create-ailk 0.19.0 → 0.20.0

package/templates/database/migrations/20261015120000_rate_limit_counters/migration.sql

@@ -0,0 +1,43 @@
+-- #5040 — the rate limiter's shared database store (spec
+-- docs/specs/5040-the-api-s-rate-limiter-spec.md D2/D3). One row per bucket
+-- key hash; the middleware's database store (`apps/api/src/lib/rate-limit-store.ts`)
+-- is the only reader or writer. Belongs to the deployment, not a tenant: no
+-- workspace_id, no tenancy fence. Rows are disposable — a lost counter only
+-- resets a window.
+--
+-- Rollback (safe while no code selects the database store, i.e. deploy this
+-- migration before the code that reads AILK_RATE_LIMIT_STORE=database or
+-- defaults to it with DATABASE_URL set):
+--   DROP TABLE "rate_limit_counters";
+
+-- CreateTable
+CREATE TABLE "rate_limit_counters" (
+    "id" TEXT NOT NULL DEFAULT ('rlc_'::text || (uuidv7())::text),
+    "key_hash" TEXT NOT NULL,
+    "window_start_ms" BIGINT NOT NULL,
+    "window_ms" INTEGER NOT NULL,
+    "count" INTEGER NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+    CONSTRAINT "rate_limit_counters_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "rate_limit_counters_key_hash_key" ON "rate_limit_counters"("key_hash");
+
+-- CreateIndex
+-- The sweep: DELETE WHERE window_start_ms + window_ms <= now.
+CREATE INDEX "rate_limit_counters_window_start_ms_idx" ON "rate_limit_counters"("window_start_ms");
+
+-- ADR-0031 rule 3 — rate_limit_counters: rlc_ (registered in
+-- packages/ids/src/registry.ts; this migration's path is added to
+-- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "rate_limit_counters" ALTER COLUMN "id" SET DEFAULT ('rlc_'::text || (uuidv7())::text);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_id_format" CHECK ("id" ~ '^rlc_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- D2 — key_hash is always a sha256 hex digest, never the raw bucket key.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_key_hash_hex" CHECK ("key_hash" ~ '^[0-9a-f]{64}$');
+
+-- D2 — window_ms > 0, count >= 1.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_window_ms_positive" CHECK ("window_ms" > 0);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_count_positive" CHECK ("count" >= 1);

package/templates/database/migrations/20261016120000_piece_kind/migration.sql

@@ -0,0 +1,95 @@
+-- #8516 — proposals as an artifact kind (spec
+-- docs/specs/8516-proposals-as-an-artifact-kind-spec.md D1, D2).
+--
+--   pieces (8 columns) — what a piece is (`kind`: `deliverable` or
+--                    `proposal`), a proposal's optional price (minor units
+--                    of a two-decimal currency), the client's current Stripe
+--                    Checkout Session (id, URL, expiry) and when Stripe
+--                    reported the proposal paid, with the session that paid
+--                    it. Stripe objects are named by plain columns with a
+--                    format CHECK and no foreign key (ADR 0009).
+--
+-- DDL only. Every existing row reads `kind = 'deliverable'` from the constant
+-- default — Postgres stores the default in the catalog and rewrites no row, so
+-- `updated_at` and every other column of an existing piece are unchanged. The
+-- seven other columns are nullable with no default. Each CHECK below is added
+-- NOT VALID and then VALIDATEd; every existing row passes each one (a
+-- deliverable with every new column NULL).
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- columns; code without them fails every piece read.
+--
+-- Rollback: DROP INDEX "pieces_checkout_session_id_key"; ALTER TABLE "pieces"
+-- DROP COLUMN "kind", DROP COLUMN "price_amount", DROP COLUMN
+-- "price_currency", DROP COLUMN "checkout_session_id", DROP COLUMN
+-- "checkout_url", DROP COLUMN "checkout_expires_at", DROP COLUMN "paid_at",
+-- DROP COLUMN "paid_session_id"; (the CHECKs go with them).
+
+-- AlterTable
+ALTER TABLE "pieces" ADD COLUMN     "kind" VARCHAR(16) NOT NULL DEFAULT 'deliverable',
+ADD COLUMN     "price_amount" INTEGER,
+ADD COLUMN     "price_currency" CHAR(3),
+ADD COLUMN     "checkout_session_id" TEXT,
+ADD COLUMN     "checkout_url" VARCHAR(2048),
+ADD COLUMN     "checkout_expires_at" TIMESTAMP(3),
+ADD COLUMN     "paid_at" TIMESTAMP(3),
+ADD COLUMN     "paid_session_id" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "pieces_checkout_session_id_key" ON "pieces"("checkout_session_id");
+
+-- A piece is a deliverable or a proposal, nothing else.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_kind_allowed"
+  CHECK ("kind" IN ('deliverable', 'proposal')) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_kind_allowed";
+
+-- An amount and its currency are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_pair"
+  CHECK (("price_amount" IS NULL) = ("price_currency" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_pair";
+
+-- 1 to 100,000,000 minor units (PROPOSAL_PRICE_MAX_MINOR).
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_range"
+  CHECK ("price_amount" IS NULL OR "price_amount" BETWEEN 1 AND 100000000) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_range";
+
+-- A lower-case ISO-4217 code.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_currency_format"
+  CHECK ("price_currency" IS NULL OR "price_currency" ~ '^[a-z]{3}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_currency_format";
+
+-- Only a proposal carries a price.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_proposal_only"
+  CHECK ("price_amount" IS NULL OR "kind" = 'proposal') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_proposal_only";
+
+-- A Checkout Session's id, URL and expiry are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_triple"
+  CHECK (("checkout_session_id" IS NULL) = ("checkout_url" IS NULL)
+     AND ("checkout_session_id" IS NULL) = ("checkout_expires_at" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_triple";
+
+-- A Stripe Checkout Session id.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_session_format"
+  CHECK ("checkout_session_id" IS NULL OR "checkout_session_id" ~ '^cs_(test|live)_[A-Za-z0-9]{1,250}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_session_format";
+
+-- A Checkout URL is https.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_url_https"
+  CHECK ("checkout_url" IS NULL OR "checkout_url" ~ '^https://') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_url_https";
+
+-- A Checkout Session opens only for an approved, priced proposal.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_needs_approved_price"
+  CHECK ("checkout_session_id" IS NULL OR ("price_amount" IS NOT NULL AND "approved_at" IS NOT NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_needs_approved_price";
+
+-- When paid and the session that paid are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_pair"
+  CHECK (("paid_at" IS NULL) = ("paid_session_id" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_pair";
+
+-- Only a priced proposal is paid.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_needs_price"
+  CHECK ("paid_at" IS NULL OR "price_amount" IS NOT NULL) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_needs_price";

package/templates/database/migrations/20261017120000_outbound_message_action/migration.sql

@@ -0,0 +1,30 @@
+-- #8515 — an outbound message may carry the onboarding action (spec
+-- docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md D6).
+--
+-- `interactions_outbound_shape` (20261012120000_member_contract) admitted an
+-- outbound row only as a payload-free `message`. Start onboarding writes an
+-- outbound `message` whose `payload` is exactly `{"action": "onboarding"}`,
+-- which the client's own site renders as a link to its `/account/onboarding`.
+-- The CHECK is replaced in place, under the same name, admitting that one
+-- payload and nothing else; no other constraint changes and no row is
+-- rewritten. The new CHECK is added NOT VALID and then VALIDATEd (the #8516
+-- piece_kind shape). The DROP takes ACCESS EXCLUSIVE and, in the migration's
+-- one transaction, holds it through the VALIDATE scan, so the table is locked
+-- for that scan; in exchange there is no moment without the constraint. Every
+-- existing outbound row is payload-free and passes.
+--
+-- Folder name: the spec named 20261016120000; #8516's 20261016120000_piece_kind
+-- landed first at that timestamp, so this sorts after it (spec §5.3).
+--
+-- Rollback — only AFTER the code is rolled back (running code would write
+-- rows the old CHECK refuses):
+--   UPDATE "interactions" SET "payload" = NULL WHERE "direction" = 'outbound';
+--   ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+--   ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+--     CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND "payload" IS NULL));
+-- Clients then lose the Open onboarding link on those messages; the body stays.
+
+ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+  CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND ("payload" IS NULL OR "payload" = '{"action": "onboarding"}'::jsonb))) NOT VALID;
+ALTER TABLE "interactions" VALIDATE CONSTRAINT "interactions_outbound_shape";

package/templates/database/ops/schema.prisma

@@ -25,3 +25,19 @@ model AuditLog {
   @@index([workspaceId, targetType, targetId])
   @@map("audit_logs")
 }
+
+/// RateLimitCounter — the shared per-bucket counter for `rateLimitMiddleware`'s
+/// database store (#5040 D2). Belongs to the deployment, not a tenant: no
+/// workspaceId, no tenancy fence. Rows are disposable — a lost counter only
+/// resets a window. `key_hash` is sha256(bucketKey) hex, never the raw key.
+model RateLimitCounter {
+  id            String   @id @default(dbgenerated("('rlc_'::text || (uuidv7())::text)")) @db.Text
+  keyHash       String   @unique @map("key_hash") @db.Text // sha256(bucketKey) hex
+  windowStartMs BigInt   @map("window_start_ms")
+  windowMs      Int      @map("window_ms")
+  count         Int
+  createdAt     DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@index([windowStartMs], map: "rate_limit_counters_window_start_ms_idx")
+  @@map("rate_limit_counters")
+}

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/project.yaml

@@ -1,7 +1,8 @@
 schema_version: 1
 
 # project.yaml — per-repo configuration consumed by Claude Code skills and
-# global rules. Replace REPLACE_ME values with your repo's actual identity.
+# global rules. Replace every REPLACE_ME value with your repo's own: its
+# identity and its Slack channel.
 #
 # See https://github.com/working-theory-labs/ai-launch-kit/blob/main/project.yaml
 # for AI Launch Kit's own canonical example.
@@ -10,10 +11,13 @@ identity:
   name: REPLACE_ME # your repo slug, kebab-case
   github_repo: REPLACE_ME/REPLACE_ME # owner/repo on GitHub
   npm_scope: "@REPLACE_ME" # e.g. "@yourorg" — replace with your npm scope
-  visibility: private # "oss" | "private"
+  visibility: private # "public" | "private" | "internal"
   default_branch: main
   branching_model: single_trunk
 
+slack:
+  primary_channel: REPLACE_ME # channel name without "#", where this repo's CI and agent reports land
+
 product:
   identity_mode: organization # "organization" | "person" | null
   default_locale: en
@@ -27,7 +31,6 @@ labels:
   blocked: status/blocked
   done: status/done
   needs_spec: status/needs-spec
-  auto_merge: auto-merge-eligible
 
 verification:
   preflight: pnpm preflight

package/versions.json

@@ -1,53 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.39.0",
-  "@working-theory/aeo": "0.39.0",
-  "@working-theory/agent-context": "0.39.0",
+  "@working-theory/admin-ui": "0.41.0",
+  "@working-theory/aeo": "0.41.0",
+  "@working-theory/agent-context": "0.41.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.39.0",
-  "@working-theory/api-client": "0.39.0",
+  "@working-theory/analytics": "0.41.0",
+  "@working-theory/api-client": "0.41.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.39.0",
-  "@working-theory/common": "0.39.0",
+  "@working-theory/cli": "0.41.0",
+  "@working-theory/common": "0.41.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.39.0",
-  "@working-theory/content-projection": "0.39.0",
-  "@working-theory/email": "0.39.0",
+  "@working-theory/content-adapters": "0.41.0",
+  "@working-theory/content-projection": "0.41.0",
+  "@working-theory/email": "0.41.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.39.0",
-  "@working-theory/fumadocs-schema": "0.39.0",
-  "@working-theory/ids": "0.12.0",
-  "@working-theory/jsonld": "0.39.0",
-  "@working-theory/license": "0.39.0",
-  "@working-theory/metadata": "0.39.0",
-  "@working-theory/observability": "0.39.0",
-  "@working-theory/page-renderer": "0.39.0",
+  "@working-theory/eslint-config": "0.41.0",
+  "@working-theory/fumadocs-schema": "0.41.0",
+  "@working-theory/ids": "0.14.0",
+  "@working-theory/jsonld": "0.41.0",
+  "@working-theory/license": "0.41.0",
+  "@working-theory/metadata": "0.41.0",
+  "@working-theory/observability": "0.41.0",
+  "@working-theory/page-renderer": "0.41.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.39.0",
-  "@working-theory/schema-pack-registry": "0.39.0",
-  "@working-theory/schema-validator": "0.39.0",
-  "@working-theory/sections-registry": "0.39.0",
-  "@working-theory/site-config": "0.39.0",
-  "@working-theory/spoke-checkout": "0.5.0",
-  "@working-theory/stripe-client": "0.39.0",
-  "@working-theory/templates": "0.39.0",
-  "@working-theory/theme": "0.39.0",
-  "@working-theory/ui": "0.39.0",
-  "@working-theory/validation": "0.39.0",
-  "@working-theory/web-i18n": "0.39.0",
+  "@working-theory/schema": "0.41.0",
+  "@working-theory/schema-pack-registry": "0.41.0",
+  "@working-theory/schema-validator": "0.41.0",
+  "@working-theory/sections-registry": "0.41.0",
+  "@working-theory/site-config": "0.41.0",
+  "@working-theory/spoke-checkout": "0.5.2",
+  "@working-theory/stripe-client": "0.41.0",
+  "@working-theory/templates": "0.41.0",
+  "@working-theory/theme": "0.41.0",
+  "@working-theory/ui": "0.41.0",
+  "@working-theory/validation": "0.41.0",
+  "@working-theory/web-i18n": "0.41.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.17",
-  "@working-theory/ui-docs-blog": "0.23.17",
-  "@working-theory/ui-scheduling": "0.23.17",
-  "@working-theory/ui-signal-collectors": "0.25.6",
+  "@working-theory/ui-commerce": "0.23.19",
+  "@working-theory/ui-docs-blog": "0.23.19",
+  "@working-theory/ui-scheduling": "0.23.19",
+  "@working-theory/ui-signal-collectors": "0.25.8",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.39.0"
+  "@working-theory/database": "0.41.0"
 }

package/templates/.claude/rules/preserve-existing-style.md

@@ -1,51 +0,0 @@
-# Preserve Existing Style
-
-When editing existing files, preserve their existing formatting. Do
-**not** reformat, reflow, reorganize imports, change quote style,
-change indentation, or rearrange whitespace on lines that aren't
-materially changing as part of your task.
-
-Your diff should contain only the lines you deliberately touched. A
-20-line functional change should produce a ~20-line diff, not a
-900-line diff with 880 lines of formatting churn.
-
-## Why
-
-Formatting churn:
-
-- Obscures real changes during code review.
-- Creates noise in `git blame` / `git log`.
-- Triggers unnecessary merge conflicts.
-- Violates the spirit of "behavior must not change unless the
-  acceptance criteria say so" — even if runtime behavior is identical,
-  the meaning to a human reader has changed.
-
-## How to apply
-
-- **Before committing:** run `git diff --stat`. If the delta is
-  wildly larger than the work you did, investigate before pushing.
-- **If your editor runs a formatter on save:** disable it for the
-  session, configure it to match the existing style, or revert
-  formatting-only lines before committing.
-- **If quotes, semicolons, or import grouping differ from the
-  existing file:** match the existing file, not your editor's
-  defaults.
-- **The diff is the contract.** A reviewer should see only the lines
-  you meant to change.
-
-## Not covered by this rule
-
-- Deliberate cleanup (removing dead code, inlining single-use
-  helpers, collapsing redundant abstraction) is fine when it's the
-  point of the task and called out in the PR.
-- Net-new files set their own style, subject to the project's
-  existing conventions.
-- A task whose acceptance criteria explicitly say "reformat file X"
-  (rare).
-
-## Escalation
-
-If you believe the existing style is genuinely wrong and want to
-change it: stop. Note it in the PR description and propose the
-reformat as a separate PR. Do not unilaterally reformat the codebase
-as a side effect of an unrelated task.