create-ailk 0.31.0 → 0.33.0

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -29,6 +29,16 @@
  * `tools/content-compile`, which the scaffold does not ship, and the adapter
  * reads the same files with the same frontmatter schema the manifest is
  * compiled from. See docs/internal/decisions/scaffold-structured-data-check.md.
+ *
+ * The pages come from the site's active content source (#10704):
+ * `resolvedAdapterKind()`, the resolver every page reads through. Under `mdx`
+ * (the default) they are the files under `content/`. Under `database` — a
+ * spoke that serves every page from its hub and may hold no page file — they
+ * are the hub's published pages as the build's last-good snapshot holds them
+ * (`.ailk/content-snapshot.json`, written by `pnpm --filter web build` under
+ * `CONTENT_ADAPTER=database`), read through the site's own content source
+ * with the API origin pinned to a refused loopback, so a test run reads no
+ * hub and needs no key.
  */
 import {
   copyFileSync,
@@ -51,8 +61,11 @@ import type {
 import {
   SCHEMA_ORG_TYPES,
   createMdxAdapter,
+  resolvedAdapterKind,
 } from "@working-theory/content-adapters";
 import {
+  getContentAdapter,
+  getMdxSource,
   getPageSections,
   pageToJsonLd,
   siteOrigin,
@@ -158,6 +171,94 @@ const adapter = createMdxAdapter({
   defaultLocale: DEFAULT_LOCALE,
 });
 
+// ── #10704 D2 — a site that serves its pages from its hub ──────────────────
+
+const SOURCE = resolvedAdapterKind();
+// page-renderer's `CONTENT_SNAPSHOT_PATH`, which this jest config maps no
+// subpath to read; create-ailk's structured-data-check suite pins the two
+// equal. Relative to cwd, as the content source reads it.
+const SNAPSHOT_REL = ".ailk/content-snapshot.json";
+
+// No read may reach a hub: every page and list read fails as unavailable and
+// the content source answers from the snapshot, the path a deployed spoke
+// takes while its hub is down.
+if (SOURCE === "database") process.env.AILK_API_URL = "http://127.0.0.1:9";
+
+/**
+ * Every page the snapshot holds, keyed by its cache tag
+ * (`content:<workspace>:<type>:<slug>:<locale>`, `cache-tags.ts`), or why it
+ * holds none. Read only under `database`.
+ */
+function readHubPages(): {
+  pages: Array<{ locale: string; type: string; slug: string }>;
+  problem: string | null;
+} {
+  const path = join(process.cwd(), SNAPSHOT_REL);
+  const build = "run `pnpm --filter web build` under CONTENT_ADAPTER=database to write it";
+  if (!existsSync(path)) {
+    return { pages: [], problem: `${path} does not exist — ${build}` };
+  }
+  let parsed: { version?: unknown; pages?: unknown; lists?: unknown } | null;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8")) as typeof parsed;
+  } catch {
+    parsed = null;
+  }
+  if (
+    parsed === null ||
+    typeof parsed !== "object" ||
+    parsed.version !== 1 ||
+    typeof parsed.pages !== "object" ||
+    parsed.pages === null ||
+    typeof parsed.lists !== "object" ||
+    parsed.lists === null
+  ) {
+    return { pages: [], problem: `${path} is not a version-1 content snapshot — ${build}` };
+  }
+  const pages = Object.keys(parsed.pages).map((tag) => {
+    const parts = tag.split(":");
+    return {
+      type: parts[2] ?? "",
+      slug: parts.slice(3, -1).join(":"),
+      locale: parts[parts.length - 1] ?? "",
+    };
+  });
+  if (pages.length === 0) {
+    return { pages, problem: `${path} holds no page — ${build}` };
+  }
+  return { pages, problem: null };
+}
+
+const HUB = SOURCE === "database" ? readHubPages() : { pages: [], problem: null };
+
+/** The snapshot's (locale, type) pairs, in the shape the content walk takes. */
+function hubTypeDirs(): Array<{ locale: string; typeDir: string }> {
+  const seen = new Set<string>();
+  const out: Array<{ locale: string; typeDir: string }> = [];
+  for (const { locale, type } of HUB.pages) {
+    if (seen.has(`${locale}/${type}`)) continue;
+    seen.add(`${locale}/${type}`);
+    out.push({ locale, typeDir: type });
+  }
+  return out.sort((a, b) =>
+    `${a.locale}/${a.typeDir}`.localeCompare(`${b.locale}/${b.typeDir}`),
+  );
+}
+
+/** A type's pages in a locale, from the active source. */
+function listDetailFor(type: PageType, locale: string): Promise<ContentPage[]> {
+  return SOURCE === "database"
+    ? getContentAdapter().listDetail(type, locale)
+    : adapter.listDetail(type, locale);
+}
+
+/** One page's source, from the active source (`ContentAdapter` has no `getPageSource`). */
+function pageSourceFor(type: PageType, slug: string, locale: string) {
+  return SOURCE === "database"
+    ? getMdxSource(type, slug, locale)
+    : adapter.getPageSource(type, slug, locale);
+}
+
 // ── JSON-LD flatten + validate (the ten lines from tools/scrape-jsonld.ts) ──
 
 function flattenBlocks(parsed: unknown): JsonLdObject[] {
@@ -244,9 +345,21 @@ function identityFailure(blocks: JsonLdObject[], label: string): string | null {
 // ── 1. Content-driven: every content page builds valid JSON-LD ──────────────
 
 describe("structured data — every content page builds valid JSON-LD", () => {
-  const typeDirs = contentTypeDirs();
+  const typeDirs = SOURCE === "database" ? hubTypeDirs() : contentTypeDirs();
+  let hubPagesChecked = 0;
+
+  afterAll(() => {
+    if (SOURCE === "database") {
+      console.info(`structured-data: ${hubPagesChecked} hub page(s) checked from ${SNAPSHOT_REL}`);
+    }
+  });
 
   it("finds content to check", () => {
+    if (SOURCE === "database") {
+      // A hub-served site with no snapshot has nothing to check: misconfigured.
+      expect(HUB.problem).toBeNull();
+      return;
+    }
     // A site with no content directory at all is misconfigured, not clean.
     expect(existsSync(CONTENT_ROOT)).toBe(true);
     expect(typeDirs.length).toBeGreaterThan(0);
@@ -274,14 +387,17 @@ describe("structured data — every content page builds valid JSON-LD", () => {
       }
       const type = typeDir as PageType;
 
-      const pages: ContentPage[] = await adapter.listDetail(type, locale);
-      const dirPath = join(CONTENT_ROOT, locale, typeDir);
-      const mdxCount = readdirSync(dirPath).filter(
-        (n) => n.endsWith(".mdx") && !n.startsWith("_"),
-      ).length;
+      const pages: ContentPage[] = await listDetailFor(type, locale);
       // The adapter drops a page whose frontmatter fails the schema; that
       // page would render nothing, so count it here rather than lose it.
-      expect(pages.length).toBe(mdxCount);
+      // Under `database` the count is the pages the hub published (#10704).
+      const expected =
+        SOURCE === "database"
+          ? HUB.pages.filter((p) => p.locale === locale && p.type === type).length
+          : readdirSync(join(CONTENT_ROOT, locale, typeDir)).filter(
+              (n) => n.endsWith(".mdx") && !n.startsWith("_"),
+            ).length;
+      expect(pages.length).toBe(expected);
 
       const failures: string[] = [];
       for (const page of pages) {
@@ -295,6 +411,7 @@ describe("structured data — every content page builds valid JSON-LD", () => {
         if (failure !== null) failures.push(failure);
       }
       expect(failures).toEqual([]);
+      if (SOURCE === "database") hubPagesChecked += pages.length;
     },
   );
 });
@@ -674,14 +791,16 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
     // #10043 D7 — a Service's category, for the nested route's params.
     const parents = new Map<string, string>();
     if (identity.slug !== null) {
-      const page = await adapter.getPageSource(
+      const page = await pageSourceFor(
         type,
         identity.slug,
         DEFAULT_LOCALE,
       );
       if (page === null) {
         throw new Error(
-          `${label}: renders ${type}/${identity.slug}, but content/${DEFAULT_LOCALE}/${type}/${identity.slug}.mdx does not exist — the route serves 404 in production.`,
+          SOURCE === "database"
+            ? `${label}: renders ${type}/${identity.slug}, but the hub serves no such page (${SNAPSHOT_REL}) — the route serves 404 in production.`
+            : `${label}: renders ${type}/${identity.slug}, but content/${DEFAULT_LOCALE}/${type}/${identity.slug}.mdx does not exist — the route serves 404 in production.`,
         );
       }
       slugs = [identity.slug];
@@ -689,7 +808,7 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
       // The hub's own page shares this route's type but is served at the hub
       // (#10044 D13), so it is never rendered here.
       const hubSlug = hubOwnSlug(file, type);
-      const pages = (await adapter.listDetail(type, DEFAULT_LOCALE)).filter(
+      const pages = (await listDetailFor(type, DEFAULT_LOCALE)).filter(
         (p: ContentPage) => p.slug !== hubSlug,
       );
       for (const p of pages) if (p.parent !== undefined) parents.set(p.slug, p.parent);
@@ -772,6 +891,8 @@ describe("structured data — a hub's own page is not rendered at its detail rou
     async () => {
       const root = mkdtempSync(join(tmpdir(), "ailk-10044-sd-"));
       const prior = process.env.AILK_CONTENT_ROOT;
+      // #10704 D2 — the fixture is files, whatever source the site serves from.
+      const priorSource = process.env.CONTENT_ADAPTER;
       try {
         mkdirSync(join(root, DEFAULT_LOCALE, "Pricing"), { recursive: true });
         copyFileSync(join(CONTENT_ROOT, "_site.mdx"), join(root, "_site.mdx"));
@@ -784,6 +905,7 @@ describe("structured data — a hub's own page is not rendered at its detail rou
           '---\ntype: "Pricing"\nslug: "website-rebuild"\ntitle: "Website Rebuild"\ndescription: "What a rebuild costs."\nplans: ["ss-website-rebuild"]\n---\n',
         );
         process.env.AILK_CONTENT_ROOT = root;
+        process.env.CONTENT_ADAPTER = "mdx";
         const fixtureAdapter = createMdxAdapter({
           contentRoot: root,
           defaultLocale: DEFAULT_LOCALE,
@@ -807,6 +929,8 @@ describe("structured data — a hub's own page is not rendered at its detail rou
       } finally {
         if (prior === undefined) delete process.env.AILK_CONTENT_ROOT;
         else process.env.AILK_CONTENT_ROOT = prior;
+        if (priorSource === undefined) delete process.env.CONTENT_ADAPTER;
+        else process.env.CONTENT_ADAPTER = priorSource;
         rmSync(root, { recursive: true, force: true });
       }
     },

package/templates/apps/web/lib/__tests__/telemetry-scrub.test.ts

@@ -82,3 +82,23 @@ describe("scrubTelemetryUrl — the /v1/deliverables/<grantId> path (#9162)", ()
     }
   });
 });
+
+describe("scrubTelemetryUrl — the email-verification nonce (#10820 D2)", () => {
+  it("strips verify=<nonce> from a reported confirm-page URL", () => {
+    const nonce = "N".repeat(43);
+    const scrubbed = scrubTelemetryUrl(`https://site.example/verify-email?verify=${nonce}`);
+    expect(scrubbed).not.toContain(nonce);
+    expect(scrubbed.startsWith("https://site.example/verify-email")).toBe(true);
+  });
+
+  it("strips lead= and verify= from a magnet Lead's confirm link (#10826 D5, SEC-10826-7)", () => {
+    const nonce = "N".repeat(43);
+    const leadId = "lead_01920000-1082-7000-8000-000000000001";
+    const scrubbed = scrubTelemetryUrl(
+      `https://site.example/flows/growth-check/verify?lead=${leadId}&verify=${nonce}`,
+    );
+    expect(scrubbed).not.toContain(nonce);
+    expect(scrubbed).not.toContain(leadId);
+    expect(scrubbed).toBe("https://site.example/flows/growth-check/verify");
+  });
+});

package/templates/apps/web/lib/account-config.ts

@@ -21,7 +21,10 @@
 // The base contributions (D9, amended 2026-10-01 by D6a/D8a — #7448) use
 // existing reads only, each with the caller's cookie forwarded (`ctx.init`):
 //
-//   - Inbox kind `result` — a row of the All tab.
+//   - Inbox kind `result` — a row of the All tab: the waitlist signups above
+//     and, where the workspace module is present, the caller's verified
+//     submissions to `user` magnets (`member.results`, #10826 D7), each with
+//     an Open action back to its results.
 //   - For-you sources `email-unverified` and `payment-due` — needs-you items
 //     with an Open action to User settings' two pages, `/account/general`
 //     and `/account/billing` (#8232 D10), never Inbox rows. Neither read carries the time the condition began, so their time
@@ -109,6 +112,7 @@ import type {
   MemberMessage,
   MemberPiece,
   MemberPurchase,
+  MemberResult,
 } from "@working-theory/validation";
 import { formatMoney, formatNumber } from "@working-theory/web-i18n";
 import { cache } from "react";
@@ -149,27 +153,61 @@ function formatWhen(iso: string, locale: string): string {
 
 // ── Base Inbox kinds (D9) ─────────────────────────────────────────────────────
 
-const result: AccountInboxKind<WaitlistSignupMeResponse> = {
+/** A `result` row: a waitlist signup, or a submission to a `user` magnet (#10826 D7). */
+type ResultRecord = WaitlistSignupMeResponse | MemberResult;
+
+const result: AccountInboxKind<ResultRecord> = {
   kind: "result",
   label: "results.heading",
   section: "updates",
   async load({ init, user }) {
     // One failed key fails the kind (D12) — never a partial list passed off as whole.
-    const signups = await Promise.all(
-      accountExperimentKeys.map((key) =>
-        read(waitlistSignups.me(key, init), user),
+    // A 404 from the results read (no workspace module) loads none.
+    const [signups, results] = await Promise.all([
+      Promise.all(
+        accountExperimentKeys.map((key) =>
+          read(waitlistSignups.me(key, init), user),
+        ),
       ),
-    );
-    return signups
-      .filter((s): s is WaitlistSignupMeResponse => s !== null)
-      .map((s) => ({
-        id: s.experimentKey,
-        title: s.experimentKey,
-        at: s.completedAt,
-        data: s,
-      }));
+      read(member.results(init), user),
+    ]);
+    return [
+      ...signups
+        .filter((s): s is WaitlistSignupMeResponse => s !== null)
+        .map((s) => ({
+          id: s.experimentKey,
+          title: s.experimentKey,
+          at: s.completedAt,
+          data: s,
+        })),
+      ...(results?.items ?? []).map((r) => ({
+        id: r.id,
+        title: r.title,
+        at: r.submittedAt,
+        data: r,
+      })),
+    ];
   },
   renderDetail({ data }, { locale, t }) {
+    if ("magnetSlug" in data) {
+      return {
+        actions: [
+          {
+            key: "open-result",
+            label: t("results.open"),
+            variant: "default" as const,
+            href: localeHref(locale, data.href),
+          },
+        ],
+        fields: {
+          heading: t("results.heading"),
+          items: [
+            { label: t("results.magnet"), value: data.title },
+            { label: t("results.submittedAt"), value: formatWhen(data.submittedAt, locale) },
+          ],
+        },
+      };
+    }
     return {
       fields: {
         heading: t("results.heading"),

package/templates/apps/web/lib/auth-email.ts

@@ -319,13 +319,30 @@ export function makeSendResetPassword(deps: ResetPasswordDeps) {
   };
 }
 
-/** Better Auth's `sendVerificationEmail` (§ D9). */
-export function makeSendVerificationEmail(deps: DispatchDeps) {
-  const { send } = deps;
+interface VerificationDeps extends DispatchDeps {
+  /**
+   * The site's own confirm page — `new URL("/verify-email", BETTER_AUTH_URL)`
+   * — which the API's email-verification service appends its single-use nonce
+   * to (#10820 D4).
+   */
+  confirmBase: string;
+}
+
+/**
+ * Better Auth's `sendVerificationEmail` (§ D9, #10820 D4).
+ *
+ * Keeps the library's signature and IGNORES its `url`: that link is Better
+ * Auth's stateless JWT, which is neither single-use nor revocable, and its
+ * `/verify-email` endpoint is disabled in `auth.ts`. The relay's
+ * `email-verification` kind mints the service's own nonce for this user and
+ * mails `confirmBase?verify=<nonce>`; a click on that page confirms through
+ * `confirmSignUpEmail` below.
+ */
+export function makeSendVerificationEmail(deps: VerificationDeps) {
+  const { send, confirmBase } = deps;
   const log = deps.log ?? defaultLog;
   return async function sendVerificationEmail({
     user,
-    url,
   }: {
     user: { id: string; email: string };
     url: string;
@@ -335,7 +352,7 @@ export function makeSendVerificationEmail(deps: DispatchDeps) {
         kind: "email-verification",
         userId: user.id,
         to: user.email,
-        url,
+        url: confirmBase,
         expiresInMinutes: 24 * 60,
       },
       { send, log },
@@ -343,6 +360,71 @@ export function makeSendVerificationEmail(deps: DispatchDeps) {
   };
 }
 
+/** The confirm hop's answer, as the `/verify-email` action reads it. */
+export type SignUpConfirmOutcome =
+  | "verified"
+  | "already_verified"
+  | "expired"
+  | "invalid"
+  | "failed";
+
+/** The confirm hop's transport seam — `authEmail.confirm`'s shape. */
+export type ConfirmTransport = (
+  rawBody: string,
+  headers: Record<string, string>,
+) => Promise<{ ok: boolean; body?: unknown }>;
+
+const CONFIRM_OUTCOMES = new Set(["verified", "already_verified", "expired", "invalid"]);
+
+/**
+ * Confirm a sign-up link's nonce through the API's signed hop,
+ * `POST /v1/auth/email-verification/confirm` (#10820 D2, D7).
+ *
+ * ONE serialization of `{ nonce }`, signed over the DOMAIN-SEPARATED base
+ * string `email-verification-confirm.<timestamp>.<rawBody>` — so a body signed
+ * for the mail relay can never be replayed to the confirm route, or the
+ * reverse — and the same bytes handed to the transport.
+ *
+ * NEVER THROWS, and logs only `{ kind, outcome | errorKind }`: never the
+ * nonce, which is the credential. Anything but a 2xx carrying a known outcome
+ * is `failed`.
+ */
+export async function confirmSignUpEmail(
+  nonce: string,
+  deps: { confirm?: ConfirmTransport; log?: AuthEmailLog } = {},
+): Promise<SignUpConfirmOutcome> {
+  const confirm: ConfirmTransport =
+    deps.confirm ?? ((rawBody, headers) => authEmail.confirm(rawBody, headers));
+  const log = deps.log ?? defaultLog;
+  const base = { kind: "email-verification-confirm" };
+  const secret = process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+  if (!secret) {
+    log.warn({ ...base, errorKind: "not_configured" });
+    return "failed";
+  }
+  try {
+    const rawBody = JSON.stringify({ nonce });
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const signature = `sha256=${createHmac("sha256", secret)
+      .update(`email-verification-confirm.${timestamp}.${rawBody}`, "utf8")
+      .digest("hex")}`;
+    const result = await confirm(rawBody, {
+      "x-ailk-auth-email-signature": signature,
+      "x-ailk-auth-email-timestamp": timestamp,
+    });
+    const outcome = (result.body as { outcome?: unknown } | null | undefined)?.outcome;
+    if (!result.ok || typeof outcome !== "string" || !CONFIRM_OUTCOMES.has(outcome)) {
+      log.warn({ ...base, errorKind: "relay_rejected" });
+      return "failed";
+    }
+    log.info({ ...base, outcome });
+    return outcome as SignUpConfirmOutcome;
+  } catch {
+    log.warn({ ...base, errorKind: "transport_error" });
+    return "failed";
+  }
+}
+
 /**
  * The completed-reset notice (§ D17).
  *

package/templates/apps/web/lib/telemetry-scrub.ts

@@ -19,12 +19,18 @@
 // Mirrored (duplicated, not shared) in packages/analytics/src/scrub.ts,
 // since apps/* must not import @working-theory/* packages — keep both lists
 // in sync (#5613).
+// `verify` joined by #10820 (D2): the email-verification nonce on a
+// `/verify-email` or listing resume link.
+// `lead` joined by #10826 (D5, SEC-10826-7): a magnet Lead's id on its
+// `/flows/<slug>/verify?lead=…&verify=…` confirm link.
 export const TOKEN_QUERY_PARAMS = [
   "g",
   "session_id",
   "email",
   "login_hint",
   "ref",
+  "verify",
+  "lead",
 ];
 
 // The same grant id rides a PATH too: `deliverables.openGrant` fetches

package/templates/apps/web/messages/en.json

@@ -80,6 +80,7 @@
     "heading": "Blog",
     "emptyState": "No posts yet. Drop MDX files into",
     "emptyStateTrailing": "to populate this list.",
+    "emptyStateLive": "No posts yet.",
     "allTopics": "All",
     "topicsNav": "Blog topics",
     "latestPosts": "Latest posts",
@@ -254,6 +255,20 @@
     },
     "questions": {}
   },
+  "flowVerify": {
+    "title": "Confirm your email",
+    "confirmHeading": "Confirm your email",
+    "confirmSubhead": "One click and your address is confirmed.",
+    "confirmBody": "Select the button below to confirm this email address.",
+    "confirmButton": "Confirm my email",
+    "confirmedHeading": "Your email is confirmed",
+    "confirmedSubhead": "Thanks — your address is verified.",
+    "confirmedBody": "You can close this tab once you're done.",
+    "errorHeading": "This confirmation link has expired",
+    "errorSubhead": "Confirmation links last 24 hours.",
+    "errorBody": "Answer the form again and we'll send you a fresh confirmation email.",
+    "back": "Back to the form"
+  },
   "how-to": {
     "heading": "How-To Guides",
     "description": "Step-by-step guides for building with this site.",
@@ -665,6 +680,13 @@
     "verifyExpiredHeading": "This confirmation link has expired",
     "verifyExpiredSubhead": "Confirmation links last 24 hours.",
     "verifyExpiredBody": "Sign in again and we'll send you a fresh confirmation email.",
+    "confirmHeading": "Confirm your email",
+    "confirmSubhead": "One click and your address is confirmed.",
+    "confirmBody": "Select the button below to confirm this email address for your account.",
+    "confirmButton": "Confirm my email",
+    "verifiedHeading": "Your email is confirmed",
+    "verifiedSubhead": "Thanks — your address is verified.",
+    "verifiedBody": "You can sign in now. You can close this tab once you're done.",
     "sentHeading": "Check your email",
     "sentSubhead": "Follow the link we just sent to continue.",
     "sentBody": "Check your inbox and follow the link to continue. You can close this tab once you're done.",
@@ -969,7 +991,10 @@
       "tier": "Tier",
       "score": "Score",
       "completedAt": "Completed",
-      "unavailable": "—"
+      "unavailable": "—",
+      "magnet": "Form",
+      "submittedAt": "Submitted",
+      "open": "Open"
     },
     "purchases": {
       "heading": "My purchases",

package/templates/apps/web/src/lib/routes.ts

@@ -39,9 +39,11 @@ export function resolveBaseUrl(): string {
  * `packages/templates/src/__tests__/routes-map.test.ts`'s table test and
  * `apps/web/__tests__/routes/routes-map-identity.test.ts`'s differential
  * test over the live content tree). The signature is annotated explicitly so
- * this stays the exact `(type: string, slug: string) => string` contract the
- * three call sites (`sitemap.xml`, `llms.txt`, `docs-blog/llms-route.ts`)
- * depend on, even though `routeFor`'s own `slug` parameter is optional.
+ * this stays the exact `(type: string, slug: string) => string` contract its
+ * callers depend on, even though `routeFor`'s own `slug` parameter is
+ * optional. `sitemap.xml`, `llms.txt` and, since #10775, the docs-blog
+ * module's `docs-blog/llms-route.ts` call `pagePathFor` instead; the export
+ * stays for a docs-blog site that installed the older copy of that route.
  */
 export const slugToPath: (type: string, slug: string) => string = routeFor;
 

package/templates/database/seed.ts

@@ -149,8 +149,8 @@ export async function provisionDefaultWorkspace(
       kind: "contact",
       title: REQUEST_QUOTE_FLOW_TITLE,
       status: "draft",
-      customersEnabled: true,
-      completion: "invite",
+      who: "user",
+      completion: "user",
       tags: [STANDARD_MAGNET_TAGS[REQUEST_QUOTE_FLOW_SLUG]!],
     },
     update: {},
@@ -171,7 +171,7 @@ export async function provisionDefaultWorkspace(
       kind: "contact",
       title: CONTACT_FORM_FLOW_TITLE,
       status: "live",
-      customersEnabled: false,
+      who: "visitor",
       completion: "lead",
       tags: [STANDARD_MAGNET_TAGS[CONTACT_FORM_FLOW_SLUG]!],
       landingPage: CONTACT_FORM_LANDING_PAGE,
@@ -194,8 +194,8 @@ export async function provisionDefaultWorkspace(
       kind: "diagnostic",
       title: JOB_APPLICATION_FLOW_TITLE,
       status: "live",
-      customersEnabled: false,
-      completion: "invite",
+      who: "visitor",
+      completion: "user",
       tags: [STANDARD_MAGNET_TAGS[JOB_APPLICATION_FLOW_SLUG]!],
       landingPage: JOB_APPLICATION_LANDING_PAGE,
     },
@@ -218,7 +218,7 @@ export async function provisionDefaultWorkspace(
       kind: "newsletter",
       title: NEWSLETTER_FLOW_TITLE,
       status: "live",
-      customersEnabled: false,
+      who: "visitor",
       completion: "lead",
       tags: [STANDARD_MAGNET_TAGS[NEWSLETTER_FLOW_SLUG]!],
       landingPage: NEWSLETTER_LANDING_PAGE,
@@ -242,7 +242,7 @@ export async function provisionDefaultWorkspace(
       kind: "diagnostic",
       title: TRIAL_FLOW_TITLE,
       status: "live",
-      customersEnabled: false,
+      who: "visitor",
       completion: "lead",
       tags: [STANDARD_MAGNET_TAGS[TRIAL_FLOW_SLUG]!],
       landingPage: TRIAL_FLOW_LANDING_PAGE,

package/templates/package.json

@@ -21,7 +21,8 @@
     "architecture": "tsx tools/lint-architecture.ts",
     "claude-md:check": "tsx tools/check-claude-md.ts",
     "content-source:check": "tsx tools/check-content-source.ts",
-    "preflight": "pnpm architecture && pnpm claude-md:check && pnpm content-source:check && pnpm type-check && pnpm lint && pnpm build"
+    "mdx-body:check": "tsx tools/check-mdx-body.ts",
+    "preflight": "pnpm architecture && pnpm claude-md:check && pnpm content-source:check && pnpm mdx-body:check && pnpm type-check && pnpm lint && pnpm build"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.5",