create-ailk 0.18.0 → 0.19.1

package/dist/module-architecture.js

@@ -77,8 +77,8 @@ const PUBLIC_SCHEDULING_VAR_PATTERN = [
  * live-key-shaped token in this file's source would itself trip the repo's
  * own live-key hard block (`rules/environment-boundaries.md`). `apps/api` is
  * excluded because `STRIPE_SECRET_KEY` legitimately lives there, gated by
- * `assertSandboxKey`'s sandbox-only allow-list at request time and by
- * `assertCommerceSandboxKey` at boot (server.ts) — this pattern catches a
+ * lib/stripe.ts's admitted-key guard at request time and by
+ * `admitCommerceStripeKey` at boot (server.ts) — this pattern catches a
  * live-shaped key leaking anywhere ELSE (a fixture, a client component, a
  * `NEXT_PUBLIC_` var).
  */
@@ -157,15 +157,43 @@ export const ARCHITECTURE_BASE = {
  * file behind it — the three operator route files, the two member route
  * files, the member resolution (`services/member-area.ts`) and the member
  * data boundary (`lib/member-store.ts`).
+ *
+ * #8169 D9 adds the five Phase 1 member reads registered under that same
+ * disjunction. Its two other reads — `routes/member/meeting-types.ts` and
+ * `availability.ts` — reach `services/scheduling/`, so they are the
+ * `scheduling` slice's, not listed here.
+ *
+ * #8170 D11 adds the four member writes registered under that same
+ * disjunction (the message POST rides `messages.ts`). The fifth —
+ * `routes/member/bookings.ts` — reaches `services/scheduling/`, so it is the
+ * `scheduling` slice's.
  */
 const MEMBER_AREA_FILES = [
     "apps/api/src/routes/workspaces/pieces.ts",
     "apps/api/src/routes/workspaces/plan.ts",
     "apps/api/src/routes/workspaces/messages-out.ts",
+    // #8171 D8 — the workspace Requests read; imports only pieces.ts,
+    // lib/tenant-db.ts and @working-theory/validation.
+    "apps/api/src/routes/workspaces/requests.ts",
     "apps/api/src/routes/member/pieces.ts",
     "apps/api/src/routes/member/messages.ts",
+    "apps/api/src/routes/member/purchases.ts",
+    "apps/api/src/routes/member/appointments.ts",
+    "apps/api/src/routes/member/artifacts.ts",
+    "apps/api/src/routes/member/request-form.ts",
+    "apps/api/src/routes/member/billing.ts",
+    "apps/api/src/routes/member/requests.ts",
+    "apps/api/src/routes/member/artifact-review.ts",
+    "apps/api/src/routes/member/profile.ts",
+    "apps/api/src/routes/member/deletion-request.ts",
+    // #8438 D6 — the member's own consents; the same gate as the writes above.
+    "apps/api/src/routes/member/consents.ts",
     "apps/api/src/services/member-area.ts",
     "apps/api/src/lib/member-store.ts",
+    // #8226 D12 — the member-request match CLI; both import member-store.ts,
+    // which a build without the member slice does not carry.
+    "apps/api/src/lib/member-request-match.ts",
+    "apps/api/src/bin/member-request-match.ts",
 ];
 /**
  * The workspace asset store (#5854), CO-OWNED by the `workspace` and
@@ -759,6 +787,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/index.ts",
             "apps/api/src/routes/workspaces/sessions.ts",
             "apps/api/src/routes/workspaces/config.ts",
+            // #8438 D8 — the Admin owner's consents to Working Theory: registered
+            // under `isModuleEnabled("multi-tenant")` alone, the module that
+            // contributes the Admin app.
+            "apps/api/src/routes/consent/platform.ts",
             // Co-owned with `workspace` (#5853): the content-write scope is gated on
             // content-write AND (workspace || multi-tenant) and this file imports
             // lib/tenant-db.ts, so each tenancy slice must deliver it.
@@ -864,6 +896,18 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/waitlist/components/SignupsTable.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/components/WaitlistComparisonTabs.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/components/status-badges.tsx",
+            // #7389 — the three api suites that enable `multi-tenant` ALONE and so
+            // reach files this slice delivers (`services/tenant-context.ts` and the
+            // `routes/workspaces/` index). Each is listed individually, never as a
+            // glob (the `scheduling` slice's § D12 property 1: a glob entry is a
+            // silent no-op), so it ships to a keyed scaffold with the slice and is
+            // stripped from a keyless one with it — instead of a keyless scaffold
+            // carrying a test that raises `createNoMappedModuleFoundError`. A suite
+            // that enables SEVERAL paid modules cannot be owned by any one of
+            // them; those are `EXCLUDE_TEMPLATE_DIRS` entries below.
+            "apps/api/src/services/__tests__/lead-promotion.test.ts",
+            "apps/api/src/services/__tests__/leads-inbox.test.ts",
+            "apps/api/src/__tests__/content-write-production-boot.test.ts",
             "apps-paid/admin/**",
         ],
         // The whole-app glob above lands its files at their REPO-relative path
@@ -1232,6 +1276,13 @@ export const MODULE_SLICES = {
             // records: "each tenancy slice must deliver it").
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/services/tenant-context.ts",
+            // #7389 — `routes/workspaces/__tests__/meetings.test.ts` and
+            // `meetings-connection.test.ts` (listed below) register the real
+            // `tenantPreHandlerPlugin` in front of `meetings.ts`, so a scheduling
+            // scaffold without `multi-tenant` could not load them. It imports only
+            // `services/tenant-context.ts` (owned above) and the base
+            // `default-tenant.ts`, so co-owning it keeps the closure tight.
+            "apps/api/src/middleware/tenant.ts",
             // #7533 — a scheduling connection per workspace. `connections.ts` (the
             // cipher + the one SchedulingConnection data-access boundary) and
             // `resolve.ts` (the workspace-aware provider resolution the meetings,
@@ -1248,6 +1299,23 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/schedule/__tests__/public-connection.test.ts",
             "apps/api/src/routes/webhooks/__tests__/calcom-connection.test.ts",
             "apps/api/src/config/__tests__/scheduling-credential-key.test.ts",
+            // #8169 D9 — the two member reads that reach `services/scheduling/`,
+            // registered under `scheduling && (workspace || multi-tenant)`, plus
+            // the three member files they import, which this slice then CO-OWNS
+            // with the two tenancy slices (`MEMBER_AREA_FILES`) — exactly as it
+            // co-owns `lib/tenant-db.ts` for `routes/workspaces/meetings.ts` above.
+            "apps/api/src/routes/member/meeting-types.ts",
+            "apps/api/src/routes/member/availability.ts",
+            // #8170 D11 — the member booking, the same shape.
+            "apps/api/src/routes/member/bookings.ts",
+            "apps/api/src/routes/member/pieces.ts",
+            "apps/api/src/services/member-area.ts",
+            "apps/api/src/lib/member-store.ts",
+            // #7389 — the two api suites that enable `scheduling` alone, so they
+            // strip with `routes/schedule/index.ts`, which they load by a computed
+            // specifier the import-graph closure cannot follow.
+            "apps/api/src/__tests__/schedule-forwarded-rate-limit.test.ts",
+            "apps/api/src/__tests__/openapi-keyless-hub.test.ts",
         ],
         // pageContributions (spec 5478; parent § D6 shape 1) — the booker, the
         // per-booking-type page and the confirmation page, whose route files
@@ -1463,6 +1531,10 @@ export const MODULE_SLICES = {
             "apps/api/src/bin/listing-csv-sweep.ts",
             "apps/api/src/bin/followup-sweep.ts",
             "apps/api/src/bin/seed-waitlist-experiments.ts",
+            // #7389 — the listing-directory suite enables `signal-collectors` alone
+            // and loads `routes/waitlist-signups/index.ts` through the server it
+            // builds, so it strips with that route. Individually, never as a glob.
+            "apps/api/src/routes/project-listings/__tests__/directory.test.ts",
             "apps/mcp/src/tools/get_flow.ts",
             "apps/mcp/src/tools/submit_flow_step.ts",
             // #3591 PR-E — the signed-in MCP tools that twin the tenant-scoped
@@ -1777,7 +1849,7 @@ export const MODULE_SLICES = {
             {
                 pattern: STRIPE_LIVE_KEY_PATTERN,
                 paths_excluded: ["apps/api/**"],
-                reason: "The commerce credential belongs to apps/api, behind assertSandboxKey's sandbox-only allow-list. A live-mode-shaped key anywhere else is a leak, not a config choice",
+                reason: "The commerce credential belongs to apps/api, behind lib/stripe.ts's admitted-key guard. A live-mode-shaped key anywhere else is a leak, not a config choice",
             },
         ],
         // ownedFiles (S1, #5088). SOURCE files only (#5182 D6) — no __tests__/,
@@ -2013,6 +2085,44 @@ export function coOwnedModuleDestinations() {
 //     docs/specs/7315-a-gated-pro-tool-re-spec.md D4) — same reason as the
 //     three suites above: it imports `SITE_ARGS` from the monorepo's root
 //     `tests/parity/` tree, which no scaffold carries.
+//   - apps/mcp/__tests__/write-tool-guard.test.ts (#8071, spec
+//     docs/specs/8071-mcp-write-guard-spec.md D4) — it reads every anonymous
+//     catalog tool's handler file, and a scaffold carries only the handler
+//     files of the modules it selected while the catalog lists every tool.
+//     `WRITE_TOOLS` is edited in the monorepo, which is where it must run.
+//   - the suites a keyless scaffold's own `pnpm test` cannot run (#7389) —
+//     file entries, matched exactly. Two classes, neither of which a slice can
+//     own (a slice's `ownedFiles` carries a suite that needs ONE paid module;
+//     the six api suites that do are listed under `multi-tenant`, `scheduling`
+//     and `signal-collectors` above, and a keyed scaffold runs them):
+//       * monorepo fixtures — each reads a path only this repo has:
+//         `services/__tests__/aeo-score.test.ts` (packages/aeo's result.json),
+//         `routes/leads/__tests__/index.test.ts` (packages/validation's
+//         newsletter-lead fixture), `routes/workspaces/__tests__/
+//         inbox-wire-schemas.test.ts` (the root `tests/parity/` core),
+//         mcp's `workspace-surface.test.ts` (the same core) and mcp's
+//         `audit.test.ts` (the T1 fixture site's `project.yaml`).
+//       * whole-composition suites — each builds the real server or reads
+//         the whole tree under SEVERAL module sets, or asserts the
+//         monorepo's own identity, so no single slice is its owner and a
+//         scaffold that selected only some of the modules would fail it:
+//         `server.test.ts` (asserts the monorepo's "AI Launch Kit API" name,
+//         and a `signal-collectors` case), `cors.test.ts` (multi-tenant +
+//         scheduling), `root-modules.test.ts`, `module-exclusion.test.ts`,
+//         `openapi/__tests__/surface-drift.test.ts`,
+//         `review-surface-registration.test.ts` and
+//         `workspace-module-registration.test.ts` (each a matrix over module
+//         sets), and mcp's `parity.test.ts` (counts the Server Actions and
+//         tool handlers of the FULL tree, which a stripped scaffold lacks).
+//     The exclusion is per file, not a `testPathIgnorePatterns` entry in the
+//     scaffold's jest config: that would hide these suites from a keyed
+//     scaffold too, and from the suites a slice owns.
+//   - database/__tests__/build.test.ts (#7959) — the monorepo build probe
+//     (#7565). Its `beforeAll` symlinks `REPO_ROOT/packages` and copies
+//     `REPO_ROOT/tsconfig.base.json`, neither of which a scaffold has, so it
+//     red the scaffold's database jest run. Matched exactly, not by basename
+//     in `EXCLUDE_FILES`, which would drop a `build.test.ts` anywhere in the
+//     snapshot; every other database suite still ships.
 export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/web/__tests__",
     "apps/web/app/__tests__",
@@ -2023,6 +2133,21 @@ export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/api/src/__tests__/api-parity-paid.test.ts",
     "apps/mcp/__tests__/api-parity.test.ts",
     "apps/mcp/__tests__/pro-tool-call-gate.test.ts",
+    "apps/mcp/__tests__/write-tool-guard.test.ts",
+    "apps/api/src/services/__tests__/aeo-score.test.ts",
+    "apps/api/src/routes/leads/__tests__/index.test.ts",
+    "apps/api/src/routes/workspaces/__tests__/inbox-wire-schemas.test.ts",
+    "apps/api/src/__tests__/server.test.ts",
+    "apps/api/src/__tests__/cors.test.ts",
+    "apps/api/src/__tests__/root-modules.test.ts",
+    "apps/api/src/__tests__/module-exclusion.test.ts",
+    "apps/api/src/openapi/__tests__/surface-drift.test.ts",
+    "apps/api/src/__tests__/review-surface-registration.test.ts",
+    "apps/api/src/__tests__/workspace-module-registration.test.ts",
+    "apps/mcp/__tests__/workspace-surface.test.ts",
+    "apps/mcp/__tests__/parity.test.ts",
+    "apps/mcp/__tests__/audit.test.ts",
+    "database/__tests__/build.test.ts",
 ];
 export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
     const roots = new Set(snapshotRoots);

package/dist/programmatic.js

@@ -45,7 +45,7 @@ import { SITE_FONTS_PATH, renderSiteFonts } from "./site-fonts.js";
 import { planSiteManifest } from "./site-manifest.js";
 import { SITE_ROSTER_PATH, planHomeRecord, planSiteManifestDesign, readSiteRoster, withMeetPlaceholderSeeds, } from "./site-roster.js";
 import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
-import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
+import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, isUnservedSurfaceContent, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
 import { SPOKE_ONLY_FILES, TopologyError, applySpokeTransforms, isSpokeExcluded, normalizeHubSignInUrl, normalizeHubUrl, readSiteTopology, spokeExclusions, spokeDestination, spokeModuleRefusal, spokeModules, writeHubOriginEnv, writeHubSignInEnv, } from "./topology.js";
@@ -573,7 +573,14 @@ export async function scaffold(opts) {
             versions,
             markers,
             ownership,
+            // #8427 D4 — a module bundle never writes a file inside the content
+            // directory of a gateable surface the result does not enable (the
+            // signal-collectors `projects`-surface seeds, on a scaffold whose
+            // roster carries no /projects route). The spoke filter still drops
+            // whatever it already drops; remapDestination is unchanged.
             ...spokeSkip,
+            skip: (destination) => spokeSkip.skip?.(destination) === true ||
+                isUnservedSurfaceContent(destination, result.surfaces),
         });
     }
     // The template lands LAST — after `scaffoldSync` and after every module
@@ -747,11 +754,14 @@ export async function scaffold(opts) {
     // two return pages, once every layer has landed (so the spoke filter has
     // already dropped the hub-checkout files) and before the manifest, whose
     // code-route rows then record /checkout/thank-you and /checkout/unavailable.
+    // #8217 D8 — a spoke that signs in through its hub also gets the billing
+    // action and the web seam render that reaches it.
     const spokeCommerce = spoke !== undefined && result.modules.includes("commerce");
     if (spokeCommerce) {
         writeSpokeCheckoutSlice(result.targetDir, {
             site: spokeCheckoutSite(projectName),
             versions,
+            signIn: spoke.signIn,
         });
     }
     // #6944 — the manifest records what this scaffold IS, once every layer has

package/dist/site-roster.js

@@ -33,6 +33,7 @@ import { locatePageSections } from "./design-presets.js";
 import { diffTwoStrings } from "./lib/extract-module-bundle.js";
 import { MODULE_SLICES, normalizeModules, } from "./module-architecture.js";
 import { substituteMarkers } from "./substitute.js";
+import { isUnservedSurfaceContent, resolveSurfaces } from "./surfaces.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, resolveTemplate, rosterDeclares, shippedManifestPath, templateTreeDir, } from "./template-manifest.js";
 /** The site-root file that is the roster of record (#6658 D7). */
 export const SITE_ROSTER_PATH = ".ailk-site-manifest.json";
@@ -613,7 +614,7 @@ function spliceRows(file, rows) {
     return text.slice(0, open + 1) + body + text.slice(close);
 }
 /** Every `content/en/**.mdx` some layer installs into a site of this template and module set. */
-function layerInstalledSeeds(template, modules, opts) {
+function layerInstalledSeeds(template, modules, opts, surfaces) {
     const out = new Set();
     for (const root of [
         opts.templatesDir,
@@ -640,7 +641,15 @@ function layerInstalledSeeds(template, modules, opts) {
             for (const path of row.content ?? [])
                 out.add(path);
         }
-        destinations.push(...Object.values(slice.installMap ?? {}));
+        // #8427 D4 — a module installMap destination the scaffold's own
+        // surfaces do not serve is not "installed": the writer
+        // (programmatic.ts's module-bundle loop, add-module.ts) declines the
+        // write, so the reader must agree or report a seed that is not there.
+        for (const dest of Object.values(slice.installMap ?? {})) {
+            if (isUnservedSurfaceContent(dest, surfaces))
+                continue;
+            destinations.push(dest);
+        }
     }
     for (const to of destinations) {
         if (to.startsWith("content/en/") && to.endsWith(".mdx"))
@@ -666,7 +675,15 @@ export function siteRosterProblems(opts) {
     const roster = readSiteRoster(opts.targetDir);
     if (roster === undefined)
         return [];
-    const { modules } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    const { modules, surfaces: headerSurfaces } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    // #8427 D4 — the FULL effective surface set (module-contributed surfaces
+    // unioned with the header's own explicit list), the same set the writer
+    // resolves. Throws SurfaceError on a header surface that is unknown or
+    // owned by a module the site lacks — intended: `add-module` already
+    // refuses such a header before its first write, so a direct caller
+    // reaches the same refusal instead of a report built on a header the
+    // scaffold would never actually write.
+    const surfaces = resolveSurfaces(modules, headerSurfaces);
     const problems = [];
     const routes = roster.rows.map((r) => r.value["route"]);
     const seen = new Set();
@@ -715,7 +732,7 @@ export function siteRosterProblems(opts) {
     });
     // #6942 — the Free /meet placeholder seeds the scheduling module's rows keep.
     const declared = withMeetPlaceholderSeeds(effective);
-    const installed = [...layerInstalledSeeds(roster.template, modules, opts)]
+    const installed = [...layerInstalledSeeds(roster.template, modules, opts, surfaces)]
         .filter((path) => existsSync(join(opts.targetDir, path)))
         .sort();
     for (const path of installed) {

package/dist/spoke-checkout.d.ts

@@ -1,6 +1,7 @@
 import type { EnvCatalogEntry, PlanEnvRowsOptions } from "./lib/declared-env.js";
 import { type InstallReportRow } from "./lib/extract-module-bundle.js";
 import { type WorkspaceVersionMap } from "./substitute.js";
+import { type SignInMode } from "./topology.js";
 /** The checkout package a spoke's two route files import. */
 export declare const SPOKE_CHECKOUT_PACKAGE = "@working-theory/spoke-checkout";
 /** The site's checkout data — written once, the site's from then on. */
@@ -48,13 +49,19 @@ export declare const CHECKOUT_E2E_WORKFLOW: string;
 /**
  * The slice for `site`, in order: the two route files, the config, the two
  * pages (D3), then the checkout e2e workflow (#7839 D8), which does not
- * depend on `site`. Throws `TopologyError` for an invalid stamp (SEC-7838-10).
+ * depend on `site`. With `signIn: "hub"` the billing action is the third
+ * pair, so the first three paths are `SPOKE_CHECKOUT_ROUTE_FILES` (#8217 D8).
+ * Throws `TopologyError` for an invalid stamp (SEC-7838-10).
  */
-export declare function renderSpokeCheckoutFiles(site: string): [string, string][];
+export declare function renderSpokeCheckoutFiles(site: string, opts?: {
+    signIn?: SignInMode | undefined;
+}): [string, string][];
 /**
  * Write the slice into `targetDir` (D3). A file that already exists is left
  * byte-for-byte and reported `skipped` — the config is the site's once
- * written. Adds the package to `apps/web/package.json` when absent, and
+ * written. With `signIn: "hub"` (#8217 D8) the slice carries the billing
+ * action, and the web seam — generated, so always rewritten — becomes the
+ * billing render: reported `patched` when it changed, not at all when equal. Adds the package to `apps/web/package.json` when absent, and
  * raises a plain pin older than the one it writes (#7839): the generated
  * checkout e2e workflow runs a command a `^0.2.0` pin never reaches. Any
  * other range — newer, `workspace:`, a tag — is the site's and is kept.
@@ -64,4 +71,5 @@ export declare function renderSpokeCheckoutFiles(site: string): [string, string]
 export declare function writeSpokeCheckoutSlice(targetDir: string, opts: {
     site: string;
     versions: WorkspaceVersionMap;
+    signIn?: SignInMode | undefined;
 }): InstallReportRow[];

package/dist/spoke-checkout.js

@@ -1,8 +1,10 @@
 /**
  * The spoke checkout slice (#7838) — what a spoke carrying `commerce` gets in
- * `apps/web`: the buy route and the Stripe webhook route (the only two files
- * allowed to import the checkout package, #7873), the site's own
- * `lib/checkout-config.ts`, and the thank-you and unavailable return pages.
+ * `apps/web`: the buy route and the Stripe webhook route (allowed to import
+ * the checkout package, #7873), the site's own `lib/checkout-config.ts`, and
+ * the thank-you and unavailable return pages. A spoke that signs in through
+ * its hub also gets the billing action, the third file allowed to import the
+ * package, and the web seam render that reaches it (#8217 D6–D8).
  *
  * Every guarantee lives in `@working-theory/spoke-checkout` and arrives by a
  * package bump; these files are thin and, apart from the config's one stamp
@@ -23,7 +25,7 @@ import { SPOKE_CHECKOUT_ROUTE_FILES } from "./derive-architecture.js";
 import { ENV_CATALOG } from "./lib/env-catalog.js";
 import { diffTwoStrings, } from "./lib/extract-module-bundle.js";
 import { substituteWorkspaceVersions, } from "./substitute.js";
-import { TopologyError } from "./topology.js";
+import { TopologyError, WEB_SEAM_PATH, renderWebSeam, } from "./topology.js";
 /** The checkout package a spoke's two route files import. */
 export const SPOKE_CHECKOUT_PACKAGE = "@working-theory/spoke-checkout";
 const API_CLIENT_PACKAGE = "@working-theory/api-client";
@@ -131,6 +133,33 @@ const WEBHOOK_ROUTE = renderRoute({
     waiver: "the endpoint URL registered in Stripe, not a versioned API contract",
     exportLine: "export const { POST } = createSpokeCheckout(checkoutConfig).webhook;",
 });
+/**
+ * The spoke billing action (#8217 D6): wiring only, byte-identical across
+ * sites, so every guarantee arrives by a package bump. A plain server module
+ * (C2): its two exports take no argument, and the hub's read is its only
+ * source of customer ids.
+ */
+const BILLING_ACTION = [
+    "// The spoke billing action — GENERATED by create-ailk (#8217). Do not edit:",
+    "// every guarantee lives in the spoke-checkout package and arrives by a",
+    "// package bump. A plain server module, not a Server Action file: neither",
+    "// export takes an argument, and the hub's GET /v1/member/billing is the only",
+    "// source of customer ids. billing-source.ts reaches it through",
+    "// lib/topology.generated.ts and never imports the package.",
+    `import { member } from "${API_CLIENT_PACKAGE}";`,
+    `import { createSpokeCheckout } from "${SPOKE_CHECKOUT_PACKAGE}";`,
+    "",
+    `import { checkoutConfig } from "../../../../../lib/checkout-config";`,
+    `import { forwardedCookieInit } from "../../../../../lib/server-api";`,
+    "",
+    "const billing = createSpokeCheckout(checkoutConfig).billing.forMember(",
+    "  async () => member.billing(await forwardedCookieInit()),",
+    ");",
+    "",
+    "export const readSpokeBilling = billing.read;",
+    "export const spokeBillingPortalUrl = billing.portalUrl;",
+    "",
+].join("\n");
 /** The site's checkout data (D5). Only the `const SITE` line varies by site. */
 function renderConfig(site) {
     return [
@@ -138,9 +167,10 @@ function renderConfig(site) {
         "//",
         "// Written once by create-ailk and yours from then on: create-ailk never",
         "// rewrites it. The buy route and the Stripe webhook route build their",
-        "// handlers from it. Those two are the only files allowed to import the",
-        "// checkout package (architecture.yaml), so this file never imports it,",
-        "// stripe-client or the stripe SDK. Keep it to data and the fulfil callback.",
+        "// handlers from it, and so does the billing action on a spoke that signs",
+        "// in through its hub. Only those files may import the checkout package",
+        "// (architecture.yaml), so this file never imports it, stripe-client or the",
+        "// stripe SDK. Keep it to data and the fulfil callback.",
         "//",
         "// site       Stamped on every Checkout Session as metadata.site. This site's",
         "//            webhook acts only on its own stamp, and the hub ignores any stamp",
@@ -462,15 +492,20 @@ jobs:
 /**
  * The slice for `site`, in order: the two route files, the config, the two
  * pages (D3), then the checkout e2e workflow (#7839 D8), which does not
- * depend on `site`. Throws `TopologyError` for an invalid stamp (SEC-7838-10).
+ * depend on `site`. With `signIn: "hub"` the billing action is the third
+ * pair, so the first three paths are `SPOKE_CHECKOUT_ROUTE_FILES` (#8217 D8).
+ * Throws `TopologyError` for an invalid stamp (SEC-7838-10).
  */
-export function renderSpokeCheckoutFiles(site) {
+export function renderSpokeCheckoutFiles(site, opts = {}) {
     assertSite(site);
-    const [buyPath, webhookPath] = SPOKE_CHECKOUT_ROUTE_FILES;
+    const [buyPath, webhookPath, billingActionPath] = SPOKE_CHECKOUT_ROUTE_FILES;
     const [thankYouPath, unavailablePath] = SPOKE_CHECKOUT_PAGE_FILES;
     return [
         [buyPath, BUY_ROUTE],
         [webhookPath, WEBHOOK_ROUTE],
+        ...(opts.signIn === "hub"
+            ? [[billingActionPath, BILLING_ACTION]]
+            : []),
         [SPOKE_CHECKOUT_CONFIG_PATH, renderConfig(site)],
         [thankYouPath, THANK_YOU_PAGE],
         [unavailablePath, UNAVAILABLE_PAGE],
@@ -516,7 +551,9 @@ function isOlderPin(current, wanted) {
 /**
  * Write the slice into `targetDir` (D3). A file that already exists is left
  * byte-for-byte and reported `skipped` — the config is the site's once
- * written. Adds the package to `apps/web/package.json` when absent, and
+ * written. With `signIn: "hub"` (#8217 D8) the slice carries the billing
+ * action, and the web seam — generated, so always rewritten — becomes the
+ * billing render: reported `patched` when it changed, not at all when equal. Adds the package to `apps/web/package.json` when absent, and
  * raises a plain pin older than the one it writes (#7839): the generated
  * checkout e2e workflow runs a command a `^0.2.0` pin never reaches. Any
  * other range — newer, `workspace:`, a tag — is the site's and is kept.
@@ -524,7 +561,7 @@ function isOlderPin(current, wanted) {
  * missing or malformed `apps/web/package.json`) throws before the first write.
  */
 export function writeSpokeCheckoutSlice(targetDir, opts) {
-    const files = renderSpokeCheckoutFiles(opts.site);
+    const files = renderSpokeCheckoutFiles(opts.site, { signIn: opts.signIn });
     const range = JSON.parse(substituteWorkspaceVersions(`{"${SPOKE_CHECKOUT_PACKAGE}": "workspace:*"}`, opts.versions));
     const version = range[SPOKE_CHECKOUT_PACKAGE];
     const pkgPath = join(targetDir, WEB_PACKAGE_JSON);
@@ -541,6 +578,19 @@ export function writeSpokeCheckoutSlice(targetDir, opts) {
         writeFileSync(abs, text);
         rows.push({ path, action: "written" });
     }
+    if (opts.signIn === "hub") {
+        const seamPath = join(targetDir, WEB_SEAM_PATH);
+        const seamBefore = existsSync(seamPath) ? readFileSync(seamPath, "utf8") : "";
+        const seam = renderWebSeam("spoke", "hub", { spokeBilling: true });
+        if (seamBefore !== seam) {
+            writeFileSync(seamPath, seam);
+            rows.push({
+                path: WEB_SEAM_PATH,
+                action: "patched",
+                change: diffTwoStrings(WEB_SEAM_PATH, seamBefore, seam, true),
+            });
+        }
+    }
     const deps = pkg.dependencies ?? {};
     const current = Object.prototype.hasOwnProperty.call(deps, SPOKE_CHECKOUT_PACKAGE)
         ? deps[SPOKE_CHECKOUT_PACKAGE]

package/dist/starter-grid.d.ts

@@ -14,7 +14,7 @@
  * lives in `template-manifest.ts`, whose `resolveTemplate` is the one reader
  * that yields a template's roster. Nothing but those two files imports this one.
  */
-import type { CategorySlug } from "@working-theory/schema/categories";
+import type { CategorySlug } from "./category-profile.js";
 import type { ModuleName } from "./parse-args.js";
 import type { TemplateLayout } from "./site-chrome.js";
 import type { StarterDesign, StarterShape, TemplateRosterRow } from "./template-manifest.js";

package/dist/surfaces.d.ts

@@ -126,6 +126,20 @@ export declare function excludedRoutePaths(enabled: string[]): string[];
  * route has been removed would advertise URLs that 404.
  */
 export declare function excludedContentPaths(enabled: string[]): string[];
+/**
+ * True when `path` (scaffold-relative, `/`-separated) lies inside one of the
+ * content directories `excludedContentPaths(enabled)` names, with `<locale>`
+ * matching any one path segment (#8427 D4).
+ *
+ * This is `excludedContentPaths`' first non-export reader — its own comment
+ * already named exactly this class ("orphan content makes `/sitemap.xml`
+ * advertise URLs that 404"). It is wired into the `skip` predicate
+ * `extractModuleBundle` already takes (`programmatic.ts`, `add-module.ts`),
+ * and into `layerInstalledSeeds`'s installed-seed count (`site-roster.ts`),
+ * so a module bundle never writes — and a roster check never counts — a
+ * seed under a gateable surface the scaffold does not enable.
+ */
+export declare function isUnservedSurfaceContent(path: string, enabled: readonly string[]): boolean;
 /**
  * Route manifest (#4986): every template route directory, keyed relative to
  * ROUTE_ROOT (`apps/web/app/[locale]`), → the `@working-theory/*` fixed-group