create-ailk 0.9.0 → 0.10.0

package/templates/.claude/skills/setup-deploy/references/env-vars-template.md

@@ -1,192 +0,0 @@
-# `.env.example` Template
-
-The structure the `setup-deploy` skill emits at the consumer's
-project root. Placeholder values only — the skill never echoes a
-real secret.
-
-When `@working-theory/env` ships a Zod schema (currently a placeholder
-package), this template should be revised to derive from that
-schema instead. Until then, this file is the source of truth for
-what env vars an AILK consumer site reads.
-
-## Template
-
-```bash
-# AI Launch Kit — environment template
-# Copy this file to `.env.local` (gitignored) and fill in values.
-# Production values live in your deploy platform's dashboard
-# (Vercel project settings → Environment Variables).
-
-# ── Marketing / canonical domain ─────────────────────────────────
-# Your site's canonical public domain (no protocol).
-AILK_PUBLIC_DOMAIN=your-domain.com
-
-# ── Content backend ──────────────────────────────────────────────
-# AILK's MDX adapter is the default. Other adapters ship as
-# additive PRs later.
-CONTENT_BACKEND=mdx
-# Override the content directory. Default is <repo-root>/content.
-# AILK_CONTENT_ROOT=
-
-# ── Lead delivery ────────────────────────────────────────────────
-# Where contact-form messages go (RUNBOOK.md § "Leads — where
-# messages go"). Set these on the API project.
-#
-# Lead inbox — set by the `setup-database` skill. With it, messages
-# land in /leads and newsletter signups are collected.
-# DATABASE_URL=postgres://user:pass@host:5432/db
-# DATABASE_URL_NON_POOLED=postgres://user:pass@host:5432/db
-#
-# Email (default) — with no database, each message is emailed to you.
-# All three are required; a key alone sends nothing.
-# RESEND_API_KEY=
-# AILK_LEAD_NOTIFICATION_TO=you@your-domain.com
-# AILK_LEAD_NOTIFICATION_FROM=leads@your-domain.com
-#
-# With neither, /contact shows your contact email (content/_site.mdx
-# `contactEmail`) instead of the form in production.
-
-# ── API origin checks + checkout gate (apps/api) ─────────────────
-# Set both on the API project. Unset in production, the API logs a
-# startup warning for each and keeps running, but:
-# - without FRONTEND_URL, CORS and cookie origin checks are pinned to
-#   http://localhost:3000 and checkout answers 500 to a caller admitted
-#   without X-Internal-Auth;
-# - without OSS_API_INTERNAL_SECRET, the checkout route admits callers
-#   without the X-Internal-Auth header.
-# FRONTEND_URL is the site the browser loads (no trailing slash).
-# FRONTEND_URL=https://your-domain.com
-# Shared secret: the same value on the API and web projects.
-# Generate with: openssl rand -hex 32
-# OSS_API_INTERNAL_SECRET=
-
-# ── Auth — required env vars ─────────────────────────────────────
-# Set to "1" to require sign-in for protected routes; default is
-# auth-disabled / public.
-# AILK_AUTH_REQUIRED=1
-#
-# Better Auth secret — signs session cookies. REQUIRED in production:
-# apps/web/auth.ts throws in production without it. Generate with:
-#   openssl rand -base64 32
-# Local dev (next dev) uses a development fallback.
-# BETTER_AUTH_SECRET=
-#
-# The site's public origin — Better Auth builds OAuth callback URLs on
-# it and trusts only it. Set it in production; local dev can leave it
-# unset.
-# BETTER_AUTH_URL=https://your-domain.com
-
-# ── Auth — email sign-in (Resend) ────────────────────────────────
-# Activated when both AUTH_EMAIL_SERVER and AUTH_EMAIL_FROM are set.
-# Get a Resend API key at https://resend.com/api-keys.
-# AUTH_EMAIL_SERVER=smtp://resend:re_yourkeyhere@smtp.resend.com:465
-# AUTH_EMAIL_FROM=onboarding@resend.dev
-
-# ── Auth — Google OAuth ──────────────────────────────────────────
-# Activated when both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET set.
-# Set up at https://console.cloud.google.com/apis/credentials.
-# Production callback: https://your-domain.com/api/auth/callback/google
-# GOOGLE_CLIENT_ID=
-# GOOGLE_CLIENT_SECRET=
-
-# ── Auth — GitHub OAuth ──────────────────────────────────────────
-# Activated when both GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET set.
-# Set up at https://github.com/settings/developers.
-# Production callback: https://your-domain.com/api/auth/callback/github
-# GITHUB_CLIENT_ID=
-# GITHUB_CLIENT_SECRET=
-
-# ── Stripe (sandbox keys only — sk_test_* / pk_test_*) ───────────
-# AILK is sandbox-only at v1. Live keys (sk_live_*, pk_live_*) are
-# hook-blocked from appearing in source.
-# Get test keys at https://dashboard.stripe.com/test/apikeys.
-# STRIPE_SECRET_KEY=sk_test_...
-# NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
-# Webhook signing secret — see Stripe Dashboard → Developers →
-# Webhooks → <endpoint> → Signing secret. Format: whsec_*.
-# STRIPE_WEBHOOK_SECRET=
-
-# ── Analytics — all off by default ───────────────────────────────
-# Each provider is independent. Set the env var(s) to enable.
-#
-# Vercel Analytics — built-in dashboard for Vercel deploys.
-# Requires Vercel hosting. Set to "true" to enable. Requires redeploy
-# after change (NEXT_PUBLIC_* values bake at build time).
-# NEXT_PUBLIC_VERCEL_ANALYTICS_ENABLED=
-#
-# Google Analytics 4 — gtag.js measurement. Requires consent in EU/UK/CA.
-# Get the measurement ID from analytics.google.com → Admin → Data Streams.
-# Format: G-XXXXXXXXXX. Requires redeploy after change.
-# NEXT_PUBLIC_GA_MEASUREMENT_ID=
-#
-# GA4 Measurement Protocol — server-side analytics secret.
-# Required alongside NEXT_PUBLIC_GA_MEASUREMENT_ID for server-side
-# lead/purchase events.
-# GA_API_SECRET=
-#
-# Google Search Console — verification meta tag. No script, no consent.
-# Get the token from search.google.com/search-console → Settings →
-# Ownership verification → HTML tag. Paste only the content="..." value.
-# GOOGLE_SITE_VERIFICATION=
-```
-
-## Categories the skill emits
-
-The template above groups vars into seven categories. Every emitted
-`.env.example` should hit each category at least with its header
-comment, even if the consumer hasn't activated any vars in that
-category — the comment block tells future-them what's available.
-
-Categories:
-
-1. Marketing / canonical domain
-2. Content backend
-3. Lead delivery (database or email)
-4. API origin checks + checkout gate
-5. Auth — required + per-provider
-6. Stripe (sandbox-only)
-7. Analytics
-
-## What the skill never includes
-
-- Real secret values. All values are placeholders or commented
-  examples.
-- Live Stripe keys. Sandbox-only at AILK v1.
-- Live Vercel deploy tokens. The Vercel CLI handles deploy auth via
-  `vercel login`.
-- Database connection strings with embedded passwords. Comments
-  show shape only.
-
-## Counting vars for validation
-
-The skill's Step 5 validation counts the declared (uncommented) vars
-the template emits and confirms the count is non-zero. Empty
-`.env.example` is a bug. Currently declared vars in the template:
-
-- `AILK_PUBLIC_DOMAIN`
-- `CONTENT_BACKEND`
-
-(All other entries are commented optional vars.) The skill should
-not require the consumer to set every commented var — they're
-opt-in. The two declared entries are the minimum the AILK scaffold
-needs to boot, even on a static-content-only site.
-
-## Merge logic
-
-If the consumer already has `.env.example`, the skill (per SKILL.md
-Step 3) offers merge / overwrite / skip. Merge logic:
-
-1. Read the existing file.
-2. For each line in this template that's not a comment-only line,
-   check whether the var name already appears anywhere in the
-   existing file (commented or uncommented).
-3. Vars **already present** are not modified — the consumer's
-   existing comments and value choices win.
-4. Vars **missing** are appended at the end of the existing file
-   under a new section:
-   ```
-   # ── Added by setup-deploy ────────────────────────────────
-   ```
-
-This avoids duplicating vars while still surfacing additions the
-template gained since the consumer's last run.

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-31.552Z-fallback-1789916251590-037e9005.json

@@ -1,8 +0,0 @@
-{
-  "id": "fallback-1789916251590-037e9005",
-  "siteId": "site_1",
-  "source": "callback",
-  "email": "",
-  "payload": {},
-  "createdAt": "2026-09-20T14:57:31.552Z"
-}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.840Z-fallback-1789916253842-b52659e9.json

@@ -1,12 +0,0 @@
-{
-  "id": "fallback-1789916253842-b52659e9",
-  "siteId": "wksp_00000000-0000-7000-8000-000000000001",
-  "source": "flow:get-a-quote",
-  "email": "abandoner@example.com",
-  "payload": {
-    "email": "abandoner@example.com",
-    "flowSlug": "get-a-quote",
-    "locale": "en"
-  },
-  "createdAt": "2026-09-20T14:57:33.840Z"
-}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.844Z-fallback-1789916253845-6b266f8c.json

@@ -1,12 +0,0 @@
-{
-  "id": "fallback-1789916253845-6b266f8c",
-  "siteId": "default",
-  "source": "flow:get-a-quote",
-  "email": "abandoner@example.com",
-  "payload": {
-    "email": "abandoner@example.com",
-    "flowSlug": "get-a-quote",
-    "locale": "en"
-  },
-  "createdAt": "2026-09-20T14:57:33.844Z"
-}