create-ailk 0.21.0 → 0.22.0

package/templates/apps/web/src/lib/__tests__/lead-write.test.ts

@@ -0,0 +1,187 @@
+/**
+ * The site's one lead writer (#8747): every lead carries `payload.site` (from
+ * `AILK_LEAD_SITE`) and `payload.page`, spread last so no caller field can
+ * override them; no `siteId` is sent (the hub names the tenant itself); only
+ * the visitor and consent-visitor headers are forwarded; a thrown submit
+ * resolves as `{ ok: false, status: 0 }` and logs no field value.
+ */
+jest.mock("@working-theory/api-client", () => ({
+  leads: { submit: jest.fn() },
+}));
+
+import { leads } from "@working-theory/api-client";
+
+import { writeLead } from "../lead-write";
+
+const mockSubmit = leads.submit as jest.Mock;
+const priorSite = process.env.AILK_LEAD_SITE;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  if (priorSite === undefined) delete process.env.AILK_LEAD_SITE;
+  else process.env.AILK_LEAD_SITE = priorSite;
+});
+
+type Body = { siteId?: unknown; source: string; email: string; payload: Record<string, unknown> };
+
+function sentBody(): Body {
+  return mockSubmit.mock.calls[0][0] as Body;
+}
+
+describe("writeLead — the site marker", () => {
+  it("marks payload.site from AILK_LEAD_SITE and payload.page from the caller, and sends no siteId", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res.ok).toBe(true);
+    expect(sentBody()).toEqual({
+      source: "contact-form",
+      email: "jane@example.com",
+      payload: { name: "Jane", site: "wendihenry", page: "contact" },
+    });
+    expect(sentBody()).not.toHaveProperty("siteId");
+  });
+
+  it("a caller's own site or page field never overrides the marker", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { site: "attacker", page: "checkout" },
+    });
+
+    expect(sentBody().payload).toEqual({ site: "wendihenry", page: "contact" });
+  });
+
+  it("trims AILK_LEAD_SITE", async () => {
+    process.env.AILK_LEAD_SITE = "  wendihenry\n";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(sentBody().payload.site).toBe("wendihenry");
+  });
+
+  it.each([
+    ["unset", undefined],
+    ["empty", ""],
+    ["blank", "   "],
+  ])("with AILK_LEAD_SITE %s, writes no site — and drops a caller's own site", async (_label, value) => {
+    if (value === undefined) delete process.env.AILK_LEAD_SITE;
+    else process.env.AILK_LEAD_SITE = value;
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane", site: "attacker" },
+    });
+
+    expect(sentBody().payload).toEqual({ name: "Jane", page: "contact" });
+  });
+});
+
+describe("writeLead — forwarded headers", () => {
+  it("forwards only the visitor and consent-visitor headers", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      {
+        headers: {
+          "x-ailk-visitor-ip": "203.0.113.5",
+          "x-ailk-visitor-forward-key": "k",
+          "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+          "x-ailk-spoke-key": "forged",
+          "content-type": "text/plain",
+        },
+      },
+    );
+
+    expect(mockSubmit.mock.calls[0][1]).toEqual({
+      headers: {
+        "x-ailk-visitor-ip": "203.0.113.5",
+        "x-ailk-visitor-forward-key": "k",
+        "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+      },
+    });
+  });
+
+  it("calls leads.submit with one argument when no header survives", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      { headers: { "x-ailk-spoke-key": "forged" } },
+    );
+
+    expect(mockSubmit.mock.calls[0]).toHaveLength(1);
+  });
+});
+
+describe("writeLead — a thrown submit", () => {
+  it("resolves as status 0 and logs the error name only", async () => {
+    mockSubmit.mockRejectedValueOnce(new TypeError("fetch failed for jane@example.com"));
+    const spy = jest.spyOn(console, "error").mockImplementation(() => undefined);
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res).toEqual({ ok: false, status: 0, body: null });
+    const logged = spy.mock.calls.flat().map(String).join(" ");
+    expect(logged).toContain("TypeError");
+    expect(logged).not.toContain("jane@example.com");
+    expect(logged).not.toContain("Jane");
+    spy.mockRestore();
+  });
+
+  it("passes the api-client's own failure through unchanged", async () => {
+    const failure = { ok: false, status: 503, body: { error: "lead_capture_not_configured" } };
+    mockSubmit.mockResolvedValueOnce(failure);
+
+    expect(
+      await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" }),
+    ).toEqual(failure);
+  });
+});
+
+describe("writeLead — terms acceptance (#8730)", () => {
+  it("sends consent: true at the top level when the caller says the terms were accepted", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      consent: true,
+      payload: { name: "Jane" },
+    });
+
+    const body = mockSubmit.mock.calls[0][0] as Record<string, unknown>;
+    expect(body["consent"]).toBe(true);
+    expect((body["payload"] as Record<string, unknown>)["consent"]).toBeUndefined();
+  });
+
+  it("sends no consent key at all when the caller does not set it", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(mockSubmit.mock.calls[0][0]).not.toHaveProperty("consent");
+  });
+});

package/templates/apps/web/src/lib/__tests__/rate-limit.test.ts

@@ -0,0 +1,67 @@
+/**
+ * The per-visitor limiter the /contact action runs before it writes a lead
+ * (#8747): a fixed window per key, refusing the call past the limit, and a
+ * client address read from the platform's own headers.
+ */
+import {
+  __resetRateLimit,
+  checkRateLimit,
+  clientIpFromHeaders,
+} from "../rate-limit";
+
+const WINDOW_MS = 10 * 60 * 1000;
+
+function headersOf(values: Record<string, string>): { get(name: string): string | null } {
+  return { get: (name) => values[name] ?? null };
+}
+
+afterEach(() => {
+  __resetRateLimit();
+  jest.useRealTimers();
+});
+
+describe("checkRateLimit", () => {
+  it("admits exactly `limit` calls in a window and refuses the next", () => {
+    for (let i = 0; i < 30; i += 1) {
+      expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(true);
+    }
+    expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(false);
+  });
+
+  it("counts each key on its own", () => {
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+    expect(checkRateLimit("contact:b", 30, WINDOW_MS)).toBe(true);
+  });
+
+  it("opens a new window once the old one ends", () => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date("2026-10-15T10:00:00Z"));
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+
+    jest.setSystemTime(new Date("2026-10-15T10:10:00Z"));
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(true);
+  });
+});
+
+describe("clientIpFromHeaders", () => {
+  it("prefers x-vercel-forwarded-for, first value", () => {
+    expect(
+      clientIpFromHeaders(
+        headersOf({
+          "x-vercel-forwarded-for": "198.51.100.7, 10.0.0.1",
+          "x-forwarded-for": "203.0.113.5",
+        }),
+      ),
+    ).toBe("198.51.100.7");
+  });
+
+  it("falls back to x-forwarded-for, then x-real-ip, then unknown", () => {
+    expect(clientIpFromHeaders(headersOf({ "x-forwarded-for": "203.0.113.5, 10.0.0.1" }))).toBe(
+      "203.0.113.5",
+    );
+    expect(clientIpFromHeaders(headersOf({ "x-real-ip": "192.0.2.9" }))).toBe("192.0.2.9");
+    expect(clientIpFromHeaders(headersOf({}))).toBe("unknown");
+  });
+});

package/templates/apps/web/src/lib/lead-write.ts

@@ -0,0 +1,90 @@
+/**
+ * lead-write.ts — this site's lead writer (#8747): the /contact action writes
+ * through it, and so can any other page that writes a lead.
+ *
+ * A lead goes to `POST /v1/leads/submit` through `@working-theory/api-client`.
+ * The API resolves the lead's workspace itself — from the spoke key on a hub,
+ * from its own site alias otherwise — and ignores a body `siteId`, so none is
+ * sent. The site marks itself in the payload instead: `payload.site` is
+ * `AILK_LEAD_SITE` (the same variable `apps/mcp`'s `capture_lead` reads,
+ * `LEAD_SITE_MARKER_KEY`) and `payload.page` the page key, both spread LAST so
+ * no caller field can override them. With `AILK_LEAD_SITE` unset or blank the
+ * lead carries no `site` at all — a caller's own `site` is dropped, never sent.
+ *
+ * The marker is attribution, not authorization: the route is public and a
+ * direct caller can write any `payload.site`. Nothing may gate on it.
+ *
+ * Terms acceptance (#8730): a caller that collected the visitor's acceptance
+ * passes `consent: true`, sent as the body's top-level `consent`. The API
+ * refuses a contact lead without it and records `payload.consent` itself, so
+ * nothing about the acceptance is written into the payload here.
+ *
+ * Forwarded headers: only the two `visitorForwardHeaders` builds (#7394) and
+ * the consent-visitor id (#8438 D12) reach the api-client, so no caller can
+ * set its own `x-ailk-spoke-key` or `content-type`. With none of the three,
+ * `leads.submit` is called with one argument.
+ *
+ * Never throws. The api-client's own result passes through unchanged, so a
+ * caller still reads the API's 503 `lead_capture_not_configured`. A thrown
+ * submit — the API could not be reached — resolves as
+ * `{ ok: false, status: 0, body: null }` and logs the error's NAME only: its
+ * message could echo the payload.
+ */
+import { leads } from "@working-theory/api-client";
+import { LEAD_SITE_MARKER_KEY } from "@working-theory/validation";
+
+export interface LeadWriteInput {
+  source: string;
+  email: string;
+  /** The page key the marker carries, e.g. `contact` or `checkout`. */
+  page: string;
+  /** The visitor accepted the terms (#8730). Sent only when `true`. */
+  consent?: boolean;
+  payload?: Record<string, unknown>;
+}
+
+type SubmitInit = Parameters<typeof leads.submit>[1];
+type SubmitResult = Awaited<ReturnType<typeof leads.submit>>;
+
+/** The only request headers a lead write forwards. */
+const FORWARDED_HEADERS = [
+  "x-ailk-visitor-ip",
+  "x-ailk-visitor-forward-key",
+  "x-ailk-consent-visitor",
+] as const;
+
+function forwardOnly(init: SubmitInit): SubmitInit {
+  const headers: Record<string, string> = {};
+  for (const name of FORWARDED_HEADERS) {
+    const value = init?.headers?.[name];
+    if (typeof value === "string") headers[name] = value;
+  }
+  return Object.keys(headers).length > 0 ? { headers } : undefined;
+}
+
+/** The site marker from configuration, or `undefined` when unset or blank. */
+function leadSite(): string | undefined {
+  return process.env.AILK_LEAD_SITE?.trim() || undefined;
+}
+
+export async function writeLead(input: LeadWriteInput, init?: SubmitInit): Promise<SubmitResult> {
+  const site = leadSite();
+  const { [LEAD_SITE_MARKER_KEY]: _callerSite, ...callerPayload } = input.payload ?? {};
+  const body = {
+    source: input.source,
+    email: input.email,
+    ...(input.consent === true && { consent: true }),
+    payload: {
+      ...callerPayload,
+      ...(site && { [LEAD_SITE_MARKER_KEY]: site }),
+      page: input.page,
+    },
+  };
+  const forward = forwardOnly(init);
+  try {
+    return forward ? await leads.submit(body, forward) : await leads.submit(body);
+  } catch (err) {
+    console.error(`[lead-write] submit failed: ${err instanceof Error ? err.name : "unknown"}`);
+    return { ok: false, status: 0, body: null };
+  }
+}

package/templates/apps/web/src/lib/rate-limit.ts

@@ -0,0 +1,79 @@
+/**
+ * rate-limit.ts — a best-effort, in-memory, per-instance limiter (#8747).
+ *
+ * The /contact Server Action runs it before it writes a lead. From a server
+ * action the hub sees this site's own egress address, so without a limit
+ * here one visitor could drain the hub's per-IP budget for every visitor of
+ * the site. Brought upstream from the consumer sites' copies
+ * (salessmyth/samhenry, salessmyth/wendihenry `apps/web/src/lib/rate-limit.ts`).
+ *
+ * NOT a distributed limiter: state lives in one serverless instance's memory
+ * and resets on a cold start. It raises the bar against a flood on one warm
+ * instance; it does not stop one spread across many. The hub keeps its own
+ * per-IP limit on the route.
+ */
+
+type Bucket = { count: number; resetAt: number };
+
+const buckets = new Map<string, Bucket>();
+
+// Bound the map so a caller rotating keys (spoofed addresses) cannot grow it
+// without limit between resets.
+const MAX_TRACKED_KEYS = 5000;
+
+/** Test-only reset. Not reachable from a request. */
+export function __resetRateLimit(): void {
+  buckets.clear();
+}
+
+/**
+ * Fixed-window check. `true` when the caller is under `limit` in the current
+ * window (and counts the call); `false` once it has used `limit` calls.
+ */
+export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
+  const now = Date.now();
+  const existing = buckets.get(key);
+
+  if (!existing || existing.resetAt <= now) {
+    if (buckets.size >= MAX_TRACKED_KEYS) pruneExpired(now);
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return true;
+  }
+
+  if (existing.count >= limit) return false;
+
+  existing.count += 1;
+  return true;
+}
+
+function pruneExpired(now: number): void {
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) buckets.delete(key);
+  }
+  // Nothing expired (keys rotated inside one window): evict the oldest entry
+  // — `Map` iterates in insertion order — so the bound always holds.
+  if (buckets.size >= MAX_TRACKED_KEYS) {
+    const oldestKey = buckets.keys().next().value;
+    if (oldestKey !== undefined) buckets.delete(oldestKey);
+  }
+}
+
+/** The subset of Next's `headers()` the address read needs. */
+export interface HeaderReader {
+  get(name: string): string | null;
+}
+
+/**
+ * The visitor's address, coarse: `x-vercel-forwarded-for`, else
+ * `x-forwarded-for`, else `x-real-ip` (first value of each), else
+ * `"unknown"`. Vercel's edge overwrites these with the connecting address;
+ * behind an edge that appends instead, a caller chooses its own key. An
+ * abuse-throttling key only — never an authorization decision.
+ */
+export function clientIpFromHeaders(headers: HeaderReader): string {
+  for (const name of ["x-vercel-forwarded-for", "x-forwarded-for"]) {
+    const value = headers.get(name);
+    if (value) return value.split(",")[0]?.trim() || "unknown";
+  }
+  return headers.get("x-real-ip") || "unknown";
+}

package/templates/database/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @working-theory/database
 
+## 0.43.0
+
+### Minor Changes
+
+- [#8775](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8775) [`ee8e713`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ee8e713b8194e8d65052f4b1dca928ca0c970318) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A per-magnet completion setting — lead only, invite to account, or continue to checkout ([#8757](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8757), Phase 1).
+
+  - **`@working-theory/database`** — `flow_definitions` gains `completion` (`lead` | `invite` | `checkout`, default `lead`) and `checkout_offering`, closed by three CHECKs. The migration backfills `onboarding`, `request-quote` and `job-application` to `invite` by slug; `contact` and every other magnet stay `lead`. Deploy the migration before the API.
+  - **`@working-theory/validation`** — `flow-completion.ts`: `FLOW_COMPLETIONS`, `flowCompletionSettingSchema`, `flowCheckoutOfferingSchema`, `STANDARD_MAGNET_COMPLETIONS`, `leadSubmitNextSchema`, `accountEmailHintSchema`, `accountInvitePath`, the invite caps and the email defaults.
+  - **`@working-theory/api-client`** — `Magnet` carries `completion` and `checkoutOffering`, `MagnetUpdateInput` can set them, and `LeadWriteResponse` gains an optional `next`.
+  - **`@working-theory/ui`** — `AuthCard` takes an optional `defaultEmail`; `LeadCaptureFormState`'s success state takes an optional `next` link.
+  - **`@working-theory/analytics`** — `email` and `login_hint` are scrubbed from URLs like `session_id`.
+  - **`create-ailk`** — the API: the magnet PATCH writes the setting alone (`checkout` needs a person, the `commerce` claim and a published offering) and every full row serves it; a `flow:<slug>` submit to an `invite` magnet answers `next` and sends one capped confirmation email whose link starts sign-in with the address prefilled. The web: /contact's thank-you shows "Track this in your account", and sign-in opens with a hinted email on a site and through the hub. The Admin: one "When someone submits" control on the magnet page.
+
+- [#8807](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8807) [`956bfe6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/956bfe60fff4bd9a43135e6a2fb79e6f012e14f8) Thanks [@claudio-planck](https://github.com/claudio-planck)! - Every hosted Stripe Checkout session collects terms acceptance, and a completed checkout records a dated grant for the buyer ([#8765](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8765), PR B).
+
+  - **`@working-theory/stripe-client`** — both session creators set `consent_collection.terms_of_service: "required"` and a `custom_text.terms_of_service_acceptance` message: the site's account-terms sentence with its Terms, Privacy Policy and Working Agreement links resolved on the session's own return origin. Every session is stamped `metadata.ailk_terms` (`account_terms@2` by default). An optional `termsOfService` input overrides the sentence and its links. A Stripe refusal for a missing Terms URL is rethrown as `TermsOfServiceUrlMissingError`. **Precondition:** the seller's Stripe account needs a Terms of Service URL in its Dashboard's Public details, or Stripe refuses every session with the box.
+  - **`@working-theory/validation`** — `CONSENT_SOURCES` gains `checkout`.
+  - **`@working-theory/database`** — a migration widens the `consent_grants_source_known` CHECK to the eight sources. It writes no row.
+  - **`create-ailk`** — the API: the hub's `checkout.session.completed` webhook records one `checkout` grant per session for the buyer's Person when the session carries the terms stamp and Stripe recorded the consent as accepted. A checkout row is an unverified (any-source) row. The Admin labels the source "Checkout".
+
+### Patch Changes
+
+- [#8767](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8767) [`5ff341d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5ff341d683d35a024fc1073c1b010aa56956a1d2) Thanks [@claudio-planck](https://github.com/claudio-planck)! - A JobPosting names where to apply, and a standard Job application magnet is seeded like the Contact form and drawn on every job page ([#8746](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8746)).
+
+  - **`@working-theory/schema`** — `ContentPageInput` gains an optional `origin` (the site's origin, passed by the caller; the package never reads the environment for it). When it is present, the JobPosting builder puts a `potentialAction` `ApplyAction` on the JobPosting whose `target` is the job page's own URL plus `#apply`: `<origin>/<locale>/careers/<slug>#apply`, the same form the page's BreadcrumbList uses. `buildJobPostingNode` takes an optional `applyUrl`. Every other builder ignores `origin`, so CareersList keeps its ItemList unchanged.
+  - **`@working-theory/page-renderer`** — `toContentPageInput` passes the render's origin (the one the BreadcrumbList is built from).
+  - **`@working-theory/validation`** — the magnet's one source: `JOB_APPLICATION_FLOW_SLUG` (`job-application`), `JOB_APPLICATION_FLOW_TITLE`, `JOB_APPLICATION_LANDING_PAGE` (`/careers`) and `jobApplicationFlowConfig` — one field step of First name, Last name and Email (required), Phone (`tel`) and LinkedIn URL (`url`). `RESERVED_FLOW_SLUGS` gains `job-application`, so no flow-engine write, spoke seed or new listing takes it.
+  - **`@working-theory/database`** — the database seed writes the default workspace's Job application magnet: `diagnostic`, `live`, landing page `/careers`, insert-only.
+  - **`create-ailk`** — the API seeds the magnet into every workspace insert-only (after `POST /v1/workspaces` and from the seed-presets CLI for existing workspaces), a magnet can be neither renamed from nor to `job-application`, and `GET /v1/content/:type/:slug` passes `_site.mdx`'s `baseUrl` as the origin, so the API's JobPosting JSON-LD carries the ApplyAction too. Each job page `/careers/<slug>` renders the magnet's field step under an `#apply` anchor, falling back to the same built-in form when the magnet is absent or off; a submission is a `flow:job-application` lead whose `name` is first + last and whose hidden `job` is the posting's slug, and the form thanks the applicant with the `careers` catalog's own `applicationSuccess` line. The `/careers` index carries no form.
+
+- [#8788](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8788) [`3a89742`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/3a89742f7b816deca6cd604863f2fd041a79abfa) Thanks [@claudio-planck](https://github.com/claudio-planck)! - The standard magnets are seeded with their completion setting ([#8759](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8759)), so a workspace created after the [#8757](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8757) migration no longer depends on its backfill.
+
+  - **`@working-theory/database`** — the database seed writes `completion` on the default workspace's magnets: `invite` on `request-quote` and `job-application`, `lead` on `contact`. On a fresh install the migration's backfill runs before the seed and finds no rows.
+  - **`create-ailk`** — the API's insert-only seed writes `lead` on the Contact form and `invite` on the onboarding and Job application magnets, and `POST /v1/workspaces` creates the `request-quote` magnet at `invite`.
+
+- Updated dependencies [[`5032b3e`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5032b3eefb05bbe67ebddf1b4b07904717100472), [`5ff341d`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/5ff341d683d35a024fc1073c1b010aa56956a1d2), [`ee8e713`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/ee8e713b8194e8d65052f4b1dca928ca0c970318), [`c74bd72`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/c74bd7270fa2cb82bebedfb1b53f89ca6e09917f), [`956bfe6`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/956bfe60fff4bd9a43135e6a2fb79e6f012e14f8), [`97237f2`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/97237f278006a43e17d58709ed9ac3b4f62ae76f), [`1eb9688`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/1eb9688708dbc65cd4e2fdb6efeb40880e1606f0), [`b001413`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/b001413238973f4ecb3d4a5a18968cd7732210d8)]:
+  - @working-theory/validation@0.43.0
+
 ## 0.42.0
 
 ### Patch Changes

package/templates/database/__tests__/consent-source-checkout-migration.test.ts

@@ -0,0 +1,79 @@
+/**
+ * @file consent-source-checkout-migration.test.ts
+ *
+ * DB-free proof of the consent_source_checkout migration's shape (#8765, spec
+ * docs/specs/8765-sign-up-refuses-without-the-spec.md D13, AC-8). Reads the
+ * migration's own text: it drops `consent_grants_source_known` and re-adds it
+ * `NOT VALID` with exactly the values of `CONSENT_SOURCES`, then `VALIDATE`s
+ * it — with no `UPDATE`, `INSERT` or `DELETE`, so the append-only ledger is
+ * never written.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { CONSENT_SOURCES } from "@working-theory/validation";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261019120000_consent_source_checkout",
+  "migration.sql",
+);
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+describe("the consent_source_checkout migration (#8765 D13, AC-8)", () => {
+  it("drops the source CHECK, re-adds it NOT VALID, then VALIDATEs it — nothing else", () => {
+    const shapes = statements().map((s) => {
+      if (
+        s ===
+        'ALTER TABLE "consent_grants" DROP CONSTRAINT "consent_grants_source_known"'
+      ) {
+        return "drop";
+      }
+      if (
+        /^ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_source_known" CHECK \(.*\) NOT VALID$/.test(
+          s,
+        )
+      ) {
+        return "add";
+      }
+      if (
+        s ===
+        'ALTER TABLE "consent_grants" VALIDATE CONSTRAINT "consent_grants_source_known"'
+      ) {
+        return "validate";
+      }
+      return `unexpected: ${s}`;
+    });
+    expect(shapes).toEqual(["drop", "add", "validate"]);
+  });
+
+  it("names exactly the eight values of CONSENT_SOURCES, checkout among them", () => {
+    const add = statements().find((s) => s.includes("ADD CONSTRAINT"));
+    const list = add?.match(/CHECK \("source" IN \(([^)]*)\)\)/)?.[1];
+    expect(list).toBeDefined();
+    const values = (list ?? "")
+      .split(",")
+      .map((v) => v.trim().replace(/^'|'$/g, ""));
+    expect(values).toHaveLength(8);
+    expect([...values].sort()).toEqual([...CONSENT_SOURCES].sort());
+    expect(values).toContain("checkout");
+  });
+
+  it("writes no row: no UPDATE, INSERT or DELETE", () => {
+    for (const s of statements())
+      expect(s).not.toMatch(/\b(UPDATE|INSERT|DELETE)\b/i);
+  });
+});

package/templates/database/__tests__/flow-completion-migration.test.ts

@@ -0,0 +1,115 @@
+/**
+ * @file flow-completion-migration.test.ts
+ *
+ * DB-free proof of the flow_completion migration's shape (#8757, spec
+ * docs/specs/8757-a-per-magnet-completion-setting-spec.md D2, AC-2). Reads
+ * the migration's own text: it adds exactly the two columns and three named
+ * CHECKs, each added `NOT VALID` then `VALIDATE`d, and its one `UPDATE` is the
+ * slug backfill between its markers — naming exactly the standard magnets
+ * whose default is `invite` (`STANDARD_MAGNET_COMPLETIONS`). It inserts and
+ * deletes nothing. The live-database half is `flow-completion.db.test.ts`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { STANDARD_MAGNET_COMPLETIONS } from "@working-theory/validation";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261018120000_flow_completion",
+  "migration.sql",
+);
+
+const CHECKS = [
+  "flow_definitions_completion_domain",
+  "flow_definitions_checkout_offering_pair",
+  "flow_definitions_checkout_offering_format",
+];
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+/** The text between the `-- BEGIN completion backfill` / `-- END …` markers. */
+function backfillBlock(): string {
+  const match = /-- BEGIN completion backfill\n([\s\S]*?)-- END completion backfill/.exec(
+    readFileSync(MIGRATION, "utf8"),
+  );
+  if (!match) throw new Error("completion backfill markers not found");
+  return match[1]!;
+}
+
+describe("the flow_completion migration (#8757 D2, AC-2)", () => {
+  it("adds exactly the two columns, the completion default lead", () => {
+    const adds = statements().filter((s) => /^ALTER TABLE "flow_definitions" ADD COLUMN /.test(s));
+    expect(adds).toHaveLength(1);
+    const columns = adds[0]!.split(/ADD COLUMN /).slice(1).map((c) => c.trim().replace(/,$/, ""));
+    expect(columns).toEqual([
+      `"completion" VARCHAR(16) NOT NULL DEFAULT 'lead'`,
+      `"checkout_offering" VARCHAR(40)`,
+    ]);
+  });
+
+  it("adds the three named CHECKs NOT VALID, then VALIDATEs each", () => {
+    const all = statements();
+    const added = all
+      .map((s) => /^ALTER TABLE "flow_definitions" ADD CONSTRAINT "([a-z_]+)" CHECK \(.*\) NOT VALID$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    const validated = all
+      .map((s) => /^ALTER TABLE "flow_definitions" VALIDATE CONSTRAINT "([a-z_]+)"$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(added).toEqual(CHECKS);
+    expect(validated).toEqual(CHECKS);
+    for (const name of CHECKS) {
+      expect(all.findIndex((s) => s.includes(`VALIDATE CONSTRAINT "${name}"`))).toBeGreaterThan(
+        all.findIndex((s) => s.includes(`ADD CONSTRAINT "${name}"`)),
+      );
+    }
+  });
+
+  it("holds exactly one UPDATE, inside the backfill markers, naming the invite defaults", () => {
+    const updates = statements().filter((s) => /\bUPDATE\b/i.test(s));
+    expect(updates).toHaveLength(1);
+    const block = backfillBlock().replace(/\s+/g, " ").trim();
+    expect(block).toBe(updates[0] + ";");
+    const list = /WHERE "slug" IN \(([^)]*)\)/.exec(block)?.[1];
+    const slugs = (list ?? "").split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+    const invite = Object.entries(STANDARD_MAGNET_COMPLETIONS)
+      .filter(([, completion]) => completion === "invite")
+      .map(([slug]) => slug);
+    expect([...slugs].sort()).toEqual([...invite].sort());
+    expect(block).toContain(`SET "completion" = 'invite'`);
+  });
+
+  it("inserts and deletes nothing", () => {
+    for (const s of statements()) expect(s).not.toMatch(/\b(INSERT|DELETE)\b/i);
+  });
+
+  it("every statement is one of the expected shapes", () => {
+    const unexpected = statements().filter(
+      (s) =>
+        !/^ALTER TABLE "flow_definitions" (ADD COLUMN|ADD CONSTRAINT|VALIDATE CONSTRAINT) /.test(s) &&
+        !/^UPDATE "flow_definitions" SET "completion" = 'invite' WHERE "slug" IN \(/.test(s),
+    );
+    expect(unexpected).toEqual([]);
+  });
+
+  it("schema.prisma declares both fields on FlowDefinition", () => {
+    const prisma = readFileSync(join(__dirname, "..", "inbox", "schema.prisma"), "utf8");
+    const model = /model FlowDefinition \{([\s\S]*?)\n\}/.exec(prisma)?.[1] ?? "";
+    expect(model).toMatch(/\n\s*completion String @default\("lead"\) @db\.VarChar\(16\)\n/);
+    expect(model).toMatch(
+      /\n\s*checkoutOffering String\? @map\("checkout_offering"\) @db\.VarChar\(40\)\n/,
+    );
+  });
+});