create-ailk 0.19.0 → 0.20.0

package/dist/surfaces.js

@@ -94,6 +94,11 @@ export const CORE_ROUTE_DIRS = [
     // 404s. Neither `GATEABLE_SURFACES` nor `MODULE_SURFACES.commerce` gains
     // an entry — the claim decides whether the pages serve, not the scaffold.
     `${ROUTE_ROOT}/purchase`,
+    // #8438 D17/D21 — the one unsubscribe landing every signed link calls.
+    // Consent logging is part of the never-gated privacy floor (CLAUDE.md §
+    // License & tier hygiene's never-gate list), so this ships unconditionally
+    // like `/about`/`/contact`/`/faq` above — never a `GATEABLE_SURFACES` entry.
+    `${ROUTE_ROOT}/unsubscribe`,
 ];
 /**
  * Directory names skipped by `listTemplateRouteDirs`'s walker even though they
@@ -503,6 +508,31 @@ export function excludedContentPaths(enabled) {
     }
     return out.sort();
 }
+/**
+ * True when `path` (scaffold-relative, `/`-separated) lies inside one of the
+ * content directories `excludedContentPaths(enabled)` names, with `<locale>`
+ * matching any one path segment (#8427 D4).
+ *
+ * This is `excludedContentPaths`' first non-export reader — its own comment
+ * already named exactly this class ("orphan content makes `/sitemap.xml`
+ * advertise URLs that 404"). It is wired into the `skip` predicate
+ * `extractModuleBundle` already takes (`programmatic.ts`, `add-module.ts`),
+ * and into `layerInstalledSeeds`'s installed-seed count (`site-roster.ts`),
+ * so a module bundle never writes — and a roster check never counts — a
+ * seed under a gateable surface the scaffold does not enable.
+ */
+export function isUnservedSurfaceContent(path, enabled) {
+    const segments = path.split("/");
+    for (const contentPath of excludedContentPaths([...enabled])) {
+        const prefixSegments = contentPath.split("/");
+        if (prefixSegments.length > segments.length)
+            continue;
+        const matches = prefixSegments.every((segment, i) => segment === "<locale>" || segment === segments[i]);
+        if (matches)
+            return true;
+    }
+    return false;
+}
 /**
  * Route manifest (#4986): every template route directory, keyed relative to
  * ROUTE_ROOT (`apps/web/app/[locale]`), → the `@working-theory/*` fixed-group
@@ -641,12 +671,20 @@ export const ROUTE_SINCE = {
     // version, the same rule #7430/#8232 applied.
     "(authed)/account/security": "0.38.0",
     "(authed)/account/notifications": "0.38.0",
+    // #8438 D21 — User settings' fifth tab, Privacy, and the public
+    // unsubscribe landing every signed link calls. Genuinely new, so they
+    // attach at today's fixed-group version, the same rule #8339 applied.
+    "(authed)/account/privacy": "0.40.0",
+    unsubscribe: "0.40.0",
     // #8234 — the member Artifacts pages and a version's file route. Genuinely
     // new, so they attach at today's fixed-group version, the same rule #7430
     // applied.
     "(authed)/account/artifacts": "0.38.0",
     "(authed)/account/artifacts/[pieceId]": "0.38.0",
     "(authed)/account/artifacts/[pieceId]/versions/[version]/file": "0.38.0",
+    // #8515 — the client's onboarding page. Genuinely new, so it attaches at
+    // today's fixed-group version, the same rule #7430 applied.
+    "(authed)/account/onboarding": "0.40.0",
     // The leads inbox (#5678). The ROUTE ships in every scaffold, Free
     // included — lead capture is a never-gate surface, so reading a lead back
     // is one too. Whether it shows a ROW is a separate question with two
@@ -749,7 +787,13 @@ export const ROUTE_DEPENDENCIES = {
         "apps/web/lib/auth-routes.ts",
     ],
     "(auth)/sign-in": ["apps/web/lib/auth-env.ts"],
-    "(auth)/sign-up": ["apps/web/lib/auth-env.ts"],
+    // #8438 D13/D21 — the sign-up card's agreements gate also carries the
+    // carried-cookie mint, `sign-up.actions.ts`, beside it in this route's own
+    // directory.
+    "(auth)/sign-up": [
+        "apps/web/lib/auth-env.ts",
+        `${ROUTE_ROOT}/(auth)/sign-up/sign-up.actions.ts`,
+    ],
     "(auth)/forgot-password": ["apps/web/lib/auth-env.ts"],
     "(auth)/reset-password": ["apps/web/lib/auth-env.ts"],
     // #7430 — the group's layout reads `isAccountPath()` to give the account
@@ -764,6 +808,17 @@ export const ROUTE_DEPENDENCIES = {
         "apps/web/lib/server-api.ts",
         "apps/web/lib/site-brand.tsx",
         "apps/web/lib/site-logo.tsx",
+        // #8438 D13/D21 — two brand-new files in this already-existing route
+        // directory; a scaffold whose `(authed)/account` predates this unit
+        // needs them added, which the directory-level sync alone would not do
+        // (sync never overwrites or adds to a directory it already has).
+        // `acceptCarriedAgreementsAction` (the carried-cookie CONSUME side) lives
+        // in this directory's own `agreements-actions.ts`, never in
+        // `(auth)/sign-up` — see that file's header: `(auth)/**` is a sign-in
+        // seed a sign-in-less spoke drops, so a cross-directory reach from here
+        // into it would dangle.
+        `${ROUTE_ROOT}/(authed)/account/agreements-prompt.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/agreements-actions.ts`,
     ],
     // #7430 — the three child routes also import files in their PARENT's
     // directory. A scaffold whose `(authed)/account` predates #7430 keeps its
@@ -834,23 +889,47 @@ export const ROUTE_DEPENDENCIES = {
         `${ROUTE_ROOT}/(authed)/account/components/send-message.tsx`,
     ],
     // #8339 D11 — Security holds the former Sign-in section, moved verbatim
-    // from General: `sign-in-method.ts` and what it imports.
+    // from General: `sign-in-method.ts` and what it imports. #8431 D8 — the
+    // tab's failed-read row (`error-row.tsx` and its `retry-button.tsx`); its
+    // own `security-source.ts` and `security-panel.tsx` live in the route dir
+    // and copy with it.
     "(authed)/account/security": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/auth-env.ts",
         "apps/web/lib/server-api.ts",
         "apps/web/lib/hub-session/config.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/error-row.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/retry-button.tsx`,
         `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
         `${ROUTE_ROOT}/(authed)/account/sign-in-method.ts`,
     ],
     // #8339 D11 — Notifications holds the former Privacy section's
-    // cookie-settings link, moved verbatim from General.
+    // cookie-settings link, moved verbatim from General. #8438 D15 — that
+    // link moved on again, to Privacy; Notifications now reads the registry
+    // through `member.consents` instead, so it keeps the same dependency set.
     "(authed)/account/notifications": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
         `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/privacy/actions.ts`,
+    ],
+    // #8438 D14 — Privacy's five sections: the summary, the cookie-choice
+    // read from the browser cookie, data-use consents and read-only
+    // agreements (both through `member.consents`), and Request account
+    // deletion, moved here unchanged from General (D16) — so Privacy needs
+    // General's own deletion files too, the same cross-directory rule #8339
+    // D11 applied to Notifications' cookie-settings link.
+    "(authed)/account/privacy": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/sign-in-method.ts`,
+        `${ROUTE_ROOT}/(authed)/account/profile-actions.ts`,
+        `${ROUTE_ROOT}/(authed)/account/general/deletion-request.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/general/profile-source.ts`,
     ],
     "(authed)/account/billing": [
         "apps/web/lib/account-config.ts",
@@ -894,6 +973,17 @@ export const ROUTE_DEPENDENCIES = {
         `${ROUTE_ROOT}/(authed)/account/artifacts/artifact-actions.ts`,
     ],
     "(authed)/account/artifacts/[pieceId]/versions/[version]/file": ["apps/web/lib/server-api.ts"],
+    // #8515 D12 — the onboarding page imports its parent's account-data.ts
+    // and error-row.tsx (which renders retry-button.tsx); its actions forward
+    // the credential `forwardedCookieInit` returns. account-data.ts reads the
+    // account config, as the Artifacts pages' does.
+    "(authed)/account/onboarding": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/error-row.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/retry-button.tsx`,
+    ],
     "(authed)/account/support": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/server-api.ts",
@@ -967,10 +1057,13 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/account/general": ["account"],
     "(authed)/account/security": ["account"],
     "(authed)/account/notifications": ["account"],
+    "(authed)/account/privacy": ["account"],
     "(authed)/account/billing": ["account"],
     // #8234 — the two Artifacts pages; the file route renders no string.
     "(authed)/account/artifacts": ["account"],
     "(authed)/account/artifacts/[pieceId]": ["account"],
+    // #8515 — the onboarding page.
+    "(authed)/account/onboarding": ["account"],
     "(authed)/admin": ["admin"],
     "(authed)/leads": ["leadsInbox"],
     // #5977 — every string on both editor routes comes from the `edit`
@@ -982,6 +1075,8 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/waitlist": ["waitlistDashboard.gate"],
     // #7744 — the /team hub's empty state reads the `team` namespace.
     team: ["team"],
+    // #8438 D21 — the unsubscribe landing's own namespace.
+    unsubscribe: ["unsubscribe"],
 };
 /** Template-relative path of the generated site-nav registry. */
 export const NAV_CONFIG_PATH = "apps/web/lib/nav-config.ts";

package/dist/template-record.d.ts

@@ -0,0 +1,59 @@
+/** Where the per-file record lives, beside `.ailk-site-manifest.json`. */
+export declare const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
+/**
+ * The app paths a generator rewrites after `copyTemplate` lands its copy
+ * (§1): the nav, the site chrome, the site fonts, the paid-sections
+ * registry, and the four spoke seams. Composed from each writer's own
+ * exported path constant, so a renamed constant carries its path along
+ * here too (#8522 D2).
+ */
+export declare const REGENERATED_APP_PATHS: readonly string[];
+/**
+ * Whether a destination path (`/`-separated, as `templateDestination`
+ * returns it) is one `update` ever records or touches (#8522 D2): under one
+ * of the three app trees, not a `package.json`, not an `.env*` file, no
+ * `.claude` segment, and not a path a generator rewrites after the copy.
+ */
+export declare function isRecordable(destRel: string): boolean;
+/** The hex sha256 digest of `bytes` — the one hash every record row uses. */
+export declare function sha256Hex(bytes: Uint8Array): string;
+export interface TemplateFileRow {
+    sha256: string;
+    version: string;
+}
+export interface TemplateRecord {
+    schema: 1;
+    projectName: string;
+    files: Record<string, TemplateFileRow>;
+}
+/** Thrown by `parseTemplateRecord` on a malformed or unsafe record. */
+export declare class TemplateRecordError extends Error {
+    constructor(message: string);
+}
+/**
+ * Parse `.ailk-template-files.json` text, refusing — naming the field — on:
+ * JSON that does not parse; `schema !== 1`; an unknown top-level key; an
+ * empty `projectName`; a `files` key that is not a recordable path; a
+ * `sha256` that is not 64 lowercase hex; a `version` that is not a semver
+ * string (#8522 D1).
+ */
+export declare function parseTemplateRecord(text: string): TemplateRecord;
+/** `record` as `scaffold()` and `update` write it: sorted keys, trailing newline. */
+export declare function serializeTemplateRecord(record: TemplateRecord): string;
+export interface PlanTemplateRecordOptions {
+    /** The freshly scaffolded site. */
+    targetDir: string;
+    /** Destination path -> sha256 of the bytes `copyTemplate`'s `onWrite` wrote, for every recordable path. */
+    copied: ReadonlyMap<string, string>;
+    /** The create-ailk version that wrote this scaffold. */
+    version: string;
+    projectName: string;
+}
+/**
+ * The record a fresh scaffold writes (#8522 D2): one row per copied path
+ * whose file still exists and whose current bytes still hash to the copy —
+ * a later layer (a module bundle's patch, a generator) that rewrote the
+ * file drops it from the record, exactly as it is absent from the record a
+ * `create-ailk update` keeps current for it.
+ */
+export declare function planTemplateRecord(opts: PlanTemplateRecordOptions): TemplateRecord;

package/dist/template-record.js

@@ -0,0 +1,183 @@
+/**
+ * `.ailk-template-files.json` — the per-file record of what a scaffold's
+ * copied app code is (#8522 D1/D2).
+ *
+ * Written beside `.ailk-site-manifest.json` at the site root, it lists every
+ * `apps/web/`, `apps/api/` and `apps/mcp/` file the base `templates/` copy
+ * wrote and no later layer rewrote, with the sha256 of the template's copy
+ * of that file and the create-ailk version it came from. `create-ailk
+ * update` (`update.ts`) reads it to tell an untouched copy from an owner's
+ * edit; `scaffold()` (`programmatic.ts`) writes it, as its last write, from
+ * the `onWrite` hook `copyTemplate` (`copy.ts`) calls once per file.
+ *
+ * Pure module: no `import.meta.url`, no filesystem write — `planTemplateRecord`
+ * only READS the scaffold's own disk to confirm a copied path's final bytes
+ * (a later layer may have rewritten it, D2); every write goes through the
+ * caller.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PAID_SECTIONS_PATH } from "./paid-sections.js";
+import { SITE_CHROME_PATH } from "./site-chrome.js";
+import { SITE_FONTS_PATH } from "./site-fonts.js";
+import { NAV_CONFIG_PATH } from "./surfaces.js";
+import { SPOKE_SEAM_FILES } from "./topology.js";
+/** Where the per-file record lives, beside `.ailk-site-manifest.json`. */
+export const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
+/**
+ * The app paths a generator rewrites after `copyTemplate` lands its copy
+ * (§1): the nav, the site chrome, the site fonts, the paid-sections
+ * registry, and the four spoke seams. Composed from each writer's own
+ * exported path constant, so a renamed constant carries its path along
+ * here too (#8522 D2).
+ */
+export const REGENERATED_APP_PATHS = [
+    NAV_CONFIG_PATH,
+    SITE_CHROME_PATH,
+    SITE_FONTS_PATH,
+    PAID_SECTIONS_PATH,
+    ...SPOKE_SEAM_FILES,
+];
+const REGENERATED_SET = new Set(REGENERATED_APP_PATHS);
+const RECORDABLE_APP_ROOT = /^apps\/(web|api|mcp)\//;
+/**
+ * Whether a destination path (`/`-separated, as `templateDestination`
+ * returns it) is one `update` ever records or touches (#8522 D2): under one
+ * of the three app trees, not a `package.json`, not an `.env*` file, no
+ * `.claude` segment, and not a path a generator rewrites after the copy.
+ */
+export function isRecordable(destRel) {
+    if (!RECORDABLE_APP_ROOT.test(destRel))
+        return false;
+    const segments = destRel.split("/");
+    const base = segments[segments.length - 1] ?? "";
+    if (base === "package.json")
+        return false;
+    if (base.startsWith(".env"))
+        return false;
+    if (segments.includes(".claude"))
+        return false;
+    if (REGENERATED_SET.has(destRel))
+        return false;
+    return true;
+}
+/** The hex sha256 digest of `bytes` — the one hash every record row uses. */
+export function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/** Thrown by `parseTemplateRecord` on a malformed or unsafe record. */
+export class TemplateRecordError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TemplateRecordError";
+    }
+}
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+/**
+ * Whether `key` is traversal-safe: no `..`, no empty segment, no backslash,
+ * no leading `/` (D1). This alone does not make `key` a path `update` may
+ * touch — `parseTemplateRecord` also requires `isRecordable(key)`, so a
+ * tampered record can never direct a write or delete outside the three app
+ * trees nor at a non-recordable path (`package.json`, `.env*`, a
+ * `REGENERATED_APP_PATHS` entry, …) inside them.
+ */
+function isSafeRecordKey(key) {
+    if (key.length === 0 || key.startsWith("/") || key.includes("\\")) {
+        return false;
+    }
+    const segments = key.split("/");
+    return segments.every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+/**
+ * Parse `.ailk-template-files.json` text, refusing — naming the field — on:
+ * JSON that does not parse; `schema !== 1`; an unknown top-level key; an
+ * empty `projectName`; a `files` key that is not a recordable path; a
+ * `sha256` that is not 64 lowercase hex; a `version` that is not a semver
+ * string (#8522 D1).
+ */
+export function parseTemplateRecord(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (err) {
+        throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} is not valid JSON: ${err.message}`);
+    }
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+        throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} is not a JSON object`);
+    }
+    const record = doc;
+    const allowed = new Set(["schema", "projectName", "files"]);
+    for (const key of Object.keys(record)) {
+        if (!allowed.has(key)) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} has an unknown top-level key "${key}"`);
+        }
+    }
+    if (record["schema"] !== 1) {
+        throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "schema" must be 1, got ${JSON.stringify(record["schema"])}`);
+    }
+    const projectName = record["projectName"];
+    if (typeof projectName !== "string" || projectName.length === 0) {
+        throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "projectName" must be a non-empty string`);
+    }
+    const filesRaw = record["files"];
+    if (typeof filesRaw !== "object" || filesRaw === null || Array.isArray(filesRaw)) {
+        throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files" must be an object`);
+    }
+    const files = {};
+    for (const [key, value] of Object.entries(filesRaw)) {
+        if (!isSafeRecordKey(key)) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files" has an unsafe key "${key}"`);
+        }
+        if (!isRecordable(key)) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files" has a key "${key}" that is not a recordable path`);
+        }
+        if (typeof value !== "object" || value === null) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files"["${key}"] must be an object`);
+        }
+        const row = value;
+        const sha = row["sha256"];
+        if (typeof sha !== "string" || !SHA256_PATTERN.test(sha)) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files"["${key}"].sha256 must be 64 lowercase hex characters`);
+        }
+        const version = row["version"];
+        if (typeof version !== "string" || !VERSION_PATTERN.test(version)) {
+            throw new TemplateRecordError(`${TEMPLATE_RECORD_PATH} "files"["${key}"].version must be a semver string`);
+        }
+        files[key] = { sha256: sha, version };
+    }
+    return { schema: 1, projectName, files };
+}
+/** `record` as `scaffold()` and `update` write it: sorted keys, trailing newline. */
+export function serializeTemplateRecord(record) {
+    const files = {};
+    for (const key of Object.keys(record.files).sort()) {
+        files[key] = record.files[key];
+    }
+    return (JSON.stringify({ schema: record.schema, projectName: record.projectName, files }, null, 2) +
+        "\n");
+}
+/**
+ * The record a fresh scaffold writes (#8522 D2): one row per copied path
+ * whose file still exists and whose current bytes still hash to the copy —
+ * a later layer (a module bundle's patch, a generator) that rewrote the
+ * file drops it from the record, exactly as it is absent from the record a
+ * `create-ailk update` keeps current for it.
+ */
+export function planTemplateRecord(opts) {
+    const files = {};
+    for (const path of [...opts.copied.keys()].sort()) {
+        const hash = opts.copied.get(path);
+        if (hash === undefined)
+            continue;
+        const abs = join(opts.targetDir, ...path.split("/"));
+        if (!existsSync(abs))
+            continue;
+        if (sha256Hex(readFileSync(abs)) !== hash)
+            continue;
+        files[path] = { sha256: hash, version: opts.version };
+    }
+    return { schema: 1, projectName: opts.projectName, files };
+}

package/dist/topology.js

@@ -273,7 +273,9 @@ const WEB_SEAM_HEADER = `// topology.generated.ts — how this site reads a sess
 // UNSERVED_MCP_TOOLS names the MCP tools /.well-known/mcp.json leaves out
 // on this topology (#8070).
 // loadSpokeBilling reaches the spoke billing action only on a spoke that
-// signs in through its hub and carries commerce (#8217); elsewhere, null.`;
+// signs in through its hub and carries commerce (#8217); elsewhere, null.
+// readOwnAccounts lists the signed-in person's own sign-in accounts through
+// Better Auth on a hub (#8431); a spoke has none here, so it answers null.`;
 const MCP_SEAM_HEADER = `// topology.generated.ts — how this MCP server resolves its workspace store.
 //
 // GENERATED by create-ailk for this site's topology (#7426). Do not edit:
@@ -303,6 +305,26 @@ const SITE_SESSION_TYPE = `export type SiteSession = {
     createdAt?: Date | string | null;
   };
 } | null;`;
+/**
+ * `readOwnAccounts` (#8431 D2a): the session's own sign-in accounts, which
+ * the account Security tab reads to say whether the person has a password.
+ * The hub render loads `auth.ts` only when it is called; a spoke has no local
+ * accounts, so its renders answer `null` and import nothing.
+ */
+function ownAccountsReader(topology) {
+    if (topology === "hub") {
+        return `export async function readOwnAccounts(
+  headers: Headers,
+): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  const { auth } = await import("../auth");
+  return auth.api.listUserAccounts({ headers });
+}`;
+    }
+    return `export function readOwnAccounts(headers: Headers): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  void headers;
+  return Promise.resolve(null);
+}`;
+}
 /** The sign-in exports every web seam render carries (#7894 D8). */
 function signInExports(values) {
     const literal = (value) => value === null ? "null" : JSON.stringify(value);
@@ -382,6 +404,8 @@ export async function readSession(headers: Headers): Promise<SiteSession> {
   return auth.api.getSession({ headers });
 }
 
+${ownAccountsReader("hub")}
+
 export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();
@@ -404,6 +428,8 @@ export function readSession(headers: Headers): Promise<SiteSession> {
   return readHubSession(headers);
 }
 
+${ownAccountsReader("spoke")}
+
 export function registerSiteStores(): Promise<void> {
   return Promise.resolve();
 }
@@ -424,6 +450,8 @@ export function readSession(headers: Headers): Promise<SiteSession> {
   return Promise.resolve(null);
 }
 
+${ownAccountsReader("spoke")}
+
 export function registerSiteStores(): Promise<void> {
   return Promise.resolve();
 }

package/dist/update.d.ts

@@ -0,0 +1,48 @@
+/** A refusal the CLI exits 2 on, thrown before anything is written. */
+export declare class UpdateRefusedError extends Error {
+    readonly exitCode = 2;
+    constructor(message: string);
+}
+export interface UpdateSiteOptions {
+    /** The existing site. */
+    targetDir: string;
+    /** The running package's own `templates/` directory. */
+    templatesDir: string;
+    /** The running create-ailk version. */
+    version: string;
+    /** Overrides `AILK_NPM_REGISTRY_URL` / the public npm registry default. */
+    registryUrl?: string;
+    /** Injected fetch for tests. Never a live network call in CI. */
+    fetchImpl?: typeof fetch;
+}
+export interface UpdateResult {
+    targetDir: string;
+    version: string;
+    updated: string[];
+    merged: string[];
+    added: string[];
+    removed: string[];
+    current: string[];
+    review: Array<{
+        path: string;
+        reason: string;
+    }>;
+    skipped: Array<{
+        path: string;
+        reason: string;
+    }>;
+    backfilled?: {
+        version: string;
+        files: number;
+    };
+}
+export declare function updateSite(opts: UpdateSiteOptions): Promise<UpdateResult>;
+/** The printed report (D9): one section per non-empty list, in order. */
+export declare function formatUpdateReport(result: UpdateResult): string;
+export interface UpdateArgs {
+    target: string | undefined;
+    help: boolean;
+}
+export declare const UPDATE_HELP = "create-ailk update \u2014 bring template fixes into a site's copied app code.\n\nUsage:\n  create-ailk update [<target-dir>]\n\nArguments:\n  <target-dir>             The existing site. Defaults to the current dir.\n\nOptions:\n  --help, -h               Print this message.\n\nReads .ailk-template-files.json (written beside .ailk-site-manifest.json by\nevery template scaffold) to tell an untouched copy from an edit. An\nuntouched apps/web, apps/api or apps/mcp file whose template copy changed is\noverwritten. An edited file whose template copy also changed is three-way\nmerged with `git` (git must be on PATH); a conflict leaves the file alone\nand is listed under \"Needs review\" \u2014 nothing else in the run is held back.\nA site with no record gets one on its first run, from the version its\n.ailk-site-manifest.json already records. Commit before running, and review\nthe diff after.\n";
+/** Parse the argv AFTER the `update` word. Strict `node:util` parseArgs, like `parseAdoptArgs`. */
+export declare function parseUpdateArgs(argv: string[]): UpdateArgs;