create-ailk 0.29.1 → 0.31.0

package/dist/migrate-content.js

@@ -3,15 +3,16 @@
  * [--workspace <id>]` — import an existing site's MDX pages into its
  * workspace (#10207).
  *
- * The same import as `seed-workspace` — `importMdx` over `<dir>/content` with
+ * The same import as `seed-workspace` — `importMdx` over `<dir>/content`, and
+ * the docs-blog tree `<dir>/apps/web/content` when it exists (#10701), with
  * the site's own installed adapter — for the site `seed-workspace` refuses: one
  * with no `.ailk-site-manifest.json`, or a spoke, whose workspace lives on its
  * hub (D1). No manifest and no topology is read; the operator names the API
  * origin and the workspace, which is all the topology would decide.
  *
  * A dry run is the default (D3): the importer runs over `readOnlyFetch`, which
- * passes each `GET` through and answers a `POST` or `PATCH` locally without
- * sending it, so the plan — create · update · unchanged · skipped · failed — is
+ * passes each `GET` through and answers a `POST`, `PATCH` or `PUT` locally
+ * without sending it, so the plan — create · update · unchanged · skipped · failed — is
  * decided by the importer itself against the live workspace, and no write can
  * leave the process. `--apply` writes; a second `--apply` reports every page
  * `unchanged`.
@@ -27,7 +28,8 @@
  */
 import { join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { formatImportMdxReport, importMdx, loadSiteMdxAdapter, } from "./lib/import-mdx.js";
+import { languageLines, languageOffLine, withLanguage, } from "./language-import.js";
+import { formatImportMdxReport, importMdx, isDirectory, loadSiteMdxAdapter, outcomePath, } from "./lib/import-mdx.js";
 import { ParseError } from "./parse-args.js";
 import { AGENT_KEY_ENV_VAR, WORKSPACE_ID_ENV_VAR } from "./seed-workspace.js";
 import { HUB_ORIGIN_ENV_VAR, TopologyError, normalizeHubUrl, } from "./topology.js";
@@ -53,17 +55,20 @@ function given(value) {
 /**
  * A fetch that sends `GET`s through `inner` and never sends a write: a `POST`
  * is answered `201` and a `PATCH` `200` locally, with the one member of a
- * write's answer `importMdx` reads (`data.locale`). Any other method throws.
+ * write's answer `importMdx` reads (`data.locale`), and the structure write's
+ * `PUT` (#10534) `200` as a layout unchanged (`data.written: false`). Any
+ * other method throws.
  */
 export function readOnlyFetch(inner, locale) {
     return (async (input, init) => {
         const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
         if (method === "GET")
             return inner(input, init);
-        if (method !== "POST" && method !== "PATCH") {
+        if (method !== "POST" && method !== "PATCH" && method !== "PUT") {
             throw new Error(`a dry run sends no ${method} request`);
         }
-        return new Response(JSON.stringify({ ok: true, data: { locale } }), {
+        const data = method === "PUT" ? { locale, written: false } : { locale };
+        return new Response(JSON.stringify({ ok: true, data }), {
             status: method === "POST" ? 201 : 200,
             headers: { "content-type": "application/json" },
         });
@@ -81,8 +86,8 @@ const PLAN_VERB = {
 function planLine(outcome) {
     const verb = PLAN_VERB[outcome.result];
     return "reason" in outcome
-        ? `${outcome.path}: ${verb} — ${outcome.reason}`
-        : `${outcome.path}: ${verb}`;
+        ? `${outcomePath(outcome)}: ${verb} — ${outcome.reason}`
+        : `${outcomePath(outcome)}: ${verb}`;
 }
 // ── The command (D1–D4) ─────────────────────────────────────────────────────
 export async function migrateContent(opts) {
@@ -119,14 +124,29 @@ export async function migrateContent(opts) {
         : `Planning ${opts.targetDir} against ${at} Nothing is written without --apply.`);
     const adapters = opts.adapters ?? (await loadSiteMdxAdapter(targetDir));
     const fetch = opts.fetch ?? globalThis.fetch;
+    const transport = apply ? fetch : readOnlyFetch(fetch, LOCALE);
+    // #10735 D1 — the Language pass wraps the importer's read.
+    const pass = withLanguage(adapters, {
+        apiOrigin: origin,
+        workspaceId,
+        apiKey,
+        locale: LOCALE,
+        fetch: transport,
+        apply,
+        ...(opts.sleep !== undefined && { sleep: opts.sleep }),
+        onLine,
+    });
+    // #10701 D7 — the docs-blog tree, when the site has one.
+    const editorialRoot = join(targetDir, "apps", "web", "content");
     const result = await importMdx({
         contentRoot: join(targetDir, "content"),
-        adapters,
+        ...(isDirectory(editorialRoot) && { editorialRoot }),
+        adapters: pass.adapters,
         apiOrigin: origin,
         workspaceId,
         apiKey,
         defaultLocale: LOCALE,
-        fetch: apply ? fetch : readOnlyFetch(fetch, LOCALE),
+        fetch: transport,
         ...(opts.sleep !== undefined && { sleep: opts.sleep }),
         // A dry run's importer lines say `created`/`updated`, which nothing was.
         ...(apply && { onLine }),
@@ -148,7 +168,17 @@ export async function migrateContent(opts) {
             onLine(`${failed} page(s) would fail. Fix them before --apply.`);
         }
     }
-    return { result, exitCode: failed > 0 ? 1 : 0 };
+    // #10735 D7 — the Language lines come last.
+    const { result: language, off } = pass.report();
+    if (off !== undefined)
+        onLine(languageOffLine(off));
+    if (language !== undefined)
+        languageLines(language, apply).forEach(onLine);
+    return {
+        result,
+        exitCode: failed > 0 ? 1 : 0,
+        ...(language !== undefined && { language }),
+    };
 }
 export const MIGRATE_CONTENT_HELP = `create-ailk migrate-content — import an existing site's pages into its workspace.
 
@@ -174,11 +204,27 @@ content/<Type>/<slug>.mdx) is written to the workspace as a draft through
 the API's content routes, with the agent key, which is read from
 AILK_AGENT_KEY only and needs the content-edit grant. Nothing is published,
 so the live site does not change. The site needs no .ailk-site-manifest.json
-and may be a spoke; its dependencies must be installed.
+and may be a spoke; its dependencies must be installed. A page whose
+frontmatter carries sections is converted: its words are written to the
+page's Markdown and its sections to its layout.
+
+Each FAQ item and glossary-index term becomes one Language item of its kind,
+set Live when the run creates it, and its section pins the items in the
+order the file lists them. A question on several pages is one item, with
+the FAQ page's words (the glossary page's, for a term). Lines prefixed
+language: report each item, and each page the database read will not show
+as its file does. An API with no Language collection leaves them inline.
+
+When the site has apps/web/content, each blog post and docs page in it is
+written too: apps/web/content/en/blog/<slug>.mdx (or <slug>/index.mdx) as a
+BlogPosting, the same under docs as a DocsDetail, and each directory's own
+index.mdx as its BlogList or DocsList index. Their lines are prefixed
+editorial: — each outcome's root is content or editorial.
 
 A dry run prints create, update, unchanged, skipped or failed per page. It
 cannot see a write the API would refuse at --apply (a conflict or a server
-error), and a page whose content fails its page type is planned and saved
+error), nor a layout change on a page whose words did not change, and a
+page whose content fails its page type is planned and saved
 with errors the editor shows, not failed. --apply prints created, updated,
 unchanged, skipped or failed per page, so a re-run is safe. Exit 0 when no
 page failed, 1 when any did, 2 on a refusal (nothing is sent).

package/dist/module-architecture.js

@@ -1810,7 +1810,11 @@ export function coOwnedModuleDestinations() {
 //         `review-surface-registration.test.ts` and
 //         `workspace-module-registration.test.ts` (each a matrix over module
 //         sets), and mcp's `parity.test.ts` (counts the Server Actions and
-//         tool handlers of the FULL tree, which a stripped scaffold lacks).
+//         tool handlers of the FULL tree, which a stripped scaffold lacks),
+//         and mcp's `workspace-oauth.test.ts` (#10482 — its AC-8 cases call
+//         `get_agent_context` on `/mcp/workspace`, a tool only the
+//         `@working-theory/mcp-workspace` pack ships, and the `workspace`,
+//         `multi-tenant` and `signal-collectors` slices each carry that pack).
 //     The exclusion is per file, not a `testPathIgnorePatterns` entry in the
 //     scaffold's jest config: that would hide these suites from a keyed
 //     scaffold too, and from the suites a slice owns.
@@ -1853,6 +1857,7 @@ export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/api/src/__tests__/hub-install.test.ts",
     "apps/mcp/__tests__/workspace-surface.test.ts",
     "apps/mcp/__tests__/parity.test.ts",
+    "apps/mcp/__tests__/workspace-oauth.test.ts",
     "apps/web/app/[locale]/pricing/__tests__/monorepo-only.test.tsx",
     "apps/web/app/[locale]/pricing/__tests__/__snapshots__/monorepo-only.test.tsx.snap",
     "apps/web/lib/__tests__/hub-children.test.tsx",

package/dist/provision-env.d.ts

@@ -0,0 +1,28 @@
+import { type LicenseSetRunner } from "./license-set.js";
+/** The production variables each deployed app needs (#10392 D9). */
+export declare function provisionEnv(opts: {
+    webOrigin: string;
+    mcpOrigin: string;
+}): {
+    web: {
+        MCP_PUBLIC_HTTP_URL: string;
+    };
+    mcp: {
+        MCP_PUBLIC_HTTP_URL: string;
+        BETTER_AUTH_URL: string;
+    };
+};
+export interface ProvisionEnvIo {
+    /** Resolves a relative or absent `[dir]`. */
+    cwd: string;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    /** Defaults to `license set`'s runner: `vercel`, never through a shell. */
+    runner?: LicenseSetRunner;
+}
+export declare const PROVISION_ENV_HELP = "create-ailk provision-env \u2014 set a deployed site's MCP discovery and OAuth variables.\n\nUsage:\n  pnpm create ailk@latest provision-env --web-origin <origin> --mcp-origin <origin> [<target-dir>]\n\nArguments:\n  --web-origin <origin>    The site's public origin (apps/web), e.g. https://example.com\n  --mcp-origin <origin>    The MCP server's public origin (apps/mcp), e.g. https://mcp.example.com\n  <target-dir>             An already-scaffolded repo (contains\n                           architecture.yaml). Defaults to the current dir.\n\nSets MCP_PUBLIC_HTTP_URL on apps/web and apps/mcp, and BETTER_AUTH_URL on\napps/mcp, in each app's linked Vercel production environment. The variables\npersist across deploys. An app with no Vercel link gets the values printed to\nset on your host yourself. Re-run it whenever an origin changes.\n";
+/**
+ * Run `provision-env` with `argv` = everything after the `provision-env` word.
+ * Returns the process exit code; never throws for an expected failure.
+ */
+export declare function runProvisionEnv(argv: readonly string[], io: ProvisionEnvIo): number;

package/dist/provision-env.js

@@ -0,0 +1,210 @@
+/**
+ * `create-ailk provision-env --web-origin <o> --mcp-origin <o> [dir]` — set the
+ * production variables a deployed site needs for MCP discovery and OAuth
+ * (#10392 D9).
+ *
+ * `/.well-known/mcp.json` advertises the MCP HTTP endpoint only when
+ * `MCP_PUBLIC_HTTP_URL` is set (#7396), and names the OAuth metadata only when
+ * `BETTER_AUTH_URL` is set beside it (D8); apps/mcp turns its OAuth branch on
+ * only with both (#10391). This step derives every value from the two origins
+ * and puts them on each Vercel-linked app's production environment, so a
+ * deployment advertises its MCP endpoint without hand configuration:
+ *
+ *   apps/web   MCP_PUBLIC_HTTP_URL = <mcp-origin>/mcp
+ *   apps/mcp   MCP_PUBLIC_HTTP_URL = <mcp-origin>/mcp
+ *              BETTER_AUTH_URL     = <web-origin>
+ *
+ *   1. The target (default: cwd) must contain `architecture.yaml` — the
+ *      `license set` precondition — else exit 1 with nothing run.
+ *   2. For each of `<dir>/apps/web` and `<dir>/apps/mcp` holding
+ *      `.vercel/project.json`: print its `projectId`, then per variable
+ *      `vercel env rm <NAME> production --yes` (failure tolerated: it may not
+ *      exist yet) and `vercel env add <NAME> production`, the value on STDIN.
+ *      No redeploy: the variables persist, and the next deploy reads them.
+ *   3. An app with no link → its `NAME=value` lines are printed, to set by
+ *      hand. `vercel` missing → exit 1 with the manual commands. A failed
+ *      `env add` → exit 1 naming the variable now unset, as `license set` does.
+ *
+ * A value is never an argv element of a spawned process. Local `.env.local`
+ * files are deliberately not given an MCP URL: locally apps/mcp defaults to
+ * stdio, so a loopback URL would advertise an endpoint nothing serves.
+ *
+ * Pure module: output and the process runner are injected, so jest drives it.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { defaultRunner } from "./license-set.js";
+/** apps/mcp's default `MCP_HTTP_PATH`. */
+const MCP_PATH = "/mcp";
+const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/** The production variables each deployed app needs (#10392 D9). */
+export function provisionEnv(opts) {
+    const webOrigin = assertOrigin(opts.webOrigin, "--web-origin");
+    const mcpOrigin = assertOrigin(opts.mcpOrigin, "--mcp-origin");
+    const mcpUrl = `${mcpOrigin}${MCP_PATH}`;
+    return {
+        web: { MCP_PUBLIC_HTTP_URL: mcpUrl },
+        mcp: { MCP_PUBLIC_HTTP_URL: mcpUrl, BETTER_AUTH_URL: webOrigin },
+    };
+}
+/**
+ * The origin `value` names: an absolute `https:` URL, or `http:` on a loopback
+ * host, with no path, query or fragment. Throws naming the flag otherwise.
+ */
+function assertOrigin(value, flag) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new ProvisionEnvError(`${flag} must be an absolute URL, e.g. https://example.com`);
+    }
+    const secure = url.protocol === "https:" ||
+        (url.protocol === "http:" && LOOPBACK_HOSTS.includes(url.hostname));
+    if (!secure) {
+        throw new ProvisionEnvError(`${flag} must be https (http is allowed only on localhost)`);
+    }
+    // A host name only: letters, digits, dots and hyphens (or a bracketed IPv6
+    // loopback). The URL parser keeps shell characters in a host, and the value
+    // is printed in a copyable manual command.
+    if (!/^(?:[A-Za-z0-9.-]+|\[::1\])$/.test(url.hostname)) {
+        throw new ProvisionEnvError(`${flag} must name a plain host (letters, digits, dots, hyphens)`);
+    }
+    if (url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "") {
+        throw new ProvisionEnvError(`${flag} must be an origin only — no path, query or fragment`);
+    }
+    return url.origin;
+}
+class ProvisionEnvError extends Error {
+}
+export const PROVISION_ENV_HELP = `create-ailk provision-env — set a deployed site's MCP discovery and OAuth variables.
+
+Usage:
+  pnpm create ailk@latest provision-env --web-origin <origin> --mcp-origin <origin> [<target-dir>]
+
+Arguments:
+  --web-origin <origin>    The site's public origin (apps/web), e.g. https://example.com
+  --mcp-origin <origin>    The MCP server's public origin (apps/mcp), e.g. https://mcp.example.com
+  <target-dir>             An already-scaffolded repo (contains
+                           architecture.yaml). Defaults to the current dir.
+
+Sets MCP_PUBLIC_HTTP_URL on apps/web and apps/mcp, and BETTER_AUTH_URL on
+apps/mcp, in each app's linked Vercel production environment. The variables
+persist across deploys. An app with no Vercel link gets the values printed to
+set on your host yourself. Re-run it whenever an origin changes.
+`;
+const APPS = [
+    { dir: join("apps", "web"), key: "web" },
+    { dir: join("apps", "mcp"), key: "mcp" },
+];
+function parseProvisionEnvArgs(argv) {
+    const parsed = {
+        help: false,
+        webOrigin: undefined,
+        mcpOrigin: undefined,
+        target: undefined,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h")
+            parsed.help = true;
+        else if (arg === "--web-origin")
+            parsed.webOrigin = argv[++i];
+        else if (arg === "--mcp-origin")
+            parsed.mcpOrigin = argv[++i];
+        else if (arg.startsWith("-"))
+            throw new ProvisionEnvError(`unknown option ${arg}`);
+        else if (parsed.target === undefined)
+            parsed.target = arg;
+        else
+            throw new ProvisionEnvError("expected at most one target directory");
+    }
+    return parsed;
+}
+function readProjectId(dir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(dir, ".vercel", "project.json"), "utf8"));
+        if (typeof raw.projectId === "string" && raw.projectId.length > 0)
+            return raw.projectId;
+    }
+    catch {
+        // fall through
+    }
+    throw new ProvisionEnvError(`${join(dir, ".vercel", "project.json")} has no readable projectId; run \`vercel link\` there, then re-run.`);
+}
+const envRm = (name) => ["env", "rm", name, "production", "--yes"];
+const envAdd = (name) => ["env", "add", name, "production"];
+/** The commands that set `vars` by hand, from `dir`. */
+function manualCommands(dir, vars) {
+    return [
+        `  cd '${dir}'`,
+        ...Object.entries(vars).map(([name, value]) => `  printf '%s' '${value}' | vercel ${envAdd(name).join(" ")}`),
+    ].join("\n");
+}
+/**
+ * Run `provision-env` with `argv` = everything after the `provision-env` word.
+ * Returns the process exit code; never throws for an expected failure.
+ */
+export function runProvisionEnv(argv, io) {
+    const runner = io.runner ?? defaultRunner;
+    const fail = (message) => {
+        io.stderr(`[create-ailk] provision-env: ${message}\n`);
+        return 1;
+    };
+    let args;
+    let values;
+    try {
+        args = parseProvisionEnvArgs(argv);
+        if (args.help) {
+            io.stdout(PROVISION_ENV_HELP);
+            return 0;
+        }
+        if (args.webOrigin === undefined || args.mcpOrigin === undefined) {
+            throw new ProvisionEnvError(`--web-origin and --mcp-origin are both required.\n\n${PROVISION_ENV_HELP}`);
+        }
+        values = provisionEnv({ webOrigin: args.webOrigin, mcpOrigin: args.mcpOrigin });
+    }
+    catch (err) {
+        if (err instanceof ProvisionEnvError)
+            return fail(err.message);
+        throw err;
+    }
+    const target = resolve(io.cwd, args.target ?? ".");
+    if (!existsSync(join(target, "architecture.yaml"))) {
+        return fail(`not a scaffolded repo: no architecture.yaml at ${target}. Run it from your site's root, or pass the site's directory.`);
+    }
+    for (const app of APPS) {
+        const dir = join(target, app.dir);
+        const vars = values[app.key];
+        if (!existsSync(join(dir, ".vercel", "project.json"))) {
+            io.stdout(`[create-ailk] ${app.dir} has no Vercel link (.vercel/project.json); set these on its host yourself:\n${Object.entries(vars)
+                .map(([name, value]) => `  ${name}=${value}`)
+                .join("\n")}\n`);
+            continue;
+        }
+        let projectId;
+        try {
+            projectId = readProjectId(dir);
+        }
+        catch (err) {
+            return fail(err.message);
+        }
+        io.stdout(`[create-ailk] Setting ${Object.keys(vars).join(", ")} (production) on Vercel project ${projectId}, linked at ${dir}\n`);
+        for (const [name, value] of Object.entries(vars)) {
+            const rm = runner(envRm(name), { cwd: dir });
+            if (rm.error?.code === "ENOENT") {
+                return fail(`the vercel CLI was not found; nothing was pushed. Install it (npm i -g vercel), or set them by hand:\n${manualCommands(dir, vars)}`);
+            }
+            const removed = rm.error === undefined && rm.status === 0;
+            const add = runner(envAdd(name), { cwd: dir, input: value });
+            if (add.error !== undefined || add.status !== 0) {
+                const state = removed
+                    ? `The production variable ${name} is now UNSET there (the old value was removed).`
+                    : `The production variable ${name} was not changed.`;
+                return fail(`\`vercel ${envAdd(name).join(" ")}\` failed on project ${projectId}. ${state} Finish with:\n${manualCommands(dir, { [name]: value })}`);
+            }
+        }
+    }
+    io.stdout("[create-ailk] MCP discovery and OAuth variables set; the next deploy reads them.\n");
+    return 0;
+}

package/dist/seed-workspace.d.ts

@@ -4,6 +4,8 @@ import { type Topology } from "./topology.js";
 export declare const AGENT_KEY_ENV_VAR = "AILK_AGENT_KEY";
 /** The environment variable the workspace id is read from when no flag names one. */
 export declare const WORKSPACE_ID_ENV_VAR = "AILK_WORKSPACE_ID";
+/** The environment variable each app chooses its content source by (#10659). */
+export declare const CONTENT_ADAPTER_ENV_VAR = "CONTENT_ADAPTER";
 /** A refusal the CLI exits 2 on, thrown before any request is sent. */
 export declare class SeedWorkspaceRefusedError extends Error {
     readonly exitCode = 2;
@@ -67,5 +69,5 @@ export interface SeedWorkspaceArgs {
     workspaceId: string | undefined;
     help: boolean;
 }
-export declare const SEED_WORKSPACE_HELP = "create-ailk seed-workspace \u2014 import a starter's pages into its workspace.\n\nUsage:\n  AILK_AGENT_KEY=<key> create-ailk seed-workspace [<dir>] [--api-url <origin>] [--workspace <wksp_id>]\n\nArguments:\n  <dir>                    The site. Defaults to the current dir.\n\nOptions:\n  --api-url <origin>       The site's API origin. Else AILK_API_URL. https:\n                           only (http: on localhost or 127.0.0.1).\n  --workspace <wksp_id>    The workspace the pages are written to. Else\n                           AILK_WORKSPACE_ID.\n  -h, --help               Show this help.\n\nEach content/en/<Type>/<slug>.mdx page is written to the workspace as a\ndraft through the API's content routes, with the agent key, which is read\nfrom AILK_AGENT_KEY only and needs the content-edit grant. Each page prints\ncreated, updated, unchanged, skipped or failed, so a re-run is safe. The\nsite's dependencies must be installed. Exit 0 when every page was seeded, 1\nwhen any failed, 2 on a refusal (nothing is sent).\n";
+export declare const SEED_WORKSPACE_HELP = "create-ailk seed-workspace \u2014 import a starter's pages into its workspace.\n\nUsage:\n  AILK_AGENT_KEY=<key> create-ailk seed-workspace [<dir>] [--api-url <origin>] [--workspace <wksp_id>]\n\nArguments:\n  <dir>                    The site. Defaults to the current dir.\n\nOptions:\n  --api-url <origin>       The site's API origin. Else AILK_API_URL. https:\n                           only (http: on localhost or 127.0.0.1).\n  --workspace <wksp_id>    The workspace the pages are written to. Else\n                           AILK_WORKSPACE_ID.\n  -h, --help               Show this help.\n\nEach content/en/<Type>/<slug>.mdx page is written to the workspace, and set\nLive when it has no Live version, through the API's content routes, with the\nagent key, which is read from AILK_AGENT_KEY only and needs the content-edit\nand content-publish grants. Each page prints created, updated, unchanged,\nskipped or failed, so a re-run is safe. When every page is Live, the site\nswitches apps/web and apps/api to CONTENT_ADAPTER=database, keeping a value\neither already sets. The site's dependencies must be installed. Exit 0 when\nevery page was seeded, 1 when any failed, 2 on a refusal (nothing is sent).\n";
 export declare function parseSeedWorkspaceArgs(argv: string[]): SeedWorkspaceArgs;

package/dist/seed-workspace.js

@@ -6,7 +6,10 @@
  * A fresh scaffold's `content/` tree is exactly its roster (spec §1), so the
  * seed is `importMdx` over `<dir>/content` with the site's own installed
  * adapter (D1): one `text/page` Artifact per page, and a re-run writes
- * nothing and reports every page `unchanged`.
+ * nothing and reports every page `unchanged`. Each page with no Live version
+ * is set Live, and when every page is Live both apps that choose a content
+ * source are switched to `CONTENT_ADAPTER=database`, each keeping a value it
+ * already sets (#10659 D3); anything less leaves the site on `content/`.
  *
  * The API origin comes from `--api-url`, else `AILK_API_URL`; the workspace
  * id from `--workspace`, else `AILK_WORKSPACE_ID`; the agent key from
@@ -18,12 +21,14 @@
  *
  * The scaffold-time step (D3, D6) runs only on a hub with an Admin
  * (`workspace` or `multi-tenant`), after `--install`, with all three
- * variables set; otherwise it prints why and the command that seeds later,
- * or nothing on a site with no Admin. It never fails the scaffold.
+ * variables set; otherwise it prints why and the command that seeds and
+ * switches later, or nothing on a site with no Admin. It never fails the
+ * scaffold.
  *
  * Pure module: no `import.meta.url`, so jest can import it directly. `fetch`,
  * `sleep`, `env` and the adapter are injectable. Spec:
- * docs/specs/10204-seed-the-starter-s-roster-spec.md.
+ * docs/specs/10204-seed-the-starter-s-roster-spec.md; the publish and the
+ * switch docs/specs/10659-a-licensed-hub-scaffold-starts-spec.md.
  */
 import { join, resolve } from "node:path";
 import { parseArgs } from "node:util";
@@ -31,11 +36,13 @@ import { AddModuleRefusedError } from "./add-module-core.js";
 import { ImportMdxRefusedError, formatImportMdxReport, importMdx, loadSiteMdxAdapter, } from "./lib/import-mdx.js";
 import { ParseError } from "./parse-args.js";
 import { readSiteRoster } from "./site-roster.js";
-import { HUB_ORIGIN_ENV_VAR, TopologyError, normalizeHubUrl, readSiteTopology, } from "./topology.js";
+import { HUB_ORIGIN_ENV_VAR, TopologyError, normalizeHubUrl, readSiteTopology, writeApiEnv, writeWebEnv, } from "./topology.js";
 /** The environment variable the agent key is read from — and nowhere else. */
 export const AGENT_KEY_ENV_VAR = "AILK_AGENT_KEY";
 /** The environment variable the workspace id is read from when no flag names one. */
 export const WORKSPACE_ID_ENV_VAR = "AILK_WORKSPACE_ID";
+/** The environment variable each app chooses its content source by (#10659). */
+export const CONTENT_ADAPTER_ENV_VAR = "CONTENT_ADAPTER";
 /** A refusal the CLI exits 2 on, thrown before any request is sent. */
 export class SeedWorkspaceRefusedError extends Error {
     exitCode = 2;
@@ -83,7 +90,7 @@ export async function seedWorkspace(opts) {
     }
     const apiKey = given(env[AGENT_KEY_ENV_VAR]);
     if (apiKey === undefined) {
-        refuse(`set ${AGENT_KEY_ENV_VAR} to an agent key with the content-edit grant. It is read from the environment only — never a flag or a file.`);
+        refuse(`set ${AGENT_KEY_ENV_VAR} to an agent key with the content-edit and content-publish grants. It is read from the environment only — never a flag or a file.`);
     }
     const workspaceId = given(opts.workspaceId) ?? given(env[WORKSPACE_ID_ENV_VAR]);
     if (workspaceId === undefined) {
@@ -115,12 +122,30 @@ export async function seedWorkspace(opts) {
         ...(opts.fetch !== undefined && { fetch: opts.fetch }),
         ...(opts.sleep !== undefined && { sleep: opts.sleep }),
         onLine,
+        publish: true,
     });
     // The report's count line alone: no page rows.
     onLine(formatImportMdxReport({ pages: [], counts: result.counts }).trimEnd());
-    const { failed } = result.counts;
-    if (failed > 0) {
-        onLine(`${failed} page(s) were not seeded. Fix them and re-run: create-ailk seed-workspace ${opts.targetDir}`);
+    const { created, updated, unchanged, failed } = result.counts;
+    const live = result.live ?? 0;
+    onLine(`Live: ${live} page(s), ${result.published ?? 0} published now.`);
+    // #10659 D3 — both apps switch only when every page is in and Live.
+    if (failed === 0 && live >= 1 && live === created + updated + unchanged) {
+        for (const [app, file, write] of [
+            ["apps/web", "apps/web/.env.local", writeWebEnv],
+            ["apps/api", "apps/api/.env", writeApiEnv],
+        ]) {
+            onLine(write(targetDir, CONTENT_ADAPTER_ENV_VAR, () => "database")
+                ? `Content source: the database for ${app} (${CONTENT_ADAPTER_ENV_VAR}=database in ${file}).`
+                : `Content source: ${app} already sets ${CONTENT_ADAPTER_ENV_VAR}, which was kept.`);
+        }
+        onLine("  The API serves these pages from the database it was seeded through (DATABASE_URL), for the workspace its site resolves.");
+    }
+    else {
+        if (failed > 0) {
+            onLine(`${failed} page(s) were not seeded. Fix them and re-run: create-ailk seed-workspace ${opts.targetDir}`);
+        }
+        onLine("Content source: content/ (unchanged) until every page is seeded and Live.");
     }
     return { result, exitCode: failed > 0 ? 1 : 0 };
 }
@@ -166,9 +191,10 @@ export async function runScaffoldSeed(opts) {
     const plan = scaffoldSeedPlan(opts);
     if (plan.kind === "not-applicable")
         return;
+    const later = `  To seed it and switch to the database later: ${AGENT_KEY_ENV_VAR}=<key> create-ailk seed-workspace ${opts.targetDir} --api-url <origin> --workspace <wksp_id>`;
     if (plan.kind === "skip") {
         opts.onLine(plan.reason);
-        opts.onLine(`  To seed it later: ${AGENT_KEY_ENV_VAR}=<key> create-ailk seed-workspace ${opts.targetDir} --api-url <origin> --workspace <wksp_id>`);
+        opts.onLine(later);
         return;
     }
     opts.onLine("Seeding the workspace:");
@@ -188,6 +214,7 @@ export async function runScaffoldSeed(opts) {
             throw err;
         }
         opts.onLine(err.message);
+        opts.onLine(later);
     }
 }
 export const SEED_WORKSPACE_HELP = `create-ailk seed-workspace — import a starter's pages into its workspace.
@@ -205,12 +232,14 @@ Options:
                            AILK_WORKSPACE_ID.
   -h, --help               Show this help.
 
-Each content/en/<Type>/<slug>.mdx page is written to the workspace as a
-draft through the API's content routes, with the agent key, which is read
-from AILK_AGENT_KEY only and needs the content-edit grant. Each page prints
-created, updated, unchanged, skipped or failed, so a re-run is safe. The
-site's dependencies must be installed. Exit 0 when every page was seeded, 1
-when any failed, 2 on a refusal (nothing is sent).
+Each content/en/<Type>/<slug>.mdx page is written to the workspace, and set
+Live when it has no Live version, through the API's content routes, with the
+agent key, which is read from AILK_AGENT_KEY only and needs the content-edit
+and content-publish grants. Each page prints created, updated, unchanged,
+skipped or failed, so a re-run is safe. When every page is Live, the site
+switches apps/web and apps/api to CONTENT_ADAPTER=database, keeping a value
+either already sets. The site's dependencies must be installed. Exit 0 when
+every page was seeded, 1 when any failed, 2 on a refusal (nothing is sent).
 `;
 export function parseSeedWorkspaceArgs(argv) {
     let parsed;

package/dist/surfaces.js

@@ -818,6 +818,8 @@ export const ROUTE_SINCE = {
     "(auth)/forgot-password": "0.24.0",
     "(auth)/reset-password": "0.24.0",
     "(auth)/verify-email": "0.24.0",
+    // #10357 D13 — the MCP consent step.
+    "(auth)/consent": "0.53.0",
     // #5469 D2 — the generic `[slug]` content route. A genuinely new route
     // directory, so it attaches at today's fixed-group version, the same rule
     // #5479, #5371 and #5048 applied.
@@ -1210,6 +1212,7 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(auth)/forgot-password": ["auth"],
     "(auth)/reset-password": ["auth"],
     "(auth)/verify-email": ["auth"],
+    "(auth)/consent": ["mcpConsent"],
     "(authed)/account": ["account"],
     "(authed)/account/inbox/[kind]/[id]": ["account"],
     "(authed)/account/settings": ["account"],

package/dist/topology.d.ts

@@ -215,6 +215,18 @@ export declare const HUB_ORIGIN_ENV_VAR = "AILK_API_URL";
  * the hub issues those.
  */
 export declare function writeHubOriginEnv(targetDir: string, origin: string): void;
+/**
+ * `<name>=<value()>` into `apps/web/.env.local`, unless any env file Next
+ * loads for `apps/web` already assigns `name` (`value` is then never called);
+ * and `.env.local` gitignored either way. `true` when the line was written.
+ */
+export declare function writeWebEnv(targetDir: string, name: string, value: () => string): boolean;
+/**
+ * `<name>=<value()>` into `apps/api/.env` — the one file the API's
+ * `dotenv.config()` reads — under `writeWebEnv`'s never-clobber rule, and
+ * `.env` gitignored either way (#10659 D6). `true` when the line was written.
+ */
+export declare function writeApiEnv(targetDir: string, name: string, value: () => string): boolean;
 /** The env var naming the hub's web origin a hub-mode spoke signs in at (#7894 D11). */
 export declare const HUB_SIGN_IN_URL_ENV_VAR = "AILK_HUB_SIGN_IN_URL";
 /** The env var holding a hub-mode spoke's own cookie key material (#7894 D7, D11). */