create-ailk 0.11.5 → 0.12.0

package/templates/apps/web/src/lib/commerce-sections.ts

@@ -1,92 +1,54 @@
+// oss: false
+import { loadUiCommerce } from "../../lib/paid-sections.generated";
+
 /**
- * Lazily registers the paid `@working-theory/ui-commerce` slice's sections
- * (`payment-receipt`) — never a static top-level import (#6084, code-review
- * finding on this issue's PR).
+ * Registers the paid `@working-theory/ui-commerce` slice's sections
+ * (`payment-receipt`) once per process, through the generated paid-sections
+ * registry (#6084, #7536).
  *
  * `/purchase/success` and `/purchase/cancel` ship in the BASE TREE
  * (`surfaces.ts` `CORE_ROUTE_DIRS`, D12) so a site that buys the `commerce`
- * add-on after its last deploy gets working return pages without a
- * redeploy. But a KEYLESS scaffold carries NO `ui-commerce` dependency by
- * design — `packages/create-ailk/scripts/build-templates.mjs`'s
- * `transformPaidUiPackages()` strips it from a keyless `apps/web/package.json`,
- * and `__tests__/paid-module-honest-states.test.ts`'s "#5581 U6" suite
- * asserts a keyless scaffold declares NONE of the four paid `ui-*` packages
- * as a dependency. A plain top-level, STATIC named-import of that package's
- * `registerCommerceSections` export would leave every keyless customer's
- * build failing with `ERR_MODULE_NOT_FOUND` — webpack resolves a static
- * import at BUILD time regardless of whether the code path importing it
- * ever executes at runtime, so gating the CALL at request time (as
- * `resolveCommerceClaim()` already does) is not enough on its own.
+ * add-on after its last deploy gets working return pages without a redeploy.
+ * This file stays in the base tree for the same reason (#6084 D12, disposed
+ * again on #6440): slicing it out would take the return pages with it.
  *
- * The `webpackIgnore` magic comment tells webpack to leave this `import()`
- * unresolved at build time; Node's own ESM loader then attempts it at
- * RUNTIME, where a keyless deployment's absent package throws a genuine
- * (caught) resolution error instead of a build failure. This repo's `dev`
- * and `build` scripts both force `--webpack` (never Turbopack, which does
- * not honor this comment), so the magic comment is reliably honored here.
+ * Whether the paid package is carried is decided at SCAFFOLD time, not here.
+ * `create-ailk` writes `apps/web/lib/paid-sections.generated.ts` from this
+ * app's `package.json`: a carried package is a plain `import()` that webpack
+ * bundles, and an absent one is a stub that answers `null`. So a KEYLESS build
+ * type-checks and builds with no paid package anywhere in its import graph, and
+ * `loadUiCommerce()` answers `null` there. The earlier runtime-loaded import
+ * handed resolution to Node's ESM loader, which cannot read our `dist` and
+ * answered `false` in production (#7536).
  *
  * On success, the real `payment-receipt` renderer is registered and the
- * caller may build a `payment-receipt` section as usual. On failure (the
- * package genuinely is not installed), the caller MUST NOT construct a bare
- * `payment-receipt` section anyway — `SectionRenderer`'s dispatch table
- * falls back to `ModuleAbsent`, which renders `null` in production
+ * caller may build a `payment-receipt` section as usual. On `false` (the
+ * package is not carried), the caller MUST NOT construct a bare
+ * `payment-receipt` section anyway — `SectionRenderer`'s dispatch table falls
+ * back to `ModuleAbsent`, which renders `null` in production
  * (`packages/ui/src/sections/ModuleAbsent.tsx`) — silently dropping the
  * title/message/status that is this page's entire point. The caller must
  * build an OSS `content-block` fallback carrying the same copy instead.
  *
+ * A package that IS carried but whose import rejects is a broken deploy: the
+ * rejection propagates and the page errors, never degrading to `false`. Only
+ * absence degrades, and only a stub produces it.
+ *
  * Registered (or found absent) once per process — memoised, so a concurrent
- * request never double-registers or double-attempts a failed resolution.
- * This is a build-presence fact, not the license claim itself (which
- * `resolveCommerceClaim()` deliberately re-checks every request); a
- * process only changes which packages are on disk via a fresh deploy, which
- * is a fresh process.
+ * request never double-registers. A rejected registration stays memoised: a
+ * process cannot recover from a bundled chunk that fails. This is a
+ * build-presence fact, not the license claim itself (which
+ * `resolveCommerceClaim()` deliberately re-checks every request).
  */
 let registration: Promise<boolean> | undefined;
 
-/**
- * The paid package's specifier, held in a CONST rather than written inline at
- * the `import()` call (#6440 AC2).
- *
- * `webpackIgnore` defers only WEBPACK's resolution; `tsc` resolves a dynamic
- * `import()` whose argument is a string LITERAL exactly as eagerly as a static
- * one, so the literal form failed a keyless scaffold's type-check with TS2307
- * "Cannot find module '@working-theory/ui-commerce'" — the build error #6440
- * was filed for. This monorepo never saw it: `packages-paid/ui-commerce` is on
- * disk here and `apps/web/package.json` declares it `workspace:*`, so the
- * specifier resolves and the defect is reachable only from a scaffold.
- *
- * A non-literal specifier is the whole fix. `tsc` does not attempt module
- * resolution on an `import()` it cannot constant-fold, so the paid package's
- * ABSENCE stops being a type error — while webpack still honours the magic
- * comment beside it and Node still performs the real resolution at runtime,
- * leaving the `catch` below as the one and only thing that observes whether
- * the package is installed. The behaviour is unchanged in both directions:
- * a licensed deployment registers the sections; a keyless one returns false.
- *
- * The file deliberately stays in the BASE TREE rather than moving into the
- * commerce slice: `/purchase/success` and `/purchase/cancel` import it
- * statically, so slicing it out would take the return pages with it and
- * regress #6084 D12 (disposed again on #6440, 2026-09-22).
- */
-const COMMERCE_UI_PACKAGE = "@working-theory/ui-commerce";
-
-/** The one export this module needs from the paid package. */
-interface CommerceSectionsModule {
-  registerCommerceSections: () => void;
-}
-
 export function ensureCommerceSectionsRegistered(): Promise<boolean> {
   if (!registration) {
     registration = (async () => {
-      try {
-        const mod = (await import(
-          /* webpackIgnore: true */ COMMERCE_UI_PACKAGE
-        )) as CommerceSectionsModule;
-        mod.registerCommerceSections();
-        return true;
-      } catch {
-        return false;
-      }
+      const mod = await loadUiCommerce();
+      if (mod === null) return false;
+      mod.registerCommerceSections();
+      return true;
     })();
   }
   return registration;

package/templates/database/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @working-theory/database
 
+## 0.34.0
+
+### Minor Changes
+
+- [#7544](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7544) [`aeefe93`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/aeefe93ea62d4b1c96da18f07b8a68674923e091) Thanks [@samuelhenry](https://github.com/samuelhenry)! - A hub API can register its spokes, and a spoke's public reads and writes resolve to its own workspace ([#7532](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7532)).
+
+  - `@working-theory/database`: two new tables. `spokes` (auth) binds one spoke to one workspace and stores the SHA-256 digest of its hub-minted key, never the key. `appointment_origins` (inbox) records which workspace a booking made through a spoke belongs to. Migration `20261003120000_spoke_registry` is purely additive.
+  - `@working-theory/ids`: two registered prefixes, `spoke` and `apptorg`.
+  - `@working-theory/api-client`: `get`, `post` and `patch` send `AILK_SPOKE_KEY` as `x-ailk-spoke-key` on server-side calls over `https:` or loopback only, and refuse to follow a redirect while they carry it. With the variable unset, every call is unchanged. `isSafeTransport`, `LOOPBACK_HOSTS` and `SAFE_HEADER_TOKEN` move from `leads.ts` into `http.ts`.
+
+- [#7547](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7547) [`d519d9f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d519d9ff7db3059375842d0729c482f94f74a13d) Thanks [@samuelhenry](https://github.com/samuelhenry)! - A scheduling connection per workspace ([#7533](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7533)): each workspace can read and receive bookings through its own scheduling provider account.
+
+  - **`@working-theory/database`** — new `SchedulingConnection` model (`scheduling_connections`, config namespace): one row per workspace holding the provider id, the credential and the webhook secret as AES-256-GCM ciphertext, an optional base URL and a unique webhook routing token. Migration `20261003130000_scheduling_connection`.
+  - **`@working-theory/ids`** — registers the `schconn` prefix for the new model.
+  - **`@working-theory/validation`** — `SchedulingProviderIdSchema` and the strict `SchedulingConnectionInputSchema` (`{ provider, apiKey, baseUrl? }`; the key is printable ASCII with no whitespace or control byte).
+  - **`@working-theory/admin`** — the Meetings "not connected" state gains a Connect form for owners, showing the webhook URL and one-time secret to paste into the provider.
+  - **`create-ailk`** — the `scheduling` slice carries the new connection and resolution files and their suites.
+
+### Patch Changes
+
+- Updated dependencies [[`84c8f52`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/84c8f5206f1393f079ae2e542f352c03c3605488), [`a83dca7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/a83dca7cb2d327f990e53154fcfca9be2268dc8a), [`aeefe93`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/aeefe93ea62d4b1c96da18f07b8a68674923e091), [`d519d9f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d519d9ff7db3059375842d0729c482f94f74a13d), [`8f835bb`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8f835bbc57059acfef157ffc60a5b250be6981e7)]:
+  - @working-theory/validation@0.34.0
+  - @working-theory/ids@0.9.0
+
 ## 0.33.0
 
 ### Patch Changes

package/templates/database/__tests__/spoke-registry.db.test.ts

@@ -0,0 +1,191 @@
+/**
+ * @file spoke-registry.db.test.ts
+ *
+ * LIVE-DATABASE proof of the hub's spoke registry and the booking-origin
+ * record (#7532, spec docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D5,
+ * D8; AC-2). Requires DATABASE_URL pointing at a Postgres with the migrations
+ * applied — the whole suite SKIPS when DATABASE_URL is unset, keeping the
+ * workspace Jest run DB-free (the repo convention; the
+ * `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, as `prefixed-ids.db.test.ts` does. What it
+ * proves that a mock cannot:
+ *   1. The five format CHECKs reject a malformed id.
+ *   2. The `appointment_origins` unique key refuses a second origin for one
+ *      booking uid.
+ *   3. Deleting a workspace cascades its `spokes`.
+ *   4. The per-booking advisory lock serializes: while connection A's
+ *      transaction holds the lock for uidA, connection B cannot take it, and
+ *      can once A commits; a different uid's lock is free throughout.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const V7 = "01920000-0000-7000-8000";
+const LOCK_SQL =
+  "SELECT pg_try_advisory_xact_lock(hashtextextended($1, 0)) AS locked";
+
+describeDb("the spoke registry and booking origins (#7532, live DB)", () => {
+  let a: Client;
+  let b: Client;
+  let workspaceId: string;
+
+  beforeAll(async () => {
+    a = new Client({ connectionString: process.env.DATABASE_URL });
+    b = new Client({ connectionString: process.env.DATABASE_URL });
+    await a.connect();
+    await b.connect();
+
+    const org = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('Spoke Registry Org', 'spoke7532-org', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    workspaceId = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, 'Spoke Registry Workspace', 'spoke7532-ws', now()) RETURNING "id"`,
+        [org.id],
+      )
+    ).rows[0]!.id;
+  });
+
+  afterAll(async () => {
+    await a.query(
+      `DELETE FROM "appointment_origins" WHERE "provider_booking_uid" LIKE 'spoke7532-%'`,
+    );
+    await a.query(`DELETE FROM "organizations" WHERE "slug" LIKE 'spoke7532-%'`);
+    await a.end();
+    await b.end();
+  });
+
+  /** Insert one spoke; the database mints its id. */
+  async function insertSpoke(
+    client: Client,
+    overrides: { id?: string; workspaceId?: string; hash?: string } = {},
+  ): Promise<string> {
+    const { rows } = await client.query<{ id: string }>(
+      `INSERT INTO "spokes" (${overrides.id ? '"id", ' : ""}"workspace_id", "name", "credential_hash", "credential_prefix", "updated_at")
+       VALUES (${overrides.id ? "$4, " : ""}$1, 'acme', $2, $3, now()) RETURNING "id"`,
+      [
+        overrides.workspaceId ?? workspaceId,
+        overrides.hash ?? "a".repeat(64),
+        "ailk_spk_abcdefgh",
+        ...(overrides.id ? [overrides.id] : []),
+      ],
+    );
+    return rows[0]!.id;
+  }
+
+  describe("format CHECKs (ADR-0031)", () => {
+    it("a spoke takes a database-minted spoke_ id", async () => {
+      const id = await insertSpoke(a, { hash: "1".repeat(64) });
+      expect(id).toMatch(/^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+    });
+
+    it("REJECTS a malformed spoke id", async () => {
+      await expect(
+        insertSpoke(a, { id: "bad", hash: "2".repeat(64) }),
+      ).rejects.toThrow(/spokes_id_format/);
+    });
+
+    it("REJECTS a malformed spoke workspace_id", async () => {
+      // The format CHECK fires before the foreign key.
+      await expect(
+        insertSpoke(a, { workspaceId: "not-a-workspace", hash: "3".repeat(64) }),
+      ).rejects.toThrow(/spokes_workspace_id_format/);
+    });
+
+    it.each([
+      ["id", "appointment_origins_id_format"],
+      ["spoke_id", "appointment_origins_spoke_id_format"],
+      ["workspace_id", "appointment_origins_workspace_id_format"],
+    ])("REJECTS a malformed origin %s", async (column, constraint) => {
+      const values: Record<string, string> = {
+        id: `apptorg_${V7}-0000000000e1`,
+        spoke_id: `spoke_${V7}-0000000000c1`,
+        workspace_id: workspaceId,
+      };
+      values[column] = "bad";
+      await expect(
+        a.query(
+          `INSERT INTO "appointment_origins" ("id", "provider_booking_uid", "workspace_id", "spoke_id")
+           VALUES ($1, $2, $3, $4)`,
+          [values["id"], `spoke7532-${column}`, values["workspace_id"], values["spoke_id"]],
+        ),
+      ).rejects.toThrow(new RegExp(constraint));
+    });
+  });
+
+  describe("unique keys", () => {
+    it("a credential digest is unique", async () => {
+      await insertSpoke(a, { hash: "4".repeat(64) });
+      await expect(insertSpoke(a, { hash: "4".repeat(64) })).rejects.toThrow(
+        /spokes_credential_hash_key/,
+      );
+    });
+
+    it("refuses a second origin for one booking uid, and ON CONFLICT DO NOTHING absorbs it", async () => {
+      const insert = (spokeSuffix: string) =>
+        a.query(
+          `INSERT INTO "appointment_origins" ("provider", "provider_booking_uid", "workspace_id", "spoke_id")
+           VALUES ('cal', 'spoke7532-uidA', $1, $2)`,
+          [workspaceId, `spoke_${V7}-0000000000${spokeSuffix}`],
+        );
+      await insert("c1");
+      await expect(insert("c2")).rejects.toThrow(
+        /appointment_origins_provider_provider_booking_uid_key/,
+      );
+
+      const skipped = await a.query(
+        `INSERT INTO "appointment_origins" ("provider", "provider_booking_uid", "workspace_id", "spoke_id")
+         VALUES ('cal', 'spoke7532-uidA', $1, $2) ON CONFLICT DO NOTHING`,
+        [workspaceId, `spoke_${V7}-0000000000c3`],
+      );
+      expect(skipped.rowCount).toBe(0);
+    });
+  });
+
+  it("deleting a workspace deletes its spokes", async () => {
+    const org = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('Cascade Org', 'spoke7532-cascade', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    const doomed = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, 'Doomed', 'doomed', now()) RETURNING "id"`,
+        [org.id],
+      )
+    ).rows[0]!.id;
+    const spokeId = await insertSpoke(a, { workspaceId: doomed, hash: "5".repeat(64) });
+
+    await a.query(`DELETE FROM "workspaces" WHERE "id" = $1`, [doomed]);
+
+    const { rowCount } = await a.query(`SELECT 1 FROM "spokes" WHERE "id" = $1`, [spokeId]);
+    expect(rowCount).toBe(0);
+  });
+
+  it("the per-booking advisory lock serializes one uid and leaves another free", async () => {
+    const keyA = "appointment:cal:spoke7532-uidA";
+    const keyB = "appointment:cal:spoke7532-uidB";
+
+    await a.query("BEGIN");
+    await a.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [keyA]);
+
+    await b.query("BEGIN");
+    expect((await b.query(LOCK_SQL, [keyA])).rows[0].locked).toBe(false);
+    expect((await b.query(LOCK_SQL, [keyB])).rows[0].locked).toBe(true);
+    await b.query("COMMIT");
+
+    await a.query("COMMIT");
+
+    await b.query("BEGIN");
+    expect((await b.query(LOCK_SQL, [keyA])).rows[0].locked).toBe(true);
+    await b.query("COMMIT");
+  });
+});

package/templates/database/auth/schema.prisma

@@ -100,12 +100,43 @@ model Workspace {
   updatedAt      DateTime @updatedAt @map("updated_at")
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  // #7532 — the hub's spoke registry rows bound to this workspace.
+  spokes       Spoke[]
 
   @@unique([organizationId, slug])
   @@index([organizationId])
   @@map("workspaces")
 }
 
+/// Spoke — one separately deployed site (a spoke) that calls this hub API
+/// server-to-server, bound to exactly ONE workspace (#7532, spec
+/// docs/specs/7532-a-spoke-s-public-reads-spec.md D1).
+///
+/// The spoke authenticates with a hub-minted key sent in `x-ailk-spoke-key`.
+/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
+/// recognisable `credentialPrefix`; the key itself never is. Several rows may
+/// bind one workspace, so a key rotates by registering a second spoke and
+/// revoking the first. `revokedAt` set refuses the key on the next request.
+///
+/// Room to extend (operator amendment; built by neither this unit): REL-002's
+/// sign-in client and #7533's SchedulingConnection each add ONE nullable,
+/// unique column in their own migration, so a spoke stays one record.
+model Spoke {
+  id               String    @id @default(dbgenerated("('spoke_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId      String    @map("workspace_id")
+  name             String    @db.VarChar(120)
+  credentialHash   String    @unique @map("credential_hash") @db.Char(64)
+  credentialPrefix String    @map("credential_prefix") @db.VarChar(24)
+  revokedAt        DateTime? @map("revoked_at")
+  createdAt        DateTime  @default(now()) @map("created_at")
+  updatedAt        DateTime  @updatedAt @map("updated_at")
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@index([workspaceId])
+  @@map("spokes")
+}
+
 /// Membership — User ↔ Organization with a Role. Managed by the Better Auth
 /// organization plugin (modelName "membership"). Org-level: grants visibility
 /// into every workspace of the organization.

package/templates/database/config/schema.prisma

@@ -136,6 +136,32 @@ model WorkspaceMeetings {
   @@map("workspace_meetings")
 }
 
+/// SchedulingConnection — a workspace's own scheduling provider account
+/// (#7533 D1): the provider id, its credential and the per-connection webhook
+/// entry point + secret, so each workspace reads and receives bookings through
+/// its own account. One row per workspace, mirroring WorkspaceMeetings above:
+/// a plain `workspaceId @unique` scalar, no relation, no foreign key (ADR 0009
+/// invariant 1). The credential and the webhook secret are AES-256-GCM
+/// ciphertext (`v1.<iv>.<tag>.<ct>`) under SCHEDULING_CREDENTIAL_KEY, bound to
+/// the workspace and the column; only apps/api's
+/// services/scheduling/connections.ts reads or writes them. `webhookToken` is
+/// a 256-bit routing id, not an authenticator. `provider` has no CHECK — the
+/// API accepts only the ids its factory table knows. Keep every `@map` in
+/// lockstep with the migration's column names (see WorkspaceMeetings).
+model SchedulingConnection {
+  id                      String   @id @default(dbgenerated("('schconn_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId             String   @unique @map("workspace_id")
+  provider                String   @db.VarChar(32)
+  credentialCiphertext    String   @map("credential_ciphertext") @db.Text
+  webhookToken            String   @unique @map("webhook_token") @db.VarChar(64)
+  webhookSecretCiphertext String   @map("webhook_secret_ciphertext") @db.Text
+  baseUrl                 String?  @map("base_url") @db.Text
+  createdAt               DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("scheduling_connections")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than

package/templates/database/inbox/schema.prisma

@@ -1131,3 +1131,24 @@ model Appointment {
   @@index([workspaceId])
   @@map("appointments")
 }
+
+/// AppointmentOrigin — which workspace a booking made THROUGH A SPOKE belongs
+/// to (#7532, spec D5). Written by `POST /v1/schedule/book` the moment Cal
+/// answers, and consulted by the deployment-wide Cal.com webhook BEFORE the
+/// site alias, so a spoke's booking is stored in the spoke's workspace.
+///
+/// One origin per booking uid: the unique key leaves `site_id` out. No
+/// relation directive (ADR 0009) — `workspace_id` and `spoke_id` are plain
+/// columns with format CHECKs, joined in apps/api/src/services/.
+model AppointmentOrigin {
+  id                 String   @id @default(dbgenerated("('apptorg_'::text || (uuidv7())::text)")) @db.Text
+  provider           String   @default("cal") @db.VarChar(32)
+  providerBookingUid String   @map("provider_booking_uid") @db.VarChar(200)
+  workspaceId        String   @map("workspace_id")
+  spokeId            String   @map("spoke_id")
+  createdAt          DateTime @default(now()) @map("created_at")
+
+  @@unique([provider, providerBookingUid])
+  @@index([workspaceId])
+  @@map("appointment_origins")
+}

package/templates/database/migrations/20261003120000_spoke_registry/migration.sql

@@ -0,0 +1,80 @@
+-- #7532 — the hub's spoke registry and the booking-origin record (spec
+-- docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D5).
+--
+--   spokes (auth)              — one row per separately deployed site that
+--                                calls this hub, bound to ONE workspace. It
+--                                stores the SHA-256 digest of the spoke's
+--                                hub-minted key, never the key. Deleting a
+--                                workspace deletes its spokes (the FK below).
+--   appointment_origins (inbox) — (provider, booking uid) → workspace, written
+--                                when a spoke's booking is created so the
+--                                deployment-wide Cal.com webhook stores the
+--                                booking in the spoke's workspace. One origin
+--                                per booking uid. No foreign key and no
+--                                relation (ADR 0009): workspace_id and
+--                                spoke_id are plain columns with format CHECKs.
+--
+-- PURELY ADDITIVE: two new tables, their indexes and one FK to "workspaces".
+-- No statement touches an existing table's rows or columns, so there is no
+-- pre-assertion block — this migration cannot lose a row.
+--
+-- Rollback: DROP TABLE "appointment_origins"; DROP TABLE "spokes". Safe while
+-- nothing but #7532's own code reads them.
+
+-- CreateTable
+CREATE TABLE "spokes" (
+    "id" TEXT NOT NULL DEFAULT ('spoke_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "name" VARCHAR(120) NOT NULL,
+    "credential_hash" CHAR(64) NOT NULL,
+    "credential_prefix" VARCHAR(24) NOT NULL,
+    "revoked_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "spokes_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "appointment_origins" (
+    "id" TEXT NOT NULL DEFAULT ('apptorg_'::text || (uuidv7())::text),
+    "provider" VARCHAR(32) NOT NULL DEFAULT 'cal',
+    "provider_booking_uid" VARCHAR(200) NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "spoke_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "appointment_origins_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+-- The lookup a spoke's every request makes (`findSpokeByKeyHash`).
+CREATE UNIQUE INDEX "spokes_credential_hash_key" ON "spokes"("credential_hash");
+
+-- CreateIndex
+CREATE INDEX "spokes_workspace_id_idx" ON "spokes"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "appointment_origins_workspace_id_idx" ON "appointment_origins"("workspace_id");
+
+-- CreateIndex
+-- One origin per booking uid (spec D5). The bind inserts with
+-- ON CONFLICT DO NOTHING against this key.
+CREATE UNIQUE INDEX "appointment_origins_provider_provider_booking_uid_key" ON "appointment_origins"("provider", "provider_booking_uid");
+
+-- AddForeignKey
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — spokes: spoke_, appointment_origins: apptorg_ (registered
+-- in packages/ids/src/registry.ts; this migration's path is added to
+-- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "spokes" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "spokes" ALTER COLUMN "id" SET DEFAULT ('spoke_'::text || (uuidv7())::text);
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_id_format" CHECK ("id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+ALTER TABLE "appointment_origins" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "appointment_origins" ALTER COLUMN "id" SET DEFAULT ('apptorg_'::text || (uuidv7())::text);
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_id_format" CHECK ("id" ~ '^apptorg_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_spoke_id_format" CHECK ("spoke_id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261003130000_scheduling_connection/migration.sql

@@ -0,0 +1,49 @@
+-- #7533 — the SchedulingConnection model: a workspace's own scheduling
+-- provider account (spec docs/specs/7533-a-scheduling-connection-per-workspace-spec.md
+-- D1). One row per workspace, keyed `@unique(workspace_id)` like its config
+-- sibling workspace_meetings; the credential and webhook secret columns hold
+-- AES-256-GCM ciphertext written only by apps/api's
+-- services/scheduling/connections.ts. `webhook_token` is the per-connection
+-- webhook entry point's routing id, unique so a delivery resolves at most
+-- one row.
+--
+-- One new table, two unique indexes, in the house style of
+-- 20260919130000_workspace_meetings (CreateTable + CreateIndex immediately
+-- followed by the ADR-0031 rule-3 id-format completion, in ONE migration
+-- since the table is new and needs no retrofit). No `workspace_id_format`
+-- CHECK and no `provider` CHECK, matching that same precedent (the API
+-- accepts only the provider ids its factory table knows).
+--
+-- No backfill, no constraint relaxed, no existing table touched.
+--
+-- Rollback: DROP TABLE "scheduling_connections". Every stored connection is
+-- lost; each workspace returns to the unconfigured state (or, on a
+-- one-workspace deployment, to the CAL_API_KEY env fallback).
+
+-- CreateTable
+CREATE TABLE "scheduling_connections" (
+    "id" TEXT NOT NULL DEFAULT ('schconn_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "provider" VARCHAR(32) NOT NULL,
+    "credential_ciphertext" TEXT NOT NULL,
+    "webhook_token" VARCHAR(64) NOT NULL,
+    "webhook_secret_ciphertext" TEXT NOT NULL,
+    "base_url" TEXT,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "scheduling_connections_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "scheduling_connections_workspace_id_key" ON "scheduling_connections"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "scheduling_connections_webhook_token_key" ON "scheduling_connections"("webhook_token");
+
+-- ADR-0031 rule 3 — scheduling_connections: schconn_ (registered in
+-- packages/ids/src/registry.ts ENTITY_PREFIX.schedulingConnection; this
+-- migration's path is added to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "scheduling_connections" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "scheduling_connections" ALTER COLUMN "id" SET DEFAULT ('schconn_'::text || (uuidv7())::text);
+ALTER TABLE "scheduling_connections" ADD CONSTRAINT "scheduling_connections_id_format" CHECK ("id" ~ '^schconn_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"