create-ailk 0.19.0 → 0.19.1

package/dist/add-module.js

@@ -40,7 +40,7 @@ import { ParseError, parseModules } from "./parse-args.js";
 import { writeSpokeFlowsReadme } from "./seed-flows.js";
 import { SITE_ROSTER_PATH, moduleRosterRows, planRosterAppend, readSiteRoster, siteRosterProblems, } from "./site-roster.js";
 import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
-import { MODULE_SURFACES, NAV_CONFIG_PATH, readNavConfigStamp, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
+import { MODULE_SURFACES, NAV_CONFIG_PATH, isUnservedSurfaceContent, readNavConfigStamp, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { TopologyError, isSpokeExcluded, readSiteTopology, readSpokeShape, spokeDestination, spokeModuleRefusal, } from "./topology.js";
 /**
@@ -155,9 +155,14 @@ export async function applyModuleToScaffold(opts) {
         markers: opts.markers,
         existingFilePolicy: "skip-existing",
         checkPatches: checkPlusConfigPatches,
+        // #8427 D4 — composed with the spoke filter: a module bundle never
+        // writes a seed under a gateable surface this site's own
+        // `architecture.yaml` header (resolved above, into `surfaces`) does
+        // not enable.
+        skip: (destination) => (spoke !== undefined && isSpokeExcluded(destination, spoke)) ||
+            isUnservedSurfaceContent(destination, surfaces),
         ...(spoke !== undefined
             ? {
-                skip: (destination) => isSpokeExcluded(destination, spoke),
                 // #7876 D10 — a module flow file lands in flows/ as declared data.
                 remapDestination: spokeDestination,
             }

package/dist/index.d.ts

@@ -14,6 +14,6 @@ export type { HomeSeedOutcome } from "./design-home.js";
 export { SITE_ROSTER_PATH, readSiteRoster, siteRosterProblems, } from "./site-roster.js";
 export { SYNC_ROUTES_HELP, formatSyncRoutesReport, listTemplateRouteDirs, parseSyncRoutesArgs, syncRoutes, type RouteReport, type SyncRoutesOptions, type SyncRoutesResult, } from "./sync-routes.js";
 export { deriveArchitecture } from "./derive-architecture.js";
-export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, type Surface, } from "./surfaces.js";
+export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, isUnservedSurfaceContent, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, type Surface, } from "./surfaces.js";
 export { substituteMarkers, substituteWorkspaceVersions, type MarkerMap, type WorkspaceVersionMap, } from "./substitute.js";
 export { validateTarget, ValidationError } from "./validate.js";

package/dist/index.js

@@ -30,6 +30,6 @@ export { deriveArchitecture } from "./derive-architecture.js";
 // The route-surface registry (#4154) — which public routes a scaffold carries.
 // Exported so tooling can answer "what surfaces does this site declare" without
 // re-parsing architecture.yaml.
-export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, } from "./surfaces.js";
+export { CORE_ROUTE_DIRS, CORE_SURFACE_PATHS, NAV_CONFIG_PATH, GATEABLE_SURFACES, MODULE_SURFACES, RECOGNIZED_SURFACES, ROUTE_SINCE, SurfaceError, excludedContentPaths, excludedRoutePaths, isUnservedSurfaceContent, parseSurfaces, renderNavConfig, resolveSurfaces, surfaceForRouteDir, } from "./surfaces.js";
 export { substituteMarkers, substituteWorkspaceVersions, } from "./substitute.js";
 export { validateTarget, ValidationError } from "./validate.js";

package/dist/lib/scaffold-render-sweep.d.ts

@@ -105,6 +105,20 @@ export declare function assessConfigGatedRoute(input: {
     html: string;
     locale: string;
 }): SweepVerdict;
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export declare function sitemapSweepEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -124,6 +138,15 @@ export declare function assessUnknownSlug(input: {
     hops: RedirectHop[];
     status: number | null;
 }): SweepVerdict;
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export declare function sitemapLocPaths(xml: string): string[];
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export declare function assessPrerenderManifest(manifest: {
     dynamicRoutes?: Record<string, unknown>;

package/dist/lib/scaffold-render-sweep.js

@@ -239,6 +239,23 @@ export function assessConfigGatedRoute(input) {
 function headingTexts(html) {
     return [...html.matchAll(/<h1\b[^>]*>([\s\S]*?)<\/h1>/gi)].map((m) => (m[1] ?? "").replace(/<[^>]*>/g, ""));
 }
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export function sitemapSweepEnv(env) {
+    const gated = new Set(Object.values(CONFIG_GATED_ROUTES));
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !gated.has(name)));
+}
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -291,6 +308,41 @@ export function assessUnknownSlug(input) {
         return { ok: false, reason: `${route} -> status ${status} (expected 404 for an unknown slug)` };
     return { ok: true, reason: "404" };
 }
+/**
+ * The five entities `escapeXml` (`apps/web/app/sitemap.xml/route.ts`) writes,
+ * reversed.
+ */
+const XML_ENTITIES = {
+    "&amp;": "&",
+    "&lt;": "<",
+    "&gt;": ">",
+    "&quot;": '"',
+    "&apos;": "'",
+};
+function unescapeXml(value) {
+    return value.replace(/&amp;|&lt;|&gt;|&quot;|&apos;/g, (entity) => XML_ENTITIES[entity] ?? entity);
+}
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export function sitemapLocPaths(xml) {
+    const seen = new Set();
+    const paths = [];
+    for (const match of xml.matchAll(/<loc>([^<]*)<\/loc>/g)) {
+        const loc = unescapeXml(match[1] ?? "");
+        const path = new URL(loc).pathname;
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        paths.push(path);
+    }
+    return paths;
+}
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export function assessPrerenderManifest(manifest) {
     const locale = Object.keys(manifest.dynamicRoutes ?? {})

package/dist/module-architecture.js

@@ -77,8 +77,8 @@ const PUBLIC_SCHEDULING_VAR_PATTERN = [
  * live-key-shaped token in this file's source would itself trip the repo's
  * own live-key hard block (`rules/environment-boundaries.md`). `apps/api` is
  * excluded because `STRIPE_SECRET_KEY` legitimately lives there, gated by
- * `assertSandboxKey`'s sandbox-only allow-list at request time and by
- * `assertCommerceSandboxKey` at boot (server.ts) — this pattern catches a
+ * lib/stripe.ts's admitted-key guard at request time and by
+ * `admitCommerceStripeKey` at boot (server.ts) — this pattern catches a
  * live-shaped key leaking anywhere ELSE (a fixture, a client component, a
  * `NEXT_PUBLIC_` var).
  */
@@ -186,6 +186,8 @@ const MEMBER_AREA_FILES = [
     "apps/api/src/routes/member/artifact-review.ts",
     "apps/api/src/routes/member/profile.ts",
     "apps/api/src/routes/member/deletion-request.ts",
+    // #8438 D6 — the member's own consents; the same gate as the writes above.
+    "apps/api/src/routes/member/consents.ts",
     "apps/api/src/services/member-area.ts",
     "apps/api/src/lib/member-store.ts",
     // #8226 D12 — the member-request match CLI; both import member-store.ts,
@@ -785,6 +787,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/index.ts",
             "apps/api/src/routes/workspaces/sessions.ts",
             "apps/api/src/routes/workspaces/config.ts",
+            // #8438 D8 — the Admin owner's consents to Working Theory: registered
+            // under `isModuleEnabled("multi-tenant")` alone, the module that
+            // contributes the Admin app.
+            "apps/api/src/routes/consent/platform.ts",
             // Co-owned with `workspace` (#5853): the content-write scope is gated on
             // content-write AND (workspace || multi-tenant) and this file imports
             // lib/tenant-db.ts, so each tenancy slice must deliver it.
@@ -1843,7 +1849,7 @@ export const MODULE_SLICES = {
             {
                 pattern: STRIPE_LIVE_KEY_PATTERN,
                 paths_excluded: ["apps/api/**"],
-                reason: "The commerce credential belongs to apps/api, behind assertSandboxKey's sandbox-only allow-list. A live-mode-shaped key anywhere else is a leak, not a config choice",
+                reason: "The commerce credential belongs to apps/api, behind lib/stripe.ts's admitted-key guard. A live-mode-shaped key anywhere else is a leak, not a config choice",
             },
         ],
         // ownedFiles (S1, #5088). SOURCE files only (#5182 D6) — no __tests__/,

package/dist/programmatic.js

@@ -45,7 +45,7 @@ import { SITE_FONTS_PATH, renderSiteFonts } from "./site-fonts.js";
 import { planSiteManifest } from "./site-manifest.js";
 import { SITE_ROSTER_PATH, planHomeRecord, planSiteManifestDesign, readSiteRoster, withMeetPlaceholderSeeds, } from "./site-roster.js";
 import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
-import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
+import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, isUnservedSurfaceContent, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
 import { SPOKE_ONLY_FILES, TopologyError, applySpokeTransforms, isSpokeExcluded, normalizeHubSignInUrl, normalizeHubUrl, readSiteTopology, spokeExclusions, spokeDestination, spokeModuleRefusal, spokeModules, writeHubOriginEnv, writeHubSignInEnv, } from "./topology.js";
@@ -573,7 +573,14 @@ export async function scaffold(opts) {
             versions,
             markers,
             ownership,
+            // #8427 D4 — a module bundle never writes a file inside the content
+            // directory of a gateable surface the result does not enable (the
+            // signal-collectors `projects`-surface seeds, on a scaffold whose
+            // roster carries no /projects route). The spoke filter still drops
+            // whatever it already drops; remapDestination is unchanged.
             ...spokeSkip,
+            skip: (destination) => spokeSkip.skip?.(destination) === true ||
+                isUnservedSurfaceContent(destination, result.surfaces),
         });
     }
     // The template lands LAST — after `scaffoldSync` and after every module

package/dist/site-roster.js

@@ -33,6 +33,7 @@ import { locatePageSections } from "./design-presets.js";
 import { diffTwoStrings } from "./lib/extract-module-bundle.js";
 import { MODULE_SLICES, normalizeModules, } from "./module-architecture.js";
 import { substituteMarkers } from "./substitute.js";
+import { isUnservedSurfaceContent, resolveSurfaces } from "./surfaces.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, resolveTemplate, rosterDeclares, shippedManifestPath, templateTreeDir, } from "./template-manifest.js";
 /** The site-root file that is the roster of record (#6658 D7). */
 export const SITE_ROSTER_PATH = ".ailk-site-manifest.json";
@@ -613,7 +614,7 @@ function spliceRows(file, rows) {
     return text.slice(0, open + 1) + body + text.slice(close);
 }
 /** Every `content/en/**.mdx` some layer installs into a site of this template and module set. */
-function layerInstalledSeeds(template, modules, opts) {
+function layerInstalledSeeds(template, modules, opts, surfaces) {
     const out = new Set();
     for (const root of [
         opts.templatesDir,
@@ -640,7 +641,15 @@ function layerInstalledSeeds(template, modules, opts) {
             for (const path of row.content ?? [])
                 out.add(path);
         }
-        destinations.push(...Object.values(slice.installMap ?? {}));
+        // #8427 D4 — a module installMap destination the scaffold's own
+        // surfaces do not serve is not "installed": the writer
+        // (programmatic.ts's module-bundle loop, add-module.ts) declines the
+        // write, so the reader must agree or report a seed that is not there.
+        for (const dest of Object.values(slice.installMap ?? {})) {
+            if (isUnservedSurfaceContent(dest, surfaces))
+                continue;
+            destinations.push(dest);
+        }
     }
     for (const to of destinations) {
         if (to.startsWith("content/en/") && to.endsWith(".mdx"))
@@ -666,7 +675,15 @@ export function siteRosterProblems(opts) {
     const roster = readSiteRoster(opts.targetDir);
     if (roster === undefined)
         return [];
-    const { modules } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    const { modules, surfaces: headerSurfaces } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    // #8427 D4 — the FULL effective surface set (module-contributed surfaces
+    // unioned with the header's own explicit list), the same set the writer
+    // resolves. Throws SurfaceError on a header surface that is unknown or
+    // owned by a module the site lacks — intended: `add-module` already
+    // refuses such a header before its first write, so a direct caller
+    // reaches the same refusal instead of a report built on a header the
+    // scaffold would never actually write.
+    const surfaces = resolveSurfaces(modules, headerSurfaces);
     const problems = [];
     const routes = roster.rows.map((r) => r.value["route"]);
     const seen = new Set();
@@ -715,7 +732,7 @@ export function siteRosterProblems(opts) {
     });
     // #6942 — the Free /meet placeholder seeds the scheduling module's rows keep.
     const declared = withMeetPlaceholderSeeds(effective);
-    const installed = [...layerInstalledSeeds(roster.template, modules, opts)]
+    const installed = [...layerInstalledSeeds(roster.template, modules, opts, surfaces)]
         .filter((path) => existsSync(join(opts.targetDir, path)))
         .sort();
     for (const path of installed) {

package/dist/surfaces.d.ts

@@ -126,6 +126,20 @@ export declare function excludedRoutePaths(enabled: string[]): string[];
  * route has been removed would advertise URLs that 404.
  */
 export declare function excludedContentPaths(enabled: string[]): string[];
+/**
+ * True when `path` (scaffold-relative, `/`-separated) lies inside one of the
+ * content directories `excludedContentPaths(enabled)` names, with `<locale>`
+ * matching any one path segment (#8427 D4).
+ *
+ * This is `excludedContentPaths`' first non-export reader — its own comment
+ * already named exactly this class ("orphan content makes `/sitemap.xml`
+ * advertise URLs that 404"). It is wired into the `skip` predicate
+ * `extractModuleBundle` already takes (`programmatic.ts`, `add-module.ts`),
+ * and into `layerInstalledSeeds`'s installed-seed count (`site-roster.ts`),
+ * so a module bundle never writes — and a roster check never counts — a
+ * seed under a gateable surface the scaffold does not enable.
+ */
+export declare function isUnservedSurfaceContent(path: string, enabled: readonly string[]): boolean;
 /**
  * Route manifest (#4986): every template route directory, keyed relative to
  * ROUTE_ROOT (`apps/web/app/[locale]`), → the `@working-theory/*` fixed-group

package/dist/surfaces.js

@@ -503,6 +503,31 @@ export function excludedContentPaths(enabled) {
     }
     return out.sort();
 }
+/**
+ * True when `path` (scaffold-relative, `/`-separated) lies inside one of the
+ * content directories `excludedContentPaths(enabled)` names, with `<locale>`
+ * matching any one path segment (#8427 D4).
+ *
+ * This is `excludedContentPaths`' first non-export reader — its own comment
+ * already named exactly this class ("orphan content makes `/sitemap.xml`
+ * advertise URLs that 404"). It is wired into the `skip` predicate
+ * `extractModuleBundle` already takes (`programmatic.ts`, `add-module.ts`),
+ * and into `layerInstalledSeeds`'s installed-seed count (`site-roster.ts`),
+ * so a module bundle never writes — and a roster check never counts — a
+ * seed under a gateable surface the scaffold does not enable.
+ */
+export function isUnservedSurfaceContent(path, enabled) {
+    const segments = path.split("/");
+    for (const contentPath of excludedContentPaths([...enabled])) {
+        const prefixSegments = contentPath.split("/");
+        if (prefixSegments.length > segments.length)
+            continue;
+        const matches = prefixSegments.every((segment, i) => segment === "<locale>" || segment === segments[i]);
+        if (matches)
+            return true;
+    }
+    return false;
+}
 /**
  * Route manifest (#4986): every template route directory, keyed relative to
  * ROUTE_ROOT (`apps/web/app/[locale]`), → the `@working-theory/*` fixed-group
@@ -834,13 +859,18 @@ export const ROUTE_DEPENDENCIES = {
         `${ROUTE_ROOT}/(authed)/account/components/send-message.tsx`,
     ],
     // #8339 D11 — Security holds the former Sign-in section, moved verbatim
-    // from General: `sign-in-method.ts` and what it imports.
+    // from General: `sign-in-method.ts` and what it imports. #8431 D8 — the
+    // tab's failed-read row (`error-row.tsx` and its `retry-button.tsx`); its
+    // own `security-source.ts` and `security-panel.tsx` live in the route dir
+    // and copy with it.
     "(authed)/account/security": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/auth-env.ts",
         "apps/web/lib/server-api.ts",
         "apps/web/lib/hub-session/config.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/error-row.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/retry-button.tsx`,
         `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
         `${ROUTE_ROOT}/(authed)/account/sign-in-method.ts`,
     ],

package/dist/topology.js

@@ -273,7 +273,9 @@ const WEB_SEAM_HEADER = `// topology.generated.ts — how this site reads a sess
 // UNSERVED_MCP_TOOLS names the MCP tools /.well-known/mcp.json leaves out
 // on this topology (#8070).
 // loadSpokeBilling reaches the spoke billing action only on a spoke that
-// signs in through its hub and carries commerce (#8217); elsewhere, null.`;
+// signs in through its hub and carries commerce (#8217); elsewhere, null.
+// readOwnAccounts lists the signed-in person's own sign-in accounts through
+// Better Auth on a hub (#8431); a spoke has none here, so it answers null.`;
 const MCP_SEAM_HEADER = `// topology.generated.ts — how this MCP server resolves its workspace store.
 //
 // GENERATED by create-ailk for this site's topology (#7426). Do not edit:
@@ -303,6 +305,26 @@ const SITE_SESSION_TYPE = `export type SiteSession = {
     createdAt?: Date | string | null;
   };
 } | null;`;
+/**
+ * `readOwnAccounts` (#8431 D2a): the session's own sign-in accounts, which
+ * the account Security tab reads to say whether the person has a password.
+ * The hub render loads `auth.ts` only when it is called; a spoke has no local
+ * accounts, so its renders answer `null` and import nothing.
+ */
+function ownAccountsReader(topology) {
+    if (topology === "hub") {
+        return `export async function readOwnAccounts(
+  headers: Headers,
+): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  const { auth } = await import("../auth");
+  return auth.api.listUserAccounts({ headers });
+}`;
+    }
+    return `export function readOwnAccounts(headers: Headers): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  void headers;
+  return Promise.resolve(null);
+}`;
+}
 /** The sign-in exports every web seam render carries (#7894 D8). */
 function signInExports(values) {
     const literal = (value) => value === null ? "null" : JSON.stringify(value);
@@ -382,6 +404,8 @@ export async function readSession(headers: Headers): Promise<SiteSession> {
   return auth.api.getSession({ headers });
 }
 
+${ownAccountsReader("hub")}
+
 export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();
@@ -404,6 +428,8 @@ export function readSession(headers: Headers): Promise<SiteSession> {
   return readHubSession(headers);
 }
 
+${ownAccountsReader("spoke")}
+
 export function registerSiteStores(): Promise<void> {
   return Promise.resolve();
 }
@@ -424,6 +450,8 @@ export function readSession(headers: Headers): Promise<SiteSession> {
   return Promise.resolve(null);
 }
 
+${ownAccountsReader("spoke")}
+
 export function registerSiteStores(): Promise<void> {
   return Promise.resolve();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.39.0",
-    "@working-theory/templates": "0.39.0"
+    "@working-theory/schema": "0.40.0",
+    "@working-theory/templates": "0.40.0"
   },
   "repository": {
     "type": "git",

package/templates/apps/api/.env.example

@@ -32,8 +32,14 @@ DATABASE_URL="postgresql://user:password@localhost:5432/customer_template"
 # Stripe (Optional)
 # =============================================================================
 # Consumed by apps/api/src/lib/stripe.ts via @working-theory/stripe-client wrapper.
-# Use sandbox keys only — live-mode keys are rejected at runtime.
+# Use sandbox keys only — live-mode keys are rejected at runtime, unless
+# STRIPE_MODE=live below admits a restricted live key (#8450).
 STRIPE_SECRET_KEY=sk_test_xxx
+# test (the default when unset) or live. `live` is admitted only beside a
+# restricted live key, on a production build — VERCEL_ENV=production, or,
+# off Vercel, NODE_ENV=production, so a staging host must not set the latter.
+# Every other live key stays refused at boot and on every route.
+STRIPE_MODE=test
 STRIPE_WEBHOOK_SECRET=whsec_xxx
 
 # =============================================================================
@@ -46,6 +52,16 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # Generate with: openssl rand -hex 32
 # OSS_API_INTERNAL_SECRET=your-shared-secret-here
 
+# =============================================================================
+# Consent — the signed unsubscribe link (#8438)
+# =============================================================================
+# Keys the HMAC on the unsubscribe token an email's link carries
+# (POST /v1/consent/unsubscribe). Optional: unset, no link can be minted and the
+# route answers 503 link_secret_not_configured. When set it must be at least
+# 32 bytes — a shorter value logs an error at boot and is treated as unset.
+# Generate with: openssl rand -hex 32
+# AILK_CONSENT_LINK_SECRET=
+
 # =============================================================================
 # Scheduling — the `booker` section's provider (#4416)
 # =============================================================================