create-ailk 0.1.0 → 0.1.1

package/templates/apps/web/lib/site-brand.tsx

@@ -0,0 +1,118 @@
+/**
+ * Site brand — the one place `apps/web` resolves its display name, base URL,
+ * and logo mark (#4984). Extracted verbatim from `app/[locale]/layout.tsx`
+ * so the /sign-in card can render the same brand mark the Nav + Footer
+ * chrome slots do, without a second copy drifting.
+ *
+ * #4157 — `SITE_NAME` / `SITE_BASE_URL` resolve, in order:
+ *   1. The env override (`NEXT_PUBLIC_SITE_NAME` / `NEXT_PUBLIC_BASE_URL`).
+ *   2. `content/_site.mdx`'s `siteName:` / `baseUrl:` frontmatter — the
+ *      customer's own canonical site identity, set by `create-ailk` at
+ *      scaffold time (or edited later, e.g. via the `set_site_identity` MCP
+ *      tool).
+ *   3. A neutral, non-vendor fallback — used only when `_site.mdx` is
+ *      missing or its frontmatter doesn't parse. NEVER "AI Launch Kit": a
+ *      fresh scaffold's `_site.mdx` always carries the customer's real name
+ *      (`packages/create-ailk/template-overlay/content/_site.mdx`), so this
+ *      fallback is a last resort, not the everyday default.
+ *
+ * `_site.mdx` reading is a small, local, synchronous frontmatter parse
+ * rather than a dependency on `@working-theory/site-config`'s `loadSiteConfig`
+ * (`packages/site-config/src/server/load.ts`): that package is async (this
+ * module's exports are plain constants, read at many synchronous call
+ * sites — Nav/Footer props, `siteLogo()`, edge-safe route defaults) and
+ * brings gray-matter + Zod validation + optimistic-locking writes built for
+ * the agent-operator editing workflow — disproportionate for reading two
+ * fields. See docs/specs/4157-scaffold-brand-defaults-spec.md § Design
+ * Decisions (D1) for the full reasoning.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { ReactElement } from "react";
+import { parse as parseYaml } from "yaml";
+
+/** Neutral, non-vendor fallback — see module doc comment point 3. */
+export const FALLBACK_SITE_NAME = "My Site";
+/** Neutral, non-vendor fallback — see module doc comment point 3. */
+export const FALLBACK_BASE_URL = "https://example.com";
+
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---/;
+
+interface SiteFrontmatter {
+  // `| undefined` on top of `?` — required under exactOptionalPropertyTypes
+  // because readSiteFrontmatter() always sets both keys, sometimes to
+  // `undefined` (a plain `?: string` would forbid that explicit assignment).
+  siteName?: string | undefined;
+  baseUrl?: string | undefined;
+}
+
+/**
+ * Resolve the content root exactly the way
+ * `packages/page-renderer/src/content-selector.ts`'s (unexported)
+ * `resolveContentRoot()` does: `AILK_CONTENT_ROOT` env override, else two
+ * levels up from cwd — `apps/web` in dev/build, so `../../content` lands on
+ * the site/scaffold root's `content/` directory. Duplicated locally because
+ * that resolver isn't part of `@working-theory/page-renderer`'s public API.
+ */
+function resolveContentRoot(): string {
+  const override = process.env.AILK_CONTENT_ROOT;
+  if (override && override.length > 0) return override;
+  return join(process.cwd(), "..", "..", "content");
+}
+
+/**
+ * Synchronously read + parse just the `siteName` / `baseUrl` frontmatter
+ * fields out of `_site.mdx`. Returns `null` on any failure (file absent,
+ * unreadable, no frontmatter block, unparseable YAML) — callers fall back to
+ * a neutral default, never to a vendor-branded one.
+ */
+function readSiteFrontmatter(): SiteFrontmatter | null {
+  try {
+    const path = join(resolveContentRoot(), "_site.mdx");
+    if (!existsSync(path)) return null;
+
+    const raw = readFileSync(path, "utf8");
+    const match = FRONTMATTER_RE.exec(raw);
+    if (!match) return null;
+
+    const parsed: unknown = parseYaml(match[1] ?? "");
+    if (!parsed || typeof parsed !== "object") return null;
+
+    const { siteName, baseUrl } = parsed as Record<string, unknown>;
+    return {
+      siteName: typeof siteName === "string" ? siteName : undefined,
+      baseUrl: typeof baseUrl === "string" ? baseUrl : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+// Read once at module init — mirrors the existing SITE_NAME contract (a
+// plain constant, not a function), and every consumer of this module already
+// runs in the Node.js runtime (no `content/` access exists in the Edge
+// runtime, so `app/og/route.tsx` — the one Edge-runtime consumer among the
+// #4157 sites — deliberately does NOT import this module; see its own
+// comment).
+const siteFrontmatter = readSiteFrontmatter();
+
+export const SITE_NAME =
+  process.env.NEXT_PUBLIC_SITE_NAME ?? siteFrontmatter?.siteName ?? FALLBACK_SITE_NAME;
+
+export const SITE_BASE_URL =
+  process.env.NEXT_PUBLIC_BASE_URL ?? siteFrontmatter?.baseUrl ?? FALLBACK_BASE_URL;
+
+/**
+ * Shared brand mark — the light/dark logo pair, mode-switched via the theme
+ * `dark:` utility. RSC-safe (no hooks, no client state).
+ */
+export function siteLogo(): ReactElement {
+  return (
+    <>
+      <img src="/logo-light.svg" alt={SITE_NAME} height={28} className="block dark:hidden" />
+      <img src="/logo-dark.svg" alt={SITE_NAME} height={28} className="hidden dark:block" />
+    </>
+  );
+}

package/templates/apps/web/messages/en.json

@@ -4,7 +4,12 @@
     "docs": "Docs",
     "blog": "Blog",
     "openMenu": "Open navigation menu",
-    "closeMenu": "Close navigation menu"
+    "closeMenu": "Close navigation menu",
+    "moreLinks": "More links",
+    "schedule": "Book a call",
+    "signIn": "Sign in",
+    "signOut": "Sign out",
+    "account": "Account"
   },
   "consent": {
     "title": "Cookie Preferences",
@@ -14,10 +19,10 @@
     "policyLinkLabel": "Privacy policy"
   },
   "common": {
-    "siteTitle": "AI Launch Kit"
+    "siteTitle": "My Site"
   },
   "home": {
-    "heading": "AI Launch Kit",
+    "heading": "My Site",
     "emptyState": "AX-first OSS template for shipping software with API + MCP as canonical surfaces."
   },
   "about": {
@@ -58,7 +63,22 @@
     "messageLabel": "Message",
     "sending": "Sending\u2026",
     "sendMessage": "Send message",
-    "successMessage": "Thank you for reaching out! We will be in touch shortly."
+    "successMessage": "Thank you for reaching out! We will be in touch shortly.",
+    "intake": {
+      "guidedBadge": "Guided",
+      "skip": "Skip",
+      "send": "Send",
+      "freeTextPlaceholder": "Type your answer\u2026",
+      "nameAck": "Thanks for stopping by!",
+      "namePrompt": "What's your name?",
+      "messageAck": "Good to meet you.",
+      "messagePrompt": "What are you hoping to get done?",
+      "emailAck": "Got it \u2014 last one.",
+      "emailPrompt": "What's the best email to reach you at?",
+      "skipMessage": "No worries \u2014 here's our form instead.",
+      "completionMessage": "Thanks! We'll be in touch shortly.",
+      "submitError": "We couldn't send that automatically \u2014 please review and send below."
+    }
   },
   "downloads": {
     "heading": "Downloads",
@@ -72,9 +92,71 @@
     "heading": "FAQ",
     "emptyState": "Frequently asked questions content coming soon."
   },
+  "flow": {
+    "progress": "Step {current} of {total}",
+    "validationRequired": "This field is required",
+    "validationInvalidEmail": "Enter a valid email address",
+    "validationSelectOption": "Choose an option to continue",
+    "validationTooLong": "This value is too long",
+    "validationInvalidUrl": "Enter a valid URL",
+    "validationTooShort": "Please add a bit more detail",
+    "validationSelectAtLeastOne": "Choose at least one option to continue",
+    "submitError": "Something went wrong, please try again.",
+    "rateLimited": "Too many attempts — please wait {seconds}s and try again.",
+    "next": "Continue",
+    "completedTitle": "You're all set",
+    "completedBody": "Thanks — we'll be in touch shortly.",
+    "goBack": "Go Back",
+    "computing": "Scoring your site's AI visibility...",
+    "whyThis": "Why this?",
+    "selectAllThatApply": "Select all that apply",
+    "getStarted": "Get Started",
+    "landingIntro": "A few short questions, then your result \u2014 it takes about a minute.",
+    "bookCall": "Book a Call",
+    "emailMePlan": "Save plan",
+    "pairingTitle": "Better together",
+    "pay": "Pay",
+    "back": "Back",
+    "emailStepTitle": "Where should we send your receipt?",
+    "emailStepSaveTitle": "Where should we send your plan?",
+    "emailPlaceholder": "you@company.com",
+    "checkoutSuccess": "Payment received \u2014 we'll be in touch to get you set up.",
+    "checkoutCancelled": "Checkout cancelled \u2014 your recommendation is still here whenever you're ready.",
+    "savedTitle": "Plan sent",
+    "savedBody": "Check your inbox \u2014 your recommendation is on its way.",
+    "checkoutError": "We couldn't start checkout \u2014 please try again.",
+    "sidePanel": {
+      "anchorTitle": "Not sure where to start?"
+    },
+    "price": {
+      "fromPrefix": "From"
+    },
+    "priceCard": {
+      "eyebrow": "Recommended for you",
+      "seatRowLabel": "Seats",
+      "creditRowLabel": "Credits",
+      "totalLabel": "Total",
+      "dueTodayLabel": "Due today",
+      "periodLabels": {
+        "monthly": "per month",
+        "annual": "per year",
+        "one-time": "one-time"
+      },
+      "seatsLabel": "Seats",
+      "decrementLabel": "Remove a seat",
+      "incrementLabel": "Add a seat",
+      "periodLabel": "Billing",
+      "creditsLabel": "Add-on credits",
+      "creditNoneLabel": "None",
+      "creditTierLabel": "{credits} credits",
+      "showBreakdownLabel": "Show breakdown",
+      "hideBreakdownLabel": "Hide breakdown"
+    },
+    "questions": {}
+  },
   "how-to": {
     "heading": "How-To Guides",
-    "description": "Step-by-step guides for building with AI Launch Kit.",
+    "description": "Step-by-step guides for building with this site.",
     "emptyState": "How-to guides coming soon."
   },
   "integrations": {
@@ -101,6 +183,24 @@
     "heading": "Resources",
     "emptyState": "Resources listing coming soon."
   },
+  "schedule": {
+    "title": "Book a call",
+    "description": "Pick a time that works for you.",
+    "eyebrow": "Book a call",
+    "headline": "Pick a time that works",
+    "confirmed": {
+      "title": "You're booked",
+      "description": "Your call is confirmed and the calendar invite is on its way.",
+      "headline": "You're booked",
+      "subheadline": "The calendar invite is on its way to your inbox. Add it now so the time is held on both sides.",
+      "prepareHeadline": "Before the call",
+      "prepareBody": "Come with the one problem you most want solved. The more specific it is, the more we can get through in the time we have. If something changes, the invite carries a reschedule link \u2014 use it rather than letting the slot go quiet.",
+      "ctaHeadline": "While you wait",
+      "ctaDescription": "Have a look around, or get in touch if something comes up before we speak.",
+      "ctaPrimaryLabel": "Back to the site",
+      "ctaSecondaryLabel": "Contact us"
+    }
+  },
   "services": {
     "heading": "Services",
     "emptyState": "Services listing coming soon."
@@ -112,7 +212,7 @@
   },
   "tech-articles": {
     "heading": "Technical Articles",
-    "description": "Deep dives into the architecture and internals of AI Launch Kit.",
+    "description": "Deep dives into the architecture and internals of this site.",
     "emptyState": "Technical articles coming soon."
   },
   "testimonials": {
@@ -123,9 +223,177 @@
     "heading": "Use Cases",
     "emptyState": "Use cases listing coming soon."
   },
+  "waitlistDashboard": {
+    "gate": {
+      "emptyHeadline": "Sign-in is not configured",
+      "emptyDescription": "No sign-in provider is active for this deployment yet. Set the provider environment variables to enable operator access.",
+      "signInLink": "Go to the sign-in page"
+    },
+    "status": {
+      "live": "Live",
+      "closed": "Closed",
+      "draft": "Draft"
+    },
+    "mode": {
+      "lead-capture": "Lead capture",
+      "qualifying": "Qualifying",
+      "paid": "Paid",
+      "recommending": "Recommending"
+    },
+    "common": {
+      "unavailable": "—",
+      "direct": "(direct)",
+      "other": "(other)",
+      "forbiddenHeadline": "You don't have access",
+      "forbiddenDescription": "Ask an owner or admin on this workspace for access to the waitlist dashboard."
+    },
+    "list": {
+      "title": "Waitlist experiments",
+      "description": "Every experiment in your scope, with a cross-experiment rollup above the list.",
+      "rollupAriaLabel": "Waitlist rollup",
+      "rollup": {
+        "live": "live",
+        "closed": "closed",
+        "draft": "draft",
+        "raw": "raw signups",
+        "qualified": "qualified",
+        "rate": "qualification rate",
+        "sites": "sites"
+      },
+      "table": {
+        "caption": "Experiments in your scope",
+        "columnKey": "Key",
+        "columnMode": "Mode",
+        "columnStatus": "Status",
+        "columnWaitlists": "Waitlists",
+        "columnRaw": "Raw",
+        "columnQualified": "Qualified",
+        "columnRate": "Rate",
+        "columnUpdated": "Updated",
+        "emptyHeadline": "No experiments yet",
+        "emptyDescription": "Experiments you create will appear here."
+      },
+      "offers": {
+        "captionPrefix": "Offer funnel \u2014",
+        "columnOffer": "Offer",
+        "columnRecommended": "Recommended",
+        "columnSaved": "Saved",
+        "columnCheckedOut": "Checked out"
+      }
+    },
+    "level": {
+      "gate": "Gate",
+      "label": "Level {n}"
+    },
+    "comparison": {
+      "breadcrumbExperiments": "Experiments",
+      "site": "Site",
+      "created": "Created",
+      "waitlistsCount": "Waitlists",
+      "campaigns": "Campaigns",
+      "tableCaption": "Signups by waitlist",
+      "columnTotal": "Total",
+      "rowRaw": "Raw signups",
+      "rowQualified": "Qualified",
+      "rowRate": "Qualification rate",
+      "tierRowPrefix": "Tier",
+      "bySourceCaption": "Conversion by source",
+      "bySourceColumnSource": "Source",
+      "bySourceColumnRaw": "Raw",
+      "bySourceColumnQualified": "Qualified",
+      "bySourceColumnRate": "Rate",
+      "distributionAnswered": "{count} answered",
+      "distributionNoAnswers": "No answers yet.",
+      "signupsCaption": "Signups",
+      "signupsColumnEmail": "Email",
+      "signupsColumnWaitlist": "Waitlist",
+      "signupsColumnSource": "Source",
+      "signupsColumnCreated": "Captured",
+      "signupsColumnTier": "Tier",
+      "signupsColumnScore": "Score",
+      "signupsNext": "Next",
+      "notFoundHeadline": "Experiment not found",
+      "notFoundDescription": "This experiment doesn't exist, or isn't in your scope.",
+      "genericTitle": "Waitlist comparison"
+    },
+    "signup": {
+      "breadcrumbComparison": "Comparison",
+      "email": "Email",
+      "waitlist": "Waitlist",
+      "source": "Source",
+      "captured": "Captured",
+      "tier": "Tier",
+      "score": "Score",
+      "answersTitle": "Answers",
+      "categoryScoresTitle": "Category scores",
+      "decidingDefsTitle": "Deciding factors",
+      "ruleTraceTitle": "Rule trace",
+      "notScoredHeadline": "Not scored",
+      "notScoredDescription": "No score has been computed for this signup yet.",
+      "notFoundHeadline": "Signup not found",
+      "notFoundDescription": "This signup doesn't exist, or isn't in your scope.",
+      "genericTitle": "Waitlist signup"
+    }
+  },
   "whitepapers": {
     "heading": "Whitepapers",
-    "description": "In-depth research and strategy papers from the AI Launch Kit team.",
+    "description": "In-depth research and strategy papers from this site's team.",
     "emptyState": "Whitepapers coming soon."
+  },
+  "signIn": {
+    "title": "Sign in",
+    "description": "Sign in to your account.",
+    "heading": "Sign in to your account",
+    "subhead": "Welcome back. Choose how you'd like to continue.",
+    "notConfiguredSubhead": "Sign-in is not configured for this site yet. Set a provider's environment variables to enable it.",
+    "ssoPrefix": "Sign in with",
+    "google": "Google",
+    "github": "GitHub",
+    "email": "Email address",
+    "password": "Password",
+    "forgot": "Forgot password?",
+    "submit": "Sign in",
+    "orContinue": "Or continue with",
+    "signInFailed": "We couldn't sign you in. Check your details and try again.",
+    "providerFailed": "We couldn't start sign-in with that provider. Try again."
+  },
+  "account": {
+    "title": "Your account",
+    "description": "Your profile, results, and purchases.",
+    "nav": {
+      "profile": "Profile",
+      "results": "Results",
+      "purchases": "Purchases"
+    },
+    "profile": {
+      "heading": "Profile",
+      "name": "Name",
+      "email": "Email",
+      "verified": "Email verified",
+      "unverified": "Email not verified",
+      "unavailable": "—",
+      "signOut": "Sign out"
+    },
+    "results": {
+      "heading": "My results",
+      "experiment": "Experiment",
+      "waitlist": "Waitlist",
+      "tier": "Tier",
+      "score": "Score",
+      "completedAt": "Completed",
+      "unavailable": "—",
+      "emptyHeadline": "No results yet",
+      "emptyDescription": "Complete a diagnostic and your results will appear here."
+    },
+    "purchases": {
+      "heading": "My purchases",
+      "offer": "Offer",
+      "status": "Status",
+      "amount": "Amount",
+      "period": "Period",
+      "date": "Date",
+      "emptyHeadline": "No purchases yet",
+      "emptyDescription": "Purchases you complete will appear here."
+    }
   }
 }

package/templates/apps/web/middleware.ts

@@ -72,9 +72,17 @@ export function middleware(request: NextRequest): NextResponse {
   return intlResponse;
 }
 
-// Skip Next.js internal assets and favicons — security headers attach to
-// user-facing routes and API handlers, not framework asset endpoints.
+// Skip Next.js internal assets and public/ files — security headers attach to
+// user-facing routes and API handlers, not framework or static asset endpoints.
 // Also exclude next-intl-specific internal paths (_next/server).
+//
+// The trailing `.*\\..*` alternative excludes any path whose last segment
+// contains a dot, i.e. every file with an extension. Without it the negative
+// lookahead named only favicon.ico, so next-intl's locale rewrite swallowed
+// every OTHER public/ asset — logo-light.svg, logo-dark.svg, site.webmanifest,
+// og-default.png — and each 404'd (#4090 item 4). robots.txt and sitemap.xml are
+// route handlers rather than public/ files, but they carry extensions too and
+// are equally not locale-scoped, so the same rule covers them.
 export const config = {
-  matcher: "/((?!_next/static|_next/image|_next/server|favicon.ico).*)",
+  matcher: "/((?!_next/static|_next/image|_next/server|.*\\..*).*)",
 };

package/templates/apps/web/next.config.mjs

@@ -88,10 +88,16 @@ const nextConfig = {
   // pnpm-workspace.yaml files exist (e.g. in agent worktrees).
   outputFileTracingRoot: join(process.cwd(), "../../"),
   // Include all MDX content files in the standalone bundle.
-  // Paths are relative to outputFileTracingRoot (repo root).
   // Scoped to *.mdx only — avoids pulling images/binaries into the standalone bundle.
+  //
+  // The glob resolves against THIS APP'S cwd (apps/web), not against
+  // outputFileTracingRoot — a comment here previously claimed the opposite, and
+  // the claim was the bug (#4090 item 3). "./content/**/*.mdx" therefore matched
+  // only apps/web/content (the fumadocs blog/docs tree) and never the site-level
+  // content/ directory that carries the schema-typed pages, so the standalone
+  // output shipped without them and postbuild's assert-content-bundled failed.
   outputFileTracingIncludes: {
-    "/**": ["./content/**/*.mdx"],
+    "/**": ["../../content/**/*.mdx"],
   },
   // Workspace packages live outside this app's directory. Next.js must
   // transpile them from source so that "use client" / "use server" directives

package/templates/apps/web/package.json

@@ -12,43 +12,49 @@
     "start": "next start",
     "pretypecheck": "fumadocs-mdx",
     "type-check": "tsc --noEmit",
-    "lint": "eslint . --no-cache",
+    "lint": "next lint",
     "pretest": "fumadocs-mdx",
     "test": "jest",
     "test:watch": "jest --watch"
   },
   "dependencies": {
+    "@prisma/adapter-pg": "^7.8.0",
+    "@sentry/nextjs": "^10.58.0",
     "@working-theory/analytics": "workspace:*",
-    "@working-theory/page-renderer": "workspace:*",
     "@working-theory/api-client": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
     "@working-theory/database": "workspace:*",
     "@working-theory/fumadocs-schema": "workspace:*",
+    "@working-theory/jsonld": "workspace:*",
     "@working-theory/metadata": "workspace:*",
+    "@working-theory/page-renderer": "workspace:*",
     "@working-theory/schema": "workspace:*",
     "@working-theory/schema-pack-registry": "workspace:*",
+    "@working-theory/schema-validator": "workspace:*",
     "@working-theory/templates": "workspace:*",
     "@working-theory/theme": "workspace:*",
     "@working-theory/ui": "workspace:*",
     "@working-theory/validation": "workspace:*",
     "@working-theory/web-i18n": "workspace:*",
-    "@prisma/adapter-pg": "^7.8.0",
-    "@sentry/nextjs": "^10.58.0",
-    "better-auth": "1.6.19",
+    "better-auth": "1.6.22",
     "fumadocs-core": "^16.10.4",
     "fumadocs-mdx": "^15.0.12",
-    "next": "^16.2.9",
+    "lucide-react": "^0.577.0",
+    "next": "^16.3.3",
     "next-intl": "^3.26.3",
     "next-mdx-remote": "^6.0.0",
     "pg": "^8.22.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
+    "yaml": "^2.9.0",
     "zod": "^4.2.1"
   },
   "devDependencies": {
     "@next/bundle-analyzer": "^15.5.19",
+    "@tailwindcss/postcss": "^4.3.2",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
+    "@testing-library/user-event": "^14.5.2",
     "@types/jest": "^30.0.0",
     "@types/node": "^22.20.0",
     "@types/pg": "^8.20.0",
@@ -56,7 +62,10 @@
     "@types/react-dom": "^19.2.0",
     "jest": "^30.4.2",
     "jest-environment-jsdom": "^30.4.1",
+    "tailwindcss": "^4.3.2",
     "ts-jest": "^29.4.11",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "@working-theory/license": "workspace:*",
+    "@working-theory/sections-registry": "workspace:*"
   }
 }

package/templates/apps/web/postcss.config.mjs

@@ -0,0 +1,23 @@
+// PostCSS configuration for @working-theory/web.
+//
+// Uses @tailwindcss/postcss (Tailwind v4's PostCSS plugin) so Next.js processes
+// the `@import "tailwindcss"` in app/globals.css and emits real utility classes.
+// Without this file Next runs CSS through its built-in PostCSS pipeline, which
+// does not include Tailwind — `flex`, `hidden`, `md:flex` compile to nothing and
+// every page renders unstyled (#1531, and #4090 item 1 for the scaffold).
+//
+// Extension: `.mjs`, not `.js` or `.cjs`. Neither this package nor the repo root
+// declares `"type"`, so a bare `.js` here would be parsed as CommonJS and the
+// ESM `export default` below would be a syntax error. `.mjs` states the format
+// in the filename instead of inheriting it from a `"type"` field that a consumer
+// may later add or remove, and matches this app's existing next.config.mjs.
+// (apps-paid/marketing-web can use a plain `.js` only because it declares
+// `"type": "module"` — see #4090, whose premise that apps/web does the same does
+// not hold.)
+
+/** @type {import('postcss').ProcessOptions} */
+export default {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};

package/templates/apps/web/public/.well-known/security.txt

@@ -7,11 +7,11 @@
 #   gpg --verify security.txt.sig security.txt
 
 Contact: mailto:security@ailaunchkit.ai
-Contact: https://github.com/tailwind-ai/ai-launch-kit/security/advisories/new
+Contact: https://github.com/working-theory-labs/ai-launch-kit/security/advisories/new
 Expires: 2027-05-13T00:00:00.000Z
 Encryption: https://keys.openpgp.org/vks/v1/by-email/security@ailaunchkit.ai
 Preferred-Languages: en
 Canonical: https://ailaunchkit.ai/.well-known/security.txt
-Policy: https://github.com/tailwind-ai/ai-launch-kit/blob/main/SECURITY.md
-Acknowledgments: https://github.com/tailwind-ai/ai-launch-kit/blob/main/SECURITY.md#hall-of-fame
+Policy: https://github.com/working-theory-labs/ai-launch-kit/blob/main/SECURITY.md
+Acknowledgments: https://github.com/working-theory-labs/ai-launch-kit/blob/main/SECURITY.md#hall-of-fame
 Hiring: https://ailaunchkit.ai/careers

package/templates/apps/web/src/lib/routes.ts

@@ -5,12 +5,25 @@
  * handlers to avoid copy-paste duplication.
  */
 
+import { SITE_BASE_URL } from "../../lib/site-brand";
+
 /**
  * Resolves the canonical base URL for the site.
- * Falls back to a placeholder so routes work without env configuration.
+ *
+ * #4157 — the same resolution order `lib/site-brand.tsx`'s `SITE_BASE_URL`
+ * documents: `NEXT_PUBLIC_BASE_URL` (env override) → `content/_site.mdx`'s
+ * `baseUrl:` frontmatter → a neutral placeholder. `process.env` is read
+ * FRESH on every call rather than delegating straight to `SITE_BASE_URL`
+ * (a module-load-time constant) — this function's callers (route handlers)
+ * expect a per-call env read, the same contract this function had before
+ * #4157; a frozen snapshot would silently stop honoring an env var set
+ * after this module first loaded. Every caller runs in the Node.js runtime
+ * (none of robots.txt/sitemap.xml/llms.txt/ai-plugin.json/mcp.json/layout
+ * declares `runtime = "edge"`), so the frontmatter-derived fallback
+ * (`SITE_BASE_URL`, when no env override is set) is safe here.
  */
 export function resolveBaseUrl(): string {
-  return process.env["NEXT_PUBLIC_BASE_URL"] ?? "https://ailk.example.com";
+  return process.env["NEXT_PUBLIC_BASE_URL"] ?? SITE_BASE_URL;
 }
 
 /**

package/templates/apps/web/tsconfig.json

@@ -16,20 +16,5 @@
     "types": ["jest", "node", "@testing-library/jest-dom"]
   },
   "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules", ".next", "dist"],
-  "references": [
-    { "path": "../../packages/analytics" },
-    { "path": "../../packages/page-renderer" },
-    { "path": "../../packages/api-client" },
-    { "path": "../../packages/theme" },
-    { "path": "../../packages/content-adapters" },
-    { "path": "../../packages/fumadocs-schema" },
-    { "path": "../../packages/metadata" },
-    { "path": "../../packages/schema" },
-    { "path": "../../packages/schema-pack-registry" },
-    { "path": "../../packages/templates" },
-    { "path": "../../packages/ui" },
-    { "path": "../../packages/validation" },
-    { "path": "../../packages/web-i18n" }
-  ]
+  "exclude": ["node_modules", ".next", "dist"]
 }