create-ailk 0.26.0 → 0.27.0

package/README.md

@@ -245,8 +245,8 @@ present, and this is the sign-in/account shell" from "always present, and
 this is the marketing core." A gateable surface's routes (`blog`, `docs`,
 `flows`, …) are checked only when the site carries that surface; a surface
 gated off at scaffold time is listed as skipped, not missing — its absence is
-deliberate, not drift. Add a surface with `--sync-architecture` and the
-`add-page` skill, not with `sync-routes`.
+deliberate, not drift. Add a surface with `--sync-architecture` and
+`/ailk:growth-ops page add`, not with `sync-routes`.
 
 **The local-module dependency contract (#5014, #9406).** Some routes import
 files OUTSIDE their own route directory — `purchase/success/page.tsx` imports

package/dist/module-architecture.js

@@ -842,6 +842,8 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/admin/magnets/new/[kind]/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/meetings/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/meetings/[slug]/page.tsx",
+            // #9851 — the Integrations tab.
+            "apps/web/app/[locale]/(authed)/admin/integrations/page.tsx",
         ],
         // patches — the dependency add that delivers the shared package to the
         // buyer's apps/web, mirroring docs-blog's own fumadocs-schema merge-keys

package/dist/surfaces.js

@@ -20,7 +20,7 @@
  *
  * The default (`--modules marketing`) enables NO gateable surface: every one of
  * them is a claim about the business that the scaffolder cannot make. The path
- * from there is the `/ailk:add-page` skill in the `ailk` Claude Code plugin.
+ * from there is `/ailk:growth-ops page add`, from the `ailk` Claude Code plugin.
  *
  * Zero runtime dependencies — create-ailk is a published, standalone CLI.
  *
@@ -731,6 +731,8 @@ export const ROUTE_SINCE = {
     "(authed)/admin/magnets/new/[kind]": "0.46.0",
     "(authed)/admin/meetings": "0.46.0",
     "(authed)/admin/meetings/[slug]": "0.46.0",
+    // #9851 D7 — the Integrations tab, attached at today's fixed-group version.
+    "(authed)/admin/integrations": "0.48.0",
     // #5977 — the Pro content host's editor routes (spec 5872 FR1/FR2), added
     // to apps/web by #5957. Genuinely new route directories, so they attach at
     // today's fixed-group version, the same "attach at today's version" rule
@@ -1083,6 +1085,8 @@ export const ROUTE_DEPENDENCIES = {
     "(authed)/admin/magnets/new/[kind]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
     "(authed)/admin/meetings": ADMIN_PANEL_ROUTE_DEPENDENCIES,
     "(authed)/admin/meetings/[slug]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    // #9851 D7 — the Integrations tab: the nav plus the Slack bindings.
+    "(authed)/admin/integrations": ADMIN_PANEL_ROUTE_DEPENDENCIES,
     "(authed)/waitlist": ["apps/web/lib/server-api.ts"],
     // #8843 D6 — the booking pages share one builder over the meetings read;
     // `/private` returns the index frame that lives under `meet/`.
@@ -1144,6 +1148,7 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/admin/magnets/new/[kind]": ["admin"],
     "(authed)/admin/meetings": ["admin"],
     "(authed)/admin/meetings/[slug]": ["admin"],
+    "(authed)/admin/integrations": ["admin"],
     "(authed)/waitlist": ["waitlistDashboard.gate"],
     // #7744 — the /team hub's empty state reads the `team` namespace.
     team: ["team"],
@@ -1415,7 +1420,7 @@ export function renderNavConfig(enabled, options) {
 // below it, the nav is yours and add-module reports the change it wanted
 // instead.
 //
-// Adding a link: scaffold the page (the \`/ailk:add-page\` skill), then add an
+// Adding a link: scaffold the page (\`/ailk:growth-ops page add\`), then add an
 // entry below with a \`labelKey\` that exists in the \`nav\` namespace of
 // \`apps/web/messages/<locale>.json\`. Paths are locale-agnostic — Nav prefixes
 // them with the active locale at render.

package/dist/update.js

@@ -736,6 +736,47 @@ function planApiMove(targetDir, templatesDir, bootSet, recorded, versions) {
     move.review = unrecorded.review;
     return move;
 }
+// ── The web app's carried dependencies (#9889 D9) ─────────────────────────
+const WEB_PACKAGE_JSON = "apps/web/package.json";
+/**
+ * The third-party packages `update` adds to a site's `apps/web/package.json`
+ * because template-owned web code imports them: `package.json` is never
+ * recorded, so without this a site updated onto that code would not build.
+ * Frozen; a name joins only with a spec.
+ */
+const WEB_CARRIED_DEPENDENCIES = Object.freeze(["botid"]);
+/**
+ * The site's `apps/web/package.json` with each carried dependency the running
+ * template declares and the site does not (in `dependencies` or
+ * `devDependencies`, at any range) added at the template's range, or
+ * `undefined` when there is nothing to add or no web app. Throws before any
+ * write when the site's file is not valid JSON.
+ */
+function planWebDependencies(targetDir, templatesDir) {
+    const sitePath = join(targetDir, ...WEB_PACKAGE_JSON.split("/"));
+    const templatePath = join(templatesDir, ...WEB_PACKAGE_JSON.split("/"));
+    if (!existsSync(sitePath) || !existsSync(templatePath))
+        return undefined;
+    let pkg;
+    try {
+        pkg = JSON.parse(readFileSync(sitePath, "utf8"));
+    }
+    catch (err) {
+        throw new UpdateRefusedError(`${WEB_PACKAGE_JSON} is not valid JSON: ${err.message}`);
+    }
+    const templateDeps = JSON.parse(readFileSync(templatePath, "utf8")).dependencies ?? {};
+    const entries = {};
+    for (const name of WEB_CARRIED_DEPENDENCIES) {
+        const range = templateDeps[name];
+        if (range === undefined)
+            continue;
+        if (Object.hasOwn(pkg.dependencies ?? {}, name) || Object.hasOwn(pkg.devDependencies ?? {}, name)) {
+            continue;
+        }
+        entries[name] = range;
+    }
+    return Object.keys(entries).length > 0 ? withDependencies(pkg, entries) : undefined;
+}
 export async function updateSite(opts) {
     const targetDir = resolve(opts.targetDir);
     const version = opts.version;
@@ -905,6 +946,9 @@ export async function updateSite(opts) {
     const apiMove = existsSync(apiPkgPath)
         ? planApiMove(targetDir, opts.templatesDir, new Set([...newMap.keys()].filter((path) => path.startsWith(`${API_SRC}/`))), new Set(Object.keys(record.files)), opts.versions ?? {})
         : undefined;
+    // ── The web app's carried dependencies (#9889 D9), planned before the
+    // first write so an unparseable apps/web/package.json refuses the run.
+    const webPackageJson = planWebDependencies(targetDir, opts.templatesDir);
     // ── Every recorded row (D4) ────────────────────────────────────────────
     const updated = [];
     const merged = [];
@@ -1201,6 +1245,11 @@ export async function updateSite(opts) {
         moved.updated.push(API_PACKAGE_JSON);
         pruneEmptyDirs(join(targetDir, ...API_SRC.split("/")));
     }
+    // #9889 D9 — the web app's carried dependencies, after the record's writes.
+    if (webPackageJson !== undefined) {
+        writeFileSync(join(targetDir, ...WEB_PACKAGE_JSON.split("/")), webPackageJson);
+        moved.updated.push(WEB_PACKAGE_JSON);
+    }
     return {
         targetDir,
         version,
@@ -1254,8 +1303,9 @@ export function formatUpdateReport(result) {
         return `[create-ailk] Already up to date (create-ailk ${result.version}).\n`;
     }
     // #9567 / #9566 — the MCP and API moves add dependencies (the mcp README
-    // § Move, step 7, names the install; the API half says the same).
-    for (const pkgJson of [MCP_PACKAGE_JSON, API_PACKAGE_JSON]) {
+    // § Move, step 7, names the install; the API half says the same), and so
+    // does the web app's carried-dependency step (#9889 D9).
+    for (const pkgJson of [MCP_PACKAGE_JSON, API_PACKAGE_JSON, WEB_PACKAGE_JSON]) {
         if (result.updated.includes(pkgJson)) {
             lines.push(`${pkgJson} gained dependencies: run \`pnpm install\`.`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.48.0",
-    "@working-theory/templates": "0.48.0"
+    "@working-theory/schema": "0.49.0",
+    "@working-theory/templates": "0.49.0"
   },
   "repository": {
     "type": "git",

package/templates/.env.example

@@ -469,6 +469,13 @@ CONTENT_ADAPTER=mdx
 # header against (#6085). Unset makes the receiver answer 503 and accept
 # nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
 # CAL_WEBHOOK_SECRET=
+# The prospect-channel archive cron's secret (#9855). Vercel Cron sends it as
+# `Authorization: Bearer <CRON_SECRET>` to GET /v1/cron/prospect-channel-archive
+# (the scheduling module; the scaffold's apps/api/vercel.json schedules it
+# daily). Generate it with `openssl rand -hex 32`. Unset, or shorter than 32
+# characters, makes the route answer 503 and archive nothing. The bin
+# (`prospect-channel-archive:sweep`) needs no secret.
+# CRON_SECRET=
 # SCHEDULING_PUBLIC_BASE_URL=https://cal.com
 # SCHEDULING_PROVIDER=cal
 

package/templates/CLAUDE.md

@@ -73,7 +73,7 @@ your module set; `pnpm architecture` enforces it, and a hook in
 | Diff hygiene when editing existing files       | `CONVENTIONS.md` § Commit + diff hygiene                                                           |
 | Code style, testing, security                  | `CONVENTIONS.md`                                                                                   |
 | Environment variables and what they unlock     | `.env.example`                                                                                     |
-| Deploy configuration                           | `apps/api/vercel.json`; the `/ailk:setup-deploy` skill                                             |
+| Deploy configuration                           | `apps/api/vercel.json`; `/ailk:growth-ops deploy`                                                  |
 | Verification before push                       | `pnpm preflight` (see § Checks)                                                                    |
 
 <!-- /ailk:template id="resource-map" -->
@@ -82,30 +82,30 @@ your module set; `pnpm architecture` enforces it, and a hook in
 
 ## Skills
 
-The AI Launch Kit skills come from the `ailk` Claude Code plugin, not from
-this repo. `.claude/settings.json` names its marketplace and enables it, so
-Claude Code loads it once you trust this folder. To install it by hand, run
-these two lines in a Claude Code session:
+The AI Launch Kit skill, `growth-ops`, comes from the `ailk` Claude Code
+plugin, not from this repo. `.claude/settings.json` names its marketplace and
+enables it, so Claude Code loads it once you trust this folder. To install it
+by hand, run these two lines in a Claude Code session:
 
 ```
 /plugin marketplace add working-theory-labs/claude-plugins
 /plugin install ailk@working-theory
 ```
 
-| Skill                  | Use when                                                          |
-| ---------------------- | ----------------------------------------------------------------- |
-| `/ailk:add-page`       | You need a new page, or extra JSON-LD on an existing one          |
-| `/ailk:update-page`    | A page should live at a different URL, or needs a new title       |
-| `/ailk:fill-page`      | A page still carries `{placeholder}` copy                         |
-| `/ailk:check-site`     | You want the site's citation-readiness score and findings         |
-| `/ailk:setup-database` | Leads should land in a database inbox at `/leads`                 |
-| `/ailk:setup-deploy`   | You are ready to deploy to Vercel                                 |
-| `/ailk:add-auth`       | Visitors need to sign in (email, Google, GitHub)                  |
-| `/ailk:upgrade-plan`   | You are weighing Free against a paid level or the commerce add-on |
-
-A repo scaffolded by an earlier create-ailk also carries its own older
-copies of these skills. Once the plugin is installed, delete those copies;
-keep scaffold-commerce, which the commerce module delivers.
+| Command                        | Use when                                                          |
+| ------------------------------ | ----------------------------------------------------------------- |
+| `/ailk:growth-ops page add`    | You need a new page, or extra JSON-LD on an existing one          |
+| `/ailk:growth-ops page rename` | A page should live at a different URL, or needs a new title       |
+| `/ailk:growth-ops page fill`   | A page still carries `{placeholder}` copy                         |
+| `/ailk:growth-ops audit`       | You want the site's citation-readiness score and findings         |
+| `/ailk:growth-ops database`    | Leads should land in a database inbox at `/leads`                 |
+| `/ailk:growth-ops deploy`      | You are ready to deploy to Vercel                                 |
+| `/ailk:growth-ops auth`        | Visitors need to sign in (email, Google, GitHub)                  |
+| `/ailk:growth-ops plan`        | You are weighing Free against a paid level or the commerce add-on |
+
+Ask in plain words and `growth-ops` picks the verb. An older scaffold also
+carries its own copies of these jobs as skills: once the plugin is installed,
+delete them; keep scaffold-commerce, which the commerce module delivers.
 
 For design work, the third-party impeccable plugin is optional:
 `/plugin marketplace add pbakaus/impeccable`, then
@@ -125,7 +125,7 @@ For design work, the third-party impeccable plugin is optional:
 | `pnpm type-check`        | Type errors in every workspace                           |
 | `pnpm lint`              | Lint errors in every workspace                           |
 | `pnpm test`              | Failing unit tests                                       |
-| `/ailk:check-site` skill | Missing or invalid JSON-LD, weak citation-readiness      |
+| `/ailk:growth-ops audit` | Missing or invalid JSON-LD, weak citation-readiness      |
 
 `.github/workflows/ci.yml` runs the preflight checks and `pnpm test` on every
 pull request as the `preflight` status check. One step is yours: make

package/templates/README.md

@@ -77,7 +77,7 @@ A page marked `--shape organization-product` is in your site when you scaffolded
 
 To customize the home page, edit [`content/en/HomePage/home.mdx`](./content/en/HomePage/home.mdx). Save and reload the dev server. No build step.
 
-To add a new page, ask Claude Code to run the `/ailk:add-page` skill — it writes the page's content file and nav link in one confirm-before-write pass, and adds a missing route with `create-ailk add-route` first. See [Skills](#skills).
+To add a new page, ask Claude Code to run `/ailk:growth-ops page add` — it writes the page's content file and nav link in one confirm-before-write pass, and adds a missing route with `create-ailk add-route` first. See [Skills](#skills).
 
 > `content/_site.mdx` stays at the top level (not under `content/en/`) — site identity is locale-blind.
 
@@ -135,12 +135,12 @@ Set `AILK_PUBLIC_DOMAIN` to your own domain. `STEALTH=true` keeps a fresh deploy
 
 You need Postgres once you turn on one of these:
 
-| Surface                                                        | What it stores                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Auth** — `/sign-in`, `/sign-up`, `/account`                  | users, sessions, accounts                                                                                                                                                                                                                                                                                                                                                                                                       |
-| **Lead inbox** — `/leads`                                      | submitted leads, for you to review signed in, and newsletter signups. Without a database, lead capture emails each contact-form message to you instead (`RESEND_API_KEY` + `AILK_LEAD_NOTIFICATION_TO` + `AILK_LEAD_NOTIFICATION_FROM` on the API); with neither in production, `/contact` shows your `_site.mdx` `contactEmail` instead of the form. The `setup-database` skill walks you from no database to a working inbox. |
-| **Checkout returns** — `/purchase/success`, `/purchase/cancel` | the paid checkouts the Stripe webhook records. These pages serve only on a site licensed for commerce.                                                                                                                                                                                                                                                                                                                          |
-| **`CONTENT_ADAPTER=database`**                                 | pages authored in the Artifact store rather than in `content/*.mdx`                                                                                                                                                                                                                                                                                                                                                             |
+| Surface                                                        | What it stores                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Auth** — `/sign-in`, `/sign-up`, `/account`                  | users, sessions, accounts                                                                                                                                                                                                                                                                                                                                                                                                        |
+| **Lead inbox** — `/leads`                                      | submitted leads, for you to review signed in, and newsletter signups. Without a database, lead capture emails each contact-form message to you instead (`RESEND_API_KEY` + `AILK_LEAD_NOTIFICATION_TO` + `AILK_LEAD_NOTIFICATION_FROM` on the API); with neither in production, `/contact` shows your `_site.mdx` `contactEmail` instead of the form. `/ailk:growth-ops database` walks you from no database to a working inbox. |
+| **Checkout returns** — `/purchase/success`, `/purchase/cancel` | the paid checkouts the Stripe webhook records. These pages serve only on a site licensed for commerce.                                                                                                                                                                                                                                                                                                                           |
+| **`CONTENT_ADAPTER=database`**                                 | pages authored in the Artifact store rather than in `content/*.mdx`                                                                                                                                                                                                                                                                                                                                                              |
 
 ### One command to get one
 
@@ -165,7 +165,7 @@ That is the whole setup. `pnpm db:studio` opens a browser UI over the data, and
 
 ## Deploy
 
-Ask Claude Code to run the `setup-deploy` skill. It writes a Vercel deploy configuration at the project root — `vercel.json`, an `.env.example` covering the variables production needs, and a `RUNBOOK.md` with the steps — and asks before overwriting any file you already have. Vercel is the one platform it supports today. `apps/api` already ships its own `vercel.json`.
+Ask Claude Code to run `/ailk:growth-ops deploy`. It writes a Vercel deploy configuration at the project root — `vercel.json`, an `.env.example` covering the variables production needs, and a `RUNBOOK.md` with the steps — and asks before overwriting any file you already have. Vercel is the one platform it supports today. `apps/api` already ships its own `vercel.json`.
 
 The [deploy guide](https://ailaunchkit.ai/docs/guides/deploy-to-production) is where the full production walkthrough will live; until it is published, the skill's `RUNBOOK.md` is the checklist. Remember to set `STEALTH=false` on the hosting platform when you launch.
 
@@ -208,17 +208,17 @@ The AI Launch Kit skills come from the `ailk` Claude Code plugin; `.claude/setti
 
 <!-- generated:begin skills -->
 
-| Skill                  | What it does                                                                                                                                                     |
-| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `/ailk:add-auth`       | Activate the site's sign-in providers (email-and-password, Google OAuth, GitHub OAuth) and write the env vars for the ones you pick.                             |
-| `/ailk:add-page`       | Add a new page — its content file, its structured data and its nav link — in one confirm-before-write pass.                                                      |
-| `/ailk:check-site`     | Run `ailk-audit` on the site and explain the score and findings in plain language. It never edits files.                                                         |
-| `/ailk:extend-site`    | Explain the five ways this site may be extended, walk you to the right one, and record a site-authored file in `customizations.yaml` with its build-in decision. |
-| `/ailk:fill-page`      | Fill one existing page's section content from a category profile: labelled sample content, or your own first draft from a short intake.                          |
-| `/ailk:setup-database` | Take the site from no database to a working lead inbox, and prove it with one test message that must appear in the inbox.                                        |
-| `/ailk:setup-deploy`   | Emit deploy configuration — `vercel.json` and `RUNBOOK.md`, plus an env checklist read from the site's own `.env.example`.                                       |
-| `/ailk:update-page`    | Rename a page — its URL, its title, or both — in one plan-then-confirm pass, with a permanent redirect from the old URL.                                         |
-| `/ailk:upgrade-plan`   | Explain the AI Launch Kit options side by side, recommend one option for this site, and link the public pricing page for prices.                                 |
+| Command                        | What it does                                                                                                                                                     |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `/ailk:growth-ops page add`    | Add a new page — its content file, its structured data and its nav link — in one confirm-before-write pass.                                                      |
+| `/ailk:growth-ops page rename` | Rename a page — its URL, its title, or both — in one plan-then-confirm pass, with a permanent redirect from the old URL.                                         |
+| `/ailk:growth-ops page fill`   | Fill one existing page's section content from a category profile: labelled sample content, or your own first draft from a short intake.                          |
+| `/ailk:growth-ops audit`       | Run `ailk-audit` on the site and explain the score and findings in plain language. It never edits files.                                                         |
+| `/ailk:growth-ops extend`      | Explain the five ways this site may be extended, walk you to the right one, and record a site-authored file in `customizations.yaml` with its build-in decision. |
+| `/ailk:growth-ops auth`        | Activate the site's sign-in providers (email-and-password, Google OAuth, GitHub OAuth) and write the env vars for the ones you pick.                             |
+| `/ailk:growth-ops database`    | Take the site from no database to a working lead inbox, and prove it with one test message that must appear in the inbox.                                        |
+| `/ailk:growth-ops deploy`      | Emit deploy configuration — `vercel.json` and `RUNBOOK.md`, plus an env checklist read from the site's own `.env.example`.                                       |
+| `/ailk:growth-ops plan`        | Explain the AI Launch Kit options side by side, recommend one option for this site, and link the public pricing page for prices.                                 |
 
 <!-- generated:end -->
 

package/templates/apps/api/.env.example

@@ -170,6 +170,13 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # equals the caller's own workspace id: the receiver writes under
 # AILK_SITE_ID, the read scopes to the tenant's workspace, and a mismatch
 # fails EMPTY, never wide.
+# The prospect-channel archive cron's secret (#9855). Vercel Cron sends it as
+# `Authorization: Bearer <CRON_SECRET>` to GET /v1/cron/prospect-channel-archive
+# (the scheduling module; the scaffold's apps/api/vercel.json schedules it
+# daily). Generate it with `openssl rand -hex 32`. Unset, or shorter than 32
+# characters, makes the route answer 503 and archive nothing. The bin
+# (`prospect-channel-archive:sweep`) needs no secret.
+# CRON_SECRET=
 
 # =============================================================================
 # Paid modules (D-44, #5368)