create-ailk 0.8.0 → 0.9.0

package/site-templates/shapes/person-service/TEMPLATE-MANIFEST.json

@@ -4,7 +4,7 @@
   "categories": ["consulting"],
   "shape": "person-service",
   "design": "standard",
-  "generatedHash": "21c12a9cd50e661a56ca51d56b33a4750a8aae92a13ebd1127f7530eb7cb0d72",
+  "generatedHash": "a763acef14c0c36649ad99dd4a4fea566ebdf64257bddb2f553ab8823349c309",
   "layout": {
     "nav": "full",
     "footer": "columns",
@@ -111,6 +111,61 @@
       "chrome": "on",
       "sections": []
     },
+    {
+      "route": "/for",
+      "kind": "page",
+      "pageType": "UseCasesList",
+      "schema": "UseCasesList",
+      "shell": "MarketingShell",
+      "chrome": "on",
+      "sections": [
+        {
+          "type": "hero",
+          "component": "Hero"
+        },
+        {
+          "type": "items",
+          "component": "Items",
+          "options": {
+            "columns": 3
+          }
+        },
+        {
+          "type": "logoCloud",
+          "component": "LogoCloud",
+          "options": {
+            "layout": "inline"
+          }
+        },
+        {
+          "type": "testimonials",
+          "component": "Testimonials"
+        },
+        {
+          "type": "cta",
+          "component": "CTA"
+        },
+        {
+          "type": "faq",
+          "component": "FAQ"
+        }
+      ]
+    },
+    {
+      "route": "/for/[slug]",
+      "kind": "page",
+      "contentDir": "content/en/UseCase",
+      "seeds": [
+        "content/en/UseCase/persona-1.mdx",
+        "content/en/UseCase/persona-2.mdx",
+        "content/en/UseCase/persona-3.mdx"
+      ],
+      "pageType": "UseCase",
+      "schema": "UseCase",
+      "shell": "MarketingShell",
+      "chrome": "on",
+      "sections": []
+    },
     {
       "route": "/about",
       "kind": "page",
@@ -143,6 +198,13 @@
         {
           "type": "hero",
           "component": "Hero"
+        },
+        {
+          "type": "items",
+          "component": "Items",
+          "options": {
+            "columns": 2
+          }
         }
       ]
     },
@@ -208,25 +270,22 @@
       ]
     },
     {
-      "route": "/book-a-call",
-      "kind": "page",
-      "pageType": "BookCall",
-      "schema": "BookCall",
+      "route": "/sign-in",
+      "kind": "route",
+      "pageType": null,
+      "schema": null,
       "shell": "MarketingShell",
       "chrome": "on",
-      "sections": [
-        {
-          "type": "hero",
-          "component": "Hero"
-        },
-        {
-          "type": "items",
-          "component": "Items",
-          "options": {
-            "columns": 3
-          }
-        }
-      ]
+      "sections": []
+    },
+    {
+      "route": "/sign-up",
+      "kind": "route",
+      "pageType": null,
+      "schema": null,
+      "shell": "MarketingShell",
+      "chrome": "on",
+      "sections": []
     },
     {
       "route": "/purchase-policy",
@@ -311,6 +370,56 @@
         }
       ]
     },
+    {
+      "route": "/meet",
+      "kind": "page",
+      "pageType": "LandingPage",
+      "schema": "WebPage",
+      "shell": "MarketingShell",
+      "chrome": "on",
+      "sections": [
+        {
+          "type": "hero",
+          "component": "Hero"
+        },
+        {
+          "type": "items",
+          "component": "Items",
+          "options": {
+            "columns": 2
+          }
+        }
+      ]
+    },
+    {
+      "route": "/meet/[slug]",
+      "kind": "page",
+      "pageType": "BookCall",
+      "schema": "BookCall",
+      "shell": "MarketingShell",
+      "chrome": "on",
+      "sections": [
+        {
+          "type": "hero",
+          "component": "Hero"
+        },
+        {
+          "type": "cta",
+          "component": "CTA"
+        },
+        {
+          "type": "items",
+          "component": "Items",
+          "options": {
+            "columns": 3
+          }
+        },
+        {
+          "type": "content-block",
+          "component": "ContentBlock"
+        }
+      ]
+    },
     {
       "route": "/portfolio",
       "kind": "page",

package/site-templates/shapes/person-service/TEMPLATE-MANIFEST.md

@@ -96,6 +96,28 @@ One `page=<route>` region per roster row, generated from the seed file the compo
 _Detail route over `content/en/Service/` — 3 seed pages: `first-engagement.mdx`, `second-engagement.mdx`, `third-engagement.mdx`._
 <!-- generated:end -->
 
+`/for` (the persona hub — every shape carries the family now, #6878 D7):
+
+<!-- generated:begin page=/for -->
+
+| #   | Section                                                  | Component      | Copy (first line)                                                 |
+| --- | -------------------------------------------------------- | -------------- | ----------------------------------------------------------------- |
+| 1   | `hero` (eyebrow "Customers" · 2 CTAs)                    | `Hero`         | {Customers: who your product or service is for}                   |
+| 2   | `items` (columns=3 · items ×3)                           | `Items`        | {The jobs customers hire your product or service to do}           |
+| 3   | `logoCloud` (layout=inline · logos ×6)                   | `LogoCloud`    | Don’t just take our word for it                                   |
+| 4   | `testimonials` (quote · items ×1)                        | `Testimonials` | {A customer quote, in their own words, about the result they got} |
+| 5   | `cta` (box · checklist ×3 · 2 CTAs · closingLine)        | `CTA`          | {Switch to your product or service in time amount or less}        |
+| 6   | `faq` (accordion · items ×5 · 1 CTA · initialOpen first) | `FAQ`          | FAQs                                                              |
+
+<!-- generated:end -->
+
+`/for/[slug]`:
+
+<!-- generated:begin page=/for/[slug] -->
+
+_Detail route over `content/en/UseCase/` — 3 seed pages: `persona-1.mdx`, `persona-2.mdx`, `persona-3.mdx`._
+<!-- generated:end -->
+
 `/about`:
 
 <!-- generated:begin page=/about -->
@@ -111,9 +133,10 @@ _Detail route over `content/en/Service/` — 3 seed pages: `first-engagement.mdx
 
 <!-- generated:begin page=/contact -->
 
-| #   | Section                                                   | Component | Copy (first line)                     |
-| --- | --------------------------------------------------------- | --------- | ------------------------------------- |
-| 1   | `hero` (split · eyebrow "Contact" · checklist ×3 · 1 CTA) | `Hero`    | Get every message in your email, free |
+| #   | Section                                                   | Component | Copy (first line)                         |
+| --- | --------------------------------------------------------- | --------- | ----------------------------------------- |
+| 1   | `hero` (split · eyebrow "Contact" · checklist ×3 · 1 CTA) | `Hero`    | Get every message in your email, free     |
+| 2   | `items` (tiles · columns=2 · items ×4)                    | `Items`   | {Add appointment scheduling to your site} |
 
 <!-- generated:end -->
 
@@ -129,7 +152,7 @@ _Detail route over `content/en/Service/` — 3 seed pages: `first-engagement.mdx
 
 <!-- generated:end -->
 
-`/glossary`, `/newsletter`, `/book-a-call` (base-layer seeds every starter carries, #6658 D5 — `/newsletter` is this tree's own byte copy of the Free newsletter, D4/D9):
+`/glossary`, `/newsletter` (base-layer seeds every starter carries, #6658 D5 — `/newsletter` is this tree's own byte copy of the Free newsletter, D4/D9), plus the always-copied overlay's `/meet` hub and `/meet/[slug]` BookCall detail seeds (#6897 D3-D5):
 
 <!-- generated:begin page=/glossary -->
 
@@ -149,15 +172,38 @@ _Detail route over `content/en/Service/` — 3 seed pages: `first-engagement.mdx
 
 <!-- generated:end -->
 
-<!-- generated:begin page=/book-a-call -->
+<!-- generated:begin page=/meet -->
 
-| #   | Section                                | Component | Copy (first line)                          |
-| --- | -------------------------------------- | --------- | ------------------------------------------ |
-| 1   | `hero` (eyebrow "Book a call" · 1 CTA) | `Hero`    | {Book a call: what a visitor gets from it} |
-| 2   | `items` (columns=3 · items ×3)         | `Items`   | What happens on the call?                  |
+| #   | Section                                | Component | Copy (first line)     |
+| --- | -------------------------------------- | --------- | --------------------- |
+| 1   | `hero` (eyebrow "Meet")                | `Hero`    | {Book a time with us} |
+| 2   | `items` (tiles · columns=2 · items ×4) | `Items`   |                       |
 
 <!-- generated:end -->
 
+<!-- generated:begin page=/meet/[slug] -->
+
+| #   | Section                                | Component      | Copy (first line)                                |
+| --- | -------------------------------------- | -------------- | ------------------------------------------------ |
+| 1   | `hero` (eyebrow "Book a Call" · 1 CTA) | `Hero`         | Book a Call                                      |
+| 2   | `cta` (box · 1 CTA)                    | `CTA`          | {What booking a call would do for your visitors} |
+| 3   | `items` (columns=3 · items ×3)         | `Items`        | What happens on the call?                        |
+| 4   | `content-block` (1 CTA)                | `ContentBlock` |                                                  |
+
+<!-- generated:end -->
+
+`/sign-in`, `/sign-up` (code routes — the `SignInCard` island and the sign-up form inside the locale layout, whose header links both; listed so the manifest is a complete install record, #6797):
+
+<!-- generated:begin page=/sign-in -->
+
+_Code route — no content, no sections._
+<!-- generated:end -->
+
+<!-- generated:begin page=/sign-up -->
+
+_Code route — no content, no sections._
+<!-- generated:end -->
+
 `/purchase-policy` (this tree's own service-shape override — cancellation and refunds, D4):
 
 <!-- generated:begin page=/purchase-policy -->
@@ -199,7 +245,7 @@ _Detail route over `content/en/Service/` — 3 seed pages: `first-engagement.mdx
 
 <!-- generated:end -->
 
-`/portfolio` (this tree's own override of the `_base` seed — re-voiced for one person, both CTAs `/book-a-call` and `/contact`, D4):
+`/portfolio` (this tree's own override of the `_base` seed — re-voiced for one person, both CTAs `/meet/book-a-call` and `/contact`, D4):
 
 <!-- generated:begin page=/portfolio -->
 
@@ -230,19 +276,21 @@ The standard page set for this shape (`derive-roster.py --shape person-service -
 | `ProjectsList` · `Project`                                           | the portfolio pair (`/portfolio`) is the proof of past work; `/projects` is the paid signal-collectors sample listing        |
 | `Pricing`                                                            | a consultant sells named engagements, each priced on its own `Service` page or quoted on a call — not a pricing table        |
 | `CaseStudiesList` · `CaseStudy` · `TestimonialsList` · `ClientsList` | proof pages need real clients (#6658's reason for Free, unchanged); the portfolio pages carry placeholder before/after proof |
-| `UseCasesList` · `UseCase`                                           | each `Service` page names who it is for; the `_base` persona seeds are product copy that links `/pricing`                    |
 | `EventsList` · `Event` · `DownloadsList`                             | a placeholder starter has no events or downloads                                                                             |
 | `ResourcesHub` · `ResourceDetail` · `HowTo` · `Whitepaper`           | the Resources content system is the goal-driven default a site grows into, not a starter page                                |
 
 **Rows added:**
 
-| Row added                         | Reason                                                                                                                                                                    |
-| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `PurchasePolicyPage`              | every shape carries one purchase policy with its shape's sections — service: cancellation and refunds (#6646 D3, contract R2.3)                                           |
-| `PortfolioList` · `PortfolioItem` | the portfolio pair belongs to every shape's standard roster (operator, 2026-09-25; roadmap § 4)                                                                           |
-| `BlogList`                        | every Free scaffold's nav links `/blog` unconditionally (`renderNavConfig`, operator ruling 2026-09-23); the Free teaser serves it, as on organization-product (#6753 D3) |
+| Row added                         | Reason                                                                                                                                                                                                                        |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `PurchasePolicyPage`              | every shape carries one purchase policy with its shape's sections — service: cancellation and refunds (#6646 D3, contract R2.3)                                                                                               |
+| `PortfolioList` · `PortfolioItem` | the portfolio pair belongs to every shape's standard roster (operator, 2026-09-25; roadmap § 4)                                                                                                                               |
+| `BlogList`                        | every Free scaffold's nav links `/blog` unconditionally (`renderNavConfig`, operator ruling 2026-09-23); the Free teaser serves it, as on organization-product (#6753 D3)                                                     |
+| `LandingPage`                     | the Free `/meet` meeting-types hub is a LandingPage seed, the same generic `[slug]` route serves it through (#6897 D3); the four `/meet/[slug]` BookCall detail seeds ride the `BookCall` type already in the standard roster |
+
+`|S − D| = 13` and `|R| = 18`.
 
-`|S − D| = 11` and `|R| = 15`.
+`/sign-in` and `/sign-up` are also rostered (#6797) — code routes (`kind: route`) with no page type, so they sit outside this set equation: the locale layout's header links both, and the roster of record lists every page the scaffold serves.
 
 ## 4. Roster, as the registry declares it
 
@@ -260,16 +308,21 @@ person-service:
     - { route: "/",                 kind: page, content: ["content/en/HomePage/home.mdx"] }
     - { route: "/services",         kind: page, content: ["content/en/ServicesList/services.mdx"] }
     - { route: "/services/[slug]",  kind: page, contentDir: "content/en/Service" }
+    - { route: "/for",              kind: page, content: ["content/en/UseCasesList/for.mdx"] }
+    - { route: "/for/[slug]",       kind: page, contentDir: "content/en/UseCase" }
     - { route: "/about",            kind: page, content: ["content/en/AboutPage/about.mdx"] }
     - { route: "/contact",          kind: page, content: ["content/en/ContactPage/contact.mdx"] }
     - { route: "/faq",              kind: page, content: ["content/en/FAQPage/faq.mdx"] }
     - { route: "/glossary",         kind: page, content: ["content/en/GlossaryList/glossary.mdx"] }
     - { route: "/newsletter",       kind: page, content: ["content/en/NewsletterSignup/newsletter.mdx"] }
-    - { route: "/book-a-call",      kind: page, content: ["content/en/BookCall/book-call.mdx"] }
+    - { route: "/sign-in",          kind: route }
+    - { route: "/sign-up",          kind: route }
     - { route: "/purchase-policy",  kind: page, content: ["content/en/PurchasePolicyPage/purchase-policy.mdx"] }
     - { route: "/privacy",          kind: page, content: ["content/en/PrivacyPage/privacy.mdx"] }
     - { route: "/terms",            kind: page, content: ["content/en/TermsPage/terms.mdx"] }
     - { route: "/blog",             kind: page, content: ["content/en/BlogList/blog.mdx"] }
+    - { route: "/meet",             kind: page, content: ["content/en/LandingPage/meet.mdx"] }
+    - { route: "/meet/[slug]",      kind: page, content: ["content/en/BookCall/book-a-call.mdx", "content/en/BookCall/onsite-estimate.mdx", "content/en/BookCall/start-project.mdx", "content/en/BookCall/onsite-service.mdx"] }
     - { route: "/portfolio",        kind: page, content: ["content/en/PortfolioList/portfolio.mdx"] }
     - { route: "/portfolio/[slug]", kind: page, contentDir: "content/en/PortfolioItem" }
 ```
@@ -280,11 +333,12 @@ By source:
 
 ```
 starter:  / · /services · /services/<slug> · /about · /contact · /faq
-          /glossary · /newsletter · /book-a-call · /purchase-policy
-          /privacy · /terms · /blog · /portfolio · /portfolio/<slug>
+          /glossary · /newsletter · /sign-in · /sign-up
+          /purchase-policy · /privacy · /terms · /blog · /meet · /meet/<slug>
+          /portfolio · /portfolio/<slug>
 ```
 
-Every row is module-less: `requires` is `[marketing]` alone, so `mergeRoster` contributes nothing beyond this tree's own fifteen rows.
+Every row is module-less: `requires` is `[marketing]` alone, so `mergeRoster` contributes nothing beyond this tree's own seventeen rows.
 
 ## 5. Component inventory
 

package/site-templates/shapes/person-service/ailk-template.json

@@ -6,5 +6,5 @@
     "provenance.json": ".ailk-template.json",
     "TEMPLATE-MANIFEST.json": ".ailk-site-manifest.json"
   },
-  "postInstall": "Starter person-service installed. Its /faq, /contact and /blog seed pages came with the always-copied overlay; /glossary, /newsletter, /book-a-call, /privacy and /terms with the base layer it extends (content/en/). This tree's own /, /about, /services (+ three engagements), /purchase-policy and /portfolio pages are its own compositions, written for one person. Every line of copy is a placeholder — replace it before you launch."
+  "postInstall": "Starter person-service installed. Its /faq, /contact, /blog, /meet and its four /meet/<slug> seed pages came with the always-copied overlay; /glossary, /newsletter, /privacy and /terms with the base layer it extends (content/en/). This tree's own /, /about, /services (+ three engagements), /purchase-policy and /portfolio pages are its own compositions, written for one person. Every line of copy is a placeholder \u2014 replace it before you launch."
 }

package/site-templates/shapes/person-service/content/en/AboutPage/about.mdx

@@ -24,7 +24,7 @@ sections:
         {
           "variant": "minimal",
           "headline": "Work with me",
-          "primaryCta": { "label": "Book a call", "href": "/book-a-call" },
+          "primaryCta": { "label": "Book a call", "href": "/meet/book-a-call" },
           "secondaryCta":
             {
               "label": "Get in touch",

package/site-templates/shapes/person-service/content/en/HomePage/home.mdx

@@ -14,7 +14,7 @@ sections:
           "eyebrow": "{Your Name}",
           "headline": "{One line on the outcome you deliver for clients}",
           "subheadline": "{One line on who you work with and what makes working with you different.}",
-          "primaryCta": { "label": "Book a call", "href": "/book-a-call" },
+          "primaryCta": { "label": "Book a call", "href": "/meet/book-a-call" },
           "secondaryCta":
             {
               "label": "Get in touch",
@@ -82,7 +82,7 @@ sections:
           "variant": "minimal",
           "headline": "Ready to talk about your project?",
           "description": "{One line inviting the reader to start the conversation.}",
-          "primaryCta": { "label": "Book a call", "href": "/book-a-call" },
+          "primaryCta": { "label": "Book a call", "href": "/meet/book-a-call" },
           "secondaryCta":
             {
               "label": "Get in touch",

package/site-templates/shapes/person-service/content/en/PortfolioList/portfolio.mdx

@@ -20,7 +20,8 @@ sections:
           "subheadline": "{Two or three sentences on why the comparison is the honest proof — what the before cost the client, what the after changed, and how a reader can check it.}",
           "subtitleSize": "lead",
           "ctaSize": "xl",
-          "primaryCta": { "label": "{Book a call}", "href": "/book-a-call" },
+          "primaryCta":
+            { "label": "{Book a call}", "href": "/meet/book-a-call" },
           "secondaryCta": { "label": "{Get in touch}", "href": "/contact" },
         },
     },
@@ -126,7 +127,8 @@ sections:
           "variant": "beam",
           "headline": "{Is your project the before or the after?}",
           "description": "{One line offering the reader the same comparison for their own project.}",
-          "primaryCta": { "label": "{Book a call}", "href": "/book-a-call" },
+          "primaryCta":
+            { "label": "{Book a call}", "href": "/meet/book-a-call" },
           "secondaryCta": { "label": "{Get in touch}", "href": "/contact" },
           "chips":
             [

package/site-templates/shapes/person-service/content/en/ServicesList/services.mdx

@@ -63,7 +63,7 @@ sections:
           "variant": "minimal",
           "headline": "Not sure which one?",
           "description": "{One line inviting the reader to ask instead of guessing.}",
-          "primaryCta": { "label": "Book a call", "href": "/book-a-call" },
+          "primaryCta": { "label": "Book a call", "href": "/meet/book-a-call" },
         },
     },
   ]

package/templates/.claude/rules/architecture.md

@@ -61,6 +61,13 @@ These never appear in source code:
   and future prefixes included, by being absent from the list rather than
   by being named on a ban-list. Live keys live in your deployment
   platform's secrets store, never in source files or `.env`.
+  `@working-theory/stripe-client` does export one opt-in,
+  `admitLiveRestrictedKey()`: a server process that calls it once at
+  startup lets `getStripeClient()` accept a restricted live key
+  (`rk_live_`) — never `sk_live_` or `pk_live_`. Nothing in this site
+  calls it, so the default refusal stands; calling it is a deliberate
+  go-live decision, and `assertSandboxKey()` stays sandbox-only even
+  then.
 - Direct vendor SDK imports outside the wrapper packages
   (`import 'resend'` outside `@working-theory/email`, etc.).
 - Hardcoded production database URLs in committed files.

package/templates/.claude/skills/README.md

@@ -4,14 +4,15 @@ Skills are reusable Claude Code workflows scoped to this project. Each
 lives in its own subdirectory with a `SKILL.md` describing when to use
 it and how it works.
 
-The seven skills below ship with this project. Claude Code discovers
+The eight skills below ship with this project. Claude Code discovers
 them automatically at session start — nothing to install or enable.
 
 ## Available skills
 
 | Skill          | Purpose                                                                                                      |
 | -------------- | -------------------------------------------------------------------------------------------------------------- |
-| `add-page`     | Generate a new page: App Router route + MDX content stub + typed JSON-LD, in one confirm-before-write pass. Also documents the `schema:` frontmatter override for adding supplementary structured data to a page that already exists. |
+| `add-page`     | Add a page this site can serve — its content file, structured data and nav link — adding a missing route with `create-ailk add-route` first. Also documents the `schema:` frontmatter override for any page. |
+| `update-page`  | Rename a page — give it a new URL and/or a new title — in one plan-then-confirm pass: its content files, its own route folder, exact internal links and the manifest row move together, and the old URL gets a permanent redirect. |
 | `add-auth`     | Activate auth providers — magic-link via Resend, Google OAuth, GitHub OAuth.                                  |
 | `setup-deploy` | Emit deploy configuration — `vercel.json`, `.env.example`, and `RUNBOOK.md` — for a Vercel deploy. Asks where leads go (email or a database) and warns when neither is set. |
 | `setup-database` | Take the site from no database to a working lead inbox: provision Postgres, create the tables, pin the owner, and verify one test message lands in `/leads`. |

package/templates/.claude/skills/add-auth/references/env-vars.md

@@ -8,35 +8,43 @@ The activation logic lives in `apps/web/lib/auth-env.ts` →
 `getActiveProviderIds()`. A provider is active **only when every
 required var is set to a non-empty value**. Partial wiring (e.g.,
 `GOOGLE_CLIENT_ID` set but `GOOGLE_CLIENT_SECRET` missing) is treated
-as inactive — NextAuth never tries to construct that provider.
+as inactive — `apps/web/auth.ts` never constructs that provider.
+
+The site's auth library is **Better Auth** (`apps/web/auth.ts`,
+`betterAuth({ secret, baseURL, socialProviders, … })`).
 
 ## Provider activation table
 
 | Provider ID | Required env vars                            | Source                       |
 | ----------- | -------------------------------------------- | ---------------------------- |
-| `email`     | `AUTH_EMAIL_SERVER` + `AUTH_EMAIL_FROM`      | Magic-link (Resend at v1)    |
+| `email`     | `AUTH_EMAIL_SERVER` + `AUTH_EMAIL_FROM`      | Email sign-in (Resend)¹      |
 | `google`    | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET`  | Google OAuth                 |
 | `github`    | `GITHUB_CLIENT_ID` + `GITHUB_CLIENT_SECRET`  | GitHub OAuth                 |
 
+¹ Better Auth core ships no magic-link provider, so `email` is an
+env-presence signal: it switches on the password method
+(`emailAndPassword`) in `apps/web/auth.ts`, not a wired magic link.
+
 ## Auxiliary auth env vars
 
 | Var                    | Default | Effect                                                                                |
 | ---------------------- | ------- | ------------------------------------------------------------------------------------- |
-| `AILK_AUTH_REQUIRED`   | unset   | When `"1"` or `"true"`, the middleware redirects unauthenticated users to `/api/auth/signin` for protected routes. Default is auth-disabled / public, so a fresh scaffold boots without requiring any auth wiring. |
-| `NEXTAUTH_URL`         | unset   | NextAuth uses this as the base URL when constructing callback URLs in production. Local dev defaults to `http://localhost:3000` so you can leave this unset for development. |
-| `NEXTAUTH_SECRET`      | unset   | NextAuth uses this to sign JWT tokens. **Must** be set for production — generate with `openssl rand -base64 32`. Optional for `next dev` (auto-generated for local-only sessions). |
+| `AILK_AUTH_REQUIRED`   | unset   | Read by `isAuthRequired()` in `apps/web/lib/auth-env.ts` (`"1"` or `"true"`). Default is auth-disabled / public, so a fresh scaffold boots without requiring any auth wiring. |
+| `BETTER_AUTH_URL`      | unset   | The site's public origin (e.g. `https://your-domain.com`). Better Auth builds OAuth callback URLs on it and it is the one trusted origin; unset, Better Auth derives both from each request. Set it in production. Local dev can leave it unset. |
+| `BETTER_AUTH_SECRET`   | unset   | Signs session cookies and email-verification tokens. **Required in production** — `apps/web/auth.ts` throws when it is unset there, rather than fall back to the development secret published in the source. Generate with `openssl rand -base64 32`. Optional for `next dev`. |
 
 The skill writes none of these auxiliary vars on its own. It mentions
 them in the closing summary so the consumer is aware:
 
 - `AILK_AUTH_REQUIRED` is the consumer's call (skill always defaults
   to leaving it unset).
-- `NEXTAUTH_URL` and `NEXTAUTH_SECRET` are deferred to production-time
-  setup (`setup-deploy` or future deploy skill).
+- `BETTER_AUTH_URL` and `BETTER_AUTH_SECRET` are deferred to
+  production-time setup (`setup-deploy`), and a production deploy
+  fails without `BETTER_AUTH_SECRET`.
 
 ## Env-var formats — what valid values look like
 
-### `AUTH_EMAIL_SERVER` (magic-link via Resend)
+### `AUTH_EMAIL_SERVER` (email sign-in via Resend)
 
 ```
 smtp://resend:<RESEND_API_KEY>@smtp.resend.com:465
@@ -46,7 +54,7 @@ The Resend API key starts with `re_`. The literal username is the
 string `resend` (Resend's SMTP convention). Port 465 is implicit-TLS
 SMTP.
 
-### `AUTH_EMAIL_FROM` (magic-link via Resend)
+### `AUTH_EMAIL_FROM` (email sign-in via Resend)
 
 A verified sender address on the consumer's Resend account. For
 development, `onboarding@resend.dev` works without verification.
@@ -73,7 +81,7 @@ The skill's Step 1 menu marks providers as `[x]` when both required
 vars are set in `.env.local`. The detection is presence-only — the
 skill does not validate that the values actually work (no Google
 API ping, no GitHub API ping, no test SMTP connection). A consumer
-who pasted typos will get a runtime auth error from NextAuth on
+who pasted typos will get a runtime auth error from Better Auth on
 their first sign-in attempt; the fix is to re-run the skill and
 overwrite.
 
@@ -81,11 +89,10 @@ overwrite.
 
 - `apps/web/lib/auth-env.ts` — `getActiveProviderIds()` and
   `isAuthRequired()`.
-- `apps/web/auth.config.ts` — `buildProviders()` consumes the
-  active-provider list and constructs NextAuth provider objects with
-  the matching env vars.
-- `apps/web/middleware.ts` — `isAuthRequired()` decides whether to
-  redirect unauthenticated users.
+- `apps/web/auth.ts` — `buildSocialProviders()` consumes the
+  active-provider list and builds Better Auth's `socialProviders`
+  from the matching env vars; `resolveSecret()` reads
+  `BETTER_AUTH_SECRET`, and `baseURL` is `BETTER_AUTH_URL`.
 
 The skill never modifies any of those files. All activation is
 env-var-driven.

package/templates/.claude/skills/add-auth/references/oauth-app-setup.md

@@ -62,7 +62,7 @@ Google sign-in is activated when both env vars are present in
 2. If you haven't yet, configure the OAuth consent screen:
    - User type: **External** (unless you're inside a Workspace org).
    - Fill in app name, support email, and developer contact email.
-   - Scopes are auto-populated by NextAuth at runtime — leave the
+   - Scopes are requested by Better Auth at runtime — leave the
      consent screen scope list empty.
 3. Click **Create Credentials → OAuth client ID**.
 4. Application type: **Web application**.
@@ -158,7 +158,8 @@ The Client ID stays the same.
 
 A provider is **active** when both required env vars are set in
 `.env.local`. The provider list is computed at server startup from env
-vars only — there are no `auth.config.ts` edits to make.
+vars only (`getActiveProviderIds()` in `apps/web/lib/auth-env.ts`) — there
+are no `apps/web/auth.ts` edits to make.
 
 To require sign-in for protected routes, set in `.env.local`: