create-ailk 0.19.0 → 0.20.0

package/dist/lib/merge-three-way.js

@@ -0,0 +1,65 @@
+/**
+ * `git merge-file` wrapper — the three-way text merge `create-ailk update`
+ * runs for a copied app file the site owner edited and the template also
+ * changed (#8522 D5).
+ *
+ * `git merge-file` is the reference diff3 merge: every AILK owner already
+ * has `git` on `PATH` (it is how they cloned or will push this site), and
+ * using it adds no new npm dependency. The three versions are written to a
+ * fresh temp directory (never the site's own tree) and read back as text;
+ * nothing is left behind.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Run `git merge-file -p` over the three texts in a `mkdtemp` directory, no
+ * shell, argv holding only temp-file paths and the three labels (#8522 D5).
+ *
+ * Exit 0 is a clean merge (`merged`). Exit 1-127 is a conflicting hunk
+ * (`conflict`) — the file is never written with conflict markers by this
+ * function; the caller decides what to do with a conflict, and nothing here
+ * ever applies one. Any other exit, or a spawn failure (no `git` on `PATH`),
+ * is `error`.
+ */
+export function mergeThreeWay(opts) {
+    const dir = mkdtempSync(join(tmpdir(), "ailk-merge-"));
+    try {
+        const oursPath = join(dir, "ours");
+        const basePath = join(dir, "base");
+        const theirsPath = join(dir, "theirs");
+        writeFileSync(oursPath, opts.ours);
+        writeFileSync(basePath, opts.base);
+        writeFileSync(theirsPath, opts.theirs);
+        const result = spawnSync("git", [
+            "merge-file",
+            "-p",
+            "-L",
+            opts.oursLabel,
+            "-L",
+            opts.baseLabel,
+            "-L",
+            opts.theirsLabel,
+            oursPath,
+            basePath,
+            theirsPath,
+        ], { shell: false });
+        if (result.error !== undefined) {
+            return { status: "error", reason: result.error.message };
+        }
+        if (result.status === 0) {
+            return { status: "merged", text: result.stdout.toString("utf8") };
+        }
+        if (result.status !== null && result.status >= 1 && result.status <= 127) {
+            return { status: "conflict" };
+        }
+        return {
+            status: "error",
+            reason: `git merge-file exited ${result.status ?? `signal ${result.signal}`}`,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/lib/scaffold-render-sweep.d.ts

@@ -105,6 +105,20 @@ export declare function assessConfigGatedRoute(input: {
     html: string;
     locale: string;
 }): SweepVerdict;
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export declare function sitemapSweepEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -124,6 +138,15 @@ export declare function assessUnknownSlug(input: {
     hops: RedirectHop[];
     status: number | null;
 }): SweepVerdict;
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export declare function sitemapLocPaths(xml: string): string[];
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export declare function assessPrerenderManifest(manifest: {
     dynamicRoutes?: Record<string, unknown>;

package/dist/lib/scaffold-render-sweep.js

@@ -239,6 +239,23 @@ export function assessConfigGatedRoute(input) {
 function headingTexts(html) {
     return [...html.matchAll(/<h1\b[^>]*>([\s\S]*?)<\/h1>/gi)].map((m) => (m[1] ?? "").replace(/<[^>]*>/g, ""));
 }
+/**
+ * The environment the sitemap sweep's server runs under (#8501): `env` with
+ * every `CONFIG_GATED_ROUTES` variable removed.
+ *
+ * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * describes the scaffold AS GENERATED — and a config-gated route's seeds are
+ * served only while its variable is unset (the Free placeholder hand-off,
+ * #6942). Set it and the route serves its live module page instead: `/meet`
+ * becomes the booker for the operator's enabled events, `/meet/<seed>` a 404.
+ * A leg that configures the module for its booking steps would therefore score
+ * the sitemap against pages it was never written for, so the sweep runs
+ * against a server that leaves the gated variables unset. Pure.
+ */
+export function sitemapSweepEnv(env) {
+    const gated = new Set(Object.values(CONFIG_GATED_ROUTES));
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !gated.has(name)));
+}
 /**
  * Every FILE under `dir`, recursing into directories, as sorted slash-joined
  * paths relative to it — so `public/.well-known/security.txt` is listed and
@@ -291,6 +308,41 @@ export function assessUnknownSlug(input) {
         return { ok: false, reason: `${route} -> status ${status} (expected 404 for an unknown slug)` };
     return { ok: true, reason: "404" };
 }
+/**
+ * The five entities `escapeXml` (`apps/web/app/sitemap.xml/route.ts`) writes,
+ * reversed.
+ */
+const XML_ENTITIES = {
+    "&amp;": "&",
+    "&lt;": "<",
+    "&gt;": ">",
+    "&quot;": '"',
+    "&apos;": "'",
+};
+function unescapeXml(value) {
+    return value.replace(/&amp;|&lt;|&gt;|&quot;|&apos;/g, (entity) => XML_ENTITIES[entity] ?? entity);
+}
+/**
+ * Every `<loc>` path in a sitemap XML document, in order, deduped (#8427
+ * D6). Pure — no network or filesystem access, like its neighbours. Each
+ * `<loc>` is un-escaped against the five entities `escapeXml` writes, then
+ * read as `new URL(loc).pathname` — so a query string contributes nothing
+ * and an `<xhtml:link rel="alternate">` sibling, which carries no `<loc>` of
+ * its own, contributes nothing either.
+ */
+export function sitemapLocPaths(xml) {
+    const seen = new Set();
+    const paths = [];
+    for (const match of xml.matchAll(/<loc>([^<]*)<\/loc>/g)) {
+        const loc = unescapeXml(match[1] ?? "");
+        const path = new URL(loc).pathname;
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        paths.push(path);
+    }
+    return paths;
+}
 /** Fails, naming each route, when `.next/prerender-manifest.json`'s `dynamicRoutes` has a key under `/[locale]/`. */
 export function assessPrerenderManifest(manifest) {
     const locale = Object.keys(manifest.dynamicRoutes ?? {})

package/dist/module-architecture.js

@@ -21,7 +21,7 @@
  * `architecture.yaml` template files — a fixed template IS the drift this
  * removes.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { join, sep } from "node:path";
 import { CONTENT_PAYLOADS, } from "./content-payloads.js";
 import { importClosure } from "./lib/import-graph.js";
@@ -77,8 +77,8 @@ const PUBLIC_SCHEDULING_VAR_PATTERN = [
  * live-key-shaped token in this file's source would itself trip the repo's
  * own live-key hard block (`rules/environment-boundaries.md`). `apps/api` is
  * excluded because `STRIPE_SECRET_KEY` legitimately lives there, gated by
- * `assertSandboxKey`'s sandbox-only allow-list at request time and by
- * `assertCommerceSandboxKey` at boot (server.ts) — this pattern catches a
+ * lib/stripe.ts's admitted-key guard at request time and by
+ * `admitCommerceStripeKey` at boot (server.ts) — this pattern catches a
  * live-shaped key leaking anywhere ELSE (a fixture, a client component, a
  * `NEXT_PUBLIC_` var).
  */
@@ -183,10 +183,18 @@ const MEMBER_AREA_FILES = [
     "apps/api/src/routes/member/request-form.ts",
     "apps/api/src/routes/member/billing.ts",
     "apps/api/src/routes/member/requests.ts",
+    // #8515 D13 — the client's onboarding read and write.
+    "apps/api/src/routes/member/onboarding.ts",
     "apps/api/src/routes/member/artifact-review.ts",
     "apps/api/src/routes/member/profile.ts",
     "apps/api/src/routes/member/deletion-request.ts",
+    // #8438 D6 — the member's own consents; the same gate as the writes above.
+    "apps/api/src/routes/member/consents.ts",
     "apps/api/src/services/member-area.ts",
+    // #8516 D8 — whether proposal payment runs, and the Checkout Session;
+    // imported only by member-area files (pieces.ts and the two member
+    // artifact routes), and itself imports only base files.
+    "apps/api/src/services/proposal-payments.ts",
     "apps/api/src/lib/member-store.ts",
     // #8226 D12 — the member-request match CLI; both import member-store.ts,
     // which a build without the member slice does not carry.
@@ -785,6 +793,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/index.ts",
             "apps/api/src/routes/workspaces/sessions.ts",
             "apps/api/src/routes/workspaces/config.ts",
+            // #8438 D8 — the Admin owner's consents to Working Theory: registered
+            // under `isModuleEnabled("multi-tenant")` alone, the module that
+            // contributes the Admin app.
+            "apps/api/src/routes/consent/platform.ts",
             // Co-owned with `workspace` (#5853): the content-write scope is gated on
             // content-write AND (workspace || multi-tenant) and this file imports
             // lib/tenant-db.ts, so each tenancy slice must deliver it.
@@ -1482,6 +1494,13 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/slack/index.ts",
             "apps/api/src/routes/slack/actions.ts",
             "apps/api/src/routes/waitlist-signups/index.ts",
+            // #7479 — the listing-draft forwarded-visitor suite exercises the three
+            // project-listings draft routes through the real build(), and those
+            // routes register only under isModuleEnabled("signal-collectors"), so
+            // the suite strips with this slice (the #7389 shape for
+            // schedule-forwarded-rate-limit.test.ts under scheduling) instead of
+            // failing every keyless scaffold's apps/api jest gate.
+            "apps/api/src/__tests__/listings-forwarded-rate-limit.test.ts",
             // apps/api/src/routes/project-listings/{start,patch-draft,submit,public,
             // me,respond,resume-token}.ts and services/{project-listings,
             // listing-config}.ts deliberately NOT listed — see the comment above
@@ -1843,7 +1862,7 @@ export const MODULE_SLICES = {
             {
                 pattern: STRIPE_LIVE_KEY_PATTERN,
                 paths_excluded: ["apps/api/**"],
-                reason: "The commerce credential belongs to apps/api, behind assertSandboxKey's sandbox-only allow-list. A live-mode-shaped key anywhere else is a leak, not a config choice",
+                reason: "The commerce credential belongs to apps/api, behind lib/stripe.ts's admitted-key guard. A live-mode-shaped key anywhere else is a leak, not a config choice",
             },
         ],
         // ownedFiles (S1, #5088). SOURCE files only (#5182 D6) — no __tests__/,
@@ -2195,11 +2214,51 @@ export function missingArchitectureEnforcement(siteDir) {
         missing.push("package.json scripts.preflight (runs pnpm architecture)");
     }
     const postToolUse = readJson(".claude/settings.json")?.hooks?.PostToolUse ?? [];
+    const ARCH_PNPM_RE = /\bpnpm\b.*\barchitecture\b/;
+    // CloudParity's repo-owned-hook command grammar (#8509 D2/D6): no
+    // $CLAUDE_PROJECT_DIR prefix, no arguments, no shell operators.
+    const ARCH_HOOK_SCRIPT_RE = /^bash \.claude\/hooks\/([A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*)$/;
+    /**
+     * A command "runs architecture" either in today's inline form (matched on
+     * the command string itself, so a pre-#8509 scaffold still verifies) or in
+     * the script form CloudParity's declaration grammar requires — read the
+     * named script's own text, so a deleted or emptied script still reports
+     * missing even though the command string is unchanged.
+     */
+    const commandRunsArchitecture = (command) => {
+        if (ARCH_PNPM_RE.test(command))
+            return true;
+        const match = ARCH_HOOK_SCRIPT_RE.exec(command);
+        if (!match)
+            return false;
+        const scriptRel = match[1];
+        // The charset `ARCH_HOOK_SCRIPT_RE` allows per segment admits "." and
+        // "..", which CloudParity's own grammar forbids (#8509 spec §1) — reject
+        // them here too, so a crafted command string can't walk this read
+        // outside siteDir/.claude/hooks/.
+        if (scriptRel.split("/").some((seg) => seg === "." || seg === ".."))
+            return false;
+        const hooksDir = join(siteDir, ".claude", "hooks");
+        const scriptPath = join(hooksDir, scriptRel);
+        if (!existsSync(scriptPath))
+            return false;
+        try {
+            const realHooksDir = realpathSync(hooksDir);
+            const realScript = realpathSync(scriptPath);
+            if (!realScript.startsWith(realHooksDir + sep) || !lstatSync(realScript).isFile()) {
+                return false;
+            }
+            return ARCH_PNPM_RE.test(readFileSync(realScript, "utf8"));
+        }
+        catch {
+            return false;
+        }
+    };
     const hooked = postToolUse.some((entry) => {
         const tools = (entry.matcher ?? "").split("|");
         return (tools.includes("Edit") &&
             tools.includes("Write") &&
-            (entry.hooks ?? []).some((h) => /\bpnpm\b.*\barchitecture\b/.test(h.command ?? "")));
+            (entry.hooks ?? []).some((h) => commandRunsArchitecture(h.command ?? "")));
     });
     if (!hooked) {
         missing.push(".claude/settings.json PostToolUse hook on Edit|Write (runs pnpm architecture)");

package/dist/programmatic.d.ts

@@ -195,8 +195,14 @@ export interface ScaffoldResult {
  *
  * Throws ValidationError if targetDir already exists and is non-empty.
  * Throws Error if the template copy fails for any other reason.
+ *
+ * @param copied — INTERNAL (#8522 D2): when passed, every recordable path
+ *   `copyTemplate` writes is hashed into this map (destination path -> the
+ *   sha256 of the bytes written), for `scaffold()` to build
+ *   `.ailk-template-files.json` from once every later layer has landed. No
+ *   existing caller passes it, so their behaviour is unchanged.
  */
-export declare function scaffoldSync(opts: ScaffoldOptions): ScaffoldResult;
+export declare function scaffoldSync(opts: ScaffoldOptions, copied?: Map<string, string>): ScaffoldResult;
 /**
  * Scaffold an AI Launch Kit starter project into targetDir (async wrapper).
  *

package/dist/programmatic.js

@@ -45,9 +45,10 @@ import { SITE_FONTS_PATH, renderSiteFonts } from "./site-fonts.js";
 import { planSiteManifest } from "./site-manifest.js";
 import { SITE_ROSTER_PATH, planHomeRecord, planSiteManifestDesign, readSiteRoster, withMeetPlaceholderSeeds, } from "./site-roster.js";
 import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
-import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
+import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, isUnservedSurfaceContent, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
+import { TEMPLATE_RECORD_PATH, isRecordable, planTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
 import { SPOKE_ONLY_FILES, TopologyError, applySpokeTransforms, isSpokeExcluded, normalizeHubSignInUrl, normalizeHubUrl, readSiteTopology, spokeExclusions, spokeDestination, spokeModuleRefusal, spokeModules, writeHubOriginEnv, writeHubSignInEnv, } from "./topology.js";
 import { validateTarget } from "./validate.js";
 const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -148,8 +149,14 @@ function resolveShapeTemplate(shape) {
  *
  * Throws ValidationError if targetDir already exists and is non-empty.
  * Throws Error if the template copy fails for any other reason.
+ *
+ * @param copied — INTERNAL (#8522 D2): when passed, every recordable path
+ *   `copyTemplate` writes is hashed into this map (destination path -> the
+ *   sha256 of the bytes written), for `scaffold()` to build
+ *   `.ailk-template-files.json` from once every later layer has landed. No
+ *   existing caller passes it, so their behaviour is unchanged.
  */
-export function scaffoldSync(opts) {
+export function scaffoldSync(opts, copied) {
     // Validate target — throws ValidationError on rejection.
     const targetAbs = validateTarget(opts.targetDir);
     const projectName = opts.projectName ?? basename(targetAbs);
@@ -177,6 +184,14 @@ export function scaffoldSync(opts) {
                 : SPOKE_ONLY_FILES),
         ],
         markers: buildScaffoldMarkers(projectName),
+        ...(copied !== undefined
+            ? {
+                onWrite: (relPath, bytes) => {
+                    if (isRecordable(relPath))
+                        copied.set(relPath, sha256Hex(bytes));
+                },
+            }
+            : {}),
     });
     // #7426 D5/D6 — the root files a spoke rewrites, and the spoke seams.
     if (spoke !== undefined)
@@ -495,6 +510,10 @@ export async function scaffold(opts) {
     const surfaces = template !== undefined
         ? [...new Set([...(opts.surfaces ?? []), ...rosterSurfaces(template)])].sort()
         : opts.surfaces;
+    // #8522 D2 — every recordable path `copyTemplate` writes, hashed as it is
+    // written: the input to the per-file record `scaffold()` writes below,
+    // once every later layer has landed.
+    const copied = new Map();
     const result = scaffoldSync({
         ...opts,
         modules,
@@ -509,7 +528,7 @@ export async function scaffold(opts) {
         // #6813 D8 step 6 — the resolved design's OWN layout (never its name):
         // `resolveSiteChrome` reads a layout object now, not a `StarterDesign`.
         ...(resolvedDesign !== undefined ? { designLayout: resolvedDesign.pkg.layout } : {}),
-    });
+    }, copied);
     // Threaded to extractModuleBundle for `package.json` patch targets'
     // `workspace:*` substitution (spec 5418 § 3 D2) — the same version map
     // `scaffoldSync` already reads for `copyTemplate`, re-read here since
@@ -573,7 +592,14 @@ export async function scaffold(opts) {
             versions,
             markers,
             ownership,
+            // #8427 D4 — a module bundle never writes a file inside the content
+            // directory of a gateable surface the result does not enable (the
+            // signal-collectors `projects`-surface seeds, on a scaffold whose
+            // roster carries no /projects route). The spoke filter still drops
+            // whatever it already drops; remapDestination is unchanged.
             ...spokeSkip,
+            skip: (destination) => spokeSkip.skip?.(destination) === true ||
+                isUnservedSurfaceContent(destination, result.surfaces),
         });
     }
     // The template lands LAST — after `scaffoldSync` and after every module
@@ -778,6 +804,17 @@ export async function scaffold(opts) {
                 templatesDir: TEMPLATES_DIR,
                 markers,
             }));
+            // #8522 D2 — the per-file record, as this scaffold's LAST write (same
+            // guard and roster as the site manifest just above): a kept copied
+            // path only when its final bytes still hash to the copy — a later
+            // layer (a module bundle's patch, a generator) that rewrote the file
+            // is absent here too.
+            writeFileSync(join(result.targetDir, TEMPLATE_RECORD_PATH), serializeTemplateRecord(planTemplateRecord({
+                targetDir: result.targetDir,
+                copied,
+                version: markers["CREATE_AILK_VERSION"] ?? "",
+                projectName,
+            })));
         }
     }
     // #7536 D3 — the registry follows `apps/web/package.json`, which a module

package/dist/site-roster.js

@@ -33,6 +33,7 @@ import { locatePageSections } from "./design-presets.js";
 import { diffTwoStrings } from "./lib/extract-module-bundle.js";
 import { MODULE_SLICES, normalizeModules, } from "./module-architecture.js";
 import { substituteMarkers } from "./substitute.js";
+import { isUnservedSurfaceContent, resolveSurfaces } from "./surfaces.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, resolveTemplate, rosterDeclares, shippedManifestPath, templateTreeDir, } from "./template-manifest.js";
 /** The site-root file that is the roster of record (#6658 D7). */
 export const SITE_ROSTER_PATH = ".ailk-site-manifest.json";
@@ -613,7 +614,7 @@ function spliceRows(file, rows) {
     return text.slice(0, open + 1) + body + text.slice(close);
 }
 /** Every `content/en/**.mdx` some layer installs into a site of this template and module set. */
-function layerInstalledSeeds(template, modules, opts) {
+function layerInstalledSeeds(template, modules, opts, surfaces) {
     const out = new Set();
     for (const root of [
         opts.templatesDir,
@@ -640,7 +641,15 @@ function layerInstalledSeeds(template, modules, opts) {
             for (const path of row.content ?? [])
                 out.add(path);
         }
-        destinations.push(...Object.values(slice.installMap ?? {}));
+        // #8427 D4 — a module installMap destination the scaffold's own
+        // surfaces do not serve is not "installed": the writer
+        // (programmatic.ts's module-bundle loop, add-module.ts) declines the
+        // write, so the reader must agree or report a seed that is not there.
+        for (const dest of Object.values(slice.installMap ?? {})) {
+            if (isUnservedSurfaceContent(dest, surfaces))
+                continue;
+            destinations.push(dest);
+        }
     }
     for (const to of destinations) {
         if (to.startsWith("content/en/") && to.endsWith(".mdx"))
@@ -666,7 +675,15 @@ export function siteRosterProblems(opts) {
     const roster = readSiteRoster(opts.targetDir);
     if (roster === undefined)
         return [];
-    const { modules } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    const { modules, surfaces: headerSurfaces } = readArchitectureHeader(readFileSync(join(opts.targetDir, "architecture.yaml"), "utf8"));
+    // #8427 D4 — the FULL effective surface set (module-contributed surfaces
+    // unioned with the header's own explicit list), the same set the writer
+    // resolves. Throws SurfaceError on a header surface that is unknown or
+    // owned by a module the site lacks — intended: `add-module` already
+    // refuses such a header before its first write, so a direct caller
+    // reaches the same refusal instead of a report built on a header the
+    // scaffold would never actually write.
+    const surfaces = resolveSurfaces(modules, headerSurfaces);
     const problems = [];
     const routes = roster.rows.map((r) => r.value["route"]);
     const seen = new Set();
@@ -715,7 +732,7 @@ export function siteRosterProblems(opts) {
     });
     // #6942 — the Free /meet placeholder seeds the scheduling module's rows keep.
     const declared = withMeetPlaceholderSeeds(effective);
-    const installed = [...layerInstalledSeeds(roster.template, modules, opts)]
+    const installed = [...layerInstalledSeeds(roster.template, modules, opts, surfaces)]
         .filter((path) => existsSync(join(opts.targetDir, path)))
         .sort();
     for (const path of installed) {

package/dist/spoke-checkout.d.ts

@@ -8,6 +8,13 @@ export declare const SPOKE_CHECKOUT_PACKAGE = "@working-theory/spoke-checkout";
 export declare const SPOKE_CHECKOUT_CONFIG_PATH = "apps/web/lib/checkout-config.ts";
 /** The two return pages: Stripe's success URL and every refused buy's target. */
 export declare const SPOKE_CHECKOUT_PAGE_FILES: readonly string[];
+/**
+ * The marker `renderPage()` stamps into both generated return pages' header
+ * comment (D3). `apps/web`'s structured-data test cannot import create-ailk
+ * (the import boundary), so it carries this text as a literal, kept in sync
+ * by `packages/create-ailk/__tests__/spoke-checkout.test.ts` (#8513 AC-5).
+ */
+export declare const SPOKE_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 /** The variables a commerce spoke depends on (D9). The package reads three of them. */
 export declare const SPOKE_CHECKOUT_ENV_CATALOG: Readonly<Record<string, EnvCatalogEntry>>;
 /** The names a commerce spoke declares although only the package reads them (D9). */

package/dist/spoke-checkout.js

@@ -38,6 +38,13 @@ export const SPOKE_CHECKOUT_PAGE_FILES = Object.freeze([
     "apps/web/app/[locale]/checkout/thank-you/page.tsx",
     "apps/web/app/[locale]/checkout/unavailable/page.tsx",
 ]);
+/**
+ * The marker `renderPage()` stamps into both generated return pages' header
+ * comment (D3). `apps/web`'s structured-data test cannot import create-ailk
+ * (the import boundary), so it carries this text as a literal, kept in sync
+ * by `packages/create-ailk/__tests__/spoke-checkout.test.ts` (#8513 AC-5).
+ */
+export const SPOKE_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 /** The variables a commerce spoke depends on (D9). The package reads three of them. */
 export const SPOKE_CHECKOUT_ENV_CATALOG = Object.freeze({
     STRIPE_SECRET_KEY: {
@@ -245,7 +252,7 @@ function renderConfig(site) {
 /** One return page (D7): a server component that reads nothing but its copy. */
 function renderPage(opts) {
     return [
-        `// ${opts.title} — GENERATED by create-ailk (#7838).`,
+        `// ${opts.title} — ${SPOKE_CHECKOUT_PAGE_MARKER}.`,
         ...opts.about.map((line) => `// ${line}`),
         `import { SectionRenderer } from "${UI_SECTIONS_PACKAGE}";`,
         `import type { PageSection } from "${VALIDATION_PACKAGE}";`,

package/dist/surfaces.d.ts

@@ -126,6 +126,20 @@ export declare function excludedRoutePaths(enabled: string[]): string[];
  * route has been removed would advertise URLs that 404.
  */
 export declare function excludedContentPaths(enabled: string[]): string[];
+/**
+ * True when `path` (scaffold-relative, `/`-separated) lies inside one of the
+ * content directories `excludedContentPaths(enabled)` names, with `<locale>`
+ * matching any one path segment (#8427 D4).
+ *
+ * This is `excludedContentPaths`' first non-export reader — its own comment
+ * already named exactly this class ("orphan content makes `/sitemap.xml`
+ * advertise URLs that 404"). It is wired into the `skip` predicate
+ * `extractModuleBundle` already takes (`programmatic.ts`, `add-module.ts`),
+ * and into `layerInstalledSeeds`'s installed-seed count (`site-roster.ts`),
+ * so a module bundle never writes — and a roster check never counts — a
+ * seed under a gateable surface the scaffold does not enable.
+ */
+export declare function isUnservedSurfaceContent(path: string, enabled: readonly string[]): boolean;
 /**
  * Route manifest (#4986): every template route directory, keyed relative to
  * ROUTE_ROOT (`apps/web/app/[locale]`), → the `@working-theory/*` fixed-group