create-ailk 0.27.0 → 0.28.0

package/dist/seed-flows.js

@@ -12,8 +12,10 @@
  * In order (D7): the site must be a spoke; every `flows/*.json` must parse
  * and carry a `slug` equal to its file name; `--dry-run` stops there; the hub
  * origin comes from `--hub-url`, else the `AILK_API_URL` environment
- * variable, else the `AILK_API_URL=` line of `apps/web/.env.local`, and must
- * be `https:` (or `http:` on a loopback host); the key comes from the
+ * variable, else (for `--dry-run` only) the `AILK_API_URL=` line of
+ * `apps/web/.env.local`, and must be `https:` (or `http:` on a loopback
+ * host); a send whose origin only that file names is refused, because a
+ * repo file never decides where the key goes (#9969 D8); the key comes from the
  * `AILK_SPOKE_KEY` environment variable and nowhere else. Every refusal is
  * thrown before the first request. The hub origin and its source are printed
  * before any request, so where the key goes is visible before it is sent.
@@ -256,6 +258,9 @@ export async function seedFlows(opts) {
         return { ...(hub !== undefined && { hub }), flows: outcomes, exitCode: 0 };
     }
     const hub = resolveHub(targetDir, opts.hubUrl, env);
+    if (hub.source === "apps/web/.env.local") {
+        throw new SeedFlowsRefusedError(`seed-flows: the hub origin ${hub.origin} was read from apps/web/.env.local. Confirm it with --hub-url ${hub.origin} (or set ${HUB_ORIGIN_ENV_VAR}) — the spoke key is sent only to an origin you name. Nothing was sent.`);
+    }
     const key = env[SPOKE_KEY_ENV_VAR]?.trim() ?? "";
     if (key === "") {
         throw new SeedFlowsRefusedError(`seed-flows: set ${SPOKE_KEY_ENV_VAR} to the spoke key your hub issued. It is read from the environment only — never a flag or a file. Nothing was sent.`);
@@ -297,11 +302,12 @@ Run this as part of each rollout, from the site's root, with the spoke key
 your hub issued set as \`AILK_SPOKE_KEY\` in the environment (a shell or CI
 secret — never a file in this repo):
 
-    npx create-ailk seed-flows .
+    npx create-ailk seed-flows . --hub-url <the hub's origin>
 
-The hub origin comes from \`--hub-url\`, else \`AILK_API_URL\`, else the
-\`AILK_API_URL=\` line of \`apps/web/.env.local\`. The key is read from the
-environment only. Each flow answers \`created\`, \`updated\` or \`unchanged\`,
+The hub origin comes from \`--hub-url\`, else \`AILK_API_URL\`; the
+\`AILK_API_URL=\` line of \`apps/web/.env.local\` is read for \`--dry-run\`
+only, and a send whose origin only that file names is refused. The key is
+read from the environment only. Each flow answers \`created\`, \`updated\` or \`unchanged\`,
 so running it again is safe. \`--dry-run\` checks the files and sends nothing.
 
 The hub's operator must first turn seeding on (\`AILK_SPOKE_FLOW_SEED=true\`
@@ -360,9 +366,10 @@ Arguments:
   <dir>                The spoke site. Defaults to the current dir.
 
 Options:
-  --hub-url <origin>   The hub's origin. Else AILK_API_URL, else the
-                       AILK_API_URL= line of apps/web/.env.local. https:
-                       only (http: on localhost or 127.0.0.1).
+  --hub-url <origin>   The hub's origin. Else AILK_API_URL. The
+                       AILK_API_URL= line of apps/web/.env.local is read
+                       for --dry-run only. https: only (http: on
+                       localhost or 127.0.0.1).
   --dry-run            Check every flows/*.json and print what would be sent.
                        Sends nothing and reads no key.
   -h, --help           Show this help.

package/dist/site-roster.js

@@ -31,6 +31,7 @@ import { AddModuleRefusedError, readArchitectureHeader, } from "./add-module-cor
 import { DESIGN_SEED_PAGES } from "./design-home.js";
 import { locatePageSections } from "./design-presets.js";
 import { diffTwoStrings } from "./lib/extract-module-bundle.js";
+import { publicTreeRemoved } from "./lib/site-modules.js";
 import { MODULE_SLICES, normalizeModules, } from "./module-architecture.js";
 import { substituteMarkers } from "./substitute.js";
 import { isUnservedSurfaceContent, resolveSurfaces } from "./surfaces.js";
@@ -695,7 +696,9 @@ export function siteRosterProblems(opts) {
         seen.add(route);
     }
     const contributions = new Map();
-    for (const moduleName of modules) {
+    // #10040 D3 — a site that dropped `marketing` carries no public route tree,
+    // so no module's public pages are expected on its roster either.
+    for (const moduleName of publicTreeRemoved(opts.targetDir) ? [] : modules) {
         let refs;
         try {
             refs = moduleRosterRows(moduleName, opts.siteTemplatesDir);

package/dist/starter-grid.d.ts

@@ -18,6 +18,12 @@ import type { CategorySlug } from "./category-profile.js";
 import type { ModuleName } from "./parse-args.js";
 import type { TemplateLayout } from "./site-chrome.js";
 import type { StarterDesign, StarterShape, TemplateRosterRow } from "./template-manifest.js";
+/**
+ * The roster routes a hub keeps (#10040): the sign-in pair and the three legal
+ * pages. Declared here, beside the rosters they are cut from, so this file
+ * stays import-free at runtime; the hub alias's `drop` is derived from it.
+ */
+export declare const HUB_KEPT_ROUTES: readonly string[];
 /** The shapes a starter can be built from — every StarterShape but the reserved one. */
 export type BuildableShape = Exclude<StarterShape, "local-business-product">;
 /** How an alias's own rows differ from its shape's standard roster. */
@@ -148,6 +154,26 @@ export declare const ALIASES: Readonly<{
             readonly before: "/portfolio";
         };
     };
+    /**
+     * The hub starter (#10040, decision 4): a site that signs people in and
+     * serves the account area, the API and the Admin, with no public pages.
+     * The shape is `organization-service` (the account service is the
+     * operator's organization), every public row of it dropped, and `modules`
+     * is empty — `marketing` deliberately absent, the Admin and the rest ride
+     * the key's `--modules`. Treeless (spec 6892 D1): its seed layer is the
+     * shape's tree, which `scaffold()` then strips through the same
+     * `remove-module marketing` path a live hub runs.
+     */
+    readonly hub: {
+        readonly shape: "organization-service";
+        readonly design: "standard";
+        readonly modules: readonly [];
+        readonly categories: readonly ["accounting", "legal", "real-estate"];
+        readonly ownTree: false;
+        readonly differences: {
+            readonly drop: string[];
+        };
+    };
 }>;
 /**
  * The coordinates a keyless `--shape S` builds (#6757 D5) — the composed

package/dist/starter-grid.js

@@ -1,3 +1,15 @@
+/**
+ * The roster routes a hub keeps (#10040): the sign-in pair and the three legal
+ * pages. Declared here, beside the rosters they are cut from, so this file
+ * stays import-free at runtime; the hub alias's `drop` is derived from it.
+ */
+export const HUB_KEPT_ROUTES = [
+    "/sign-in",
+    "/sign-up",
+    "/privacy",
+    "/terms",
+    "/working-agreement",
+];
 /**
  * The pages every starter carries whatever its shape (#6658 D5,
  * `docs/decisions/starter-roster-page-set.md` D4/D7): a glossary and a
@@ -471,6 +483,28 @@ export const ALIASES = Object.freeze({
             before: "/portfolio",
         },
     },
+    /**
+     * The hub starter (#10040, decision 4): a site that signs people in and
+     * serves the account area, the API and the Admin, with no public pages.
+     * The shape is `organization-service` (the account service is the
+     * operator's organization), every public row of it dropped, and `modules`
+     * is empty — `marketing` deliberately absent, the Admin and the rest ride
+     * the key's `--modules`. Treeless (spec 6892 D1): its seed layer is the
+     * shape's tree, which `scaffold()` then strips through the same
+     * `remove-module marketing` path a live hub runs.
+     */
+    hub: {
+        shape: "organization-service",
+        design: "standard",
+        modules: [],
+        categories: ["accounting", "legal", "real-estate"],
+        ownTree: false,
+        differences: {
+            drop: SHAPE_ROSTERS["organization-service"]
+                .map((row) => row.route)
+                .filter((route) => !HUB_KEPT_ROUTES.includes(route)),
+        },
+    },
 });
 /**
  * The coordinates a keyless `--shape S` builds (#6757 D5) — the composed

package/dist/surfaces.d.ts

@@ -1,3 +1,5 @@
+/** Template-relative prefix every `apps/web` route directory sits under. */
+export declare const ROUTE_ROOT = "apps/web/app/[locale]";
 /**
  * Route paths (site-relative, for the record written into `architecture.yaml`)
  * that every scaffold carries.
@@ -9,6 +11,24 @@
  * is authored per form, when the form exists.
  */
 export declare const CORE_SURFACE_PATHS: readonly string[];
+/**
+ * The `app/[locale]/` entries a site keeps when it drops the `marketing`
+ * module (#10040, the operator's decisions of 2026-10-26): the sign-in group,
+ * the authed account area, and the three legal pages the kept sign-up form
+ * and account pages link through `consentPoliciesFor`. Every OTHER directory
+ * under `app/[locale]/` is the public route tree `remove-module marketing`
+ * deletes, `sync-routes` stops copying and `update` stops adding (spec
+ * 10040 D2, D10). One constant, three readers.
+ */
+export declare const HUB_KEPT_ROUTE_DIRS: readonly string[];
+/**
+ * Whether a `/`-separated scaffold path (`apps/web/app/[locale]/about/page.tsx`)
+ * lies inside a public route directory — one `remove-module marketing` removes.
+ * A file directly under `app/[locale]/` (the layout, the home page, the
+ * consent pair) is not: those stay. Read by `sync-routes` and `update` on a
+ * site whose manifest lists no `marketing` (`lib/site-modules.ts`, spec 10040 D10).
+ */
+export declare function isRemovedPublicRoutePath(destRel: string): boolean;
 /** Template-relative route directories that are always copied. */
 export declare const CORE_ROUTE_DIRS: readonly string[];
 /**
@@ -220,6 +240,12 @@ export interface RenderNavConfigOptions {
      * surface is on (there is nothing to link yet).
      */
     serviceSlugs?: readonly string[];
+    /**
+     * `false` on a site without the `marketing` module (#10040 D2): the public
+     * tree is gone, so the nav and footer link nothing — empty `navItems` and
+     * `footerColumns` under the same self-hashing stamp. Absent → `true`.
+     */
+    publicPages?: boolean;
 }
 /**
  * Render `apps/web/lib/nav-config.ts` for an enabled surface set.

package/dist/surfaces.js

@@ -32,7 +32,7 @@
  */
 import { createHash } from "node:crypto";
 /** Template-relative prefix every `apps/web` route directory sits under. */
-const ROUTE_ROOT = "apps/web/app/[locale]";
+export const ROUTE_ROOT = "apps/web/app/[locale]";
 /**
  * Route paths (site-relative, for the record written into `architecture.yaml`)
  * that every scaffold carries.
@@ -56,6 +56,38 @@ export const CORE_SURFACE_PATHS = [
     // module's own route (the docs-blog `blog/`) win over a same-named MDX.
     "/{slug}",
 ];
+/**
+ * The `app/[locale]/` entries a site keeps when it drops the `marketing`
+ * module (#10040, the operator's decisions of 2026-10-26): the sign-in group,
+ * the authed account area, and the three legal pages the kept sign-up form
+ * and account pages link through `consentPoliciesFor`. Every OTHER directory
+ * under `app/[locale]/` is the public route tree `remove-module marketing`
+ * deletes, `sync-routes` stops copying and `update` stops adding (spec
+ * 10040 D2, D10). One constant, three readers.
+ */
+export const HUB_KEPT_ROUTE_DIRS = [
+    "(auth)",
+    "(authed)",
+    "privacy",
+    "terms",
+    "working-agreement",
+];
+/**
+ * Whether a `/`-separated scaffold path (`apps/web/app/[locale]/about/page.tsx`)
+ * lies inside a public route directory — one `remove-module marketing` removes.
+ * A file directly under `app/[locale]/` (the layout, the home page, the
+ * consent pair) is not: those stay. Read by `sync-routes` and `update` on a
+ * site whose manifest lists no `marketing` (`lib/site-modules.ts`, spec 10040 D10).
+ */
+export function isRemovedPublicRoutePath(destRel) {
+    const prefix = `${ROUTE_ROOT}/`;
+    if (!destRel.startsWith(prefix))
+        return false;
+    const rest = destRel.slice(prefix.length).split("/");
+    if (rest.length < 2)
+        return false;
+    return !HUB_KEPT_ROUTE_DIRS.includes(rest[0]);
+}
 /** Template-relative route directories that are always copied. */
 export const CORE_ROUTE_DIRS = [
     `${ROUTE_ROOT}/about`,
@@ -316,6 +348,16 @@ export const GATEABLE_SURFACES = [
         routes: [`${ROUTE_ROOT}/tech-articles`],
         content: ["content/<locale>/TechArticle"],
     },
+    {
+        // #10051 D9 — the templates route family: the /templates hub that lists
+        // every TemplatePage itself, and /templates/<slug>. No roster names it,
+        // so a fresh scaffold excludes it; `add-route templates` installs it and
+        // seeds one TemplatePage per AILK template. No `navLabelKey`: the site
+        // links it from its own nav (the `alternatives` rule).
+        id: "templates",
+        routes: [`${ROUTE_ROOT}/templates`],
+        content: ["content/<locale>/TemplatesList", "content/<locale>/TemplatePage"],
+    },
     {
         id: "terms",
         routes: [`${ROUTE_ROOT}/terms`],
@@ -619,6 +661,9 @@ export const ROUTE_SINCE = {
     portfolio: "0.27.0",
     "portfolio/[slug]": "0.27.0",
     pricing: "0.22.0",
+    // #10044 D9 — a pricing page per offering. Genuinely new, so it attaches at
+    // the fixed group's next release line (the line `templates` attached at).
+    "pricing/[slug]": "0.50.0",
     privacy: "0.22.0",
     products: "0.0.0",
     "products/[slug]": "0.0.0",
@@ -638,6 +683,9 @@ export const ROUTE_SINCE = {
     "resources/[slug]": "0.0.0",
     services: "0.0.0",
     "services/[slug]": "0.0.0",
+    // #10043 D11 — a Service under its category. Genuinely new, so it attaches
+    // at the fixed group's next release line (the line `templates` attached at).
+    "services/[slug]/[child]": "0.50.0",
     software: "0.0.0",
     "software/[slug]": "0.0.0",
     // #7744 — the team profile pages, a new route pair at today's line.
@@ -708,6 +756,13 @@ export const ROUTE_SINCE = {
     // #8515 — the client's onboarding page. Genuinely new, so it attaches at
     // today's fixed-group version, the same rule #7430 applied.
     "(authed)/account/onboarding": "0.40.0",
+    // #9966 D2 — the hub's consent page. Genuinely new, so it attaches at the
+    // fixed group's next release line.
+    "(authed)/account/connect": "0.50.0",
+    // #10051 D9 — the templates route family. Genuinely new, so it attaches at
+    // the fixed group's next release line.
+    templates: "0.50.0",
+    "templates/[slug]": "0.50.0",
     // The leads inbox (#5678). The ROUTE ships in every scaffold, Free
     // included — lead capture is a never-gate surface, so reading a lead back
     // is one too. Whether it shows a ROW is a separate question with two
@@ -828,6 +883,11 @@ export const ROUTE_DEPENDENCIES = {
         "apps/web/lib/auth-routes.ts",
     ],
     "(auth)/sign-in": ["apps/web/lib/auth-env.ts"],
+    // #10051 D9 — the /templates hub imports the route-family helper and the
+    // template-listing mapping, its detail route the mapping; each lists both
+    // so the pair travels together to a site scaffolded before them.
+    templates: ["apps/web/lib/route-family.ts", "apps/web/lib/template-listing.ts"],
+    "templates/[slug]": ["apps/web/lib/route-family.ts", "apps/web/lib/template-listing.ts"],
     // #8765 D8/D9 — the sign-up page links its agreements through the one
     // localized policy map; the carried-cookie mint (`sign-up.actions.ts`) is
     // deleted, since the server now refuses and records the agreements.
@@ -1102,6 +1162,34 @@ export const ROUTE_DEPENDENCIES = {
     pricing: [
         "apps/web/lib/offerings-pricing.ts",
         "apps/web/lib/api-origin.generated.ts",
+        // #10044 D9 — the shared Pricing render and the offering pages' list.
+        "apps/web/lib/pricing-page.ts",
+        "apps/web/lib/route-family.ts",
+    ],
+    // #10044 D9 — one offering's pricing page renders through the same lib,
+    // which imports the route-family helper's `DetailPage` type.
+    "pricing/[slug]": [
+        "apps/web/lib/offerings-pricing.ts",
+        "apps/web/lib/api-origin.generated.ts",
+        "apps/web/lib/pricing-page.ts",
+        "apps/web/lib/route-family.ts",
+    ],
+    // #10043 D11 — the services hub maps its links through the services
+    // listing; a service page lists its category's children through it and the
+    // route-family helper, and the nested route redirects with it. The
+    // listing reads the base from `services-path.ts`, which the middleware
+    // already carries; it is listed so a site whose middleware predates it
+    // still compiles (a dependency copy never overwrites).
+    services: ["apps/web/lib/service-listing.ts", "apps/web/lib/services-path.ts"],
+    "services/[slug]": [
+        "apps/web/lib/route-family.ts",
+        "apps/web/lib/service-listing.ts",
+        "apps/web/lib/services-path.ts",
+    ],
+    "services/[slug]/[child]": [
+        "apps/web/lib/route-family.ts",
+        "apps/web/lib/service-listing.ts",
+        "apps/web/lib/services-path.ts",
     ],
 };
 /**
@@ -1136,6 +1224,8 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/account/artifacts/[pieceId]": ["account"],
     // #8515 — the onboarding page.
     "(authed)/account/onboarding": ["account"],
+    // #9966 D2 — the hub's consent page reads its own namespace.
+    "(authed)/account/connect": ["hubConnect"],
     "(authed)/admin": ["admin"],
     "(authed)/leads": ["leadsInbox"],
     // #5977 — every string on both editor routes comes from the `edit`
@@ -1155,7 +1245,14 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     // #8438 D21 — the unsubscribe landing's own namespace.
     unsubscribe: ["unsubscribe"],
     // #8927 D6 — the Offerings cards' CTA, recommendation and period phrases.
-    pricing: ["pricing", "pricingOfferings"],
+    // #10044 D8 — the offering pricing pages list's heading and link label.
+    pricing: ["pricing", "pricingOfferings", "pricingPages"],
+    "pricing/[slug]": ["pricing", "pricingOfferings"],
+    // #10051 D8 — the /templates cards, actions and empty state.
+    templates: ["templates"],
+    "templates/[slug]": ["templates"],
+    // #10043 D11 — a category's list of its services (heading, link label).
+    "services/[slug]": ["services"],
 };
 /** Template-relative path of the generated site-nav registry. */
 export const NAV_CONFIG_PATH = "apps/web/lib/nav-config.ts";
@@ -1409,6 +1506,9 @@ export function renderNavConfig(enabled, options) {
         "from ",
         '"@working-theory/ui";',
     ].join("");
+    const publicPages = options?.publicPages !== false;
+    const navEntries = publicPages ? entries : [];
+    const footerColumnEntries = publicPages ? footerEntries : [];
     const body = `// nav-config.ts — site-nav registry.
 //
 // GENERATED by create-ailk from the declared route surfaces. Every entry here
@@ -1425,10 +1525,8 @@ export function renderNavConfig(enabled, options) {
 // \`apps/web/messages/<locale>.json\`. Paths are locale-agnostic — Nav prefixes
 // them with the active locale at render.
 ${navItemImport}
-${servicesHub ? 'import { ArrowRight } from "lucide-react";\n' : ""}
-export const navItems: NavItem[] = [
-${entries.join("\n")}
-];
+${servicesHub && publicPages ? 'import { ArrowRight } from "lucide-react";\n' : ""}
+export const navItems: NavItem[] = ${navEntries.length > 0 ? `[\n${navEntries.join("\n")}\n]` : "[]"};
 
 // Footer column groups. Keys only — the layout resolves each \`headingKey\`
 // and \`labelKey\` through the same \`nav\` labels as the header.
@@ -1437,9 +1535,7 @@ export interface FooterColumnConfig {
   items: { labelKey: string; path: string }[];
 }
 
-export const footerColumns: FooterColumnConfig[] = [
-${footerEntries.join("\n")}
-];
+export const footerColumns: FooterColumnConfig[] = ${footerColumnEntries.length > 0 ? `[\n${footerColumnEntries.join("\n")}\n]` : "[]"};
 `;
     // D1 — a first-line stamp holding the SHA-256 of the rest of the file
     // (`body`), so an unedited nav proves itself whatever generator wrote it.

package/dist/sync-routes.d.ts

@@ -78,6 +78,13 @@ export interface SyncRoutesResult {
     missingMessageNamespaces: string[];
     /** Gateable surface ids the target does not carry, sorted. */
     skippedSurfaces: string[];
+    /**
+     * The template route dirs left out of scope because the site has dropped the
+     * `marketing` module (#10040 D10): its manifest lists no `marketing`,
+     * so every dir outside `HUB_KEPT_ROUTE_DIRS` is deliberate absence, never
+     * drift — not reported missing, not copied, `forceSurfaces` included.
+     */
+    publicTreeRemoved: string[];
     /**
      * When `apply` added a route the template exempts in its structured-data
      * test and the site's copy of that test is site-edited (its bytes differ

package/dist/sync-routes.js

@@ -42,10 +42,11 @@ import { copyTemplate, renderTemplateFile } from "./copy.js";
 import { SPOKE_BILLING_ACTION_PATH } from "./derive-architecture.js";
 import { appendEnvRows } from "./lib/declared-env.js";
 import { ENV_CATALOG } from "./lib/env-catalog.js";
+import { publicTreeRemoved } from "./lib/site-modules.js";
 import { BILLING_ACTION, BILLING_ACTION_MARKER, RETIRED_CHECKOUT_E2E_MARKER, RETIRED_CHECKOUT_E2E_WORKFLOW_PATH, RETIRED_SPOKE_CHECKOUT_PATHS, } from "./spoke-checkout.js";
-import { GATEABLE_SURFACES, NON_ROUTE_DIRS, ROUTE_DEPENDENCIES, ROUTE_MESSAGE_NAMESPACES, ROUTE_SINCE, surfaceForRouteDir, } from "./surfaces.js";
+import { GATEABLE_SURFACES, HUB_KEPT_ROUTE_DIRS, NON_ROUTE_DIRS, ROUTE_DEPENDENCIES, ROUTE_MESSAGE_NAMESPACES, ROUTE_SINCE, surfaceForRouteDir, } from "./surfaces.js";
 import { TEMPLATE_RECORD_PATH, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
-import { SPOKE_SEAM_FILES, isSpokeExcluded, readSpokeShape, } from "./topology.js";
+import { SPOKE_SEAM_FILES, isSpokeExcluded, readSpokeShape, spokeExclusions, } from "./topology.js";
 /** Template-relative prefix every `apps/web` route directory sits under. */
 const ROUTE_ROOT = "apps/web/app/[locale]";
 /** The site test that fails a route neither rendered through `renderPage` nor in its `NO_STRUCTURED_DATA_ROUTES` (#8704). */
@@ -172,9 +173,13 @@ function walkRouteImports(route, ctx) {
     const differs = new Set();
     const unresolved = [];
     const reached = [];
+    // A file under a seed the spoke does not carry is never copied, so its
+    // imports are not walked (the hub's consent page under a hub sign-in spoke's
+    // account, #9966 D2).
     const queue = regularFilesUnder(ctx.scratch, route)
         .map((rel) => `${ROUTE_ROOT}/${rel}`)
-        .filter((path) => ownerRoute(path, ctx.missingRoutes) === route);
+        .filter((path) => ownerRoute(path, ctx.missingRoutes) === route)
+        .filter((path) => ctx.spoke === undefined || !isSpokeExcluded(path, ctx.spoke));
     const visited = new Set(queue);
     for (let from = queue.shift(); from !== undefined; from = queue.shift()) {
         if (!SOURCE_FILE.test(from))
@@ -432,6 +437,20 @@ function regularFilesUnder(targetAbs, rel) {
         .sort()
         .flatMap((name) => regularFilesUnder(targetAbs, `${rel}/${name}`));
 }
+/**
+ * The outermost paths strictly under route dir `route` of `routeRoot` that a
+ * spoke does not carry, relative to `route` — a directory is named once and
+ * not descended, so the copier skips it whole instead of leaving it empty.
+ */
+function spokeExcludedUnder(routeRoot, route, spoke) {
+    const walk = (rel) => readdirSync(join(routeRoot, route, rel), { withFileTypes: true }).flatMap((entry) => {
+        const child = rel === "" ? entry.name : `${rel}/${entry.name}`;
+        if (isSpokeExcluded(`${ROUTE_ROOT}/${route}/${child}`, spoke))
+            return [child];
+        return entry.isDirectory() ? walk(child) : [];
+    });
+    return walk("");
+}
 /** The first line of a text file. */
 function firstLine(text) {
     const eol = text.indexOf("\n");
@@ -608,7 +627,19 @@ export function syncRoutes(opts) {
         return (spoke !== undefined &&
             (SPOKE_SEAM_FILES.includes(path) || isSpokeExcluded(path, spoke)));
     };
+    // #10040 D10 — a site that dropped `marketing` carries no public route
+    // tree: every template route dir outside the kept set is out of scope.
+    const publicTreeSkipped = [];
+    const marketingRemoved = publicTreeRemoved(targetAbs);
     const inScope = listTemplateRouteDirs(opts.templatesDir)
+        .filter((route) => {
+        if (!marketingRemoved)
+            return true;
+        if (HUB_KEPT_ROUTE_DIRS.includes(route.split("/")[0]))
+            return true;
+        publicTreeSkipped.push(route);
+        return false;
+    })
         .map(reportFor)
         // "authed" (#5014): the `(authed)` route group ships unconditionally in
         // every hub scaffold, the same as "core" — it is checked regardless of
@@ -719,6 +750,11 @@ export function syncRoutes(opts) {
     const appliedDependencies = [];
     if (opts.apply === true) {
         const writable = missingRoutes.filter((r) => !refusedSet.has(r));
+        // #6786 — the closure a fresh spoke scaffold drops, not only its seeds:
+        // a template file that imports a seed goes with it here too.
+        const spokeShape = spoke === undefined
+            ? undefined
+            : { ...spoke, exclusions: spokeExclusions(opts.templatesDir, spoke) };
         for (const route of writable) {
             applied.push(route);
             // An ancestor route dir's subtree copy already brings this one.
@@ -734,9 +770,16 @@ export function syncRoutes(opts) {
                 versions: opts.versions,
                 markers,
                 // #9406 DD4 — hold back each refused sub-route from the ancestor's copy.
-                excludePaths: refused
-                    .filter((r) => r.startsWith(route + "/"))
-                    .map((r) => r.slice(route.length + 1)),
+                // #6786 — on a spoke, hold back every file the spoke does not carry,
+                // so an ancestor's subtree copy lands what a fresh spoke scaffold does.
+                excludePaths: [
+                    ...refused
+                        .filter((r) => r.startsWith(route + "/"))
+                        .map((r) => r.slice(route.length + 1)),
+                    ...(spokeShape === undefined
+                        ? []
+                        : spokeExcludedUnder(templateRouteRoot, route, spokeShape)),
+                ],
             });
         }
         for (const dep of missingDependencies) {
@@ -766,6 +809,7 @@ export function syncRoutes(opts) {
         appliedDependencies,
         missingMessageNamespaces,
         skippedSurfaces,
+        publicTreeRemoved: publicTreeSkipped,
         structuredDataEntries: structuredDataEntriesFor(targetAbs, opts.templatesDir, applied),
         retiredCheckout: spoke !== undefined
             ? retireLegacySpokeCheckout(targetAbs, opts.apply === true)
@@ -838,6 +882,9 @@ export function formatSyncRoutesReport(result, apply) {
     if (result.skippedSurfaces.length > 0) {
         lines.push(`[create-ailk] Surfaces this site does not carry (skipped): ${result.skippedSurfaces.join(", ")}`);
     }
+    if (result.publicTreeRemoved.length > 0) {
+        lines.push(`[create-ailk] Public route tree not carried (marketing removed, #10040): ${result.publicTreeRemoved.length} template route(s) skipped`);
+    }
     // #9406 DD5 — per missing route, what its imports copy, leave, or cannot
     // resolve; then the routes a dangling import holds back.
     if (result.routeImports.length > 0) {

package/dist/template-pages.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The templates route family's generated seeds (#10051 D10) — the /templates
+ * hub seed plus one placeholder TemplatePage per AILK template, derived from
+ * `TEMPLATE_MANIFESTS` so a new template never needs a hand-written seed.
+ * `add-route templates` writes them (`GENERATED_SEEDS` in `add-route.ts`);
+ * the site then edits or deletes them like any content.
+ *
+ * A seed never invents a fact: its copy is placeholder (`placeholder: true`,
+ * renderPage's replace-before-launch label), it has no thumbnail, and its Get
+ * it action is `/contact`. Only a template whose `templateDelivery` is
+ * `"free"` gets `price: 0` — a paid template's price is the site's to set.
+ *
+ * Pure (no fs). create-ailk has no YAML dependency by design, so every
+ * frontmatter value is written as `JSON.stringify(value)` — a JSON scalar,
+ * array or object is valid YAML flow syntax (the `derive-architecture.ts`
+ * precedent).
+ */
+import { type ModuleName } from "./parse-args.js";
+import { type TemplateManifest } from "./template-manifest.js";
+/** One "What's included" row. */
+export interface IncludeRow {
+    title: string;
+    description: string;
+}
+/** What every template carries whatever its modules: the base site. */
+export declare const BASE_INCLUDE: IncludeRow;
+/** One row per module, typed exhaustively so a new module fails type-check. */
+export declare const MODULE_INCLUDES: Readonly<Record<ModuleName, IncludeRow>>;
+/**
+ * The hub seed, then one TemplatePage seed per manifest, sorted by name.
+ * `manifests` defaults to the frozen registry; a test may pass its own.
+ */
+export declare function templatePageSeeds(manifests?: Readonly<Record<string, TemplateManifest>>): {
+    path: string;
+    text: string;
+}[];