create-ailk 0.23.0 → 0.25.1

package/dist/paid-sections.d.ts

@@ -2,6 +2,8 @@
 export declare const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
 /** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
 export declare const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
+/** Scaffold-relative path of the generated paid MCP tool registry (#9460 DD6). */
+export declare const PAID_MCP_TOOLS_PATH = "apps/mcp/src/lib/paid-tools.generated.ts";
 export interface PaidSectionRow {
     module: string;
     package: string;
@@ -33,9 +35,31 @@ export declare function renderModuleFlags(flags: {
  * `undefined` (writing nothing) for a scaffold with no web app.
  */
 export declare function writeModuleFlags(targetDir: string): "added" | "updated" | "unchanged" | undefined;
+/**
+ * The paid MCP tool packages, one row each (#9460 DD6): every slice's
+ * `paidMcpToolPackages` in `RECOGNIZED_MODULES` order, then first
+ * appearance, so a package two modules deliver is one row.
+ */
+export declare function paidMcpToolRows(): string[];
+/**
+ * Render the MCP registry: one `() => import("<package>")` per carried
+ * package, `[]` when none is carried. Line 1 is `// oss: false` exactly when
+ * a row is present — #7536's rule, so the public strip drops the file.
+ */
+export declare function renderPaidMcpTools(present: ReadonlySet<string>): string;
+/**
+ * Write the MCP registry into a scaffold from its own `apps/mcp/package.json`
+ * `dependencies` (#9460 DD6), creating `apps/mcp/src/lib/` if need be.
+ * Answers whether the file was `added`, `updated` (changed bytes) or
+ * `unchanged`, or `undefined` (writing nothing) when that package.json is
+ * absent — a `--without-mcp` spoke — the `writeModuleFlags` shape, so
+ * `create-ailk update` reports it the same way (#9567).
+ */
+export declare function writePaidMcpTools(targetDir: string): "added" | "updated" | "unchanged" | undefined;
 /**
  * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`, and the module-presence flags beside it.
+ * own `apps/web/package.json`, and the module-presence flags beside it,
+ * then the MCP registry from `apps/mcp/package.json` (#9460 DD6).
  * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
  * absent — a scaffold with no web app.
  */

package/dist/paid-sections.js

@@ -23,14 +23,16 @@
  * file, importing nothing, because the registry's `import()`s would pull UI
  * packages into any edge code that reads the flag.
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { MODULE_SLICES } from "./module-architecture.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
 /** Scaffold-relative path of the generated registry. */
 export const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
 /** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
 export const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
+/** Scaffold-relative path of the generated paid MCP tool registry (#9460 DD6). */
+export const PAID_MCP_TOOLS_PATH = "apps/mcp/src/lib/paid-tools.generated.ts";
 /** The dependency whose presence means the scheduling module's pages exist. */
 const SCHEDULING_PAGES_PACKAGE = "@working-theory/ui-scheduling";
 function pascalCase(shortName) {
@@ -162,9 +164,91 @@ export function writeModuleFlags(targetDir) {
     writeFileSync(path, next);
     return before === undefined ? "added" : "updated";
 }
+/**
+ * The paid MCP tool packages, one row each (#9460 DD6): every slice's
+ * `paidMcpToolPackages` in `RECOGNIZED_MODULES` order, then first
+ * appearance, so a package two modules deliver is one row.
+ */
+export function paidMcpToolRows() {
+    const rows = [];
+    for (const name of RECOGNIZED_MODULES) {
+        for (const pkg of MODULE_SLICES[name].paidMcpToolPackages ?? []) {
+            if (!rows.includes(pkg))
+                rows.push(pkg);
+        }
+    }
+    return rows;
+}
+const PAID_MCP_TOOLS_HEADER = `// paid-tools.generated.ts — the paid MCP tool packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (\`paidMcpToolPackages\`) and
+// this app's package.json dependencies (#9460). Do not edit: every scaffold
+// and \`create-ailk add-module\` rewrites it. A carried package is a bundled
+// dynamic import the server resolves its paid tools from at call time; a
+// site that carries none exports an empty list.
+`;
+/**
+ * Render the MCP registry: one `() => import("<package>")` per carried
+ * package, `[]` when none is carried. Line 1 is `// oss: false` exactly when
+ * a row is present — #7536's rule, so the public strip drops the file.
+ */
+export function renderPaidMcpTools(present) {
+    // Spelled through a constant, not a `from "…"` literal: create-ailk's own
+    // dist must carry no `@working-theory/*` import text (#8412), while the
+    // scaffold's generated registry still imports the type (#9460 DD6).
+    const MCP_SERVER_PACKAGE = "@working-theory/mcp-server";
+    const rows = paidMcpToolRows().filter((pkg) => present.has(pkg));
+    const lines = [];
+    if (rows.length > 0)
+        lines.push("// oss: false");
+    lines.push(PAID_MCP_TOOLS_HEADER.trimEnd());
+    lines.push(`import type { McpToolPackLoader } from ${JSON.stringify(MCP_SERVER_PACKAGE)};`);
+    lines.push("");
+    if (rows.length === 0) {
+        lines.push("export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [];");
+    }
+    else {
+        lines.push("export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [");
+        for (const pkg of rows)
+            lines.push(`  () => import("${pkg}"),`);
+        lines.push("];");
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Write the MCP registry into a scaffold from its own `apps/mcp/package.json`
+ * `dependencies` (#9460 DD6), creating `apps/mcp/src/lib/` if need be.
+ * Answers whether the file was `added`, `updated` (changed bytes) or
+ * `unchanged`, or `undefined` (writing nothing) when that package.json is
+ * absent — a `--without-mcp` spoke — the `writeModuleFlags` shape, so
+ * `create-ailk update` reports it the same way (#9567).
+ */
+export function writePaidMcpTools(targetDir) {
+    const pkgPath = join(targetDir, "apps/mcp/package.json");
+    if (!existsSync(pkgPath))
+        return undefined;
+    let pkg;
+    try {
+        pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    }
+    catch (err) {
+        throw new Error(`cannot read ${pkgPath} to write the paid MCP tool registry: ${err.message}`, { cause: err });
+    }
+    const deps = pkg.dependencies ?? {};
+    const present = new Set(paidMcpToolRows().filter((name) => Object.hasOwn(deps, name)));
+    const path = join(targetDir, PAID_MCP_TOOLS_PATH);
+    const before = existsSync(path) ? readFileSync(path, "utf8") : undefined;
+    const next = renderPaidMcpTools(present);
+    if (before === next)
+        return "unchanged";
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, next);
+    return before === undefined ? "added" : "updated";
+}
 /**
  * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`, and the module-presence flags beside it.
+ * own `apps/web/package.json`, and the module-presence flags beside it,
+ * then the MCP registry from `apps/mcp/package.json` (#9460 DD6).
  * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
  * absent — a scaffold with no web app.
  */
@@ -177,5 +261,6 @@ export function writePaidSections(targetDir) {
         .filter((name) => Object.hasOwn(deps, name)));
     writeFileSync(join(targetDir, PAID_SECTIONS_PATH), renderPaidSections(present));
     writeModuleFlags(targetDir);
+    writePaidMcpTools(targetDir);
     return true;
 }

package/dist/surfaces.js

@@ -713,7 +713,7 @@ export const ROUTE_SINCE = {
     // is one too. Whether it shows a ROW is a separate question with two
     // deployment preconditions (a resolvable workspace, and a `siteId` that
     // equals a workspace id); both fail empty, never wide. See
-    // `apps/api/src/services/leads-inbox.ts` § "What it takes for this to
+    // `packages/api/src/services/leads-inbox.ts` § "What it takes for this to
     // return anything".
     "(authed)/leads": "0.24.0",
     // #5371 — the workspace module's three settings routes. Genuinely new route
@@ -1065,7 +1065,15 @@ export const ROUTE_DEPENDENCIES = {
     "meet/[slug]": ["apps/web/lib/meetings.tsx"],
     private: ["apps/web/lib/meetings.tsx", `${ROUTE_ROOT}/meet/meeting-index.tsx`],
     // #8927 D8 — /pricing maps the Offerings shown set through the mapper.
-    pricing: ["apps/web/lib/offerings-pricing.ts"],
+    // #9480 — and reads its browser-facing API origin through the topology seam
+    // (#7874 D12), so a spoke with /pricing reads no refused name. Every
+    // scaffold since #7874 already carries its own render of the seam, and a
+    // dependency copy never overwrites, so this entry admits the import; it
+    // never replaces a spoke's render with the template's hub one.
+    pricing: [
+        "apps/web/lib/offerings-pricing.ts",
+        "apps/web/lib/api-origin.generated.ts",
+    ],
 };
 /**
  * i18n message namespaces (dot-path into `apps/web/messages/<locale>.json`) a

package/dist/sync-routes.d.ts

@@ -49,12 +49,23 @@ export interface SyncRoutesResult {
     missing: RouteReport[];
     /** Route dirs present but with a direct file absent or changed, sorted. */
     modified: RouteReport[];
-    /** Route dirs copied this run (the missing list when applying, else empty). */
+    /** Route dirs copied this run (the missing list minus `refused` when applying, else empty). */
     applied: string[];
     /**
-     * `ROUTE_DEPENDENCIES` files, of any route in `missing`, absent from the
-     * target — copied when `apply` is set (never overwriting), else reported
-     * only. Sorted, deduplicated.
+     * Missing routes `--apply` does not write because an import does not
+     * resolve (#9406 DD4) — reported in check mode too. Sorted.
+     */
+    refused: string[];
+    /**
+     * Per missing route, the local modules its files import (#9406 DD5): one
+     * entry per route with any non-empty list, sorted by route.
+     */
+    routeImports: RouteImportReport[];
+    /**
+     * Files, of any route in `missing` not `refused`, absent from the target:
+     * its `ROUTE_DEPENDENCIES` entries unioned with the `copies` its imports
+     * resolve to (#9406). Copied when `apply` is set (never overwriting), else
+     * reported only. Sorted, deduplicated.
      */
     missingDependencies: string[];
     /** Dependency files copied this run. Sorted. */
@@ -96,6 +107,21 @@ export interface RetiredCheckoutReport {
     /** Generated files rewritten (without `apply`: to rewrite) — the billing action. */
     rewritten: string[];
 }
+/** One missing route's site-local imports (#9406 DD5) — see `walkRouteImports`. */
+export interface RouteImportReport {
+    /** ROUTE_ROOT-relative, `/`-separated. */
+    route: string;
+    /** Template files the route reaches that the site lacks — copied with `--apply`. Sorted. */
+    copies: string[];
+    /** Files the route reaches that the site has, whose bytes differ from the template's — never written. Sorted. */
+    differs: string[];
+    /** Imports that resolve nowhere this sync can write; any entry refuses the route. Sorted by `from`, then `specifier`. */
+    unresolved: Array<{
+        specifier: string;
+        from: string;
+        reason: string;
+    }>;
+}
 /** One `NO_STRUCTURED_DATA_ROUTES` element: its source text, dedented, and the routes it exempts. */
 interface StructuredDataExemption {
     route: string;

package/dist/sync-routes.js

@@ -36,14 +36,13 @@
  */
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { basename, dirname, join, posix, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
-import { copyTemplate } from "./copy.js";
+import { copyTemplate, renderTemplateFile } from "./copy.js";
 import { SPOKE_BILLING_ACTION_PATH } from "./derive-architecture.js";
 import { appendEnvRows } from "./lib/declared-env.js";
 import { ENV_CATALOG } from "./lib/env-catalog.js";
 import { BILLING_ACTION, BILLING_ACTION_MARKER, RETIRED_CHECKOUT_E2E_MARKER, RETIRED_CHECKOUT_E2E_WORKFLOW_PATH, RETIRED_SPOKE_CHECKOUT_PATHS, } from "./spoke-checkout.js";
-import { substituteMarkers } from "./substitute.js";
 import { GATEABLE_SURFACES, NON_ROUTE_DIRS, ROUTE_DEPENDENCIES, ROUTE_MESSAGE_NAMESPACES, ROUTE_SINCE, surfaceForRouteDir, } from "./surfaces.js";
 import { TEMPLATE_RECORD_PATH, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
 import { SPOKE_SEAM_FILES, isSpokeExcluded, readSpokeShape, } from "./topology.js";
@@ -70,6 +69,171 @@ const NESTED_FOREIGN_MODULE_ENTRIES = new Set([
     "careers/apply",
     "careers/[slug]",
 ]);
+/** Extensions whose files are scanned for import specifiers (#9406 DD1). */
+const SOURCE_FILE = /\.(?:ts|tsx|js|jsx|mjs|mts)$/;
+/**
+ * Static import and re-export (`import … from`, `export … from`), side-effect
+ * (`import "…"`) and dynamic (`import("…")`) specifiers (#9406 DD1). Matched
+ * over the whole text: `[^'"]*?` spans newlines, so a multi-line
+ * `import {\n  a,\n} from "…"` is caught from its `import` line.
+ */
+const IMPORT_PATTERNS = [
+    /^\s*(?:import|export)\b[^'"]*?\bfrom\s*['"]([^'"]+)['"]/gm,
+    /^\s*import\s*['"]([^'"]+)['"]/gm,
+    /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g,
+];
+/** The site-local (`./`, `../`) import specifiers of a source text, deduplicated. */
+function relativeImportSpecifiers(text) {
+    const out = new Set();
+    for (const pattern of IMPORT_PATTERNS) {
+        for (const match of text.matchAll(pattern)) {
+            const specifier = match[1];
+            if (specifier !== undefined && (specifier.startsWith("./") || specifier.startsWith("../"))) {
+                out.add(specifier);
+            }
+        }
+    }
+    return [...out];
+}
+/**
+ * The scaffold-relative files `specifier`, imported from `importer`, may name —
+ * in #9406 DD2's probe order: a `.js`/`.jsx` specifier's `.ts`/`.tsx` spelling
+ * first, then the exact path, the extension probes and the directory index.
+ * Empty when the path climbs out of the scaffold root.
+ */
+function importCandidates(importer, specifier) {
+    const base = posix.normalize(posix.join(posix.dirname(importer), specifier));
+    if (base === ".." || base.startsWith("../"))
+        return [];
+    const out = [];
+    const js = /\.(jsx?)$/.exec(base);
+    if (js !== null) {
+        const stem = base.slice(0, -js[0].length);
+        if (js[1] === "js")
+            out.push(`${stem}.ts`);
+        out.push(`${stem}.tsx`);
+    }
+    out.push(base);
+    for (const ext of [".ts", ".tsx", ".js", ".jsx", ".mjs"])
+        out.push(base + ext);
+    out.push(`${base}/index.ts`, `${base}/index.tsx`);
+    return out;
+}
+/** Whether `root`/`rel` (`/`-separated) is an existing regular file. */
+function isRegularFile(root, rel) {
+    try {
+        return statSync(join(root, ...rel.split("/"))).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The deepest route in `missingRoutes` a scaffold-relative path sits under —
+ * the route whose own copy writes it — or undefined.
+ */
+function ownerRoute(path, missingRoutes) {
+    if (!path.startsWith(`${ROUTE_ROOT}/`))
+        return undefined;
+    const rel = path.slice(ROUTE_ROOT.length + 1);
+    let owner;
+    for (const m of missingRoutes) {
+        if (rel.startsWith(`${m}/`) && (owner === undefined || m.length > owner.length))
+            owner = m;
+    }
+    return owner;
+}
+/**
+ * Resolve the site-local imports of every file `route`'s own copy writes, and
+ * transitively of every helper that brings (#9406 DD1–DD3). Each import is
+ * resolved against the site first, then the template. A file the site has
+ * ends the walk there (the site owns its closure); a file another missing
+ * route's copy brings is recorded for DD4's propagation; a file only the
+ * template has is a copy — unless the spoke drops it or its surface is not
+ * carried, which refuses the route.
+ */
+function walkRouteImports(route, ctx) {
+    const inScratch = (path) => path.startsWith(`${ROUTE_ROOT}/`) ? path.slice(ROUTE_ROOT.length + 1) : undefined;
+    const templateHas = (path) => {
+        const rel = inScratch(path);
+        return rel !== undefined
+            ? isRegularFile(ctx.scratch, rel)
+            : isRegularFile(ctx.templatesDir, path);
+    };
+    // The bytes `copyTemplate` (a route file) or `copyDependencyFile` (any
+    // other) would write for `path`.
+    const templateBytes = (path) => {
+        const rel = inScratch(path);
+        if (rel !== undefined)
+            return readFileSync(join(ctx.scratch, ...rel.split("/")));
+        return Buffer.from(renderTemplateFile(readFileSync(join(ctx.templatesDir, ...path.split("/"))), path, ctx.versions, ctx.markers));
+    };
+    const copies = new Set();
+    const differs = new Set();
+    const unresolved = [];
+    const reached = [];
+    const queue = regularFilesUnder(ctx.scratch, route)
+        .map((rel) => `${ROUTE_ROOT}/${rel}`)
+        .filter((path) => ownerRoute(path, ctx.missingRoutes) === route);
+    const visited = new Set(queue);
+    for (let from = queue.shift(); from !== undefined; from = queue.shift()) {
+        if (!SOURCE_FILE.test(from))
+            continue;
+        const importer = from;
+        for (const specifier of relativeImportSpecifiers(templateBytes(importer).toString("utf8"))) {
+            const candidates = importCandidates(importer, specifier);
+            const inSite = candidates.find((c) => isRegularFile(ctx.targetAbs, c));
+            const path = inSite ?? candidates.find(templateHas);
+            if (path === undefined) {
+                unresolved.push({ specifier, from: importer, reason: "not in the template" });
+                continue;
+            }
+            const owner = ownerRoute(path, ctx.missingRoutes);
+            if (owner !== undefined) {
+                if (owner !== route)
+                    reached.push({ path, owner, specifier, from: importer });
+                continue;
+            }
+            if (inSite !== undefined) {
+                const siteBytes = readFileSync(join(ctx.targetAbs, ...path.split("/")));
+                if (templateHas(path) && !templateBytes(path).equals(siteBytes))
+                    differs.add(path);
+                continue;
+            }
+            if (ctx.spoke !== undefined && isSpokeExcluded(path, ctx.spoke)) {
+                unresolved.push({ specifier, from: importer, reason: "the spoke does not carry it" });
+                continue;
+            }
+            const routeRel = inScratch(path);
+            const surface = routeRel === undefined ? "core" : surfaceForRouteDir(routeRel);
+            if (surface === undefined || !ctx.carried.has(surface)) {
+                unresolved.push({
+                    specifier,
+                    from: importer,
+                    reason: `its surface (${surface ?? "none"}) is not carried by this site`,
+                });
+                continue;
+            }
+            copies.add(path);
+            if (!visited.has(path)) {
+                visited.add(path);
+                queue.push(path);
+            }
+        }
+    }
+    return {
+        route,
+        copies: [...copies].sort(),
+        differs: [...differs].sort(),
+        unresolved: sortUnresolved(unresolved),
+        reached,
+    };
+}
+/** `unresolved` rows sorted by `from`, then `specifier`. */
+function sortUnresolved(rows) {
+    const key = (row) => `${row.from}\u0000${row.specifier}`;
+    return [...rows].sort((a, b) => (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0));
+}
 /**
  * The elements of `source`'s `NO_STRUCTURED_DATA_ROUTES` array literal, by a
  * brace scan that skips string literals and comments. Empty when the
@@ -462,6 +626,7 @@ export function syncRoutes(opts) {
     const targetRouteRoot = join(targetAbs, ROUTE_ROOT);
     const missing = [];
     const modified = [];
+    let walks = [];
     const scratch = mkdtempSync(join(tmpdir(), "ailk-sync-routes-"));
     try {
         copyTemplate({
@@ -479,18 +644,73 @@ export function syncRoutes(opts) {
                 modified.push(report);
             }
         }
+        // #9406 — resolve each missing route's site-local imports while the
+        // scratch render is still on disk.
+        walks = missing.map((r) => walkRouteImports(r.route, {
+            scratch,
+            templatesDir: opts.templatesDir,
+            targetAbs,
+            missingRoutes: missing.map((m) => m.route),
+            versions: opts.versions,
+            markers,
+            spoke,
+            carried: new Set(["core", "authed", ...carried]),
+        }));
     }
     finally {
         rmSync(scratch, { recursive: true, force: true });
     }
+    // #9406 DD4 — a route refuses when an import resolves nowhere; refusal
+    // inherits to its sub-routes and to any route importing a file only a
+    // refused route's copy would write, iterated to a fixpoint. Never upward:
+    // an ancestor is still copied without the refused sub-tree.
+    const missingRoutes = missing.map((r) => r.route);
+    const refusedSet = new Set(walks.filter((w) => w.unresolved.length > 0).map((w) => w.route));
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const walk of walks) {
+            if (refusedSet.has(walk.route))
+                continue;
+            if (missingRoutes.some((a) => refusedSet.has(a) && walk.route.startsWith(`${a}/`))) {
+                refusedSet.add(walk.route);
+                changed = true;
+                continue;
+            }
+            const dangling = walk.reached.filter((r) => refusedSet.has(r.owner));
+            if (dangling.length > 0) {
+                walk.unresolved = sortUnresolved([
+                    ...walk.unresolved,
+                    ...dangling.map(({ path, owner, specifier, from }) => ({
+                        specifier,
+                        from,
+                        reason: `${path} is brought by ${owner}, which is refused`,
+                    })),
+                ]);
+                refusedSet.add(walk.route);
+                changed = true;
+            }
+        }
+    }
+    const refused = missingRoutes.filter((r) => refusedSet.has(r)).sort();
+    const routeImports = walks
+        .filter((w) => w.copies.length + w.differs.length + w.unresolved.length > 0)
+        .map(({ route, copies, differs, unresolved }) => ({ route, copies, differs, unresolved }))
+        .sort((a, b) => (a.route < b.route ? -1 : a.route > b.route ? 1 : 0));
     // #5014 third clause: a route's ROUTE_DEPENDENCIES files must exist in the
     // target too, or `--apply` leaves a route that cannot compile. Computed
     // from `missing` only — a route already present is assumed to already have
     // brought its own dependencies along (or the site owner has otherwise
     // satisfied them); re-checking every IN-SCOPE route's dependencies on every
     // run would report a pre-existing, unrelated gap as if this sync caused it.
+    // #9406 — unioned with the copies each route's imports resolve to, and
+    // never for a refused route: its helpers are neither required nor copied.
     const missingDependencies = [
-        ...new Set(missing.flatMap((r) => r.dependencies.filter((dep) => !existsSync(join(targetAbs, dep))))),
+        ...new Set(missing
+            .filter((r) => !refusedSet.has(r.route))
+            .flatMap((r) => [
+            ...r.dependencies.filter((dep) => !existsSync(join(targetAbs, dep))),
+            ...(walks.find((w) => w.route === r.route)?.copies ?? []),
+        ])),
     ].sort();
     const missingMessageNamespaces = [
         ...new Set(missing.flatMap((r) => r.messageNamespaces.filter((ns) => !hasMessageNamespace(targetAbs, ns)))),
@@ -498,11 +718,11 @@ export function syncRoutes(opts) {
     const applied = [];
     const appliedDependencies = [];
     if (opts.apply === true) {
-        const missingRoutes = missing.map((r) => r.route);
-        for (const route of missingRoutes) {
+        const writable = missingRoutes.filter((r) => !refusedSet.has(r));
+        for (const route of writable) {
             applied.push(route);
             // An ancestor route dir's subtree copy already brings this one.
-            if (missingRoutes.some((m) => route.startsWith(m + "/")))
+            if (writable.some((m) => route.startsWith(m + "/")))
                 continue;
             const dst = resolve(join(targetRouteRoot, route));
             if (!dst.startsWith(targetAbs + sep)) {
@@ -513,6 +733,10 @@ export function syncRoutes(opts) {
                 targetDir: dst,
                 versions: opts.versions,
                 markers,
+                // #9406 DD4 — hold back each refused sub-route from the ancestor's copy.
+                excludePaths: refused
+                    .filter((r) => r.startsWith(route + "/"))
+                    .map((r) => r.slice(route.length + 1)),
             });
         }
         for (const dep of missingDependencies) {
@@ -520,7 +744,7 @@ export function syncRoutes(opts) {
             if (!dst.startsWith(targetAbs + sep)) {
                 throw new Error(`refusing to write outside target dir: ${dst}`);
             }
-            copyDependencyFile(join(opts.templatesDir, dep), dst, markers);
+            copyDependencyFile(opts.templatesDir, dep, dst, opts.versions, markers);
             appliedDependencies.push(dep);
         }
         // #7874 D9 — a spoke declares what the copied routes read, as the last
@@ -536,6 +760,8 @@ export function syncRoutes(opts) {
         missing,
         modified,
         applied,
+        refused,
+        routeImports,
         missingDependencies,
         appliedDependencies,
         missingMessageNamespaces,
@@ -572,19 +798,20 @@ function hasMessageNamespace(targetAbs, namespace) {
     }
 }
 /**
- * Copy one dependency file from the template into the target, applying the
- * same marker substitution `copyTemplate` applies to text files — every
- * `ROUTE_DEPENDENCIES` entry is `.ts`/`.tsx`, always text. Never overwrites:
- * the caller (`syncRoutes`) only calls this for a path already confirmed
- * absent from the target, but the check is repeated here so this helper is
- * safe to call on its own.
+ * Copy one dependency file (`rel`, template-relative) from the template into
+ * the target through `renderTemplateFile` — the renderer `copyTemplate` uses,
+ * so a text file gets its markers and a non-text asset an import reached
+ * (`./logo.png`, #9406) is copied byte-for-byte. Never overwrites: the caller
+ * (`syncRoutes`) only calls this for a path already confirmed absent from the
+ * target, but the check is repeated here so this helper is safe to call on
+ * its own.
  */
-function copyDependencyFile(src, dst, markers) {
+function copyDependencyFile(templatesDir, rel, dst, versions, markers) {
     if (existsSync(dst))
         return;
     mkdirSync(dirname(dst), { recursive: true });
-    const text = readFileSync(src, "utf8");
-    writeFileSync(dst, substituteMarkers(text, markers));
+    const bytes = readFileSync(join(templatesDir, ...rel.split("/")));
+    writeFileSync(dst, renderTemplateFile(bytes, rel, versions, markers));
 }
 /** Render the report the CLI prints after a run. Ends with a newline. */
 export function formatSyncRoutesReport(result, apply) {
@@ -598,7 +825,7 @@ export function formatSyncRoutesReport(result, apply) {
     }
     else if (apply) {
         lines.push(`[create-ailk] Copied ${result.applied.length} route(s):`);
-        lines.push(...result.missing.map(entry));
+        lines.push(...result.missing.filter((r) => result.applied.includes(r.route)).map(entry));
     }
     else {
         lines.push(`[create-ailk] ${result.missing.length} template route(s) missing:`);
@@ -611,6 +838,32 @@ export function formatSyncRoutesReport(result, apply) {
     if (result.skippedSurfaces.length > 0) {
         lines.push(`[create-ailk] Surfaces this site does not carry (skipped): ${result.skippedSurfaces.join(", ")}`);
     }
+    // #9406 DD5 — per missing route, what its imports copy, leave, or cannot
+    // resolve; then the routes a dangling import holds back.
+    if (result.routeImports.length > 0) {
+        lines.push("[create-ailk] Local modules the missing route(s) import:");
+        for (const { route, copies, differs, unresolved } of result.routeImports) {
+            lines.push(`  ${route}`);
+            if (copies.length > 0) {
+                lines.push("    copies:");
+                lines.push(...copies.map((path) => `      ${path}`));
+            }
+            if (differs.length > 0) {
+                lines.push("    left as-is (differs from the template):");
+                lines.push(...differs.map((path) => `      ${path}`));
+            }
+            if (unresolved.length > 0) {
+                lines.push("    cannot resolve:");
+                lines.push(...unresolved.map(({ specifier, from, reason }) => `      ${specifier} (from ${from}): ${reason}`));
+            }
+        }
+    }
+    if (result.refused.length > 0) {
+        lines.push(apply
+            ? `[create-ailk] ${result.refused.length} route(s) not copied — an import does not resolve:`
+            : `[create-ailk] ${result.refused.length} route(s) would not be copied — an import does not resolve:`);
+        lines.push(...result.refused.map((route) => `  ${route}`));
+    }
     // #5014 third clause: the routes/messages/lib a synced route needs to
     // compile, reported (and, for lib files, applied) alongside the route.
     if (result.missingDependencies.length > 0) {

package/dist/template-record.d.ts

@@ -3,17 +3,27 @@ export declare const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
 /**
  * The app paths a generator rewrites after `copyTemplate` lands its copy
  * (§1): the nav, the site chrome, the site fonts, the paid-sections
- * registry and its module-presence flags (#8843 D10), the four spoke seams, and a commerce spoke's checkout config,
+ * registry and its module-presence flags (#8843 D10), the paid MCP tool
+ * registry (#9460 DD6; `update` rewrites it every run, #9567), the four spoke seams, and a commerce spoke's checkout config,
  * which the checkout writer stamps and the site owns from then on (#8748
  * D2). Composed from each writer's own exported path constant, so a renamed
  * constant carries its path along here too (#8522 D2).
  */
 export declare const REGENERATED_APP_PATHS: readonly string[];
+/**
+ * A hub's thin `database/` (#9569 DD1/DD8): the Prisma config that points at
+ * the installed `@working-theory/database`, and the two seeds the package
+ * does not publish. Recorded and carried by `update` like an app file; the
+ * module data files beside them (`database/flows/`, `database/waitlist/`)
+ * are bundle output, never recorded.
+ */
+export declare const DATABASE_BOOT_FILES: readonly string[];
 /**
  * Whether a destination path (`/`-separated, as `templateDestination`
- * returns it) is one `update` ever records or touches (#8522 D2): under one
- * of the three app trees, not a `package.json`, not an `.env*` file, no
- * `.claude` segment, and not a path a generator rewrites after the copy.
+ * returns it) is one `update` ever records or touches (#8522 D2): one of
+ * the three `DATABASE_BOOT_FILES`, or under one of the three app trees, not
+ * a `package.json`, not an `.env*` file, no `.claude` segment, and not a
+ * path a generator rewrites after the copy.
  */
 export declare function isRecordable(destRel: string): boolean;
 /** The hex sha256 digest of `bytes` — the one hash every record row uses. */