create-ailk 0.25.1 → 0.27.0

package/README.md

@@ -18,15 +18,17 @@ Compose the site from modules with `--modules`. The recognized vocabulary is
 `multi-tenant`, `workspace`, `scheduling`, `signal-collectors`, `commerce` —
 and `--modules` TRIMS or ADDS relative to the level your licence key unlocks
 (#6759), never replaces it: Free is `marketing` alone; a Pro key switches
-on `docs-blog`, `scheduling` and `signal-collectors` too; Pro Plus adds
+on `docs-blog`, `workspace` (the `/admin` settings surface, #9696),
+`scheduling` and `signal-collectors` too; Pro Plus adds
 `multi-tenant`. A run with no key is a Free run, and Free is held for now
 (`release-scope.json` marks `levels.free` `deferred`, #6484): the CLI refuses
 it before its first write, naming `https://ailaunchkit.ai/pricing` and the
 two ways to pass a key (`--license <key>` or `AILK_LICENSE_KEY`). The Free
 template and level stay defined; only the keyless path is held. Naming modules here
 keeps exactly those, trimming the level's default; naming only `commerce`
-(a per-site add-on) or `workspace` (included at Pro, opt-in) adds it on top
-of the level's default without trimming. The level is always DERIVED from
+(a per-site add-on) adds it on top of the level's default without trimming,
+and naming only `workspace` is a no-op at Pro and Pro Plus, whose defaults already
+carry it (below Pro it is refused, naming Pro). The level is always DERIVED from
 what the module registry answers for your key — never read from a flag, a
 manifest or a key claim (`src/lib/module-tier.ts` `LEVEL_MODULES`,
 `src/lib/module-license-gate.ts` `deriveLevel`):
@@ -76,6 +78,13 @@ AILK_LICENSE_KEY=<key> create-ailk add-module docs-blog
 AILK_LICENSE_KEY=<key> create-ailk upgrade docs-blog ./my-site
 ```
 
+A Pro site scaffolded before a Pro key switched on `workspace` (#9696) has no
+`/admin`. This is how it gains the owner's settings surface:
+
+```bash
+AILK_LICENSE_KEY=<key> create-ailk add-module workspace
+```
+
 It fetches the module's bundle through the same licence gate a scaffold uses
 (no key, or a key that does not cover the module, is refused with the same
 message, before anything is written) and merges it **without overwriting
@@ -236,8 +245,8 @@ present, and this is the sign-in/account shell" from "always present, and
 this is the marketing core." A gateable surface's routes (`blog`, `docs`,
 `flows`, …) are checked only when the site carries that surface; a surface
 gated off at scaffold time is listed as skipped, not missing — its absence is
-deliberate, not drift. Add a surface with `--sync-architecture` and the
-`add-page` skill, not with `sync-routes`.
+deliberate, not drift. Add a surface with `--sync-architecture` and
+`/ailk:growth-ops page add`, not with `sync-routes`.
 
 **The local-module dependency contract (#5014, #9406).** Some routes import
 files OUTSIDE their own route directory — `purchase/success/page.tsx` imports

package/dist/lib/fetch-template-snapshot.d.ts

@@ -12,7 +12,8 @@ export interface FetchTemplateSnapshotOptions {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree, plus its `templates/database/` boot files, from its published npm tarball.
+ * tree, plus its `templates/database/` boot files and root `templates/tools/`
+ * files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/fetch-template-snapshot.js

@@ -21,7 +21,7 @@ import { createHash } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 import * as tar from "tar";
 import { templateDestination } from "../copy.js";
-import { DATABASE_BOOT_FILES } from "../template-record.js";
+import { DATABASE_BOOT_FILES, ROOT_TOOL_FILES } from "../template-record.js";
 import { MAX_TOTAL_SIZE_BYTES } from "./extract-module-bundle.js";
 import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
 export const DEFAULT_AILK_NPM_REGISTRY_URL = "https://registry.npmjs.org";
@@ -30,8 +30,8 @@ const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
 /** The one tar path prefix a snapshot is read from, and the three app roots inside it. */
 const TAR_ROOT = "package/templates/";
 const APP_PREFIXES = ["apps/web/", "apps/api/", "apps/mcp/"];
-/** The paths outside the app roots a snapshot keeps: a hub's three database boot files (#9569 DD8). */
-const BOOT_FILES = new Set(DATABASE_BOOT_FILES);
+/** The paths outside the app roots a snapshot keeps: a hub's three database boot files (#9569 DD8) and the root tools/ files the app configs require (#9654). */
+const BOOT_FILES = new Set([...DATABASE_BOOT_FILES, ...ROOT_TOOL_FILES]);
 export class FetchTemplateSnapshotError extends Error {
     constructor(message) {
         super(message);
@@ -113,7 +113,7 @@ async function fetchTarball(tarballUrl, integrity, version, fetchImpl) {
     }
     return buf;
 }
-/** The template-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees and the database boot files. */
+/** The template-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees, the database boot files and the root tools/ files. */
 function appRelativePath(tarPath) {
     if (!tarPath.startsWith(TAR_ROOT))
         return undefined;
@@ -180,7 +180,8 @@ function parseSnapshot(gunzipped, version) {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree, plus its `templates/database/` boot files, from its published npm tarball.
+ * tree, plus its `templates/database/` boot files and root `templates/tools/`
+ * files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/module-license-gate.js

@@ -29,7 +29,7 @@
 import releaseScopeJson from "../../release-scope.json" with { type: "json" };
 import { FetchModuleError, fetchModule } from "./fetch-module.js";
 import { assertLicenseKeyShape } from "./license-key-files.js";
-import { ADD_ONS, LEVEL_LABEL, LEVEL_MODULES, OPT_IN_MODULES, PAID_MODULES, classifyModules, composeModuleSet, levelOf, } from "./module-tier.js";
+import { LEVEL_LABEL, LEVEL_MODULES, PAID_MODULES, classifyModules, composeModuleSet, isAddition, levelOf, } from "./module-tier.js";
 /**
  * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
  * `/pro` route and there will not be one (#6439, operator decision OD-2) —
@@ -346,8 +346,7 @@ export async function deriveDesignLevel(options) {
  */
 export async function resolveModuleSet(options) {
     const namedList = options.named ?? [];
-    const additions = [...ADD_ONS, ...OPT_IN_MODULES];
-    const isKeep = namedList.some((m) => !additions.includes(m));
+    const isKeep = namedList.some((m) => !isAddition(m));
     if (isKeep) {
         const modules = composeModuleSet(namedList, "free");
         const { paid } = classifyModules(modules);

package/dist/lib/module-tier.d.ts

@@ -23,13 +23,6 @@ export declare const LEVEL_LABEL: Readonly<Record<Level, string>>;
  * an add-on ON TOP of.
  */
 export declare const ADD_ONS: readonly ModuleName[];
-/**
- * Included at Pro and above (the licence manifest's `pro` tier), but not
- * switched on by default at any level (D1) — an authed app surface
- * contributing no PUBLIC page to a marketing site. Naming it in `--modules`
- * adds it without trimming, exactly like an add-on.
- */
-export declare const OPT_IN_MODULES: readonly ModuleName[];
 /** Whether naming `m` in `--modules` adds it without trimming the level default. */
 export declare function isAddition(m: ModuleName): boolean;
 /**
@@ -42,7 +35,8 @@ export declare const LEVEL_MODULES: Readonly<Record<Level, readonly ModuleName[]
 /**
  * Which level (or add-on status) a module belongs to (D2). `"free"` for
  * `FREE_MODULES`, `"add-on"` for `ADD_ONS`, `"pro-plus"` for
- * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — D1). Pure.
+ * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — in the Pro default
+ * since #9696, the DECISION-LOG row in salessmyth/ailaunchkit-site#134). Pure.
  */
 export declare function levelOf(m: ModuleName): Level | "add-on";
 /**

package/dist/lib/module-tier.js

@@ -43,22 +43,22 @@ export const LEVEL_LABEL = {
  * an add-on ON TOP of.
  */
 export const ADD_ONS = ["commerce"];
-/**
- * Included at Pro and above (the licence manifest's `pro` tier), but not
- * switched on by default at any level (D1) — an authed app surface
- * contributing no PUBLIC page to a marketing site. Naming it in `--modules`
- * adds it without trimming, exactly like an add-on.
- */
-export const OPT_IN_MODULES = ["workspace"];
 /** The Pro Plus membership: what Pro Plus switches on beyond Pro. */
 const PRO_PLUS_MODULES = ["multi-tenant"];
-/** Named modules that never trim the level default when composing a set (D2). */
-const ADDITIONS = [...ADD_ONS, ...OPT_IN_MODULES];
+/**
+ * Named modules that never trim the level default when composing a set (D2):
+ * the add-ons, and `workspace` — the authed /admin surface, which contributes
+ * no PUBLIC page. Since #9696 (reversing #6759 D1; the DECISION-LOG row dated
+ * 2026-10-24, salessmyth/ailaunchkit-site#134) `workspace` is IN the Pro and
+ * Pro Plus defaults, so naming it is a no-op there; below Pro it adds it, and
+ * the gate refuses it naming Pro.
+ */
+const ADDITIONS = [...ADD_ONS, "workspace"];
 /** Whether naming `m` in `--modules` adds it without trimming the level default. */
 export function isAddition(m) {
     return ADDITIONS.includes(m);
 }
-const PRO_EXCLUDED = new Set([...ADDITIONS, ...PRO_PLUS_MODULES]);
+const PRO_EXCLUDED = new Set([...ADD_ONS, ...PRO_PLUS_MODULES]);
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —
  * every list is `RECOGNIZED_MODULES.filter(...)`, so declaration order is
@@ -70,12 +70,13 @@ export const LEVEL_MODULES = Object.freeze({
     pro: RECOGNIZED_MODULES.filter((m) => FREE_MODULES.includes(m) ||
         (PAID_MODULES.includes(m) && !PRO_EXCLUDED.has(m))),
     "pro-plus": RECOGNIZED_MODULES.filter((m) => FREE_MODULES.includes(m) ||
-        (PAID_MODULES.includes(m) && !ADDITIONS.includes(m))),
+        (PAID_MODULES.includes(m) && !ADD_ONS.includes(m))),
 });
 /**
  * Which level (or add-on status) a module belongs to (D2). `"free"` for
  * `FREE_MODULES`, `"add-on"` for `ADD_ONS`, `"pro-plus"` for
- * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — D1). Pure.
+ * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — in the Pro default
+ * since #9696, the DECISION-LOG row in salessmyth/ailaunchkit-site#134). Pure.
  */
 export function levelOf(m) {
     if (FREE_MODULES.includes(m))

package/dist/module-architecture.js

@@ -794,7 +794,7 @@ export const MODULE_SLICES = {
         webImports: [WEB_AUTH_ADAPTER_IMPORT, "packages/admin-ui"],
         packages: {
             "admin-ui": {
-                description: "Shared Admin-settings components — the settings shell plus the General / Site / Team panels, presentational only (data + save callbacks as props)",
+                description: "Shared Admin components — the settings shell plus the General / Site / Team panels, and the Magnets (flow wizard, flow list) and Meetings (meeting types, meeting detail) screens, presentational only (data + save callbacks as props)",
                 // packages/templates is required because AdminSettingsShell
                 // composes AppShell from @working-theory/templates/shells — the same
                 // composition apps/web's own account page uses.
@@ -807,7 +807,7 @@ export const MODULE_SLICES = {
             },
         },
         // SOURCE files only, and only the ones this module physically owns: the
-        // three apps/web route files and the two apps/api route files.
+        // apps/web /admin route files and the two modules they share.
         //
         // `packages/admin-ui/**` is deliberately NOT listed (D1a). It is a
         // whole package that is paid end to end, whose strip disposition is
@@ -832,6 +832,18 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/admin/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/site/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/team/page.tsx",
+            // #9746 D10 — the shared nav, the client bindings, and the Magnets and
+            // Meetings tabs. Not routes themselves (the first two), but owned the
+            // same way: a keyless scaffold drops them with the pages that import
+            // them.
+            "apps/web/app/[locale]/(authed)/admin/admin-nav.ts",
+            "apps/web/app/[locale]/(authed)/admin/admin-panels.tsx",
+            "apps/web/app/[locale]/(authed)/admin/magnets/page.tsx",
+            "apps/web/app/[locale]/(authed)/admin/magnets/new/[kind]/page.tsx",
+            "apps/web/app/[locale]/(authed)/admin/meetings/page.tsx",
+            "apps/web/app/[locale]/(authed)/admin/meetings/[slug]/page.tsx",
+            // #9851 — the Integrations tab.
+            "apps/web/app/[locale]/(authed)/admin/integrations/page.tsx",
         ],
         // patches — the dependency add that delivers the shared package to the
         // buyer's apps/web, mirroring docs-blog's own fumadocs-schema merge-keys

package/dist/starter-grid.d.ts

@@ -83,10 +83,10 @@ export declare const SHAPE_ROSTERS: Readonly<Record<BuildableShape, readonly Tem
  * in the declaration order both keep. The plain name is the Pro one: it is
  * the flagship and the demo (Sam, 2026-09-14, parent § D12).
  *
- * `workspace` appears in no module list. It is a Pro module, but an authed app
- * surface contributing no PUBLIC page to a marketing site, and `modules` names
- * what the roster uses (parent § D15). A Pro key unlocks it regardless of any
- * template.
+ * Both paid aliases carry `workspace` because a Pro or Pro Plus key switches
+ * it on (#9696, reversing parent § D15), and a template's `requires` is what
+ * the alias path fetches, since it derives no level. It is an authed app
+ * surface, so it contributes no PUBLIC row to either roster.
  *
  * `commerce` is a per-site add-on available at any level, so no alias exists
  * FOR it (parent § D13); it still contributes rows to whichever alias takes
@@ -120,7 +120,7 @@ export declare const ALIASES: Readonly<{
     readonly "marketing-site": {
         readonly shape: "organization-product";
         readonly design: "standard";
-        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors"];
+        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "workspace"];
         readonly categories: readonly ["accounting", "legal", "consulting", "hvac", "roofing", "plumbing", "electrical", "landscaping", "auto-repair", "real-estate", "technology", "medical-specialty"];
         readonly differences: {
             readonly drop: readonly ["/blog", "/meet", "/meet/[slug]"];
@@ -140,7 +140,7 @@ export declare const ALIASES: Readonly<{
     readonly "saas-product": {
         readonly shape: "organization-product";
         readonly design: "standard";
-        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "multi-tenant"];
+        readonly modules: readonly ["marketing", "docs-blog", "scheduling", "signal-collectors", "workspace", "multi-tenant"];
         readonly categories: readonly ["technology", "medical-specialty"];
         readonly differences: {
             readonly drop: readonly ["/blog", "/meet", "/meet/[slug]"];

package/dist/starter-grid.js

@@ -372,10 +372,10 @@ export const SHAPE_ROSTERS = Object.freeze({
  * in the declaration order both keep. The plain name is the Pro one: it is
  * the flagship and the demo (Sam, 2026-09-14, parent § D12).
  *
- * `workspace` appears in no module list. It is a Pro module, but an authed app
- * surface contributing no PUBLIC page to a marketing site, and `modules` names
- * what the roster uses (parent § D15). A Pro key unlocks it regardless of any
- * template.
+ * Both paid aliases carry `workspace` because a Pro or Pro Plus key switches
+ * it on (#9696, reversing parent § D15), and a template's `requires` is what
+ * the alias path fetches, since it derives no level. It is an authed app
+ * surface, so it contributes no PUBLIC row to either roster.
  *
  * `commerce` is a per-site add-on available at any level, so no alias exists
  * FOR it (parent § D13); it still contributes rows to whichever alias takes
@@ -415,7 +415,13 @@ export const ALIASES = Object.freeze({
     "marketing-site": {
         shape: "organization-product",
         design: "standard",
-        modules: ["marketing", "docs-blog", "scheduling", "signal-collectors"],
+        modules: [
+            "marketing",
+            "docs-blog",
+            "scheduling",
+            "signal-collectors",
+            "workspace",
+        ],
         // The flagship is the general-purpose template: it carries the whole
         // registry, so every group tile on the hub has at least one template.
         categories: [
@@ -455,6 +461,7 @@ export const ALIASES = Object.freeze({
             "docs-blog",
             "scheduling",
             "signal-collectors",
+            "workspace",
             "multi-tenant",
         ],
         categories: ["technology", "medical-specialty"],

package/dist/surfaces.js

@@ -20,7 +20,7 @@
  *
  * The default (`--modules marketing`) enables NO gateable surface: every one of
  * them is a claim about the business that the scaffolder cannot make. The path
- * from there is the `/ailk:add-page` skill in the `ailk` Claude Code plugin.
+ * from there is `/ailk:growth-ops page add`, from the `ailk` Claude Code plugin.
  *
  * Zero runtime dependencies — create-ailk is a published, standalone CLI.
  *
@@ -725,6 +725,14 @@ export const ROUTE_SINCE = {
     "(authed)/admin": "0.22.1",
     "(authed)/admin/site": "0.22.1",
     "(authed)/admin/team": "0.22.1",
+    // #9746 D10 — the Magnets and Meetings tabs. Genuinely new route
+    // directories, so they attach at today's fixed-group version.
+    "(authed)/admin/magnets": "0.46.0",
+    "(authed)/admin/magnets/new/[kind]": "0.46.0",
+    "(authed)/admin/meetings": "0.46.0",
+    "(authed)/admin/meetings/[slug]": "0.46.0",
+    // #9851 D7 — the Integrations tab, attached at today's fixed-group version.
+    "(authed)/admin/integrations": "0.48.0",
     // #5977 — the Pro content host's editor routes (spec 5872 FR1/FR2), added
     // to apps/web by #5957. Genuinely new route directories, so they attach at
     // today's fixed-group version, the same "attach at today's version" rule
@@ -785,6 +793,13 @@ export function surfaceForRouteDir(routeDir) {
         return "core";
     return GATEABLE_SURFACES.find((s) => s.routes.includes(top))?.id;
 }
+/** #9746 D10 — what each Magnets and Meetings tab page imports beside itself. */
+const ADMIN_PANEL_ROUTE_DEPENDENCIES = [
+    "apps/web/lib/server-api.ts",
+    `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+    `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
+    `${ROUTE_ROOT}/(authed)/admin/admin-panels.tsx`,
+];
 /**
  * Non-route consumer-side files a route's own source imports, that a sync
  * must ALSO bring along so `--apply` never leaves a route that cannot
@@ -964,6 +979,8 @@ export const ROUTE_DEPENDENCIES = {
     ],
     "(authed)/account/billing": [
         "apps/web/lib/account-config.ts",
+        // #9401 D7 — the site's own Billing sections, the frozen stub the page imports.
+        "apps/web/lib/site-contributions.ts",
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
         `${ROUTE_ROOT}/(authed)/account/actions.ts`,
@@ -1034,6 +1051,8 @@ export const ROUTE_DEPENDENCIES = {
     "(authed)/admin": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        // #9746 D8 — the shared nav every /admin tab imports.
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
     "(authed)/leads": ["apps/web/lib/server-api.ts"],
     // #5977 — the editor routes' own imports, read from their sources: both
@@ -1053,11 +1072,21 @@ export const ROUTE_DEPENDENCIES = {
     "(authed)/admin/site": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
     "(authed)/admin/team": [
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
+        `${ROUTE_ROOT}/(authed)/admin/admin-nav.ts`,
     ],
+    // #9746 D10 — the Magnets and Meetings tabs: the nav plus the client
+    // bindings of the shared admin-ui components.
+    "(authed)/admin/magnets": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/magnets/new/[kind]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/meetings": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    "(authed)/admin/meetings/[slug]": ADMIN_PANEL_ROUTE_DEPENDENCIES,
+    // #9851 D7 — the Integrations tab: the nav plus the Slack bindings.
+    "(authed)/admin/integrations": ADMIN_PANEL_ROUTE_DEPENDENCIES,
     "(authed)/waitlist": ["apps/web/lib/server-api.ts"],
     // #8843 D6 — the booking pages share one builder over the meetings read;
     // `/private` returns the index frame that lives under `meet/`.
@@ -1115,6 +1144,11 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/edit/[type]/[slug]": ["edit"],
     "(authed)/admin/site": ["admin"],
     "(authed)/admin/team": ["admin"],
+    "(authed)/admin/magnets": ["admin"],
+    "(authed)/admin/magnets/new/[kind]": ["admin"],
+    "(authed)/admin/meetings": ["admin"],
+    "(authed)/admin/meetings/[slug]": ["admin"],
+    "(authed)/admin/integrations": ["admin"],
     "(authed)/waitlist": ["waitlistDashboard.gate"],
     // #7744 — the /team hub's empty state reads the `team` namespace.
     team: ["team"],
@@ -1386,7 +1420,7 @@ export function renderNavConfig(enabled, options) {
 // below it, the nav is yours and add-module reports the change it wanted
 // instead.
 //
-// Adding a link: scaffold the page (the \`/ailk:add-page\` skill), then add an
+// Adding a link: scaffold the page (\`/ailk:growth-ops page add\`), then add an
 // entry below with a \`labelKey\` that exists in the \`nav\` namespace of
 // \`apps/web/messages/<locale>.json\`. Paths are locale-agnostic — Nav prefixes
 // them with the active locale at render.

package/dist/template-record.d.ts

@@ -18,12 +18,20 @@ export declare const REGENERATED_APP_PATHS: readonly string[];
  * are bundle output, never recorded.
  */
 export declare const DATABASE_BOOT_FILES: readonly string[];
+/**
+ * The root `tools/` files every app `jest.config.cjs` requires by its
+ * repo-relative path (#9654): the timezone pin (#8657) and the shared
+ * reporters (#9430) — `SNAPSHOT_FILES` in `scripts/build-templates.mjs`
+ * ships both at that path. Recorded and carried by `update` like an app
+ * file, so a merged config never names a file the site lacks.
+ */
+export declare const ROOT_TOOL_FILES: readonly string[];
 /**
  * Whether a destination path (`/`-separated, as `templateDestination`
  * returns it) is one `update` ever records or touches (#8522 D2): one of
- * the three `DATABASE_BOOT_FILES`, or under one of the three app trees, not
- * a `package.json`, not an `.env*` file, no `.claude` segment, and not a
- * path a generator rewrites after the copy.
+ * the three `DATABASE_BOOT_FILES` or the `ROOT_TOOL_FILES`, or under one of
+ * the three app trees, not a `package.json`, not an `.env*` file, no
+ * `.claude` segment, and not a path a generator rewrites after the copy.
  */
 export declare function isRecordable(destRel: string): boolean;
 /** The hex sha256 digest of `bytes` — the one hash every record row uses. */

package/dist/template-record.js

@@ -4,9 +4,10 @@
  *
  * Written beside `.ailk-site-manifest.json` at the site root, it lists every
  * `apps/web/`, `apps/api/` and `apps/mcp/` file the base `templates/` copy
- * wrote and no later layer rewrote, with the sha256 of the template's copy
- * of that file and the create-ailk version it came from. `create-ailk
- * update` (`update.ts`) reads it to tell an untouched copy from an owner's
+ * wrote and no later layer rewrote — and the few files outside them the
+ * record also carries (`DATABASE_BOOT_FILES`, `ROOT_TOOL_FILES`) — with the
+ * sha256 of the template's copy of that file and the create-ailk version it
+ * came from. `create-ailk update` (`update.ts`) reads it to tell an untouched copy from an owner's
  * edit; `scaffold()` (`programmatic.ts`) writes it, as its last write, from
  * the `onWrite` hook `copyTemplate` (`copy.ts`) calls once per file.
  *
@@ -60,15 +61,27 @@ export const DATABASE_BOOT_FILES = [
     "database/seed-test.ts",
 ];
 const DATABASE_BOOT_SET = new Set(DATABASE_BOOT_FILES);
+/**
+ * The root `tools/` files every app `jest.config.cjs` requires by its
+ * repo-relative path (#9654): the timezone pin (#8657) and the shared
+ * reporters (#9430) — `SNAPSHOT_FILES` in `scripts/build-templates.mjs`
+ * ships both at that path. Recorded and carried by `update` like an app
+ * file, so a merged config never names a file the site lacks.
+ */
+export const ROOT_TOOL_FILES = [
+    "tools/jest/pin-timezone.cjs",
+    "tools/jest/reporters.cjs",
+];
+const ROOT_TOOL_SET = new Set(ROOT_TOOL_FILES);
 /**
  * Whether a destination path (`/`-separated, as `templateDestination`
  * returns it) is one `update` ever records or touches (#8522 D2): one of
- * the three `DATABASE_BOOT_FILES`, or under one of the three app trees, not
- * a `package.json`, not an `.env*` file, no `.claude` segment, and not a
- * path a generator rewrites after the copy.
+ * the three `DATABASE_BOOT_FILES` or the `ROOT_TOOL_FILES`, or under one of
+ * the three app trees, not a `package.json`, not an `.env*` file, no
+ * `.claude` segment, and not a path a generator rewrites after the copy.
  */
 export function isRecordable(destRel) {
-    if (DATABASE_BOOT_SET.has(destRel))
+    if (DATABASE_BOOT_SET.has(destRel) || ROOT_TOOL_SET.has(destRel))
         return true;
     if (!RECORDABLE_APP_ROOT.test(destRel))
         return false;

package/dist/topology.js

@@ -515,9 +515,11 @@ import { readLocales } from "${WEB_I18N_PACKAGE}";
 import { getTranslations } from "${NEXT_INTL_SERVER}";
 import type { ReactElement } from "${REACT_PACKAGE}";
 
+import { legalFootnote } from "../(auth)/legal-footnote";
 import { resolveSignInCardText } from "../(auth)/sign-in/sign-in-text";
 import { getActiveProviderIds } from "../../../lib/auth-env";
 import { isAccountPath } from "../../../lib/auth-routes";
+import { siteLogo } from "../../../lib/site-logo";
 
 import { SignInGate } from "./sign-in-gate";
 
@@ -539,9 +541,7 @@ export async function SignedOutGate({
     namespace: isAccount ? "account.gate" : "waitlistDashboard.gate",
   });
   const active = getActiveProviderIds();
-  const emailLink = active.includes("magic-link")
-    ? { text: await resolveSignInCardText(locale) }
-    : undefined;
+  const emailLink = active.includes("magic-link");
   const providers = active.filter((id): id is AuthPanelProvider =>
     (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
   );
@@ -575,6 +575,25 @@ export async function SignedOutGate({
     );
   }
 
+  // The sign-in card: with the email link on, and on the member gate, which
+  // also wears the one card's frame — the mark, the toggle line to /sign-up
+  // and the Terms + Privacy acknowledgement (#9662).
+  const text =
+    emailLink || isAccount ? await resolveSignInCardText(locale) : undefined;
+  const card = text
+    ? {
+        text,
+        emailLink,
+        ...(isAccount
+          ? {
+              logo: siteLogo(),
+              prospect: { ...text.prospect, href: localeHref(locale, "/sign-up") },
+              footnote: legalFootnote(locale, text.acknowledgement),
+            }
+          : {}),
+      }
+    : undefined;
+
   return (
     <SignInGate
       labels={{
@@ -584,7 +603,7 @@ export async function SignedOutGate({
       }}
       signInPath={signInPath}
       providers={providers}
-      {...(emailLink ? { emailLink } : {})}
+      {...(card ? { card } : {})}
     />
   );
 }

package/dist/update.d.ts

@@ -57,6 +57,6 @@ export interface UpdateArgs {
     target: string | undefined;
     help: boolean;
 }
-export declare const UPDATE_HELP = "create-ailk update \u2014 bring template fixes into a site's copied app code.\n\nUsage:\n  create-ailk update [<target-dir>]\n\nArguments:\n  <target-dir>             The existing site. Defaults to the current dir.\n\nOptions:\n  --help, -h               Print this message.\n\nReads .ailk-template-files.json (written beside .ailk-site-manifest.json by\nevery template scaffold) to tell an untouched copy from an edit. An\nuntouched apps/web, apps/api or apps/mcp file whose template copy changed is\noverwritten. An edited file whose template copy also changed is three-way\nmerged with `git` (git must be on PATH); a conflict leaves the file alone\nand is listed under \"Needs review\". Every template test that imports a file\nleft under \"Needs review\" or \"Skipped\" (by a relative import) is held at the\nsite's version with it, its record entry is not advanced, and it is listed\nunder \"Held back with <file>\" \u2014 reconcile the file, then run update again to\nbring its tests forward. Every other file in the run still updates.\nA site with no record gets one on its first run, from the version its\n.ailk-site-manifest.json already records. A site scaffolded before\n@working-theory/mcp-server has its copied apps/mcp moved to the boot set:\nthe server and each module's paid MCP pack join apps/mcp/package.json, the\ncopied server files go, and apps/mcp/src/lib/paid-tools.generated.ts is\nrewritten on every run. A site scaffolded before @working-theory/api has its\ncopied apps/api moved to the boot file: the app becomes @working-theory/app-api,\nthe package and the six @working-theory/api-<module> packages join\napps/api/package.json, its bins and build:vercel delegate to the package, and\nthe copied server files go. Run `pnpm install` after either move, since the\napp's package.json gained dependencies. Commit before running, and review the\ndiff after.\n";
+export declare const UPDATE_HELP = "create-ailk update \u2014 bring template fixes into a site's copied app code.\n\nUsage:\n  create-ailk update [<target-dir>]\n\nArguments:\n  <target-dir>             The existing site. Defaults to the current dir.\n\nOptions:\n  --help, -h               Print this message.\n\nReads .ailk-template-files.json (written beside .ailk-site-manifest.json by\nevery template scaffold) to tell an untouched copy from an edit. An\nuntouched apps/web, apps/api or apps/mcp file, or a root tools/jest file the\napp jest configs require, whose template copy changed is overwritten. An\nedited file whose template copy also changed is three-way merged with\n`git` (git must be on PATH); a conflict leaves the file alone and is\nlisted under \"Needs review\". Every template test that imports a file\nleft under \"Needs review\" or \"Skipped\" (by a relative import) is held at the\nsite's version with it, its record entry is not advanced, and it is listed\nunder \"Held back with <file>\" \u2014 reconcile the file, then run update again to\nbring its tests forward. Every other file in the run still updates.\nA site with no record gets one on its first run, from the version its\n.ailk-site-manifest.json already records. A site scaffolded before\n@working-theory/mcp-server has its copied apps/mcp moved to the boot set:\nthe server and each module's paid MCP pack join apps/mcp/package.json, the\ncopied server files go, and apps/mcp/src/lib/paid-tools.generated.ts is\nrewritten on every run. A site scaffolded before @working-theory/api has its\ncopied apps/api moved to the boot file: the app becomes @working-theory/app-api,\nthe package and the six @working-theory/api-<module> packages join\napps/api/package.json, its bins and build:vercel delegate to the package, and\nthe copied server files go. Run `pnpm install` after either move, since the\napp's package.json gained dependencies. Commit before running, and review the\ndiff after.\n";
 /** Parse the argv AFTER the `update` word. Strict `node:util` parseArgs, like `parseAdoptArgs`. */
 export declare function parseUpdateArgs(argv: string[]): UpdateArgs;