create-ailk 0.24.0 → 0.25.1

package/templates/apps/mcp/src/lib/paid-tools.generated.ts

@@ -0,0 +1,10 @@
+// paid-tools.generated.ts — the paid MCP tool packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (`paidMcpToolPackages`) and
+// this app's package.json dependencies (#9460). Do not edit: every scaffold
+// and `create-ailk add-module` rewrites it. A carried package is a bundled
+// dynamic import the server resolves its paid tools from at call time; a
+// site that carries none exports an empty list.
+import type { McpToolPackLoader } from "@working-theory/mcp-server";
+
+export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [];

package/templates/apps/mcp/src/lib/topology.generated.ts

@@ -10,9 +10,9 @@ import {
   initMcpPublicWorkspace,
   mcpPublicWorkspace,
   type McpWorkspaceResolution,
-} from "./public-workspace.js";
+} from "@working-theory/mcp-server/hub";
 
-export { registerLicenseKeyStore } from "./license-key-store.js";
+export { registerLicenseKeyStore } from "@working-theory/mcp-server/hub";
 export type { McpWorkspaceResolution };
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";

package/templates/apps/mcp/src/site.ts

@@ -0,0 +1,12 @@
+/**
+ * The site this MCP server runs for (#9460 DD2/DD4): the topology seam and
+ * the paid-tool registry, both generated by create-ailk, handed to
+ * `@working-theory/mcp-server` as one object. Nothing else is the site's own.
+ */
+
+import type { McpSite } from "@working-theory/mcp-server";
+
+import { PAID_TOOL_PACKS } from "./lib/paid-tools.generated.js";
+import * as topology from "./lib/topology.generated.js";
+
+export const site: McpSite = { topology, paidToolPacks: PAID_TOOL_PACKS };

package/templates/apps/web/.env.example

@@ -229,7 +229,7 @@ CONTENT_ADAPTER=mdx
 # AILK_HUB_SIGN_IN_URL=https://hub.example.com
 #
 # This site's client id and secret, issued on the hub with
-#   pnpm --filter @working-theory/api spokes sign-in-client --id <spoke_id> \
+#   pnpm --filter @working-theory/app-api spokes sign-in-client --id <spoke_id> \
 #     --redirect-uri <this site's origin>/api/hub-session/callback
 # The client id is the spoke's id. The secret is shown once; keep it out of git.
 # AILK_HUB_CLIENT_ID=

package/templates/apps/web/CLAUDE.md

@@ -407,7 +407,8 @@ Every multi-step magnet is a page pair (#8840), rendered by one module,
   content. With none, #8848 D6 holds for a configured hub: a 5xx or a refused
   connection shows the contact email (`noindex`). A site with no hub to ask —
   the read answers 503 `flows_not_configured`, or no API origin
-  (`AILK_API_URL`, `NEXT_PUBLIC_AILK_API_URL`, `NEXT_PUBLIC_API_URL`) is set —
+  (`AILK_API_URL`, the origin `browserApiOrigin()` returns, or
+  `NEXT_PUBLIC_API_URL`) is set —
   reads `not-configured` (set once in `readMagnet`), and the slug 404s, as
   does its `/start` (#9219). `/downloads` and `/downloads/<slug>` are
   permanent redirects into `/reports` (signal-collectors files).
@@ -426,7 +427,11 @@ key), so the page names none. It renders one of three pages:
 - **Unconnected** — the route answers `unconnected`, or the deployment runs
   in production with none of the API origin variables `getApiBase()` reads:
   today's MDX page through `renderPage`, byte for byte, `?plan=` matching
-  authored plan keys as #8842 made it.
+  authored plan keys as #8842 made it. The browser-facing one is read
+  through `lib/api-origin.generated.ts`'s `browserApiOrigin()` (#7874 D12):
+  `NEXT_PUBLIC_AILK_API_URL` on a hub, nothing on a spoke, which refuses that
+  name — so a spoke with `/pricing` passes its own `env:check` (#9480). The
+  magnet pages and the results permalink read it the same way.
 - **A current shown set** — `lib/offerings-pricing.ts` maps it to a plans
   fragment and an add-ons fragment. The first `pricing` section that is not
   `addons` becomes the Stripe plans, and the first `addons` one the Stripe
@@ -546,7 +551,9 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - Don't reach into `apps/api` or `apps/mcp` from `apps/web`. They're peer apps — talk via HTTP/MCP.
 - Don't commit images to `screenshots/` — only the `.gitkeep` is tracked.
 
-Last updated: 2026-10-20 — § Magnet pages: the trial magnet's pair, `/trial` (its button to `/trial/request` through `renderMagnetLanding`'s `startPath`) and the chrome-free `/trial/request` walk with its own `<h1>` fallback (#9287 C2, DD10) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/trial/{page,request/page}.tsx` and `lib/magnet-routes.ts`.
+Last updated: 2026-10-21 — § Pricing page and § Magnet pages: `/pricing`, the magnet pages and the results permalink read the browser-facing API origin through `browserApiOrigin()` (#7874 D12), so a spoke that enables them passes its own `env:check` (#9480) — verified against `app/[locale]/pricing/page.tsx`, `app/[locale]/flows/[slug]/{magnet-page.tsx,results/[payload]/page.tsx}` and `lib/api-origin.generated.ts`.
+
+Prior: 2026-10-20 — § Magnet pages: the trial magnet's pair, `/trial` (its button to `/trial/request` through `renderMagnetLanding`'s `startPath`) and the chrome-free `/trial/request` walk with its own `<h1>` fallback (#9287 C2, DD10) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/trial/{page,request/page}.tsx` and `lib/magnet-routes.ts`.
 
 Prior: 2026-10-19 — § Magnet pages: `/careers/apply` renders the contact email under its own `<h1>` when its flow is absent or the hub cannot answer; `readMagnet`'s `not-configured` kind 404s an unknown `/reports/<slug>` (and its `/start`) on a site with no hub to ask, while a configured hub that is down keeps #8848 D6's contact email (#9219) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/careers/apply/page.tsx`, `app/[locale]/reports/deliverable-page.tsx` and `app/[locale]/reports/[slug]/{page,start/page}.tsx`.
 

package/templates/apps/web/app/.well-known/mcp.json/route.ts

@@ -16,7 +16,9 @@
  * the surface disagreement `apps/mcp/__tests__/catalog-drift.test.ts` exists
  * to make impossible. The same single read also yields the licence features
  * the deployment holds (#7136), which gate the five `feature`-tagged tools
- * here exactly as they gate registration on the MCP server.
+ * here exactly as they gate registration on the MCP server. `create_project`
+ * is left out while create-ailk's release scope holds the Free level (#9534),
+ * as `apps/mcp` leaves it unregistered — `lib/release-scope.ts`.
  *
  * Mirrors /.well-known/ai-plugin.json conventions: Response.json with a
  * conservative cache-control header.
@@ -26,6 +28,7 @@
  * is appropriate per the MCP discovery spec.
  */
 
+import { isFreeLevelReleased } from "../../../lib/release-scope";
 import { UNSERVED_MCP_TOOLS } from "../../../lib/topology.generated";
 import packageJson from "../../../package.json";
 import {
@@ -60,8 +63,11 @@ export async function GET(): Promise<Response> {
     ailkVersion: packageJson.version,
     commerceClaimed: heldFeatures.includes(COMMERCE_FEATURE),
     heldFeatures,
-    // The tools this topology's MCP server does not register (#8070 D7).
-    unservedTools: UNSERVED_MCP_TOOLS,
+    // The tools this topology's MCP server does not register (#8070 D7) —
+    // and create_project while the Free level is held (#9534).
+    unservedTools: isFreeLevelReleased()
+      ? UNSERVED_MCP_TOOLS
+      : [...UNSERVED_MCP_TOOLS, "create_project"],
     // Spread conditional to satisfy exactOptionalPropertyTypes: omit the key
     // entirely when the env var is not set rather than passing undefined.
     ...(mcpHttpUrlEnv ? { mcpHttpUrl: mcpHttpUrlEnv } : {}),

package/templates/apps/web/app/[locale]/contact/intake-analytics.ts

@@ -5,7 +5,7 @@
  * ConversationalIntakeWrapper (#4534, epic #4521's integration leg).
  *
  * `recordIntakeTurn` fires `track()` (`@working-theory/analytics/server`,
- * the same fire-and-forget helper `apps/api/src/routes/leads/index.ts`
+ * the same fire-and-forget helper `packages/api/src/routes/leads/index.ts`
  * already uses for "lead-captured") once per conversation turn, tagged with
  * the turn index and the engine status as of that turn. A session's last
  * "intake-turn-abandonment" event with `status: "in_progress"` marks the

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/magnet-page.test.tsx

@@ -86,6 +86,7 @@ jest.mock("../../../contact/site-contact-email", () => ({
   readSiteContactEmail: () => "hello@example.com",
 }));
 
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import {
   magnetLandingMetadata,
   magnetStartMetadata,
@@ -361,7 +362,15 @@ describe("the read tells a hub that is not configured from one that is down (#92
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
   });
 
-  it.each(ORIGIN_NAMES)("with %s set, a 5xx or a throw is unavailable", async (name) => {
+  // #9480 — the browser-facing name is read through the topology seam
+  // (#7874 D12). The committed seam is the hub render; #8060 — a spoke render
+  // reads no NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold leaves that row out.
+  const CONFIGURED_BY =
+    TOPOLOGY === "hub"
+      ? ORIGIN_NAMES
+      : ORIGIN_NAMES.filter((name) => name !== "NEXT_PUBLIC_AILK_API_URL");
+
+  it.each(CONFIGURED_BY)("with %s set, a 5xx or a throw is unavailable", async (name) => {
     process.env[name] = "https://hub.example";
     mockGet.mockResolvedValue({ ok: false, status: 503, body: null });
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "unavailable" });
@@ -378,6 +387,18 @@ describe("the read tells a hub that is not configured from one that is down (#92
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
   });
 
+  it("on a spoke (the seam's spoke render), NEXT_PUBLIC_AILK_API_URL alone is not-configured", async () => {
+    process.env.NEXT_PUBLIC_AILK_API_URL = "https://hub.example";
+    mockGet.mockResolvedValue({ ok: false, status: 503, body: null });
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../magnet-page");
+      await expect(spoke.readMagnet("growth")).resolves.toEqual({ kind: "not-configured" });
+    });
+  });
+
   it("with no API origin, a 404 is still absent and a served flow still ok", async () => {
     mockGet.mockResolvedValue({ ok: false, status: 404, body: null });
     await expect(readMagnet("growth")).resolves.toEqual({ kind: "absent" });

package/templates/apps/web/app/[locale]/flows/[slug]/magnet-page.tsx

@@ -51,6 +51,7 @@ import { notFound, redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { browserApiOrigin } from "../../../../lib/api-origin.generated";
 import { readSiteContactEmail } from "../../contact/site-contact-email";
 
 import { FlowStepperClient } from "./FlowStepperClient";
@@ -74,13 +75,16 @@ const magnetReads = new Map<string, { at: number; read: Promise<MagnetRead> }>()
 
 /**
  * Whether an API origin is configured: the three names `getApiBase()` in
- * packages/api-client/src/http.ts reads, in step with it (as `/pricing`
- * checks them). Without one that function answers `localhost:3001`.
+ * packages/api-client/src/http.ts reads, in step with it on a hub. Without one
+ * that function answers `localhost:3001`. The browser-facing origin comes from
+ * the topology seam (#7874 D12), which a spoke renders with no env read, so a
+ * spoke passes its own `env:check` (#9480). A spoke diverges on purpose: the
+ * browser-facing name set on one at runtime counts as no origin here.
  */
 function apiOriginConfigured(): boolean {
   return Boolean(
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL,
   );
 }

package/templates/apps/web/app/[locale]/pricing/__tests__/unconnected.test.tsx

@@ -23,6 +23,7 @@ import {
 import type { PageSection } from "@working-theory/validation";
 import type { ReactElement } from "react";
 
+import { TOPOLOGY } from "../../../../lib/topology.generated";
 import * as pricingPage from "../page";
 import PricingPage, { generateMetadata } from "../page";
 
@@ -219,6 +220,48 @@ describe("/pricing on an unconnected site is today's page (#8927 AC-4)", () => {
     expect(served).toBe(await oracleHtml(undefined, true));
   });
 
+  // #9480 — the browser-facing origin is read through the topology seam
+  // (#7874 D12). The committed seam is the hub render, so this case runs it
+  // unmocked. #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, reads the shown set in production configured only by the browser-facing origin",
+    async () => {
+      for (const name of API_ENV) delete process.env[name];
+      process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+      (process.env as Record<string, string>).NODE_ENV = "production";
+
+      const served = await pageHtml({}, true);
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(String(fetchMock.mock.calls[0][0])).toMatch(
+        /^https:\/\/api\.example\.test\/v1\/content\/shown-offerings/,
+      );
+      expect(served).toBe(await oracleHtml(undefined, true));
+    },
+  );
+
+  it("on a spoke (the seam's spoke render), that origin is not read in production", async () => {
+    for (const name of API_ENV) delete process.env[name];
+    process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+    (process.env as Record<string, string>).NODE_ENV = "production";
+
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../page");
+      await spoke.default({
+        params: Promise.resolve({ locale: "en" }),
+        searchParams: Promise.resolve({}),
+        getMdxSource,
+        getPageSections,
+      });
+    });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("keeps the MDX page's metadata and renders per request", async () => {
     const params = Promise.resolve({ locale: "en" });
 

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -36,6 +36,7 @@ import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { browserApiOrigin } from "../../../lib/api-origin.generated";
 import {
   offeringsPricing,
   type OfferingsPricing,
@@ -114,13 +115,16 @@ function sharedRead(
 
 /**
  * Whether an API origin is configured: the three names `getApiBase()` in
- * packages/api-client/src/http.ts reads, in step with it. Without one that
- * function answers `localhost:3001`.
+ * packages/api-client/src/http.ts reads, in step with it on a hub. Without one
+ * that function answers `localhost:3001`. The browser-facing origin comes from
+ * the topology seam (#7874 D12), which a spoke renders with no env read, so a
+ * spoke passes its own `env:check` (#9480). A spoke diverges on purpose: the
+ * browser-facing name set on one at runtime counts as no origin here.
  */
 function apiOriginConfigured(): boolean {
   return Boolean(
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL,
   );
 }

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/__tests__/route.test.ts

@@ -0,0 +1,222 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The Offerings buy route's API origin on each topology (#9419). The route
+ * takes its browser-facing origin from the #7874 D12 seam
+ * (`lib/api-origin.generated.ts`), never from `NEXT_PUBLIC_AILK_API_URL`
+ * itself: a spoke's render of that seam reads no env, so a fresh
+ * `--topology spoke` scaffold passes its own `env:check` (SPOKE_REFUSED_ENV,
+ * #7874 D5). The rest of the ladder is pinned in `../../__tests__/route.test.ts`.
+ *
+ * Each case loads the route in its own module registry, so no case reads
+ * another's shared shown-set answer; a spoke case swaps in the spoke render
+ * of both generated seams, as `lib/__tests__/relay.test.ts` does.
+ */
+import { workspaceShownSetSchema } from "@working-theory/validation";
+
+import { TOPOLOGY } from "../../../../../../lib/topology.generated";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn(async () => ({ features: ["commerce"] })),
+}));
+
+const ORIGIN_SEAM = "../../../../../../lib/api-origin.generated";
+const TOPOLOGY_SEAM = "../../../../../../lib/topology.generated";
+const HUB_API = "https://api.example.test";
+
+/** One shown plan with one price, `growth_monthly`, in the wire shape. */
+const SHOWN_SET = workspaceShownSetSchema
+  .partial({ workspaceId: true, organizationId: true })
+  .parse({
+    productIds: ["prod_growth"],
+    recommended: { plan: null, addon: null },
+    offerings: [
+      {
+        productId: "prod_growth",
+        plan: "growth",
+        name: "growth",
+        description: null,
+        marketingFeatures: [],
+        unitLabel: null,
+        note: null,
+        termsNote: null,
+        ailkGroup: "plan",
+        ailkOrder: null,
+        prices: [
+          {
+            priceId: "price_growthmonthly",
+            lookupKey: "growth_monthly",
+            plan: "growth",
+            period: "monthly",
+            interval: "month",
+            amount: 4900,
+            currency: "usd",
+          },
+        ],
+        recommended: false,
+      },
+    ],
+    state: "current",
+    snapshotAt: "2026-10-21T00:00:00.000Z",
+  });
+
+const env = process.env as Record<string, string | undefined>;
+const ENV_NAMES = [
+  "AILK_API_URL",
+  "NEXT_PUBLIC_AILK_API_URL",
+  "NEXT_PUBLIC_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+  "NODE_ENV",
+  "OSS_API_INTERNAL_SECRET",
+  "AILK_SPOKE_KEY",
+] as const;
+const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
+
+function json(status: number, body: unknown): Promise<Response> {
+  return Promise.resolve(
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+/** The shown-set read answers `shownStatus`; the session POST starts one. */
+let shownStatus: "unconnected" | "shown";
+const realFetch = global.fetch;
+const fetchMock = jest.fn(
+  (input: string | URL | Request, _init?: RequestInit) => {
+    if (new URL(String(input)).pathname === "/v1/checkout/sessions") {
+      return json(201, {
+        sessionId: "cs_test_a1",
+        url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+      });
+    }
+    return json(200, {
+      ok: true,
+      data: { status: shownStatus, shownSet: SHOWN_SET },
+    });
+  },
+);
+let warnSpy: jest.SpyInstance;
+
+beforeAll(() => {
+  global.fetch = fetchMock as jest.Mock;
+});
+
+afterAll(() => {
+  global.fetch = realFetch;
+  for (const name of ENV_NAMES) {
+    if (savedEnv[name] === undefined) delete env[name];
+    else env[name] = savedEnv[name];
+  }
+});
+
+beforeEach(() => {
+  for (const name of ENV_NAMES) delete env[name];
+  env.NODE_ENV = "production";
+  env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
+  shownStatus = "unconnected";
+  fetchMock.mockClear();
+  warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  warnSpy.mockRestore();
+});
+
+/** A buyer's click on `growth_monthly`, served by a site of `topology`. */
+async function buy(topology: "hub" | "spoke"): Promise<Response> {
+  let res: Response | undefined;
+  await jest.isolateModulesAsync(async () => {
+    // A doMock outlives the registry it was made in, so a hub case undoes it.
+    if (topology === "spoke") {
+      jest.doMock(ORIGIN_SEAM, () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      jest.doMock(TOPOLOGY_SEAM, () => ({
+        ...jest.requireActual(TOPOLOGY_SEAM),
+        TOPOLOGY: "spoke",
+      }));
+    } else {
+      jest.dontMock(ORIGIN_SEAM);
+      jest.dontMock(TOPOLOGY_SEAM);
+    }
+    const { GET } = await import("../route");
+    const request = new Request(
+      "https://shop.example.com/api/offerings/checkout/growth_monthly",
+      {
+        headers: {
+          "sec-fetch-mode": "navigate",
+          "sec-fetch-dest": "document",
+          "sec-fetch-site": "same-origin",
+        },
+      },
+    );
+    res = await GET(request, {
+      params: Promise.resolve({ lookupKey: "growth_monthly" }),
+    });
+  });
+  if (res === undefined) throw new Error("the route did not answer");
+  return res;
+}
+
+function postHeaders(): Record<string, string> {
+  const post = fetchMock.mock.calls.find(
+    ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+  );
+  if (post === undefined) throw new Error("no session POST");
+  return (post[1]?.headers ?? {}) as Record<string, string>;
+}
+
+describe("the route's API origin comes from the topology seam", () => {
+  it("on a spoke, a set NEXT_PUBLIC_AILK_API_URL is not an API origin", async () => {
+    env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+    const res = await buy("spoke");
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe("/pricing");
+    expect(warnSpy).toHaveBeenCalledWith(
+      "[offerings-checkout] refused reason=unconnected",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("on a spoke, the server-only AILK_API_URL is the API origin", async () => {
+    env.AILK_API_URL = HUB_API;
+
+    await buy("spoke");
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  // The committed seam is the hub render, so this case runs it unmocked.
+  // #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, NEXT_PUBLIC_AILK_API_URL is the API origin through the seam",
+    async () => {
+      env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+      await buy("hub");
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("a spoke with no spoke key never sends the internal secret", async () => {
+    // The transport check skips NEXT_PUBLIC_AILK_API_URL on a spoke, while
+    // the api-client still sends there: only the topology withholds it.
+    env.NODE_ENV = "test";
+    env.NEXT_PUBLIC_AILK_API_URL = "http://api.remote.example";
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    shownStatus = "shown";
+
+    await buy("spoke");
+
+    expect(postHeaders()["x-internal-auth"]).toBeUndefined();
+  });
+});

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -14,8 +14,10 @@
 import { checkout, offerings } from "@working-theory/api-client";
 import { parseLookupKey } from "@working-theory/validation";
 
+import { browserApiOrigin } from "../../../../../lib/api-origin.generated";
 import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
 import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
 import { resolveBaseUrl } from "../../../../../src/lib/routes";
 
@@ -70,12 +72,14 @@ function isBuyerNavigation(request: Request): boolean {
 
 /**
  * The API origin, in the order `getApiBase()` in
- * packages/api-client/src/http.ts reads it.
+ * packages/api-client/src/http.ts reads it. The browser-facing origin comes
+ * from the topology seam (#7874 D12), which a spoke renders with no env read,
+ * so a spoke passes its own `env:check` (#9419).
  */
 function configuredApiBase(): string | undefined {
   return (
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL ||
     undefined
   );
@@ -203,6 +207,8 @@ const START_TIMEOUT_MS = 10_000;
  * D5 — the visitor's forwarded address, so the API's per-IP bucket counts
  * buyers, and the internal secret only from a site that is not a spoke and
  * only to an `https:` or loopback API. Nothing else of the request is sent.
+ * A spoke topology withholds it even with no spoke key: its transport check
+ * skips `NEXT_PUBLIC_AILK_API_URL`, which the api-client still sends to.
  */
 function startHeaders(incoming: Headers): Record<string, string> {
   const headers: Record<string, string> = {};
@@ -210,7 +216,8 @@ function startHeaders(incoming: Headers): Record<string, string> {
   if (visitor) headers["x-forwarded-for"] = visitor;
 
   const secret = process.env.OSS_API_INTERNAL_SECRET;
-  if (secret && !process.env.AILK_SPOKE_KEY?.trim() && isSafeApiTransport()) {
+  const spoke = TOPOLOGY === "spoke" || !!process.env.AILK_SPOKE_KEY?.trim();
+  if (secret && !spoke && isSafeApiTransport()) {
     headers["x-internal-auth"] = secret;
   }
   return headers;

package/templates/apps/web/app/api/revalidate/route.ts

@@ -31,7 +31,7 @@
  *
  * Replay window (D7, reopened and closed by #5902): a captured delivery
  * verifies for 5 minutes and no longer, the Slack receiver's tolerance
- * (apps/api/src/routes/slack/actions.ts). Within the window a replay is a
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts). Within the window a replay is a
  * second revalidateTag on an already-purged tag — a no-op — so the receiver
  * still keeps no seen-set.
  *
@@ -65,7 +65,7 @@ const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
 const TIMESTAMP_SHAPE = /^[0-9]{1,12}$/;
 
 /**
- * The sender's bounds (apps/api/src/services/revalidation.ts), applied again
+ * The sender's bounds (packages/api/src/services/revalidation.ts), applied again
  * here because this route is unauthenticated until the MAC verifies and the
  * values become cache tags. `workspaceId` is logged, never tagged, so it stays
  * a plain string.
@@ -90,7 +90,7 @@ type RevalidateBody = z.infer<typeof bodySchema>;
 
 /**
  * Line-for-line the repo's one shipped verifier
- * (apps/api/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
  * base string extended by the event (#5902). The length guard is required,
  * not decorative: timingSafeEqual throws on unequal lengths. The `sha256=`
  * prefix stays inside the compared material so a same-length `sha512=` header

package/templates/apps/web/auth.ts

@@ -560,7 +560,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      *
      * So: when the IP is resolvable the § D8a values apply as specified; when
      * it is not, we fall through to the library's shorter-recovery defaults.
-     * This is the same reasoning `apps/api/src/lib/auth-email-budget.ts`
+     * This is the same reasoning `packages/api/src/lib/auth-email-budget.ts`
      * applies to the site-wide send cap it declines to implement — a
      * site-wide cap an attacker can hold open is a denial of the control it
      * implements — and the two now agree instead of contradicting each other.
@@ -568,7 +568,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      * STORAGE CAVEAT, load-bearing and NOT solved here: `"memory"` is a
      * process-local Map, so on a multi-instance deployment the effective
      * ceiling is 5 × N per 900 s — the identical caveat
-     * `apps/api/src/middleware/rate-limit.ts` documents for itself. The
+     * `packages/api/src/middleware/rate-limit.ts` documents for itself. The
      * durable alternative needs a rate-limit table the schema does not have,
      * and this issue adds no migration. What does bound the consequence is
      * the per-recipient send budget at the apps/api relay.

package/templates/apps/web/jest.config.cjs

@@ -3,6 +3,7 @@
 module.exports = {
   preset: "ts-jest",
   globalSetup: require.resolve("../../tools/jest/pin-timezone.cjs"),
+  reporters: require("../../tools/jest/reporters.cjs"),
   testEnvironment: "jsdom",
   roots: [
     "<rootDir>/__tests__",

package/templates/apps/web/lib/auth-email.ts

@@ -18,7 +18,7 @@
  *
  * ONE SERIALIZATION. `buildAuthEmailRequest` builds the body string ONCE,
  * signs THAT string, and hands the same string to the transport — the
- * invariant `apps/api/src/services/revalidation.ts` states for itself ("a
+ * invariant `packages/api/src/services/revalidation.ts` states for itself ("a
  * key-order or whitespace drift between signer and sender is impossible by
  * construction"). This is why the call cannot go through the client's
  * `post()`, which stringifies its own payload argument.

package/templates/apps/web/lib/relay.ts

@@ -132,7 +132,7 @@ type RateLimitBucket = {
 // Module-scoped store, shared by the visitor (`visitor|<identity>`) and
 // session (`session|<identity>`) budgets (D7: same identity, window and
 // store). Ported from the hub's own limiter
-// (`apps/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
+// (`packages/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
 // cannot import `apps/api`.
 const rateLimitBuckets = new Map<string, RateLimitBucket>();
 let requestsSinceSweep = 0;
@@ -181,7 +181,7 @@ function hit(key: string, now: number): RateLimitBucket {
 
 /**
  * The eight hextets of a valid IPv6 address, or `null`. Ported from the
- * hub's own `expandIpv6` (`apps/api/src/middleware/rate-limit.ts`).
+ * hub's own `expandIpv6` (`packages/api/src/middleware/rate-limit.ts`).
  */
 function expandIpv6(address: string): number[] | null {
   let text = address;