create-ailk 0.7.0 → 0.9.0

package/site-templates/shapes/person-service/content/en/PortfolioList/portfolio.mdx

@@ -0,0 +1,171 @@
+---
+type: "PortfolioList"
+slug: "portfolio"
+title: "{Before and after, compared} | {Your Name}"
+description: "{Every project shown as a comparison — what the client had, what they have now, and what changed in between.}"
+sections:
+  [
+    {
+      "id": "cases-hero",
+      "type": "hero",
+      "data":
+        {
+          "variant": "default",
+          "size": "display",
+          "surface": "wash-secondary",
+          "gapBelow": "tight",
+          "eyebrow": "{Portfolio}",
+          "eyebrowTone": "brand",
+          "headline": "{My work, before and after.}",
+          "subheadline": "{Two or three sentences on why the comparison is the honest proof — what the before cost the client, what the after changed, and how a reader can check it.}",
+          "subtitleSize": "lead",
+          "ctaSize": "xl",
+          "primaryCta":
+            { "label": "{Book a call}", "href": "/meet/book-a-call" },
+          "secondaryCta": { "label": "{Get in touch}", "href": "/contact" },
+        },
+    },
+    {
+      "id": "cases-tiles",
+      "type": "items",
+      "data":
+        {
+          "variant": "tile",
+          "tileHover": "outline",
+          "columns": 2,
+          "surface": "none",
+          "items":
+            [
+              {
+                "title": "{Example one}: before and after",
+                "description": "{One sentence on what example one had, and what they have now}",
+                "rows":
+                  [
+                    {
+                      "label": "THE CLIENT",
+                      "body": "{Who they are and the market they sell into}",
+                    },
+                    {
+                      "label": "WHAT CHANGED",
+                      "body": "{The one thing the after does that the before could not}",
+                    },
+                  ],
+                "link":
+                  {
+                    "label": "See the comparison →",
+                    "href": "/portfolio/sample-one",
+                  },
+              },
+              {
+                "title": "{Example two}: before and after",
+                "description": "{One sentence on what example two had, and what they have now}",
+                "rows":
+                  [
+                    {
+                      "label": "THE CLIENT",
+                      "body": "{Who they are and the market they sell into}",
+                    },
+                    {
+                      "label": "WHAT CHANGED",
+                      "body": "{The one thing the after does that the before could not}",
+                    },
+                  ],
+                "link":
+                  {
+                    "label": "See the comparison →",
+                    "href": "/portfolio/sample-two",
+                  },
+              },
+              {
+                "title": "{Example three}: before and after",
+                "description": "{One sentence on what example three had, and what they have now}",
+                "rows":
+                  [
+                    {
+                      "label": "THE CLIENT",
+                      "body": "{Who they are and the market they sell into}",
+                    },
+                    {
+                      "label": "WHAT CHANGED",
+                      "body": "{The one thing the after does that the before could not}",
+                    },
+                  ],
+                "link":
+                  {
+                    "label": "See the comparison →",
+                    "href": "/portfolio/sample-three",
+                  },
+              },
+              {
+                "title": "{Example four}: before and after",
+                "description": "{One sentence on what example four had, and what they have now}",
+                "rows":
+                  [
+                    {
+                      "label": "THE CLIENT",
+                      "body": "{Who they are and the market they sell into}",
+                    },
+                    {
+                      "label": "WHAT CHANGED",
+                      "body": "{The one thing the after does that the before could not}",
+                    },
+                  ],
+                "link":
+                  {
+                    "label": "See the comparison →",
+                    "href": "/portfolio/sample-four",
+                  },
+              },
+            ],
+        },
+    },
+    {
+      "id": "cases-close",
+      "type": "cta",
+      "data":
+        {
+          "variant": "beam",
+          "headline": "{Is your project the before or the after?}",
+          "description": "{One line offering the reader the same comparison for their own project.}",
+          "primaryCta":
+            { "label": "{Book a call}", "href": "/meet/book-a-call" },
+          "secondaryCta": { "label": "{Get in touch}", "href": "/contact" },
+          "chips":
+            [
+              "{Proof you can check}",
+              "{Every project shown both ways}",
+              "{Re-checked every quarter}",
+            ],
+        },
+    },
+    {
+      "id": "cases-faq",
+      "type": "faq",
+      "data":
+        {
+          "headline": "Frequently Asked Questions",
+          "variant": "centered",
+          "presentation": "accordion",
+          "questionSize": "body-lg",
+          "initialOpen": "first",
+          "containerWidth": "default",
+          "surface": "gray-100",
+          "items":
+            [
+              {
+                "question": "{How do you pick which projects to show?}",
+                "answer": "{Two or three sentences.}",
+              },
+              {
+                "question": "{Are the before screenshots real?}",
+                "answer": "{Two or three sentences.}",
+              },
+              {
+                "question": "{Can I see the numbers behind a comparison?}",
+                "answer": "{Two or three sentences.}",
+              },
+            ],
+        },
+    },
+  ]
+---

package/site-templates/{simple-service → shapes/person-service}/content/en/PurchasePolicyPage/purchase-policy.mdx

@@ -2,8 +2,7 @@
 type: "PurchasePolicyPage"
 slug: "purchase-policy"
 title: "Purchase Policy"
-description: "How cancellations, reschedules and refunds work for bookings made on this site. Placeholder policy — replace every section before you launch."
-placeholder: true
+description: "How cancellations, reschedules and refunds work for engagements booked on this site. Placeholder policy — replace every section before you launch."
 sections:
   [
     {
@@ -24,11 +23,11 @@ sections:
                   [
                     {
                       "kind": "paragraph",
-                      "text": "This page is starter content that shipped with your site. It is not a purchase policy, it makes no commitment on behalf of Your Company, and it is not legal advice. Replace every section with the policy you actually operate, and have someone qualified read it before you publish.",
+                      "text": "This page is starter content that shipped with your site. It is not a purchase policy, it makes no commitment on behalf of Your Name, and it is not legal advice. Replace every section with the policy you actually operate, and have someone qualified read it before you publish.",
                     },
                     {
                       "kind": "paragraph",
-                      "text": "This section explains how cancellations and reschedules work for bookings made on this site. The headings are the ones a customer and an agent both look for, so keep them and fill in your own terms.",
+                      "text": "This section explains how cancellations and reschedules work for engagements booked on this site. The headings are the ones a client and an agent both look for, so keep them and fill in your own terms.",
                     },
                   ],
                 "subsections":
@@ -40,7 +39,7 @@ sections:
                         [
                           {
                             "kind": "paragraph",
-                            "text": "State the notice period in hours before the appointment, and say how it is measured. A customer reading at midnight should be able to work out, without arithmetic you have not shown them, whether they are still inside it.",
+                            "text": "State the notice period in hours before the session, and say how it is measured. A client reading at midnight should be able to work out, without arithmetic you have not shown them, whether they are still inside it.",
                           },
                         ],
                     },
@@ -62,18 +61,18 @@ sections:
                         [
                           {
                             "kind": "paragraph",
-                            "text": "Say what a late cancellation costs and what a no-show costs, as a figure or a share of the booking, and when each is charged. If you hold a deposit, say what happens to it in each case.",
+                            "text": "Say what a late cancellation costs and what a no-show costs, as a figure or a share of the engagement, and when each is charged. If you hold a deposit, say what happens to it in each case.",
                           },
                         ],
                     },
                     {
                       "id": "our-cancellations",
-                      "heading": "If we cancel",
+                      "heading": "If I cancel",
                       "blocks":
                         [
                           {
                             "kind": "paragraph",
-                            "text": "Set out what a customer gets if you cancel or move an appointment — a full refund, a rebooking, or both — and how quickly you tell them. A policy that only binds one side reads as one.",
+                            "text": "Set out what a client gets if you cancel or move a session — a full refund, a rebooking, or both — and how quickly you tell them. A policy that only binds one side reads as one.",
                           },
                         ],
                     },
@@ -84,7 +83,7 @@ sections:
                         [
                           {
                             "kind": "paragraph",
-                            "text": "Name the circumstances in which you waive a fee — illness, bereavement, severe weather — and say what you need from the customer to apply the waiver. Vague discretion is worse for you than a short written list.",
+                            "text": "Name the circumstances in which you waive a fee — illness, bereavement, severe weather — and say what you need from the client to apply the waiver. Vague discretion is worse for you than a short written list.",
                           },
                         ],
                     },
@@ -97,7 +96,7 @@ sections:
                   [
                     {
                       "kind": "paragraph",
-                      "text": "Say what a customer gets back after a cancellation — the booking price, the deposit, or both, and how long the refund takes to reach the payment method it came from. If you offer store credit or a rebooking instead, describe when each applies.",
+                      "text": "Say what a client gets back after a cancellation — the session price, the deposit, or both, and how long the refund takes to reach the payment method it came from. If you offer credit toward a future engagement instead, describe when that applies.",
                     },
                   ],
                 "subsections":
@@ -109,7 +108,7 @@ sections:
                         [
                           {
                             "kind": "paragraph",
-                            "text": "Point to the one place a customer should write, and say roughly how quickly you answer. A policy nobody can ask a question about is a policy that generates disputes.",
+                            "text": "Point to the one place a client should write, and say roughly how quickly you answer. A policy nobody can ask a question about is a policy that generates disputes.",
                           },
                         ],
                     },

package/site-templates/shapes/person-service/content/en/Service/first-engagement.mdx

@@ -0,0 +1,38 @@
+---
+type: "Service"
+slug: "first-engagement"
+title: "{First engagement}"
+description: "{One line on what this engagement is and who it suits. Replace before you launch.}"
+schema:
+  serviceType: "{First engagement}"
+  provider:
+    "@type": Person
+    name: "Your Name"
+---
+
+# {First engagement}
+
+{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.}
+
+## What it covers
+
+- {The first thing you actually do}
+- {The second thing you actually do}
+- {The third thing you actually do}
+
+## How it runs
+
+{One paragraph on the shape of the engagement: how it starts, how long it runs,
+who is involved, and what a week looks like.}
+
+## What you end up with
+
+{One paragraph on the deliverable. Be concrete — name the artefact, not the
+feeling.}
+
+## What it costs
+
+{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+excludes. Replace with your real numbers, or delete this section and let the
+call do it.}

package/site-templates/shapes/person-service/content/en/Service/second-engagement.mdx

@@ -0,0 +1,38 @@
+---
+type: "Service"
+slug: "second-engagement"
+title: "{Second engagement}"
+description: "{One line on what this engagement is and who it suits. Replace before you launch.}"
+schema:
+  serviceType: "{Second engagement}"
+  provider:
+    "@type": Person
+    name: "Your Name"
+---
+
+# {Second engagement}
+
+{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.}
+
+## What it covers
+
+- {The first thing you actually do}
+- {The second thing you actually do}
+- {The third thing you actually do}
+
+## How it runs
+
+{One paragraph on the shape of the engagement: how it starts, how long it runs,
+who is involved, and what a week looks like.}
+
+## What you end up with
+
+{One paragraph on the deliverable. Be concrete — name the artefact, not the
+feeling.}
+
+## What it costs
+
+{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+excludes. Replace with your real numbers, or delete this section and let the
+call do it.}

package/site-templates/shapes/person-service/content/en/Service/third-engagement.mdx

@@ -0,0 +1,38 @@
+---
+type: "Service"
+slug: "third-engagement"
+title: "{Third engagement}"
+description: "{One line on what this engagement is and who it suits. Replace before you launch.}"
+schema:
+  serviceType: "{Third engagement}"
+  provider:
+    "@type": Person
+    name: "Your Name"
+---
+
+# {Third engagement}
+
+{Open with the situation a reader is in when they come looking for this. Two or
+three sentences, no more — the detail belongs under the headings below.}
+
+## What it covers
+
+- {The first thing you actually do}
+- {The second thing you actually do}
+- {The third thing you actually do}
+
+## How it runs
+
+{One paragraph on the shape of the engagement: how it starts, how long it runs,
+who is involved, and what a week looks like.}
+
+## What you end up with
+
+{One paragraph on the deliverable. Be concrete — name the artefact, not the
+feeling.}
+
+## What it costs
+
+{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+excludes. Replace with your real numbers, or delete this section and let the
+call do it.}

package/site-templates/{simple-service → shapes/person-service}/content/en/ServicesList/services.mdx

@@ -2,7 +2,7 @@
 type: "ServicesList"
 slug: "services"
 title: "Services"
-description: "The three jobs {your company} does, each with its own price. Placeholder copy — replace before you launch."
+description: "The three engagements {Your Name} offers. Placeholder copy — replace before you launch."
 sections:
   [
     {
@@ -12,44 +12,44 @@ sections:
         {
           "variant": "centered",
           "eyebrow": "Services",
-          "headline": "Three jobs, three prices",
+          "headline": "Three ways to work together",
           "subheadline": "{One line on how to choose between them. Name the question a reader is actually asking.}",
         },
     },
     {
-      "id": "jobs",
+      "id": "engagements",
       "type": "items",
       "data":
         {
-          "headline": "What we do",
+          "headline": "Engagements",
           "columns": 3,
           "items":
             [
               {
-                "title": "{Lawn maintenance}",
-                "description": "{One line on the recurring visit — what it includes and how often it runs.}",
+                "title": "{First engagement}",
+                "description": "{One line on what it is and who it suits.}",
                 "link":
                   {
                     "label": "Read more",
-                    "href": "/services/lawn-maintenance",
+                    "href": "/services/first-engagement",
                   },
               },
               {
-                "title": "{Seasonal cleanup}",
-                "description": "{One line on the spring and autumn clear-down.}",
+                "title": "{Second engagement}",
+                "description": "{One line on what it is and who it suits.}",
                 "link":
                   {
                     "label": "Read more",
-                    "href": "/services/seasonal-cleanup",
+                    "href": "/services/second-engagement",
                   },
               },
               {
-                "title": "{Landscape design}",
-                "description": "{One line on the design-and-plant job, and what a customer ends up with.}",
+                "title": "{Third engagement}",
+                "description": "{One line on what it is and who it suits.}",
                 "link":
                   {
                     "label": "Read more",
-                    "href": "/services/landscape-design",
+                    "href": "/services/third-engagement",
                   },
               },
             ],
@@ -62,11 +62,11 @@ sections:
         {
           "variant": "minimal",
           "headline": "Not sure which one?",
-          "description": "{One line inviting the reader to book the visit instead of guessing.}",
-          "primaryCta": { "label": "Book a visit →", "href": "/meet" },
+          "description": "{One line inviting the reader to ask instead of guessing.}",
+          "primaryCta": { "label": "Book a call", "href": "/meet/book-a-call" },
         },
     },
   ]
 ---
 
-Placeholder copy. The three detail pages under `content/en/Service/` carry the long form and the price; this page is the chooser.
+Placeholder copy. The three detail pages under `content/en/Service/` carry the long form; this page is the chooser.

package/site-templates/shapes/person-service/provenance.json

@@ -0,0 +1,4 @@
+{
+  "template": "person-service",
+  "requires": ["marketing"]
+}

package/templates/.claude/rules/architecture.md

@@ -61,6 +61,13 @@ These never appear in source code:
   and future prefixes included, by being absent from the list rather than
   by being named on a ban-list. Live keys live in your deployment
   platform's secrets store, never in source files or `.env`.
+  `@working-theory/stripe-client` does export one opt-in,
+  `admitLiveRestrictedKey()`: a server process that calls it once at
+  startup lets `getStripeClient()` accept a restricted live key
+  (`rk_live_`) — never `sk_live_` or `pk_live_`. Nothing in this site
+  calls it, so the default refusal stands; calling it is a deliberate
+  go-live decision, and `assertSandboxKey()` stays sandbox-only even
+  then.
 - Direct vendor SDK imports outside the wrapper packages
   (`import 'resend'` outside `@working-theory/email`, etc.).
 - Hardcoded production database URLs in committed files.

package/templates/.claude/skills/README.md

@@ -4,16 +4,18 @@ Skills are reusable Claude Code workflows scoped to this project. Each
 lives in its own subdirectory with a `SKILL.md` describing when to use
 it and how it works.
 
-The six skills below ship with this project. Claude Code discovers
+The eight skills below ship with this project. Claude Code discovers
 them automatically at session start — nothing to install or enable.
 
 ## Available skills
 
 | Skill          | Purpose                                                                                                      |
 | -------------- | -------------------------------------------------------------------------------------------------------------- |
-| `add-page`     | Generate a new page: App Router route + MDX content stub + typed JSON-LD, in one confirm-before-write pass. Also documents the `schema:` frontmatter override for adding supplementary structured data to a page that already exists. |
+| `add-page`     | Add a page this site can serve — its content file, structured data and nav link — adding a missing route with `create-ailk add-route` first. Also documents the `schema:` frontmatter override for any page. |
+| `update-page`  | Rename a page — give it a new URL and/or a new title — in one plan-then-confirm pass: its content files, its own route folder, exact internal links and the manifest row move together, and the old URL gets a permanent redirect. |
 | `add-auth`     | Activate auth providers — magic-link via Resend, Google OAuth, GitHub OAuth.                                  |
-| `setup-deploy` | Emit deploy configuration — `vercel.json`, `.env.example`, and `RUNBOOK.md` — for a Vercel deploy.            |
+| `setup-deploy` | Emit deploy configuration — `vercel.json`, `.env.example`, and `RUNBOOK.md` — for a Vercel deploy. Asks where leads go (email or a database) and warns when neither is set. |
+| `setup-database` | Take the site from no database to a working lead inbox: provision Postgres, create the tables, pin the owner, and verify one test message lands in `/leads`. |
 | `check-site`   | Run `ailk-audit --json` and explain the score and findings in plain language.                                 |
 | `fill-page`    | Fill one page's section content from a category profile: labelled sample content (tier 1) or your own first draft from a short intake (tier 2). |
 | `upgrade-plan` | Compare Free, Pro, Pro Plus, Agency and the commerce add-on side by side, with the prices the public pricing page publishes right now, and recommend one option for this site with a reason. |

package/templates/.claude/skills/add-auth/references/env-vars.md

@@ -8,35 +8,43 @@ The activation logic lives in `apps/web/lib/auth-env.ts` →
 `getActiveProviderIds()`. A provider is active **only when every
 required var is set to a non-empty value**. Partial wiring (e.g.,
 `GOOGLE_CLIENT_ID` set but `GOOGLE_CLIENT_SECRET` missing) is treated
-as inactive — NextAuth never tries to construct that provider.
+as inactive — `apps/web/auth.ts` never constructs that provider.
+
+The site's auth library is **Better Auth** (`apps/web/auth.ts`,
+`betterAuth({ secret, baseURL, socialProviders, … })`).
 
 ## Provider activation table
 
 | Provider ID | Required env vars                            | Source                       |
 | ----------- | -------------------------------------------- | ---------------------------- |
-| `email`     | `AUTH_EMAIL_SERVER` + `AUTH_EMAIL_FROM`      | Magic-link (Resend at v1)    |
+| `email`     | `AUTH_EMAIL_SERVER` + `AUTH_EMAIL_FROM`      | Email sign-in (Resend)¹      |
 | `google`    | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET`  | Google OAuth                 |
 | `github`    | `GITHUB_CLIENT_ID` + `GITHUB_CLIENT_SECRET`  | GitHub OAuth                 |
 
+¹ Better Auth core ships no magic-link provider, so `email` is an
+env-presence signal: it switches on the password method
+(`emailAndPassword`) in `apps/web/auth.ts`, not a wired magic link.
+
 ## Auxiliary auth env vars
 
 | Var                    | Default | Effect                                                                                |
 | ---------------------- | ------- | ------------------------------------------------------------------------------------- |
-| `AILK_AUTH_REQUIRED`   | unset   | When `"1"` or `"true"`, the middleware redirects unauthenticated users to `/api/auth/signin` for protected routes. Default is auth-disabled / public, so a fresh scaffold boots without requiring any auth wiring. |
-| `NEXTAUTH_URL`         | unset   | NextAuth uses this as the base URL when constructing callback URLs in production. Local dev defaults to `http://localhost:3000` so you can leave this unset for development. |
-| `NEXTAUTH_SECRET`      | unset   | NextAuth uses this to sign JWT tokens. **Must** be set for production — generate with `openssl rand -base64 32`. Optional for `next dev` (auto-generated for local-only sessions). |
+| `AILK_AUTH_REQUIRED`   | unset   | Read by `isAuthRequired()` in `apps/web/lib/auth-env.ts` (`"1"` or `"true"`). Default is auth-disabled / public, so a fresh scaffold boots without requiring any auth wiring. |
+| `BETTER_AUTH_URL`      | unset   | The site's public origin (e.g. `https://your-domain.com`). Better Auth builds OAuth callback URLs on it and it is the one trusted origin; unset, Better Auth derives both from each request. Set it in production. Local dev can leave it unset. |
+| `BETTER_AUTH_SECRET`   | unset   | Signs session cookies and email-verification tokens. **Required in production** — `apps/web/auth.ts` throws when it is unset there, rather than fall back to the development secret published in the source. Generate with `openssl rand -base64 32`. Optional for `next dev`. |
 
 The skill writes none of these auxiliary vars on its own. It mentions
 them in the closing summary so the consumer is aware:
 
 - `AILK_AUTH_REQUIRED` is the consumer's call (skill always defaults
   to leaving it unset).
-- `NEXTAUTH_URL` and `NEXTAUTH_SECRET` are deferred to production-time
-  setup (`setup-deploy` or future deploy skill).
+- `BETTER_AUTH_URL` and `BETTER_AUTH_SECRET` are deferred to
+  production-time setup (`setup-deploy`), and a production deploy
+  fails without `BETTER_AUTH_SECRET`.
 
 ## Env-var formats — what valid values look like
 
-### `AUTH_EMAIL_SERVER` (magic-link via Resend)
+### `AUTH_EMAIL_SERVER` (email sign-in via Resend)
 
 ```
 smtp://resend:<RESEND_API_KEY>@smtp.resend.com:465
@@ -46,7 +54,7 @@ The Resend API key starts with `re_`. The literal username is the
 string `resend` (Resend's SMTP convention). Port 465 is implicit-TLS
 SMTP.
 
-### `AUTH_EMAIL_FROM` (magic-link via Resend)
+### `AUTH_EMAIL_FROM` (email sign-in via Resend)
 
 A verified sender address on the consumer's Resend account. For
 development, `onboarding@resend.dev` works without verification.
@@ -73,7 +81,7 @@ The skill's Step 1 menu marks providers as `[x]` when both required
 vars are set in `.env.local`. The detection is presence-only — the
 skill does not validate that the values actually work (no Google
 API ping, no GitHub API ping, no test SMTP connection). A consumer
-who pasted typos will get a runtime auth error from NextAuth on
+who pasted typos will get a runtime auth error from Better Auth on
 their first sign-in attempt; the fix is to re-run the skill and
 overwrite.
 
@@ -81,11 +89,10 @@ overwrite.
 
 - `apps/web/lib/auth-env.ts` — `getActiveProviderIds()` and
   `isAuthRequired()`.
-- `apps/web/auth.config.ts` — `buildProviders()` consumes the
-  active-provider list and constructs NextAuth provider objects with
-  the matching env vars.
-- `apps/web/middleware.ts` — `isAuthRequired()` decides whether to
-  redirect unauthenticated users.
+- `apps/web/auth.ts` — `buildSocialProviders()` consumes the
+  active-provider list and builds Better Auth's `socialProviders`
+  from the matching env vars; `resolveSecret()` reads
+  `BETTER_AUTH_SECRET`, and `baseURL` is `BETTER_AUTH_URL`.
 
 The skill never modifies any of those files. All activation is
 env-var-driven.

package/templates/.claude/skills/add-auth/references/oauth-app-setup.md

@@ -62,7 +62,7 @@ Google sign-in is activated when both env vars are present in
 2. If you haven't yet, configure the OAuth consent screen:
    - User type: **External** (unless you're inside a Workspace org).
    - Fill in app name, support email, and developer contact email.
-   - Scopes are auto-populated by NextAuth at runtime — leave the
+   - Scopes are requested by Better Auth at runtime — leave the
      consent screen scope list empty.
 3. Click **Create Credentials → OAuth client ID**.
 4. Application type: **Web application**.
@@ -158,7 +158,8 @@ The Client ID stays the same.
 
 A provider is **active** when both required env vars are set in
 `.env.local`. The provider list is computed at server startup from env
-vars only — there are no `auth.config.ts` edits to make.
+vars only (`getActiveProviderIds()` in `apps/web/lib/auth-env.ts`) — there
+are no `apps/web/auth.ts` edits to make.
 
 To require sign-in for protected routes, set in `.env.local`: