create-ailk 0.14.0 → 0.15.0

package/dist/lib/extract-module-bundle.d.ts

@@ -49,6 +49,8 @@ export interface ExtractModuleBundleOptions {
     existingFilePolicy?: ExistingFilePolicy;
     /** A caller check on the manifest's `patches` (#6653 D3). See `InstallBundleTreeOptions`. */
     checkPatches?: (patches: readonly ModulePatch[]) => void;
+    /** Destinations this scaffold does not carry (#7426 D4). See `InstallBundleTreeOptions`. */
+    skip?: (destination: string) => boolean;
 }
 /**
  * Extract a fetched module bundle into `targetDir`, merging its files onto
@@ -131,6 +133,15 @@ export interface InstallBundleTreeOptions {
      * bundle's patches to the plus-config allowlist.
      */
     checkPatches?: (patches: readonly ModulePatch[]) => void;
+    /**
+     * Scaffold-relative destinations this scaffold does not carry (#7426 D4) —
+     * a spoke passes `topology.ts` `isSpokeExcluded`. A skipped destination is
+     * never written: a plain file or an `installMap` destination it names is
+     * dropped, and so is a `patches` entry whose target it names. It is NOT an
+     * ownership claim, and a skipped patch target is not a missing one. Every
+     * entry is still validated as before. Absent ⟹ nothing is skipped.
+     */
+    skip?: (destination: string) => boolean;
 }
 /** See `InstallBundleTreeOptions.existingFilePolicy`. */
 export type ExistingFilePolicy = "overwrite" | "skip-existing";

package/dist/lib/extract-module-bundle.js

@@ -385,6 +385,24 @@ function validateLayerOwnership(destinations, ownership, subject, isTemplate, pa
         }
     }
 }
+/** Every regular file under `srcRoot`, as a `/`-separated relative path. */
+function stagedFiles(srcRoot) {
+    const out = [];
+    const stack = [srcRoot];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const srcPath = join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(srcPath);
+            else if (entry.isFile())
+                out.push(relative(srcRoot, srcPath).split(sep).join("/"));
+        }
+    }
+    return out;
+}
 /**
  * Every scaffold-relative destination this tree will write: each unmapped
  * staged file at its own path (exactly the set `copyTree` lands, same walk,
@@ -457,6 +475,7 @@ export async function extractModuleBundle(options) {
             ...(options.checkPatches !== undefined
                 ? { checkPatches: options.checkPatches }
                 : {}),
+            ...(options.skip !== undefined ? { skip: options.skip } : {}),
         });
     }
     finally {
@@ -484,13 +503,18 @@ export function installBundleTree(options) {
     const manifest = isTemplate
         ? readAilkTemplateManifest(sourceRoot, name, templateRequires, templateExtends)
         : readAilkModuleManifest(sourceRoot);
-    const installMap = manifest?.installMap ?? {};
-    validateInstallMap(installMap, sourceRoot, targetAbs, subject, isTemplate);
+    const declaredInstallMap = manifest?.installMap ?? {};
+    validateInstallMap(declaredInstallMap, sourceRoot, targetAbs, subject, isTemplate);
+    // #7426 D4 — a destination the scaffold does not carry is dropped here,
+    // after validation, so a spoke never receives it and never records it.
+    const skip = options.skip;
+    const isSkipped = (destination) => skip !== undefined && skip(normalize(destination).split(sep).join("/"));
+    const installMap = Object.fromEntries(Object.entries(declaredInstallMap).filter(([, destination]) => !isSkipped(destination)));
     // patches validation (spec 5418 § 3 D6) runs at the same point, before
     // any copy — a bad target/kind/op rejects the whole tree with nothing
     // written to targetDir, same posture as installMap and the tar-entry
     // validation above.
-    const patches = manifest?.patches ?? [];
+    const declaredPatches = manifest?.patches ?? [];
     // #5514 (Medium) — content, never code (spec 5462 D9/D16): every `patches`
     // kind either edits a code file directly (`next-config`, `jest-config`)
     // or a manifest a template has no legitimate reason to touch
@@ -498,10 +522,13 @@ export function installBundleTree(options) {
     // content template) — no shipped template uses it, so the simplest
     // fail-closed reading refuses it outright rather than enumerating an
     // allowed subset that has no current user.
-    if (isTemplate && patches.length > 0) {
+    if (isTemplate && declaredPatches.length > 0) {
         throw new Error(`${subject}: a template must not carry patches — content, never code (spec 5462 D9)`);
     }
-    validatePatches(patches, targetAbs, subject);
+    // Every declared patch is validated, skipped or not (#7426 D4), exactly as
+    // the installMap is above; only then are the skipped ones dropped.
+    validatePatches(declaredPatches, targetAbs, subject);
+    const patches = declaredPatches.filter((patch) => !isSkipped(patch.target));
     options.checkPatches?.(patches);
     // The exclusion set copyTree/the content-only guard both use — built from
     // NORMALIZED installMap keys (#5514) so a "./x" key excludes the same
@@ -512,7 +539,10 @@ export function installBundleTree(options) {
     const excluded = new Set([
         AILK_TEMPLATE_JSON,
         AILK_MODULE_JSON,
-        ...Object.keys(installMap).map((key) => normalize(key).split(sep).join("/")),
+        ...Object.keys(declaredInstallMap).map((key) => normalize(key).split(sep).join("/")),
+        // A plain file lands at its own staged path, so that path IS its
+        // destination: a skipped one is excluded from the copy like a mapped source.
+        ...(skip !== undefined ? stagedFiles(sourceRoot).filter(isSkipped) : []),
     ]);
     if (isTemplate) {
         // #6658 D7 — a template's roster of record lands as JSON, through its

package/dist/lib/license-key-files.d.ts

@@ -20,5 +20,10 @@ export declare function appendLine(text: string, line: string): string;
  * `apps/api/.env` line (0600, other lines kept), and a `.gitignore` entry for
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
+ *
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
+ * `apps/api`, so it keeps the key in `ailk.key` alone.
  */
-export declare function writeLicenseKeyFiles(dir: string, key: string): void;
+export declare function writeLicenseKeyFiles(dir: string, key: string, opts?: {
+    apiEnv?: boolean;
+}): void;

package/dist/lib/license-key-files.js

@@ -85,13 +85,18 @@ function upsertEnvLine(existing, key) {
  * `apps/api/.env` line (0600, other lines kept), and a `.gitignore` entry for
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
+ *
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
+ * `apps/api`, so it keeps the key in `ailk.key` alone.
  */
-export function writeLicenseKeyFiles(dir, key) {
+export function writeLicenseKeyFiles(dir, key, opts = {}) {
     assertLicenseKeyShape(key);
     writeOwnerOnly(join(dir, LICENSE_KEY_FILE), `${key}\n`);
-    const envPath = join(dir, LICENSE_ENV_FILE);
-    const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
-    writeOwnerOnly(envPath, upsertEnvLine(env, key));
+    if (opts.apiEnv !== false) {
+        const envPath = join(dir, LICENSE_ENV_FILE);
+        const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+        writeOwnerOnly(envPath, upsertEnvLine(env, key));
+    }
     const ignorePath = join(dir, ".gitignore");
     const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
     const covered = ignore

package/dist/module-architecture.d.ts

@@ -83,6 +83,15 @@ export interface PageRosterRow {
  * scaffold carries (#6940).
  */
 export interface ModuleSlice {
+    /**
+     * Admits the module on a spoke (`create-ailk --topology spoke`, #7426 D7).
+     * `true` → a spoke may carry it, and its bundle installs through the spoke
+     * filter (`topology.ts` `isSpokeExcluded`), so any `apps/api` or
+     * `database` part it carries is dropped. Unset → refused on a spoke.
+     * `topology.ts` `spokeModules()` reads it; a sibling issue admits its
+     * module by setting it here, never in a second list.
+     */
+    spoke?: true;
     /**
      * The paid UI package base-tree code loads through
      * `apps/web/lib/paid-sections.generated.ts` (#7536). Present → one row in the

package/dist/module-architecture.js

@@ -206,6 +206,7 @@ function payloadPaths(kind, name, destRoot) {
 export const MODULE_SLICES = {
     // ── marketing — thin presentation module (the default) ───────────────────
     marketing: {
+        spoke: true,
         webImports: [
             WEB_AUTH_ADAPTER_IMPORT,
             "packages/content-adapters",
@@ -287,6 +288,7 @@ export const MODULE_SLICES = {
     },
     // ── docs-blog — Pro module: both fumadocs surfaces (D-46) ────────────────
     "docs-blog": {
+        spoke: true,
         webImports: [WEB_AUTH_ADAPTER_IMPORT, "packages/fumadocs-schema"],
         packages: {
             "fumadocs-schema": {
@@ -1388,6 +1390,10 @@ export const MODULE_SLICES = {
             "apps/api/src/bin/deliverable-upload.ts",
             "apps/api/src/bin/session-retention-sweep.ts",
             "apps/api/src/bin/seed-presets.ts",
+            // #7844 D7 — the operator flow-copy CLI and its service: flows code by
+            // subject, and a Free scaffold carries no flows.
+            "apps/api/src/bin/flows-copy.ts",
+            "apps/api/src/services/flow-copy.ts",
             "apps/api/src/bin/listing-csv-sweep.ts",
             "apps/api/src/bin/followup-sweep.ts",
             "apps/api/src/bin/seed-waitlist-experiments.ts",

package/dist/parse-args.d.ts

@@ -26,6 +26,15 @@ export declare const RESERVED_SHAPES: readonly ["local-business-product"];
 /** The `--design` vocabulary (#6754 D1) — `STARTER_DESIGNS`, pinned by test. */
 export declare const RECOGNIZED_DESIGNS: readonly ["standard", "minimalism"];
 export type DesignName = (typeof RECOGNIZED_DESIGNS)[number];
+/**
+ * The `--topology` vocabulary (#7426 D1) — orthogonal to `--shape`: any shape
+ * can be scaffolded as either. Declared here rather than imported from
+ * `topology.ts` for the reason `RECOGNIZED_MODULES` is: that module reads
+ * `MODULE_SLICES`, and importing it here closes a runtime cycle through
+ * `lib/module-tier.ts`. `spoke-topology.test.ts` pins the two lists equal.
+ */
+export declare const RECOGNIZED_TOPOLOGIES: readonly ["hub", "spoke"];
+export type TopologyName = (typeof RECOGNIZED_TOPOLOGIES)[number];
 export interface CliOptions {
     /** Positional target directory (the dir to scaffold into). Optional only
      *  when `help` or `version` is set. */
@@ -94,6 +103,19 @@ export interface CliOptions {
      * flag is.
      */
     license?: string;
+    /**
+     * The scaffold's topology (`--topology`, #7426 D1). `hub` — the default,
+     * and the only value before #7426 — unless `--topology spoke`.
+     */
+    topology: TopologyName;
+    /**
+     * The raw `--hub-url` value (#7426 D2), present only on a spoke run that
+     * passed it. `scaffold()` validates and normalizes it, falling back to
+     * `AILK_API_URL`.
+     */
+    hubUrl?: string;
+    /** Spoke only: `false` with `--without-mcp` (#7426 D3), else `true`. */
+    mcp?: boolean;
 }
 export declare class ParseError extends Error {
     constructor(message: string);

package/dist/parse-args.js

@@ -59,6 +59,14 @@ const SHAPE_DESCRIPTIONS = {
     "person-service": "a person selling their own service",
 };
 const SHAPE_LIST = RECOGNIZED_SHAPES.join(", ");
+/**
+ * The `--topology` vocabulary (#7426 D1) — orthogonal to `--shape`: any shape
+ * can be scaffolded as either. Declared here rather than imported from
+ * `topology.ts` for the reason `RECOGNIZED_MODULES` is: that module reads
+ * `MODULE_SLICES`, and importing it here closes a runtime cycle through
+ * `lib/module-tier.ts`. `spoke-topology.test.ts` pins the two lists equal.
+ */
+export const RECOGNIZED_TOPOLOGIES = ["hub", "spoke"];
 export class ParseError extends Error {
     constructor(message) {
         super(message);
@@ -158,6 +166,18 @@ Options:
   --license <key>          Your licence key: fetch paid modules with it and
                            write it into the scaffold (apps/api/.env and a
                            gitignored ailk.key, both owner-only).
+  --topology <hub|spoke>   hub (the default) scaffolds the whole site: web,
+                           API, MCP and database. spoke scaffolds a web-only
+                           site that sends its forms, flows and listings to a
+                           hub — no apps/api, no database, no sign-in, and
+                           apps/mcp kept as a stateless front. Composes with
+                           any --shape or --template. A spoke carries
+                           marketing and docs-blog.
+  --hub-url <origin>       A spoke's hub, e.g. https://hub.example.com (https:,
+                           or http: on localhost). Defaults to AILK_API_URL;
+                           a spoke with neither is refused. Written to
+                           apps/web/.env.local — the spoke key never is.
+  --without-mcp            A spoke without apps/mcp.
   --install                After scaffolding, run \`pnpm install\` in the
                            target directory. Off by default.
   --help, -h               Print this message.
@@ -194,6 +214,9 @@ export function parseCliArgs(argv, env = { interactive: false }) {
                 shape: { type: "string" },
                 design: { type: "string" },
                 license: { type: "string" },
+                topology: { type: "string" },
+                "hub-url": { type: "string" },
+                "without-mcp": { type: "boolean", default: false },
                 surfaces: { type: "string" },
                 "sync-architecture": { type: "string" },
                 "sync-catalog": { type: "boolean", default: false },
@@ -224,6 +247,10 @@ export function parseCliArgs(argv, env = { interactive: false }) {
     const syncClaudeMd = parsed.values["sync-claude-md"] === true;
     const withCatalog = parsed.values["with-catalog"] === true;
     const license = parseLicense(parsed.values.license);
+    const rawTopology = parsed.values.topology;
+    const topology = parseTopology(rawTopology);
+    const hubUrl = parsed.values["hub-url"];
+    const withoutMcp = parsed.values["without-mcp"] === true;
     // The sync modes each exit after rewriting their one file, so asking for
     // more than one in one invocation has no coherent meaning.
     const syncFlags = [
@@ -234,6 +261,21 @@ export function parseCliArgs(argv, env = { interactive: false }) {
     if (syncFlags.length > 1) {
         throw new ParseError(`${syncFlags.join(" and ")} cannot be combined; run them one at a time`);
     }
+    // #7426 D1 — a sync reads the topology from the site's manifest; naming one
+    // here has no coherent meaning.
+    if (rawTopology !== undefined && syncFlags.length > 0) {
+        throw new ParseError(`--topology cannot be combined with ${syncFlags[0]}: a sync reads the site's topology from its .ailk-site-manifest.json`);
+    }
+    // #7426 D2/D3 — the spoke-only flags.
+    if (topology !== "spoke") {
+        const spokeOnly = [
+            hubUrl !== undefined ? "--hub-url" : undefined,
+            withoutMcp ? "--without-mcp" : undefined,
+        ].filter((f) => f !== undefined);
+        if (spokeOnly.length > 0) {
+            throw new ParseError(`${spokeOnly.join(" and ")} only apply${spokeOnly.length === 1 ? "s" : ""} to a spoke. Pass --topology spoke, or drop ${spokeOnly.length === 1 ? "it" : "them"}.`);
+        }
+    }
     // Validate the sync-architecture value now, through the SAME parseModules
     // path `--modules` uses, so an unknown module throws ParseError at parse time
     // (cli.ts re-parses the raw value to the module list in sync mode).
@@ -255,6 +297,7 @@ export function parseCliArgs(argv, env = { interactive: false }) {
             syncClaudeMd: false,
             withCatalog: false,
             syncArchitecture: undefined,
+            topology: "hub",
         };
     }
     // Sync modes: the target dir is optional (positional if given, else cwd).
@@ -275,6 +318,7 @@ export function parseCliArgs(argv, env = { interactive: false }) {
             syncClaudeMd,
             withCatalog,
             syncArchitecture,
+            topology: "hub",
         };
     }
     if (parsed.positionals.length === 0) {
@@ -292,6 +336,13 @@ export function parseCliArgs(argv, env = { interactive: false }) {
                 : "--design";
         throw new ParseError(`--template cannot be combined with ${flags}: a template already fixes its shape and design. Pass --template alone, or --shape with an optional --design.`);
     }
+    // #7426 D2 — a spoke needs its hub's origin. Presence only, here: the value
+    // is validated and normalized by `scaffold()` (`topology.ts`
+    // `normalizeHubUrl`), still before the target directory exists.
+    if (topology === "spoke" &&
+        (hubUrl ?? process.env["AILK_API_URL"] ?? "").trim() === "") {
+        throw new ParseError("a spoke needs its hub's origin, and none was given. Pass --hub-url <origin>, or set AILK_API_URL (e.g. https://hub.example.com).");
+    }
     // R1 — no silent default: with neither a template nor a shape, ask on a
     // terminal and refuse without one.
     const needsShapePrompt = template === undefined && shape === undefined;
@@ -314,8 +365,22 @@ export function parseCliArgs(argv, env = { interactive: false }) {
         withCatalog,
         syncArchitecture: undefined,
         ...(license !== undefined ? { license } : {}),
+        topology,
+        ...(topology === "spoke"
+            ? { ...(hubUrl !== undefined ? { hubUrl } : {}), mcp: !withoutMcp }
+            : {}),
     };
 }
+/** Validate `--topology` (#7426 D1): `hub` when absent, trimmed and lowercased. */
+function parseTopology(raw) {
+    if (raw === undefined)
+        return "hub";
+    const name = raw.trim().toLowerCase();
+    if (!RECOGNIZED_TOPOLOGIES.includes(name)) {
+        throw new ParseError(`unknown topology "${raw}". Recognized: ${RECOGNIZED_TOPOLOGIES.join(", ")}`);
+    }
+    return name;
+}
 /**
  * Validate `--shape` (#6754 D2 step 2): trimmed and lowercased. A reserved
  * shape is refusal R2; any other unrecognized value names the recognized set.
@@ -467,6 +532,14 @@ export function toScaffoldOptions(opts) {
         ...(opts.shape !== undefined ? { shape: opts.shape } : {}),
         ...(opts.design !== undefined ? { design: opts.design } : {}),
         ...(opts.license !== undefined ? { license: opts.license } : {}),
+        // #7426 — a hub run hands `scaffold()` the object it did before.
+        ...(opts.topology === "spoke"
+            ? {
+                topology: "spoke",
+                ...(opts.hubUrl !== undefined ? { hubUrl: opts.hubUrl } : {}),
+                mcp: opts.mcp !== false,
+            }
+            : {}),
     };
 }
 /**

package/dist/programmatic.d.ts

@@ -22,6 +22,7 @@ import { type ModuleName } from "./parse-args.js";
 import { type TemplateLayout } from "./site-chrome.js";
 import { type SyncRoutesResult } from "./sync-routes.js";
 import { type StarterShape } from "./template-manifest.js";
+import { type Topology } from "./topology.js";
 export interface ScaffoldOptions {
     /** Absolute or relative path to the target directory. Must not exist or be empty. */
     targetDir: string;
@@ -136,6 +137,18 @@ export interface ScaffoldOptions {
      * code registry that has since been deleted (#6638's per-name table).
      */
     designLayout?: TemplateLayout;
+    /**
+     * The scaffold's topology (`--topology`, #7426 D1). `"hub"` — the default
+     * — is the whole site. `"spoke"` is the same scaffold with nodes removed
+     * (`topology.ts`): no `apps/api`, no `database/`, no sign-in, `apps/mcp`
+     * a stateless front unless `mcp: false`. A spoke needs a `template` or a
+     * `shape` (the manifest records the topology) and a hub origin.
+     */
+    topology?: Topology;
+    /** A spoke's hub origin (`--hub-url`), else `AILK_API_URL` (#7426 D2). */
+    hubUrl?: string;
+    /** Spoke only: `false` drops `apps/mcp` (`--without-mcp`, #7426 D3). Default true. */
+    mcp?: boolean;
 }
 export interface ScaffoldResult {
     /** Resolved absolute path to the scaffolded directory. */
@@ -161,6 +174,13 @@ export interface ScaffoldResult {
      * a keyed run with no `--modules` carries the key's derived level here.
      */
     modules: ModuleName[];
+    /**
+     * A spoke only (#7426 D7): modules the key's default set carried that a
+     * spoke does not admit, dropped from this scaffold. Absent when none were.
+     */
+    droppedModules?: ModuleName[];
+    /** A spoke only (#7426 D2): the normalized hub origin written to apps/web/.env.local. */
+    hubOrigin?: string;
 }
 /**
  * Scaffold an AI Launch Kit starter project into targetDir (synchronous).

package/dist/programmatic.js

@@ -18,7 +18,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { AddModuleRefusedError, applyModuleToScaffold, } from "./add-module.js";
+import { AddModuleRefusedError, addModuleSiteTopology, applyModuleToScaffold, } from "./add-module.js";
 import { planDesignMd } from "./apply-design-md.js";
 import { renderClaudeMd, syncClaudeMd, } from "./claude-md.js";
 import { CATALOG_TARGET_PATH, writeComponentCatalog, } from "./component-catalog.js";
@@ -44,6 +44,7 @@ import { SITE_ROSTER_PATH, planHomeRecord, planSiteManifestDesign, readSiteRoste
 import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
+import { TopologyError, applySpokeTransforms, isSpokeExcluded, normalizeHubUrl, readSiteTopology, spokeExclusions, spokeModuleRefusal, spokeModules, writeHubOriginEnv, } from "./topology.js";
 import { validateTarget } from "./validate.js";
 const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const TEMPLATES_DIR = resolve(PKG_ROOT, "templates");
@@ -151,14 +152,23 @@ export function scaffoldSync(opts) {
     // The declared route surface (#4154). Resolved BEFORE the copy: it decides
     // both which route directories are skipped and what architecture.yaml records.
     const enabledSurfaces = resolveSurfaces(opts.modules ?? ["marketing"], opts.surfaces ?? []);
+    // #7426 D4 — a spoke is this same copy with the spoke's exclusions added:
+    // one registry over the one template tree, never a second tree.
+    const spoke = opts.topology === "spoke" ? { mcp: opts.mcp !== false } : undefined;
     const versions = readVersionMap();
     copyTemplate({
         templatesDir: TEMPLATES_DIR,
         targetDir: targetAbs,
         versions,
-        excludePaths: excludedRoutePaths(enabledSurfaces),
+        excludePaths: [
+            ...excludedRoutePaths(enabledSurfaces),
+            ...(spoke !== undefined ? spokeExclusions(TEMPLATES_DIR, spoke) : []),
+        ],
         markers: buildScaffoldMarkers(projectName),
     });
+    // #7426 D5/D6 — the root files a spoke rewrites, and the spoke seams.
+    if (spoke !== undefined)
+        applySpokeTransforms(targetAbs, spoke);
     // Stamp the copied CLAUDE.md's template regions with their hashes (#6904
     // D2). No later layer writes a root CLAUDE.md, so this is the final file.
     writeFileSync(join(targetAbs, "CLAUDE.md"), renderClaudeMd(readFileSync(join(TEMPLATES_DIR, "CLAUDE.md"), "utf8"), projectName));
@@ -167,7 +177,7 @@ export function scaffoldSync(opts) {
     // closes the dangling `architecture_rules: architecture.yaml` reference in
     // the scaffolded project.yaml. Written AFTER the template copy, at the target
     // root — a deterministic function of the selected module set.
-    writeFileSync(join(targetAbs, "architecture.yaml"), deriveArchitecture(opts.modules ?? ["marketing"], enabledSurfaces));
+    writeFileSync(join(targetAbs, "architecture.yaml"), deriveArchitecture(opts.modules ?? ["marketing"], enabledSurfaces, spoke !== undefined ? { topology: "spoke", mcp: spoke.mcp } : {}));
     // Regenerate the site nav from the same surface set (#4154). The nav is a
     // static list the layout renders into the header AND the footer, so leaving
     // the template's copy in place would link /docs and /blog sitewide in a
@@ -252,6 +262,9 @@ export async function scaffold(opts) {
             ? resolveShapeTemplate(opts.shape)
             : undefined;
     assertReleased("modules", [...(opts.modules ?? []), ...(template?.requires ?? [])]);
+    // #7426 D1-D3/D7 — a spoke's refusals, before anything is fetched or
+    // written: the target directory never exists for a refused spoke.
+    const spoke = resolveSpoke(opts, template);
     // #6813 D8 step 3 — the design this scaffold renders, resolved from its
     // package ONCE, before any fetch or write: the caller's override, else the
     // template's own. Unset for a scaffold naming neither. Replaces the
@@ -308,6 +321,8 @@ export async function scaffold(opts) {
     // list.
     let modules;
     let bundles;
+    // #7426 D7 — the key's default modules a spoke does not admit.
+    let dropped = [];
     // The run's derived level (#6759), for `assertDesignAllowed` below.
     // Undefined on the alias branch and on a `--modules`-keep run (D2/D4 in
     // module-license-gate.ts — the level plays no part in composing either),
@@ -360,6 +375,15 @@ export async function scaffold(opts) {
         });
         bundles = chosen.bundles;
         level = chosen.level;
+        // #7426 D7 — a key-derived default set keeps only what a spoke admits;
+        // the run names what it dropped (`droppedModules`).
+        if (spoke !== undefined && opts.modules === undefined) {
+            const admitted = new Set(spokeModules());
+            dropped = chosen.modules.filter((m) => !admitted.has(m));
+            chosen.modules = chosen.modules.filter((m) => admitted.has(m));
+            for (const name of dropped)
+                bundles.delete(name);
+        }
         // #7010 — a `--modules`-keep run composes no level (NFR-2), so a chosen
         // non-Free design derives one from the key here, as the addition branch
         // does; a plain keep run makes no extra network call.
@@ -453,6 +477,7 @@ export async function scaffold(opts) {
     const result = scaffoldSync({
         ...opts,
         modules,
+        ...(spoke !== undefined ? { topology: "spoke", mcp: spoke.mcp } : {}),
         ...(surfaces !== undefined ? { surfaces } : {}),
         // #5612 D1/D2 — the code registry's own `layout` block, known
         // synchronously (unlike a bundle's `ailk-template.json`, only readable
@@ -486,6 +511,14 @@ export async function scaffold(opts) {
     // anything. Starts empty at the base-layer boundary: the `templates/`
     // snapshot (layer 0) is deliberately outside it.
     const ownership = new Map();
+    // #7426 D4 — every layer below lands through the spoke filter: a module
+    // bundle's or the template's destination a spoke does not carry is dropped.
+    const exclusions = spoke !== undefined ? spokeExclusions(TEMPLATES_DIR, spoke) : [];
+    const spokeSkip = spoke !== undefined
+        ? {
+            skip: (destination) => isSpokeExcluded(destination, { mcp: spoke.mcp, exclusions }),
+        }
+        : {};
     // The BASE LAYER lands first (#5618 D1) — the seed files every template
     // reaches by `extends` (today the three module-less base pages), read off
     // the `site-templates/_base/` tree this package ships, through the same
@@ -505,6 +538,7 @@ export async function scaffold(opts) {
             versions,
             markers,
             ownership,
+            ...spokeSkip,
         });
     }
     for (const [moduleName, bytes] of bundles) {
@@ -515,6 +549,7 @@ export async function scaffold(opts) {
             versions,
             markers,
             ownership,
+            ...spokeSkip,
         });
     }
     // The template lands LAST — after `scaffoldSync` and after every module
@@ -550,6 +585,7 @@ export async function scaffold(opts) {
                 versions,
                 markers,
                 ownership,
+                ...spokeSkip,
             })
             : (() => {
                 const sourceRoot = join(SITE_TEMPLATES_DIR, templateTreeDir(template.name));
@@ -565,6 +601,7 @@ export async function scaffold(opts) {
                     versions,
                     markers,
                     ownership,
+                    ...spokeSkip,
                 });
             })();
         installedLayout = installed.layout;
@@ -696,6 +733,8 @@ export async function scaffold(opts) {
                 roster,
                 modules: result.modules,
                 level,
+                topology: spoke !== undefined ? "spoke" : "hub",
+                patternVersion: markers["CREATE_AILK_VERSION"] ?? "",
                 siteTemplatesDir: SITE_TEMPLATES_DIR,
                 templatesDir: TEMPLATES_DIR,
                 markers,
@@ -707,20 +746,70 @@ export async function scaffold(opts) {
     writePaidSections(result.targetDir);
     // #6107 D2 — after every layer landed, so nothing later overwrites it: a
     // served scaffold needs BETTER_AUTH_SECRET (#6044), and this is its value.
-    writeAuthSecretFile(result.targetDir);
+    // A spoke has no sign-in (#7426 D4), so it gets its hub's origin instead
+    // (D2) — never the spoke key, which the hub issues.
+    if (spoke !== undefined)
+        writeHubOriginEnv(result.targetDir, spoke.hubOrigin);
+    else
+        writeAuthSecretFile(result.targetDir);
     // #6683 D9 — persisted only after every layer landed, and only when the
-    // caller passed `license`: a scaffold without it writes nothing new.
+    // caller passed `license`: a scaffold without it writes nothing new. A
+    // spoke has no apps/api, so it keeps the key in ailk.key alone (#7426 D6).
     if (opts.license !== undefined) {
-        writeLicenseKeyFiles(result.targetDir, opts.license);
+        writeLicenseKeyFiles(result.targetDir, opts.license, {
+            apiEnv: spoke === undefined,
+        });
     }
     // #6754 D4/D5 — the resolved starter, so the CLI names what it built.
+    const withDropped = {
+        ...result,
+        ...(dropped.length > 0 ? { droppedModules: dropped } : {}),
+        ...(spoke !== undefined ? { hubOrigin: spoke.hubOrigin } : {}),
+    };
     if (template !== undefined && resolvedDesign !== undefined) {
         return {
-            ...result,
+            ...withDropped,
             starter: { template: template.name, shape: template.shape, design: resolvedDesign.recorded },
         };
     }
-    return result;
+    return withDropped;
+}
+/**
+ * A spoke's resolved inputs (#7426 D1-D3/D7), or undefined for a hub. Every
+ * refusal is a `TemplateError` thrown before anything is fetched or written.
+ */
+function resolveSpoke(opts, template) {
+    if (opts.topology !== "spoke") {
+        const spokeOnly = [
+            opts.hubUrl !== undefined ? "hubUrl" : undefined,
+            opts.mcp !== undefined ? "mcp" : undefined,
+        ].filter((f) => f !== undefined);
+        if (spokeOnly.length > 0) {
+            throw new TemplateError(`${spokeOnly.join(" and ")} only apply to a spoke — pass topology: "spoke"`);
+        }
+        return undefined;
+    }
+    if (template === undefined) {
+        throw new TemplateError("a spoke needs a starter — pass --shape <shape> or --template <name>: the site manifest is where the topology is recorded");
+    }
+    let hubOrigin;
+    try {
+        hubOrigin = normalizeHubUrl(opts.hubUrl ?? process.env["AILK_API_URL"]);
+    }
+    catch (err) {
+        if (err instanceof TopologyError)
+            throw new TemplateError(err.message);
+        throw err;
+    }
+    for (const name of normalizeModules([...(opts.modules ?? []), ...template.requires])) {
+        const refusal = spokeModuleRefusal(name);
+        if (refusal !== undefined) {
+            throw new TemplateError(template.requires.includes(name) && !(opts.modules ?? []).includes(name)
+                ? `template "${template.name}" requires ${refusal}`
+                : refusal);
+        }
+    }
+    return { mcp: opts.mcp !== false, hubOrigin };
 }
 /**
  * The per-row install of the two SHARED seed layers (#6646 D1, disposition
@@ -842,7 +931,12 @@ export function syncArchitectureSync(opts) {
         throw new Error(`not a scaffolded repo: no architecture.yaml at ${targetAbs}. Run \`create-ailk <target-dir>\` to scaffold first.`);
     }
     const enabledSurfaces = resolveSurfaces(opts.modules, opts.surfaces ?? []);
-    writeFileSync(archPath, deriveArchitecture(opts.modules, enabledSurfaces));
+    // #7426 D13 — a spoke stays a spoke: its topology is read from its
+    // manifest, and `mcp` from whether it still carries apps/mcp.
+    const topology = readSiteTopology(targetAbs);
+    writeFileSync(archPath, deriveArchitecture(opts.modules, enabledSurfaces, topology === "spoke"
+        ? { topology, mcp: existsSync(join(targetAbs, "apps", "mcp")) }
+        : {}));
     return {
         targetDir: targetAbs,
         surfaces: enabledSurfaces,
@@ -960,6 +1054,13 @@ export async function addModule(opts) {
     if (!existsSync(join(targetAbs, "architecture.yaml"))) {
         throw new Error(`not a scaffolded repo: no architecture.yaml at ${targetAbs}. Run \`create-ailk <target-dir>\` to scaffold first.`);
     }
+    // #7426 D13 — a spoke refuses a module it does not admit before any key
+    // read or network call (`applyModuleToScaffold` refuses it again).
+    if (addModuleSiteTopology(targetAbs) === "spoke") {
+        const refusal = spokeModuleRefusal(opts.moduleName);
+        if (refusal !== undefined)
+            throw new AddModuleRefusedError(refusal);
+    }
     const { paid } = classifyModules([opts.moduleName]);
     if (paid.length === 0) {
         throw new AddModuleRefusedError(`"${opts.moduleName}" ships with every scaffold — there is no module bundle to add`);