create-ailk 0.24.0 → 0.26.0

package/dist/paid-sections.d.ts

@@ -2,6 +2,8 @@
 export declare const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
 /** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
 export declare const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
+/** Scaffold-relative path of the generated paid MCP tool registry (#9460 DD6). */
+export declare const PAID_MCP_TOOLS_PATH = "apps/mcp/src/lib/paid-tools.generated.ts";
 export interface PaidSectionRow {
     module: string;
     package: string;
@@ -33,9 +35,31 @@ export declare function renderModuleFlags(flags: {
  * `undefined` (writing nothing) for a scaffold with no web app.
  */
 export declare function writeModuleFlags(targetDir: string): "added" | "updated" | "unchanged" | undefined;
+/**
+ * The paid MCP tool packages, one row each (#9460 DD6): every slice's
+ * `paidMcpToolPackages` in `RECOGNIZED_MODULES` order, then first
+ * appearance, so a package two modules deliver is one row.
+ */
+export declare function paidMcpToolRows(): string[];
+/**
+ * Render the MCP registry: one `() => import("<package>")` per carried
+ * package, `[]` when none is carried. Line 1 is `// oss: false` exactly when
+ * a row is present — #7536's rule, so the public strip drops the file.
+ */
+export declare function renderPaidMcpTools(present: ReadonlySet<string>): string;
+/**
+ * Write the MCP registry into a scaffold from its own `apps/mcp/package.json`
+ * `dependencies` (#9460 DD6), creating `apps/mcp/src/lib/` if need be.
+ * Answers whether the file was `added`, `updated` (changed bytes) or
+ * `unchanged`, or `undefined` (writing nothing) when that package.json is
+ * absent — a `--without-mcp` spoke — the `writeModuleFlags` shape, so
+ * `create-ailk update` reports it the same way (#9567).
+ */
+export declare function writePaidMcpTools(targetDir: string): "added" | "updated" | "unchanged" | undefined;
 /**
  * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`, and the module-presence flags beside it.
+ * own `apps/web/package.json`, and the module-presence flags beside it,
+ * then the MCP registry from `apps/mcp/package.json` (#9460 DD6).
  * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
  * absent — a scaffold with no web app.
  */

package/dist/paid-sections.js

@@ -23,14 +23,16 @@
  * file, importing nothing, because the registry's `import()`s would pull UI
  * packages into any edge code that reads the flag.
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { MODULE_SLICES } from "./module-architecture.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
 /** Scaffold-relative path of the generated registry. */
 export const PAID_SECTIONS_PATH = "apps/web/lib/paid-sections.generated.ts";
 /** Scaffold-relative path of the generated module-presence flags (#8843 D10). */
 export const MODULE_FLAGS_PATH = "apps/web/lib/modules.generated.ts";
+/** Scaffold-relative path of the generated paid MCP tool registry (#9460 DD6). */
+export const PAID_MCP_TOOLS_PATH = "apps/mcp/src/lib/paid-tools.generated.ts";
 /** The dependency whose presence means the scheduling module's pages exist. */
 const SCHEDULING_PAGES_PACKAGE = "@working-theory/ui-scheduling";
 function pascalCase(shortName) {
@@ -162,9 +164,91 @@ export function writeModuleFlags(targetDir) {
     writeFileSync(path, next);
     return before === undefined ? "added" : "updated";
 }
+/**
+ * The paid MCP tool packages, one row each (#9460 DD6): every slice's
+ * `paidMcpToolPackages` in `RECOGNIZED_MODULES` order, then first
+ * appearance, so a package two modules deliver is one row.
+ */
+export function paidMcpToolRows() {
+    const rows = [];
+    for (const name of RECOGNIZED_MODULES) {
+        for (const pkg of MODULE_SLICES[name].paidMcpToolPackages ?? []) {
+            if (!rows.includes(pkg))
+                rows.push(pkg);
+        }
+    }
+    return rows;
+}
+const PAID_MCP_TOOLS_HEADER = `// paid-tools.generated.ts — the paid MCP tool packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (\`paidMcpToolPackages\`) and
+// this app's package.json dependencies (#9460). Do not edit: every scaffold
+// and \`create-ailk add-module\` rewrites it. A carried package is a bundled
+// dynamic import the server resolves its paid tools from at call time; a
+// site that carries none exports an empty list.
+`;
+/**
+ * Render the MCP registry: one `() => import("<package>")` per carried
+ * package, `[]` when none is carried. Line 1 is `// oss: false` exactly when
+ * a row is present — #7536's rule, so the public strip drops the file.
+ */
+export function renderPaidMcpTools(present) {
+    // Spelled through a constant, not a `from "…"` literal: create-ailk's own
+    // dist must carry no `@working-theory/*` import text (#8412), while the
+    // scaffold's generated registry still imports the type (#9460 DD6).
+    const MCP_SERVER_PACKAGE = "@working-theory/mcp-server";
+    const rows = paidMcpToolRows().filter((pkg) => present.has(pkg));
+    const lines = [];
+    if (rows.length > 0)
+        lines.push("// oss: false");
+    lines.push(PAID_MCP_TOOLS_HEADER.trimEnd());
+    lines.push(`import type { McpToolPackLoader } from ${JSON.stringify(MCP_SERVER_PACKAGE)};`);
+    lines.push("");
+    if (rows.length === 0) {
+        lines.push("export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [];");
+    }
+    else {
+        lines.push("export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [");
+        for (const pkg of rows)
+            lines.push(`  () => import("${pkg}"),`);
+        lines.push("];");
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Write the MCP registry into a scaffold from its own `apps/mcp/package.json`
+ * `dependencies` (#9460 DD6), creating `apps/mcp/src/lib/` if need be.
+ * Answers whether the file was `added`, `updated` (changed bytes) or
+ * `unchanged`, or `undefined` (writing nothing) when that package.json is
+ * absent — a `--without-mcp` spoke — the `writeModuleFlags` shape, so
+ * `create-ailk update` reports it the same way (#9567).
+ */
+export function writePaidMcpTools(targetDir) {
+    const pkgPath = join(targetDir, "apps/mcp/package.json");
+    if (!existsSync(pkgPath))
+        return undefined;
+    let pkg;
+    try {
+        pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    }
+    catch (err) {
+        throw new Error(`cannot read ${pkgPath} to write the paid MCP tool registry: ${err.message}`, { cause: err });
+    }
+    const deps = pkg.dependencies ?? {};
+    const present = new Set(paidMcpToolRows().filter((name) => Object.hasOwn(deps, name)));
+    const path = join(targetDir, PAID_MCP_TOOLS_PATH);
+    const before = existsSync(path) ? readFileSync(path, "utf8") : undefined;
+    const next = renderPaidMcpTools(present);
+    if (before === next)
+        return "unchanged";
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, next);
+    return before === undefined ? "added" : "updated";
+}
 /**
  * Write the registry into a scaffold, deriving presence from the scaffold's
- * own `apps/web/package.json`, and the module-presence flags beside it.
+ * own `apps/web/package.json`, and the module-presence flags beside it,
+ * then the MCP registry from `apps/mcp/package.json` (#9460 DD6).
  * Returns `false` (writing nothing) when that file or `apps/web/lib/` is
  * absent — a scaffold with no web app.
  */
@@ -177,5 +261,6 @@ export function writePaidSections(targetDir) {
         .filter((name) => Object.hasOwn(deps, name)));
     writeFileSync(join(targetDir, PAID_SECTIONS_PATH), renderPaidSections(present));
     writeModuleFlags(targetDir);
+    writePaidMcpTools(targetDir);
     return true;
 }

package/dist/starter-grid.d.ts

@@ -83,10 +83,10 @@ export declare const SHAPE_ROSTERS: Readonly<Record<BuildableShape, readonly Tem
  * in the declaration order both keep. The plain name is the Pro one: it is
  * the flagship and the demo (Sam, 2026-09-14, parent § D12).
  *
- * `workspace` appears in no module list. It is a Pro module, but an authed app
- * surface contributing no PUBLIC page to a marketing site, and `modules` names
- * what the roster uses (parent § D15). A Pro key unlocks it regardless of any
- * template.
+ * Both paid aliases carry `workspace` because a Pro or Pro Plus key switches
+ * it on (#9696, reversing parent § D15), and a template's `requires` is what
+ * the alias path fetches, since it derives no level. It is an authed app
+ * surface, so it contributes no PUBLIC row to either roster.
  *
  * `commerce` is a per-site add-on available at any level, so no alias exists
  * FOR it (parent § D13); it still contributes rows to whichever alias takes
@@ -120,7 +120,7 @@ export declare const ALIASES: Readonly<{
     readonly "marketing-site": {
         readonly shape: "organization-product";
         readonly design: "standard";
-        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors"];
+        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "workspace"];
         readonly categories: readonly ["accounting", "legal", "consulting", "hvac", "roofing", "plumbing", "electrical", "landscaping", "auto-repair", "real-estate", "technology", "medical-specialty"];
         readonly differences: {
             readonly drop: readonly ["/blog", "/meet", "/meet/[slug]"];
@@ -140,7 +140,7 @@ export declare const ALIASES: Readonly<{
     readonly "saas-product": {
         readonly shape: "organization-product";
         readonly design: "standard";
-        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "multi-tenant"];
+        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "workspace", "multi-tenant"];
         readonly categories: readonly ["technology", "medical-specialty"];
         readonly differences: {
             readonly drop: readonly ["/blog", "/meet", "/meet/[slug]"];

package/dist/starter-grid.js

@@ -372,10 +372,10 @@ export const SHAPE_ROSTERS = Object.freeze({
  * in the declaration order both keep. The plain name is the Pro one: it is
  * the flagship and the demo (Sam, 2026-09-14, parent § D12).
  *
- * `workspace` appears in no module list. It is a Pro module, but an authed app
- * surface contributing no PUBLIC page to a marketing site, and `modules` names
- * what the roster uses (parent § D15). A Pro key unlocks it regardless of any
- * template.
+ * Both paid aliases carry `workspace` because a Pro or Pro Plus key switches
+ * it on (#9696, reversing parent § D15), and a template's `requires` is what
+ * the alias path fetches, since it derives no level. It is an authed app
+ * surface, so it contributes no PUBLIC row to either roster.
  *
  * `commerce` is a per-site add-on available at any level, so no alias exists
  * FOR it (parent § D13); it still contributes rows to whichever alias takes
@@ -415,7 +415,13 @@ export const ALIASES = Object.freeze({
     "marketing-site": {
         shape: "organization-product",
         design: "standard",
-        modules: ["marketing", "docs-blog", "scheduling", "signal-collectors"],
+        modules: [
+            "marketing",
+            "docs-blog",
+            "scheduling",
+            "signal-collectors",
+            "workspace",
+        ],
         // The flagship is the general-purpose template: it carries the whole
         // registry, so every group tile on the hub has at least one template.
         categories: [
@@ -455,6 +461,7 @@ export const ALIASES = Object.freeze({
             "docs-blog",
             "scheduling",
             "signal-collectors",
+            "workspace",
             "multi-tenant",
         ],
         categories: ["technology", "medical-specialty"],

package/dist/surfaces.js

@@ -713,7 +713,7 @@ export const ROUTE_SINCE = {
     // is one too. Whether it shows a ROW is a separate question with two
     // deployment preconditions (a resolvable workspace, and a `siteId` that
     // equals a workspace id); both fail empty, never wide. See
-    // `apps/api/src/services/leads-inbox.ts` § "What it takes for this to
+    // `packages/api/src/services/leads-inbox.ts` § "What it takes for this to
     // return anything".
     "(authed)/leads": "0.24.0",
     // #5371 — the workspace module's three settings routes. Genuinely new route
@@ -725,6 +725,12 @@ export const ROUTE_SINCE = {
     "(authed)/admin": "0.22.1",
     "(authed)/admin/site": "0.22.1",
     "(authed)/admin/team": "0.22.1",
+    // #9746 D10 — the Magnets and Meetings tabs. Genuinely new route
+    // directories, so they attach at today's fixed-group version.
+    "(authed)/admin/magnets": "0.46.0",
+    "(authed)/admin/magnets/new/[kind]": "0.46.0",
+    "(authed)/admin/meetings": "0.46.0",
+    "(authed)/admin/meetings/[slug]": "0.46.0",
     // #5977 — the Pro content host's editor routes (spec 5872 FR1/FR2), added
     // to apps/web by #5957. Genuinely new route directories, so they attach at
     // today's fixed-group version, the same "attach at today's version" rule
@@ -785,6 +791,13 @@ export function surfaceForRouteDir(routeDir) {
         return "core";
     return GATEABLE_SURFACES.find((s) => s.routes.includes(top))?.id;
 }
+/** #9746 D10 — what each Magnets and Meetings tab page imports beside itself. */
+const ADMIN_PANEL_ROUTE_DEPENDENCIES = [
+    "apps/web/lib/server-api.ts",
+    `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+    `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
+    `${ROUTE_ROOT}/(authed)/admin/admin-panels.tsx`,
+];
 /**
  * Non-route consumer-side files a route's own source imports, that a sync
  * must ALSO bring along so `--apply` never leaves a route that cannot
@@ -964,6 +977,8 @@ export const ROUTE_DEPENDENCIES = {
     ],
     "(authed)/account/billing": [
         "apps/web/lib/account-config.ts",
+        // #9401 D7 — the site's own Billing sections, the frozen stub the page imports.
+        "apps/web/lib/site-contributions.ts",
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
         `${ROUTE_ROOT}/(authed)/account/actions.ts`,
@@ -1034,6 +1049,8 @@ export const ROUTE_DEPENDENCIES = {
     "(authed)/admin": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        // #9746 D8 — the shared nav every /admin tab imports.
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
     "(authed)/leads": ["apps/web/lib/server-api.ts"],
     // #5977 — the editor routes' own imports, read from their sources: both
@@ -1053,11 +1070,19 @@ export const ROUTE_DEPENDENCIES = {
     "(authed)/admin/site": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
     "(authed)/admin/team": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
+    // #9746 D10 — the Magnets and Meetings tabs: the nav plus the client
+    // bindings of the shared admin-ui components.
+    "(authed)/admin/magnets": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/magnets/new/[kind]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/meetings": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/meetings/[slug]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
     "(authed)/waitlist": ["apps/web/lib/server-api.ts"],
     // #8843 D6 — the booking pages share one builder over the meetings read;
     // `/private` returns the index frame that lives under `meet/`.
@@ -1065,7 +1090,15 @@ export const ROUTE_DEPENDENCIES = {
     "meet/[slug]": ["apps/web/lib/meetings.tsx"],
     private: ["apps/web/lib/meetings.tsx", `${ROUTE_ROOT}/meet/meeting-index.tsx`],
     // #8927 D8 — /pricing maps the Offerings shown set through the mapper.
-    pricing: ["apps/web/lib/offerings-pricing.ts"],
+    // #9480 — and reads its browser-facing API origin through the topology seam
+    // (#7874 D12), so a spoke with /pricing reads no refused name. Every
+    // scaffold since #7874 already carries its own render of the seam, and a
+    // dependency copy never overwrites, so this entry admits the import; it
+    // never replaces a spoke's render with the template's hub one.
+    pricing: [
+        "apps/web/lib/offerings-pricing.ts",
+        "apps/web/lib/api-origin.generated.ts",
+    ],
 };
 /**
  * i18n message namespaces (dot-path into `apps/web/messages/<locale>.json`) a
@@ -1107,6 +1140,10 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/edit/[type]/[slug]": ["edit"],
     "(authed)/admin/site": ["admin"],
     "(authed)/admin/team": ["admin"],
+    "(authed)/admin/magnets": ["admin"],
+    "(authed)/admin/magnets/new/[kind]": ["admin"],
+    "(authed)/admin/meetings": ["admin"],
+    "(authed)/admin/meetings/[slug]": ["admin"],
     "(authed)/waitlist": ["waitlistDashboard.gate"],
     // #7744 — the /team hub's empty state reads the `team` namespace.
     team: ["team"],

package/dist/template-record.d.ts

@@ -3,16 +3,34 @@ export declare const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
 /**
  * The app paths a generator rewrites after `copyTemplate` lands its copy
  * (§1): the nav, the site chrome, the site fonts, the paid-sections
- * registry and its module-presence flags (#8843 D10), the four spoke seams, and a commerce spoke's checkout config,
+ * registry and its module-presence flags (#8843 D10), the paid MCP tool
+ * registry (#9460 DD6; `update` rewrites it every run, #9567), the four spoke seams, and a commerce spoke's checkout config,
  * which the checkout writer stamps and the site owns from then on (#8748
  * D2). Composed from each writer's own exported path constant, so a renamed
  * constant carries its path along here too (#8522 D2).
  */
 export declare const REGENERATED_APP_PATHS: readonly string[];
+/**
+ * A hub's thin `database/` (#9569 DD1/DD8): the Prisma config that points at
+ * the installed `@working-theory/database`, and the two seeds the package
+ * does not publish. Recorded and carried by `update` like an app file; the
+ * module data files beside them (`database/flows/`, `database/waitlist/`)
+ * are bundle output, never recorded.
+ */
+export declare const DATABASE_BOOT_FILES: readonly string[];
+/**
+ * The root `tools/` files every app `jest.config.cjs` requires by its
+ * repo-relative path (#9654): the timezone pin (#8657) and the shared
+ * reporters (#9430) — `SNAPSHOT_FILES` in `scripts/build-templates.mjs`
+ * ships both at that path. Recorded and carried by `update` like an app
+ * file, so a merged config never names a file the site lacks.
+ */
+export declare const ROOT_TOOL_FILES: readonly string[];
 /**
  * Whether a destination path (`/`-separated, as `templateDestination`
- * returns it) is one `update` ever records or touches (#8522 D2): under one
- * of the three app trees, not a `package.json`, not an `.env*` file, no
+ * returns it) is one `update` ever records or touches (#8522 D2): one of
+ * the three `DATABASE_BOOT_FILES` or the `ROOT_TOOL_FILES`, or under one of
+ * the three app trees, not a `package.json`, not an `.env*` file, no
  * `.claude` segment, and not a path a generator rewrites after the copy.
  */
 export declare function isRecordable(destRel: string): boolean;

package/dist/template-record.js

@@ -4,9 +4,10 @@
  *
  * Written beside `.ailk-site-manifest.json` at the site root, it lists every
  * `apps/web/`, `apps/api/` and `apps/mcp/` file the base `templates/` copy
- * wrote and no later layer rewrote, with the sha256 of the template's copy
- * of that file and the create-ailk version it came from. `create-ailk
- * update` (`update.ts`) reads it to tell an untouched copy from an owner's
+ * wrote and no later layer rewrote — and the few files outside them the
+ * record also carries (`DATABASE_BOOT_FILES`, `ROOT_TOOL_FILES`) — with the
+ * sha256 of the template's copy of that file and the create-ailk version it
+ * came from. `create-ailk update` (`update.ts`) reads it to tell an untouched copy from an owner's
  * edit; `scaffold()` (`programmatic.ts`) writes it, as its last write, from
  * the `onWrite` hook `copyTemplate` (`copy.ts`) calls once per file.
  *
@@ -18,7 +19,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { MODULE_FLAGS_PATH, PAID_SECTIONS_PATH } from "./paid-sections.js";
+import { MODULE_FLAGS_PATH, PAID_MCP_TOOLS_PATH, PAID_SECTIONS_PATH } from "./paid-sections.js";
 import { SITE_CHROME_PATH } from "./site-chrome.js";
 import { SITE_FONTS_PATH } from "./site-fonts.js";
 import { SPOKE_CHECKOUT_CONFIG_PATH } from "./spoke-checkout.js";
@@ -29,7 +30,8 @@ export const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
 /**
  * The app paths a generator rewrites after `copyTemplate` lands its copy
  * (§1): the nav, the site chrome, the site fonts, the paid-sections
- * registry and its module-presence flags (#8843 D10), the four spoke seams, and a commerce spoke's checkout config,
+ * registry and its module-presence flags (#8843 D10), the paid MCP tool
+ * registry (#9460 DD6; `update` rewrites it every run, #9567), the four spoke seams, and a commerce spoke's checkout config,
  * which the checkout writer stamps and the site owns from then on (#8748
  * D2). Composed from each writer's own exported path constant, so a renamed
  * constant carries its path along here too (#8522 D2).
@@ -40,18 +42,47 @@ export const REGENERATED_APP_PATHS = [
     SITE_FONTS_PATH,
     PAID_SECTIONS_PATH,
     MODULE_FLAGS_PATH,
+    PAID_MCP_TOOLS_PATH,
     ...SPOKE_SEAM_FILES,
     SPOKE_CHECKOUT_CONFIG_PATH,
 ];
 const REGENERATED_SET = new Set(REGENERATED_APP_PATHS);
 const RECORDABLE_APP_ROOT = /^apps\/(web|api|mcp)\//;
+/**
+ * A hub's thin `database/` (#9569 DD1/DD8): the Prisma config that points at
+ * the installed `@working-theory/database`, and the two seeds the package
+ * does not publish. Recorded and carried by `update` like an app file; the
+ * module data files beside them (`database/flows/`, `database/waitlist/`)
+ * are bundle output, never recorded.
+ */
+export const DATABASE_BOOT_FILES = [
+    "database/prisma.config.ts",
+    "database/seed.ts",
+    "database/seed-test.ts",
+];
+const DATABASE_BOOT_SET = new Set(DATABASE_BOOT_FILES);
+/**
+ * The root `tools/` files every app `jest.config.cjs` requires by its
+ * repo-relative path (#9654): the timezone pin (#8657) and the shared
+ * reporters (#9430) — `SNAPSHOT_FILES` in `scripts/build-templates.mjs`
+ * ships both at that path. Recorded and carried by `update` like an app
+ * file, so a merged config never names a file the site lacks.
+ */
+export const ROOT_TOOL_FILES = [
+    "tools/jest/pin-timezone.cjs",
+    "tools/jest/reporters.cjs",
+];
+const ROOT_TOOL_SET = new Set(ROOT_TOOL_FILES);
 /**
  * Whether a destination path (`/`-separated, as `templateDestination`
- * returns it) is one `update` ever records or touches (#8522 D2): under one
- * of the three app trees, not a `package.json`, not an `.env*` file, no
+ * returns it) is one `update` ever records or touches (#8522 D2): one of
+ * the three `DATABASE_BOOT_FILES` or the `ROOT_TOOL_FILES`, or under one of
+ * the three app trees, not a `package.json`, not an `.env*` file, no
  * `.claude` segment, and not a path a generator rewrites after the copy.
  */
 export function isRecordable(destRel) {
+    if (DATABASE_BOOT_SET.has(destRel) || ROOT_TOOL_SET.has(destRel))
+        return true;
     if (!RECORDABLE_APP_ROOT.test(destRel))
         return false;
     const segments = destRel.split("/");

package/dist/topology.d.ts

@@ -150,13 +150,26 @@ export declare function renderWebSeam(topology: Topology, signIn?: SignInMode, o
  * @throws TopologyError for a spoke in the default mode.
  */
 export declare function renderAuthedGateSeam(topology: Topology, signIn?: SignInMode): string;
+/** The hub seam's source of its workspace resolution and licence store (#9460 DD7). */
+export declare const MCP_SERVER_HUB = "@working-theory/mcp-server/hub";
 /** `apps/mcp/src/lib/topology.generated.ts` for `topology` (D5). */
 export declare function renderMcpSeam(topology: Topology): string;
 /** `apps/web/lib/api-origin.generated.ts` for `topology` (#7874 D12). */
 export declare function renderApiOriginSeam(topology: Topology): string;
-/** `pnpm-workspace.yaml` without its `database` package entry. */
-export declare function transformWorkspaceYaml(text: string): string;
-/** The root `package.json` without its `db:*` scripts. */
+/**
+ * The packages a hub's root `package.json` declares for its thin `database/`
+ * (#9569 DD3): the two the boot files import, and the three the `db:*`
+ * scripts run. `build-templates.mjs` writes them into the snapshot's root
+ * `devDependencies`; the spoke transform below strips the same five.
+ */
+export declare const DATABASE_CONSUMER_DEPENDENCIES: readonly string[];
+/**
+ * The root `package.json` without its `db:*` scripts and without the
+ * `DATABASE_CONSUMER_DEPENDENCIES` lines (#9569 DD6): a spoke has no
+ * `database/`, so it runs no database script and installs no Prisma.
+ * @throws TopologyError when the `scripts` block or the
+ *   `@working-theory/database` declaration is absent.
+ */
 export declare function transformRootPackageJson(text: string): string;
 /** The spoke's declared-env script (#7874 D11) — named apart from the monorepo's `env:check`. */
 export declare const ENV_DECLARED_SCRIPT = "env:declared";

package/dist/topology.js

@@ -67,9 +67,6 @@ export const SPOKE_REMOVAL_SEEDS = [
     "apps/web/app/api/auth",
     "apps/web/app/[locale]/(auth)",
     "apps/web/app/[locale]/(authed)",
-    "apps/mcp/src/lib/prisma.ts",
-    "apps/mcp/src/lib/public-workspace.ts",
-    "apps/mcp/src/lib/license-key-store.ts",
     ...SPOKE_HUB_CHECKOUT_SEEDS,
 ];
 /**
@@ -518,9 +515,11 @@ import { readLocales } from "${WEB_I18N_PACKAGE}";
 import { getTranslations } from "${NEXT_INTL_SERVER}";
 import type { ReactElement } from "${REACT_PACKAGE}";
 
+import { legalFootnote } from "../(auth)/legal-footnote";
 import { resolveSignInCardText } from "../(auth)/sign-in/sign-in-text";
 import { getActiveProviderIds } from "../../../lib/auth-env";
 import { isAccountPath } from "../../../lib/auth-routes";
+import { siteLogo } from "../../../lib/site-logo";
 
 import { SignInGate } from "./sign-in-gate";
 
@@ -542,9 +541,7 @@ export async function SignedOutGate({
     namespace: isAccount ? "account.gate" : "waitlistDashboard.gate",
   });
   const active = getActiveProviderIds();
-  const emailLink = active.includes("magic-link")
-    ? { text: await resolveSignInCardText(locale) }
-    : undefined;
+  const emailLink = active.includes("magic-link");
   const providers = active.filter((id): id is AuthPanelProvider =>
     (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
   );
@@ -578,6 +575,25 @@ export async function SignedOutGate({
     );
   }
 
+  // The sign-in card: with the email link on, and on the member gate, which
+  // also wears the one card's frame — the mark, the toggle line to /sign-up
+  // and the Terms + Privacy acknowledgement (#9662).
+  const text =
+    emailLink || isAccount ? await resolveSignInCardText(locale) : undefined;
+  const card = text
+    ? {
+        text,
+        emailLink,
+        ...(isAccount
+          ? {
+              logo: siteLogo(),
+              prospect: { ...text.prospect, href: localeHref(locale, "/sign-up") },
+              footnote: legalFootnote(locale, text.acknowledgement),
+            }
+          : {}),
+      }
+    : undefined;
+
   return (
     <SignInGate
       labels={{
@@ -587,7 +603,7 @@ export async function SignedOutGate({
       }}
       signInPath={signInPath}
       providers={providers}
-      {...(emailLink ? { emailLink } : {})}
+      {...(card ? { card } : {})}
     />
   );
 }
@@ -618,6 +634,8 @@ export function SignedOutGate({
  * create-ailk carries no runtime dependency.
  */
 const CONTENT_ADAPTERS_PACKAGE = "@working-theory/content-adapters";
+/** The hub seam's source of its workspace resolution and licence store (#9460 DD7). */
+export const MCP_SERVER_HUB = "@working-theory/mcp-server/hub";
 /** `apps/mcp/src/lib/topology.generated.ts` for `topology` (D5). */
 export function renderMcpSeam(topology) {
     if (topology === "hub") {
@@ -626,9 +644,9 @@ import {
   initMcpPublicWorkspace,
   mcpPublicWorkspace,
   type McpWorkspaceResolution,
-} from "./public-workspace.js";
+} from "${MCP_SERVER_HUB}";
 
-export { registerLicenseKeyStore } from "./license-key-store.js";
+export { registerLicenseKeyStore } from "${MCP_SERVER_HUB}";
 export type { McpWorkspaceResolution };
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
@@ -709,22 +727,37 @@ function dropLines(text, drop, label, json) {
     }
     return next;
 }
-/** `pnpm-workspace.yaml` without its `database` package entry. */
-export function transformWorkspaceYaml(text) {
-    const entry = /^\s*-\s*["']?database["']?\s*$/;
-    if (!text.split("\n").some((line) => entry.test(line))) {
-        throw new TopologyError(`pnpm-workspace.yaml: no "database" package entry to remove`);
-    }
-    return dropLines(text, (line) => entry.test(line), "pnpm-workspace.yaml", false);
-}
-/** The root `package.json` without its `db:*` scripts. */
+/**
+ * The packages a hub's root `package.json` declares for its thin `database/`
+ * (#9569 DD3): the two the boot files import, and the three the `db:*`
+ * scripts run. `build-templates.mjs` writes them into the snapshot's root
+ * `devDependencies`; the spoke transform below strips the same five.
+ */
+export const DATABASE_CONSUMER_DEPENDENCIES = [
+    "@working-theory/database",
+    "@working-theory/validation",
+    "@prisma/adapter-pg",
+    "prisma",
+    "dotenv",
+];
+/**
+ * The root `package.json` without its `db:*` scripts and without the
+ * `DATABASE_CONSUMER_DEPENDENCIES` lines (#9569 DD6): a spoke has no
+ * `database/`, so it runs no database script and installs no Prisma.
+ * @throws TopologyError when the `scripts` block or the
+ *   `@working-theory/database` declaration is absent.
+ */
 export function transformRootPackageJson(text) {
     const pkg = JSON.parse(text);
     if (pkg.scripts === undefined) {
         throw new TopologyError(`package.json: no "scripts" block to remove the db:* scripts from`);
     }
     const scriptLine = /^\s*"db:[^"]*"\s*:/;
-    return dropLines(text, (line) => scriptLine.test(line), "package.json", true);
+    const depLine = new RegExp(`^\\s*"(${DATABASE_CONSUMER_DEPENDENCIES.map((name) => name.replace(/[/@.]/g, "\\$&")).join("|")})"\\s*:`);
+    if (!text.split("\n").some((line) => /^\s*"@working-theory\/database"\s*:/.test(line))) {
+        throw new TopologyError(`package.json: no "@working-theory/database" dependency to remove`);
+    }
+    return dropLines(text, (line) => scriptLine.test(line) || depLine.test(line), "package.json", true);
 }
 /** The spoke's declared-env script (#7874 D11) — named apart from the monorepo's `env:check`. */
 export const ENV_DECLARED_SCRIPT = "env:declared";
@@ -825,7 +858,6 @@ export function applySpokeTransforms(targetDir, opts) {
         if (next !== text)
             writeFileSync(path, next);
     };
-    edit("pnpm-workspace.yaml", transformWorkspaceYaml);
     edit("package.json", (text) => addEnvCheckScripts(transformRootPackageJson(text)));
     edit(".github/workflows/ci.yml", transformCiWorkflow);
     edit("tsconfig.json", (text) => transformRootTsconfig(text, opts));
@@ -937,9 +969,8 @@ export function renderSpokeHardFloors(opts) {
             ? "    reason: sign-in paths — this spoke signs in through its hub; every change requires human review"
             : "    reason: sign-in paths — absent on a spoke; their return requires human review",
     ];
-    if (opts.mcp) {
-        lines.push("  - paths:", '      - "apps/mcp/src/tools/**"', "    reason: MCP tool surface — signatures require human review");
-    }
+    // No MCP tool floor (#9567): a spoke's `apps/mcp/src` is the boot set, and
+    // the tool surface lives in `@working-theory/mcp-server`.
     return `${lines.join("\n")}\n`;
 }
 /** `project.yaml` with its `hard_floors:` block replaced by the spoke's (D9). */