create-ailk 0.23.0 → 0.25.1

package/templates/apps/mcp/src/index.ts

@@ -23,41 +23,13 @@
  *   CONTENT_ADAPTER=mdx|projection|database
  *   DATABASE_URL=  (required only when CONTENT_ADAPTER=database)
  *
- * The boot sequence and the HTTP env reading live in `boot.ts`, shared with
- * the Vercel entry `app.ts` (#8070 D2).
+ * The server is `@working-theory/mcp-server` (#9460): the boot sequence, the
+ * transports and every tool come from the package, so a version bump of it is
+ * the whole of taking an MCP change. This file hands it the site.
  */
 
-import {
-  bootMcp,
-  httpTransportConfigFromEnv,
-  readStatelessEnv,
-} from "./boot.js";
+import { runMcp } from "@working-theory/mcp-server";
 
-// The workspace, the licence-key store, the commerce claim, its re-read loop
-// and the licence boot warning — before either transport branch below.
-await bootMcp();
+import { site } from "./site.js";
 
-const transport = process.env["MCP_TRANSPORT"] ?? "stdio";
-
-if (transport === "http") {
-  const { startHttpTransport } = await import("./http-transport.js");
-
-  const config = httpTransportConfigFromEnv();
-  await startHttpTransport({
-    ...config,
-    stateless: readStatelessEnv(false),
-  });
-
-  console.log(
-    `MCP HTTP transport listening on port ${config.port} at ${config.path}`,
-  );
-} else {
-  // Default: stdio transport
-  const { StdioServerTransport } =
-    await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const { createMcpServer } = await import("./server.js");
-
-  const server = createMcpServer();
-  const stdioTransport = new StdioServerTransport();
-  await server.connect(stdioTransport);
-}
+await runMcp(site);

package/templates/apps/mcp/src/lib/paid-tools.generated.ts

@@ -0,0 +1,10 @@
+// paid-tools.generated.ts — the paid MCP tool packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (`paidMcpToolPackages`) and
+// this app's package.json dependencies (#9460). Do not edit: every scaffold
+// and `create-ailk add-module` rewrites it. A carried package is a bundled
+// dynamic import the server resolves its paid tools from at call time; a
+// site that carries none exports an empty list.
+import type { McpToolPackLoader } from "@working-theory/mcp-server";
+
+export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [];

package/templates/apps/mcp/src/lib/topology.generated.ts

@@ -10,9 +10,9 @@ import {
   initMcpPublicWorkspace,
   mcpPublicWorkspace,
   type McpWorkspaceResolution,
-} from "./public-workspace.js";
+} from "@working-theory/mcp-server/hub";
 
-export { registerLicenseKeyStore } from "./license-key-store.js";
+export { registerLicenseKeyStore } from "@working-theory/mcp-server/hub";
 export type { McpWorkspaceResolution };
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";

package/templates/apps/mcp/src/site.ts

@@ -0,0 +1,12 @@
+/**
+ * The site this MCP server runs for (#9460 DD2/DD4): the topology seam and
+ * the paid-tool registry, both generated by create-ailk, handed to
+ * `@working-theory/mcp-server` as one object. Nothing else is the site's own.
+ */
+
+import type { McpSite } from "@working-theory/mcp-server";
+
+import { PAID_TOOL_PACKS } from "./lib/paid-tools.generated.js";
+import * as topology from "./lib/topology.generated.js";
+
+export const site: McpSite = { topology, paidToolPacks: PAID_TOOL_PACKS };

package/templates/apps/web/.env.example

@@ -229,7 +229,7 @@ CONTENT_ADAPTER=mdx
 # AILK_HUB_SIGN_IN_URL=https://hub.example.com
 #
 # This site's client id and secret, issued on the hub with
-#   pnpm --filter @working-theory/api spokes sign-in-client --id <spoke_id> \
+#   pnpm --filter @working-theory/app-api spokes sign-in-client --id <spoke_id> \
 #     --redirect-uri <this site's origin>/api/hub-session/callback
 # The client id is the spoke's id. The secret is shown once; keep it out of git.
 # AILK_HUB_CLIENT_ID=

package/templates/apps/web/CLAUDE.md

@@ -345,8 +345,9 @@ Every multi-step magnet is a page pair (#8840), rendered by one module,
 - **`/<magnet>/start`** — the walk, `noindex, follow`, full-screen with the
   back arrow alone (`NavBackLink`) above step 1. `lib/magnet-routes.ts`'s
   `isMagnetWalkPath` is what the locale layout drops the Nav and Footer on:
-  any path ending in `start`, plus `/careers/apply` and
-  `/careers/<posting>/apply`. The cookie consent banner stays.
+  any path ending in `start`, plus `/careers/apply`,
+  `/careers/<posting>/apply` and `/trial/request`. The cookie consent banner
+  stays.
 - **The ending.** A flow with an `ending` ends on it, never on `thankYou`:
   `FlowStepperClient` picks the outcome from the walk's answers
   (`selectFlowEndingOutcome`) — a screen in the finished card with `{name}`
@@ -362,6 +363,12 @@ Every multi-step magnet is a page pair (#8840), rendered by one module,
 - **The pairs.** `/flows/<slug>` is the canonical pair. `/careers/apply` and
   `/careers/<posting>/apply` walk the Job application magnet (the second
   titles step 1 with the posting and sends its slug as the hidden `job`).
+  `/trial` and `/trial/request` are the trial magnet's pair (#9287): the
+  landing passes `renderMagnetLanding` a `startPath`, so its one button
+  (the magnet's `landing.cta`, "Request a free trial") goes to
+  `/trial/request` rather than `/trial/start`, and the walk passes a
+  `title`, so an absent flow renders the contact email under its own `<h1>`,
+  as `/careers/apply` does. Both are `signal-collectors` slice files.
   Any other pair is written by `create-ailk add-route magnet --path <path>
   --flow <slug>`: two short pages carrying the `Standard magnet page
   (#8840)` marker, which `lib/__tests__/structured-data.test.tsx` exempts
@@ -400,7 +407,8 @@ Every multi-step magnet is a page pair (#8840), rendered by one module,
   content. With none, #8848 D6 holds for a configured hub: a 5xx or a refused
   connection shows the contact email (`noindex`). A site with no hub to ask —
   the read answers 503 `flows_not_configured`, or no API origin
-  (`AILK_API_URL`, `NEXT_PUBLIC_AILK_API_URL`, `NEXT_PUBLIC_API_URL`) is set —
+  (`AILK_API_URL`, the origin `browserApiOrigin()` returns, or
+  `NEXT_PUBLIC_API_URL`) is set —
   reads `not-configured` (set once in `readMagnet`), and the slug 404s, as
   does its `/start` (#9219). `/downloads` and `/downloads/<slug>` are
   permanent redirects into `/reports` (signal-collectors files).
@@ -419,7 +427,11 @@ key), so the page names none. It renders one of three pages:
 - **Unconnected** — the route answers `unconnected`, or the deployment runs
   in production with none of the API origin variables `getApiBase()` reads:
   today's MDX page through `renderPage`, byte for byte, `?plan=` matching
-  authored plan keys as #8842 made it.
+  authored plan keys as #8842 made it. The browser-facing one is read
+  through `lib/api-origin.generated.ts`'s `browserApiOrigin()` (#7874 D12):
+  `NEXT_PUBLIC_AILK_API_URL` on a hub, nothing on a spoke, which refuses that
+  name — so a spoke with `/pricing` passes its own `env:check` (#9480). The
+  magnet pages and the results permalink read it the same way.
 - **A current shown set** — `lib/offerings-pricing.ts` maps it to a plans
   fragment and an add-ons fragment. The first `pricing` section that is not
   `addons` becomes the Stripe plans, and the first `addons` one the Stripe
@@ -539,7 +551,11 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - Don't reach into `apps/api` or `apps/mcp` from `apps/web`. They're peer apps — talk via HTTP/MCP.
 - Don't commit images to `screenshots/` — only the `.gitkeep` is tracked.
 
-Last updated: 2026-10-19 — § Magnet pages: `/careers/apply` renders the contact email under its own `<h1>` when its flow is absent or the hub cannot answer; `readMagnet`'s `not-configured` kind 404s an unknown `/reports/<slug>` (and its `/start`) on a site with no hub to ask, while a configured hub that is down keeps #8848 D6's contact email (#9219) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/careers/apply/page.tsx`, `app/[locale]/reports/deliverable-page.tsx` and `app/[locale]/reports/[slug]/{page,start/page}.tsx`.
+Last updated: 2026-10-21 — § Pricing page and § Magnet pages: `/pricing`, the magnet pages and the results permalink read the browser-facing API origin through `browserApiOrigin()` (#7874 D12), so a spoke that enables them passes its own `env:check` (#9480) — verified against `app/[locale]/pricing/page.tsx`, `app/[locale]/flows/[slug]/{magnet-page.tsx,results/[payload]/page.tsx}` and `lib/api-origin.generated.ts`.
+
+Prior: 2026-10-20 — § Magnet pages: the trial magnet's pair, `/trial` (its button to `/trial/request` through `renderMagnetLanding`'s `startPath`) and the chrome-free `/trial/request` walk with its own `<h1>` fallback (#9287 C2, DD10) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/trial/{page,request/page}.tsx` and `lib/magnet-routes.ts`.
+
+Prior: 2026-10-19 — § Magnet pages: `/careers/apply` renders the contact email under its own `<h1>` when its flow is absent or the hub cannot answer; `readMagnet`'s `not-configured` kind 404s an unknown `/reports/<slug>` (and its `/start`) on a site with no hub to ask, while a configured hub that is down keeps #8848 D6's contact email (#9219) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/careers/apply/page.tsx`, `app/[locale]/reports/deliverable-page.tsx` and `app/[locale]/reports/[slug]/{page,start/page}.tsx`.
 
 Prior: 2026-10-18 — § Spoke checkout: the Offerings buy route is the one selling path, and the legacy env-key buy route, webhook route, `lib/checkout.ts` and checkout e2e workflow are retired (#9142) — verified against `app/api/offerings/checkout/[lookupKey]/route.ts`, `app/[locale]/checkout/*/page.tsx`, `lib/checkout-config.ts` and create-ailk's `spoke-checkout.ts` and `sync-routes.ts`.
 

package/templates/apps/web/app/.well-known/mcp.json/route.ts

@@ -16,7 +16,9 @@
  * the surface disagreement `apps/mcp/__tests__/catalog-drift.test.ts` exists
  * to make impossible. The same single read also yields the licence features
  * the deployment holds (#7136), which gate the five `feature`-tagged tools
- * here exactly as they gate registration on the MCP server.
+ * here exactly as they gate registration on the MCP server. `create_project`
+ * is left out while create-ailk's release scope holds the Free level (#9534),
+ * as `apps/mcp` leaves it unregistered — `lib/release-scope.ts`.
  *
  * Mirrors /.well-known/ai-plugin.json conventions: Response.json with a
  * conservative cache-control header.
@@ -26,6 +28,7 @@
  * is appropriate per the MCP discovery spec.
  */
 
+import { isFreeLevelReleased } from "../../../lib/release-scope";
 import { UNSERVED_MCP_TOOLS } from "../../../lib/topology.generated";
 import packageJson from "../../../package.json";
 import {
@@ -60,8 +63,11 @@ export async function GET(): Promise<Response> {
     ailkVersion: packageJson.version,
     commerceClaimed: heldFeatures.includes(COMMERCE_FEATURE),
     heldFeatures,
-    // The tools this topology's MCP server does not register (#8070 D7).
-    unservedTools: UNSERVED_MCP_TOOLS,
+    // The tools this topology's MCP server does not register (#8070 D7) —
+    // and create_project while the Free level is held (#9534).
+    unservedTools: isFreeLevelReleased()
+      ? UNSERVED_MCP_TOOLS
+      : [...UNSERVED_MCP_TOOLS, "create_project"],
     // Spread conditional to satisfy exactOptionalPropertyTypes: omit the key
     // entirely when the env var is not set rather than passing undefined.
     ...(mcpHttpUrlEnv ? { mcpHttpUrl: mcpHttpUrlEnv } : {}),

package/templates/apps/web/app/[locale]/contact/__tests__/ConversationalIntakeWrapper.test.tsx

@@ -7,7 +7,7 @@
  *   boundary is mocked (`@working-theory/api-client`'s `leads.submit`) —
  *   the REAL `ConversationalIntake` block (#4543) and its engine (#4532),
  *   the REAL `captureLeadAction` (the SAME action the shared
- *   `LeadCaptureForm` on `/contact` uses), and the REAL `submitLeadInputSchema` validation all run, proving
+ *   `LeadCaptureForm` on `/contact` uses), and the REAL `contactFormSchema` validation all run, proving
  *   the whole chain end to end. No file under apps/api is imported, mocked,
  *   or touched by this test or by the wiring it exercises.
  * AC2 — Skip renders the existing form, carrying over answers already

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -3,8 +3,10 @@
 /**
  * captureLeadAction — Server Action paired with ailkCaptureLead MCP tool.
  *
- * Validates contact-form input with submitLeadInputSchema (shared schema per
- * ADR 0013), calls POST /v1/leads/submit via @working-theory/api-client, and returns
+ * Validates contact-form input with its own `contactFormSchema` (the form's
+ * field set is the page's, not a wire contract — the `capture_lead` MCP tool
+ * takes the route body since #7171), calls POST /v1/leads/submit via
+ * @working-theory/api-client, and returns
  * the shared `LeadCaptureForm` block's `LeadCaptureFormState`.
  *
  * Canonical filename: contact.actions.ts (*.actions.ts per ADR 0013 / U0 spec
@@ -102,11 +104,11 @@ import {
   CONTACT_LEAD_SOURCES,
   flowCheckoutOfferingSchema,
   leadSubmitNextSchema,
-  submitLeadInputSchema,
 } from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { getLocale, getTranslations } from "next-intl/server";
+import { z } from "zod";
 
 import { accountInviteHref } from "../../../lib/account-invite";
 import { consentVisitorHeader, readConsentVisitor } from "../../../lib/consent-visitor";
@@ -139,6 +141,14 @@ const DEFAULT_SOURCE = "contact-form";
 const CONSENT_REQUIRED = "Please accept the terms to send your message.";
 const MAX_EXTRA_FIELD_LENGTH = 2000;
 
+/** The form's four fields and bounds; each field error is zod's own message. */
+const contactFormSchema = z.object({
+  name: z.string().min(1).max(200),
+  email: z.string().email(),
+  message: z.string().max(2000).optional(),
+  phone: z.string().max(50).optional(),
+});
+
 /**
  * The declared extra fields, or `null` when they exceed the bounds. Non-string
  * entries (files) and Next's own `$ACTION_…` keys are skipped.
@@ -253,7 +263,7 @@ export async function captureLeadAction(
     fieldErrors.consent = CONSENT_REQUIRED;
   }
 
-  const parsed = submitLeadInputSchema.safeParse(raw);
+  const parsed = contactFormSchema.safeParse(raw);
   if (!parsed.success) {
     for (const issue of parsed.error.issues) {
       const field = String(issue.path[0] ?? "form");

package/templates/apps/web/app/[locale]/contact/intake-analytics.ts

@@ -5,7 +5,7 @@
  * ConversationalIntakeWrapper (#4534, epic #4521's integration leg).
  *
  * `recordIntakeTurn` fires `track()` (`@working-theory/analytics/server`,
- * the same fire-and-forget helper `apps/api/src/routes/leads/index.ts`
+ * the same fire-and-forget helper `packages/api/src/routes/leads/index.ts`
  * already uses for "lead-captured") once per conversation turn, tagged with
  * the turn index and the engine status as of that turn. A session's last
  * "intake-turn-abandonment" event with `status: "in_progress"` marks the

package/templates/apps/web/app/[locale]/contact/intake-script.ts

@@ -4,7 +4,7 @@
  * leg).
  *
  * Three open questions, deliberately keyed `name` / `message` / `email` —
- * the SAME field names `submitLeadInputSchema` (packages/validation)
+ * the SAME field names `contactFormSchema` (`./contact.actions.ts`)
  * expects. `ConversationalIntakeWrapper` reads `IntakeEngineState.answers`
  * by these exact ids to build the `FormData` it hands to the existing
  * `captureLeadAction` (`./contact.actions.ts`), so the script's question

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/magnet-page.test.tsx

@@ -86,6 +86,7 @@ jest.mock("../../../contact/site-contact-email", () => ({
   readSiteContactEmail: () => "hello@example.com",
 }));
 
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import {
   magnetLandingMetadata,
   magnetStartMetadata,
@@ -361,7 +362,15 @@ describe("the read tells a hub that is not configured from one that is down (#92
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
   });
 
-  it.each(ORIGIN_NAMES)("with %s set, a 5xx or a throw is unavailable", async (name) => {
+  // #9480 — the browser-facing name is read through the topology seam
+  // (#7874 D12). The committed seam is the hub render; #8060 — a spoke render
+  // reads no NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold leaves that row out.
+  const CONFIGURED_BY =
+    TOPOLOGY === "hub"
+      ? ORIGIN_NAMES
+      : ORIGIN_NAMES.filter((name) => name !== "NEXT_PUBLIC_AILK_API_URL");
+
+  it.each(CONFIGURED_BY)("with %s set, a 5xx or a throw is unavailable", async (name) => {
     process.env[name] = "https://hub.example";
     mockGet.mockResolvedValue({ ok: false, status: 503, body: null });
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "unavailable" });
@@ -378,6 +387,18 @@ describe("the read tells a hub that is not configured from one that is down (#92
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
   });
 
+  it("on a spoke (the seam's spoke render), NEXT_PUBLIC_AILK_API_URL alone is not-configured", async () => {
+    process.env.NEXT_PUBLIC_AILK_API_URL = "https://hub.example";
+    mockGet.mockResolvedValue({ ok: false, status: 503, body: null });
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../magnet-page");
+      await expect(spoke.readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
+    });
+  });
+
   it("with no API origin, a 404 is still absent and a served flow still ok", async () => {
     mockGet.mockResolvedValue({ ok: false, status: 404, body: null });
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "absent" });

package/templates/apps/web/app/[locale]/flows/[slug]/magnet-page.tsx

@@ -7,7 +7,9 @@
  * chrome — a centred hero of the flow record's `landing` copy, a CTA to
  * `/<magnet>/start`, and the `Assessment` page type's single-layer
  * `WebApplication` JSON-LD) and a `noindex, follow` WALK (`/<magnet>/start`,
- * chrome-free by `lib/magnet-routes.ts`, the back arrow alone above step 1).
+ * or the `startPath` a landing names, as `/trial` names `/trial/request` —
+ * #9287 DD10; chrome-free by `lib/magnet-routes.ts`, the back arrow alone
+ * above step 1).
  * This module is the only code that renders either half: `/flows/<slug>`,
  * the careers apply pages and every pair `create-ailk add-route magnet`
  * writes are callers of the factories below.
@@ -23,7 +25,8 @@
  * with no hub to ask — the read answers 503 `flows_not_configured`, or a
  * failed read with no API origin configured — is `not-configured` (#9219);
  * a pair renders it as `unavailable`, and `/reports/<slug>` uses it to 404
- * an unknown slug where a hub outage shows the contact email. A walk
+ * an unknown slug where a hub outage shows the contact email; a landing that
+ * passes `notFoundWhenNotConfigured` (`/trial`, #9423) 404s on it too. A walk
  * that exists apart from its flow (`/careers/apply`) passes a `title`: its
  * fallback then carries that page heading, and an absent flow renders the
  * same fallback rather than a 404 (#9219).
@@ -48,6 +51,7 @@ import { notFound, redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { browserApiOrigin } from "../../../../lib/api-origin.generated";
 import { readSiteContactEmail } from "../../contact/site-contact-email";
 
 import { FlowStepperClient } from "./FlowStepperClient";
@@ -71,13 +75,16 @@ const magnetReads = new Map<string, { at: number; read: Promise<MagnetRead> }>()
 
 /**
  * Whether an API origin is configured: the three names `getApiBase()` in
- * packages/api-client/src/http.ts reads, in step with it (as `/pricing`
- * checks them). Without one that function answers `localhost:3001`.
+ * packages/api-client/src/http.ts reads, in step with it on a hub. Without one
+ * that function answers `localhost:3001`. The browser-facing origin comes from
+ * the topology seam (#7874 D12), which a spoke renders with no env read, so a
+ * spoke passes its own `env:check` (#9480). A spoke diverges on purpose: the
+ * browser-facing name set on one at runtime counts as no origin here.
  */
 function apiOriginConfigured(): boolean {
   return Boolean(
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL,
   );
 }
@@ -170,6 +177,15 @@ export interface MagnetLandingInput {
   /** The landing's own path, e.g. `/diagnostic`; the CTA goes to `<path>/start`. */
   path: string;
   locale: string;
+  /** #9287 DD10 — the walk's path when it is not `<path>/start` (`/trial/request`). */
+  startPath?: string;
+  /**
+   * #9423 — a landing that exists only to sell its hub's flow (`/trial`) is a
+   * 404 on a site with no hub to ask (`not-configured`), as `/reports/<slug>`
+   * is (#9219). A configured hub that cannot answer still shows the contact
+   * email.
+   */
+  notFoundWhenNotConfigured?: boolean;
 }
 
 /** The indexable landing of a magnet pair (D8). */
@@ -177,9 +193,12 @@ export async function renderMagnetLanding({
   slug,
   path,
   locale,
+  startPath = `${path}/start`,
+  notFoundWhenNotConfigured = false,
 }: MagnetLandingInput): Promise<ReactElement> {
   const read = await readMagnet(slug);
   if (read.kind === "absent") notFound();
+  if (read.kind === "not-configured" && notFoundWhenNotConfigured) notFound();
   if (read.kind !== "ok") return magnetUnavailable(locale);
   // #8848 D7 — a deliverable's one route.
   if (read.config.deliverable !== undefined) redirect(localeHref(locale, `/reports/${slug}`));
@@ -194,7 +213,7 @@ export async function renderMagnetLanding({
         headline: copy.title,
         subheadline: copy.description,
         ...(copy.meta !== undefined ? { body: copy.meta } : {}),
-        primaryCta: { label: copy.cta, href: localeHref(locale, `${path}/start`) },
+        primaryCta: { label: copy.cta, href: localeHref(locale, startPath) },
       },
     },
   ];
@@ -221,9 +240,11 @@ export async function renderMagnetLanding({
 export async function renderMagnetLandingMetadata({
   slug,
   locale,
-}: Pick<MagnetLandingInput, "slug" | "locale">): Promise<Metadata> {
+  notFoundWhenNotConfigured = false,
+}: Pick<MagnetLandingInput, "slug" | "locale" | "notFoundWhenNotConfigured">): Promise<Metadata> {
   const read = await readMagnet(slug);
   if (read.kind === "absent") return {};
+  if (read.kind === "not-configured" && notFoundWhenNotConfigured) return {};
   if (read.kind !== "ok") return flowRouteMetadata();
   const copy = await landingCopy(read.config, locale);
   return { title: copy.title, description: copy.description };

package/templates/apps/web/app/[locale]/pricing/__tests__/unconnected.test.tsx

@@ -23,6 +23,7 @@ import {
 import type { PageSection } from "@working-theory/validation";
 import type { ReactElement } from "react";
 
+import { TOPOLOGY } from "../../../../lib/topology.generated";
 import * as pricingPage from "../page";
 import PricingPage, { generateMetadata } from "../page";
 
@@ -219,6 +220,48 @@ describe("/pricing on an unconnected site is today's page (#8927 AC-4)", () => {
     expect(served).toBe(await oracleHtml(undefined, true));
   });
 
+  // #9480 — the browser-facing origin is read through the topology seam
+  // (#7874 D12). The committed seam is the hub render, so this case runs it
+  // unmocked. #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, reads the shown set in production configured only by the browser-facing origin",
+    async () => {
+      for (const name of API_ENV) delete process.env[name];
+      process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+      (process.env as Record<string, string>).NODE_ENV = "production";
+
+      const served = await pageHtml({}, true);
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(String(fetchMock.mock.calls[0][0])).toMatch(
+        /^https:\/\/api\.example\.test\/v1\/content\/shown-offerings/,
+      );
+      expect(served).toBe(await oracleHtml(undefined, true));
+    },
+  );
+
+  it("on a spoke (the seam's spoke render), that origin is not read in production", async () => {
+    for (const name of API_ENV) delete process.env[name];
+    process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+    (process.env as Record<string, string>).NODE_ENV = "production";
+
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../page");
+      await spoke.default({
+        params: Promise.resolve({ locale: "en" }),
+        searchParams: Promise.resolve({}),
+        getMdxSource,
+        getPageSections,
+      });
+    });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("keeps the MDX page's metadata and renders per request", async () => {
     const params = Promise.resolve({ locale: "en" });
 

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -36,6 +36,7 @@ import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { browserApiOrigin } from "../../../lib/api-origin.generated";
 import {
   offeringsPricing,
   type OfferingsPricing,
@@ -114,13 +115,16 @@ function sharedRead(
 
 /**
  * Whether an API origin is configured: the three names `getApiBase()` in
- * packages/api-client/src/http.ts reads, in step with it. Without one that
- * function answers `localhost:3001`.
+ * packages/api-client/src/http.ts reads, in step with it on a hub. Without one
+ * that function answers `localhost:3001`. The browser-facing origin comes from
+ * the topology seam (#7874 D12), which a spoke renders with no env read, so a
+ * spoke passes its own `env:check` (#9480). A spoke diverges on purpose: the
+ * browser-facing name set on one at runtime counts as no origin here.
  */
 function apiOriginConfigured(): boolean {
   return Boolean(
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL,
   );
 }