create-ailk 0.23.0 → 0.25.1

package/dist/derive-architecture.js

@@ -14,7 +14,19 @@
  * fixed document shape this module produces — no `yaml`/`js-yaml` dependency.
  */
 import { ARCHITECTURE_BASE, MODULE_SLICES, normalizeModules, } from "./module-architecture.js";
-import { CORE_SURFACE_PATHS, RECOGNIZED_SURFACES, resolveSurfaces, } from "./surfaces.js";
+import { MODULE_FLAGS_PATH, PAID_MCP_TOOLS_PATH, PAID_SECTIONS_PATH } from "./paid-sections.js";
+import { SITE_CHROME_PATH } from "./site-chrome.js";
+import { SITE_FONTS_PATH } from "./site-fonts.js";
+import { SPOKE_CHECKOUT_CONFIG_PATH, SPOKE_CHECKOUT_TEMPLATE_PATHS, } from "./spoke-checkout.js";
+import { CORE_SURFACE_PATHS, NAV_CONFIG_PATH, RECOGNIZED_SURFACES, resolveSurfaces, } from "./surfaces.js";
+import { SPOKE_SEAM_FILES } from "./topology.js";
+/** The npm scope a site consumes and never forks (#9191). */
+const PACKAGE_SCOPE = "@working-theory/";
+/** Apps whose `package.json` name is not `@working-theory/<dir>`, because the published package took it (#9564, #9570). */
+const SHELL_PACKAGE_NAME = {
+    api: "app-api",
+    admin: "admin-shell",
+};
 /** A spoke's composition tiers (#7426 D8): its data and API are the hub's. */
 const SPOKE_TIERS = {
     data: "none — the hub's database",
@@ -207,18 +219,6 @@ function appToYaml(app) {
     }
     return m;
 }
-function namespacesToYaml(ns) {
-    const members = {};
-    const sortedMembers = Object.entries(ns.members).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    for (const [key, mem] of sortedMembers) {
-        members[key] = { path: mem.path, description: mem.description };
-    }
-    return {
-        description: ns.description,
-        members,
-        rules: [...ns.rules],
-    };
-}
 /**
  * Derive the `architecture.yaml` document for a module set.
  *
@@ -229,9 +229,8 @@ function namespacesToYaml(ns) {
  *   modules gets exactly what the modules imply.
  * @param options the topology (#7426 D8). Absent or `"hub"` ⟹ the output is
  *   byte-identical to the two-argument form. `"spoke"` ⟹ only the spoke's own
- *   apps (`web`, and `mcp` unless `mcp: false`), no `namespaces`, no
- *   `database` root, a top-level `topology: spoke` and the hub-facing
- *   composition tiers.
+ *   apps (`web`, and `mcp` unless `mcp: false`), no `database` root, a
+ *   top-level `topology: spoke` and the hub-facing composition tiers.
  * @returns the complete `architecture.yaml` file content (a deterministic
  *   function of the module SET, the surface SET and the topology).
  * @throws Error on an unrecognized module (defensive; parse-args rejects first).
@@ -304,16 +303,69 @@ export function deriveArchitecture(modules = ["marketing"], surfaces, options =
             forbidden_patterns: mergeForbidden([...ARCHITECTURE_BASE.appForbiddenPatterns], [...(a.forbidden_patterns ?? []), ...extra]).map(scoped),
         });
     }
-    // namespaces — present only if a data-tier module contributes one, and
-    // never on a spoke, which has no database/ of its own.
-    const nsSlice = spoke
-        ? undefined
-        : slices.find((s) => s.namespaces)?.namespaces;
+    // No `namespaces` block (#9569): a site's `database/` holds no schema — the
+    // namespace boundaries belong to `@working-theory/database`'s own source and
+    // this monorepo's lint, and a rule naming `database/<ns>` paths a scaffold
+    // lacks is what #6940 refuses.
     // forbidden_patterns — base floor first, then the selected modules' patterns.
     const extraForbidden = [];
     for (const s of slices)
         extraForbidden.push(...(s.forbiddenPatterns ?? []));
     const forbidden = mergeForbidden([...ARCHITECTURE_BASE.forbiddenPatterns], extraForbidden).map(scoped);
+    // The upgradeable-consumer rules (#9191): the workspaces this scaffold
+    // creates and the in-scope package names it gives them. The site lint
+    // reads this block to refuse a forked, patched or pinned-off package.
+    // A hub's `database/` is a plain folder, not a workspace (#9569): the
+    // package is an npm dependency the same-caret rule covers like any other.
+    const upgradeableConsumer = {
+        package_scope: PACKAGE_SCOPE,
+        workspaces: ["apps/*"],
+        // Every app the scaffold ships is named `@working-theory/<dir>`, except
+        // the two whose published package took the name: `@working-theory/api` is
+        // what the API app boots from (#9564), so the app is
+        // `@working-theory/app-api`; `@working-theory/admin` is what the Admin
+        // shell boots from (#9570), so the app is `@working-theory/admin-shell`.
+        scaffold_packages: Object.keys(apps)
+            .map((dir) => `${PACKAGE_SCOPE}${SHELL_PACKAGE_NAME[dir] ?? dir}`)
+            .sort(),
+    };
+    // The customizations manifest (#9223): the files under `apps/` the template
+    // record (`.ailk-template-files.json`) cannot see, so the site lint can tell
+    // a site-authored file from a scaffolded one by membership alone. (a) The
+    // generator outputs, on a hub and a spoke alike — an exempted path that is
+    // absent exempts nothing, and only a create-ailk generator writes each. The
+    // constants are composed here, never at module top level: `spoke-checkout`
+    // imports this module back, and `template-record`'s own list is deliberately
+    // not imported (it reads `spoke-checkout` at top level). (b) Each selected
+    // module's bundle-delivered and patched app files, scoped to the apps this
+    // derivation declares. (c) A commerce spoke's checkout slice, which
+    // `add-module` writes with no record row.
+    const generatorPaths = [
+        NAV_CONFIG_PATH,
+        SITE_CHROME_PATH,
+        SITE_FONTS_PATH,
+        PAID_SECTIONS_PATH,
+        MODULE_FLAGS_PATH,
+        PAID_MCP_TOOLS_PATH,
+        ...SPOKE_SEAM_FILES,
+        SPOKE_CHECKOUT_CONFIG_PATH,
+        SPOKE_BILLING_ACTION_PATH,
+    ];
+    const modulePaths = [];
+    for (const s of slices) {
+        modulePaths.push(...(s.ownedFiles ?? []));
+        modulePaths.push(...Object.values(s.installMap ?? {}));
+        if (s.installRoot)
+            modulePaths.push(`${s.installRoot.replace(/\/$/, "")}/**`);
+        modulePaths.push(...(s.patches ?? []).map((p) => p.target));
+    }
+    const checkoutPaths = spoke && selected.includes("commerce")
+        ? SPOKE_CHECKOUT_TEMPLATE_PATHS.map((p) => (/\.[^/]+$/.test(p) ? p : `${p}/**`))
+        : [];
+    const customizations = {
+        manifest: "customizations.yaml",
+        scaffold_paths: sortedUnion(generatorPaths, [...modulePaths, ...checkoutPaths].filter((p) => p.startsWith("apps/") && inScaffold(p))),
+    };
     const doc = {
         version: ARCHITECTURE_BASE.version,
         ...(spoke ? { topology: "spoke" } : {}),
@@ -328,8 +380,9 @@ export function deriveArchitecture(modules = ["marketing"], surfaces, options =
             available: [...RECOGNIZED_SURFACES],
         },
         apps,
-        ...(nsSlice ? { namespaces: namespacesToYaml(nsSlice) } : {}),
         forbidden_patterns: forbidden.map(forbiddenToYaml),
+        upgradeable_consumer: upgradeableConsumer,
+        customizations,
     };
     const header = [
         "# Architecture Boundaries — AI Launch Kit site",

package/dist/lib/design-checks.d.ts

@@ -79,13 +79,18 @@ export interface MeasureApplyDesignDriftOptions {
     workDir: string;
     /** The loopback registry the CLI resolves modules and templates from. */
     registryUrl?: string;
-    /** Written to the site's own `ailk.key`, which `apply-design` gates a non-Free design on. */
+    /**
+     * Scaffolds with `--license <key>` (#9650: a keyless run refuses while Free
+     * is held), which writes the site's own `ailk.key` — what `apply-design`
+     * gates a non-Free design on.
+     */
     licenseKey?: string;
 }
 /**
- * Scaffold a keyless `organization-product` site on `standard`, compose its
- * JSON-LD, run `apply-design <design>` on it, and compose again. A non-zero
- * exit at any step throws naming the step and the child's stderr.
+ * Scaffold an `organization-product` site on `standard` — keyed when
+ * `licenseKey` is given — compose its JSON-LD, run `apply-design <design>` on
+ * it, and compose again. A non-zero exit at any step throws naming the step
+ * and the child's stderr.
  */
 export declare function measureApplyDesignDrift(opts: MeasureApplyDesignDriftOptions): {
     before: ComposedPages;

package/dist/lib/design-checks.js

@@ -25,7 +25,6 @@
  * (#8661 D11); `admitSeededContactPage` admits only those two fields.
  */
 import { execFileSync } from "node:child_process";
-import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { CONTACT_PAGE_PATH } from "../design-home.js";
@@ -189,9 +188,10 @@ export function assessJsonLdDrift(design, before, after) {
     };
 }
 /**
- * Scaffold a keyless `organization-product` site on `standard`, compose its
- * JSON-LD, run `apply-design <design>` on it, and compose again. A non-zero
- * exit at any step throws naming the step and the child's stderr.
+ * Scaffold an `organization-product` site on `standard` — keyed when
+ * `licenseKey` is given — compose its JSON-LD, run `apply-design <design>` on
+ * it, and compose again. A non-zero exit at any step throws naming the step
+ * and the child's stderr.
  */
 export function measureApplyDesignDrift(opts) {
     const baseEnv = { ...process.env };
@@ -223,9 +223,15 @@ export function measureApplyDesignDrift(opts) {
             throw new Error(`drift: ${label} printed no JSON: ${err.message}`, { cause: err });
         }
     };
-    exec("scaffold organization-product on standard", process.execPath, [opts.cliPath, site, "--shape", "organization-product", "--design", "standard"], registryEnv);
-    if (opts.licenseKey !== undefined)
-        writeFileSync(join(site, "ailk.key"), `${opts.licenseKey}\n`);
+    exec("scaffold organization-product on standard", process.execPath, [
+        opts.cliPath,
+        site,
+        "--shape",
+        "organization-product",
+        "--design",
+        "standard",
+        ...(opts.licenseKey === undefined ? [] : ["--license", opts.licenseKey]),
+    ], registryEnv);
     const before = compose("compose JSON-LD before apply-design");
     const applyStdout = exec(`apply-design ${opts.design}`, process.execPath, [opts.cliPath, "apply-design", opts.design, "--target", site], opts.registryUrl === undefined ? {} : { AILK_MODULE_REGISTRY_URL: opts.registryUrl });
     const after = compose("compose JSON-LD after apply-design");

package/dist/lib/extract-module-bundle.js

@@ -23,8 +23,8 @@
  * `extractBundle` extracts into an EMPTY staging dir that then swap-renames
  * over the (possibly pre-existing) install target — appropriate for a single
  * self-contained skill directory. A fetched module's files are scattered
- * across an ALREADY-SCAFFOLDED tree (`apps/api/src/routes/...`,
- * `apps/web/app/...`), so there is no single directory to rename over.
+ * across an ALREADY-SCAFFOLDED tree (`apps/web/app/...`,
+ * `apps/web/lib/...`), so there is no single directory to rename over.
  * `extractModuleBundle` therefore extracts into a throwaway temp dir first
  * (same validation, same guards), and ONLY on full success copies each
  * validated file into its place under `targetDir` — so a rejected or
@@ -386,6 +386,26 @@ function validateLayerOwnership(destinations, ownership, subject, isTemplate, pa
     }
 }
 /** Every regular file under `srcRoot`, as a `/`-separated relative path. */
+const API_SOURCE_ROOT = "apps/api/";
+/**
+ * #9565 D6 — refuse a tree that would write under `apps/api/`, naming the
+ * path. Checked BEFORE any write, beside `validateInstallMap` and
+ * `validatePatches`.
+ */
+function refuseApiSource(sourceRoot, installMap, patches, subject) {
+    const toPosixRel = (p) => normalize(p).split(sep).join("/").replace(/^\.\//, "");
+    // Compared lower-cased: on a case-insensitive filesystem `Apps/API/...` lands
+    // in the same tree.
+    const underApi = (rel) => rel.toLowerCase().startsWith(API_SOURCE_ROOT);
+    const offenders = [
+        ...stagedFiles(sourceRoot).filter(underApi),
+        ...Object.values(installMap).map(toPosixRel).filter(underApi),
+        ...patches.map((patch) => toPosixRel(patch.target)).filter(underApi),
+    ];
+    if (offenders.length > 0) {
+        throw new Error(`${subject}: refuses to write ${offenders[0]} — API source ships in its @working-theory/api-<module> package, never in a bundle (#9565)`);
+    }
+}
 function stagedFiles(srcRoot) {
     const out = [];
     const stack = [srcRoot];
@@ -545,6 +565,13 @@ export function installBundleTree(options) {
     // Every declared patch is validated, skipped or not (#7426 D4), exactly as
     // the installMap is above; only then are the skipped ones dropped.
     validatePatches(declaredPatches, targetAbs, subject);
+    // #9565 D6 — no bundle writes under apps/api/: a module's API source is its
+    // `@working-theory/api-<module>` package, installed from npm, never a copy
+    // in the site's tree. A staged file, a (remapped) installMap destination or
+    // a patch target under apps/api/ refuses the whole tree at this same
+    // fail-closed point, for module and template trees alike — which is what
+    // holds for a bundle built before this change and still at the store.
+    refuseApiSource(sourceRoot, remappedInstallMap, declaredPatches, subject);
     const patches = declaredPatches.filter((patch) => !isSkipped(patch.target));
     options.checkPatches?.(patches);
     // The exclusion set copyTree/the content-only guard both use — built from

package/dist/lib/fetch-template-snapshot.d.ts

@@ -12,7 +12,7 @@ export interface FetchTemplateSnapshotOptions {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree from its published npm tarball.
+ * tree, plus its `templates/database/` boot files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/fetch-template-snapshot.js

@@ -21,6 +21,7 @@ import { createHash } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 import * as tar from "tar";
 import { templateDestination } from "../copy.js";
+import { DATABASE_BOOT_FILES } from "../template-record.js";
 import { MAX_TOTAL_SIZE_BYTES } from "./extract-module-bundle.js";
 import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
 export const DEFAULT_AILK_NPM_REGISTRY_URL = "https://registry.npmjs.org";
@@ -29,6 +30,8 @@ const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
 /** The one tar path prefix a snapshot is read from, and the three app roots inside it. */
 const TAR_ROOT = "package/templates/";
 const APP_PREFIXES = ["apps/web/", "apps/api/", "apps/mcp/"];
+/** The paths outside the app roots a snapshot keeps: a hub's three database boot files (#9569 DD8). */
+const BOOT_FILES = new Set(DATABASE_BOOT_FILES);
 export class FetchTemplateSnapshotError extends Error {
     constructor(message) {
         super(message);
@@ -110,13 +113,14 @@ async function fetchTarball(tarballUrl, integrity, version, fetchImpl) {
     }
     return buf;
 }
-/** The app-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees. */
+/** The template-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees and the database boot files. */
 function appRelativePath(tarPath) {
     if (!tarPath.startsWith(TAR_ROOT))
         return undefined;
     const rel = tarPath.slice(TAR_ROOT.length);
-    if (!APP_PREFIXES.some((prefix) => rel.startsWith(prefix)))
+    if (!APP_PREFIXES.some((prefix) => rel.startsWith(prefix)) && !BOOT_FILES.has(rel)) {
         return undefined;
+    }
     if (rel.length === 0)
         return undefined;
     const segments = rel.split("/");
@@ -176,7 +180,7 @@ function parseSnapshot(gunzipped, version) {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree from its published npm tarball.
+ * tree, plus its `templates/database/` boot files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/import-graph.d.ts

@@ -16,7 +16,7 @@ export declare function resolveRelativeImport(fromFile: string, spec: string, ca
  * This is the shape both consumers need, and the reason the walk is shared
  * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
  * paid module's `ownedFiles` to get the files a keyless starter must not
- * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * carry; the retired slice-registration lint seeded it with the same set to
  * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
  *
  * Never a filename-stem rule (#5182 D7), which misses eleven files and

package/dist/lib/import-graph.js

@@ -8,9 +8,9 @@
  * - `paidModuleTemplateExclusions()` (module-architecture.ts) walks it to take
  *   the companion closure of every paid module's `ownedFiles` — the files that
  *   would ship dangling into a keyless starter.
- * - `tools/lint-slice-registration.ts` walks it to close over the specifiers an
- *   `isModuleEnabled("X")` branch in `apps/api/src/server.ts` loads, and to
- *   check every reached file against what module X's slice delivers.
+ * - the slice-registration lint walked it (#5701, retired by #9565 D8 once
+ *   no bundle delivered an API file) to close over the specifiers a module
+ *   gate loaded and check each against what the slice delivered.
  *
  * Both questions are "which files does this one reach through relative
  * imports", and the answer must be the same function in both mouths: a lint
@@ -105,7 +105,7 @@ function posixJoin(dir, spec) {
  * This is the shape both consumers need, and the reason the walk is shared
  * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
  * paid module's `ownedFiles` to get the files a keyless starter must not
- * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * carry; the retired slice-registration lint seeded it with the same set to
  * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
  *
  * Never a filename-stem rule (#5182 D7), which misses eleven files and

package/dist/lib/module-license-gate.d.ts

@@ -17,7 +17,7 @@ export declare class LicenseRequiredError extends Error {
 }
 /** The five axes `release-scope.json` declares (spec 6977 D3). */
 export type ReleaseAxis = "templates" | "shapes" | "designs" | "modules" | "levels";
-/** `gated` and `deferred` are both refused; only a `gated` one gets negative checks. */
+/** `gated` and `deferred` are both refused; only a `gated` one gets negative checks (the Free level excepted, #6484). */
 export type ReleaseStatus = "released" | "gated" | "deferred";
 export type ReleaseScope = Readonly<Record<ReleaseAxis, Readonly<Record<string, ReleaseStatus>>>>;
 /**
@@ -44,6 +44,17 @@ export declare class ReleaseScopeError extends Error {
  * gated module.
  */
 export declare function assertReleased(axis: ReleaseAxis, names: readonly (string | undefined)[], scope?: ReleaseScope): void;
+/**
+ * A run with no key is a Free run, and `release-scope.json` says whether Free
+ * is available (#6484, REL-034.1: deferred — held). Refused before any prompt,
+ * fetch or write, with the level gate's message naming the pricing page; zero
+ * network. A keyed run passes through untouched — its level is the registry's
+ * answer (`deriveLevel`), never decided here. Called by `cli.ts` ahead of the
+ * shape prompt, and by `resolvePaidModules` for an all-Free request — the
+ * seam every `scaffold()` branch crosses (alias, keep and default alike),
+ * after the scope-name refusals and before the first write.
+ */
+export declare function assertKeyedOrFreeReleased(licenseKey?: string | undefined): void;
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by

package/dist/lib/module-license-gate.js

@@ -12,10 +12,11 @@
  *   (c) a valid key → every requested paid module's bundle bytes, ready for
  *       `extract-module-bundle.ts` to merge into the scaffold.
  *
- * A Free-only request (no paid modules) never reaches the key check at all —
- * `resolvePaidModules` returns immediately, before touching `process.env` or
- * the network, so a bare/all-Free scaffold is provably unaffected by this
- * gate (K1's regression floor).
+ * A Free-only request (no paid modules) never reaches the network — but since
+ * #6484 (REL-034.1) it does read the key: no key is the Free level, which
+ * `release-scope.json` defers, so `resolvePaidModules` refuses it through
+ * `assertKeyedOrFreeReleased` before returning its empty map. A keyed
+ * all-Free scaffold is unaffected (K1's regression floor, keyed).
  *
  * Also carries the design gate (#6760): `assertDesignAllowed` refuses a
  * non-`standard` design at the `free` level, naming the design and the
@@ -107,14 +108,32 @@ export function assertReleased(axis, names, scope = RELEASE_SCOPE) {
             continue;
         const released = Object.keys(statuses).filter((n) => statuses[n] === "released");
         // A level comes from the key, never a flag — so it points at what the run CAN choose.
-        const choose = axis === "levels"
-            ? `Your licence key's level is ${name}; name the modules you want with --modules (one of: ${Object.keys(scope.modules)
-                .filter((m) => scope.modules[m] === "released")
-                .join(", ")}).`
-            : `Choose one of: ${released.join(", ")}.`;
+        // `free` is the keyless level (#6484): it points at the pricing page.
+        const choose = axis === "levels" && name === "free"
+            ? `No licence key, so this would be a Free scaffold — pass --license <key> or set AILK_LICENSE_KEY with a Pro key → ${CONVERSION_HINT_URL}`
+            : axis === "levels"
+                ? `Your licence key's level is ${name}; name the modules you want with --modules (one of: ${Object.keys(scope.modules)
+                    .filter((m) => scope.modules[m] === "released")
+                    .join(", ")}).`
+                : `Choose one of: ${released.join(", ")}.`;
         throw new ReleaseScopeError(`${AXIS_NOUN[axis]} "${name}" is not available yet. ${choose}`);
     }
 }
+/**
+ * A run with no key is a Free run, and `release-scope.json` says whether Free
+ * is available (#6484, REL-034.1: deferred — held). Refused before any prompt,
+ * fetch or write, with the level gate's message naming the pricing page; zero
+ * network. A keyed run passes through untouched — its level is the registry's
+ * answer (`deriveLevel`), never decided here. Called by `cli.ts` ahead of the
+ * shape prompt, and by `resolvePaidModules` for an all-Free request — the
+ * seam every `scaffold()` branch crosses (alias, keep and default alike),
+ * after the scope-name refusals and before the first write.
+ */
+export function assertKeyedOrFreeReleased(licenseKey = process.env["AILK_LICENSE_KEY"]) {
+    if (licenseKey === undefined || licenseKey.length === 0) {
+        assertReleased("levels", ["free"]);
+    }
+}
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by
@@ -182,12 +201,15 @@ function licenseErrorMessage(err, moduleName, templateName, level) {
  */
 export async function resolvePaidModules(options) {
     const { paidModules } = options;
+    const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (paidModules.length === 0) {
-        // Regression floor: zero key reads, zero network, for any request that
-        // names no paid module.
+        // Zero network for any request that names no paid module — but no
+        // longer zero key reads (#6484): a keyless all-Free request is the Free
+        // level, which `release-scope.json` holds, and is refused here, after
+        // `scaffold()`'s scope-name refusals and before its first write.
+        assertKeyedOrFreeReleased(token);
         return new Map();
     }
-    const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (token === undefined || token.length === 0) {
         throw new LicenseRequiredError(noKeyMessage(paidModules, options.templateName));
     }

package/dist/lib/scaffold-render-sweep.d.ts

@@ -21,6 +21,39 @@ export declare const MAX_REDIRECTS = 5;
  * so each entry must answer exactly 404. A 200 means the gate stopped gating.
  */
 export declare const CLAIM_GATED_ROUTES: Readonly<Record<string, string>>;
+/**
+ * Routes whose answer depends on whether the site has a hub to ask (#9423),
+ * and the flow each one sells. With no API origin configured the flow read
+ * is `not-configured` and the route must answer exactly 404 — the no-hub
+ * 404 where the module that owns it is installed, Next's own 404 where it
+ * is not. With one configured it must render its own content.
+ */
+export declare const HUB_GATED_ROUTES: Readonly<Record<string, string>>;
+/**
+ * The API origin names `apps/web` reads, in step with `apiOriginConfigured()`
+ * in `apps/web/app/[locale]/flows/[slug]/magnet-page.tsx`.
+ */
+export declare const HUB_ORIGIN_ENV_NAMES: readonly ["AILK_API_URL", "NEXT_PUBLIC_AILK_API_URL", "NEXT_PUBLIC_API_URL"];
+/**
+ * Whether a served `apps/web` has an API origin: a non-empty value for one
+ * of `HUB_ORIGIN_ENV_NAMES` in the serve environment or assigned in one of
+ * the env files Next loads (`envFileTexts`).
+ */
+export declare function hubOriginConfigured(env: Readonly<Record<string, string | undefined>>, envFileTexts: string[]): boolean;
+/**
+ * A `HUB_GATED_ROUTES` entry. Hub configured: the page must render its own
+ * content (`assessPageRender`). No hub: exactly 404 with no redirect — a 200
+ * means the no-hub branch stopped running.
+ */
+export declare function assessHubGatedRoute(input: {
+    route: string;
+    hubConfigured: boolean;
+    hops: RedirectHop[];
+    status: number | null;
+    contentType: string | null;
+    html: string;
+    locale: string;
+}): SweepVerdict;
 /**
  * A route whose live page needs an env var the driver never sets (#6146).
  * While it is unset the route serves its Free placeholder seed instead

package/dist/lib/scaffold-render-sweep.js

@@ -37,6 +37,51 @@ export const CLAIM_GATED_ROUTES = {
     "/purchase/success": "commerce",
     "/purchase/cancel": "commerce",
 };
+/**
+ * Routes whose answer depends on whether the site has a hub to ask (#9423),
+ * and the flow each one sells. With no API origin configured the flow read
+ * is `not-configured` and the route must answer exactly 404 — the no-hub
+ * 404 where the module that owns it is installed, Next's own 404 where it
+ * is not. With one configured it must render its own content.
+ */
+export const HUB_GATED_ROUTES = {
+    "/trial": "trial",
+};
+/**
+ * The API origin names `apps/web` reads, in step with `apiOriginConfigured()`
+ * in `apps/web/app/[locale]/flows/[slug]/magnet-page.tsx`.
+ */
+export const HUB_ORIGIN_ENV_NAMES = ["AILK_API_URL", "NEXT_PUBLIC_AILK_API_URL", "NEXT_PUBLIC_API_URL"];
+/**
+ * Whether a served `apps/web` has an API origin: a non-empty value for one
+ * of `HUB_ORIGIN_ENV_NAMES` in the serve environment or assigned in one of
+ * the env files Next loads (`envFileTexts`).
+ */
+export function hubOriginConfigured(env, envFileTexts) {
+    if (HUB_ORIGIN_ENV_NAMES.some((name) => Boolean(env[name])))
+        return true;
+    return envFileTexts.some((text) => HUB_ORIGIN_ENV_NAMES.some((name) => new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*["']?[^\\s"'#]`, "m").test(text)));
+}
+/**
+ * A `HUB_GATED_ROUTES` entry. Hub configured: the page must render its own
+ * content (`assessPageRender`). No hub: exactly 404 with no redirect — a 200
+ * means the no-hub branch stopped running.
+ */
+export function assessHubGatedRoute(input) {
+    const { route, hubConfigured, hops, status, contentType, html, locale } = input;
+    const flow = HUB_GATED_ROUTES[route];
+    if (hubConfigured) {
+        const rendered = assessPageRender({ route, hops, status, contentType, html, locale });
+        return { ok: rendered.ok, reason: `${rendered.reason} (hub-gated: ${flow}, hub configured)` };
+    }
+    if (hops.length > 0 || status !== 404) {
+        const first = hops[0];
+        const seen = first ? `${first.status} redirect` : `status ${status}`;
+        const why = status === 200 ? "rendered with no hub to ask" : `expected 404, got ${seen}`;
+        return { ok: false, reason: `${route} -> ${why} (hub-gated: ${flow}, no hub)` };
+    }
+    return { ok: true, reason: `404 (hub-gated: ${flow}, no hub)` };
+}
 /**
  * A route whose live page needs an env var the driver never sets (#6146).
  * While it is unset the route serves its Free placeholder seed instead

package/dist/module-architecture.d.ts

@@ -100,6 +100,15 @@ export interface ModuleSlice {
      * otherwise. Only a module with a BASE-tree consumer sets it.
      */
     paidSectionsPackage?: string;
+    /**
+     * The paid MCP tool packages base code loads through
+     * `apps/mcp/src/lib/paid-tools.generated.ts` (#9460 DD6). Each is one row
+     * in the generated registry: a bundled `import()` when the scaffold's
+     * `apps/mcp/package.json` declares the package, absent otherwise. A
+     * package two modules deliver (`mcp-workspace`) is listed by each and
+     * rendered once.
+     */
+    paidMcpToolPackages?: string[];
     /** Packages this module adds to apps/web.may_import_from (its presentation surface). */
     webImports?: string[];
     /** Apps this module declares (api, mcp replace the base block; admin is new). web is BASE, never here. */
@@ -124,7 +133,7 @@ export interface ModuleSlice {
      * *scaffolded customer site's* `architecture.yaml` — "apps/web MAY import
      * packages/fumadocs-schema." `ownedFiles` instead names, one literal path at
      * a time, which files in *this* monorepo physically belong to the module —
-     * "apps/api/src/routes/schedule/index.ts IS the scheduling module." A
+     * "packages-paid/api-scheduling/src/routes/schedule/index.ts IS the scheduling module." A
      * package can appear in one view and not the other: `packages/fumadocs-schema`
      * is a `webImports` entry (a permission — a docs scaffold installs it) but
      * NOT an `ownedFiles` entry (it is `oss`-tiered; the strip keeps it).
@@ -154,7 +163,7 @@ export interface ModuleSlice {
      *     `RECOGNIZED_MODULES`, so adding a `content-write` key would make
      *     `create-ailk --modules content-write` a valid scaffold selection. It is
      *     not one — content-write is a licence-tier line drawn inside a single
-     *     app, never a customer opt-in (see `apps/api/src/config/modules.ts`).
+     *     app, never a customer opt-in (see `packages/api/src/config/modules.ts`).
      *   - Two are this-list-only and the manifest simply never recorded them:
      *     `apps/web/app/[locale]/docs/[[...slug]]/page.tsx` and
      *     `apps/web/app/[locale]/meet/confirmed/page.tsx`.
@@ -164,6 +173,14 @@ export interface ModuleSlice {
      * are derived from the import graph — a test or story file carries
      * `oss: false` iff it imports a slice file — never from filename stems,
      * which miss eleven and over-mark three.
+     *
+     * Since REL-034.4 (#9565 D6) no entry names an `apps/api/` path: a module's
+     * API source is its `@working-theory/api-<module>` package under
+     * `packages-paid/`, dropped from the public tree wholesale and reached by a
+     * keyed scaffold through npm, never through a bundle. The producer
+     * (`scripts/build-module-bundles.mjs` `stageModule`) refuses to stage, and
+     * the extractor (`lib/extract-module-bundle.ts` `installBundleTree`) refuses
+     * to install, any path under `apps/api/`.
      */
     ownedFiles?: string[];
     /**
@@ -349,7 +366,7 @@ export declare const ARCHITECTURE_BASE: {
     readonly version: 1;
     readonly composition_model: {
         readonly tiers: {
-            readonly data: "database/ — Prisma schema + migrations";
+            readonly data: "database/ — Prisma config + seed; schema and migrations ship in @working-theory/database";
             readonly api: "apps/api (public HTTP API) + apps/mcp (agent tools)";
             readonly presentation: "apps/web — frontend surfaces";
         };