create-ailk 0.27.0 → 0.28.1

package/templates/apps/web/scripts/assert-content-bundled.ts

@@ -8,8 +8,8 @@
  * See: docs/runbooks/page-renderer-deploy-verification.md §1 Cause 2
  */
 
-import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // apps/web/ is one level up from scripts/
@@ -18,10 +18,32 @@ const scriptDir = resolve(fileURLToPath(import.meta.url), "..");
 const appWebDir = resolve(scriptDir, "..");
 const standaloneDir = join(appWebDir, ".next", "standalone");
 
-// Sentinel file: content/en/HomePage/home.mdx
-// Traced from ../../content/en/HomePage/home.mdx (relative to apps/web),
-// placed at standaloneDir/content/en/HomePage/home.mdx by Next.js file tracing.
-const sentinelRelative = join("content", "en", "HomePage", "home.mdx");
+// Sentinel: the first MDX file under <repo-root>/content on disk — one traced
+// file proves the tracing; it does not count the others. A site that
+// dropped the marketing module (#10040) has no HomePage — only its legal
+// pages — so the sentinel is whichever page this site carries, traced from
+// ../../content/<locale>/<Type>/<page>.mdx (relative to apps/web) and placed
+// at standaloneDir/content/... by Next.js file tracing.
+const contentDir = resolve(appWebDir, "..", "..", "content");
+function firstMdx(dir: string): string | undefined {
+  if (!existsSync(dir)) return undefined;
+  for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const abs = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      const found = firstMdx(abs);
+      if (found !== undefined) return found;
+    } else if (entry.name.endsWith(".mdx")) {
+      return abs;
+    }
+  }
+  return undefined;
+}
+const sentinelAbs = firstMdx(contentDir);
+if (sentinelAbs === undefined) {
+  console.error("[assert-content-bundled] ERROR: no .mdx file under content/ to trace.");
+  process.exit(1);
+}
+const sentinelRelative = join("content", relative(contentDir, sentinelAbs));
 const sentinelPath = join(standaloneDir, sentinelRelative);
 
 if (!existsSync(standaloneDir)) {

package/templates/apps/web/scripts/check-nav-labels.ts

@@ -0,0 +1,39 @@
+/**
+ * Fail the build when a nav key has no text (#10045 D2).
+ *
+ * Every `labelKey` / `headingKey` / `descKey` in `lib/nav-config.ts`, and the
+ * keys the layout resolves by name, must exist in the `nav` namespace of every
+ * `messages/<locale>.json` (or its site overlay). A missing key would render
+ * as raw text in the header or footer; this check names the key and the file
+ * instead. Runs as the first step of `pnpm build`.
+ */
+
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  findMissingNavLabels,
+  formatMissingNavLabels,
+} from "../lib/nav-label-check";
+import { usedNavLabelKeys } from "../lib/nav-label-keys";
+
+const appWebDir = resolve(fileURLToPath(import.meta.url), "..", "..");
+const messagesDir = resolve(appWebDir, "messages");
+
+const keys = usedNavLabelKeys();
+const missing = findMissingNavLabels(messagesDir, keys);
+
+if (missing.length > 0) {
+  console.error(
+    `[check-nav-labels] ERROR:\n${formatMissingNavLabels(missing)}`,
+  );
+  console.error(
+    "[check-nav-labels] Add each key's text to the `nav` namespace of that file " +
+      "(or messages/site/<locale>.json).",
+  );
+  process.exit(1);
+}
+
+console.log(
+  `[check-nav-labels] ✓ ${keys.size} nav keys resolve in every locale`,
+);

package/templates/apps/web/sentry.server.config.ts

@@ -12,7 +12,11 @@
 
 import * as Sentry from "@sentry/nextjs";
 
-import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+import {
+  scrubSpanDescription,
+  scrubTelemetryQuery,
+  scrubTelemetryUrl,
+} from "./lib/telemetry-scrub";
 
 // #5613 / security review PR #5639: the report-grant token (?g=<id> on
 // /reports/<slug>, #5562) is a bearer credential for a private customer
@@ -21,13 +25,29 @@ import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
 // header, the transaction name, navigation breadcrumbs, and any URL
 // captured as span/trace data (e.g. `url.full`,
 // `http.request.header.referer`) here too.
+//
+// #9969 D9 (#8329): the Stripe SDK's outgoing requests carry a customer id in
+// their URL and query, so a span's `description` (`<METHOD> <url>`), its raw
+// `url`/`url.path`/`http.target`, and the separate query keys (`http.query`,
+// `url.query`) on spans, the trace and breadcrumbs are scrubbed as well.
+const QUERY_KEYS = ["http.query", "url.query"];
+
+function scrubQueryData(data: Record<string, unknown>): void {
+  for (const key of QUERY_KEYS) {
+    const value = data[key];
+    if (typeof value === "string") {
+      data[key] = scrubTelemetryQuery(value);
+    }
+  }
+}
+
 function scrubSentryEvent<
   T extends {
     request?: { url?: string; headers?: Record<string, string> };
     transaction?: string;
     breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
     contexts?: { trace?: { data?: Record<string, unknown> } };
-    spans?: { data?: Record<string, unknown> }[];
+    spans?: { description?: string; data?: Record<string, unknown> }[];
   },
 >(event: T): T {
   if (event.request?.url) {
@@ -60,6 +80,7 @@ function scrubSentryEvent<
     if (typeof url === "string") {
       crumb.data["url"] = scrubTelemetryUrl(url);
     }
+    scrubQueryData(crumb.data);
   }
   const scrubSpanData = (data?: Record<string, unknown>): void => {
     if (!data) return;
@@ -67,15 +88,22 @@ function scrubSentryEvent<
       "url.full",
       "http.url",
       "http.request.header.referer",
+      "url",
+      "url.path",
+      "http.target",
     ]) {
       const value = data[key];
       if (typeof value === "string") {
         data[key] = scrubTelemetryUrl(value);
       }
     }
+    scrubQueryData(data);
   };
   scrubSpanData(event.contexts?.trace?.data);
   for (const span of event.spans ?? []) {
+    if (span.description) {
+      span.description = scrubSpanDescription(span.description);
+    }
     scrubSpanData(span.data);
   }
   return event;

package/templates/apps/web/src/lib/__tests__/rate-limit.test.ts

@@ -1,12 +1,14 @@
 /**
  * The per-visitor limiter the /contact action runs before it writes a lead
  * (#8747): a fixed window per key, refusing the call past the limit, and a
- * client address read from the platform's own headers.
+ * client address read from the platform's own headers — on Vercel only, and
+ * a shared, wider bucket for a visitor it cannot read (#9967 D1).
  */
 import {
   __resetRateLimit,
   checkRateLimit,
   clientIpFromHeaders,
+  takeVisitorLimit,
 } from "../rate-limit";
 
 const WINDOW_MS = 10 * 60 * 1000;
@@ -15,9 +17,13 @@ function headersOf(values: Record<string, string>): { get(name: string): string
   return { get: (name) => values[name] ?? null };
 }
 
+const originalVercel = process.env.VERCEL;
+
 afterEach(() => {
   __resetRateLimit();
   jest.useRealTimers();
+  if (originalVercel === undefined) delete process.env.VERCEL;
+  else process.env.VERCEL = originalVercel;
 });
 
 describe("checkRateLimit", () => {
@@ -46,22 +52,74 @@ describe("checkRateLimit", () => {
 });
 
 describe("clientIpFromHeaders", () => {
-  it("prefers x-vercel-forwarded-for, first value", () => {
+  it("on Vercel, reads x-vercel-forwarded-for, first value", () => {
+    process.env.VERCEL = "1";
     expect(
       clientIpFromHeaders(
         headersOf({
-          "x-vercel-forwarded-for": "198.51.100.7, 10.0.0.1",
+          "x-vercel-forwarded-for": "198.51.100.1, 10.0.0.1",
           "x-forwarded-for": "203.0.113.5",
         }),
       ),
-    ).toBe("198.51.100.7");
+    ).toBe("198.51.100.1");
   });
 
-  it("falls back to x-forwarded-for, then x-real-ip, then unknown", () => {
-    expect(clientIpFromHeaders(headersOf({ "x-forwarded-for": "203.0.113.5, 10.0.0.1" }))).toBe(
-      "203.0.113.5",
-    );
-    expect(clientIpFromHeaders(headersOf({ "x-real-ip": "192.0.2.9" }))).toBe("192.0.2.9");
+  it("never keys a client-sent x-forwarded-for or x-real-ip (#9945)", () => {
+    process.env.VERCEL = "1";
+    expect(clientIpFromHeaders(headersOf({ "x-forwarded-for": "203.0.113.5" }))).toBe("unknown");
+    expect(clientIpFromHeaders(headersOf({ "x-real-ip": "192.0.2.9" }))).toBe("unknown");
     expect(clientIpFromHeaders(headersOf({}))).toBe("unknown");
   });
+
+  it("off Vercel, trusts no header at all", () => {
+    delete process.env.VERCEL;
+    expect(
+      clientIpFromHeaders(headersOf({ "x-vercel-forwarded-for": "198.51.100.1, 10.0.0.1" })),
+    ).toBe("unknown");
+  });
+});
+
+describe("takeVisitorLimit (#9967 D1)", () => {
+  beforeEach(() => {
+    process.env.VERCEL = "1";
+  });
+
+  it("refuses past the limit with the window's remaining wait, not the whole window", () => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date("2026-10-26T10:00:00Z"));
+    const h = headersOf({ "x-vercel-forwarded-for": "198.51.100.1" });
+    expect(takeVisitorLimit("t", h, 2, 60_000)).toEqual({ allowed: true });
+    expect(takeVisitorLimit("t", h, 2, 60_000)).toEqual({ allowed: true });
+
+    jest.setSystemTime(new Date("2026-10-26T10:00:20Z"));
+    expect(takeVisitorLimit("t", h, 2, 60_000)).toEqual({ allowed: false, retryAfterSeconds: 40 });
+    // Another address keeps its own bucket.
+    expect(takeVisitorLimit("t", headersOf({ "x-vercel-forwarded-for": "198.51.100.2" }), 2, 60_000)).toEqual({
+      allowed: true,
+    });
+  });
+
+  it("charges an unreadable visitor one shared bucket at ten times the limit, never skips it", () => {
+    const none = headersOf({ "x-forwarded-for": "203.0.113.5" });
+    for (let i = 0; i < 20; i += 1) {
+      expect(takeVisitorLimit("t", none, 2, 60_000).allowed).toBe(true);
+    }
+    expect(takeVisitorLimit("t", headersOf({ "x-forwarded-for": "203.0.113.6" }), 2, 60_000).allowed).toBe(false);
+  });
+
+  it("keeps the shared bucket out of reach of a flood of address keys", () => {
+    const none = headersOf({});
+    for (let i = 0; i < 20; i += 1) takeVisitorLimit("t", none, 2, 60_000);
+    for (let i = 0; i < 5000; i += 1) {
+      takeVisitorLimit("t", headersOf({ "x-vercel-forwarded-for": `10.0.${i >> 8}.${i & 255}` }), 2, 60_000);
+    }
+    expect(takeVisitorLimit("t", none, 2, 60_000).allowed).toBe(false);
+  });
+
+  it("counts each scope's shared bucket on its own", () => {
+    const none = headersOf({});
+    for (let i = 0; i < 20; i += 1) takeVisitorLimit("a", none, 2, 60_000);
+    expect(takeVisitorLimit("a", none, 2, 60_000).allowed).toBe(false);
+    expect(takeVisitorLimit("b", none, 2, 60_000).allowed).toBe(true);
+  });
 });

package/templates/apps/web/src/lib/rate-limit.ts

@@ -17,44 +17,64 @@ type Bucket = { count: number; resetAt: number };
 
 const buckets = new Map<string, Bucket>();
 
+// The `<scope>:unknown` buckets (#9967 D1): one per scope, kept apart from
+// `buckets` so no flood of address keys can evict them through its
+// oldest-first bound.
+const unknownBuckets = new Map<string, Bucket>();
+
 // Bound the map so a caller rotating keys (spoofed addresses) cannot grow it
 // without limit between resets.
 const MAX_TRACKED_KEYS = 5000;
 
+/** A visitor with no readable address shares one bucket this many times as wide. */
+export const UNKNOWN_VISITOR_FACTOR = 10;
+
 /** Test-only reset. Not reachable from a request. */
 export function __resetRateLimit(): void {
   buckets.clear();
+  unknownBuckets.clear();
 }
 
-/**
- * Fixed-window check. `true` when the caller is under `limit` in the current
- * window (and counts the call); `false` once it has used `limit` calls.
- */
-export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
-  const now = Date.now();
-  const existing = buckets.get(key);
+/** Count one call in `map`'s fixed window for `key`; the window's end either way. */
+function hitWindow(
+  map: Map<string, Bucket>,
+  key: string,
+  limit: number,
+  windowMs: number,
+  now: number,
+): { allowed: boolean; resetAt: number } {
+  const existing = map.get(key);
 
   if (!existing || existing.resetAt <= now) {
-    if (buckets.size >= MAX_TRACKED_KEYS) pruneExpired(now);
-    buckets.set(key, { count: 1, resetAt: now + windowMs });
-    return true;
+    if (map.size >= MAX_TRACKED_KEYS) pruneExpired(map, now);
+    const resetAt = now + windowMs;
+    map.set(key, { count: 1, resetAt });
+    return { allowed: true, resetAt };
   }
 
-  if (existing.count >= limit) return false;
+  if (existing.count >= limit) return { allowed: false, resetAt: existing.resetAt };
 
   existing.count += 1;
-  return true;
+  return { allowed: true, resetAt: existing.resetAt };
+}
+
+/**
+ * Fixed-window check. `true` when the caller is under `limit` in the current
+ * window (and counts the call); `false` once it has used `limit` calls.
+ */
+export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
+  return hitWindow(buckets, key, limit, windowMs, Date.now()).allowed;
 }
 
-function pruneExpired(now: number): void {
-  for (const [key, bucket] of buckets) {
-    if (bucket.resetAt <= now) buckets.delete(key);
+function pruneExpired(map: Map<string, Bucket>, now: number): void {
+  for (const [key, bucket] of map) {
+    if (bucket.resetAt <= now) map.delete(key);
   }
   // Nothing expired (keys rotated inside one window): evict the oldest entry
   // — `Map` iterates in insertion order — so the bound always holds.
-  if (buckets.size >= MAX_TRACKED_KEYS) {
-    const oldestKey = buckets.keys().next().value;
-    if (oldestKey !== undefined) buckets.delete(oldestKey);
+  if (map.size >= MAX_TRACKED_KEYS) {
+    const oldestKey = map.keys().next().value;
+    if (oldestKey !== undefined) map.delete(oldestKey);
   }
 }
 
@@ -64,16 +84,37 @@ export interface HeaderReader {
 }
 
 /**
- * The visitor's address, coarse: `x-vercel-forwarded-for`, else
- * `x-forwarded-for`, else `x-real-ip` (first value of each), else
- * `"unknown"`. Vercel's edge overwrites these with the connecting address;
- * behind an edge that appends instead, a caller chooses its own key. An
+ * The visitor's address, coarse: on Vercel (`VERCEL=1`), the first value of
+ * `x-vercel-forwarded-for`, which Vercel's edge overwrites on every request;
+ * else `"unknown"` (#9967 D1). `x-forwarded-for` and `x-real-ip` are never
+ * read, and off Vercel no header is, since a client can set any of them. An
  * abuse-throttling key only — never an authorization decision.
  */
 export function clientIpFromHeaders(headers: HeaderReader): string {
-  for (const name of ["x-vercel-forwarded-for", "x-forwarded-for"]) {
-    const value = headers.get(name);
-    if (value) return value.split(",")[0]?.trim() || "unknown";
-  }
-  return headers.get("x-real-ip") || "unknown";
+  if (process.env.VERCEL !== "1") return "unknown";
+  return headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+}
+
+export type VisitorLimit = { allowed: true } | { allowed: false; retryAfterSeconds: number };
+
+/**
+ * The per-visitor limit (#9967 D1): `limit` calls per window on
+ * `<scope>:<address>`, or — for a visitor whose address cannot be read —
+ * `UNKNOWN_VISITOR_FACTOR * limit` on one shared `<scope>:unknown` bucket,
+ * never a skip. A refusal names the seconds left in the window, at least 1.
+ */
+export function takeVisitorLimit(
+  scope: string,
+  headers: HeaderReader,
+  limit: number,
+  windowMs: number,
+): VisitorLimit {
+  const now = Date.now();
+  const address = clientIpFromHeaders(headers);
+  const { allowed, resetAt } =
+    address === "unknown"
+      ? hitWindow(unknownBuckets, `${scope}:unknown`, UNKNOWN_VISITOR_FACTOR * limit, windowMs, now)
+      : hitWindow(buckets, `${scope}:${address}`, limit, windowMs, now);
+  if (allowed) return { allowed: true };
+  return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((resetAt - now) / 1000)) };
 }

package/templates/apps/web/src/lib/routes.ts

@@ -5,8 +5,9 @@
  * handlers to avoid copy-paste duplication.
  */
 
-import { routeFor } from "@working-theory/templates/routes";
+import { pagePath, routeFor } from "@working-theory/templates/routes";
 
+import { SERVICES_PATH } from "../../lib/services-path";
 import { SITE_BASE_URL } from "../../lib/site-brand";
 
 /**
@@ -43,3 +44,16 @@ export function resolveBaseUrl(): string {
  * depend on, even though `routeFor`'s own `slug` parameter is optional.
  */
 export const slugToPath: (type: string, slug: string) => string = routeFor;
+
+/**
+ * One listed page's public path (#10043 D9): `slugToPath`, except that the
+ * services live at the site's base and a `Service` with a `parent` sits under
+ * its category. Drives /sitemap.xml and /llms.txt.
+ */
+export function pagePathFor(page: {
+  type: string;
+  slug: string;
+  parent?: string | undefined;
+}): string {
+  return pagePath(page, SERVICES_PATH);
+}

package/templates/tools/declared-env.ts

@@ -1025,6 +1025,12 @@ export interface PlanEnvRowsOptions {
    * with no reader and so no `scope`; a platform or refused name is skipped.
    */
   declare?: readonly string[];
+  /**
+   * When set, only reads in these site-relative files get a row (#10173):
+   * `update` declares what the files it wrote read, never a name only the
+   * site's own code reads.
+   */
+  onlyFiles?: ReadonlySet<string>;
 }
 
 /** The header the writer puts above a block it creates. */
@@ -1066,6 +1072,7 @@ export function planEnvRows(
   const refused = new Set(opts.topology === "spoke" ? SPOKE_REFUSED_ENV : []);
   const files = new Map<string, string[]>();
   for (const read of collectSiteReads(root).reads) {
+    if (opts.onlyFiles !== undefined && !opts.onlyFiles.has(read.file)) continue;
     if (isPlatformEnvName(read.name) || refused.has(read.name)) continue;
     if (declared.has(read.name)) continue;
     const list = files.get(read.name) ?? [];

package/versions.json

@@ -1,66 +1,66 @@
 {
-  "@working-theory/admin-ui": "0.49.0",
-  "@working-theory/aeo": "0.49.0",
-  "@working-theory/agent-context": "0.49.0",
+  "@working-theory/admin-ui": "0.50.0",
+  "@working-theory/aeo": "0.50.0",
+  "@working-theory/agent-context": "0.50.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.49.0",
-  "@working-theory/api": "0.49.0",
-  "@working-theory/api-client": "0.49.0",
+  "@working-theory/analytics": "0.50.0",
+  "@working-theory/api": "0.50.0",
+  "@working-theory/api-client": "0.50.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.49.0",
-  "@working-theory/common": "0.49.0",
+  "@working-theory/cli": "0.50.0",
+  "@working-theory/common": "0.50.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.49.0",
-  "@working-theory/content-projection": "0.49.0",
-  "@working-theory/email": "0.49.0",
+  "@working-theory/content-adapters": "0.50.0",
+  "@working-theory/content-projection": "0.50.0",
+  "@working-theory/email": "0.50.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.49.0",
-  "@working-theory/fumadocs-schema": "0.49.0",
-  "@working-theory/ids": "0.16.0",
-  "@working-theory/jsonld": "0.49.0",
-  "@working-theory/license": "0.49.0",
-  "@working-theory/mcp-server": "0.49.0",
-  "@working-theory/metadata": "0.49.0",
-  "@working-theory/observability": "0.49.0",
-  "@working-theory/page-renderer": "0.49.0",
+  "@working-theory/eslint-config": "0.50.0",
+  "@working-theory/fumadocs-schema": "0.50.0",
+  "@working-theory/ids": "0.16.1",
+  "@working-theory/jsonld": "0.50.0",
+  "@working-theory/license": "0.50.0",
+  "@working-theory/mcp-server": "0.50.0",
+  "@working-theory/metadata": "0.50.0",
+  "@working-theory/observability": "0.50.0",
+  "@working-theory/page-renderer": "0.50.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.49.0",
-  "@working-theory/schema-pack-registry": "0.49.0",
-  "@working-theory/schema-validator": "0.49.0",
-  "@working-theory/sections-registry": "0.49.0",
-  "@working-theory/site-config": "0.49.0",
-  "@working-theory/spoke-checkout": "0.7.5",
-  "@working-theory/stripe-client": "0.49.0",
-  "@working-theory/templates": "0.49.0",
-  "@working-theory/theme": "0.49.0",
-  "@working-theory/ui": "0.49.0",
-  "@working-theory/validation": "0.49.0",
-  "@working-theory/web-i18n": "0.49.0",
-  "@working-theory/admin": "0.6.0",
-  "@working-theory/api-commerce": "0.1.3",
-  "@working-theory/api-content-write": "0.1.3",
-  "@working-theory/api-hub": "0.3.0",
-  "@working-theory/api-multi-tenant": "0.1.3",
-  "@working-theory/api-scheduling": "0.4.0",
-  "@working-theory/api-signal-collectors": "0.2.2",
-  "@working-theory/api-workspace": "0.2.2",
+  "@working-theory/schema": "0.50.0",
+  "@working-theory/schema-pack-registry": "0.50.0",
+  "@working-theory/schema-validator": "0.50.0",
+  "@working-theory/sections-registry": "0.50.0",
+  "@working-theory/site-config": "0.50.0",
+  "@working-theory/spoke-checkout": "0.7.6",
+  "@working-theory/stripe-client": "0.50.0",
+  "@working-theory/templates": "0.50.0",
+  "@working-theory/theme": "0.50.0",
+  "@working-theory/ui": "0.50.0",
+  "@working-theory/validation": "0.50.0",
+  "@working-theory/web-i18n": "0.50.0",
+  "@working-theory/admin": "0.7.1",
+  "@working-theory/api-commerce": "0.1.4",
+  "@working-theory/api-content-write": "0.1.4",
+  "@working-theory/api-hub": "0.3.1",
+  "@working-theory/api-multi-tenant": "0.1.4",
+  "@working-theory/api-scheduling": "0.4.1",
+  "@working-theory/api-signal-collectors": "0.2.3",
+  "@working-theory/api-workspace": "0.3.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
-  "@working-theory/mcp-scheduling": "0.3.2",
-  "@working-theory/mcp-signal-collectors": "0.2.3",
-  "@working-theory/mcp-workspace": "0.3.2",
+  "@working-theory/mcp-scheduling": "0.3.3",
+  "@working-theory/mcp-signal-collectors": "0.2.4",
+  "@working-theory/mcp-workspace": "0.3.3",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.27",
-  "@working-theory/ui-docs-blog": "0.23.27",
-  "@working-theory/ui-scheduling": "0.25.1",
-  "@working-theory/ui-signal-collectors": "0.27.5",
+  "@working-theory/ui-commerce": "0.23.28",
+  "@working-theory/ui-docs-blog": "0.23.28",
+  "@working-theory/ui-scheduling": "0.25.2",
+  "@working-theory/ui-signal-collectors": "0.27.6",
   "@working-theory/web": "0.0.0",
   "@working-theory/app-api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.49.0"
+  "@working-theory/database": "0.50.0"
 }