feat: workspaces v1

.env.example

@@ -1,6 +1,12 @@
-# Thunderbolt Cloud URL (optional, defaults to http://localhost:8000)
+# Thunderbolt Cloud URL — the default-server URL the boot decision tree fetches
+# /v1/config from. Optional; defaults to http://localhost:8000.
 VITE_THUNDERBOLT_CLOUD_URL="http://localhost:8000/v1"
 
+# Boot decision flags. v1 production: standalone off + default URL set + user-added off
+# (forced-server). The mode picker UI ships in a later PR; v1 production never reaches it.
+# VITE_STANDALONE_MODE_ENABLED="false"
+# VITE_ALLOW_USER_ADDED_SERVERS="false"
+
 # Bypass waitlist routes for UI development (set to "true" to skip waitlist)
 # Note: This only bypasses frontend routing, not backend auth
 # VITE_BYPASS_WAITLIST="true"

.github/workflows/ci.yml

@@ -222,6 +222,13 @@ jobs:
           cd backend
           bun install --frozen-lockfile
 
+      # `shared/workspaces.ts` imports `uuid`. TS bundler-mode resolution from
+      # shared/ walks up to root `node_modules/` (never reaches backend/), so
+      # the backend type-check fails with "Cannot find module 'uuid'" unless
+      # the root deps are installed too.
+      - name: Install root dependencies (needed for shared/ type-check)
+        run: bun install --frozen-lockfile
+
       - name: Type check backend
         run: |
           cd backend

backend/.env.example

@@ -1,11 +1,19 @@
 # Backend dev environment variables.
 # Copy to .env: cp .env.example .env
-# Then run `make doctor` — it generates BETTER_AUTH_SECRET for you.
+# Then run `make doctor` — it generates BETTER_AUTH_SECRET and SERVER_ID for you.
 #
 # REQUIRED for the app to start:
 #   - BETTER_AUTH_SECRET (auto-generated by `make doctor`)
+#   - SERVER_ID (auto-generated by `make doctor`)
 #   - At least one AI provider key (ANTHROPIC_API_KEY / FIREWORKS_API_KEY / MISTRAL_API_KEY / THUNDERBOLT_INFERENCE_API_KEY)
 
+# === Required: deployment identity ===
+# Stable per-deployment UUID returned by GET /v1/config. The frontend uses this to
+# namespace its trust-domain registry (auth token, device ID, encryption keys, DB filename
+# are all keyed by it), so changing it in place is a hard reset for connected clients.
+# Generate with `uuidgen` or run `make doctor`.
+SERVER_ID=
+
 # === Required: auth signing secret ===
 # Used to sign bearer tokens and session cookies.
 # Generate with `openssl rand -base64 32` or run `make doctor`.
@@ -46,7 +54,15 @@ POWERSYNC_TOKEN_EXPIRY_SECONDS=3600
 AUTH_MODE=consumer
 # Anonymous-session overlay. When false, the anonymous() plugin is NOT registered
 # and /v1/api/auth/sign-in/anonymous returns 404. Frontend mirror: VITE_AUTH_ENABLE_ANONYMOUS.
+# Surfaced to the UI via GET /v1/config as `allowAnonUsers`.
 AUTH_ALLOW_ANONYMOUS=false
+
+# === Workspace creation policy ===
+# Surfaced to the UI via GET /v1/config; enforced by the PowerSync upload-handler factory
+# (workspaces table). Both default to false to match v1 production posture
+# (central-admin only); relax per deployment.
+ALLOW_WORKSPACE_CREATION_BY_ANON=false
+ALLOW_WORKSPACE_CREATION_BY_MEMBERS=false
 # Backend's public URL used for OIDC redirect URIs (must match what's registered with your IdP)
 BETTER_AUTH_URL=http://localhost:8000
 TRUSTED_ORIGINS=http://localhost:1420,http://localhost:8180