@shaferllc/keel 0.83.2 → 0.83.4

package/dist/hosting/secrets.js

@@ -0,0 +1,27 @@
+/**
+ * Encrypted key/value secrets vault — purpose-scoped encryption via Keel core.
+ *
+ * Apps supply a table of rows with `owner_id`, `key`, `value_encrypted`.
+ * This helper doesn't own the model; it encrypts/decrypts values.
+ */
+import { encryption } from "../core/crypto.js";
+export function normalizeSecretKey(key) {
+    return key.trim().toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+}
+export async function encryptSecretValue(value, purpose = "app-secret") {
+    return encryption.encrypt(value, { purpose });
+}
+export async function decryptSecretValue(payload, purpose = "app-secret") {
+    const value = await encryption.decrypt(payload, { purpose });
+    return typeof value === "string" ? value : null;
+}
+/** Decrypt a list of encrypted rows into a plain key→value map. */
+export async function resolveSecretRows(rows, purpose = "app-secret") {
+    const out = {};
+    for (const row of rows) {
+        const value = await decryptSecretValue(row.value_encrypted, purpose);
+        if (value !== null)
+            out[row.key] = value;
+    }
+    return out;
+}

package/dist/mcp/cloud.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Keel Cloud MCP tools — registered only when KEEL_CLOUD_TOKEN is set.
+ *
+ * Talks to a Keel Cloud control plane over HTTP (Bearer token). Agents use these
+ * to create sites, preview/publish, and manage secrets without leaving the IDE.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Register Cloud tools on an existing MCP server when a Cloud token is present. */
+export declare function registerCloudTools(server: McpServer): boolean;

package/dist/mcp/cloud.js

@@ -0,0 +1,179 @@
+/**
+ * Keel Cloud MCP tools — registered only when KEEL_CLOUD_TOKEN is set.
+ *
+ * Talks to a Keel Cloud control plane over HTTP (Bearer token). Agents use these
+ * to create sites, preview/publish, and manage secrets without leaving the IDE.
+ */
+import { z } from "zod";
+const PRESETS = ["minimal", "api", "app", "saas"];
+function cloudConfig() {
+    const token = String(process.env.KEEL_CLOUD_TOKEN ?? "").trim();
+    if (!token)
+        return null;
+    const url = String(process.env.KEEL_CLOUD_URL ?? "http://localhost:3000").replace(/\/$/, "");
+    return { url, token };
+}
+async function cloudFetch(path, init = {}) {
+    const cfg = cloudConfig();
+    if (!cfg)
+        throw new Error("KEEL_CLOUD_TOKEN is not set");
+    const response = await fetch(`${cfg.url}${path}`, {
+        ...init,
+        headers: {
+            authorization: `Bearer ${cfg.token}`,
+            accept: "application/json",
+            ...(init.body ? { "content-type": "application/json" } : {}),
+            ...(init.headers ?? {}),
+        },
+    });
+    const text = await response.text();
+    let body = text;
+    try {
+        body = text ? JSON.parse(text) : null;
+    }
+    catch {
+        /* keep text */
+    }
+    return { ok: response.ok, status: response.status, body };
+}
+function jsonText(data, isError = false) {
+    return {
+        content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }],
+        ...(isError ? { isError: true } : {}),
+    };
+}
+/** Register Cloud tools on an existing MCP server when a Cloud token is present. */
+export function registerCloudTools(server) {
+    if (!cloudConfig())
+        return false;
+    server.registerTool("keel_cloud_me", {
+        title: "Keel Cloud — who am I",
+        description: "Return the Keel Cloud user authenticated by KEEL_CLOUD_TOKEN.",
+        inputSchema: {},
+    }, async () => {
+        const res = await cloudFetch("/api/v1/me");
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_list_sites", {
+        title: "Keel Cloud — list sites",
+        description: "List sites on the current Keel Cloud team. Includes storage_path for local editing and hostnames.",
+        inputSchema: {},
+    }, async () => {
+        const res = await cloudFetch("/api/v1/sites");
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_get_site", {
+        title: "Keel Cloud — get site",
+        description: "Fetch one Keel Cloud site by id (paths, hostnames, status).",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id from keel_cloud_list_sites"),
+        },
+    }, async ({ site_id }) => {
+        const res = await cloudFetch(`/api/v1/sites/${site_id}`);
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_create_site", {
+        title: "Keel Cloud — create site",
+        description: "Create a new Keel Cloud site from a preset (minimal|api|app|saas). Scaffolds source under storage/sites/{slug} and returns storage_path for editing.",
+        inputSchema: {
+            name: z.string().min(1).describe("Human-readable site name"),
+            preset: z.enum(PRESETS).optional().describe("Keel preset (default minimal)"),
+        },
+    }, async ({ name, preset }) => {
+        const res = await cloudFetch("/api/v1/sites", {
+            method: "POST",
+            body: JSON.stringify({ name, preset: preset ?? "minimal" }),
+        });
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_preview", {
+        title: "Keel Cloud — deploy preview",
+        description: "Deploy the site's preview Worker (and attach preview hostname when Cloudflare is configured). Safe to call freely while iterating.",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+        },
+    }, async ({ site_id }) => {
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/preview`, { method: "POST", body: "{}" });
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_publish", {
+        title: "Keel Cloud — publish production",
+        description: "Publish the site to its production Worker/hostname. Requires confirm=true (explicit user approval).",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+            confirm: z
+                .boolean()
+                .describe("Must be true to publish — ask the user before setting this"),
+        },
+    }, async ({ site_id, confirm }) => {
+        if (!confirm) {
+            return jsonText({
+                error: "Publish requires confirm=true. Ask the user to confirm before calling again.",
+            }, true);
+        }
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/publish`, {
+            method: "POST",
+            body: JSON.stringify({ confirm: true }),
+        });
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_deploys", {
+        title: "Keel Cloud — deploy history",
+        description: "List recent preview/production deploys and logs for a site.",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+        },
+    }, async ({ site_id }) => {
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/deploys`);
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_set_secret", {
+        title: "Keel Cloud — set secret",
+        description: "Store a secret in the site vault (never in git). Injected into the Worker on the next preview/publish.",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+            key: z.string().min(1).describe("Env-style key, e.g. STRIPE_SECRET_KEY"),
+            value: z.string().describe("Secret value (will not be echoed by the dashboard)"),
+        },
+    }, async ({ site_id, key, value }) => {
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/secrets`, {
+            method: "PUT",
+            body: JSON.stringify({ key, value }),
+        });
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_export", {
+        title: "Keel Cloud — export manifest",
+        description: "Return the site's export manifest (paths, hostnames, Keel version, SQL dump URLs). Use storage_path / git_url for code; use keel_cloud_export_sql for data.",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+        },
+    }, async ({ site_id }) => {
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/export`);
+        return jsonText(res.body, !res.ok);
+    });
+    server.registerTool("keel_cloud_export_sql", {
+        title: "Keel Cloud — export SQL dump",
+        description: "Download a portable .sql dump for local sqlite, preview D1, or production D1. Prefer production after publish for a full escape hatch.",
+        inputSchema: {
+            site_id: z.number().int().describe("Site id"),
+            env: z
+                .enum(["local", "preview", "production"])
+                .optional()
+                .describe("Which database to dump (default local)"),
+        },
+    }, async ({ site_id, env }) => {
+        const environment = env ?? "local";
+        const res = await cloudFetch(`/api/v1/sites/${site_id}/export/sql?env=${environment}`);
+        if (!res.ok)
+            return jsonText(res.body, true);
+        const sql = typeof res.body === "string" ? res.body : JSON.stringify(res.body);
+        return jsonText({
+            site_id,
+            env: environment,
+            sql,
+            hint: "Write this to a .sql file and restore with sqlite3 / D1 import on a real Keel app.",
+        });
+    });
+    return true;
+}

package/dist/mcp/server.d.ts

@@ -11,6 +11,8 @@
  *   keel_search_api        search the public export surface
  *   keel_list_generators   the `keel make:*` generators
  *   keel_scaffold          generate a controller/provider/job/… stub (no write)
+ * When KEEL_CLOUD_TOKEN is set, also:
+ *   keel_cloud_*           create/list/preview/publish sites on Keel Cloud
  * Resources: keel://overview, keel://llms-full, and keel://docs/<slug> per guide.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp/server.js

@@ -11,6 +11,8 @@
  *   keel_search_api        search the public export surface
  *   keel_list_generators   the `keel make:*` generators
  *   keel_scaffold          generate a controller/provider/job/… stub (no write)
+ * When KEEL_CLOUD_TOKEN is set, also:
+ *   keel_cloud_*           create/list/preview/publish sites on Keel Cloud
  * Resources: keel://overview, keel://llms-full, and keel://docs/<slug> per guide.
  */
 import { readFile, readdir, stat } from "node:fs/promises";
@@ -20,6 +22,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { controllerStub, resourceControllerStub, providerStub, middlewareStub, factoryStub, seederStub, jobStub, notificationStub, transformerStub, } from "../core/cli/stubs.js";
+import { registerCloudTools } from "./cloud.js";
 async function exists(p) {
     try {
         await stat(p);
@@ -183,6 +186,18 @@ export async function createServer() {
         "",
         "## Generators — use keel_scaffold or `keel make:*`",
         ...manifest.generators.map((g) => `- ${g.command} → ${g.produces}`),
+        ...(process.env.KEEL_CLOUD_TOKEN?.trim()
+            ? [
+                "",
+                "## Keel Cloud (token detected)",
+                "Cloud tools are enabled. Typical loop:",
+                "1. keel_cloud_create_site { name, preset }",
+                "2. Edit files at the returned storage_path (real Keel app)",
+                "3. keel_cloud_preview { site_id }",
+                "4. keel_cloud_publish { site_id, confirm: true } after user approval",
+                "Also: keel_cloud_list_sites, keel_cloud_get_site, keel_cloud_set_secret, keel_cloud_deploys, keel_cloud_export.",
+            ]
+            : []),
     ].join("\n");
     // ---- tools ----
     server.registerTool("keel_overview", {
@@ -343,6 +358,7 @@ export async function createServer() {
     for (const doc of manifest.docs) {
         server.registerResource(`doc:${doc.slug}`, `keel://docs/${doc.slug}`, { title: doc.title, description: doc.summary || doc.title, mimeType: "text/markdown" }, async (uri) => ({ contents: [{ uri: uri.href, text: await readFile(join(root, doc.path), "utf8") }] }));
     }
+    registerCloudTools(server);
     return server;
 }
 /** Boot the server on stdio. Called by the `keel-mcp` bin and `keel mcp`. */
@@ -351,5 +367,8 @@ export async function runMcpServer() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     // stdout is the protocol channel — log to stderr only.
-    console.error("⚓ Keel MCP server running on stdio");
+    const cloud = Boolean(process.env.KEEL_CLOUD_TOKEN?.trim());
+    console.error(cloud
+        ? "⚓ Keel MCP server running on stdio (Cloud tools enabled)"
+        : "⚓ Keel MCP server running on stdio");
 }

package/docs/ai-manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "@shaferllc/keel",
-  "version": "0.83.2",
+  "version": "0.83.4",
   "description": "The house framework for Node.js — a service container, providers, routing, JSX views, and a code-generating console.",
   "repo": "https://github.com/shaferllc/keel",
   "generated": "run `npm run build:ai` to regenerate",
@@ -159,6 +159,13 @@
       "path": "docs/factories.md",
       "example": "docs/examples/factories.ts"
     },
+    {
+      "slug": "gates",
+      "title": "Gates",
+      "summary": "Keel Gates is a signup gate for private alpha / waitlist apps: an email allowlist, invite codes with use limits and expiry, and a single check that answers \"may this person register?\".",
+      "path": "docs/gates.md",
+      "example": "docs/examples/gates.ts"
+    },
     {
       "slug": "getting-started",
       "title": "Getting Started",
@@ -201,6 +208,13 @@
       "path": "docs/hooks.md",
       "example": "docs/examples/hooks.ts"
     },
+    {
+      "slug": "hosting",
+      "title": "Hosting",
+      "summary": "Keel Hosting is a small toolkit for hosted Workers / D1 apps: a Cloudflare REST client, hostname helpers, a SQLite-compatible SQL dump, and purpose-scoped secret encryption.",
+      "path": "docs/hosting.md",
+      "example": "docs/examples/hosting.ts"
+    },
     {
       "slug": "i18n",
       "title": "Internationalization",
@@ -3077,6 +3091,11 @@
       "kind": "value",
       "module": "tokens"
     },
+    {
+      "name": "tokensMigration",
+      "kind": "value",
+      "module": "tokens"
+    },
     {
       "name": "TooManyRequestsException",
       "kind": "value",

package/docs/ai.md

@@ -61,6 +61,35 @@ package, so it always matches your installed version.
 | `keel_list_generators` | The `keel make:*` generators, what they produce, and their flags. |
 | `keel_scaffold` | Generate a controller/provider/middleware/factory/seeder/job/notification/transformer stub. Returns code + target path — it does **not** write to disk. |
 
+When `KEEL_CLOUD_TOKEN` (and optional `KEEL_CLOUD_URL`) is set, Cloud tools are
+also registered:
+
+| Tool | What it does |
+|------|--------------|
+| `keel_cloud_me` | Authenticated Cloud user |
+| `keel_cloud_list_sites` / `keel_cloud_get_site` | List or fetch a site (includes `storage_path`) |
+| `keel_cloud_create_site` | Create from preset (`minimal` \| `api` \| `app` \| `saas`) |
+| `keel_cloud_preview` | Deploy preview Worker |
+| `keel_cloud_publish` | Publish production — requires `confirm: true` |
+| `keel_cloud_set_secret` | Vault a secret (injected on next deploy) |
+| `keel_cloud_deploys` / `keel_cloud_export` | Deploy history and export manifest |
+| `keel_cloud_export_sql` | Portable `.sql` dump (`local` \| `preview` \| `production`) |
+
+```json
+{
+  "mcpServers": {
+    "keel": {
+      "command": "npx",
+      "args": ["-y", "keel-mcp"],
+      "env": {
+        "KEEL_CLOUD_TOKEN": "kc_…",
+        "KEEL_CLOUD_URL": "https://app.keeljs.cloud"
+      }
+    }
+  }
+}
+```
+
 ### Resources
 
 - `keel://overview` — the same orientation text as `keel_overview`
@@ -75,6 +104,13 @@ package, so it always matches your installed version.
 4. `keel_scaffold { kind: "controller", name: "Post", resource: true }` → get the stub.
 5. Write the file, add the route, run `npm run typecheck`.
 
+### A typical Keel Cloud loop
+
+1. `keel_cloud_create_site { name: "Acme", preset: "app" }`
+2. Edit the returned `storage_path` (real Keel app + git)
+3. `keel_cloud_preview { site_id }`
+4. `keel_cloud_publish { site_id, confirm: true }` after the user approves
+
 ## `llms.txt` and `llms-full.txt`
 
 At the package root:

package/docs/billing.md

@@ -157,6 +157,15 @@ const intent = await user.createSetupIntent();  // return intent.clientSecret to
 const methods = await user.paymentMethods();
 ```
 
+### Customer portal (Stripe)
+
+Send the customer to Stripe's hosted portal to update their card or cancel:
+
+```ts
+const portal = await user.billingPortal("https://app.example.com/billing");
+// redirect to portal.url
+```
+
 These are Stripe-only capabilities; calling them on the Paddle gateway throws a
 `BillingError` (Paddle collects cards in its own hosted checkout).
 
@@ -251,7 +260,7 @@ real gateway from `config/billing.ts` and `.env`.
 |---------|--------|--------|
 | Create a subscription server-side | `create(pmId)` | Not supported — use `checkout()`; the webhook creates the local row |
 | One-off `charge()` | Confirms a PaymentIntent | Not supported — use `checkout({ mode })` / transactions |
-| SetupIntent / `paymentMethods()` | Supported | Throws `BillingError` (hosted checkout) |
+| SetupIntent / `paymentMethods()` / `billingPortal()` | Supported | Throws `BillingError` (hosted checkout) |
 | Checkout handle | `session.url` (redirect) | `session.clientToken` (overlay/inline) |
 | Webhook signature | `Stripe-Signature: t=…,v1=…` | `Paddle-Signature: ts=…;h1=…` |
 

package/docs/changelog.md

@@ -4,6 +4,36 @@ All notable changes to Keel are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims to
 adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.83.4] — 2026-07-13
+
+### Added
+
+- **MCP Cloud tools** (`keel_cloud_*`) — when `KEEL_CLOUD_TOKEN` is set,
+  `keel-mcp` registers create/list/preview/publish/secrets/export tools against
+  a Keel Cloud control plane. Documented in [Building with AI](./docs/ai.md).
+- **`tokensMigration()`** — personal access tokens schema helper for apps that
+  need the table via `keel migrate`.
+- **Billing customer portal** — `user.billingPortal(returnUrl)` (Stripe + Fake
+  gateway); opens the hosted portal to manage card / cancel.
+- **Hosting guide** — [`docs/hosting.md`](./docs/hosting.md) + example harness
+  for `@shaferllc/keel/hosting`.
+- **Tests** for gates, hosting, billing portal, and `tokensMigration`.
+
+[0.83.4]: https://github.com/shaferllc/keel/releases/tag/v0.83.4
+
+## [0.83.3] — 2026-07-12
+
+### Added
+
+- **`@shaferllc/keel/gates`** — signup gating for private alpha / waitlist:
+  email allowlist + invite codes (`canRegister` / `redeemInvite`), shipped as a
+  package with a migration. Used by Keel Cloud; not the same as team invitations
+  or authorization gates.
+- **`@shaferllc/keel/hosting`** — Cloudflare client, hostname helpers, SQL dump,
+  and secrets encryption helpers for hosted Workers/D1 apps.
+
+[0.83.3]: https://github.com/shaferllc/keel/releases/tag/v0.83.3
+
 ## [0.83.2] — 2026-07-12
 
 ### Added

package/docs/examples/gates.ts

@@ -0,0 +1,30 @@
+// Type-check harness for docs/gates.md. Compile-only — never executed.
+import { Application, json } from "@shaferllc/keel/core";
+import {
+  GatesServiceProvider,
+  InviteCode,
+  EmailAllowlist,
+  canRegister,
+  redeemInvite,
+} from "@shaferllc/keel/gates";
+
+export function install() {
+  const app = new Application();
+  app.register(GatesServiceProvider);
+  return app;
+}
+
+export async function register(email: string, inviteCode?: string) {
+  const gate = await canRegister(email, inviteCode);
+  if (!gate.ok) return json({ error: gate.reason }, 403);
+
+  if (gate.via === "code" && gate.invite) {
+    await redeemInvite(gate.invite);
+  }
+  return json({ ok: true, via: gate.via });
+}
+
+export async function seed() {
+  await InviteCode.create({ code: "ALPHA-42", max_uses: 10, uses: 0, expires_at: null });
+  await EmailAllowlist.create({ email: "ada@example.com" });
+}

package/docs/examples/hosting.ts

@@ -0,0 +1,37 @@
+// Type-check harness for docs/hosting.md. Compile-only — never executed.
+import type { Connection } from "@shaferllc/keel/core";
+import {
+  CloudflareClient,
+  cloudflareConfigured,
+  normalizeHostname,
+  isValidHostname,
+  zoneCandidates,
+  dumpConnection,
+  normalizeSecretKey,
+  encryptSecretValue,
+  decryptSecretValue,
+  resolveSecretRows,
+} from "@shaferllc/keel/hosting";
+
+export function client() {
+  const creds = { accountId: "acct", apiToken: "tok" };
+  if (!cloudflareConfigured(creds)) throw new Error("missing");
+  return new CloudflareClient(creds);
+}
+
+export function hostnames(raw: string) {
+  const host = normalizeHostname(raw);
+  return { host, valid: isValidHostname(host), zones: zoneCandidates(host) };
+}
+
+export async function dump(conn: Connection) {
+  return dumpConnection(conn, "Acme local D1", { generatedBy: "Keel Cloud" });
+}
+
+export async function vault(secret: string) {
+  const key = normalizeSecretKey("stripe-secret-key");
+  const encrypted = await encryptSecretValue(secret, "app-secret");
+  const plain = await decryptSecretValue(encrypted, "app-secret");
+  const env = await resolveSecretRows([{ key, value_encrypted: encrypted }], "app-secret");
+  return { key, plain, env };
+}

package/docs/gates.md

@@ -0,0 +1,75 @@
+# Gates
+
+Keel Gates is a **signup gate** for private alpha / waitlist apps: an email
+allowlist, invite codes with use limits and expiry, and a single check that
+answers "may this person register?". It ships as `@shaferllc/keel/gates`.
+
+This is **not** authorization (`can` / policies in [authorization](./authorization.md))
+and **not** team invitations ([teams](./teams.md)). Those answer different
+questions. Gates answers only: *is this email allowed to create an account?*
+
+## Install
+
+```ts
+// bootstrap/providers.ts
+import { GatesServiceProvider } from "@shaferllc/keel/gates";
+
+export const providers = [AppServiceProvider, GatesServiceProvider];
+```
+
+Then migrate — the provider contributes `invite_codes` and `email_allowlist`
+tables (`CREATE TABLE IF NOT EXISTS`, so existing apps stay safe):
+
+```bash
+keel migrate
+```
+
+## Checking registration
+
+```ts
+import { canRegister, redeemInvite } from "@shaferllc/keel/gates";
+
+const gate = await canRegister(email, inviteCode);
+if (!gate.ok) {
+  return json({ error: gate.reason }, 403);
+}
+
+// …create the user…
+
+if (gate.via === "code" && gate.invite) {
+  await redeemInvite(gate.invite); // increments uses
+}
+```
+
+`canRegister` returns:
+
+| Result | Meaning |
+|--------|---------|
+| `{ ok: true, via: "allowlist" }` | Email is on `email_allowlist` |
+| `{ ok: true, via: "code", invite }` | Valid invite code (not expired, uses left) |
+| `{ ok: false, reason }` | Rejected — show `reason` to the user |
+
+Allowlist wins over codes: if the email is allowlisted, the code is ignored.
+
+## Managing codes and allowlist
+
+The models are ordinary Keel models — create rows from an admin UI or a seeder:
+
+```ts
+import { InviteCode, EmailAllowlist } from "@shaferllc/keel/gates";
+
+await InviteCode.create({
+  code: "ALPHA-42",
+  max_uses: 10,
+  uses: 0,
+  expires_at: null,
+});
+
+await EmailAllowlist.create({ email: "ada@example.com" });
+```
+
+## Related
+
+- [Accounts](./accounts.md) — register / login flows that call `canRegister` first
+- [Teams](./teams.md) — invitations *into* a team, after the user already exists
+- [Authorization](./authorization.md) — ability checks once they're signed in