create-ailk 0.12.1 → 0.14.0

package/templates/apps/web/lib/__tests__/site-theme.test.ts

@@ -29,9 +29,11 @@ import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { PartialColorPaletteSchema, SiteThemeSchema } from "@working-theory/site-config/schema";
 import {
   siteColorTokenMap,
+  siteThemeScopedDarkCss,
   siteThemeShapeCss,
   siteThemeToBrandTokens,
   themeToCssVarsBothModes,
+  themeToScopedDarkCss,
 } from "@working-theory/theme";
 
 import { loadSiteBrandTokens, loadSiteShapeCss } from "../site-theme";
@@ -268,8 +270,11 @@ describe("loadSiteBrandTokens — the brand triad", () => {
 
     const theme = SiteThemeSchema.parse(parsed);
     const before = siteThemeToBrandTokens(theme);
+    // Mirrors loadSiteShapeCss: a `darkBands: site` theme (minimalism's, since #7739) also scopes
+    // its dark ink; without it `scoped` is "" and the golden is the pre-triad CSS unchanged.
+    const scoped = theme.darkBands === "site" && before ? siteThemeScopedDarkCss(theme, before) : "";
     expect(layoutCss()).toBe(
-      themeToCssVarsBothModes(before ? { brand: before } : {}) + siteThemeShapeCss(theme),
+      themeToCssVarsBothModes(before ? { brand: before } : {}) + siteThemeShapeCss(theme) + scoped,
     );
   });
 
@@ -318,3 +323,61 @@ describe("the two vocabularies agree on which slots exist", () => {
     );
   });
 });
+
+// #7719 D6 — `darkBands: site` paints dark-scoped bands with the site's dark colours.
+describe("loadSiteShapeCss — darkBands", () => {
+  const originalRoot = process.env.AILK_CONTENT_ROOT;
+  const tempRoots: string[] = [];
+
+  afterEach(() => {
+    if (originalRoot === undefined) delete process.env.AILK_CONTENT_ROOT;
+    else process.env.AILK_CONTENT_ROOT = originalRoot;
+    for (const root of tempRoots.splice(0)) rmSync(root, { recursive: true, force: true });
+  });
+
+  function useSiteMdx(frontmatter: string): void {
+    const root = mkdtempSync(join(tmpdir(), "ailk-site-dark-bands-"));
+    tempRoots.push(root);
+    writeFileSync(join(root, "_site.mdx"), `---\nsiteName: Test\n${frontmatter}---\n`, "utf8");
+    process.env.AILK_CONTENT_ROOT = root;
+  }
+
+  const THEME = [
+    "theme:",
+    "  corners: square",
+    "  colors:",
+    "    dark:",
+    '      bg: "#1c1917"',
+    '      text: "#fafaf9"',
+    "",
+  ].join("\n");
+
+  it("without darkBands, the shape CSS is today's", () => {
+    useSiteMdx(THEME);
+    const theme = SiteThemeSchema.parse({ corners: "square", colors: { dark: { bg: "#1c1917", text: "#fafaf9" } } });
+    expect(loadSiteShapeCss()).toBe(siteThemeShapeCss(theme));
+  });
+
+  it("with darkBands: site, ends with the scoped dark rule carrying the site's dark --color-bg", () => {
+    useSiteMdx(`${THEME}  darkBands: site\n`);
+    const css = loadSiteShapeCss();
+    const brand = loadSiteBrandTokens();
+    expect(brand).toBeDefined();
+    const scoped = themeToScopedDarkCss({ brand: brand! });
+    expect(css.endsWith(scoped)).toBe(true);
+    expect(scoped).toContain("--color-bg: #1c1917;");
+    expect(css.startsWith(siteThemeShapeCss(SiteThemeSchema.parse({ corners: "square" })))).toBe(true);
+  });
+
+  it("with darkBands: site, the scoped rule leaves square corners to inherit from :root", () => {
+    useSiteMdx(`${THEME}  darkBands: site\n`);
+    const scoped = loadSiteShapeCss().slice(loadSiteShapeCss().indexOf(":not(:root)"));
+    expect(scoped).not.toMatch(/--radius-/);
+    expect(scoped).not.toMatch(/--font-/);
+  });
+
+  it("darkBands: platform adds nothing", () => {
+    useSiteMdx(`${THEME}  darkBands: platform\n`);
+    expect(loadSiteShapeCss()).not.toContain(':not(:root)');
+  });
+});

package/templates/apps/web/lib/profile-back-link.ts

@@ -0,0 +1,51 @@
+/**
+ * The back arrow's href on a team profile page (#7744 D7).
+ *
+ * On a deck home, a profile at `/team/<slug>` returns the visitor to the
+ * home's people slide — `#slide-people`, the anchor #7740 gives the home
+ * section whose id is `people` — rather than to the top of the home
+ * (checklist D3). Every other inner page, the `/team` index included, and
+ * every page on a non-deck home goes home.
+ *
+ * No Next.js import — pure functions, asserted directly by their own suite,
+ * in the `auth-routes.ts` idiom.
+ */
+
+/** The people slide's anchor: #7740's `slide-` prefix plus the section id `people`. */
+export const PEOPLE_SLIDE_ANCHOR = "slide-people";
+
+/**
+ * Whether `pathname` is a team profile: `/team/<slug>`, bare or under an
+ * enabled-locale prefix. Not `/team` (the index) and not a deeper path.
+ *
+ * Fail-safe direction: an absent or empty pathname answers `false`, so a
+ * missing `x-pathname` header leaves the back arrow pointing home.
+ */
+export function isTeamProfilePath(
+  pathname: string | null | undefined,
+  locales: readonly string[],
+): boolean {
+  if (!pathname) return false;
+  const path = pathname.split(/[?#]/)[0] ?? "";
+  const bare =
+    locales.length > 0
+      ? path.replace(new RegExp(`^/(${locales.join("|")})(?=/|$)`), "")
+      : path;
+  const segments = bare.split("/").slice(1);
+  return (
+    segments.length === 2 && segments[0] === "team" && segments[1] !== ""
+  );
+}
+
+/** `${homePath}#slide-people` when the home is a deck and the path is a profile; otherwise `homePath`. */
+export function backLinkHref(input: {
+  pathname: string | null | undefined;
+  homePath: string;
+  home: string;
+  locales: readonly string[];
+}): string {
+  const { pathname, homePath, home, locales } = input;
+  return home === "deck" && isTeamProfilePath(pathname, locales)
+    ? `${homePath}#${PEOPLE_SLIDE_ANCHOR}`
+    : homePath;
+}

package/templates/apps/web/lib/relay.ts

@@ -0,0 +1,279 @@
+/**
+ * The same-origin relay (#7644, spec docs/specs/7644-the-browser-talks-only-to-spec.md).
+ *
+ * A visitor's browser posts lead capture, newsletter signup, flow submits and
+ * booking calls to THIS site's own address — `resolveSubmitUrl` leaves a
+ * root-relative action alone in a build of this app (next.config.mjs sets
+ * `NEXT_PUBLIC_AILK_SAME_ORIGIN_RELAY`). `app/v1/[...path]/route.ts` hands
+ * every `/v1/...` request here, and this module forwards it server-side to
+ * the hub through `@working-theory/api-client`'s `relayToApi`, which attaches
+ * the site's own `AILK_SPOKE_KEY` when it has one. A browser never holds the
+ * key and never calls the hub, so a hub can refuse callers it does not know
+ * (#7633) without taking any site's forms down. A single-site install takes
+ * the same path with no key.
+ *
+ * What it guarantees:
+ *
+ *   - ONLY THE LIST (D2). `RELAY_ROUTES` is the fixed set of (method, path)
+ *     pairs a browser form calls; an exact, case-sensitive match on the
+ *     pathname or a 404 with no hub call. Adding a route is a reviewed change
+ *     to this list, its test and apps/web/.env.example.
+ *   - NO CROSS-SITE POST (D4). `Sec-Fetch-Site` other than `same-origin`, or
+ *     an `Origin` whose host is not this site's own, is refused with 403
+ *     before the hub is called. A POST must be JSON, which no cross-origin
+ *     browser can send without a preflight this route never answers.
+ *   - THE VISITOR, UNCHANGED (D3). `x-forwarded-for` as received (else
+ *     `x-real-ip`) and `user-agent` reach the hub, so per-visitor rate limits
+ *     still count each visitor (#7615's rule; `flow.actions.ts`).
+ *   - AN ALLOW-LIST OF HEADERS (D3). Nothing else from the incoming request is
+ *     forwarded: no `authorization`, no client-sent `x-ailk-*`, no `host`, and
+ *     a `cookie` only on the one session route.
+ *
+ * NO SECRET IS LOGGED. A failure logs `{ path, outcome }` and nothing else.
+ */
+import { relayToApi, visitorForwardHeaders } from "@working-theory/api-client";
+
+type RelayMethod = "GET" | "POST";
+
+/** One relayed (method, path) pair. */
+export interface RelayRoute {
+  readonly method: RelayMethod;
+  readonly path: string;
+}
+
+function route(method: RelayMethod, path: string): RelayRoute {
+  return Object.freeze({ method, path });
+}
+
+/**
+ * The fixed list (D2). The scheduling and commerce paths are plain strings:
+ * on a hub without those modules the hub's own 404 passes through.
+ */
+/**
+ * The one session route: a site-admin, cookie-authenticated write. It is
+ * forwarded with the visitor's `cookie` and `Origin` (the hub still checks
+ * that `Origin` against its trusted list), mirroring `forwardedCookieInit` in
+ * lib/server-api.ts. Every other entry is a visitor route.
+ */
+const SESSION_ROUTE = route("POST", "/v1/commerce/invoices");
+
+export const RELAY_ROUTES: readonly RelayRoute[] = Object.freeze([
+  route("POST", "/v1/leads/submit"),
+  route("POST", "/v1/leads/subscribe"),
+  route("POST", "/v1/leads/callback"),
+  route("GET", "/v1/schedule/availability"),
+  route("POST", "/v1/schedule/book"),
+  SESSION_ROUTE,
+]);
+
+/** Fastify's default `bodyLimit`; the hub sets none (NFR4). */
+const RELAY_BODY_LIMIT = 1_048_576;
+
+/** Set on every forwarded call; an incoming request carrying it is a loop. */
+const RELAYED_HEADER = "x-ailk-relayed";
+
+/** Set on every answer: never cached, never content-sniffed by the browser. */
+const BASE_RESPONSE_HEADERS = {
+  "cache-control": "no-store",
+  "x-content-type-options": "nosniff",
+} as const;
+
+function refusal(status: number, code: string, message: string): Response {
+  return Response.json(
+    { ok: false, error: { code, message } },
+    { status, headers: BASE_RESPONSE_HEADERS },
+  );
+}
+
+/**
+ * True when the site has an API address to forward to. `getApiBase()` falls
+ * back to `http://localhost:3001` for local development; a production site
+ * with no address set must not send its visitors' calls (and its key) there.
+ */
+function hubConfigured(): boolean {
+  if (process.env.NODE_ENV !== "production") return true;
+  return Boolean(
+    process.env.AILK_API_URL ||
+      process.env.NEXT_PUBLIC_AILK_API_URL ||
+      process.env.NEXT_PUBLIC_API_URL,
+  );
+}
+
+/**
+ * The host the browser addressed: the first `x-forwarded-host`, else `host`.
+ * The site's edge must overwrite `x-forwarded-host`, never pass a client's on.
+ */
+function ownHost(request: Request): string {
+  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0];
+  if (forwarded) return forwarded.trim();
+  return request.headers.get("host") ?? new URL(request.url).host;
+}
+
+/**
+ * True when the request is a cross-site browser call (D4 step 3). A request
+ * with neither `Sec-Fetch-Site` nor `Origin` is a non-browser caller and is
+ * admitted: it can forge either header anyway.
+ */
+function isCrossSite(request: Request): boolean {
+  const fetchSite = request.headers.get("sec-fetch-site");
+  if (fetchSite !== null && fetchSite !== "same-origin") return true;
+
+  const origin = request.headers.get("origin");
+  if (origin === null) return false;
+  try {
+    const originUrl = new URL(origin);
+    // Parsing the own host under the Origin's scheme normalises a default
+    // port and letter case, so `spoke.example:443` equals `spoke.example`.
+    const own = new URL(`${originUrl.protocol}//${ownHost(request)}`);
+    return originUrl.host !== own.host;
+  } catch {
+    // `null`, or anything that is not a URL.
+    return true;
+  }
+}
+
+function isJson(contentType: string | null): boolean {
+  return (
+    contentType?.split(";")[0]?.trim().toLowerCase() === "application/json"
+  );
+}
+
+/**
+ * The body as text, or `null` once it passes `limit` bytes. Read as a stream
+ * so an oversized body is refused without buffering all of it.
+ */
+async function readCapped(
+  request: Request,
+  limit: number,
+): Promise<string | null> {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > limit) return null;
+  if (!request.body) return "";
+
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > limit) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+
+/** The outbound headers, built from an allow-list (D3). Never a spread of the incoming set. */
+function relayHeaders(
+  request: Request,
+  entry: RelayRoute,
+): Record<string, string> {
+  const incoming = request.headers;
+  const out: Record<string, string> = { [RELAYED_HEADER]: "1" };
+
+  const contentType = incoming.get("content-type");
+  if (entry.method === "POST" && contentType) out["content-type"] = contentType;
+
+  const userAgent = incoming.get("user-agent");
+  if (userAgent) out["user-agent"] = userAgent;
+
+  const visitorIp =
+    incoming.get("x-forwarded-for") ?? incoming.get("x-real-ip");
+  if (visitorIp) out["x-forwarded-for"] = visitorIp;
+
+  if (entry === SESSION_ROUTE) {
+    const cookie = incoming.get("cookie");
+    if (cookie) out.cookie = cookie;
+    const origin = incoming.get("origin");
+    if (origin) out.origin = origin;
+  } else {
+    Object.assign(
+      out,
+      visitorForwardHeaders(incoming, process.env.AILK_VISITOR_FORWARD_KEY),
+    );
+  }
+  return out;
+}
+
+/** Answer one `/v1/...` request to this site: refuse it, or forward it to the hub. */
+export async function handleRelay(request: Request): Promise<Response> {
+  if (request.headers.has(RELAYED_HEADER)) {
+    return refusal(508, "relay_loop", "Request already relayed");
+  }
+
+  const url = new URL(request.url);
+  const entry = RELAY_ROUTES.find(
+    (r) => r.method === request.method && r.path === url.pathname,
+  );
+  if (!entry) return refusal(404, "not_found", "Not found");
+
+  if (isCrossSite(request)) {
+    return refusal(403, "cross_site", "Cross-site request refused");
+  }
+
+  let body: string | undefined;
+  if (entry.method === "POST") {
+    if (!isJson(request.headers.get("content-type"))) {
+      return refusal(415, "unsupported_media_type", "Expected application/json");
+    }
+    const text = await readCapped(request, RELAY_BODY_LIMIT);
+    if (text === null) {
+      return refusal(413, "payload_too_large", "Request body too large");
+    }
+    body = text;
+  }
+
+  if (!hubConfigured()) {
+    console.error("[relay] hub call failed", {
+      path: entry.path,
+      outcome: "no-api-address",
+    });
+    return refusal(502, "relay_unreachable", "The site could not reach its API");
+  }
+
+  try {
+    const result = await relayToApi(
+      entry.method === "GET" ? `${entry.path}${url.search}` : entry.path,
+      {
+        method: entry.method,
+        headers: relayHeaders(request, entry),
+        ...(body !== undefined ? { body } : {}),
+      },
+    );
+    // Only a JSON answer keeps its content-type; anything else (an HTML error
+    // page from a proxy in front of the hub) is served as plain text, so it
+    // can never render as markup on this site's origin.
+    const headers: Record<string, string> = {
+      ...BASE_RESPONSE_HEADERS,
+      "content-type":
+        result.contentType && isJson(result.contentType)
+          ? result.contentType
+          : "text/plain; charset=utf-8",
+    };
+    if (result.retryAfter) headers["retry-after"] = result.retryAfter;
+    // A null-body status (204, 304) cannot carry even an empty string.
+    return new Response(result.body === "" ? null : result.body, {
+      status: result.status,
+      headers,
+    });
+  } catch (err) {
+    // The error's name only (TypeError for a refused redirect or a network
+    // failure, TimeoutError for a hub that never answered) — never its
+    // message, which can quote a request detail.
+    console.error("[relay] hub call failed", {
+      path: entry.path,
+      outcome: "unreachable",
+      error: err instanceof Error ? err.name : "unknown",
+    });
+    return refusal(502, "relay_unreachable", "The site could not reach its API");
+  }
+}

package/templates/apps/web/lib/site-chrome.ts

@@ -13,12 +13,24 @@
 //   - home: "deck" → the locale-root route mounts MarketingShell with
 //     snap="mandatory" + deckHero (spec 5426 D7); every other route is
 //     unaffected.
+//   - innerPages: "bare" → every non-home page renders the bare header and
+//     the one-bar footer.
+//   - deckPresentation → the deck home presents slide by slide: fitted slides, slide anchors, the mark follows the ground
+//   - colorMode: "light" → the site is pinned to light and shows no theme
+//     switch; dark appears only as a deck ground.
+//   - chromeStyle: "minimal" → the deck's closing slide is the wordmark,
+//     contact lines and one legal line; the consent bar is a hairline bar on
+//     the page ground; the 404 renders in the site's theme.
 
 export interface SiteChrome {
   nav: "full" | "mark-only";
   footer: "columns" | "centered";
   announcementBanner: boolean;
   home: "default" | "deck";
+  innerPages?: "bare";
+  deckPresentation?: true;
+  colorMode?: "light";
+  chromeStyle?: "minimal";
 }
 
 export const siteChrome: SiteChrome = {

package/templates/apps/web/lib/site-fonts.ts

@@ -0,0 +1,15 @@
+// site-fonts.ts — the web faces the site's design sources.
+//
+// GENERATED by create-ailk from the design's `typography.<role>.fontSource`
+// (#7720). A design that sources no face gets the empty default.
+// `apps/web/app/[locale]/layout.tsx` passes this to `applyDesignFonts`
+// (@working-theory/theme): `families` fills --font-display / --font-body
+// unless the site's own `brand.fonts` sets them, and `className` (the
+// next/font variable classes) goes on <html>.
+
+export interface SiteFonts {
+  className: string;
+  families: { display?: string | undefined; body?: string | undefined };
+}
+
+export const siteFonts: SiteFonts = { className: "", families: {} };

package/templates/apps/web/lib/site-logo.tsx

@@ -5,7 +5,7 @@
  * Split from `site-brand.tsx`, which ten route and lib modules import for
  * `SITE_NAME` / `SITE_BASE_URL`: the mark needs `@working-theory/ui`'s
  * `Image` and site-config's schema, and those stay out of that wider graph
- * (spec #6820 § 5.4). The two layouts are the only callers.
+ * (spec #6820 § 5.4). The two layouts and the home page are the only callers.
  */
 
 import { BrandLogomarkSchema } from "@working-theory/site-config/schema";
@@ -14,6 +14,44 @@ import type { ReactElement } from "react";
 
 import { SITE_LOGOMARK, SITE_NAME } from "./site-brand";
 
+/** The light-mode mark as a hero `lockup`: square, so the Hero shows it as a brand mark. */
+export interface SiteLogomarkAsset {
+  src: string;
+  alt: string;
+  width: number;
+  height: number;
+}
+
+/**
+ * The same mark `siteLogo()` renders, as data (#7711): the deck home passes it
+ * to its landing hero, which carries the brand while the header is bare
+ * (#5697). It passes the light mark only, with no `darkSrc`, as #7711 shipped it.
+ */
+export function siteLogomarkAsset(): SiteLogomarkAsset {
+  if (SITE_LOGOMARK === undefined) {
+    return { src: "/logomark.svg", alt: SITE_NAME, width: 28, height: 28 };
+  }
+  const { light, alt } = BrandLogomarkSchema.parse(SITE_LOGOMARK);
+  return { src: light, alt, width: 28, height: 28 };
+}
+
+/**
+ * The header's wordmark pair as a hero `lockup` (#7733): the deck home's
+ * landing puts it in the headline's place. The same files and size the
+ * layout's header wordmark uses; wide, so the Hero reads it as a wordmark,
+ * and `alt` is the site name, so the landing's one `h1` is named for the site.
+ * `darkSrc` is the light-ink wordmark the Hero swaps in on a dark ground.
+ */
+export function siteWordmarkAsset(): SiteLogomarkAsset & { darkSrc: string } {
+  return {
+    src: "/wordmark.svg",
+    darkSrc: "/wordmark-light.svg",
+    alt: SITE_NAME,
+    width: 140,
+    height: 16,
+  };
+}
+
 /**
  * Shared brand mark. The Nav pairs it with `/wordmark.svg`. RSC-safe (no
  * hooks, no client state).

package/templates/apps/web/lib/site-theme-head.ts

@@ -0,0 +1,33 @@
+/**
+ * The site's theme head (#7742 D6): the inline CSS the locale layout puts in
+ * its `<style data-ailk="theme-vars">`, and the class its `<html>` carries
+ * for the design's web faces. One helper so the locale layout and the
+ * `chromeStyle: minimal` 404 (`app/not-found.tsx`), which renders its own
+ * `<html>`, can never drift apart.
+ *
+ * The site's own declared colours (`_site.mdx` `theme:` + `brand:`) become
+ * the token overlay; the design's faces (#7720, the generated
+ * `site-fonts.ts`) lie beneath `brand.fonts`; both theme modes are emitted,
+ * the dark one gated by `[data-theme="dark"]` (#1532); the site's shape
+ * settings (`theme.corners`, `theme.eyebrowCase`) follow so they win.
+ */
+
+import { applyDesignFonts, themeToCssVarsBothModes } from "@working-theory/theme";
+
+import { siteFonts } from "./site-fonts";
+import { loadSiteBrandTokens, loadSiteShapeCss } from "./site-theme";
+
+export interface SiteThemeHead {
+  /** The `<style data-ailk="theme-vars">` text. */
+  css: string;
+  /** The `<html>` class for the design's faces; absent when there are none. */
+  fontClassName?: string;
+}
+
+export function siteThemeHead(): SiteThemeHead {
+  const designFonts = applyDesignFonts(loadSiteBrandTokens(), siteFonts);
+  const css =
+    themeToCssVarsBothModes(designFonts.tokens ? { brand: designFonts.tokens } : {}) +
+    loadSiteShapeCss();
+  return designFonts.className ? { css, fontClassName: designFonts.className } : { css };
+}

package/templates/apps/web/lib/site-theme.ts

@@ -30,6 +30,7 @@ import { join } from "node:path";
 import { BrandSchema, SiteThemeSchema } from "@working-theory/site-config/schema";
 import {
   siteBrandToBrandTokens,
+  siteThemeScopedDarkCss,
   siteThemeShapeCss,
   type BrandTokenOverrides,
 } from "@working-theory/theme";
@@ -97,9 +98,20 @@ export function loadSiteBrandTokens(): BrandTokenOverrides | undefined {
 /**
  * The site's shape settings (`theme.corners`, `theme.eyebrowCase`) as a CSS
  * override block for `:root`. "" when the site sets neither.
+ *
+ * #7719 D6 — a theme with `darkBands: "site"` also gets its own dark palette
+ * on every dark-scoped band below the root (`siteThemeScopedDarkCss`), built
+ * from the overlay the root rule carries (the `brand:` triad included). Only
+ * mode-variant tokens are re-declared, so the shape settings above still
+ * reach inside the band.
+ * Without it the string is today's.
  */
 export function loadSiteShapeCss(): string {
   const { theme } = readSiteBlocks();
   if (theme === undefined) return "";
-  return siteThemeShapeCss(SiteThemeSchema.parse(theme));
+  const parsed = SiteThemeSchema.parse(theme);
+  const shape = siteThemeShapeCss(parsed);
+  if (parsed.darkBands !== "site") return shape;
+  const brand = loadSiteBrandTokens();
+  return brand ? shape + siteThemeScopedDarkCss(parsed, brand) : shape;
 }

package/templates/apps/web/messages/en.json

@@ -51,7 +51,9 @@
     "customer3": "'{Customer 3}'",
     "service1": "'{Service 1}'",
     "service2": "'{Service 2}'",
-    "service3": "'{Service 3}'"
+    "service3": "'{Service 3}'",
+    "nextSlide": "Next slide",
+    "backToTop": "Back to top"
   },
   "consent": {
     "title": "Cookie Preferences",
@@ -96,6 +98,10 @@
     "heading": "Portfolio",
     "emptyState": "Portfolio coming soon."
   },
+  "team": {
+    "heading": "Team",
+    "emptyState": "Team listing coming soon."
+  },
   "courses": {
     "heading": "Courses",
     "emptyState": "Courses listing coming soon."

package/templates/apps/web/middleware.ts

@@ -12,9 +12,10 @@
 // Locale list: read once at module load from project.yaml via readLocales() (S1).
 // Static assets and internal Next.js paths are excluded via the matcher below.
 //
-// /api/* and /og are route handlers outside app/[locale] (#6864). They skip
-// next-intl — whose as-needed rewrite would send them to /en/api/… and /en/og,
-// which do not exist — but still get the security headers. They are exempted
+// /api/*, /og and /v1/* are route handlers outside app/[locale] (#6864; /v1
+// is the same-origin relay, #7644). They skip next-intl — whose as-needed
+// rewrite would send them to /en/api/…, /en/og and /en/v1/…, which do not
+// exist — but still get the security headers. They are exempted
 // here rather than in the matcher, because this middleware is the only place
 // the security headers are stamped.
 //
@@ -57,7 +58,7 @@ const intlMiddleware = createMiddleware({
 
 // Top-level app/ route directories that live outside [locale]. Kept in step
 // with app/ by the drift test in __tests__/i18n/middleware.test.ts.
-export const NON_LOCALE_ROUTE_PREFIXES = ["/api", "/og"] as const;
+export const NON_LOCALE_ROUTE_PREFIXES = ["/api", "/og", "/v1"] as const;
 
 // Segment-bound: /og and /og/x are exempt; /ogden and /og-image are not.
 export function isNonLocaleRoute(pathname: string): boolean {

package/templates/apps/web/next.config.mjs

@@ -148,6 +148,12 @@ const nextConfig = {
     // Default locale baked at build time — consumed by the sitemap route for
     // x-default URL composition and bare-path default-locale serving.
     NEXT_PUBLIC_DEFAULT_LOCALE: defaultLocaleAtBuild,
+    // This site serves the same-origin relay (app/v1/[...path]/route.ts,
+    // #7644), so @working-theory/ui's resolveSubmitUrl leaves a form's
+    // root-relative action on this site's own address instead of rewriting it
+    // onto the hub's. Part of the source, not an operator setting: a build
+    // that carries the relay always carries the flag, and no other build does.
+    NEXT_PUBLIC_AILK_SAME_ORIGIN_RELAY: "1",
   },
   async headers() {
     if (!STEALTH) return [];

package/templates/database/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @working-theory/database
 
+## 0.36.0
+
+### Patch Changes
+
+- Updated dependencies [[`14119fa`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/14119fac22bf0c26973d9286a74bced761ed1218), [`2475b60`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2475b608d65880d9986d94628494509faedd0cd9), [`7fdf60d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/7fdf60de18d86d878f5e567d6df5c2e0d64d97eb), [`47eeb95`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/47eeb958390f2eadd7b0c43a47c46fbbd1309872), [`4609e76`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4609e7640798c53c730b7b9f0e723df1300ca379), [`91c5f56`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/91c5f56121d0efe475f918c493ed4245834d9e7f), [`994094f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/994094f77619b8b0ff79688b24d7befb4b1b29fa)]:
+  - @working-theory/validation@0.36.0
+
+## 0.35.0
+
+### Minor Changes
+
+- [#7671](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/7671) [`25d4a69`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/25d4a699cefaac7cf9c73dafa802696ebdc995e8) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The agent seat, step A ([#3591](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/3591), PR-A of docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md).
+
+  - `@working-theory/database` — a new `auth` model, `Agent`, and its enum `AgentPermissionLevel` (`member`): a stored delegate of one person, bound to one workspace, keeping only the SHA-256 digest of its key. The migration `20261005120000_agents` is purely additive: one table, its indexes, the ADR-0031 `agent_` primary-key CHECK and format CHECKs on every reference column. Deleting the organization, the workspace or the person's membership deletes the agent; deleting the membership of the person last shown its key clears `key_issued_to_membership_id`.
+  - `@working-theory/ids` — registers the `agent_` prefix and exports `zAgentId`.
+
+### Patch Changes
+
+- Updated dependencies [[`589b167`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/589b167dcd5acb83cb37b46bd5cdb0a57a80df1a), [`25d4a69`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/25d4a699cefaac7cf9c73dafa802696ebdc995e8), [`0fb0f37`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/0fb0f3727db9ad32776b88f39ec8b0943671bcad), [`a6833f9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/a6833f940da064c36f3150a4af614c9fd8b38628)]:
+  - @working-theory/validation@0.35.0
+  - @working-theory/ids@0.10.0
+
 ## 0.34.1
 
 ### Patch Changes