create-ailk 0.18.0 → 0.19.1

package/templates/apps/web/lib/hub-session/reseal.ts

@@ -0,0 +1,90 @@
+/**
+ * The spoke's session re-seal (#8232, spec
+ * docs/specs/8232-member-settings-account-general-and-spec.md D11; roadmap
+ * D9).
+ *
+ * After a member saves their name through the hub (`PATCH /v1/member/profile`),
+ * the sealed session cookie still names the person as they were at sign-in.
+ * `resealHubSession()` re-reads the person from the hub's own record,
+ * `GET /v1/hub-sign-in/me`, with the session's credential, and writes the
+ * cookie again so the next render shows the new name:
+ *
+ *   - no hub-session configuration (a single site) or no session cookie ⇒
+ *     `"skipped"`, with no call;
+ *   - `/me` refusing, throwing, or answering a person of the wrong shape ⇒
+ *     `"failed"`, and the cookie is left as it is (sign-out is the sign-out
+ *     route's job — a transient hub error never signs the member out);
+ *   - otherwise only `user` changes. `v`, `accessToken` and `expiresAt` are
+ *     kept exactly and `Max-Age` is the remaining lifetime, so a re-seal
+ *     never extends a session (SEC-8232-1). The cookie's name, key and
+ *     attributes are the ones the callback route writes at sign-in
+ *     (`cookieHeader`: `HttpOnly`, `SameSite=Lax`, `Path=/`, `Secure` on an
+ *     https site — SEC-8232-2).
+ *
+ * It tests no topology: a single site has no configuration and no cookie.
+ * Nothing here logs a credential, a cookie value, a name or an email.
+ */
+
+import { hubSignIn } from "@working-theory/api-client";
+import { cookies, headers } from "next/headers";
+
+import { hubSessionConfig } from "./config";
+import { seal } from "./seal";
+import { type HubSessionUser, readHubSessionPayload, sessionCookieName } from "./session";
+
+/**
+ * The person `/me` names, when every field is the type the session holds.
+ * It repeats `session.ts`'s private shape check on purpose: `sync-routes`
+ * brings this file to a scaffold whose own `session.ts` it never updates,
+ * so it cannot rely on a new export there.
+ */
+function sessionUser(value: unknown): HubSessionUser | null {
+  if (typeof value !== "object" || value === null) return null;
+  const user = value as Record<string, unknown>;
+  const { name, email, emailVerified, createdAt } = user;
+  if (
+    typeof email !== "string" ||
+    typeof emailVerified !== "boolean" ||
+    typeof createdAt !== "string" ||
+    (name !== null && typeof name !== "string")
+  ) {
+    return null;
+  }
+  return { name, email, emailVerified, createdAt };
+}
+
+/** Re-seals the hub session cookie from the hub's `/me`. Never throws. */
+export async function resealHubSession(): Promise<"resealed" | "skipped" | "failed"> {
+  const config = hubSessionConfig();
+  if (config === null) return "skipped";
+  const payload = readHubSessionPayload(await headers());
+  if (payload === null) return "skipped";
+  const maxAge = Math.floor((payload.expiresAt - Date.now()) / 1000);
+  if (maxAge <= 0) return "skipped";
+
+  let user: HubSessionUser | null;
+  try {
+    const res = await hubSignIn.me({
+      headers: { authorization: `Bearer ${payload.accessToken}` },
+    });
+    user = res.ok ? sessionUser(res.body.user) : null;
+  } catch {
+    user = null;
+  }
+  if (user === null) return "failed";
+
+  const name = sessionCookieName(config);
+  try {
+    (await cookies()).set(name, seal({ ...payload, user }, config.sessionSecret, "session", name), {
+      httpOnly: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge,
+      secure: config.secure,
+    });
+  } catch {
+    // Outside a Server Action or route handler Next refuses a cookie write.
+    return "failed";
+  }
+  return "resealed";
+}

package/templates/apps/web/lib/hub-session/seal.ts

@@ -1,12 +1,15 @@
 /**
- * Sealed cookie values for the spoke's hub session (#7894 D7).
+ * Sealed values for the hub sign-in (#7894 D7, #8146 D3).
  *
- * AES-256-GCM with a fresh 12-byte IV per seal. The key is HKDF-SHA256 of
- * `AILK_HUB_SESSION_SECRET` with one info string per cookie purpose, so the
- * session cookie and the flow cookie never share a key, and the cookie's NAME
- * is the additional authenticated data, so a value sealed for one cookie never
- * opens as the other. The key never derives from the client secret: a leaked
- * client secret forges no spoke session.
+ * AES-256-GCM with a fresh 12-byte IV per seal. The key is HKDF-SHA256 of the
+ * caller's secret with one info string per purpose, so the three purposes
+ * never share a key, and the caller-supplied name is the additional
+ * authenticated data, so a value sealed for one name never opens as another.
+ * Two secrets feed this module: `AILK_HUB_SESSION_SECRET` for the spoke's
+ * `session` and `flow` cookies, and `BETTER_AUTH_SECRET` for the hub's
+ * `continue` ref (`app/api/auth/hub/continuation.ts`, hub and standalone
+ * sites only; the entry is unused on a spoke). The key never derives from the
+ * client secret: a leaked client secret forges no spoke session.
  *
  * Wire form: base64url(iv ‖ tag ‖ ciphertext). Anything that does not open —
  * a wrong key, a wrong name, a truncated or altered value — reads as `null`,
@@ -20,12 +23,13 @@ import {
   randomBytes,
 } from "node:crypto";
 
-/** The two things this module seals, each under its own derived key. */
-export type SealPurpose = "session" | "flow";
+/** The things this module seals, each under its own derived key. */
+export type SealPurpose = "session" | "flow" | "continue";
 
 const INFO: Record<SealPurpose, string> = {
   session: "ailk-hub-session/v1",
   flow: "ailk-hub-flow/v1",
+  continue: "ailk-hub-continue/v1",
 };
 
 const IV_BYTES = 12;

package/templates/apps/web/lib/topology.generated.ts

@@ -7,6 +7,10 @@
 // `--hub-sign-in` (#7894) it reads the sealed hub-session cookie.
 // UNSERVED_MCP_TOOLS names the MCP tools /.well-known/mcp.json leaves out
 // on this topology (#8070).
+// loadSpokeBilling reaches the spoke billing action only on a spoke that
+// signs in through its hub and carries commerce (#8217); elsewhere, null.
+// readOwnAccounts lists the signed-in person's own sign-in accounts through
+// Better Auth on a hub (#8431); a spoke has none here, so it answers null.
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
 export const UNSERVED_MCP_TOOLS: readonly string[] = [];
@@ -30,7 +34,36 @@ export async function readSession(headers: Headers): Promise<SiteSession> {
   return auth.api.getSession({ headers });
 }
 
+export async function readOwnAccounts(
+  headers: Headers,
+): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  const { auth } = await import("../auth");
+  return auth.api.listUserAccounts({ headers });
+}
+
 export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();
 }
+
+export type SpokeCard = { brand: string; last4: string; expMonth: number; expYear: number };
+
+export type SpokeBillingRead =
+  | {
+      kind: "subscription";
+      status: "trialing" | "active" | "past_due" | "canceled";
+      planName: string | null;
+      paymentMethod: SpokeCard | null;
+      unreadable: boolean;
+    }
+  | { kind: "none"; unreadable: boolean }
+  | { kind: "failed" };
+
+export type SpokeBilling = {
+  read(): Promise<SpokeBillingRead>;
+  portalUrl(): Promise<string | null>;
+};
+
+export function loadSpokeBilling(): Promise<SpokeBilling | null> {
+  return Promise.resolve(null);
+}

package/templates/apps/web/messages/en.json

@@ -70,7 +70,7 @@
   },
   "home": {
     "heading": "My Site",
-    "emptyState": "AX-first OSS template for shipping software with API + MCP as canonical surfaces."
+    "emptyState": "Home page content coming soon."
   },
   "about": {
     "heading": "About",
@@ -573,12 +573,64 @@
   "account": {
     "title": "Your account",
     "description": "What changed, what's coming, and what needs you.",
+    "artifacts": {
+      "title": "Artifacts",
+      "lead": "Work delivered to you, newest first.",
+      "all": "All artifacts",
+      "facets": "Filter artifacts",
+      "reviewGroup": "Review",
+      "filter": "Show",
+      "empty": "Nothing has been delivered to you yet.",
+      "facetEmpty": "No artifacts here.",
+      "error": "We couldn't load your artifacts.",
+      "itemError": "We couldn't load this artifact.",
+      "retry": "Retry",
+      "back": "Artifacts",
+      "caption": "Artifact",
+      "versions": "Versions",
+      "version": "Version {version}",
+      "deliveredOn": "Delivered {date}",
+      "approvedOn": "Approved {date}",
+      "download": "Download {filename}",
+      "view": "View",
+      "columns": {
+        "title": "Title",
+        "latest": "Latest",
+        "delivered": "Delivered",
+        "review": "Review"
+      },
+      "states": {
+        "approved": "Approved",
+        "changesRequested": "Changes requested",
+        "ready": "Ready for review"
+      },
+      "reviewApproved": "You approved this version on {date}.",
+      "reviewChangesRequested": "You requested changes on {date}.",
+      "review": {
+        "heading": "Review version {version}",
+        "comment": "Comment",
+        "commentHint": "Needed to request changes.",
+        "approve": "Approve",
+        "requestChanges": "Request changes",
+        "submitting": "Sending…",
+        "sent": "Thanks — your review was sent.",
+        "waiting": "You requested changes. The next version will appear here.",
+        "errors": {
+          "commentRequired": "Add a comment to request changes.",
+          "closed": "This version can't be reviewed now. It may already be approved.",
+          "notLatest": "A newer version has arrived. Reload the page to review it.",
+          "rateLimited": "Too many requests. Try again later.",
+          "failed": "We couldn't send your review. Try again."
+        }
+      }
+    },
     "frame": {
       "home": "Home",
       "inbox": "Inbox",
       "forYou": "For you",
       "settings": "Settings",
       "signOut": "Log out",
+      "signOutFailed": "We couldn't log you out. You're still signed in; try again.",
       "help": "Help",
       "contactSupport": "Contact support",
       "helpCenter": "Help center",
@@ -590,7 +642,9 @@
       "collapseAside": "Collapse panel",
       "expandAside": "Expand panel",
       "openAside": "Open For you",
-      "closeAside": "Close For you"
+      "closeAside": "Close For you",
+      "library": "Library",
+      "artifacts": "Artifacts"
     },
     "forYou": {
       "title": "For you",
@@ -617,10 +671,9 @@
       "title": "Inbox",
       "lead": "What changed, and what's coming.",
       "tabs": {
-        "recents": "Recents",
-        "suggested": "Suggested",
-        "scheduled": "Scheduled",
-        "all": "All"
+        "all": "All",
+        "purchases": "Purchases",
+        "scheduled": "Scheduled"
       },
       "empty": "Nothing here yet.",
       "error": "We couldn't load everything in your Inbox.",
@@ -642,60 +695,112 @@
     },
     "settings": {
       "title": "Settings",
-      "lead": "Your profile, sign-in, notifications and privacy.",
+      "back": "Back",
+      "account": "Account",
       "general": {
         "title": "General",
-        "lead": "Your name, email and appearance.",
+        "lead": "Your profile and appearance.",
         "colorMode": "Color mode",
         "light": "Light",
         "auto": "Auto",
         "dark": "Dark",
         "name": "Name",
-        "namePlaceholder": "Your name",
+        "photo": "Photo",
+        "photoPlaceholder": "https://",
+        "photoHint": "A link to a square image, starting with https://. Leave it empty to show your initials.",
         "email": "Email",
         "save": "Save changes",
         "saving": "Saving…",
         "saved": "Saved.",
-        "unsaved": "Unsaved changes",
-        "clean": "No unsaved changes",
         "nameRequired": "Enter your name.",
-        "saveError": "We couldn't save your name. Try again.",
-        "manageOnHub": "Manage your account on our main site"
+        "saveError": "We couldn't save your changes. Try again.",
+        "photoInvalid": "Enter a link that starts with https://.",
+        "unverified": "Confirm your email address first, then try again.",
+        "unavailable": "Profile changes aren't available on this site yet.",
+        "contact": {
+          "title": "Contact details",
+          "lead": "Kept on this site, for the people you work with here.",
+          "givenName": "First name",
+          "familyName": "Last name",
+          "telephone": "Phone",
+          "address": "Address",
+          "companyName": "Company",
+          "jobTitle": "Job title",
+          "save": "Save contact details",
+          "saving": "Saving…",
+          "saved": "Saved.",
+          "addressIncomplete": "Fill in the address line, city, state or region, postal code and country, or clear the whole address.",
+          "unavailable": "Contact details aren't available on this site right now.",
+          "errors": {
+            "telephone": "Enter the phone number with its country code.",
+            "invalid": "Some of these details couldn't be saved. Check them and try again.",
+            "unverified": "Confirm your email address first, then try again.",
+            "unavailable": "Contact details can't be saved on this site yet.",
+            "failed": "We couldn't save your contact details. Try again."
+          }
+        }
       },
       "security": {
         "title": "Security",
-        "lead": "The ways you can sign in to this site.",
-        "methods": "Sign-in methods",
-        "google": "Google",
-        "github": "GitHub",
-        "magicLink": "Email sign-in link",
-        "password": "Password",
-        "available": "Available",
-        "none": "No sign-in method is configured.",
-        "viaHub": "You sign in through our main site. Your sign-in methods are managed there."
+        "methodsHeading": "Sign-in methods",
+        "passwordLabel": "Password",
+        "passwordSet": "Set",
+        "passwordNotSet": "Not set",
+        "setHint": "Add a password so you can also sign in with your email and password.",
+        "changeHint": "Change the password you sign in with.",
+        "setNote": "We'll email {email} a secure link to create your password.",
+        "changeNote": "We'll email {email} a secure link to change your password.",
+        "setButton": "Set password",
+        "changeButton": "Change password",
+        "sending": "Sending…",
+        "sent": "Link sent. It works once, for an hour. Saving a password signs you out everywhere.",
+        "sendFailed": "We couldn't send the email. Try again in a few minutes.",
+        "logOut": "Log out",
+        "logOutFailed": "Log out didn't finish. Try again.",
+        "signsInWith": "You sign in with {methods}.",
+        "signedInAs": "You're signed in as {email}.",
+        "methods": {
+          "google": "Google",
+          "github": "GitHub",
+          "magicLink": "a link sent to {email}",
+          "password": "your email and password"
+        },
+        "managedAt": "Your sign-in is managed at {hub}.",
+        "managedUnnamed": "Your sign-in is managed by our main site.",
+        "manageOnHub": "Manage sign-in on {hub}",
+        "passwordUnavailable": "We couldn't check your password settings."
       },
       "notifications": {
-        "title": "Notifications",
-        "lead": "How this site contacts you.",
-        "placeholder": "Notification preferences are coming. Until then, we email you only about your account and your requests."
+        "title": "Notifications"
+      },
+      "signIn": {
+        "lead": "How you sign in to this site."
       },
       "privacy": {
-        "title": "Privacy",
         "lead": "Cookies and your data.",
         "cookies": "Cookie settings",
         "deletion": "Request account deletion",
         "deletionLead": "Ask the site owner to delete your account and its data. We'll confirm by email.",
-        "deletionSent": "Your deletion request is on its way. We'll confirm by email.",
+        "deletionSentSite": "Sent to the site operator. They'll confirm by email.",
+        "deletionSentHub": "Sent to the hub operator. They'll confirm by email.",
+        "deletionUnverified": "Confirm your email address first, then ask again.",
+        "deletionUnavailable": "This site can't take deletion requests right now.",
         "deletionError": "We couldn't send your request. Try again in a moment.",
-        "deletionSubject": "Account deletion request",
-        "deletionMessage": "Please delete my account and its data."
+        "deletionViaSupport": "To ask for your account to be deleted, contact support.",
+        "deletionSupportLink": "Contact support"
       },
       "billing": {
         "title": "Billing",
-        "lead": "Your subscription.",
-        "status": "Status",
-        "accessRevokesAt": "Access ends",
+        "lead": "Your plan and payment method.",
+        "currentPlan": "Current plan",
+        "unnamedPlan": "Your subscription",
+        "accessEnds": "Access ends {date}",
+        "card": "{brand} ending in {last4}, expires {month}/{year}",
+        "noCard": "No card on file",
         "manage": "Manage billing",
+        "none": "You don't have a subscription.",
+        "unavailable": "We couldn't load your billing details.",
+        "unreadable": "Some of your billing is with another Stripe account, so it isn't shown here.",
         "statuses": {
           "trialing": "Trial",
           "active": "Active",
@@ -731,7 +836,19 @@
       "offer": "Offer",
       "amount": "Amount",
       "period": "Period",
-      "date": "Date"
+      "date": "Date",
+      "unavailable": "Not recorded"
+    },
+    "appointments": {
+      "heading": "My appointments",
+      "untitled": "Appointment",
+      "starts": "Starts",
+      "ends": "Ends",
+      "statuses": {
+        "pending": "Pending",
+        "confirmed": "Confirmed",
+        "cancelled": "Cancelled"
+      }
     },
     "pieces": {
       "heading": "My pieces",
@@ -750,6 +867,50 @@
     "subscription": {
       "headline": "Your payment didn't go through",
       "action": "Update payment method"
+    },
+    "new": {
+      "trigger": "New",
+      "close": "Close",
+      "loading": "Loading…",
+      "loadFailed": "This could not load.",
+      "retry": "Try again",
+      "submitting": "Sending…",
+      "optional": "Optional",
+      "actions": {
+        "scheduleService": "Schedule service",
+        "requestQuote": "Request quote",
+        "sendMessage": "Send message"
+      },
+      "schedule": {
+        "service": "Service",
+        "duration": "{minutes} min",
+        "time": "Time",
+        "notes": "Notes",
+        "submit": "Book",
+        "none": "No times are offered right now. You can send a message instead.",
+        "suggest": "Send a message",
+        "noSlots": "No open times in the next 14 days."
+      },
+      "quote": {
+        "submit": "Send request"
+      },
+      "message": {
+        "subject": "Subject",
+        "body": "Message",
+        "link": "Link",
+        "linkHelp": "Must start with https://.",
+        "submit": "Send"
+      },
+      "errors": {
+        "linkNotHttps": "A link must start with https://.",
+        "answersInvalid": "Some answers do not fit this form. Check them and try again.",
+        "requestFormOff": "Requests are switched off right now.",
+        "meetingTypeNotOffered": "This service is no longer offered.",
+        "slotUnavailable": "That time was just taken. Pick another.",
+        "tooManyRequests": "Too many requests. Try again later.",
+        "invalidInput": "Check what you entered and try again.",
+        "failed": "This could not be sent. Try again."
+      }
     }
   },
   "admin": {

package/templates/database/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @working-theory/database
 
+## 0.40.0
+
+### Minor Changes
+
+- [#8497](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8497) [`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Contact details on the client record ([#8435](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8435), spec docs/specs/8435-contact-details-on-the-client-spec.md).
+
+  A Person now carries a given name, a family name, an E.164 telephone, a six-part address, a company name and a job title, with the two columns that say who last saved them by hand. `callbacks` and `subscribers` gain a `person_id` foreign key. A capture fills only a blank field of an uncurated Person; the operator edits the contact from the Person page and a client edits their own on the site, from the account General tab. A magnet field's `mapsTo` tag names the contact field it fills: `email`, `name`, `givenName`, `familyName`, `phone`, `address`, `company`, `jobTitle`. Additive; the migration (`20261014120000_person_contact`, its second half the idempotent backfill) deploys before the code.
+
+- [#8490](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8490) [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The consent ledger ([#8438](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8438), the API half). The per-site consent registry gains a kind (`agreement` · `consent` · `preference`), a plain description, a policy link and a policy version per purpose, and its platform default now declares `service_terms`, `account_terms` and `analytics_cookies`; a registry stored before this change still parses and means what it meant. `consent_grants` becomes the one ledger: each row names its source (`cookie_banner` · `sign_up` · `magnet` · `account_settings` · `email_unsubscribe` · `api`), its policy version and, when known, its Person, and the database refuses to change or truncate a stored row. A new `consent_visitor_links` table joins a banner visitor to the Person a later form identifies. `@working-theory/api-client` gains `consent.recordCookieChoice`, `consent.unsubscribe`, `member.consents` and `member.setConsent`; `@working-theory/validation` gains their wire schemas and the `platform-consents` permission. Run the new migration before deploying code that writes the ledger.
+
+### Patch Changes
+
+- Updated dependencies [[`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26), [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc)]:
+  - @working-theory/validation@0.40.0
+  - @working-theory/ids@0.13.0
+
+## 0.39.0
+
+### Minor Changes
+
+- [#8177](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8177) [`6fa07d3`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fa07d36321033e1661de34eaee8427eb7e1a6ca) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The member area data model ([#8168](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8168)): the schema and wire contract the member reads, member writes and provider routes build on. No route changes.
+
+  - `@working-theory/database` — `PieceVersion` (`piece_versions`): one delivery of a piece to its client, a private file or an https link, numbered per piece, with the client's review on it; held to its shape by CHECKs and by one composite foreign key onto `pieces(id, person_id, workspace_id)`. `Piece.approvedAt`. `Interaction.kind` (`message` · `quote` · `review`) and `payload`, and `inbound` beside `outbound`; an outbound row stays a payload-free `message`. `FlowDefinition.customersEnabled`. Migration `20261012120000_member_contract` backfills a draft `request-quote` contact magnet into every workspace, never overwriting an existing one, and `db:seed` gives the default workspace the same magnet.
+  - `@working-theory/validation` — the Phase 1 member contract in `member.ts`: reads, writes, write responses, the stored payloads, the vocabularies and `memberErrorCodeSchema`, and `isHttpsLink`. `requestQuoteFlowConfig`, `REQUEST_QUOTE_FLOW_SLUG`, `REQUEST_QUOTE_FLOW_TITLE`, `flowCustomersEnabledSchema` and `FLOW_CUSTOMERS_ENABLED_DEFAULT` in `flow.ts`. `plainText` is exported. `subscriptionMeResponseSchema` gains optional `planName` and `paymentMethod`; today's body still parses.
+  - `@working-theory/site-config` — `MeetingsSchema` gains optional `customerSlugs` (no default, duplicates refused).
+  - `@working-theory/ids` — the `pver_` prefix (`pieceVersion`).
+
+- [#8235](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8235) [`2f8a0fe`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/2f8a0fed78739b758f9db44caecbb297e009d841) Thanks [@samuelhenry](https://github.com/samuelhenry)! - `Lead.spokeCheckout` ([#8185](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8185)): a `leads.spoke_checkout BOOLEAN NOT NULL DEFAULT false` column, migration `20261013120000_lead_spoke_checkout`. The hub sets it at creation for a spoke's live paid checkout lead (a registered spoke's key, not relayed, a `cs_live_` Idempotency-Key and the checkout shape) and never updates it. Existing rows read false; there is no backfill. Apply the migration before deploying the API that writes it.
+
+### Patch Changes
+
+- [#8321](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8321) [`f17db78`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f17db78cc14671473c976d4098b1bdc001f517be) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Licence metadata only: `LICENSE` is now the canonical, unmodified Apache-2.0 text, and the package ships a `NOTICE` file carrying the copyright notice (`Copyright 2026 SalesSmyth LLC`). The previous `LICENSE` appendix named a stale holder. No behavior change.
+
+- Updated dependencies [[`6fb73eb`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fb73eb106836a6d201111f460de0811711a1f39), [`6fa07d3`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/6fa07d36321033e1661de34eaee8427eb7e1a6ca), [`55567c6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/55567c678b2338523959569457499531c6aac374), [`f17db78`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f17db78cc14671473c976d4098b1bdc001f517be), [`caeffba`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/caeffba335a8c8f232cedc901babfb6674e319f5)]:
+  - @working-theory/validation@0.39.0
+  - @working-theory/ids@0.12.0
+
 ## 0.38.0
 
 ### Minor Changes

package/templates/database/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/templates/database/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/templates/database/README.md

@@ -69,7 +69,7 @@ model RefreshToken {
 
 ```bash
 # Mobile app authenticates with token
-curl -H "Authorization: Bearer tok_abc123..." \
+curl -H "Authorization: Bearer <access-token>" \
   https://api.customer-site.com/api/user/profile
 
 # Refresh expired access token