create-ailk 0.18.0 → 0.19.0

package/templates/apps/web/lib/topology.generated.ts

@@ -7,6 +7,8 @@
 // `--hub-sign-in` (#7894) it reads the sealed hub-session cookie.
 // UNSERVED_MCP_TOOLS names the MCP tools /.well-known/mcp.json leaves out
 // on this topology (#8070).
+// loadSpokeBilling reaches the spoke billing action only on a spoke that
+// signs in through its hub and carries commerce (#8217); elsewhere, null.
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
 export const UNSERVED_MCP_TOOLS: readonly string[] = [];
@@ -34,3 +36,25 @@ export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();
 }
+
+export type SpokeCard = { brand: string; last4: string; expMonth: number; expYear: number };
+
+export type SpokeBillingRead =
+  | {
+      kind: "subscription";
+      status: "trialing" | "active" | "past_due" | "canceled";
+      planName: string | null;
+      paymentMethod: SpokeCard | null;
+      unreadable: boolean;
+    }
+  | { kind: "none"; unreadable: boolean }
+  | { kind: "failed" };
+
+export type SpokeBilling = {
+  read(): Promise<SpokeBillingRead>;
+  portalUrl(): Promise<string | null>;
+};
+
+export function loadSpokeBilling(): Promise<SpokeBilling | null> {
+  return Promise.resolve(null);
+}

package/templates/apps/web/messages/en.json

@@ -70,7 +70,7 @@
   },
   "home": {
     "heading": "My Site",
-    "emptyState": "AX-first OSS template for shipping software with API + MCP as canonical surfaces."
+    "emptyState": "Home page content coming soon."
   },
   "about": {
     "heading": "About",
@@ -573,6 +573,57 @@
   "account": {
     "title": "Your account",
     "description": "What changed, what's coming, and what needs you.",
+    "artifacts": {
+      "title": "Artifacts",
+      "lead": "Work delivered to you, newest first.",
+      "all": "All artifacts",
+      "facets": "Filter artifacts",
+      "reviewGroup": "Review",
+      "filter": "Show",
+      "empty": "Nothing has been delivered to you yet.",
+      "facetEmpty": "No artifacts here.",
+      "error": "We couldn't load your artifacts.",
+      "itemError": "We couldn't load this artifact.",
+      "retry": "Retry",
+      "back": "Artifacts",
+      "caption": "Artifact",
+      "versions": "Versions",
+      "version": "Version {version}",
+      "deliveredOn": "Delivered {date}",
+      "approvedOn": "Approved {date}",
+      "download": "Download {filename}",
+      "view": "View",
+      "columns": {
+        "title": "Title",
+        "latest": "Latest",
+        "delivered": "Delivered",
+        "review": "Review"
+      },
+      "states": {
+        "approved": "Approved",
+        "changesRequested": "Changes requested",
+        "ready": "Ready for review"
+      },
+      "reviewApproved": "You approved this version on {date}.",
+      "reviewChangesRequested": "You requested changes on {date}.",
+      "review": {
+        "heading": "Review version {version}",
+        "comment": "Comment",
+        "commentHint": "Needed to request changes.",
+        "approve": "Approve",
+        "requestChanges": "Request changes",
+        "submitting": "Sending…",
+        "sent": "Thanks — your review was sent.",
+        "waiting": "You requested changes. The next version will appear here.",
+        "errors": {
+          "commentRequired": "Add a comment to request changes.",
+          "closed": "This version can't be reviewed now. It may already be approved.",
+          "notLatest": "A newer version has arrived. Reload the page to review it.",
+          "rateLimited": "Too many requests. Try again later.",
+          "failed": "We couldn't send your review. Try again."
+        }
+      }
+    },
     "frame": {
       "home": "Home",
       "inbox": "Inbox",
@@ -590,7 +641,9 @@
       "collapseAside": "Collapse panel",
       "expandAside": "Expand panel",
       "openAside": "Open For you",
-      "closeAside": "Close For you"
+      "closeAside": "Close For you",
+      "library": "Library",
+      "artifacts": "Artifacts"
     },
     "forYou": {
       "title": "For you",
@@ -617,10 +670,9 @@
       "title": "Inbox",
       "lead": "What changed, and what's coming.",
       "tabs": {
-        "recents": "Recents",
-        "suggested": "Suggested",
-        "scheduled": "Scheduled",
-        "all": "All"
+        "all": "All",
+        "purchases": "Purchases",
+        "scheduled": "Scheduled"
       },
       "empty": "Nothing here yet.",
       "error": "We couldn't load everything in your Inbox.",
@@ -642,60 +694,73 @@
     },
     "settings": {
       "title": "Settings",
-      "lead": "Your profile, sign-in, notifications and privacy.",
+      "back": "Back",
+      "account": "Account",
       "general": {
         "title": "General",
-        "lead": "Your name, email and appearance.",
+        "lead": "Your profile and appearance.",
         "colorMode": "Color mode",
         "light": "Light",
         "auto": "Auto",
         "dark": "Dark",
         "name": "Name",
-        "namePlaceholder": "Your name",
+        "photo": "Photo",
+        "photoPlaceholder": "https://",
+        "photoHint": "A link to a square image, starting with https://. Leave it empty to show your initials.",
         "email": "Email",
         "save": "Save changes",
         "saving": "Saving…",
         "saved": "Saved.",
-        "unsaved": "Unsaved changes",
-        "clean": "No unsaved changes",
         "nameRequired": "Enter your name.",
-        "saveError": "We couldn't save your name. Try again.",
-        "manageOnHub": "Manage your account on our main site"
+        "saveError": "We couldn't save your changes. Try again.",
+        "photoInvalid": "Enter a link that starts with https://.",
+        "unverified": "Confirm your email address first, then try again.",
+        "unavailable": "Profile changes aren't available on this site yet."
       },
       "security": {
-        "title": "Security",
-        "lead": "The ways you can sign in to this site.",
-        "methods": "Sign-in methods",
-        "google": "Google",
-        "github": "GitHub",
-        "magicLink": "Email sign-in link",
-        "password": "Password",
-        "available": "Available",
-        "none": "No sign-in method is configured.",
-        "viaHub": "You sign in through our main site. Your sign-in methods are managed there."
+        "title": "Security"
       },
       "notifications": {
-        "title": "Notifications",
-        "lead": "How this site contacts you.",
-        "placeholder": "Notification preferences are coming. Until then, we email you only about your account and your requests."
+        "title": "Notifications"
+      },
+      "signIn": {
+        "lead": "How you sign in to this site.",
+        "methods": {
+          "google": "Google",
+          "github": "GitHub",
+          "magicLink": "Email sign-in link",
+          "password": "Password"
+        },
+        "available": "Available",
+        "none": "No sign-in method is configured.",
+        "viaHub": "You sign in through {hub}.",
+        "viaHubUnnamed": "You sign in through our main site."
       },
       "privacy": {
-        "title": "Privacy",
         "lead": "Cookies and your data.",
         "cookies": "Cookie settings",
         "deletion": "Request account deletion",
         "deletionLead": "Ask the site owner to delete your account and its data. We'll confirm by email.",
-        "deletionSent": "Your deletion request is on its way. We'll confirm by email.",
+        "deletionSentSite": "Sent to the site operator. They'll confirm by email.",
+        "deletionSentHub": "Sent to the hub operator. They'll confirm by email.",
+        "deletionUnverified": "Confirm your email address first, then ask again.",
+        "deletionUnavailable": "This site can't take deletion requests right now.",
         "deletionError": "We couldn't send your request. Try again in a moment.",
-        "deletionSubject": "Account deletion request",
-        "deletionMessage": "Please delete my account and its data."
+        "deletionViaSupport": "To ask for your account to be deleted, contact support.",
+        "deletionSupportLink": "Contact support"
       },
       "billing": {
         "title": "Billing",
-        "lead": "Your subscription.",
-        "status": "Status",
-        "accessRevokesAt": "Access ends",
-        "manage": "Manage billing",
+        "lead": "Your plan and payment method.",
+        "currentPlan": "Current plan",
+        "unnamedPlan": "Your subscription",
+        "accessEnds": "Access ends {date}",
+        "card": "{brand} ending in {last4}, expires {month}/{year}",
+        "noCard": "No card on file",
+        "manage": "Manage in Stripe",
+        "none": "You don't have a subscription.",
+        "unavailable": "We couldn't load your billing details.",
+        "unreadable": "Some of your billing is with another Stripe account, so it isn't shown here.",
         "statuses": {
           "trialing": "Trial",
           "active": "Active",
@@ -731,7 +796,19 @@
       "offer": "Offer",
       "amount": "Amount",
       "period": "Period",
-      "date": "Date"
+      "date": "Date",
+      "unavailable": "Not recorded"
+    },
+    "appointments": {
+      "heading": "My appointments",
+      "untitled": "Appointment",
+      "starts": "Starts",
+      "ends": "Ends",
+      "statuses": {
+        "pending": "Pending",
+        "confirmed": "Confirmed",
+        "cancelled": "Cancelled"
+      }
     },
     "pieces": {
       "heading": "My pieces",
@@ -750,6 +827,50 @@
     "subscription": {
       "headline": "Your payment didn't go through",
       "action": "Update payment method"
+    },
+    "new": {
+      "trigger": "New",
+      "close": "Close",
+      "loading": "Loading…",
+      "loadFailed": "This could not load.",
+      "retry": "Try again",
+      "submitting": "Sending…",
+      "optional": "Optional",
+      "actions": {
+        "scheduleService": "Schedule service",
+        "requestQuote": "Request quote",
+        "sendMessage": "Send message"
+      },
+      "schedule": {
+        "service": "Service",
+        "duration": "{minutes} min",
+        "time": "Time",
+        "notes": "Notes",
+        "submit": "Book",
+        "none": "No times are offered right now. You can send a message instead.",
+        "suggest": "Send a message",
+        "noSlots": "No open times in the next 14 days."
+      },
+      "quote": {
+        "submit": "Send request"
+      },
+      "message": {
+        "subject": "Subject",
+        "body": "Message",
+        "link": "Link",
+        "linkHelp": "Must start with https://.",
+        "submit": "Send"
+      },
+      "errors": {
+        "linkNotHttps": "A link must start with https://.",
+        "answersInvalid": "Some answers do not fit this form. Check them and try again.",
+        "requestFormOff": "Requests are switched off right now.",
+        "meetingTypeNotOffered": "This service is no longer offered.",
+        "slotUnavailable": "That time was just taken. Pick another.",
+        "tooManyRequests": "Too many requests. Try again later.",
+        "invalidInput": "Check what you entered and try again.",
+        "failed": "This could not be sent. Try again."
+      }
     }
   },
   "admin": {

package/templates/database/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @working-theory/database
 
+## 0.39.0
+
+### Minor Changes
+
+- [#8177](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8177) [`6fa07d3`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fa07d36321033e1661de34eaee8427eb7e1a6ca) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The member area data model ([#8168](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8168)): the schema and wire contract the member reads, member writes and provider routes build on. No route changes.
+
+  - `@working-theory/database` — `PieceVersion` (`piece_versions`): one delivery of a piece to its client, a private file or an https link, numbered per piece, with the client's review on it; held to its shape by CHECKs and by one composite foreign key onto `pieces(id, person_id, workspace_id)`. `Piece.approvedAt`. `Interaction.kind` (`message` · `quote` · `review`) and `payload`, and `inbound` beside `outbound`; an outbound row stays a payload-free `message`. `FlowDefinition.customersEnabled`. Migration `20261012120000_member_contract` backfills a draft `request-quote` contact magnet into every workspace, never overwriting an existing one, and `db:seed` gives the default workspace the same magnet.
+  - `@working-theory/validation` — the Phase 1 member contract in `member.ts`: reads, writes, write responses, the stored payloads, the vocabularies and `memberErrorCodeSchema`, and `isHttpsLink`. `requestQuoteFlowConfig`, `REQUEST_QUOTE_FLOW_SLUG`, `REQUEST_QUOTE_FLOW_TITLE`, `flowCustomersEnabledSchema` and `FLOW_CUSTOMERS_ENABLED_DEFAULT` in `flow.ts`. `plainText` is exported. `subscriptionMeResponseSchema` gains optional `planName` and `paymentMethod`; today's body still parses.
+  - `@working-theory/site-config` — `MeetingsSchema` gains optional `customerSlugs` (no default, duplicates refused).
+  - `@working-theory/ids` — the `pver_` prefix (`pieceVersion`).
+
+- [#8235](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8235) [`2f8a0fe`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2f8a0fed78739b758f9db44caecbb297e009d841) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `Lead.spokeCheckout` ([#8185](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8185)): a `leads.spoke_checkout BOOLEAN NOT NULL DEFAULT false` column, migration `20261013120000_lead_spoke_checkout`. The hub sets it at creation for a spoke's live paid checkout lead (a registered spoke's key, not relayed, a `cs_live_` Idempotency-Key and the checkout shape) and never updates it. Existing rows read false; there is no backfill. Apply the migration before deploying the API that writes it.
+
+### Patch Changes
+
+- [#8321](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8321) [`f17db78`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f17db78cc14671473c976d4098b1bdc001f517be) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Licence metadata only: `LICENSE` is now the canonical, unmodified Apache-2.0 text, and the package ships a `NOTICE` file carrying the copyright notice (`Copyright 2026 SalesSmyth LLC`). The previous `LICENSE` appendix named a stale holder. No behavior change.
+
+- Updated dependencies [[`6fb73eb`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fb73eb106836a6d201111f460de0811711a1f39), [`6fa07d3`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fa07d36321033e1661de34eaee8427eb7e1a6ca), [`55567c6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/55567c678b2338523959569457499531c6aac374), [`f17db78`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f17db78cc14671473c976d4098b1bdc001f517be), [`caeffba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/caeffba335a8c8f232cedc901babfb6674e319f5)]:
+  - @working-theory/validation@0.39.0
+  - @working-theory/ids@0.12.0
+
 ## 0.38.0
 
 ### Minor Changes

package/templates/database/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/templates/database/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/templates/database/README.md

@@ -69,7 +69,7 @@ model RefreshToken {
 
 ```bash
 # Mobile app authenticates with token
-curl -H "Authorization: Bearer tok_abc123..." \
+curl -H "Authorization: Bearer <access-token>" \
   https://api.customer-site.com/api/user/profile
 
 # Refresh expired access token

package/templates/database/__tests__/member-area.db.test.ts

@@ -61,14 +61,26 @@ const describeMonorepo = existsSync(join(REPO_ROOT, "packages", "validation"))
   : describe.skip;
 
 describeMonorepo("the member-area wire contract (#7877 AC-1, no database)", () => {
-  it("packages/validation's pieces and member schemas name no stage literal and no enum", () => {
+  it("packages/validation's pieces and member schemas name no stage literal and no stage enum", () => {
+    // #8168 narrowed this match to its intent: a stage LITERAL is a quoted
+    // stage name. member.ts now legitimately carries `deliveredAt`, the
+    // `changes-requested` review value and non-stage vocabularies
+    // (`z.enum(["message", "quote", "review"])`, D11) — none of them a stage.
+    // A stage enum would have to quote a stage name, so the quoted match
+    // still catches one; pieces.ts, where stages and offerings live, keeps
+    // the blanket no-`z.enum` rule.
     for (const file of ["pieces.ts", "member.ts"]) {
       const text = readFileSync(
         join(REPO_ROOT, "packages", "validation", "src", "schemas", file),
         "utf8",
       );
-      expect(text).not.toMatch(/requested|in-progress|in-review|delivered|scoping|z\.enum/);
+      expect(text).not.toMatch(/["'`](requested|in-progress|in-review|delivered|scoping)["'`]/);
     }
+    const pieces = readFileSync(
+      join(REPO_ROOT, "packages", "validation", "src", "schemas", "pieces.ts"),
+      "utf8",
+    );
+    expect(pieces).not.toMatch(/z\.enum/);
   });
 
   it("the product default stage list is named by no package", () => {
@@ -197,7 +209,7 @@ describeDb("the member-area tables (#7877 D1–D3, AC-1, live DB)", () => {
 
   it.each([
     ["channel `email`", { channel: "email" }, "interactions_channel_allowed"],
-    ["direction `inbound`", { direction: "inbound" }, "interactions_direction_allowed"],
+    ["direction `sideways`", { direction: "sideways" }, "interactions_direction_allowed"],
     ["a lead_ asset id", { asset_id: LEAD_ID }, "interactions_asset_id_format"],
     ["an empty subject", { subject: "" }, "interactions_subject_length"],
     ["a 10001-character body", { body: "b".repeat(10001) }, "interactions_body_length"],

package/templates/database/__tests__/member-contract-migration.test.ts

@@ -0,0 +1,85 @@
+/**
+ * @file member-contract-migration.test.ts
+ *
+ * DB-free: the `request-quote` backfill in
+ * migrations/20261012120000_member_contract writes its config as a JSONB
+ * literal, because SQL cannot import TS. This test holds that copy to the one
+ * TS source, `requestQuoteFlowConfig` (#8168 spec D8, D9; AC-6), and the
+ * block's slug and title literals to their constants — so the two can never
+ * drift. `member-contract.db.test.ts` re-executes the same block live.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  flowConfigSchema,
+  REQUEST_QUOTE_FLOW_SLUG,
+  REQUEST_QUOTE_FLOW_TITLE,
+  requestQuoteFlowConfig,
+} from "@working-theory/validation";
+
+const MIGRATION_SQL = readFileSync(
+  join(
+    __dirname,
+    "..",
+    "migrations",
+    "20261012120000_member_contract",
+    "migration.sql",
+  ),
+  "utf8",
+);
+
+/** The text between the `-- BEGIN request-quote backfill` / `-- END …` markers. */
+function backfillBlock(sql: string): string {
+  const match =
+    /-- BEGIN request-quote backfill\n([\s\S]*?)-- END request-quote backfill/.exec(
+      sql,
+    );
+  if (!match?.[1]) throw new Error("request-quote backfill markers not found");
+  return match[1];
+}
+
+describe("the request-quote backfill literal (#8168 D9, AC-6)", () => {
+  const block = backfillBlock(MIGRATION_SQL);
+
+  it("carries exactly one JSONB config literal, and it deep-equals requestQuoteFlowConfig", () => {
+    const literals = [...block.matchAll(/'(\{[\s\S]*?\})'::jsonb/g)];
+    expect(literals).toHaveLength(1);
+    const parsed: unknown = JSON.parse(literals[0]![1]!);
+    expect(parsed).toEqual(requestQuoteFlowConfig);
+    expect(flowConfigSchema.safeParse(parsed).success).toBe(true);
+  });
+
+  it("writes the constants' slug and title, kind contact, status draft, customers_enabled true", () => {
+    expect(block).toContain(
+      `SELECT w."id", w."id", '${REQUEST_QUOTE_FLOW_SLUG}',`,
+    );
+    expect(block).toContain(
+      `'contact', '${REQUEST_QUOTE_FLOW_TITLE}', 'draft', true, CURRENT_TIMESTAMP`,
+    );
+    expect(block).toContain(
+      `("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "updated_at")`,
+    );
+  });
+
+  it("never overwrites a workspace's existing (site_id, slug) row", () => {
+    expect(block).toContain(`ON CONFLICT ("site_id", "slug") DO NOTHING;`);
+    expect(block).not.toMatch(/DO UPDATE/i);
+  });
+});
+
+describe("no round count, limit or remaining count in the migration (#8168 AC-7)", () => {
+  it("names no such column in piece_versions or in the pieces ADD COLUMN", () => {
+    const createTable = /CREATE TABLE "piece_versions" \(([\s\S]*?)\n\);/.exec(
+      MIGRATION_SQL,
+    )?.[1];
+    const addPieceColumn = /ALTER TABLE "pieces" ADD COLUMN[^;]*;/.exec(
+      MIGRATION_SQL,
+    )?.[0];
+    expect(createTable).toContain('"review_comment"');
+    expect(addPieceColumn).toContain('"approved_at"');
+    for (const ddl of [createTable ?? "", addPieceColumn ?? ""]) {
+      expect(ddl).not.toMatch(/round|remaining|limit|left/i);
+    }
+  });
+});