create-ailk 0.23.0 → 0.25.1

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/__tests__/route.test.ts

@@ -0,0 +1,222 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The Offerings buy route's API origin on each topology (#9419). The route
+ * takes its browser-facing origin from the #7874 D12 seam
+ * (`lib/api-origin.generated.ts`), never from `NEXT_PUBLIC_AILK_API_URL`
+ * itself: a spoke's render of that seam reads no env, so a fresh
+ * `--topology spoke` scaffold passes its own `env:check` (SPOKE_REFUSED_ENV,
+ * #7874 D5). The rest of the ladder is pinned in `../../__tests__/route.test.ts`.
+ *
+ * Each case loads the route in its own module registry, so no case reads
+ * another's shared shown-set answer; a spoke case swaps in the spoke render
+ * of both generated seams, as `lib/__tests__/relay.test.ts` does.
+ */
+import { workspaceShownSetSchema } from "@working-theory/validation";
+
+import { TOPOLOGY } from "../../../../../../lib/topology.generated";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn(async () => ({ features: ["commerce"] })),
+}));
+
+const ORIGIN_SEAM = "../../../../../../lib/api-origin.generated";
+const TOPOLOGY_SEAM = "../../../../../../lib/topology.generated";
+const HUB_API = "https://api.example.test";
+
+/** One shown plan with one price, `growth_monthly`, in the wire shape. */
+const SHOWN_SET = workspaceShownSetSchema
+  .partial({ workspaceId: true, organizationId: true })
+  .parse({
+    productIds: ["prod_growth"],
+    recommended: { plan: null, addon: null },
+    offerings: [
+      {
+        productId: "prod_growth",
+        plan: "growth",
+        name: "growth",
+        description: null,
+        marketingFeatures: [],
+        unitLabel: null,
+        note: null,
+        termsNote: null,
+        ailkGroup: "plan",
+        ailkOrder: null,
+        prices: [
+          {
+            priceId: "price_growthmonthly",
+            lookupKey: "growth_monthly",
+            plan: "growth",
+            period: "monthly",
+            interval: "month",
+            amount: 4900,
+            currency: "usd",
+          },
+        ],
+        recommended: false,
+      },
+    ],
+    state: "current",
+    snapshotAt: "2026-10-21T00:00:00.000Z",
+  });
+
+const env = process.env as Record<string, string | undefined>;
+const ENV_NAMES = [
+  "AILK_API_URL",
+  "NEXT_PUBLIC_AILK_API_URL",
+  "NEXT_PUBLIC_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+  "NODE_ENV",
+  "OSS_API_INTERNAL_SECRET",
+  "AILK_SPOKE_KEY",
+] as const;
+const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
+
+function json(status: number, body: unknown): Promise<Response> {
+  return Promise.resolve(
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+/** The shown-set read answers `shownStatus`; the session POST starts one. */
+let shownStatus: "unconnected" | "shown";
+const realFetch = global.fetch;
+const fetchMock = jest.fn(
+  (input: string | URL | Request, _init?: RequestInit) => {
+    if (new URL(String(input)).pathname === "/v1/checkout/sessions") {
+      return json(201, {
+        sessionId: "cs_test_a1",
+        url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+      });
+    }
+    return json(200, {
+      ok: true,
+      data: { status: shownStatus, shownSet: SHOWN_SET },
+    });
+  },
+);
+let warnSpy: jest.SpyInstance;
+
+beforeAll(() => {
+  global.fetch = fetchMock as jest.Mock;
+});
+
+afterAll(() => {
+  global.fetch = realFetch;
+  for (const name of ENV_NAMES) {
+    if (savedEnv[name] === undefined) delete env[name];
+    else env[name] = savedEnv[name];
+  }
+});
+
+beforeEach(() => {
+  for (const name of ENV_NAMES) delete env[name];
+  env.NODE_ENV = "production";
+  env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
+  shownStatus = "unconnected";
+  fetchMock.mockClear();
+  warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  warnSpy.mockRestore();
+});
+
+/** A buyer's click on `growth_monthly`, served by a site of `topology`. */
+async function buy(topology: "hub" | "spoke"): Promise<Response> {
+  let res: Response | undefined;
+  await jest.isolateModulesAsync(async () => {
+    // A doMock outlives the registry it was made in, so a hub case undoes it.
+    if (topology === "spoke") {
+      jest.doMock(ORIGIN_SEAM, () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      jest.doMock(TOPOLOGY_SEAM, () => ({
+        ...jest.requireActual(TOPOLOGY_SEAM),
+        TOPOLOGY: "spoke",
+      }));
+    } else {
+      jest.dontMock(ORIGIN_SEAM);
+      jest.dontMock(TOPOLOGY_SEAM);
+    }
+    const { GET } = await import("../route");
+    const request = new Request(
+      "https://shop.example.com/api/offerings/checkout/growth_monthly",
+      {
+        headers: {
+          "sec-fetch-mode": "navigate",
+          "sec-fetch-dest": "document",
+          "sec-fetch-site": "same-origin",
+        },
+      },
+    );
+    res = await GET(request, {
+      params: Promise.resolve({ lookupKey: "growth_monthly" }),
+    });
+  });
+  if (res === undefined) throw new Error("the route did not answer");
+  return res;
+}
+
+function postHeaders(): Record<string, string> {
+  const post = fetchMock.mock.calls.find(
+    ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+  );
+  if (post === undefined) throw new Error("no session POST");
+  return (post[1]?.headers ?? {}) as Record<string, string>;
+}
+
+describe("the route's API origin comes from the topology seam", () => {
+  it("on a spoke, a set NEXT_PUBLIC_AILK_API_URL is not an API origin", async () => {
+    env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+    const res = await buy("spoke");
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe("/pricing");
+    expect(warnSpy).toHaveBeenCalledWith(
+      "[offerings-checkout] refused reason=unconnected",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("on a spoke, the server-only AILK_API_URL is the API origin", async () => {
+    env.AILK_API_URL = HUB_API;
+
+    await buy("spoke");
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  // The committed seam is the hub render, so this case runs it unmocked.
+  // #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, NEXT_PUBLIC_AILK_API_URL is the API origin through the seam",
+    async () => {
+      env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+      await buy("hub");
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("a spoke with no spoke key never sends the internal secret", async () => {
+    // The transport check skips NEXT_PUBLIC_AILK_API_URL on a spoke, while
+    // the api-client still sends there: only the topology withholds it.
+    env.NODE_ENV = "test";
+    env.NEXT_PUBLIC_AILK_API_URL = "http://api.remote.example";
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    shownStatus = "shown";
+
+    await buy("spoke");
+
+    expect(postHeaders()["x-internal-auth"]).toBeUndefined();
+  });
+});

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -14,8 +14,10 @@
 import { checkout, offerings } from "@working-theory/api-client";
 import { parseLookupKey } from "@working-theory/validation";
 
+import { browserApiOrigin } from "../../../../../lib/api-origin.generated";
 import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
 import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
 import { resolveBaseUrl } from "../../../../../src/lib/routes";
 
@@ -70,12 +72,14 @@ function isBuyerNavigation(request: Request): boolean {
 
 /**
  * The API origin, in the order `getApiBase()` in
- * packages/api-client/src/http.ts reads it.
+ * packages/api-client/src/http.ts reads it. The browser-facing origin comes
+ * from the topology seam (#7874 D12), which a spoke renders with no env read,
+ * so a spoke passes its own `env:check` (#9419).
  */
 function configuredApiBase(): string | undefined {
   return (
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL ||
     undefined
   );
@@ -203,6 +207,8 @@ const START_TIMEOUT_MS = 10_000;
  * D5 — the visitor's forwarded address, so the API's per-IP bucket counts
  * buyers, and the internal secret only from a site that is not a spoke and
  * only to an `https:` or loopback API. Nothing else of the request is sent.
+ * A spoke topology withholds it even with no spoke key: its transport check
+ * skips `NEXT_PUBLIC_AILK_API_URL`, which the api-client still sends to.
  */
 function startHeaders(incoming: Headers): Record<string, string> {
   const headers: Record<string, string> = {};
@@ -210,7 +216,8 @@ function startHeaders(incoming: Headers): Record<string, string> {
   if (visitor) headers["x-forwarded-for"] = visitor;
 
   const secret = process.env.OSS_API_INTERNAL_SECRET;
-  if (secret && !process.env.AILK_SPOKE_KEY?.trim() && isSafeApiTransport()) {
+  const spoke = TOPOLOGY === "spoke" || !!process.env.AILK_SPOKE_KEY?.trim();
+  if (secret && !spoke && isSafeApiTransport()) {
     headers["x-internal-auth"] = secret;
   }
   return headers;

package/templates/apps/web/app/api/revalidate/route.ts

@@ -31,7 +31,7 @@
  *
  * Replay window (D7, reopened and closed by #5902): a captured delivery
  * verifies for 5 minutes and no longer, the Slack receiver's tolerance
- * (apps/api/src/routes/slack/actions.ts). Within the window a replay is a
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts). Within the window a replay is a
  * second revalidateTag on an already-purged tag — a no-op — so the receiver
  * still keeps no seen-set.
  *
@@ -65,7 +65,7 @@ const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
 const TIMESTAMP_SHAPE = /^[0-9]{1,12}$/;
 
 /**
- * The sender's bounds (apps/api/src/services/revalidation.ts), applied again
+ * The sender's bounds (packages/api/src/services/revalidation.ts), applied again
  * here because this route is unauthenticated until the MAC verifies and the
  * values become cache tags. `workspaceId` is logged, never tagged, so it stays
  * a plain string.
@@ -90,7 +90,7 @@ type RevalidateBody = z.infer<typeof bodySchema>;
 
 /**
  * Line-for-line the repo's one shipped verifier
- * (apps/api/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
  * base string extended by the event (#5902). The length guard is required,
  * not decorative: timingSafeEqual throws on unequal lengths. The `sha256=`
  * prefix stays inside the compared material so a same-length `sha512=` header

package/templates/apps/web/auth.ts

@@ -560,7 +560,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      *
      * So: when the IP is resolvable the § D8a values apply as specified; when
      * it is not, we fall through to the library's shorter-recovery defaults.
-     * This is the same reasoning `apps/api/src/lib/auth-email-budget.ts`
+     * This is the same reasoning `packages/api/src/lib/auth-email-budget.ts`
      * applies to the site-wide send cap it declines to implement — a
      * site-wide cap an attacker can hold open is a denial of the control it
      * implements — and the two now agree instead of contradicting each other.
@@ -568,7 +568,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      * STORAGE CAVEAT, load-bearing and NOT solved here: `"memory"` is a
      * process-local Map, so on a multi-instance deployment the effective
      * ceiling is 5 × N per 900 s — the identical caveat
-     * `apps/api/src/middleware/rate-limit.ts` documents for itself. The
+     * `packages/api/src/middleware/rate-limit.ts` documents for itself. The
      * durable alternative needs a rate-limit table the schema does not have,
      * and this issue adds no migration. What does bound the consequence is
      * the per-recipient send budget at the apps/api relay.

package/templates/apps/web/jest.config.cjs

@@ -3,6 +3,7 @@
 module.exports = {
   preset: "ts-jest",
   globalSetup: require.resolve("../../tools/jest/pin-timezone.cjs"),
+  reporters: require("../../tools/jest/reporters.cjs"),
   testEnvironment: "jsdom",
   roots: [
     "<rootDir>/__tests__",

package/templates/apps/web/lib/__tests__/magnet-routes.test.ts

@@ -14,6 +14,9 @@ describe("isMagnetWalkPath (#8840 D10)", () => {
     "/careers/writer/apply",
     "/fr/careers/writer/apply",
     "/diagnostic/start?step=2",
+    "/trial/request",
+    "/en/trial/request",
+    "/fr/trial/request",
   ])("is a walk: %s", (path) => {
     expect(isMagnetWalkPath(path, LOCALES)).toBe(true);
   });
@@ -28,6 +31,10 @@ describe("isMagnetWalkPath (#8840 D10)", () => {
     "",
     "/apply",
     "/careers/a/b/apply",
+    "/trial",
+    "/en/trial",
+    "/request",
+    "/trial/a/request",
   ])("is not a walk: %j", (path) => {
     expect(isMagnetWalkPath(path, LOCALES)).toBe(false);
   });

package/templates/apps/web/lib/auth-email.ts

@@ -18,7 +18,7 @@
  *
  * ONE SERIALIZATION. `buildAuthEmailRequest` builds the body string ONCE,
  * signs THAT string, and hands the same string to the transport — the
- * invariant `apps/api/src/services/revalidation.ts` states for itself ("a
+ * invariant `packages/api/src/services/revalidation.ts` states for itself ("a
  * key-order or whitespace drift between signer and sender is impossible by
  * construction"). This is why the call cannot go through the client's
  * `post()`, which stringifies its own payload argument.

package/templates/apps/web/lib/magnet-routes.ts

@@ -12,7 +12,8 @@
  * rather than writing a second predicate. #8848 D9 adds every page under
  * `/reports/<slug>` — a gated landing, an ungated reader and the grant
  * reader alike, since the path cannot tell them apart; `/reports` itself
- * keeps its chrome.
+ * keeps its chrome. #9287 DD10 adds `/trial/request`, the trial magnet's
+ * walk; `/trial`, its landing, keeps its chrome.
  *
  * Fail-safe direction, as `isAuthPath()`: an absent or empty pathname
  * answers `false`, so a missing `x-pathname` never strips a page's chrome.
@@ -34,6 +35,7 @@ export function isMagnetWalkPath(
   if (segments.length === 0) return false;
   if (segments[segments.length - 1] === "start") return true;
   if (segments[0] === "reports" && segments.length === 2) return true;
+  if (segments.length === 2 && segments[0] === "trial" && segments[1] === "request") return true;
   return (
     segments[0] === "careers" &&
     segments[segments.length - 1] === "apply" &&

package/templates/apps/web/lib/newsletter.actions.ts

@@ -6,7 +6,9 @@
  *
  * `/newsletter` and the footer render the newsletter magnet's
  * `NewsletterFormInline` bound to this action. Validates the address with
- * the tool's own input schema, calls `POST /v1/leads/subscribe` through
+ * its own `newsletterFormSchema` (the form's one field is the page's, not a
+ * wire contract — the `subscribe_newsletter` MCP tool takes the route body
+ * since #7172), calls `POST /v1/leads/subscribe` through
  * `@working-theory/api-client`, and maps the outcome the same way
  * `captureLeadAction` does: the API's 503 `lead_capture_not_configured` →
  * `unavailable`; any other non-2xx or thrown error → the generic `error`;
@@ -34,12 +36,10 @@
 
 import { flows, leads, visitorForwardHeaders } from "@working-theory/api-client";
 import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
-import {
-  NEWSLETTER_FLOW_SLUG,
-  subscribeNewsletterInputSchema,
-} from "@working-theory/validation";
+import { NEWSLETTER_FLOW_SLUG } from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
 import { getLocale } from "next-intl/server";
+import { z } from "zod";
 
 import { checkRateLimit, clientIpFromHeaders } from "../src/lib/rate-limit";
 
@@ -55,6 +55,9 @@ const RATE_LIMITED = "Too many signups from here. Please try again in a few minu
 const RATE_LIMIT_MAX_CALLS = 30;
 const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
 
+/** The form's one field; zod's default message is the field error shown. */
+const newsletterFormSchema = z.object({ email: z.string().email() });
+
 /** The API's 503 for a deployment with nowhere to keep a lead. */
 function isNotConfigured(res: { status: number; body: unknown }): boolean {
   return (
@@ -122,7 +125,7 @@ export async function subscribeNewsletterAction(
   const honeypot = formData.get(LEAD_CAPTURE_HONEYPOT);
   if (typeof honeypot === "string" && honeypot !== "") return { kind: "success" };
 
-  const parsed = subscribeNewsletterInputSchema.safeParse({
+  const parsed = newsletterFormSchema.safeParse({
     email: formData.get("email"),
   });
   if (!parsed.success) {

package/templates/apps/web/lib/relay.ts

@@ -132,7 +132,7 @@ type RateLimitBucket = {
 // Module-scoped store, shared by the visitor (`visitor|<identity>`) and
 // session (`session|<identity>`) budgets (D7: same identity, window and
 // store). Ported from the hub's own limiter
-// (`apps/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
+// (`packages/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
 // cannot import `apps/api`.
 const rateLimitBuckets = new Map<string, RateLimitBucket>();
 let requestsSinceSweep = 0;
@@ -181,7 +181,7 @@ function hit(key: string, now: number): RateLimitBucket {
 
 /**
  * The eight hextets of a valid IPv6 address, or `null`. Ported from the
- * hub's own `expandIpv6` (`apps/api/src/middleware/rate-limit.ts`).
+ * hub's own `expandIpv6` (`packages/api/src/middleware/rate-limit.ts`).
  */
 function expandIpv6(address: string): number[] | null {
   let text = address;

package/templates/apps/web/lib/release-scope.ts

@@ -0,0 +1,47 @@
+/**
+ * Whether create-ailk's release scope marks the Free level released (#9534).
+ *
+ * `/.well-known/mcp.json` leaves `create_project` out while Free is held, in
+ * step with `apps/mcp`, whose `isFreeLevelReleased()` (`src/tools/
+ * create_project.ts`) registers the tool on the same read. apps/web cannot
+ * import apps/mcp, so this is the same predicate over the same file:
+ * `<cwd>/packages/create-ailk/release-scope.json` — present only in a
+ * monorepo checkout started from the repo root, which is also the only place
+ * the MCP server can spawn the CLI. The scope FILE alone decides (the CLI's
+ * `AILK_RELEASE_SCOPE=ignore` bypass is not honoured); a missing or
+ * unreadable file fails closed, with one line on stderr.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+let releaseScopeFileOverride: string | undefined;
+
+export function isFreeLevelReleased(): boolean {
+  const file =
+    releaseScopeFileOverride ??
+    join(process.cwd(), "packages/create-ailk/release-scope.json");
+  try {
+    const scope = JSON.parse(readFileSync(file, "utf8")) as {
+      levels?: Record<string, unknown>;
+    };
+    return scope.levels?.["free"] === "released";
+  } catch (err) {
+    console.warn(
+      `[web] create_project is left out of /.well-known/mcp.json: release scope ${file} could not be read (${
+        err instanceof Error ? err.message : String(err)
+      })`,
+    );
+    return false;
+  }
+}
+
+/** Test-only: point {@link isFreeLevelReleased} at a scope copy. */
+export function __setReleaseScopeFileForTest(file: string | undefined): void {
+  if (process.env["NODE_ENV"] !== "test") {
+    throw new Error(
+      "__setReleaseScopeFileForTest is test-only and cannot run outside a test",
+    );
+  }
+  releaseScopeFileOverride = file;
+}

package/templates/apps/web/lib/server-api.ts

@@ -17,7 +17,7 @@
  * hand-rolled `fetch`. This module supplies exactly the two things that
  * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
- * (mirrors `apps-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
+ * (mirrors `packages-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */

package/templates/apps/web/src/lib/commerce-claim.ts

@@ -6,7 +6,7 @@
  * only its import line moves. `/purchase/success` and `/purchase/cancel`
  * need the identical check (D12's shape-2 gate: the pages ship BASE TREE
  * and gate at REQUEST time on this claim, exactly as the checkout
- * primitives do — `apps/api/src/lib/require-commerce-claim.ts`), so this is
+ * primitives do — `packages/api/src/lib/require-commerce-claim.ts`), so this is
  * extracted ONCE and imported three times rather than copied a third time.
  *
  * Fail-closed (NFR-3 mirror): anything short of a positively-held,

package/templates/customizations.yaml

@@ -0,0 +1,37 @@
+# customizations.yaml — every source file under apps/ this site authored,
+# mapped to the issue that asked for it and the build-in decision.
+#
+# A customization is the exception: AILK builds it in unless AILK decides not
+# to. `pnpm architecture` (and the PostToolUse hook) refuses a code file under
+# apps/ the scaffold did not ship when no entry's paths match it. Record the
+# entry BEFORE you write the file.
+#
+# An entry:
+#   - id: booking-embed                 # unique; lowercase letters, digits, hyphens
+#     paths:                            # one or more; under apps/; ** spans
+#       - "apps/web/components/booking/**"   # segments, * stays inside one;
+#     request: "acme/acme-site#12"      # the issue that asked; <owner/repo>#N or #N
+#     decision: "build-in: ailk#9300 — removed when the bump lands"
+#
+# The decision is exactly one of:
+#   build-in: ailk#<N>[ — <text>]      AILK builds it; the site takes the bump,
+#                                      and this copy and its tests go then.
+#                                      An entry whose paths still match test
+#                                      files is refused: tests belong in AILK.
+#   build-in: site — <decider>, <YYYY-MM-DD>, <reason>
+#                                      AILK decided not to; the site keeps it.
+#   undecided                          only while the grace line below is in
+#                                      the future (strictly after today, UTC):
+#                                        undecided_ok_until: 2027-01-31
+#
+# Seeding an existing site:
+#   1. Copy tools/lint-architecture.ts (and this file, if absent) from a fresh
+#      scaffold of this create-ailk version.
+#   2. Run `create-ailk --sync-architecture <the modules in architecture.yaml's
+#      header>`.
+#   3. If .ailk-template-files.json is missing, run `create-ailk update`.
+#   4. Set `undecided_ok_until` to the groundskeeper's deadline.
+#   5. Change the last line of this file to `customizations:` and append the
+#      output of `pnpm exec tsx tools/lint-architecture.ts --seed-customizations`.
+#   6. Run `pnpm architecture`, which prints `architecture: OK`.
+customizations: []

package/templates/database/prisma.config.ts

@@ -1,20 +1,16 @@
-// Prisma 7 CLI config.
+// The schema and every migration ship in the installed @working-theory/database;
+// this site carries none. Take new migrations by bumping that dependency, then
+// run `pnpm db:migrate:deploy`. Never add a migration or a .prisma file here.
 //
-// Runtime DB URL (DATABASE_URL, pooled) is injected into the driver adapter at
-// PrismaClient construction in apps/api and apps/web — it does NOT appear here.
-// Migrate-time DB URL (DATABASE_URL_NON_POOLED, direct) is read here and
-// consumed by `prisma migrate`. The two-env-var contract from the migration
-// brief's D2 is preserved.
-//
-// `dotenv/config` is imported because the Prisma 7 CLI runs in its own process
-// and does not inherit .env values from a parent shell.
-
+// DATABASE_URL_NON_POOLED is the direct connection `prisma migrate` uses; the
+// apps' pooled DATABASE_URL is read at runtime, never here.
 import "dotenv/config";
 import { defineConfig } from "prisma/config";
 
+const pkg = "../node_modules/@working-theory/database";
+
 export default defineConfig({
-  schema: ".",
-  datasource: {
-    url: process.env.DATABASE_URL_NON_POOLED,
-  },
+  schema: pkg,
+  migrations: { path: `${pkg}/migrations` },
+  datasource: { url: process.env.DATABASE_URL_NON_POOLED },
 });

package/templates/database/seed-test.ts

@@ -16,7 +16,7 @@
  * `update: {}` clause leaves existing rows untouched).
  *
  * Run via:
- *   pnpm --filter @working-theory/database db:seed:test
+ *   pnpm db:seed:test
  *
  * Environment variables read:
  *   AILK_TEST_AUTH_ENABLED   — must be the literal string "true" or this
@@ -27,7 +27,7 @@ import "dotenv/config";
 
 import { PrismaPg } from "@prisma/adapter-pg";
 
-import { PrismaClient } from "./generated/client/client.js";
+import { PrismaClient } from "@working-theory/database";
 
 // Fixed, well-known ids from the ADR-0031 reserved sentinel range (zero
 // timestamp + version 7 + variant 8 + counter) — valid-shaped ids the