create-ailk 0.11.5 → 0.12.1

package/component-catalog.json

@@ -97,7 +97,7 @@
       "importPath": "@working-theory/ui-signal-collectors",
       "rootBarrel": "@working-theory/ui-signal-collectors",
       "sourceRoot": "packages-paid/ui-signal-collectors/src/sections",
-      "count": 3
+      "count": 5
     },
     {
       "name": "signal-collectors-blocks",
@@ -105,7 +105,7 @@
       "importPath": "@working-theory/ui-signal-collectors",
       "rootBarrel": "@working-theory/ui-signal-collectors",
       "sourceRoot": "packages-paid/ui-signal-collectors/src/blocks",
-      "count": 8
+      "count": 9
     },
     {
       "name": "commerce-sections",
@@ -3213,6 +3213,28 @@
       "descriptionGrade": "strong",
       "sectionType": null
     },
+    {
+      "name": "ListingDetail",
+      "tier": "signal-collectors-sections",
+      "sourcePath": "packages-paid/ui-signal-collectors/src/sections/ListingDetail.tsx",
+      "importPath": "@working-theory/ui-signal-collectors",
+      "exported": true,
+      "description": "One accepted entry's own page: its name as the page's `<h1>`, its summary, its own link, and its PROFILE — the applicant's answers to the listicle's Application fields, as label · value in the wizard's order. The profile is built and filtered server-side (`listingProfile`); this component renders what it is handed, in order, and nothing else.",
+      "descriptionSource": "doc-comment",
+      "descriptionGrade": "strong",
+      "sectionType": null
+    },
+    {
+      "name": "ListingShelves",
+      "tier": "signal-collectors-sections",
+      "sourcePath": "packages-paid/ui-signal-collectors/src/sections/ListingShelves.tsx",
+      "importPath": "@working-theory/ui-signal-collectors",
+      "exported": true,
+      "description": "A listicle's accepted entries on its landing page, as two shelves partitioned from ONE list: `status === \"active\"` on one, `\"closed\"` on the other. `closed` is computed by the API from the window end; this component only reads it. Featured entries lead the active shelf (stable sort, so the API's order otherwise survives).",
+      "descriptionSource": "doc-comment",
+      "descriptionGrade": "strong",
+      "sectionType": null
+    },
     {
       "name": "ProjectListingShelves",
       "tier": "signal-collectors-sections",
@@ -3235,6 +3257,17 @@
       "descriptionGrade": "strong",
       "sectionType": null
     },
+    {
+      "name": "ListingCard",
+      "tier": "signal-collectors-blocks",
+      "sourcePath": "packages-paid/ui-signal-collectors/src/blocks/ListingCard.tsx",
+      "importPath": "@working-theory/ui-signal-collectors",
+      "exported": true,
+      "description": "The tile for one accepted entry of a listicle's directory. Generic by name and by shape: it reads the directory's `ListingEntryPublic` — name, summary, featured flag, waitlist count — and none of the project-shaped columns `ProjectListingCard` renders. The whole tile is one anchor, composed from `Link` directly (the LinkCard precedent: Card renders a <div>).",
+      "descriptionSource": "doc-comment",
+      "descriptionGrade": "strong",
+      "sectionType": null
+    },
     {
       "name": "ListingFullPreview",
       "tier": "signal-collectors-blocks",

package/component-catalog.md

@@ -15,13 +15,13 @@ The component inventory of `@working-theory/ui` and the shells of `@working-theo
 3. Check the Primitives, Panels and Shells tables too — a low-level control, a collapsible layout container, or a route-level frame lives there, not under Sections or Blocks.
 4. Only then build. If you do build, you are declaring the capability is genuinely absent.
 
-Inventory: **304 component files** across 16 tiers — 55 sections, 99 blocks, 18 chrome, 79 primitives, 6 panels, 6 shells, 5 docs-blog-blocks, 1 docs-blog-chrome, 2 docs-blog-shells, 2 scheduling-sections, 5 scheduling-blocks, 3 signal-collectors-sections, 8 signal-collectors-blocks, 2 commerce-sections, 12 commerce-blocks, 1 commerce-panels. 301 distinct names: `SchedulerEmbed`, `Separator`, `Tabs` exist in more than one tier as genuinely different components, listed once per tier with its own source path.
+Inventory: **307 component files** across 16 tiers — 55 sections, 99 blocks, 18 chrome, 79 primitives, 6 panels, 6 shells, 5 docs-blog-blocks, 1 docs-blog-chrome, 2 docs-blog-shells, 2 scheduling-sections, 5 scheduling-blocks, 5 signal-collectors-sections, 9 signal-collectors-blocks, 2 commerce-sections, 12 commerce-blocks, 1 commerce-panels. 304 distinct names: `SchedulerEmbed`, `Separator`, `Tabs` exist in more than one tier as genuinely different components, listed once per tier with its own source path.
 
-Description coverage: **300/304** components carry a capability description derived from source — 44 from the section registry's hand-authored when-to-use text, 225 from the component's own doc-comment header, 31 from its tier barrel's roster line. **4** have none; they are listed under [Undescribed components](#undescribed-components) rather than given a sentence invented from their name.
+Description coverage: **303/307** components carry a capability description derived from source — 44 from the section registry's hand-authored when-to-use text, 228 from the component's own doc-comment header, 31 from its tier barrel's roster line. **4** have none; they are listed under [Undescribed components](#undescribed-components) rather than given a sentence invented from their name.
 
-Of those, **269** are *strong* — a capability sentence you could match a requirement against — and **31** are *weak*: either one short clause, or a long one that spends itself on wiring (client boundaries, class names, which primitives it composes) instead of on what the thing is for. Weak rows are marked `(weak)` and listed in full under [Weak descriptions](#weak-descriptions). Coverage is 99%, but **findable-without-luck coverage is 88%**.
+Of those, **272** are *strong* — a capability sentence you could match a requirement against — and **31** are *weak*: either one short clause, or a long one that spends itself on wiring (client boundaries, class names, which primitives it composes) instead of on what the thing is for. Weak rows are marked `(weak)` and listed in full under [Weak descriptions](#weak-descriptions). Coverage is 99%, but **findable-without-luck coverage is 89%**.
 
-Per tier, strong out of total: **Sections** 54/55 · **Blocks** 93/99 · **Chrome** 10/18 · **Primitives** 64/79 (4 undescribed) · **Panels** 5/6 · **Shells** 5/6 · **Docs + Blog Blocks** 5/5 · **Docs + Blog Chrome** 1/1 · **Docs + Blog Shells** 0/2 · **Scheduling Sections** 2/2 · **Scheduling Blocks** 5/5 · **Signal-Collectors Sections** 3/3 · **Signal-Collectors Blocks** 7/8 · **Commerce Sections** 2/2 · **Commerce Blocks** 12/12 · **Commerce Panels** 1/1. A tier low on this line is a tier where a capability search is most likely to come up empty on something that exists.
+Per tier, strong out of total: **Sections** 54/55 · **Blocks** 93/99 · **Chrome** 10/18 · **Primitives** 64/79 (4 undescribed) · **Panels** 5/6 · **Shells** 5/6 · **Docs + Blog Blocks** 5/5 · **Docs + Blog Chrome** 1/1 · **Docs + Blog Shells** 0/2 · **Scheduling Sections** 2/2 · **Scheduling Blocks** 5/5 · **Signal-Collectors Sections** 5/5 · **Signal-Collectors Blocks** 8/9 · **Commerce Sections** 2/2 · **Commerce Blocks** 12/12 · **Commerce Panels** 1/1. A tier low on this line is a tier where a capability search is most likely to come up empty on something that exists.
 
 That grade is **mechanical**. It counts what it can measure — how much a description adds beyond the component's own name, how much of it is spent on wiring, whether the extraction came out damaged — and it cannot tell a fluent paragraph about the wrong subject from a useful one. A person reading these tables will find more rows unusable than the weak count admits. Treat it as a floor on the problem, not a measurement of it, and read the source before concluding a capability is absent.
 
@@ -452,7 +452,7 @@ Import: `import { X } from "@working-theory/ui-scheduling";` (or from the `@work
 
 ---
 
-## Signal-Collectors Sections (3)
+## Signal-Collectors Sections (5)
 
 Paid — delivered by the `signal-collectors` module bundle, not present in a Free scaffold. Multi-step flow and listing surfaces — the page-level bands a signal-collection route is assembled from.
 
@@ -462,11 +462,13 @@ Import: `import { X } from "@working-theory/ui-signal-collectors";` (or from the
 | --- | --- | --- |
 | `FlowStepper` | Rendering a served flow config as a real multi-step form. | `import { FlowStepper } from "@working-theory/ui-signal-collectors"` |
 | `ListingApplicationFlow` | This is the thing a consuming site mounts INSTEAD of hand-writing three proxy routes, a save-on-advance form, and a decision about where a bearer token lives. | `import { ListingApplicationFlow } from "@working-theory/ui-signal-collectors"` |
+| `ListingDetail` | One accepted entry's own page: its name as the page's `<h1>`, its summary, its own link, and its PROFILE — the applicant's answers to the listicle's Application fields, as label · value in the wizard's order. The profile is built and filtered server-side (`listingProfile`); this component renders what it is handed, in order, and nothing else. | `import { ListingDetail } from "@working-theory/ui-signal-collectors"` |
+| `ListingShelves` | A listicle's accepted entries on its landing page, as two shelves partitioned from ONE list: `status === "active"` on one, `"closed"` on the other. `closed` is computed by the API from the window end; this component only reads it. Featured entries lead the active shelf (stable sort, so the API's order otherwise survives). | `import { ListingShelves } from "@working-theory/ui-signal-collectors"` |
 | `ProjectListingShelves` | Two shelves of ProjectListingCards partitioned from ONE list of public listing rows: `status === "active"` on one shelf, `status === "closed"` on the other. `closed` is COMPUTED by the API read (the window-end check lives server-side, / D6b) — this component never recomputes it, it only reads the field. | `import { ProjectListingShelves } from "@working-theory/ui-signal-collectors"` |
 
 ---
 
-## Signal-Collectors Blocks (8)
+## Signal-Collectors Blocks (9)
 
 Paid — delivered by the `signal-collectors` module bundle, not present in a Free scaffold. Flow step, listing card, response chart and results-reveal tiles the sections above compose.
 
@@ -475,6 +477,7 @@ Import: `import { X } from "@working-theory/ui-signal-collectors";` (or from the
 | Component | What it does | How to use it |
 | --- | --- | --- |
 | `FlowSidePanel` | The per-view side panel of the flow/recommender surface. ONE CHASSIS, THREE VIEWS. | `import { FlowSidePanel } from "@working-theory/ui-signal-collectors"` |
+| `ListingCard` | The tile for one accepted entry of a listicle's directory. Generic by name and by shape: it reads the directory's `ListingEntryPublic` — name, summary, featured flag, waitlist count — and none of the project-shaped columns `ProjectListingCard` renders. The whole tile is one anchor, composed from `Link` directly (the LinkCard precedent: Card renders a <div>). | `import { ListingCard } from "@working-theory/ui-signal-collectors"` |
 | `ListingFullPreview` | The full-page-preview `custom` step renderer. The founder's assembled application, rendered as a page, with an edit link back to the step that owns each rendered part. Purely presentational: every entry's label and formatted value arrive pre-built on `entries` (this block does no formatting of its own), and `onEdit` is the only way it ever changes anything — it never mutates, saves, or fetches. | internal — compose from `packages-paid/ui-signal-collectors/src/blocks/ListingFullPreview.tsx` |
 | `ListingPrivacyNotice` | The per-listing privacy notice. It names the FOUNDER — not the platform — as the party collecting a visitor's personal data, and it renders ON THE FLOW (where a visitor submits answers), not on the listing page. | `import { ListingPrivacyNotice } from "@working-theory/ui-signal-collectors"` |
 | `ListingQuestionReview` | The edit-only question-review `custom` step renderer. The founder is refining a diagnostic template the SITE authored, not composing one from nothing (`projectListingQuestionsSchema`, `packages/validation/src/schemas/project-listings.ts`). | internal — compose from `packages-paid/ui-signal-collectors/src/blocks/ListingQuestionReview.tsx` |

package/dist/add-module.js

@@ -34,6 +34,7 @@ import { LEGACY_NAV_RENDERERS } from "./legacy-nav-renderers.js";
 import { writeAuthSecretFile } from "./lib/auth-secret-file.js";
 import { diffTwoStrings, extractModuleBundle, } from "./lib/extract-module-bundle.js";
 import { normalizeModules } from "./module-architecture.js";
+import { PAID_SECTIONS_PATH, writePaidSections } from "./paid-sections.js";
 import { ParseError, parseModules } from "./parse-args.js";
 import { SITE_ROSTER_PATH, moduleRosterRows, planRosterAppend, readSiteRoster, siteRosterProblems, } from "./site-roster.js";
 import { MODULE_SURFACES, NAV_CONFIG_PATH, readNavConfigStamp, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
@@ -126,7 +127,19 @@ export async function applyModuleToScaffold(opts) {
     // The same composition `syncArchitectureSync` writes — a pure function of
     // the module set, so an unchanged set rewrites identical bytes.
     writeFileSync(archPath, deriveArchitecture(modules, surfaces));
+    // #7536 D3 — the paid-sections registry follows `apps/web/package.json`,
+    // which the bundle's `patches` just edited. Generated and always
+    // overwritten, like `architecture.yaml` above.
+    const registryPath = join(targetAbs, PAID_SECTIONS_PATH);
+    const registryBefore = existsSync(registryPath)
+        ? readFileSync(registryPath, "utf8")
+        : undefined;
+    writePaidSections(targetAbs);
+    const registryChanged = existsSync(registryPath) &&
+        readFileSync(registryPath, "utf8") !== registryBefore;
     const rows = [...report];
+    if (registryChanged)
+        rows.push({ path: PAID_SECTIONS_PATH, action: "written" });
     const navRow = syncNavConfig(targetAbs, current.surfaces, surfaces);
     if (navRow !== undefined)
         rows.push(navRow);

package/dist/module-architecture.d.ts

@@ -83,6 +83,14 @@ export interface PageRosterRow {
  * scaffold carries (#6940).
  */
 export interface ModuleSlice {
+    /**
+     * The paid UI package base-tree code loads through
+     * `apps/web/lib/paid-sections.generated.ts` (#7536). Present → one row in the
+     * generated registry: a bundled `import()` when the scaffold's
+     * `apps/web/package.json` declares the package, a stub answering `null`
+     * otherwise. Only a module with a BASE-tree consumer sets it.
+     */
+    paidSectionsPackage?: string;
     /** Packages this module adds to apps/web.may_import_from (its presentation surface). */
     webImports?: string[];
     /** Apps this module declares (api, mcp replace the base block; admin is new). web is BASE, never here. */

package/dist/module-architecture.js

@@ -790,6 +790,13 @@ export const MODULE_SLICES = {
             // deliverable by BOTH bundles.
             "apps/api/src/services/inbox-messages.ts",
             "apps/api/src/routes/workspaces/messages.ts",
+            // #7535 — the Inbox submissions and subscribers reads: the same
+            // workspace||multi-tenant gate and the same tenant-db.ts import as
+            // the two lines above, so co-owned with `workspace` for the same
+            // reason (see that slice's entry below).
+            "apps/api/src/routes/workspaces/submissions.ts",
+            "apps/api/src/routes/workspaces/subscribers.ts",
+            "apps/api/src/services/inbox-submissions.ts",
             // #7399 — the two siblings #6216 left `workspace`-only. They register
             // under that same `workspace || multi-tenant` gate, so a scaffold with
             // `multi-tenant` and without `workspace` loaded them with no file behind
@@ -910,6 +917,11 @@ export const MODULE_SLICES = {
             // bundle alone.
             "apps/api/src/routes/workspaces/messages.ts",
             "apps/api/src/services/inbox-messages.ts",
+            // Co-owned with `multi-tenant` (#7535), for the reason the two
+            // message lines above carry.
+            "apps/api/src/routes/workspaces/submissions.ts",
+            "apps/api/src/routes/workspaces/subscribers.ts",
+            "apps/api/src/services/inbox-submissions.ts",
             // Co-owned with `multi-tenant` (#5853) — see that slice's entry.
             "apps/api/src/routes/workspaces/content.ts",
             ...ASSET_STORE_FILES,
@@ -1143,6 +1155,9 @@ export const MODULE_SLICES = {
             "apps/api/src/lib/public-meetings-config.ts",
             "apps/api/src/routes/schedule/meeting-types.ts",
             "apps/api/src/routes/schedule/__tests__/meeting-types.test.ts",
+            // #7532 — a hub spoke's meeting types and booking, through the real
+            // scheduling routes; it ships and strips with them.
+            "apps/api/src/routes/schedule/__tests__/spoke.test.ts",
             // meetings.ts is the FIRST scheduling-gated route to use the generic
             // tenantDb() scope layer directly (its sibling, appointments.ts, does
             // its own scoped read in services/scheduling/appointments.ts instead)
@@ -1153,6 +1168,22 @@ export const MODULE_SLICES = {
             // records: "each tenancy slice must deliver it").
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/services/tenant-context.ts",
+            // #7533 — a scheduling connection per workspace. `connections.ts` (the
+            // cipher + the one SchedulingConnection data-access boundary) and
+            // `resolve.ts` (the workspace-aware provider resolution the meetings,
+            // schedule and webhook routes above now call), plus each new suite,
+            // individually (§ D12, property 1: a glob ships no test). The config
+            // suite is listed here although `config/index.ts` itself stays base:
+            // it tests a scheduling-only variable, so a keyless scaffold carries
+            // neither the variable's purpose nor its test.
+            "apps/api/src/services/scheduling/connections.ts",
+            "apps/api/src/services/scheduling/resolve.ts",
+            "apps/api/src/services/scheduling/__tests__/connections.test.ts",
+            "apps/api/src/services/scheduling/__tests__/provider-resolution.test.ts",
+            "apps/api/src/routes/workspaces/__tests__/meetings-connection.test.ts",
+            "apps/api/src/routes/schedule/__tests__/public-connection.test.ts",
+            "apps/api/src/routes/webhooks/__tests__/calcom-connection.test.ts",
+            "apps/api/src/config/__tests__/scheduling-credential-key.test.ts",
         ],
         // pageContributions (spec 5478; parent § D6 shape 1) — the booker, the
         // per-booking-type page and the confirmation page, whose route files
@@ -1285,6 +1316,7 @@ export const MODULE_SLICES = {
     // cannot place an unreached file either) is unchanged and still governs
     // where all eleven live.
     "signal-collectors": {
+        paidSectionsPackage: "@working-theory/ui-signal-collectors",
         ownedFiles: [
             "apps/api/src/routes/flows/index.ts",
             // README.md documents the flows rate-limit rationale (#4730) — not a
@@ -1590,6 +1622,7 @@ export const MODULE_SLICES = {
     // `lib/stripe.ts` and the webhook receiver this module owns — declared
     // here, not engineered around.
     commerce: {
+        paidSectionsPackage: "@working-theory/ui-commerce",
         apps: {
             api: {
                 path: "apps/api",

package/dist/paid-sections.d.ts

@@ -0,0 +1,23 @@
+/** Scaffold-relative path of the generated registry. */
+export declare const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
+export interface PaidSectionRow {
+    module: string;
+    package: string;
+    loader: string;
+    contract: string;
+}
+/** One row per slice declaring `paidSectionsPackage`, in `RECOGNIZED_MODULES` order. */
+export declare function paidSectionRows(): PaidSectionRow[];
+/**
+ * Render the registry. `present` holds the package names whose row is a
+ * bundled `import()`; every other row is a stub. Pure and order-independent.
+ * Line 1 is `// oss: false` exactly when a row imports a paid package, so the
+ * public strip drops the file (\`check-oss-strip.sh\` condition (e)).
+ */
+export declare function renderPaidSections(present: ReadonlySet<string>): string;
+/**
+ * Write the registry into a scaffold, deriving presence from the scaffold's
+ * own `apps/web/package.json`. Returns `false` (writing nothing) when that
+ * file or `apps/web/lib/` is absent — a scaffold with no web app.
+ */
+export declare function writePaidSections(targetDir: string): boolean;

package/dist/paid-sections.js

@@ -0,0 +1,119 @@
+/**
+ * The paid-sections registry (#7536) — `apps/web/lib/paid-sections.generated.ts`,
+ * the one file through which base-tree code reaches a paid UI package.
+ *
+ * Base code used to load `@working-theory/ui-commerce` with a
+ * `webpackIgnore`d `import()`, which hands resolution to Node's ESM loader at
+ * request time. That loader cannot read our `dist`, so the load failed and the
+ * `catch` answered `false`: the feature rendered nothing in production. This
+ * file owns the optionality at scaffold time instead. A package the scaffold
+ * carries is a plain `import()` webpack bundles; one it does not carry is a
+ * typed stub that answers `null`.
+ *
+ * Rows come from `MODULE_SLICES` (`paidSectionsPackage`); presence comes from
+ * the scaffold's own `apps/web/package.json` `dependencies`, the one fact
+ * every layer (snapshot transform, module `patches`, `add-module`) already
+ * keeps true. The monorepo's committed copy is the render with every row
+ * present and is pinned byte-equal by `__tests__/paid-sections.test.ts`.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { MODULE_SLICES } from "./module-architecture.js";
+import { RECOGNIZED_MODULES } from "./parse-args.js";
+/** Scaffold-relative path of the generated registry. */
+export const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
+function pascalCase(shortName) {
+    return shortName
+        .split("-")
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join("");
+}
+/** One row per slice declaring `paidSectionsPackage`, in `RECOGNIZED_MODULES` order. */
+export function paidSectionRows() {
+    const rows = [];
+    for (const name of RECOGNIZED_MODULES) {
+        const pkg = MODULE_SLICES[name].paidSectionsPackage;
+        if (pkg === undefined)
+            continue;
+        const pascal = pascalCase(pkg.slice(pkg.indexOf("/") + 1));
+        rows.push({
+            module: name,
+            package: pkg,
+            loader: `load${pascal}`,
+            contract: `${pascal}Contract`,
+        });
+    }
+    return rows;
+}
+const HEADER = `// paid-sections.generated.ts — the paid section packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (\`paidSectionsPackage\`) and
+// this app's package.json dependencies (#7536). Do not edit: every scaffold
+// and \`create-ailk add-module\` rewrites it. A carried package is a bundled
+// dynamic import; one this site does not carry is a stub that answers null.
+`;
+/**
+ * Render the registry. `present` holds the package names whose row is a
+ * bundled `import()`; every other row is a stub. Pure and order-independent.
+ * Line 1 is `// oss: false` exactly when a row imports a paid package, so the
+ * public strip drops the file (\`check-oss-strip.sh\` condition (e)).
+ */
+export function renderPaidSections(present) {
+    const rows = paidSectionRows();
+    const contracts = rows.map((row) => row.contract).sort();
+    const anyPresent = rows.some((row) => present.has(row.package));
+    const lines = [];
+    if (anyPresent)
+        lines.push("// oss: false");
+    lines.push(HEADER.trimEnd());
+    lines.push("import type {");
+    for (const contract of contracts)
+        lines.push(`  ${contract},`);
+    lines.push('} from "./paid-section-contracts";');
+    for (const row of rows) {
+        lines.push("");
+        const type = `Promise<${row.contract} | null>`;
+        // Shaped as Prettier formats it, so the committed copy survives the
+        // repo's format hook byte-for-byte.
+        if (present.has(row.package)) {
+            const head = `export const ${row.loader} = (): ${type} =>`;
+            const body = `import("${row.package}");`;
+            lines.push(head.length <= 80
+                ? `${head}\n  ${body}`
+                : `export const ${row.loader} =\n  (): ${type} =>\n    ${body}`);
+        }
+        else {
+            const head = `export const ${row.loader} = async (): ${type} =>`;
+            lines.push(`${head} null;`.length <= 80
+                ? `${head} null;`
+                : head.length <= 80
+                    ? `${head}\n  null;`
+                    : `export const ${row.loader} =\n  async (): ${type} => null;`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Write the registry into a scaffold, deriving presence from the scaffold's
+ * own `apps/web/package.json`. Returns `false` (writing nothing) when that
+ * file or `apps/web/lib/` is absent — a scaffold with no web app.
+ */
+export function writePaidSections(targetDir) {
+    const pkgPath = join(targetDir, "apps/web/package.json");
+    if (!existsSync(pkgPath) || !existsSync(join(targetDir, "apps/web/lib"))) {
+        return false;
+    }
+    let pkg;
+    try {
+        pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    }
+    catch (err) {
+        throw new Error(`cannot read ${pkgPath} to write the paid-sections registry: ${err.message}`, { cause: err });
+    }
+    const deps = pkg.dependencies ?? {};
+    const present = new Set(paidSectionRows()
+        .map((row) => row.package)
+        .filter((name) => Object.hasOwn(deps, name)));
+    writeFileSync(join(targetDir, PAID_SECTIONS_PATH), renderPaidSections(present));
+    return true;
+}

package/dist/programmatic.js

@@ -34,6 +34,7 @@ import { assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-
 import { assertDesignAllowed, assertReleased, deriveLevel, resolveModuleSet, resolvePaidModules, } from "./lib/module-license-gate.js";
 import { classifyModules } from "./lib/module-tier.js";
 import { normalizeModules } from "./module-architecture.js";
+import { writePaidSections } from "./paid-sections.js";
 import { RECOGNIZED_SHAPES, RESERVED_SHAPES, } from "./parse-args.js";
 import { SITE_CHROME_PATH, renderSiteChrome, resolveSiteChrome, } from "./site-chrome.js";
 import { planSiteManifest } from "./site-manifest.js";
@@ -176,6 +177,10 @@ export function scaffoldSync(opts) {
     // synchronous caller) writes DEFAULT_SITE_CHROME, byte-identical to the
     // monorepo's own committed apps/web/lib/site-chrome.ts.
     writeFileSync(join(targetAbs, SITE_CHROME_PATH), renderSiteChrome(resolveSiteChrome(opts.layout, opts.designLayout)));
+    // The paid-sections registry (#7536), from this scaffold's own
+    // `apps/web/package.json` — on the keyless snapshot, the all-stub render.
+    // `scaffold()` writes it again once every layer has landed.
+    writePaidSections(targetAbs);
     // Opt-in only (#4636). Every write above this line is unconditional, so a
     // scaffold with `withCatalog` unset touches exactly the files it did before.
     if (opts.withCatalog === true)
@@ -653,6 +658,9 @@ export async function scaffold(opts) {
             }));
         }
     }
+    // #7536 D3 — the registry follows `apps/web/package.json`, which a module
+    // bundle's `patches` (and the template layer) just finished editing.
+    writePaidSections(result.targetDir);
     // #6107 D2 — after every layer landed, so nothing later overwrites it: a
     // served scaffold needs BETTER_AUTH_SECRET (#6044), and this is its value.
     writeAuthSecretFile(result.targetDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.11.5",
+  "version": "0.12.1",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,8 +27,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.33.0",
-    "@working-theory/templates": "0.33.0"
+    "@working-theory/schema": "0.34.1",
+    "@working-theory/templates": "0.34.1"
   },
   "repository": {
     "type": "git",

package/templates/.env.example

@@ -85,7 +85,9 @@ CONTENT_ADAPTER=mdx
 # ── Single-tenant operator pin (apps/api) ────────────────────────────────────
 # REQUIRED on a build WITHOUT the multi-tenant module — for the submissions
 # review dashboard AND for the `workspace` module's settings surface.
-# OPTIONAL with the multi-tenant module.
+# REQUIRED with the multi-tenant module too, on a deployment that has exactly
+# one workspace (the seeded default) — see "With the multi-tenant module"
+# below (#7523).
 #
 # On a single-tenant deployment (the default Workspace exists and is the ONLY
 # Workspace) the FIRST authenticated user to resolve a tenant context is
@@ -111,8 +113,35 @@ CONTENT_ADAPTER=mdx
 # to its owner.
 #
 # If your own dashboard returns 403, this variable is the first thing to
-# check. With the multi-tenant module present, resolution comes from the
-# session's active workspace and this stays optional, exactly as before.
+# check.
+#
+# With the multi-tenant module (#7523): a session that has activated a
+# workspace (every Admin-app request) resolves from that workspace and its
+# Membership, unchanged. A session with NO active workspace — every apps/web
+# request, including the /admin* and /waitlist* pages — is granted the
+# default workspace only when this pin is set, the caller's VERIFIED email
+# equals it, and the deployment has exactly one workspace. Unset, apps/api
+# seats nobody: those requests answer 403 and no Membership is written. Every
+# default-organization member other than the pinned operator reaches their
+# workspace through the Admin app instead.
+#
+# The every-site waitlist read (kind: "all" on /v1/waitlist-experiments/*)
+# needs the caller to BE this pin — a sentinel-organization owner whose
+# verified email is this address. Holding an owner Membership on the default
+# organization is not enough on its own.
+#
+# If a one-workspace multi-tenant deployment EVER ran with this unset, the
+# first signed-in caller may already hold the owner Membership, and this fix
+# does not revoke a Membership minted earlier. Check, on the database:
+#   1. every Membership on organization
+#      org_00000000-0000-7000-8000-000000000001 — start with id
+#      member_00000000-0000-7000-8000-000000000001 (the operator Membership) —
+#      and every pending Invitation on it;
+#   2. every Workspace other than wksp_00000000-0000-7000-8000-000000000001
+#      (one extra workspace also stops the real operator binding through the
+#      fallback);
+#   3. delete whatever does not belong to the pinned operator or someone they
+#      invited.
 # AILK_OPERATOR_EMAIL=
 #
 # ── Site id (apps/api, apps/web) ─────────────────────────────────────────────
@@ -399,8 +428,14 @@ CONTENT_ADAPTER=mdx
 # Server-side only — read inside apps/api, never exposed to the browser.
 # Unset is a supported state: the booker degrades to the provider's own
 # booking page. Full notes in apps/api/.env.example.
+# CAL_API_KEY is the deployment's account; it serves a workspace only on a
+# one-workspace deployment — each workspace can connect its own (#7533).
 # CAL_API_KEY=cal_live_xxx
 # CAL_API_BASE_URL=https://api.cal.com
+# The key per-workspace connections are encrypted under (#7533): exactly 32
+# random bytes, `openssl rand -base64 32`. Unset = connections cannot be
+# written; any other shape stops the API. Losing it unreads every connection.
+# SCHEDULING_CREDENTIAL_KEY=
 # HMAC-SHA256 key POST /v1/webhooks/calcom verifies the x-cal-signature-256
 # header against (#6085). Unset makes the receiver answer 503 and accept
 # nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
@@ -472,12 +507,43 @@ CONTENT_ADAPTER=mdx
 # AILK_RATE_LIMIT_LEADS_PER_MINUTE=10
 # AILK_RATE_LIMIT_LEADS_PER_KEY_PER_MINUTE=300
 #
+# HUB (apps/api). The listicle directory read's per-IP limit per minute
+# (#7521) — its own scope, not the leads one, because the web server renders
+# it from one egress address. A whole number from 1 to 999999. Default: 120.
+# AILK_RATE_LIMIT_DIRECTORY_PER_MINUTE=120
+#
 # SPOKE (apps/web, server-only — never NEXT_PUBLIC_). This spoke's key: one
 # entry of the hub's AILK_VISITOR_FORWARD_KEYS. Sent only when AILK_API_URL
 # is https (or loopback). Issue a key only to a spoke whose platform
 # overwrites x-forwarded-for / x-real-ip with the real client address.
 # AILK_VISITOR_FORWARD_KEY=
 #
+# Hub and spokes — a spoke's reads and writes resolve to ITS OWN workspace
+# (#7532). A hub holding one workspace per spoke registers each spoke in its
+# database (`pnpm --filter @working-theory/api spokes register --workspace
+# <wksp_id> --name <label>`), which prints the spoke's key once. The spoke
+# sends it on every server-side call, and the hub resolves meeting types, the
+# three lead writes, bookings and public content reads to that spoke's
+# workspace. Runbook: docs/runbooks/site-configuration.md § Hub and spokes:
+# registering a spoke. Both unset = the behaviour before #7532.
+#
+# HUB (apps/api). `true` (or `1`) refuses every header-less call to those
+# surfaces: no key, no workspace. Unset, empty, `false` or `0` = off; any
+# other value stops the API at boot, and so does `true` with no DATABASE_URL.
+# Do NOT turn it on while a spoke still renders the browser booker section,
+# NewsletterFormInline or StepFlow — those post from the BROWSER, which holds
+# no key. Register every caller first, the hub's own apps/web and apps/mcp
+# included. On a hub, AILK_SITE_ID must name the PLATFORM OPERATOR's own
+# workspace, never a spoke's: it is where every header-less lead and every
+# booking no spoke bound lands.
+# AILK_HUB_REQUIRE_SPOKE_KEY=
+#
+# SPOKE (apps/web and apps/mcp, server-only — never NEXT_PUBLIC_). The key the
+# hub's `spokes register` printed. Sent as `x-ailk-spoke-key` on every
+# server-side call to AILK_API_URL, and only when that is https (or
+# loopback). Not the same value as AILK_VISITOR_FORWARD_KEY above.
+# AILK_SPOKE_KEY=
+#
 # NEXT_PUBLIC_ENABLED_LOCALES — do NOT set by hand. Baked at build time by
 # apps/web/next.config.mjs from project.yaml `product.locales` (falls back to
 # "en" when project.yaml is absent) and read by middleware.ts, the sitemap

package/templates/apps/api/.env.example

@@ -56,6 +56,13 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # Unset CAL_API_KEY is a supported state, not a broken one — the routes answer
 # 503 not_configured with the provider's public booking page, and the section
 # renders a link out to it rather than an error.
+#
+# CAL_API_KEY is the DEPLOYMENT's account. Since #7533 each workspace can hold
+# its own connection (PUT /v1/workspaces/:workspaceId/meetings/connection),
+# and a workspace's connection always wins. CAL_API_KEY serves a workspace
+# only on a one-workspace deployment (its sole workspace the seeded default,
+# as on every single-tenant scaffold); on a deployment with two or more
+# workspaces, a workspace with no connection answers not_configured.
 # CAL_API_KEY=cal_live_xxx
 # Self-hosted Cal instances only; defaults to https://api.cal.com.
 # CAL_API_BASE_URL=https://api.cal.com
@@ -65,12 +72,27 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # (#4288) lands as a second value here with no change to the section.
 # SCHEDULING_PROVIDER=cal
 #
+# Per-workspace scheduling connections (#7533) — the AES-256-GCM key each
+# workspace's provider credential and webhook secret are encrypted under.
+# Exactly 32 random bytes in canonical standard base64:
+#   openssl rand -base64 32
+# Any other value stops the API at startup. Unset means connections cannot be
+# written (PUT answers 503 credential_key_not_configured) and CAL_API_KEY works
+# exactly as before. LOSING OR CHANGING THIS KEY makes every stored connection
+# unreadable: each workspace must then reconnect. Never log or share it.
+# SCHEDULING_CREDENTIAL_KEY=
+#
 # The booking webhook receiver (#6085) — a SEPARATE credential from the
 # three above: it verifies POST /v1/webhooks/calcom's x-cal-signature-256
 # header, it does not call the provider. Unset makes the receiver answer 503
 # and accept nothing (the same fail-closed posture STRIPE_WEBHOOK_SECRET
 # unset already has) — every booking is then silently lost, so this must be
 # set for the receiver to do anything.
+# It verifies only the ENV account's receiver, whose bookings land in the
+# AILK_SITE_ID workspace. A workspace's own connection has its own entry point
+# (POST /v1/webhooks/calcom/<token>) and its own secret, both returned once by
+# the connect PUT (#7533). On a hub whose spokes all have connections, unset
+# this to retire the env receiver (it then answers 503).
 # CAL_WEBHOOK_SECRET=
 # GET /v1/schedule/appointments only returns rows where this deployment's
 # AILK_SITE_ID (declared below, under "Project listings — site addressing")