create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/rentals.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+You can now hire things out. Mark a catalogue product as a rental, give it its
+own resource calendar, and Freeholder handles the rest: by the hour, day or
+week, with a deposit, a turnaround gap for cleaning or charging, and a
+replacement value for the day something does not come back.
+
+Because a hireable thing has a real calendar, its time shows up in your diary
+beside everything else you have booked — and the same protection that stops two
+people booking one room at once stops two people hiring one lens. There is no
+separate availability to keep in step.
+
+The hire desk at **Hire** shows what is out, what is late, and what is due
+back, overdue first. Hand something over, take it back, and Freeholder works
+out the late fee by the unit and what the damage policy says — then tells you
+what goes back of the deposit and what is still owed, without moving a penny by
+itself. Settling stays yours to do on the invoice.
+
+Prices come from your normal price lists, so a member rate or a volume break
+applies to hire exactly as it applies to a sale.

package/dist/template/.changeset/reports-you-will-read.md

@@ -0,0 +1,31 @@
+---
+"freeholder": minor
+---
+
+Reports. A new page showing what the business earned, who it earned it from,
+and — under every figure — exactly how that figure was arrived at.
+
+Revenue is money that actually arrived: an invoice counts in the month it was
+paid rather than the month it was written, and anything refunded comes back
+out. Each currency is reported on its own. Nothing is ever converted to make
+one bigger-looking total, because the invoice you send and the money you
+receive are in the same currency and a report should not pretend otherwise.
+
+You can cut that revenue by service, by product, or by location. What each cut
+covers is written on the page, including where it stops: revenue by location
+covers bookings and not shop orders, because an order records where it was
+sent rather than where it was rung up, and guessing one from the other would
+give you a number that looks right and is not.
+
+Revenue by product is counted from item prices, and the page says so, because
+that total will not match your revenue figure — discounts, postage and tax
+belong to the whole invoice rather than to any one item, and splitting them
+across items by proportion would invent a decision you never made.
+
+There is a cohort report — what the customers who first paid in a given month
+went on to spend since — and the visit-to-paid funnel, which asks the traffic
+pages rather than defining a second version of the same thing.
+
+Views can be saved by name. A saved view keeps the question rather than the
+answer, so opening one always shows today's figures, and it is checked when
+you save it rather than months later when you open it.

package/dist/template/.changeset/rescan-without-open-transactions.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Rescanning a file no longer holds a database connection open while Freeholder
+talks to the malware scanner or rebuilds image sizes. Other work can continue
+during a slow scan. If someone edits or replaces the file while that work is
+running, the edit wins and any new image sizes stay as leftover objects the
+nightly sweep can remove — they are never attached to the wrong file.

package/dist/template/.changeset/retire-stale-handoffs.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Session handoff files are historical snapshots only. The product plan is
+still only MASTER.md §43, and CI now refuses a handoff that claims to be
+current.

package/dist/template/.changeset/reviews.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Collect and publish customer reviews. Ask once after a purchase or booking,
+moderate what comes back, reply in public, and show a review wall with photos.
+
+The rating is the careful part: withholding a review keeps it out of the wall
+but still counts it, so moderating can never quietly improve the number. Only
+reviews judged not to be a customer's opinion at all are excluded, and the wall
+says when there are more reviews than it is showing.

package/dist/template/.changeset/rich-link-url-allowlist.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C2.05: Rich-text links now allow web, mail, phone and relative URLs while refusing executable and document URL schemes on both write and render paths. The owner recovery password generator now chooses characters without modulo bias, and mobile app slug generation handles long punctuation runs in linear time.

package/dist/template/.changeset/role-guidance.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add resumable, capability-filtered first-win guidance for owners, staff roles and customers, with evidence-based progress, contextual relaunch, skip and reset controls.

package/dist/template/.changeset/rule-strong-token.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+Control borders now meet WCAG 1.4.11. The `rule` token was 1.17:1 against every
+background it borders, so the edges of inputs, selects and textareas were
+effectively invisible to low-vision users, in the default palette as well as in
+custom ones. Raising `rule` itself was not the fix: it draws 828 hairlines across
+the product and only 60 of them are controls, so every divider would have gone
+dark to correct the fields. There is now a separate `ruleStrong` role, checked
+for 3:1 on every ground a control sits on, and 322 control borders use it.
+Dividers keep the lighter `rule`, which is correct — 1.4.11 governs the edge of
+something you can operate, not decoration. Reported by a third party.

package/dist/template/.changeset/saved-views.md

@@ -0,0 +1,19 @@
+---
+"freeholder": minor
+---
+
+Keep the list you keep going back to. Filter a list the way you want it, give
+that a name, and it sits along the top ready to open again — "Ontario customers",
+"unpaid over 30 days", "mine, due this week".
+
+A saved view is just this page's address with a name on it. That means it works
+the way you would expect a web page to: the back button behaves, you can
+bookmark it, and you can paste the link to a colleague and they see what you
+see. Nothing is hidden in the app that the address does not say.
+
+On the contacts list you can also choose which columns you want, and that
+travels in the link too.
+
+Share a view and anyone here can use it; only you can change yours. Pick one to
+open first and it opens first — for you. Somebody else picking a different one
+does not take yours away.

package/dist/template/.changeset/schema-baseline.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+The database schema is now one reviewed baseline instead of a chain of 168
+migrations. A brand-new install still migrates from empty, and seed, demo and
+restore still work. This is a one-time break of the N-1 upgrade gate: an
+instance whose journal still names the old chain cannot apply this file, and
+rolling back to a pre-collapse image is not a safe image swap. That is
+expected, labelled `schemaRisk: "breaking"`, and is why this lands before 1.0.
+First-party plugin migrations numbered 0168 are not in this baseline and must
+be folded in when those PRs land.

package/dist/template/.changeset/scoring.md

@@ -0,0 +1,23 @@
+---
+"freeholder": minor
+---
+
+Lead scoring you can actually read. Say what earns points — viewed the pricing
+page, opened an email, accepted a quote — and how long those points last. Every
+rule is on one screen, in full, and nothing scores anybody any other way.
+
+Open a customer and you see their number and every reason for it, line by line,
+each one showing what it was worth when it happened and what is left of it now.
+The lines add up to the number. There is no hidden model and no stored score to
+go stale.
+
+Points can fade. A page view from last week says more than one from last year,
+so a rule can state how long its points last and they fall away steadily rather
+than vanishing overnight.
+
+Rules can move people along: accept a quote and become a customer, or reach a
+score you choose and become a prospect worth calling. Nothing ever moves
+somebody backwards — opening an email will not demote a customer to a lead.
+
+You can also give points by hand, with a reason, and it shows up in the same
+list as everything else.

package/dist/template/.changeset/security-parsing-and-recovery.md

@@ -0,0 +1,8 @@
+---
+"@freeholder/sdk": patch
+---
+
+Parse imported HTML with the browser-compatible parser and the CMS allowlist,
+including malformed markup and numeric character references. Accessibility smoke
+checks now run only their own axe code, never page scripts. Recovery passwords
+are saved to a private file rather than printed into terminal logs or captured output.

package/dist/template/.changeset/seed-demo.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+A new Freeholder can now fill itself with a complete example business — Aurora
+Coast Photography, with six pages, a menu, photographs and pricing — so you can
+click around a working site before deciding what to change. It installs only
+into an empty site, and never over your own content.

package/dist/template/.changeset/seeded-development-home.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Serve the complete Aurora Coast demo from a pristine development install, keep blank setup as an explicit opt-out, and verify the fresh seeded home at the HTTP boundary.

package/dist/template/.changeset/segments.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+One way of saying who. Describe a group of people once — "customers in Ontario
+who bought twice", "anyone tagged trade who has not been in for a year" — and
+everything that has to pick people uses that same description. Price lists can
+now target a group instead of a single tag, which is what a wholesale rate
+actually means.
+
+Before you save anything, the screen tells you how many people it would be and
+shows you a few of them. Afterwards, you can point at any customer and ask why
+they are in the group, and get the answer rule by rule rather than a shrug.
+
+A group can be live or frozen. A live one always means whoever matches right
+now. Freeze one and it stops moving, so the answer to "who did this go to in
+March" is still right in April, even for the people who have changed since.
+
+If a group asks about something the system cannot answer — a module you have
+switched off, say — it refuses rather than quietly matching more people than
+you meant.

package/dist/template/.changeset/self-building-scope.md

@@ -0,0 +1,12 @@
+---
+"freeholder": patch
+---
+
+Scope: an owner will be able to talk to a builder from anywhere in their own
+site — "make this section wider", "add a deposit to my booking form" — and have
+it happen, with a preview before anything publishes and one-click reversal
+afterwards. The same builder is reachable from the owner's own AI assistant, so
+they can administer and extend their site from whatever tools they already use.
+
+Whoever deploys their own copy chooses which intelligence does the building, or
+switches it off entirely. It is off by default.

package/dist/template/.changeset/seo-riba-surface.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Public pages now follow the BigDataSEO / RIBA contract more closely. Every
+page gets a branded Open Graph image (or your own override), search engines
+are pinged via IndexNow when you publish or rename a page, robots.txt keeps
+checkout and filter URLs out of the index, sitemaps split at 50,000 URLs and
+weight section indexes above leaves, and `/llms.txt` lists locations and
+catalog offerings alongside pages. Product, location, event and newsletter
+feeds are generated from the same public URL registry as the sitemap.

package/dist/template/.changeset/service-output-schemas.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Every service now declares the shape of what it returns. Development and tests refuse a handler that does not match, and the live OpenAPI document describes those same success bodies.

package/dist/template/.changeset/session-device-management.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Add personal session and device management to Account security, including
+current-session identification, last-seen and expiry details, revoke-one and
+step-up-protected revoke-all controls. Record privacy-limited successful-login
+history for 90 days, detect new devices and networks, show suspicious sign-ins
+in-product, and deliver transactional email notices without making login depend
+on mail uptime. Full IP addresses are never retained; active-session metadata
+expires with the session and scheduled cleanup enforces both retention bounds.

package/dist/template/.changeset/sharing-in-the-dna.md

@@ -0,0 +1,32 @@
+---
+"freeholder": minor
+---
+
+Every public page on your site can now be shared, and you can see what came of
+it. A share bar appears at the bottom of each page — copy the link, use your
+phone's own share sheet, or send it straight to WhatsApp, email, a text
+message, Facebook, X, LinkedIn, Reddit or Telegram. It works without
+JavaScript, so it works for everybody.
+
+Each share creates its own short link, like `/s/k3mq7bt2xp`. Following one
+lands on the ordinary page, and the visit shows up in your traffic figures as
+having come from sharing — which means the sharing report and the traffic
+report are the same numbers, not two counts that disagree. The Sharing screen
+in your admin lists every link, who sent it if you know them, how many people
+came, and how many of those got in touch.
+
+You can switch sharing off for anything you would rather not have circulating —
+one photograph gallery, one page, one product. Switching it off does not just
+hide the buttons: the links people have already sent stop working too. That is
+the whole point of the setting, and it is the part most tools quietly get
+wrong.
+
+Channel controls distinguish “all” from “none,” so clearing every channel does
+not accidentally turn every sharing option back on. Removing an unpublished
+target also asks you to confirm that its existing tracked links will stop.
+
+You can also give a page its own headline, description and image for social,
+separate from the ones search engines see. A search result is read by somebody
+already looking for you; a shared link is read by somebody who was not. Leave
+them blank and the page's own title is used, with a branded card generated
+automatically.

package/dist/template/.changeset/ship-replit-storage-sdk.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Ship the official Replit Object Storage SDK required by the Tier-1 Replit storage adapter.

package/dist/template/.changeset/shopify-live-channel.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+"@freeholder/sdk": patch
+---
+
+Connect an own-store Shopify app and import its paid orders as draft invoices
+for review on the shared contact spine. Tokens renew before expiry, shop
+identity is verified on every page, and retries preserve import checkpoints
+without duplicating invoices. Concurrent connection handshakes are fenced.
+The marketplace screen explains setup and import limits in English, French
+and Spanish. Live merchant acceptance and refund reconciliation remain open
+under C3.13.

package/dist/template/.changeset/shopify-refund-reconciliation.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C3.13: Shopify channel sync now reconciles refunds. Refunded and partially-refunded orders return their refunds; each provider refund is recorded once and, once the imported invoice has been issued, becomes an issued credit note through the invoicing module, bounded by the invoice total like any other credit note. Multiple refunds on one order produce separate notes. A refund whose order has not imported yet, or whose invoice is still a reviewable draft, stays listed as pending and reconciles on a later sync. Re-syncing never double-creates refund documents. The marketplace screen lists refund states in English, French and Spanish. Live merchant acceptance remains open.

package/dist/template/.changeset/signed-candidate-history.md

@@ -0,0 +1,4 @@
+---
+"freeholder": patch
+---
+Release candidates keep their full version in release notes and carry forward verified signed history, including earlier candidates. The stable checklist now reflects remaining paid-event, provider-settlement and Tier-1 object-recovery work, with a recorded fresh install and real-file restore rehearsal.

package/dist/template/.changeset/signed-release-feed.md

@@ -0,0 +1,6 @@
+---
+"freeholder": minor
+---
+
+Versioned images publish a signed `releases.json`. This instance ships the
+public key that must have signed it; a feed that does not verify is refused.

package/dist/template/.changeset/signup-contact-import.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Let owners optionally offer new portal members a skippable contact import from Google, Microsoft, vCard, CSV, or supported devices. Members see an exact preview before importing, can undo their own batch and disconnect provider credentials, while imported people remain unsubscribed and unmessaged unless separately permitted.

package/dist/template/.changeset/site-live-chat.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Turn the site-chat block into a live, bearer-isolated Contact conversation with owner replies, assistant-authored messages and explicit human handoff, plus consent-neutral WhatsApp and Messenger deep links.

package/dist/template/.changeset/sms-consent-boundary.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Enforce affirmative per-contact consent for marketing SMS, consume localized
+STOP/START/HELP before inbox processing, propagate STOP across every marketing
+channel, queue localized acknowledgements after commit, and retain idempotent
+compliance evidence across contact merge, export, and erasure workflows.

package/dist/template/.changeset/sms-registration.md

@@ -0,0 +1,25 @@
+---
+"freeholder": minor
+---
+
+Texting in the US and Canada needs the carriers' permission first, and this now
+says so before you find out the hard way.
+
+The hard way is worth explaining, because it is what makes this the commonest
+way a text-message launch fails: an unregistered US number does not bounce. The
+carrier takes the message, tells you it worked, charges you for it, and then
+quietly drops it. Nothing anywhere says it never arrived.
+
+So Freeholder works out what each of your numbers needs — 10DLC brand and
+campaign registration for ordinary US numbers, verification for US and Canadian
+toll-free ones, and whether a sender name is even permitted where you are
+sending — and refuses to send from a number that has not got there yet. It
+refuses rather than warns, because a warning you can click past leaves you in
+exactly the position this is meant to prevent.
+
+You record how far along each registration is as you go through your provider's
+forms, including why one was rejected if it was. The screen tells you which
+number is blocked and on what, and when nothing can send it says which of the
+possible reasons is the real one — no numbers, all switched off, none healthy,
+or one waiting on paperwork — instead of a single unhelpful message that sends
+you to check the thing that is already right.

package/dist/template/.changeset/sms-templates-keywords-mms.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Make text messaging a complete two-way channel: reusable localized templates, safe owner keyword actions, booking confirmation replies, media-library MMS, delivery and cost evidence, and carrier-invalid number protection now share the same contact and conversation history.

package/dist/template/.changeset/sms.md

@@ -0,0 +1,27 @@
+---
+"freeholder": minor
+---
+
+Text messages, sent and received. Connect a Twilio account and the numbers you
+already hold appear here — what each one can do, which country it belongs to,
+and whether it can actually send right now.
+
+That last one matters more than it sounds. The commonest way a text-message
+launch fails is a number that looks perfectly fine in every console and is being
+quietly filtered by the carriers. So the health check shows three answers, not
+two: it can send, it cannot send and here is why, or nobody could ask. A green
+tick that nobody verified is exactly the failure it would be hiding.
+
+Numbers are read in from your provider, never bought here. Buying one spends
+your money on their terms, in a country with its own rules about who may hold
+it, and that belongs in their console where you can see what you are agreeing
+to.
+
+Texts people send you arrive in the same inbox as their emails and form
+submissions, on the same thread, and a text from a number you have never seen
+becomes a real contact rather than an orphan message. Replies now go out by text
+where the conversation is a text conversation.
+
+Every message records what it cost and how many parts the carrier billed —
+texting is the one thing here where money can leave by accident — and what the
+carrier actually said happened to it, in the carrier's own words.

package/dist/template/.changeset/social-composer.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Write a social post once and send a version to each connected profile.
+Crops, caption length and safe area follow what that network actually
+allows. Generated images wait for a person to approve them. Publishing
+is idempotent, so a partial failure does not double-post the accounts
+that already succeeded.

package/dist/template/.changeset/social-connections.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Connect Instagram, Facebook, TikTok, YouTube, LinkedIn, X, Pinterest and
+Google Business Profile from Admin → Social. Several profiles per network
+are normal. Each profile is assigned to a person, the business, or
+locations, with separate read, respond, publish and approval switches.
+Nothing is usable until you finish the provider's sign-in and then review
+the profile. Token health is checked so expiry shows up before post time.

package/dist/template/.changeset/social-gbp.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Sync Google Business Profile posts, opening hours and reviews, and
+attribute the links on outbound social posts to visits, contacts and
+revenue.

package/dist/template/.changeset/social-ingest.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Connected social profiles can pull their owned posts back into Freeholder.
+Media lands in the library with checksums and provenance. The same post
+cannot be ingested twice. A comment becomes an inbox thread only when the
+network actually gave an email address — a handle is not a contact.

package/dist/template/.changeset/social-onboarding.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Social networks are listed on day one in every normal business preset.
+Nothing is authorized or published until you finish the provider's sign-in
+and review the profile. Admin → Social shows what each network can actually
+do, and a plugin can add another network without changing that screen.

package/dist/template/.changeset/source-first-start.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C3.16: Add a truthful source-first getting started guide while npm packages are unpublished, and pass the Docker Compose recipe's environment file explicitly so its database password interpolates on a fresh install.

package/dist/template/.changeset/source-map-security-floor.md

@@ -0,0 +1,4 @@
+---
+"freeholder": patch
+---
+Require patched source-map-js 1.2.2 throughout the workspace to resolve GHSA-68fv-2mgg-jv7q, retaining the high/critical advisory gate.

package/dist/template/.changeset/source-provenance.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+There is a /source page now that answers "what is this instance actually
+running?" — the version, every installed plugin with its licence and what it is
+allowed to do, third-party notices, and every change the builder actually made,
+with a link to the pull request where a code change came from.
+
+It only lists changes that were applied. A proposal you never accepted did not
+change anything, so it does not appear.
+
+It is for you, not the public: you have to be signed in. Running modified
+software over a network does not oblige anyone to publish those modifications,
+and a list of your plugins and changes is the first thing someone attacking
+your site would want.

package/dist/template/.changeset/spine-and-service-registry.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+The contact spine is in place: every person the business touches now has one
+record, and the system refuses to create a second one for the same email
+address — a contact can be looked up or created in a single safe step, and two
+records for the same person can be merged without losing their history.
+
+Owner accounts, passwords and login sessions work, and setting up the owner
+account can only ever happen once, even if the setup page is opened twice at
+the same moment. Logging out ends your own session and nobody else's.
+
+A misconfigured site now refuses to start and says exactly what is missing,
+instead of appearing to work and failing at the first login.
+
+Underneath, every action the software takes now runs through one gate that
+checks permission, validates the request, writes an audit entry, and saves
+everything or nothing — so a half-finished change to your data is impossible
+rather than unlikely. Prices and dates are formatted correctly for every
+currency and locale, including currencies that do not divide into hundredths.

package/dist/template/.changeset/stable-release-publication.md

@@ -0,0 +1,10 @@
+---
+"@freeholder/cli": patch
+"@freeholder/sdk": patch
+"create-freeholder": patch
+---
+
+Preserve build-declared compatibility and recovery instructions in signed releases.
+Keep release candidates off stable/latest tags, require completed owner acceptance
+before stable publication, and publish all six v1 package artifacts after exact main CI.
+Skip IndexNow delivery in the isolated public playground instead of filling its failed-job queue.

package/dist/template/.changeset/staff-invitations.md

@@ -0,0 +1,13 @@
+---
+"freeholder": minor
+---
+
+Add the complete staff invitation lifecycle: create an expiring invitation for
+an assignable admin role, deliver it through the configured transactional mail
+adapter, rotate its private token on resend, revoke it immediately, and accept
+it through a noindex password-creation screen that signs the new staff member
+in. Invitation tokens are hashed at rest and redacted from audit and
+rate-limit records; role eligibility is checked again at acceptance; duplicate
+and concurrent acceptance are closed at the database boundary; expiry is
+scheduled; delivery state and the plain-language audit history are visible in
+the localized admin.

package/dist/template/.changeset/standalone-artifact-boundary.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Keep runtime filesystem paths from expanding the standalone server trace, remove build-host environment files and source-only repository roots, and fail builds if either reappears.

package/dist/template/.changeset/standing-debts-1.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+Merging two contacts who can both sign in now stops and explains itself
+instead of quietly leaving one of the two logins attached to nobody. The
+activity feed on your dashboard describes what happened in the words the
+platform uses for it, rather than a guess assembled from the internal name.
+Public pages and admin screens also load the business details once per visit
+instead of several times.

package/dist/template/.changeset/storage-adapters.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+Freeholder can now keep files wherever you keep them. DigitalOcean Spaces,
+Cloudflare R2, MinIO, Backblaze and Amazon S3 all work through one setting, and
+Replit's own storage works when you deploy there — switching between them is a
+line of configuration, not a change to the software.
+
+Private storage is the default. If your bucket is not meant to be public,
+links to your files are signed and expire, so a client gallery link cannot be
+forwarded to the whole internet by accident.

package/dist/template/.changeset/subscription-billing.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+Memberships can now bill themselves. A plan chooses **manual** (you send the
+invoice), **platform** (Freeholder charges a stored card when the period ends),
+or **provider** (Stripe or PayPal own the calendar, and Freeholder follows
+their webhooks). A mid-cycle plan change follows the proration rule you set on
+the plan: charge the unused fraction now, or wait until this period ends.
+
+Automatic modes need a stored payment method on the contact. Customers can
+change plan from the portal the same way they already cancel.

package/dist/template/.changeset/supplier-agreement-search.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.14: Find suppliers by name and agreements by title in workspace search. Results use existing read permissions and destinations. Agreement search preserves the human-session restriction of contracts.get and selects no signing token, document body or signer evidence. Supplier results link to their row in procurement; kind labels are available in English, French and Spanish.