create-ailk 0.11.5 → 0.12.1

package/templates/apps/web/src/lib/commerce-sections.ts

@@ -1,92 +1,54 @@
+// oss: false
+import { loadUiCommerce } from "../../lib/paid-sections.generated";
+
 /**
- * Lazily registers the paid `@working-theory/ui-commerce` slice's sections
- * (`payment-receipt`) — never a static top-level import (#6084, code-review
- * finding on this issue's PR).
+ * Registers the paid `@working-theory/ui-commerce` slice's sections
+ * (`payment-receipt`) once per process, through the generated paid-sections
+ * registry (#6084, #7536).
  *
  * `/purchase/success` and `/purchase/cancel` ship in the BASE TREE
  * (`surfaces.ts` `CORE_ROUTE_DIRS`, D12) so a site that buys the `commerce`
- * add-on after its last deploy gets working return pages without a
- * redeploy. But a KEYLESS scaffold carries NO `ui-commerce` dependency by
- * design — `packages/create-ailk/scripts/build-templates.mjs`'s
- * `transformPaidUiPackages()` strips it from a keyless `apps/web/package.json`,
- * and `__tests__/paid-module-honest-states.test.ts`'s "#5581 U6" suite
- * asserts a keyless scaffold declares NONE of the four paid `ui-*` packages
- * as a dependency. A plain top-level, STATIC named-import of that package's
- * `registerCommerceSections` export would leave every keyless customer's
- * build failing with `ERR_MODULE_NOT_FOUND` — webpack resolves a static
- * import at BUILD time regardless of whether the code path importing it
- * ever executes at runtime, so gating the CALL at request time (as
- * `resolveCommerceClaim()` already does) is not enough on its own.
+ * add-on after its last deploy gets working return pages without a redeploy.
+ * This file stays in the base tree for the same reason (#6084 D12, disposed
+ * again on #6440): slicing it out would take the return pages with it.
  *
- * The `webpackIgnore` magic comment tells webpack to leave this `import()`
- * unresolved at build time; Node's own ESM loader then attempts it at
- * RUNTIME, where a keyless deployment's absent package throws a genuine
- * (caught) resolution error instead of a build failure. This repo's `dev`
- * and `build` scripts both force `--webpack` (never Turbopack, which does
- * not honor this comment), so the magic comment is reliably honored here.
+ * Whether the paid package is carried is decided at SCAFFOLD time, not here.
+ * `create-ailk` writes `apps/web/lib/paid-sections.generated.ts` from this
+ * app's `package.json`: a carried package is a plain `import()` that webpack
+ * bundles, and an absent one is a stub that answers `null`. So a KEYLESS build
+ * type-checks and builds with no paid package anywhere in its import graph, and
+ * `loadUiCommerce()` answers `null` there. The earlier runtime-loaded import
+ * handed resolution to Node's ESM loader, which cannot read our `dist` and
+ * answered `false` in production (#7536).
  *
  * On success, the real `payment-receipt` renderer is registered and the
- * caller may build a `payment-receipt` section as usual. On failure (the
- * package genuinely is not installed), the caller MUST NOT construct a bare
- * `payment-receipt` section anyway — `SectionRenderer`'s dispatch table
- * falls back to `ModuleAbsent`, which renders `null` in production
+ * caller may build a `payment-receipt` section as usual. On `false` (the
+ * package is not carried), the caller MUST NOT construct a bare
+ * `payment-receipt` section anyway — `SectionRenderer`'s dispatch table falls
+ * back to `ModuleAbsent`, which renders `null` in production
  * (`packages/ui/src/sections/ModuleAbsent.tsx`) — silently dropping the
  * title/message/status that is this page's entire point. The caller must
  * build an OSS `content-block` fallback carrying the same copy instead.
  *
+ * A package that IS carried but whose import rejects is a broken deploy: the
+ * rejection propagates and the page errors, never degrading to `false`. Only
+ * absence degrades, and only a stub produces it.
+ *
  * Registered (or found absent) once per process — memoised, so a concurrent
- * request never double-registers or double-attempts a failed resolution.
- * This is a build-presence fact, not the license claim itself (which
- * `resolveCommerceClaim()` deliberately re-checks every request); a
- * process only changes which packages are on disk via a fresh deploy, which
- * is a fresh process.
+ * request never double-registers. A rejected registration stays memoised: a
+ * process cannot recover from a bundled chunk that fails. This is a
+ * build-presence fact, not the license claim itself (which
+ * `resolveCommerceClaim()` deliberately re-checks every request).
  */
 let registration: Promise<boolean> | undefined;
 
-/**
- * The paid package's specifier, held in a CONST rather than written inline at
- * the `import()` call (#6440 AC2).
- *
- * `webpackIgnore` defers only WEBPACK's resolution; `tsc` resolves a dynamic
- * `import()` whose argument is a string LITERAL exactly as eagerly as a static
- * one, so the literal form failed a keyless scaffold's type-check with TS2307
- * "Cannot find module '@working-theory/ui-commerce'" — the build error #6440
- * was filed for. This monorepo never saw it: `packages-paid/ui-commerce` is on
- * disk here and `apps/web/package.json` declares it `workspace:*`, so the
- * specifier resolves and the defect is reachable only from a scaffold.
- *
- * A non-literal specifier is the whole fix. `tsc` does not attempt module
- * resolution on an `import()` it cannot constant-fold, so the paid package's
- * ABSENCE stops being a type error — while webpack still honours the magic
- * comment beside it and Node still performs the real resolution at runtime,
- * leaving the `catch` below as the one and only thing that observes whether
- * the package is installed. The behaviour is unchanged in both directions:
- * a licensed deployment registers the sections; a keyless one returns false.
- *
- * The file deliberately stays in the BASE TREE rather than moving into the
- * commerce slice: `/purchase/success` and `/purchase/cancel` import it
- * statically, so slicing it out would take the return pages with it and
- * regress #6084 D12 (disposed again on #6440, 2026-09-22).
- */
-const COMMERCE_UI_PACKAGE = "@working-theory/ui-commerce";
-
-/** The one export this module needs from the paid package. */
-interface CommerceSectionsModule {
-  registerCommerceSections: () => void;
-}
-
 export function ensureCommerceSectionsRegistered(): Promise<boolean> {
   if (!registration) {
     registration = (async () => {
-      try {
-        const mod = (await import(
-          /* webpackIgnore: true */ COMMERCE_UI_PACKAGE
-        )) as CommerceSectionsModule;
-        mod.registerCommerceSections();
-        return true;
-      } catch {
-        return false;
-      }
+      const mod = await loadUiCommerce();
+      if (mod === null) return false;
+      mod.registerCommerceSections();
+      return true;
     })();
   }
   return registration;

package/templates/database/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @working-theory/database
 
+## 0.34.1
+
+### Patch Changes
+
+- [#7566](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7566) [`64a3245`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64a324556595861b42166a49d98a4c73cef5115a) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `build` runs `prisma generate` first and always re-emits `dist/client` ([#7565](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7565)), so a stale or skipped generated client can no longer be built into a release. Before this, `build` was `tsc -b` alone: it never regenerated the client, and `tsc -b` trusted `tsconfig.build.tsbuildinfo`, so `database@0.14.0` shipped without `FlowCheckout` and `database@0.34.0` without `Spoke`, `SchedulingConnection` and `AppointmentOrigin`. `db:generate` is now `pnpm run build`, so it still generates and builds, once.
+
+- Updated dependencies [[`4df3e2c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4df3e2cd0f4d22471f7422ada4018040ecca402b)]:
+  - @working-theory/ids@0.9.1
+  - @working-theory/validation@0.34.1
+
+## 0.34.0
+
+### Minor Changes
+
+- [#7544](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7544) [`aeefe93`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/aeefe93ea62d4b1c96da18f07b8a68674923e091) Thanks [@samuelhenry](https://github.com/samuelhenry)! - A hub API can register its spokes, and a spoke's public reads and writes resolve to its own workspace ([#7532](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7532)).
+
+  - `@working-theory/database`: two new tables. `spokes` (auth) binds one spoke to one workspace and stores the SHA-256 digest of its hub-minted key, never the key. `appointment_origins` (inbox) records which workspace a booking made through a spoke belongs to. Migration `20261003120000_spoke_registry` is purely additive.
+  - `@working-theory/ids`: two registered prefixes, `spoke` and `apptorg`.
+  - `@working-theory/api-client`: `get`, `post` and `patch` send `AILK_SPOKE_KEY` as `x-ailk-spoke-key` on server-side calls over `https:` or loopback only, and refuse to follow a redirect while they carry it. With the variable unset, every call is unchanged. `isSafeTransport`, `LOOPBACK_HOSTS` and `SAFE_HEADER_TOKEN` move from `leads.ts` into `http.ts`.
+
+- [#7547](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7547) [`d519d9f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d519d9ff7db3059375842d0729c482f94f74a13d) Thanks [@samuelhenry](https://github.com/samuelhenry)! - A scheduling connection per workspace ([#7533](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7533)): each workspace can read and receive bookings through its own scheduling provider account.
+
+  - **`@working-theory/database`** — new `SchedulingConnection` model (`scheduling_connections`, config namespace): one row per workspace holding the provider id, the credential and the webhook secret as AES-256-GCM ciphertext, an optional base URL and a unique webhook routing token. Migration `20261003130000_scheduling_connection`.
+  - **`@working-theory/ids`** — registers the `schconn` prefix for the new model.
+  - **`@working-theory/validation`** — `SchedulingProviderIdSchema` and the strict `SchedulingConnectionInputSchema` (`{ provider, apiKey, baseUrl? }`; the key is printable ASCII with no whitespace or control byte).
+  - **`@working-theory/admin`** — the Meetings "not connected" state gains a Connect form for owners, showing the webhook URL and one-time secret to paste into the provider.
+  - **`create-ailk`** — the `scheduling` slice carries the new connection and resolution files and their suites.
+
+### Patch Changes
+
+- Updated dependencies [[`84c8f52`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/84c8f5206f1393f079ae2e542f352c03c3605488), [`a83dca7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/a83dca7cb2d327f990e53154fcfca9be2268dc8a), [`aeefe93`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/aeefe93ea62d4b1c96da18f07b8a68674923e091), [`d519d9f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d519d9ff7db3059375842d0729c482f94f74a13d), [`8f835bb`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8f835bbc57059acfef157ffc60a5b250be6981e7)]:
+  - @working-theory/validation@0.34.0
+  - @working-theory/ids@0.9.0
+
 ## 0.33.0
 
 ### Patch Changes

package/templates/database/__tests__/build.test.ts

@@ -0,0 +1,131 @@
+/**
+ * @file build.test.ts
+ * @description The package `build` cannot emit a stale generated client
+ * (#7565). `build` used to be `tsc -b` alone: it never ran `prisma generate`,
+ * and `tsc -b` trusts `tsconfig.build.tsbuildinfo`, so a checkout whose
+ * generated client predated a schema change built — and reported as built —
+ * a dist missing the new models (database@0.14.0 shipped without
+ * FlowCheckout, database@0.34.0 without Spoke).
+ *
+ * The suite runs the package's REAL scripts and tsconfigs against a copy of
+ * the package in a temp dir, so it never touches this package's generated
+ * client or dist (the tenancy/flows configs still build `packages/ids` and
+ * `packages/validation` in place when those are stale, as any database build
+ * does). The copy keeps the real model-free `schema.prisma`
+ * (generator + datasource) and swaps the namespace schemas for one probe
+ * model, which keeps both builds to seconds. `node_modules` and the sibling
+ * `packages/` the tenancy/flows configs reference are symlinked in, and the
+ * root `tsconfig.base.json` is copied to where `extends` expects it.
+ */
+
+import { execFileSync } from "node:child_process";
+import {
+  cpSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PACKAGE_DIR = join(__dirname, "..");
+const REPO_ROOT = join(PACKAGE_DIR, "..");
+
+const PACKAGE_FILES = [
+  "package.json",
+  "prisma.config.ts",
+  "schema.prisma",
+  "tenancy.ts",
+  "tsconfig.build.json",
+  "tsconfig.tenancy.json",
+  "tsconfig.flows.json",
+];
+
+const BUILD_TIMEOUT_MS = 180_000;
+
+let root: string;
+let db: string;
+
+function run(script: string): void {
+  try {
+    execFileSync("pnpm", ["run", script], { cwd: db, stdio: "pipe" });
+  } catch (error) {
+    // tsc reports type errors on stdout, which execFileSync's message omits.
+    const { stdout } = error as { stdout?: Buffer };
+    throw new Error(`pnpm run ${script} failed:\n${stdout?.toString() ?? ""}`, {
+      cause: error,
+    });
+  }
+}
+
+function addModel(name: string): void {
+  writeFileSync(
+    join(db, `${name}.prisma`),
+    `model ${name} {\n  id String @id\n}\n`,
+  );
+}
+
+function emitted(file: string): string {
+  return readFileSync(join(db, "dist", "client", "internal", file), "utf8");
+}
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), "ailk-database-build-"));
+  db = join(root, "database");
+  cpSync(
+    join(REPO_ROOT, "tsconfig.base.json"),
+    join(root, "tsconfig.base.json"),
+  );
+  symlinkSync(join(REPO_ROOT, "packages"), join(root, "packages"), "dir");
+  for (const file of PACKAGE_FILES) {
+    cpSync(join(PACKAGE_DIR, file), join(db, file));
+  }
+  cpSync(join(PACKAGE_DIR, "flows"), join(db, "flows"), { recursive: true });
+  symlinkSync(
+    join(PACKAGE_DIR, "node_modules"),
+    join(db, "node_modules"),
+    "dir",
+  );
+
+  // The state every release that shipped a stale client started from: the
+  // client was generated and built once, and tsc -b recorded it as built.
+  addModel("BuildProbeAlpha");
+  run("db:generate");
+}, BUILD_TIMEOUT_MS);
+
+afterAll(() => {
+  if (root) rmSync(root, { recursive: true, force: true });
+});
+
+describe("@working-theory/database build", () => {
+  it(
+    "emits a model added to the schema after the last build, despite an existing tsconfig.build.tsbuildinfo",
+    () => {
+      expect(existsSync(join(db, "tsconfig.build.tsbuildinfo"))).toBe(true);
+      expect(emitted("class.d.ts")).not.toContain("buildProbeBravo");
+
+      addModel("BuildProbeBravo");
+      run("build");
+
+      expect(emitted("class.d.ts")).toContain("get buildProbeBravo()");
+      expect(emitted("class.js")).toContain("BuildProbeBravo");
+    },
+    BUILD_TIMEOUT_MS,
+  );
+
+  it(
+    "re-emits a deleted dist/client although the generated sources did not change",
+    () => {
+      rmSync(join(db, "dist", "client"), { recursive: true, force: true });
+
+      run("build");
+
+      expect(emitted("class.d.ts")).toContain("get buildProbeAlpha()");
+      expect(emitted("class.js")).toContain("BuildProbeAlpha");
+    },
+    BUILD_TIMEOUT_MS,
+  );
+});

package/templates/database/__tests__/spoke-registry.db.test.ts

@@ -0,0 +1,191 @@
+/**
+ * @file spoke-registry.db.test.ts
+ *
+ * LIVE-DATABASE proof of the hub's spoke registry and the booking-origin
+ * record (#7532, spec docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D5,
+ * D8; AC-2). Requires DATABASE_URL pointing at a Postgres with the migrations
+ * applied — the whole suite SKIPS when DATABASE_URL is unset, keeping the
+ * workspace Jest run DB-free (the repo convention; the
+ * `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, as `prefixed-ids.db.test.ts` does. What it
+ * proves that a mock cannot:
+ *   1. The five format CHECKs reject a malformed id.
+ *   2. The `appointment_origins` unique key refuses a second origin for one
+ *      booking uid.
+ *   3. Deleting a workspace cascades its `spokes`.
+ *   4. The per-booking advisory lock serializes: while connection A's
+ *      transaction holds the lock for uidA, connection B cannot take it, and
+ *      can once A commits; a different uid's lock is free throughout.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const V7 = "01920000-0000-7000-8000";
+const LOCK_SQL =
+  "SELECT pg_try_advisory_xact_lock(hashtextextended($1, 0)) AS locked";
+
+describeDb("the spoke registry and booking origins (#7532, live DB)", () => {
+  let a: Client;
+  let b: Client;
+  let workspaceId: string;
+
+  beforeAll(async () => {
+    a = new Client({ connectionString: process.env.DATABASE_URL });
+    b = new Client({ connectionString: process.env.DATABASE_URL });
+    await a.connect();
+    await b.connect();
+
+    const org = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('Spoke Registry Org', 'spoke7532-org', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    workspaceId = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, 'Spoke Registry Workspace', 'spoke7532-ws', now()) RETURNING "id"`,
+        [org.id],
+      )
+    ).rows[0]!.id;
+  });
+
+  afterAll(async () => {
+    await a.query(
+      `DELETE FROM "appointment_origins" WHERE "provider_booking_uid" LIKE 'spoke7532-%'`,
+    );
+    await a.query(`DELETE FROM "organizations" WHERE "slug" LIKE 'spoke7532-%'`);
+    await a.end();
+    await b.end();
+  });
+
+  /** Insert one spoke; the database mints its id. */
+  async function insertSpoke(
+    client: Client,
+    overrides: { id?: string; workspaceId?: string; hash?: string } = {},
+  ): Promise<string> {
+    const { rows } = await client.query<{ id: string }>(
+      `INSERT INTO "spokes" (${overrides.id ? '"id", ' : ""}"workspace_id", "name", "credential_hash", "credential_prefix", "updated_at")
+       VALUES (${overrides.id ? "$4, " : ""}$1, 'acme', $2, $3, now()) RETURNING "id"`,
+      [
+        overrides.workspaceId ?? workspaceId,
+        overrides.hash ?? "a".repeat(64),
+        "ailk_spk_abcdefgh",
+        ...(overrides.id ? [overrides.id] : []),
+      ],
+    );
+    return rows[0]!.id;
+  }
+
+  describe("format CHECKs (ADR-0031)", () => {
+    it("a spoke takes a database-minted spoke_ id", async () => {
+      const id = await insertSpoke(a, { hash: "1".repeat(64) });
+      expect(id).toMatch(/^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+    });
+
+    it("REJECTS a malformed spoke id", async () => {
+      await expect(
+        insertSpoke(a, { id: "bad", hash: "2".repeat(64) }),
+      ).rejects.toThrow(/spokes_id_format/);
+    });
+
+    it("REJECTS a malformed spoke workspace_id", async () => {
+      // The format CHECK fires before the foreign key.
+      await expect(
+        insertSpoke(a, { workspaceId: "not-a-workspace", hash: "3".repeat(64) }),
+      ).rejects.toThrow(/spokes_workspace_id_format/);
+    });
+
+    it.each([
+      ["id", "appointment_origins_id_format"],
+      ["spoke_id", "appointment_origins_spoke_id_format"],
+      ["workspace_id", "appointment_origins_workspace_id_format"],
+    ])("REJECTS a malformed origin %s", async (column, constraint) => {
+      const values: Record<string, string> = {
+        id: `apptorg_${V7}-0000000000e1`,
+        spoke_id: `spoke_${V7}-0000000000c1`,
+        workspace_id: workspaceId,
+      };
+      values[column] = "bad";
+      await expect(
+        a.query(
+          `INSERT INTO "appointment_origins" ("id", "provider_booking_uid", "workspace_id", "spoke_id")
+           VALUES ($1, $2, $3, $4)`,
+          [values["id"], `spoke7532-${column}`, values["workspace_id"], values["spoke_id"]],
+        ),
+      ).rejects.toThrow(new RegExp(constraint));
+    });
+  });
+
+  describe("unique keys", () => {
+    it("a credential digest is unique", async () => {
+      await insertSpoke(a, { hash: "4".repeat(64) });
+      await expect(insertSpoke(a, { hash: "4".repeat(64) })).rejects.toThrow(
+        /spokes_credential_hash_key/,
+      );
+    });
+
+    it("refuses a second origin for one booking uid, and ON CONFLICT DO NOTHING absorbs it", async () => {
+      const insert = (spokeSuffix: string) =>
+        a.query(
+          `INSERT INTO "appointment_origins" ("provider", "provider_booking_uid", "workspace_id", "spoke_id")
+           VALUES ('cal', 'spoke7532-uidA', $1, $2)`,
+          [workspaceId, `spoke_${V7}-0000000000${spokeSuffix}`],
+        );
+      await insert("c1");
+      await expect(insert("c2")).rejects.toThrow(
+        /appointment_origins_provider_provider_booking_uid_key/,
+      );
+
+      const skipped = await a.query(
+        `INSERT INTO "appointment_origins" ("provider", "provider_booking_uid", "workspace_id", "spoke_id")
+         VALUES ('cal', 'spoke7532-uidA', $1, $2) ON CONFLICT DO NOTHING`,
+        [workspaceId, `spoke_${V7}-0000000000c3`],
+      );
+      expect(skipped.rowCount).toBe(0);
+    });
+  });
+
+  it("deleting a workspace deletes its spokes", async () => {
+    const org = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('Cascade Org', 'spoke7532-cascade', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    const doomed = (
+      await a.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, 'Doomed', 'doomed', now()) RETURNING "id"`,
+        [org.id],
+      )
+    ).rows[0]!.id;
+    const spokeId = await insertSpoke(a, { workspaceId: doomed, hash: "5".repeat(64) });
+
+    await a.query(`DELETE FROM "workspaces" WHERE "id" = $1`, [doomed]);
+
+    const { rowCount } = await a.query(`SELECT 1 FROM "spokes" WHERE "id" = $1`, [spokeId]);
+    expect(rowCount).toBe(0);
+  });
+
+  it("the per-booking advisory lock serializes one uid and leaves another free", async () => {
+    const keyA = "appointment:cal:spoke7532-uidA";
+    const keyB = "appointment:cal:spoke7532-uidB";
+
+    await a.query("BEGIN");
+    await a.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [keyA]);
+
+    await b.query("BEGIN");
+    expect((await b.query(LOCK_SQL, [keyA])).rows[0].locked).toBe(false);
+    expect((await b.query(LOCK_SQL, [keyB])).rows[0].locked).toBe(true);
+    await b.query("COMMIT");
+
+    await a.query("COMMIT");
+
+    await b.query("BEGIN");
+    expect((await b.query(LOCK_SQL, [keyA])).rows[0].locked).toBe(true);
+    await b.query("COMMIT");
+  });
+});

package/templates/database/auth/schema.prisma

@@ -100,12 +100,43 @@ model Workspace {
   updatedAt      DateTime @updatedAt @map("updated_at")
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  // #7532 — the hub's spoke registry rows bound to this workspace.
+  spokes       Spoke[]
 
   @@unique([organizationId, slug])
   @@index([organizationId])
   @@map("workspaces")
 }
 
+/// Spoke — one separately deployed site (a spoke) that calls this hub API
+/// server-to-server, bound to exactly ONE workspace (#7532, spec
+/// docs/specs/7532-a-spoke-s-public-reads-spec.md D1).
+///
+/// The spoke authenticates with a hub-minted key sent in `x-ailk-spoke-key`.
+/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
+/// recognisable `credentialPrefix`; the key itself never is. Several rows may
+/// bind one workspace, so a key rotates by registering a second spoke and
+/// revoking the first. `revokedAt` set refuses the key on the next request.
+///
+/// Room to extend (operator amendment; built by neither this unit): REL-002's
+/// sign-in client and #7533's SchedulingConnection each add ONE nullable,
+/// unique column in their own migration, so a spoke stays one record.
+model Spoke {
+  id               String    @id @default(dbgenerated("('spoke_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId      String    @map("workspace_id")
+  name             String    @db.VarChar(120)
+  credentialHash   String    @unique @map("credential_hash") @db.Char(64)
+  credentialPrefix String    @map("credential_prefix") @db.VarChar(24)
+  revokedAt        DateTime? @map("revoked_at")
+  createdAt        DateTime  @default(now()) @map("created_at")
+  updatedAt        DateTime  @updatedAt @map("updated_at")
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@index([workspaceId])
+  @@map("spokes")
+}
+
 /// Membership — User ↔ Organization with a Role. Managed by the Better Auth
 /// organization plugin (modelName "membership"). Org-level: grants visibility
 /// into every workspace of the organization.

package/templates/database/config/schema.prisma

@@ -136,6 +136,32 @@ model WorkspaceMeetings {
   @@map("workspace_meetings")
 }
 
+/// SchedulingConnection — a workspace's own scheduling provider account
+/// (#7533 D1): the provider id, its credential and the per-connection webhook
+/// entry point + secret, so each workspace reads and receives bookings through
+/// its own account. One row per workspace, mirroring WorkspaceMeetings above:
+/// a plain `workspaceId @unique` scalar, no relation, no foreign key (ADR 0009
+/// invariant 1). The credential and the webhook secret are AES-256-GCM
+/// ciphertext (`v1.<iv>.<tag>.<ct>`) under SCHEDULING_CREDENTIAL_KEY, bound to
+/// the workspace and the column; only apps/api's
+/// services/scheduling/connections.ts reads or writes them. `webhookToken` is
+/// a 256-bit routing id, not an authenticator. `provider` has no CHECK — the
+/// API accepts only the ids its factory table knows. Keep every `@map` in
+/// lockstep with the migration's column names (see WorkspaceMeetings).
+model SchedulingConnection {
+  id                      String   @id @default(dbgenerated("('schconn_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId             String   @unique @map("workspace_id")
+  provider                String   @db.VarChar(32)
+  credentialCiphertext    String   @map("credential_ciphertext") @db.Text
+  webhookToken            String   @unique @map("webhook_token") @db.VarChar(64)
+  webhookSecretCiphertext String   @map("webhook_secret_ciphertext") @db.Text
+  baseUrl                 String?  @map("base_url") @db.Text
+  createdAt               DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("scheduling_connections")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than

package/templates/database/inbox/schema.prisma

@@ -1131,3 +1131,24 @@ model Appointment {
   @@index([workspaceId])
   @@map("appointments")
 }
+
+/// AppointmentOrigin — which workspace a booking made THROUGH A SPOKE belongs
+/// to (#7532, spec D5). Written by `POST /v1/schedule/book` the moment Cal
+/// answers, and consulted by the deployment-wide Cal.com webhook BEFORE the
+/// site alias, so a spoke's booking is stored in the spoke's workspace.
+///
+/// One origin per booking uid: the unique key leaves `site_id` out. No
+/// relation directive (ADR 0009) — `workspace_id` and `spoke_id` are plain
+/// columns with format CHECKs, joined in apps/api/src/services/.
+model AppointmentOrigin {
+  id                 String   @id @default(dbgenerated("('apptorg_'::text || (uuidv7())::text)")) @db.Text
+  provider           String   @default("cal") @db.VarChar(32)
+  providerBookingUid String   @map("provider_booking_uid") @db.VarChar(200)
+  workspaceId        String   @map("workspace_id")
+  spokeId            String   @map("spoke_id")
+  createdAt          DateTime @default(now()) @map("created_at")
+
+  @@unique([provider, providerBookingUid])
+  @@index([workspaceId])
+  @@map("appointment_origins")
+}