); // 3 blocks → 2 after the delete
372 
373      // A's cursor label is gone from B's overlay (the stale blockId
374      // dropped); A's avatar STAYS (presence is independent of blocks).
375      await expect
376        .poll(async () => (await cursorLabel(s.bob.page, DEMO_NAME).count()) === 0, {
377          timeout: PRESENCE_BUDGET_MS * 2,
378          message: "A's stale cursor is dropped on B",
379        })
380        .toBeTruthy();
381      expect(await avatars(s.bob.page).count(), "A's avatar stays after the block delete").toBe(2);
382    } finally {
383      await s.closeAll();
384    }
385  });
386 
387  test("a11y: the live region announces presence state; the cursor overlay is aria-hidden", async ({
388    browser,
389    api,
390  }) => {
391    const s = await seed(browser, api);
392    try {
393      await s.owner.page.goto(s.url);
394      await s.bob.page.goto(s.url);
395      // The polite live region (role=status) is attached + visually hidden.
396      const live = s.bob.page.locator('[role="status"]').first();
397      await expect(live).toBeAttached();
398 
399      // A join is a state change → announced (≤ 1/s; the first change
400      // within the window lands immediately).
401      const before = await live.innerText().catch(() => "");
402      await s.carol.page.goto(s.url); // a 3rd client joins
403      await expect
404        .poll(async () => (await live.innerText().catch(() => "")).replace(before, "").trim(), {
405          timeout: PRESENCE_BUDGET_MS * 2,
406          message: "the live region gains an announcement on the join",
407        })
408        .toMatch(/joined|editing|left/);
409 
410      // The cursor overlay is decorative (aria-hidden): the caret + name
411      // label are NOT in the accessibility tree — the announcement is the
412      // SR channel, the cursor is the visual one (spec R5).
413      await s.owner.page
414        .locator("[data-block-id]")
415        .nth(0)
416        .locator('[contenteditable="true"]')
417        .first()
418        .click();
419      await s.owner.page.keyboard.type("a");
420      const overlay = s.bob.page
421        .locator('div[aria-hidden="true"]')
422        .filter({ has: s.bob.page.locator("span") })
423        .last();
424      await expect
425        .poll(async () => (await cursorLabel(s.bob.page, DEMO_NAME).count()) > 0, {
426          timeout: PRESENCE_BUDGET_MS * 2,
427          message: "the cursor renders (visually)",
428        })
429        .toBeTruthy();
430      await expect(overlay).toHaveAttribute("aria-hidden", "true");
431    } finally {
432      await s.closeAll();
433    }
434  });
435 
436  test("reduced motion: the cursor caret has transition-duration 0s (instant)", async ({
437    browser,
438    api,
439  }) => {
440    const ws = await createWorkspace(api, `RM ${Date.now()}`);
441    const owner = await ownerTab(browser);
442    const bob = await newUser(browser, "Bob");
443    // Seam add (TASK-0095 S9 — D3 unblock; see the seed() above).
444    await addMemberViaSeam(seamServiceToken(), ws.id, bob.user.email, "MEMBER");
445    const pg = await createPage(api, ws.id, { title: "RM page" });
446    for (let i = 0; i < 2; i += 1) {
447      await createBlock(api, pg.id, {
448        type: "paragraph",
449        content: { text: ["a", "b"][i] },
450        position: `${i + 1}.0`,
451      });
452    }
453    const url = `/w/${ws.id}/page/${pg.id}`;
454    // Bob in a reduced-motion context (the Phase-4 flag).
455    const rm = await browser.newContext({
456      storageState: await bob.page.context().storageState(),
457      reducedMotion: "reduce",
458    });
459    const rmPage = await rm.newPage();
460    try {
461      await owner.page.goto(url);
462      await rmPage.goto(url);
463      await expect.poll(() => avatars(rmPage).count(), { timeout: PRESENCE_BUDGET_MS * 2 }).toBe(1);
464      await owner.page
465        .locator("[data-block-id]")
466        .nth(0)
467        .locator('[contenteditable="true"]')
468        .first()
469        .click();
470      await owner.page.keyboard.type("x");
471      await expect
472        .poll(async () => (await cursorLabel(rmPage, DEMO_NAME).count()) > 0, {
473          timeout: PRESENCE_BUDGET_MS * 2,
474          message: "the cursor renders under reduced motion",
475        })
476        .toBeTruthy();
477      // The caret spans have no CSS transition (the global
478      // prefers-reduced-motion rule + the layer sets none) — instant.
479      const dur = await rmPage
480        .locator('div[aria-hidden="true"] span')
481        .first()
482        .evaluate((el) => getComputedStyle(el).transitionDuration);
483      expect(dur, `caret transition-duration under reduced motion (got ${dur})`).toBe("0s");
484    } finally {
485      await owner.close().catch(() => {});
486      await rm.close().catch(() => {});
487      await bob.close().catch(() => {});
488    }
489  });
490});
491