create-ailk 0.15.0 → 0.17.0

package/dist/topology.d.ts

@@ -10,16 +10,48 @@ export declare class TopologyError extends Error {
 export declare const SPOKE_REMOVED_ROOTS: readonly string[];
 /** The root `--without-mcp` removes. */
 export declare const SPOKE_MCP_ROOT = "apps/mcp";
+/** Commerce's apps/web files that reach the hub's own checkout (spoke-intake Rule 3, #7838). */
+export declare const SPOKE_HUB_CHECKOUT_SEEDS: readonly string[];
 /**
- * The sign-in and database files a spoke does not carry — files and
- * directories, scaffold-relative. Every other file that imports one of them
- * goes with it (`spokeExclusions`).
+ * The files a spoke does not carry — files and directories, scaffold-relative:
+ * the sign-in and database seeds, then the commerce files that call the hub's
+ * own checkout (`SPOKE_HUB_CHECKOUT_SEEDS`; a spoke keeps its own, #7838).
+ * Every other file that imports one of them goes with it (`spokeExclusions`).
  */
 export declare const SPOKE_REMOVAL_SEEDS: readonly string[];
-/** The two generated seam files (D5). A seam is rewritten, never removed. */
+/**
+ * Module paths a spoke drops even when it carries the module (#7876 D8,
+ * clarified 2026-10-09). `signal-collectors`' report reader links a
+ * grant-gated report's bytes on the hub from `NEXT_PUBLIC_AILK_API_URL`,
+ * which a spoke refuses (#7874: its hub origin is server-only), and a
+ * deliverable is hub-side anyway — so a spoke carries neither the
+ * `/reports` routes nor the report seeds that would have no route.
+ */
+export declare const SPOKE_EXCLUDED_MODULE_PATHS: readonly string[];
+/**
+ * The `(authed)` seeds of the sign-in-through-the-hub mode (#7894 D9): the
+ * whole `(authed)` group goes in the default mode; in the hub mode its account
+ * area, layout and gate seam stay, and only these go — the operator surfaces,
+ * the Better Auth gate and the suites that mock `auth.ts` by path.
+ */
+export declare const HUB_MODE_AUTHED_SEEDS: readonly string[];
+/** The generated seam files (D5; #7874 D12). A seam is rewritten, never removed. */
 export declare const WEB_SEAM_PATH = "apps/web/lib/topology.generated.ts";
 export declare const MCP_SEAM_PATH = "apps/mcp/src/lib/topology.generated.ts";
+/** The browser API origin seam (#7874 D12): a spoke's render reads no env. */
+export declare const API_ORIGIN_SEAM_PATH = "apps/web/lib/api-origin.generated.ts";
+/**
+ * The `(authed)` layout's signed-out gate (#7894 D8). Under the `(authed)`
+ * seed, so a default-mode spoke drops it with its group and never renders it.
+ */
+export declare const AUTHED_GATE_SEAM_PATH = "apps/web/app/[locale]/(authed)/signed-out-gate.generated.tsx";
 export declare const SPOKE_SEAM_FILES: readonly string[];
+/**
+ * Template files only a spoke carries (#7874 D11): the declared-env check.
+ * `scaffoldSync` excludes them from a hub's copy (`copyTemplate`'s
+ * `excludePaths` matches an exact file path).
+ */
+export declare const SPOKE_ONLY_FILES: readonly string[];
 /**
  * The closure's allow-list: a file `spokeExclusions` removes must sit under
  * one of these prefixes, or under a `__tests__/` directory. A member outside
@@ -27,14 +59,26 @@ export declare const SPOKE_SEAM_FILES: readonly string[];
  * file — and `spokeExclusions` throws naming it rather than cut it silently.
  */
 export declare const SPOKE_REMOVABLE_PREFIXES: readonly string[];
+/**
+ * A spoke's sign-in modes (#7894 D1): `off` — the default, no sign-in — and
+ * `hub`, signing a visitor in through the hub (`--hub-sign-in <origin>`).
+ */
+export type SignInMode = "off" | "hub";
 export interface SpokeShapeOptions {
     /** Whether the spoke keeps `apps/mcp` (the default; `--without-mcp` drops it). */
     mcp: boolean;
+    /** The sign-in mode (#7894 D1). Absent means `"off"`, so every existing caller is the default mode. */
+    signIn?: SignInMode;
 }
 /** The removed roots for these options. */
 export declare function spokeRemovedRoots(opts: SpokeShapeOptions): string[];
-/** Whether a closure member is one the registry allows a spoke to drop. */
-export declare function isRemovableClosureMember(path: string): boolean;
+/**
+ * Whether a closure member is one the registry allows a spoke to drop: under
+ * a seed of THAT sign-in mode, or a test. In the hub mode a surviving account
+ * file that imports `auth.ts` is therefore not removable, and
+ * `spokeExclusions` throws naming it (#7894 D9).
+ */
+export declare function isRemovableClosureMember(path: string, opts?: Pick<SpokeShapeOptions, "signIn">): boolean;
 /**
  * Every path a spoke does not carry, computed over the built `templates/`
  * tree: the removed roots, the seeds that apply, and every source file under
@@ -69,14 +113,56 @@ export interface IsSpokeExcludedOptions extends SpokeShapeOptions {
  * generator contract). Scaffold-relative, `/`- or `\`-separated.
  */
 export declare function isSpokeExcluded(path: string, opts: IsSpokeExcludedOptions): boolean;
-/** `apps/web/lib/topology.generated.ts` for `topology` (D5). */
-export declare function renderWebSeam(topology: Topology): string;
+/**
+ * Where a module bundle's `installMap` destination lands on a spoke (#7876
+ * D10): `database/flows/<name>.flow.json` becomes `flows/<name>.json` — a
+ * declared flow `create-ailk seed-flows` sends to the hub — and every other
+ * destination is returned unchanged. Applied before the spoke filter, so a
+ * remapped flow survives it while the rest of `database/` is dropped. A hub
+ * install passes no remap.
+ */
+export declare function spokeDestination(destination: string): string;
+/**
+ * `apps/web/lib/topology.generated.ts` for `topology` (D5) and, on a spoke,
+ * its sign-in mode (#7894 D8). The hub render loads `auth.ts` only when a
+ * session is read, so a module that imports this seam for a constant never
+ * loads Better Auth.
+ */
+export declare function renderWebSeam(topology: Topology, signIn?: SignInMode): string;
+/**
+ * `apps/web/app/[locale]/(authed)/signed-out-gate.generated.tsx` (#7894 D8).
+ * The hub render is the `(authed)` layout's no-session branch, moved; the
+ * `signIn: "hub"` render imports only the hub-session gate. A default-mode
+ * spoke carries no `(authed)` group, so it has no render.
+ * @throws TopologyError for a spoke in the default mode.
+ */
+export declare function renderAuthedGateSeam(topology: Topology, signIn?: SignInMode): string;
 /** `apps/mcp/src/lib/topology.generated.ts` for `topology` (D5). */
 export declare function renderMcpSeam(topology: Topology): string;
+/** `apps/web/lib/api-origin.generated.ts` for `topology` (#7874 D12). */
+export declare function renderApiOriginSeam(topology: Topology): string;
 /** `pnpm-workspace.yaml` without its `database` package entry. */
 export declare function transformWorkspaceYaml(text: string): string;
 /** The root `package.json` without its `db:*` scripts. */
 export declare function transformRootPackageJson(text: string): string;
+/** The spoke's declared-env script (#7874 D11) — named apart from the monorepo's `env:check`. */
+export declare const ENV_DECLARED_SCRIPT = "env:declared";
+/**
+ * The spoke's root `package.json` with the declared-env check (#7874 D11):
+ * an `env:declared` script after `claude-md:check`, and `preflight` running
+ * it right after `claude-md:check`. Applied after `transformRootPackageJson`.
+ * @throws TopologyError when either anchor is missing.
+ */
+export declare function addEnvCheckScripts(text: string): string;
+/**
+ * The spoke's `.github/workflows/ci.yml` (#7874 D11): a `pnpm env:declared`
+ * step after `pnpm claude-md:check`, and no `pnpm db:generate` step — a
+ * spoke has no `database/` and no `db:*` script, so that step would fail
+ * first (#7962). The comment block directly above the dropped step goes with
+ * it.
+ * @throws TopologyError when either anchor is missing.
+ */
+export declare function transformCiWorkflow(text: string): string;
 /** The root `tsconfig.json` without a reference under a removed root. */
 export declare function transformRootTsconfig(text: string, opts: SpokeShapeOptions): string;
 /**
@@ -87,7 +173,8 @@ export declare function transformAppPackageJson(text: string, label: string, req
 /**
  * Apply every D6 root-file transform to the spoke at `targetDir` (after the
  * base copy, before any module or template layer), and write the spoke
- * render of each seam it carries (D5).
+ * render of each seam it carries (D5). Also the declared-env check's root
+ * script and CI step (#7874 D11), and the browser API origin seam (D12).
  * @throws TopologyError naming the file whose anchor is missing.
  */
 export declare function applySpokeTransforms(targetDir: string, opts: SpokeShapeOptions): void;
@@ -101,10 +188,24 @@ export declare const HUB_ORIGIN_ENV_VAR = "AILK_API_URL";
  * the hub issues those.
  */
 export declare function writeHubOriginEnv(targetDir: string, origin: string): void;
+/** The env var naming the hub's web origin a hub-mode spoke signs in at (#7894 D11). */
+export declare const HUB_SIGN_IN_URL_ENV_VAR = "AILK_HUB_SIGN_IN_URL";
+/** The env var holding a hub-mode spoke's own cookie key material (#7894 D7, D11). */
+export declare const HUB_SESSION_SECRET_ENV_VAR = "AILK_HUB_SESSION_SECRET";
+/**
+ * Write a hub-mode spoke's sign-in env (#7894 D11) to `apps/web/.env.local`,
+ * under `writeHubOriginEnv`'s never-clobber rule: the hub's web origin, and a
+ * fresh session secret (32 random bytes, 43 base64url characters). Never the
+ * client id or client secret — the hub issues those (`spokes sign-in-client`)
+ * — and never `BETTER_AUTH_SECRET` or a database URL.
+ */
+export declare function writeHubSignInEnv(targetDir: string, origin: string): void;
 /** The `hard_floors:` block a spoke's `project.yaml` carries (D9). */
 export declare function renderSpokeHardFloors(opts: SpokeShapeOptions): string;
 /** `project.yaml` with its `hard_floors:` block replaced by the spoke's (D9). */
 export declare function transformProjectYaml(text: string, opts: SpokeShapeOptions): string;
+/** Why a module is not admitted on a spoke, and where its admission lives. */
+export declare const SPOKE_REFUSAL_REASONS: Partial<Record<ModuleName, string>>;
 /** The modules a spoke may carry — every slice declaring `spoke: true`. */
 export declare function spokeModules(): ModuleName[];
 /** The refusal for a module a spoke cannot carry, or undefined when admitted. */
@@ -115,6 +216,14 @@ export declare function spokeModuleRefusal(name: ModuleName): string | undefined
  * @throws TopologyError on an unreadable manifest or an unknown value.
  */
 export declare function readSiteTopology(targetDir: string): Topology;
+/**
+ * The spoke options `<targetDir>` records (#7894 D1), for the later commands
+ * (`sync-routes`, `add-module`): `undefined` on a hub; on a spoke, `mcp` from
+ * whether it still carries `apps/mcp` and `signIn` from the manifest's
+ * `signIn` key — absent reads as `"off"`, every spoke before #7894.
+ * @throws TopologyError on an unreadable manifest or an unknown value.
+ */
+export declare function readSpokeShape(targetDir: string): SpokeShapeOptions | undefined;
 /**
  * Hosts a spoke may reach over plain `http:` — the set
  * `packages/api-client/src/http.ts` sends the spoke key under. Named here
@@ -129,3 +238,9 @@ export declare const LOOPBACK_HOSTS: readonly string[];
  *   is not such an origin. Never echoes a query or fragment.
  */
 export declare function normalizeHubUrl(raw: string | undefined): string;
+/**
+ * The hub's WEB origin a hub-mode spoke signs in at (`--hub-sign-in`, #7894
+ * D1) — `normalizeHubUrl`'s rules, each refusal naming the flag.
+ * @throws TopologyError when `raw` is not such an origin.
+ */
+export declare function normalizeHubSignInUrl(raw: string): string;