create-ailk 0.15.0 → 0.16.0

package/templates/apps/web/lib/hub-session/sign-in-gate.tsx

@@ -0,0 +1,79 @@
+/**
+ * HubSignInGate — the signed-out account gate of a spoke that signs in
+ * through its hub (#7894 D10).
+ *
+ * A Server Component, rendered by the `(authed)` layout through the generated
+ * gate seam (`signed-out-gate.generated.tsx`, its `signIn: "hub"` render). It
+ * offers ONE action: a link to this site's own `/api/hub-session/sign-in`,
+ * carrying the requested path as `next`, which starts the hub sign-in. The
+ * link is a plain anchor (the `Link` primitive), so nothing prefetches the
+ * route and starts a flow the visitor did not ask for.
+ *
+ * Not configured (`hubSessionConfig()` is `null`: a client id, secret or
+ * session secret missing), it renders the account area's existing "sign-in
+ * isn't available yet" state, whose one action leads back to the site.
+ */
+
+import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { hubSessionConfig } from "./config";
+import { HUB_SESSION_FALLBACK_PATH } from "./session";
+
+/** The route that starts the hub sign-in. */
+const HUB_SIGN_IN_ROUTE = "/api/hub-session/sign-in";
+
+export interface HubSignInGateProps {
+  locale: string;
+  /** The incoming request's headers; `x-pathname` is the page to return to. */
+  requestHeaders: Headers;
+}
+
+export async function HubSignInGate({
+  locale,
+  requestHeaders,
+}: HubSignInGateProps): Promise<ReactElement> {
+  const t = await getTranslations({ locale, namespace: "account.gate" });
+  const configured = hubSessionConfig() !== null;
+  const next =
+    requestHeaders.get("x-pathname") ??
+    localeHref(locale, HUB_SESSION_FALLBACK_PATH);
+
+  return (
+    <div
+      className="flex min-h-screen flex-col items-center justify-center gap-4 py-section text-center"
+      data-testid="account-sign-in-gate"
+    >
+      <Heading level={1} visual={4}>
+        {configured ? t("hubHeadline") : t("emptyHeadline")}
+      </Heading>
+      <Text variant="body-sm" tone="muted" className="max-w-xs">
+        {configured ? t("hubDescription") : t("emptyDescription")}
+      </Text>
+      {configured ? (
+        // The primary action: 44px on a phone, 36px from md up.
+        <Button asChild className="max-md:min-h-11">
+          <Link
+            href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
+            variant="bare"
+            data-testid="account-hub-sign-in"
+          >
+            {t("hubSignIn")}
+          </Link>
+        </Button>
+      ) : (
+        <Button asChild variant="secondary" className="max-md:min-h-11">
+          <Link
+            href={localeHref(locale, "/")}
+            variant="bare"
+            data-testid="account-sign-in-gate-home"
+          >
+            {t("homeLink")}
+          </Link>
+        </Button>
+      )}
+    </div>
+  );
+}

package/templates/apps/web/lib/listings-config.ts

@@ -0,0 +1,31 @@
+/**
+ * The listing site key — the ONE reader (#7872 D8).
+ *
+ * The listicle directory (`./listings.tsx`, #7521) switches on this key:
+ * declared, it renders; absent, it is off and makes no read. Every reader of
+ * the key goes through here, so two copies cannot drift.
+ *
+ *   1. `NEXT_PUBLIC_AILK_LISTING_SITE_KEY` — the name the spoke roadmap fixes
+ *      (§7.3). The value names a site and grants nothing (#5048 D2), so it is
+ *      public by design, and a client consumer gets it inlined at build.
+ *   2. `AILK_LISTING_PUBLIC_KEY` — the server-only name every site
+ *      configured since create-ailk 0.12.0 already sets, kept as a fallback
+ *      so an upgrade does not switch a working directory off.
+ *
+ * An empty or whitespace value counts as unset. Both reads use dot access, so
+ * Next inlines the public name at build: changing or rotating it needs a
+ * rebuild, and while it is set a runtime change to the fallback has no effect.
+ */
+
+/** The site's listing key, trimmed, or `undefined` when neither name holds one. */
+export function listingSiteKey(): string | undefined {
+  const declared = process.env.NEXT_PUBLIC_AILK_LISTING_SITE_KEY?.trim();
+  if (declared) return declared;
+  const fallback = process.env.AILK_LISTING_PUBLIC_KEY?.trim();
+  return fallback ? fallback : undefined;
+}
+
+/** Whether the listicle directory is switched on for this site. */
+export function listingsEnabled(): boolean {
+  return listingSiteKey() !== undefined;
+}

package/templates/apps/web/lib/listings.tsx

@@ -20,8 +20,11 @@
  * BASE TREE, and inert without two things (D7). It ships in every scaffold,
  * Free included, and is never slice-owned — the layout imports it, so owning
  * it would strip every page from a keyless scaffold. Each member answers
- * `null` with NO read when `AILK_LISTING_PUBLIC_KEY` is unset or the paid
- * `@working-theory/ui-signal-collectors` package is absent. The package is
+ * `null` with NO read when the site's listing key is unset or the paid
+ * `@working-theory/ui-signal-collectors` package is absent. The key is the
+ * switch: `./listings-config.ts` is its one reader
+ * (`NEXT_PUBLIC_AILK_LISTING_SITE_KEY`, falling back to
+ * `AILK_LISTING_PUBLIC_KEY`, #7872 D8). The package is
  * reached the way `src/lib/commerce-sections.ts` reaches its own: through
  * `loadUiSignalCollectors()` in the generated paid-sections registry (#7536),
  * a bundled `import()` where the site carries the package and a stub that
@@ -64,6 +67,7 @@ import { cache, type ComponentType, type ReactElement, type ReactNode } from "re
 
 import { resolveBaseUrl } from "../src/lib/routes";
 
+import { listingSiteKey } from "./listings-config";
 import { loadUiSignalCollectors } from "./paid-sections.generated";
 
 // ── The paid sections, through the generated registry ──────────────────────
@@ -252,7 +256,7 @@ export function entryJsonLd(entry: ListingEntryPublic, entryType: string, url: s
 // ── The extension ───────────────────────────────────────────────────────────
 
 export function createListingExtension(deps: ListingExtensionDeps = {}): ListingExtension {
-  const siteKey = deps.siteKey ?? (() => process.env["AILK_LISTING_PUBLIC_KEY"]);
+  const siteKey = deps.siteKey ?? listingSiteKey;
   const pathname =
     deps.pathname ?? (async () => (await headers()).get("x-pathname"));
   const locales = deps.locales ?? (() => readLocales());

package/templates/apps/web/lib/meeting-slugs.ts

@@ -17,10 +17,18 @@
  * A duplicated inline call in both pages is how the two would drift, and
  * it is also how one of them would forget the fail-closed arm — this is
  * the ONE place that reasoning lives (D5).
+ *
+ * ON A SPOKE (#7872 D4), `null` means `[]`: the `SCHEDULING_CAL_LINK`
+ * fallback is not consulted. The hub books a spoke's slug only when that
+ * spoke's workspace has stored it (`spokeMayBook`), so a fallback slug would
+ * advertise a meeting whose every booking fails with `event_not_found`. The
+ * other arms are the same on both topologies.
  */
 import { schedule } from "@working-theory/api-client";
 import { MeetingSlugSchema } from "@working-theory/site-config/schema";
 
+import { TOPOLOGY } from "./topology.generated";
+
 /**
  * The D4 row-1 fallback: the slug half of the env-configured booker's own
  * calLink (`"<owner>/<slug>"`), or `[]` when the env var is unset. This is
@@ -49,5 +57,7 @@ function derivedFallbackSlugs(): string[] {
 export async function enabledMeetingSlugs(): Promise<string[]> {
   const res = await schedule.meetingTypes();
   if (!res.ok) return [];
-  return res.body.slugs ?? derivedFallbackSlugs();
+  const { slugs } = res.body;
+  if (slugs) return slugs;
+  return TOPOLOGY === "spoke" ? [] : derivedFallbackSlugs();
 }

package/templates/apps/web/lib/next-path.ts

@@ -0,0 +1,35 @@
+/**
+ * `?next=` sanitizer for the /sign-in page (#4984) and the hub-session
+ * callback (#7894 D7 — moved here from `app/[locale]/(auth)/sign-in/`, which
+ * re-exports it, so a spoke that drops the `(auth)` group keeps it).
+ *
+ * The post-sign-in `callbackURL` handed to Better Auth is caller-controlled
+ * via the `next` search param, so it must be a SAME-ORIGIN, SAME-APP path —
+ * never a foreign origin (open redirect), a protocol-relative URL, a
+ * backslash trick browsers normalise to `//`, or a control character that
+ * could split a header. Anything that fails falls back to `fallback`.
+ */
+
+// U+0000–U+001F and U+007F — the header-splitting / URL-mangling range.
+// eslint-disable-next-line no-control-regex -- the control range is the thing being rejected
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+
+/**
+ * Returns `raw` when it is a safe in-app path, else `fallback`.
+ *
+ * Accepts: a string starting with a single "/" (e.g. `/account`,
+ * `/en/account?tab=x`, `/waitlist#a`).
+ * Rejects: non-strings (incl. Next's `string[]` for a repeated param), "",
+ * `//host` (protocol-relative), `/\host` (backslash normalised to `//`),
+ * any backslash anywhere, whitespace, control characters, and anything not
+ * starting with "/" (`https://…`, `host.tld`).
+ */
+export function resolveNextPath(raw: unknown, fallback: string): string {
+  if (typeof raw !== "string") return fallback;
+  if (!raw.startsWith("/")) return fallback;
+  if (raw.startsWith("//")) return fallback;
+  if (raw.includes("\\")) return fallback;
+  if (/\s/.test(raw)) return fallback;
+  if (CONTROL_CHARS.test(raw)) return fallback;
+  return raw;
+}

package/templates/apps/web/lib/relay.ts

@@ -42,6 +42,8 @@ import { isIP } from "node:net";
 
 import { relayToApi, visitorForwardHeaders } from "@working-theory/api-client";
 
+import { browserApiOrigin } from "./api-origin.generated";
+
 type RelayMethod = "GET" | "POST";
 
 /** One relayed (method, path) pair. */
@@ -287,7 +289,7 @@ function hubConfigured(): boolean {
   if (process.env.NODE_ENV !== "production") return true;
   return Boolean(
     process.env.AILK_API_URL ||
-      process.env.NEXT_PUBLIC_AILK_API_URL ||
+      browserApiOrigin() ||
       process.env.NEXT_PUBLIC_API_URL,
   );
 }

package/templates/apps/web/lib/server-api.ts

@@ -24,6 +24,9 @@
 
 import { cookies, headers } from "next/headers";
 
+import { hubSessionInit } from "./hub-session/session";
+import { SIGN_IN_PROVIDER } from "./topology.generated";
+
 /**
  * Structural mirror of `@working-theory/api-client`'s `ApiResult<T>`
  * (`packages/api-client/src/http.ts`) — not imported, because that type is
@@ -75,10 +78,17 @@ interface ErrorBody {
  * pass the check exactly as a browser-originated one would. RSC `GET`s are
  * unaffected: `isOriginAllowed` short-circuits `true` for safe methods before
  * it ever inspects the header.
+ *
+ * On a spoke that signs in through its hub (`SIGN_IN_PROVIDER === "hub"`,
+ * #7894 D12) this is the ONE request-init re-target: it returns the hub
+ * credential as `Authorization: Bearer` (`hubSessionInit`), and no header at
+ * all signed out — the hub has no cookie session for this site's visitor.
+ * Every caller passes the result straight to the api-client unchanged.
  */
 export async function forwardedCookieInit(): Promise<{
-  headers: { cookie: string; origin?: string };
+  headers: Record<string, string>;
 }> {
+  if (SIGN_IN_PROVIDER === "hub") return hubSessionInit();
   const cookieHeader = (await cookies()).toString();
   const origin = (await headers()).get("origin");
   return { headers: { cookie: cookieHeader, ...(origin ? { origin } : {}) } };

package/templates/apps/web/lib/topology.generated.ts

@@ -1,19 +1,29 @@
 // topology.generated.ts — how this site reads a session and registers its stores.
 //
 // GENERATED by create-ailk for this site's topology (#7426). Do not edit:
-// every scaffold rewrites it. A hub reads the session through Better Auth;
-// a spoke (`--topology spoke`) has no sign-in and no database of its own,
-// so its render reads no session and imports nothing.
-import { auth } from "../auth";
+// every scaffold rewrites it. A hub reads the session through Better Auth.
+// A spoke (`--topology spoke`) has no database of its own: by default it
+// has no sign-in, so its render reads no session and imports nothing; with
+// `--hub-sign-in` (#7894) it reads the sealed hub-session cookie.
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
 export const SIGN_IN_ENABLED: boolean = true;
+export const SIGN_IN_PROVIDER: "site" | "hub" | "none" = "site";
+export const SIGN_IN_PATH: string | null = "/sign-in";
+export const SIGN_UP_PATH: string | null = "/sign-up";
+export const SIGN_OUT_ENDPOINT: string | null = null;
 
 export type SiteSession = {
-  user: { name?: string | null; email: string };
+  user: {
+    name?: string | null;
+    email: string;
+    emailVerified: boolean;
+    createdAt?: Date | string | null;
+  };
 } | null;
 
 export async function readSession(headers: Headers): Promise<SiteSession> {
+  const { auth } = await import("../auth");
   return auth.api.getSession({ headers });
 }
 

package/templates/apps/web/messages/en.json

@@ -303,6 +303,16 @@
       "ctaLabel": "Back to services"
     }
   },
+  "checkoutThankYou": {
+    "title": "Thank you",
+    "body": "Your payment went through. We'll email you a receipt and the next steps."
+  },
+  "checkoutUnavailable": {
+    "title": "Checkout isn't available right now",
+    "body": "Nothing was charged. Please try again in a few minutes.",
+    "ctaHeadline": "Need a hand?",
+    "ctaLabel": "Contact us"
+  },
   "resources": {
     "heading": "Resources",
     "emptyState": "Resources listing coming soon."
@@ -649,7 +659,8 @@
         "unsaved": "Unsaved changes",
         "clean": "No unsaved changes",
         "nameRequired": "Enter your name.",
-        "saveError": "We couldn't save your name. Try again."
+        "saveError": "We couldn't save your name. Try again.",
+        "manageOnHub": "Manage your account on our main site"
       },
       "security": {
         "title": "Security",
@@ -660,7 +671,8 @@
         "magicLink": "Email sign-in link",
         "password": "Password",
         "available": "Available",
-        "none": "No sign-in method is configured."
+        "none": "No sign-in method is configured.",
+        "viaHub": "You sign in through our main site. Your sign-in methods are managed there."
       },
       "notifications": {
         "title": "Notifications",
@@ -696,7 +708,10 @@
       "emptyHeadline": "Sign-in isn't available yet",
       "emptyDescription": "This site hasn't turned on sign-in for members yet. Check back soon, or contact the site owner.",
       "signInLink": "Go to the sign-in page",
-      "homeLink": "Back to the site"
+      "homeLink": "Back to the site",
+      "hubHeadline": "Sign in to your account",
+      "hubDescription": "You sign in on our main site, then come straight back here.",
+      "hubSignIn": "Sign in"
     },
     "profile": {
       "email": "Email",
@@ -718,6 +733,20 @@
       "period": "Period",
       "date": "Date"
     },
+    "pieces": {
+      "heading": "My pieces",
+      "type": "Piece",
+      "stage": "Stage",
+      "createdAt": "Started",
+      "updatedAt": "Updated",
+      "needsClient": "This piece is waiting on you."
+    },
+    "messages": {
+      "heading": "My messages",
+      "sentAt": "Sent",
+      "file": "File",
+      "download": "Download {filename}"
+    },
     "subscription": {
       "headline": "Your payment didn't go through",
       "action": "Update payment method"

package/templates/database/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @working-theory/database
 
+## 0.38.0
+
+### Minor Changes
+
+- [#8037](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8037) [`89eba8c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/89eba8c2bab16766a68284f52c872aae86f59fde) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The member area contract ([#7877](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7877)): a client's pieces, plan and messages.
+
+  - `@working-theory/database` — `Piece` and `Interaction` on Person (a composite `(person_id, workspace_id)` foreign key to `people`) and `WorkspacePieceStages`, a workspace's declared piece stages; migration `20261011120000_member_area`.
+  - `@working-theory/ids` — the `piece_`, `intx_` and `pstages_` prefixes; `zPieceId` and `zInteractionId`.
+  - `@working-theory/validation` — the member-area wire schemas (`pieces.ts`, `member.ts`), the Person timeline's `message` kind, the `people-write` permission (owner, admin; not agent-grantable) and the attachment helpers (`ATTACHABLE_CONTENT_TYPES`, `attachmentFilename`).
+  - `@working-theory/api-client` — `member.pieces`, `member.messages` and `member.messageFile` (with `getRaw`), the reads a spoke's server makes for its signed-in client. A spoke that re-serves a file sends its five response headers unchanged.
+  - `create-ailk` — the member-area files are co-owned by the `workspace` and `multi-tenant` slices.
+
+- [#8049](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8049) [`6a2a120`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6a2a120765c423303716d5e3ebf216c9c10e118b) Thanks [@samuelhenry](https://github.com/samuelhenry)! - An agent key may be granted `member-pieces-manage` ([#7878](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/7878)).
+
+  `@working-theory/validation`: the `member-pieces-manage` permission (owner, admin), the seventh entry of `AGENT_GRANTABLE_PERMISSIONS`. The member area's operator writes — a client's pieces, plan and outbound messages — check it through `allows`, so an agent granted it keeps them in its one workspace; `people-write` stays never-grantable. `@working-theory/database`: the `agents_grants_allowed` CHECK widened to admit it (additive).
+
+- [#8004](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8004) [`d9ba65f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d9ba65f6334681b17bd77b64bb7ca9e069b1980f) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Person — the per-workspace client record ([#852](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/852)).
+
+  `@working-theory/database`: a `Person` model (one client per normalized email per workspace), `personId` on `Lead` and `Appointment`, the schema and set-based backfill migrations, the post-cutover re-run script `scripts/person-backfill.sql`, the agent-grant CHECK widened to admit `people-read`, and the timeline's email-fallback SQL constants on the `tenancy` subpath. `@working-theory/ids`: the `person_` prefix and `zPersonId`. `@working-theory/validation`: the `people-read` permission (owner, admin; agent-grantable) and the People wire schemas. `@working-theory/api-client`: `people.list` and `people.get` for an agent key granted `people-read`.
+
+### Patch Changes
+
+- Updated dependencies [[`89eba8c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/89eba8c2bab16766a68284f52c872aae86f59fde), [`6a2a120`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6a2a120765c423303716d5e3ebf216c9c10e118b), [`6d38b1a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6d38b1a5362b36e56d6bce79fdf96c878020cb18), [`d9ba65f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d9ba65f6334681b17bd77b64bb7ca9e069b1980f)]:
+  - @working-theory/validation@0.38.0
+  - @working-theory/ids@0.11.0
+
 ## 0.37.0
 
 ### Minor Changes

package/templates/database/__tests__/agents.db.test.ts

@@ -18,11 +18,12 @@
  *   4. Deleting the membership of the person last shown the key sets
  *      `key_issued_to_membership_id` null and keeps the agent.
  *   5. Deleting the creator's user row leaves the agent (no relation).
- *   6. `grants` (#7864 D2, AC-2) defaults to empty, takes any of the five
- *      grantable permissions, and the `agents_grants_allowed` CHECK refuses
- *      anything else.
+ *   6. `grants` (#7864 D2, AC-2) defaults to empty, takes any of the seven
+ *      grantable permissions (`people-read` since #852 D9,
+ *      `member-pieces-manage` since #7878), and the `agents_grants_allowed`
+ *      CHECK refuses anything else.
  *
- * One case needs no database and always runs: the migration's CHECK names
+ * One case needs no database and always runs: the latest migration's CHECK names
  * exactly `@working-theory/validation`'s `AGENT_GRANTABLE_PERMISSIONS`, so the
  * SQL and the TypeScript spelling of the list cannot drift (SEC-7864-G).
  */
@@ -34,11 +35,12 @@ import { Client } from "pg";
 
 const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
 
+// #7878 — the CHECK as it stands now: the latest migration that re-adds it.
 const GRANTS_MIGRATION = join(
   __dirname,
   "..",
   "migrations",
-  "20261009120000_agent_grants",
+  "20261011130000_agent_grants_member_pieces_manage",
   "migration.sql",
 );
 
@@ -225,6 +227,24 @@ describeDb("the agents table (#3591, live DB)", () => {
       expect(await grantsOf(id)).toEqual(["content-edit", "magnets-manage"]);
     });
 
+    it("takes people-read (#852 D9)", async () => {
+      const id = await insertAgent();
+      await db.query(
+        `UPDATE "agents" SET "grants" = ARRAY['people-read']::TEXT[] WHERE "id" = $1`,
+        [id],
+      );
+      expect(await grantsOf(id)).toEqual(["people-read"]);
+    });
+
+    it("takes member-pieces-manage (#7878)", async () => {
+      const id = await insertAgent();
+      await db.query(
+        `UPDATE "agents" SET "grants" = ARRAY['member-pieces-manage','people-read']::TEXT[] WHERE "id" = $1`,
+        [id],
+      );
+      expect(await grantsOf(id)).toEqual(["member-pieces-manage", "people-read"]);
+    });
+
     it("refuses any other permission", async () => {
       const id = await insertAgent();
       await expect(