create-ailk 0.1.0 → 0.1.1

package/templates/database/CHANGELOG.md

@@ -1,5 +1,387 @@
 # @working-theory/database
 
+## 0.19.0
+
+### Minor Changes
+
+- [#5266](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5266) [`911e452`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/911e452c13b45e7fba213ed34290c981cc1bf346) Thanks [@claudio-planck](https://github.com/claudio-planck)! - `ProjectListing` (`inbox` namespace) gains `submittedCopy`, `copyEditedAt` and `copyEditedBy`, with migration `20260911120000_listing_copy_edit_audit`. They back the operator's copy edit — the third review outcome beside approve and reject: `copyEditedAt`/`copyEditedBy` mirror the existing `decidedAt`/`decidedBy` audit pair and are re-stamped on every edit, while `submittedCopy` is written once, on the first edit only, and preserves the five published copy fields exactly as the applicant submitted them. Additive — every existing column, model and migration is unchanged, and a row with the three columns unset behaves as before. Consumers that vendor `apps/api` need this version: `apps/api/src/services/project-listings.ts` writes the new fields and `PATCH /v1/project-listings/:id/copy` is the route that calls it.
+
+### Patch Changes
+
+- [#5204](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5204) [`c74fdba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74fdbaab253941b4f862ac0da845fab7c879d49) Thanks [@claudio-planck](https://github.com/claudio-planck)! - License/publication flip: adds `license: Apache-2.0` + a root `LICENSE` file and flips `publishConfig.access` from `restricted` to `public`, per the `commercial_tier: oss` disposition (`architecture.yaml`, A1 [#5075](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5075)) and ADR 0033. No behavior change.
+
+- [#5156](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5156) [`ddac6c1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ddac6c1c05ff30765d78c69e8f298a35082202ef) Thanks [@claudio-planck](https://github.com/claudio-planck)! - `@working-theory/metadata`: `mcp-tool-catalog.ts` gains an optional `module` field per tool entry (set on the scheduling and content-write tools), consumed by `apps/mcp/src/server.ts` to gate registration when a paid module is excluded (S1, [#5088](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5088)). Additive — `McpToolCatalogEntry`/`McpToolRegistration` both keep every existing field.
+
+  `database` and `@working-theory/ui`: comment-only path-reference fixes after the S1 workspace move, which relocated the workspace app under the paid tree — no behavior change.
+
+- Updated dependencies [[`6b76b3d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6b76b3d65e3b9cfb5cf8bfeb4309b9b8fb9c1345), [`23c7fd6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/23c7fd601e48a37f3f210e130cb8dcd37899b9ab), [`c74fdba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74fdbaab253941b4f862ac0da845fab7c879d49)]:
+  - @working-theory/validation@0.19.0
+
+## 0.18.0
+
+### Minor Changes
+
+- [#5056](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5056) [`8d2b130`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8d2b1305aa08dde674d15214b9c546fbdc3c60d1) Thanks [@claudio-planck](https://github.com/claudio-planck)! - <!--
+  MINOR, not MAJOR, and the changes below are still breaking. The published
+  group is on the `0.y.z` initial-development line, where MAJOR is pinned at 0
+  (claude-setup `rules/operating-policy.md` § Hard floors are the SemVer public
+  API, D7; AILK `docs/decisions/semver-activation.md`). A literal `major` here
+  would take the whole fixed group from 0.17.0 straight to 1.0.0 — a declaration
+  that the API is stable, which is a positioning act and not something a
+  changeset should perform as a side effect of describing breakage. [#5043](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5043) hit
+  that trap and [#5045](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5045) records the lesson. Pre-1.0, a breaking change is a MINOR
+  flagged breaking in the changelog, which is what the "**Breaking —**"
+  paragraphs below do.
+
+  `@working-theory/api-client` is NOT listed: it sits in `.changeset/config.json`'s
+  `ignore` list and changesets refuses a changeset mixing ignored and
+  non-ignored packages. Its version is bumped by hand in this repo (the [#5013](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5013) /
+  [#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036) precedent). Its change is described below anyway, because the
+  description is what a consumer reads.
+  -->
+
+  The consumer half of project listings ships: a mountable founder application, its previews, its shelves and its card ([#5048](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5048))
+
+  Project listings shipped backend-only. After [#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036) replaced one anonymous POST
+  with a three-call resumable-draft protocol, every consuming site had to
+  hand-write three proxy routes, a form that saved on each advance, and a
+  decision about where a bearer credential lives. That is a platform capability,
+  not per-site plumbing, and this is it.
+
+  **`@working-theory/ui` — the mountable surface.** `ListingApplicationFlow` is a
+  new section: a site passes its own step config, its own copy and a draft
+  client, and gets a resumable multi-step application with a live preview tile.
+  It is NOT a new stepper — it configures `FlowStepper` ([#3957](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/3957)) and supplies an
+  `onSubmitStep` that calls the draft protocol. Also new: `ProjectListingCard`
+  and `ProjectListingShelves` (the two shelves and the tile),
+  `ListingPrivacyNotice` (the per-listing disclosure, rendered on the flow where
+  a visitor submits, naming the founder as the party collecting their data),
+  `ListingTilePreview`, `ListingQuestionReview` and `ListingFullPreview`.
+
+  Not one of these ships a founder-readable string. Every prompt, option label,
+  button label, band label and privacy sentence is a required prop or config
+  value.
+
+  **`@working-theory/ui` — `FlowStepper` gains three additive props.**
+  `customSteps` resolves a `custom` step's renderer, `initialStepKey` lands a
+  resumed flow past the step that minted its draft, and `sidePanel`'s view object
+  gains `answers` and `live` so a side region can render what the visitor is
+  typing right now. Every existing caller compiles and behaves unchanged.
+
+  **`@working-theory/validation` — the configuration contract.**
+  `listingApplicationConfigSchema` is what a site supplies, and
+  `compileListingApplicationFlow` turns it into a `FlowConfig`. Two ordering
+  constraints are ENFORCED at parse time rather than documented: `contact` must
+  be the first step (the draft is keyed on the identity it captures, so nothing
+  can save before it), and a `preview` step must follow every step kind it
+  previews (ordered earlier it has nothing to render). Both fail loudly.
+
+  `flowStepSchema` gains one additive member, `custom`, carrying a `renderer`
+  identifier the mounting surface resolves. Every existing flow config parses
+  unchanged.
+
+  **Breaking — the application payload names its site by a PUBLIC KEY, not a
+  `siteId`.** `projectListingStartSchema` carries `siteKey` where it carried
+  `siteId`, and the server resolves the site from it. A body-supplied tenant
+  identifier is exactly what the consuming site's proxy route existed to prevent;
+  resolving it server-side is what lets the proxy go away. The schema is
+  `.strict()`, so a body still carrying `siteId` is refused with a 400 naming the
+  unrecognised key rather than silently honoured. The anonymous public read moves
+  from `?siteId=` to `?siteKey=` for the same reason — one identifier for the
+  whole mountable contract. `SiteListingConfig` gains a nullable, unique
+  `publicKey` column as the mapping, with an `AILK_LISTING_PUBLIC_KEY` env
+  fallback so a single-tenant scaffold needs no config row.
+
+  **Breaking — submit-completeness derives from the site's configured field set.**
+  `projectListingSubmitSchema` validated a fixed roster. It cannot: steps are
+  individually optional, so a field whose step a site never rendered was never
+  asked for, and requiring it silently refuses valid applications naming
+  questions the founder never saw. `buildProjectListingSubmitSchema(caps,
+collectedFields)` builds the schema instead, and `SiteListingConfig` gains
+  `collectedFields`, defaulting to the full roster — so a site that has
+  configured nothing behaves exactly as before. The set is read server-side and
+  never from a request: a caller that could post its own required-field set could
+  post an empty one.
+
+  **Breaking — the word caps are a site's numbers.** Ten words of headline and
+  twenty-five of one-liner were platform constants compiled into a regex.
+  `SiteListingConfig` gains `wordCaps`, and
+  `buildProjectListingDraftPatchSchema` / `buildProjectListingSubmitSchema`
+  compile the rules from it. The defaults reproduce the previous constants
+  exactly, so no existing site's behaviour changes.
+
+  **`@working-theory/api-client` (0.6.0 → 0.7.0, bumped by hand).**
+  `projectListings.startDraft` and `.resumeDraft` bind a draft's id and its
+  caller-held resume token into one session. The token is never a cookie and this
+  package touches no browser storage: the resume link is emailed and doubles as
+  address verification (salessmyth/samhenry [#316](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/316) D6b), and an agent-mediated
+  caller ([#5039](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5039)) cannot present a cookie at all. `start`, `patchDraft` and
+  `submit` are unchanged.
+
+  **No honeypot and no timing heuristic ships anywhere in this change.** Both
+  were removed deliberately ([#316](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/316) D6b) because [#5039](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5039) opens an agent-mediated
+  submission channel they would close.
+
+### Patch Changes
+
+- Updated dependencies [[`8d2b130`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8d2b1305aa08dde674d15214b9c546fbdc3c60d1)]:
+  - @working-theory/validation@0.18.0
+
+## 0.17.0
+
+### Minor Changes
+
+- [#5035](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5035) [`63974f5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/63974f52d241db3179df7b263a3dc1430c3810c1) Thanks [@claudio-planck](https://github.com/claudio-planck)! - <!--
+  `@working-theory/api-client` was listed here by [#5035](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5035) and has been REMOVED
+  ([#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036)). It is in `.changeset/config.json`'s `ignore` list, and changesets
+  refuses a changeset that mixes ignored and non-ignored packages — so as
+  written this changeset could not be consumed at all, and `changeset version`
+  errored out before versioning anything. That would have blocked the very
+  release this work is timed to ride. api-client's version is bumped by hand in
+  this repo (the [#5013](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5013) precedent); its breaking changes are still described
+  below, because the description is what a consumer reads.
+  -->
+
+  <!--
+  MINOR, not MAJOR, and the changes below are still breaking. The published
+  group is on the `0.y.z` initial-development line, where MAJOR is pinned at 0
+  (claude-setup `rules/operating-policy.md` § Hard floors are the SemVer public
+  API, D7; AILK `docs/decisions/semver-activation.md`, which puts the >=1.0.0
+  hard-floor->MAJOR gate explicitly out of scope). A literal `major` here would
+  take the whole 27-package fixed group from 0.16.0 straight to 1.0.0 — a
+  declaration that the API is stable, which is a positioning act and not
+  something a changeset should perform as a side effect of describing breakage.
+  Pre-1.0, a breaking change is a MINOR flagged breaking in the changelog, which
+  is what every "**Breaking —**" paragraph below does.
+  -->
+
+  Project listings become a platform feature: per-site window config, a five-state lifecycle, and a derived slug ([#5033](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5033))
+
+  **Breaking — the apply payload no longer accepts `slug`.** `projectListingCreateSchema` is `.strict()`, so a payload still supplying one is a 400. The server derives the slug from `name` (lowercased, non-alphanumeric runs to hyphens, truncated to 48) and resolves collisions with a site-scoped numeric suffix; the created slug comes back in the 201 response, which is now the only place a caller learns it.
+
+  **Breaking — the apply payload gains `requestedWindowDays`.** An applicant may request a listing window in whole days. The server clamps it against the site's own maximum instead of rejecting the application. The site's bounds are never representable in a request body.
+
+  **Breaking — the status vocabulary changed.** `PROJECT_LISTING_STATUSES` is now `draft | requested | rejected | active | closed`, replacing `applied | approved | rejected | live | closed`. `closed` is computed from the listing's window end on every read and is never stored, so an expired listing cannot stay open because a scheduled job failed. Two new exports narrow what may be written: `PROJECT_LISTING_STORED_STATUSES` (the four persistable values) and `PROJECT_LISTING_DECISION_STATUSES` (`active | rejected`, the only transition targets).
+
+  **Breaking — `backlinkUntil` is now `windowEndsAt`** on the row and the public read. The field bounds the whole listing rather than a backlink.
+
+  **Breaking — `projectListingPatchSchema` changed shape** from a required `{ status }` over all five statuses to `{ status?, featured? }` with at least one field present, `status` narrowed to the two decision targets. `apiClient.projectListings.patch` takes `ProjectListingPatchInput` accordingly.
+
+  **Added.** `siteListingConfigSchema`, `SITE_LISTING_CONFIG_DEFAULTS` and `clampWindowDays` in `@working-theory/validation`, backed by a new `SiteListingConfig` model keyed `siteId @unique` in the `config` namespace. The row and public read gain `featured`, `headline`, `logoMarkUrl` and `logoWordmarkUrl`; the logo columns ship nullable with no upload path.
+
+  The ninety-day listing window that `apps/api` hardcoded was one consuming site's commercial terms. No duration constant remains in the published package outside the config schema's own defaults.
+
+  ## The application becomes a resumable draft, and the listing carries the fields its page and tile render ([#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036))
+
+  **Breaking — the single anonymous create is replaced by three operations.** `apiClient.projectListings.create` is gone. In its place: `start` (`POST /v1/project-listings` — the founder's name, email and a literal-`true` `consent`, returning `{ id, resumeToken }` at 201), `patchDraft` (`PATCH /v1/project-listings/drafts/:id` — merges a partial application and returns the merged row) and `submit` (`POST /v1/project-listings/drafts/:id/submit` — no body, returns `{ id, slug }`). All three answer with the API's `{ ok, data }` / `{ ok, error }` envelope on every path; the create they replace answered bare on success and enveloped on failure, so a client branching on `body.ok` read a successful apply as a failure. `projectListingCreateSchema` / `ProjectListingCreateInput` / `projectListingCreateResponseSchema` are replaced by `projectListingStartSchema`, `projectListingDraftPatchSchema`, `projectListingSubmitSchema` and their response schemas. The form the change exists for saves on every advance; a single terminal POST no longer describes it.
+
+  **Breaking — validation moved from write-time to submit-time, so every application field on `projectListingSchema` is now nullable.** `slug`, `name`, `oneLiner`, `problem`, `product`, `commitment`, `teamComposition`, `faqs`, `anythingElse`, `address` and `questions` all read `T | null`. So does `leadId`: the `Lead` is written at SUBMIT rather than at start, because the founder's contact details are already captured on the listing row itself at step one, and `routeLead` sends an operator notification — which on an anonymous route meant a stranger could mail the operator by opening a draft they never finished. A draft is a legitimately incomplete row and only `submit` asserts completeness; a consumer that assumed a listing always carries a name must now handle the draft case. `submit` names the fields that are missing rather than reporting a generic failure.
+
+  **Breaking — `patch`/`submit` are gated by a resume token.** `start` returns it once; only its sha-256 digest is stored, and lookup requires the listing id AND the digest, so a token is bound to one listing and grants access to no other. It travels in `Authorization: Bearer`, and `submit` clears it. There is no route that reads a token back.
+
+  **Breaking — `PROJECT_LISTING_STAGES` and the `stage` field are gone.** `PROJECT_LISTING_PRODUCTS` and a `product` field replace them: `new-idea-written | wireframes | demo-video | working-prototype | live-no-users | live-some-users`. No shim translates the old four values — the ladders do not align rung-for-rung, so a silent translation would invent data. Existing rows are remapped once by the migration.
+
+  **Breaking — `audience` is removed from the payload, the row and the public read.** No question feeds it any more; its guidance folded into `oneLiner`. Existing values are not migrated anywhere.
+
+  **Breaking — `oneLiner` is word-capped, not character-capped.** It was `.max(160)`; it is now 25 words (with a 400-character backstop). `headline` becomes required at submit and is capped at 10 words alongside its existing single-line rule. What a tile has room for is a sentence, not a byte count.
+
+  **Breaking — `ProjectListing.experimentId` becomes `experimentKey`.** `WaitlistScore` stores `experimentKey`, so a listing holding the experiment's id meant every listing-to-submissions read fetched the experiment purely to translate one into the other. The same string now sits on both sides.
+
+  **Breaking — `WaitlistScore` is unique per `[leadId, experimentKey]`, not per `[leadId]`.** A visitor who joins two founders' waitlists is one lead with two scores; the old constraint permitted one, so the second write erased the first and a founder's CSV under-reported with no error raised. Overwrite-on-retake is preserved, scoped per experiment.
+
+  **Added.** `@working-theory/validation` exports `segmentation.js`: `TEAM_COMPOSITIONS` (the canonical eight-value team-composition axis), `COMMITMENTS` (five values), their default label maps, and `TEAM_COMPOSITION_QUESTION_ID`. The application's `teamComposition` enum is the first six team values; the diagnostic renders the full list. A register is JSON and the constant is TypeScript, so neither imports the other and a test asserts the register's question-one values are a subset.
+
+  **Added.** The row and the public read gain `commitment`, `teamComposition`, `faqs` (exactly three `{question, answer}` entries), `anythingElse`, `address` and `consentAt`. The founder's address is on the PUBLIC read deliberately: visitors answering that founder's diagnostic hand personal data to the founder, not the platform, and a per-listing privacy notice naming the collecting party cannot be built downstream without it.
+
+  **Changed.** A `featured: true` listing is exempt from the computed `closed` status and may carry a null `windowEndsAt`; a non-featured `active` row with no window is a data error, logged and read `closed`. `computeListingStatus` takes the row's `featured` flag as a fourth argument.
+
+  **Changed.** A founder may hold at most two listings in a non-terminal state (`draft`, `requested`, `active`) on one site. A third `submit` is refused with `listing_limit_reached`. Drafts count, or the limit is evaded by never submitting — but only for fourteen days, and `founderEmail` is lowercased before it is stored or counted. `founderEmail` is unverified on an anonymous surface, so an unbounded draft would let two anonymous requests lock a named founder out of applying permanently, and a case-sensitive comparison would let the limit be evaded by holding down shift.
+
+  **Changed.** The project-listing diagnostic register resolves points by option VALUE rather than by a positional `q{n}:{i}of{k}` token. `LISTING_DIAGNOSTIC_SCORING` becomes `buildListingDiagnosticScoring(questions)`, and `listingOptionValue`, `LISTING_DIAGNOSTIC_ARITIES`, `LISTING_DIAGNOSTIC_OPTION_VALUES` and `listingDiagnosticQuestionOptions` are removed from `@working-theory/database/flows/listing-diagnostic`. Q5's urgency weights are now declared explicitly strongest-first, which corrects a scoring inversion the positional rule produced.
+
+  **Changed.** `FlowDefinition` and `FlowSession` carry a nullable `listingId`. The link from a submission back to a listing was previously the coincidence that the generated flow's slug equalled the listing's slug; it is now stated. `upsertFlowDefinition` takes an optional third `listingId` argument.
+
+### Patch Changes
+
+- Updated dependencies [[`933791e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/933791ef204baabed2038b9e66e5b4b09d3ed50c), [`63974f5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/63974f52d241db3179df7b263a3dc1430c3810c1)]:
+  - @working-theory/ids@0.6.0
+  - @working-theory/validation@0.17.0
+
+## 0.16.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.16.0
+
+## 0.15.0
+
+### Minor Changes
+
+- [#5009](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5009) [`19dbfa7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/19dbfa77f0233c0591dc06c777fd2bfbb85910a8) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Add the project-listing diagnostic's shared scoring register and the
+  `ListingCsvSend` model ([#5001](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5001)).
+
+  `database/flows/listing-diagnostic.ts` (exported as
+  `@working-theory/database/flows/listing-diagnostic`, beside the existing
+  `./flows/presets` subpath) is the ONE `WaitlistScoring` register every
+  generated listing diagnostic shares: Q3–Q6 scored by option POSITION —
+  `round(3·i/(k−1))` over a listing-independent `q{n}:{i}of{k}` option value —
+  summed 0–12 into `now` (10–12) · `soon` (7–9) · `later` (4–6) · `curious`
+  (0–3). Q1/Q2/Q7 and the extras carry no points.
+
+  `ListingCsvSend` (`listing_csv_sends`, id prefix `lcsv_`) records one row per
+  DELIVERED weekly founder CSV — `listingId`, `sentAt`, `rowCount`, `grantId` —
+  and is the watermark the next sweep selects after.
+
+  Additive: a new model plus a new export subpath, no change to any existing
+  model, migration, or export. Consumers that vendor `apps/api` need this
+  version — `apps/api/src/services/project-listing-flow.ts` imports the register
+  and `listing-csv-sweep.ts` reads the new model.
+
+### Patch Changes
+
+- Updated dependencies [[`e29589c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e29589c932e9d24bb84b7f0913ceac8e40d0fc36), [`d0f77a1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d0f77a1a175533eb90e31fa11c0ab6bb1b7f208e), [`3e3b63f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3e3b63fe310abc6f0c1b8b315e51ef2670955c35)]:
+  - @working-theory/ids@0.5.0
+  - @working-theory/validation@0.15.0
+
+## 0.14.0
+
+### Minor Changes
+
+- [#4891](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4891) [`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Add the `FlowCheckout` model (`inbox` namespace, `@@map("flow_checkouts")`,
+  `flchk_` ids) with migration `20260905230000_add_flow_checkout` ([#4837](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4837)) —
+  the recommender's buyer record: one row per checkout attempt carrying the
+  site, flow slug, experiment key, session, lead, offer key, the purchased
+  configuration (seats / period / credit stop), the server's quote and its
+  minor-unit amount + currency, the permalink, and the Stripe session /
+  customer ids and `status` / `completedAt` the webhook stamps ([#4838](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4838)).
+  Additive; no existing model or column changes.
+
+### Patch Changes
+
+- Updated dependencies [[`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf), [`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf)]:
+  - @working-theory/ids@0.4.0
+  - @working-theory/validation@0.14.0
+
+## 0.13.1
+
+### Patch Changes
+
+- [#4746](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4746) [`fbe5d42`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fbe5d422bb96fc963c0f2132d7ac2416b4b1bdf0) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Rebuild + republish. The 0.13.0 tarballs were published from a stale `dist/` (the manual publish loop ran `pnpm publish` without `pnpm -r build`), so `@working-theory/validation`, `@working-theory/database` and others carry pre-[#4731](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4731)/[#4732](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4732) compiled output under the 0.13.0 version. No source change; this patch republishes every fixed-group package from a fresh build at `main`. Consumers pin `^0.13.1`.
+
+- Updated dependencies [[`fbe5d42`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fbe5d422bb96fc963c0f2132d7ac2416b4b1bdf0)]:
+  - @working-theory/validation@0.13.1
+
+## 0.13.0
+
+### Patch Changes
+
+- [#4739](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4739) [`7fb762e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/7fb762eea3db575dada5569b53884b679707e7ef) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add a changeset for FEAT-074 U3/U4a/U4b ([#4725](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4725), [#4727](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4727), [#4734](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4734)), which shipped
+  without one. `waitlistExperimentConfigShapeSchema` (`waitlist.ts`) gains an
+  optional `deliverables` block, and `compileWaitlistFlow` (`waitlist-compile.ts`)
+  carries it into the compiled flow — a compiled waitlist flow may now declare
+  deliverables. `@working-theory/database` adds the `PlaybookInstance` model
+  (`inbox` namespace, migration `20260903010000_add_playbook_instance`,
+  `@@map("playbook_instances")`) — the platform schema gains a `playbook_instances`
+  table with `pbk_` ids, written append-only by targeting-maturity signup scoring.
+  Both additive; an existing flow config or site-plan projection with no
+  `deliverables` block is unaffected.
+- Updated dependencies [[`7fb762e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/7fb762eea3db575dada5569b53884b679707e7ef), [`93d14de`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/93d14de711e88d2768c38b97c0f88a0fb270193b)]:
+  - @working-theory/validation@0.13.0
+
+## 0.12.1
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.12.1
+
+## 0.12.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.12.0
+
+## 0.11.0
+
+### Minor Changes
+
+- [#4693](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4693) [`251003f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/251003f0ef26cf288c472f8cc4b5bf1818f7f085) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Extend the flow engine additively ([#4663](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4663) A3): per-step `showIf` branch
+  predicates resolved by one shared pure resolver (`flow-visibility.ts`, used
+  by both the engine and `FlowStepper`), derived + persisted session `flags`,
+  `whenHidden` auto-answers for a hidden step, `multi`/`exclusiveValues`
+  segmentation questions, a `url` field input type + `minLength`, and a fourth
+  step type `aeo_score` that computes an AI-visibility score server-side inside
+  its own invisible, auto-submitted step and persists it on `FlowSession`.
+  `FlowStepper` gains opt-in back-navigation (`messages.goBack`), multi-select
+  rendering, url autoformatting, and branch-aware progress. `compileWaitlistFlow`
+  lifts its three prior refusals (`multi`, `showIf`, `exclusiveValues`) onto the
+  extended grammar. Additive only — an existing linear flow with no `showIf`,
+  `flags`, or `aeo_score` step is unaffected.
+
+- [#4673](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4673) [`cd23c21`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cd23c21e403abbad825bc794bc8c0d613325de01) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add the waitlist-experiment data model ([#4661](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4661) A1): the `waitlist.ts` register
+  schemas (question set, scoring rules grammar, tracking, experiment config),
+  `compileWaitlistFlow` in `waitlist-compile.ts`, an optional `experiment`
+  binding block on `flowConfigSchema`, and the `WaitlistExperiment` +
+  `WaitlistScore` Prisma models (`inbox` namespace) with their migration.
+  Additive only — an existing flow config or site-plan projection with no
+  `experiment`/`waitlistExperiments` block is unaffected.
+
+### Patch Changes
+
+- Updated dependencies [[`251003f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/251003f0ef26cf288c472f8cc4b5bf1818f7f085), [`48c7962`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48c796243ee0f5c97440c1487737970a9d0124d3), [`e638747`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e638747ab2ddfbae4ecfce14fd2f3ccf92523a3c), [`9a7fc2c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/9a7fc2c129e095099f0be907a831190f24c9e7e3), [`cd23c21`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cd23c21e403abbad825bc794bc8c0d613325de01), [`44e9795`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/44e9795dac30b9d6b87e57e33d81ce823a6c93da), [`fa5ece2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fa5ece2f86d5195988f69fe9568d9a06addc8e9d)]:
+  - @working-theory/validation@0.11.0
+  - @working-theory/ids@0.2.0
+
+## 0.10.0
+
+### Patch Changes
+
+- Updated dependencies [[`dd8cc0e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/dd8cc0e46b042009f41915097b93c5737fcf80a0)]:
+  - @working-theory/validation@0.10.0
+
+## 0.9.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.9.0
+
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.7.0
+
+## 0.6.0
+
+### Patch Changes
+
+- Updated dependencies [[`3a10200`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3a1020088c9df36d60f3539504c89dfe1cdd3827)]:
+  - @working-theory/validation@0.6.0
+
+## 0.5.0
+
+### Patch Changes
+
+- Updated dependencies [[`b4a9e20`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/b4a9e20a9708f3f104f921511fce8ce56bcf3e2f)]:
+  - @working-theory/validation@0.5.0
+
+## 0.4.0
+
+### Patch Changes
+
+- Updated dependencies [[`5c80fee`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5c80fee9ef52b5842fa5f62a682c14743032fb2e)]:
+  - @working-theory/validation@0.4.0
+
+## 0.3.0
+
+## 0.2.0
+
+## 0.1.3
+
 ## 0.1.2
 
 ## 0.1.1

package/templates/database/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Tailwind AI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/templates/database/README.md

@@ -214,7 +214,9 @@ Customers can extend the schema for custom features:
 ```prisma
 // Example: Add a SavedItem model for wishlists
 model SavedItem {
-  id        String   @id @default(cuid())
+  // New models are born with the prefixed-UUIDv7 scheme (ADR-0031):
+  // add a registry row in @working-theory/ids + a CHECK constraint migration.
+  id        String   @id @default(dbgenerated("('saved_'::text || (uuidv7())::text)")) @db.Text
   userId    String
   itemType  String   // "product", "blog_post"
   itemId    String   // Platform ID