create-ailk 0.15.0 → 0.17.0

package/dist/lib/env-catalog.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The described row create-ailk writes for each env name a spoke-carried app
+ * reads (#7874 D10). `planEnvRows` (`declared-env.ts`) takes a name's
+ * `description` and `secret` from here; a name missing from it gets a
+ * placeholder row a reviewer sees.
+ *
+ * One plain sentence per name, drawn from the `.env.example` comments
+ * (`apps/web`, `apps/mcp`, the repo root) where they exist. The keys are
+ * exactly the non-platform names this monorepo's `apps/web` and `apps/mcp`
+ * read: `__tests__/check-declared-env.test.ts` scans both with the same
+ * scanner and fails on a name with no entry or an entry nothing reads, so a
+ * new env read in a spoke-carried app cannot ship undescribed. A
+ * `NEXT_PUBLIC_*` name is inlined into the browser bundle, so it is never a
+ * secret.
+ */
+import type { EnvCatalogEntry } from "./declared-env.js";
+export declare const ENV_CATALOG: Readonly<Record<string, EnvCatalogEntry>>;

package/dist/lib/env-catalog.js

@@ -0,0 +1,234 @@
+export const ENV_CATALOG = {
+    AILK_API_URL: {
+        description: "The hub API origin this site's server calls (forms, flows, listings). Server-only; never NEXT_PUBLIC_.",
+        secret: false,
+    },
+    AILK_AUTH_PASSWORD_RESET: {
+        description: 'Set to "1" or "true" to offer password reset once the server-side reset flow is wired.',
+        secret: false,
+    },
+    AILK_AUTH_REQUIRED: {
+        description: 'Set to "1" or "true" to require sign-in; unset leaves every route public.',
+        secret: false,
+    },
+    AILK_AUTH_SIGNUP_OPEN: {
+        description: 'Set to "1" or "true" to open public sign-up on /sign-up.',
+        secret: false,
+    },
+    AILK_AUTH_TRUSTED_PROXIES: {
+        description: "Comma-separated CIDRs of this site's edge or proxy, used to key the sign-in rate limit on the real client address.",
+        secret: false,
+    },
+    AILK_BASE_URL: {
+        description: "This site's public origin as the MCP server sees it: the same-origin check for audits and the purchase return URLs.",
+        secret: false,
+    },
+    AILK_CONTENT_ROOT: {
+        description: "Overrides the on-disk content root; defaults to <repo-root>/content.",
+        secret: false,
+    },
+    AILK_ENABLED_MODULES: {
+        description: "Comma-separated paid modules the MCP server enables; must match the API's value. Unset means none.",
+        secret: false,
+    },
+    AILK_HELP_CENTER_URL: {
+        description: "When set, the account area's help menu links to this help center.",
+        secret: false,
+    },
+    AILK_HUB_CLIENT_ID: {
+        description: "The spoke's client id at its hub (spokes register --redirect-uri <origin>/api/hub-session/callback). Server-only; set with --hub-sign-in.",
+        secret: false,
+    },
+    AILK_HUB_CLIENT_SECRET: {
+        description: "The spoke's client secret at its hub, shown once at registration. Server-only; never NEXT_PUBLIC_, never committed.",
+        secret: true,
+    },
+    AILK_HUB_SESSION_SECRET: {
+        description: "Seals this spoke's own hub-session cookie (create-ailk writes one; `openssl rand -base64 32` makes another). Never the client secret; rotating it signs every visitor out.",
+        secret: true,
+    },
+    AILK_HUB_SIGN_IN_URL: {
+        description: "The hub's WEB origin where its /sign-in lives (https:, or http: on localhost). Server-only; create-ailk writes it to .env.local.",
+        secret: false,
+    },
+    AILK_LEAD_SITE: {
+        description: "Marks which site of a hub and its spokes captured an MCP lead; unset leaves the lead unmarked.",
+        secret: false,
+    },
+    AILK_LICENSE_STORAGE_PATH: {
+        description: "The file the daily-refreshed licence key is written to; defaults to .ailk-license.jwt in the working directory.",
+        secret: false,
+    },
+    AILK_LISTING_PUBLIC_KEY: {
+        description: "The site's public listing key, read on the server when NEXT_PUBLIC_AILK_LISTING_SITE_KEY is unset. Public by design: it names a site and grants nothing.",
+        secret: false,
+    },
+    AILK_ROBOTS_DISALLOW: {
+        description: 'Comma-separated paths robots.txt disallows, e.g. "/admin/,/private/".',
+        secret: false,
+    },
+    AILK_SITE_ID: {
+        description: "The scope captured leads are stamped with; on a single-tenant install, the default workspace id.",
+        secret: false,
+    },
+    AILK_VISITOR_FORWARD_KEY: {
+        description: "This spoke's key for forwarding each visitor's IP to the hub, so the hub rate-limits per visitor. Server-only.",
+        secret: true,
+    },
+    ANALYZE: {
+        description: 'Set to "true" to run the bundle analyzer during next build.',
+        secret: false,
+    },
+    AUTH_EMAIL_FROM: {
+        description: "The From address on sign-in and password-reset mail.",
+        secret: false,
+    },
+    AUTH_EMAIL_SERVER: {
+        description: "The mail server connection that enables the email sign-in method.",
+        secret: true,
+    },
+    AUTH_EMAIL_WEBHOOK_SECRET: {
+        description: "Signs the hop that asks the API to send auth mail; must match the API's value. Deployment-only.",
+        secret: true,
+    },
+    BETTER_AUTH_SECRET: {
+        description: "Signs session cookies and email-verification tokens. Required in production.",
+        secret: true,
+    },
+    BETTER_AUTH_URL: {
+        description: "The origin Better Auth builds OAuth callbacks and password-reset links on.",
+        secret: false,
+    },
+    BETTER_STACK_HEARTBEAT_URL: {
+        description: "Better Stack heartbeat URL pinged on cron and startup; unset turns the heartbeat off.",
+        secret: true,
+    },
+    CONTENT_REVALIDATE_SECRET: {
+        description: "The shared secret /api/revalidate checks the API's publish webhook against; the same value as the API's.",
+        secret: true,
+    },
+    DATABASE_URL: {
+        description: "The database connection string, for the database content adapter and the licence-key store.",
+        secret: true,
+    },
+    GITHUB_CLIENT_ID: {
+        description: "GitHub OAuth app client id; set with GITHUB_CLIENT_SECRET to turn on GitHub sign-in.",
+        secret: false,
+    },
+    GITHUB_CLIENT_SECRET: {
+        description: "GitHub OAuth app client secret; set with GITHUB_CLIENT_ID to turn on GitHub sign-in.",
+        secret: true,
+    },
+    GOOGLE_CLIENT_ID: {
+        description: "Google OAuth client id; set with GOOGLE_CLIENT_SECRET to turn on Google sign-in.",
+        secret: false,
+    },
+    GOOGLE_CLIENT_SECRET: {
+        description: "Google OAuth client secret; set with GOOGLE_CLIENT_ID to turn on Google sign-in.",
+        secret: true,
+    },
+    MCP_ABUSE_BLOCKED_USER_AGENTS: {
+        description: "Comma-separated User-Agent substrings the MCP server blocks, beyond its built-in list.",
+        secret: false,
+    },
+    MCP_CORS_WRITE_ALLOWED_ORIGINS: {
+        description: "Comma-separated origins allowed to call the MCP write tools; empty allows no cross-origin writes.",
+        secret: false,
+    },
+    MCP_HTTP_PATH: {
+        description: "The URL path of the MCP HTTP endpoint; defaults to /mcp.",
+        secret: false,
+    },
+    MCP_HTTP_PORT: {
+        description: "The port the MCP HTTP transport binds; defaults to 8080.",
+        secret: false,
+    },
+    MCP_PUBLIC_HTTP_URL: {
+        description: "The public URL of the MCP HTTP transport, advertised by /.well-known/mcp.json.",
+        secret: false,
+    },
+    MCP_RATE_LIMIT_READ_PER_MIN: {
+        description: "Maximum MCP read-tool requests per minute per IP; defaults to 60.",
+        secret: false,
+    },
+    MCP_RATE_LIMIT_WRITE_PER_MIN: {
+        description: "Maximum MCP write-tool requests per minute per IP; defaults to 10.",
+        secret: false,
+    },
+    MCP_TRANSPORT: {
+        description: 'Which MCP transport to boot: "stdio" (the default) or "http".',
+        secret: false,
+    },
+    NEXT_PUBLIC_AILK_API_URL: {
+        description: "The API origin the browser reads on a hub. A spoke never sets it: its hub origin is server-only (AILK_API_URL).",
+        secret: false,
+    },
+    NEXT_PUBLIC_AILK_LISTING_SITE_KEY: {
+        description: "The site's public listing key, inlined at build; it switches the listicle directory on. Public by design.",
+        secret: false,
+    },
+    NEXT_PUBLIC_API_URL: {
+        description: "Deprecated fallback for the API origin; do not set it in a new deployment.",
+        secret: false,
+    },
+    NEXT_PUBLIC_BASE_URL: {
+        description: "This site's public origin, scheme and host only: canonical URLs and Stripe return URLs are built on it.",
+        secret: false,
+    },
+    NEXT_PUBLIC_DEFAULT_LOCALE: {
+        description: "The site's default locale; defaults to en.",
+        secret: false,
+    },
+    NEXT_PUBLIC_ENABLED_LOCALES: {
+        description: "The site's locales, baked at build from project.yaml; do not set by hand.",
+        secret: false,
+    },
+    NEXT_PUBLIC_GOOGLE_TAG_ID: {
+        description: "Google Analytics 4 measurement ID (G-XXXXXXXXXX); unset sends no analytics.",
+        secret: false,
+    },
+    NEXT_PUBLIC_SENTRY_DSN: {
+        description: "Sentry DSN for browser error capture; unset turns it off. Public by design.",
+        secret: false,
+    },
+    NEXT_PUBLIC_SITE_NAME: {
+        description: "The site name shown where the site's content files cannot be read (the OG image, the admin pages).",
+        secret: false,
+    },
+    NEXT_PUBLIC_SITE_WORDMARK: {
+        description: "The wordmark the generated OG image shows.",
+        secret: false,
+    },
+    NEXT_PUBLIC_THEME_COOKIE_NAME: {
+        description: "The cookie the colour-mode choice is stored in; defaults to ailk-theme.",
+        secret: false,
+    },
+    OSS_API_INTERNAL_SECRET: {
+        description: "Shared secret the /dev/purchase action sends to the API's checkout route; must equal the API's value. Server-only.",
+        secret: true,
+    },
+    SCHEDULING_CAL_LINK: {
+        description: 'Which event /meet books, as "<owner>/<event-slug>"; unset makes /meet 404.',
+        secret: false,
+    },
+    SENTRY_AUTH_TOKEN: {
+        description: "Build-time Sentry token that uploads source maps; unset skips the upload.",
+        secret: true,
+    },
+    SENTRY_DSN: {
+        description: "Sentry DSN for server-side error capture; unset turns it off.",
+        secret: false,
+    },
+    SENTRY_ORG: {
+        description: "The Sentry organisation slug used for the source-map upload.",
+        secret: false,
+    },
+    SENTRY_PROJECT: {
+        description: "The Sentry project slug used for the source-map upload.",
+        secret: false,
+    },
+    STEALTH: {
+        description: 'Set to "true" to keep the site out of search indexes (noindex headers) until launch.',
+        secret: false,
+    },
+};

package/dist/lib/extract-module-bundle.d.ts

@@ -51,6 +51,8 @@ export interface ExtractModuleBundleOptions {
     checkPatches?: (patches: readonly ModulePatch[]) => void;
     /** Destinations this scaffold does not carry (#7426 D4). See `InstallBundleTreeOptions`. */
     skip?: (destination: string) => boolean;
+    /** Where an installMap destination lands instead (#7876 D10). See `InstallBundleTreeOptions`. */
+    remapDestination?: (destination: string) => string;
 }
 /**
  * Extract a fetched module bundle into `targetDir`, merging its files onto
@@ -142,6 +144,13 @@ export interface InstallBundleTreeOptions {
      * entry is still validated as before. Absent ⟹ nothing is skipped.
      */
     skip?: (destination: string) => boolean;
+    /**
+     * Where an `installMap` destination lands instead (#7876 D10) — a spoke
+     * passes `topology.ts` `spokeDestination`. Applied after the installMap is
+     * validated and before `skip`; a remapped destination that leaves the
+     * target refuses the tree. Absent ⟹ every destination is unchanged.
+     */
+    remapDestination?: (destination: string) => string;
 }
 /** See `InstallBundleTreeOptions.existingFilePolicy`. */
 export type ExistingFilePolicy = "overwrite" | "skip-existing";

package/dist/lib/extract-module-bundle.js

@@ -476,6 +476,9 @@ export async function extractModuleBundle(options) {
                 ? { checkPatches: options.checkPatches }
                 : {}),
             ...(options.skip !== undefined ? { skip: options.skip } : {}),
+            ...(options.remapDestination !== undefined
+                ? { remapDestination: options.remapDestination }
+                : {}),
         });
     }
     finally {
@@ -505,11 +508,25 @@ export function installBundleTree(options) {
         : readAilkModuleManifest(sourceRoot);
     const declaredInstallMap = manifest?.installMap ?? {};
     validateInstallMap(declaredInstallMap, sourceRoot, targetAbs, subject, isTemplate);
+    // #7876 D10 — a spoke lands some destinations elsewhere (its module flows
+    // become declared data). The remapped destination passes the same
+    // containment rule `validateInstallMap` applies, or the tree is refused.
+    const remap = options.remapDestination;
+    const remappedInstallMap = {};
+    for (const [source, declared] of Object.entries(declaredInstallMap)) {
+        const destination = remap !== undefined ? remap(declared) : declared;
+        if (destination !== declared &&
+            (hasUnsafeSegment(destination) ||
+                !isPathInside(targetAbs, resolve(targetAbs, destination)))) {
+            throw new Error(`${subject}: remapped installMap destination "${destination}" resolves outside target`);
+        }
+        remappedInstallMap[source] = destination;
+    }
     // #7426 D4 — a destination the scaffold does not carry is dropped here,
     // after validation, so a spoke never receives it and never records it.
     const skip = options.skip;
     const isSkipped = (destination) => skip !== undefined && skip(normalize(destination).split(sep).join("/"));
-    const installMap = Object.fromEntries(Object.entries(declaredInstallMap).filter(([, destination]) => !isSkipped(destination)));
+    const installMap = Object.fromEntries(Object.entries(remappedInstallMap).filter(([, destination]) => !isSkipped(destination)));
     // patches validation (spec 5418 § 3 D6) runs at the same point, before
     // any copy — a bad target/kind/op rejects the whole tree with nothing
     // written to targetDir, same posture as installMap and the tar-entry

package/dist/lib/module-tier.d.ts

@@ -30,6 +30,8 @@ export declare const ADD_ONS: readonly ModuleName[];
  * adds it without trimming, exactly like an add-on.
  */
 export declare const OPT_IN_MODULES: readonly ModuleName[];
+/** Whether naming `m` in `--modules` adds it without trimming the level default. */
+export declare function isAddition(m: ModuleName): boolean;
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —
  * every list is `RECOGNIZED_MODULES.filter(...)`, so declaration order is

package/dist/lib/module-tier.js

@@ -54,6 +54,10 @@ export const OPT_IN_MODULES = ["workspace"];
 const PRO_PLUS_MODULES = ["multi-tenant"];
 /** Named modules that never trim the level default when composing a set (D2). */
 const ADDITIONS = [...ADD_ONS, ...OPT_IN_MODULES];
+/** Whether naming `m` in `--modules` adds it without trimming the level default. */
+export function isAddition(m) {
+    return ADDITIONS.includes(m);
+}
 const PRO_EXCLUDED = new Set([...ADDITIONS, ...PRO_PLUS_MODULES]);
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —

package/dist/module-architecture.js

@@ -150,6 +150,23 @@ export const ARCHITECTURE_BASE = {
         },
     ],
 };
+/**
+ * The member area's apps/api files (#7877 D9, D11), co-owned by `workspace`
+ * and `multi-tenant`: server.ts registers all five routes under the
+ * `workspace || multi-tenant` disjunction, so both bundles must deliver every
+ * file behind it — the three operator route files, the two member route
+ * files, the member resolution (`services/member-area.ts`) and the member
+ * data boundary (`lib/member-store.ts`).
+ */
+const MEMBER_AREA_FILES = [
+    "apps/api/src/routes/workspaces/pieces.ts",
+    "apps/api/src/routes/workspaces/plan.ts",
+    "apps/api/src/routes/workspaces/messages-out.ts",
+    "apps/api/src/routes/member/pieces.ts",
+    "apps/api/src/routes/member/messages.ts",
+    "apps/api/src/services/member-area.ts",
+    "apps/api/src/lib/member-store.ts",
+];
 /**
  * The workspace asset store (#5854), CO-OWNED by the `workspace` and
  * `multi-tenant` slices.
@@ -799,6 +816,15 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // #852 D8 — the People reads: the same workspace||multi-tenant gate and
+            // the same tenant-db.ts import, co-owned with `workspace` for the same
+            // reason.
+            "apps/api/src/routes/workspaces/people.ts",
+            // #7877 D9, D11 — the member area: the operator's routes and the member
+            // reads register under the same workspace||multi-tenant gate, so each
+            // file behind it — the routes, the member resolution and the member
+            // data boundary — is co-owned with `workspace`, as people.ts is.
+            ...MEMBER_AREA_FILES,
             // #7399 — the two siblings #6216 left `workspace`-only. They register
             // under that same `workspace || multi-tenant` gate, so a scaffold with
             // `multi-tenant` and without `workspace` loaded them with no file behind
@@ -947,6 +973,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // Co-owned with `multi-tenant` (#852 D8), as the reads above.
+            "apps/api/src/routes/workspaces/people.ts",
+            // Co-owned with `multi-tenant` (#7877 D9, D11) — see that slice's entry.
+            ...MEMBER_AREA_FILES,
             // Co-owned with `multi-tenant` (#5853) — see that slice's entry.
             "apps/api/src/routes/workspaces/content.ts",
             ...ASSET_STORE_FILES,
@@ -1005,6 +1035,15 @@ export const MODULE_SLICES = {
     // scheduling-bearing scaffold's `apps/api` really does contain the billing,
     // checkout and email routes those imports are for.
     scheduling: {
+        // #7872 — admitted on a spoke. Its bundle installs through the spoke
+        // filter (`isSpokeExcluded`), which drops every destination under
+        // apps/api or database — the routes, services/scheduling (the provider
+        // client and the only reader of the credential), the Cal.com webhook —
+        // and the (authed)/appointments page. What lands is the web tier: the
+        // three apps/web/app/[locale]/meet pages and the @working-theory/ui-scheduling
+        // dependency (`patches` below), plus the three MCP tools when apps/mcp is
+        // kept. Every booking call then reaches the hub with the spoke key.
+        spoke: true,
         apps: {
             api: {
                 path: "apps/api",
@@ -1341,6 +1380,33 @@ export const MODULE_SLICES = {
     // cannot place an unreached file either) is unchanged and still governs
     // where all eleven live.
     "signal-collectors": {
+        // #7876 D8 — admitted on a spoke, so a Pro spoke carries the flow
+        // stepper and its flows reach the hub with the spoke key. Its bundle
+        // installs through the spoke filter (`isSpokeExcluded`) and the D10
+        // remap (`spokeDestination`); every part of the slice lands as follows:
+        //
+        //   apps/web/app/[locale]/flows/** (its `flows` surface)              lands
+        //   apps/web/app/[locale]/reports/**, the ReportPage + ReportsList seeds
+        //                                  dropped (`SPOKE_EXCLUDED_MODULE_PATHS`,
+        //                                  2026-10-09): the reader links a report's
+        //                                  bytes on the hub through
+        //                                  NEXT_PUBLIC_AILK_API_URL, refused on a
+        //                                  spoke (#7874); deliverables are hub-side
+        //   ownedFiles under apps/api/**                       dropped (removed root)
+        //   ownedFiles under (authed)/waitlist/**              dropped (removal seed)
+        //   ownedFiles projects/apply/ListingApplicationClient lands; no route mounts it
+        //   ownedFiles under apps/mcp/src/tools/**             lands when apps/mcp is kept
+        //   installMap content/en/** (12 seeds)    lands, but for the five report seeds
+        //   installMap database/flows/{referral,fit-check}.flow.json
+        //                                  remapped to flows/<name>.json — declared
+        //                                  data `create-ailk seed-flows` sends
+        //   installMap database/waitlist/**.experiment.json    dropped (removed root):
+        //                                  a register is hub-side state
+        //   installMap apps/web/public/reports/**, reports/**  lands
+        //   patches — @working-theory/ui-signal-collectors     lands
+        //
+        // It stays a Pro module: a keyless spoke carries no flows.
+        spoke: true,
         paidSectionsPackage: "@working-theory/ui-signal-collectors",
         ownedFiles: [
             "apps/api/src/routes/flows/index.ts",
@@ -1655,6 +1721,16 @@ export const MODULE_SLICES = {
     // `lib/stripe.ts` and the webhook receiver this module owns — declared
     // here, not engineered around.
     commerce: {
+        // #7838 — admitted on a spoke. Its bundle installs through the spoke
+        // filter (`isSpokeExcluded`), which drops every destination under
+        // apps/api or database and the web files that call the hub's own
+        // checkout (`SPOKE_HUB_CHECKOUT_SEEDS`: flows/[slug]/checkout.actions.ts,
+        // the flow results pages, dev/purchase — spoke-intake Rule 3). What lands
+        // is the scaffold-commerce skill, the commerce-boundary rule and the
+        // @working-theory/ui-commerce dependency (`patches` below); the spoke's own
+        // checkout — two routes, checkout-config.ts and two return pages — is
+        // rendered by create-ailk (`spoke-checkout.ts`), not carried here.
+        spoke: true,
         paidSectionsPackage: "@working-theory/ui-commerce",
         apps: {
             api: {

package/dist/parse-args.d.ts

@@ -116,6 +116,11 @@ export interface CliOptions {
     hubUrl?: string;
     /** Spoke only: `false` with `--without-mcp` (#7426 D3), else `true`. */
     mcp?: boolean;
+    /**
+     * Spoke only: the raw `--hub-sign-in` value (#7894 D1) — the hub's web
+     * origin this spoke signs visitors in at. `scaffold()` validates it.
+     */
+    hubSignIn?: string;
 }
 export declare class ParseError extends Error {
     constructor(message: string);

package/dist/parse-args.js

@@ -178,6 +178,12 @@ Options:
                            a spoke with neither is refused. Written to
                            apps/web/.env.local — the spoke key never is.
   --without-mcp            A spoke without apps/mcp.
+  --hub-sign-in <origin>   A spoke whose /account signs visitors in through
+                           its hub's own sign-in page (the hub's web origin,
+                           https: or http: on localhost). No database: the
+                           session is a sealed cookie. Writes the origin and
+                           a session secret to apps/web/.env.local — never the
+                           client secret, which the hub issues.
   --install                After scaffolding, run \`pnpm install\` in the
                            target directory. Off by default.
   --help, -h               Print this message.
@@ -217,6 +223,7 @@ export function parseCliArgs(argv, env = { interactive: false }) {
                 topology: { type: "string" },
                 "hub-url": { type: "string" },
                 "without-mcp": { type: "boolean", default: false },
+                "hub-sign-in": { type: "string" },
                 surfaces: { type: "string" },
                 "sync-architecture": { type: "string" },
                 "sync-catalog": { type: "boolean", default: false },
@@ -251,6 +258,7 @@ export function parseCliArgs(argv, env = { interactive: false }) {
     const topology = parseTopology(rawTopology);
     const hubUrl = parsed.values["hub-url"];
     const withoutMcp = parsed.values["without-mcp"] === true;
+    const hubSignIn = parsed.values["hub-sign-in"];
     // The sync modes each exit after rewriting their one file, so asking for
     // more than one in one invocation has no coherent meaning.
     const syncFlags = [
@@ -271,6 +279,7 @@ export function parseCliArgs(argv, env = { interactive: false }) {
         const spokeOnly = [
             hubUrl !== undefined ? "--hub-url" : undefined,
             withoutMcp ? "--without-mcp" : undefined,
+            hubSignIn !== undefined ? "--hub-sign-in" : undefined,
         ].filter((f) => f !== undefined);
         if (spokeOnly.length > 0) {
             throw new ParseError(`${spokeOnly.join(" and ")} only apply${spokeOnly.length === 1 ? "s" : ""} to a spoke. Pass --topology spoke, or drop ${spokeOnly.length === 1 ? "it" : "them"}.`);
@@ -367,7 +376,11 @@ export function parseCliArgs(argv, env = { interactive: false }) {
         ...(license !== undefined ? { license } : {}),
         topology,
         ...(topology === "spoke"
-            ? { ...(hubUrl !== undefined ? { hubUrl } : {}), mcp: !withoutMcp }
+            ? {
+                ...(hubUrl !== undefined ? { hubUrl } : {}),
+                mcp: !withoutMcp,
+                ...(hubSignIn !== undefined ? { hubSignIn } : {}),
+            }
             : {}),
     };
 }
@@ -538,6 +551,9 @@ export function toScaffoldOptions(opts) {
                 topology: "spoke",
                 ...(opts.hubUrl !== undefined ? { hubUrl: opts.hubUrl } : {}),
                 mcp: opts.mcp !== false,
+                ...(opts.hubSignIn !== undefined
+                    ? { hubSignInUrl: opts.hubSignIn }
+                    : {}),
             }
             : {}),
     };

package/dist/programmatic.d.ts

@@ -149,6 +149,12 @@ export interface ScaffoldOptions {
     hubUrl?: string;
     /** Spoke only: `false` drops `apps/mcp` (`--without-mcp`, #7426 D3). Default true. */
     mcp?: boolean;
+    /**
+     * Spoke only: the hub's web origin this spoke signs visitors in at
+     * (`--hub-sign-in`, #7894 D1). Set, the spoke is scaffolded in the hub
+     * sign-in mode (`SpokeShapeOptions.signIn: "hub"`).
+     */
+    hubSignInUrl?: string;
 }
 export interface ScaffoldResult {
     /** Resolved absolute path to the scaffolded directory. */
@@ -181,6 +187,8 @@ export interface ScaffoldResult {
     droppedModules?: ModuleName[];
     /** A spoke only (#7426 D2): the normalized hub origin written to apps/web/.env.local. */
     hubOrigin?: string;
+    /** A hub sign-in spoke only (#7894 D11): the hub web origin written to apps/web/.env.local. */
+    hubSignInOrigin?: string;
 }
 /**
  * Scaffold an AI Launch Kit starter project into targetDir (synchronous).