create-ailk 0.27.0 → 0.28.1

package/templates/apps/mcp/CLAUDE.md

@@ -71,14 +71,19 @@ now mean `packages/mcp-server/src/<file>`.
   started from the repo root — anywhere else the file is absent and so is the tool, where it
   could not run anyway (no `dist/cli.js`). The scope FILE alone decides — a release-scope
   decision, never a licence check, and the CLI's `AILK_RELEASE_SCOPE=ignore` bypass is not
-  honoured; a missing or unreadable file fails closed with one stderr line. apps/web's
-  `/.well-known/mcp.json` drops it on the same read (`apps/web/lib/release-scope.ts`).
+  honoured; a missing or unreadable file fails closed with one stderr line. It is served over
+  **stdio only** (#9965 D13, #8584): it spawns a filesystem-writing CLI, so
+  `createMcpServer()` and `listRegisteredTools()` default to the HTTP transport, which never
+  registers it, and only `run.ts`'s stdio branch passes `{ transport: "stdio" }`; the
+  call-time gate asks for the transport the server was built with. apps/web's
+  `/.well-known/mcp.json` describes the HTTP surface, so it always drops it.
 
 ### What a spoke's MCP host on Vercel enforces
 
 - **The address is the caller's, behind exactly one proxy.** The Vercel entry trusts one hop
   (`trustOneHop`, `src/serverless-app.ts`), so the limits key on the address Vercel's edge
-  saw and a caller's own `X-Forwarded-For` cannot move the key. This holds when the MCP host
+  saw and a caller's own `X-Forwarded-For` cannot move the key. It trusts that hop only on
+  Vercel (`VERCEL=1`); reused anywhere else it trusts nothing and keys on the socket (#8080). This holds when the MCP host
   name points straight at the Vercel project; a second proxy in front keys every caller on
   that proxy. It is a function, not `trustProxy: 1`, because Fastify 5.12 treats a numeric
   hop count as trusting nothing. The long-running entry trusts no proxy.
@@ -116,11 +121,11 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
 
 **Read (9):** `list_pages`, `read_content`, `search_content`, `get_site_info`, `get_business_hours`, `get_locations`, `get_offerings`, `get_pricing`, `get_faq`. The first three adopted their `apps/api` routes' arguments and results (#7167, #7168, #7169 — the operator's decision of 2026-10-19): `search_content` takes `q` and answers the route's `ItemList` (`query`, `items`, `totalItems`); `list_pages` requires `type`, takes `page`/`pageSize` and answers the paginated `ItemList` (`items`, `pagination`); `read_content` takes `include` and answers the page's JSON-LD at the root with `page`, plus `body` only with `include: "body"` — a miss is the not-found body. Each parses the same `@working-theory/validation` export its route parses with and answers through the same `@working-theory/content-adapters` builder, so the parity guard holds them as `twin`s
 **Conversion-write (3):** `capture_lead`, `subscribe_newsletter`, `request_callback` — each takes the body its `POST /v1/leads/{submit,subscribe,callback}` route parses (`leadSubmitBodySchema`: `source`, `email`, `consent`, `payload`; `leadSubscribeBodySchema`: `email`, `source`; `leadCallbackBodySchema`: `name`, `phone`, `preferredTime`, `payload`) and returns the route's 201 body `{ id, persisted, email }` unchanged (#7171, #7172, #7173 — the operator's decision of 2026-10-19), so the parity guard holds the three as `twin`s. `source` is the agent's to choose — `mcp` unless the operator says otherwise — and a consent-bearing source needs `consent: true`, exactly as a form does; `capture_lead` still spreads the spoke marker `payload.site` from `AILK_LEAD_SITE` last. The AbuseGuard reads the first two's `email` at the top level, else inside `payload` (the route lifts it from there), so a malformed address is refused wherever it sits
-**Maintenance (2):** `audit`, `create_project`
+**Maintenance (2):** `audit`, `create_project` (stdio only, #9965 D13)
 **Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366) and licence-feature-tagged (`feature: "flows-deliverables"`, #7136): identity-blind like every tool in this list, registered only when the signal-collectors module is present, and gated on the deployment's `flows-deliverables` licence feature under `MCP_FEATURE_GATE_MODE`, the same shape Booking below has. `submit_flow_step` takes the HTTP write branch (its own daily cap, `MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP`, default 50 — #8071)
 **Booking (4):** `list_availability`, `get_event_meta`, `list_meetings`, `create_booking` — module-gated (`module: "scheduling"`) and licence-feature-tagged (`feature: "scheduling"`, #7136), gated on the deployment's `scheduling` licence feature under `MCP_FEATURE_GATE_MODE`. `create_booking` takes the HTTP write branch (its own daily cap, `MCP_ABUSE_CREATE_BOOKING_DAILY_CAP`, default 20, and an `attendee.email` format check — #8071). `list_meetings` (#8843 D5) twins `GET /v1/schedule/meetings`: it takes no argument and returns the site's Live meetings — slug, visibility, position and whether each can be booked, plus a bookable one's calLink, title, length, description and price; `private` means unlisted, not secret
 
-### Why the parity test counts 21 and a keyless server registers 19 (20 once Free is released)
+### Why the parity test counts 21 and a keyless server registers 19 (20 over stdio once Free is released)
 
 - **21 in the `TOOLS` array / parity test**: the `TOOLS` array in
   `packages/metadata/src/mcp-tool-catalog.ts` defines 21 anonymous tools; the
@@ -128,16 +133,17 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
   workspace tools (#3591), which no anonymous view returns — see § The
   signed-in workspace surface below.
 - **19 registered on a KEYLESS deployment, 20 on a commerce-claimed one,
-  while the Free level is held — 20 and 21 once it is released**
-  (#5971, #9534): `createMcpServer` (`apps/mcp/src/server.ts`) registers
+  while the Free level is held or over HTTP — 20 and 21 over stdio once it is
+  released** (#5971, #9534, #9965 D13): `createMcpServer` (`apps/mcp/src/server.ts`) registers
   `getMcpToolRegistrations()` minus the topology seam's `UNSERVED_MCP_TOOLS`,
   minus `create_project` while create-ailk's `release-scope.json` holds
-  `levels.free` (the release-scope filter, #9534), minus `OSS_DISABLED_TOOLS`
+  `levels.free` (the release-scope filter, #9534) and on any transport but
+  stdio (the transport filter, #9965 D13), minus `OSS_DISABLED_TOOLS`
   (now empty), minus module-gated tools whose module is off, minus any
   `addon`-tagged tool whose claim this deployment does not hold.
   `start_purchase` carries `addon: "commerce"`, so it is the one entry whose
   presence depends on the licence — one fewer without the claim.
-- **19 free anonymous tools while Free is held (20 released)**: since #5853 retired the three content-write
+- **19 free anonymous tools while Free is held or over HTTP (20 over stdio once released)**: since #5853 retired the three content-write
   tools, every registered tool remains anonymous — call-time gating checks a
   licence claim, never an identity. The six carrying `tier: "pro"`
   (`get_flow`, `submit_flow_step`, `list_availability`, `get_event_meta`,
@@ -277,7 +283,9 @@ Example (lead routing):
 - Don't add a tool without the matching `apps/api` endpoint.
 - Don't put business logic in tool handlers — they're adapters.
 
-Last updated: 2026-10-24 — #9749: `get_slack_connection_status` (`mcp-workspace`'s `slack_connection.ts`) and `get_prospect_channel_settings` / `set_prospect_channel_settings` (`mcp-scheduling`'s `prospect_channel_settings.ts`, the first signed-in handlers outside `mcp-workspace`) twin the Slack status read and the prospect-channel settings pair — the signed-in workspace surface is thirty-one tools — verified against `packages/metadata/src/mcp-tool-catalog.ts`, `packages-paid/mcp-workspace/src/index.ts`, `packages-paid/mcp-scheduling/src/index.ts` and `tests/parity/api-parity/kinds/site.ts`.
+Last updated: 2026-10-26 — #9965 (D12, D13): `create_project` is served over stdio only — the HTTP transport, the default, never registers it, and the web manifest always drops it — and `trustOneHop` trusts its hop only on Vercel — verified against `packages/mcp-server/src/{server,run,serverless-app}.ts` and `apps/web/app/.well-known/mcp.json/route.ts`.
+
+Prior: 2026-10-24 — #9749: `get_slack_connection_status` (`mcp-workspace`'s `slack_connection.ts`) and `get_prospect_channel_settings` / `set_prospect_channel_settings` (`mcp-scheduling`'s `prospect_channel_settings.ts`, the first signed-in handlers outside `mcp-workspace`) twin the Slack status read and the prospect-channel settings pair — the signed-in workspace surface is thirty-one tools — verified against `packages/metadata/src/mcp-tool-catalog.ts`, `packages-paid/mcp-workspace/src/index.ts`, `packages-paid/mcp-scheduling/src/index.ts` and `tests/parity/api-parity/kinds/site.ts`.
 
 Prior: 2026-10-24 — #9714: `list_people` (`people_list.ts`) twins `GET /v1/workspaces/:workspaceId/people` in both its modes — the signed-in workspace surface is twenty-eight tools — verified against `packages/metadata/src/mcp-tool-catalog.ts`, `packages-paid/mcp-workspace/src/index.ts` and `tests/parity/api-parity/kinds/site.ts`.
 

package/templates/apps/web/.env.example

@@ -47,17 +47,26 @@ CONTENT_ADAPTER=mdx
 # NEXT_PUBLIC_; see the repo-root .env.example, #7394). A cross-site post is
 # refused before the hub is called.
 #
-# THE BOOKING BOT CHECK (#9889). On Vercel, POST /v1/schedule/book asks Vercel
-# BotID for a verdict before the hub is called: a bot is refused 403
-# bot_detected, so no booking and no Slack invite exist. A real visitor sees no
-# extra step. It is ON by default; set this to `off` to turn it off (any other
-# value leaves it on). Off Vercel it cannot run, so it is inert and the server
-# logs that once. On Vercel it needs the project's OIDC token (on by default):
-# without it every booking answers 503 bot_check_unavailable, as it does when
-# BotID cannot answer. A self-hosted or local `next start` must not carry
-# VERCEL=1 (as `vercel env pull` writes it), or every booking answers 503.
-# Basic or Deep Analysis is the Vercel project's own setting; Deep Analysis is
-# billed per check.
+# THE BOT CHECK (#9889, #9255). On Vercel, every public write a visitor sends
+# asks Vercel BotID for a verdict before the hub is called: the relay's
+# POST /v1/leads/submit, /v1/leads/subscribe, /v1/leads/callback and
+# /v1/schedule/book, and the site's lead, flow and checkout Server Actions
+# (contact, careers, newsletter, flow step, flow checkout, saved
+# recommendation, /dev/purchase). A bot is refused (403 bot_detected on the
+# relay; the form's own error from an action), so no lead, booking or Slack
+# invite exists. A real visitor sees no extra step, except that a form posted
+# before the page has finished loading (or with JavaScript off) carries no
+# challenge and is refused like a bot; resubmitting works. It is ON by
+# default: set AILK_BOT_CHECK to `off` to turn every check off, or
+# AILK_BOOKING_BOT_CHECK to `off` to turn off the booking's alone (any other
+# value leaves a check on). Off Vercel it cannot run, so it is inert and the
+# server logs that once. On Vercel it needs the project's OIDC token (on by
+# default): without it every checked write is refused as unavailable (503
+# bot_check_unavailable on the relay), as when BotID cannot answer. A
+# self-hosted or local `next start` must not carry VERCEL=1 (as `vercel env
+# pull` writes it), or every checked write is refused. Basic or Deep Analysis
+# is the Vercel project's own setting; Deep Analysis is billed per check.
+# AILK_BOT_CHECK=
 # AILK_BOOKING_BOT_CHECK=
 #
 # EDGE PRECONDITION: the relay forwards x-forwarded-for exactly as this site
@@ -168,6 +177,11 @@ CONTENT_ADAPTER=mdx
 # passes its own origin check and the emailed reset link is built on the
 # attacker's host. It is a conjunct of resetSendConfigured(), so a deployment
 # that has not pinned its origin does not offer reset at all.
+#
+# REQUIRED in production (#8620, #9965 D10): apps/web/auth.ts THROWS when
+# Better Auth is first built without it, outside the build phase, as it does
+# without BETTER_AUTH_SECRET. Every page that reads the session then fails, not
+# only sign-in. It must be an https: URL (http: only on a loopback host).
 # BETTER_AUTH_URL=http://localhost:3000
 #
 # Secret used to sign session cookies AND the email-verification tokens.

package/templates/apps/web/CLAUDE.md

@@ -43,7 +43,7 @@ Raw HTML is allowed only when no `@working-theory/ui` component fits. Flag it in
 - Animations: only `transform` and `opacity`. Never `transition-all`.
 - Every interactive element needs hover, focus-visible, and active states.
 
-The four widths above are the responsive contract. Brand reference files (logos, photos, colour and type notes) live in `brand_assets/` at the repo root; the site's own brand colours and fonts are set in `content/_site.mdx` under `brand.colors` and `brand.fonts`.
+The four widths above are the responsive contract. Brand reference files (logos, photos, colour and type notes) live in `brand_assets/` at the repo root; the site's own brand colours and fonts are set in `content/_site.mdx` under `brand.colors` and `brand.fonts`. The signed-out header button is set there too, as `header.cta` (`label`, `href`), with `header.signIn: link | hidden` choosing whether Sign in stays beside it as a text link — never by editing `app/[locale]/layout.tsx`. Each page's chrome is set there too (#10049, resolved by `lib/page-chrome.ts`): `header.style` (`full | bare | none`), `footer.style` (`columns | centered | closing | none`), `layout` (`deck | default`, the home's) and one `{ header, footer }` key per route family (`blog`, `docs`, `services`, …), with a page's own `header:` / `footer:` / `layout:` frontmatter winning over all of them.
 
 ## Local dev
 
@@ -149,6 +149,21 @@ exists, deleting the user if that write fails. A request with no `metadata`
 between the user and grant inserts leaves a user with no grant, whom the
 account interstitial stops.
 
+**The hub asks once per spoke before it signs a person in to it (#9966 D2).**
+`app/api/auth/hub/authorize/route.ts`'s GET never says yes for anyone: when
+the API answers `403 consent_required` — no unrevoked grant for that
+(person, spoke) carrying the `consent` scope — it seals the six authorize
+keys and 303s to `(authed)/account/connect?ref=…`. That page names the spoke
+from the registry (`hubSignIn.clientInfo`), renders its form only when the
+ref's `redirect_uri` is on the registry's origin, answers `referrer:
+same-origin`, and 404s on a spoke build. Its Continue is a form POST of `ref`
+to the same route, which accepts only `Sec-Fetch-Site: same-origin` with the
+pinned `Origin` (a missing or `null` one is refused) and is the one call site
+that sends `consent: true` — beside `x-internal-auth` under the Offerings buy
+route's rule, since the API honours consent only with it where
+`OSS_API_INTERNAL_SECRET` is set. A password reset or a sign-out revokes the
+grant, so the next sign-in asks again. `ref` is in both telemetry scrub lists.
+
 ## Contact page
 
 The contact page (`apps/web/app/[locale]/contact/page.tsx`) renders the
@@ -305,7 +320,9 @@ records (#8849):
   `noindex, follow` and full-screen. Next.js serves the static `apply`
   segment first, the `[slug]/[detail]` idiom; every other action 404s. Lead
   capture is never-gate, so every tier takes an application. Both apply pages
-  read the posting's title through `lib/posting-title.ts`.
+  read the posting's title through `lib/posting-title.ts`. A posting's
+  `applicationFlow: <magnet slug>` picks the magnet both pages run (#10054);
+  an unknown slug falls back to the Job application and is logged.
 
 ## Meeting pages
 
@@ -554,9 +571,29 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - **No cross-site POST.** A `Sec-Fetch-Site` other than `same-origin`, or an `Origin` not on this site's own host, is refused 403 before the hub is called.
 - **Headers are an allow-list.** The visitor's `x-forwarded-for` (else `x-real-ip`) and `user-agent` pass through so per-visitor rate limits still count each visitor; no `authorization`, client-sent `x-ailk-*` or `host` is forwarded, and a `cookie` goes only on `POST /v1/commerce/invoices`, the one session route.
 - **The relay has its own per-visitor budget (#7707).** Each visitor gets 8 calls per 10 minutes across the five visitor routes, and the session route (`POST /v1/commerce/invoices`) gets its own, wider budget of 30 per 10 minutes; the call that exceeds either gets `429 rate_limited` before any hub call. The budget is held in this instance's own process (no shared store, no env variable) and holds only where the site's edge overwrites `x-forwarded-for` and `x-real-ip` — Vercel does; a bare self-hosted Next server does not.
-- **A bot check on the booking (#9889).** On Vercel, `POST /v1/schedule/book` asks Vercel BotID (`checkBotId`, from `BOT_CHECKED_ROUTES`) for a verdict after every refusal above and before the hub is called: a bot is `403 bot_detected`, and a check that throws, answers no boolean or takes over 5 seconds is `503 bot_check_unavailable`, so a scripted booking never reaches Cal.com or Slack. It is on unless `AILK_BOOKING_BOT_CHECK=off` and inert off Vercel; the locale layout mounts `BotIdClient` on the same list and predicate, `next.config.mjs` wraps `withBotId`, and `middleware.ts` keeps BotID's proxy prefix out of its matcher.
+- **A bot check on the public writes (#9889, #9255).** On Vercel, `lib/bot-check.ts`'s `runBotCheck` asks Vercel BotID for a verdict before the hub is called — in the relay for `POST /v1/leads/{submit,subscribe,callback}` and `POST /v1/schedule/book` (`BOT_CHECKED_ROUTES`: `403 bot_detected`, or `503 bot_check_unavailable` when the check throws, answers no boolean or takes over 5 seconds), and in the contact, careers, newsletter, flow-step, flow-checkout, saved-recommendation and `/dev/purchase` Server Actions immediately before their hub call, which answer their own existing failure variant. The locale layout's `BotIdClient` protects every same-origin POST (`BOT_CLIENT_PROTECT`, `/*`), because a Server Action posts to the page it was submitted from; `next.config.mjs` wraps `withBotId` and `middleware.ts` keeps BotID's proxy prefix out of its matcher. It is on by default and inert off Vercel: `AILK_BOT_CHECK=off` turns every check off, `AILK_BOOKING_BOT_CHECK=off` the booking's alone, and MCP tools never pass through a site, so they are never challenged.
 - `/v1` is exempt from next-intl's locale rewrite in `middleware.ts`, as `/api` is.
 
+## Where the docs live (`docsPath`)
+
+A site serves its docs at `/docs` unless `content/_site.mdx` sets a top-level `docsPath` (one to four lowercase kebab segments, leading slash, no trailing slash — e.g. `docsPath: /working-theory/docs`, #10041). The route never moves: it stays at `app/[locale]/docs/`, and every surface reads the one value through `lib/docs-path.ts` (`DOCS_PATH`, `toPublicDocsHref`).
+
+- **Build.** `next.config.mjs` reads `docsPath`, bakes it into `NEXT_PUBLIC_AILK_DOCS_PATH`, and fails the build naming the value when it breaks the pattern, starts with `api`, `og`, `v1` or an enabled locale, sits under `/docs`, shadows a `ROUTES` page (a `:param` segment matches any segment, so `/products/docs` is refused) or sits under a catch-all (`/blog/...`), or when this site's `lib/source.ts` does not set `baseUrl: DOCS_PATH` — a site with no docs-blog module, or one whose docs-blog files predate the setting. Links inside a doc's body are re-pointed only on a site that sets `docsPath`; there they render through `Link`, which forwards a fixed prop set, so a body anchor's `title` / `target` / `rel` are not kept.
+- **Request.** `middleware.ts` hands next-intl the internal `/docs/...` path for a request at or under `docsPath` (bare or locale-prefixed), so the browser keeps the public URL, and maps a redirect's `Location` and each hreflang `Link` entry back onto it. `/docs` and `/docs/...` answer with the site's 404 — rewritten to `/_ailk-docs-unmounted`, whose first segment is no locale, so the locale layout calls `notFound()`.
+- **Surfaces.** The docs sidebar, index and search index (both sources' `baseUrl`), the doc's breadcrumb, links inside a doc's body, every nav and footer entry at `/docs` (mapped at render in the locale layout and `components/signed-in-nav.tsx`; `nav-config.ts` is never edited), and the docs entries in `/sitemap.xml` and `/llms.txt` (`lib/docs-index.ts`, default locale only) all follow it. A site with no `docsPath` serves every URL exactly as before.
+- **Existing docs sites.** `create-ailk update` carries the base readers but never refreshes a module bundle's files, so a docs-blog site installed before this release keeps a `lib/source.ts` without `DOCS_PATH` and its build refuses a `docsPath` until those files are re-installed — a standing gap no command fills yet (#10076).
+- **Rollout.** A `@working-theory/site-config` older than this setting rejects a `_site.mdx` carrying `docsPath` (its schema is strict), and `@working-theory/api` / `@working-theory/mcp-server` then read the site as having no config. Set `docsPath` only once the site's packages carry it.
+
+## Where the services live (`services.path`)
+
+A site serves its services at `/services` unless `content/_site.mdx` sets `services: { path: /capabilities }` (the `services` route family's one extra key, beside its `header` / `footer`; one to four lowercase kebab segments, not under `/services`, #10043). The routes never move: they stay at `app/[locale]/services/`, and every surface reads the one value through `lib/services-path.ts` (`SERVICES_PATH`, `toPublicServicesHref`) or, in `@working-theory/page-renderer`, `NEXT_PUBLIC_AILK_SERVICES_PATH`.
+
+- **Categories.** A category is itself a `Service` page. A service names its category with frontmatter `parent: <category-slug>` and is served at `/<base>/<category>/<slug>` (`services/[slug]/[child]/page.tsx`); its flat URL answers a permanent redirect there, and the nested URL answers 404 unless the `parent` names that category and the category has no `parent` of its own. A category page lists its services after its body (`lib/service-listing.ts`, the `services` messages' `childrenHeading` / `viewService`). One level only.
+- **Build.** `next.config.mjs` reads `services.path`, bakes it into `NEXT_PUBLIC_AILK_SERVICES_PATH`, and fails the build naming the value when it breaks the pattern, starts with an enabled locale, shadows a `ROUTES` page, sits under a catch-all, or overlaps `docsPath` either way. It also fails, naming the file, on a default-locale `Service` whose `parent` names no Service or a Service with its own `parent`, and on any `parent` when the nested route is missing (`create-ailk sync-routes` adds it).
+- **Request.** `middleware.ts` hands next-intl the internal `/services/...` path for a request at or under the base, keeps `x-pathname` public, and maps a redirect's `Location` and each hreflang `Link` entry back. `/services` and `/services/...` answer `308` onto the same rest under the base (query and locale prefix kept), so old links keep working; links inside content are not rewritten.
+- **Surfaces.** The canonical, hreflang and `BreadcrumbList` (the base's title-cased last segment, then the category's title), `/sitemap.xml` and `/llms.txt` (`pagePathFor`), every nav and footer entry at `/services` (mapped in the locale layout and `components/signed-in-nav.tsx`), the hub's own section links, and route-family chrome (`lib/page-chrome.ts`) all follow it. A site that sets neither `services.path` nor any `parent` serves every URL exactly as before.
+- **Moving it.** `/ailk:growth-ops page rename` moves the base (`--from <current base> --to <new base>`): it writes `services.path` and keeps a previous moved base redirecting.
+
 ## AEO & performance
 
 - Static rendering is the default. Don't introduce client rendering without a reason.
@@ -573,7 +610,11 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - Don't reach into `apps/api` or `apps/mcp` from `apps/web`. They're peer apps — talk via HTTP/MCP.
 - Don't commit images to `screenshots/` — only the `.gitkeep` is tracked.
 
-Last updated: 2026-10-25 — the Offerings buy route's spoke sentence: on a hub that sets `OSS_API_INTERNAL_SECRET` a spoke's key authenticates its buy, held to its hub sign-in client's origin (#9910) — verified against `app/api/offerings/checkout/[lookupKey]/route.ts` and `packages/api/src/routes/checkout/sessions.ts`.
+Last updated: 2026-10-27 — § Where the services live (`services.path`): the services base, one category level, the 308 from `/services` and the `update-page` base move (#10043) — verified against `lib/services-path.ts`, `lib/service-listing.ts`, `middleware.ts`, `next.config.mjs` and `app/[locale]/services/`.
+
+Prior: 2026-10-26 — § The same-origin relay: the bot check moves to `lib/bot-check.ts` and covers the relay's three lead routes and the seven public lead, flow and checkout Server Actions, with `BotIdClient` protecting every same-origin POST and the `AILK_BOT_CHECK` switch (#9255) — verified against `lib/bot-check.ts`, `lib/relay.ts`, `app/[locale]/layout.tsx` and the seven actions' files.
+
+Prior: 2026-10-25 — the Offerings buy route's spoke sentence: on a hub that sets `OSS_API_INTERNAL_SECRET` a spoke's key authenticates its buy, held to its hub sign-in client's origin (#9910) — verified against `app/api/offerings/checkout/[lookupKey]/route.ts` and `packages/api/src/routes/checkout/sessions.ts`.
 
 Prior: 2026-10-25 — § The same-origin relay: the booking bot check — Vercel BotID on `POST /v1/schedule/book`, `bot_detected` / `bot_check_unavailable`, the `AILK_BOOKING_BOT_CHECK` switch and the middleware's BotID exclusion (#9889) — verified against `lib/relay.ts`, `app/[locale]/layout.tsx`, `next.config.mjs` and `middleware.ts`.
 

package/templates/apps/web/__tests__/setup.ts

@@ -58,6 +58,13 @@ if (typeof window !== "undefined") {
   /* eslint-enable no-restricted-syntax */
 }
 
+// A page whose generateMetadata calls @working-theory/page-renderer's
+// renderPageMetadata builds hreflang from readLocales() (#9660), which reads the
+// locale list next.config.mjs bakes into NEXT_PUBLIC_ENABLED_LOCALES and
+// otherwise throws on a missing project.yaml. Jest runs no next build, so supply
+// the baked value; a suite that sets its own keeps it.
+process.env.NEXT_PUBLIC_ENABLED_LOCALES ??= "en";
+
 // next-intl/server and next-intl are supplied by moduleNameMapper entries in
 // jest.config.cjs (__tests__/__mocks__/next-intl-server.ts and next-intl.ts),
 // not by jest.mock() here. A mapper is path-independent; a jest.mock() binds to

package/templates/apps/web/app/.well-known/mcp.json/route.ts

@@ -17,8 +17,8 @@
  * to make impossible. The same single read also yields the licence features
  * the deployment holds (#7136), which gate the five `feature`-tagged tools
  * here exactly as they gate registration on the MCP server. `create_project`
- * is left out while create-ailk's release scope holds the Free level (#9534),
- * as `apps/mcp` leaves it unregistered — `lib/release-scope.ts`.
+ * is always left out: this manifest describes the HTTP surface, and the MCP
+ * server serves that tool over stdio only (#9965 D13, #8584).
  *
  * Mirrors /.well-known/ai-plugin.json conventions: Response.json with a
  * conservative cache-control header.
@@ -28,7 +28,6 @@
  * is appropriate per the MCP discovery spec.
  */
 
-import { isFreeLevelReleased } from "../../../lib/release-scope";
 import { UNSERVED_MCP_TOOLS } from "../../../lib/topology.generated";
 import packageJson from "../../../package.json";
 import {
@@ -64,10 +63,11 @@ export async function GET(): Promise<Response> {
     commerceClaimed: heldFeatures.includes(COMMERCE_FEATURE),
     heldFeatures,
     // The tools this topology's MCP server does not register (#8070 D7) —
-    // and create_project while the Free level is held (#9534).
-    unservedTools: isFreeLevelReleased()
-      ? UNSERVED_MCP_TOOLS
-      : [...UNSERVED_MCP_TOOLS, "create_project"],
+    // and create_project, which the HTTP transport never serves (#9965 D13).
+    unservedTools: [
+      ...UNSERVED_MCP_TOOLS.filter((name) => name !== "create_project"),
+      "create_project",
+    ],
     // Spread conditional to satisfy exactOptionalPropertyTypes: omit the key
     // entirely when the env var is not set rather than passing undefined.
     ...(mcpHttpUrlEnv ? { mcpHttpUrl: mcpHttpUrlEnv } : {}),

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/[pieceId]/versions/[version]/file/route.ts

@@ -17,7 +17,8 @@
  * sandbox `Content-Security-Policy` and `Cache-Control: private, no-store` —
  * so the file is never a document on this origin and never cached on the way.
  * A hub answer missing any of the five is refused 502 rather than served
- * without it.
+ * without it — and so is one whose safety headers carry the wrong value
+ * (#8320, #9965 D8): presence alone is not the hub's promise.
  *
  * The params are shape-checked before any call (a malformed piece id or a
  * version that is not a whole number from 1 is a 404 with no call). A
@@ -43,6 +44,59 @@ const FILE_HEADER_NAMES: Record<keyof MemberFileHeaders, string> = {
   cacheControl: "Cache-Control",
 };
 
+/**
+ * HTTP's own whitespace — SP and HTAB, never JS `\s`. A browser reads any
+ * other byte (a non-breaking space among them) as part of the token, so a
+ * check that trimmed or split on it would pass a value it does not describe.
+ */
+const HTTP_VALUE = /^[\t\x20-\x7e]*$/;
+const httpTrim = (value: string) => value.replace(/^[ \t]+|[ \t]+$/g, "");
+
+/**
+ * The CSP's directives by name, or `null` for two policies joined or a
+ * directive named twice — a browser enforces the first copy, so a check that
+ * read a later one could pass a policy it does not describe.
+ */
+function cspDirectives(policy: string): Map<string, string> | null {
+  // `Headers.get` joins two CSP headers with ", " — a second policy the hub
+  // never sent (#9965 SEC-9965-16).
+  if (policy.includes(",")) return null;
+  const directives = new Map<string, string>();
+  for (const part of policy.split(";")) {
+    const [name = "", ...rest] = httpTrim(part).split(/[ \t]+/);
+    if (!name) continue;
+    if (directives.has(name)) return null;
+    directives.set(name, rest.join(" "));
+  }
+  return directives;
+}
+
+/**
+ * Whether each safety header carries the value the hub sends (D8). Every
+ * comparison is case-insensitive and trimmed of SP and HTAB, and a value
+ * carrying any byte outside visible ASCII, SP and HTAB is refused before it
+ * is parsed. `Content-Type` is not checked: the other four contain it.
+ */
+const SAFE_VALUE: Partial<
+  Record<keyof MemberFileHeaders, (value: string) => boolean>
+> = {
+  contentTypeOptions: (value) => value === "nosniff",
+  contentDisposition: (value) => /^attachment[ \t]*(;|$)/.test(value),
+  contentSecurityPolicy: (value) => {
+    const directives = cspDirectives(value);
+    const sandbox = directives?.get("sandbox");
+    return (
+      sandbox !== undefined &&
+      !sandbox.split(" ").includes("allow-scripts") &&
+      directives?.get("default-src") === "'none'"
+    );
+  },
+  cacheControl: (value) => {
+    const directives = value.split(",").map((part) => part.trim());
+    return directives.includes("private") && directives.includes("no-store");
+  },
+};
+
 function refusal(status: number): Response {
   return new Response(null, {
     status,
@@ -90,7 +144,12 @@ export async function GET(
     string,
   ][]) {
     const value = headers[key];
-    if (value === null) {
+    const check = SAFE_VALUE[key];
+    const safe =
+      value !== null &&
+      (check === undefined ||
+        (HTTP_VALUE.test(value) && check(httpTrim(value).toLowerCase())));
+    if (!safe) {
       await stream.cancel();
       return refusal(502);
     }

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/__tests__/file-route.test.ts

@@ -14,6 +14,8 @@
  *     unchanged;
  *   - a hub answer missing any of the five is refused 502, its stream
  *     cancelled — never bytes on this origin without them;
+ *   - so is one carrying a safety header with the wrong value (#8320, #9965
+ *     D8): presence is not enough;
  *   - malformed params are a 404 with no call — and `locale`, which Next
  *     always passes, never makes a real request fail;
  *   - refusals map to a status with no body and `private, no-store`;
@@ -140,6 +142,85 @@ describe("the version file read", () => {
     },
   );
 
+  it.each([
+    [
+      "an inline Content-Disposition",
+      { contentDisposition: "inline; filename=a.pdf" },
+    ],
+    [
+      "X-Content-Type-Options other than nosniff",
+      { contentTypeOptions: "sniff" },
+    ],
+    [
+      "a Content-Security-Policy with no sandbox",
+      { contentSecurityPolicy: "default-src *" },
+    ],
+    [
+      "a sandbox that allows scripts",
+      { contentSecurityPolicy: "default-src 'none'; sandbox allow-scripts" },
+    ],
+    [
+      "a sandbox with default-src other than 'none'",
+      { contentSecurityPolicy: "default-src *; sandbox" },
+    ],
+    [
+      "two CSP headers, joined (the hub's plus default-src *)",
+      { contentSecurityPolicy: "default-src 'none'; sandbox, default-src *" },
+    ],
+    [
+      "a repeated sandbox directive, whose first copy allows scripts",
+      {
+        contentSecurityPolicy:
+          "sandbox allow-scripts; sandbox; default-src 'none'",
+      },
+    ],
+    // HTTP whitespace is SP and HTAB only: a browser reads a non-breaking
+    // space as part of the token, so a value JS would trim to the safe one
+    // is not the safe one.
+    [
+      "an attachment Content-Disposition with a non-breaking space",
+      { contentDisposition: "attachment\u00a0; filename=x.html" },
+    ],
+    [
+      "nosniff followed by a non-breaking space",
+      { contentTypeOptions: "nosniff\u00a0" },
+    ],
+    [
+      "a CSP whose directives are split by non-breaking spaces",
+      { contentSecurityPolicy: "default-src\u00a0'none'; sandbox\u00a0" },
+    ],
+    [
+      "a public, cacheable Cache-Control",
+      { cacheControl: "public, max-age=3600" },
+    ],
+    [
+      "a Cache-Control without no-store",
+      { cacheControl: "private, max-age=60" },
+    ],
+  ])("refuses 502 with no bytes on %s", async (_case, headers) => {
+    const result = fileResult(headers);
+    const cancel = jest.spyOn(result.body.stream as ReadableStream, "cancel");
+    mockArtifactFile.mockResolvedValue(result);
+    const res = await get();
+    expect(cancel).toHaveBeenCalled();
+    await expectBodylessRefusal(res, 502);
+  });
+
+  it("serves the hub's own attachment policy, compared case-insensitively", async () => {
+    mockArtifactFile.mockResolvedValue(
+      fileResult({
+        contentDisposition: 'Attachment; filename="brief-v2.pdf"',
+        contentTypeOptions: "NoSniff",
+        contentSecurityPolicy:
+          "default-src 'none'; sandbox; frame-ancestors 'none'; form-action 'none'; base-uri 'none'",
+        cacheControl: "no-store, Private",
+      }),
+    );
+    const res = await get();
+    expect(res.status).toBe(200);
+    await expect(res.text()).resolves.toBe("%PDF-1.7 bytes");
+  });
+
   it.each([
     ["a version of 0", PIECE, "0"],
     ["a version that is not a number", PIECE, "abc"],