create-ailk 0.23.0 → 0.25.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.23.0",
+  "version": "0.25.1",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.44.0",
-    "@working-theory/templates": "0.44.0"
+    "@working-theory/schema": "0.46.0",
+    "@working-theory/templates": "0.46.0"
   },
   "repository": {
     "type": "git",

package/release-scope.json

@@ -21,5 +21,5 @@
     "multi-tenant": "gated",
     "commerce": "gated"
   },
-  "levels": { "free": "released", "pro": "released", "pro-plus": "gated" }
+  "levels": { "free": "deferred", "pro": "released", "pro-plus": "gated" }
 }

package/templates/.claude/cloudparity-repo-hooks.json

@@ -1,5 +1,10 @@
 {
   "hooks": [
+    {
+      "event": "PreToolUse",
+      "matcher": "Edit|Write",
+      "command": "bash .claude/hooks/template-guard.sh"
+    },
     {
       "event": "PostToolUse",
       "matcher": "Edit|Write",

package/templates/.claude/hooks/template-guard.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# PreToolUse (Edit|Write): refuse an unrecorded edit to a template-owned file.
+# A code file under apps/ that .ailk-template-files.json records, whose bytes
+# still match the template's sha256, is refused (exit 2) unless an entry in
+# customizations.yaml names it; the refusal on stderr names the file, the
+# entry to add and the upstream route. An edited, unrecorded or manifest-named
+# file passes. A site with no record warns and passes. Pure bash, grep, awk
+# and sha256sum/shasum — nothing a scaffold has to install. Registered in
+# .claude/settings.json and declared in .claude/cloudparity-repo-hooks.json;
+# keep the two in step.
+export LC_ALL=C
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+IFS= read -r -d '' input
+[[ $input =~ \"file_path\"[[:space:]]*:[[:space:]]*\"([^\"\\]*)\" ]] || exit 0
+rel=${BASH_REMATCH[1]}
+case $rel in
+  "$PWD"/*) rel=${rel#"$PWD"/} ;;
+  /*) exit 0 ;;
+  ./*) rel=${rel#./} ;;
+esac
+# Only a code file under one of the three recordable roots can be template-owned.
+case $rel in
+  *.d.ts) exit 0 ;;
+  apps/web/*|apps/api/*|apps/mcp/*)
+    case $rel in
+      *.ts|*.tsx|*.js|*.jsx|*.mts|*.cts|*.mjs|*.cjs) ;;
+      *) exit 0 ;;
+    esac ;;
+  *) exit 0 ;;
+esac
+case "/$rel/" in
+  */./*|*/../*|*//*) exit 0 ;;
+esac
+
+record=.ailk-template-files.json
+if [ ! -f "$record" ]; then
+  printf '%s\n' '{"systemMessage":"template-guard: warning — no .ailk-template-files.json, so template files cannot be told from site files and edits under apps/ are not guarded; run create-ailk update to write it"}'
+  exit 0
+fi
+# The record is written by serializeTemplateRecord only: one `    "<path>": {`
+# line per file, its `"sha256"` on the next.
+row=$(grep -F -x -A1 -- "    \"$rel\": {" "$record") || exit 0
+[[ $row =~ \"sha256\":[[:space:]]*\"([0-9a-f]{64})\" ]] || exit 0
+template=${BASH_REMATCH[1]}
+[ -f "$rel" ] || exit 0
+
+if command -v sha256sum >/dev/null 2>&1; then
+  disk=$(sha256sum -- "$rel")
+elif command -v shasum >/dev/null 2>&1; then
+  disk=$(shasum -a 256 -- "$rel")
+else
+  printf '%s\n' '{"systemMessage":"template-guard: warning — neither sha256sum nor shasum is on PATH, so edits to template files are not guarded"}'
+  exit 0
+fi
+# Edited already (update's own rule): the owner's file, a three-way-merge target.
+[ "${disk%% *}" = "$template" ] || exit 0
+
+# Named by a customizations.yaml pattern? Read lexically: every quoted scalar
+# and every `- <plain>` item outside a comment that starts `apps/`, matched as
+# a glob where `**` spans segments, `*` stays inside one and all else is literal.
+if [ -f customizations.yaml ] && awk -v rel="$rel" -v sq="'" '
+  function matches(pat,    n, seg, i, j, c, re, s) {
+    if (pat !~ /^apps\//) return 0
+    n = split(pat, seg, "/")
+    re = "^"
+    for (i = 1; i <= n; i++) {
+      s = seg[i]
+      if (s == "**") { re = re (i == n ? ".*" : "([^/]+/)*"); continue }
+      for (j = 1; j <= length(s); j++) {
+        c = substr(s, j, 1)
+        if (c == "*") re = re "[^/]*"
+        else if (c == "]") re = re "[]]"
+        else if (c == "^") re = re "\\^"
+        else if (c == "\\") re = re "\\\\"
+        else if (index(".[()+?{}|$", c)) re = re "[" c "]"
+        else re = re c
+      }
+      if (i < n) re = re "/"
+    }
+    return rel ~ (re "$")
+  }
+  /^[ \t]*#/ { next }
+  {
+    line = $0; n = length(line); quote = ""; cut = n
+    for (i = 1; i <= n; i++) {
+      c = substr(line, i, 1)
+      if (quote != "") { if (c == quote) quote = ""; continue }
+      if (c == "\"" || c == sq) { quote = c; continue }
+      if (c == "#" && (i == 1 || substr(line, i - 1, 1) ~ /[ \t]/)) { cut = i - 1; break }
+    }
+    line = substr(line, 1, cut)
+    rest = line
+    while (match(rest, "\"[^\"]*\"|" sq "[^" sq "]*" sq)) {
+      if (matches(substr(rest, RSTART + 1, RLENGTH - 2))) { found = 1; exit }
+      rest = substr(rest, RSTART + RLENGTH)
+    }
+    if (match(line, /^[ \t]*- /)) {
+      item = substr(line, RLENGTH + 1)
+      sub(/[ \t]+$/, "", item)
+      if (matches(item)) { found = 1; exit }
+    }
+  }
+  END { exit !found }
+' customizations.yaml; then
+  exit 0
+fi
+
+# The seed id (#9223's rule) and the issue title, percent-encoded byte by byte.
+out=$(awk -v rel="$rel" '
+  BEGIN {
+    id = tolower(rel); gsub(/[^a-z0-9]+/, "-", id); sub(/^-/, "", id); sub(/-$/, "", id)
+    for (i = 1; i < 256; i++) ord[sprintf("%c", i)] = i
+    s = "Template change: " rel
+    for (i = 1; i <= length(s); i++) {
+      c = substr(s, i, 1)
+      title = title (c ~ /[A-Za-z0-9._~-]/ ? c : sprintf("%%%02X", ord[c]))
+    }
+    print id; print title
+  }')
+id=${out%%$'\n'*}
+title=${out#*$'\n'}
+
+printf '%s\n' >&2 \
+  "template-guard: $rel is a template file, unchanged since create-ailk wrote it, and no customizations.yaml entry names it." \
+  "A template file takes its fixes from create-ailk update; change it here only once the change is recorded." \
+  "Fix, one of:" \
+  "  1. Record it: add this entry under customizations: in customizations.yaml, fill in request and decision, then retry." \
+  "       - id: $id" \
+  "         paths:" \
+  "           - \"$rel\"" \
+  "         request: \"<owner>/<repo>#<issue>\"" \
+  "         decision: \"build-in: site — <decider>, <YYYY-MM-DD>, <reason>\"" \
+  "     decision is one of: build-in: ailk#<N> | build-in: site — <decider>, <YYYY-MM-DD>, <reason> | undecided (only while undecided_ok_until is in the future)." \
+  "  2. File it upstream, so AILK builds it in and this site takes it as a version bump:" \
+  "       https://github.com/working-theory-labs/ai-launch-kit/issues/new?title=$title"
+exit 2

package/templates/.claude/rules/extending.md

@@ -0,0 +1,106 @@
+# Extending the Site
+
+## The five extension points
+
+This site stays upgradeable because it changes in five sanctioned ways,
+and only five. From the program decision, with the manifest named:
+
+> site config and content; the design package and theme; a section swap through the sections registry; wrapping a published component from an app; a site-authored file recorded in `customizations.yaml` with a build-in decision.
+
+Everything else files upstream. The manifest's `undecided_ok_until`
+grace is the only escape valve.
+
+## Why this matters
+
+- Every `@working-theory/*` package and every template-owned file is
+  replaced on upgrade. A change made anywhere else is a change the next
+  `create-ailk update` either overwrites or has to merge by hand.
+- The five points are the places an upgrade preserves. Work done through
+  them survives a bump without a merge.
+- A site that drifts outside them is a fork in all but name, and a fork
+  stops getting fixes.
+
+## How to apply
+
+Find the point your change belongs to, in this order, and use the first
+that fits:
+
+1. **Site config and content.** The site's name, identity entity, `theme:`
+   and `brand:` are `content/_site.mdx`; every page is an MDX file under
+   `content/<locale>/<TypeName>/`. New copy, a new page, a changed nav
+   label, which section a page renders and where it stands in the page's
+   `sections:` list: all content.
+2. **The design package and theme.** The locked look is `DESIGN.md` plus
+   the `theme:` block in `_site.mdx`. A different look is
+   `pnpm create ailk@latest apply-design <name|path>`, which keeps
+   `brand:`; the owner's colours and fonts are the `brand:` block.
+3. **A section swap through the sections registry.** When a section
+   needs different markup, the site registers a local component for that
+   section name in place of the published one (ADR 0007): the registry
+   seam is `registerSliceRenderer` from `@working-theory/ui`, and it
+   accepts only the keys the runtime offers for a swap (today `booker` and
+   `payment-receipt`); any other key is refused, not swapped. The local
+   component is site-authored code under `apps/`, so it is also recorded
+   under point five. A section the runtime offers no swap for is an
+   upstream request, not a component you write into the app.
+4. **Wrapping a published component from an app.** When a published
+   component must behave differently here, wrap it in a file of this
+   site's and import the wrapper: never edit the package, patch it, or
+   copy its source in. The wrapper is site-authored code under `apps/`, so
+   it is also recorded under point five.
+5. **A site-authored file recorded in `customizations.yaml` with a
+   build-in decision.** Source under `apps/` that none of the first four
+   points covers is the exception, and the exception is recorded before
+   it is written. One entry per customization:
+
+   ```yaml
+   undecided_ok_until: 2027-01-31 # optional; YYYY-MM-DD
+   customizations: # required; may be []
+     - id: booking-embed # required; unique; /^[a-z0-9][a-z0-9-]*$/
+       paths: # required; ≥1; each starts "apps/"; no ".." segment
+         - "apps/web/components/booking/**"
+       request: "salessmyth/wendihenry#12" # /^([\w.-]+\/[\w.-]+)?#\d+$/; required unless undecided
+       decision: "build-in: ailk#9300 — removed when the bump lands"
+   ```
+
+   `decision` is exactly one of:
+
+   - `undecided`
+   - `build-in: ailk#<N>`, optionally followed by ` — <text>`
+   - `build-in: site — <decider>, <YYYY-MM-DD>, <reason>`
+
+   AILK builds a customization in unless it decides not to. `build-in:
+ailk#N` means AILK ships it and this site's copy, tests included, goes
+   when the bump lands. `build-in: site` means AILK decided not to, and
+   the site keeps the file with the decider, the date and the reason.
+   `pnpm architecture` refuses site code with no entry.
+
+## Everything else files upstream
+
+A change that fits none of the five is a request to AI Launch Kit, not an
+edit here. Open an issue at
+<https://github.com/working-theory-labs/ai-launch-kit/issues> describing
+what the site needs and why the five points do not cover it, and record
+the request's issue in the manifest entry. Do not edit a template-owned
+file, do not patch or pin off a `@working-theory/*` package (the
+architecture rule already refuses each), and do not carry the change as
+an unrecorded file.
+
+## The one escape valve
+
+An `undecided` entry passes the lint only while `undecided_ok_until` is a
+date strictly after today (UTC). It exists so a site can be seeded, or a
+request can be filed and decided, without going red the same day. It is
+a deadline, not a state: when the date passes, record the decision or
+move it with the request's owner.
+
+## Escalation
+
+Stop and surface the question rather than decide alone if:
+
+- A change seems to need a sixth way in: an edit to a template-owned
+  file, a package patch, a copied source tree.
+- The right point is unclear between four and five, or between three and
+  an upstream request.
+- An `undecided` entry is about to go out of grace with no decision on
+  its request.

package/templates/.claude/rules/loop-contract.md

@@ -70,8 +70,8 @@ result on the PR.
 
 For PRs touching specific surfaces:
 
-- `database/` schema changes — also run `pnpm db:migrate` locally if
-  you added a migration.
+- `database/` — never add a migration or a schema file; bump
+  `@working-theory/database` and run `pnpm db:migrate:deploy`.
 
 ## Commit + PR
 

package/templates/.claude/settings.json

@@ -1,5 +1,16 @@
 {
   "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/template-guard.sh"
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Edit|Write",

package/templates/.env.example

@@ -148,7 +148,7 @@ CONTENT_ADAPTER=mdx
 # ── Site id (apps/api, apps/web) ─────────────────────────────────────────────
 # The scope captured rows are stamped with. Lead, WaitlistExperiment and
 # ProjectListing carry `siteId`, which defaults to the literal "default"
-# (apps/api/src/lib/site.ts), while tenancy scopes reads by WORKSPACE id.
+# (packages/api/src/lib/site.ts), while tenancy scopes reads by WORKSPACE id.
 # A single-tenant deployment should set this to the default workspace
 # sentinel so the two agree:
 # AILK_SITE_ID=wksp_00000000-0000-7000-8000-000000000001
@@ -381,7 +381,7 @@ CONTENT_ADAPTER=mdx
 
 # ── E2E test-auth seam (pre-OSS — never set in production) ───────────────────
 # These two env vars enable the test-auth route at POST /api/test/auth/session
-# (apps/api/src/routes/test/auth/session.ts) so an e2e harness can mint a
+# (packages/api/src/routes/test/auth/session.ts) so an e2e harness can mint a
 # Better Auth session for a seeded test user WITHOUT going through Google
 # OAuth, GitHub OAuth, or magic-link email.
 #
@@ -396,7 +396,7 @@ CONTENT_ADAPTER=mdx
 #
 # Allowlist format: comma-separated user IDs (exact-match strings; no regex,
 # no wildcard). Empty entries between commas are trimmed.
-# Run `pnpm --filter @working-theory/database db:seed:test` to seed three test users
+# Run `pnpm db:seed:test` to seed three test users
 # (user_00000000-0000-7000-8000-0000000000e1 / …e2 / …e3 — reserved-range
 # prefixed ids per ADR-0031, distinguished by the Better Auth `role` field).
 # The seed script itself refuses to run unless
@@ -446,6 +446,10 @@ CONTENT_ADAPTER=mdx
 # that database. Rotation and the rekey bin: apps/api/.env.example.
 # STRIPE_CONNECTION_KEY=
 # STRIPE_CONNECTION_KEY_PREVIOUS=
+# The Organization that owns STRIPE_SECRET_KEY (#9285): with the multi-tenant
+# module only the Organization whose id is named here sells through it; unset
+# means nobody. Without the module the single Organization owns it.
+# STRIPE_ENV_ORGANIZATION_ID=
 # HMAC-SHA256 key POST /v1/webhooks/calcom verifies the x-cal-signature-256
 # header against (#6085). Unset makes the receiver answer 503 and accept
 # nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
@@ -529,7 +533,7 @@ CONTENT_ADAPTER=mdx
 # pre-#5040 in-process Map, which does not. Default: `database` when
 # DATABASE_URL is set, else `memory`. A database failure or a 1s-slow call
 # falls back to the in-process Map for that request rather than letting it
-# through uncounted. Run `pnpm --filter @working-theory/api rate-limit:probe
+# through uncounted. Run `pnpm --filter @working-theory/app-api rate-limit:probe
 # --origin <https origin>` against a live deployment to check which store it
 # selected and whether a burst holds — see
 # docs/runbooks/site-configuration.md.
@@ -543,7 +547,7 @@ CONTENT_ADAPTER=mdx
 #
 # Hub and spokes — a spoke's reads and writes resolve to ITS OWN workspace
 # (#7532). A hub holding one workspace per spoke registers each spoke in its
-# database (`pnpm --filter @working-theory/api spokes register --workspace
+# database (`pnpm --filter @working-theory/app-api spokes register --workspace
 # <wksp_id> --name <label>`), which prints the spoke's key once. The spoke
 # sends it on every server-side call, and the hub resolves meeting types, the
 # three lead writes, bookings and public content reads to that spoke's

package/templates/.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   ci:
+    # Posted as the `preflight` status check — the one to make required on the
+    # default branch (project.yaml `ci.required_checks`, CLAUDE.md § Checks).
+    name: preflight
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -46,10 +49,10 @@ jobs:
       # real lockfile has been committed.
       - run: pnpm install
 
-      # Prisma's generated client (database/generated/) is a build artifact,
-      # not part of the scaffold — type-check/build/test all resolve
-      # `@working-theory/database`'s generated types, and `prisma generate` needs
-      # no DATABASE_URL (it reads only the schema file, no live DB).
+      # The Prisma client ships prebuilt in the installed @working-theory/database;
+      # `db:generate` (through database/prisma.config.ts) is the cheapest proof
+      # that the installed schema loads under this site's own Prisma CLI, and it
+      # needs no DATABASE_URL (it reads only the schema files, no live DB).
       - run: pnpm db:generate
 
       - run: pnpm type-check

package/templates/CLAUDE.md

@@ -19,14 +19,20 @@ CloudParity block goes just above it.
 apps/web/         Next.js app — visitor-facing UX
 apps/api/         Fastify HTTP API — lead capture, checkout, webhooks
 apps/mcp/         MCP server — agent-callable tools
-database/         Prisma schema + migrations
+database/         Prisma config + seed; schema and migrations ship in @working-theory/database
 content/          Site settings (_site.mdx) and MDX pages (en/<TypeName>/)
 .claude/          Rules, the agent definition and settings for Claude Code
 tools/            This repo's own checks (architecture, CLAUDE.md drift)
 ```
 
-You consume `@working-theory/*` packages from npm. Treat each one as a
-third-party dependency: read its README or its types, not its source.
+You consume `@working-theory/*` packages from npm: read a README or types,
+not the source. Build on one by composing, wrapping or configuring it via
+its documented extension points. Never copy it out of `node_modules`, fork,
+patch or pin it: a copy stops taking fixes. `pnpm architecture` refuses each.
+
+Before you write a new source file under `apps/`, record it in `customizations.yaml`:
+its paths, the request issue, and the build-in decision. AILK builds a customization
+in unless it decides not to. `pnpm architecture` refuses site code with no entry.
 <!-- /ailk:template id="repo-shape" -->
 
 <!-- ailk:template id="architecture" -->
@@ -121,6 +127,12 @@ For design work, the third-party impeccable plugin is optional:
 | `pnpm test`              | Failing unit tests                                       |
 | `/ailk:check-site` skill | Missing or invalid JSON-LD, weak citation-readiness      |
 
+`.github/workflows/ci.yml` runs the preflight checks and `pnpm test` on every
+pull request as the `preflight` status check. One step is yours: make
+`preflight` a required status check on your default branch (GitHub: Settings →
+Branches), so a change that fails it — an AI Launch Kit upgrade included —
+cannot merge.
+
 <!-- /ailk:template id="checks" -->
 
 <!-- ailk:template id="workflow" -->

package/templates/CONVENTIONS.md

@@ -96,13 +96,12 @@ decision — write a short rationale in `docs/` first.
 
 If you've enabled the optional database layer:
 
-- **Prisma is the source of truth.** Schema lives in
-  `prisma/schema.prisma`; migrations are generated with
-  `pnpm db:migrate`.
-- **Migrations are forward-only.** Never edit a migration that has
-  already been applied. Write a corrective migration instead.
-- **No raw SQL outside the migrations folder.** All runtime data
-  access goes through Prisma.
+- **The schema and the migrations ship in `@working-theory/database`.**
+  This site carries neither: `database/prisma.config.ts` points Prisma at
+  the installed package. Take new ones by bumping that dependency and
+  running `pnpm db:migrate:deploy`. Never write a migration or a `.prisma`
+  file here.
+- **No raw SQL; all runtime data access goes through Prisma.**
 - **`@map` for snake_case ↔ camelCase.** DB columns are snake_case;
   TS field names are camelCase.
 - **Index every query you ship.** Add `@@index([...])` for any field
@@ -117,9 +116,8 @@ If you've enabled the optional database layer:
 
 ## Testing
 
-- **Jest + ts-jest** for unit tests, co-located. Each app and `database/`
-  ships its own Jest config; the root `pnpm test` fans out via
-  `pnpm -r test`.
+- **Jest + ts-jest** for unit tests, co-located. Each app ships its own
+  Jest config; the root `pnpm test` fans out via `pnpm -r test`.
   - Source: `Foo.tsx` → tests: `__tests__/Foo.test.tsx`.
   - Run: `pnpm --filter <pkg> test`.
 - **Playwright** for end-to-end (root `e2e/` once you add it).

package/templates/README.md

@@ -33,7 +33,7 @@ pnpm preflight   # architecture + CLAUDE.md drift + types + lint + build
 pnpm build       # production build
 ```
 
-> Requires Node.js 20+ and `pnpm` — that is the whole prerequisite list. No database is needed to run or build this site (see [When you need a database](#when-you-need-a-database)), and no vendor API keys are required for first boot — Stripe, auth and email-provider integrations are opt-in. `pnpm install` generates the Prisma client for you; there is no generator step to remember.
+> Requires Node.js 20+ and `pnpm` — that is the whole prerequisite list. No database is needed to run or build this site (see [When you need a database](#when-you-need-a-database)), and no vendor API keys are required for first boot — Stripe, auth and email-provider integrations are opt-in. The Prisma client ships prebuilt in `@working-theory/database`; there is no generator step to remember.
 
 ## Content
 
@@ -131,7 +131,7 @@ Set `AILK_PUBLIC_DOMAIN` to your own domain. `STEALTH=true` keeps a fresh deploy
 
 ## When you need a database
 
-**A free marketing site needs no database at all.** `pnpm install`, `pnpm dev` and `pnpm build` all run green on an empty machine with no Postgres, no `DATABASE_URL` and no `.env` — the pages render from `content/*.mdx`, and the Prisma client is generated for you by `database`'s `postinstall` so the workspace type-checks and builds either way.
+**A free marketing site needs no database at all.** `pnpm install`, `pnpm dev` and `pnpm build` all run green on an empty machine with no Postgres, no `DATABASE_URL` and no `.env` — the pages render from `content/*.mdx`, and the Prisma client ships prebuilt in `@working-theory/database` so the workspace type-checks and builds either way.
 
 You need Postgres once you turn on one of these:
 
@@ -208,16 +208,17 @@ The AI Launch Kit skills come from the `ailk` Claude Code plugin; `.claude/setti
 
 <!-- generated:begin skills -->
 
-| Skill                  | What it does                                                                                                                            |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| `/ailk:add-auth`       | Activate the site's sign-in providers (email-and-password, Google OAuth, GitHub OAuth) and write the env vars for the ones you pick.    |
-| `/ailk:add-page`       | Add a new page — its content file, its structured data and its nav link — in one confirm-before-write pass.                             |
-| `/ailk:check-site`     | Run `ailk-audit` on the site and explain the score and findings in plain language. It never edits files.                                |
-| `/ailk:fill-page`      | Fill one existing page's section content from a category profile: labelled sample content, or your own first draft from a short intake. |
-| `/ailk:setup-database` | Take the site from no database to a working lead inbox, and prove it with one test message that must appear in the inbox.               |
-| `/ailk:setup-deploy`   | Emit deploy configuration — `vercel.json` and `RUNBOOK.md`, plus an env checklist read from the site's own `.env.example`.              |
-| `/ailk:update-page`    | Rename a page — its URL, its title, or both — in one plan-then-confirm pass, with a permanent redirect from the old URL.                |
-| `/ailk:upgrade-plan`   | Explain the AI Launch Kit options side by side, recommend one option for this site, and link the public pricing page for prices.        |
+| Skill                  | What it does                                                                                                                                                     |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `/ailk:add-auth`       | Activate the site's sign-in providers (email-and-password, Google OAuth, GitHub OAuth) and write the env vars for the ones you pick.                             |
+| `/ailk:add-page`       | Add a new page — its content file, its structured data and its nav link — in one confirm-before-write pass.                                                      |
+| `/ailk:check-site`     | Run `ailk-audit` on the site and explain the score and findings in plain language. It never edits files.                                                         |
+| `/ailk:extend-site`    | Explain the five ways this site may be extended, walk you to the right one, and record a site-authored file in `customizations.yaml` with its build-in decision. |
+| `/ailk:fill-page`      | Fill one existing page's section content from a category profile: labelled sample content, or your own first draft from a short intake.                          |
+| `/ailk:setup-database` | Take the site from no database to a working lead inbox, and prove it with one test message that must appear in the inbox.                                        |
+| `/ailk:setup-deploy`   | Emit deploy configuration — `vercel.json` and `RUNBOOK.md`, plus an env checklist read from the site's own `.env.example`.                                       |
+| `/ailk:update-page`    | Rename a page — its URL, its title, or both — in one plan-then-confirm pass, with a permanent redirect from the old URL.                                         |
+| `/ailk:upgrade-plan`   | Explain the AI Launch Kit options side by side, recommend one option for this site, and link the public pricing page for prices.                                 |
 
 <!-- generated:end -->
 
@@ -225,7 +226,7 @@ The AI Launch Kit skills come from the `ailk` Claude Code plugin; `.claude/setti
 
 This is your code — `{{PROJECT_NAME}}`, owned by {{COMPANY_NAME}} ({{COMPANY_DOMAIN}}). The root `package.json`'s `license` field ships set to `UNLICENSED` as a neutral placeholder; it's yours to change to whatever license suits your project (or to remove entirely if the repo is private).
 
-The `LICENSE` files under `apps/*/` and `database/` are the exception — they stay **Apache 2.0** because those directories are snapshots of `@working-theory/*` packages' own source, not code you authored.
+The `LICENSE` files under `apps/*/` are the exception — they stay **Apache 2.0** because those directories are snapshots of `@working-theory/*` packages' own source, not code you authored.
 
 The AI Launch Kit framework upstream is **Apache 2.0** — see <https://github.com/working-theory-labs/ai-launch-kit/blob/main/LICENSE>. Contributions are welcome at the upstream repo; start with the [contributing guide](https://github.com/working-theory-labs/ai-launch-kit/blob/main/CONTRIBUTING.md).
 

package/templates/apps/api/.env.example

@@ -31,7 +31,7 @@ DATABASE_URL="postgresql://user:password@localhost:5432/customer_template"
 # =============================================================================
 # Stripe (Optional)
 # =============================================================================
-# Consumed by apps/api/src/lib/stripe.ts via @working-theory/stripe-client wrapper.
+# Consumed by packages/api/src/lib/stripe.ts via @working-theory/stripe-client wrapper.
 # Use sandbox keys only — live-mode keys are rejected at runtime, unless
 # STRIPE_MODE=live below admits a restricted live key (#8450).
 STRIPE_SECRET_KEY=sk_test_xxx
@@ -115,7 +115,7 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # ROTATION. Set STRIPE_CONNECTION_KEY_PREVIOUS to the old key and
 # STRIPE_CONNECTION_KEY to a new one, redeploy, run
 # `node dist/bin/stripe-connections-rekey.js` (dev:
-# `pnpm --filter @working-theory/api stripe-connections:rekey`) with the
+# `pnpm --filter @working-theory/app-api stripe-connections:rekey`) with the
 # production environment (VERCEL_ENV=production, or NODE_ENV=production off
 # Vercel) — anywhere else it prints `not_production` and touches nothing —
 # and unset _PREVIOUS once it prints `remaining=0`. A row it counts `unreadable`
@@ -125,6 +125,13 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # STRIPE_CONNECTION_KEY=
 # STRIPE_CONNECTION_KEY_PREVIOUS=
 #
+# The Organization that owns STRIPE_SECRET_KEY (#9285). On a deployment with
+# the multi-tenant module, only the Organization whose id is named here sees
+# that key as its Stripe connection and sells its Offerings through it; unset,
+# blank or naming no Organization, nobody owns it. Without the multi-tenant
+# module the deployment's single Organization owns it and this is not read.
+# STRIPE_ENV_ORGANIZATION_ID=
+#
 # The booking webhook receiver (#6085) — a SEPARATE credential from the
 # three above: it verifies POST /v1/webhooks/calcom's x-cal-signature-256
 # header, it does not call the provider. Unset makes the receiver answer 503