create-ailk 0.19.1 → 0.21.0

package/templates/database/inbox/schema.prisma

@@ -155,6 +155,14 @@ model Person {
   // NULL and `userId` is NULL, a capture may fill a blank field (D4).
   contactConfirmedAt DateTime? @map("contact_confirmed_at")
   contactConfirmedBy String?   @map("contact_confirmed_by") @db.VarChar(16)
+  // #8514 D1 — the team's private note on this client: one per Person, never
+  // served to the client. Who last saved it (a user id of the auth namespace,
+  // no foreign key — ADR 0009) and when; both NULL until the first save.
+  // When an agent saved it, which agent (its person is notesUpdatedBy).
+  notes               String?   @db.VarChar(5000)
+  notesUpdatedAt      DateTime? @map("notes_updated_at")
+  notesUpdatedBy      String?   @map("notes_updated_by")
+  notesUpdatedByAgent String?   @map("notes_updated_by_agent")
   createdAt          DateTime  @default(now()) @map("created_at")
   updatedAt          DateTime  @updatedAt @map("updated_at")
 
@@ -174,7 +182,7 @@ model Person {
   @@map("people")
 }
 
-/// Piece — one deliverable for one client (#7877). Written only through
+/// Piece — one deliverable or proposal for one client (#7877, #8516). Written only through
 /// tenantDb(tenant).memberArea; read by a client only through
 /// lib/member-store.ts. `stage` is one of the workspace's declared stages
 /// (WorkspacePieceStages), checked at write time, never an enum.
@@ -184,16 +192,32 @@ model Person {
 /// review lands. Approval is a piece-level fact; the version's own `review`
 /// records which version was approved.
 model Piece {
-  id          String    @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String    @map("workspace_id")
-  personId    String    @map("person_id")
-  title       String    @db.VarChar(200)
-  stage       String    @db.VarChar(40)
-  needsClient Boolean   @default(false) @map("needs_client")
-  updatedBy   String    @map("updated_by")
-  approvedAt  DateTime? @map("approved_at")
-  createdAt   DateTime  @default(now()) @map("created_at")
-  updatedAt   DateTime  @updatedAt @map("updated_at")
+  id                String    @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId       String    @map("workspace_id")
+  personId          String    @map("person_id")
+  title             String    @db.VarChar(200)
+  stage             String    @db.VarChar(40)
+  needsClient       Boolean   @default(false) @map("needs_client")
+  updatedBy         String    @map("updated_by")
+  approvedAt        DateTime? @map("approved_at")
+  // #8516 D1 — what the piece is: a `deliverable` (every row before #8516) or a
+  // `proposal` the client approves or sends back. Never changes after create.
+  kind              String    @default("deliverable") @db.VarChar(16)
+  // A proposal's price, in minor units of a two-decimal currency; both or
+  // neither, and only on a proposal.
+  priceAmount       Int?      @map("price_amount")
+  priceCurrency     String?   @map("price_currency") @db.Char(3)
+  // The client's current Stripe Checkout Session (#8516 D11) — its id, URL and
+  // expiry. Never served to the operator. Replaced once five minutes or less
+  // remain; the replaced session is expired at Stripe.
+  checkoutSessionId String?   @unique @map("checkout_session_id")
+  checkoutUrl       String?   @map("checkout_url") @db.VarChar(2048)
+  checkoutExpiresAt DateTime? @map("checkout_expires_at")
+  // When Stripe reported the proposal paid, and the session that paid it (D13).
+  paidAt            DateTime? @map("paid_at")
+  paidSessionId     String?   @map("paid_session_id")
+  createdAt         DateTime  @default(now()) @map("created_at")
+  updatedAt         DateTime  @updatedAt @map("updated_at")
 
   person   Person         @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "pieces_person_fk")
   versions PieceVersion[]
@@ -249,7 +273,9 @@ model PieceVersion {
 ///
 /// #8168 D3/D4 — `direction` is `outbound` (an operator's message, #7877) or
 /// `inbound` (a client's own write); `kind` is `message`, `quote` or
-/// `review`. An outbound row is always a `message` with no `payload`
+/// `review`. An outbound row is always a `message` whose `payload` is null
+/// or, since #8515 D6, exactly `{ "action": "onboarding" }` — the one outbound
+/// action, rendered by the client's site as a link to `/account/onboarding`
 /// (`interactions_outbound_shape`); a `quote` or `review` row carries the
 /// stored payload `packages/validation`'s member.ts types. Every existing
 /// reader filters to `direction: "outbound"`, so an inbound row is invisible

package/templates/database/jest.config.cjs

@@ -1,5 +1,6 @@
 module.exports = {
   preset: "ts-jest",
+  globalSetup: require.resolve("../tools/jest/pin-timezone.cjs"),
   testEnvironment: "node",
   roots: ["<rootDir>"],
   testMatch: ["**/__tests__/**/*.test.ts"],

package/templates/database/migrations/20261015120000_person_notes/migration.sql

@@ -0,0 +1,77 @@
+-- #8514 — the client record's private notes (spec
+-- docs/specs/8514-redesign-the-person-record-page-spec.md D1, D2).
+--
+--   people (4 columns) — the team's one note on a client (never served to the
+--                    client), who last saved it (a user id of the auth
+--                    namespace, no foreign key — ADR 0009, the
+--                    piece_versions.delivered_by precedent), when, and which
+--                    agent when an agent saved it. Every column is nullable
+--                    and has no default, so Postgres changes only the catalog.
+--
+-- DDL first, then one data statement (D2b, below the marker): the DDL adds
+-- columns and CHECKs only; the data half removes inert client grants from
+-- agents of members. One directory, per the one-migration-per-milestone
+-- check (the #8435 person_contact shape). Prisma runs this file as one
+-- transaction; each CHECK below is added NOT VALID and then VALIDATEd over an
+-- all-NULL column, and the data half touches "agents" alone.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- notes and gives members the client rows; code without the columns fails
+-- every notes read, and code before the grant reset would switch the inert
+-- grants on (SEC-8514-B).
+--
+-- Rollback: ALTER TABLE "people" DROP COLUMN "notes", DROP COLUMN
+-- "notes_updated_at", DROP COLUMN "notes_updated_by", DROP COLUMN
+-- "notes_updated_by_agent"; (the CHECKs go with them). The grant reset needs
+-- none: every grant it removes was inert.
+
+-- AlterTable
+ALTER TABLE "people" ADD COLUMN     "notes" VARCHAR(5000),
+ADD COLUMN     "notes_updated_at" TIMESTAMP(3),
+ADD COLUMN     "notes_updated_by" TEXT,
+ADD COLUMN     "notes_updated_by_agent" TEXT;
+
+-- The editor is a user id of the auth namespace (the delivered_by shape).
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_updated_by_format"
+  CHECK ("notes_updated_by" IS NULL OR "notes_updated_by" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_updated_by_format";
+
+-- The agent, when one saved it, is an agent id (the agents_id_format shape).
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_updated_by_agent_format"
+  CHECK ("notes_updated_by_agent" IS NULL OR "notes_updated_by_agent" ~ '^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_updated_by_agent_format";
+
+-- Who and when are written together.
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_edit_pair"
+  CHECK (("notes_updated_at" IS NULL) = ("notes_updated_by" IS NULL)) NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_edit_pair";
+
+-- An agent's save always names the agent's person.
+ALTER TABLE "people" ADD CONSTRAINT "people_notes_agent_has_person"
+  CHECK ("notes_updated_by_agent" IS NULL OR "notes_updated_by" IS NOT NULL) NOT VALID;
+ALTER TABLE "people" VALIDATE CONSTRAINT "people_notes_agent_has_person";
+
+-- ===== #8514 D2b member agent grant reset (data only; runs after the DDL above) =====
+-- #8514 — dormant client grants cleared from agents of members (spec
+-- docs/specs/8514-redesign-the-person-record-page-spec.md D2b, SEC-8514-B).
+--
+-- Until #8514 a member held neither people-read nor member-pieces-manage, so
+-- the agent clamp (`can(personTenant.role, p)`) dropped either grant stored on
+-- a member's agent: it was inert. #8514 gives members both by role, and the
+-- clamp would then switch those stored grants on with no admin action. This
+-- removes them first, so a member's agent holds either only once an owner or
+-- admin grants it after the deploy.
+--
+-- DATA ONLY. Changes no effective permission at the time it runs (every grant
+-- it removes is inert). Idempotent: a second run matches no row.
+--
+-- Rollout: in the same deploy as, and BEFORE, the #8514 API code.
+--
+-- Rollback: none needed — every removed grant was inert.
+
+UPDATE "agents" a
+SET "grants" = array_remove(array_remove(a."grants", 'people-read'), 'member-pieces-manage')
+FROM "memberships" m
+WHERE m."id" = a."responsible_membership_id"
+  AND m."role" = 'member'
+  AND a."grants" && ARRAY['people-read', 'member-pieces-manage']::text[];

package/templates/database/migrations/20261015120000_rate_limit_counters/migration.sql

@@ -0,0 +1,43 @@
+-- #5040 — the rate limiter's shared database store (spec
+-- docs/specs/5040-the-api-s-rate-limiter-spec.md D2/D3). One row per bucket
+-- key hash; the middleware's database store (`apps/api/src/lib/rate-limit-store.ts`)
+-- is the only reader or writer. Belongs to the deployment, not a tenant: no
+-- workspace_id, no tenancy fence. Rows are disposable — a lost counter only
+-- resets a window.
+--
+-- Rollback (safe while no code selects the database store, i.e. deploy this
+-- migration before the code that reads AILK_RATE_LIMIT_STORE=database or
+-- defaults to it with DATABASE_URL set):
+--   DROP TABLE "rate_limit_counters";
+
+-- CreateTable
+CREATE TABLE "rate_limit_counters" (
+    "id" TEXT NOT NULL DEFAULT ('rlc_'::text || (uuidv7())::text),
+    "key_hash" TEXT NOT NULL,
+    "window_start_ms" BIGINT NOT NULL,
+    "window_ms" INTEGER NOT NULL,
+    "count" INTEGER NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+    CONSTRAINT "rate_limit_counters_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "rate_limit_counters_key_hash_key" ON "rate_limit_counters"("key_hash");
+
+-- CreateIndex
+-- The sweep: DELETE WHERE window_start_ms + window_ms <= now.
+CREATE INDEX "rate_limit_counters_window_start_ms_idx" ON "rate_limit_counters"("window_start_ms");
+
+-- ADR-0031 rule 3 — rate_limit_counters: rlc_ (registered in
+-- packages/ids/src/registry.ts; this migration's path is added to
+-- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "rate_limit_counters" ALTER COLUMN "id" SET DEFAULT ('rlc_'::text || (uuidv7())::text);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_id_format" CHECK ("id" ~ '^rlc_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- D2 — key_hash is always a sha256 hex digest, never the raw bucket key.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_key_hash_hex" CHECK ("key_hash" ~ '^[0-9a-f]{64}$');
+
+-- D2 — window_ms > 0, count >= 1.
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_window_ms_positive" CHECK ("window_ms" > 0);
+ALTER TABLE "rate_limit_counters" ADD CONSTRAINT "rate_limit_counters_count_positive" CHECK ("count" >= 1);

package/templates/database/migrations/20261016120000_piece_kind/migration.sql

@@ -0,0 +1,95 @@
+-- #8516 — proposals as an artifact kind (spec
+-- docs/specs/8516-proposals-as-an-artifact-kind-spec.md D1, D2).
+--
+--   pieces (8 columns) — what a piece is (`kind`: `deliverable` or
+--                    `proposal`), a proposal's optional price (minor units
+--                    of a two-decimal currency), the client's current Stripe
+--                    Checkout Session (id, URL, expiry) and when Stripe
+--                    reported the proposal paid, with the session that paid
+--                    it. Stripe objects are named by plain columns with a
+--                    format CHECK and no foreign key (ADR 0009).
+--
+-- DDL only. Every existing row reads `kind = 'deliverable'` from the constant
+-- default — Postgres stores the default in the catalog and rewrites no row, so
+-- `updated_at` and every other column of an existing piece are unchanged. The
+-- seven other columns are nullable with no default. Each CHECK below is added
+-- NOT VALID and then VALIDATEd; every existing row passes each one (a
+-- deliverable with every new column NULL).
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- columns; code without them fails every piece read.
+--
+-- Rollback: DROP INDEX "pieces_checkout_session_id_key"; ALTER TABLE "pieces"
+-- DROP COLUMN "kind", DROP COLUMN "price_amount", DROP COLUMN
+-- "price_currency", DROP COLUMN "checkout_session_id", DROP COLUMN
+-- "checkout_url", DROP COLUMN "checkout_expires_at", DROP COLUMN "paid_at",
+-- DROP COLUMN "paid_session_id"; (the CHECKs go with them).
+
+-- AlterTable
+ALTER TABLE "pieces" ADD COLUMN     "kind" VARCHAR(16) NOT NULL DEFAULT 'deliverable',
+ADD COLUMN     "price_amount" INTEGER,
+ADD COLUMN     "price_currency" CHAR(3),
+ADD COLUMN     "checkout_session_id" TEXT,
+ADD COLUMN     "checkout_url" VARCHAR(2048),
+ADD COLUMN     "checkout_expires_at" TIMESTAMP(3),
+ADD COLUMN     "paid_at" TIMESTAMP(3),
+ADD COLUMN     "paid_session_id" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "pieces_checkout_session_id_key" ON "pieces"("checkout_session_id");
+
+-- A piece is a deliverable or a proposal, nothing else.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_kind_allowed"
+  CHECK ("kind" IN ('deliverable', 'proposal')) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_kind_allowed";
+
+-- An amount and its currency are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_pair"
+  CHECK (("price_amount" IS NULL) = ("price_currency" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_pair";
+
+-- 1 to 100,000,000 minor units (PROPOSAL_PRICE_MAX_MINOR).
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_range"
+  CHECK ("price_amount" IS NULL OR "price_amount" BETWEEN 1 AND 100000000) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_range";
+
+-- A lower-case ISO-4217 code.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_currency_format"
+  CHECK ("price_currency" IS NULL OR "price_currency" ~ '^[a-z]{3}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_currency_format";
+
+-- Only a proposal carries a price.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_price_proposal_only"
+  CHECK ("price_amount" IS NULL OR "kind" = 'proposal') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_price_proposal_only";
+
+-- A Checkout Session's id, URL and expiry are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_triple"
+  CHECK (("checkout_session_id" IS NULL) = ("checkout_url" IS NULL)
+     AND ("checkout_session_id" IS NULL) = ("checkout_expires_at" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_triple";
+
+-- A Stripe Checkout Session id.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_session_format"
+  CHECK ("checkout_session_id" IS NULL OR "checkout_session_id" ~ '^cs_(test|live)_[A-Za-z0-9]{1,250}$') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_session_format";
+
+-- A Checkout URL is https.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_url_https"
+  CHECK ("checkout_url" IS NULL OR "checkout_url" ~ '^https://') NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_url_https";
+
+-- A Checkout Session opens only for an approved, priced proposal.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_checkout_needs_approved_price"
+  CHECK ("checkout_session_id" IS NULL OR ("price_amount" IS NOT NULL AND "approved_at" IS NOT NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_checkout_needs_approved_price";
+
+-- When paid and the session that paid are written together.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_pair"
+  CHECK (("paid_at" IS NULL) = ("paid_session_id" IS NULL)) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_pair";
+
+-- Only a priced proposal is paid.
+ALTER TABLE "pieces" ADD CONSTRAINT "pieces_paid_needs_price"
+  CHECK ("paid_at" IS NULL OR "price_amount" IS NOT NULL) NOT VALID;
+ALTER TABLE "pieces" VALIDATE CONSTRAINT "pieces_paid_needs_price";

package/templates/database/migrations/20261017120000_outbound_message_action/migration.sql

@@ -0,0 +1,30 @@
+-- #8515 — an outbound message may carry the onboarding action (spec
+-- docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md D6).
+--
+-- `interactions_outbound_shape` (20261012120000_member_contract) admitted an
+-- outbound row only as a payload-free `message`. Start onboarding writes an
+-- outbound `message` whose `payload` is exactly `{"action": "onboarding"}`,
+-- which the client's own site renders as a link to its `/account/onboarding`.
+-- The CHECK is replaced in place, under the same name, admitting that one
+-- payload and nothing else; no other constraint changes and no row is
+-- rewritten. The new CHECK is added NOT VALID and then VALIDATEd (the #8516
+-- piece_kind shape). The DROP takes ACCESS EXCLUSIVE and, in the migration's
+-- one transaction, holds it through the VALIDATE scan, so the table is locked
+-- for that scan; in exchange there is no moment without the constraint. Every
+-- existing outbound row is payload-free and passes.
+--
+-- Folder name: the spec named 20261016120000; #8516's 20261016120000_piece_kind
+-- landed first at that timestamp, so this sorts after it (spec §5.3).
+--
+-- Rollback — only AFTER the code is rolled back (running code would write
+-- rows the old CHECK refuses):
+--   UPDATE "interactions" SET "payload" = NULL WHERE "direction" = 'outbound';
+--   ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+--   ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+--     CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND "payload" IS NULL));
+-- Clients then lose the Open onboarding link on those messages; the body stays.
+
+ALTER TABLE "interactions" DROP CONSTRAINT "interactions_outbound_shape";
+ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
+  CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND ("payload" IS NULL OR "payload" = '{"action": "onboarding"}'::jsonb))) NOT VALID;
+ALTER TABLE "interactions" VALIDATE CONSTRAINT "interactions_outbound_shape";

package/templates/database/ops/schema.prisma

@@ -25,3 +25,19 @@ model AuditLog {
   @@index([workspaceId, targetType, targetId])
   @@map("audit_logs")
 }
+
+/// RateLimitCounter — the shared per-bucket counter for `rateLimitMiddleware`'s
+/// database store (#5040 D2). Belongs to the deployment, not a tenant: no
+/// workspaceId, no tenancy fence. Rows are disposable — a lost counter only
+/// resets a window. `key_hash` is sha256(bucketKey) hex, never the raw key.
+model RateLimitCounter {
+  id            String   @id @default(dbgenerated("('rlc_'::text || (uuidv7())::text)")) @db.Text
+  keyHash       String   @unique @map("key_hash") @db.Text // sha256(bucketKey) hex
+  windowStartMs BigInt   @map("window_start_ms")
+  windowMs      Int      @map("window_ms")
+  count         Int
+  createdAt     DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@index([windowStartMs], map: "rate_limit_counters_window_start_ms_idx")
+  @@map("rate_limit_counters")
+}

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/database/seed.ts

@@ -26,6 +26,10 @@ import "dotenv/config";
 import { basename } from "node:path";
 
 import {
+  CONTACT_FORM_FLOW_SLUG,
+  CONTACT_FORM_FLOW_TITLE,
+  CONTACT_FORM_LANDING_PAGE,
+  contactFormFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
@@ -74,6 +78,10 @@ export type DefaultWorkspacePrismaClient = Pick<
  * backfill finds no workspace and seeds nothing; this is where the default
  * workspace's magnet comes from. Insert-if-absent: an `upsert` with an empty
  * `update`, so an existing `(site_id, slug)` row is never overwritten.
+ *
+ * #8661 D3 — and its live Contact form magnet, the same way. An existing
+ * deployment (a workspace already present) gets its row from the seed-presets
+ * CLI instead.
  */
 export async function provisionDefaultWorkspace(
   prisma: DefaultWorkspacePrismaClient,
@@ -129,6 +137,27 @@ export async function provisionDefaultWorkspace(
     update: {},
   });
 
+  await prisma.flowDefinition.upsert({
+    where: {
+      siteId_slug: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        slug: CONTACT_FORM_FLOW_SLUG,
+      },
+    },
+    create: {
+      siteId: DEFAULT_WORKSPACE_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      slug: CONTACT_FORM_FLOW_SLUG,
+      config: contactFormFlowConfig,
+      kind: "contact",
+      title: CONTACT_FORM_FLOW_TITLE,
+      status: "live",
+      customersEnabled: false,
+      landingPage: CONTACT_FORM_LANDING_PAGE,
+    },
+    update: {},
+  });
+
   return { created: true };
 }
 

package/templates/project.yaml

@@ -1,7 +1,8 @@
 schema_version: 1
 
 # project.yaml — per-repo configuration consumed by Claude Code skills and
-# global rules. Replace REPLACE_ME values with your repo's actual identity.
+# global rules. Replace every REPLACE_ME value with your repo's own: its
+# identity and its Slack channel.
 #
 # See https://github.com/working-theory-labs/ai-launch-kit/blob/main/project.yaml
 # for AI Launch Kit's own canonical example.
@@ -10,10 +11,13 @@ identity:
   name: REPLACE_ME # your repo slug, kebab-case
   github_repo: REPLACE_ME/REPLACE_ME # owner/repo on GitHub
   npm_scope: "@REPLACE_ME" # e.g. "@yourorg" — replace with your npm scope
-  visibility: private # "oss" | "private"
+  visibility: private # "public" | "private" | "internal"
   default_branch: main
   branching_model: single_trunk
 
+slack:
+  primary_channel: REPLACE_ME # channel name without "#", where this repo's CI and agent reports land
+
 product:
   identity_mode: organization # "organization" | "person" | null
   default_locale: en
@@ -27,7 +31,6 @@ labels:
   blocked: status/blocked
   done: status/done
   needs_spec: status/needs-spec
-  auto_merge: auto-merge-eligible
 
 verification:
   preflight: pnpm preflight

package/templates/tools/jest/pin-timezone.cjs

@@ -0,0 +1,34 @@
+"use strict";
+/* global process */
+
+/**
+ * Shared Jest `globalSetup` — pins every jest run in the workspace to one
+ * timezone (#8657).
+ *
+ * Jest otherwise inherits the developer's `TZ`, so a test that renders a date
+ * in local time (`formatDate`, `toLocaleDateString`, `getDate()`) passes in CI,
+ * which runs in UTC, and fails on a laptop that does not: the #8578 shape,
+ * where UTC-midnight consent fixtures rendered the previous day on an MDT
+ * machine and failed 11 release-check rows.
+ *
+ * WHY `globalSetup` AND NOT `setupFiles`: a setup file runs inside the test
+ * sandbox, whose `process.env` is jest's copy of the real one, so assigning
+ * `TZ` there never reaches the process clock. `globalSetup` runs in jest's
+ * parent process before any worker is spawned: the workers inherit the pinned
+ * `TZ`, and Node re-reads an assigned `process.env.TZ` at once, so an in-band
+ * run (`--runInBand`, a single test file) is pinned in place too.
+ *
+ * Every committed `jest.config.cjs` loads this file; the guard is
+ * `tests/architecture/jest-timezone-pin.test.ts`, and the value is documented
+ * in CONVENTIONS.md § Testing. A test that needs another zone formats with an
+ * explicit `timeZone` option rather than changing `TZ`. The create-ailk
+ * scaffold ships this file at the same path (`SNAPSHOT_FILES` in
+ * packages/create-ailk/scripts/build-templates.mjs), so its copied configs
+ * load it unchanged.
+ */
+const PINNED_TZ = "UTC";
+
+module.exports = async function pinTimezone() {
+  process.env.TZ = PINNED_TZ;
+};
+module.exports.PINNED_TZ = PINNED_TZ;

package/versions.json

@@ -1,53 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.40.0",
-  "@working-theory/aeo": "0.40.0",
-  "@working-theory/agent-context": "0.40.0",
+  "@working-theory/admin-ui": "0.42.0",
+  "@working-theory/aeo": "0.42.0",
+  "@working-theory/agent-context": "0.42.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.40.0",
-  "@working-theory/api-client": "0.40.0",
+  "@working-theory/analytics": "0.42.0",
+  "@working-theory/api-client": "0.42.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.40.0",
-  "@working-theory/common": "0.40.0",
+  "@working-theory/cli": "0.42.0",
+  "@working-theory/common": "0.42.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.40.0",
-  "@working-theory/content-projection": "0.40.0",
-  "@working-theory/email": "0.40.0",
+  "@working-theory/content-adapters": "0.42.0",
+  "@working-theory/content-projection": "0.42.0",
+  "@working-theory/email": "0.42.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.40.0",
-  "@working-theory/fumadocs-schema": "0.40.0",
-  "@working-theory/ids": "0.13.0",
-  "@working-theory/jsonld": "0.40.0",
-  "@working-theory/license": "0.40.0",
-  "@working-theory/metadata": "0.40.0",
-  "@working-theory/observability": "0.40.0",
-  "@working-theory/page-renderer": "0.40.0",
+  "@working-theory/eslint-config": "0.42.0",
+  "@working-theory/fumadocs-schema": "0.42.0",
+  "@working-theory/ids": "0.14.0",
+  "@working-theory/jsonld": "0.42.0",
+  "@working-theory/license": "0.42.0",
+  "@working-theory/metadata": "0.42.0",
+  "@working-theory/observability": "0.42.0",
+  "@working-theory/page-renderer": "0.42.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.40.0",
-  "@working-theory/schema-pack-registry": "0.40.0",
-  "@working-theory/schema-validator": "0.40.0",
-  "@working-theory/sections-registry": "0.40.0",
-  "@working-theory/site-config": "0.40.0",
-  "@working-theory/spoke-checkout": "0.5.1",
-  "@working-theory/stripe-client": "0.40.0",
-  "@working-theory/templates": "0.40.0",
-  "@working-theory/theme": "0.40.0",
-  "@working-theory/ui": "0.40.0",
-  "@working-theory/validation": "0.40.0",
-  "@working-theory/web-i18n": "0.40.0",
+  "@working-theory/schema": "0.42.0",
+  "@working-theory/schema-pack-registry": "0.42.0",
+  "@working-theory/schema-validator": "0.42.0",
+  "@working-theory/sections-registry": "0.42.0",
+  "@working-theory/site-config": "0.42.0",
+  "@working-theory/spoke-checkout": "0.5.3",
+  "@working-theory/stripe-client": "0.42.0",
+  "@working-theory/templates": "0.42.0",
+  "@working-theory/theme": "0.42.0",
+  "@working-theory/ui": "0.42.0",
+  "@working-theory/validation": "0.42.0",
+  "@working-theory/web-i18n": "0.42.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.18",
-  "@working-theory/ui-docs-blog": "0.23.18",
-  "@working-theory/ui-scheduling": "0.23.18",
-  "@working-theory/ui-signal-collectors": "0.25.7",
+  "@working-theory/ui-commerce": "0.23.20",
+  "@working-theory/ui-docs-blog": "0.23.20",
+  "@working-theory/ui-scheduling": "0.24.0",
+  "@working-theory/ui-signal-collectors": "0.25.9",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.40.0"
+  "@working-theory/database": "0.42.0"
 }

package/templates/.claude/rules/preserve-existing-style.md

@@ -1,51 +0,0 @@
-# Preserve Existing Style
-
-When editing existing files, preserve their existing formatting. Do
-**not** reformat, reflow, reorganize imports, change quote style,
-change indentation, or rearrange whitespace on lines that aren't
-materially changing as part of your task.
-
-Your diff should contain only the lines you deliberately touched. A
-20-line functional change should produce a ~20-line diff, not a
-900-line diff with 880 lines of formatting churn.
-
-## Why
-
-Formatting churn:
-
-- Obscures real changes during code review.
-- Creates noise in `git blame` / `git log`.
-- Triggers unnecessary merge conflicts.
-- Violates the spirit of "behavior must not change unless the
-  acceptance criteria say so" — even if runtime behavior is identical,
-  the meaning to a human reader has changed.
-
-## How to apply
-
-- **Before committing:** run `git diff --stat`. If the delta is
-  wildly larger than the work you did, investigate before pushing.
-- **If your editor runs a formatter on save:** disable it for the
-  session, configure it to match the existing style, or revert
-  formatting-only lines before committing.
-- **If quotes, semicolons, or import grouping differ from the
-  existing file:** match the existing file, not your editor's
-  defaults.
-- **The diff is the contract.** A reviewer should see only the lines
-  you meant to change.
-
-## Not covered by this rule
-
-- Deliberate cleanup (removing dead code, inlining single-use
-  helpers, collapsing redundant abstraction) is fine when it's the
-  point of the task and called out in the PR.
-- Net-new files set their own style, subject to the project's
-  existing conventions.
-- A task whose acceptance criteria explicitly say "reformat file X"
-  (rare).
-
-## Escalation
-
-If you believe the existing style is genuinely wrong and want to
-change it: stop. Note it in the PR description and propose the
-reformat as a separate PR. Do not unilaterally reformat the codebase
-as a side effect of an unrelated task.