create-ailk 0.19.1 → 0.21.0

package/templates/apps/web/lib/account-config.ts

@@ -48,7 +48,9 @@
 //     (`GET /v1/member/messages`) — rows of All. A message with a file has a
 //     file action to this site's own member file read,
 //     `account/inbox/message/[id]/file`, which re-serves the bytes — the
-//     browser holds no hub credential.
+//     browser holds no hub credential. A message whose `action` is
+//     `onboarding` (#8515 D6) has an Open onboarding action to this site's
+//     own `/account/onboarding`.
 //   - For-you source `piece-needs-client` — each piece waiting on the client,
 //     with an Open action to its Inbox row. It shares the pieces read.
 //
@@ -283,23 +285,36 @@ const message: AccountInboxKind<MemberMessage> = {
     }));
   },
   renderDetail({ data }, { locale, t }) {
+    // An onboarding message (#8515 D6) links to this site's own onboarding
+    // page, before the file action when both apply; the body stays plain text.
+    const actions = [
+      ...(data.action === "onboarding"
+        ? [
+            {
+              key: "onboarding",
+              label: t("messages.openOnboarding"),
+              variant: "default" as const,
+              href: localeHref(locale, "/account/onboarding"),
+            },
+          ]
+        : []),
+      ...(data.file
+        ? [
+            {
+              key: "file",
+              label: t("messages.download", { filename: data.file.filename }),
+              variant: "default" as const,
+              href: localeHref(
+                locale,
+                `/account/inbox/message/${encodeURIComponent(data.id)}/file`,
+              ),
+            },
+          ]
+        : []),
+    ];
     return {
       lead: data.body,
-      ...(data.file
-        ? {
-            actions: [
-              {
-                key: "file",
-                label: t("messages.download", { filename: data.file.filename }),
-                variant: "default" as const,
-                href: localeHref(
-                  locale,
-                  `/account/inbox/message/${encodeURIComponent(data.id)}/file`,
-                ),
-              },
-            ],
-          }
-        : {}),
+      ...(actions.length > 0 ? { actions } : {}),
       fields: {
         heading: t("messages.heading"),
         items: [

package/templates/apps/web/lib/consent-visitor.ts

@@ -0,0 +1,103 @@
+/**
+ * consent-visitor.ts — the banner's visitor id (#8438 D12, spec
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md).
+ *
+ * Owns `ailk-vid`, a random version-4 UUID the site's own server mints for a
+ * visitor who has not signed in — it is the subject a cookie-banner choice is
+ * logged against (`POST /v1/consent/cookie`), and it is NEVER the cookie that
+ * gates anything (`ailk-consent`, §1.4/C3 of the spec, stays the operative
+ * switch; this id only lets a later form or sign-in link the two).
+ *
+ * httpOnly, `Secure` in production, `SameSite=Lax`, path `/`, one year — a
+ * Server Action can read and mint it; client script never sees its value.
+ */
+
+const CONSENT_VISITOR_COOKIE_NAME = "ailk-vid";
+const ONE_YEAR_SECONDS = 60 * 60 * 24 * 365;
+
+const V4_UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/** Whether `value` is a well-formed version-4 UUID. */
+export function isValidConsentVisitorId(value: string): boolean {
+  return V4_UUID.test(value);
+}
+
+/** The subset of Next's `cookies()` jar a read needs. */
+export interface ConsentVisitorCookieReader {
+  get(name: string): { value: string } | undefined;
+}
+
+/** The cookie attributes `ensureConsentVisitor` sets — a subset of Next's `ResponseCookie`. */
+export interface ConsentVisitorCookieOptions {
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: "lax" | "strict" | "none";
+  path?: string;
+  maxAge?: number;
+}
+
+/**
+ * The subset of Next's `cookies()` jar `ensureConsentVisitor` needs. The
+ * options type is narrow (not `Record<string, unknown>`) on purpose: Next's
+ * real `cookies().set` is itself a rest-tuple overload
+ * (`ResponseCookies.set`), and TypeScript checks a rest-tuple signature's
+ * parameters contravariantly with no method-bivariance leniency — a wider
+ * options type here fails that check even though every real call site passes
+ * only these five attributes.
+ */
+export interface ConsentVisitorCookieWriter extends ConsentVisitorCookieReader {
+  set(name: string, value: string, options: ConsentVisitorCookieOptions): void;
+}
+
+/** The existing visitor id, or `undefined` with none set or an invalid value. */
+export function readConsentVisitor(
+  cookies: ConsentVisitorCookieReader,
+): string | undefined {
+  const value = cookies.get(CONSENT_VISITOR_COOKIE_NAME)?.value;
+  return value !== undefined && isValidConsentVisitorId(value) ? value : undefined;
+}
+
+/**
+ * The visitor id, minting and setting a fresh one when absent or invalid.
+ * Server Actions only — Next refuses a cookie write outside one (the same
+ * posture `hub-session/reseal.ts` documents).
+ */
+export function ensureConsentVisitor(cookies: ConsentVisitorCookieWriter): string {
+  const existing = readConsentVisitor(cookies);
+  if (existing !== undefined) return existing;
+  const id = crypto.randomUUID();
+  cookies.set(CONSENT_VISITOR_COOKIE_NAME, id, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: ONE_YEAR_SECONDS,
+  });
+  return id;
+}
+
+/** The one header a visitor-id-bearing request carries (D11). */
+export function consentVisitorHeader(id: string): Record<string, string> {
+  return { "x-ailk-consent-visitor": id };
+}
+
+/**
+ * The visitor id out of a raw `Cookie:` header string (the relay's own
+ * `Request`, which carries no Next `cookies()` jar). `undefined` with no
+ * header, no matching cookie, or a value that fails the UUID shape.
+ */
+export function readConsentVisitorFromCookieHeader(
+  header: string | null | undefined,
+): string | undefined {
+  if (!header) return undefined;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const name = part.slice(0, eq).trim();
+    if (name !== CONSENT_VISITOR_COOKIE_NAME) continue;
+    const value = part.slice(eq + 1).trim();
+    return isValidConsentVisitorId(value) ? value : undefined;
+  }
+  return undefined;
+}

package/templates/apps/web/lib/deck-page.ts

@@ -0,0 +1,186 @@
+/**
+ * The deck-page resolver (#8687 D3) — the layout's question ("does the page
+ * at this path opt in?") and `renderPage`'s consult both ask this ONE
+ * resolver, so they always agree. Registers with `@working-theory/page-renderer`
+ * at module load, in `lib/site-identity.ts`'s precedent: `app/[locale]/layout.tsx`
+ * imports this module, and Next.js evaluates a layout module before any page
+ * under it renders.
+ */
+import {
+  getMdxSource as defaultGetMdxSource,
+  optsIntoDeck,
+  setDeckPages,
+  type DeckPageContext,
+  type DeckPageInputs,
+  type SchemaOrgType,
+} from "@working-theory/page-renderer";
+import { ROUTES, type RouteRow } from "@working-theory/templates/routes";
+import { readLocales } from "@working-theory/web-i18n";
+import { headers } from "next/headers";
+import { cache } from "react";
+
+import { normalizeRoutePath } from "./closing-footer-path";
+import { siteChrome, type SiteChrome } from "./site-chrome";
+
+/**
+ * The routes besides `[slug]` whose page can present as a deck: every
+ * routes-map row with seed content whose route renders sections, minus `/`.
+ *
+ * This is a fixed superset across every shape/level a scaffold can ship,
+ * not a per-site exact list: a shape that doesn't carry one of these routes
+ * (e.g. a Free scaffold without `/alternatives`) has no `page.tsx` there, so
+ * `deckCandidates`/`resolveDeckPage` never get a request for that path —
+ * harmless. `apps/web/lib/__tests__/deck-page.test.ts`'s parity case checks
+ * the direction that would be a real bug: that this list names every
+ * sections route THIS build's own tree actually carries.
+ */
+export const DECK_ROUTES = [
+  "/about",
+  "/alternatives",
+  "/contact",
+  "/faq",
+  "/launch-service",
+  "/pricing",
+  "/privacy",
+  "/projects",
+  "/projects/:slug",
+  "/purchase-policy",
+  "/reports",
+  "/terms",
+  "/thanks/:slug",
+  "/working-agreement",
+] as const;
+
+/** The widened type (#7719 D3, #7740 D8): present only when the design sets it. */
+type Chrome = SiteChrome & {
+  deckGrounds?: DeckPageInputs["deckGrounds"];
+  deckPresentation?: true;
+};
+const chrome: Chrome = siteChrome;
+
+function routeSegments(route: string): string[] {
+  return route.split("/").filter((segment) => segment.length > 0);
+}
+
+function matchesRoute(routeDef: string, pathSegments: readonly string[]): boolean {
+  const defSegments = routeSegments(routeDef);
+  if (defSegments.length !== pathSegments.length) return false;
+  return defSegments.every(
+    (segment, i) => segment.startsWith(":") || segment === pathSegments[i],
+  );
+}
+
+/** The type and slug a matched routes-map row resolves to for this request. */
+function resolveTypeAndSlug(
+  row: RouteRow,
+  routeDef: string,
+  pathSegments: readonly string[],
+): { type: SchemaOrgType; slug: string } | null {
+  if (row.contentPath === undefined) return null;
+  const parts = row.contentPath.split("/");
+  const last = parts[parts.length - 1];
+  if (last === undefined) return null;
+  const isFile = last.endsWith(".mdx");
+  const type = isFile ? parts[parts.length - 2] : last;
+  if (type === undefined) return null;
+  const slug = isFile
+    ? last.replace(/\.mdx$/, "")
+    : pathSegments[routeSegments(routeDef).findIndex((segment) => segment.startsWith(":"))];
+  if (slug === undefined) return null;
+  return { type: type as SchemaOrgType, slug };
+}
+
+/** Whether a routes-map row at this exact route is always scaffolded (never absent from a site). */
+function isAlwaysScaffolded(path: string): boolean {
+  const row = ROUTES.find((candidate) => candidate.route === path);
+  return row !== undefined && row.gateable !== true && row.module === "marketing";
+}
+
+/**
+ * The content pages that could serve `pathname`, in the order Next.js tries
+ * them (D3). `/` gives none — the home's deck is its own `layout.home` knob,
+ * never this resolver's.
+ */
+export function deckCandidates(
+  pathname: string,
+  locales: readonly string[],
+): Array<{ type: SchemaOrgType; slug: string }> {
+  const path = normalizeRoutePath(pathname, locales);
+  if (path === "/") return [];
+  const segments = routeSegments(path);
+  const candidates: Array<{ type: SchemaOrgType; slug: string }> = [];
+
+  for (const routeDef of DECK_ROUTES) {
+    if (!matchesRoute(routeDef, segments)) continue;
+    const row = ROUTES.find((candidate) => candidate.route === routeDef);
+    const resolved = row && resolveTypeAndSlug(row, routeDef, segments);
+    if (resolved) candidates.push(resolved);
+    break;
+  }
+
+  // A one-segment path not always scaffolded falls through to `[slug]`,
+  // which serves `LandingPage` then `BlogList` (D3).
+  if (segments.length === 1 && !isAlwaysScaffolded(path)) {
+    const slug = segments[0];
+    if (slug !== undefined) {
+      candidates.push({ type: "LandingPage", slug });
+      candidates.push({ type: "BlogList", slug });
+    }
+  }
+
+  return candidates;
+}
+
+/**
+ * The first candidate with a source, and its frontmatter, or `null`. A read
+ * that throws ends the walk as `null` (NFR 3) — the page's own render
+ * surfaces that error, and the layout keeps its plain shell. Per-request
+ * memoised (React `cache`) — the layout and `renderPage`'s consult ask the
+ * same question for the same request and must share one answer.
+ */
+export const resolveDeckPage = cache(async function resolveDeckPage(
+  pathname: string,
+  locale: string,
+): Promise<{ type: SchemaOrgType; slug: string; frontmatter: Record<string, unknown> } | null> {
+  for (const candidate of deckCandidates(pathname, readLocales())) {
+    let source;
+    try {
+      source = await defaultGetMdxSource(candidate.type, candidate.slug, locale);
+    } catch {
+      return null;
+    }
+    if (source) return { ...candidate, frontmatter: source.frontmatter };
+  }
+  return null;
+});
+
+/** The layout's question: does the page at this path opt in? */
+export async function pageOptsIntoDeck(input: {
+  pathname: string;
+  locale: string;
+}): Promise<boolean> {
+  const resolved = await resolveDeckPage(input.pathname, input.locale);
+  return resolved !== null && optsIntoDeck(resolved.frontmatter);
+}
+
+/** `inputsFor`: only when this render IS the page the request path resolves to and it opts in. */
+async function inputsFor(ctx: DeckPageContext): Promise<DeckPageInputs | null> {
+  const headerStore = await headers();
+  const pathname = headerStore.get("x-pathname") ?? null;
+  if (pathname === null) return null;
+  const resolved = await resolveDeckPage(pathname, ctx.locale);
+  if (
+    resolved === null ||
+    resolved.type !== ctx.type ||
+    resolved.slug !== ctx.slug ||
+    !optsIntoDeck(resolved.frontmatter)
+  ) {
+    return null;
+  }
+  return {
+    ...(chrome.deckGrounds !== undefined ? { deckGrounds: chrome.deckGrounds } : {}),
+    deckPresentation: chrome.deckPresentation === true,
+  };
+}
+
+setDeckPages({ inputsFor });

package/templates/apps/web/lib/relay.ts

@@ -43,6 +43,7 @@ import { isIP } from "node:net";
 import { relayToApi, visitorForwardHeaders } from "@working-theory/api-client";
 
 import { browserApiOrigin } from "./api-origin.generated";
+import { readConsentVisitorFromCookieHeader } from "./consent-visitor";
 
 type RelayMethod = "GET" | "POST";
 
@@ -77,6 +78,16 @@ export const RELAY_ROUTES: readonly RelayRoute[] = Object.freeze([
   SESSION_ROUTE,
 ]);
 
+/**
+ * The three lead routes (#8438 D11, D12): a visitor's banner choice is
+ * linked to a Person only through these — a booking has no consent writer.
+ */
+const LEAD_ROUTE_PATHS = new Set([
+  "/v1/leads/submit",
+  "/v1/leads/subscribe",
+  "/v1/leads/callback",
+]);
+
 /** Fastify's default `bodyLimit`; the hub sets none (NFR4). */
 const RELAY_BODY_LIMIT = 1_048_576;
 
@@ -395,6 +406,15 @@ function relayHeaders(
       out,
       visitorForwardHeaders(incoming, process.env.AILK_VISITOR_FORWARD_KEY),
     );
+    // #8438 D12 — the banner's visitor id, read from THIS request's own
+    // `ailk-vid` cookie, never from a client-sent `x-ailk-*` header (the
+    // allow-list above already strips those). Only the three lead routes:
+    // the link between a banner choice and a client record is made there
+    // (D11), and the schedule routes have no consent writer to link.
+    if (LEAD_ROUTE_PATHS.has(entry.path)) {
+      const visitorId = readConsentVisitorFromCookieHeader(incoming.get("cookie"));
+      if (visitorId) out["x-ailk-consent-visitor"] = visitorId;
+    }
   }
   return out;
 }

package/templates/apps/web/messages/en.json

@@ -57,7 +57,6 @@
   },
   "consent": {
     "title": "Cookie Preferences",
-    "body": "We use analytics to understand how visitors use this site. We don't sell your data.",
     "acceptLabel": "Accept",
     "rejectLabel": "Reject",
     "policyLinkLabel": "Privacy policy",
@@ -74,12 +73,19 @@
   },
   "about": {
     "heading": "About",
-    "emptyState": "About page content coming soon."
+    "emptyState": "About page content coming soon.",
+    "viewProfile": "View profile"
   },
   "blog": {
     "heading": "Blog",
     "emptyState": "No posts yet. Drop MDX files into",
-    "emptyStateTrailing": "to populate this list."
+    "emptyStateTrailing": "to populate this list.",
+    "allTopics": "All",
+    "topicsNav": "Blog topics",
+    "latestPosts": "Latest posts",
+    "previousPosts": "Previous posts",
+    "readMore": "Read more",
+    "sidebar": "More from this site"
   },
   "docs": {
     "heading": "Docs",
@@ -119,7 +125,8 @@
     "sending": "Sending…",
     "sendMessage": "Send message",
     "successMessage": "Thank you for reaching out! We will be in touch shortly.",
-    "consentStatement": "I accept the [Terms](terms).",
+    "consentStatement": "I accept the [Terms](terms), [Privacy Policy](privacy), and [Working Agreement](working_agreement).",
+    "consentRequired": "Please accept the terms to send your message.",
     "genericError": "Something went wrong, please try again.",
     "unavailableHeading": "Get in touch",
     "unavailableBody": "Email us at {email} and we'll reply.",
@@ -318,9 +325,8 @@
     "emptyState": "Resources listing coming soon."
   },
   "schedule": {
-    "title": "Book a call",
+    "heading": "Book time with me",
     "description": "Pick a time that works for you.",
-    "eyebrow": "Book a call",
     "headline": "Pick a time that works",
     "confirmed": {
       "title": "You're booked",
@@ -353,6 +359,10 @@
     "heading": "Terms of Service",
     "emptyState": "Terms of service content coming soon."
   },
+  "workingAgreement": {
+    "heading": "Working Agreement",
+    "emptyState": "Working agreement content coming soon."
+  },
   "testimonials": {
     "heading": "Testimonials",
     "emptyState": "Testimonials coming soon."
@@ -535,6 +545,7 @@
     "signUpSubmit": "Create account",
     "signUpFooterPrompt": "Already have an account?",
     "signUpFooterLink": "Sign in",
+    "signUpAgreementsLegend": "Agreements",
     "signUpNotConfiguredSubhead": "Sign-up is not configured for this site yet. Set a provider's environment variables to enable it.",
     "signUpFailed": "We couldn't create your account. Check your details and try again.",
     "providerFailed": "We couldn't start sign-up with that provider. Try again.",
@@ -622,6 +633,17 @@
           "rateLimited": "Too many requests. Try again later.",
           "failed": "We couldn't send your review. Try again."
         }
+      },
+      "proposal": {
+        "caption": "Proposal",
+        "price": "Price {amount}",
+        "approve": "Approve proposal",
+        "heading": "Your decision on version {version}",
+        "pay": "Pay now",
+        "paying": "Opening payment…",
+        "paid": "Paid {date}",
+        "paidPending": "Payment received — it may take a minute to show here.",
+        "payError": "We couldn't open the payment page. Try again."
       }
     },
     "frame": {
@@ -771,14 +793,32 @@
         "passwordUnavailable": "We couldn't check your password settings."
       },
       "notifications": {
-        "title": "Notifications"
+        "title": "Notifications",
+        "lead": "What we send you.",
+        "empty": "There's nothing to set here yet."
       },
       "signIn": {
         "lead": "How you sign in to this site."
       },
       "privacy": {
+        "title": "Privacy",
         "lead": "Cookies and your data.",
-        "cookies": "Cookie settings",
+        "summary": "How we use your data.",
+        "policyLink": "Read our privacy policy",
+        "cookiesTitle": "Cookies",
+        "cookiesAccepted": "Accepted",
+        "cookiesDeclined": "Declined",
+        "cookiesUnset": "Not chosen yet",
+        "cookiesChange": "Change",
+        "consentsTitle": "Data use",
+        "consentsEmpty": "This site asks for no other data-use consents.",
+        "agreementsTitle": "Agreements accepted",
+        "agreementsEmpty": "None yet",
+        "version": "Version {version}",
+        "given": "Given {date}",
+        "withdrawn": "Withdrawn {date}",
+        "accepted": "Accepted {date}",
+        "unavailable": "Your consent choices can't be shown right now.",
         "deletion": "Request account deletion",
         "deletionLead": "Ask the site owner to delete your account and its data. We'll confirm by email.",
         "deletionSentSite": "Sent to the site operator. They'll confirm by email.",
@@ -809,6 +849,12 @@
         }
       }
     },
+    "agreements": {
+      "titleNew": "Please accept our terms",
+      "titleUpdated": "We've updated our terms",
+      "accept": "Accept",
+      "error": "We couldn't save that. Try again."
+    },
     "gate": {
       "emptyHeadline": "Sign-in isn't available yet",
       "emptyDescription": "This site hasn't turned on sign-in for members yet. Check back soon, or contact the site owner.",
@@ -862,7 +908,26 @@
       "heading": "My messages",
       "sentAt": "Sent",
       "file": "File",
-      "download": "Download {filename}"
+      "download": "Download {filename}",
+      "openOnboarding": "Open onboarding"
+    },
+    "onboarding": {
+      "title": "Onboarding",
+      "unavailable": "Onboarding isn't open to you here right now.",
+      "back": "Back to your account",
+      "optional": "Optional",
+      "submit": "Send answers",
+      "submitting": "Sending…",
+      "sent": "Thank you — your answers were sent.",
+      "retry": "Retry",
+      "errors": {
+        "load": "We couldn't load your onboarding questions.",
+        "onboardingOff": "Onboarding isn't open to you here right now.",
+        "answersInvalid": "Some answers do not fit these questions. Check them and try again.",
+        "linkNotHttps": "A link must start with https://.",
+        "tooManyRequests": "Too many submissions. Try again later.",
+        "failed": "Your answers could not be sent. Try again."
+      }
     },
     "subscription": {
       "headline": "Your payment didn't go through",
@@ -1079,5 +1144,14 @@
     "sending": "Subscribing…",
     "success": "You're subscribed. Thanks for signing up!",
     "consentStatement": "I accept the [Terms](terms)."
+  },
+  "unsubscribe": {
+    "title": "Unsubscribe",
+    "lead": "Stop these emails?",
+    "button": "Unsubscribe",
+    "done": "You're unsubscribed from {description}.",
+    "already": "You were already unsubscribed.",
+    "invalid": "This link isn't valid.",
+    "unavailable": "Unsubscribing isn't available right now."
   }
 }

package/templates/apps/web/next.config.mjs

@@ -5,6 +5,7 @@ import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
 import { legacyRedirects } from "@working-theory/templates/routes";
+import { parseStealth } from "@working-theory/web-i18n/stealth";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -16,11 +17,16 @@ const withBundleAnalyzer = bundleAnalyzer({
   analyzerMode: "json",
 });
 
-// When STEALTH=true, every response carries X-Robots-Tag: noindex, nofollow,
+// When STEALTH is on, every response carries X-Robots-Tag: noindex, nofollow,
 // noarchive — paired with the <meta robots> tag in app/layout.tsx. Layer 2 of
 // the three-layer stealth posture (#884); new AILK installs default to
 // STEALTH=true so a forked instance doesn't ship indexable by accident.
-const STEALTH = process.env.STEALTH === "true";
+// parseStealth is the one shared parse (#8511): true, 1, yes or on turn it on;
+// false, 0, no, off, empty or unset leave it off; any other value throws here,
+// so `next build` (and a non-standalone `next start`) fails before a page
+// renders. A standalone server.js does not load this file, so there the
+// robots route and every page's <meta robots> throw per request instead.
+const STEALTH = parseStealth(process.env.STEALTH);
 
 // next-intl plugin — no explicit path: uses next-intl's default convention
 // lookup (./i18n/request.ts). We use `next build --webpack` (see package.json)

package/templates/database/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @working-theory/database
 
+## 0.42.0
+
+### Patch Changes
+
+- [#8740](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8740) [`d1461bf`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d1461bff10a69aa4cf05627e393bd1902c358b00) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The database seed writes the default workspace's Contact form magnet ([#8661](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8661)): one live contact-kind magnet at slug `contact`, insert-only, so `/contact` reads it on a freshly seeded site.
+
+- Updated dependencies [[`cb2f3a5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cb2f3a50c38fe77b92aa52d1462d3d11a5981981), [`425e253`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/425e2538dfd22dfb6f0b6439d473fa2aafcbb883), [`da9253b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/da9253bb6f8c792e7e75cfe1c1a7bba5ca569e26), [`df1b8e4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/df1b8e485f9cdd1885925430b7aaa186ffdf6ac1), [`d4e0598`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d4e0598c7659d9349bd56ba184e4ab941e3fde62)]:
+  - @working-theory/validation@0.42.0
+
+## 0.41.0
+
+### Minor Changes
+
+- [#8540](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8540) [`48ff411`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48ff41198ef01163412118249f51d64b66d4ce42) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The API's per-IP rate limiter counts in a shared database table when one is configured, so one visitor's limit holds across every concurrent isolate ([#5040](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5040)).
+
+  New model `RateLimitCounter` (table `rate_limit_counters`, prefix `rlc`) in the `ops` namespace, holding one row per hashed bucket key. Run the migration before deploying the code that reads it — code deployed first falls back to the per-isolate in-process limiter, safely, until the table exists.
+
+- [#8545](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8545) [`41bc2df`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/41bc2df800c8fe69e2cbb528be68f579abfbd80d) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The Person record redesign ([#8514](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8514), docs/specs/8514-redesign-the-person-record-page-spec.md).
+
+  - **database** — `people` gains the team's private note on a client (`notes`, who last saved it, when, and which agent), with format and pairing CHECKs. The same migration then removes `people-read` and `member-pieces-manage` from agents of members, where they were inert; deploy it before the code.
+  - **validation** — members now hold `people-read`, `people-write` and `member-pieces-manage`. The new `AGENT_WITHHELD_PERMISSIONS` and `roleAllows` keep every agent off those three by role: an agent holds the grantable two only by an explicit grant, and `people-write` never. New `personNotes*` and `planOfferings*` schemas.
+  - **api-client** — `people.notes` and `people.setNotes`.
+  - **metadata** — two signed-in workspace tools, `get_person_notes` and `set_person_notes` (thirteen in all).
+  - **ui** — `PhoneNumberField` shows its country format as a "Format: …" caption under the field and no longer puts the example in the placeholder.
+  - **templates** — `ContactDetailsForm`, the one contact form the account page and the Admin share; Save stays disabled until something changes.
+
+- [#8574](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8574) [`83b7a96`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/83b7a96ccd115230f82e111a9776c8e2136b6bf9) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Standard client onboarding diagnostic and Start onboarding ([#8515](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8515), docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md).
+
+  - `@working-theory/database`: `interactions_outbound_shape` admits one outbound payload, `{"action": "onboarding"}` (migration `20261017120000_outbound_message_action`; no row is rewritten).
+  - `@working-theory/validation`: `ONBOARDING_FLOW_SLUG`, `ONBOARDING_FLOW_TITLE` and `onboardingFlowConfig`, the standard onboarding magnet every workspace holds; `OUTBOUND_MESSAGE_ACTIONS` and `onboardingStartBodySchema`; `memberMessageSchema` gains `action`; `memberOnboardingFormResponseSchema`, `memberOnboardingStepSchema`, `memberOnboardingReceiptSchema` and the `onboarding_off` member error code.
+  - `@working-theory/api-client`: `member.onboarding` and `member.submitOnboarding`.
+
+- [#8572](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8572) [`16abdb4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/16abdb45ef60cc46aba35d4179960468b8df1a8b) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Proposals as an artifact kind ([#8516](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8516), docs/specs/8516-proposals-as-an-artifact-kind-spec.md).
+
+  - `@working-theory/database`: `pieces` gains `kind` (`deliverable` by default, so every existing piece is unchanged), a proposal's optional price, the client's Checkout Session and the paid stamp, with their CHECKs and one unique index (migration `20261016120000_piece_kind`, DDL only).
+  - `@working-theory/validation`: `PIECE_KINDS`, `pieceKindSchema`, `PROPOSAL_CURRENCIES`, `proposalPriceSchema`; `pieceSchema` serves `kind`; the new `proposals.ts` wire (`proposalCreateBodySchema`, `proposalSchema`, `proposalsListResponseSchema`, `proposalResultSchema`, `proposalPaymentsSchema`); `memberArtifactSchema` gains optional `kind`, `price` and `payment`; `isStripeCheckoutUrl`, `memberProposalPaymentResponseSchema` and three member error codes.
+  - `@working-theory/api-client`: `people.proposals`, `people.createProposal` and `member.payArtifact`.
+  - `@working-theory/metadata`: the `list_proposals` and `create_proposal` workspace tools.
+  - `@working-theory/stripe-client`: `createQuotedCheckoutSession` takes optional `expiresAt` and `paymentMethodTypes`; existing callers' sessions are unchanged.
+
+### Patch Changes
+
+- [#8551](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8551) [`13e1d6f`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/13e1d6f74ef3db02b9cdedb5f33f84ad1a9a0d66) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Person gains a private team note (notes, notes_updated_at, notes_updated_by, notes_updated_by_agent) and tenant-db gains its one reader and writer ([#8514](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8514), PR 1 of 2 — the fence half; the API, MCP and Admin surfaces follow in PR 2).
+
+- Updated dependencies [[`1b0d07a`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/1b0d07acc0c97f519bf7a2dccf108d6b98c24065), [`48ff411`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/48ff41198ef01163412118249f51d64b66d4ce42), [`98b82b0`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/98b82b0e1cf29be3ba33886ebc7b8294ebff52f0), [`41bc2df`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/41bc2df800c8fe69e2cbb528be68f579abfbd80d), [`83b7a96`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/83b7a96ccd115230f82e111a9776c8e2136b6bf9), [`16abdb4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/16abdb45ef60cc46aba35d4179960468b8df1a8b)]:
+  - @working-theory/validation@0.41.0
+  - @working-theory/ids@0.14.0
+
 ## 0.40.0
 
 ### Minor Changes