create-ailk 0.9.0 → 0.11.0

package/dist/programmatic.js

@@ -31,7 +31,7 @@ import { writeAuthSecretFile } from "./lib/auth-secret-file.js";
 import { extractModuleBundle, installBundleTree, } from "./lib/extract-module-bundle.js";
 import { fetchTemplate } from "./lib/fetch-template.js";
 import { assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-files.js";
-import { assertDesignAllowed, deriveLevel, resolveModuleSet, resolvePaidModules, } from "./lib/module-license-gate.js";
+import { assertDesignAllowed, assertReleased, deriveLevel, resolveModuleSet, resolvePaidModules, } from "./lib/module-license-gate.js";
 import { classifyModules } from "./lib/module-tier.js";
 import { normalizeModules } from "./module-architecture.js";
 import { RECOGNIZED_SHAPES, RESERVED_SHAPES, } from "./parse-args.js";
@@ -235,11 +235,16 @@ export async function scaffold(opts) {
     if (opts.template !== undefined && opts.shape !== undefined) {
         throw new TemplateError("pass a template or a shape, not both");
     }
+    // #6984 — a surface `release-scope.json` does not release is refused here,
+    // after parsing and before the licence gate, fetch or write (spec 6977 D3).
+    assertReleased("templates", [opts.template]);
+    assertReleased("shapes", [opts.shape]);
     const template = opts.template !== undefined
         ? resolveTemplate(opts.template)
         : opts.shape !== undefined
             ? resolveShapeTemplate(opts.shape)
             : undefined;
+    assertReleased("modules", [...(opts.modules ?? []), ...(template?.requires ?? [])]);
     // #6813 D8 step 3 — the design this scaffold renders, resolved from its
     // package ONCE, before any fetch or write: the caller's override, else the
     // template's own. Unset for a scaffold naming neither. Replaces the
@@ -250,6 +255,8 @@ export async function scaffold(opts) {
     const resolvedDesign = designRef !== undefined
         ? resolveDesign(designRef, { designsDir: DESIGNS_DIR })
         : undefined;
+    // By registry name, so a byte-identical copy of a gated design is refused too.
+    assertReleased("designs", [resolvedDesign?.recorded]);
     // #6816 D6 step 3b — a design's section presets are validated here, before
     // any fetch or write, against the look groups the shipped catalog carries
     // (D2): a non-look field or unknown variant throws `DesignPackageError`
@@ -313,8 +320,8 @@ export async function scaffold(opts) {
         // answers, never a key claim (D2) — only when the caller CHOSE a
         // non-Free design alongside the template (`opts.design`, #6813 D7). An
         // alias's own declared design is never gated (#6778 option (c)), so a
-        // plain `--template minimalism-site` run makes no extra network call and
-        // is never refused on its design.
+        // plain `--template <alias>` run makes no extra network call and is
+        // never refused on its design.
         if (chosenDesign !== undefined && !chosenDesign.free) {
             ({ level } = await deriveLevel({
                 licenseKey,
@@ -557,7 +564,8 @@ export async function scaffold(opts) {
         writeFileSync(join(result.targetDir, NAV_CONFIG_PATH), renderNavConfig(result.surfaces, { serviceSlugs }));
         pruneUnrosteredSeeds(result.targetDir, mergeRoster(template, template.requires), result.surfaces, ownership);
         // spec 6892 D4 — the resolved design's own sample (the minimalism design's
-        // nine-slide deck home + its SVGs today), installed AFTER the template
+        // nine-slide deck home + its SVGs; no template declares `minimalism`
+        // since #6976, so none installs it today), installed AFTER the template
         // layer so it wins over the shape's `HomePage/home.mdx`, and ONLY when
         // the resolved design is the template's OWN declared design: a caller
         // combination like `--shape organization-product --design minimalism`

package/dist/starter-grid.d.ts

@@ -31,9 +31,8 @@ export interface AliasDifferences {
     /**
      * Further positioned groups (#6757 D7): each group's rows go before its
      * own `before` route, applied group by group in array order, AFTER `add`
-     * is placed. The one alias that needs more than one anchor
-     * (`minimalism-site`, which interleaves rows at two separate points in the
-     * shape's row order) uses this; every other alias leaves it unset.
+     * is placed — for an alias that interleaves rows at more than one point
+     * in the shape's row order. No alias in the table below needs it today.
      */
     readonly insert?: readonly {
         readonly before: string;
@@ -58,8 +57,8 @@ export interface TemplateAlias {
     readonly differences?: AliasDifferences;
     /**
      * Whether this alias ships its own `site-templates/<name>/` tree (spec 6892
-     * D1). Absent means `true` — every alias but `minimalism-site` keeps its
-     * own directory. `false` declares that the alias resolves purely from the
+     * D1). Absent means `true` — every alias today keeps its own directory.
+     * `false` declares that the alias resolves purely from the
      * grid: its seed layer is its shape's tree (`templateTreeDir`), and its
      * generated roster record lives under `site-templates/aliases/` rather
      * than a directory of its own (`shippedManifestPath`).
@@ -152,68 +151,6 @@ export declare const ALIASES: Readonly<{
             readonly before: "/portfolio";
         };
     };
-    /**
-     * The second Pro template (#5589) — the reports-first, scroll-snap deck
-     * site. NOT `marketing-site` plus a module: its `modules` omit `docs-blog`,
-     * so the two Pro templates are siblings under `_base` (#5618 D2), never a
-     * lineage. Level still derives from `modules`: `scheduling` and
-     * `signal-collectors` are paid, so `templateDelivery` returns `"paid"`
-     * exactly as it does for `marketing-site`.
-     *
-     * It composes the `organization-service` shape roster (#6757) rather than
-     * the organization-product one: the deck home replaces the document-scroll
-     * home, and `/how-it-works`, the product page, `/pricing` and `/sign-in`
-     * are not pages this site has. The roster is what the
-     * template IS, so an unrostered page has neither a route directory
-     * (`rosterSurfaces`) nor its `_base`/overlay seed (#6646 D1).
-     *
-     * It declares NO `layout` block (#6638): the deck home, mark-only nav and
-     * centered footer are the `minimalism` design's own `layout` (its
-     * `DESIGN.md`, resolved by `resolveDesign` off `design:` — #6813 D4) — the
-     * look any shape can wear. This alias ships no tree of its own (`ownTree:
-     * false`, spec 6892 D1); its GENERATED roster record (no narrative `.md`,
-     * D5) lives at `site-templates/aliases/minimalism-site.TEMPLATE-MANIFEST.json`.
-     *
-     * `/reports` (a `ReportsList` hub over `ReportPage`) and `/referral` (a
-     * flow landing page) are signal-collectors module samples (spec 6892 D3);
-     * neither carries a `GATEABLE_SURFACES` entry: `/referral` is a
-     * single-segment `LandingPage` slug served by the generic `[slug]` route
-     * (#5469 D2), the same mechanism Free's `/how-it-works` uses, and `/reports`
-     * is its own routes-map row. `/reports/[slug]` (the reader) is the
-     * signal-collectors module's own contributed row.
-     *
-     * `/services/[slug]` declares its seed DIRECTORY as `contentDir`
-     * (`content/en/Service`, as `routes-map.ts` records it). The three
-     * samples ride the template tree unmapped, landing at that directory.
-     *
-     * Since #6757, `organization-service` carries a real standard roster
-     * (D1), so this alias's `differences` is additions and drops only: it
-     * drops the `/blog` teaser (a Pro alias does not upsell its own level,
-     * D8), the portfolio pair (the reports are the proof, not a
-     * portfolio) and the two auth code routes the shape rosters (#6797 —
-     * this site has no `/sign-in`, above), adds the signal-collectors
-     * samples, and INSERTS its two own
-     * rows — `/reports` before `/about`, `/referral` before `/faq` (D7) — to
-     * reproduce its pre-#6757 row order (§ 1.2) exactly.
-     */
-    readonly "minimalism-site": {
-        readonly shape: "organization-service";
-        readonly design: "minimalism";
-        readonly modules: readonly ["marketing", "scheduling", "signal-collectors"];
-        readonly categories: readonly ["real-estate", "technology", "legal"];
-        readonly ownTree: false;
-        readonly differences: {
-            readonly drop: readonly ["/sign-in", "/sign-up", "/blog", "/meet", "/meet/[slug]", "/portfolio", "/portfolio/[slug]"];
-            readonly add: readonly import("./module-architecture.js").PageRosterRow[];
-            readonly insert: readonly [{
-                readonly before: "/about";
-                readonly rows: readonly [import("./module-architecture.js").PageRosterRow];
-            }, {
-                readonly before: "/faq";
-                readonly rows: readonly [import("./module-architecture.js").PageRosterRow];
-            }];
-        };
-    };
 }>;
 /**
  * The coordinates a keyless `--shape S` builds (#6757 D5) — the composed

package/dist/starter-grid.js

@@ -171,14 +171,10 @@ const PORTFOLIO_ROWS = [
     { route: "/portfolio/[slug]", contentDir: "content/en/PortfolioItem" },
 ];
 /**
- * `minimalism-site`'s two OWN rows (#5589, shrunk from its own 17-row roster
- * by #6757 once the `organization-service` shape carried a standard roster of
- * its own): the deck's two `LandingPage` slugs, positioned by `insert` (D7)
- * at the two points this alias interleaves them into the shape's row order
- * (§ 1.2) — `/reports` before `/about`, `/referral` before `/faq`. Neither
- * carries a `GATEABLE_SURFACES` entry: both are single-segment slugs served
- * by the generic `[slug]` route (#5469 D2), the same mechanism Free's
- * `/how-it-works` used.
+ * The two report/referral sample rows. Neither carries a `GATEABLE_SURFACES`
+ * entry: `/referral` is a single-segment `LandingPage` slug served by the
+ * generic `[slug]` route (#5469 D2), the same mechanism Free's
+ * `/how-it-works` used, and `/reports` is its own routes-map row.
  */
 const REPORTS_ROW = {
     route: "/reports",
@@ -193,8 +189,7 @@ const REFERRAL_ROW = {
  * `/reports`, a `ReportsList` hub over the module's four `ReportPage` seeds,
  * and `/referral`, a sample flow landing page. `marketing-site` and
  * `saas-product` add these before `/portfolio`, alongside
- * `SIGNAL_COLLECTORS_SAMPLE_ROWS`; `minimalism-site` keeps its own two
- * `insert` groups instead (its pre-existing row order, D1).
+ * `SIGNAL_COLLECTORS_SAMPLE_ROWS`.
  */
 const SIGNAL_COLLECTORS_REPORT_ROWS = [
     REPORTS_ROW,
@@ -206,8 +201,7 @@ const SIGNAL_COLLECTORS_REPORT_ROWS = [
  * --registry packages/schema/src/registry/entries.ts` at harness commit
  * `7bdaf148e1b0e639cd90a80008955e55cc4aa2b5`, edited only by the deviations
  * `site-templates/shapes/organization-service/TEMPLATE-MANIFEST.md` § 3a
- * records with their reasons. Row order matches `minimalism-site`'s (D3), so
- * that alias's `differences` are additions and drops only.
+ * records with their reasons.
  */
 const ORGANIZATION_SERVICE_ROWS = [
     { route: "/", content: ["content/en/HomePage/home.mdx"] },
@@ -429,78 +423,6 @@ export const ALIASES = Object.freeze({
             before: "/portfolio",
         },
     },
-    /**
-     * The second Pro template (#5589) — the reports-first, scroll-snap deck
-     * site. NOT `marketing-site` plus a module: its `modules` omit `docs-blog`,
-     * so the two Pro templates are siblings under `_base` (#5618 D2), never a
-     * lineage. Level still derives from `modules`: `scheduling` and
-     * `signal-collectors` are paid, so `templateDelivery` returns `"paid"`
-     * exactly as it does for `marketing-site`.
-     *
-     * It composes the `organization-service` shape roster (#6757) rather than
-     * the organization-product one: the deck home replaces the document-scroll
-     * home, and `/how-it-works`, the product page, `/pricing` and `/sign-in`
-     * are not pages this site has. The roster is what the
-     * template IS, so an unrostered page has neither a route directory
-     * (`rosterSurfaces`) nor its `_base`/overlay seed (#6646 D1).
-     *
-     * It declares NO `layout` block (#6638): the deck home, mark-only nav and
-     * centered footer are the `minimalism` design's own `layout` (its
-     * `DESIGN.md`, resolved by `resolveDesign` off `design:` — #6813 D4) — the
-     * look any shape can wear. This alias ships no tree of its own (`ownTree:
-     * false`, spec 6892 D1); its GENERATED roster record (no narrative `.md`,
-     * D5) lives at `site-templates/aliases/minimalism-site.TEMPLATE-MANIFEST.json`.
-     *
-     * `/reports` (a `ReportsList` hub over `ReportPage`) and `/referral` (a
-     * flow landing page) are signal-collectors module samples (spec 6892 D3);
-     * neither carries a `GATEABLE_SURFACES` entry: `/referral` is a
-     * single-segment `LandingPage` slug served by the generic `[slug]` route
-     * (#5469 D2), the same mechanism Free's `/how-it-works` uses, and `/reports`
-     * is its own routes-map row. `/reports/[slug]` (the reader) is the
-     * signal-collectors module's own contributed row.
-     *
-     * `/services/[slug]` declares its seed DIRECTORY as `contentDir`
-     * (`content/en/Service`, as `routes-map.ts` records it). The three
-     * samples ride the template tree unmapped, landing at that directory.
-     *
-     * Since #6757, `organization-service` carries a real standard roster
-     * (D1), so this alias's `differences` is additions and drops only: it
-     * drops the `/blog` teaser (a Pro alias does not upsell its own level,
-     * D8), the portfolio pair (the reports are the proof, not a
-     * portfolio) and the two auth code routes the shape rosters (#6797 —
-     * this site has no `/sign-in`, above), adds the signal-collectors
-     * samples, and INSERTS its two own
-     * rows — `/reports` before `/about`, `/referral` before `/faq` (D7) — to
-     * reproduce its pre-#6757 row order (§ 1.2) exactly.
-     */
-    "minimalism-site": {
-        shape: "organization-service",
-        design: "minimalism",
-        modules: ["marketing", "scheduling", "signal-collectors"],
-        categories: ["real-estate", "technology", "legal"],
-        // Spec 6892 D1 — this alias ships no `site-templates/minimalism-site/`
-        // tree of its own: it resolves purely from the grid. Its seed layer is
-        // its shape's tree (`templateTreeDir`), its deck home + SVGs are a
-        // sample the `minimalism` design installs (D4), and its `/reports` +
-        // `/referral` rows are signal-collectors module samples (D3).
-        ownTree: false,
-        differences: {
-            drop: [
-                "/sign-in",
-                "/sign-up",
-                "/blog",
-                "/meet",
-                "/meet/[slug]",
-                "/portfolio",
-                "/portfolio/[slug]",
-            ],
-            add: SIGNAL_COLLECTORS_SAMPLE_ROWS,
-            insert: [
-                { before: "/about", rows: [REPORTS_ROW] },
-                { before: "/faq", rows: [REFERRAL_ROW] },
-            ],
-        },
-    },
 });
 /**
  * The coordinates a keyless `--shape S` builds (#6757 D5) — the composed

package/dist/surfaces.js

@@ -20,8 +20,7 @@
  *
  * The default (`--modules marketing`) enables NO gateable surface: every one of
  * them is a claim about the business that the scaffolder cannot make. The path
- * from there is the `add-page` skill that already ships in
- * `templates/.claude/skills/`.
+ * from there is the `/ailk:add-page` skill in the `ailk` Claude Code plugin.
  *
  * Zero runtime dependencies — create-ailk is a published, standalone CLI.
  *
@@ -1047,7 +1046,7 @@ export function renderNavConfig(enabled, options) {
 // below it, the nav is yours and add-module reports the change it wanted
 // instead.
 //
-// Adding a link: scaffold the page (the \`add-page\` skill), then add an
+// Adding a link: scaffold the page (the \`/ailk:add-page\` skill), then add an
 // entry below with a \`labelKey\` that exists in the \`nav\` namespace of
 // \`apps/web/messages/<locale>.json\`. Paths are locale-agnostic — Nav prefixes
 // them with the active locale at render.

package/dist/template-manifest.d.ts

@@ -183,7 +183,7 @@ export declare function templateTreeDir(name: string): string;
 /**
  * Whether `name` ships its own `site-templates/<name>/` directory (spec 6892
  * D1) — `false` only for a declared `--template` alias whose `ownTree` is
- * `false` (`minimalism-site` today). A `SHAPE_STARTERS` key owns its
+ * `false` (none today). A `SHAPE_STARTERS` key owns its
  * `shapes/<name>` tree outright, so it is never treeless by this predicate
  * even though `templateTreeDir` also renames its directory.
  *

package/dist/template-manifest.js

@@ -60,10 +60,10 @@ export class TemplateError extends Error {
  * shape's standard roster, minus the alias's `drop` routes, with its `add`
  * rows inserted before the `before` route (appended when there is none),
  * then each `insert` group's rows spliced before ITS OWN `before` route, in
- * array order — the one alias with more than one anchor point
- * (`minimalism-site`) uses this to interleave its own rows into the shape's
- * row order. Rows are pushed by reference, never cloned, so
- * `manifest.roster.includes(row)` identity checks downstream keep working.
+ * array order — for an alias that interleaves its own rows into the shape's
+ * row order at more than one anchor point. Rows are pushed by reference,
+ * never cloned, so `manifest.roster.includes(row)` identity checks
+ * downstream keep working.
  * Every refusal names the alias, so a malformed table fails at load — the
  * shipped one — or in the test that injected it.
  *
@@ -178,7 +178,7 @@ export function templateTreeDir(name) {
 /**
  * Whether `name` ships its own `site-templates/<name>/` directory (spec 6892
  * D1) — `false` only for a declared `--template` alias whose `ownTree` is
- * `false` (`minimalism-site` today). A `SHAPE_STARTERS` key owns its
+ * `false` (none today). A `SHAPE_STARTERS` key owns its
  * `shapes/<name>` tree outright, so it is never treeless by this predicate
  * even though `templateTreeDir` also renames its directory.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -10,9 +10,11 @@
   },
   "files": [
     "dist",
+    "!dist/modules",
     "templates",
     "site-templates",
     "versions.json",
+    "release-scope.json",
     "component-catalog.json",
     "component-catalog.md",
     "README.md",
@@ -25,8 +27,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.29.0",
-    "@working-theory/templates": "0.29.0"
+    "@working-theory/schema": "0.30.0",
+    "@working-theory/templates": "0.30.0"
   },
   "repository": {
     "type": "git",
@@ -58,7 +60,7 @@
     "build-catalog": "node scripts/build-component-catalog.mjs",
     "check-catalog": "node scripts/build-component-catalog.mjs --check",
     "manifest:build": "node scripts/build-template-manifest.mjs --template marketing-site-free",
-    "manifest:check": "node scripts/build-template-manifest.mjs --template marketing-site-free --check && node scripts/build-template-manifest.mjs --template marketing-site --check && node scripts/build-template-manifest.mjs --template minimalism-site --check",
+    "manifest:check": "node scripts/build-template-manifest.mjs --template marketing-site-free --check && node scripts/build-template-manifest.mjs --template marketing-site --check",
     "design:gen": "tsc -b && node scripts/build-design-md.mjs",
     "page-types:build": "tsx scripts/generate-page-types-reference.ts",
     "page-types:check": "tsx scripts/generate-page-types-reference.ts --check"

package/release-scope.json

@@ -0,0 +1,25 @@
+{
+  "templates": {
+    "marketing-site-free": "released",
+    "marketing-site": "released",
+    "saas-product": "gated"
+  },
+  "shapes": {
+    "organization-product": "released",
+    "organization-service": "released",
+    "local-business-service": "released",
+    "person-service": "released",
+    "local-business-product": "deferred"
+  },
+  "designs": { "standard": "released", "minimalism": "gated" },
+  "modules": {
+    "marketing": "released",
+    "docs-blog": "released",
+    "scheduling": "released",
+    "signal-collectors": "released",
+    "workspace": "gated",
+    "multi-tenant": "gated",
+    "commerce": "gated"
+  },
+  "levels": { "free": "released", "pro": "released", "pro-plus": "gated" }
+}

package/site-templates/designs/minimalism/sample/README.md

@@ -1,7 +1,7 @@
 # The `minimalism` design's home-deck sample
 
-> Narrative moved here from the retired `site-templates/minimalism-site/TEMPLATE-MANIFEST.md`
-> when that tree retired (spec 6892 D4/D5) — `minimalism` is a design, not a template, so it
+> Narrative moved here from the retired minimalism template's `TEMPLATE-MANIFEST.md` when
+> that tree retired (spec 6892 D4/D5) — `minimalism` is a design, not a template, so it
 > carries no generated manifest of its own. This file is NOT installed onto a scaffold
 > (`installDesignSample` copies only `content/**` and `public/**`); it documents the sample for
 > maintainers of this design.

package/site-templates/designs/minimalism/sample/content/en/HomePage/home.mdx

@@ -2,7 +2,7 @@
 type: "HomePage"
 slug: "home"
 title: "Your Company"
-description: "Placeholder home for the minimalism-site template — a nine-slide scroll-snap deck. Replace every line before you launch."
+description: "Placeholder home for the minimalism design — a nine-slide scroll-snap deck. Replace every line before you launch."
 sections:
   [
     {

package/site-templates/marketing-site-free/TEMPLATE-MANIFEST.md

@@ -366,10 +366,11 @@ Every content route emits one `application/ld+json` script whose `@graph` carrie
 | Node                                                   | `@id`                                                                                         | Built from                                                                | Links                                                                                                                                                                                |
 | ------------------------------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Identity (`Organization` · `Person` · `LocalBusiness`) | `<origin>/#organization` (`#person` for a Person)                                             | `siteIdentity` `name` · `url` · `logo`/`image` · `description` · `sameAs` | —                                                                                                                                                                                    |
+| Identity (`SoftwareApplication`)                       | `<origin>/#product`                                                                           | `siteIdentity` fields; `logo` emitted as `image`                          | `publisher` → the maker's own `@id` (`siteIdentity.publisher`), never a node here; takes no secondary                                                                                |
 | Secondary (optional)                                   | `<origin>/#product` (a `SoftwareApplication`) · `<origin>/#organization` (a Person's company) | `siteIdentity.secondary`                                                  | product `publisher` → `#organization`, `featureList` from the product page's (`/software/product`) feature items; a Person `worksFor` its company, which has the Person as `founder` |
-| `WebSite`                                              | `<origin>/#website`                                                                           | `siteName` · `baseUrl` · the render locale                                | `publisher` → the identity node                                                                                                                                                      |
+| `WebSite`                                              | `<origin>/#website`                                                                           | `siteName` · `baseUrl` · the render locale                                | `publisher` → the identity node (the maker, for a `SoftwareApplication` identity)                                                                                                    |
 
-Each page's primary node is `isPartOf` the `WebSite`; the home page's `mainEntity` is the secondary when declared, else the identity. A testimonials `Review` points its `itemReviewed` at the identity node, declared in the same graph. Free declares no secondary, so a fresh site emits the Organization and the WebSite. `/sign-in` emits no JSON-LD.
+Each page's primary node is `isPartOf` the `WebSite`; the home page's `mainEntity` is the secondary when declared, else the identity (`#product` for a `SoftwareApplication` identity, #7103). A testimonials `Review` points its `itemReviewed` at the identity node, declared in the same graph. Free declares no secondary, so a fresh site emits the Organization and the WebSite. `/sign-in` emits no JSON-LD.
 
 ## 2a. State and persistence (every interactive element)
 
@@ -466,7 +467,7 @@ reversed (`docs/decisions/starter-roster-page-set.md` D4, D7).
 
 ### 3b. Site entity (operator-disposed 2026-09-24)
 
-`derive-roster.py` names `SoftwareApplication` as the main entity for this template's inputs. The template deliberately declares the **Organization** as the site's primary node and the software as its **secondary** node (`siteIdentity.secondary`, kind `SoftwareApplication`, #6597): the Free template is a company's own site about its product, so the entity the site is _about_ is the maker. The inverse — `SoftwareApplication` primary — is for a product whose canonical site is elsewhere (Positionary, whose maker has its own site). A fresh Free scaffold declares no `secondary` until the owner names the product; the overlay `_site.mdx` documents the field.
+`derive-roster.py` names `SoftwareApplication` as the main entity for this template's inputs. The template deliberately declares the **Organization** as the site's primary node and the software as its **secondary** node (`siteIdentity.secondary`, kind `SoftwareApplication`, #6597): the Free template is a company's own site about its product, so the entity the site is _about_ is the maker. The inverse — `SoftwareApplication` primary — is for a product whose maker has its own site (Positionary): express it as `siteIdentity.kind: SoftwareApplication` with a required `publisher` naming the maker's stable `@id` on that site (e.g. `https://salessmyth.com/#organization`, #7103), so the product is `<origin>/#product` and the maker is a reference, never a second Organization node here. A fresh Free scaffold declares no `secondary` until the owner names the product; the overlay `_site.mdx` documents the field.
 
 ## 4. Component inventory (Free, by tier)
 

package/templates/.claude/agents/web.md

@@ -22,8 +22,8 @@ upstream packages; don't try to edit them locally.
 ## Read before edit
 
 1. `.claude/rules/architecture.md` — confirm what `apps/web` may
-   import. NextAuth handlers are the only API-shaped code allowed in
-   `apps/web`; everything else server-side goes through `apps/api`.
+   import, including its one database exception (the Better Auth
+   adapter). Everything else server-side goes through `apps/api`.
 2. The page or component you're modifying, plus any sibling files in
    the same directory.
 3. Any project-local theme override file before touching styles —
@@ -46,7 +46,8 @@ Run `pnpm preflight` before opening a PR.
 - Need a new content type? Add it under `content/<TypeName>/` and
   reference the schema from `@working-theory/schema`.
 - Need a database read? Wrong layer — `apps/web` does not read the
-  database. Route through `apps/api`.
+  database outside the one exception `.claude/rules/architecture.md`
+  names. Route through `apps/api`.
 
 ## Domain conventions
 
@@ -55,23 +56,24 @@ Run `pnpm preflight` before opening a PR.
   Adding `'use client'` to a file that just renders JSX is the
   default failure mode — resist it.
 - **Tailwind tokens only.** No raw hex, rgb, or arbitrary colors.
-  Use semantic tokens from `@working-theory/theme` (`bg-canvas`, `text-fg`,
+  Use semantic tokens from `@working-theory/theme` (`bg-surface`, `text-fg`,
   `border-border`, etc.). If a token doesn't exist, extend the theme;
   don't bypass.
 - **Mobile-first responsive.** Default styles target mobile;
   `md:`/`lg:` modifiers for larger viewports.
 - **MDX rendering** uses `next-mdx-remote/rsc`, never `@next/mdx`
   (the latter requires runtime config that fights Server Components).
-- **NextAuth handlers** are the only API-shaped code in `apps/web`
-  — they live at `apps/web/app/api/auth/[...nextauth]/route.ts`.
+- **Better Auth's route handler** is the only API-shaped code in
+  `apps/web` — it lives at `apps/web/app/api/auth/[...all]/route.ts`.
   Everything else goes to `apps/api`.
 
 ## Forbidden
 
 - Importing from `apps/api` or `apps/mcp` — these are peer apps;
   speak to the API via `@working-theory/api-client`.
-- Importing `@working-theory/database` — `apps/web` does not touch the DB;
-  route through `apps/api`.
+- Importing `@working-theory/database` outside the Better Auth adapter
+  (the exception `.claude/rules/architecture.md` names) — route through
+  `apps/api`.
 - Importing `resend`, `@react-email/*` directly — wrap through
   `@working-theory/email`, server-side via `apps/api`.
 - Adding a `utils.ts`, `helpers.ts`, `common.ts`, or `misc.ts` file

package/templates/.claude/rules/architecture.md

@@ -25,13 +25,16 @@ other.
   or `@working-theory/schema` (schema.org types).
 - Need an HTTP call from `apps/web` to `apps/api`? Use
   `@working-theory/api-client`. Don't import API route handlers directly.
-- Need database access? Only `apps/api` and `apps/mcp` import
-  `@working-theory/database`. `apps/web` never reads the database directly — it
-  goes through the HTTP API.
-- Cross-cutting integrations (auth, email, analytics) go through their
-  wrapper packages: `@working-theory/auth-client`, `@working-theory/email`,
-  `@working-theory/analytics`. Never import `next-auth`, `resend`, etc.
-  directly.
+- Need database access? `apps/api` and `apps/mcp` import
+  `@working-theory/database`. `apps/web` does not read the database — it goes
+  through `apps/api` via the published HTTP client. The one exception is the
+  Better Auth adapter (`apps/web/lib/prisma-for-auth.ts`, typed in
+  `apps/web/auth.ts`).
+- Cross-cutting integrations (email, analytics) go through their
+  wrapper packages: `@working-theory/email`, `@working-theory/analytics`.
+  Never import `resend`, etc. directly. Auth has no wrapper package: it is
+  Better Auth, configured in `apps/web/auth.ts` and mounted at
+  `apps/web/app/api/auth/[...all]/route.ts`.
 
 ## What you can verify, what you can't
 

package/templates/.claude/settings.json

@@ -11,5 +11,17 @@
         ]
       }
     ]
+  },
+  "extraKnownMarketplaces": {
+    "working-theory": {
+      "source": {
+        "source": "github",
+        "repo": "working-theory-labs/claude-plugins"
+      },
+      "autoUpdate": true
+    }
+  },
+  "enabledPlugins": {
+    "ailk@working-theory": true
   }
 }

package/templates/.env.example

@@ -40,6 +40,8 @@ CONTENT_ADAPTER=mdx
 
 # ── Database (optional in standalone mode) ───────────────────────────────────
 # DATABASE_URL=postgres://user:pass@host:5432/db
+# Direct (non-pooled) URL that `prisma migrate` uses (database/prisma.config.ts).
+# DATABASE_URL_NON_POOLED=
 
 # ── Stripe (sandbox keys only — never sk_live_/pk_live_) ─────────────────────
 # STRIPE_SECRET_KEY=sk_test_...
@@ -57,6 +59,23 @@ CONTENT_ADAPTER=mdx
 # BETTER_AUTH_URL=http://localhost:3000
 # BETTER_AUTH_SECRET=
 
+# ── API origin checks + checkout gate (apps/api) ─────────────────────────────
+# Unset in production, either one makes the API log a startup warning; the
+# API keeps running.
+# FRONTEND_URL is the site the browser loads (no trailing slash). Set it on the
+# API project: unset in production, CORS, cookie origin checks and the
+# billing-portal return URLs fall back to http://localhost:3000, and checkout
+# answers 500 to a caller without X-Internal-Auth.
+# FRONTEND_URL=https://your-domain.com
+# OSS_API_INTERNAL_SECRET gates POST /v1/checkout/sessions. Unset, the route
+# admits every caller. Set, it answers 401 to any caller that does not send it
+# as X-Internal-Auth — including the MCP start_purchase tool and a browser
+# calling the API directly — so set it only when every checkout caller is a
+# server that sends the header. Use the same value on the API and on each such
+# caller.
+# Generate with: openssl rand -hex 32
+# OSS_API_INTERNAL_SECRET=
+
 # ── Single-tenant operator pin (apps/api) ────────────────────────────────────
 # REQUIRED on a build WITHOUT the multi-tenant module — for the submissions
 # review dashboard AND for the `workspace` module's settings surface.
@@ -295,7 +314,7 @@ CONTENT_ADAPTER=mdx
 # AILK_LICENSE_KEY=
 # Override the daily refresh upstream (self-hosters point at their own server
 # implementing the @working-theory/validation refresh contract).
-# Default: https://ailaunchkit.ai/api/license/refresh
+# Default: https://api.ailaunchkit.ai/v1/licenses/refresh
 # AILK_LICENSE_REFRESH_URL=
 # Self-host override — replaces the bundled public key with a PEM-encoded one.
 # Only set this if you operate your own license-signing infrastructure.
@@ -351,8 +370,10 @@ CONTENT_ADAPTER=mdx
 # AILK_TEST_AUTH_USER_ALLOWLIST=
 
 # ── Lead capture file store ───────────────────────────────────────────────────
-# Always-on JSONL write path — every successful submission appends a line.
-# Default output: apps/api/leads.jsonl (relative to process cwd).
+# Outside production, every successful submission appends one JSONL line here,
+# whichever destination delivered it. In production the write is skipped unless
+# LEAD_CAPTURE_FILE is set, and then it is a side copy, never the delivery.
+# Default: apps/api/leads.jsonl (relative to process cwd).
 # LEAD_CAPTURE_FILE=apps/api/leads.jsonl
 # Set to "true" to disable file writes (leads go to DB only; requires DATABASE_URL).
 # LEAD_CAPTURE_FILE_DISABLED=false