create-ailk 0.18.0 → 0.19.1

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/dist/add-module.js

@@ -40,7 +40,7 @@ import { ParseError, parseModules } from "./parse-args.js";
 import { writeSpokeFlowsReadme } from "./seed-flows.js";
 import { SITE_ROSTER_PATH, moduleRosterRows, planRosterAppend, readSiteRoster, siteRosterProblems, } from "./site-roster.js";
 import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
-import { MODULE_SURFACES, NAV_CONFIG_PATH, readNavConfigStamp, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
+import { MODULE_SURFACES, NAV_CONFIG_PATH, isUnservedSurfaceContent, readNavConfigStamp, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { TopologyError, isSpokeExcluded, readSiteTopology, readSpokeShape, spokeDestination, spokeModuleRefusal, } from "./topology.js";
 /**
@@ -155,9 +155,14 @@ export async function applyModuleToScaffold(opts) {
         markers: opts.markers,
         existingFilePolicy: "skip-existing",
         checkPatches: checkPlusConfigPatches,
+        // #8427 D4 — composed with the spoke filter: a module bundle never
+        // writes a seed under a gateable surface this site's own
+        // `architecture.yaml` header (resolved above, into `surfaces`) does
+        // not enable.
+        skip: (destination) => (spoke !== undefined && isSpokeExcluded(destination, spoke)) ||
+            isUnservedSurfaceContent(destination, surfaces),
         ...(spoke !== undefined
             ? {
-                skip: (destination) => isSpokeExcluded(destination, spoke),
                 // #7876 D10 — a module flow file lands in flows/ as declared data.
                 remapDestination: spokeDestination,
             }
@@ -165,12 +170,15 @@ export async function applyModuleToScaffold(opts) {
     });
     // #7838 D8 — commerce on a spoke brings the spoke's own checkout, stamped
     // from the site directory's name (the `projectName` scaffold() defaults to).
-    // A file the site already has is left as it is.
+    // A file the site already has is left as it is. #8217 D8 — on a spoke that
+    // signs in through its hub, the billing action and its seam render too, so
+    // re-running add-module commerce gives an existing commerce spoke the action.
     const spokeCommerce = spoke !== undefined && opts.moduleName === "commerce";
     const checkoutRows = spokeCommerce
         ? writeSpokeCheckoutSlice(targetAbs, {
             site: spokeCheckoutSite(basename(targetAbs)),
             versions: opts.versions,
+            signIn: spoke.signIn,
         })
         : [];
     // #7876 D9 — a spoke that just gained the flow stepper says what its

package/dist/category-profile.d.ts

@@ -50,6 +50,16 @@ export declare const CATEGORY_PROFILE_SHAPES: {
  * set-equal to the `schema-dts` closure, so it cannot drift silently.
  */
 export declare const LOCAL_BUSINESS_TYPES: ReadonlySet<string>;
+/**
+ * The leaf category slugs, in registry order — create-ailk's own copy of the
+ * site-category registry's leaves (`SITE_CATEGORIES`, #5830). A literal, not
+ * a type import, so the emitted `.d.ts` of the public tarball names no
+ * `@working-theory/*` package (#8412); `category-slugs.test.ts` proves it
+ * equal to the registry, so it cannot drift silently.
+ */
+export declare const CATEGORY_SLUGS: readonly ["accounting", "legal", "consulting", "hvac", "roofing", "plumbing", "electrical", "landscaping", "auto-repair", "real-estate", "technology", "medical-specialty"];
+/** A leaf category slug — the only thing a template's `categories` names. */
+export type CategorySlug = (typeof CATEGORY_SLUGS)[number];
 export declare const OFFERING_PRICING: readonly ["quote", "fixed", "hourly", "subscription"];
 export declare const PROOF_KINDS: readonly ["credential", "reviews", "before-after", "response-time", "guarantee", "experience"];
 export declare const CONTENT_POSTURES: readonly ["instructions", "sample"];

package/dist/category-profile.js

@@ -71,6 +71,27 @@ export const LOCAL_BUSINESS_TYPES = new Set([
     "TennisComplex", "TireShop", "TouristInformationCenter", "ToyStore",
     "TravelAgency", "VacationRental", "WholesaleStore", "Winery",
 ]);
+/**
+ * The leaf category slugs, in registry order — create-ailk's own copy of the
+ * site-category registry's leaves (`SITE_CATEGORIES`, #5830). A literal, not
+ * a type import, so the emitted `.d.ts` of the public tarball names no
+ * `@working-theory/*` package (#8412); `category-slugs.test.ts` proves it
+ * equal to the registry, so it cannot drift silently.
+ */
+export const CATEGORY_SLUGS = [
+    "accounting",
+    "legal",
+    "consulting",
+    "hvac",
+    "roofing",
+    "plumbing",
+    "electrical",
+    "landscaping",
+    "auto-repair",
+    "real-estate",
+    "technology",
+    "medical-specialty",
+];
 export const OFFERING_PRICING = ["quote", "fixed", "hourly", "subscription"];
 export const PROOF_KINDS = [
     "credential",

package/dist/derive-architecture.d.ts

@@ -22,7 +22,11 @@ export interface DeriveArchitectureOptions {
     /** Spoke only: whether the spoke keeps `apps/mcp` (default true). */
     mcp?: boolean;
 }
-/** The only spoke files that may import @working-theory/spoke-checkout (#7873). */
+/**
+ * The only spoke files that may import @working-theory/spoke-checkout (#7873):
+ * the buy route, the webhook route and — on a spoke that signs in through its
+ * hub — the billing action (#8217 D9, a reviewed change to the #7873 rule).
+ */
 export declare const SPOKE_CHECKOUT_ROUTE_FILES: readonly string[];
 /** The forbidden patterns a spoke's apps/web carries (#7873, brief Part 2 §2). */
 export declare const SPOKE_WEB_FORBIDDEN_PATTERNS: readonly ForbiddenPattern[];

package/dist/derive-architecture.js

@@ -27,10 +27,15 @@ const SPOKE_TIERS = {
 // import only to a workspace on disk, so the one way to ban an npm package is
 // a line-level forbidden pattern. These go under the spoke's own `apps.web`
 // and `apps.mcp` only — never top level, and never on a hub derivation.
-/** The only spoke files that may import @working-theory/spoke-checkout (#7873). */
+/**
+ * The only spoke files that may import @working-theory/spoke-checkout (#7873):
+ * the buy route, the webhook route and — on a spoke that signs in through its
+ * hub — the billing action (#8217 D9, a reviewed change to the #7873 rule).
+ */
 export const SPOKE_CHECKOUT_ROUTE_FILES = Object.freeze([
     "apps/web/app/api/checkout/[offering]/route.ts",
     "apps/web/app/api/webhooks/stripe/route.ts",
+    "apps/web/app/[locale]/(authed)/account/billing/spoke-billing.action.ts",
 ]);
 /**
  * A line-level regex for an import of `specifier` or one of its subpaths, in
@@ -45,10 +50,10 @@ function specifierForm(specifier) {
     const literal = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     return `\\b(?:from|import|require)\\s*\\(?\\s*${q}${literal}(?:/[^'"\`]*)?${q}`;
 }
-/** P1 with no exclusions — a kept apps/mcp's form; apps/web adds the two routes. */
+/** P1 with no exclusions — a kept apps/mcp's form; apps/web adds the route files. */
 const SPOKE_CHECKOUT_PATTERN = Object.freeze({
     pattern: specifierForm("@working-theory/spoke-checkout"),
-    reason: "Spoke checkout: only the buy route and the webhook route may import @working-theory/spoke-checkout (brief Part 2 §2, #7873)",
+    reason: "Spoke checkout: only the buy route, the webhook route and the billing action may import @working-theory/spoke-checkout (brief Part 2 §2, #7873, #8217)",
 });
 const STRIPE_CLIENT_PATTERN = Object.freeze({
     pattern: specifierForm("@working-theory/stripe-client"),

package/dist/index.d.ts

@@ -14,6 +14,6 @@ export type { HomeSeedOutcome } from "./design-home.js";
 export { SITE_ROSTER_PATH, readSiteRoster, siteRosterProblems, } from "./site-roster.js";
 export { SYNC_ROUTES_HELP, formatSyncRoutesReport, listTemplateRouteDirs, parseSyncRoutesArgs, syncRoutes, type RouteReport, type SyncRoutesOptions, type SyncRoutesResult, } from "./sync-routes.js";
 export { deriveArchitecture } from "./derive-architecture.js";
-export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, type Surface, } from "./surfaces.js";
+export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, isUnservedSurfaceContent, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, type Surface, } from "./surfaces.js";
 export { substituteMarkers, substituteWorkspaceVersions, type MarkerMap, type WorkspaceVersionMap, } from "./substitute.js";
 export { validateTarget, ValidationError } from "./validate.js";

package/dist/index.js

@@ -30,6 +30,6 @@ export { deriveArchitecture } from "./derive-architecture.js";
 // The route-surface registry (#4154) — which public routes a scaffold carries.
 // Exported so tooling can answer "what surfaces does this site declare" without
 // re-parsing architecture.yaml.
-export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, } from "./surfaces.js";
+export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, isUnservedSurfaceContent, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, } from "./surfaces.js";
 export { substituteMarkers, substituteWorkspaceVersions, } from "./substitute.js";
 export { validateTarget, ValidationError } from "./validate.js";

package/dist/lib/license-key-files.d.ts

@@ -21,9 +21,12 @@ export declare function appendLine(text: string, line: string): string;
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
  *
- * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
- * `apps/api`, so it keeps the key in `ailk.key` alone.
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) or any
+ * site without `apps/api` (#7779) keeps the key in `ailk.key` alone.
+ *
+ * Returns the key files it holds the key in, relative to `dir`
+ * (`LICENSE_KEY_FILE`, then `LICENSE_ENV_FILE` when written).
  */
 export declare function writeLicenseKeyFiles(dir: string, key: string, opts?: {
     apiEnv?: boolean;
-}): void;
+}): string[];

package/dist/lib/license-key-files.js

@@ -86,16 +86,21 @@ function upsertEnvLine(existing, key) {
  * `ailk.key` when no existing line covers it. Idempotent — a second call with
  * the same key changes no byte.
  *
- * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) has no
- * `apps/api`, so it keeps the key in `ailk.key` alone.
+ * `apiEnv: false` skips the `apps/api/.env` line — a spoke (#7426 D6) or any
+ * site without `apps/api` (#7779) keeps the key in `ailk.key` alone.
+ *
+ * Returns the key files it holds the key in, relative to `dir`
+ * (`LICENSE_KEY_FILE`, then `LICENSE_ENV_FILE` when written).
  */
 export function writeLicenseKeyFiles(dir, key, opts = {}) {
     assertLicenseKeyShape(key);
     writeOwnerOnly(join(dir, LICENSE_KEY_FILE), `${key}\n`);
+    const written = [LICENSE_KEY_FILE];
     if (opts.apiEnv !== false) {
         const envPath = join(dir, LICENSE_ENV_FILE);
         const env = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
         writeOwnerOnly(envPath, upsertEnvLine(env, key));
+        written.push(LICENSE_ENV_FILE);
     }
     const ignorePath = join(dir, ".gitignore");
     const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
@@ -104,4 +109,5 @@ export function writeLicenseKeyFiles(dir, key, opts = {}) {
         .some((l) => KEY_IGNORE_LINES.has(l.trim()));
     if (!covered)
         writeFileSync(ignorePath, appendLine(ignore, LICENSE_KEY_FILE));
+    return written;
 }

package/dist/lib/scaffold-render-sweep.d.ts

@@ -53,6 +53,15 @@ export declare function assessClaimGatedRoute(input: {
     hops: RedirectHop[];
     status: number | null;
 }): SweepVerdict;
+/**
+ * A `redirect()` thrown by a Server Component after the shell has flushed is
+ * not an HTTP 3xx: the response is a 200 whose flight payload carries the
+ * digest `NEXT_REDIRECT;<replace|push>;<url>;<status>;`. The driver follows it
+ * as a hop exactly like a `Location` header (#8311 — `/account/settings`
+ * forwards to `/account/general` this way). Null when the HTML carries no
+ * such digest.
+ */
+export declare function streamedRedirect(html: string): RedirectHop | null;
 /**
  * Decide whether a page route rendered, under the real locale, with its own
  * content. The first failed rule is the reason:
@@ -96,6 +105,20 @@ export declare function assessConfigGatedRoute(input: {
     html: string;
     locale: string;
 }): SweepVerdict;
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export declare function sitemapSweepEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -115,6 +138,15 @@ export declare function assessUnknownSlug(input: {
     hops: RedirectHop[];
     status: number | null;
 }): SweepVerdict;
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export declare function sitemapLocPaths(xml: string): string[];
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export declare function assessPrerenderManifest(manifest: {
     dynamicRoutes?: Record<string, unknown>;

package/dist/lib/scaffold-render-sweep.js

@@ -122,6 +122,24 @@ function htmlLang(html) {
 function flightDigest(html) {
     return /\\"digest\\":\\"([^"\\]*)\\"/.exec(html)?.[1] ?? null;
 }
+/**
+ * A `redirect()` thrown by a Server Component after the shell has flushed is
+ * not an HTTP 3xx: the response is a 200 whose flight payload carries the
+ * digest `NEXT_REDIRECT;<replace|push>;<url>;<status>;`. The driver follows it
+ * as a hop exactly like a `Location` header (#8311 — `/account/settings`
+ * forwards to `/account/general` this way). Null when the HTML carries no
+ * such digest.
+ */
+export function streamedRedirect(html) {
+    const digest = flightDigest(html);
+    if (digest === null || !digest.startsWith("NEXT_REDIRECT;"))
+        return null;
+    const [, , location = "", status = ""] = digest.split(";");
+    if (location === "")
+        return null;
+    const code = Number.parseInt(status, 10);
+    return { status: Number.isFinite(code) ? code : 307, location };
+}
 /**
  * Whether an `<h1>`'s inner HTML carries a name: text once tags are stripped,
  * or an image with a non-empty `alt` (the Hero's lockup renders the wordmark
@@ -170,9 +188,12 @@ export function assessPageRender(input) {
         return { ok: false, reason: `${route} -> rendered under locale "${lang}"` };
     const digest = flightDigest(html);
     if (digest !== null) {
-        const why = digest.startsWith("NEXT_HTTP_ERROR_FALLBACK;404")
-            ? "streamed not-found"
-            : `streamed error (digest ${digest})`;
+        const redirect = streamedRedirect(html);
+        const why = redirect !== null
+            ? `streamed redirect to ${redirect.location} that was not followed`
+            : digest.startsWith("NEXT_HTTP_ERROR_FALLBACK;404")
+                ? "streamed not-found"
+                : `streamed error (digest ${digest})`;
         return { ok: false, reason: `${route} -> ${why}` };
     }
     const marker = ownContentMarker(html);
@@ -218,6 +239,23 @@ export function assessConfigGatedRoute(input) {
 function headingTexts(html) {
     return [...html.matchAll(/<h1\b[^>]*>([\s\S]*?)<\/h1>/gi)].map((m) => (m[1] ?? "").replace(/<[^>]*>/g, ""));
 }
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export function sitemapSweepEnv(env) {
+    const gated = new Set(Object.values(CONFIG_GATED_ROUTES));
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !gated.has(name)));
+}
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -270,6 +308,41 @@ export function assessUnknownSlug(input) {
         return { ok: false, reason: `${route} -> status ${status} (expected 404 for an unknown slug)` };
     return { ok: true, reason: "404" };
 }
+/**
+ * The five entities `escapeXml` (`apps/web/app/sitemap.xml/route.ts`) writes,
+ * reversed.
+ */
+const XML_ENTITIES = {
+    "&amp;": "&",
+    "&lt;": "<",
+    "&gt;": ">",
+    "&quot;": '"',
+    "&apos;": "'",
+};
+function unescapeXml(value) {
+    return value.replace(/&amp;|&lt;|&gt;|&quot;|&apos;/g, (entity) => XML_ENTITIES[entity] ?? entity);
+}
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export function sitemapLocPaths(xml) {
+    const seen = new Set();
+    const paths = [];
+    for (const match of xml.matchAll(/<loc>([^<]*)<\/loc>/g)) {
+        const loc = unescapeXml(match[1] ?? "");
+        const path = new URL(loc).pathname;
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        paths.push(path);
+    }
+    return paths;
+}
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export function assessPrerenderManifest(manifest) {
     const locale = Object.keys(manifest.dynamicRoutes ?? {})

package/dist/license-set.d.ts

@@ -24,7 +24,7 @@ export interface LicenseSetIO {
     /** Defaults to `spawnSync` with `shell: false` (see `defaultRunner`). */
     runner?: LicenseSetRunner;
 }
-export declare const LICENSE_SET_HELP = "create-ailk license set \u2014 put your licence key into an existing site.\n\nUsage:\n  pnpm create ailk@latest license set <key> [<target-dir>]\n  pnpm create ailk@latest license set - [<target-dir>] < key.txt\n\nArguments:\n  <key>                    Your licence key, or `-` to read it from stdin\n                           (keeps it out of your shell history).\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nWrites the key to ailk.key and apps/api/.env (owner-only, gitignored). When the\nsite (or apps/api, or apps/web) is linked to Vercel, it also replaces the\nproduction AILK_LICENSE_KEY variable and redeploys.\n";
+export declare const LICENSE_SET_HELP = "create-ailk license set \u2014 put your licence key into an existing site.\n\nUsage:\n  pnpm create ailk@latest license set <key> [<target-dir>]\n  pnpm create ailk@latest license set - [<target-dir>] < key.txt\n\nArguments:\n  <key>                    Your licence key, or `-` to read it from stdin\n                           (keeps it out of your shell history).\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nWrites the key to ailk.key, and to apps/api/.env when the site has apps/api\n(owner-only, gitignored). When the site (or apps/api, or apps/web) is linked to\nVercel, it also replaces the production AILK_LICENSE_KEY variable and redeploys.\n";
 /** `spawnSync`, never through a shell; stdin piped only when there is input. */
 export declare const defaultRunner: LicenseSetRunner;
 /**

package/dist/license-set.js

@@ -7,8 +7,9 @@
  *
  *   1. The target (default: cwd) must contain `architecture.yaml` — the
  *      `sync-routes` precondition — else exit 1 with nothing written.
- *   2. `writeLicenseKeyFiles` — `ailk.key` + `apps/api/.env`, both 0600 and
- *      gitignored; the same writer `--license` uses.
+ *   2. `writeLicenseKeyFiles` — `ailk.key`, plus `apps/api/.env` only when
+ *      `apps/api` already exists (#7779), both 0600 and gitignored; the same
+ *      writer `--license` uses. The output names only the files written.
  *   3. For each of `<dir>`, `<dir>/apps/api`, `<dir>/apps/web` holding
  *      `.vercel/project.json`, with that directory as `cwd`:
  *        a. print the linked `projectId` about to change (SEC-13);
@@ -31,7 +32,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import { LICENSE_ENV_FILE, LICENSE_ENV_VAR, LICENSE_KEY_FILE, assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-files.js";
+import { LICENSE_ENV_VAR, LICENSE_KEY_FILE, assertLicenseKeyShape, writeLicenseKeyFiles, } from "./lib/license-key-files.js";
 export const LICENSE_SET_HELP = `create-ailk license set — put your licence key into an existing site.
 
 Usage:
@@ -44,9 +45,9 @@ Arguments:
   <target-dir>             An already-scaffolded repo (contains
                            architecture.yaml). Defaults to the current dir.
 
-Writes the key to ailk.key and apps/api/.env (owner-only, gitignored). When the
-site (or apps/api, or apps/web) is linked to Vercel, it also replaces the
-production AILK_LICENSE_KEY variable and redeploys.
+Writes the key to ailk.key, and to apps/api/.env when the site has apps/api
+(owner-only, gitignored). When the site (or apps/api, or apps/web) is linked to
+Vercel, it also replaces the production AILK_LICENSE_KEY variable and redeploys.
 `;
 const LINK_DIRS = [".", join("apps", "api"), join("apps", "web")];
 const VERCELIGNORE_LINES = [LICENSE_KEY_FILE, ".env"];
@@ -151,9 +152,13 @@ export function runLicenseSet(argv, io) {
     if (!existsSync(join(target, "architecture.yaml"))) {
         return fail(`not a scaffolded repo: no architecture.yaml at ${target}. Run it from your site's root, or pass the site's directory.`);
     }
-    writeLicenseKeyFiles(target, key);
+    // A site without apps/api (a web-only spoke) keeps the key in ailk.key
+    // alone — writing apps/api/.env would create an app directory it never had.
+    const files = writeLicenseKeyFiles(target, key, {
+        apiEnv: existsSync(join(target, "apps", "api")),
+    });
     const keyFile = join(target, LICENSE_KEY_FILE);
-    const written = `Wrote ${LICENSE_KEY_FILE} and ${LICENSE_ENV_FILE.split("\\").join("/")} in ${target}`;
+    const written = `Wrote ${files.map((f) => f.split("\\").join("/")).join(" and ")} in ${target}`;
     io.stdout(`[create-ailk] ${written} (owner-only, gitignored).\n`);
     const linked = LINK_DIRS.map((d) => join(target, d)).filter((d) => existsSync(join(d, ".vercel", "project.json")));
     if (linked.length === 0) {