create-ailk 0.19.0 → 0.20.0

package/templates/apps/web/lib/topology.generated.ts

@@ -9,6 +9,8 @@
 // on this topology (#8070).
 // loadSpokeBilling reaches the spoke billing action only on a spoke that
 // signs in through its hub and carries commerce (#8217); elsewhere, null.
+// readOwnAccounts lists the signed-in person's own sign-in accounts through
+// Better Auth on a hub (#8431); a spoke has none here, so it answers null.
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
 export const UNSERVED_MCP_TOOLS: readonly string[] = [];
@@ -32,6 +34,13 @@ export async function readSession(headers: Headers): Promise<SiteSession> {
   return auth.api.getSession({ headers });
 }
 
+export async function readOwnAccounts(
+  headers: Headers,
+): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  const { auth } = await import("../auth");
+  return auth.api.listUserAccounts({ headers });
+}
+
 export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();

package/templates/apps/web/messages/en.json

@@ -57,7 +57,6 @@
   },
   "consent": {
     "title": "Cookie Preferences",
-    "body": "We use analytics to understand how visitors use this site. We don't sell your data.",
     "acceptLabel": "Accept",
     "rejectLabel": "Reject",
     "policyLinkLabel": "Privacy policy",
@@ -535,6 +534,7 @@
     "signUpSubmit": "Create account",
     "signUpFooterPrompt": "Already have an account?",
     "signUpFooterLink": "Sign in",
+    "signUpAgreementsLegend": "Agreements",
     "signUpNotConfiguredSubhead": "Sign-up is not configured for this site yet. Set a provider's environment variables to enable it.",
     "signUpFailed": "We couldn't create your account. Check your details and try again.",
     "providerFailed": "We couldn't start sign-up with that provider. Try again.",
@@ -622,6 +622,17 @@
           "rateLimited": "Too many requests. Try again later.",
           "failed": "We couldn't send your review. Try again."
         }
+      },
+      "proposal": {
+        "caption": "Proposal",
+        "price": "Price {amount}",
+        "approve": "Approve proposal",
+        "heading": "Your decision on version {version}",
+        "pay": "Pay now",
+        "paying": "Opening payment…",
+        "paid": "Paid {date}",
+        "paidPending": "Payment received — it may take a minute to show here.",
+        "payError": "We couldn't open the payment page. Try again."
       }
     },
     "frame": {
@@ -630,6 +641,7 @@
       "forYou": "For you",
       "settings": "Settings",
       "signOut": "Log out",
+      "signOutFailed": "We couldn't log you out. You're still signed in; try again.",
       "help": "Help",
       "contactSupport": "Contact support",
       "helpCenter": "Help center",
@@ -715,30 +727,87 @@
         "saveError": "We couldn't save your changes. Try again.",
         "photoInvalid": "Enter a link that starts with https://.",
         "unverified": "Confirm your email address first, then try again.",
-        "unavailable": "Profile changes aren't available on this site yet."
+        "unavailable": "Profile changes aren't available on this site yet.",
+        "contact": {
+          "title": "Contact details",
+          "lead": "Kept on this site, for the people you work with here.",
+          "givenName": "First name",
+          "familyName": "Last name",
+          "telephone": "Phone",
+          "address": "Address",
+          "companyName": "Company",
+          "jobTitle": "Job title",
+          "save": "Save contact details",
+          "saving": "Saving…",
+          "saved": "Saved.",
+          "addressIncomplete": "Fill in the address line, city, state or region, postal code and country, or clear the whole address.",
+          "unavailable": "Contact details aren't available on this site right now.",
+          "errors": {
+            "telephone": "Enter the phone number with its country code.",
+            "invalid": "Some of these details couldn't be saved. Check them and try again.",
+            "unverified": "Confirm your email address first, then try again.",
+            "unavailable": "Contact details can't be saved on this site yet.",
+            "failed": "We couldn't save your contact details. Try again."
+          }
+        }
       },
       "security": {
-        "title": "Security"
-      },
-      "notifications": {
-        "title": "Notifications"
-      },
-      "signIn": {
-        "lead": "How you sign in to this site.",
+        "title": "Security",
+        "methodsHeading": "Sign-in methods",
+        "passwordLabel": "Password",
+        "passwordSet": "Set",
+        "passwordNotSet": "Not set",
+        "setHint": "Add a password so you can also sign in with your email and password.",
+        "changeHint": "Change the password you sign in with.",
+        "setNote": "We'll email {email} a secure link to create your password.",
+        "changeNote": "We'll email {email} a secure link to change your password.",
+        "setButton": "Set password",
+        "changeButton": "Change password",
+        "sending": "Sending…",
+        "sent": "Link sent. It works once, for an hour. Saving a password signs you out everywhere.",
+        "sendFailed": "We couldn't send the email. Try again in a few minutes.",
+        "logOut": "Log out",
+        "logOutFailed": "Log out didn't finish. Try again.",
+        "signsInWith": "You sign in with {methods}.",
+        "signedInAs": "You're signed in as {email}.",
         "methods": {
           "google": "Google",
           "github": "GitHub",
-          "magicLink": "Email sign-in link",
-          "password": "Password"
+          "magicLink": "a link sent to {email}",
+          "password": "your email and password"
         },
-        "available": "Available",
-        "none": "No sign-in method is configured.",
-        "viaHub": "You sign in through {hub}.",
-        "viaHubUnnamed": "You sign in through our main site."
+        "managedAt": "Your sign-in is managed at {hub}.",
+        "managedUnnamed": "Your sign-in is managed by our main site.",
+        "manageOnHub": "Manage sign-in on {hub}",
+        "passwordUnavailable": "We couldn't check your password settings."
+      },
+      "notifications": {
+        "title": "Notifications",
+        "lead": "What we send you.",
+        "empty": "There's nothing to set here yet."
+      },
+      "signIn": {
+        "lead": "How you sign in to this site."
       },
       "privacy": {
+        "title": "Privacy",
         "lead": "Cookies and your data.",
-        "cookies": "Cookie settings",
+        "summary": "How we use your data.",
+        "policyLink": "Read our privacy policy",
+        "cookiesTitle": "Cookies",
+        "cookiesAccepted": "Accepted",
+        "cookiesDeclined": "Declined",
+        "cookiesUnset": "Not chosen yet",
+        "cookiesChange": "Change",
+        "consentsTitle": "Data use",
+        "consentsEmpty": "This site asks for no other data-use consents.",
+        "agreementsTitle": "Agreements accepted",
+        "agreementsEmpty": "None yet",
+        "version": "Version {version}",
+        "given": "Given {date}",
+        "withdrawn": "Withdrawn {date}",
+        "accepted": "Accepted {date}",
+        "unavailable": "Your consent choices can't be shown right now.",
         "deletion": "Request account deletion",
         "deletionLead": "Ask the site owner to delete your account and its data. We'll confirm by email.",
         "deletionSentSite": "Sent to the site operator. They'll confirm by email.",
@@ -757,7 +826,7 @@
         "accessEnds": "Access ends {date}",
         "card": "{brand} ending in {last4}, expires {month}/{year}",
         "noCard": "No card on file",
-        "manage": "Manage in Stripe",
+        "manage": "Manage billing",
         "none": "You don't have a subscription.",
         "unavailable": "We couldn't load your billing details.",
         "unreadable": "Some of your billing is with another Stripe account, so it isn't shown here.",
@@ -769,6 +838,12 @@
         }
       }
     },
+    "agreements": {
+      "titleNew": "Please accept our terms",
+      "titleUpdated": "We've updated our terms",
+      "accept": "Accept",
+      "error": "We couldn't save that. Try again."
+    },
     "gate": {
       "emptyHeadline": "Sign-in isn't available yet",
       "emptyDescription": "This site hasn't turned on sign-in for members yet. Check back soon, or contact the site owner.",
@@ -822,7 +897,26 @@
       "heading": "My messages",
       "sentAt": "Sent",
       "file": "File",
-      "download": "Download {filename}"
+      "download": "Download {filename}",
+      "openOnboarding": "Open onboarding"
+    },
+    "onboarding": {
+      "title": "Onboarding",
+      "unavailable": "Onboarding isn't open to you here right now.",
+      "back": "Back to your account",
+      "optional": "Optional",
+      "submit": "Send answers",
+      "submitting": "Sending…",
+      "sent": "Thank you — your answers were sent.",
+      "retry": "Retry",
+      "errors": {
+        "load": "We couldn't load your onboarding questions.",
+        "onboardingOff": "Onboarding isn't open to you here right now.",
+        "answersInvalid": "Some answers do not fit these questions. Check them and try again.",
+        "linkNotHttps": "A link must start with https://.",
+        "tooManyRequests": "Too many submissions. Try again later.",
+        "failed": "Your answers could not be sent. Try again."
+      }
     },
     "subscription": {
       "headline": "Your payment didn't go through",
@@ -1039,5 +1133,14 @@
     "sending": "Subscribing…",
     "success": "You're subscribed. Thanks for signing up!",
     "consentStatement": "I accept the [Terms](terms)."
+  },
+  "unsubscribe": {
+    "title": "Unsubscribe",
+    "lead": "Stop these emails?",
+    "button": "Unsubscribe",
+    "done": "You're unsubscribed from {description}.",
+    "already": "You were already unsubscribed.",
+    "invalid": "This link isn't valid.",
+    "unavailable": "Unsubscribing isn't available right now."
   }
 }

package/templates/apps/web/next.config.mjs

@@ -5,6 +5,7 @@ import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
 import { legacyRedirects } from "@working-theory/templates/routes";
+import { parseStealth } from "@working-theory/web-i18n/stealth";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -16,11 +17,16 @@ const withBundleAnalyzer = bundleAnalyzer({
   analyzerMode: "json",
 });
 
-// When STEALTH=true, every response carries X-Robots-Tag: noindex, nofollow,
+// When STEALTH is on, every response carries X-Robots-Tag: noindex, nofollow,
 // noarchive — paired with the <meta robots> tag in app/layout.tsx. Layer 2 of
 // the three-layer stealth posture (#884); new AILK installs default to
 // STEALTH=true so a forked instance doesn't ship indexable by accident.
-const STEALTH = process.env.STEALTH === "true";
+// parseStealth is the one shared parse (#8511): true, 1, yes or on turn it on;
+// false, 0, no, off, empty or unset leave it off; any other value throws here,
+// so `next build` (and a non-standalone `next start`) fails before a page
+// renders. A standalone server.js does not load this file, so there the
+// robots route and every page's <meta robots> throw per request instead.
+const STEALTH = parseStealth(process.env.STEALTH);
 
 // next-intl plugin — no explicit path: uses next-intl's default convention
 // lookup (./i18n/request.ts). We use `next build --webpack` (see package.json)

package/templates/database/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @working-theory/database
 
+## 0.41.0
+
+### Minor Changes
+
+- [#8540](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8540) [`48ff411`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48ff41198ef01163412118249f51d64b66d4ce42) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The API's per-IP rate limiter counts in a shared database table when one is configured, so one visitor's limit holds across every concurrent isolate ([#5040](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5040)).
+
+  New model `RateLimitCounter` (table `rate_limit_counters`, prefix `rlc`) in the `ops` namespace, holding one row per hashed bucket key. Run the migration before deploying the code that reads it — code deployed first falls back to the per-isolate in-process limiter, safely, until the table exists.
+
+- [#8545](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8545) [`41bc2df`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/41bc2df800c8fe69e2cbb528be68f579abfbd80d) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The Person record redesign ([#8514](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8514), docs/specs/8514-redesign-the-person-record-page-spec.md).
+
+  - **database** — `people` gains the team's private note on a client (`notes`, who last saved it, when, and which agent), with format and pairing CHECKs. The same migration then removes `people-read` and `member-pieces-manage` from agents of members, where they were inert; deploy it before the code.
+  - **validation** — members now hold `people-read`, `people-write` and `member-pieces-manage`. The new `AGENT_WITHHELD_PERMISSIONS` and `roleAllows` keep every agent off those three by role: an agent holds the grantable two only by an explicit grant, and `people-write` never. New `personNotes*` and `planOfferings*` schemas.
+  - **api-client** — `people.notes` and `people.setNotes`.
+  - **metadata** — two signed-in workspace tools, `get_person_notes` and `set_person_notes` (thirteen in all).
+  - **ui** — `PhoneNumberField` shows its country format as a "Format: …" caption under the field and no longer puts the example in the placeholder.
+  - **templates** — `ContactDetailsForm`, the one contact form the account page and the Admin share; Save stays disabled until something changes.
+
+- [#8574](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8574) [`83b7a96`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/83b7a96ccd115230f82e111a9776c8e2136b6bf9) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Standard client onboarding diagnostic and Start onboarding ([#8515](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8515), docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md).
+
+  - `@working-theory/database`: `interactions_outbound_shape` admits one outbound payload, `{"action": "onboarding"}` (migration `20261017120000_outbound_message_action`; no row is rewritten).
+  - `@working-theory/validation`: `ONBOARDING_FLOW_SLUG`, `ONBOARDING_FLOW_TITLE` and `onboardingFlowConfig`, the standard onboarding magnet every workspace holds; `OUTBOUND_MESSAGE_ACTIONS` and `onboardingStartBodySchema`; `memberMessageSchema` gains `action`; `memberOnboardingFormResponseSchema`, `memberOnboardingStepSchema`, `memberOnboardingReceiptSchema` and the `onboarding_off` member error code.
+  - `@working-theory/api-client`: `member.onboarding` and `member.submitOnboarding`.
+
+- [#8572](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8572) [`16abdb4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/16abdb45ef60cc46aba35d4179960468b8df1a8b) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Proposals as an artifact kind ([#8516](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8516), docs/specs/8516-proposals-as-an-artifact-kind-spec.md).
+
+  - `@working-theory/database`: `pieces` gains `kind` (`deliverable` by default, so every existing piece is unchanged), a proposal's optional price, the client's Checkout Session and the paid stamp, with their CHECKs and one unique index (migration `20261016120000_piece_kind`, DDL only).
+  - `@working-theory/validation`: `PIECE_KINDS`, `pieceKindSchema`, `PROPOSAL_CURRENCIES`, `proposalPriceSchema`; `pieceSchema` serves `kind`; the new `proposals.ts` wire (`proposalCreateBodySchema`, `proposalSchema`, `proposalsListResponseSchema`, `proposalResultSchema`, `proposalPaymentsSchema`); `memberArtifactSchema` gains optional `kind`, `price` and `payment`; `isStripeCheckoutUrl`, `memberProposalPaymentResponseSchema` and three member error codes.
+  - `@working-theory/api-client`: `people.proposals`, `people.createProposal` and `member.payArtifact`.
+  - `@working-theory/metadata`: the `list_proposals` and `create_proposal` workspace tools.
+  - `@working-theory/stripe-client`: `createQuotedCheckoutSession` takes optional `expiresAt` and `paymentMethodTypes`; existing callers' sessions are unchanged.
+
+### Patch Changes
+
+- [#8551](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8551) [`13e1d6f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/13e1d6f74ef3db02b9cdedb5f33f84ad1a9a0d66) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Person gains a private team note (notes, notes_updated_at, notes_updated_by, notes_updated_by_agent) and tenant-db gains its one reader and writer ([#8514](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8514), PR 1 of 2 — the fence half; the API, MCP and Admin surfaces follow in PR 2).
+
+- Updated dependencies [[`1b0d07a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/1b0d07acc0c97f519bf7a2dccf108d6b98c24065), [`48ff411`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48ff41198ef01163412118249f51d64b66d4ce42), [`98b82b0`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/98b82b0e1cf29be3ba33886ebc7b8294ebff52f0), [`41bc2df`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/41bc2df800c8fe69e2cbb528be68f579abfbd80d), [`83b7a96`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/83b7a96ccd115230f82e111a9776c8e2136b6bf9), [`16abdb4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/16abdb45ef60cc46aba35d4179960468b8df1a8b)]:
+  - @working-theory/validation@0.41.0
+  - @working-theory/ids@0.14.0
+
+## 0.40.0
+
+### Minor Changes
+
+- [#8497](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8497) [`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Contact details on the client record ([#8435](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8435), spec docs/specs/8435-contact-details-on-the-client-spec.md).
+
+  A Person now carries a given name, a family name, an E.164 telephone, a six-part address, a company name and a job title, with the two columns that say who last saved them by hand. `callbacks` and `subscribers` gain a `person_id` foreign key. A capture fills only a blank field of an uncurated Person; the operator edits the contact from the Person page and a client edits their own on the site, from the account General tab. A magnet field's `mapsTo` tag names the contact field it fills: `email`, `name`, `givenName`, `familyName`, `phone`, `address`, `company`, `jobTitle`. Additive; the migration (`20261014120000_person_contact`, its second half the idempotent backfill) deploys before the code.
+
+- [#8490](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8490) [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The consent ledger ([#8438](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8438), the API half). The per-site consent registry gains a kind (`agreement` · `consent` · `preference`), a plain description, a policy link and a policy version per purpose, and its platform default now declares `service_terms`, `account_terms` and `analytics_cookies`; a registry stored before this change still parses and means what it meant. `consent_grants` becomes the one ledger: each row names its source (`cookie_banner` · `sign_up` · `magnet` · `account_settings` · `email_unsubscribe` · `api`), its policy version and, when known, its Person, and the database refuses to change or truncate a stored row. A new `consent_visitor_links` table joins a banner visitor to the Person a later form identifies. `@working-theory/api-client` gains `consent.recordCookieChoice`, `consent.unsubscribe`, `member.consents` and `member.setConsent`; `@working-theory/validation` gains their wire schemas and the `platform-consents` permission. Run the new migration before deploying code that writes the ledger.
+
+### Patch Changes
+
+- Updated dependencies [[`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26), [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc)]:
+  - @working-theory/validation@0.40.0
+  - @working-theory/ids@0.13.0
+
 ## 0.39.0
 
 ### Minor Changes