create-ailk 0.14.0 → 0.16.0

package/dist/lib/env-catalog.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The described row create-ailk writes for each env name a spoke-carried app
+ * reads (#7874 D10). `planEnvRows` (`declared-env.ts`) takes a name's
+ * `description` and `secret` from here; a name missing from it gets a
+ * placeholder row a reviewer sees.
+ *
+ * One plain sentence per name, drawn from the `.env.example` comments
+ * (`apps/web`, `apps/mcp`, the repo root) where they exist. The keys are
+ * exactly the non-platform names this monorepo's `apps/web` and `apps/mcp`
+ * read: `__tests__/check-declared-env.test.ts` scans both with the same
+ * scanner and fails on a name with no entry or an entry nothing reads, so a
+ * new env read in a spoke-carried app cannot ship undescribed. A
+ * `NEXT_PUBLIC_*` name is inlined into the browser bundle, so it is never a
+ * secret.
+ */
+import type { EnvCatalogEntry } from "./declared-env.js";
+export declare const ENV_CATALOG: Readonly<Record<string, EnvCatalogEntry>>;

package/dist/lib/env-catalog.js

@@ -0,0 +1,234 @@
+export const ENV_CATALOG = {
+    AILK_API_URL: {
+        description: "The hub API origin this site's server calls (forms, flows, listings). Server-only; never NEXT_PUBLIC_.",
+        secret: false,
+    },
+    AILK_AUTH_PASSWORD_RESET: {
+        description: 'Set to "1" or "true" to offer password reset once the server-side reset flow is wired.',
+        secret: false,
+    },
+    AILK_AUTH_REQUIRED: {
+        description: 'Set to "1" or "true" to require sign-in; unset leaves every route public.',
+        secret: false,
+    },
+    AILK_AUTH_SIGNUP_OPEN: {
+        description: 'Set to "1" or "true" to open public sign-up on /sign-up.',
+        secret: false,
+    },
+    AILK_AUTH_TRUSTED_PROXIES: {
+        description: "Comma-separated CIDRs of this site's edge or proxy, used to key the sign-in rate limit on the real client address.",
+        secret: false,
+    },
+    AILK_BASE_URL: {
+        description: "This site's public origin as the MCP server sees it: the same-origin check for audits and the purchase return URLs.",
+        secret: false,
+    },
+    AILK_CONTENT_ROOT: {
+        description: "Overrides the on-disk content root; defaults to <repo-root>/content.",
+        secret: false,
+    },
+    AILK_ENABLED_MODULES: {
+        description: "Comma-separated paid modules the MCP server enables; must match the API's value. Unset means none.",
+        secret: false,
+    },
+    AILK_HELP_CENTER_URL: {
+        description: "When set, the account area's help menu links to this help center.",
+        secret: false,
+    },
+    AILK_HUB_CLIENT_ID: {
+        description: "The spoke's client id at its hub (spokes register --redirect-uri <origin>/api/hub-session/callback). Server-only; set with --hub-sign-in.",
+        secret: false,
+    },
+    AILK_HUB_CLIENT_SECRET: {
+        description: "The spoke's client secret at its hub, shown once at registration. Server-only; never NEXT_PUBLIC_, never committed.",
+        secret: true,
+    },
+    AILK_HUB_SESSION_SECRET: {
+        description: "Seals this spoke's own hub-session cookie (create-ailk writes one; `openssl rand -base64 32` makes another). Never the client secret; rotating it signs every visitor out.",
+        secret: true,
+    },
+    AILK_HUB_SIGN_IN_URL: {
+        description: "The hub's WEB origin where its /sign-in lives (https:, or http: on localhost). Server-only; create-ailk writes it to .env.local.",
+        secret: false,
+    },
+    AILK_LEAD_SITE: {
+        description: "Marks which site of a hub and its spokes captured an MCP lead; unset leaves the lead unmarked.",
+        secret: false,
+    },
+    AILK_LICENSE_STORAGE_PATH: {
+        description: "The file the daily-refreshed licence key is written to; defaults to .ailk-license.jwt in the working directory.",
+        secret: false,
+    },
+    AILK_LISTING_PUBLIC_KEY: {
+        description: "The site's public listing key, read on the server when NEXT_PUBLIC_AILK_LISTING_SITE_KEY is unset. Public by design: it names a site and grants nothing.",
+        secret: false,
+    },
+    AILK_ROBOTS_DISALLOW: {
+        description: 'Comma-separated paths robots.txt disallows, e.g. "/admin/,/private/".',
+        secret: false,
+    },
+    AILK_SITE_ID: {
+        description: "The scope captured leads are stamped with; on a single-tenant install, the default workspace id.",
+        secret: false,
+    },
+    AILK_VISITOR_FORWARD_KEY: {
+        description: "This spoke's key for forwarding each visitor's IP to the hub, so the hub rate-limits per visitor. Server-only.",
+        secret: true,
+    },
+    ANALYZE: {
+        description: 'Set to "true" to run the bundle analyzer during next build.',
+        secret: false,
+    },
+    AUTH_EMAIL_FROM: {
+        description: "The From address on sign-in and password-reset mail.",
+        secret: false,
+    },
+    AUTH_EMAIL_SERVER: {
+        description: "The mail server connection that enables the email sign-in method.",
+        secret: true,
+    },
+    AUTH_EMAIL_WEBHOOK_SECRET: {
+        description: "Signs the hop that asks the API to send auth mail; must match the API's value. Deployment-only.",
+        secret: true,
+    },
+    BETTER_AUTH_SECRET: {
+        description: "Signs session cookies and email-verification tokens. Required in production.",
+        secret: true,
+    },
+    BETTER_AUTH_URL: {
+        description: "The origin Better Auth builds OAuth callbacks and password-reset links on.",
+        secret: false,
+    },
+    BETTER_STACK_HEARTBEAT_URL: {
+        description: "Better Stack heartbeat URL pinged on cron and startup; unset turns the heartbeat off.",
+        secret: true,
+    },
+    CONTENT_REVALIDATE_SECRET: {
+        description: "The shared secret /api/revalidate checks the API's publish webhook against; the same value as the API's.",
+        secret: true,
+    },
+    DATABASE_URL: {
+        description: "The database connection string, for the database content adapter and the licence-key store.",
+        secret: true,
+    },
+    GITHUB_CLIENT_ID: {
+        description: "GitHub OAuth app client id; set with GITHUB_CLIENT_SECRET to turn on GitHub sign-in.",
+        secret: false,
+    },
+    GITHUB_CLIENT_SECRET: {
+        description: "GitHub OAuth app client secret; set with GITHUB_CLIENT_ID to turn on GitHub sign-in.",
+        secret: true,
+    },
+    GOOGLE_CLIENT_ID: {
+        description: "Google OAuth client id; set with GOOGLE_CLIENT_SECRET to turn on Google sign-in.",
+        secret: false,
+    },
+    GOOGLE_CLIENT_SECRET: {
+        description: "Google OAuth client secret; set with GOOGLE_CLIENT_ID to turn on Google sign-in.",
+        secret: true,
+    },
+    MCP_ABUSE_BLOCKED_USER_AGENTS: {
+        description: "Comma-separated User-Agent substrings the MCP server blocks, beyond its built-in list.",
+        secret: false,
+    },
+    MCP_CORS_WRITE_ALLOWED_ORIGINS: {
+        description: "Comma-separated origins allowed to call the MCP write tools; empty allows no cross-origin writes.",
+        secret: false,
+    },
+    MCP_HTTP_PATH: {
+        description: "The URL path of the MCP HTTP endpoint; defaults to /mcp.",
+        secret: false,
+    },
+    MCP_HTTP_PORT: {
+        description: "The port the MCP HTTP transport binds; defaults to 8080.",
+        secret: false,
+    },
+    MCP_PUBLIC_HTTP_URL: {
+        description: "The public URL of the MCP HTTP transport, advertised by /.well-known/mcp.json.",
+        secret: false,
+    },
+    MCP_RATE_LIMIT_READ_PER_MIN: {
+        description: "Maximum MCP read-tool requests per minute per IP; defaults to 60.",
+        secret: false,
+    },
+    MCP_RATE_LIMIT_WRITE_PER_MIN: {
+        description: "Maximum MCP write-tool requests per minute per IP; defaults to 10.",
+        secret: false,
+    },
+    MCP_TRANSPORT: {
+        description: 'Which MCP transport to boot: "stdio" (the default) or "http".',
+        secret: false,
+    },
+    NEXT_PUBLIC_AILK_API_URL: {
+        description: "The API origin the browser reads on a hub. A spoke never sets it: its hub origin is server-only (AILK_API_URL).",
+        secret: false,
+    },
+    NEXT_PUBLIC_AILK_LISTING_SITE_KEY: {
+        description: "The site's public listing key, inlined at build; it switches the listicle directory on. Public by design.",
+        secret: false,
+    },
+    NEXT_PUBLIC_API_URL: {
+        description: "Deprecated fallback for the API origin; do not set it in a new deployment.",
+        secret: false,
+    },
+    NEXT_PUBLIC_BASE_URL: {
+        description: "This site's public origin, scheme and host only: canonical URLs and Stripe return URLs are built on it.",
+        secret: false,
+    },
+    NEXT_PUBLIC_DEFAULT_LOCALE: {
+        description: "The site's default locale; defaults to en.",
+        secret: false,
+    },
+    NEXT_PUBLIC_ENABLED_LOCALES: {
+        description: "The site's locales, baked at build from project.yaml; do not set by hand.",
+        secret: false,
+    },
+    NEXT_PUBLIC_GOOGLE_TAG_ID: {
+        description: "Google Analytics 4 measurement ID (G-XXXXXXXXXX); unset sends no analytics.",
+        secret: false,
+    },
+    NEXT_PUBLIC_SENTRY_DSN: {
+        description: "Sentry DSN for browser error capture; unset turns it off. Public by design.",
+        secret: false,
+    },
+    NEXT_PUBLIC_SITE_NAME: {
+        description: "The site name shown where the site's content files cannot be read (the OG image, the admin pages).",
+        secret: false,
+    },
+    NEXT_PUBLIC_SITE_WORDMARK: {
+        description: "The wordmark the generated OG image shows.",
+        secret: false,
+    },
+    NEXT_PUBLIC_THEME_COOKIE_NAME: {
+        description: "The cookie the colour-mode choice is stored in; defaults to ailk-theme.",
+        secret: false,
+    },
+    OSS_API_INTERNAL_SECRET: {
+        description: "Shared secret the /dev/purchase action sends to the API's checkout route; must equal the API's value. Server-only.",
+        secret: true,
+    },
+    SCHEDULING_CAL_LINK: {
+        description: 'Which event /meet books, as "<owner>/<event-slug>"; unset makes /meet 404.',
+        secret: false,
+    },
+    SENTRY_AUTH_TOKEN: {
+        description: "Build-time Sentry token that uploads source maps; unset skips the upload.",
+        secret: true,
+    },
+    SENTRY_DSN: {
+        description: "Sentry DSN for server-side error capture; unset turns it off.",
+        secret: false,
+    },
+    SENTRY_ORG: {
+        description: "The Sentry organisation slug used for the source-map upload.",
+        secret: false,
+    },
+    SENTRY_PROJECT: {
+        description: "The Sentry project slug used for the source-map upload.",
+        secret: false,
+    },
+    STEALTH: {
+        description: 'Set to "true" to keep the site out of search indexes (noindex headers) until launch.',
+        secret: false,
+    },
+};

package/dist/lib/extract-module-bundle.d.ts

@@ -49,6 +49,10 @@ export interface ExtractModuleBundleOptions {
     existingFilePolicy?: ExistingFilePolicy;
     /** A caller check on the manifest's `patches` (#6653 D3). See `InstallBundleTreeOptions`. */
     checkPatches?: (patches: readonly ModulePatch[]) => void;
+    /** Destinations this scaffold does not carry (#7426 D4). See `InstallBundleTreeOptions`. */
+    skip?: (destination: string) => boolean;
+    /** Where an installMap destination lands instead (#7876 D10). See `InstallBundleTreeOptions`. */
+    remapDestination?: (destination: string) => string;
 }
 /**
  * Extract a fetched module bundle into `targetDir`, merging its files onto
@@ -131,6 +135,22 @@ export interface InstallBundleTreeOptions {
      * bundle's patches to the plus-config allowlist.
      */
     checkPatches?: (patches: readonly ModulePatch[]) => void;
+    /**
+     * Scaffold-relative destinations this scaffold does not carry (#7426 D4) —
+     * a spoke passes `topology.ts` `isSpokeExcluded`. A skipped destination is
+     * never written: a plain file or an `installMap` destination it names is
+     * dropped, and so is a `patches` entry whose target it names. It is NOT an
+     * ownership claim, and a skipped patch target is not a missing one. Every
+     * entry is still validated as before. Absent ⟹ nothing is skipped.
+     */
+    skip?: (destination: string) => boolean;
+    /**
+     * Where an `installMap` destination lands instead (#7876 D10) — a spoke
+     * passes `topology.ts` `spokeDestination`. Applied after the installMap is
+     * validated and before `skip`; a remapped destination that leaves the
+     * target refuses the tree. Absent ⟹ every destination is unchanged.
+     */
+    remapDestination?: (destination: string) => string;
 }
 /** See `InstallBundleTreeOptions.existingFilePolicy`. */
 export type ExistingFilePolicy = "overwrite" | "skip-existing";

package/dist/lib/extract-module-bundle.js

@@ -385,6 +385,24 @@ function validateLayerOwnership(destinations, ownership, subject, isTemplate, pa
         }
     }
 }
+/** Every regular file under `srcRoot`, as a `/`-separated relative path. */
+function stagedFiles(srcRoot) {
+    const out = [];
+    const stack = [srcRoot];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const srcPath = join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(srcPath);
+            else if (entry.isFile())
+                out.push(relative(srcRoot, srcPath).split(sep).join("/"));
+        }
+    }
+    return out;
+}
 /**
  * Every scaffold-relative destination this tree will write: each unmapped
  * staged file at its own path (exactly the set `copyTree` lands, same walk,
@@ -457,6 +475,10 @@ export async function extractModuleBundle(options) {
             ...(options.checkPatches !== undefined
                 ? { checkPatches: options.checkPatches }
                 : {}),
+            ...(options.skip !== undefined ? { skip: options.skip } : {}),
+            ...(options.remapDestination !== undefined
+                ? { remapDestination: options.remapDestination }
+                : {}),
         });
     }
     finally {
@@ -484,13 +506,32 @@ export function installBundleTree(options) {
     const manifest = isTemplate
         ? readAilkTemplateManifest(sourceRoot, name, templateRequires, templateExtends)
         : readAilkModuleManifest(sourceRoot);
-    const installMap = manifest?.installMap ?? {};
-    validateInstallMap(installMap, sourceRoot, targetAbs, subject, isTemplate);
+    const declaredInstallMap = manifest?.installMap ?? {};
+    validateInstallMap(declaredInstallMap, sourceRoot, targetAbs, subject, isTemplate);
+    // #7876 D10 — a spoke lands some destinations elsewhere (its module flows
+    // become declared data). The remapped destination passes the same
+    // containment rule `validateInstallMap` applies, or the tree is refused.
+    const remap = options.remapDestination;
+    const remappedInstallMap = {};
+    for (const [source, declared] of Object.entries(declaredInstallMap)) {
+        const destination = remap !== undefined ? remap(declared) : declared;
+        if (destination !== declared &&
+            (hasUnsafeSegment(destination) ||
+                !isPathInside(targetAbs, resolve(targetAbs, destination)))) {
+            throw new Error(`${subject}: remapped installMap destination "${destination}" resolves outside target`);
+        }
+        remappedInstallMap[source] = destination;
+    }
+    // #7426 D4 — a destination the scaffold does not carry is dropped here,
+    // after validation, so a spoke never receives it and never records it.
+    const skip = options.skip;
+    const isSkipped = (destination) => skip !== undefined && skip(normalize(destination).split(sep).join("/"));
+    const installMap = Object.fromEntries(Object.entries(remappedInstallMap).filter(([, destination]) => !isSkipped(destination)));
     // patches validation (spec 5418 § 3 D6) runs at the same point, before
     // any copy — a bad target/kind/op rejects the whole tree with nothing
     // written to targetDir, same posture as installMap and the tar-entry
     // validation above.
-    const patches = manifest?.patches ?? [];
+    const declaredPatches = manifest?.patches ?? [];
     // #5514 (Medium) — content, never code (spec 5462 D9/D16): every `patches`
     // kind either edits a code file directly (`next-config`, `jest-config`)
     // or a manifest a template has no legitimate reason to touch
@@ -498,10 +539,13 @@ export function installBundleTree(options) {
     // content template) — no shipped template uses it, so the simplest
     // fail-closed reading refuses it outright rather than enumerating an
     // allowed subset that has no current user.
-    if (isTemplate && patches.length > 0) {
+    if (isTemplate && declaredPatches.length > 0) {
         throw new Error(`${subject}: a template must not carry patches — content, never code (spec 5462 D9)`);
     }
-    validatePatches(patches, targetAbs, subject);
+    // Every declared patch is validated, skipped or not (#7426 D4), exactly as
+    // the installMap is above; only then are the skipped ones dropped.
+    validatePatches(declaredPatches, targetAbs, subject);
+    const patches = declaredPatches.filter((patch) => !isSkipped(patch.target));
     options.checkPatches?.(patches);
     // The exclusion set copyTree/the content-only guard both use — built from
     // NORMALIZED installMap keys (#5514) so a "./x" key excludes the same
@@ -512,7 +556,10 @@ export function installBundleTree(options) {
     const excluded = new Set([
         AILK_TEMPLATE_JSON,
         AILK_MODULE_JSON,
-        ...Object.keys(installMap).map((key) => normalize(key).split(sep).join("/")),
+        ...Object.keys(declaredInstallMap).map((key) => normalize(key).split(sep).join("/")),
+        // A plain file lands at its own staged path, so that path IS its
+        // destination: a skipped one is excluded from the copy like a mapped source.
+        ...(skip !== undefined ? stagedFiles(sourceRoot).filter(isSkipped) : []),
     ]);
     if (isTemplate) {
         // #6658 D7 — a template's roster of record lands as JSON, through its

package/dist/lib/license-key-files.d.ts

@@ -20,5 +20,10 @@ export declare function appendLine(text: string, line: string): string;
  * `apps/api/.env` line (0600, other lines kept), and a `.gitignore` entry for
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
+ *
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
+ * `apps/api`, so it keeps the key in `ailk.key` alone.
  */
-export declare function writeLicenseKeyFiles(dir: string, key: string): void;
+export declare function writeLicenseKeyFiles(dir: string, key: string, opts?: {
+    apiEnv?: boolean;
+}): void;

package/dist/lib/license-key-files.js

@@ -85,13 +85,18 @@ function upsertEnvLine(existing, key) {
  * `apps/api/.env` line (0600, other lines kept), and a `.gitignore` entry for
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
+ *
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
+ * `apps/api`, so it keeps the key in `ailk.key` alone.
  */
-export function writeLicenseKeyFiles(dir, key) {
+export function writeLicenseKeyFiles(dir, key, opts = {}) {
     assertLicenseKeyShape(key);
     writeOwnerOnly(join(dir, LICENSE_KEY_FILE), `${key}\n`);
-    const envPath = join(dir, LICENSE_ENV_FILE);
-    const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
-    writeOwnerOnly(envPath, upsertEnvLine(env, key));
+    if (opts.apiEnv !== false) {
+        const envPath = join(dir, LICENSE_ENV_FILE);
+        const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+        writeOwnerOnly(envPath, upsertEnvLine(env, key));
+    }
     const ignorePath = join(dir, ".gitignore");
     const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
     const covered = ignore

package/dist/lib/module-tier.d.ts

@@ -30,6 +30,8 @@ export declare const ADD_ONS: readonly ModuleName[];
  * adds it without trimming, exactly like an add-on.
  */
 export declare const OPT_IN_MODULES: readonly ModuleName[];
+/** Whether naming `m` in `--modules` adds it without trimming the level default. */
+export declare function isAddition(m: ModuleName): boolean;
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —
  * every list is `RECOGNIZED_MODULES.filter(...)`, so declaration order is

package/dist/lib/module-tier.js

@@ -54,6 +54,10 @@ export const OPT_IN_MODULES = ["workspace"];
 const PRO_PLUS_MODULES = ["multi-tenant"];
 /** Named modules that never trim the level default when composing a set (D2). */
 const ADDITIONS = [...ADD_ONS, ...OPT_IN_MODULES];
+/** Whether naming `m` in `--modules` adds it without trimming the level default. */
+export function isAddition(m) {
+    return ADDITIONS.includes(m);
+}
 const PRO_EXCLUDED = new Set([...ADDITIONS, ...PRO_PLUS_MODULES]);
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —

package/dist/module-architecture.d.ts

@@ -83,6 +83,15 @@ export interface PageRosterRow {
  * scaffold carries (#6940).
  */
 export interface ModuleSlice {
+    /**
+     * Admits the module on a spoke (`create-ailk --topology spoke`, #7426 D7).
+     * `true` → a spoke may carry it, and its bundle installs through the spoke
+     * filter (`topology.ts` `isSpokeExcluded`), so any `apps/api` or
+     * `database` part it carries is dropped. Unset → refused on a spoke.
+     * `topology.ts` `spokeModules()` reads it; a sibling issue admits its
+     * module by setting it here, never in a second list.
+     */
+    spoke?: true;
     /**
      * The paid UI package base-tree code loads through
      * `apps/web/lib/paid-sections.generated.ts` (#7536). Present → one row in the

package/dist/module-architecture.js

@@ -150,6 +150,23 @@ export const ARCHITECTURE_BASE = {
         },
     ],
 };
+/**
+ * The member area's apps/api files (#7877 D9, D11), co-owned by `workspace`
+ * and `multi-tenant`: server.ts registers all five routes under the
+ * `workspace || multi-tenant` disjunction, so both bundles must deliver every
+ * file behind it — the three operator route files, the two member route
+ * files, the member resolution (`services/member-area.ts`) and the member
+ * data boundary (`lib/member-store.ts`).
+ */
+const MEMBER_AREA_FILES = [
+    "apps/api/src/routes/workspaces/pieces.ts",
+    "apps/api/src/routes/workspaces/plan.ts",
+    "apps/api/src/routes/workspaces/messages-out.ts",
+    "apps/api/src/routes/member/pieces.ts",
+    "apps/api/src/routes/member/messages.ts",
+    "apps/api/src/services/member-area.ts",
+    "apps/api/src/lib/member-store.ts",
+];
 /**
  * The workspace asset store (#5854), CO-OWNED by the `workspace` and
  * `multi-tenant` slices.
@@ -206,6 +223,7 @@ function payloadPaths(kind, name, destRoot) {
 export const MODULE_SLICES = {
     // ── marketing — thin presentation module (the default) ───────────────────
     marketing: {
+        spoke: true,
         webImports: [
             WEB_AUTH_ADAPTER_IMPORT,
             "packages/content-adapters",
@@ -287,6 +305,7 @@ export const MODULE_SLICES = {
     },
     // ── docs-blog — Pro module: both fumadocs surfaces (D-46) ────────────────
     "docs-blog": {
+        spoke: true,
         webImports: [WEB_AUTH_ADAPTER_IMPORT, "packages/fumadocs-schema"],
         packages: {
             "fumadocs-schema": {
@@ -797,6 +816,15 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // #852 D8 — the People reads: the same workspace||multi-tenant gate and
+            // the same tenant-db.ts import, co-owned with `workspace` for the same
+            // reason.
+            "apps/api/src/routes/workspaces/people.ts",
+            // #7877 D9, D11 — the member area: the operator's routes and the member
+            // reads register under the same workspace||multi-tenant gate, so each
+            // file behind it — the routes, the member resolution and the member
+            // data boundary — is co-owned with `workspace`, as people.ts is.
+            ...MEMBER_AREA_FILES,
             // #7399 — the two siblings #6216 left `workspace`-only. They register
             // under that same `workspace || multi-tenant` gate, so a scaffold with
             // `multi-tenant` and without `workspace` loaded them with no file behind
@@ -945,6 +973,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // Co-owned with `multi-tenant` (#852 D8), as the reads above.
+            "apps/api/src/routes/workspaces/people.ts",
+            // Co-owned with `multi-tenant` (#7877 D9, D11) — see that slice's entry.
+            ...MEMBER_AREA_FILES,
             // Co-owned with `multi-tenant` (#5853) — see that slice's entry.
             "apps/api/src/routes/workspaces/content.ts",
             ...ASSET_STORE_FILES,
@@ -1003,6 +1035,15 @@ export const MODULE_SLICES = {
     // scheduling-bearing scaffold's `apps/api` really does contain the billing,
     // checkout and email routes those imports are for.
     scheduling: {
+        // #7872 — admitted on a spoke. Its bundle installs through the spoke
+        // filter (`isSpokeExcluded`), which drops every destination under
+        // apps/api or database — the routes, services/scheduling (the provider
+        // client and the only reader of the credential), the Cal.com webhook —
+        // and the (authed)/appointments page. What lands is the web tier: the
+        // three apps/web/app/[locale]/meet pages and the @working-theory/ui-scheduling
+        // dependency (`patches` below), plus the three MCP tools when apps/mcp is
+        // kept. Every booking call then reaches the hub with the spoke key.
+        spoke: true,
         apps: {
             api: {
                 path: "apps/api",
@@ -1339,6 +1380,33 @@ export const MODULE_SLICES = {
     // cannot place an unreached file either) is unchanged and still governs
     // where all eleven live.
     "signal-collectors": {
+        // #7876 D8 — admitted on a spoke, so a Pro spoke carries the flow
+        // stepper and its flows reach the hub with the spoke key. Its bundle
+        // installs through the spoke filter (`isSpokeExcluded`) and the D10
+        // remap (`spokeDestination`); every part of the slice lands as follows:
+        //
+        //   apps/web/app/[locale]/flows/** (its `flows` surface)              lands
+        //   apps/web/app/[locale]/reports/**, the ReportPage + ReportsList seeds
+        //                                  dropped (`SPOKE_EXCLUDED_MODULE_PATHS`,
+        //                                  2026-10-09): the reader links a report's
+        //                                  bytes on the hub through
+        //                                  NEXT_PUBLIC_AILK_API_URL, refused on a
+        //                                  spoke (#7874); deliverables are hub-side
+        //   ownedFiles under apps/api/**                       dropped (removed root)
+        //   ownedFiles under (authed)/waitlist/**              dropped (removal seed)
+        //   ownedFiles projects/apply/ListingApplicationClient lands; no route mounts it
+        //   ownedFiles under apps/mcp/src/tools/**             lands when apps/mcp is kept
+        //   installMap content/en/** (12 seeds)    lands, but for the five report seeds
+        //   installMap database/flows/{referral,fit-check}.flow.json
+        //                                  remapped to flows/<name>.json — declared
+        //                                  data `create-ailk seed-flows` sends
+        //   installMap database/waitlist/**.experiment.json    dropped (removed root):
+        //                                  a register is hub-side state
+        //   installMap apps/web/public/reports/**, reports/**  lands
+        //   patches — @working-theory/ui-signal-collectors     lands
+        //
+        // It stays a Pro module: a keyless spoke carries no flows.
+        spoke: true,
         paidSectionsPackage: "@working-theory/ui-signal-collectors",
         ownedFiles: [
             "apps/api/src/routes/flows/index.ts",
@@ -1388,6 +1456,10 @@ export const MODULE_SLICES = {
             "apps/api/src/bin/deliverable-upload.ts",
             "apps/api/src/bin/session-retention-sweep.ts",
             "apps/api/src/bin/seed-presets.ts",
+            // #7844 D7 — the operator flow-copy CLI and its service: flows code by
+            // subject, and a Free scaffold carries no flows.
+            "apps/api/src/bin/flows-copy.ts",
+            "apps/api/src/services/flow-copy.ts",
             "apps/api/src/bin/listing-csv-sweep.ts",
             "apps/api/src/bin/followup-sweep.ts",
             "apps/api/src/bin/seed-waitlist-experiments.ts",
@@ -1649,6 +1721,16 @@ export const MODULE_SLICES = {
     // `lib/stripe.ts` and the webhook receiver this module owns — declared
     // here, not engineered around.
     commerce: {
+        // #7838 — admitted on a spoke. Its bundle installs through the spoke
+        // filter (`isSpokeExcluded`), which drops every destination under
+        // apps/api or database and the web files that call the hub's own
+        // checkout (`SPOKE_HUB_CHECKOUT_SEEDS`: flows/[slug]/checkout.actions.ts,
+        // the flow results pages, dev/purchase — spoke-intake Rule 3). What lands
+        // is the scaffold-commerce skill, the commerce-boundary rule and the
+        // @working-theory/ui-commerce dependency (`patches` below); the spoke's own
+        // checkout — two routes, checkout-config.ts and two return pages — is
+        // rendered by create-ailk (`spoke-checkout.ts`), not carried here.
+        spoke: true,
         paidSectionsPackage: "@working-theory/ui-commerce",
         apps: {
             api: {

package/dist/parse-args.d.ts

@@ -26,6 +26,15 @@ export declare const RESERVED_SHAPES: readonly ["local-business-product"];
 /** The `--design` vocabulary (#6754 D1) — `STARTER_DESIGNS`, pinned by test. */
 export declare const RECOGNIZED_DESIGNS: readonly ["standard", "minimalism"];
 export type DesignName = (typeof RECOGNIZED_DESIGNS)[number];
+/**
+ * The `--topology` vocabulary (#7426 D1) — orthogonal to `--shape`: any shape
+ * can be scaffolded as either. Declared here rather than imported from
+ * `topology.ts` for the reason `RECOGNIZED_MODULES` is: that module reads
+ * `MODULE_SLICES`, and importing it here closes a runtime cycle through
+ * `lib/module-tier.ts`. `spoke-topology.test.ts` pins the two lists equal.
+ */
+export declare const RECOGNIZED_TOPOLOGIES: readonly ["hub", "spoke"];
+export type TopologyName = (typeof RECOGNIZED_TOPOLOGIES)[number];
 export interface CliOptions {
     /** Positional target directory (the dir to scaffold into). Optional only
      *  when `help` or `version` is set. */
@@ -94,6 +103,24 @@ export interface CliOptions {
      * flag is.
      */
     license?: string;
+    /**
+     * The scaffold's topology (`--topology`, #7426 D1). `hub` — the default,
+     * and the only value before #7426 — unless `--topology spoke`.
+     */
+    topology: TopologyName;
+    /**
+     * The raw `--hub-url` value (#7426 D2), present only on a spoke run that
+     * passed it. `scaffold()` validates and normalizes it, falling back to
+     * `AILK_API_URL`.
+     */
+    hubUrl?: string;
+    /** Spoke only: `false` with `--without-mcp` (#7426 D3), else `true`. */
+    mcp?: boolean;
+    /**
+     * Spoke only: the raw `--hub-sign-in` value (#7894 D1) — the hub's web
+     * origin this spoke signs visitors in at. `scaffold()` validates it.
+     */
+    hubSignIn?: string;
 }
 export declare class ParseError extends Error {
     constructor(message: string);