create-ailk 0.11.5 → 0.12.1

package/templates/database/migrations/20261003120000_spoke_registry/migration.sql

@@ -0,0 +1,80 @@
+-- #7532 — the hub's spoke registry and the booking-origin record (spec
+-- docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D5).
+--
+--   spokes (auth)              — one row per separately deployed site that
+--                                calls this hub, bound to ONE workspace. It
+--                                stores the SHA-256 digest of the spoke's
+--                                hub-minted key, never the key. Deleting a
+--                                workspace deletes its spokes (the FK below).
+--   appointment_origins (inbox) — (provider, booking uid) → workspace, written
+--                                when a spoke's booking is created so the
+--                                deployment-wide Cal.com webhook stores the
+--                                booking in the spoke's workspace. One origin
+--                                per booking uid. No foreign key and no
+--                                relation (ADR 0009): workspace_id and
+--                                spoke_id are plain columns with format CHECKs.
+--
+-- PURELY ADDITIVE: two new tables, their indexes and one FK to "workspaces".
+-- No statement touches an existing table's rows or columns, so there is no
+-- pre-assertion block — this migration cannot lose a row.
+--
+-- Rollback: DROP TABLE "appointment_origins"; DROP TABLE "spokes". Safe while
+-- nothing but #7532's own code reads them.
+
+-- CreateTable
+CREATE TABLE "spokes" (
+    "id" TEXT NOT NULL DEFAULT ('spoke_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "name" VARCHAR(120) NOT NULL,
+    "credential_hash" CHAR(64) NOT NULL,
+    "credential_prefix" VARCHAR(24) NOT NULL,
+    "revoked_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "spokes_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "appointment_origins" (
+    "id" TEXT NOT NULL DEFAULT ('apptorg_'::text || (uuidv7())::text),
+    "provider" VARCHAR(32) NOT NULL DEFAULT 'cal',
+    "provider_booking_uid" VARCHAR(200) NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "spoke_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "appointment_origins_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+-- The lookup a spoke's every request makes (`findSpokeByKeyHash`).
+CREATE UNIQUE INDEX "spokes_credential_hash_key" ON "spokes"("credential_hash");
+
+-- CreateIndex
+CREATE INDEX "spokes_workspace_id_idx" ON "spokes"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "appointment_origins_workspace_id_idx" ON "appointment_origins"("workspace_id");
+
+-- CreateIndex
+-- One origin per booking uid (spec D5). The bind inserts with
+-- ON CONFLICT DO NOTHING against this key.
+CREATE UNIQUE INDEX "appointment_origins_provider_provider_booking_uid_key" ON "appointment_origins"("provider", "provider_booking_uid");
+
+-- AddForeignKey
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — spokes: spoke_, appointment_origins: apptorg_ (registered
+-- in packages/ids/src/registry.ts; this migration's path is added to
+-- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "spokes" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "spokes" ALTER COLUMN "id" SET DEFAULT ('spoke_'::text || (uuidv7())::text);
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_id_format" CHECK ("id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+ALTER TABLE "appointment_origins" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "appointment_origins" ALTER COLUMN "id" SET DEFAULT ('apptorg_'::text || (uuidv7())::text);
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_id_format" CHECK ("id" ~ '^apptorg_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_spoke_id_format" CHECK ("spoke_id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261003130000_scheduling_connection/migration.sql

@@ -0,0 +1,49 @@
+-- #7533 — the SchedulingConnection model: a workspace's own scheduling
+-- provider account (spec docs/specs/7533-a-scheduling-connection-per-workspace-spec.md
+-- D1). One row per workspace, keyed `@unique(workspace_id)` like its config
+-- sibling workspace_meetings; the credential and webhook secret columns hold
+-- AES-256-GCM ciphertext written only by apps/api's
+-- services/scheduling/connections.ts. `webhook_token` is the per-connection
+-- webhook entry point's routing id, unique so a delivery resolves at most
+-- one row.
+--
+-- One new table, two unique indexes, in the house style of
+-- 20260919130000_workspace_meetings (CreateTable + CreateIndex immediately
+-- followed by the ADR-0031 rule-3 id-format completion, in ONE migration
+-- since the table is new and needs no retrofit). No `workspace_id_format`
+-- CHECK and no `provider` CHECK, matching that same precedent (the API
+-- accepts only the provider ids its factory table knows).
+--
+-- No backfill, no constraint relaxed, no existing table touched.
+--
+-- Rollback: DROP TABLE "scheduling_connections". Every stored connection is
+-- lost; each workspace returns to the unconfigured state (or, on a
+-- one-workspace deployment, to the CAL_API_KEY env fallback).
+
+-- CreateTable
+CREATE TABLE "scheduling_connections" (
+    "id" TEXT NOT NULL DEFAULT ('schconn_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "provider" VARCHAR(32) NOT NULL,
+    "credential_ciphertext" TEXT NOT NULL,
+    "webhook_token" VARCHAR(64) NOT NULL,
+    "webhook_secret_ciphertext" TEXT NOT NULL,
+    "base_url" TEXT,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "scheduling_connections_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "scheduling_connections_workspace_id_key" ON "scheduling_connections"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "scheduling_connections_webhook_token_key" ON "scheduling_connections"("webhook_token");
+
+-- ADR-0031 rule 3 — scheduling_connections: schconn_ (registered in
+-- packages/ids/src/registry.ts ENTITY_PREFIX.schedulingConnection; this
+-- migration's path is added to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "scheduling_connections" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "scheduling_connections" ALTER COLUMN "id" SET DEFAULT ('schconn_'::text || (uuidv7())::text);
+ALTER TABLE "scheduling_connections" ADD CONSTRAINT "scheduling_connections_id_format" CHECK ("id" ~ '^schconn_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"
@@ -51,8 +51,8 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "build": "tsc -b tsconfig.build.json && tsc -b tsconfig.tenancy.json && tsc -b tsconfig.flows.json",
-    "db:generate": "prisma generate && pnpm run build",
+    "build": "prisma generate && tsc -b tsconfig.build.json --force && tsc -b tsconfig.tenancy.json && tsc -b tsconfig.flows.json",
+    "db:generate": "pnpm run build",
     "db:migrate": "prisma migrate dev",
     "db:migrate:deploy": "prisma migrate deploy",
     "db:push": "prisma db push",

package/versions.json

@@ -1,52 +1,52 @@
 {
-  "@working-theory/admin-ui": "0.33.0",
-  "@working-theory/aeo": "0.33.0",
-  "@working-theory/agent-context": "0.33.0",
+  "@working-theory/admin-ui": "0.34.1",
+  "@working-theory/aeo": "0.34.1",
+  "@working-theory/agent-context": "0.34.1",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.33.0",
-  "@working-theory/api-client": "0.33.0",
+  "@working-theory/analytics": "0.34.1",
+  "@working-theory/api-client": "0.34.1",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.33.0",
-  "@working-theory/common": "0.33.0",
+  "@working-theory/cli": "0.34.1",
+  "@working-theory/common": "0.34.1",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.33.0",
-  "@working-theory/content-projection": "0.33.0",
-  "@working-theory/email": "0.33.0",
+  "@working-theory/content-adapters": "0.34.1",
+  "@working-theory/content-projection": "0.34.1",
+  "@working-theory/email": "0.34.1",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.33.0",
-  "@working-theory/fumadocs-schema": "0.33.0",
-  "@working-theory/ids": "0.8.0",
-  "@working-theory/jsonld": "0.33.0",
-  "@working-theory/license": "0.33.0",
-  "@working-theory/metadata": "0.33.0",
-  "@working-theory/observability": "0.33.0",
-  "@working-theory/page-renderer": "0.33.0",
+  "@working-theory/eslint-config": "0.34.1",
+  "@working-theory/fumadocs-schema": "0.34.1",
+  "@working-theory/ids": "0.9.1",
+  "@working-theory/jsonld": "0.34.1",
+  "@working-theory/license": "0.34.1",
+  "@working-theory/metadata": "0.34.1",
+  "@working-theory/observability": "0.34.1",
+  "@working-theory/page-renderer": "0.34.1",
   "@working-theory/plugin-mcp": "0.1.1",
-  "@working-theory/schema": "0.33.0",
-  "@working-theory/schema-pack-registry": "0.33.0",
-  "@working-theory/schema-validator": "0.33.0",
-  "@working-theory/sections-registry": "0.33.0",
-  "@working-theory/site-config": "0.33.0",
-  "@working-theory/stripe-client": "0.33.0",
-  "@working-theory/templates": "0.33.0",
-  "@working-theory/theme": "0.33.0",
-  "@working-theory/ui": "0.33.0",
-  "@working-theory/validation": "0.33.0",
-  "@working-theory/web-i18n": "0.33.0",
+  "@working-theory/schema": "0.34.1",
+  "@working-theory/schema-pack-registry": "0.34.1",
+  "@working-theory/schema-validator": "0.34.1",
+  "@working-theory/sections-registry": "0.34.1",
+  "@working-theory/site-config": "0.34.1",
+  "@working-theory/stripe-client": "0.34.1",
+  "@working-theory/templates": "0.34.1",
+  "@working-theory/theme": "0.34.1",
+  "@working-theory/ui": "0.34.1",
+  "@working-theory/validation": "0.34.1",
+  "@working-theory/web-i18n": "0.34.1",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.10",
-  "@working-theory/ui-docs-blog": "0.23.10",
-  "@working-theory/ui-scheduling": "0.23.10",
-  "@working-theory/ui-signal-collectors": "0.24.8",
+  "@working-theory/ui-commerce": "0.23.12",
+  "@working-theory/ui-docs-blog": "0.23.12",
+  "@working-theory/ui-scheduling": "0.23.12",
+  "@working-theory/ui-signal-collectors": "0.25.1",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.33.0"
+  "@working-theory/database": "0.34.1"
 }