create-ailk 0.21.0 → 0.23.0

package/dist/lib/npm-auth.js

@@ -0,0 +1,48 @@
+/**
+ * Hands `NPM_TOKEN` to the scaffold's own `pnpm install` through a user-level
+ * npmrc (#9092).
+ *
+ * The published `@working-theory/*` scope is private, and pnpm sends an
+ * authorization header only when an npmrc maps the registry to a token.
+ * pnpm >= 11 ignores registry credentials in a PROJECT `.npmrc`, so the
+ * scaffold commits none; the token has to arrive at user level instead.
+ *
+ * When the caller exported `NPM_TOKEN` and has no user npmrc of its own (the
+ * credential-less environment: no `~/.npmrc`, no `npm login`), the install
+ * runs with `NPM_CONFIG_USERCONFIG` pointing at a temporary, owner-only file
+ * carrying only the `${NPM_TOKEN}` reference — never the value — removed when
+ * the install returns. A caller with its own user npmrc owns its auth, and is
+ * left untouched; a userconfig override naming a missing file is replaced.
+ *
+ * Pure module: no `import.meta.url`, so jest imports it directly.
+ */
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** The one user-level line: the registry mapped to the env var, no value. */
+export const NPM_TOKEN_AUTH_LINE = "//registry.npmjs.org/:_authToken=${NPM_TOKEN}";
+/** The user npmrc npm and pnpm read for `env` — the override, else `~/.npmrc`. */
+function userNpmrcPath(env, home) {
+    return env["NPM_CONFIG_USERCONFIG"] || env["npm_config_userconfig"] || join(home, ".npmrc");
+}
+/**
+ * Calls `run` with the env the install should use: `env` itself, or — when
+ * `NPM_TOKEN` is set and no user npmrc exists — `env` plus
+ * `NPM_CONFIG_USERCONFIG` naming a temporary reference-only npmrc, which is
+ * removed once `run` returns or throws.
+ */
+export function withNpmTokenUserConfig(env, home, run) {
+    if (!env["NPM_TOKEN"] || existsSync(userNpmrcPath(env, home)))
+        return run(env);
+    const dir = mkdtempSync(join(tmpdir(), "create-ailk-npmrc-"));
+    try {
+        const path = join(dir, ".npmrc");
+        writeFileSync(path, `${NPM_TOKEN_AUTH_LINE}\n`, { mode: 0o600 });
+        // Both spellings: npm and pnpm read either, and a stale lower-case one
+        // left beside ours would make the winner depend on key order.
+        return run({ ...env, NPM_CONFIG_USERCONFIG: path, npm_config_userconfig: path });
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/lib/scaffold-render-sweep.d.ts

@@ -33,8 +33,9 @@ export declare const CLAIM_GATED_ROUTES: Readonly<Record<string, string>>;
 export declare const CONFIG_GATED_ROUTES: Readonly<Record<string, string>>;
 /**
  * The placeholder heading each `CONFIG_GATED_ROUTES` entry renders while its
- * env var is unset — for `/meet`, the hero headline of the overlay's
- * `content/en/LandingPage/meet.mdx` seed. A fresh scaffold never edits it.
+ * env var is unset. Empty since #8843 D14: `/meet` reads the workspace's
+ * meetings and answers 200 with its own H1 unconfigured, so no route is
+ * config-gated today.
  */
 export declare const CONFIG_GATED_PLACEHOLDERS: Readonly<Record<string, string>>;
 /** Reachability only — for routes that are not pages (`/og`, `/llms.txt`, …). */

package/dist/lib/scaffold-render-sweep.js

@@ -46,17 +46,14 @@ export const CLAIM_GATED_ROUTES = {
  * `CLAIM_GATED_ROUTES`, a route absent from the route table is not stale: the
  * module that owns it may simply not be installed in this leg.
  */
-export const CONFIG_GATED_ROUTES = {
-    "/meet": "SCHEDULING_CAL_LINK",
-};
+export const CONFIG_GATED_ROUTES = {};
 /**
  * The placeholder heading each `CONFIG_GATED_ROUTES` entry renders while its
- * env var is unset — for `/meet`, the hero headline of the overlay's
- * `content/en/LandingPage/meet.mdx` seed. A fresh scaffold never edits it.
+ * env var is unset. Empty since #8843 D14: `/meet` reads the workspace's
+ * meetings and answers 200 with its own H1 unconfigured, so no route is
+ * config-gated today.
  */
-export const CONFIG_GATED_PLACEHOLDERS = {
-    "/meet": "{Book a time with us}",
-};
+export const CONFIG_GATED_PLACEHOLDERS = {};
 const LOOPBACK_BASE = "http://localhost";
 function pathnameOf(location, relativeTo) {
     return new URL(location, new URL(relativeTo, LOOPBACK_BASE)).pathname;

package/dist/module-architecture.js

@@ -793,6 +793,9 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/index.ts",
             "apps/api/src/routes/workspaces/sessions.ts",
             "apps/api/src/routes/workspaces/config.ts",
+            // #8926 D1 — the workspace Offerings routes, registered in the
+            // multi-tenant tenant scope beside the billing routes.
+            "apps/api/src/routes/workspaces/offerings.ts",
             // #8438 D8 — the Admin owner's consents to Working Theory: registered
             // under `isModuleEnabled("multi-tenant")` alone, the module that
             // contributes the Admin app.
@@ -805,6 +808,8 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/billing/index.ts",
             "apps/api/src/routes/billing/portal.ts",
             "apps/api/src/routes/billing/read.ts",
+            "apps/api/src/routes/billing/stripe-connection.ts",
+            "apps/api/src/routes/billing/stripe-products.ts",
             "apps/api/src/routes/billing/usage.ts",
             "apps/api/src/routes/waitlist-experiments/index.ts",
             "apps/api/src/routes/waitlist-experiments/list.ts",
@@ -854,6 +859,10 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // #9170 — the Inbox orders read: the same gate and the same
+            // tenant-db.ts import, co-owned with `workspace` for the same reason.
+            "apps/api/src/routes/workspaces/orders.ts",
+            "apps/api/src/services/inbox-orders.ts",
             // #852 D8 — the People reads: the same workspace||multi-tenant gate and
             // the same tenant-db.ts import, co-owned with `workspace` for the same
             // reason.
@@ -1023,6 +1032,9 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/submissions.ts",
             "apps/api/src/routes/workspaces/subscribers.ts",
             "apps/api/src/services/inbox-submissions.ts",
+            // Co-owned with `multi-tenant` (#9170), as the reads above.
+            "apps/api/src/routes/workspaces/orders.ts",
+            "apps/api/src/services/inbox-orders.ts",
             // Co-owned with `multi-tenant` (#852 D8), as the reads above.
             "apps/api/src/routes/workspaces/people.ts",
             // Co-owned with `multi-tenant` (#7877 D9, D11) — see that slice's entry.
@@ -1134,8 +1146,16 @@ export const MODULE_SLICES = {
                 pattern: CAL_DOMAIN_PATTERN,
                 // The two server-side apps: apps/api holds the provider client, and
                 // apps/mcp's tools name booking links in their fixtures. Everything
-                // else — apps/web above all — is browser-reachable.
-                paths_excluded: ["apps/api/**", "apps/mcp/**"],
+                // else — apps/web above all — is browser-reachable. The two web files
+                // are the booking pages' CSP (#8843 D12): the policy file names the
+                // embed's origin only to admit it on those pages, and the middleware
+                // applies it. Same carve-out as the source monorepo's architecture.yaml.
+                paths_excluded: [
+                    "apps/api/**",
+                    "apps/mcp/**",
+                    "apps/web/security-headers.config.ts",
+                    "apps/web/middleware.ts",
+                ],
                 reason: "Only this site's server tier addresses the provider; every browser call goes to this site's own /v1/schedule/* routes instead",
             },
             {
@@ -1224,10 +1244,22 @@ export const MODULE_SLICES = {
             "apps/api/src/services/scheduling/__tests__/cal-provider.test.ts",
             "apps/mcp/src/tools/list_availability.ts",
             "apps/mcp/src/tools/get_event_meta.ts",
+            // #8843 D5 — the twin of GET /v1/schedule/meetings.
+            "apps/mcp/src/tools/list_meetings.ts",
             "apps/mcp/src/tools/create_booking.ts",
             "apps/web/app/[locale]/meet/page.tsx",
             "apps/web/app/[locale]/meet/[slug]/page.tsx",
             "apps/web/app/[locale]/meet/confirmed/page.tsx",
+            // #8843 D6–D8 — the booking pages' one builder, the index frame
+            // `/meet` and `/private` share, the private index, and their suites,
+            // individually (§ D12, property 1: a glob ships no test).
+            "apps/web/lib/meetings.tsx",
+            "apps/web/lib/__tests__/meetings.test.tsx",
+            "apps/web/lib/__tests__/meetings.fixtures.ts",
+            "apps/web/app/[locale]/meet/meeting-index.tsx",
+            "apps/web/app/[locale]/private/page.tsx",
+            "apps/web/app/[locale]/private/__tests__/page.test.tsx",
+            "apps/web/app/[locale]/private/__tests__/sitemap.test.ts",
             // #6085 (brief H7) — the six files the webhook receiver + the
             // tenant-guarded appointments read add. Individually, never as a
             // glob (§ D12 / this card's own comment above, property 1: a glob
@@ -1269,6 +1301,9 @@ export const MODULE_SLICES = {
             "apps/api/src/lib/public-meetings-config.ts",
             "apps/api/src/routes/schedule/meeting-types.ts",
             "apps/api/src/routes/schedule/__tests__/meeting-types.test.ts",
+            // #8843 D1 — the meetings read's own suite; the route is in
+            // `routes/schedule/index.ts`, listed above.
+            "apps/api/src/routes/schedule/__tests__/meetings.test.ts",
             // #7532 — a hub spoke's meeting types and booking, through the real
             // scheduling routes; it ships and strips with them.
             "apps/api/src/routes/schedule/__tests__/spoke.test.ts",
@@ -1301,6 +1336,10 @@ export const MODULE_SLICES = {
             "apps/api/src/services/scheduling/resolve.ts",
             "apps/api/src/services/scheduling/__tests__/connections.test.ts",
             "apps/api/src/services/scheduling/__tests__/provider-resolution.test.ts",
+            // #9129 — the meetings-list assembly the meetings route and the member
+            // meeting types share, plus its suite.
+            "apps/api/src/services/scheduling/meetings.ts",
+            "apps/api/src/services/scheduling/__tests__/meetings.test.ts",
             "apps/api/src/routes/workspaces/__tests__/meetings-connection.test.ts",
             "apps/api/src/routes/schedule/__tests__/public-connection.test.ts",
             "apps/api/src/routes/webhooks/__tests__/calcom-connection.test.ts",
@@ -1323,14 +1362,16 @@ export const MODULE_SLICES = {
             "apps/api/src/__tests__/schedule-forwarded-rate-limit.test.ts",
             "apps/api/src/__tests__/openapi-keyless-hub.test.ts",
         ],
-        // pageContributions (spec 5478; parent § D6 shape 1) — the booker, the
-        // per-booking-type page and the confirmation page, whose route files
-        // `ownedFiles` above already carries. No row names seed content: all
-        // three render from the /v1/schedule/* routes, not from an MDX file.
+        // pageContributions (spec 5478; parent § D6 shape 1) — the meeting
+        // index, the meeting page, the confirmation page and the private index
+        // (#8843 D8), whose route files `ownedFiles` above already carries. No
+        // row names seed content: all four render from the /v1/schedule/*
+        // routes, not from an MDX file.
         pageContributions: [
             { route: "/meet" },
             { route: "/meet/[slug]" },
             { route: "/meet/confirmed" },
+            { route: "/private" },
             // #6086 — the authed appointments page. Bracket (roster) grammar and no
             // `content` key, for the same reason the three /meet rows carry none:
             // it renders from `/v1/schedule/appointments`, not from an MDX file.
@@ -1668,6 +1709,16 @@ export const MODULE_SLICES = {
             // `NESTED_FOREIGN_MODULE_ENTRIES` for the companion fix that keeps its
             // presence from falsely reading as "projects carried".
             "apps/web/app/[locale]/projects/apply/ListingApplicationClient.tsx",
+            // #8840 D11/D13 — the Job application magnet's two walks. Same kind as
+            // `projects/apply` above: they sit under the UNRELATED "careers"
+            // surface's URL segment, which `excludedRoutePaths` does not gate on
+            // signal-collectors, so `ownedFiles` keeps them out of a keyless
+            // scaffold, and `NESTED_FOREIGN_MODULE_ENTRIES` keeps their presence
+            // from reading as "careers carried". `flows/[slug]/magnet-page.tsx`,
+            // the renderer they mount, rides the `flows` surface's directory with
+            // its siblings (the note above).
+            "apps/web/app/[locale]/careers/apply/page.tsx",
+            "apps/web/app/[locale]/careers/[slug]/apply/page.tsx",
             // #5581 U4 — the eleven signal-collectors components + the slice's own
             // re-export entry point moved to packages-paid/ui-signal-collectors;
             // the package is delivered to a keyed scaffold via `patches` below,
@@ -1683,6 +1734,17 @@ export const MODULE_SLICES = {
             // spec 6892 D2 — the /reports hub, alongside its reader above: also a
             // URL segment MODULE_SURFACES["signal-collectors"] does not gate.
             "apps/web/app/[locale]/reports/page.tsx",
+            // #8848 D6, D7 — the hub deliverable at `/reports/<slug>`: its renderer,
+            // the gated walk and the ungated file's byte proxy. Same segment, same
+            // reason as the reader above.
+            "apps/web/app/[locale]/reports/deliverable-page.tsx",
+            "apps/web/app/[locale]/reports/[slug]/start/page.tsx",
+            "apps/web/app/[locale]/reports/[slug]/file/route.ts",
+            // #8848 D12 — `/downloads` redirects into `/reports`, so a scaffold
+            // without this module ships no `/downloads` at all (the redirect target
+            // is this module's) rather than the old broken list.
+            "apps/web/app/[locale]/downloads/page.tsx",
+            "apps/web/app/[locale]/downloads/[slug]/page.tsx",
             //
             // The two sections that route composes — `report-header` and
             // `reports-list` — are deliberately NOT owned here. They are
@@ -1721,6 +1783,9 @@ export const MODULE_SLICES = {
             // the module gets them — `moduleRosterRows` derives the code-route form
             // for this row rather than requiring a template to ship one (D9).
             { route: "/reports/[slug]", contentDir: "content/en/ReportPage" },
+            // #8848 D7's walk (`/reports/[slug]/start`) is NOT a contribution: a
+            // contribution needs a shipped template manifest to carry its row, and
+            // none does yet. Its code ships through `ownedFiles` above.
         ],
         // installMap (#5618 D6.3) — the module's sample files, moved here out
         // of `site-templates/marketing-site/` so the module OWNS its samples
@@ -1750,6 +1815,12 @@ export const MODULE_SLICES = {
         // code of its own for either route.
         // `generate-sample-report.py` keeps its root-level destination
         // (finding 1 — AC7 forbids changing the Pro file set).
+        // `diagnostic` and `join-waitlist` are the starter's two placeholder
+        // flow seeds (#8850 D5): every visible string a `{brace}`, every key one
+        // a spoke may seed, so `create-ailk seed-flows` sends them to a hub with
+        // no edits once `spokeDestination` lands them at `flows/<slug>.json`. A
+        // hub gets them as inert `database/flows/` files, as it gets
+        // `fit-check` and `referral`.
         installMap: {
             "packages/create-ailk/module-templates/signal-collectors/content/en/ProjectsList/projects.mdx": "content/en/ProjectsList/projects.mdx",
             "packages/create-ailk/module-templates/signal-collectors/content/en/Project/fit-check-funnel.mdx": "content/en/Project/fit-check-funnel.mdx",
@@ -1765,6 +1836,8 @@ export const MODULE_SLICES = {
             "packages/create-ailk/module-templates/signal-collectors/content/en/LandingPage/referral.mdx": "content/en/LandingPage/referral.mdx",
             "packages/create-ailk/module-templates/signal-collectors/flows/fit-check.flow.json": "database/flows/fit-check.flow.json",
             "packages/create-ailk/module-templates/signal-collectors/flows/referral.flow.json": "database/flows/referral.flow.json",
+            "packages/create-ailk/module-templates/signal-collectors/flows/diagnostic.flow.json": "database/flows/diagnostic.flow.json",
+            "packages/create-ailk/module-templates/signal-collectors/flows/join-waitlist.flow.json": "database/flows/join-waitlist.flow.json",
             "packages/create-ailk/module-templates/signal-collectors/waitlist/launch-waitlist.experiment.json": "database/waitlist/launch-waitlist.experiment.json",
             "packages/create-ailk/module-templates/signal-collectors/reports/sample-report.pdf": "apps/web/public/reports/sample-report.pdf",
             "packages/create-ailk/module-templates/signal-collectors/reports/generate-sample-report.py": "reports/generate-sample-report.py",
@@ -1812,9 +1885,11 @@ export const MODULE_SLICES = {
         // checkout (`SPOKE_HUB_CHECKOUT_SEEDS`: flows/[slug]/checkout.actions.ts,
         // the flow results pages, dev/purchase — spoke-intake Rule 3). What lands
         // is the scaffold-commerce skill, the commerce-boundary rule and the
-        // @working-theory/ui-commerce dependency (`patches` below); the spoke's own
-        // checkout — two routes, checkout-config.ts and two return pages — is
-        // rendered by create-ailk (`spoke-checkout.ts`), not carried here.
+        // @working-theory/ui-commerce dependency (`patches` below). A spoke sells
+        // through its hub's Offerings buy route (#9142); its remaining checkout
+        // files — `apps/web` template source (checkout-config.ts, two return
+        // pages and their tests) — are copied by `writeSpokeCheckoutSlice`
+        // (`spoke-checkout.ts`, #8748), not carried here.
         spoke: true,
         paidSectionsPackage: "@working-theory/ui-commerce",
         apps: {
@@ -2136,6 +2211,18 @@ export function coOwnedModuleDestinations() {
 //     red the scaffold's database jest run. Matched exactly, not by basename
 //     in `EXCLUDE_FILES`, which would drop a `build.test.ts` anywhere in the
 //     snapshot; every other database suite still ships.
+//   - the /pricing suite `monorepo-only.test.tsx` and its snapshot (#9179) —
+//     it snapshots the monorepo's own `content/en/Pricing/pricing.mdx`, which
+//     a scaffold replaces with its seed, and reads
+//     `packages/api-client/src/offerings.ts`, which no scaffold carries. Only
+//     those two assertions moved there; `unconnected.test.tsx` and
+//     `offerings.test.tsx` keep every scaffold-meaningful case and ship.
+//   - the Offerings `delegate-confinement.test.ts` (#9179) — it runs
+//     `git grep -- apps apps-paid packages` from the repo root to prove the
+//     `stripeConnection` and `offeringsCheckoutSession` delegates are each
+//     named by one file. A scaffold is not a git repository. Only those two
+//     cases moved there; `connection.test.ts` and
+//     `checkout-session-record.test.ts` keep the stores' coverage and ship.
 export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/web/__tests__",
     "apps/web/app/__tests__",
@@ -2161,6 +2248,9 @@ export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/mcp/__tests__/parity.test.ts",
     "apps/mcp/__tests__/audit.test.ts",
     "database/__tests__/build.test.ts",
+    "apps/web/app/[locale]/pricing/__tests__/monorepo-only.test.tsx",
+    "apps/web/app/[locale]/pricing/__tests__/__snapshots__/monorepo-only.test.tsx.snap",
+    "apps/api/src/services/offerings/__tests__/delegate-confinement.test.ts",
 ];
 export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
     const roots = new Set(snapshotRoots);

package/dist/paid-sections.d.ts

@@ -1,5 +1,7 @@
 /** Scaffold-relative path of the generated registry. */
 export declare const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
+/** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
+export declare const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
 export interface PaidSectionRow {
     module: string;
     package: string;
@@ -15,9 +17,26 @@ export declare function paidSectionRows(): PaidSectionRow[];
  * public strip drops the file (\`check-oss-strip.sh\` condition (e)).
  */
 export declare function renderPaidSections(present: ReadonlySet<string>): string;
+/**
+ * Render the module-presence flags. Line 1 is `// oss: false` exactly when a
+ * flag is on, the registry's own rule: an `on` flag names pages the public
+ * tree does not carry.
+ */
+export declare function renderModuleFlags(flags: {
+    schedulingPages: boolean;
+}): string;
+/**
+ * Write the module-presence flags into a scaffold from its own
+ * `apps/web/package.json` (#8843 D10) — never copied from a template, so a
+ * site without the scheduling module can never carry `true`. Answers whether
+ * the file was `added`, `updated` (changed bytes) or `unchanged`, or
+ * `undefined` (writing nothing) for a scaffold with no web app.
+ */
+export declare function writeModuleFlags(targetDir: string): "added" | "updated" | "unchanged" | undefined;
 /**
  * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`. Returns `false` (writing nothing) when that
- * file or `apps/web/lib/` is absent — a scaffold with no web app.
+ * own `apps/web/package.json`, and the module-presence flags beside it.
+ * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
+ * absent — a scaffold with no web app.
  */
 export declare function writePaidSections(targetDir: string): boolean;

package/dist/paid-sections.js

@@ -15,6 +15,13 @@
  * every layer (snapshot transform, module `patches`, `add-module`) already
  * keeps true. The monorepo's committed copy is the render with every row
  * present and is pinned byte-equal by `__tests__/paid-sections.test.ts`.
+ *
+ * Its sibling, `apps/web/lib/modules.generated.ts` (#8843 D10), is the
+ * module-presence flag: `SCHEDULING_PAGES` is true exactly when the site
+ * carries the scheduling slice's UI package, so the locale layout drops the
+ * marketing chrome on the booking pages only where they exist. A separate
+ * file, importing nothing, because the registry's `import()`s would pull UI
+ * packages into any edge code that reads the flag.
  */
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -22,6 +29,10 @@ import { MODULE_SLICES } from "./module-architecture.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
 /** Scaffold-relative path of the generated registry. */
 export const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
+/** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
+export const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
+/** The dependency whose presence means the scheduling module's pages exist. */
+const SCHEDULING_PAGES_PACKAGE = "@working-theory/ui-scheduling";
 function pascalCase(shortName) {
     return shortName
         .split("-")
@@ -93,27 +104,78 @@ export function renderPaidSections(present) {
     }
     return `${lines.join("\n")}\n`;
 }
+const MODULE_FLAGS_HEADER = `// modules.generated.ts — which module pages this site carries.
+//
+// GENERATED by create-ailk from this app's package.json dependencies (#8843).
+// Do not edit: every scaffold, \`create-ailk add-module\` and
+// \`create-ailk update\` rewrites it. It imports nothing, so edge code may
+// read it as well as the locale layout.
+`;
 /**
- * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`. Returns `false` (writing nothing) when that
- * file or `apps/web/lib/` is absent — a scaffold with no web app.
+ * Render the module-presence flags. Line 1 is `// oss: false` exactly when a
+ * flag is on, the registry's own rule: an `on` flag names pages the public
+ * tree does not carry.
  */
-export function writePaidSections(targetDir) {
+export function renderModuleFlags(flags) {
+    const lines = [];
+    if (flags.schedulingPages)
+        lines.push("// oss: false");
+    lines.push(MODULE_FLAGS_HEADER.trimEnd());
+    lines.push("");
+    lines.push("/** The scheduling module's booking pages (/meet, /private) exist. */");
+    lines.push(`export const SCHEDULING_PAGES: boolean = ${String(flags.schedulingPages)};`);
+    return `${lines.join("\n")}\n`;
+}
+/** The web app's `dependencies`, or `undefined` for a scaffold with no web app. */
+function webDependencies(targetDir, writing) {
     const pkgPath = join(targetDir, "apps/web/package.json");
     if (!existsSync(pkgPath) || !existsSync(join(targetDir, "apps/web/lib"))) {
-        return false;
+        return undefined;
     }
     let pkg;
     try {
         pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
     }
     catch (err) {
-        throw new Error(`cannot read ${pkgPath} to write the paid-sections registry: ${err.message}`, { cause: err });
+        throw new Error(`cannot read ${pkgPath} to write the ${writing}: ${err.message}`, { cause: err });
     }
-    const deps = pkg.dependencies ?? {};
+    return pkg.dependencies ?? {};
+}
+/**
+ * Write the module-presence flags into a scaffold from its own
+ * `apps/web/package.json` (#8843 D10) — never copied from a template, so a
+ * site without the scheduling module can never carry `true`. Answers whether
+ * the file was `added`, `updated` (changed bytes) or `unchanged`, or
+ * `undefined` (writing nothing) for a scaffold with no web app.
+ */
+export function writeModuleFlags(targetDir) {
+    const deps = webDependencies(targetDir, "module flags");
+    if (deps === undefined)
+        return undefined;
+    const path = join(targetDir, MODULE_FLAGS_PATH);
+    const before = existsSync(path) ? readFileSync(path, "utf8") : undefined;
+    const next = renderModuleFlags({
+        schedulingPages: Object.hasOwn(deps, SCHEDULING_PAGES_PACKAGE),
+    });
+    if (before === next)
+        return "unchanged";
+    writeFileSync(path, next);
+    return before === undefined ? "added" : "updated";
+}
+/**
+ * Write the registry into a scaffold, deriving presence from the scaffold's
+ * own `apps/web/package.json`, and the module-presence flags beside it.
+ * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
+ * absent — a scaffold with no web app.
+ */
+export function writePaidSections(targetDir) {
+    const deps = webDependencies(targetDir, "paid-sections registry");
+    if (deps === undefined)
+        return false;
     const present = new Set(paidSectionRows()
         .map((row) => row.package)
         .filter((name) => Object.hasOwn(deps, name)));
     writeFileSync(join(targetDir, PAID_SECTIONS_PATH), renderPaidSections(present));
+    writeModuleFlags(targetDir);
     return true;
 }

package/dist/programmatic.js

@@ -44,7 +44,7 @@ import { SITE_CHROME_PATH, renderSiteChrome, resolveSiteChrome, } from "./site-c
 import { SITE_FONTS_PATH, renderSiteFonts } from "./site-fonts.js";
 import { planSiteManifest } from "./site-manifest.js";
 import { SITE_ROSTER_PATH, planHomeRecord, planSiteManifestDesign, readSiteRoster, withMeetPlaceholderSeeds, } from "./site-roster.js";
-import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
+import { SPOKE_CHECKOUT_TEMPLATE_PATHS, dropSpokeCheckoutDependency, spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from "./spoke-checkout.js";
 import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, isUnservedSurfaceContent, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
@@ -182,6 +182,9 @@ export function scaffoldSync(opts, copied) {
             ...(spoke !== undefined
                 ? spokeExclusions(TEMPLATES_DIR, spoke)
                 : SPOKE_ONLY_FILES),
+            // #8748 D3 — the standard spoke checkout lands only through
+            // `writeSpokeCheckoutSlice`, on a spoke carrying commerce.
+            ...SPOKE_CHECKOUT_TEMPLATE_PATHS,
         ],
         markers: buildScaffoldMarkers(projectName),
         ...(copied !== undefined
@@ -193,6 +196,9 @@ export function scaffoldSync(opts, copied) {
             }
             : {}),
     });
+    // #8748 D3 — the copied apps/web depends on the checkout package; only a
+    // commerce spoke keeps it, re-added by `writeSpokeCheckoutSlice` in scaffold().
+    dropSpokeCheckoutDependency(targetAbs);
     // #7426 D5/D6 — the root files a spoke rewrites, and the spoke seams.
     if (spoke !== undefined)
         applySpokeTransforms(targetAbs, spoke);
@@ -793,18 +799,26 @@ export async function scaffold(opts) {
                 writeFileSync(rosterPath, manifestText);
         }
     }
-    // #7838 D8 — a commerce spoke's own checkout: two routes, its config and
-    // two return pages, once every layer has landed (so the spoke filter has
-    // already dropped the hub-checkout files) and before the manifest, whose
-    // code-route rows then record /checkout/thank-you and /checkout/unavailable.
+    // #7838 D8 — a commerce spoke's own checkout: the standard spoke checkout
+    // copied from the template (#8748 D3), its config stamped, once every layer
+    // has landed (so the spoke filter has already dropped the hub-checkout
+    // files) and before the manifest, whose code-route rows then record
+    // /checkout/thank-you and /checkout/unavailable. Each copied file is
+    // recorded like the base copy's, so `update` keeps it current.
     // #8217 D8 — a spoke that signs in through its hub also gets the billing
     // action and the web seam render that reaches it.
     const spokeCommerce = spoke !== undefined && result.modules.includes("commerce");
     if (spokeCommerce) {
         writeSpokeCheckoutSlice(result.targetDir, {
             site: spokeCheckoutSite(projectName),
+            projectName,
             versions,
+            templatesDir: TEMPLATES_DIR,
             signIn: spoke.signIn,
+            onWrite: (relPath, bytes) => {
+                if (isRecordable(relPath))
+                    copied.set(relPath, sha256Hex(bytes));
+            },
         });
     }
     // #6944 — the manifest records what this scaffold IS, once every layer has

package/dist/seed-flows.d.ts

@@ -26,6 +26,8 @@ export type SeedFlowOutcome = {
     ok: true;
     result: string;
     status: string;
+    /** #8850 D6 — the flow's copy is the starter's `{brace}` placeholder. */
+    placeholder?: true;
 } | {
     slug: string;
     ok: false;
@@ -33,6 +35,7 @@ export type SeedFlowOutcome = {
 } | {
     slug: string;
     ok: "dry-run";
+    placeholder?: true;
 };
 export interface SeedFlowsResult {
     /** The hub origin, when one resolved (a dry run may have none). */
@@ -49,7 +52,7 @@ export interface SeedFlowsResult {
 /** The whole report, one line per row — what `seedFlows` printed as it went. */
 export declare function formatSeedFlowsReport(result: SeedFlowsResult): string;
 export declare function seedFlows(opts: SeedFlowsOptions): Promise<SeedFlowsResult>;
-export declare const SPOKE_FLOWS_README = "# flows/\n\nEach file here is one **declared flow**: `flows/<slug>.json` holds one flow\nconfig, exactly as the hub stores it. This repo owns these configs \u2014 the hub\nruns them for this site.\n\n## What a spoke may declare\n\nA spoke key may seed only what this site's own flow pages show:\n`slug`, `defaultLocale`, `steps`, `thankYou` and `flags`. Anything the\nhub acts on outside these pages \u2014 emails, deliverables, pricing, registers,\nlistings \u2014 is refused (`field_not_seedable`). A flow that needs one of those\nis authored in the hub's Admin instead.\n\nThe file name must be the config's `slug` plus `.json`.\n\n## Seeding them into the hub\n\nRun this as part of each rollout, from the site's root, with the spoke key\nyour hub issued set as `AILK_SPOKE_KEY` in the environment (a shell or CI\nsecret \u2014 never a file in this repo):\n\n    npx create-ailk seed-flows .\n\nThe hub origin comes from `--hub-url`, else `AILK_API_URL`, else the\n`AILK_API_URL=` line of `apps/web/.env.local`. The key is read from the\nenvironment only. Each flow answers `created`, `updated` or `unchanged`,\nso running it again is safe. `--dry-run` checks the files and sends nothing.\n\nThe hub's operator must first turn seeding on (`AILK_SPOKE_FLOW_SEED=true`\non the hub). Until it is on and this command has run, links to these flows\n(`/flows/<slug>`) reach no flow.\n\n## Who owns what\n\nThe next seed that differs overwrites the hub's copy of a flow's config, so\nedit flows here, not in the Admin. A flow's status (live or draft) is the\nhub's: switching a seeded flow to draft in the Admin keeps it draft through\nevery later seed. Removing a file here does not delete the hub's flow. If\nthe Admin adds a block only it can author (an email, a deliverable, an\noffer), the hub refuses the next seed of that flow (`slug_owned`) rather\nthan delete the block.\n";
+export declare const SPOKE_FLOWS_README = "# flows/\n\nEach file here is one **declared flow**: `flows/<slug>.json` holds one flow\nconfig, exactly as the hub stores it. This repo owns these configs \u2014 the hub\nruns them for this site.\n\n## What a spoke may declare\n\nA spoke key may seed only what this site's own flow pages show:\n`slug`, `defaultLocale`, `steps`, `thankYou` and `flags`. Anything the\nhub acts on outside these pages \u2014 emails, deliverables, pricing, registers,\nlistings \u2014 is refused (`field_not_seedable`). A flow that needs one of those\nis authored in the hub's Admin instead.\n\nThe file name must be the config's `slug` plus `.json`.\n\n## Seeding them into the hub\n\nRun this as part of each rollout, from the site's root, with the spoke key\nyour hub issued set as `AILK_SPOKE_KEY` in the environment (a shell or CI\nsecret \u2014 never a file in this repo):\n\n    npx create-ailk seed-flows .\n\nThe hub origin comes from `--hub-url`, else `AILK_API_URL`, else the\n`AILK_API_URL=` line of `apps/web/.env.local`. The key is read from the\nenvironment only. Each flow answers `created`, `updated` or `unchanged`,\nso running it again is safe. `--dry-run` checks the files and sends nothing.\n\nThe hub's operator must first turn seeding on (`AILK_SPOKE_FLOW_SEED=true`\non the hub). Until it is on and this command has run, links to these flows\n(`/flows/<slug>`) reach no flow.\n\n## The starter's placeholder flows\n\nThe `signal-collectors` module ships two declared flows here:\n`flows/diagnostic.json` (an email step, then two questions) and\n`flows/join-waitlist.json` (an email and an optional name). Every visible\nstring in both is a `{brace}` placeholder: replace each one with your own\ncopy. Both go live on the hub with the first seed, so each line this command\nprints for them says they still carry placeholder copy.\n\nA flow is reached at `/flows/<slug>`. To give one its own page pair, run:\n\n    npx create-ailk add-route magnet --path /diagnostic --flow diagnostic\n    npx create-ailk add-route magnet --path /waitlist --flow join-waitlist\n\nA job application comes with the `careers` surface. Contact, newsletter and\njob application are the hub's own standard magnets: the hub seeds them in\nevery workspace and refuses a spoke's copy of each, so they need no file\nhere. If the hub's Admin already owns a magnet under one of these two slugs,\nthe hub refuses the seed (`slug_owned`); rename the file and its `slug`.\n\n## Who owns what\n\nThe next seed that differs overwrites the hub's copy of a flow's config, so\nedit flows here, not in the Admin. A flow's status (live or draft) is the\nhub's: switching a seeded flow to draft in the Admin keeps it draft through\nevery later seed. Removing a file here does not delete the hub's flow. If\nthe Admin adds a block only it can author (an email, a deliverable, an\noffer), the hub refuses the next seed of that flow (`slug_owned`) rather\nthan delete the block.\n";
 /**
  * Write `SPOKE_FLOWS_README` to `<targetDir>/flows/README.md` unless that
  * file exists. Returns whether it wrote.