create-ailk 0.29.0 → 0.30.0

package/README.md

@@ -592,11 +592,6 @@ command above. A site with no Admin, or a spoke, prints nothing about it. A
 seed that fails or is refused at scaffold time prints why and never fails the
 scaffold; `seed-workspace` is where a seed's result is an exit code.
 
-On a site carrying `signal-collectors`, the two `ThankYouPage` seeds
-`contact` and `newsletter` share an address (locale and slug) with the
-`ContactPage` and `NewsletterSignup` pages, so those two are reported
-`failed` and the seed exits 1 until one side's slug changes.
-
 To check a seed:
 
 ```bash

package/dist/add-route.js

@@ -336,6 +336,7 @@ const RESERVED_FIRST_SEGMENTS = new Set([
     "forgot-password",
     "reset-password",
     "verify-email",
+    "consent",
 ]);
 /** A first segment next-intl would read as a locale prefix. */
 const LOCALE_SHAPED_RE = /^[a-z]{2}(-[a-z]{2})?$/;

package/dist/cli.js

@@ -27,6 +27,8 @@
  *      print the report, exit (1 iff routes are missing in check mode)
  *      on a `license set` subcommand: write the key into the scaffold, push it
  *      to a linked Vercel project and redeploy, exit (#6683 D9)
+ *      on a `provision-env` subcommand: set MCP_PUBLIC_HTTP_URL (and apps/mcp's
+ *      BETTER_AUTH_URL) on the linked Vercel projects, exit (#10392 D9)
  *      on an `apply-design` subcommand: rewrite an existing site's look,
  *      print the changed-file report, exit (#6819)
  *      on an `update` subcommand: bring template fixes into a site's
@@ -76,6 +78,7 @@ import { LICENSE_SET_HELP, runLicenseSet } from "./license-set.js";
 import { MIGRATE_CONTENT_HELP, MigrateContentRefusedError, migrateContent, parseMigrateContentArgs, } from "./migrate-content.js";
 import { PLUGIN_INSTALL_LINES, ParseError, helpText, parseCliArgs, parseModules, resolveCliShape, toScaffoldOptions, } from "./parse-args.js";
 import { addModule, removeModule, formatSurfaceDrift, scaffold, syncArchitectureSync, syncCatalogSync, syncClaudeMdSync, syncRoutesSync, } from "./programmatic.js";
+import { PROVISION_ENV_HELP, runProvisionEnv } from "./provision-env.js";
 import { REMOVE_MODULE_HELP, RemoveModuleRefusedError, formatRemoveModuleReport, parseRemoveModuleArgs, } from "./remove-module.js";
 import { SEED_FLOWS_HELP, SeedFlowsRefusedError, parseSeedFlowsArgs, seedFlows, } from "./seed-flows.js";
 import { SEED_WORKSPACE_HELP, SeedWorkspaceRefusedError, parseSeedWorkspaceArgs, runScaffoldSeed, seedWorkspace, } from "./seed-workspace.js";
@@ -374,6 +377,15 @@ async function main() {
             readStdin: () => readFileSync(0, "utf8"),
         }));
     }
+    // `provision-env --web-origin <o> --mcp-origin <o> [dir]` (#10392 D9): its
+    // own argv shape, beside `license set`. Values reach `vercel` on stdin only.
+    if (argv[0] === "provision-env") {
+        process.exit(runProvisionEnv(argv.slice(1), {
+            cwd: process.cwd(),
+            stdout: (text) => process.stdout.write(text),
+            stderr: (text) => process.stderr.write(text),
+        }));
+    }
     // `apply-design <name|path> [--target <dir>]` (#6819): rewrite an existing
     // site's look only. Every refusal — the licence gate included — reaches
     // the top-level catch, exit 1, as a scaffold-time design refusal does.
@@ -476,7 +488,9 @@ async function main() {
             "\n" +
             UPDATE_HELP +
             "\n" +
-            LICENSE_SET_HELP);
+            LICENSE_SET_HELP +
+            "\n" +
+            PROVISION_ENV_HELP);
         process.exit(0);
     }
     if (opts.version) {

package/dist/lib/env-catalog.js

@@ -164,7 +164,7 @@ export const ENV_CATALOG = {
         secret: false,
     },
     MCP_PUBLIC_HTTP_URL: {
-        description: "The public URL of the MCP HTTP transport, advertised by /.well-known/mcp.json.",
+        description: "The public URL of the MCP HTTP transport (apps/mcp's `/mcp`), advertised by /.well-known/mcp.json; with BETTER_AUTH_URL it turns on the OAuth metadata. Set by create-ailk provision-env.",
         secret: false,
     },
     MCP_TRANSPORT: {

package/dist/lib/import-mdx.js

@@ -4,7 +4,7 @@
  * Reads a site's default-locale MDX pages through the site's own MDX adapter
  * and writes each one as a `text/page` Artifact through the tenant-guarded
  * workspace content routes. Per page (D3): read the draft; create on 404;
- * PATCH under `If-Match` when the content differs; write nothing when it is
+ * PATCH under `X-Draft-Version` (#10264) when the content differs; write nothing when it is
  * the same — so a second run over the same files creates nothing and reports
  * every page `unchanged`. A file the adapter rejects is `failed` with its path
  * and reason and the run goes on. The seed step (U6b) and `migrate-content`
@@ -204,7 +204,10 @@ async function call(t, method, url, body, ifMatch) {
                 headers: {
                     authorization: `Bearer ${t.key}`,
                     ...(body !== undefined && { "content-type": "application/json" }),
-                    ...(ifMatch !== undefined && { "if-match": ifMatch }),
+                    // #10264 — the version rides `x-draft-version`; `if-match` rides
+                    // beside it for one release so this importer still saves against an
+                    // API that predates the new header (the route prefers the new one).
+                    ...(ifMatch !== undefined && { "x-draft-version": ifMatch, "if-match": ifMatch }),
                 },
                 ...(body !== undefined && { body: JSON.stringify(body) }),
                 // A redirect would re-send the key and the body to another URL.
@@ -304,9 +307,12 @@ async function writePage(t, page, locale, content) {
         if (created.status === 201) {
             return wrongLocale(path, created, locale) ?? done("created");
         }
-        // 409: created by someone else since the read — read it once more.
-        if (created.status !== 409)
+        // 409 slug_taken: another type holds this page's registry link (#10268
+        // D5) — reported as it is, since a re-read at this address finds nothing.
+        // Any other 409: created by someone else since the read — read it once more.
+        if (created.status !== 409 || created.code === "slug_taken") {
             return refusedAnswer(path, created);
+        }
     }
 }
 // ── The report (D6) ─────────────────────────────────────────────────────────
@@ -348,21 +354,24 @@ export async function importMdx(opts) {
         outcomes.push(outcome);
         onLine(outcomeLine(outcome));
     };
-    // Two pages at one (locale, slug) address would overwrite each other on
-    // every run, so the first in processing order wins and the rest fail.
+    // Two pages at one (locale, type, slug) address would overwrite each other
+    // on every run — the legacy and the locale-tree copy of one page — so the
+    // first in processing order wins and the rest fail. Two pages of different
+    // types may share a slug (#10268 D7): the store addresses by type too.
     const addresses = new Map();
     let halt;
     for (const page of pages) {
-        const holder = addresses.get(page.slug);
+        const address = `${page.type}/${page.slug}`;
+        const holder = addresses.get(address);
         if (holder !== undefined) {
             record({
                 path: page.path,
                 result: "failed",
-                reason: `same address as ${holder} (a page is addressed by locale and slug)`,
+                reason: `same address as ${holder} (a page is addressed by locale, type and slug)`,
             });
             continue;
         }
-        addresses.set(page.slug, page.path);
+        addresses.set(address, page.path);
         if (halt !== undefined) {
             record({ path: page.path, result: "failed", reason: halt });
             continue;

package/dist/lib/scaffold-render-sweep.d.ts

@@ -143,7 +143,7 @@ export declare function assessConfigGatedRoute(input: {
  * The environment the sitemap sweep's server runs under (#8501): `env` with
  * every `CONFIG_GATED_ROUTES` variable removed.
  *
- * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * `/sitemap.xml` is rendered on request, from the content seeds, so it
  * describes the scaffold AS GENERATED — and a config-gated route's seeds are
  * served only while its variable is unset (the Free placeholder hand-off,
  * #6942). Set it and the route serves its live module page instead: `/meet`

package/dist/lib/scaffold-render-sweep.js

@@ -285,7 +285,7 @@ function headingTexts(html) {
  * The environment the sitemap sweep's server runs under (#8501): `env` with
  * every `CONFIG_GATED_ROUTES` variable removed.
  *
- * `/sitemap.xml` is prerendered at `next build`, from the content seeds, so it
+ * `/sitemap.xml` is rendered on request, from the content seeds, so it
  * describes the scaffold AS GENERATED — and a config-gated route's seeds are
  * served only while its variable is unset (the Free placeholder hand-off,
  * #6942). Set it and the route serves its live module page instead: `/meet`

package/dist/module-architecture.js

@@ -1810,7 +1810,11 @@ export function coOwnedModuleDestinations() {
 //         `review-surface-registration.test.ts` and
 //         `workspace-module-registration.test.ts` (each a matrix over module
 //         sets), and mcp's `parity.test.ts` (counts the Server Actions and
-//         tool handlers of the FULL tree, which a stripped scaffold lacks).
+//         tool handlers of the FULL tree, which a stripped scaffold lacks),
+//         and mcp's `workspace-oauth.test.ts` (#10482 — its AC-8 cases call
+//         `get_agent_context` on `/mcp/workspace`, a tool only the
+//         `@working-theory/mcp-workspace` pack ships, and the `workspace`,
+//         `multi-tenant` and `signal-collectors` slices each carry that pack).
 //     The exclusion is per file, not a `testPathIgnorePatterns` entry in the
 //     scaffold's jest config: that would hide these suites from a keyed
 //     scaffold too, and from the suites a slice owns.
@@ -1853,6 +1857,7 @@ export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/api/src/__tests__/hub-install.test.ts",
     "apps/mcp/__tests__/workspace-surface.test.ts",
     "apps/mcp/__tests__/parity.test.ts",
+    "apps/mcp/__tests__/workspace-oauth.test.ts",
     "apps/web/app/[locale]/pricing/__tests__/monorepo-only.test.tsx",
     "apps/web/app/[locale]/pricing/__tests__/__snapshots__/monorepo-only.test.tsx.snap",
     "apps/web/lib/__tests__/hub-children.test.tsx",

package/dist/provision-env.d.ts

@@ -0,0 +1,28 @@
+import { type LicenseSetRunner } from "./license-set.js";
+/** The production variables each deployed app needs (#10392 D9). */
+export declare function provisionEnv(opts: {
+    webOrigin: string;
+    mcpOrigin: string;
+}): {
+    web: {
+        MCP_PUBLIC_HTTP_URL: string;
+    };
+    mcp: {
+        MCP_PUBLIC_HTTP_URL: string;
+        BETTER_AUTH_URL: string;
+    };
+};
+export interface ProvisionEnvIo {
+    /** Resolves a relative or absent `[dir]`. */
+    cwd: string;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    /** Defaults to `license set`'s runner: `vercel`, never through a shell. */
+    runner?: LicenseSetRunner;
+}
+export declare const PROVISION_ENV_HELP = "create-ailk provision-env \u2014 set a deployed site's MCP discovery and OAuth variables.\n\nUsage:\n  pnpm create ailk@latest provision-env --web-origin <origin> --mcp-origin <origin> [<target-dir>]\n\nArguments:\n  --web-origin <origin>    The site's public origin (apps/web), e.g. https://example.com\n  --mcp-origin <origin>    The MCP server's public origin (apps/mcp), e.g. https://mcp.example.com\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nSets MCP_PUBLIC_HTTP_URL on apps/web and apps/mcp, and BETTER_AUTH_URL on\napps/mcp, in each app's linked Vercel production environment. The variables\npersist across deploys. An app with no Vercel link gets the values printed to\nset on your host yourself. Re-run it whenever an origin changes.\n";
+/**
+ * Run `provision-env` with `argv` = everything after the `provision-env` word.
+ * Returns the process exit code; never throws for an expected failure.
+ */
+export declare function runProvisionEnv(argv: readonly string[], io: ProvisionEnvIo): number;

package/dist/provision-env.js

@@ -0,0 +1,210 @@
+/**
+ * `create-ailk provision-env --web-origin <o> --mcp-origin <o> [dir]` — set the
+ * production variables a deployed site needs for MCP discovery and OAuth
+ * (#10392 D9).
+ *
+ * `/.well-known/mcp.json` advertises the MCP HTTP endpoint only when
+ * `MCP_PUBLIC_HTTP_URL` is set (#7396), and names the OAuth metadata only when
+ * `BETTER_AUTH_URL` is set beside it (D8); apps/mcp turns its OAuth branch on
+ * only with both (#10391). This step derives every value from the two origins
+ * and puts them on each Vercel-linked app's production environment, so a
+ * deployment advertises its MCP endpoint without hand configuration:
+ *
+ *   apps/web   MCP_PUBLIC_HTTP_URL = <mcp-origin>/mcp
+ *   apps/mcp   MCP_PUBLIC_HTTP_URL = <mcp-origin>/mcp
+ *              BETTER_AUTH_URL     = <web-origin>
+ *
+ *   1. The target (default: cwd) must contain `architecture.yaml` — the
+ *      `license set` precondition — else exit 1 with nothing run.
+ *   2. For each of `<dir>/apps/web` and `<dir>/apps/mcp` holding
+ *      `.vercel/project.json`: print its `projectId`, then per variable
+ *      `vercel env rm <NAME> production --yes` (failure tolerated: it may not
+ *      exist yet) and `vercel env add <NAME> production`, the value on STDIN.
+ *      No redeploy: the variables persist, and the next deploy reads them.
+ *   3. An app with no link → its `NAME=value` lines are printed, to set by
+ *      hand. `vercel` missing → exit 1 with the manual commands. A failed
+ *      `env add` → exit 1 naming the variable now unset, as `license set` does.
+ *
+ * A value is never an argv element of a spawned process. Local `.env.local`
+ * files are deliberately not given an MCP URL: locally apps/mcp defaults to
+ * stdio, so a loopback URL would advertise an endpoint nothing serves.
+ *
+ * Pure module: output and the process runner are injected, so jest drives it.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { defaultRunner } from "./license-set.js";
+/** apps/mcp's default `MCP_HTTP_PATH`. */
+const MCP_PATH = "/mcp";
+const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/** The production variables each deployed app needs (#10392 D9). */
+export function provisionEnv(opts) {
+    const webOrigin = assertOrigin(opts.webOrigin, "--web-origin");
+    const mcpOrigin = assertOrigin(opts.mcpOrigin, "--mcp-origin");
+    const mcpUrl = `${mcpOrigin}${MCP_PATH}`;
+    return {
+        web: { MCP_PUBLIC_HTTP_URL: mcpUrl },
+        mcp: { MCP_PUBLIC_HTTP_URL: mcpUrl, BETTER_AUTH_URL: webOrigin },
+    };
+}
+/**
+ * The origin `value` names: an absolute `https:` URL, or `http:` on a loopback
+ * host, with no path, query or fragment. Throws naming the flag otherwise.
+ */
+function assertOrigin(value, flag) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new ProvisionEnvError(`${flag} must be an absolute URL, e.g. https://example.com`);
+    }
+    const secure = url.protocol === "https:" ||
+        (url.protocol === "http:" && LOOPBACK_HOSTS.includes(url.hostname));
+    if (!secure) {
+        throw new ProvisionEnvError(`${flag} must be https (http is allowed only on localhost)`);
+    }
+    // A host name only: letters, digits, dots and hyphens (or a bracketed IPv6
+    // loopback). The URL parser keeps shell characters in a host, and the value
+    // is printed in a copyable manual command.
+    if (!/^(?:[A-Za-z0-9.-]+|\[::1\])$/.test(url.hostname)) {
+        throw new ProvisionEnvError(`${flag} must name a plain host (letters, digits, dots, hyphens)`);
+    }
+    if (url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "") {
+        throw new ProvisionEnvError(`${flag} must be an origin only — no path, query or fragment`);
+    }
+    return url.origin;
+}
+class ProvisionEnvError extends Error {
+}
+export const PROVISION_ENV_HELP = `create-ailk provision-env — set a deployed site's MCP discovery and OAuth variables.
+
+Usage:
+  pnpm create ailk@latest provision-env --web-origin <origin> --mcp-origin <origin> [<target-dir>]
+
+Arguments:
+  --web-origin <origin>    The site's public origin (apps/web), e.g. https://example.com
+  --mcp-origin <origin>    The MCP server's public origin (apps/mcp), e.g. https://mcp.example.com
+  <target-dir>             An already-scaffolded repo (contains
+                           architecture.yaml). Defaults to the current dir.
+
+Sets MCP_PUBLIC_HTTP_URL on apps/web and apps/mcp, and BETTER_AUTH_URL on
+apps/mcp, in each app's linked Vercel production environment. The variables
+persist across deploys. An app with no Vercel link gets the values printed to
+set on your host yourself. Re-run it whenever an origin changes.
+`;
+const APPS = [
+    { dir: join("apps", "web"), key: "web" },
+    { dir: join("apps", "mcp"), key: "mcp" },
+];
+function parseProvisionEnvArgs(argv) {
+    const parsed = {
+        help: false,
+        webOrigin: undefined,
+        mcpOrigin: undefined,
+        target: undefined,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h")
+            parsed.help = true;
+        else if (arg === "--web-origin")
+            parsed.webOrigin = argv[++i];
+        else if (arg === "--mcp-origin")
+            parsed.mcpOrigin = argv[++i];
+        else if (arg.startsWith("-"))
+            throw new ProvisionEnvError(`unknown option ${arg}`);
+        else if (parsed.target === undefined)
+            parsed.target = arg;
+        else
+            throw new ProvisionEnvError("expected at most one target directory");
+    }
+    return parsed;
+}
+function readProjectId(dir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(dir, ".vercel", "project.json"), "utf8"));
+        if (typeof raw.projectId === "string" && raw.projectId.length > 0)
+            return raw.projectId;
+    }
+    catch {
+        // fall through
+    }
+    throw new ProvisionEnvError(`${join(dir, ".vercel", "project.json")} has no readable projectId; run \`vercel link\` there, then re-run.`);
+}
+const envRm = (name) => ["env", "rm", name, "production", "--yes"];
+const envAdd = (name) => ["env", "add", name, "production"];
+/** The commands that set `vars` by hand, from `dir`. */
+function manualCommands(dir, vars) {
+    return [
+        `  cd '${dir}'`,
+        ...Object.entries(vars).map(([name, value]) => `  printf '%s' '${value}' | vercel ${envAdd(name).join(" ")}`),
+    ].join("\n");
+}
+/**
+ * Run `provision-env` with `argv` = everything after the `provision-env` word.
+ * Returns the process exit code; never throws for an expected failure.
+ */
+export function runProvisionEnv(argv, io) {
+    const runner = io.runner ?? defaultRunner;
+    const fail = (message) => {
+        io.stderr(`[create-ailk] provision-env: ${message}\n`);
+        return 1;
+    };
+    let args;
+    let values;
+    try {
+        args = parseProvisionEnvArgs(argv);
+        if (args.help) {
+            io.stdout(PROVISION_ENV_HELP);
+            return 0;
+        }
+        if (args.webOrigin === undefined || args.mcpOrigin === undefined) {
+            throw new ProvisionEnvError(`--web-origin and --mcp-origin are both required.\n\n${PROVISION_ENV_HELP}`);
+        }
+        values = provisionEnv({ webOrigin: args.webOrigin, mcpOrigin: args.mcpOrigin });
+    }
+    catch (err) {
+        if (err instanceof ProvisionEnvError)
+            return fail(err.message);
+        throw err;
+    }
+    const target = resolve(io.cwd, args.target ?? ".");
+    if (!existsSync(join(target, "architecture.yaml"))) {
+        return fail(`not a scaffolded repo: no architecture.yaml at ${target}. Run it from your site's root, or pass the site's directory.`);
+    }
+    for (const app of APPS) {
+        const dir = join(target, app.dir);
+        const vars = values[app.key];
+        if (!existsSync(join(dir, ".vercel", "project.json"))) {
+            io.stdout(`[create-ailk] ${app.dir} has no Vercel link (.vercel/project.json); set these on its host yourself:\n${Object.entries(vars)
+                .map(([name, value]) => `  ${name}=${value}`)
+                .join("\n")}\n`);
+            continue;
+        }
+        let projectId;
+        try {
+            projectId = readProjectId(dir);
+        }
+        catch (err) {
+            return fail(err.message);
+        }
+        io.stdout(`[create-ailk] Setting ${Object.keys(vars).join(", ")} (production) on Vercel project ${projectId}, linked at ${dir}\n`);
+        for (const [name, value] of Object.entries(vars)) {
+            const rm = runner(envRm(name), { cwd: dir });
+            if (rm.error?.code === "ENOENT") {
+                return fail(`the vercel CLI was not found; nothing was pushed. Install it (npm i -g vercel), or set them by hand:\n${manualCommands(dir, vars)}`);
+            }
+            const removed = rm.error === undefined && rm.status === 0;
+            const add = runner(envAdd(name), { cwd: dir, input: value });
+            if (add.error !== undefined || add.status !== 0) {
+                const state = removed
+                    ? `The production variable ${name} is now UNSET there (the old value was removed).`
+                    : `The production variable ${name} was not changed.`;
+                return fail(`\`vercel ${envAdd(name).join(" ")}\` failed on project ${projectId}. ${state} Finish with:\n${manualCommands(dir, { [name]: value })}`);
+            }
+        }
+    }
+    io.stdout("[create-ailk] MCP discovery and OAuth variables set; the next deploy reads them.\n");
+    return 0;
+}

package/dist/surfaces.js

@@ -818,6 +818,8 @@ export const ROUTE_SINCE = {
     "(auth)/forgot-password": "0.24.0",
     "(auth)/reset-password": "0.24.0",
     "(auth)/verify-email": "0.24.0",
+    // #10357 D13 — the MCP consent step.
+    "(auth)/consent": "0.53.0",
     // #5469 D2 — the generic `[slug]` content route. A genuinely new route
     // directory, so it attaches at today's fixed-group version, the same rule
     // #5479, #5371 and #5048 applied.
@@ -1210,6 +1212,7 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(auth)/forgot-password": ["auth"],
     "(auth)/reset-password": ["auth"],
     "(auth)/verify-email": ["auth"],
+    "(auth)/consent": ["mcpConsent"],
     "(authed)/account": ["account"],
     "(authed)/account/inbox/[kind]/[id]": ["account"],
     "(authed)/account/settings": ["account"],

package/dist/topology.js

@@ -63,8 +63,12 @@ export const SPOKE_HUB_CHECKOUT_SEEDS = [
 export const SPOKE_REMOVAL_SEEDS = [
     "apps/web/auth.ts",
     "apps/web/lib/prisma-for-auth.ts",
+    // The MCP authorization server (#10357 D10): a spoke has no auth.ts to
+    // install it, and the root discovery route reads it.
+    "apps/web/lib/mcp-oauth.ts",
     "apps/web/lib/license-key-store.ts",
     "apps/web/app/api/auth",
+    "apps/web/app/.well-known/oauth-authorization-server",
     "apps/web/app/[locale]/(auth)",
     "apps/web/app/[locale]/(authed)",
     ...SPOKE_HUB_CHECKOUT_SEEDS,
@@ -949,6 +953,13 @@ export function renderSpokeHardFloors(opts) {
         "  # Stripe webhook route, the checkout route, its price map and its e2e",
         "  # workflow, and the sign-in paths are floored so their arrival here is a",
         "  # human merge.",
+        "  # Provenance (claude-setup#11353, claude-setup PR #11367): a `paths:` floor",
+        "  # below fires only when the touched file is site-edited or not template-owned.",
+        "  # A file whose PR-head bytes match its `.ailk-template-files.json` row AND the",
+        "  # published create-ailk template at that row's version is exempt, so a",
+        "  # `create-ailk update` that moves a template-owned file merges unattended.",
+        "  # Never for a high-cost floor (security_settings, payments), never to an older",
+        "  # template version, and only while the record already exists on main.",
         "  - kind: pricing",
         "  - kind: stripe_live_mode",
         "  - paths:",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.51.0",
-    "@working-theory/templates": "0.51.0"
+    "@working-theory/schema": "0.53.0",
+    "@working-theory/templates": "0.53.0"
   },
   "repository": {
     "type": "git",

package/templates/.env.example

@@ -606,6 +606,13 @@ CONTENT_ADAPTER=mdx
 # docs/runbooks/site-configuration.md § Seeding a spoke's flows.
 # AILK_SPOKE_FLOW_SEED=
 #
+# HUB (apps/api, optional) — the always-loaded set's token budget (#10504):
+# every Brief's body plus the Memory index an agent loads on each turn,
+# estimated at four characters a token. Past it the knowledge-base read sets
+# `warning: true` and still returns every doc whole. A whole number from 1 to
+# 1000000; unset means 8000. Any other value stops the API at boot.
+# AILK_CONTEXT_BUDGET_TOKENS=
+#
 # SPOKE (apps/web and apps/mcp, server-only — never NEXT_PUBLIC_). The key the
 # hub's `spokes register` printed. Sent as `x-ailk-spoke-key` on every
 # server-side call to AILK_API_URL, and only when that is https (or