create-ailk 0.17.0 → 0.19.0

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/dist/add-module.js

@@ -165,12 +165,15 @@ export async function applyModuleToScaffold(opts) {
     });
     // #7838 D8 — commerce on a spoke brings the spoke's own checkout, stamped
     // from the site directory's name (the `projectName` scaffold() defaults to).
-    // A file the site already has is left as it is.
+    // A file the site already has is left as it is. #8217 D8 — on a spoke that
+    // signs in through its hub, the billing action and its seam render too, so
+    // re-running add-module commerce gives an existing commerce spoke the action.
     const spokeCommerce = spoke !== undefined && opts.moduleName === "commerce";
     const checkoutRows = spokeCommerce
         ? writeSpokeCheckoutSlice(targetAbs, {
             site: spokeCheckoutSite(basename(targetAbs)),
             versions: opts.versions,
+            signIn: spoke.signIn,
         })
         : [];
     // #7876 D9 — a spoke that just gained the flow stepper says what its

package/dist/category-profile.d.ts

@@ -50,6 +50,16 @@ export declare const CATEGORY_PROFILE_SHAPES: {
  * set-equal to the `schema-dts` closure, so it cannot drift silently.
  */
 export declare const LOCAL_BUSINESS_TYPES: ReadonlySet<string>;
+/**
+ * The leaf category slugs, in registry order — create-ailk's own copy of the
+ * site-category registry's leaves (`SITE_CATEGORIES`, #5830). A literal, not
+ * a type import, so the emitted `.d.ts` of the public tarball names no
+ * `@working-theory/*` package (#8412); `category-slugs.test.ts` proves it
+ * equal to the registry, so it cannot drift silently.
+ */
+export declare const CATEGORY_SLUGS: readonly ["accounting", "legal", "consulting", "hvac", "roofing", "plumbing", "electrical", "landscaping", "auto-repair", "real-estate", "technology", "medical-specialty"];
+/** A leaf category slug — the only thing a template's `categories` names. */
+export type CategorySlug = (typeof CATEGORY_SLUGS)[number];
 export declare const OFFERING_PRICING: readonly ["quote", "fixed", "hourly", "subscription"];
 export declare const PROOF_KINDS: readonly ["credential", "reviews", "before-after", "response-time", "guarantee", "experience"];
 export declare const CONTENT_POSTURES: readonly ["instructions", "sample"];

package/dist/category-profile.js

@@ -71,6 +71,27 @@ export const LOCAL_BUSINESS_TYPES = new Set([
     "TennisComplex", "TireShop", "TouristInformationCenter", "ToyStore",
     "TravelAgency", "VacationRental", "WholesaleStore", "Winery",
 ]);
+/**
+ * The leaf category slugs, in registry order — create-ailk's own copy of the
+ * site-category registry's leaves (`SITE_CATEGORIES`, #5830). A literal, not
+ * a type import, so the emitted `.d.ts` of the public tarball names no
+ * `@working-theory/*` package (#8412); `category-slugs.test.ts` proves it
+ * equal to the registry, so it cannot drift silently.
+ */
+export const CATEGORY_SLUGS = [
+    "accounting",
+    "legal",
+    "consulting",
+    "hvac",
+    "roofing",
+    "plumbing",
+    "electrical",
+    "landscaping",
+    "auto-repair",
+    "real-estate",
+    "technology",
+    "medical-specialty",
+];
 export const OFFERING_PRICING = ["quote", "fixed", "hourly", "subscription"];
 export const PROOF_KINDS = [
     "credential",

package/dist/derive-architecture.d.ts

@@ -22,7 +22,11 @@ export interface DeriveArchitectureOptions {
     /** Spoke only: whether the spoke keeps `apps/mcp` (default true). */
     mcp?: boolean;
 }
-/** The only spoke files that may import @working-theory/spoke-checkout (#7873). */
+/**
+ * The only spoke files that may import @working-theory/spoke-checkout (#7873):
+ * the buy route, the webhook route and — on a spoke that signs in through its
+ * hub — the billing action (#8217 D9, a reviewed change to the #7873 rule).
+ */
 export declare const SPOKE_CHECKOUT_ROUTE_FILES: readonly string[];
 /** The forbidden patterns a spoke's apps/web carries (#7873, brief Part 2 §2). */
 export declare const SPOKE_WEB_FORBIDDEN_PATTERNS: readonly ForbiddenPattern[];

package/dist/derive-architecture.js

@@ -27,10 +27,15 @@ const SPOKE_TIERS = {
 // import only to a workspace on disk, so the one way to ban an npm package is
 // a line-level forbidden pattern. These go under the spoke's own `apps.web`
 // and `apps.mcp` only — never top level, and never on a hub derivation.
-/** The only spoke files that may import @working-theory/spoke-checkout (#7873). */
+/**
+ * The only spoke files that may import @working-theory/spoke-checkout (#7873):
+ * the buy route, the webhook route and — on a spoke that signs in through its
+ * hub — the billing action (#8217 D9, a reviewed change to the #7873 rule).
+ */
 export const SPOKE_CHECKOUT_ROUTE_FILES = Object.freeze([
     "apps/web/app/api/checkout/[offering]/route.ts",
     "apps/web/app/api/webhooks/stripe/route.ts",
+    "apps/web/app/[locale]/(authed)/account/billing/spoke-billing.action.ts",
 ]);
 /**
  * A line-level regex for an import of `specifier` or one of its subpaths, in
@@ -45,10 +50,10 @@ function specifierForm(specifier) {
     const literal = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     return `\\b(?:from|import|require)\\s*\\(?\\s*${q}${literal}(?:/[^'"\`]*)?${q}`;
 }
-/** P1 with no exclusions — a kept apps/mcp's form; apps/web adds the two routes. */
+/** P1 with no exclusions — a kept apps/mcp's form; apps/web adds the route files. */
 const SPOKE_CHECKOUT_PATTERN = Object.freeze({
     pattern: specifierForm("@working-theory/spoke-checkout"),
-    reason: "Spoke checkout: only the buy route and the webhook route may import @working-theory/spoke-checkout (brief Part 2 §2, #7873)",
+    reason: "Spoke checkout: only the buy route, the webhook route and the billing action may import @working-theory/spoke-checkout (brief Part 2 §2, #7873, #8217)",
 });
 const STRIPE_CLIENT_PATTERN = Object.freeze({
     pattern: specifierForm("@working-theory/stripe-client"),

package/dist/lib/env-catalog.js

@@ -24,7 +24,7 @@ export const ENV_CATALOG = {
         secret: false,
     },
     AILK_CONTENT_ROOT: {
-        description: "Overrides the on-disk content root; defaults to <repo-root>/content.",
+        description: "Overrides the on-disk content root (absolute, or relative to the working directory). Unset, the MCP server tries <cwd>/content, then <cwd>/../../content; the web app defaults to <repo-root>/content.",
         secret: false,
     },
     AILK_ENABLED_MODULES: {
@@ -143,16 +143,12 @@ export const ENV_CATALOG = {
         description: "The port the MCP HTTP transport binds; defaults to 8080.",
         secret: false,
     },
-    MCP_PUBLIC_HTTP_URL: {
-        description: "The public URL of the MCP HTTP transport, advertised by /.well-known/mcp.json.",
-        secret: false,
-    },
-    MCP_RATE_LIMIT_READ_PER_MIN: {
-        description: "Maximum MCP read-tool requests per minute per IP; defaults to 60.",
+    MCP_HTTP_STATELESS: {
+        description: 'Set to "true" or "1" for an MCP HTTP transport with no sessions, which any instance can answer; "false" or "0" keeps sessions in one process. Unset means stateless on Vercel (src/app.ts) and stateful on a port (src/index.ts).',
         secret: false,
     },
-    MCP_RATE_LIMIT_WRITE_PER_MIN: {
-        description: "Maximum MCP write-tool requests per minute per IP; defaults to 10.",
+    MCP_PUBLIC_HTTP_URL: {
+        description: "The public URL of the MCP HTTP transport, advertised by /.well-known/mcp.json.",
         secret: false,
     },
     MCP_TRANSPORT: {

package/dist/lib/license-key-files.d.ts

@@ -21,9 +21,12 @@ export declare function appendLine(text: string, line: string): string;
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
  *
- * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
- * `apps/api`, so it keeps the key in `ailk.key` alone.
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) or any
+ * site without `apps/api` (#7779) keeps the key in `ailk.key` alone.
+ *
+ * Returns the key files it holds the key in, relative to `dir`
+ * (`LICENSE_KEY_FILE`, then `LICENSE_ENV_FILE` when written).
  */
 export declare function writeLicenseKeyFiles(dir: string, key: string, opts?: {
     apiEnv?: boolean;
-}): void;
+}): string[];

package/dist/lib/license-key-files.js

@@ -86,16 +86,21 @@ function upsertEnvLine(existing, key) {
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
  *
- * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
- * `apps/api`, so it keeps the key in `ailk.key` alone.
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) or any
+ * site without `apps/api` (#7779) keeps the key in `ailk.key` alone.
+ *
+ * Returns the key files it holds the key in, relative to `dir`
+ * (`LICENSE_KEY_FILE`, then `LICENSE_ENV_FILE` when written).
  */
 export function writeLicenseKeyFiles(dir, key, opts = {}) {
     assertLicenseKeyShape(key);
     writeOwnerOnly(join(dir, LICENSE_KEY_FILE), `${key}\n`);
+    const written = [LICENSE_KEY_FILE];
     if (opts.apiEnv !== false) {
         const envPath = join(dir, LICENSE_ENV_FILE);
         const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
         writeOwnerOnly(envPath, upsertEnvLine(env, key));
+        written.push(LICENSE_ENV_FILE);
     }
     const ignorePath = join(dir, ".gitignore");
     const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
@@ -104,4 +109,5 @@ export function writeLicenseKeyFiles(dir, key, opts = {}) {
         .some((l) => KEY_IGNORE_LINES.has(l.trim()));
     if (!covered)
         writeFileSync(ignorePath, appendLine(ignore, LICENSE_KEY_FILE));
+    return written;
 }

package/dist/lib/scaffold-render-sweep.d.ts

@@ -53,6 +53,15 @@ export declare function assessClaimGatedRoute(input: {
     hops: RedirectHop[];
     status: number | null;
 }): SweepVerdict;
+/**
+ * A `redirect()` thrown by a Server Component after the shell has flushed is
+ * not an HTTP 3xx: the response is a 200 whose flight payload carries the
+ * digest `NEXT_REDIRECT;<replace|push>;<url>;<status>;`. The driver follows it
+ * as a hop exactly like a `Location` header (#8311 — `/account/settings`
+ * forwards to `/account/general` this way). Null when the HTML carries no
+ * such digest.
+ */
+export declare function streamedRedirect(html: string): RedirectHop | null;
 /**
  * Decide whether a page route rendered, under the real locale, with its own
  * content. The first failed rule is the reason:

package/dist/lib/scaffold-render-sweep.js

@@ -122,6 +122,24 @@ function htmlLang(html) {
 function flightDigest(html) {
     return /\\"digest\\":\\"([^"\\]*)\\"/.exec(html)?.[1] ?? null;
 }
+/**
+ * A `redirect()` thrown by a Server Component after the shell has flushed is
+ * not an HTTP 3xx: the response is a 200 whose flight payload carries the
+ * digest `NEXT_REDIRECT;<replace|push>;<url>;<status>;`. The driver follows it
+ * as a hop exactly like a `Location` header (#8311 — `/account/settings`
+ * forwards to `/account/general` this way). Null when the HTML carries no
+ * such digest.
+ */
+export function streamedRedirect(html) {
+    const digest = flightDigest(html);
+    if (digest === null || !digest.startsWith("NEXT_REDIRECT;"))
+        return null;
+    const [, , location = "", status = ""] = digest.split(";");
+    if (location === "")
+        return null;
+    const code = Number.parseInt(status, 10);
+    return { status: Number.isFinite(code) ? code : 307, location };
+}
 /**
  * Whether an `<h1>`'s inner HTML carries a name: text once tags are stripped,
  * or an image with a non-empty `alt` (the Hero's lockup renders the wordmark
@@ -170,9 +188,12 @@ export function assessPageRender(input) {
         return { ok: false, reason: `${route} -> rendered under locale "${lang}"` };
     const digest = flightDigest(html);
     if (digest !== null) {
-        const why = digest.startsWith("NEXT_HTTP_ERROR_FALLBACK;404")
-            ? "streamed not-found"
-            : `streamed error (digest ${digest})`;
+        const redirect = streamedRedirect(html);
+        const why = redirect !== null
+            ? `streamed redirect to ${redirect.location} that was not followed`
+            : digest.startsWith("NEXT_HTTP_ERROR_FALLBACK;404")
+                ? "streamed not-found"
+                : `streamed error (digest ${digest})`;
         return { ok: false, reason: `${route} -> ${why}` };
     }
     const marker = ownContentMarker(html);

package/dist/license-set.d.ts

@@ -24,7 +24,7 @@ export interface LicenseSetIO {
     /** Defaults to `spawnSync` with `shell: false` (see `defaultRunner`). */
     runner?: LicenseSetRunner;
 }
-export declare const LICENSE_SET_HELP = "create-ailk license set \u2014 put your licence key into an existing site.\n\nUsage:\n  pnpm create ailk@latest license set <key> [<target-dir>]\n  pnpm create ailk@latest license set - [<target-dir>] < key.txt\n\nArguments:\n  <key>                    Your licence key, or `-` to read it from stdin\n                           (keeps it out of your shell history).\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nWrites the key to ailk.key and apps/api/.env (owner-only, gitignored). When the\nsite (or apps/api, or apps/web) is linked to Vercel, it also replaces the\nproduction AILK_LICENSE_KEY variable and redeploys.\n";
+export declare const LICENSE_SET_HELP = "create-ailk license set \u2014 put your licence key into an existing site.\n\nUsage:\n  pnpm create ailk@latest license set <key> [<target-dir>]\n  pnpm create ailk@latest license set - [<target-dir>] < key.txt\n\nArguments:\n  <key>                    Your licence key, or `-` to read it from stdin\n                           (keeps it out of your shell history).\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nWrites the key to ailk.key, and to apps/api/.env when the site has apps/api\n(owner-only, gitignored). When the site (or apps/api, or apps/web) is linked to\nVercel, it also replaces the production AILK_LICENSE_KEY variable and redeploys.\n";
 /** `spawnSync`, never through a shell; stdin piped only when there is input. */
 export declare const defaultRunner: LicenseSetRunner;
 /**

package/dist/license-set.js

@@ -7,8 +7,9 @@
  *
  *   1. The target (default: cwd) must contain `architecture.yaml` — the
  *      `sync-routes` precondition — else exit 1 with nothing written.
- *   2. `writeLicenseKeyFiles` — `ailk.key` + `apps/api/.env`, both 0600 and
- *      gitignored; the same writer `--license` uses.
+ *   2. `writeLicenseKeyFiles` — `ailk.key`, plus `apps/api/.env` only when
+ *      `apps/api` already exists (#7779), both 0600 and gitignored; the same
+ *      writer `--license` uses. The output names only the files written.
  *   3. For each of `<dir>`, `<dir>/apps/api`, `<dir>/apps/web` holding
  *      `.vercel/project.json`, with that directory as `cwd`:
  *        a. print the linked `projectId` about to change (SEC-13);
@@ -31,7 +32,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import { LICENSE_ENV_FILE, LICENSE_ENV_VAR, LICENSE_KEY_FILE, assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-files.js";
+import { LICENSE_ENV_VAR, LICENSE_KEY_FILE, assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-files.js";
 export const LICENSE_SET_HELP = `create-ailk license set — put your licence key into an existing site.
 
 Usage:
@@ -44,9 +45,9 @@ Arguments:
   <target-dir>             An already-scaffolded repo (contains
                            architecture.yaml). Defaults to the current dir.
 
-Writes the key to ailk.key and apps/api/.env (owner-only, gitignored). When the
-site (or apps/api, or apps/web) is linked to Vercel, it also replaces the
-production AILK_LICENSE_KEY variable and redeploys.
+Writes the key to ailk.key, and to apps/api/.env when the site has apps/api
+(owner-only, gitignored). When the site (or apps/api, or apps/web) is linked to
+Vercel, it also replaces the production AILK_LICENSE_KEY variable and redeploys.
 `;
 const LINK_DIRS = [".", join("apps", "api"), join("apps", "web")];
 const VERCELIGNORE_LINES = [LICENSE_KEY_FILE, ".env"];
@@ -151,9 +152,13 @@ export function runLicenseSet(argv, io) {
     if (!existsSync(join(target, "architecture.yaml"))) {
         return fail(`not a scaffolded repo: no architecture.yaml at ${target}. Run it from your site's root, or pass the site's directory.`);
     }
-    writeLicenseKeyFiles(target, key);
+    // A site without apps/api (a web-only spoke) keeps the key in ailk.key
+    // alone — writing apps/api/.env would create an app directory it never had.
+    const files = writeLicenseKeyFiles(target, key, {
+        apiEnv: existsSync(join(target, "apps", "api")),
+    });
     const keyFile = join(target, LICENSE_KEY_FILE);
-    const written = `Wrote ${LICENSE_KEY_FILE} and ${LICENSE_ENV_FILE.split("\\").join("/")} in ${target}`;
+    const written = `Wrote ${files.map((f) => f.split("\\").join("/")).join(" and ")} in ${target}`;
     io.stdout(`[create-ailk] ${written} (owner-only, gitignored).\n`);
     const linked = LINK_DIRS.map((d) => join(target, d)).filter((d) => existsSync(join(d, ".vercel", "project.json")));
     if (linked.length === 0) {

package/dist/module-architecture.js

@@ -157,15 +157,41 @@ export const ARCHITECTURE_BASE = {
  * file behind it — the three operator route files, the two member route
  * files, the member resolution (`services/member-area.ts`) and the member
  * data boundary (`lib/member-store.ts`).
+ *
+ * #8169 D9 adds the five Phase 1 member reads registered under that same
+ * disjunction. Its two other reads — `routes/member/meeting-types.ts` and
+ * `availability.ts` — reach `services/scheduling/`, so they are the
+ * `scheduling` slice's, not listed here.
+ *
+ * #8170 D11 adds the four member writes registered under that same
+ * disjunction (the message POST rides `messages.ts`). The fifth —
+ * `routes/member/bookings.ts` — reaches `services/scheduling/`, so it is the
+ * `scheduling` slice's.
  */
 const MEMBER_AREA_FILES = [
     "apps/api/src/routes/workspaces/pieces.ts",
     "apps/api/src/routes/workspaces/plan.ts",
     "apps/api/src/routes/workspaces/messages-out.ts",
+    // #8171 D8 — the workspace Requests read; imports only pieces.ts,
+    // lib/tenant-db.ts and @working-theory/validation.
+    "apps/api/src/routes/workspaces/requests.ts",
     "apps/api/src/routes/member/pieces.ts",
     "apps/api/src/routes/member/messages.ts",
+    "apps/api/src/routes/member/purchases.ts",
+    "apps/api/src/routes/member/appointments.ts",
+    "apps/api/src/routes/member/artifacts.ts",
+    "apps/api/src/routes/member/request-form.ts",
+    "apps/api/src/routes/member/billing.ts",
+    "apps/api/src/routes/member/requests.ts",
+    "apps/api/src/routes/member/artifact-review.ts",
+    "apps/api/src/routes/member/profile.ts",
+    "apps/api/src/routes/member/deletion-request.ts",
     "apps/api/src/services/member-area.ts",
     "apps/api/src/lib/member-store.ts",
+    // #8226 D12 — the member-request match CLI; both import member-store.ts,
+    // which a build without the member slice does not carry.
+    "apps/api/src/lib/member-request-match.ts",
+    "apps/api/src/bin/member-request-match.ts",
 ];
 /**
  * The workspace asset store (#5854), CO-OWNED by the `workspace` and
@@ -864,6 +890,18 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/waitlist/components/SignupsTable.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/components/WaitlistComparisonTabs.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/components/status-badges.tsx",
+            // #7389 — the three api suites that enable `multi-tenant` ALONE and so
+            // reach files this slice delivers (`services/tenant-context.ts` and the
+            // `routes/workspaces/` index). Each is listed individually, never as a
+            // glob (the `scheduling` slice's § D12 property 1: a glob entry is a
+            // silent no-op), so it ships to a keyed scaffold with the slice and is
+            // stripped from a keyless one with it — instead of a keyless scaffold
+            // carrying a test that raises `createNoMappedModuleFoundError`. A suite
+            // that enables SEVERAL paid modules cannot be owned by any one of
+            // them; those are `EXCLUDE_TEMPLATE_DIRS` entries below.
+            "apps/api/src/services/__tests__/lead-promotion.test.ts",
+            "apps/api/src/services/__tests__/leads-inbox.test.ts",
+            "apps/api/src/__tests__/content-write-production-boot.test.ts",
             "apps-paid/admin/**",
         ],
         // The whole-app glob above lands its files at their REPO-relative path
@@ -1232,6 +1270,13 @@ export const MODULE_SLICES = {
             // records: "each tenancy slice must deliver it").
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/services/tenant-context.ts",
+            // #7389 — `routes/workspaces/__tests__/meetings.test.ts` and
+            // `meetings-connection.test.ts` (listed below) register the real
+            // `tenantPreHandlerPlugin` in front of `meetings.ts`, so a scheduling
+            // scaffold without `multi-tenant` could not load them. It imports only
+            // `services/tenant-context.ts` (owned above) and the base
+            // `default-tenant.ts`, so co-owning it keeps the closure tight.
+            "apps/api/src/middleware/tenant.ts",
             // #7533 — a scheduling connection per workspace. `connections.ts` (the
             // cipher + the one SchedulingConnection data-access boundary) and
             // `resolve.ts` (the workspace-aware provider resolution the meetings,
@@ -1248,6 +1293,23 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/schedule/__tests__/public-connection.test.ts",
             "apps/api/src/routes/webhooks/__tests__/calcom-connection.test.ts",
             "apps/api/src/config/__tests__/scheduling-credential-key.test.ts",
+            // #8169 D9 — the two member reads that reach `services/scheduling/`,
+            // registered under `scheduling && (workspace || multi-tenant)`, plus
+            // the three member files they import, which this slice then CO-OWNS
+            // with the two tenancy slices (`MEMBER_AREA_FILES`) — exactly as it
+            // co-owns `lib/tenant-db.ts` for `routes/workspaces/meetings.ts` above.
+            "apps/api/src/routes/member/meeting-types.ts",
+            "apps/api/src/routes/member/availability.ts",
+            // #8170 D11 — the member booking, the same shape.
+            "apps/api/src/routes/member/bookings.ts",
+            "apps/api/src/routes/member/pieces.ts",
+            "apps/api/src/services/member-area.ts",
+            "apps/api/src/lib/member-store.ts",
+            // #7389 — the two api suites that enable `scheduling` alone, so they
+            // strip with `routes/schedule/index.ts`, which they load by a computed
+            // specifier the import-graph closure cannot follow.
+            "apps/api/src/__tests__/schedule-forwarded-rate-limit.test.ts",
+            "apps/api/src/__tests__/openapi-keyless-hub.test.ts",
         ],
         // pageContributions (spec 5478; parent § D6 shape 1) — the booker, the
         // per-booking-type page and the confirmation page, whose route files
@@ -1463,6 +1525,10 @@ export const MODULE_SLICES = {
             "apps/api/src/bin/listing-csv-sweep.ts",
             "apps/api/src/bin/followup-sweep.ts",
             "apps/api/src/bin/seed-waitlist-experiments.ts",
+            // #7389 — the listing-directory suite enables `signal-collectors` alone
+            // and loads `routes/waitlist-signups/index.ts` through the server it
+            // builds, so it strips with that route. Individually, never as a glob.
+            "apps/api/src/routes/project-listings/__tests__/directory.test.ts",
             "apps/mcp/src/tools/get_flow.ts",
             "apps/mcp/src/tools/submit_flow_step.ts",
             // #3591 PR-E — the signed-in MCP tools that twin the tenant-scoped
@@ -2013,6 +2079,44 @@ export function coOwnedModuleDestinations() {
 //     docs/specs/7315-a-gated-pro-tool-re-spec.md D4) — same reason as the
 //     three suites above: it imports `SITE_ARGS` from the monorepo's root
 //     `tests/parity/` tree, which no scaffold carries.
+//   - apps/mcp/__tests__/write-tool-guard.test.ts (#8071, spec
+//     docs/specs/8071-mcp-write-guard-spec.md D4) — it reads every anonymous
+//     catalog tool's handler file, and a scaffold carries only the handler
+//     files of the modules it selected while the catalog lists every tool.
+//     `WRITE_TOOLS` is edited in the monorepo, which is where it must run.
+//   - the suites a keyless scaffold's own `pnpm test` cannot run (#7389) —
+//     file entries, matched exactly. Two classes, neither of which a slice can
+//     own (a slice's `ownedFiles` carries a suite that needs ONE paid module;
+//     the six api suites that do are listed under `multi-tenant`, `scheduling`
+//     and `signal-collectors` above, and a keyed scaffold runs them):
+//       * monorepo fixtures — each reads a path only this repo has:
+//         `services/__tests__/aeo-score.test.ts` (packages/aeo's result.json),
+//         `routes/leads/__tests__/index.test.ts` (packages/validation's
+//         newsletter-lead fixture), `routes/workspaces/__tests__/
+//         inbox-wire-schemas.test.ts` (the root `tests/parity/` core),
+//         mcp's `workspace-surface.test.ts` (the same core) and mcp's
+//         `audit.test.ts` (the T1 fixture site's `project.yaml`).
+//       * whole-composition suites — each builds the real server or reads
+//         the whole tree under SEVERAL module sets, or asserts the
+//         monorepo's own identity, so no single slice is its owner and a
+//         scaffold that selected only some of the modules would fail it:
+//         `server.test.ts` (asserts the monorepo's "AI Launch Kit API" name,
+//         and a `signal-collectors` case), `cors.test.ts` (multi-tenant +
+//         scheduling), `root-modules.test.ts`, `module-exclusion.test.ts`,
+//         `openapi/__tests__/surface-drift.test.ts`,
+//         `review-surface-registration.test.ts` and
+//         `workspace-module-registration.test.ts` (each a matrix over module
+//         sets), and mcp's `parity.test.ts` (counts the Server Actions and
+//         tool handlers of the FULL tree, which a stripped scaffold lacks).
+//     The exclusion is per file, not a `testPathIgnorePatterns` entry in the
+//     scaffold's jest config: that would hide these suites from a keyed
+//     scaffold too, and from the suites a slice owns.
+//   - database/__tests__/build.test.ts (#7959) — the monorepo build probe
+//     (#7565). Its `beforeAll` symlinks `REPO_ROOT/packages` and copies
+//     `REPO_ROOT/tsconfig.base.json`, neither of which a scaffold has, so it
+//     red the scaffold's database jest run. Matched exactly, not by basename
+//     in `EXCLUDE_FILES`, which would drop a `build.test.ts` anywhere in the
+//     snapshot; every other database suite still ships.
 export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/web/__tests__",
     "apps/web/app/__tests__",
@@ -2023,6 +2127,21 @@ export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/api/src/__tests__/api-parity-paid.test.ts",
     "apps/mcp/__tests__/api-parity.test.ts",
     "apps/mcp/__tests__/pro-tool-call-gate.test.ts",
+    "apps/mcp/__tests__/write-tool-guard.test.ts",
+    "apps/api/src/services/__tests__/aeo-score.test.ts",
+    "apps/api/src/routes/leads/__tests__/index.test.ts",
+    "apps/api/src/routes/workspaces/__tests__/inbox-wire-schemas.test.ts",
+    "apps/api/src/__tests__/server.test.ts",
+    "apps/api/src/__tests__/cors.test.ts",
+    "apps/api/src/__tests__/root-modules.test.ts",
+    "apps/api/src/__tests__/module-exclusion.test.ts",
+    "apps/api/src/openapi/__tests__/surface-drift.test.ts",
+    "apps/api/src/__tests__/review-surface-registration.test.ts",
+    "apps/api/src/__tests__/workspace-module-registration.test.ts",
+    "apps/mcp/__tests__/workspace-surface.test.ts",
+    "apps/mcp/__tests__/parity.test.ts",
+    "apps/mcp/__tests__/audit.test.ts",
+    "database/__tests__/build.test.ts",
 ];
 export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
     const roots = new Set(snapshotRoots);

package/dist/programmatic.js

@@ -747,11 +747,14 @@ export async function scaffold(opts) {
     // two return pages, once every layer has landed (so the spoke filter has
     // already dropped the hub-checkout files) and before the manifest, whose
     // code-route rows then record /checkout/thank-you and /checkout/unavailable.
+    // #8217 D8 — a spoke that signs in through its hub also gets the billing
+    // action and the web seam render that reaches it.
     const spokeCommerce = spoke !== undefined && result.modules.includes("commerce");
     if (spokeCommerce) {
         writeSpokeCheckoutSlice(result.targetDir, {
             site: spokeCheckoutSite(projectName),
             versions,
+            signIn: spoke.signIn,
         });
     }
     // #6944 — the manifest records what this scaffold IS, once every layer has

package/dist/spoke-checkout.d.ts

@@ -1,6 +1,7 @@
 import type { EnvCatalogEntry, PlanEnvRowsOptions } from "./lib/declared-env.js";
 import { type InstallReportRow } from "./lib/extract-module-bundle.js";
 import { type WorkspaceVersionMap } from "./substitute.js";
+import { type SignInMode } from "./topology.js";
 /** The checkout package a spoke's two route files import. */
 export declare const SPOKE_CHECKOUT_PACKAGE = "@working-theory/spoke-checkout";
 /** The site's checkout data — written once, the site's from then on. */
@@ -48,13 +49,19 @@ export declare const CHECKOUT_E2E_WORKFLOW: string;
 /**
  * The slice for `site`, in order: the two route files, the config, the two
  * pages (D3), then the checkout e2e workflow (#7839 D8), which does not
- * depend on `site`. Throws `TopologyError` for an invalid stamp (SEC-7838-10).
+ * depend on `site`. With `signIn: "hub"` the billing action is the third
+ * pair, so the first three paths are `SPOKE_CHECKOUT_ROUTE_FILES` (#8217 D8).
+ * Throws `TopologyError` for an invalid stamp (SEC-7838-10).
  */
-export declare function renderSpokeCheckoutFiles(site: string): [string, string][];
+export declare function renderSpokeCheckoutFiles(site: string, opts?: {
+    signIn?: SignInMode | undefined;
+}): [string, string][];
 /**
  * Write the slice into `targetDir` (D3). A file that already exists is left
  * byte-for-byte and reported `skipped` — the config is the site's once
- * written. Adds the package to `apps/web/package.json` when absent, and
+ * written. With `signIn: "hub"` (#8217 D8) the slice carries the billing
+ * action, and the web seam — generated, so always rewritten — becomes the
+ * billing render: reported `patched` when it changed, not at all when equal. Adds the package to `apps/web/package.json` when absent, and
  * raises a plain pin older than the one it writes (#7839): the generated
  * checkout e2e workflow runs a command a `^0.2.0` pin never reaches. Any
  * other range — newer, `workspace:`, a tag — is the site's and is kept.
@@ -64,4 +71,5 @@ export declare function renderSpokeCheckoutFiles(site: string): [string, string]
 export declare function writeSpokeCheckoutSlice(targetDir: string, opts: {
     site: string;
     versions: WorkspaceVersionMap;
+    signIn?: SignInMode | undefined;
 }): InstallReportRow[];