Merge origin/main into feat/blocks: resolve provision-layer conflicts

Reconcile origin/main (version-sync + finish-graphql-export-flow, #26/#27)
with the Blocks tiering refactor that routes app provisioning to the
modules host, bakes provision recipes into the template, and tiers the
base template to auth:email.

Ten provision-layer files were reconciled across the merge:
graphql/provision/provision.ts and the nextjs/constructive-app
packages/provision sources (config.ts, create-db.ts, helpers.ts,
provision.ts, seed/index.ts) plus the baked provision recipes
(provision_new_user procedure, app_namespaces namespaceprovision
trigger + trigger fn). main's version-sync and export-flow changes are
kept alongside the tiering refactor's routing of provisioning to the
modules host.

use-create-organization.ts stays deleted: the base tier strips the
org/b2b surface, so the admin organizations create hook is intentionally
not reintroduced from main.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: yyyyaaa

README.md

@@ -6,9 +6,42 @@ Boilerplate templates for Constructive applications.
 
 - **nextjs/constructive-app** — Next.js frontend boilerplate with auth, org management, and GraphQL SDK integration
 
+## Quick Local Setup
+
+### Local Development
+
+```bash
+# 1. Start Postgres
+docker compose up -d
+
+# 2. Install dependencies
+pnpm install
+
+# 3. Setup database
+eval "$(pgpm env)"
+createdb myapp
+pgpm admin-users bootstrap --database myapp --yes
+pgpm admin-users add --database myapp --test --yes
+pgpm deploy --package myapp-service --database myapp --yes
+pgpm deploy --package myapp --database myapp --yes
+pgpm deploy --package myapp-test-seed --database myapp --yes
+
+# 4. Start GraphQL server
+PGDATABASE=myapp cnc server --port 3000 --origin "*"
+
+# 5. Codegen
+pnpm run codegen
+
+# 6. Start the app
+cd nextjs/constructive-app && pnpm run dev
+```
+
+
 
 ## Setup
 
+> **AI agents:** The `src/graphql/sdk/` directory in `nextjs/constructive-app` is auto-generated by `@constructive-io/graphql-codegen`. Never edit it manually — fix the upstream config and re-run `pnpm codegen`.
+
 In constructive-db repo:
 
 ```bash
@@ -33,5 +66,6 @@ eval "$(pgpm env)"
 pnpm run create-db
 pnpm run provision
 pnpm run codegen
+pnpm run seed
 pnpm run dev
 ```

graphql/provision/provision.ts

@@ -208,14 +208,19 @@ async function main(): Promise<void> {
   // -----------------------------------------------------------------------
   // Step 2: Create database
   // -----------------------------------------------------------------------
+  // The databaseProvisionModule mutation was moved from the "api" endpoint
+  // to the "modules" endpoint in the 2025-05 upstream refactor.
+  // We point public_.createClient() at the modules endpoint — the SDK
+  // still has the databaseProvisionModule model, it just lives on a
+  // different subdomain now.
   console.log('Step 2: Creating database...');
 
-  const apiDb = platform.createClient({
-    endpoint: config.platformApi,
+  const modulesClient = platform.createClient({
+    endpoint: process.env.MODULES_ENDPOINT || 'http://modules.localhost:3000/graphql',
     headers: { Authorization: `Bearer ${accessToken}` },
   });
 
-  const dbResult = await apiDb.databaseProvisionModule.create({
+  const dbResult = await modulesClient.databaseProvisionModule.create({
     data: {
       databaseName: config.database.name,
       ownerId: userId,
@@ -234,6 +239,13 @@ async function main(): Promise<void> {
   const databaseName = provisionModule?.databaseName ?? config.database.name;
   console.log(`  Database created. id=${databaseId}, name=${databaseName}`);
 
+  // Create API client for subsequent operations (tables, relations).
+  // These use the api endpoint (api-{dbName}.localhost), not modules.
+  const apiDb = platform.createClient({
+    endpoint: config.platformApi,
+    headers: { Authorization: `Bearer ${accessToken}` },
+  });
+
   // -----------------------------------------------------------------------
   // Step 3: Resolve schema prefix and apply workarounds
   // -----------------------------------------------------------------------

nextjs/constructive-app/.env.example

@@ -2,7 +2,7 @@
 # This single value derives all GraphQL endpoints:
 #   admin-{db}.localhost:3000  → organizations, members, permissions
 #   auth-{db}.localhost:3000   → users, authentication
-#   app-public-{db}.localhost:3000 → your business data
+#   api-{db}.localhost:3000   → your business data
 NEXT_PUBLIC_DB_NAME=your-db-name
 
 # Optional: Override the default API port (default: 3000)
@@ -11,14 +11,16 @@ NEXT_PUBLIC_DB_NAME=your-db-name
 # Optional: Override individual endpoints (bypasses DB_NAME derivation)
 # NEXT_PUBLIC_ADMIN_ENDPOINT=http://admin-mydb.localhost:3000/graphql
 # NEXT_PUBLIC_AUTH_ENDPOINT=http://auth-mydb.localhost:3000/graphql
-# NEXT_PUBLIC_APP_ENDPOINT=http://app-public-mydb.localhost:3000/graphql
+# NEXT_PUBLIC_APP_ENDPOINT=http://api-mydb.localhost:3000/graphql
 
 # -----------------------------------------------------------------------------
 # Provisioning variables (set by create-db, read by provision/seed scripts)
 # -----------------------------------------------------------------------------
 # Root metaschema endpoints
 API_ENDPOINT=http://api.localhost:3000/graphql
 AUTH_ENDPOINT=http://auth.localhost:3000/graphql
+# Modules API endpoint — blueprint, constructBlueprint, databaseProvisionModule
+MODULES_ENDPOINT=http://modules.localhost:3000/graphql
 
 # Database configuration
 DATABASE_NAME=myapp
@@ -29,6 +31,17 @@ ADMIN_PASSWORD=Password123!
 ACCESS_TOKEN=
 DATABASE_ID=
 
+# -----------------------------------------------------------------------------
+# GraphQL export variables
+# -----------------------------------------------------------------------------
+# Override endpoints for pgpm export:graphql
+# META_ENDPOINT=http://api.localhost:3000/graphql
+# MIGRATE_ENDPOINT=http://migrate.localhost:3000/graphql
+# DB_AUTH_ENDPOINT=http://auth-{databaseName}.localhost:3000/graphql
+# Extension names for the exported modules
+# EXTENSION_NAME=myapp
+# META_EXTENSION_NAME=myapp-service
+
 # Postgres (set by pgpm env or manually)
 PGHOST=localhost
 PGPORT=5432

nextjs/constructive-app/README.md

@@ -12,7 +12,7 @@
 |-----|----------|------------|------|
 | admin | http://admin-myapp.localhost:3000/graphql | React Query, ORM | [./src/graphql/sdk/admin/README.md](./src/graphql/sdk/admin/README.md) |
 | auth | http://auth-myapp.localhost:3000/graphql | React Query, ORM | [./src/graphql/sdk/auth/README.md](./src/graphql/sdk/auth/README.md) |
-| app | http://app-public-myapp.localhost:3000/graphql | React Query, ORM | [./src/graphql/sdk/app/README.md](./src/graphql/sdk/app/README.md) |
+| app | http://api-myapp.localhost:3000/graphql | React Query, ORM | [./src/graphql/sdk/app/README.md](./src/graphql/sdk/app/README.md) |
 
 ---
 

nextjs/constructive-app/docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+  postgres:
+    container_name: postgres
+    image: docker.io/constructiveio/postgres-plus:18
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=password
+    ports:
+      - "5432:5432"
+    expose:
+      - "5432"
+    volumes:
+      - ./bin:/sql-bin
+      - ./packages:/sql-packages
+      - ./extensions:/sql-extensions
+
+  minio:
+    container_name: minio
+    image: minio/minio
+    environment:
+      - MINIO_ACCESS_KEY=minioadmin
+      - MINIO_SECRET_KEY=minioadmin
+    ports:
+      - "9000:9000"
+    expose:
+      - "9000"
+    command: server /data

nextjs/constructive-app/extensions/@pgpm/database-jobs/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
+Copyright (c) 2025 Constructive
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

nextjs/constructive-app/extensions/@pgpm/database-jobs/Makefile

@@ -0,0 +1,6 @@
+EXTENSION = pgpm-database-jobs
+DATA = sql/pgpm-database-jobs--0.26.3.sql
+
+PG_CONFIG = pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)