Schema with a spine

import { sql } from "drizzle-orm";
import {
  bigint,
  check,
  index,
  integer,
  jsonb,
  pgTable,
  primaryKey,
  text,
  timestamp,
  unique,
  uniqueIndex,
  uuid,
} from "drizzle-orm/pg-core";
 
// The TS twin of SAD §6.1 (ADR-16). The schema now exists twice — once as
// the SAD's SQL truth, once here — and that drift risk is checked, not
// assumed away: drizzle-kit GENERATES the migration SQL from these
// definitions, and the generated SQL is reviewed against §6.1 before the
// runner applies it. The four tenant-bearing tables reproduce §6.1
// column-for-column, constraints and DR citations included. Deliberately
// absent, with named arrivals: message_edits (edit chapter), outbox
// (ADR-06's chapter), emoji/media tables (their parts), messages
// partitioning (SAD growth note -> retention chapter).
 
// DECISION (chapter 2.1): the SAD's environments table references
// applications(id) but never defines the table. This stub satisfies the
// foreign key; the real application lifecycle belongs to Part 3's tenancy
// chapters.
export const applications = pgTable("applications", {
  id: uuid("id").primaryKey(),
  name: text("name").notNull(),
});
 
export const environments = pgTable(
  "environments",
  {
    id: uuid("id").primaryKey(),
    applicationId: uuid("application_id")
      .notNull()
      .references(() => applications.id),
    kind: text("kind").notNull(),
    // envelope-encrypted (NFR-SEC-02)
    signingSecret: text("signing_secret").notNull(),
    retentionDays: integer("retention_days"),
    quotaConfig: jsonb("quota_config").notNull().default({}),
  },
  (t) => [check("environments_kind_check", sql`${t.kind} IN ('development','production')`)],
);
 
export const users = pgTable(
  "users",
  {
    id: uuid("id").primaryKey(),
    environmentId: uuid("environment_id")
      .notNull()
      .references(() => environments.id),
    externalId: text("external_id").notNull(),
    displayName: text("display_name"),
    avatarUrl: text("avatar_url"),
    metadata: jsonb("metadata").notNull().default({}),
    bannedAt: timestamp("banned_at", { withTimezone: true }),
  },
  (t) => [unique("users_environment_id_external_id_unique").on(t.environmentId, t.externalId)], // DR-02
);
 
export const channels = pgTable(
  "channels",
  {
    id: uuid("id").primaryKey(),
    environmentId: uuid("environment_id")
      .notNull()
      .references(() => environments.id),
    externalId: text("external_id").notNull(),
    type: text("type").notNull(),
    name: text("name"),
    metadata: jsonb("metadata").notNull().default({}),
    lastSequence: bigint("last_sequence", { mode: "number" }).notNull().default(0), // ADR-03
    archivedAt: timestamp("archived_at", { withTimezone: true }),
  },
  (t) => [
    unique("channels_environment_id_external_id_unique").on(t.environmentId, t.externalId), // DR-02
    check("channels_type_check", sql`${t.type} IN ('public','private')`),
  ],
);
 
export const messages = pgTable(
  "messages",
  {
    id: uuid("id").primaryKey(),
    channelId: uuid("channel_id")
      .notNull()
      .references(() => channels.id),
    sequence: bigint("sequence", { mode: "number" }).notNull(),
    userId: uuid("user_id").references(() => users.id),
    // NULL => tombstone
    text: text("text"),
    metadata: jsonb("metadata").notNull().default({}),
    attachments: jsonb("attachments"),
    idempotencyKey: text("idempotency_key"),
    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
    editedAt: timestamp("edited_at", { withTimezone: true }),
    deletedAt: timestamp("deleted_at", { withTimezone: true }),
  },
  (t) => [
    unique("messages_channel_id_sequence_unique").on(t.channelId, t.sequence), // DR-01
    // DR-03: idempotency enforced at the storage layer — the partial unique
    // index Prisma could not express is a first-class schema citizen here.
    uniqueIndex("messages_idem")
      .on(t.channelId, t.idempotencyKey)
      .where(sql`${t.idempotencyKey} IS NOT NULL`),
    // Hot-path index (SAD §6.3): history pagination as a pure
    // index-order scan (FR-MSG-09).
    index("messages_channel_seq").on(t.channelId, t.sequence.desc()),
  ],
);
 
// DECISION (chapter 2.1): the docs/07 row and SAD §6.3's hot-path index
// both reference a members table that §6.1 never defines. This shape is
// anchored to that index; membership roles arrive with the channel
// semantics chapters.
export const members = pgTable(
  "members",
  {
    channelId: uuid("channel_id")
      .notNull()
      .references(() => channels.id),
    userId: uuid("user_id")
      .notNull()
      .references(() => users.id),
    joinedAt: timestamp("joined_at", { withTimezone: true }).notNull().defaultNow(),
  },
  (t) => [
    primaryKey({ columns: [t.channelId, t.userId] }),
    // Hot-path index (SAD §6.3): the resume path's "which channels am I in".
    index("members_user_channel").on(t.userId, t.channelId),
  ],
);

import { defineConfig } from "drizzle-kit";
 
// drizzle-kit's job here is GENERATION only: it turns src/db/schema.ts into
// plain SQL files under migrations/, which are reviewed against SAD §6.1
// and applied by src/db/migrate.ts — our runner, our single ledger. Its
// migrator and its journal table are deliberately unused (ADR-16).
export default defineConfig({
  dialect: "postgresql",
  schema: "./src/db/schema.ts",
  out: "./migrations",
});

pnpm --filter @relay/api exec drizzle-kit generate --name core_tables

-- 0000_core_tables (chapter 2.1): GENERATED by drizzle-kit from
-- src/db/schema.ts, then reviewed against SAD §6.1 — the ADR-16 drift
-- check. Review disposition: column-for-column identical to §6.1 for the
-- four tenant-bearing tables (CHECKs, DR-01/02 UNIQUEs, DR-03 partial
-- unique index, §6.3 hot-path indexes all present); differences are
-- formal only (alphabetical table order with FKs as ALTER TABLE, quoted
-- identifiers, explicit ON DELETE NO ACTION and DESC NULLS LAST — all
-- Postgres defaults spelled out). `applications` (stub) and `members`
-- remain this chapter's recorded decisions; see the DECISION comments in
-- schema.ts. Applied by src/db/migrate.ts — versioned, forward-only.
 
CREATE TABLE "applications" (
	"id" uuid PRIMARY KEY NOT NULL,
	"name" text NOT NULL
);
--> statement-breakpoint
CREATE TABLE "channels" (
	"id" uuid PRIMARY KEY NOT NULL,
	"environment_id" uuid NOT NULL,
	"external_id" text NOT NULL,
	"type" text NOT NULL,
	"name" text,
	"metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
	"last_sequence" bigint DEFAULT 0 NOT NULL,
	"archived_at" timestamp with time zone,
	CONSTRAINT "channels_environment_id_external_id_unique" UNIQUE("environment_id","external_id"),
	CONSTRAINT "channels_type_check" CHECK ("channels"."type" IN ('public','private'))
);
--> statement-breakpoint
CREATE TABLE "environments" (
	"id" uuid PRIMARY KEY NOT NULL,
	"application_id" uuid NOT NULL,
	"kind" text NOT NULL,
	"signing_secret" text NOT NULL,
	"retention_days" integer,
	"quota_config" jsonb DEFAULT '{}'::jsonb NOT NULL,
	CONSTRAINT "environments_kind_check" CHECK ("environments"."kind" IN ('development','production'))
);
--> statement-breakpoint
CREATE TABLE "members" (
	"channel_id" uuid NOT NULL,
	"user_id" uuid NOT NULL,
	"joined_at" timestamp with time zone DEFAULT now() NOT NULL,
	CONSTRAINT "members_channel_id_user_id_pk" PRIMARY KEY("channel_id","user_id")
);
--> statement-breakpoint
CREATE TABLE "messages" (
	"id" uuid PRIMARY KEY NOT NULL,
	"channel_id" uuid NOT NULL,
	"sequence" bigint NOT NULL,
	"user_id" uuid,
	"text" text,
	"metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
	"attachments" jsonb,
	"idempotency_key" text,
	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
	"edited_at" timestamp with time zone,
	"deleted_at" timestamp with time zone,
	CONSTRAINT "messages_channel_id_sequence_unique" UNIQUE("channel_id","sequence")
);
--> statement-breakpoint
CREATE TABLE "users" (
	"id" uuid PRIMARY KEY NOT NULL,
	"environment_id" uuid NOT NULL,
	"external_id" text NOT NULL,
	"display_name" text,
	"avatar_url" text,
	"metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
	"banned_at" timestamp with time zone,
	CONSTRAINT "users_environment_id_external_id_unique" UNIQUE("environment_id","external_id")
);
--> statement-breakpoint
ALTER TABLE "channels" ADD CONSTRAINT "channels_environment_id_environments_id_fk" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "environments" ADD CONSTRAINT "environments_application_id_applications_id_fk" FOREIGN KEY ("application_id") REFERENCES "public"."applications"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "members" ADD CONSTRAINT "members_channel_id_channels_id_fk" FOREIGN KEY ("channel_id") REFERENCES "public"."channels"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "members" ADD CONSTRAINT "members_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "messages" ADD CONSTRAINT "messages_channel_id_channels_id_fk" FOREIGN KEY ("channel_id") REFERENCES "public"."channels"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "messages" ADD CONSTRAINT "messages_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
ALTER TABLE "users" ADD CONSTRAINT "users_environment_id_environments_id_fk" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
CREATE INDEX "members_user_channel" ON "members" USING btree ("user_id","channel_id");--> statement-breakpoint
CREATE UNIQUE INDEX "messages_idem" ON "messages" USING btree ("channel_id","idempotency_key") WHERE "messages"."idempotency_key" IS NOT NULL;--> statement-breakpoint
CREATE INDEX "messages_channel_seq" ON "messages" USING btree ("channel_id","sequence" DESC NULLS LAST);

import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
import pg from "pg";
 
import * as schema from "./schema";
 
// The one place a connection is born. DATABASE_URL defaults to the compose
// stack's dev credentials (chapter 1.2) — override it if your host ports
// are remapped. Everything outside src/db is lint-forbidden from importing
// pg OR drizzle-orm at all (constitution I: isolation lives in data
// access) — Drizzle is the query engine INSIDE the repository layer, never
// a client handed to handlers (ADR-16).
 
export const DEFAULT_DATABASE_URL =
  "postgres://relay:relay@localhost:5432/relay";
 
export function createPool(): pg.Pool {
  return new pg.Pool({
    connectionString: process.env.DATABASE_URL ?? DEFAULT_DATABASE_URL,
  });
}
 
export type Db = NodePgDatabase<typeof schema>;
 
export function createDb(pool: pg.Pool): Db {
  return drizzle({ client: pool, schema });
}

import { readdir, readFile } from "node:fs/promises";
import { join } from "node:path";
 
import type pg from "pg";
 
import { createPool } from "./client";
 
// Migrations as discipline (constitution: versioned, forward-only). There is
// no down path — not missing, absent by design. Files apply in filename
// order, each inside a transaction, each recorded; a re-run is a no-op.
// drizzle-kit GENERATES these files from src/db/schema.ts; this runner —
// not drizzle-kit's migrator — is the only thing that APPLIES them, so the
// workspace has exactly one migration ledger: schema_migrations.
 
const MIGRATIONS_DIR = join(__dirname, "..", "..", "migrations");
 
export async function migrate(pool: pg.Pool): Promise<string[]> {
  await pool.query(
    `CREATE TABLE IF NOT EXISTS schema_migrations (
       version    TEXT PRIMARY KEY,
       applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
     )`,
  );
 
  const files = (await readdir(MIGRATIONS_DIR)).filter((f) => f.endsWith(".sql")).sort();
  const applied: string[] = [];
 
  for (const file of files) {
    const done = await pool.query("SELECT 1 FROM schema_migrations WHERE version = $1", [file]);
    if ((done.rowCount ?? 0) > 0) continue;
 
    const sql = await readFile(join(MIGRATIONS_DIR, file), "utf8");
    const client = await pool.connect();
    try {
      await client.query("BEGIN");
      await client.query(sql);
      await client.query("INSERT INTO schema_migrations (version) VALUES ($1)", [file]);
      await client.query("COMMIT");
      applied.push(file);
    } catch (error) {
      await client.query("ROLLBACK");
      throw error;
    } finally {
      client.release();
    }
  }
  return applied;
}
 
// This package compiles to CommonJS (ADR-15's dialect), so the "am I the
// entry file?" check is require.main — import.meta does not exist here.
if (require.main === module) {
  void (async () => {
    const pool = createPool();
    const applied = await migrate(pool);
    console.log(
      applied.length === 0
        ? "migrations: nothing to apply"
        : `migrations: applied ${applied.join(", ")}`,
    );
    await pool.end();
  })();
}

 {
   "name": "@relay/api",
   "private": true,
   "version": "0.0.0",
   "type": "commonjs",
   "scripts": {
     "build": "nest build",
     "dev": "nest start --watch",
     "start": "node dist/main.js",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "migrate": "nest build && node dist/db/migrate.js",
+    "test:integration": "vitest run --config vitest.integration.config.mts"
   },
   "dependencies": {
     "@nestjs/common": "^11.1.28",
     "@nestjs/core": "^11.1.28",
     "@nestjs/platform-express": "^11.1.28",
     "@relay/protocol": "workspace:*",
     "@relay/service-kit": "workspace:*",
+    "drizzle-orm": "^0.45.2",
+    "pg": "^8.22.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2"
   },
   "devDependencies": {
     "@nestjs/cli": "^11.0.24",
     "@nestjs/testing": "^11.1.28",
     "@swc/core": "^1.15.47",
+    "@types/pg": "^8.20.3",
+    "drizzle-kit": "^0.31.10",
     "unplugin-swc": "^1.5.9"
   }
 }

docker compose up -d --wait postgres
pnpm install
pnpm --filter @relay/api migrate
pnpm --filter @relay/api migrate   # → migrations: nothing to apply

import { randomUUID } from "node:crypto";
 
import { and, asc, eq, sql } from "drizzle-orm";
 
import type { Db } from "./client";
import { channels, members, users } from "./schema";
 
// The repository layer — the ONE place data access lives (ADR-04's single
// writer, constitution I). Two surfaces with a bright line between them:
//
//   createEnvironment — the ADMIN surface. It creates tenants, so it is the
//   only operation here that is not tenant-scoped. It also inserts a stub
//   application row to satisfy environments' NOT NULL foreign key (recorded
//   decision: the real application lifecycle belongs to Part 3).
//
//   Repository — everything else. The constructor REQUIRES an
//   environment_id; every query is scoped by it HERE, in one home — never
//   at call sites. Cross-tenant reads return null/empty: no data, and no
//   reveal that the foreign id even exists (FR-TEN-05).
//
// Drizzle is the query engine inside this layer (ADR-16): queries keep
// their SQL shape and gain end-to-end types. Where the builder falls short,
// a raw SQL island is permitted — inside the layer, never outside it.
//
// All primary keys are generated app-side (crypto.randomUUID) — the SAD's
// SQL declares no id defaults, and the migration adds none.
 
export interface Environment {
  id: string;
  kind: "development" | "production";
}
 
export async function createEnvironment(
  db: Db,
  { name, kind = "development" }: { name: string; kind?: Environment["kind"] },
): Promise<Environment> {
  const applicationId = randomUUID();
  const environmentId = randomUUID();
  // The admin surface writes through the same Db handle but carries no
  // tenant scope — it is the operation that MINTS the scope.
  await db.execute(sql`INSERT INTO applications (id, name) VALUES (${applicationId}, ${name})`);
  await db.execute(
    sql`INSERT INTO environments (id, application_id, kind, signing_secret)
        VALUES (${environmentId}, ${applicationId}, ${kind}, ${randomUUID()})`,
  );
  return { id: environmentId, kind };
}
 
export interface UserRow {
  id: string;
  external_id: string;
  display_name: string | null;
}
 
export interface ChannelRow {
  id: string;
  external_id: string;
  type: "public" | "private";
  name: string | null;
}
 
export class Repository {
  // Constructor parameter properties — the shorthand chapter 1.4 released
  // for this service when ADR-15 spent erasableSyntaxOnly on decorator
  // metadata. The guarantee still holds in the gateway and every package.
  constructor(
    private readonly db: Db,
    private readonly environmentId: string,
  ) {}
 
  async createUser(externalId: string, displayName?: string): Promise<UserRow> {
    const id = randomUUID();
    await this.db.insert(users).values({
      id,
      environmentId: this.environmentId,
      externalId,
      displayName: displayName ?? null,
    });
    return { id, external_id: externalId, display_name: displayName ?? null };
  }
 
  async getUserByExternalId(externalId: string): Promise<UserRow | null> {
    const rows = await this.db
      .select({ id: users.id, external_id: users.externalId, display_name: users.displayName })
      .from(users)
      .where(and(eq(users.environmentId, this.environmentId), eq(users.externalId, externalId)));
    return rows[0] ?? null;
  }
 
  async createChannel(
    externalId: string,
    type: ChannelRow["type"],
    name?: string,
  ): Promise<ChannelRow> {
    const id = randomUUID();
    await this.db.insert(channels).values({
      id,
      environmentId: this.environmentId,
      externalId,
      type,
      name: name ?? null,
    });
    return { id, external_id: externalId, type, name: name ?? null };
  }
 
  async getChannelByExternalId(externalId: string): Promise<ChannelRow | null> {
    const rows = await this.db
      .select({
        id: channels.id,
        external_id: channels.externalId,
        type: sql<ChannelRow["type"]>`${channels.type}`,
        name: channels.name,
      })
      .from(channels)
      .where(
        and(eq(channels.environmentId, this.environmentId), eq(channels.externalId, externalId)),
      );
    return rows[0] ?? null;
  }
 
  async listChannels(): Promise<ChannelRow[]> {
    return this.db
      .select({
        id: channels.id,
        external_id: channels.externalId,
        type: sql<ChannelRow["type"]>`${channels.type}`,
        name: channels.name,
      })
      .from(channels)
      .where(eq(channels.environmentId, this.environmentId))
      .orderBy(asc(channels.externalId));
  }
 
  /** Membership joins live in channel-land, so the tenant scope rides the
   * channel: the double-scoped SELECT below is what makes a foreign channel
   * id useless. INSERT ... SELECT is where the builder falls short — this
   * is the layer's one raw SQL island, permitted by ADR-16 and kept inside
   * the wall like everything else. */
  async addMember(channelId: string, userId: string): Promise<boolean> {
    const result = await this.db.execute(
      sql`INSERT INTO members (channel_id, user_id)
          SELECT c.id, u.id FROM channels c, users u
          WHERE c.id = ${channelId} AND c.environment_id = ${this.environmentId}
            AND u.id = ${userId} AND u.environment_id = ${this.environmentId}`,
    );
    return (result.rowCount ?? 0) > 0;
  }
 
  async listMembers(channelId: string): Promise<string[]> {
    const rows = await this.db
      .select({ user_id: members.userId })
      .from(members)
      .innerJoin(channels, eq(channels.id, members.channelId))
      .where(and(eq(members.channelId, channelId), eq(channels.environmentId, this.environmentId)))
      .orderBy(asc(members.joinedAt));
    return rows.map((r) => r.user_id);
  }
 
  async channelsForUser(userId: string): Promise<string[]> {
    const rows = await this.db
      .select({ channel_id: members.channelId })
      .from(members)
      .innerJoin(users, eq(users.id, members.userId))
      .where(and(eq(members.userId, userId), eq(users.environmentId, this.environmentId)));
    return rows.map((r) => r.channel_id);
  }
}

 import eslint from "@eslint/js";
 import tseslint from "typescript-eslint";
 
 // One lint config for the whole workspace (ADR-01's consequence made literal).
 export default tseslint.config(
   { ignores: ["**/node_modules/**", "**/dist/**", "**/coverage/**"] },
   eslint.configs.recommended,
   ...tseslint.configs.recommended,
+  {
+    // Isolation lives in data access, not in handlers (constitution I):
+    // only the repository layer may touch the driver.
+    files: ["**/*.ts"],
+    ignores: ["services/api/src/db/**"],
+    rules: {
+      "no-restricted-imports": [
+        "error",
+        {
+          paths: [
+            {
+              name: "pg",
+              message:
+                "Raw database access is forbidden outside services/api/src/db (constitution I).",
+            },
+            {
+              name: "drizzle-orm",
+              message:
+                "The query engine lives inside the repository layer only (constitution I, ADR-16).",
+            },
+          ],
+          patterns: [
+            {
+              group: ["drizzle-orm/*"],
+              message:
+                "The query engine lives inside the repository layer only (constitution I, ADR-16).",
+            },
+          ],
+        },
+      ],
+    },
+  },
 );

import { defineConfig } from "vitest/config";
 
// The integration lane (chapter 2.1). *.itest.ts files are invisible to the
// unit lane's include on purpose: `pnpm test` stays Docker-free, and this
// config is what `pnpm --filter @relay/api test:integration` runs against
// the compose Postgres. (.mts because this package compiles to CommonJS —
// a .ts config would be loaded as CJS, which vitest refuses.)
export default defineConfig({
  test: {
    include: ["src/**/*.itest.ts"],
  },
});

import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
import { createDb, createPool, DEFAULT_DATABASE_URL, type Db } from "./client";
import { migrate } from "./migrate";
import { createEnvironment, Repository, type Environment } from "./repository";
 
// The isolation suite: attack the repository with FOREIGN tenant ids and
// prove the leak inexpressible (FR-TEN-05, NFR-SEC-09, constitution I).
// Requires the compose Postgres — this file is *.itest.ts precisely so the
// Docker-free unit lane never collects it.
 
// Guardrail: integration tests run against the LOCAL compose stack only.
const url = new URL(process.env.DATABASE_URL ?? DEFAULT_DATABASE_URL);
if (!["localhost", "127.0.0.1"].includes(url.hostname)) {
  throw new Error(
    `integration tests refuse non-local databases (got host "${url.hostname}") — never point this suite at a shared database`,
  );
}
 
const pool = createPool();
const db: Db = createDb(pool);
let envA: Environment;
let envB: Environment;
let repoA: Repository;
let repoB: Repository;
 
beforeAll(async () => {
  await migrate(pool);
  // Deterministic ground: this suite owns these tables in the dev database.
  await pool.query(
    "TRUNCATE members, messages, channels, users, environments, applications CASCADE",
  );
  envA = await createEnvironment(db, { name: "tenant-a" });
  envB = await createEnvironment(db, { name: "tenant-b" });
  repoA = new Repository(db, envA.id);
  repoB = new Repository(db, envB.id);
});
 
afterAll(async () => {
  await pool.end();
});
 
describe("tenant isolation is structural (FR-TEN-05)", () => {
  it("a foreign external_id resolves to nothing — not even an existence hint", async () => {
    await repoA.createUser("tuan", "Tuan");
    expect(await repoA.getUserByExternalId("tuan")).not.toBeNull();
    expect(await repoB.getUserByExternalId("tuan")).toBeNull();
  });
 
  it("channel reads and lists are scoped by construction", async () => {
    await repoA.createChannel("support", "public", "Support");
    expect(await repoB.getChannelByExternalId("support")).toBeNull();
    expect(await repoB.listChannels()).toEqual([]);
    expect((await repoA.listChannels()).map((c) => c.external_id)).toContain(
      "support",
    );
  });
 
  it("membership writes with foreign ids affect zero rows", async () => {
    const user = await repoA.getUserByExternalId("tuan");
    const channel = await repoA.getChannelByExternalId("support");
    expect(await repoA.addMember(channel!.id, user!.id)).toBe(true);
    // B holds A's REAL ids — and still cannot write or read through them.
    expect(await repoB.addMember(channel!.id, user!.id)).toBe(false);
    expect(await repoB.listMembers(channel!.id)).toEqual([]);
    expect(await repoB.channelsForUser(user!.id)).toEqual([]);
    expect(await repoA.listMembers(channel!.id)).toEqual([user!.id]);
  });
 
  it("uniqueness is per-tenant (DR-02): both tenants may own the same external_id", async () => {
    await expect(repoB.createUser("tuan", "A different Tuan")).resolves.toBeTruthy();
    await expect(repoA.createUser("tuan", "Duplicate in A")).rejects.toThrow();
  });
});

pnpm lint && pnpm typecheck && pnpm test
pnpm --filter @relay/api test:integration