fix: production runtime integrity, concurrency, and adapter selection

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: app_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d app_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    env:
+      NODE_ENV: test
+      DATABASE_HOST: 127.0.0.1
+      DATABASE_PORT: 5432
+      DATABASE_USER: postgres
+      DATABASE_PASSWORD: postgres
+      DATABASE_DB: app_test
+      CORS_ORIGINS: http://localhost:3001
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.28.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Lint and format
+        run: pnpm lint
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build

README.md

@@ -277,6 +277,9 @@ pnpm build
 pnpm test:web -- --run
 pnpm test:server -- --run
 
+# End-to-end (requires running Docker stack)
+E2E=1 pnpm test:e2e
+
 # Database
 pnpm --filter server db:generate  # Generate migration from schema changes
 pnpm db:migrate                   # Apply committed development migrations
@@ -297,7 +300,7 @@ Review generated migration SQL before applying or committing it. Do not rewrite
 - Server route tests use Hono `testClient` with fresh in-memory repository adapters.
 - Server setup still requires a disposable PostgreSQL test database for migrations and transaction infrastructure.
 - In-memory adapters do not prove PostgreSQL constraints, locking, transactionality, or SQL behavior.
-- Playwright and complete Trestle end-to-end scenarios are planned but not installed.
+- Playwright end-to-end scenarios run opt-in with `E2E=1` against a running Docker stack.
 
 The repository currently has no tracked `apps/server/.env.test.example`. Create `apps/server/.env.test` from the server environment shape and point it at a disposable test database before running server tests. Do not reuse production data.
 
@@ -385,4 +388,4 @@ docker build \
   .
 ```
 
-Review CORS origins, production cookie settings, database backups, R2 least-privilege credentials, and the public/private demo mode before deployment. Never expose `OPENROUTER_API_KEY`, database credentials, R2 secrets, or session material to the web bundle.
+Review CORS origins, production cookie settings, database backups, R2 least-privilege credentials, and the `DEMO_MODE` setting before deployment. Set `DEMO_MODE=public` only for synthetic demonstrations with bounded quotas; use `private` (the default) for any real document processing. Never expose `OPENROUTER_API_KEY`, database credentials, R2 secrets, or session material to the web bundle.

apps/server/Dockerfile.prod

@@ -34,3 +34,4 @@ RUN chmod +x docker-entrypoint.sh
 ENV NODE_ENV=production
 
 ENTRYPOINT ["./docker-entrypoint.sh"]
+CMD ["node", "dist/src/index.mjs"]

apps/server/docker-entrypoint.sh

@@ -1,12 +1,17 @@
 #!/bin/sh
 set -e
 
-echo "Running database migrations..."
-node dist/scripts/migrate.mjs
-echo "Installing Graphile Worker schema..."
-node dist/scripts/migrate-queue.mjs
-echo "Bootstrapping Mastra schema..."
-node dist/scripts/bootstrap-mastra.mjs
+# Only run migrations and schema bootstrap for the API server.
+# The worker starts via compose `command` and depends on a healthy API,
+# so migrations have already been applied by the time the worker starts.
+if [ "${1}" = "node" ] && [ "${2}" = "dist/src/index.mjs" ]; then
+  echo "Running database migrations..."
+  node dist/scripts/migrate.mjs
+  echo "Installing Graphile Worker schema..."
+  node dist/scripts/migrate-queue.mjs
+  echo "Bootstrapping Mastra schema..."
+  node dist/scripts/bootstrap-mastra.mjs
+fi
 
-echo "Starting server..."
-exec node dist/src/index.mjs
+echo "Starting: $@"
+exec "$@"

apps/server/scripts/seed-e2e.ts

@@ -5,6 +5,7 @@ import { eq } from 'drizzle-orm';
 
 import { db, pool } from '../src/db/index.js';
 import {
+  apConfirmationsTable,
   caseEventsTable,
   fieldEvidenceTable,
   invoiceCasesTable,
@@ -89,7 +90,8 @@ const pdfBytes = Buffer.from(
   'base64'
 );
 
-const reset = createResetService(db);
+// This script is guarded by E2E_SEED and runs only against the test stack.
+const reset = createResetService(db, 'public');
 await reset.resetDemoState();
 await mkdir(resolve(env.DOCUMENT_STORAGE_ROOT, 'documents'), { recursive: true });
 
@@ -152,6 +154,17 @@ for (const [index, scenario] of scenarios.entries()) {
     unitPriceMinor: 150_000,
     lineAmountMinor: 150_000
   });
+
+  if (scenario.state === 'awaiting_finance_approval') {
+    await db.insert(apConfirmationsTable).values({
+      invoiceCaseId: scenario.id,
+      draftRevisionId: revisionId,
+      actorId: apId,
+      caseVersion: 1,
+      createdAt: now
+    });
+  }
+
   await db.insert(caseEventsTable).values({
     id: eventId,
     invoiceCaseId: scenario.id,

apps/server/src/adapters/documents/document-store-factory.ts

@@ -0,0 +1,10 @@
+import type { DocumentStore } from './document-port.js';
+import { LocalDocumentStore } from './local-document-store.js';
+import { R2DocumentStore, createR2Config } from './r2-document-store.js';
+
+export function createDocumentStore(env: NodeJS.ProcessEnv = process.env): DocumentStore {
+  if (env.R2_ACCOUNT_ID && env.R2_ACCESS_KEY_ID && env.R2_SECRET_ACCESS_KEY && env.R2_BUCKET_NAME) {
+    return new R2DocumentStore(createR2Config(env));
+  }
+  return new LocalDocumentStore();
+}

apps/server/src/adapters/documents/inspect-document.ts

@@ -0,0 +1,90 @@
+import { fileTypeFromBuffer } from 'file-type';
+import { PDFDocument } from 'pdf-lib';
+
+import { DocumentValidationError } from './document-port.js';
+import type { SupportedDocumentType } from './document-port.js';
+
+const PDF_ACTIVE_CONTENT_PATTERN =
+  /\/(?:JS|JavaScript|AA|OpenAction|Launch|EmbeddedFile|RichMedia|SubmitForm|GoToR|AcroForm|XFA)\b/i;
+const PNG_END_MARKER = Buffer.from([0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130]);
+
+export interface DocumentInspection {
+  contentType: SupportedDocumentType;
+  pageCount: number;
+}
+
+export async function inspectDocument(
+  bytes: Buffer,
+  maxPages: number
+): Promise<DocumentInspection> {
+  const detected = await fileTypeFromBuffer(bytes);
+  if (!detected || !isSupportedType(detected.mime)) {
+    throw new DocumentValidationError('unsupported_type', 'Document type is not supported');
+  }
+
+  if (detected.mime === 'application/pdf') {
+    return inspectPdf(bytes, maxPages);
+  }
+
+  if (detected.mime === 'image/png') {
+    if (
+      bytes.length < PNG_END_MARKER.length ||
+      !bytes.subarray(-PNG_END_MARKER.length).equals(PNG_END_MARKER)
+    ) {
+      throw new DocumentValidationError('invalid_document', 'PNG document is truncated');
+    }
+  }
+
+  if (detected.mime === 'image/jpeg') {
+    if (
+      bytes.length < 4 ||
+      bytes[0] !== 0xff ||
+      bytes[1] !== 0xd8 ||
+      bytes.at(-2) !== 0xff ||
+      bytes.at(-1) !== 0xd9
+    ) {
+      throw new DocumentValidationError('invalid_document', 'JPEG document is truncated');
+    }
+  }
+
+  return { contentType: detected.mime, pageCount: 1 };
+}
+
+async function inspectPdf(
+  bytes: Buffer,
+  maxPages: number
+): Promise<{ contentType: 'application/pdf'; pageCount: number }> {
+  const source = bytes.toString('latin1');
+  if (/\/Encrypt\b/i.test(source)) {
+    throw new DocumentValidationError('encrypted_pdf', 'Encrypted PDF documents are not supported');
+  }
+  if (PDF_ACTIVE_CONTENT_PATTERN.test(source)) {
+    throw new DocumentValidationError('active_content', 'PDF active content is not supported');
+  }
+
+  try {
+    const document = await PDFDocument.load(bytes);
+    const pageCount = document.getPageCount();
+    if (pageCount < 1) {
+      throw new DocumentValidationError('invalid_document', 'PDF document has no pages');
+    }
+    if (pageCount > maxPages) {
+      throw new DocumentValidationError('too_many_pages', 'Document exceeds maximum page count');
+    }
+
+    return { contentType: 'application/pdf', pageCount };
+  } catch (error) {
+    if (error instanceof DocumentValidationError) throw error;
+    if (error instanceof Error && /encrypt/i.test(error.message)) {
+      throw new DocumentValidationError(
+        'encrypted_pdf',
+        'Encrypted PDF documents are not supported'
+      );
+    }
+    throw new DocumentValidationError('invalid_document', 'PDF document is invalid or truncated');
+  }
+}
+
+function isSupportedType(mime: string): mime is SupportedDocumentType {
+  return mime === 'application/pdf' || mime === 'image/jpeg' || mime === 'image/png';
+}

apps/server/src/adapters/documents/local-document-store.ts

@@ -5,25 +5,15 @@ import { basename, dirname, relative, resolve } from 'node:path';
 import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
-import { fileTypeFromBuffer } from 'file-type';
-import { PDFDocument } from 'pdf-lib';
-
 import { env } from '@/lib/env-config.js';
 
 import { DocumentValidationError } from './document-port.js';
-import type {
-  DocumentStore,
-  DocumentUpload,
-  StoredDocument,
-  SupportedDocumentType
-} from './document-port.js';
+import type { DocumentStore, DocumentUpload, StoredDocument } from './document-port.js';
+import { inspectDocument } from './inspect-document.js';
 
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
 const DEFAULT_MAX_PAGES = 5;
 const OBJECT_KEY_PATTERN = /^documents\/[0-9a-f-]{36}$/;
-const PDF_ACTIVE_CONTENT_PATTERN =
-  /\/(?:JS|JavaScript|AA|OpenAction|Launch|EmbeddedFile|RichMedia|SubmitForm|GoToR|AcroForm|XFA)\b/i;
-const PNG_END_MARKER = Buffer.from([0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130]);
 
 export class LocalDocumentStore implements DocumentStore {
   private readonly rootDir: string;
@@ -67,7 +57,7 @@ export class LocalDocumentStore implements DocumentStore {
       );
 
       const bytes = await readFile(temporaryPath);
-      const inspection = await this.inspect(bytes);
+      const inspection = await inspectDocument(bytes, this.maxPages);
       await rename(temporaryPath, finalPath);
       promoted = true;
 
@@ -108,83 +98,6 @@ export class LocalDocumentStore implements DocumentStore {
 
     return objectPath;
   }
-
-  private async inspect(
-    bytes: Buffer
-  ): Promise<{ contentType: SupportedDocumentType; pageCount: number }> {
-    const detected = await fileTypeFromBuffer(bytes);
-    if (!detected || !isSupportedType(detected.mime)) {
-      throw new DocumentValidationError('unsupported_type', 'Document type is not supported');
-    }
-
-    if (detected.mime === 'application/pdf') {
-      return this.inspectPdf(bytes);
-    }
-
-    if (detected.mime === 'image/png') {
-      if (
-        bytes.length < PNG_END_MARKER.length ||
-        !bytes.subarray(-PNG_END_MARKER.length).equals(PNG_END_MARKER)
-      ) {
-        throw new DocumentValidationError('invalid_document', 'PNG document is truncated');
-      }
-    }
-
-    if (detected.mime === 'image/jpeg') {
-      if (
-        bytes.length < 4 ||
-        bytes[0] !== 0xff ||
-        bytes[1] !== 0xd8 ||
-        bytes.at(-2) !== 0xff ||
-        bytes.at(-1) !== 0xd9
-      ) {
-        throw new DocumentValidationError('invalid_document', 'JPEG document is truncated');
-      }
-    }
-
-    return { contentType: detected.mime, pageCount: 1 };
-  }
-
-  private async inspectPdf(
-    bytes: Buffer
-  ): Promise<{ contentType: 'application/pdf'; pageCount: number }> {
-    const source = bytes.toString('latin1');
-    if (/\/Encrypt\b/i.test(source)) {
-      throw new DocumentValidationError(
-        'encrypted_pdf',
-        'Encrypted PDF documents are not supported'
-      );
-    }
-    if (PDF_ACTIVE_CONTENT_PATTERN.test(source)) {
-      throw new DocumentValidationError('active_content', 'PDF active content is not supported');
-    }
-
-    try {
-      const document = await PDFDocument.load(bytes);
-      const pageCount = document.getPageCount();
-      if (pageCount < 1) {
-        throw new DocumentValidationError('invalid_document', 'PDF document has no pages');
-      }
-      if (pageCount > this.maxPages) {
-        throw new DocumentValidationError('too_many_pages', 'Document exceeds maximum page count');
-      }
-
-      return { contentType: 'application/pdf', pageCount };
-    } catch (error) {
-      if (error instanceof DocumentValidationError) throw error;
-      if (error instanceof Error && /encrypt/i.test(error.message)) {
-        throw new DocumentValidationError(
-          'encrypted_pdf',
-          'Encrypted PDF documents are not supported'
-        );
-      }
-      throw new DocumentValidationError('invalid_document', 'PDF document is invalid or truncated');
-    }
-  }
-}
-
-function isSupportedType(mime: string): mime is SupportedDocumentType {
-  return mime === 'application/pdf' || mime === 'image/jpeg' || mime === 'image/png';
 }
 
 function normalizeFilename(filename: string): string {