create-ailk 0.11.0 → 0.11.2

package/dist/content-payloads.js

@@ -29,8 +29,8 @@ export const CONTENT_PAYLOADS = Object.freeze([
         kind: "template-set",
         name: "scaffold-commerce",
         feature: "commerce",
-        version: "1.0.0",
-        digest: "baa4ac6e86ec7e3b367eb67e77c3407da90c7ff9ef51d5f4e1185615194543ee",
+        version: "1.0.1",
+        digest: "112704a7910dba3275defc0cb86b1b4f33fc8f262f4c09320e8f6b3a8d873916",
         sourceRoot: "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce",
         files: Object.freeze([
             "references/lookup-keys-template.md",

package/dist/lib/scaffold-render-sweep.d.ts

@@ -103,3 +103,19 @@ export declare function assessConfigGatedRoute(input: {
  * a socket) throws rather than being silently followed or skipped.
  */
 export declare function listPublicFiles(dir: string): string[];
+/** The slug the sweep requests to prove a detail route 404s an unknown slug. */
+export declare const UNKNOWN_SLUG = "ailk-unknown-slug-7379";
+/** `/features/[slug]` → `/features`; null unless `[slug]` is the one dynamic segment and the last. */
+export declare function detailRoutePrefix(route: string): string | null;
+/** The sorted basenames (sans `.mdx`) of the `*.mdx` files directly in `dir`; [] when `dir` is absent. */
+export declare function listSeedSlugs(dir: string): string[];
+/** An unknown slug must answer exactly 404, with no redirect. A 500 is the #7379 failure; a 200 means no 404 branch ran. */
+export declare function assessUnknownSlug(input: {
+    route: string;
+    hops: RedirectHop[];
+    status: number | null;
+}): SweepVerdict;
+/** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
+export declare function assessPrerenderManifest(manifest: {
+    dynamicRoutes?: Record<string, unknown>;
+}): SweepVerdict;

package/dist/lib/scaffold-render-sweep.js

@@ -13,10 +13,17 @@
  * not cost a templates build, an install and a `next build`. Each is a pure
  * function of what the driver observed, so
  * `__tests__/verify-scaffold-render-sweep.test.ts` drives them directly. The
- * driver loads this module from `dist/`. Only `listPublicFiles` touches the
- * filesystem, and none of it touches the network.
+ * driver loads this module from `dist/`. Only `listPublicFiles` and
+ * `listSeedSlugs` touch the filesystem, and none of it touches the network.
+ *
+ * #7379 added two sweeps. A starter roster's detail row that names a seed
+ * directory (`/features/[slug]` → `content/en/Feature`) is probed: each seed
+ * must render, and `UNKNOWN_SLUG` must answer 404. And the build's
+ * `prerender-manifest.json` must register no `/[locale]/…` route as an
+ * on-demand prerender — under the cookie-reading locale layout, such a route
+ * answers 500 for every slug, seeded or not.
  */
-import { readdirSync } from "node:fs";
+import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 /** More hops than this is a redirect chain, not a render. */
 export const MAX_REDIRECTS = 5;
@@ -234,3 +241,45 @@ function listFilesUnder(dir, relPrefix) {
     }
     return out;
 }
+/** The slug the sweep requests to prove a detail route 404s an unknown slug. */
+export const UNKNOWN_SLUG = "ailk-unknown-slug-7379";
+/** `/features/[slug]` → `/features`; null unless `[slug]` is the one dynamic segment and the last. */
+export function detailRoutePrefix(route) {
+    const match = /^((?:\/[^/[\]]+)+)\/\[slug\]$/.exec(route);
+    return match?.[1] ?? null;
+}
+/** The sorted basenames (sans `.mdx`) of the `*.mdx` files directly in `dir`; [] when `dir` is absent. */
+export function listSeedSlugs(dir) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".mdx"))
+        .map((entry) => entry.name.slice(0, -".mdx".length))
+        .sort();
+}
+/** An unknown slug must answer exactly 404, with no redirect. A 500 is the #7379 failure; a 200 means no 404 branch ran. */
+export function assessUnknownSlug(input) {
+    const { route, hops, status } = input;
+    const first = hops[0];
+    if (first !== undefined) {
+        return { ok: false, reason: `${route} -> ${first.status} redirect (an unknown slug must answer 404, not redirect)` };
+    }
+    if (status === 200)
+        return { ok: false, reason: `${route} -> 200 (no 404 branch ran for an unknown slug)` };
+    if (status !== 404)
+        return { ok: false, reason: `${route} -> status ${status} (expected 404 for an unknown slug)` };
+    return { ok: true, reason: "404" };
+}
+/** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
+export function assessPrerenderManifest(manifest) {
+    const locale = Object.keys(manifest.dynamicRoutes ?? {})
+        .filter((route) => route.startsWith("/[locale]/"))
+        .sort();
+    if (locale.length > 0) {
+        return {
+            ok: false,
+            reason: `on-demand prerender under the cookie-reading locale layout (500s every slug, #7379): ${locale.join(", ")}`,
+        };
+    }
+    return { ok: true, reason: "no /[locale] on-demand prerender route" };
+}

package/dist/module-architecture.js

@@ -790,6 +790,15 @@ export const MODULE_SLICES = {
             // deliverable by BOTH bundles.
             "apps/api/src/services/inbox-messages.ts",
             "apps/api/src/routes/workspaces/messages.ts",
+            // #7399 — the two siblings #6216 left `workspace`-only. They register
+            // under that same `workspace || multi-tenant` gate, so a scaffold with
+            // `multi-tenant` and without `workspace` loaded them with no file behind
+            // the specifier and 500'd every request at server construction. Co-owned
+            // with `workspace` (see that slice's entry below); both import only
+            // `lib/tenant-db.ts` (owned here) and base files.
+            // `__tests__/tenancy-slice-resolution.test.ts` holds the whole gate set.
+            "apps/api/src/routes/workspaces/general.ts",
+            "apps/api/src/routes/workspaces/members.ts",
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/lib/ws-token.ts",
             // #6157 D16 — the magnet Admin authoring surface, co-owned with
@@ -890,6 +899,8 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/admin/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/site/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/team/page.tsx",
+            // Co-owned with `multi-tenant` (#7399) — see that slice's entry: both
+            // register under the workspace||multi-tenant gate.
             "apps/api/src/routes/workspaces/general.ts",
             "apps/api/src/routes/workspaces/members.ts",
             // Co-owned with `multi-tenant` (#6216) — see that slice's entry: the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",

package/site-templates/shapes/local-business-service/content/en/Service/first-job.mdx

@@ -11,29 +11,29 @@ schema:
     name: "Your Company"
 ---
 
-# {First job}
+# \{First job}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the visit: how it is scheduled, how long it
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
 takes, who turns up, and what you need from the customer beforehand.}
 
 ## What you end up with
 
-{One paragraph on the result. Be concrete — describe the property when the
+\{One paragraph on the result. Be concrete — describe the property when the
 crew drives away.}
 
 ## What it costs
 
-{One line on the pricing shape — flat rate, hourly, or by the job — and what it
+\{One line on the pricing shape — flat rate, hourly, or by the job — and what it
 excludes. Replace with your real numbers, or delete this section and let a
 call do it.}

package/site-templates/shapes/local-business-service/content/en/Service/second-job.mdx

@@ -11,29 +11,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Second job}
+# \{Second job}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the visit: how it is scheduled, how long it
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
 takes, who turns up, and what you need from the customer beforehand.}
 
 ## What you end up with
 
-{One paragraph on the result. Be concrete — describe the property when the
+\{One paragraph on the result. Be concrete — describe the property when the
 crew drives away.}
 
 ## What it costs
 
-{One line on the pricing shape — flat rate, hourly, or by the job — and what it
+\{One line on the pricing shape — flat rate, hourly, or by the job — and what it
 excludes. Replace with your real numbers, or delete this section and let a
 call do it.}

package/site-templates/shapes/local-business-service/content/en/Service/third-job.mdx

@@ -11,29 +11,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Third job}
+# \{Third job}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the visit: how it is scheduled, how long it
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
 takes, who turns up, and what you need from the customer beforehand.}
 
 ## What you end up with
 
-{One paragraph on the result. Be concrete — describe the property when the
+\{One paragraph on the result. Be concrete — describe the property when the
 crew drives away.}
 
 ## What it costs
 
-{One line on the pricing shape — flat rate, hourly, or by the job — and what it
+\{One line on the pricing shape — flat rate, hourly, or by the job — and what it
 excludes. Replace with your real numbers, or delete this section and let a
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/first-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {First engagement}
+# \{First engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/second-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Second engagement}
+# \{Second engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/third-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Third engagement}
+# \{Third engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/first-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {First engagement}
+# \{First engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/second-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {Second engagement}
+# \{Second engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/third-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {Third engagement}
+# \{Third engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/templates/.env.example

@@ -50,10 +50,6 @@ CONTENT_ADAPTER=mdx
 # Developers → Webhooks → <your endpoint> → Signing secret.
 # Format: whsec_*. Server-only — must NOT be prefixed with NEXT_PUBLIC_.
 # STRIPE_WEBHOOK_SECRET=
-# Internal URL of the billing service — used by marketing-api's webhook
-# proxy (POST /v1/webhooks/stripe) to forward verified deliveries. Format:
-# https://<vercel-deployment>.vercel.app (no trailing slash, no path).
-# BILLING_SERVICE_URL=
 
 # ── Auth (Better Auth — apps/web only) ───────────────────────────────────────
 # BETTER_AUTH_URL=http://localhost:3000
@@ -63,10 +59,20 @@ CONTENT_ADAPTER=mdx
 # Unset in production, either one makes the API log a startup warning; the
 # API keeps running.
 # FRONTEND_URL is the site the browser loads (no trailing slash). Set it on the
-# API project: unset in production, CORS, cookie origin checks and the
-# billing-portal return URLs fall back to http://localhost:3000, and checkout
-# answers 500 to a caller without X-Internal-Auth.
+# API project: it is the first trusted origin for CORS, cookie-authenticated
+# writes and checkout redirects. Unset in production, those three trust only
+# AILK_TRUSTED_ORIGINS below (with neither set, they refuse every browser
+# origin and checkout answers 500 to a caller without X-Internal-Auth), and the
+# billing-portal return URLs fall back to http://localhost:3000.
 # FRONTEND_URL=https://your-domain.com
+# AILK_TRUSTED_ORIGINS lists MORE browser origins the API trusts, beside
+# FRONTEND_URL — the Admin app and spoke sites a hub API serves. Comma-separated
+# exact origins, written as a browser sends them: scheme + host (+ port), no
+# path, no trailing slash, lower-case. `*`, wildcard hosts and any other form
+# are refused and the API does not start; production requires https. Each
+# listed origin gets CORS reads, cookie writes and checkout-redirect trust, so
+# list ONLY origins the deployment owner operates — never another party's site.
+# AILK_TRUSTED_ORIGINS=https://admin.your-domain.com,https://spoke.example
 # OSS_API_INTERNAL_SECRET gates POST /v1/checkout/sessions. Unset, the route
 # admits every caller. Set, it answers 401 to any caller that does not send it
 # as X-Internal-Auth — including the MCP start_purchase tool and a browser

package/templates/apps/api/.env.example

@@ -15,6 +15,11 @@ PORT=3002
 # Frontend URL (for CORS)
 # =============================================================================
 FRONTEND_URL=http://localhost:3000
+# More trusted browser origins (Admin app, spoke sites): comma-separated exact
+# origins, no path or trailing slash; `*` is refused at startup; https in production.
+# Each listed origin gets credentialed CORS, cookie writes and checkout-redirect
+# trust — list only origins the deployment owner operates.
+# AILK_TRUSTED_ORIGINS=https://admin.your-domain.com,https://spoke.example
 
 # =============================================================================
 # Local Database (required in production)

package/templates/apps/api/package.json

@@ -49,7 +49,7 @@
     "@working-theory/stripe-client": "workspace:*",
     "@working-theory/validation": "workspace:*",
     "dotenv": "^17.4.2",
-    "fastify": "^5.12.1",
+    "fastify": "^5.12.5",
     "pdf-lib": "^1.17.1",
     "pg": "^8.22.0",
     "yaml": "^2.9.0",