create-ailk 0.21.0 → 0.23.0

package/site-templates/shapes/person-service/TEMPLATE-MANIFEST.md

@@ -133,10 +133,9 @@ _Detail route over `content/en/UseCase/` — 3 seed pages: `persona-1.mdx`, `per
 
 <!-- generated:begin page=/contact -->
 
-| #   | Section                                                   | Component | Copy (first line)                         |
-| --- | --------------------------------------------------------- | --------- | ----------------------------------------- |
-| 1   | `hero` (split · eyebrow "Contact" · checklist ×3 · 1 CTA) | `Hero`    | Get every message in your email, free     |
-| 2   | `items` (tiles · columns=2 · items ×4)                    | `Items`   | {Add appointment scheduling to your site} |
+| #   | Section                             | Component     | Copy (first line) |
+| --- | ----------------------------------- | ------------- | ----------------- |
+| 1   | `contact-form` (column · fields ×0) | `ContactForm` |                   |
 
 <!-- generated:end -->
 
@@ -165,13 +164,17 @@ _Detail route over `content/en/UseCase/` — 3 seed pages: `persona-1.mdx`, `per
 
 <!-- generated:begin page=/newsletter -->
 
-| #   | Section                                | Component | Copy (first line)                       |
-| --- | -------------------------------------- | --------- | --------------------------------------- |
-| 1   | `hero` (eyebrow "Newsletter" · 2 CTAs) | `Hero`    | {Start a free newsletter with Substack} |
-| 2   | `faq` (expanded · items ×3)            | `FAQ`     | FAQs                                    |
+| #   | Section                             | Component     | Copy (first line) |
+| --- | ----------------------------------- | ------------- | ----------------- |
+| 1   | `contact-form` (column · fields ×0) | `ContactForm` |                   |
 
 <!-- generated:end -->
 
+<!-- generated:begin page=/unsubscribe -->
+
+_Code route — no content, no sections._
+<!-- generated:end -->
+
 <!-- generated:begin page=/meet -->
 
 | #   | Section                                | Component | Copy (first line)     |
@@ -183,12 +186,10 @@ _Detail route over `content/en/UseCase/` — 3 seed pages: `persona-1.mdx`, `per
 
 <!-- generated:begin page=/meet/[slug] -->
 
-| #   | Section                                | Component      | Copy (first line)                                |
-| --- | -------------------------------------- | -------------- | ------------------------------------------------ |
-| 1   | `hero` (eyebrow "Book a Call" · 1 CTA) | `Hero`         | Book a Call                                      |
-| 2   | `cta` (box · 1 CTA)                    | `CTA`          | {What booking a call would do for your visitors} |
-| 3   | `items` (columns=3 · items ×3)         | `Items`        | What happens on the call?                        |
-| 4   | `content-block` (1 CTA)                | `ContentBlock` |                                                  |
+| #   | Section                                | Component      | Copy (first line) |
+| --- | -------------------------------------- | -------------- | ----------------- |
+| 1   | `hero` (eyebrow "Book a Call" · 1 CTA) | `Hero`         | Book a Call       |
+| 2   | `content-block` (1 CTA)                | `ContentBlock` |                   |
 
 <!-- generated:end -->
 
@@ -244,12 +245,11 @@ _Code route — no content, no sections._
 
 <!-- generated:begin page=/blog -->
 
-| #   | Section                                                      | Component      | Copy (first line)                                                 |
-| --- | ------------------------------------------------------------ | -------------- | ----------------------------------------------------------------- |
-| 1   | `hero` (centered · gapBelow=tight · eyebrow "Blog" · 2 CTAs) | `Hero`         | Get free blog/docs from Fumadocs                                  |
-| 2   | `blog-list` (grid)                                           | `BlogList`     |                                                                   |
-| 3   | `logoCloud` (layout=inline · logos ×6)                       | `LogoCloud`    | Don’t just take our word for it                                   |
-| 4   | `testimonials` (quote · items ×1)                            | `Testimonials` | {A customer quote, in their own words, about the result they got} |
+| #   | Section                                             | Component      | Copy (first line)                                                 |
+| --- | --------------------------------------------------- | -------------- | ----------------------------------------------------------------- |
+| 1   | `hero` (centered · gapBelow=tight · eyebrow "Blog") | `Hero`         | {Blog}                                                            |
+| 2   | `logoCloud` (layout=inline · logos ×6)              | `LogoCloud`    | Don’t just take our word for it                                   |
+| 3   | `testimonials` (quote · items ×1)                   | `Testimonials` | {A customer quote, in their own words, about the result they got} |
 
 <!-- generated:end -->
 
@@ -324,6 +324,7 @@ person-service:
     - { route: "/faq",               kind: page, content: ["content/en/FAQPage/faq.mdx"] }
     - { route: "/glossary",          kind: page, content: ["content/en/GlossaryList/glossary.mdx"] }
     - { route: "/newsletter",        kind: page, content: ["content/en/NewsletterSignup/newsletter.mdx"] }
+    - { route: "/unsubscribe",       kind: route }
     - { route: "/sign-in",           kind: route }
     - { route: "/sign-up",           kind: route }
     - { route: "/purchase-policy",   kind: page, content: ["content/en/PurchasePolicyPage/purchase-policy.mdx"] }
@@ -354,10 +355,10 @@ Every row is module-less: `requires` is `[marketing]` alone, so `mergeRoster` co
 
 <!-- generated:begin inventory -->
 
-| Tier     | Used by this template                                                                                                      |
-| -------- | -------------------------------------------------------------------------------------------------------------------------- |
-| Shell    | `MarketingShell`                                                                                                           |
-| Chrome   | `Nav`, `Footer`, `Banner` (+ `BannerConsentIsland`, `BannerDismissIsland`)                                                 |
-| Sections | `BlogList`, `ContentBlock`, `CTA`, `DocumentChassis`, `FAQ`, `GlossaryIndex`, `Hero`, `Items`, `LogoCloud`, `Testimonials` |
+| Tier     | Used by this template                                                                                                         |
+| -------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| Shell    | `MarketingShell`                                                                                                              |
+| Chrome   | `Nav`, `Footer`, `Banner` (+ `BannerConsentIsland`, `BannerDismissIsland`)                                                    |
+| Sections | `ContactForm`, `ContentBlock`, `CTA`, `DocumentChassis`, `FAQ`, `GlossaryIndex`, `Hero`, `Items`, `LogoCloud`, `Testimonials` |
 
 <!-- generated:end -->

package/site-templates/shapes/person-service/content/en/NewsletterSignup/newsletter.mdx

@@ -1,8 +1,8 @@
 ---
 type: "NewsletterSignup"
 slug: "newsletter"
-title: "{Start a free newsletter with Substack}"
-description: "{Or upgrade to Pro to capture every subscriber and build your own marketing database.}"
+title: "Get the newsletter"
+description: "{One sentence on what this newsletter covers and who it is for}"
 schema:
   mainEntity:
     "@type": "Offer"
@@ -12,48 +12,11 @@ schema:
 sections:
   [
     {
-      "id": "hero",
-      "type": "hero",
-      "data":
-        {
-          "eyebrow": "Newsletter",
-          "headline": "{Start a free newsletter with Substack}",
-          "subheadline": "{Or upgrade to Pro to capture every subscriber and build your own marketing database.}",
-          "primaryCta":
-            { "label": "{Connect Substack}", "href": "https://substack.com" },
-          "secondaryCta":
-            {
-              "label": "{Upgrade to Pro}",
-              "href": "https://ailaunchkit.ai/pricing",
-              "variant": "outline",
-            },
-        },
-    },
-    {
-      "id": "faq",
-      "type": "faq",
-      "data":
-        {
-          "headline": "FAQs",
-          "presentation": "expanded",
-          "items":
-            [
-              {
-                "question": "{How often will I hear from you?}",
-                "answer": "{Answer in one or two plain sentences}",
-              },
-              {
-                "question": "{What will I get?}",
-                "answer": "{Answer in one or two plain sentences}",
-              },
-              {
-                "question": "{Can I unsubscribe?}",
-                "answer": "{Answer in one or two plain sentences}",
-              },
-            ],
-        },
+      "id": "signup",
+      "type": "contact-form",
+      "data": { "variant": "column", "fields": [] },
     },
   ]
 ---
 
-{/* Rendered from frontmatter `sections[]` by the /newsletter route. The Free template has no signup form: the hero points the owner to Substack, or to Pro for subscriber capture. The `schema:` Offer is the page's JSON-LD main entity — a free subscription. Placeholder copy — replace every {brace} with your own words before you launch. */}
+{/* Rendered from frontmatter `sections[]` by the /newsletter route. The page's one signup surface is the workspace's Newsletter magnet: its heading, sentence, field, consent, button and ending all come from the magnet, mounted by the route in this section's slot. To change the signup, change the magnet in Admin → Magnets. The `schema:` Offer is the page's JSON-LD main entity — a free subscription. Replace every {brace} with your own words before you launch. */}

package/templates/.env.example

@@ -437,19 +437,21 @@ CONTENT_ADAPTER=mdx
 # random bytes, `openssl rand -base64 32`. Unset = connections cannot be
 # written; any other shape stops the API. Losing it unreads every connection.
 # SCHEDULING_CREDENTIAL_KEY=
+# The key each Organization's Stripe connection is encrypted under (#8907),
+# and the key it replaced during a rotation: 32 random bytes each, `openssl
+# rand -base64 32`, distinct from each other and from SCHEDULING_CREDENTIAL_KEY.
+# Unset = a connection can be read and removed but not written; any other
+# shape stops the API. ONE KEY PER DATABASE: a database holding live
+# connections gets its key on production only — never on a preview sharing
+# that database. Rotation and the rekey bin: apps/api/.env.example.
+# STRIPE_CONNECTION_KEY=
+# STRIPE_CONNECTION_KEY_PREVIOUS=
 # HMAC-SHA256 key POST /v1/webhooks/calcom verifies the x-cal-signature-256
 # header against (#6085). Unset makes the receiver answer 503 and accept
 # nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
 # CAL_WEBHOOK_SECRET=
 # SCHEDULING_PUBLIC_BASE_URL=https://cal.com
 # SCHEDULING_PROVIDER=cal
-#
-# Which event the /meet page books, as "<owner>/<event-slug>" (the path of
-# the provider's own public booking page). Read server-side by apps/web; unset
-# means the /meet route 404s, exactly as if the scheduling module were not
-# installed. Deliberately NOT a NEXT_PUBLIC_ variable — the whole scheduling
-# config surface is server-read.
-# SCHEDULING_CAL_LINK=owner/event-slug
 
 # ── Recommender mode — the purchase hand-off (REL-013, #4762 / #4879) ────────
 # A `recommending` flow's email + checkout moment spans two deployments:

package/templates/.github/workflows/ci.yml

@@ -26,6 +26,19 @@ jobs:
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
 
+      # The private @working-theory/* scope needs NPM_TOKEN (#9092) — add it
+      # as a repository secret. It goes into the runner's user-level npmrc,
+      # never a committed project .npmrc (pnpm >= 11 ignores credentials
+      # there), and stays there for the rest of the job — fine on a hosted
+      # runner, which is discarded after it. With no secret the step is a
+      # no-op; public packages still install.
+      - env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -n "$NPM_TOKEN" ]; then
+            pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"
+          fi
+
       # Not --frozen-lockfile: the scaffold ships no pnpm-lock.yaml (it is
       # generated fresh by the customer's own first `pnpm install`, and the
       # placeholder step above is a cache-key stand-in, not a real lockfile),

package/templates/README.md

@@ -56,6 +56,7 @@ The pages of the Free `organization-product` shape, and where each one's copy li
 | `/contact`           | `content/en/ContactPage/contact.mdx`                                                                                                                                | every scaffold                 |
 | `/glossary`          | `content/en/GlossaryList/glossary.mdx`                                                                                                                              | `--shape organization-product` |
 | `/newsletter`        | `content/en/NewsletterSignup/newsletter.mdx`                                                                                                                        | `--shape organization-product` |
+| `/unsubscribe`       | — (a code route)                                                                                                                                                    | every scaffold                 |
 | `/sign-in`           | — (a code route)                                                                                                                                                    | every scaffold                 |
 | `/sign-up`           | — (a code route)                                                                                                                                                    | every scaffold                 |
 | `/privacy`           | `content/en/PrivacyPage/privacy.mdx`                                                                                                                                | `--shape organization-product` |

package/templates/_gitignore

@@ -158,5 +158,9 @@ __pycache__/
 tests/e2e/.stack/
 tests/e2e/.results/
 
+# session scratch swept into the 0.43.0 release commit by git add -A; never tracked
+undefined/
+.impeccable/
+
 # create-ailk licence key file (`--license`, `ailk license set`) — owner-only, never committed
 ailk.key

package/templates/apps/api/.env.example

@@ -98,6 +98,33 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # unreadable: each workspace must then reconnect. Never log or share it.
 # SCHEDULING_CREDENTIAL_KEY=
 #
+# An Organization's Stripe connection (#8907) — the AES-256-GCM key each
+# Organization's restricted Stripe key and webhook signing secret are
+# encrypted under. The same shape rule: exactly 32 random bytes in canonical
+# standard base64 (`openssl rand -base64 32`), and never the same bytes as
+# SCHEDULING_CREDENTIAL_KEY. Any other value stops the API at startup. Unset
+# means a connection can be read, reset and removed, but connect, go-live and
+# the webhook secret answer 503 credential_key_not_configured.
+#
+# ONE KEY PER DATABASE. A deployment whose database holds live connections
+# sets this key on production only; a preview or development deployment that
+# shares that database must never be given it. A preview with its own
+# database takes its own key. (A build that is not production also refuses to
+# read or change a live connection.)
+#
+# ROTATION. Set STRIPE_CONNECTION_KEY_PREVIOUS to the old key and
+# STRIPE_CONNECTION_KEY to a new one, redeploy, run
+# `node dist/bin/stripe-connections-rekey.js` (dev:
+# `pnpm --filter @working-theory/api stripe-connections:rekey`) with the
+# production environment (VERCEL_ENV=production, or NODE_ENV=production off
+# Vercel) — anywhere else it prints `not_production` and touches nothing —
+# and unset _PREVIOUS once it prints `remaining=0`. A row it counts `unreadable`
+# decrypts under neither key and stays so after _PREVIOUS is unset: its owner
+# reconnects or disconnects. _PREVIOUS without a current key, or equal to it,
+# stops the API.
+# STRIPE_CONNECTION_KEY=
+# STRIPE_CONNECTION_KEY_PREVIOUS=
+#
 # The booking webhook receiver (#6085) — a SEPARATE credential from the
 # three above: it verifies POST /v1/webhooks/calcom's x-cal-signature-256
 # header, it does not call the provider. Unset makes the receiver answer 503