create-ailk 0.2.0 → 0.3.0

package/templates/apps/mcp/src/tools/index.ts

@@ -124,27 +124,12 @@ export {
   type ScaffoldOutput,
 } from "./scaffold.js";
 
-export {
-  getFlowInputSchema,
-  getFlowOutputSchema,
-  ailkGetFlow,
-  type GetFlowInput,
-  type AilkGetFlowOutput,
-} from "./get_flow.js";
-
-export {
-  submitFlowStepInputSchemaForTool,
-  submitFlowStepOutputSchema,
-  ailkSubmitFlowStep,
-  type SubmitFlowStepInput,
-  type AilkSubmitFlowStepOutput,
-} from "./submit_flow_step.js";
-
-// The scheduling tools (list_availability, get_event_meta, create_booking) are
-// deliberately NOT re-exported here, and neither are the content-write tools
-// (create_page, update_page, delete_page). Both groups are module-conditional
-// slice files (#5182): a re-export from this barrel is a static path into a
-// file the OSS strip removes, which reds the public tree's type-check. They are
-// reached only through `createMcpServer`'s per-module loader in ../server.ts.
+// The scheduling tools (list_availability, get_event_meta, create_booking),
+// the content-write tools (create_page, update_page, delete_page), and the
+// signal-collectors flow tools (get_flow, submit_flow_step) are deliberately
+// NOT re-exported here. All three groups are module-conditional slice files
+// (#5182): a re-export from this barrel is a static path into a file the OSS
+// strip removes, which reds the public tree's type-check. They are reached
+// only through `createMcpServer`'s per-module loader in ../server.ts.
 // The rule this barrel now follows: it re-exports exactly the tools no module
 // gate can remove.

package/templates/apps/web/.env.example

@@ -26,6 +26,21 @@ CONTENT_BACKEND=mdx
 # Same convention as apps/workspace/lib/client-api.ts's identically-named var.
 # Should be apps/api's origin with NO trailing slash (a single trailing
 # slash is stripped before joining, but keep this clean regardless).
+#
+# THIS IS THE ONE BROWSER-SIDE NAME (#5397). All three browser readers of the
+# apps/api origin resolve it from this variable: resolveSubmitUrl
+# (packages/ui, the form blocks above), apps/workspace's client-api, and
+# @working-theory/api-client's getApiBase() — which runs in the browser
+# wherever a "use client" component binds it, e.g. the founder application's
+# ListingApplicationClient. getApiBase() previously read NEXT_PUBLIC_API_URL,
+# a name this file never documented, so a site configured exactly per these
+# docs sent its browser traffic to http://localhost:3001. That name is still
+# honoured as a deprecated fallback; do not set it in a new deployment.
+#
+# The server-side counterpart is AILK_API_URL (see the repo-root .env.example)
+# — deliberately NOT NEXT_PUBLIC_, and it still wins over this one when both
+# are set, so an RSC/Server-Action call can target an internal origin the
+# browser never sees.
 # NEXT_PUBLIC_AILK_API_URL=http://localhost:3002
 
 # =============================================================================

package/templates/apps/web/app/[locale]/(authed)/{waitlist/__tests__ → __tests__}/gate.test.tsx

@@ -24,14 +24,14 @@ jest.mock("next/headers", () => ({
 
 const mockGetSession = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session-branch can mock without standing up Prisma.
-jest.mock("../../../../../auth", () => ({
+jest.mock("../../../../auth", () => ({
   __esModule: true,
   auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
 }));
 
 const mockGetActiveProviderIds = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
-jest.mock("../../../../../lib/auth-env", () => ({
+jest.mock("../../../../lib/auth-env", () => ({
   __esModule: true,
   getActiveProviderIds: () => mockGetActiveProviderIds(),
 }));
@@ -48,8 +48,8 @@ jest.mock("better-auth/react", () => ({
   createAuthClient: () => ({ signIn: { social: mockSignInSocial } }),
 }));
 
-import AuthedLayout from "../../layout";
-import { SignInGate } from "../../sign-in-gate";
+import AuthedLayout from "../layout";
+import { SignInGate } from "../sign-in-gate";
 
 describe("AuthedLayout — the (authed) session guard", () => {
   beforeEach(() => {

package/templates/apps/web/app/[locale]/flows/[slug]/FlowStepperClient.tsx

@@ -1,3 +1,4 @@
+// oss: false
 "use client";
 
 /**
@@ -53,7 +54,7 @@ import {
   type FlowStepperMessages,
   type FlowStepSubmitPayload,
   type FlowStepSubmitResult,
-} from "@working-theory/ui";
+} from "@working-theory/ui/slices/signal-collectors";
 import type { AeoScoreResult, FlowConfig, FlowState } from "@working-theory/validation";
 import {
   deriveFlags,

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.permalink.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for FlowStepperClient's permalink completion redirect on a
  * `mode:"recommending"` flow (#4770 D1/D7/D12).
@@ -64,7 +65,7 @@ interface MockFlowStepperProps {
 
 let captured: MockFlowStepperProps | undefined;
 
-jest.mock("@working-theory/ui", () => ({
+jest.mock("@working-theory/ui/slices/signal-collectors", () => ({
   FlowStepper: (props: MockFlowStepperProps) => {
     captured = props;
     return require("react").createElement("div", {

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for FlowStepperClient's segment-keyed completion redirect (#3960 D5).
  *
@@ -68,7 +69,7 @@ const PII_PAYLOAD = {
 
 let capturedOnCompleted: MockFlowStepperProps["onCompleted"];
 
-jest.mock("@working-theory/ui", () => ({
+jest.mock("@working-theory/ui/slices/signal-collectors", () => ({
   FlowStepper: (props: MockFlowStepperProps) => {
     capturedOnCompleted = props.onCompleted;
     async function handleSubmit(): Promise<void> {

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/flow.actions.test.ts

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for submitFlowStepAction Server Action (#3957 D8).
  *

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/two-route-tool.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * #5053 — an interactive tool is two routes.
  *

package/templates/apps/web/app/[locale]/flows/[slug]/flow.actions.ts

@@ -1,3 +1,4 @@
+// oss: false
 "use server";
 
 /**
@@ -29,7 +30,7 @@
  */
 
 import { flows } from "@working-theory/api-client";
-import type { FlowStepSubmitResult } from "@working-theory/ui";
+import type { FlowStepSubmitResult } from "@working-theory/ui/slices/signal-collectors";
 import {
   flowSlugSchema,
   submitFlowStepInputSchema,

package/templates/apps/web/app/[locale]/flows/[slug]/page.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * /[locale]/flows/[slug] — the tool's LANDING route (#5053 D3/D5).
  *

package/templates/apps/web/app/[locale]/flows/[slug]/start/page.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * /[locale]/flows/[slug]/start — the flow half of the two-route tool
  * (#5053 D3/D5). Moved here from `../page.tsx`, which is now the indexed

package/templates/apps/web/app/llms.txt/route.ts

@@ -4,9 +4,11 @@
  * Returns a plain-text index of AILK's content surface for LLM consumption,
  * following the llms.txt convention (https://llmstxt.org).
  *
- * Aggregates two surfaces:
- *   1. Section-catalog (MDX seeds in content/) via @working-theory/content-adapters
- *   2. Fumadocs blog corpus via blogSource.getPages()
+ * Indexes the section catalog (MDX seeds in content/) via
+ * @working-theory/content-adapters. Nothing is gated: a Free site has no blog
+ * (D-46), so there is no blog corpus to omit — `getBlogPages` defaults to an
+ * empty list and the docs + blog module ships its own variant of this route
+ * that reads `blogSource` (#5365 D9).
  *
  * Format per entry:
  *   - Title: <title>
@@ -14,8 +16,9 @@
  *     Description: <description>
  *
  * DI note: `createLlmsHandler` accepts optional `getContentAdapter` and
- * `getBlogPages` deps for testing — tests inject stubs to avoid mocking
- * internal modules. The exported `GET` uses the real implementations.
+ * `getBlogPages` deps — tests inject stubs, and the module's variant of this
+ * route supplies the real `blogSource` reader. The exported `GET` is
+ * unchanged either way.
  */
 
 import { SCHEMA_ORG_TYPES } from "@working-theory/content-adapters";
@@ -23,7 +26,6 @@ import type { ContentAdapter, SchemaOrgType } from "@working-theory/content-adap
 import { getContentAdapter as defaultGetContentAdapter } from "@working-theory/page-renderer";
 
 import { SITE_NAME } from "../../lib/site-brand";
-import { blogSource as defaultBlogSource } from "../../lib/source";
 import { resolveBaseUrl, slugToPath } from "../../src/lib/routes";
 
 export interface LlmsHandlerDeps {
@@ -33,8 +35,9 @@ export interface LlmsHandlerDeps {
    */
   getContentAdapter?: () => ContentAdapter;
   /**
-   * Blog pages getter. Defaults to the real blogSource.getPages().
-   * Override in tests to inject stub pages without mocking lib/source.
+   * Blog pages getter. Defaults to none — Free has no blog (D-46, #5365 D9).
+   * The docs + blog module's own copy of this route reads `blogSource`.
+   * Override in tests to inject stub pages.
    */
   getBlogPages?: () => Array<{ url: string; data: { title: string; description?: string } }>;
 }
@@ -45,7 +48,7 @@ export interface LlmsHandlerDeps {
  */
 export function createLlmsHandler(deps: LlmsHandlerDeps = {}) {
   const resolveAdapter = deps.getContentAdapter ?? defaultGetContentAdapter;
-  const resolveBlogPages = deps.getBlogPages ?? (() => defaultBlogSource.getPages() as Array<{ url: string; data: { title: string; description?: string } }>);
+  const resolveBlogPages = deps.getBlogPages ?? (() => []);
 
   return async function llmsGET(): Promise<Response> {
     const adapter = resolveAdapter();

package/templates/apps/web/jest.config.cjs

@@ -11,11 +11,11 @@ module.exports = {
   ],
   testMatch: ["**/__tests__/**/*.test.ts", "**/__tests__/**/*.test.tsx"],
   testPathIgnorePatterns: ["/node_modules/", "/.next/", "/dist/"],
-  // Ignore node_modules except fumadocs-* (ESM-only packages loaded via lib/source.ts → fumadocs-core/source).
+  // Ignore node_modules except @working-theory/* (their dist is ESM).
   // Mirrors the canonical jose carve-out used in apps/api, apps/mcp, and apps-paid/license-issuer.
   // Added: issue #1077
   transformIgnorePatterns: [
-    "/node_modules/(?!(\\.pnpm/)?(fumadocs-[^/]*?@?[^/]*?|@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+))(/|$))",
+    "/node_modules/(?!(\\.pnpm/)?@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))",
   ],
   moduleFileExtensions: ["ts", "tsx", "js", "jsx", "json"],
   // Workspace packages publish ESM in dist/, but ts-jest runs in CommonJS.
@@ -27,12 +27,6 @@ module.exports = {
     // Map all *.css to an empty stub — layout.tsx imports ./globals.css (#4090 item 1)
     // and CSS is not parseable by ts-jest's CommonJS transform (apps-paid/marketing-web precedent, #1531).
     "\\.css$": "<rootDir>/__tests__/__mocks__/style-mock.js",
-    // Fumadocs codegen output — produced by `pnpm --filter @working-theory/web build` into .source/
-    // The server entry uses top-level await + ESM-only fumadocs-mdx/runtime/server;
-    // map to a CJS stub so ts-jest can load modules that import lib/source.ts. (#1077)
-    // Stub lives in lib/__mocks__/ (committed) not .source/__mocks__/ (gitignored).
-    "^@/\\.source/server$": "<rootDir>/lib/__mocks__/source-server.js",
-    "^@/\\.source$": "<rootDir>/.source/index.ts",
     "^@working-theory/page-renderer/testing$":
       "<rootDir>/node_modules/@working-theory/page-renderer/dist/testing.js",
     "^@working-theory/page-renderer$":
@@ -51,8 +45,6 @@ module.exports = {
     "^@working-theory/api-client$": "<rootDir>/node_modules/@working-theory/api-client/dist/index.js",
     "^@working-theory/content-adapters$":
       "<rootDir>/node_modules/@working-theory/content-adapters/dist/index.js",
-    "^@working-theory/fumadocs-schema$":
-      "<rootDir>/node_modules/@working-theory/fumadocs-schema/dist/index.js",
     "^@working-theory/license$": "<rootDir>/node_modules/@working-theory/license/dist/index.js",
     "^@working-theory/jsonld$": "<rootDir>/node_modules/@working-theory/jsonld/dist/index.js",
     "^@working-theory/metadata$": "<rootDir>/node_modules/@working-theory/metadata/dist/index.js",
@@ -66,6 +58,7 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/schema-validator/dist/index.js",
     "^@working-theory/sections-registry$":
       "<rootDir>/node_modules/@working-theory/sections-registry/dist/index.js",
+
     "^@working-theory/templates/shells$":
       "<rootDir>/node_modules/@working-theory/templates/dist/shells/index.js",
     "^@working-theory/templates$": "<rootDir>/node_modules/@working-theory/templates/dist/index.js",
@@ -82,6 +75,14 @@ module.exports = {
     // tree, where nothing imports it, so the unused mapping is inert there.
     "^@working-theory/ui/slices/scheduling$":
       "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
+    // #5366: the signal-collectors slice's re-export subpath. Same reasoning
+    // as the scheduling mapping above.
+    "^@working-theory/ui/slices/signal-collectors$":
+      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/signal-collectors.js",
+    // #5364: the commerce slice's renderer-registration + CheckoutPriceCard
+    // re-export subpath. Same reasoning as the scheduling mapping above.
+    "^@working-theory/ui/slices/commerce$":
+      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/commerce.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
     // site-config publishes ESM in dist/; map to source so ts-jest compiles it
     // through the same transformer as every sibling above. Only the
@@ -126,9 +127,9 @@ module.exports = {
   },
   setupFilesAfterEnv: ["<rootDir>/__tests__/setup.ts"],
   transform: {
-    // fumadocs-core (16.10.6+) ships `import.meta.env` in its dist JS
-    // (e.g. dist/url-*.js), which the transformIgnorePatterns carve-out
-    // above lets reach a transformer instead of being required raw.
+    // Some `@working-theory/*` dist JS ships `import.meta`, which the
+    // transformIgnorePatterns carve-out above lets reach a transformer
+    // instead of being required raw.
     // `import.meta` has no CJS form, so it must run through the shared
     // import.meta -> {} rewrite BEFORE ts-jest — ts-jest's own
     // astTransformers hook never fires for a node_modules JS file (see the

package/templates/apps/web/next.config.mjs

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
-import { createMDX } from "fumadocs-mdx/next";
 import createNextIntlPlugin from "next-intl/plugin";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
@@ -110,7 +109,6 @@ const nextConfig = {
     "@working-theory/analytics",
     "@working-theory/api-client",
     "@working-theory/content-adapters",
-    "@working-theory/fumadocs-schema",
     "@working-theory/jsonld",
     "@working-theory/metadata",
     "@working-theory/page-renderer",
@@ -168,6 +166,6 @@ const sentryBuildOptions = {
 };
 
 export default withSentryConfig(
-  withBundleAnalyzer(withNextIntl(createMDX()(nextConfig))),
+  withBundleAnalyzer(withNextIntl(nextConfig)),
   sentryBuildOptions,
 );

package/templates/apps/web/package.json

@@ -6,14 +6,11 @@
   "license": "Apache-2.0",
   "scripts": {
     "dev": "next dev",
-    "prebuild": "fumadocs-mdx",
     "build": "next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
-    "pretypecheck": "fumadocs-mdx",
     "type-check": "tsc --noEmit",
     "lint": "next lint",
-    "pretest": "fumadocs-mdx",
     "test": "jest",
     "test:watch": "jest --watch"
   },
@@ -24,7 +21,6 @@
     "@working-theory/api-client": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
     "@working-theory/database": "workspace:*",
-    "@working-theory/fumadocs-schema": "workspace:*",
     "@working-theory/jsonld": "workspace:*",
     "@working-theory/metadata": "workspace:*",
     "@working-theory/page-renderer": "workspace:*",
@@ -38,8 +34,6 @@
     "@working-theory/validation": "workspace:*",
     "@working-theory/web-i18n": "workspace:*",
     "better-auth": "1.6.22",
-    "fumadocs-core": "^16.10.4",
-    "fumadocs-mdx": "^15.0.12",
     "lucide-react": "^0.577.0",
     "next": "^16.3.3",
     "next-intl": "^3.26.3",

package/templates/apps/web/public/favicon.svg

@@ -1,4 +1,7 @@
-<svg width="1080" height="1080" viewBox="0 0 1080 1080" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="1080" height="1080" rx="190" fill="#F0B100"/>
-<path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="white"/>
+<svg width="1520" height="1520" viewBox="0 0 1520 1520" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="AI Launch Kit loop logomark">
+<title>AI Launch Kit — favicon (the loop logomark on the #0656E9 tile)</title>
+<rect x="0" y="0" width="1520" height="1520" rx="267" fill="#0656E9"/>
+<svg x="258.4" y="270.1" width="1003.2" height="979.9" viewBox="127.6 137.2 824.8 805.6" fill="#FFFFFF">
+<path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#FFFFFF"/>
+</svg>
 </svg>

package/templates/apps/web/public/lockup-horizontal.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-196.50 -128.00 1248.00 143.50" width="1248" height="144">
+<!-- AI Launch Kit — horizontal lockup from the portfolio logo builder (mark: loop; wordmark: custom lettering). -->
+<g transform="scale(100)" fill="#2F2E2F"><g transform="translate(-1.9050 -1.2206) scale(0.0016343825665859565) translate(-127.0 -137.0)"><path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#2F2E2F"/></g><g><g transform="translate(0.0000 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(1.2171 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(2.0699 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -5.830939525076691 -1.4599045865638782)"><path d="M 2402.425781 183.285156 C 2396.121094 184.144531 2381.960938 186.203125 2370.179688 188.808594 L 2369.75 188.917969 L 2369.320312 188.871094 C 2368.386719 188.792969 2347.890625 187.152344 2332.242188 182.320312 L 2332.367188 584.121094 L 2560.800781 582.847656 L 2560.800781 553.59375 L 2403.714844 559.222656 Z M 2402.425781 183.285156 "/></g></g><g transform="translate(2.7492 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(3.8551 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -4.32856421446149 -1.661401981511421)"><path d="M588.43 79.8509L582.5 78.3809H582.4V152.431C582.4 170.651 578.49 184.301 560.57 185.691C535.83 187.611 534.33 168.701 534.33 152.431V78.3809H512.93V154.271C512.93 180.851 526.97 196.901 553.55 196.901C580.13 196.901 594.34 180.851 594.34 154.271V78.3809H594.29L588.43 79.8509Z"/></g></g><g transform="translate(4.7219 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -8.030530574367127 -1.835802888450144)"><path d="M2004.42 193.996L1983.67 191.122V201.903V362.052H1981.67L1873.96 191.064H1836.85V419.909H1878.31V249.847H1880.2L1988.03 419.909H2024.9V201.903V191.122L2004.42 193.996Z"/></g></g><g transform="translate(5.7438 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -6.325890417670046 -1.661401981511421)"><path d="M836.41 164.341C835.23 168.751 829.47 176.661 826.1 179.451C821.03 183.641 815.16 185.671 808.28 185.381C799.06 185.021 790.21 178.941 786.62 175.401C774.31 163.261 763.42 126.371 785.6 101.151C790.38 95.7213 799.06 90.4313 808.28 90.0713C815.16 89.7813 821.04 91.8113 826.1 96.0013C829.47 98.8013 835.23 106.701 836.41 111.111L850.58 110.991L856.37 95.5913C854.69 93.3213 842.2 80.1513 813.29 78.3613H811.99C806.12 78.3613 800.73 78.8913 795.85 79.7713C774.34 83.6413 757.22 100.051 752.05 121.281C750.58 127.301 749.55 133.771 749.57 140.021C749.57 141.261 749.62 142.501 749.71 143.731C751.72 171.321 773.66 193.211 801.13 196.451C802.11 196.571 803.52 196.671 805.04 196.751C814.56 197.281 824.14 196.051 833.09 192.741C847.38 187.471 854.38 179.421 855.59 177.781L850.57 164.441L836.4 164.321L836.41 164.341Z"/></g></g><g transform="translate(6.8247 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -7.397806839178519 -1.4599045865638782)"><path d="M 3259.496094 184.34375 L 3259.21875 356.253906 L 3141.863281 363.183594 L 3028.496094 355.238281 L 3028.773438 185.34375 L 2994.425781 190.695312 L 2959.082031 185.328125 L 2959.082031 584.074219 L 2991.449219 583.722656 L 3028.789062 584.074219 L 3029.003906 381.808594 L 3142.355469 380.472656 L 3258.726562 381.808594 L 3259.496094 583.109375 L 3293.84375 582.753906 L 3329.21875 583.109375 L 3329.21875 184.359375 L 3294.855469 189.714844 Z M 3259.496094 184.34375 "/></g></g><g transform="translate(8.3998 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -6.531551848288504 -1.835802888450144)"><path d="M1582.59 274.514L1651.05 192.742H1636.78L1536.82 312.159V192.761L1515.7 195.828L1493.99 192.742V419.909H1536.82V329.69L1553.7 309.247L1614.7 419.909H1664.03L1582.59 274.514Z"/></g></g><g transform="translate(9.3625 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(9.6336 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -6.402239906111586 -1.4599045865638782)"><path d="M 2691.488281 583.628906 L 2758.25 583.628906 L 2758.25 204.410156 L 2888.722656 218.15625 L 2888.832031 183.714844 L 2560.910156 183.714844 L 2560.800781 217.679688 L 2691.488281 204.425781 Z M 2691.488281 583.628906 "/></g></g></g></g>
+</svg>

package/templates/apps/web/public/logomark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="100" height="100">
+<!-- loop logomark in the portfolio square frame (fills 90% of the side) -->
+<g transform="translate(5.000 6.090) scale(0.108959) translate(-127.0 -137.0)" fill="#2F2E2F"><path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#2F2E2F"/></g>
+</svg>

package/templates/apps/web/public/site.webmanifest

@@ -13,7 +13,7 @@
       "type": "image/png"
     }
   ],
-  "theme_color": "#F0B100",
-  "background_color": "#ffffff",
+  "theme_color": "#0656E9",
+  "background_color": "#0656E9",
   "display": "standalone"
 }

package/templates/apps/web/public/wordmark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-6.00 -118.50 1057.50 124.50" width="1058" height="125">
+<!-- AI Launch Kit — wordmark from the portfolio logo builder (custom lettering). -->
+<g transform="scale(100)" fill="#2F2E2F"><g><g transform="translate(0.0000 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(1.2171 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(2.0699 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -5.830939525076691 -1.4599045865638782)"><path d="M 2402.425781 183.285156 C 2396.121094 184.144531 2381.960938 186.203125 2370.179688 188.808594 L 2369.75 188.917969 L 2369.320312 188.871094 C 2368.386719 188.792969 2347.890625 187.152344 2332.242188 182.320312 L 2332.367188 584.121094 L 2560.800781 582.847656 L 2560.800781 553.59375 L 2403.714844 559.222656 Z M 2402.425781 183.285156 "/></g></g><g transform="translate(2.7492 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(3.8551 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -4.32856421446149 -1.661401981511421)"><path d="M588.43 79.8509L582.5 78.3809H582.4V152.431C582.4 170.651 578.49 184.301 560.57 185.691C535.83 187.611 534.33 168.701 534.33 152.431V78.3809H512.93V154.271C512.93 180.851 526.97 196.901 553.55 196.901C580.13 196.901 594.34 180.851 594.34 154.271V78.3809H594.29L588.43 79.8509Z"/></g></g><g transform="translate(4.7219 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -8.030530574367127 -1.835802888450144)"><path d="M2004.42 193.996L1983.67 191.122V201.903V362.052H1981.67L1873.96 191.064H1836.85V419.909H1878.31V249.847H1880.2L1988.03 419.909H2024.9V201.903V191.122L2004.42 193.996Z"/></g></g><g transform="translate(5.7438 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -6.325890417670046 -1.661401981511421)"><path d="M836.41 164.341C835.23 168.751 829.47 176.661 826.1 179.451C821.03 183.641 815.16 185.671 808.28 185.381C799.06 185.021 790.21 178.941 786.62 175.401C774.31 163.261 763.42 126.371 785.6 101.151C790.38 95.7213 799.06 90.4313 808.28 90.0713C815.16 89.7813 821.04 91.8113 826.1 96.0013C829.47 98.8013 835.23 106.701 836.41 111.111L850.58 110.991L856.37 95.5913C854.69 93.3213 842.2 80.1513 813.29 78.3613H811.99C806.12 78.3613 800.73 78.8913 795.85 79.7713C774.34 83.6413 757.22 100.051 752.05 121.281C750.58 127.301 749.55 133.771 749.57 140.021C749.57 141.261 749.62 142.501 749.71 143.731C751.72 171.321 773.66 193.211 801.13 196.451C802.11 196.571 803.52 196.671 805.04 196.751C814.56 197.281 824.14 196.051 833.09 192.741C847.38 187.471 854.38 179.421 855.59 177.781L850.57 164.441L836.4 164.321L836.41 164.341Z"/></g></g><g transform="translate(6.8247 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -7.397806839178519 -1.4599045865638782)"><path d="M 3259.496094 184.34375 L 3259.21875 356.253906 L 3141.863281 363.183594 L 3028.496094 355.238281 L 3028.773438 185.34375 L 2994.425781 190.695312 L 2959.082031 185.328125 L 2959.082031 584.074219 L 2991.449219 583.722656 L 3028.789062 584.074219 L 3029.003906 381.808594 L 3142.355469 380.472656 L 3258.726562 381.808594 L 3259.496094 583.109375 L 3293.84375 582.753906 L 3329.21875 583.109375 L 3329.21875 184.359375 L 3294.855469 189.714844 Z M 3259.496094 184.34375 "/></g></g><g transform="translate(8.3998 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -6.531551848288504 -1.835802888450144)"><path d="M1582.59 274.514L1651.05 192.742H1636.78L1536.82 312.159V192.761L1515.7 195.828L1493.99 192.742V419.909H1536.82V329.69L1553.7 309.247L1614.7 419.909H1664.03L1582.59 274.514Z"/></g></g><g transform="translate(9.3625 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(9.6336 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -6.402239906111586 -1.4599045865638782)"><path d="M 2691.488281 583.628906 L 2758.25 583.628906 L 2758.25 204.410156 L 2888.722656 218.15625 L 2888.832031 183.714844 L 2560.910156 183.714844 L 2560.800781 217.679688 L 2691.488281 204.425781 Z M 2691.488281 583.628906 "/></g></g></g></g>
+</svg>

package/templates/database/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @working-theory/database
 
+## 0.22.0
+
+### Minor Changes
+
+- [#5412](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5412) [`e94f08c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e94f08cccfe6cb9d096b6746a092c1b6921677cf) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The founder application collects first name, last name and phone on step one, and records email verification when the emailed resume link is opened ([#5407](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5407)).
+
+  **Migration: `20260914120000_listing_founder_identity`.** Five nullable columns on `project_listings` — `founder_first_name`, `founder_last_name`, `founder_phone`, `email_verify_nonce_hash` and `email_verified_at` — with no backfill and no change to any existing column. `founder_name` stays NOT NULL and stays the single-line DISPLAY name every existing reader reads; the parts sit beside it, exactly as [#5279](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5279) put the six address parts beside `address`. Composition runs one way only, so no existing row's `founder_name` is split by guessing.
+
+  The platform's default contact screen now asks first name, last name, email, phone and consent. Phone is required by default and a site relaxes it with `questions: [{ id: "founder_phone", required: false }]`. A site that still asks for one "Your name" line keeps parsing untouched: the required `founderName` contract row is satisfied either by a question writing it or by the two parts that compose it.
+
+  `POST /v1/project-listings` accepts `founderFirstName` / `founderLastName` / `founderPhone` and composes `founder_name` server-side; a body carrying only `founderName`, as every caller before this release sends, is accepted unchanged.
+
+  New anonymous, credential-gated route `POST /v1/project-listings/drafts/:id/verify-email`, reached from `projectListings.verifyEmail(id, resumeToken, verifyNonce)`. It takes two credentials, and only the second carries the proof: the resume token is in `start`'s own 201 body, so it says only that you opened the draft, while the verification NONCE is minted at `start`, stored as a digest, and handed to nothing but the resume-email builder — it reaches the outside world only as the `?verify=` parameter of the emailed link. The route stamps `email_verified_at` write-once by compare-and-swap, so repeat openings answer the first stamp; a wrong token, a wrong nonce and an unknown draft all return the same `404 not_found` the other token-gated routes return.
+
+  `ListingApplicationFlow` calls it once when it mounts with a `resume.verifyNonce`, and a failure never blocks the founder. A resume link with no nonce still resumes the draft and records nothing — which is also what a site that has not switched the resume email on gets, permanently, since no nonce is ever delivered there.
+
+  `start`'s request and response shapes are unchanged: the nonce is never in a response body and never in a log line.
+
+  `founder_phone` and `email_verified_at` are omitted from the public listing read. The operator sees both on the tenant dashboard row and in the decision/review payload, and the weekly CSV sweep's outcome log now says whether the address it mailed had been proved.
+
+### Patch Changes
+
+- Updated dependencies [[`941db5d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/941db5d317b7332c3c5bb4134d0cc18f80678781), [`cbe99c2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cbe99c228200b4720b2f36af50c822a4bcca2275), [`e94f08c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e94f08cccfe6cb9d096b6746a092c1b6921677cf), [`f42b96b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f42b96b7489b5dae503b6c32e2045a14f382c583), [`4d28c33`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4d28c33978dde5cd33540813ec6317436a42a877)]:
+  - @working-theory/ids@0.7.0
+  - @working-theory/validation@0.22.0
+
+## 0.21.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.21.0
+
 ## 0.20.0
 
 ### Minor Changes

package/templates/database/inbox/schema.prisma

@@ -501,8 +501,75 @@ model ProjectListing {
   // `operator-only` answer reaches the dashboard and the review payload and
   // stops there.
   siteAnswers    Json?     @map("site_answers")
+  // #5407 — still the single-line DISPLAY name, and still NOT NULL: `start`
+  // has always required one and every reader below expects one. Where the two
+  // part columns beside it are written, this is COMPOSED from them
+  // server-side (`startProjectListingDraft`); where they are not, it is the
+  // line the founder typed, verbatim.
+  //
+  // Read by: the submit-time slug fallback, the approve/reject email's
+  // greeting, the Slack review card's Founder row, the build issue, and the
+  // `routeLead` identity. None of them changes.
   founderName    String    @map("founder_name")
+  // #5407 — the structured parts of the display name above, beside it rather
+  // than instead of it, exactly as #5279 put the six address parts beside
+  // `address`. Nullable for the #5036 D1 reason and one more: a row written
+  // before #5407 has no parts, and none may ever be GUESSED from its
+  // `founder_name`. "First Last" composes one way only; a name does not
+  // decompose (a two-word split mangles "van der Berg", "Maria del Carmen"
+  // and every mononym), so the migration backfills nothing and a null part
+  // stays null for the life of the row.
+  founderFirstName String? @map("founder_first_name")
+  founderLastName  String? @map("founder_last_name")
   founderEmail   String    @map("founder_email")
+  // #5407 — the founder's phone, collected on the default contact screen
+  // alongside the email (samhenry spec 316 D1). Nullable at rest for the
+  // #5036 D1 reason AND permanently: a row written before #5407 has none, and
+  // a site may declare the question optional through its own config.
+  //
+  // NEVER on the public read: `projectListingPublicSchema` omits it beside
+  // `founderEmail`. The address on this row is a legal control a visitor is
+  // owed; a phone number is a contact detail nobody outside the operator is.
+  founderPhone   String?   @map("founder_phone")
+  // #5407 — sha-256 of the EMAIL VERIFICATION NONCE, never the nonce itself.
+  //
+  // A second credential beside `resumeTokenHash`, and the reason
+  // `emailVerifiedAt` below means what its name says. The resume token is
+  // returned to WHOEVER POSTED `start`'s FORM, so presenting it proves only
+  // that you opened the draft. This nonce is minted at `start`, digested
+  // here, and handed to nothing except the resume-email builder
+  // (`services/project-listing-resume-email.ts`): it is never in a response
+  // body, never in a log, and never in the browser that filled the form. The
+  // only way to hold it is to have read mail sent to `founder_email`.
+  //
+  // Null on every row written before #5407, and on every row whose site has
+  // not switched the resume email on — there the nonce exists and is simply
+  // never delivered, so nothing can verify, which is the correct outcome.
+  // Cleared at `submit` beside `resumeTokenHash`, for the same reason: a
+  // credential that leaks after the draft stops being a draft is inert twice
+  // over.
+  emailVerifyNonceHash String? @unique @map("email_verify_nonce_hash")
+  // #5407 — when the founder proved control of `founder_email`, by opening
+  // the link mailed to it.
+  //
+  // WRITE-ONCE. `verifyProjectListingDraftEmail` sets it only where it is
+  // still null, so a founder who opens the link five times is stamped with
+  // the FIRST opening rather than the latest.
+  //
+  // WHAT IT PROVES, and its exact limit. The stamp requires the nonce above,
+  // which left this server only inside the email. So it says the holder can
+  // read mail sent to `founder_email` — which is the whole of what "email
+  // verified" claims. It says nothing about WHO they are: `owner_user_id`
+  // (#5295) is the column that carries an identity claim, and it still needs
+  // a signed-in user whose own address the auth system verified. A row can
+  // carry either, both, or neither.
+  //
+  // Permanently nullable, and NOT a backfill target. Every row written before
+  // #5407 predates the stamp; asserting verification on one would assert
+  // exactly the thing nobody proved. Null means "not verified", never
+  // "verification failed", and it is also what a site running no resume email
+  // reads forever.
+  emailVerifiedAt DateTime? @map("email_verified_at")
   founderCompany String?   @map("founder_company")
   status         String
   // #5036 D1/D6 — when the founder ticked step one's consent box. Never null: