create-ailk 0.4.0 → 0.6.0

package/site-templates/simple-service/content/en/FAQPage/faq.mdx

@@ -0,0 +1,56 @@
+---
+type: "FAQPage"
+slug: "faq"
+title: "FAQ"
+description: "The questions people ask before they book. Placeholder copy — replace every answer before you launch."
+sections:
+  [
+    {
+      "id": "faq",
+      "type": "faq",
+      "data":
+        {
+          "headline": "Questions",
+          "variant": "centered",
+          "initialOpen": "first",
+          "items":
+            [
+              {
+                "question": "{Which areas do you cover?}",
+                "answer": "{Name the towns, the radius or the postcodes. A reader outside them should know it here.}",
+              },
+              {
+                "question": "{How often do you visit?}",
+                "answer": "{Give the real cadence for the recurring job, and say what happens in winter.}",
+              },
+              {
+                "question": "{What does it cost?}",
+                "answer": "{The three service pages carry the prices. Say here what moves them — yard size, access, waste removal.}",
+              },
+              {
+                "question": "{How do I pay?}",
+                "answer": "{Say when payment is taken and how. Checkout runs on your own Stripe account; the card details never touch this site.}",
+              },
+              {
+                "question": "{What if I need to cancel?}",
+                "answer": "{Point at the cancellation policy and give the notice period in one line.}",
+              },
+            ],
+          "supportLink":
+            { "label": "Still stuck? Get in touch", "href": "/contact" },
+        },
+    },
+    {
+      "id": "closing",
+      "type": "cta",
+      "data":
+        {
+          "variant": "minimal",
+          "headline": "Still have a question?",
+          "primaryCta": { "label": "Contact us →", "href": "/contact" },
+        },
+    },
+  ]
+---
+
+Placeholder copy. Replace every answer before you launch.

package/site-templates/simple-service/content/en/HomePage/home.mdx

@@ -0,0 +1,85 @@
+---
+type: "HomePage"
+slug: "home"
+title: "Your Company"
+description: "Placeholder home for the simple-service template — a lawn-care site that books a visit and takes the payment. Replace every line before you launch."
+sections:
+  [
+    {
+      "id": "hero",
+      "type": "hero",
+      "data":
+        {
+          "variant": "centered",
+          "eyebrow": "{Your service area}",
+          "headline": "{Lawn care that turns up when it says it will}",
+          "subheadline": "{One line on who you serve and what they get. Name the street, the town or the county — a local reader is looking for their own.}",
+          "primaryCta": { "label": "Book a visit →", "href": "/meet" },
+          "secondaryCta":
+            {
+              "label": "See services",
+              "href": "/services",
+              "variant": "outline",
+            },
+        },
+    },
+    {
+      "id": "services",
+      "type": "items",
+      "data":
+        {
+          "headline": "What we do",
+          "columns": 3,
+          "items":
+            [
+              {
+                "title": "{Lawn maintenance}",
+                "description": "{One line on the recurring visit — what it includes and how often it runs.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/lawn-maintenance",
+                  },
+              },
+              {
+                "title": "{Seasonal cleanup}",
+                "description": "{One line on the spring and autumn clear-down.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/seasonal-cleanup",
+                  },
+              },
+              {
+                "title": "{Landscape design}",
+                "description": "{One line on the design-and-plant job, and what a customer ends up with.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/landscape-design",
+                  },
+              },
+            ],
+        },
+    },
+    {
+      "id": "closing",
+      "type": "cta",
+      "data":
+        {
+          "variant": "minimal",
+          "headline": "Ready for a tidier yard?",
+          "description": "{One line inviting the reader to pick a time rather than fill in a form.}",
+          "primaryCta": { "label": "Book a visit →", "href": "/meet" },
+          "secondaryCta":
+            {
+              "label": "Ask a question",
+              "href": "/contact",
+              "variant": "outline",
+            },
+        },
+    },
+  ]
+---
+
+Placeholder copy. Every headline, every line of body copy and every price on this site is a placeholder — replace them before you launch.

package/site-templates/simple-service/content/en/Service/landscape-design.mdx

@@ -0,0 +1,40 @@
+---
+type: "Service"
+slug: "landscape-design"
+title: "{Landscape design}"
+description: "{One line on what this job is and who it suits. Replace before you launch.}"
+price: 1250
+priceCurrency: "USD"
+provider:
+  name: "{Your Company}"
+schema:
+  serviceType: "{Landscape design}"
+  areaServed: "{Your service area}"
+---
+
+# \{Landscape design\}
+
+\{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.\}
+
+## What it covers
+
+- \{The first thing you actually do\}
+- \{The second thing you actually do\}
+- \{The third thing you actually do\}
+
+## How it runs
+
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
+takes, who turns up, and what you need from the customer beforehand.\}
+
+## What you end up with
+
+\{One paragraph on the result. Be concrete — describe the yard when the crew
+drives away.\}
+
+## What it costs
+
+\{The price in this page's frontmatter is a PLACEHOLDER. It is what the site
+publishes as a schema.org `Offer`, so an agent reading this page quotes it —
+replace it with your real number before you launch.\}

package/site-templates/simple-service/content/en/Service/lawn-maintenance.mdx

@@ -0,0 +1,40 @@
+---
+type: "Service"
+slug: "lawn-maintenance"
+title: "{Lawn maintenance}"
+description: "{One line on what this job is and who it suits. Replace before you launch.}"
+price: 149
+priceCurrency: "USD"
+provider:
+  name: "{Your Company}"
+schema:
+  serviceType: "{Lawn maintenance}"
+  areaServed: "{Your service area}"
+---
+
+# \{Lawn maintenance\}
+
+\{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.\}
+
+## What it covers
+
+- \{The first thing you actually do\}
+- \{The second thing you actually do\}
+- \{The third thing you actually do\}
+
+## How it runs
+
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
+takes, who turns up, and what you need from the customer beforehand.\}
+
+## What you end up with
+
+\{One paragraph on the result. Be concrete — describe the yard when the crew
+drives away.\}
+
+## What it costs
+
+\{The price in this page's frontmatter is a PLACEHOLDER. It is what the site
+publishes as a schema.org `Offer`, so an agent reading this page quotes it —
+replace it with your real number before you launch.\}

package/site-templates/simple-service/content/en/Service/seasonal-cleanup.mdx

@@ -0,0 +1,40 @@
+---
+type: "Service"
+slug: "seasonal-cleanup"
+title: "{Seasonal cleanup}"
+description: "{One line on what this job is and who it suits. Replace before you launch.}"
+price: 289
+priceCurrency: "USD"
+provider:
+  name: "{Your Company}"
+schema:
+  serviceType: "{Seasonal cleanup}"
+  areaServed: "{Your service area}"
+---
+
+# \{Seasonal cleanup\}
+
+\{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.\}
+
+## What it covers
+
+- \{The first thing you actually do\}
+- \{The second thing you actually do\}
+- \{The third thing you actually do\}
+
+## How it runs
+
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
+takes, who turns up, and what you need from the customer beforehand.\}
+
+## What you end up with
+
+\{One paragraph on the result. Be concrete — describe the yard when the crew
+drives away.\}
+
+## What it costs
+
+\{The price in this page's frontmatter is a PLACEHOLDER. It is what the site
+publishes as a schema.org `Offer`, so an agent reading this page quotes it —
+replace it with your real number before you launch.\}

package/site-templates/simple-service/content/en/ServicesList/services.mdx

@@ -0,0 +1,72 @@
+---
+type: "ServicesList"
+slug: "services"
+title: "Services"
+description: "The three jobs {your company} does, each with its own price. Placeholder copy — replace before you launch."
+sections:
+  [
+    {
+      "id": "hero",
+      "type": "hero",
+      "data":
+        {
+          "variant": "centered",
+          "eyebrow": "Services",
+          "headline": "Three jobs, three prices",
+          "subheadline": "{One line on how to choose between them. Name the question a reader is actually asking.}",
+        },
+    },
+    {
+      "id": "jobs",
+      "type": "items",
+      "data":
+        {
+          "headline": "What we do",
+          "columns": 3,
+          "items":
+            [
+              {
+                "title": "{Lawn maintenance}",
+                "description": "{One line on the recurring visit — what it includes and how often it runs.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/lawn-maintenance",
+                  },
+              },
+              {
+                "title": "{Seasonal cleanup}",
+                "description": "{One line on the spring and autumn clear-down.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/seasonal-cleanup",
+                  },
+              },
+              {
+                "title": "{Landscape design}",
+                "description": "{One line on the design-and-plant job, and what a customer ends up with.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/landscape-design",
+                  },
+              },
+            ],
+        },
+    },
+    {
+      "id": "closing",
+      "type": "cta",
+      "data":
+        {
+          "variant": "minimal",
+          "headline": "Not sure which one?",
+          "description": "{One line inviting the reader to book the visit instead of guessing.}",
+          "primaryCta": { "label": "Book a visit →", "href": "/meet" },
+        },
+    },
+  ]
+---
+
+Placeholder copy. The three detail pages under `content/en/Service/` carry the long form and the price; this page is the chooser.

package/site-templates/simple-service/provenance.json

@@ -0,0 +1,4 @@
+{
+  "template": "simple-service",
+  "requires": ["marketing", "scheduling", "commerce"]
+}

package/templates/.claude/skills/README.md

@@ -4,41 +4,32 @@ Skills are reusable Claude Code workflows scoped to this project. Each
 lives in its own subdirectory with a `SKILL.md` describing when to use
 it and how it works.
 
-The seven OSS skills below are the canonical AI Launch Kit workflows.
-Their status reflects what's available at the upstream
-<https://github.com/working-theory-labs/ai-launch-kit> repository today. Issue
-numbers in the table refer to that upstream repo (the
-`working-theory-labs/ai-launch-kit#N` form makes the link explicit), not your
-local project's issues.
-
-## Status
-
-| Skill                | Purpose                                                | Status                                               |
-| -------------------- | ------------------------------------------------------ | ---------------------------------------------------- |
-| `suggest-site-pages` | Generic page-type suggestions by category              | coming soon — issue #361 (working-theory-labs/ai-launch-kit) |
-| `scaffold-page`      | Generate a page with the appropriate schema.org type   | coming soon — issue #362 (working-theory-labs/ai-launch-kit) |
-| `scaffold-auth`      | Wire up an auth flow against `@working-theory/auth-client`       | coming soon — issue #364 (working-theory-labs/ai-launch-kit) |
-| `audit-site`         | Run `ailk audit` and explain the results               | coming soon — issue #365 (working-theory-labs/ai-launch-kit) |
-| `add-schema`         | Add Product / Service / FAQ schema to an existing page | coming soon — issue #366 (working-theory-labs/ai-launch-kit) |
-| `provision-config`   | Generate `vercel.json` and environment templates       | coming soon — issue #367 (working-theory-labs/ai-launch-kit) |
+The six skills below ship with this project. Claude Code discovers
+them automatically at session start — nothing to install or enable.
+
+## Available skills
+
+| Skill                 | Purpose                                                                                                 |
+| ---------------------- | -------------------------------------------------------------------------------------------------------- |
+| `suggest-site-pages`  | Recommend a starter set of pages — each tagged with a schema.org type — from a free-text business description. |
+| `scaffold-page`       | Generate a new page: App Router route + MDX content stub + typed JSON-LD, in one confirm-before-write pass. |
+| `add-schema`          | Add or replace schema.org JSON-LD on a page that already exists.                                        |
+| `scaffold-auth`       | Activate auth providers — magic-link via Resend, Google OAuth, GitHub OAuth.                            |
+| `provision-config`    | Emit deploy configuration — `vercel.json`, `.env.example`, and `RUNBOOK.md` — for a Vercel deploy.       |
+| `audit-site`          | Run `ailk-audit --json` and explain the score and findings in plain language.                           |
 
 `scaffold-commerce` is delivered with the commerce module (`--modules commerce`, licensed).
 
-## How a skill ships
+## How a skill works
 
-When a skill is built upstream, this directory will contain a
-subdirectory of the same name, each holding:
+Each subdirectory holds:
 
 - `SKILL.md` — when to invoke, what it produces, what it requires.
 - Any supporting prompt fragments, code templates, or reference
   files the skill loads at runtime.
 
-Until then, the workflows the skills will perform can still be done
-by hand or by asking Claude Code directly.
-
 ## Adding your own
 
 To add a project-specific skill, create a folder here with a
 `SKILL.md` describing it. Claude Code will discover it automatically
-on session start. See the upstream `@working-theory/*` repository for examples
-of the format.
+on session start. See the skills above for examples of the format.

package/templates/.env.example

@@ -23,13 +23,20 @@ STEALTH=true
 # hide the Blog link. Set BLOG_ENABLED=true and redeploy to launch the blog.
 # BLOG_ENABLED=true
 
-# ── Content backend ──────────────────────────────────────────────────────────
-# Default: mdx — reads from /content/*.mdx at the repo root.
-# Set to "pro-cms" to use the paid Pro CMS adapter (separate package, not
-# bundled with the OSS template).
-CONTENT_BACKEND=mdx
+# ── Content adapter ──────────────────────────────────────────────────────────
+# Which content adapter every consumer resolves: mdx (default, reads
+# /content/*.mdx at the repo root) | projection (compiled manifest) | database
+# (the Artifact store — needs a workspaceId).
+CONTENT_ADAPTER=mdx
+# CONTENT_BACKEND is deprecated — read for one release, then removed.
 # Override the content directory (default: <repo-root>/content). Useful for tests.
 # AILK_CONTENT_ROOT=
+# Publish revalidation (#5851) — where apps/api POSTs on publish/unpublish so
+# the site purges the affected tag, and the HMAC-SHA256 key it signs the body
+# with. Required only under CONTENT_ADAPTER=database; with the URL unset the
+# webhook is a logged no-op.
+# CONTENT_REVALIDATE_URL=https://example.com/api/revalidate
+# CONTENT_REVALIDATE_SECRET=
 
 # ── Database (optional in standalone mode) ───────────────────────────────────
 # DATABASE_URL=postgres://user:pass@host:5432/db
@@ -50,16 +57,51 @@ CONTENT_BACKEND=mdx
 # BETTER_AUTH_URL=http://localhost:3000
 # BETTER_AUTH_SECRET=
 
-# ── Single-tenant operator pin (multi-tenant module, apps/api) ───────────────
+# ── Single-tenant operator pin (apps/api) ────────────────────────────────────
+# REQUIRED on a build WITHOUT the multi-tenant module — for the submissions
+# review dashboard AND for the `workspace` module's settings surface.
+# OPTIONAL with the multi-tenant module.
+#
 # On a single-tenant deployment (the default Workspace exists and is the ONLY
 # Workspace) the FIRST authenticated user to resolve a tenant context is
 # bound as the sole owner (TOFU — trust on first use); every subsequent
-# caller is denied. AILK_OPERATOR_EMAIL is OPTIONAL and pins that binding to
-# one email address instead of "whoever logs in first" — set it when you
-# want to guarantee only a specific operator account can ever become owner.
-# Case-insensitive, trimmed. Leave unset for pure TOFU.
+# caller is denied. AILK_OPERATOR_EMAIL pins that binding to one email
+# address instead of "whoever logs in first". Case-insensitive, trimmed.
+#
+# WITHOUT the multi-tenant module it is MANDATORY and unset fails CLOSED:
+# the review routes (/v1/waitlist-experiments/*, the tenant-scoped
+# /v1/project-listings/*) answer 403 to everyone, including you. That is
+# deliberate. Those routes can widen to an unfiltered, every-site read for an
+# owner of the default Organization, so an unpinned deployment must not seat
+# whoever authenticates first — on a site with public sign-ups that is not
+# necessarily you. The pinned account's email must also be VERIFIED.
+#
+# The same MANDATORY-and-fail-closed rule covers a `--modules workspace`
+# deployment (#5371, #5515 item 1). The Pro workspace module registers
+# /v1/workspaces/:workspaceId/{theme,identity,seo,general,members} behind the
+# same guard, so on a workspace-only build the module's Admin pages (/admin)
+# answer 403 to everyone until this is set — and, because the guard refuses
+# BEFORE resolving, the first account to load the settings page cannot bind
+# ITSELF as the sole owner off a plain GET. Set this before you hand the site
+# to its owner.
+#
+# If your own dashboard returns 403, this variable is the first thing to
+# check. With the multi-tenant module present, resolution comes from the
+# session's active workspace and this stays optional, exactly as before.
 # AILK_OPERATOR_EMAIL=
 #
+# ── Site id (apps/api, apps/web) ─────────────────────────────────────────────
+# The scope captured rows are stamped with. Lead, WaitlistExperiment and
+# ProjectListing carry `siteId`, which defaults to the literal "default"
+# (apps/api/src/lib/site.ts), while tenancy scopes reads by WORKSPACE id.
+# A single-tenant deployment should set this to the default workspace
+# sentinel so the two agree:
+# AILK_SITE_ID=wksp_00000000-0000-7000-8000-000000000001
+#
+# Leaving them disagreeing is why a correctly pinned owner can still open the
+# review dashboard and see nothing: the rows exist, but under a different
+# scope key than the one their session resolves.
+#
 # Belt-and-suspenders: the owner-pin denies any non-operator account at
 # tenant resolution regardless, but for a single-tenant deployment you should
 # also disable open sign-up / configure an OAuth allowlist on your identity
@@ -98,6 +140,45 @@ CONTENT_BACKEND=mdx
 # default.
 # RESEND_AUDIENCE_ID=
 #
+# Request-and-confirm (#5970) — the callback request a site owner confirms by
+# an emailed link, which mints a Stripe Payment Link for the customer to pay
+# on. Off by default: with the flag unset the callback route behaves exactly as
+# it always has.
+#
+# Set to "true" to turn it on. Anything else (including absent) is off, and TO,
+# FROM and AILK_PUBLIC_API_URL must ALSO resolve or the path stays off — a flag
+# with no recipient would write a credential nobody is sent.
+#
+# SINGLE-TENANT ONLY. On a build carrying the multi-tenant module this flag is
+# ignored and the callback route behaves exactly as it does with the feature
+# off. Every value here is process-wide, as is STRIPE_SECRET_KEY, so on a
+# multi-tenant deployment one tenant's customer would pay into the
+# deployment's own Stripe account. Lighting it up there means resolving these
+# per site, which is a separate piece of work.
+# AILK_REQUEST_CONFIRM_ENABLED=
+#
+# Where the confirm link is sent — the site owner's own address. Optional:
+# falls back to AILK_LEAD_NOTIFICATION_TO when unset. This message SUPERSEDES
+# the generic lead notification for a callback, so the owner still receives
+# exactly one email; it just carries more (the request's details, plus the
+# link).
+# AILK_REQUEST_CONFIRM_TO=
+#
+# The verified sender for both the owner's confirm email and the customer's
+# payment-link email. Optional — falls back to AILK_LEAD_NOTIFICATION_FROM.
+# AILK_REQUEST_CONFIRM_FROM=
+#
+# The confirm form's default currency, lowercase ISO-4217. Optional; defaults
+# to usd.
+# AILK_REQUEST_CONFIRM_CURRENCY=
+#
+# The most the confirm form will price a job at, in MINOR units (cents).
+# Optional; defaults to 1000000 — ten thousand dollars at two decimal places.
+# High enough not to obstruct a real job, low enough that a typo with three
+# extra zeroes is refused rather than charged. A value that does not parse as a
+# positive integer falls back to the default rather than becoming unbounded.
+# AILK_REQUEST_CONFIRM_MAX_MINOR=
+#
 # The public base URL this API is reachable at, e.g. https://api.example.com
 # (no trailing slash). This is the API's OWN origin — distinct from
 # FRONTEND_URL (the site the browser loads) and from `_site.mdx`'s `baseUrl`
@@ -112,6 +193,11 @@ CONTENT_BACKEND=mdx
 #   2. The OpenAPI `servers` block (#5306). Unset degrades to a single
 #      document-relative server (`/`), which an agent resolves against the
 #      origin it fetched the spec from — correct, just less explicit.
+#   3. The request-and-confirm link (#5970):
+#      `${AILK_PUBLIC_API_URL}/v1/requests/:id/confirm?token=…`. The confirm
+#      route is on this API, so this is the right base and no second
+#      base-URL variable exists. Unset means the confirm email is skipped
+#      (logged, with the row still written and the 201 unchanged).
 # AILK_PUBLIC_API_URL=
 #
 # The apps/api origin @working-theory/api-client calls from
@@ -288,12 +374,16 @@ CONTENT_BACKEND=mdx
 # booking page. Full notes in apps/api/.env.example.
 # CAL_API_KEY=cal_live_xxx
 # CAL_API_BASE_URL=https://api.cal.com
+# HMAC-SHA256 key POST /v1/webhooks/calcom verifies the x-cal-signature-256
+# header against (#6085). Unset makes the receiver answer 503 and accept
+# nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
+# CAL_WEBHOOK_SECRET=
 # SCHEDULING_PUBLIC_BASE_URL=https://cal.com
 # SCHEDULING_PROVIDER=cal
 #
-# Which event the /schedule page books, as "<owner>/<event-slug>" (the path of
+# Which event the /meet page books, as "<owner>/<event-slug>" (the path of
 # the provider's own public booking page). Read server-side by apps/web; unset
-# means the /schedule route 404s, exactly as if the scheduling module were not
+# means the /meet route 404s, exactly as if the scheduling module were not
 # installed. Deliberately NOT a NEXT_PUBLIC_ variable — the whole scheduling
 # config surface is server-read.
 # SCHEDULING_CAL_LINK=owner/event-slug

package/templates/.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      # A fresh scaffold ships no pnpm-lock.yaml — it is generated by the
+      # customer's own first `pnpm install`. actions/setup-node's built-in
+      # pnpm cache globs for cache-dependency-path and errors the step
+      # outright when nothing matches, so a PR opened before that first
+      # install would fail here before `pnpm install` below even runs. This
+      # placeholder only stands in for the glob; `pnpm install` still
+      # generates (or refreshes) the real lockfile every run.
+      - run: test -f pnpm-lock.yaml || touch pnpm-lock.yaml
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      # Not --frozen-lockfile: the scaffold ships no pnpm-lock.yaml (it is
+      # generated fresh by the customer's own first `pnpm install`, and the
+      # placeholder step above is a cache-key stand-in, not a real lockfile),
+      # so a --frozen install would fail outright on any PR opened before a
+      # real lockfile has been committed.
+      - run: pnpm install
+
+      # Prisma's generated client (database/generated/) is a build artifact,
+      # not part of the scaffold — type-check/build/test all resolve
+      # `@working-theory/database`'s generated types, and `prisma generate` needs
+      # no DATABASE_URL (it reads only the schema file, no live DB).
+      - run: pnpm db:generate
+
+      - run: pnpm type-check
+
+      - run: pnpm lint
+
+      - run: pnpm test
+
+      - run: pnpm build

package/templates/README.md

@@ -103,7 +103,9 @@ If you need to override a section component, swap its registration in the sectio
 
 ## License & contributing
 
-Your project — `{{PROJECT_NAME}}`, owned by {{COMPANY_NAME}} ({{COMPANY_DOMAIN}}) — is yours. Pick whatever license suits you.
+This is your code — `{{PROJECT_NAME}}`, owned by {{COMPANY_NAME}} ({{COMPANY_DOMAIN}}). The root `package.json`'s `license` field ships set to `UNLICENSED` as a neutral placeholder; it's yours to change to whatever license suits your project (or to remove entirely if the repo is private).
+
+The `LICENSE` files under `apps/*/` and `database/` are the exception — they stay **Apache 2.0** because those directories are snapshots of `@working-theory/*` packages' own source, not code you authored.
 
 The AI Launch Kit framework upstream is **Apache 2.0** — see <https://github.com/working-theory-labs/ai-launch-kit/blob/main/LICENSE>. Contributions are welcome at the upstream repo; start with the [contributing guide](https://github.com/working-theory-labs/ai-launch-kit/blob/main/CONTRIBUTING.md).
 

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-31.552Z-fallback-1789916251590-037e9005.json

@@ -0,0 +1,8 @@
+{
+  "id": "fallback-1789916251590-037e9005",
+  "siteId": "site_1",
+  "source": "callback",
+  "email": "",
+  "payload": {},
+  "createdAt": "2026-09-20T14:57:31.552Z"
+}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.840Z-fallback-1789916253842-b52659e9.json

@@ -0,0 +1,12 @@
+{
+  "id": "fallback-1789916253842-b52659e9",
+  "siteId": "wksp_00000000-0000-7000-8000-000000000001",
+  "source": "flow:get-a-quote",
+  "email": "abandoner@example.com",
+  "payload": {
+    "email": "abandoner@example.com",
+    "flowSlug": "get-a-quote",
+    "locale": "en"
+  },
+  "createdAt": "2026-09-20T14:57:33.840Z"
+}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.844Z-fallback-1789916253845-6b266f8c.json

@@ -0,0 +1,12 @@
+{
+  "id": "fallback-1789916253845-6b266f8c",
+  "siteId": "default",
+  "source": "flow:get-a-quote",
+  "email": "abandoner@example.com",
+  "payload": {
+    "email": "abandoner@example.com",
+    "flowSlug": "get-a-quote",
+    "locale": "en"
+  },
+  "createdAt": "2026-09-20T14:57:33.844Z"
+}