create-ailk 0.1.0 → 0.2.0

package/templates/database/CHANGELOG.md

@@ -1,5 +1,448 @@
 # @working-theory/database
 
+## 0.20.0
+
+### Minor Changes
+
+- [#5282](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5282) [`49e6ba4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/49e6ba470a0ff4a0e6d4f7d14147232e90a12259) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Consent purposes and grants ([#5275](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5275)): a site declares its consent purposes once, any form renders them as real checkboxes with inline policy links, and every answer produces a durable record carrying the exact wording the person read.
+
+  `@working-theory/validation` gains `consent-config.ts` — the per-site consent registry contract (`siteConsentConfigSchema`, `SITE_CONSENT_CONFIG_DEFAULTS`, `consentConfigFor`, `resolveConsentStatement`), following `SiteListingConfig`: a Zod-validated blob, platform defaults, and an unparseable blob that resolves to those defaults rather than to a failed form. A statement's links are markdown-shaped with a KEY target (`[Privacy Policy](privacy)`) resolved against the site's policy map, so a config string can never carry a URL or a scheme. `fieldInputTypeSchema` gains the `consent` kind, carrying `purposes: string[]` (ids only; `options`/`minLength` are refused on it). `projectListingStartSchema` keeps `consent: z.literal(true)` and gains an optional `consents: Record<purposeId, boolean>` and `locale`, so every existing caller (agent submission included) still parses. The listing application's contact step compiles its consent control as the `consent` kind (an optional `consentPurposes` list, defaulting to the platform's `service_terms`) instead of a `select` carrying one fake option.
+
+  `@working-theory/ui` gains two blocks: `ConsentStatement` (parses `[Label](key)` tokens; an unresolvable key renders as plain text, never a dead link; no code path renders an href taken from the statement string) and `ConsentGroup` (one `Checkbox` per purpose, every box unticked on first render, each named and described by its statement via `aria-labelledby`/`aria-describedby`, posting under a flat `<field>.<purposeId>` name). `ContactFormFields` accepts `type: "consent"`; `FlowStepper` gates advance on required purposes only and sends one `"true"`/`"false"` per purpose (a decline is a value, not an absent key); both take an optional `consentConfig` that defaults to the platform registry. `ListingApplicationFlow` now sends the founder's real grants (`consents` + `locale`) instead of a hardcoded `consent: true`.
+
+  `@working-theory/database` gains the append-only `ConsentGrant` model (`consent_grants`): subject as a type + id pair of plain scalars (no cross-namespace relation), declines stored as `granted: false`, the resolved statement denormalized with its hash and served locale, no `updatedAt` and no unique constraint on subject + purpose. The migration backfills one row per pre-existing listing marked wording-unrecoverable, stamped at the listing's own `consent_at`, and never touches `project_listings`.
+
+  Additive: a flow, form, or site declaring no consent config renders and parses exactly as before. The one deliberate behavior change is the listing application's consent control.
+
+- [#5294](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5294) [`cf6b325`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cf6b325298e92d22ab7edfe8538f5ca17f54ebfd) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The founder application becomes data ([#5285](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5285)): a published field contract, questions and screens as records, and override by exception.
+
+  `@working-theory/validation` gains `listing-application-contract.ts` — the fields the platform actually READS, each with the call site that reads it, which of them a published listing cannot do without, and the control a question writing one must declare. Two beliefs the design carried did not survive that grounding and are recorded in the module header: there is no `FAQPage` emission for a listing in this tree, and no resume-link email. `listing-application.ts` gains the question record (an id, a control, copy, options, validation, and either a `writesTo` naming a contract field or a `siteAnswer` destination carrying a visibility flag), the screen record (its own copy, an ordered list of question ids, and its own side-panel declaration), merge-by-id so a site rewording one question inherits every other default including ones added later, and a parse-time invariant: exactly one question writes each required contract field, with zero and two both named failures. The compiler emits ONE step per screen carrying every field its questions contribute — the generalization of the `contact` and `faqs` cases, not a third mechanism. `listing-application-defaults.ts` ships a complete default question set and a grouped arrangement following combine-selection, separate-composition; it deliberately reverses the ships-no-copy discipline and says why.
+
+  `@working-theory/ui` reaches two capabilities that already existed and were thrown away in one line. `ListingApplicationFlow` returned the live tile unconditionally on every step, ignoring the view `FlowStepper` handed it; a screen declares its own side panel now, and a screen declaring none renders a full-width question with `FlowFrame`'s side region collapsed. `FlowFrame` gains a side cell with the same padding, measure and centring the active cell's step card has, so side content no longer hand-rolls its own inset, and its side region gains `md:flex-1` — without it the region carried `md:w-1/2` against an active region carrying `flex-1`, so a caller's gap came out of the question column alone. `FlowStepper` measures the step card and sizes the side cell to the tallest card observed, never shrinking, capped at the VISIBLE slot height rather than the frame's declared `h-dvh` — a page mounting the frame below a header makes it taller than the viewport.
+
+  `@working-theory/database` gains the bounded site-answers store on `ProjectListing`, and the logo columns become writable from the application.
+
+  Additive, with two boundaries stated precisely. The flat `steps` config parses and compiles to the byte-identical `FlowConfig` — verified old-against-new on a fifteen-step config exercising every step kind — and `steps` is now optional, with a config declaring both shapes, or declaring `steps` as an explicit `undefined`, a named parse failure. What is NOT unchanged is the rendered frame: the side-cell container, the shared gap and the measured panel height are fixes to `FlowFrame` and `FlowStepper`, so they reach every consumer of those two components by design, not only the listing application.
+
+  A site that overrides one question's copy and declares no `screens` inherits every other default and renders new defaults added later. A site that declares its own `screens` inherits new defaults into its question set but does not render them — declared screens are that site's statement of what it asks, and inserting a screen into a live form is not something an upstream release should do. A new default that writes a REQUIRED contract field still fails that site's config at parse, by name.
+
+  The three fields the application gained — the two logo URLs and the requested window — are OPT-IN: they are excluded from the default collected-field mask, so adding them cannot widen what an anonymous caller may write on a site that never asked for them. A site that wants them names them.
+
+- [#5298](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5298) [`57b0b04`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/57b0b047eb3f04d40f0712a893c89415b742c7f5) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A verified owner link on a listing ([#5295](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5295)): a founder who signs in can read their own submitted listings, and nobody else's.
+
+  `@working-theory/database` gains `ProjectListing.ownerUserId` / `ownerLinkedAt` — plain nullable scalars with no cross-namespace relation, exactly the shape `Lead.promotedUserId` / `promotedAt` already has (ADR 0009 invariant [#1](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/1)). A listing carried `founderEmail` and `leadId` and no user link, so the only join available for "the listings belonging to this signed-in person" was a session's email against `founderEmail`. That string is typed into an anonymous form and proves nothing: two people who type the same address are two people, and the join hands one of them the other's submission. These columns are the ownership claim a read may actually join on.
+
+  The link is stamped only when all three of these hold: the reconciling user's own email is VERIFIED; that verified address matches the row's `founderEmail`; and the row's site resolves to one of that user's own tenant workspaces. Any one failing writes nothing and returns a count rather than throwing — the reconciliation path would otherwise fail an unrelated request. The email comparison is exact equality against the same normalization the write path applies, deliberately not Prisma's `mode: "insensitive"`, which compiles to `ILIKE` and would make `_` and `%` in the caller's own address wildcards that capture a neighbour's row.
+
+  A fourth condition has no counterpart in the lead service: the match must be UNAMBIGUOUS. Two strangers can type the same address into the anonymous form, and when they do nothing says which of the two un-linked rows is whose — so a row is claimed only when it is the only un-linked row carrying that address at its site, and an ambiguous group stays null. The cost is a founder who legitimately submitted two applications at one site, which the concurrent limit allows: neither is linked. That is the deliberate trade, because nothing in the data separates their second application from a stranger's first. The write also repeats `ownerUserId: null`, making it a compare-and-swap, so two concurrent reconciliation runs cannot transfer a row away from whoever claimed it first.
+
+  Candidacy is also restricted to submitted rows — every stored status except `draft`. A draft is addressed by its resume token, which is cleared at submit, so the token and the owner link hand off to each other cleanly and a draft needs no link. It is also a security boundary: draft creation is anonymous with the quota enforced at submit, so a claimable draft would let one unauthenticated request either disclose a stranger's text or, under the ambiguity refusal, permanently block someone from claiming their own listing.
+
+  `@working-theory/validation` gains `projectListingMeResponseSchema` — an array of the existing founder-facing `projectListingDraftSchema`, reused rather than forked because the audience is the same person that shape already serves. Nothing existing changes.
+
+  No existing row is backfilled, now or later. Every row predates verification, so deriving a link from `founderEmail` would assert the thing nobody proved. A listing submitted by someone who never signs in stays null for the life of the row, which is a legitimate resting state rather than a backlog.
+
+  Additive throughout. Both columns are nullable with no default; the new schema export is new; the operator's `owner|admin` floor on the existing tenant-scoped listing routes is unchanged, and the founder reads their own rows through the owner link rather than through a relaxed floor.
+
+- [#5283](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5283) [`a713ea7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/a713ea78c12c1dc2519b80831deed197a4f227b4) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A structured `address` field type in the flow vocabulary, and structured address storage for listings ([#5279](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5279)).
+
+  `AddressFieldset` has shipped since [#4395](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4395) and `StepFlow` has rendered it ever since, but `fieldInputTypeSchema` exposed six input types and `address` was not one of them — so a flow config could not name the composite, and the founder application collected a whole published business address in a single free-text box capped at 300 characters.
+
+  `fieldInputTypeSchema` gains `"address"`. The two cross-field rules already beneath that enum cover the new member without a new clause: `options` is select-only and `minLength` is text/textarea-only, so an address field declaring either is a named parse failure rather than a silently discarded setting. `flowAddressValueSchema` and `composeAddressLine` are new exports — the first declares the six-part value an address field submits, the second composes the single-line display string from those parts. There is deliberately no function that runs the conversion the other way.
+
+  `FlowStepper` reads, validates, gates, seeds and submits the composite against the six fixed keys `AddressFieldset` posts under, which is the handling `StepFlow` has carried since [#4395](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4395). Required means every required sub-control has a value rather than that a key named `address` is non-empty. `ContactFormFields` already rendered the type and is unchanged, as are `AddressFieldset` and `ADDRESS_COUNTRIES`.
+
+  `ProjectListing` keeps `address` as the single-line display string and gains six nullable columns for the parts beside it. A new application composes its display string from the parts, server-side. An existing row keeps its display string exactly as the founder typed it and its parts stay null — no stored address is ever parsed, split, or rewritten, and the migration does not backfill.
+
+  Every change is additive: a flow config that declares no address field parses, renders and submits exactly as it did before, and a listing carrying only the legacy free-text address reads unchanged.
+
+### Patch Changes
+
+- Updated dependencies [[`49e6ba4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/49e6ba470a0ff4a0e6d4f7d14147232e90a12259), [`cf6b325`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cf6b325298e92d22ab7edfe8538f5ca17f54ebfd), [`767a35c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/767a35ca83155f774667ea3f7a10eb0ce1c094ab), [`57b0b04`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/57b0b047eb3f04d40f0712a893c89415b742c7f5), [`65989b4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/65989b4dc6915bf37608475ed6409f98cd5945e2), [`a713ea7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/a713ea78c12c1dc2519b80831deed197a4f227b4)]:
+  - @working-theory/validation@0.20.0
+
+## 0.19.0
+
+### Minor Changes
+
+- [#5266](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5266) [`911e452`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/911e452c13b45e7fba213ed34290c981cc1bf346) Thanks [@claudio-planck](https://github.com/claudio-planck)! - `ProjectListing` (`inbox` namespace) gains `submittedCopy`, `copyEditedAt` and `copyEditedBy`, with migration `20260911120000_listing_copy_edit_audit`. They back the operator's copy edit — the third review outcome beside approve and reject: `copyEditedAt`/`copyEditedBy` mirror the existing `decidedAt`/`decidedBy` audit pair and are re-stamped on every edit, while `submittedCopy` is written once, on the first edit only, and preserves the five published copy fields exactly as the applicant submitted them. Additive — every existing column, model and migration is unchanged, and a row with the three columns unset behaves as before. Consumers that vendor `apps/api` need this version: `apps/api/src/services/project-listings.ts` writes the new fields and `PATCH /v1/project-listings/:id/copy` is the route that calls it.
+
+### Patch Changes
+
+- [#5204](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5204) [`c74fdba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74fdbaab253941b4f862ac0da845fab7c879d49) Thanks [@claudio-planck](https://github.com/claudio-planck)! - License/publication flip: adds `license: Apache-2.0` + a root `LICENSE` file and flips `publishConfig.access` from `restricted` to `public`, per the `commercial_tier: oss` disposition (`architecture.yaml`, A1 [#5075](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5075)) and ADR 0033. No behavior change.
+
+- [#5156](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5156) [`ddac6c1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ddac6c1c05ff30765d78c69e8f298a35082202ef) Thanks [@claudio-planck](https://github.com/claudio-planck)! - `@working-theory/metadata`: `mcp-tool-catalog.ts` gains an optional `module` field per tool entry (set on the scheduling and content-write tools), consumed by `apps/mcp/src/server.ts` to gate registration when a paid module is excluded (S1, [#5088](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5088)). Additive — `McpToolCatalogEntry`/`McpToolRegistration` both keep every existing field.
+
+  `database` and `@working-theory/ui`: comment-only path-reference fixes after the S1 workspace move, which relocated the workspace app under the paid tree — no behavior change.
+
+- Updated dependencies [[`6b76b3d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6b76b3d65e3b9cfb5cf8bfeb4309b9b8fb9c1345), [`23c7fd6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/23c7fd601e48a37f3f210e130cb8dcd37899b9ab), [`c74fdba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74fdbaab253941b4f862ac0da845fab7c879d49)]:
+  - @working-theory/validation@0.19.0
+
+## 0.18.0
+
+### Minor Changes
+
+- [#5056](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5056) [`8d2b130`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8d2b1305aa08dde674d15214b9c546fbdc3c60d1) Thanks [@claudio-planck](https://github.com/claudio-planck)! - <!--
+  MINOR, not MAJOR, and the changes below are still breaking. The published
+  group is on the `0.y.z` initial-development line, where MAJOR is pinned at 0
+  (claude-setup `rules/operating-policy.md` § Hard floors are the SemVer public
+  API, D7; AILK `docs/decisions/semver-activation.md`). A literal `major` here
+  would take the whole fixed group from 0.17.0 straight to 1.0.0 — a declaration
+  that the API is stable, which is a positioning act and not something a
+  changeset should perform as a side effect of describing breakage. [#5043](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5043) hit
+  that trap and [#5045](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5045) records the lesson. Pre-1.0, a breaking change is a MINOR
+  flagged breaking in the changelog, which is what the "**Breaking —**"
+  paragraphs below do.
+
+  `@working-theory/api-client` is NOT listed: it sits in `.changeset/config.json`'s
+  `ignore` list and changesets refuses a changeset mixing ignored and
+  non-ignored packages. Its version is bumped by hand in this repo (the [#5013](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5013) /
+  [#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036) precedent). Its change is described below anyway, because the
+  description is what a consumer reads.
+  -->
+
+  The consumer half of project listings ships: a mountable founder application, its previews, its shelves and its card ([#5048](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5048))
+
+  Project listings shipped backend-only. After [#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036) replaced one anonymous POST
+  with a three-call resumable-draft protocol, every consuming site had to
+  hand-write three proxy routes, a form that saved on each advance, and a
+  decision about where a bearer credential lives. That is a platform capability,
+  not per-site plumbing, and this is it.
+
+  **`@working-theory/ui` — the mountable surface.** `ListingApplicationFlow` is a
+  new section: a site passes its own step config, its own copy and a draft
+  client, and gets a resumable multi-step application with a live preview tile.
+  It is NOT a new stepper — it configures `FlowStepper` ([#3957](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/3957)) and supplies an
+  `onSubmitStep` that calls the draft protocol. Also new: `ProjectListingCard`
+  and `ProjectListingShelves` (the two shelves and the tile),
+  `ListingPrivacyNotice` (the per-listing disclosure, rendered on the flow where
+  a visitor submits, naming the founder as the party collecting their data),
+  `ListingTilePreview`, `ListingQuestionReview` and `ListingFullPreview`.
+
+  Not one of these ships a founder-readable string. Every prompt, option label,
+  button label, band label and privacy sentence is a required prop or config
+  value.
+
+  **`@working-theory/ui` — `FlowStepper` gains three additive props.**
+  `customSteps` resolves a `custom` step's renderer, `initialStepKey` lands a
+  resumed flow past the step that minted its draft, and `sidePanel`'s view object
+  gains `answers` and `live` so a side region can render what the visitor is
+  typing right now. Every existing caller compiles and behaves unchanged.
+
+  **`@working-theory/validation` — the configuration contract.**
+  `listingApplicationConfigSchema` is what a site supplies, and
+  `compileListingApplicationFlow` turns it into a `FlowConfig`. Two ordering
+  constraints are ENFORCED at parse time rather than documented: `contact` must
+  be the first step (the draft is keyed on the identity it captures, so nothing
+  can save before it), and a `preview` step must follow every step kind it
+  previews (ordered earlier it has nothing to render). Both fail loudly.
+
+  `flowStepSchema` gains one additive member, `custom`, carrying a `renderer`
+  identifier the mounting surface resolves. Every existing flow config parses
+  unchanged.
+
+  **Breaking — the application payload names its site by a PUBLIC KEY, not a
+  `siteId`.** `projectListingStartSchema` carries `siteKey` where it carried
+  `siteId`, and the server resolves the site from it. A body-supplied tenant
+  identifier is exactly what the consuming site's proxy route existed to prevent;
+  resolving it server-side is what lets the proxy go away. The schema is
+  `.strict()`, so a body still carrying `siteId` is refused with a 400 naming the
+  unrecognised key rather than silently honoured. The anonymous public read moves
+  from `?siteId=` to `?siteKey=` for the same reason — one identifier for the
+  whole mountable contract. `SiteListingConfig` gains a nullable, unique
+  `publicKey` column as the mapping, with an `AILK_LISTING_PUBLIC_KEY` env
+  fallback so a single-tenant scaffold needs no config row.
+
+  **Breaking — submit-completeness derives from the site's configured field set.**
+  `projectListingSubmitSchema` validated a fixed roster. It cannot: steps are
+  individually optional, so a field whose step a site never rendered was never
+  asked for, and requiring it silently refuses valid applications naming
+  questions the founder never saw. `buildProjectListingSubmitSchema(caps,
+collectedFields)` builds the schema instead, and `SiteListingConfig` gains
+  `collectedFields`, defaulting to the full roster — so a site that has
+  configured nothing behaves exactly as before. The set is read server-side and
+  never from a request: a caller that could post its own required-field set could
+  post an empty one.
+
+  **Breaking — the word caps are a site's numbers.** Ten words of headline and
+  twenty-five of one-liner were platform constants compiled into a regex.
+  `SiteListingConfig` gains `wordCaps`, and
+  `buildProjectListingDraftPatchSchema` / `buildProjectListingSubmitSchema`
+  compile the rules from it. The defaults reproduce the previous constants
+  exactly, so no existing site's behaviour changes.
+
+  **`@working-theory/api-client` (0.6.0 → 0.7.0, bumped by hand).**
+  `projectListings.startDraft` and `.resumeDraft` bind a draft's id and its
+  caller-held resume token into one session. The token is never a cookie and this
+  package touches no browser storage: the resume link is emailed and doubles as
+  address verification (salessmyth/samhenry [#316](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/316) D6b), and an agent-mediated
+  caller ([#5039](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5039)) cannot present a cookie at all. `start`, `patchDraft` and
+  `submit` are unchanged.
+
+  **No honeypot and no timing heuristic ships anywhere in this change.** Both
+  were removed deliberately ([#316](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/316) D6b) because [#5039](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5039) opens an agent-mediated
+  submission channel they would close.
+
+### Patch Changes
+
+- Updated dependencies [[`8d2b130`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/8d2b1305aa08dde674d15214b9c546fbdc3c60d1)]:
+  - @working-theory/validation@0.18.0
+
+## 0.17.0
+
+### Minor Changes
+
+- [#5035](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5035) [`63974f5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/63974f52d241db3179df7b263a3dc1430c3810c1) Thanks [@claudio-planck](https://github.com/claudio-planck)! - <!--
+  `@working-theory/api-client` was listed here by [#5035](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5035) and has been REMOVED
+  ([#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036)). It is in `.changeset/config.json`'s `ignore` list, and changesets
+  refuses a changeset that mixes ignored and non-ignored packages — so as
+  written this changeset could not be consumed at all, and `changeset version`
+  errored out before versioning anything. That would have blocked the very
+  release this work is timed to ride. api-client's version is bumped by hand in
+  this repo (the [#5013](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5013) precedent); its breaking changes are still described
+  below, because the description is what a consumer reads.
+  -->
+
+  <!--
+  MINOR, not MAJOR, and the changes below are still breaking. The published
+  group is on the `0.y.z` initial-development line, where MAJOR is pinned at 0
+  (claude-setup `rules/operating-policy.md` § Hard floors are the SemVer public
+  API, D7; AILK `docs/decisions/semver-activation.md`, which puts the >=1.0.0
+  hard-floor->MAJOR gate explicitly out of scope). A literal `major` here would
+  take the whole 27-package fixed group from 0.16.0 straight to 1.0.0 — a
+  declaration that the API is stable, which is a positioning act and not
+  something a changeset should perform as a side effect of describing breakage.
+  Pre-1.0, a breaking change is a MINOR flagged breaking in the changelog, which
+  is what every "**Breaking —**" paragraph below does.
+  -->
+
+  Project listings become a platform feature: per-site window config, a five-state lifecycle, and a derived slug ([#5033](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5033))
+
+  **Breaking — the apply payload no longer accepts `slug`.** `projectListingCreateSchema` is `.strict()`, so a payload still supplying one is a 400. The server derives the slug from `name` (lowercased, non-alphanumeric runs to hyphens, truncated to 48) and resolves collisions with a site-scoped numeric suffix; the created slug comes back in the 201 response, which is now the only place a caller learns it.
+
+  **Breaking — the apply payload gains `requestedWindowDays`.** An applicant may request a listing window in whole days. The server clamps it against the site's own maximum instead of rejecting the application. The site's bounds are never representable in a request body.
+
+  **Breaking — the status vocabulary changed.** `PROJECT_LISTING_STATUSES` is now `draft | requested | rejected | active | closed`, replacing `applied | approved | rejected | live | closed`. `closed` is computed from the listing's window end on every read and is never stored, so an expired listing cannot stay open because a scheduled job failed. Two new exports narrow what may be written: `PROJECT_LISTING_STORED_STATUSES` (the four persistable values) and `PROJECT_LISTING_DECISION_STATUSES` (`active | rejected`, the only transition targets).
+
+  **Breaking — `backlinkUntil` is now `windowEndsAt`** on the row and the public read. The field bounds the whole listing rather than a backlink.
+
+  **Breaking — `projectListingPatchSchema` changed shape** from a required `{ status }` over all five statuses to `{ status?, featured? }` with at least one field present, `status` narrowed to the two decision targets. `apiClient.projectListings.patch` takes `ProjectListingPatchInput` accordingly.
+
+  **Added.** `siteListingConfigSchema`, `SITE_LISTING_CONFIG_DEFAULTS` and `clampWindowDays` in `@working-theory/validation`, backed by a new `SiteListingConfig` model keyed `siteId @unique` in the `config` namespace. The row and public read gain `featured`, `headline`, `logoMarkUrl` and `logoWordmarkUrl`; the logo columns ship nullable with no upload path.
+
+  The ninety-day listing window that `apps/api` hardcoded was one consuming site's commercial terms. No duration constant remains in the published package outside the config schema's own defaults.
+
+  ## The application becomes a resumable draft, and the listing carries the fields its page and tile render ([#5036](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5036))
+
+  **Breaking — the single anonymous create is replaced by three operations.** `apiClient.projectListings.create` is gone. In its place: `start` (`POST /v1/project-listings` — the founder's name, email and a literal-`true` `consent`, returning `{ id, resumeToken }` at 201), `patchDraft` (`PATCH /v1/project-listings/drafts/:id` — merges a partial application and returns the merged row) and `submit` (`POST /v1/project-listings/drafts/:id/submit` — no body, returns `{ id, slug }`). All three answer with the API's `{ ok, data }` / `{ ok, error }` envelope on every path; the create they replace answered bare on success and enveloped on failure, so a client branching on `body.ok` read a successful apply as a failure. `projectListingCreateSchema` / `ProjectListingCreateInput` / `projectListingCreateResponseSchema` are replaced by `projectListingStartSchema`, `projectListingDraftPatchSchema`, `projectListingSubmitSchema` and their response schemas. The form the change exists for saves on every advance; a single terminal POST no longer describes it.
+
+  **Breaking — validation moved from write-time to submit-time, so every application field on `projectListingSchema` is now nullable.** `slug`, `name`, `oneLiner`, `problem`, `product`, `commitment`, `teamComposition`, `faqs`, `anythingElse`, `address` and `questions` all read `T | null`. So does `leadId`: the `Lead` is written at SUBMIT rather than at start, because the founder's contact details are already captured on the listing row itself at step one, and `routeLead` sends an operator notification — which on an anonymous route meant a stranger could mail the operator by opening a draft they never finished. A draft is a legitimately incomplete row and only `submit` asserts completeness; a consumer that assumed a listing always carries a name must now handle the draft case. `submit` names the fields that are missing rather than reporting a generic failure.
+
+  **Breaking — `patch`/`submit` are gated by a resume token.** `start` returns it once; only its sha-256 digest is stored, and lookup requires the listing id AND the digest, so a token is bound to one listing and grants access to no other. It travels in `Authorization: Bearer`, and `submit` clears it. There is no route that reads a token back.
+
+  **Breaking — `PROJECT_LISTING_STAGES` and the `stage` field are gone.** `PROJECT_LISTING_PRODUCTS` and a `product` field replace them: `new-idea-written | wireframes | demo-video | working-prototype | live-no-users | live-some-users`. No shim translates the old four values — the ladders do not align rung-for-rung, so a silent translation would invent data. Existing rows are remapped once by the migration.
+
+  **Breaking — `audience` is removed from the payload, the row and the public read.** No question feeds it any more; its guidance folded into `oneLiner`. Existing values are not migrated anywhere.
+
+  **Breaking — `oneLiner` is word-capped, not character-capped.** It was `.max(160)`; it is now 25 words (with a 400-character backstop). `headline` becomes required at submit and is capped at 10 words alongside its existing single-line rule. What a tile has room for is a sentence, not a byte count.
+
+  **Breaking — `ProjectListing.experimentId` becomes `experimentKey`.** `WaitlistScore` stores `experimentKey`, so a listing holding the experiment's id meant every listing-to-submissions read fetched the experiment purely to translate one into the other. The same string now sits on both sides.
+
+  **Breaking — `WaitlistScore` is unique per `[leadId, experimentKey]`, not per `[leadId]`.** A visitor who joins two founders' waitlists is one lead with two scores; the old constraint permitted one, so the second write erased the first and a founder's CSV under-reported with no error raised. Overwrite-on-retake is preserved, scoped per experiment.
+
+  **Added.** `@working-theory/validation` exports `segmentation.js`: `TEAM_COMPOSITIONS` (the canonical eight-value team-composition axis), `COMMITMENTS` (five values), their default label maps, and `TEAM_COMPOSITION_QUESTION_ID`. The application's `teamComposition` enum is the first six team values; the diagnostic renders the full list. A register is JSON and the constant is TypeScript, so neither imports the other and a test asserts the register's question-one values are a subset.
+
+  **Added.** The row and the public read gain `commitment`, `teamComposition`, `faqs` (exactly three `{question, answer}` entries), `anythingElse`, `address` and `consentAt`. The founder's address is on the PUBLIC read deliberately: visitors answering that founder's diagnostic hand personal data to the founder, not the platform, and a per-listing privacy notice naming the collecting party cannot be built downstream without it.
+
+  **Changed.** A `featured: true` listing is exempt from the computed `closed` status and may carry a null `windowEndsAt`; a non-featured `active` row with no window is a data error, logged and read `closed`. `computeListingStatus` takes the row's `featured` flag as a fourth argument.
+
+  **Changed.** A founder may hold at most two listings in a non-terminal state (`draft`, `requested`, `active`) on one site. A third `submit` is refused with `listing_limit_reached`. Drafts count, or the limit is evaded by never submitting — but only for fourteen days, and `founderEmail` is lowercased before it is stored or counted. `founderEmail` is unverified on an anonymous surface, so an unbounded draft would let two anonymous requests lock a named founder out of applying permanently, and a case-sensitive comparison would let the limit be evaded by holding down shift.
+
+  **Changed.** The project-listing diagnostic register resolves points by option VALUE rather than by a positional `q{n}:{i}of{k}` token. `LISTING_DIAGNOSTIC_SCORING` becomes `buildListingDiagnosticScoring(questions)`, and `listingOptionValue`, `LISTING_DIAGNOSTIC_ARITIES`, `LISTING_DIAGNOSTIC_OPTION_VALUES` and `listingDiagnosticQuestionOptions` are removed from `@working-theory/database/flows/listing-diagnostic`. Q5's urgency weights are now declared explicitly strongest-first, which corrects a scoring inversion the positional rule produced.
+
+  **Changed.** `FlowDefinition` and `FlowSession` carry a nullable `listingId`. The link from a submission back to a listing was previously the coincidence that the generated flow's slug equalled the listing's slug; it is now stated. `upsertFlowDefinition` takes an optional third `listingId` argument.
+
+### Patch Changes
+
+- Updated dependencies [[`933791e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/933791ef204baabed2038b9e66e5b4b09d3ed50c), [`63974f5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/63974f52d241db3179df7b263a3dc1430c3810c1)]:
+  - @working-theory/ids@0.6.0
+  - @working-theory/validation@0.17.0
+
+## 0.16.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.16.0
+
+## 0.15.0
+
+### Minor Changes
+
+- [#5009](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5009) [`19dbfa7`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/19dbfa77f0233c0591dc06c777fd2bfbb85910a8) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Add the project-listing diagnostic's shared scoring register and the
+  `ListingCsvSend` model ([#5001](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5001)).
+
+  `database/flows/listing-diagnostic.ts` (exported as
+  `@working-theory/database/flows/listing-diagnostic`, beside the existing
+  `./flows/presets` subpath) is the ONE `WaitlistScoring` register every
+  generated listing diagnostic shares: Q3–Q6 scored by option POSITION —
+  `round(3·i/(k−1))` over a listing-independent `q{n}:{i}of{k}` option value —
+  summed 0–12 into `now` (10–12) · `soon` (7–9) · `later` (4–6) · `curious`
+  (0–3). Q1/Q2/Q7 and the extras carry no points.
+
+  `ListingCsvSend` (`listing_csv_sends`, id prefix `lcsv_`) records one row per
+  DELIVERED weekly founder CSV — `listingId`, `sentAt`, `rowCount`, `grantId` —
+  and is the watermark the next sweep selects after.
+
+  Additive: a new model plus a new export subpath, no change to any existing
+  model, migration, or export. Consumers that vendor `apps/api` need this
+  version — `apps/api/src/services/project-listing-flow.ts` imports the register
+  and `listing-csv-sweep.ts` reads the new model.
+
+### Patch Changes
+
+- Updated dependencies [[`e29589c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e29589c932e9d24bb84b7f0913ceac8e40d0fc36), [`d0f77a1`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d0f77a1a175533eb90e31fa11c0ab6bb1b7f208e), [`3e3b63f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3e3b63fe310abc6f0c1b8b315e51ef2670955c35)]:
+  - @working-theory/ids@0.5.0
+  - @working-theory/validation@0.15.0
+
+## 0.14.0
+
+### Minor Changes
+
+- [#4891](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4891) [`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Add the `FlowCheckout` model (`inbox` namespace, `@@map("flow_checkouts")`,
+  `flchk_` ids) with migration `20260905230000_add_flow_checkout` ([#4837](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4837)) —
+  the recommender's buyer record: one row per checkout attempt carrying the
+  site, flow slug, experiment key, session, lead, offer key, the purchased
+  configuration (seats / period / credit stop), the server's quote and its
+  minor-unit amount + currency, the permalink, and the Stripe session /
+  customer ids and `status` / `completedAt` the webhook stamps ([#4838](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4838)).
+  Additive; no existing model or column changes.
+
+### Patch Changes
+
+- Updated dependencies [[`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf), [`4a41a0a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4a41a0a81bfbd8049771f289d577e236cffea6bf)]:
+  - @working-theory/ids@0.4.0
+  - @working-theory/validation@0.14.0
+
+## 0.13.1
+
+### Patch Changes
+
+- [#4746](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4746) [`fbe5d42`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fbe5d422bb96fc963c0f2132d7ac2416b4b1bdf0) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Rebuild + republish. The 0.13.0 tarballs were published from a stale `dist/` (the manual publish loop ran `pnpm publish` without `pnpm -r build`), so `@working-theory/validation`, `@working-theory/database` and others carry pre-[#4731](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4731)/[#4732](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4732) compiled output under the 0.13.0 version. No source change; this patch republishes every fixed-group package from a fresh build at `main`. Consumers pin `^0.13.1`.
+
+- Updated dependencies [[`fbe5d42`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fbe5d422bb96fc963c0f2132d7ac2416b4b1bdf0)]:
+  - @working-theory/validation@0.13.1
+
+## 0.13.0
+
+### Patch Changes
+
+- [#4739](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4739) [`7fb762e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/7fb762eea3db575dada5569b53884b679707e7ef) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add a changeset for FEAT-074 U3/U4a/U4b ([#4725](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4725), [#4727](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4727), [#4734](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4734)), which shipped
+  without one. `waitlistExperimentConfigShapeSchema` (`waitlist.ts`) gains an
+  optional `deliverables` block, and `compileWaitlistFlow` (`waitlist-compile.ts`)
+  carries it into the compiled flow — a compiled waitlist flow may now declare
+  deliverables. `@working-theory/database` adds the `PlaybookInstance` model
+  (`inbox` namespace, migration `20260903010000_add_playbook_instance`,
+  `@@map("playbook_instances")`) — the platform schema gains a `playbook_instances`
+  table with `pbk_` ids, written append-only by targeting-maturity signup scoring.
+  Both additive; an existing flow config or site-plan projection with no
+  `deliverables` block is unaffected.
+- Updated dependencies [[`7fb762e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/7fb762eea3db575dada5569b53884b679707e7ef), [`93d14de`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/93d14de711e88d2768c38b97c0f88a0fb270193b)]:
+  - @working-theory/validation@0.13.0
+
+## 0.12.1
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.12.1
+
+## 0.12.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.12.0
+
+## 0.11.0
+
+### Minor Changes
+
+- [#4693](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4693) [`251003f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/251003f0ef26cf288c472f8cc4b5bf1818f7f085) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Extend the flow engine additively ([#4663](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4663) A3): per-step `showIf` branch
+  predicates resolved by one shared pure resolver (`flow-visibility.ts`, used
+  by both the engine and `FlowStepper`), derived + persisted session `flags`,
+  `whenHidden` auto-answers for a hidden step, `multi`/`exclusiveValues`
+  segmentation questions, a `url` field input type + `minLength`, and a fourth
+  step type `aeo_score` that computes an AI-visibility score server-side inside
+  its own invisible, auto-submitted step and persists it on `FlowSession`.
+  `FlowStepper` gains opt-in back-navigation (`messages.goBack`), multi-select
+  rendering, url autoformatting, and branch-aware progress. `compileWaitlistFlow`
+  lifts its three prior refusals (`multi`, `showIf`, `exclusiveValues`) onto the
+  extended grammar. Additive only — an existing linear flow with no `showIf`,
+  `flags`, or `aeo_score` step is unaffected.
+
+- [#4673](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/4673) [`cd23c21`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cd23c21e403abbad825bc794bc8c0d613325de01) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Add the waitlist-experiment data model ([#4661](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/4661) A1): the `waitlist.ts` register
+  schemas (question set, scoring rules grammar, tracking, experiment config),
+  `compileWaitlistFlow` in `waitlist-compile.ts`, an optional `experiment`
+  binding block on `flowConfigSchema`, and the `WaitlistExperiment` +
+  `WaitlistScore` Prisma models (`inbox` namespace) with their migration.
+  Additive only — an existing flow config or site-plan projection with no
+  `experiment`/`waitlistExperiments` block is unaffected.
+
+### Patch Changes
+
+- Updated dependencies [[`251003f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/251003f0ef26cf288c472f8cc4b5bf1818f7f085), [`48c7962`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48c796243ee0f5c97440c1487737970a9d0124d3), [`e638747`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e638747ab2ddfbae4ecfce14fd2f3ccf92523a3c), [`9a7fc2c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/9a7fc2c129e095099f0be907a831190f24c9e7e3), [`cd23c21`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cd23c21e403abbad825bc794bc8c0d613325de01), [`44e9795`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/44e9795dac30b9d6b87e57e33d81ce823a6c93da), [`fa5ece2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/fa5ece2f86d5195988f69fe9568d9a06addc8e9d)]:
+  - @working-theory/validation@0.11.0
+  - @working-theory/ids@0.2.0
+
+## 0.10.0
+
+### Patch Changes
+
+- Updated dependencies [[`dd8cc0e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/dd8cc0e46b042009f41915097b93c5737fcf80a0)]:
+  - @working-theory/validation@0.10.0
+
+## 0.9.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.9.0
+
+## 0.7.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.7.0
+
+## 0.6.0
+
+### Patch Changes
+
+- Updated dependencies [[`3a10200`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3a1020088c9df36d60f3539504c89dfe1cdd3827)]:
+  - @working-theory/validation@0.6.0
+
+## 0.5.0
+
+### Patch Changes
+
+- Updated dependencies [[`b4a9e20`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/b4a9e20a9708f3f104f921511fce8ce56bcf3e2f)]:
+  - @working-theory/validation@0.5.0
+
+## 0.4.0
+
+### Patch Changes
+
+- Updated dependencies [[`5c80fee`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5c80fee9ef52b5842fa5f62a682c14743032fb2e)]:
+  - @working-theory/validation@0.4.0
+
+## 0.3.0
+
+## 0.2.0
+
+## 0.1.3
+
 ## 0.1.2
 
 ## 0.1.1