create-ailk 0.20.0 → 0.22.0

package/templates/apps/web/messages/en.json

@@ -73,12 +73,19 @@
   },
   "about": {
     "heading": "About",
-    "emptyState": "About page content coming soon."
+    "emptyState": "About page content coming soon.",
+    "viewProfile": "View profile"
   },
   "blog": {
     "heading": "Blog",
     "emptyState": "No posts yet. Drop MDX files into",
-    "emptyStateTrailing": "to populate this list."
+    "emptyStateTrailing": "to populate this list.",
+    "allTopics": "All",
+    "topicsNav": "Blog topics",
+    "latestPosts": "Latest posts",
+    "previousPosts": "Previous posts",
+    "readMore": "Read more",
+    "sidebar": "More from this site"
   },
   "docs": {
     "heading": "Docs",
@@ -87,7 +94,8 @@
   },
   "careers": {
     "heading": "Careers",
-    "emptyState": "Career listings coming soon."
+    "emptyState": "Career listings coming soon.",
+    "applicationSuccess": "Thank you for applying! We have your application and will be in touch."
   },
   "case-studies": {
     "heading": "Case Studies",
@@ -118,7 +126,9 @@
     "sending": "Sending…",
     "sendMessage": "Send message",
     "successMessage": "Thank you for reaching out! We will be in touch shortly.",
-    "consentStatement": "I accept the [Terms](terms).",
+    "trackInAccount": "Track this in your account",
+    "consentStatement": "I accept the [Terms](terms), [Privacy Policy](privacy), and [Working Agreement](working_agreement).",
+    "consentRequired": "Please accept the terms to send your message.",
     "genericError": "Something went wrong, please try again.",
     "unavailableHeading": "Get in touch",
     "unavailableBody": "Email us at {email} and we'll reply.",
@@ -132,8 +142,12 @@
       "namePrompt": "What's your name?",
       "messageAck": "Good to meet you.",
       "messagePrompt": "What are you hoping to get done?",
-      "emailAck": "Got it — last one.",
+      "emailAck": "Got it.",
       "emailPrompt": "What's the best email to reach you at?",
+      "consentAck": "Thanks — one last thing.",
+      "consentPrompt": "Do you accept our Terms, Privacy Policy and Working Agreement? They're linked at the foot of every page.",
+      "consentAccept": "Yes, I accept",
+      "consentDecline": "Not yet",
       "skipMessage": "No worries — here's our form instead.",
       "completionMessage": "Thanks! We'll be in touch shortly.",
       "submitError": "We couldn't send that automatically — please review and send below."
@@ -304,7 +318,8 @@
   },
   "checkoutThankYou": {
     "title": "Thank you",
-    "body": "Your payment went through. We'll email you a receipt and the next steps."
+    "body": "Your payment went through. We'll email you a receipt and the next steps.",
+    "openAccount": "Open your account"
   },
   "checkoutUnavailable": {
     "title": "Checkout isn't available right now",
@@ -317,9 +332,8 @@
     "emptyState": "Resources listing coming soon."
   },
   "schedule": {
-    "title": "Book a call",
+    "heading": "Book time with me",
     "description": "Pick a time that works for you.",
-    "eyebrow": "Book a call",
     "headline": "Pick a time that works",
     "confirmed": {
       "title": "You're booked",
@@ -352,6 +366,10 @@
     "heading": "Terms of Service",
     "emptyState": "Terms of service content coming soon."
   },
+  "workingAgreement": {
+    "heading": "Working Agreement",
+    "emptyState": "Working agreement content coming soon."
+  },
   "testimonials": {
     "heading": "Testimonials",
     "emptyState": "Testimonials coming soon."
@@ -488,8 +506,7 @@
   "signIn": {
     "title": "Sign in",
     "description": "Sign in to your account.",
-    "heading": "Sign in to your account",
-    "subhead": "Welcome back. Choose how you'd like to continue.",
+    "heading": "Welcome back",
     "notConfiguredSubhead": "Sign-in is not configured for this site yet. Set a provider's environment variables to enable it.",
     "ssoPrefix": "Sign in with",
     "google": "Google",
@@ -509,7 +526,14 @@
     "emailLinkSentBody": "If an account uses that address, a sign-in link is on its way. It works once and expires in 5 minutes.",
     "emailLinkFailed": "We couldn't send a sign-in link. Try again.",
     "emailLinkRateLimited": "Too many requests. Wait a minute, then try again.",
-    "emailLinkExpired": "That sign-in link has expired or was already used. Request a new one."
+    "emailLinkExpired": "That sign-in link has expired or was already used. Request a new one.",
+    "useEmailLink": "Email me a sign-in link instead",
+    "emailPlaceholder": "you@example.com",
+    "backTo": "Back to {site}",
+    "acknowledgement": "You acknowledge that you read and agree to our",
+    "termsLink": "Terms of Service",
+    "privacyLink": "Privacy Policy",
+    "workingAgreementLink": "Working Agreement"
   },
   "auth": {
     "signUpTitle": "Create an account",
@@ -535,6 +559,7 @@
     "signUpFooterPrompt": "Already have an account?",
     "signUpFooterLink": "Sign in",
     "signUpAgreementsLegend": "Agreements",
+    "signUpAgreementsRequired": "Accept the agreements to create an account.",
     "signUpNotConfiguredSubhead": "Sign-up is not configured for this site yet. Set a provider's environment variables to enable it.",
     "signUpFailed": "We couldn't create your account. Check your details and try again.",
     "providerFailed": "We couldn't start sign-up with that provider. Try again.",
@@ -841,7 +866,9 @@
     "agreements": {
       "titleNew": "Please accept our terms",
       "titleUpdated": "We've updated our terms",
+      "lead": "To keep using your account, accept the agreements below.",
       "accept": "Accept",
+      "signOut": "Sign out",
       "error": "We couldn't save that. Try again."
     },
     "gate": {
@@ -851,7 +878,8 @@
       "homeLink": "Back to the site",
       "hubHeadline": "Sign in to your account",
       "hubDescription": "You sign in on our main site, then come straight back here.",
-      "hubSignIn": "Sign in"
+      "hubSignIn": "Sign in",
+      "title": "Sign in"
     },
     "profile": {
       "email": "Email",

package/templates/apps/web/package.json

@@ -30,6 +30,7 @@
     "@working-theory/schema-pack-registry": "workspace:*",
     "@working-theory/schema-validator": "workspace:*",
     "@working-theory/site-config": "workspace:*",
+    "@working-theory/spoke-checkout": "workspace:*",
     "@working-theory/templates": "workspace:*",
     "@working-theory/theme": "workspace:*",
     "@working-theory/ui": "workspace:*",

package/templates/apps/web/src/lib/__tests__/lead-write.test.ts

@@ -0,0 +1,187 @@
+/**
+ * The site's one lead writer (#8747): every lead carries `payload.site` (from
+ * `AILK_LEAD_SITE`) and `payload.page`, spread last so no caller field can
+ * override them; no `siteId` is sent (the hub names the tenant itself); only
+ * the visitor and consent-visitor headers are forwarded; a thrown submit
+ * resolves as `{ ok: false, status: 0 }` and logs no field value.
+ */
+jest.mock("@working-theory/api-client", () => ({
+  leads: { submit: jest.fn() },
+}));
+
+import { leads } from "@working-theory/api-client";
+
+import { writeLead } from "../lead-write";
+
+const mockSubmit = leads.submit as jest.Mock;
+const priorSite = process.env.AILK_LEAD_SITE;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  if (priorSite === undefined) delete process.env.AILK_LEAD_SITE;
+  else process.env.AILK_LEAD_SITE = priorSite;
+});
+
+type Body = { siteId?: unknown; source: string; email: string; payload: Record<string, unknown> };
+
+function sentBody(): Body {
+  return mockSubmit.mock.calls[0][0] as Body;
+}
+
+describe("writeLead — the site marker", () => {
+  it("marks payload.site from AILK_LEAD_SITE and payload.page from the caller, and sends no siteId", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res.ok).toBe(true);
+    expect(sentBody()).toEqual({
+      source: "contact-form",
+      email: "jane@example.com",
+      payload: { name: "Jane", site: "wendihenry", page: "contact" },
+    });
+    expect(sentBody()).not.toHaveProperty("siteId");
+  });
+
+  it("a caller's own site or page field never overrides the marker", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { site: "attacker", page: "checkout" },
+    });
+
+    expect(sentBody().payload).toEqual({ site: "wendihenry", page: "contact" });
+  });
+
+  it("trims AILK_LEAD_SITE", async () => {
+    process.env.AILK_LEAD_SITE = "  wendihenry\n";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(sentBody().payload.site).toBe("wendihenry");
+  });
+
+  it.each([
+    ["unset", undefined],
+    ["empty", ""],
+    ["blank", "   "],
+  ])("with AILK_LEAD_SITE %s, writes no site — and drops a caller's own site", async (_label, value) => {
+    if (value === undefined) delete process.env.AILK_LEAD_SITE;
+    else process.env.AILK_LEAD_SITE = value;
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane", site: "attacker" },
+    });
+
+    expect(sentBody().payload).toEqual({ name: "Jane", page: "contact" });
+  });
+});
+
+describe("writeLead — forwarded headers", () => {
+  it("forwards only the visitor and consent-visitor headers", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      {
+        headers: {
+          "x-ailk-visitor-ip": "203.0.113.5",
+          "x-ailk-visitor-forward-key": "k",
+          "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+          "x-ailk-spoke-key": "forged",
+          "content-type": "text/plain",
+        },
+      },
+    );
+
+    expect(mockSubmit.mock.calls[0][1]).toEqual({
+      headers: {
+        "x-ailk-visitor-ip": "203.0.113.5",
+        "x-ailk-visitor-forward-key": "k",
+        "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+      },
+    });
+  });
+
+  it("calls leads.submit with one argument when no header survives", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      { headers: { "x-ailk-spoke-key": "forged" } },
+    );
+
+    expect(mockSubmit.mock.calls[0]).toHaveLength(1);
+  });
+});
+
+describe("writeLead — a thrown submit", () => {
+  it("resolves as status 0 and logs the error name only", async () => {
+    mockSubmit.mockRejectedValueOnce(new TypeError("fetch failed for jane@example.com"));
+    const spy = jest.spyOn(console, "error").mockImplementation(() => undefined);
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res).toEqual({ ok: false, status: 0, body: null });
+    const logged = spy.mock.calls.flat().map(String).join(" ");
+    expect(logged).toContain("TypeError");
+    expect(logged).not.toContain("jane@example.com");
+    expect(logged).not.toContain("Jane");
+    spy.mockRestore();
+  });
+
+  it("passes the api-client's own failure through unchanged", async () => {
+    const failure = { ok: false, status: 503, body: { error: "lead_capture_not_configured" } };
+    mockSubmit.mockResolvedValueOnce(failure);
+
+    expect(
+      await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" }),
+    ).toEqual(failure);
+  });
+});
+
+describe("writeLead — terms acceptance (#8730)", () => {
+  it("sends consent: true at the top level when the caller says the terms were accepted", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      consent: true,
+      payload: { name: "Jane" },
+    });
+
+    const body = mockSubmit.mock.calls[0][0] as Record<string, unknown>;
+    expect(body["consent"]).toBe(true);
+    expect((body["payload"] as Record<string, unknown>)["consent"]).toBeUndefined();
+  });
+
+  it("sends no consent key at all when the caller does not set it", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(mockSubmit.mock.calls[0][0]).not.toHaveProperty("consent");
+  });
+});

package/templates/apps/web/src/lib/__tests__/rate-limit.test.ts

@@ -0,0 +1,67 @@
+/**
+ * The per-visitor limiter the /contact action runs before it writes a lead
+ * (#8747): a fixed window per key, refusing the call past the limit, and a
+ * client address read from the platform's own headers.
+ */
+import {
+  __resetRateLimit,
+  checkRateLimit,
+  clientIpFromHeaders,
+} from "../rate-limit";
+
+const WINDOW_MS = 10 * 60 * 1000;
+
+function headersOf(values: Record<string, string>): { get(name: string): string | null } {
+  return { get: (name) => values[name] ?? null };
+}
+
+afterEach(() => {
+  __resetRateLimit();
+  jest.useRealTimers();
+});
+
+describe("checkRateLimit", () => {
+  it("admits exactly `limit` calls in a window and refuses the next", () => {
+    for (let i = 0; i < 30; i += 1) {
+      expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(true);
+    }
+    expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(false);
+  });
+
+  it("counts each key on its own", () => {
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+    expect(checkRateLimit("contact:b", 30, WINDOW_MS)).toBe(true);
+  });
+
+  it("opens a new window once the old one ends", () => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date("2026-10-15T10:00:00Z"));
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+
+    jest.setSystemTime(new Date("2026-10-15T10:10:00Z"));
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(true);
+  });
+});
+
+describe("clientIpFromHeaders", () => {
+  it("prefers x-vercel-forwarded-for, first value", () => {
+    expect(
+      clientIpFromHeaders(
+        headersOf({
+          "x-vercel-forwarded-for": "198.51.100.7, 10.0.0.1",
+          "x-forwarded-for": "203.0.113.5",
+        }),
+      ),
+    ).toBe("198.51.100.7");
+  });
+
+  it("falls back to x-forwarded-for, then x-real-ip, then unknown", () => {
+    expect(clientIpFromHeaders(headersOf({ "x-forwarded-for": "203.0.113.5, 10.0.0.1" }))).toBe(
+      "203.0.113.5",
+    );
+    expect(clientIpFromHeaders(headersOf({ "x-real-ip": "192.0.2.9" }))).toBe("192.0.2.9");
+    expect(clientIpFromHeaders(headersOf({}))).toBe("unknown");
+  });
+});

package/templates/apps/web/src/lib/lead-write.ts

@@ -0,0 +1,90 @@
+/**
+ * lead-write.ts — this site's lead writer (#8747): the /contact action writes
+ * through it, and so can any other page that writes a lead.
+ *
+ * A lead goes to `POST /v1/leads/submit` through `@working-theory/api-client`.
+ * The API resolves the lead's workspace itself — from the spoke key on a hub,
+ * from its own site alias otherwise — and ignores a body `siteId`, so none is
+ * sent. The site marks itself in the payload instead: `payload.site` is
+ * `AILK_LEAD_SITE` (the same variable `apps/mcp`'s `capture_lead` reads,
+ * `LEAD_SITE_MARKER_KEY`) and `payload.page` the page key, both spread LAST so
+ * no caller field can override them. With `AILK_LEAD_SITE` unset or blank the
+ * lead carries no `site` at all — a caller's own `site` is dropped, never sent.
+ *
+ * The marker is attribution, not authorization: the route is public and a
+ * direct caller can write any `payload.site`. Nothing may gate on it.
+ *
+ * Terms acceptance (#8730): a caller that collected the visitor's acceptance
+ * passes `consent: true`, sent as the body's top-level `consent`. The API
+ * refuses a contact lead without it and records `payload.consent` itself, so
+ * nothing about the acceptance is written into the payload here.
+ *
+ * Forwarded headers: only the two `visitorForwardHeaders` builds (#7394) and
+ * the consent-visitor id (#8438 D12) reach the api-client, so no caller can
+ * set its own `x-ailk-spoke-key` or `content-type`. With none of the three,
+ * `leads.submit` is called with one argument.
+ *
+ * Never throws. The api-client's own result passes through unchanged, so a
+ * caller still reads the API's 503 `lead_capture_not_configured`. A thrown
+ * submit — the API could not be reached — resolves as
+ * `{ ok: false, status: 0, body: null }` and logs the error's NAME only: its
+ * message could echo the payload.
+ */
+import { leads } from "@working-theory/api-client";
+import { LEAD_SITE_MARKER_KEY } from "@working-theory/validation";
+
+export interface LeadWriteInput {
+  source: string;
+  email: string;
+  /** The page key the marker carries, e.g. `contact` or `checkout`. */
+  page: string;
+  /** The visitor accepted the terms (#8730). Sent only when `true`. */
+  consent?: boolean;
+  payload?: Record<string, unknown>;
+}
+
+type SubmitInit = Parameters<typeof leads.submit>[1];
+type SubmitResult = Awaited<ReturnType<typeof leads.submit>>;
+
+/** The only request headers a lead write forwards. */
+const FORWARDED_HEADERS = [
+  "x-ailk-visitor-ip",
+  "x-ailk-visitor-forward-key",
+  "x-ailk-consent-visitor",
+] as const;
+
+function forwardOnly(init: SubmitInit): SubmitInit {
+  const headers: Record<string, string> = {};
+  for (const name of FORWARDED_HEADERS) {
+    const value = init?.headers?.[name];
+    if (typeof value === "string") headers[name] = value;
+  }
+  return Object.keys(headers).length > 0 ? { headers } : undefined;
+}
+
+/** The site marker from configuration, or `undefined` when unset or blank. */
+function leadSite(): string | undefined {
+  return process.env.AILK_LEAD_SITE?.trim() || undefined;
+}
+
+export async function writeLead(input: LeadWriteInput, init?: SubmitInit): Promise<SubmitResult> {
+  const site = leadSite();
+  const { [LEAD_SITE_MARKER_KEY]: _callerSite, ...callerPayload } = input.payload ?? {};
+  const body = {
+    source: input.source,
+    email: input.email,
+    ...(input.consent === true && { consent: true }),
+    payload: {
+      ...callerPayload,
+      ...(site && { [LEAD_SITE_MARKER_KEY]: site }),
+      page: input.page,
+    },
+  };
+  const forward = forwardOnly(init);
+  try {
+    return forward ? await leads.submit(body, forward) : await leads.submit(body);
+  } catch (err) {
+    console.error(`[lead-write] submit failed: ${err instanceof Error ? err.name : "unknown"}`);
+    return { ok: false, status: 0, body: null };
+  }
+}

package/templates/apps/web/src/lib/rate-limit.ts

@@ -0,0 +1,79 @@
+/**
+ * rate-limit.ts — a best-effort, in-memory, per-instance limiter (#8747).
+ *
+ * The /contact Server Action runs it before it writes a lead. From a server
+ * action the hub sees this site's own egress address, so without a limit
+ * here one visitor could drain the hub's per-IP budget for every visitor of
+ * the site. Brought upstream from the consumer sites' copies
+ * (salessmyth/samhenry, salessmyth/wendihenry `apps/web/src/lib/rate-limit.ts`).
+ *
+ * NOT a distributed limiter: state lives in one serverless instance's memory
+ * and resets on a cold start. It raises the bar against a flood on one warm
+ * instance; it does not stop one spread across many. The hub keeps its own
+ * per-IP limit on the route.
+ */
+
+type Bucket = { count: number; resetAt: number };
+
+const buckets = new Map<string, Bucket>();
+
+// Bound the map so a caller rotating keys (spoofed addresses) cannot grow it
+// without limit between resets.
+const MAX_TRACKED_KEYS = 5000;
+
+/** Test-only reset. Not reachable from a request. */
+export function __resetRateLimit(): void {
+  buckets.clear();
+}
+
+/**
+ * Fixed-window check. `true` when the caller is under `limit` in the current
+ * window (and counts the call); `false` once it has used `limit` calls.
+ */
+export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
+  const now = Date.now();
+  const existing = buckets.get(key);
+
+  if (!existing || existing.resetAt <= now) {
+    if (buckets.size >= MAX_TRACKED_KEYS) pruneExpired(now);
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return true;
+  }
+
+  if (existing.count >= limit) return false;
+
+  existing.count += 1;
+  return true;
+}
+
+function pruneExpired(now: number): void {
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) buckets.delete(key);
+  }
+  // Nothing expired (keys rotated inside one window): evict the oldest entry
+  // — `Map` iterates in insertion order — so the bound always holds.
+  if (buckets.size >= MAX_TRACKED_KEYS) {
+    const oldestKey = buckets.keys().next().value;
+    if (oldestKey !== undefined) buckets.delete(oldestKey);
+  }
+}
+
+/** The subset of Next's `headers()` the address read needs. */
+export interface HeaderReader {
+  get(name: string): string | null;
+}
+
+/**
+ * The visitor's address, coarse: `x-vercel-forwarded-for`, else
+ * `x-forwarded-for`, else `x-real-ip` (first value of each), else
+ * `"unknown"`. Vercel's edge overwrites these with the connecting address;
+ * behind an edge that appends instead, a caller chooses its own key. An
+ * abuse-throttling key only — never an authorization decision.
+ */
+export function clientIpFromHeaders(headers: HeaderReader): string {
+  for (const name of ["x-vercel-forwarded-for", "x-forwarded-for"]) {
+    const value = headers.get(name);
+    if (value) return value.split(",")[0]?.trim() || "unknown";
+  }
+  return headers.get("x-real-ip") || "unknown";
+}

package/templates/database/CHANGELOG.md

@@ -1,5 +1,52 @@
 # @working-theory/database
 
+## 0.43.0
+
+### Minor Changes
+
+- [#8775](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8775) [`ee8e713`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ee8e713b8194e8d65052f4b1dca928ca0c970318) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A per-magnet completion setting — lead only, invite to account, or continue to checkout ([#8757](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8757), Phase 1).
+
+  - **`@working-theory/database`** — `flow_definitions` gains `completion` (`lead` | `invite` | `checkout`, default `lead`) and `checkout_offering`, closed by three CHECKs. The migration backfills `onboarding`, `request-quote` and `job-application` to `invite` by slug; `contact` and every other magnet stay `lead`. Deploy the migration before the API.
+  - **`@working-theory/validation`** — `flow-completion.ts`: `FLOW_COMPLETIONS`, `flowCompletionSettingSchema`, `flowCheckoutOfferingSchema`, `STANDARD_MAGNET_COMPLETIONS`, `leadSubmitNextSchema`, `accountEmailHintSchema`, `accountInvitePath`, the invite caps and the email defaults.
+  - **`@working-theory/api-client`** — `Magnet` carries `completion` and `checkoutOffering`, `MagnetUpdateInput` can set them, and `LeadWriteResponse` gains an optional `next`.
+  - **`@working-theory/ui`** — `AuthCard` takes an optional `defaultEmail`; `LeadCaptureFormState`'s success state takes an optional `next` link.
+  - **`@working-theory/analytics`** — `email` and `login_hint` are scrubbed from URLs like `session_id`.
+  - **`create-ailk`** — the API: the magnet PATCH writes the setting alone (`checkout` needs a person, the `commerce` claim and a published offering) and every full row serves it; a `flow:<slug>` submit to an `invite` magnet answers `next` and sends one capped confirmation email whose link starts sign-in with the address prefilled. The web: /contact's thank-you shows "Track this in your account", and sign-in opens with a hinted email on a site and through the hub. The Admin: one "When someone submits" control on the magnet page.
+
+- [#8807](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8807) [`956bfe6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/956bfe60fff4bd9a43135e6a2fb79e6f012e14f8) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Every hosted Stripe Checkout session collects terms acceptance, and a completed checkout records a dated grant for the buyer ([#8765](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8765), PR B).
+
+  - **`@working-theory/stripe-client`** — both session creators set `consent_collection.terms_of_service: "required"` and a `custom_text.terms_of_service_acceptance` message: the site's account-terms sentence with its Terms, Privacy Policy and Working Agreement links resolved on the session's own return origin. Every session is stamped `metadata.ailk_terms` (`account_terms@2` by default). An optional `termsOfService` input overrides the sentence and its links. A Stripe refusal for a missing Terms URL is rethrown as `TermsOfServiceUrlMissingError`. **Precondition:** the seller's Stripe account needs a Terms of Service URL in its Dashboard's Public details, or Stripe refuses every session with the box.
+  - **`@working-theory/validation`** — `CONSENT_SOURCES` gains `checkout`.
+  - **`@working-theory/database`** — a migration widens the `consent_grants_source_known` CHECK to the eight sources. It writes no row.
+  - **`create-ailk`** — the API: the hub's `checkout.session.completed` webhook records one `checkout` grant per session for the buyer's Person when the session carries the terms stamp and Stripe recorded the consent as accepted. A checkout row is an unverified (any-source) row. The Admin labels the source "Checkout".
+
+### Patch Changes
+
+- [#8767](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8767) [`5ff341d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5ff341d683d35a024fc1073c1b010aa56956a1d2) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A JobPosting names where to apply, and a standard Job application magnet is seeded like the Contact form and drawn on every job page ([#8746](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8746)).
+
+  - **`@working-theory/schema`** — `ContentPageInput` gains an optional `origin` (the site's origin, passed by the caller; the package never reads the environment for it). When it is present, the JobPosting builder puts a `potentialAction` `ApplyAction` on the JobPosting whose `target` is the job page's own URL plus `#apply`: `<origin>/<locale>/careers/<slug>#apply`, the same form the page's BreadcrumbList uses. `buildJobPostingNode` takes an optional `applyUrl`. Every other builder ignores `origin`, so CareersList keeps its ItemList unchanged.
+  - **`@working-theory/page-renderer`** — `toContentPageInput` passes the render's origin (the one the BreadcrumbList is built from).
+  - **`@working-theory/validation`** — the magnet's one source: `JOB_APPLICATION_FLOW_SLUG` (`job-application`), `JOB_APPLICATION_FLOW_TITLE`, `JOB_APPLICATION_LANDING_PAGE` (`/careers`) and `jobApplicationFlowConfig` — one field step of First name, Last name and Email (required), Phone (`tel`) and LinkedIn URL (`url`). `RESERVED_FLOW_SLUGS` gains `job-application`, so no flow-engine write, spoke seed or new listing takes it.
+  - **`@working-theory/database`** — the database seed writes the default workspace's Job application magnet: `diagnostic`, `live`, landing page `/careers`, insert-only.
+  - **`create-ailk`** — the API seeds the magnet into every workspace insert-only (after `POST /v1/workspaces` and from the seed-presets CLI for existing workspaces), a magnet can be neither renamed from nor to `job-application`, and `GET /v1/content/:type/:slug` passes `_site.mdx`'s `baseUrl` as the origin, so the API's JobPosting JSON-LD carries the ApplyAction too. Each job page `/careers/<slug>` renders the magnet's field step under an `#apply` anchor, falling back to the same built-in form when the magnet is absent or off; a submission is a `flow:job-application` lead whose `name` is first + last and whose hidden `job` is the posting's slug, and the form thanks the applicant with the `careers` catalog's own `applicationSuccess` line. The `/careers` index carries no form.
+
+- [#8788](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8788) [`3a89742`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3a89742f7b816deca6cd604863f2fd041a79abfa) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The standard magnets are seeded with their completion setting ([#8759](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8759)), so a workspace created after the [#8757](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8757) migration no longer depends on its backfill.
+
+  - **`@working-theory/database`** — the database seed writes `completion` on the default workspace's magnets: `invite` on `request-quote` and `job-application`, `lead` on `contact`. On a fresh install the migration's backfill runs before the seed and finds no rows.
+  - **`create-ailk`** — the API's insert-only seed writes `lead` on the Contact form and `invite` on the onboarding and Job application magnets, and `POST /v1/workspaces` creates the `request-quote` magnet at `invite`.
+
+- Updated dependencies [[`5032b3e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5032b3eefb05bbe67ebddf1b4b07904717100472), [`5ff341d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5ff341d683d35a024fc1073c1b010aa56956a1d2), [`ee8e713`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ee8e713b8194e8d65052f4b1dca928ca0c970318), [`c74bd72`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74bd7270fa2cb82bebedfb1b53f89ca6e09917f), [`956bfe6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/956bfe60fff4bd9a43135e6a2fb79e6f012e14f8), [`97237f2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/97237f278006a43e17d58709ed9ac3b4f62ae76f), [`1eb9688`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/1eb9688708dbc65cd4e2fdb6efeb40880e1606f0), [`b001413`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/b001413238973f4ecb3d4a5a18968cd7732210d8)]:
+  - @working-theory/validation@0.43.0
+
+## 0.42.0
+
+### Patch Changes
+
+- [#8740](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8740) [`d1461bf`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d1461bff10a69aa4cf05627e393bd1902c358b00) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The database seed writes the default workspace's Contact form magnet ([#8661](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8661)): one live contact-kind magnet at slug `contact`, insert-only, so `/contact` reads it on a freshly seeded site.
+
+- Updated dependencies [[`cb2f3a5`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/cb2f3a50c38fe77b92aa52d1462d3d11a5981981), [`425e253`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/425e2538dfd22dfb6f0b6439d473fa2aafcbb883), [`da9253b`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/da9253bb6f8c792e7e75cfe1c1a7bba5ca569e26), [`df1b8e4`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/df1b8e485f9cdd1885925430b7aaa186ffdf6ac1), [`d4e0598`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/d4e0598c7659d9349bd56ba184e4ab941e3fde62)]:
+  - @working-theory/validation@0.42.0
+
 ## 0.41.0
 
 ### Minor Changes