create-ailk 0.12.1 → 0.14.0

package/templates/database/__tests__/agents.db.test.ts

@@ -0,0 +1,235 @@
+/**
+ * @file agents.db.test.ts
+ *
+ * LIVE-DATABASE proof of the agents table (#3591, spec
+ * docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1; AC-1 and AC-2's
+ * cascade legs). Requires DATABASE_URL pointing at a Postgres with the
+ * migrations applied — the whole suite SKIPS when DATABASE_URL is unset,
+ * keeping the workspace Jest run DB-free (the repo convention; the
+ * `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, as `spoke-registry.db.test.ts` does. What it
+ * proves that a mock cannot:
+ *   1. The six format CHECKs reject a malformed id.
+ *   2. `credential_hash` is unique.
+ *   3. Deleting the responsible person's membership, the workspace or the
+ *      organization deletes the agent — so a re-invited person's new
+ *      membership cannot revive it.
+ *   4. Deleting the membership of the person last shown the key sets
+ *      `key_issued_to_membership_id` null and keeps the agent.
+ *   5. Deleting the creator's user row leaves the agent (no relation).
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const AGENT_ID = /^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+describeDb("the agents table (#3591, live DB)", () => {
+  let db: Client;
+  let organizationId: string;
+  let workspaceId: string;
+  let ownerUserId: string;
+  let personUserId: string;
+  let ownerMembershipId: string;
+  let personMembershipId: string;
+  let hashSeq = 0;
+
+  /** A fresh 64-character digest per insert, so the unique key never collides by accident. */
+  function nextHash(): string {
+    hashSeq += 1;
+    return hashSeq.toString(16).padStart(64, "0");
+  }
+
+  async function insertUser(tag: string): Promise<string> {
+    return (
+      await db.query<{ id: string }>(
+        `INSERT INTO "users" ("email", "updated_at") VALUES ($1, now()) RETURNING "id"`,
+        [`agents3591-${tag}@example.test`],
+      )
+    ).rows[0]!.id;
+  }
+
+  async function insertOrganization(slug: string): Promise<string> {
+    return (
+      await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ($1, $1, now()) RETURNING "id"`,
+        [`agents3591-${slug}`],
+      )
+    ).rows[0]!.id;
+  }
+
+  async function insertWorkspace(orgId: string, slug: string): Promise<string> {
+    return (
+      await db.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, $2, $2, now()) RETURNING "id"`,
+        [orgId, slug],
+      )
+    ).rows[0]!.id;
+  }
+
+  async function insertMembership(orgId: string, userId: string, role: string): Promise<string> {
+    return (
+      await db.query<{ id: string }>(
+        `INSERT INTO "memberships" ("organization_id", "user_id", "role")
+         VALUES ($1, $2, $3::"Role") RETURNING "id"`,
+        [orgId, userId, role],
+      )
+    ).rows[0]!.id;
+  }
+
+  type AgentColumns = {
+    id?: string;
+    organization_id: string;
+    workspace_id: string;
+    responsible_membership_id: string;
+    created_by_user_id: string;
+    key_issued_to_membership_id: string | null;
+    credential_hash: string;
+  };
+
+  function defaults(): AgentColumns {
+    return {
+      organization_id: organizationId,
+      workspace_id: workspaceId,
+      responsible_membership_id: personMembershipId,
+      created_by_user_id: ownerUserId,
+      key_issued_to_membership_id: ownerMembershipId,
+      credential_hash: nextHash(),
+    };
+  }
+
+  /** Insert one agent; the database mints its id unless one is given. */
+  async function insertAgent(overrides: Partial<AgentColumns> = {}): Promise<string> {
+    const row = { ...defaults(), ...overrides };
+    const columns = Object.keys(row);
+    const values = Object.values(row);
+    const { rows } = await db.query<{ id: string }>(
+      `INSERT INTO "agents" (${columns.map((c) => `"${c}"`).join(", ")}, "name", "credential_prefix", "updated_at")
+       VALUES (${columns.map((_, i) => `$${i + 1}`).join(", ")}, 'inbox helper', 'ailk_agt_abcdefgh', now())
+       RETURNING "id"`,
+      values,
+    );
+    return rows[0]!.id;
+  }
+
+  async function agentRow(id: string): Promise<{ key_issued_to_membership_id: string | null } | undefined> {
+    return (
+      await db.query<{ key_issued_to_membership_id: string | null }>(
+        `SELECT "key_issued_to_membership_id" FROM "agents" WHERE "id" = $1`,
+        [id],
+      )
+    ).rows[0];
+  }
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    organizationId = await insertOrganization("org");
+    workspaceId = await insertWorkspace(organizationId, "agents3591-ws");
+    ownerUserId = await insertUser("owner");
+    personUserId = await insertUser("person");
+    ownerMembershipId = await insertMembership(organizationId, ownerUserId, "owner");
+    personMembershipId = await insertMembership(organizationId, personUserId, "member");
+  });
+
+  afterAll(async () => {
+    await db.query(`DELETE FROM "organizations" WHERE "slug" LIKE 'agents3591-%'`);
+    await db.query(`DELETE FROM "users" WHERE "email" LIKE 'agents3591-%'`);
+    await db.end();
+  });
+
+  describe("format CHECKs (ADR-0031)", () => {
+    it("an agent takes a database-minted agent_ id, a member ceiling and is enabled", async () => {
+      const id = await insertAgent();
+      expect(id).toMatch(AGENT_ID);
+      const { rows } = await db.query<{ permission_level: string; enabled: boolean }>(
+        `SELECT "permission_level", "enabled" FROM "agents" WHERE "id" = $1`,
+        [id],
+      );
+      expect(rows[0]).toEqual({ permission_level: "member", enabled: true });
+    });
+
+    it.each([
+      ["id", "agents_id_format"],
+      ["organization_id", "agents_organization_id_format"],
+      ["workspace_id", "agents_workspace_id_format"],
+      ["responsible_membership_id", "agents_responsible_membership_id_format"],
+      ["key_issued_to_membership_id", "agents_key_issued_to_membership_id_format"],
+      ["created_by_user_id", "agents_created_by_user_id_format"],
+    ] as const)("REJECTS a malformed %s", async (column, constraint) => {
+      // The format CHECK fires before any foreign key.
+      await expect(insertAgent({ [column]: "bad" })).rejects.toThrow(new RegExp(constraint));
+    });
+
+    it("refuses a ceiling outside the enum", async () => {
+      const id = await insertAgent();
+      await expect(
+        db.query(`UPDATE "agents" SET "permission_level" = 'owner' WHERE "id" = $1`, [id]),
+      ).rejects.toThrow(/AgentPermissionLevel/);
+    });
+  });
+
+  it("a credential digest is unique", async () => {
+    const hash = nextHash();
+    await insertAgent({ credential_hash: hash });
+    await expect(insertAgent({ credential_hash: hash })).rejects.toThrow(
+      /agents_credential_hash_key/,
+    );
+  });
+
+  describe("cascades (D1 — leaving stops the agent)", () => {
+    it("deleting the person's membership deletes their agent, and a re-invite does not revive it", async () => {
+      const user = await insertUser("leaver");
+      const membership = await insertMembership(organizationId, user, "member");
+      const agent = await insertAgent({ responsible_membership_id: membership });
+
+      await db.query(`DELETE FROM "memberships" WHERE "id" = $1`, [membership]);
+      expect(await agentRow(agent)).toBeUndefined();
+
+      const reinvited = await insertMembership(organizationId, user, "member");
+      expect(reinvited).not.toBe(membership);
+      expect(await agentRow(agent)).toBeUndefined();
+    });
+
+    it("deleting the workspace deletes its agents", async () => {
+      const doomed = await insertWorkspace(organizationId, "agents3591-doomed");
+      const agent = await insertAgent({ workspace_id: doomed });
+      await db.query(`DELETE FROM "workspaces" WHERE "id" = $1`, [doomed]);
+      expect(await agentRow(agent)).toBeUndefined();
+    });
+
+    it("deleting the organization deletes its agents", async () => {
+      const org = await insertOrganization("doomed-org");
+      const ws = await insertWorkspace(org, "agents3591-doomed-org-ws");
+      const user = await insertUser("doomed-org-person");
+      const membership = await insertMembership(org, user, "owner");
+      const agent = await insertAgent({
+        organization_id: org,
+        workspace_id: ws,
+        responsible_membership_id: membership,
+        key_issued_to_membership_id: membership,
+      });
+      await db.query(`DELETE FROM "organizations" WHERE "id" = $1`, [org]);
+      expect(await agentRow(agent)).toBeUndefined();
+    });
+
+    it("deleting the key-holder's membership keeps the agent and clears key_issued_to_membership_id", async () => {
+      const admin = await insertUser("departing-admin");
+      const adminMembership = await insertMembership(organizationId, admin, "admin");
+      const agent = await insertAgent({ key_issued_to_membership_id: adminMembership });
+
+      await db.query(`DELETE FROM "memberships" WHERE "id" = $1`, [adminMembership]);
+      expect(await agentRow(agent)).toEqual({ key_issued_to_membership_id: null });
+    });
+
+    it("deleting the creator's user row leaves the agent (created_by_user_id has no relation)", async () => {
+      const creator = await insertUser("creator");
+      const agent = await insertAgent({ created_by_user_id: creator, key_issued_to_membership_id: null });
+      await db.query(`DELETE FROM "users" WHERE "id" = $1`, [creator]);
+      expect(await agentRow(agent)).toEqual({ key_issued_to_membership_id: null });
+    });
+  });
+});

package/templates/database/auth/schema.prisma

@@ -82,6 +82,8 @@ model Organization {
   memberships Membership[]
   invitations Invitation[]
   workspaces  Workspace[]
+  // #3591 — the agents (delegates) of this organization's members.
+  agents      Agent[]
 
   @@unique([billingProvider, billingCustomerId])
   @@map("organizations")
@@ -102,6 +104,8 @@ model Workspace {
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   // #7532 — the hub's spoke registry rows bound to this workspace.
   spokes       Spoke[]
+  // #3591 — the agents bound to this workspace.
+  agents       Agent[]
 
   @@unique([organizationId, slug])
   @@index([organizationId])
@@ -137,6 +141,59 @@ model Spoke {
   @@map("spokes")
 }
 
+/// AgentPermissionLevel — an agent's ceiling (#3591, spec
+/// docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D5). The agent
+/// acts with the LOWER of its person's `Role` and this. One value in v1;
+/// raising the ceiling later is a new value here and in
+/// `@working-theory/validation`'s `AGENT_PERMISSION_LEVELS`.
+enum AgentPermissionLevel {
+  member
+}
+
+/// Agent — a stored delegate of ONE person, bound to ONE workspace (#3591,
+/// spec docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D2).
+///
+/// The agent signs in with a key (`ailk_agt_…`, shown once) and passes the
+/// same tenant guard a browser session does, through its person's live
+/// `Membership` (`responsibleMembershipId`). Removing that membership deletes
+/// the agent (the FK below), so a re-invite cannot revive it.
+///
+/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
+/// recognisable `credentialPrefix`; the key itself never is.
+/// `keyIssuedToMembershipId` is the owner or admin who created or last
+/// re-keyed the agent — the only person who has seen its key. Removing that
+/// membership sets the column null and the guard refuses the agent until it
+/// is re-keyed. `createdByUserId` is a plain column with no relation, so
+/// deleting the creator does not delete the agents they made for others.
+/// `apps/api/src/lib/agent-store.ts` is the only file that names
+/// `prisma.agent`.
+model Agent {
+  id                      String               @id @default(dbgenerated("('agent_'::text || (uuidv7())::text)")) @db.Text
+  organizationId          String               @map("organization_id")
+  workspaceId             String               @map("workspace_id")
+  responsibleMembershipId String               @map("responsible_membership_id")
+  name                    String               @db.VarChar(80)
+  permissionLevel         AgentPermissionLevel @default(member) @map("permission_level")
+  enabled                 Boolean              @default(true)
+  credentialHash          String               @unique @map("credential_hash") @db.Char(64)
+  credentialPrefix        String               @map("credential_prefix") @db.VarChar(24)
+  lastActiveAt            DateTime?            @map("last_active_at")
+  createdByUserId         String               @map("created_by_user_id")
+  keyIssuedToMembershipId String?              @map("key_issued_to_membership_id")
+  createdAt               DateTime             @default(now()) @map("created_at")
+  updatedAt               DateTime             @updatedAt @map("updated_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  workspace    Workspace    @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  responsible  Membership   @relation("AgentResponsible", fields: [responsibleMembershipId], references: [id], onDelete: Cascade)
+  keyIssuedTo  Membership?  @relation("AgentKeyIssuedTo", fields: [keyIssuedToMembershipId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+  @@index([workspaceId])
+  @@index([responsibleMembershipId])
+  @@map("agents")
+}
+
 /// Membership — User ↔ Organization with a Role. Managed by the Better Auth
 /// organization plugin (modelName "membership"). Org-level: grants visibility
 /// into every workspace of the organization.
@@ -149,6 +206,10 @@ model Membership {
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)
+  // #3591 — the agents this person is responsible for, and the agents whose
+  // current key this person was the one shown.
+  agents          Agent[] @relation("AgentResponsible")
+  agentKeysIssued Agent[] @relation("AgentKeyIssuedTo")
 
   @@unique([organizationId, userId])
   @@index([userId])

package/templates/database/migrations/20261005120000_agents/migration.sql

@@ -0,0 +1,84 @@
+-- #3591 — the agent seat, step A (spec
+-- docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1).
+--
+--   agents (auth) — one row per agent: a stored delegate of ONE person (its
+--                   responsible Membership), bound to ONE workspace. It stores
+--                   the SHA-256 digest of the agent's key, never the key.
+--                   Deleting the organization, the workspace or the person's
+--                   membership deletes the agent; deleting the membership of
+--                   the person who was last shown its key sets
+--                   key_issued_to_membership_id null, which the guard refuses
+--                   until the agent is re-keyed. created_by_user_id is a plain
+--                   column with no foreign key, so deleting the creator does
+--                   not delete the agents they made for someone else.
+--
+-- PURELY ADDITIVE: one new enum, one new table, its indexes and four FKs (to
+-- "organizations", "workspaces" and twice to "memberships"). No statement
+-- touches an existing table's rows or columns, so there is no pre-assertion
+-- block — this migration cannot lose a row.
+--
+-- Rollback: DROP TABLE "agents"; DROP TYPE "AgentPermissionLevel". Safe while
+-- nothing but #3591's own code reads them.
+
+-- CreateEnum
+CREATE TYPE "AgentPermissionLevel" AS ENUM ('member');
+
+-- CreateTable
+CREATE TABLE "agents" (
+    "id" TEXT NOT NULL DEFAULT ('agent_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "responsible_membership_id" TEXT NOT NULL,
+    "name" VARCHAR(80) NOT NULL,
+    "permission_level" "AgentPermissionLevel" NOT NULL DEFAULT 'member',
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "credential_hash" CHAR(64) NOT NULL,
+    "credential_prefix" VARCHAR(24) NOT NULL,
+    "last_active_at" TIMESTAMP(3),
+    "created_by_user_id" TEXT NOT NULL,
+    "key_issued_to_membership_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "agents_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+-- The lookup an agent's every request makes (`findAgentByKeyHash`).
+CREATE UNIQUE INDEX "agents_credential_hash_key" ON "agents"("credential_hash");
+
+-- CreateIndex
+CREATE INDEX "agents_organization_id_idx" ON "agents"("organization_id");
+
+-- CreateIndex
+CREATE INDEX "agents_workspace_id_idx" ON "agents"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "agents_responsible_membership_id_idx" ON "agents"("responsible_membership_id");
+
+-- AddForeignKey
+ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_fkey" FOREIGN KEY ("organization_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+-- Leaving stops the agent: removing the person's membership deletes it.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_fkey" FOREIGN KEY ("responsible_membership_id") REFERENCES "memberships"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+-- A key dies with the person who received it: SET NULL, which the guard refuses.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_fkey" FOREIGN KEY ("key_issued_to_membership_id") REFERENCES "memberships"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — agents: agent_ (registered in packages/ids/src/registry.ts;
+-- this migration's path is added to migration-sync.test.ts's
+-- PK_CHECK_MIGRATIONS). Each reference column carries the format CHECK of the
+-- entity it names, in the exact pattern the spoke migration uses.
+ALTER TABLE "agents" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "agents" ALTER COLUMN "id" SET DEFAULT ('agent_'::text || (uuidv7())::text);
+ALTER TABLE "agents" ADD CONSTRAINT "agents_id_format" CHECK ("id" ~ '^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_format" CHECK ("responsible_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_format" CHECK ("key_issued_to_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "agents" ADD CONSTRAINT "agents_created_by_user_id_format" CHECK ("created_by_user_id" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.34.1",
+  "version": "0.36.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/versions.json

@@ -1,52 +1,52 @@
 {
-  "@working-theory/admin-ui": "0.34.1",
-  "@working-theory/aeo": "0.34.1",
-  "@working-theory/agent-context": "0.34.1",
+  "@working-theory/admin-ui": "0.36.0",
+  "@working-theory/aeo": "0.36.0",
+  "@working-theory/agent-context": "0.36.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.34.1",
-  "@working-theory/api-client": "0.34.1",
+  "@working-theory/analytics": "0.36.0",
+  "@working-theory/api-client": "0.36.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.34.1",
-  "@working-theory/common": "0.34.1",
+  "@working-theory/cli": "0.36.0",
+  "@working-theory/common": "0.36.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.34.1",
-  "@working-theory/content-projection": "0.34.1",
-  "@working-theory/email": "0.34.1",
+  "@working-theory/content-adapters": "0.36.0",
+  "@working-theory/content-projection": "0.36.0",
+  "@working-theory/email": "0.36.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.34.1",
-  "@working-theory/fumadocs-schema": "0.34.1",
-  "@working-theory/ids": "0.9.1",
-  "@working-theory/jsonld": "0.34.1",
-  "@working-theory/license": "0.34.1",
-  "@working-theory/metadata": "0.34.1",
-  "@working-theory/observability": "0.34.1",
-  "@working-theory/page-renderer": "0.34.1",
-  "@working-theory/plugin-mcp": "0.1.1",
-  "@working-theory/schema": "0.34.1",
-  "@working-theory/schema-pack-registry": "0.34.1",
-  "@working-theory/schema-validator": "0.34.1",
-  "@working-theory/sections-registry": "0.34.1",
-  "@working-theory/site-config": "0.34.1",
-  "@working-theory/stripe-client": "0.34.1",
-  "@working-theory/templates": "0.34.1",
-  "@working-theory/theme": "0.34.1",
-  "@working-theory/ui": "0.34.1",
-  "@working-theory/validation": "0.34.1",
-  "@working-theory/web-i18n": "0.34.1",
+  "@working-theory/eslint-config": "0.36.0",
+  "@working-theory/fumadocs-schema": "0.36.0",
+  "@working-theory/ids": "0.10.0",
+  "@working-theory/jsonld": "0.36.0",
+  "@working-theory/license": "0.36.0",
+  "@working-theory/metadata": "0.36.0",
+  "@working-theory/observability": "0.36.0",
+  "@working-theory/page-renderer": "0.36.0",
+  "@working-theory/plugin-mcp": "0.1.2",
+  "@working-theory/schema": "0.36.0",
+  "@working-theory/schema-pack-registry": "0.36.0",
+  "@working-theory/schema-validator": "0.36.0",
+  "@working-theory/sections-registry": "0.36.0",
+  "@working-theory/site-config": "0.36.0",
+  "@working-theory/stripe-client": "0.36.0",
+  "@working-theory/templates": "0.36.0",
+  "@working-theory/theme": "0.36.0",
+  "@working-theory/ui": "0.36.0",
+  "@working-theory/validation": "0.36.0",
+  "@working-theory/web-i18n": "0.36.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.12",
-  "@working-theory/ui-docs-blog": "0.23.12",
-  "@working-theory/ui-scheduling": "0.23.12",
-  "@working-theory/ui-signal-collectors": "0.25.1",
+  "@working-theory/ui-commerce": "0.23.14",
+  "@working-theory/ui-docs-blog": "0.23.14",
+  "@working-theory/ui-scheduling": "0.23.14",
+  "@working-theory/ui-signal-collectors": "0.25.3",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.34.1"
+  "@working-theory/database": "0.36.0"
 }

package/site-templates/designs/minimalism/sample/README.md

@@ -1,48 +0,0 @@
-# The `minimalism` design's home-deck sample
-
-> Narrative moved here from the retired minimalism template's `TEMPLATE-MANIFEST.md` when
-> that tree retired (spec 6892 D4/D5) — `minimalism` is a design, not a template, so it
-> carries no generated manifest of its own. This file is NOT installed onto a scaffold
-> (`installDesignSample` copies only `content/**` and `public/**`); it documents the sample for
-> maintainers of this design.
-
-The second Pro template (#5589) that first wore this design was a reports-first site whose home
-is a **nine-slide scroll-snap deck**, shaped after the reference captured in
-`docs/research/bondcap-capture/`. Structure and design are the reference; **the copy is not** —
-every line in `content/en/HomePage/home.mdx` is placeholder English of the same shape and length.
-
-`layout.home: "deck"` (the `minimalism` design's own layout knob) makes every direct section
-child of `home.mdx` one full-viewport snap target, in order. The mark is hidden on slide 1 (the
-deck-hero landing state) and revealed from slide 2 on.
-
-| #   | Slide             | Section                                                        | Ground                   | Action                                                     |
-| --- | ----------------- | -------------------------------------------------------------- | ------------------------ | ---------------------------------------------------------- |
-| 1   | Landing           | `hero` (`backdrop`)                                            | gradient band + backdrop | `{Primary CTA} →` → `/reports`, centered; 44px scroll cue. |
-| 2   | Tagline           | `content-block` (`align: center`, `fill: viewport`)            | light                    | —                                                          |
-| 3   | Our community     | `logoCloud` (`actions`)                                        | light                    | `Refer someone →` → `/referral`, bottom-centered at 44px   |
-| 4   | Reports headline  | `content-block` (`align: center`, `fill: viewport`)            | light                    | —                                                          |
-| 5   | Special reports   | `reports-list` (`list`, `tone: on-dark`)                       | dark (`gradient-dark`)   | four dated titles → `/reports/<slug>`                      |
-| 6   | Favorites         | `reports-list` (`list`, `tone: on-dark`)                       | dark (`gradient-dark`)   | year-only titles → `/reports/<slug>`                       |
-| 7   | Services headline | `content-block` (`align: center`, `fill: viewport`)            | light                    | `Hire me →` → `/meet`                                      |
-| 8   | Partners          | `team` (`with-large-images`, `hoverReveal`, `phoneColumns: 2`) | light                    | `About us →` → `/about`, bottom-centered at 44px           |
-| 9   | Closing           | `cta` (`minimal`)                                              | light                    | `Contact me →` → `/contact`, centered                      |
-
-## The site principle
-
-Every slide's action sits at the bottom, centered, at 44px or larger; grids are 2-up on a phone.
-This is held by bounded section props on the sections above, never by a `className` override or
-hand-rolled markup (`.claude/rules/frontend.md` § Chrome Composes Blocks).
-
-## The 11 SVGs
-
-`public/hero-backdrop.svg`, `public/wordmark-placeholder.svg`, three `public/logo-placeholder-*.svg`
-and six `public/avatar-placeholder-*.svg` — all placeholders, referenced only from this sample's
-`home.mdx` (the avatars are also referenced by the retired bespoke `AboutPage` seed, which did not
-move with this design — its team slide is the only remaining consumer). They ride with the design
-because the deck uses all 11; a shape/design pair that does not install this sample never ships
-them (D4).
-
-## Copy density
-
-This design declares `copy: { density: "sparse" }` in its `DESIGN.md` — its pages, this deck
-included, carry far fewer words than a standard site.