create-ailk 0.2.0 → 0.4.0

package/templates/apps/web/next.config.mjs

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
-import { createMDX } from "fumadocs-mdx/next";
 import createNextIntlPlugin from "next-intl/plugin";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
@@ -110,7 +109,6 @@ const nextConfig = {
     "@working-theory/analytics",
     "@working-theory/api-client",
     "@working-theory/content-adapters",
-    "@working-theory/fumadocs-schema",
     "@working-theory/jsonld",
     "@working-theory/metadata",
     "@working-theory/page-renderer",
@@ -168,6 +166,6 @@ const sentryBuildOptions = {
 };
 
 export default withSentryConfig(
-  withBundleAnalyzer(withNextIntl(createMDX()(nextConfig))),
+  withBundleAnalyzer(withNextIntl(nextConfig)),
   sentryBuildOptions,
 );

package/templates/apps/web/package.json

@@ -6,14 +6,11 @@
   "license": "Apache-2.0",
   "scripts": {
     "dev": "next dev",
-    "prebuild": "fumadocs-mdx",
     "build": "next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
-    "pretypecheck": "fumadocs-mdx",
     "type-check": "tsc --noEmit",
     "lint": "next lint",
-    "pretest": "fumadocs-mdx",
     "test": "jest",
     "test:watch": "jest --watch"
   },
@@ -24,7 +21,6 @@
     "@working-theory/api-client": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
     "@working-theory/database": "workspace:*",
-    "@working-theory/fumadocs-schema": "workspace:*",
     "@working-theory/jsonld": "workspace:*",
     "@working-theory/metadata": "workspace:*",
     "@working-theory/page-renderer": "workspace:*",
@@ -38,8 +34,6 @@
     "@working-theory/validation": "workspace:*",
     "@working-theory/web-i18n": "workspace:*",
     "better-auth": "1.6.22",
-    "fumadocs-core": "^16.10.4",
-    "fumadocs-mdx": "^15.0.12",
     "lucide-react": "^0.577.0",
     "next": "^16.3.3",
     "next-intl": "^3.26.3",

package/templates/apps/web/public/favicon.svg

@@ -1,4 +1,7 @@
-<svg width="1080" height="1080" viewBox="0 0 1080 1080" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="1080" height="1080" rx="190" fill="#F0B100"/>
-<path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="white"/>
+<svg width="1520" height="1520" viewBox="0 0 1520 1520" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="AI Launch Kit loop logomark">
+<title>AI Launch Kit — favicon (the loop logomark on the #0656E9 tile)</title>
+<rect x="0" y="0" width="1520" height="1520" rx="267" fill="#0656E9"/>
+<svg x="258.4" y="270.1" width="1003.2" height="979.9" viewBox="127.6 137.2 824.8 805.6" fill="#FFFFFF">
+<path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#FFFFFF"/>
+</svg>
 </svg>

package/templates/apps/web/public/lockup-horizontal.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-196.50 -128.00 1248.00 143.50" width="1248" height="144">
+<!-- AI Launch Kit — horizontal lockup from the portfolio logo builder (mark: loop; wordmark: custom lettering). -->
+<g transform="scale(100)" fill="#2F2E2F"><g transform="translate(-1.9050 -1.2206) scale(0.0016343825665859565) translate(-127.0 -137.0)"><path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#2F2E2F"/></g><g><g transform="translate(0.0000 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(1.2171 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(2.0699 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -5.830939525076691 -1.4599045865638782)"><path d="M 2402.425781 183.285156 C 2396.121094 184.144531 2381.960938 186.203125 2370.179688 188.808594 L 2369.75 188.917969 L 2369.320312 188.871094 C 2368.386719 188.792969 2347.890625 187.152344 2332.242188 182.320312 L 2332.367188 584.121094 L 2560.800781 582.847656 L 2560.800781 553.59375 L 2403.714844 559.222656 Z M 2402.425781 183.285156 "/></g></g><g transform="translate(2.7492 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(3.8551 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -4.32856421446149 -1.661401981511421)"><path d="M588.43 79.8509L582.5 78.3809H582.4V152.431C582.4 170.651 578.49 184.301 560.57 185.691C535.83 187.611 534.33 168.701 534.33 152.431V78.3809H512.93V154.271C512.93 180.851 526.97 196.901 553.55 196.901C580.13 196.901 594.34 180.851 594.34 154.271V78.3809H594.29L588.43 79.8509Z"/></g></g><g transform="translate(4.7219 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -8.030530574367127 -1.835802888450144)"><path d="M2004.42 193.996L1983.67 191.122V201.903V362.052H1981.67L1873.96 191.064H1836.85V419.909H1878.31V249.847H1880.2L1988.03 419.909H2024.9V201.903V191.122L2004.42 193.996Z"/></g></g><g transform="translate(5.7438 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -6.325890417670046 -1.661401981511421)"><path d="M836.41 164.341C835.23 168.751 829.47 176.661 826.1 179.451C821.03 183.641 815.16 185.671 808.28 185.381C799.06 185.021 790.21 178.941 786.62 175.401C774.31 163.261 763.42 126.371 785.6 101.151C790.38 95.7213 799.06 90.4313 808.28 90.0713C815.16 89.7813 821.04 91.8113 826.1 96.0013C829.47 98.8013 835.23 106.701 836.41 111.111L850.58 110.991L856.37 95.5913C854.69 93.3213 842.2 80.1513 813.29 78.3613H811.99C806.12 78.3613 800.73 78.8913 795.85 79.7713C774.34 83.6413 757.22 100.051 752.05 121.281C750.58 127.301 749.55 133.771 749.57 140.021C749.57 141.261 749.62 142.501 749.71 143.731C751.72 171.321 773.66 193.211 801.13 196.451C802.11 196.571 803.52 196.671 805.04 196.751C814.56 197.281 824.14 196.051 833.09 192.741C847.38 187.471 854.38 179.421 855.59 177.781L850.57 164.441L836.4 164.321L836.41 164.341Z"/></g></g><g transform="translate(6.8247 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -7.397806839178519 -1.4599045865638782)"><path d="M 3259.496094 184.34375 L 3259.21875 356.253906 L 3141.863281 363.183594 L 3028.496094 355.238281 L 3028.773438 185.34375 L 2994.425781 190.695312 L 2959.082031 185.328125 L 2959.082031 584.074219 L 2991.449219 583.722656 L 3028.789062 584.074219 L 3029.003906 381.808594 L 3142.355469 380.472656 L 3258.726562 381.808594 L 3259.496094 583.109375 L 3293.84375 582.753906 L 3329.21875 583.109375 L 3329.21875 184.359375 L 3294.855469 189.714844 Z M 3259.496094 184.34375 "/></g></g><g transform="translate(8.3998 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -6.531551848288504 -1.835802888450144)"><path d="M1582.59 274.514L1651.05 192.742H1636.78L1536.82 312.159V192.761L1515.7 195.828L1493.99 192.742V419.909H1536.82V329.69L1553.7 309.247L1614.7 419.909H1664.03L1582.59 274.514Z"/></g></g><g transform="translate(9.3625 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(9.6336 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -6.402239906111586 -1.4599045865638782)"><path d="M 2691.488281 583.628906 L 2758.25 583.628906 L 2758.25 204.410156 L 2888.722656 218.15625 L 2888.832031 183.714844 L 2560.910156 183.714844 L 2560.800781 217.679688 L 2691.488281 204.425781 Z M 2691.488281 583.628906 "/></g></g></g></g>
+</svg>

package/templates/apps/web/public/logomark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="100" height="100">
+<!-- loop logomark in the portfolio square frame (fills 90% of the side) -->
+<g transform="translate(5.000 6.090) scale(0.108959) translate(-127.0 -137.0)" fill="#2F2E2F"><path d="M127.624 704.255C127.624 704.255 303.232 444.079 606.336 428.823C606.336 428.823 827.464 405.543 824.36 645.295C824.36 645.295 824.344 832.999 659.872 916.079C507.8 992.887 380.56 892.023 383.664 757.023C386.552 631.327 467.136 458.695 824.392 199.167L792.552 155.463L952.384 137.359L893.416 288.399L861.864 246.503C861.864 246.503 529.792 463.231 475.216 676.335C475.216 676.335 432.544 848.583 558.992 852.527C689.056 856.591 794.88 637.543 696.856 535.383C613.632 448.639 369.888 498.079 163.504 733.167L127.616 704.263L127.624 704.255Z" fill="#2F2E2F"/></g>
+</svg>

package/templates/apps/web/public/site.webmanifest

@@ -13,7 +13,7 @@
       "type": "image/png"
     }
   ],
-  "theme_color": "#F0B100",
-  "background_color": "#ffffff",
+  "theme_color": "#0656E9",
+  "background_color": "#0656E9",
   "display": "standalone"
 }

package/templates/apps/web/public/wordmark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-6.00 -118.50 1057.50 124.50" width="1058" height="125">
+<!-- AI Launch Kit — wordmark from the portfolio logo builder (custom lettering). -->
+<g transform="scale(100)" fill="#2F2E2F"><g><g transform="translate(0.0000 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(1.2171 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(2.0699 0) scale(1.12)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -5.830939525076691 -1.4599045865638782)"><path d="M 2402.425781 183.285156 C 2396.121094 184.144531 2381.960938 186.203125 2370.179688 188.808594 L 2369.75 188.917969 L 2369.320312 188.871094 C 2368.386719 188.792969 2347.890625 187.152344 2332.242188 182.320312 L 2332.367188 584.121094 L 2560.800781 582.847656 L 2560.800781 553.59375 L 2403.714844 559.222656 Z M 2402.425781 183.285156 "/></g></g><g transform="translate(2.7492 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -4.7020750267431675 -1.4599045865638782)"><path d="M 2017.5 402.472656 L 2069.75 282.953125 L 2117.78125 403.007812 Z M 2058.75 183.148438 L 1880.675781 584.136719 L 1942.238281 584.136719 L 2008.234375 422.691406 L 2125.605469 423.199219 L 2190.234375 584.136719 L 2271.277344 584.136719 L 2099.449219 183.226562 Z M 2058.75 183.148438 "/></g></g><g transform="translate(3.8551 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -4.32856421446149 -1.661401981511421)"><path d="M588.43 79.8509L582.5 78.3809H582.4V152.431C582.4 170.651 578.49 184.301 560.57 185.691C535.83 187.611 534.33 168.701 534.33 152.431V78.3809H512.93V154.271C512.93 180.851 526.97 196.901 553.55 196.901C580.13 196.901 594.34 180.851 594.34 154.271V78.3809H594.29L588.43 79.8509Z"/></g></g><g transform="translate(4.7219 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -8.030530574367127 -1.835802888450144)"><path d="M2004.42 193.996L1983.67 191.122V201.903V362.052H1981.67L1873.96 191.064H1836.85V419.909H1878.31V249.847H1880.2L1988.03 419.909H2024.9V201.903V191.122L2004.42 193.996Z"/></g></g><g transform="translate(5.7438 0) scale(1)"><g transform="matrix(0.008439053643785967 0 0 0.008439053643785967 -6.325890417670046 -1.661401981511421)"><path d="M836.41 164.341C835.23 168.751 829.47 176.661 826.1 179.451C821.03 183.641 815.16 185.671 808.28 185.381C799.06 185.021 790.21 178.941 786.62 175.401C774.31 163.261 763.42 126.371 785.6 101.151C790.38 95.7213 799.06 90.4313 808.28 90.0713C815.16 89.7813 821.04 91.8113 826.1 96.0013C829.47 98.8013 835.23 106.701 836.41 111.111L850.58 110.991L856.37 95.5913C854.69 93.3213 842.2 80.1513 813.29 78.3613H811.99C806.12 78.3613 800.73 78.8913 795.85 79.7713C774.34 83.6413 757.22 100.051 752.05 121.281C750.58 127.301 749.55 133.771 749.57 140.021C749.57 141.261 749.62 142.501 749.71 143.731C751.72 171.321 773.66 193.211 801.13 196.451C802.11 196.571 803.52 196.671 805.04 196.751C814.56 197.281 824.14 196.051 833.09 192.741C847.38 187.471 854.38 179.421 855.59 177.781L850.57 164.441L836.4 164.321L836.41 164.341Z"/></g></g><g transform="translate(6.8247 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -7.397806839178519 -1.4599045865638782)"><path d="M 3259.496094 184.34375 L 3259.21875 356.253906 L 3141.863281 363.183594 L 3028.496094 355.238281 L 3028.773438 185.34375 L 2994.425781 190.695312 L 2959.082031 185.328125 L 2959.082031 584.074219 L 2991.449219 583.722656 L 3028.789062 584.074219 L 3029.003906 381.808594 L 3142.355469 380.472656 L 3258.726562 381.808594 L 3259.496094 583.109375 L 3293.84375 582.753906 L 3329.21875 583.109375 L 3329.21875 184.359375 L 3294.855469 189.714844 Z M 3259.496094 184.34375 "/></g></g><g transform="translate(8.3998 0) scale(1.12)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -6.531551848288504 -1.835802888450144)"><path d="M1582.59 274.514L1651.05 192.742H1636.78L1536.82 312.159V192.761L1515.7 195.828L1493.99 192.742V419.909H1536.82V329.69L1553.7 309.247L1614.7 419.909H1664.03L1582.59 274.514Z"/></g></g><g transform="translate(9.3625 0) scale(1)"><g transform="matrix(0.00437188995905497 0 0 0.00437188995905497 -7.51705209867612 -1.835802888450144)"><path d="M1740.19 194.304L1719.36 191.411V202.211V419.908H1760.75V202.211V191.411L1740.19 194.304Z"/></g></g><g transform="translate(9.6336 0) scale(1)"><g transform="matrix(0.002500025961207091 0 0 0.002500025961207091 -6.402239906111586 -1.4599045865638782)"><path d="M 2691.488281 583.628906 L 2758.25 583.628906 L 2758.25 204.410156 L 2888.722656 218.15625 L 2888.832031 183.714844 L 2560.910156 183.714844 L 2560.800781 217.679688 L 2691.488281 204.425781 Z M 2691.488281 583.628906 "/></g></g></g></g>
+</svg>

package/templates/database/CHANGELOG.md

@@ -1,5 +1,52 @@
 # @working-theory/database
 
+## 0.23.0
+
+### Patch Changes
+
+- Updated dependencies [[`10a9fc9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/10a9fc97455ecadb760c06d295965035b45aa605)]:
+  - @working-theory/validation@0.23.0
+
+## 0.22.1
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.22.1
+
+## 0.22.0
+
+### Minor Changes
+
+- [#5412](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/5412) [`e94f08c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e94f08cccfe6cb9d096b6746a092c1b6921677cf) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The founder application collects first name, last name and phone on step one, and records email verification when the emailed resume link is opened ([#5407](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5407)).
+
+  **Migration: `20260914120000_listing_founder_identity`.** Five nullable columns on `project_listings` — `founder_first_name`, `founder_last_name`, `founder_phone`, `email_verify_nonce_hash` and `email_verified_at` — with no backfill and no change to any existing column. `founder_name` stays NOT NULL and stays the single-line DISPLAY name every existing reader reads; the parts sit beside it, exactly as [#5279](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/5279) put the six address parts beside `address`. Composition runs one way only, so no existing row's `founder_name` is split by guessing.
+
+  The platform's default contact screen now asks first name, last name, email, phone and consent. Phone is required by default and a site relaxes it with `questions: [{ id: "founder_phone", required: false }]`. A site that still asks for one "Your name" line keeps parsing untouched: the required `founderName` contract row is satisfied either by a question writing it or by the two parts that compose it.
+
+  `POST /v1/project-listings` accepts `founderFirstName` / `founderLastName` / `founderPhone` and composes `founder_name` server-side; a body carrying only `founderName`, as every caller before this release sends, is accepted unchanged.
+
+  New anonymous, credential-gated route `POST /v1/project-listings/drafts/:id/verify-email`, reached from `projectListings.verifyEmail(id, resumeToken, verifyNonce)`. It takes two credentials, and only the second carries the proof: the resume token is in `start`'s own 201 body, so it says only that you opened the draft, while the verification NONCE is minted at `start`, stored as a digest, and handed to nothing but the resume-email builder — it reaches the outside world only as the `?verify=` parameter of the emailed link. The route stamps `email_verified_at` write-once by compare-and-swap, so repeat openings answer the first stamp; a wrong token, a wrong nonce and an unknown draft all return the same `404 not_found` the other token-gated routes return.
+
+  `ListingApplicationFlow` calls it once when it mounts with a `resume.verifyNonce`, and a failure never blocks the founder. A resume link with no nonce still resumes the draft and records nothing — which is also what a site that has not switched the resume email on gets, permanently, since no nonce is ever delivered there.
+
+  `start`'s request and response shapes are unchanged: the nonce is never in a response body and never in a log line.
+
+  `founder_phone` and `email_verified_at` are omitted from the public listing read. The operator sees both on the tenant dashboard row and in the decision/review payload, and the weekly CSV sweep's outcome log now says whether the address it mailed had been proved.
+
+### Patch Changes
+
+- Updated dependencies [[`941db5d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/941db5d317b7332c3c5bb4134d0cc18f80678781), [`cbe99c2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cbe99c228200b4720b2f36af50c822a4bcca2275), [`e94f08c`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/e94f08cccfe6cb9d096b6746a092c1b6921677cf), [`f42b96b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/f42b96b7489b5dae503b6c32e2045a14f382c583), [`4d28c33`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/4d28c33978dde5cd33540813ec6317436a42a877)]:
+  - @working-theory/ids@0.7.0
+  - @working-theory/validation@0.22.0
+
+## 0.21.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @working-theory/validation@0.21.0
+
 ## 0.20.0
 
 ### Minor Changes

package/templates/database/inbox/schema.prisma

@@ -501,8 +501,75 @@ model ProjectListing {
   // `operator-only` answer reaches the dashboard and the review payload and
   // stops there.
   siteAnswers    Json?     @map("site_answers")
+  // #5407 — still the single-line DISPLAY name, and still NOT NULL: `start`
+  // has always required one and every reader below expects one. Where the two
+  // part columns beside it are written, this is COMPOSED from them
+  // server-side (`startProjectListingDraft`); where they are not, it is the
+  // line the founder typed, verbatim.
+  //
+  // Read by: the submit-time slug fallback, the approve/reject email's
+  // greeting, the Slack review card's Founder row, the build issue, and the
+  // `routeLead` identity. None of them changes.
   founderName    String    @map("founder_name")
+  // #5407 — the structured parts of the display name above, beside it rather
+  // than instead of it, exactly as #5279 put the six address parts beside
+  // `address`. Nullable for the #5036 D1 reason and one more: a row written
+  // before #5407 has no parts, and none may ever be GUESSED from its
+  // `founder_name`. "First Last" composes one way only; a name does not
+  // decompose (a two-word split mangles "van der Berg", "Maria del Carmen"
+  // and every mononym), so the migration backfills nothing and a null part
+  // stays null for the life of the row.
+  founderFirstName String? @map("founder_first_name")
+  founderLastName  String? @map("founder_last_name")
   founderEmail   String    @map("founder_email")
+  // #5407 — the founder's phone, collected on the default contact screen
+  // alongside the email (samhenry spec 316 D1). Nullable at rest for the
+  // #5036 D1 reason AND permanently: a row written before #5407 has none, and
+  // a site may declare the question optional through its own config.
+  //
+  // NEVER on the public read: `projectListingPublicSchema` omits it beside
+  // `founderEmail`. The address on this row is a legal control a visitor is
+  // owed; a phone number is a contact detail nobody outside the operator is.
+  founderPhone   String?   @map("founder_phone")
+  // #5407 — sha-256 of the EMAIL VERIFICATION NONCE, never the nonce itself.
+  //
+  // A second credential beside `resumeTokenHash`, and the reason
+  // `emailVerifiedAt` below means what its name says. The resume token is
+  // returned to WHOEVER POSTED `start`'s FORM, so presenting it proves only
+  // that you opened the draft. This nonce is minted at `start`, digested
+  // here, and handed to nothing except the resume-email builder
+  // (`services/project-listing-resume-email.ts`): it is never in a response
+  // body, never in a log, and never in the browser that filled the form. The
+  // only way to hold it is to have read mail sent to `founder_email`.
+  //
+  // Null on every row written before #5407, and on every row whose site has
+  // not switched the resume email on — there the nonce exists and is simply
+  // never delivered, so nothing can verify, which is the correct outcome.
+  // Cleared at `submit` beside `resumeTokenHash`, for the same reason: a
+  // credential that leaks after the draft stops being a draft is inert twice
+  // over.
+  emailVerifyNonceHash String? @unique @map("email_verify_nonce_hash")
+  // #5407 — when the founder proved control of `founder_email`, by opening
+  // the link mailed to it.
+  //
+  // WRITE-ONCE. `verifyProjectListingDraftEmail` sets it only where it is
+  // still null, so a founder who opens the link five times is stamped with
+  // the FIRST opening rather than the latest.
+  //
+  // WHAT IT PROVES, and its exact limit. The stamp requires the nonce above,
+  // which left this server only inside the email. So it says the holder can
+  // read mail sent to `founder_email` — which is the whole of what "email
+  // verified" claims. It says nothing about WHO they are: `owner_user_id`
+  // (#5295) is the column that carries an identity claim, and it still needs
+  // a signed-in user whose own address the auth system verified. A row can
+  // carry either, both, or neither.
+  //
+  // Permanently nullable, and NOT a backfill target. Every row written before
+  // #5407 predates the stamp; asserting verification on one would assert
+  // exactly the thing nobody proved. Null means "not verified", never
+  // "verification failed", and it is also what a site running no resume email
+  // reads forever.
+  emailVerifiedAt DateTime? @map("email_verified_at")
   founderCompany String?   @map("founder_company")
   status         String
   // #5036 D1/D6 — when the founder ticked step one's consent box. Never null:

package/templates/database/migrations/20260914120000_listing_founder_identity/migration.sql

@@ -0,0 +1,123 @@
+-- The founder's structured identity and PROVEN email address on
+-- `project_listings` (#5407).
+--
+-- Step one of the application collected ONE `founder_name` line and an email.
+-- samhenry spec 316 D1 asks for first name, last name, email and phone, with
+-- the two name parts stored separately, and 316 D6b asks that an application
+-- whose emailed resume link was opened be marked verified so the operator can
+-- filter on it at review.
+--
+-- FIVE NULLABLE COLUMNS, NO BACKFILL, NO CHANGE TO ANY EXISTING ONE.
+--
+-- `founder_first_name` / `founder_last_name` sit BESIDE `founder_name`, not
+-- instead of it — the #5279 precedent that put six address parts beside the
+-- single-line `address`. `founder_name` stays NOT NULL and stays the DISPLAY
+-- string every existing reader already reads (the submit-time slug fallback,
+-- the approve/reject email's greeting, the Slack review card's Founder row,
+-- the build issue, the `routeLead` identity); where the parts are written the
+-- server COMPOSES it from them, and where they are not it is the line the
+-- founder typed, verbatim.
+--
+-- Composition runs ONE WAY ONLY, and that is why nothing here backfills.
+-- "First" + "Last" composes into a display line deterministically; a display
+-- line does not decompose into parts. Splitting on the last space mangles
+-- "van der Berg", "Maria del Carmen" and every mononym, and a wrong split is
+-- silent — it would put an invented surname on the row the approve email
+-- greets and the operator reviews, with nothing to mark it as invented. A
+-- null part is honest; a guessed one is not. Every existing row therefore
+-- keeps `founder_name` byte-for-byte and keeps both parts NULL for the life
+-- of the row.
+--
+-- `founder_phone` is the contact detail spec 316 D1 adds. Nullable at rest
+-- for the #5036 D1 reason — every field the submit payload requires must be
+-- storable half-filled — and nullable permanently besides: a row written
+-- before #5407 has none, and a site may declare the question optional through
+-- its own listing config. It NEVER rides the public read; the public row
+-- shape omits it beside `founder_email`.
+--
+-- `email_verify_nonce_hash` and `email_verified_at` are the verification pair,
+-- and the first is what makes the second mean what it says.
+--
+-- The obvious design is to stamp verification when the emailed resume link is
+-- opened, keyed on the resume token that link carries. That design does not
+-- work, and the reason is worth stating here because the column name does not
+-- carry it: `start` returns the resume token to WHOEVER POSTED THE FORM, in
+-- its own 201 body. The emailed link is a second copy of a credential the
+-- applicant already holds — so two HTTP calls (open a draft under a
+-- stranger's address, take the token out of the response, present it back)
+-- would forge the stamp with no mailbox involved. Caught by this PR's
+-- security review before it shipped.
+--
+-- So verification requires a SECOND credential the applicant never receives
+-- any other way. `email_verify_nonce_hash` holds the sha-256 digest of a
+-- 256-bit nonce minted at `start`, handed to nothing except the resume-email
+-- builder (apps/api/src/services/project-listing-resume-email.ts), and
+-- present in no response body and no log line. It reaches exactly one place:
+-- the `?verify=` parameter of the link inside the email. Holding it means
+-- having read mail sent to `founder_email`, which is what the stamp claims.
+--
+-- `email_verified_at` is therefore genuine evidence of address control, and
+-- is still WRITE-ONCE: the verify call sets it only where it is still NULL,
+-- by compare-and-swap, so a founder who opens the link five times is stamped
+-- with the first opening and two concurrent openings produce one stamp
+-- between them.
+--
+-- WHAT IT STILL DOES NOT SAY is who the founder is. `owner_user_id`
+-- (20260912120000_listing_owner_link) is the identity claim and needs a
+-- signed-in user whose own address the auth system verified. A row can carry
+-- either, both, or neither.
+--
+-- Neither is a backfill target. Stamping an existing row would assert exactly
+-- the event nobody recorded. NULL means "not verified", never "verification
+-- failed" — and it is also what a site that has not switched the resume email
+-- on will read forever, because the nonce is minted there and simply never
+-- delivered. That is the correct outcome, not a gap.
+--
+-- `email_verify_nonce_hash` is UNIQUE, mirroring `resume_token_hash`: two
+-- rows can never share a nonce, and the digest lookup is indexed. It is
+-- cleared at `submit` beside the resume-token digest, so a credential that
+-- leaks after the draft stops being a draft is inert twice over. It has NO
+-- EXPIRY otherwise, by design and for the reason the service records: the
+-- same message carries the resume token, so a TTL on the nonce alone would
+-- bound nothing.
+--
+-- OPERATIONAL NOTE on the index. `CREATE UNIQUE INDEX` below is not
+-- `CONCURRENTLY`, so it takes a SHARE lock and blocks writes to
+-- `project_listings` while it builds. Every existing row is NULL there and
+-- Postgres treats NULLs as distinct in a unique index (no NULLS NOT
+-- DISTINCT), so it cannot fail on existing data and builds fast — and the
+-- same property is why `submit` setting many rows back to NULL never
+-- collides. Stated so whoever runs this against a large table knows it is
+-- write-blocking DDL; it matches the `resume_token_hash` precedent.
+--
+-- Distinct from `owner_user_id` (20260912120000_listing_owner_link), which
+-- needs a SIGNED-IN user whose own address the auth system verified. This
+-- column needs no account at all: it records that a capability sent to
+-- `founder_email` came back. A row can carry either, both, or neither.
+--
+-- NO INDEX on the other four. The verify write is keyed by the row's primary
+-- key plus two digests, both already UNIQUE, and the operator filters
+-- verified applications inside a site's already-indexed page of listings
+-- (`project_listings_site_id_status_idx`) rather than by scanning on
+-- `email_verified_at`.
+--
+-- Forward-additive only: all five columns are nullable with no default, so
+-- every existing read and write is unaffected.
+--
+-- Rollback:
+--   DROP INDEX "project_listings_email_verify_nonce_hash_key";
+--   ALTER TABLE "project_listings" DROP COLUMN "email_verified_at";
+--   ALTER TABLE "project_listings" DROP COLUMN "email_verify_nonce_hash";
+--   ALTER TABLE "project_listings" DROP COLUMN "founder_phone";
+--   ALTER TABLE "project_listings" DROP COLUMN "founder_last_name";
+--   ALTER TABLE "project_listings" DROP COLUMN "founder_first_name";
+
+-- AlterTable
+ALTER TABLE "project_listings" ADD COLUMN     "founder_first_name" TEXT,
+ADD COLUMN     "founder_last_name" TEXT,
+ADD COLUMN     "founder_phone" TEXT,
+ADD COLUMN     "email_verify_nonce_hash" TEXT,
+ADD COLUMN     "email_verified_at" TIMESTAMP(3);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "project_listings_email_verify_nonce_hash_key" ON "project_listings"("email_verify_nonce_hash");

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.20.0",
+  "version": "0.23.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/package.json

@@ -60,7 +60,7 @@
     "yaml": "^2.9.0",
     "zod": "^4.2.1",
     "zod-to-ts": "^2.1.0",
-    "@working-theory/cli": "^0.20.0"
+    "@working-theory/cli": "^0.23.0"
   },
   "lint-staged": {
     "*.{ts,tsx}": [