create-ailk 0.6.0 → 0.6.1

package/README.md

@@ -133,7 +133,7 @@ fetched at scaffold time. `resolvePaidModules` in
 `src/lib/module-license-gate.ts` reads `AILK_LICENSE_KEY` from the environment
 (or an injected `licenseKey` option) and refuses the run when it is unset or
 empty, naming the paid modules requested and pointing at
-`https://ailaunchkit.ai/pro`. An invalid or lapsed key is refused the same way,
+`https://ailaunchkit.ai/pricing`. An invalid or lapsed key is refused the same way,
 from the module distribution's own 401/403 (`src/lib/fetch-module.ts`). The
 gate runs before anything is copied (`scaffold()` in `src/programmatic.ts`), so
 a refused run leaves no partial scaffold behind.

package/dist/cli.js

@@ -52,6 +52,35 @@ function readRawFlagValue(argv, flag) {
     }
     return undefined;
 }
+/**
+ * The prerequisites a freshly-scaffolded starter ACTUALLY has before
+ * `pnpm dev` / `pnpm build` will run (#6440 AC4).
+ *
+ * Read back off the scaffold that was just written rather than hard-coded
+ * here, so the printed floors can never drift from the ones the scaffold's own
+ * `engines` / `packageManager` fields enforce. Both fields are optional in
+ * principle; a missing one is simply not named, since naming a prerequisite
+ * the scaffold does not enforce is the other half of the defect this fixes.
+ */
+function readScaffoldPrerequisites(targetAbs) {
+    try {
+        const pkg = JSON.parse(readFileSync(resolve(targetAbs, "package.json"), "utf8"));
+        const node = pkg.engines?.node;
+        // `packageManager` is "pnpm@<version>[+<integrity>]" — the version only.
+        const pnpm = pkg.packageManager?.startsWith("pnpm@")
+            ? pkg.packageManager.slice("pnpm@".length).split("+")[0]
+            : undefined;
+        return {
+            ...(node !== undefined ? { node } : {}),
+            ...(pnpm !== undefined ? { pnpm } : {}),
+        };
+    }
+    catch {
+        // A scaffold with no readable root package.json is a bug the copy step
+        // would already have thrown on; next-steps is not the place to fail.
+        return {};
+    }
+}
 async function main() {
     const argv = process.argv.slice(2);
     // Subcommand dispatch, ahead of the flag parser: `sync-routes` has its own
@@ -166,14 +195,34 @@ async function main() {
             ? `Scaffolded AI Launch Kit starter from the "${opts.template}" template.`
             : "Scaffolded AI Launch Kit starter.",
         "",
-        "Next steps:",
-        `  cd ${targetAbs}`,
     ];
-    if (!opts.install)
-        lines.push("  pnpm install");
-    lines.push("  pnpm dev");
+    // Prerequisites (#6440 AC4) — every one the scaffold enforces, and nothing
+    // it does not. A starter reaches `pnpm dev` AND `pnpm build` on a toolchain
+    // alone: the Prisma client is generated by `database`'s own `postinstall`,
+    // so there is no generator step to remember, and no database, licence key or
+    // vendor API key gates either command. Saying so is the point — the previous
+    // output named no prerequisites at all, which left a customer to discover
+    // the toolchain floor from a failure.
+    const prereqs = readScaffoldPrerequisites(targetAbs);
+    const toolchain = [
+        prereqs.node !== undefined ? `Node.js ${prereqs.node}` : undefined,
+        prereqs.pnpm !== undefined ? `pnpm ${prereqs.pnpm}` : "pnpm",
+    ].filter((part) => part !== undefined);
+    if (toolchain.length > 0) {
+        lines.push(`Prerequisites: ${toolchain.join(" and ")} — that is all.`);
+        lines.push("No database, no licence key and no vendor API key are needed to run or build this site.");
+        lines.push("");
+    }
+    lines.push("Next steps:");
+    lines.push(`  cd ${targetAbs}`);
+    if (!opts.install) {
+        lines.push("  pnpm install     # also generates the Prisma client");
+    }
+    lines.push("  pnpm dev         # http://localhost:3000");
+    lines.push("  pnpm build       # production build, when you are ready to deploy");
     lines.push("");
     lines.push("Open http://localhost:3000 to see the home page.");
+    lines.push("Adding auth, saved flows, checkout or database-backed content later? README.md \u00a7 \"When you need a database\" has the one-command setup.");
     lines.push("");
     lines.push(`Route surfaces: ${CORE_SURFACE_PATHS.join(", ")}` +
         (surfaces.length > 0 ? ` + ${surfaces.join(", ")}` : ""));

package/dist/copy.d.ts

@@ -1,4 +1,12 @@
 import { type MarkerMap, type WorkspaceVersionMap } from "./substitute.js";
+/**
+ * THE marker map every layer of a scaffold substitutes with (#6460) — the base
+ * `templates/` copy below, and (threaded through `installBundleTree`) the base
+ * layer and site-template trees that land on top of it. One definition, so a
+ * `{{MARKER}}` resolves to the same value whichever layer authored the file it
+ * sits in; a second copy would let the two drift silently.
+ */
+export declare function buildScaffoldMarkers(projectName: string): MarkerMap;
 export interface CopyTemplateOptions {
     templatesDir: string;
     targetDir: string;
@@ -12,4 +20,10 @@ export interface CopyTemplateOptions {
      */
     excludePaths?: string[];
 }
+/**
+ * Whether a scaffolded path's content is text we run markers over. Exported
+ * because the template/base layer (`installBundleTree`) substitutes with the
+ * same classifier — one definition, not two (#6460).
+ */
+export declare function isTextFile(relativePath: string): boolean;
 export declare function copyTemplate(opts: CopyTemplateOptions): void;

package/dist/copy.js

@@ -20,7 +20,39 @@
  */
 import { copyFileSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from "node:fs";
 import { extname, join, relative, resolve, sep } from "node:path";
+import pkg from "../package.json" with { type: "json" };
 import { substituteMarkers, substituteWorkspaceVersions, } from "./substitute.js";
+/**
+ * This package's own `package.json` `"version"` — the value the
+ * `{{CREATE_AILK_VERSION}}` marker is stamped with at scaffold time (#6460).
+ * Deliberately a static JSON import rather than `import.meta.url` +
+ * `fileURLToPath`, for the reason `lib/fetch-module.ts`'s own
+ * `CREATE_AILK_VERSION` doc records: `copy.ts` is loaded directly by
+ * `copy.test.ts`, and `import.meta` is a SyntaxError under ts-jest's CommonJS
+ * transform.
+ */
+const CREATE_AILK_VERSION = pkg.version;
+/**
+ * THE marker map every layer of a scaffold substitutes with (#6460) — the base
+ * `templates/` copy below, and (threaded through `installBundleTree`) the base
+ * layer and site-template trees that land on top of it. One definition, so a
+ * `{{MARKER}}` resolves to the same value whichever layer authored the file it
+ * sits in; a second copy would let the two drift silently.
+ */
+export function buildScaffoldMarkers(projectName) {
+    return {
+        PROJECT_NAME: projectName,
+        COMPANY_NAME: "Your Company",
+        COMPANY_DOMAIN: "example.com",
+        // The social-profile handle the Free chrome's footer links carry
+        // (`https://x.com/{{COMPANY_HANDLE}}`, #5469 D5) — a placeholder the
+        // site owner replaces, never the kit vendor's own handle.
+        COMPANY_HANDLE: "yourcompany",
+        // Stamped into each DESIGN.md header so an installed scaffold records the
+        // create-ailk it was generated by (#6460).
+        CREATE_AILK_VERSION,
+    };
+}
 /**
  * Whether a walked template-relative path is inside (or equal to) an excluded
  * directory. Compares `/`-normalized paths so the check holds on Windows, and
@@ -65,7 +97,12 @@ const DOTFILES_AS_TEXT = new Set([
     ".prettierrc",
     ".eslintrc",
 ]);
-function isTextFile(relativePath) {
+/**
+ * Whether a scaffolded path's content is text we run markers over. Exported
+ * because the template/base layer (`installBundleTree`) substitutes with the
+ * same classifier — one definition, not two (#6460).
+ */
+export function isTextFile(relativePath) {
     const ext = extname(relativePath);
     if (TEXT_EXTS.has(ext))
         return true;

package/dist/lib/extract-module-bundle.d.ts

@@ -1,5 +1,5 @@
 import { type TemplateLayout } from "../site-chrome.js";
-import type { WorkspaceVersionMap } from "../substitute.js";
+import { type MarkerMap, type WorkspaceVersionMap } from "../substitute.js";
 /** Exported for `fetch-template.ts`/`fetch-module.ts`'s Content-Length guard (#5514) — one cap, not two literals. */
 export declare const MAX_TOTAL_SIZE_BYTES: number;
 /**
@@ -42,6 +42,8 @@ export interface ExtractModuleBundleOptions {
     templateExtends?: string;
     /** The call-scoped ownership registry (#5618 D4). See `InstallBundleTreeOptions`. */
     ownership?: LayerOwnership;
+    /** The scaffold's marker map (#6460). See `InstallBundleTreeOptions`. */
+    markers?: MarkerMap;
 }
 /**
  * Extract a fetched module bundle into `targetDir`, merging its files onto
@@ -89,6 +91,23 @@ export interface InstallBundleTreeOptions {
     ownership?: LayerOwnership;
     /** Canonical `@working-theory/*` versions for `workspace:*` substitution in patch targets. */
     versions?: WorkspaceVersionMap;
+    /**
+     * The scaffold's marker map (#6460) — `copy.ts`'s `buildScaffoldMarkers`,
+     * the SAME object `copyTemplate` substituted the base `templates/` copy
+     * with, threaded here so a `{{MARKER}}` resolves to the same value whichever
+     * layer authored the file it sits in. Applied by `copyTree` and the
+     * installMap loop below, to text files only (`copy.ts`'s own `isTextFile`),
+     * so the classifier is one definition rather than two. Absent ⟹ files land
+     * byte-for-byte as committed, the pre-#6460 behaviour.
+     *
+     * EVERY layer that lands on the snapshot gets it, modules included — not
+     * just the base layer and the site template. A bundle fetched by version
+     * from the paid registry may have been produced by an older create-ailk
+     * that never saw this pass, so a bundle author should know that the five
+     * mapped keys, and only those, now resolve in their `.md`/`.json`/`.ts`
+     * files; `substituteMarkers` leaves every other `{{KEY}}` alone.
+     */
+    markers?: MarkerMap;
 }
 /** `installBundleTree`'s result — presently only the template-only `layout` knobs. */
 export interface InstallBundleTreeResult {

package/dist/lib/extract-module-bundle.js

@@ -83,8 +83,10 @@ import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import * as tar from "tar";
+import { isTextFile } from "../copy.js";
 import { coOwnedModuleDestinations, } from "../module-architecture.js";
 import { validateTemplateLayout, } from "../site-chrome.js";
+import { substituteMarkers, } from "../substitute.js";
 import { computeModulePatches, writeModulePatches } from "./apply-module-patches.js";
 /** Soft limits to prevent decompression-bomb / zip-bomb attacks. Same values as extractBundle. */
 const MAX_ENTRIES = 1000;
@@ -446,6 +448,7 @@ export async function extractModuleBundle(options) {
                 : {}),
             ...(options.ownership !== undefined ? { ownership: options.ownership } : {}),
             ...(options.versions !== undefined ? { versions: options.versions } : {}),
+            ...(options.markers !== undefined ? { markers: options.markers } : {}),
         });
     }
     finally {
@@ -463,7 +466,7 @@ export async function extractModuleBundle(options) {
  * rejected tree leaves `targetDir` exactly as it was.
  */
 export function installBundleTree(options) {
-    const { sourceRoot, name, templateRequires, templateExtends, ownership } = options;
+    const { sourceRoot, name, templateRequires, templateExtends, ownership, markers } = options;
     const targetAbs = resolve(options.targetDir);
     const isTemplate = templateRequires !== undefined;
     const subject = isTemplate ? `template "${name}"` : `module "${name}"`;
@@ -526,6 +529,17 @@ export function installBundleTree(options) {
     // installMap destination) is read from the STAGED tree here, since
     // targetDir would not have it yet at this point.
     const installMapDestinationToSource = new Map(Object.entries(installMap).map(([source, destination]) => [destination, source]));
+    // #6460 — a patch target is read RAW from the staged tree here, while
+    // `copyTree` below writes the same path SUBSTITUTED, and
+    // `writeModulePatches` runs after `copyTree`. So a file a bundle both
+    // delivers as plain content AND patches would end up carrying unsubstituted
+    // markers. Unreachable today and asserted as such rather than guarded: the
+    // only patch targets any slice declares are `apps/web/package.json`,
+    // `next.config.mjs` and `jest.config.cjs`, all three delivered by the base
+    // `templates/` snapshot rather than by a bundle — so this reader falls
+    // through to the `targetAbs` branch and reads already-substituted bytes —
+    // and a template is refused `patches` outright above. A bundle that starts
+    // delivering one of its own patch targets must substitute here too.
     const readPatchTarget = (target) => {
         const mappedSource = installMapDestinationToSource.get(target);
         if (mappedSource !== undefined) {
@@ -550,11 +564,18 @@ export function installBundleTree(options) {
     // every installMap source are excluded from the whole-tree copy — the
     // manifest never lands in the scaffold, and a mapped source lands ONLY
     // at its mapped destination, never also at its original path.
-    copyTree(sourceRoot, targetAbs, excluded);
+    copyTree(sourceRoot, targetAbs, excluded, markers);
     for (const [source, destination] of Object.entries(installMap)) {
         const destAbs = resolve(targetAbs, destination);
         mkdirSync(join(destAbs, ".."), { recursive: true });
-        copyFileSync(resolve(sourceRoot, source), destAbs);
+        // BOTH ends decide text-ness (#6460), because an installMap entry is free
+        // to rename across the boundary and the two mismatches are not
+        // symmetric: a text source landing at a binary name merely misses a
+        // substitution, while a BINARY source landing at a text name would be
+        // read as utf8 and rewritten, turning every invalid byte sequence into
+        // U+FFFD — silent, unrecoverable corruption. Requiring both makes the
+        // safe direction structural rather than a property of today's manifests.
+        writeOneFile(resolve(sourceRoot, source), destAbs, [source, destination], markers);
     }
     // patches write AFTER every file the tree brought is in place (D5) —
     // after installMap, before postInstall — so a patch can never race a
@@ -589,8 +610,11 @@ export function installBundleTree(options) {
  * `safeExtractTarGz` has validated every entry, so no additional
  * path-safety check is needed here — `srcRoot` is our own staging tree, not
  * attacker-controlled input.
+ *
+ * `markers`, when given, is substituted into every TEXT file on the way
+ * through (#6460) — see `InstallBundleTreeOptions.markers`.
  */
-function copyTree(srcRoot, destRoot, excluded = new Set()) {
+function copyTree(srcRoot, destRoot, excluded = new Set(), markers) {
     const stack = [srcRoot];
     while (stack.length > 0) {
         const dir = stack.pop();
@@ -608,12 +632,47 @@ function copyTree(srcRoot, destRoot, excluded = new Set()) {
                 if (excluded.has(rel.split(sep).join("/")))
                     continue;
                 mkdirSync(join(destPath, ".."), { recursive: true });
-                copyFileSync(srcPath, destPath);
+                writeOneFile(srcPath, destPath, [rel], markers);
             }
             // symlinks: never present — safeExtractTarGz rejects them outright.
         }
     }
 }
+/**
+ * Land one file at `destAbs`, substituting `markers` into it when EVERY path
+ * in `relsForType` is text by `copy.ts`'s own `isTextFile` (#6460) — the
+ * source's relative path alone for a plain-content copy, source AND
+ * destination for an installMap entry, which may rename across the
+ * text/binary boundary. Unanimity rather than either-or, so binary content is
+ * never round-tripped through a utf8 string by construction; see the
+ * installMap loop for why the two mismatch directions are not symmetric.
+ *
+ * With no `markers`, or with any non-text path, this is exactly the
+ * `copyFileSync` it replaced.
+ *
+ * `isTextFile` is an allowlist of extensions, NOT "anything that parses as
+ * text": `.css`, `.html`, `.svg`, `.sh`, `.toml` and `.sql` are outside it, so
+ * a marker authored in one of those survives verbatim. That is pre-existing
+ * `copyTemplate` behaviour, deliberately shared rather than forked here.
+ *
+ * The source's mode rides along, because `copyFileSync` preserves it and
+ * `writeFileSync` does not: no tree this installs carries an executable file
+ * today, but a module slice is free to ship one, and a substituted `.mjs`
+ * silently losing its `+x` surfaces as "the scaffold builds but the hook never
+ * runs". Masked to the permission bits — `statSync().mode` carries the
+ * `S_IFREG` type bits too, which `open(2)` ignores but which have no business
+ * being passed. Like `copyFileSync`, this only sets the mode when the file is
+ * CREATED: an overwrite (the layer-over-layer case) keeps the existing one.
+ */
+function writeOneFile(srcAbs, destAbs, relsForType, markers) {
+    if (markers === undefined || !relsForType.every(isTextFile)) {
+        copyFileSync(srcAbs, destAbs);
+        return;
+    }
+    writeFileSync(destAbs, substituteMarkers(readFileSync(srcAbs, "utf8"), markers), {
+        mode: statSync(srcAbs).mode & 0o777,
+    });
+}
 /**
  * `extractBundle`'s validating-filter tar extraction, ported verbatim (see
  * file doc for why this is a port and not an import). Extracts `tarGzPath`

package/dist/lib/module-license-gate.d.ts

@@ -18,7 +18,12 @@
  * gate (K1's regression floor).
  */
 import type { ModuleName } from "../parse-args.js";
-export declare const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pro";
+/**
+ * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
+ * `/pro` route and there will not be one (#6439, operator decision OD-2) —
+ * pricing is where every level and the commerce add-on are actually listed.
+ */
+export declare const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pricing";
 /**
  * Thrown for both honest-denial states (no key, and an invalid/lapsed key).
  * The CLI does not distinguish them in its exit code — both are "this run

package/dist/lib/module-license-gate.js

@@ -1,5 +1,10 @@
 import { FetchModuleError, fetchModule } from "./fetch-module.js";
-export const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pro";
+/**
+ * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
+ * `/pro` route and there will not be one (#6439, operator decision OD-2) —
+ * pricing is where every level and the commerce add-on are actually listed.
+ */
+export const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pricing";
 /**
  * Thrown for both honest-denial states (no key, and an invalid/lapsed key).
  * The CLI does not distinguish them in its exit code — both are "this run

package/dist/lib/pro-callout.js

@@ -15,6 +15,6 @@ export function proCallout() {
         "your business, generates a vertical-aware page plan, configures",
         "Stripe / auth / lead routing / analytics, and sets up your",
         "GitHub→Vercel deploy — all in one orchestrated flow. Or invoke the",
-        "free scaffolders one at a time → ailaunchkit.ai/pro",
+        "free scaffolders one at a time → ailaunchkit.ai/pricing",
     ].join("\n");
 }

package/dist/programmatic.js

@@ -19,7 +19,7 @@ import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, } from
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CATALOG_TARGET_PATH, writeComponentCatalog, } from "./component-catalog.js";
-import { copyTemplate } from "./copy.js";
+import { buildScaffoldMarkers, copyTemplate } from "./copy.js";
 import { deriveArchitecture } from "./derive-architecture.js";
 import { extractModuleBundle, installBundleTree, } from "./lib/extract-module-bundle.js";
 import { fetchTemplate } from "./lib/fetch-template.js";
@@ -92,15 +92,7 @@ export function scaffoldSync(opts) {
         targetDir: targetAbs,
         versions,
         excludePaths: excludedRoutePaths(enabledSurfaces),
-        markers: {
-            PROJECT_NAME: projectName,
-            COMPANY_NAME: "Your Company",
-            COMPANY_DOMAIN: "example.com",
-            // The social-profile handle the Free chrome's footer links carry
-            // (`https://x.com/{{COMPANY_HANDLE}}`, #5469 D5) — a placeholder the
-            // site owner replaces, never the kit vendor's own handle.
-            COMPANY_HANDLE: "yourcompany",
-        },
+        markers: buildScaffoldMarkers(projectName),
     });
     // Derive + write the module-set-driven architecture.yaml (spec #3787). This
     // is the single source of the scaffolded site's code-boundary config and
@@ -241,6 +233,14 @@ export async function scaffold(opts) {
     // `scaffoldSync` already reads for `copyTemplate`, re-read here since
     // `scaffold()` doesn't share `scaffoldSync`'s call frame.
     const versions = readVersionMap();
+    // #6460 — the SAME marker map `scaffoldSync` just substituted the base
+    // `templates/` copy with, rebuilt here from the same inputs (`scaffold()`
+    // does not share `scaffoldSync`'s call frame, exactly as `versions` above
+    // does not) and threaded into every layer that lands on top of it. Without
+    // it a `{{MARKER}}` authored in a base-layer or site-template file would
+    // survive into the scaffold verbatim — the state before this card, and the
+    // reason a template file could not carry the version stamp.
+    const markers = buildScaffoldMarkers(opts.projectName ?? basename(result.targetDir));
     // #5618 D4 — the file-grain ownership registry for THIS scaffold: which
     // layer wrote which destination. Call-scoped (a fresh Map per scaffold(),
     // never module-level), threaded through every layer install below in the
@@ -267,6 +267,7 @@ export async function scaffold(opts) {
             name: BASE_LAYER_DIR,
             templateRequires: [],
             versions,
+            markers,
             ownership,
         });
     }
@@ -276,6 +277,7 @@ export async function scaffold(opts) {
             targetDir: result.targetDir,
             moduleName,
             versions,
+            markers,
             ownership,
         });
     }
@@ -305,6 +307,7 @@ export async function scaffold(opts) {
                 templateRequires: template.requires,
                 templateExtends: template.extends,
                 versions,
+                markers,
                 ownership,
             })
             : (() => {
@@ -319,6 +322,7 @@ export async function scaffold(opts) {
                     templateRequires: template.requires,
                     templateExtends: template.extends,
                     versions,
+                    markers,
                     ownership,
                 });
             })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.25.0",
-    "@working-theory/templates": "0.25.0"
+    "@working-theory/schema": "0.26.0",
+    "@working-theory/templates": "0.26.0"
   },
   "repository": {
     "type": "git",

package/site-templates/marketing-site/DESIGN.md

@@ -0,0 +1,148 @@
+---
+name: Marketing site (Pro) — marketing-site
+description: The Pro flagship: the Standard marketing pages plus blog, docs, booking and signal-collector pages, on the base foundation.
+colors:
+  bg: "#ffffff"
+  fg: "#000000"
+  surface: "#ffffff"
+  surface-secondary: "#ffffff"
+  border: "#000000"
+  text-muted: "#333333"
+  brand: "#000000"
+  fg-on-brand: "#ffffff"
+  accent: "#000000"
+  bg-dark: "#000000"
+  fg-dark: "#ffffff"
+  border-dark: "#ffffff"
+  brand-dark: "#ffffff"
+typography:
+  display:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "6rem"
+    fontWeight: 400
+    lineHeight: 1
+    letterSpacing: "-0.05em"
+  heading-section:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "2.25rem"
+    fontWeight: 400
+    lineHeight: 1.25
+    letterSpacing: "-0.05em"
+  heading-item:
+    fontSize: "1.25rem"
+    fontWeight: 600
+    lineHeight: 1.375
+  body:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "1.125rem"
+    fontWeight: 400
+    lineHeight: 1.5
+  eyebrow:
+    fontSize: "0.875rem"
+    fontWeight: 600
+    lineHeight: 1.4
+    letterSpacing: "0.05em"
+rounded:
+  button: "0.25rem"
+  card: "0.75rem"
+spacing:
+  section: "4rem"
+  card: "1.5rem"
+  grid: "1.5rem"
+  container: "1280px"
+---
+
+<!--
+  Source template: marketing-site
+  Version: create-ailk {{CREATE_AILK_VERSION}}
+  Extends: _base — installing this template replaces the base scaffold's
+  DESIGN.md with this file. Its tokens are the base foundation's, unchanged:
+  this template carries no theme of its own.
+
+  The tokens above describe what the site RENDERS today. Colours come from
+  content/_site.mdx (`theme.colors`); type, radius and spacing are platform
+  defaults a site cannot override yet — see "Where this is heading" below.
+-->
+
+# Marketing site (Pro)
+
+## Overview
+
+The Pro flagship template. It carries the same nine-beat home and marketing pages as Standard (Free), and adds the pages its four Pro modules bring: the blog, the docs, the booking pages under `/meet`, and the signal-collector surfaces. It runs on the base foundation unchanged.
+
+## Colors
+
+### Primary
+
+**Black** (`brand` `#000000`) fills the primary button; its label is white. The secondary button is white with a black hairline and black label.
+
+### Neutral
+
+Pure white ground (`bg` `#ffffff`), pure black ink for headings (`fg` `#000000`), and near-black `#333333` for body copy — well above AA on white. **Borders are black** (`#000000`): card outlines, the rule under the navigation, the rules between sections and the rule above the footer are all 1px black lines. Cards are white, not tinted (`surface-secondary` is white too). There is no accent colour — `accent` is black.
+
+Dark mode inverts: black ground, white ink, white rules, white primary button with black label.
+
+### Named Rules
+
+- **Rules, not fills.** A container is drawn with a black hairline on the white ground. Grey fills are reserved for image placeholders.
+
+## Typography
+
+System sans throughout; no web font.
+
+### Hierarchy
+
+| Role            | Size     | Weight | Notes                                                                       |
+| --------------- | -------- | ------ | --------------------------------------------------------------------------- |
+| Hero headline   | 6rem     | 400    | Tracking -0.05em, line-height 1                                             |
+| Section heading | 2.25rem  | 400    | Tracking -0.05em — light and tight, not bold                                |
+| Item heading    | 1.25rem  | 600    | Card, feature and step titles                                               |
+| Body            | 1.125rem | 400    | `#333333`, line-height 1.5                                                  |
+| Section label   | 0.875rem | 600    | Uppercase, +0.05em tracking today — the small label above a section heading |
+
+Measured from the rendered scaffold (1440px wide), not transcribed from tokens.
+
+The small label above a section heading is **kept** as part of this foundation's voice (operator-disposed 2026-09-22) and is headed toward the treatment below.
+
+## Layout
+
+Full navigation with the announcement banner; a multi-column footer; the default home. Every page and its sections are listed in `TEMPLATE-MANIFEST.md` in this directory. Shared foundation: a 1280px container, sections at 4rem, card grids at 1.5rem, breakpoints 320 / 768 / 1024 / 1440.
+
+## Shapes
+
+Two radii today: buttons at 0.25rem, cards and outlined boxes at 0.75rem. Headed toward square corners — see below.
+
+## Components
+
+### Buttons
+
+Primary: black fill, white label, 0.25rem corners. Secondary: transparent with a black 1px outline and black label. Both are the library `Button`.
+
+### Cards / Containers
+
+White panels with a black 1px outline, 0.75rem corners, `card` (1.5rem) padding. The one exception today: the "how it works" steps render as dark filled cards (see below).
+
+### Navigation
+
+Full navigation: wordmark left, page links, an outlined and a filled button at the far right, the announcement banner above. A black hairline separates it from the page.
+
+## Where this is heading
+
+The foundation's pinned direction is the pacing of a classic wireframe marketing kit — `standardissue.webflow.io` is the reference for rhythm, type scale, spacing density and section pacing only; no image, copy or code is taken from it. Six parts of that direction cannot be expressed through a site's theme today, so they wait on a platform change rather than being hand-coded. Until they land, this file describes the rendered site above, not these targets.
+
+| Target                                            | Reference value                                                                                                                  | Blocked by                                                                                               |
+| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| Square corners on buttons, cards and inputs       | radius 0                                                                                                                         | A site's `theme:` block accepts colours only — no radius                                                 |
+| Bold, tighter headings                            | hero ~3.6rem and section headings ~2.9rem, both at weight 700 with tracking about -0.02em (today 6rem and 2.25rem at weight 400) | No per-site type-role override                                                                           |
+| Generous section pacing                           | about 10rem between sections, not 4rem                                                                                           | No per-site section-spacing override; `spacious` (6rem) is not author-selectable                         |
+| Section label in sentence case, bold, no tracking | "Core Features", not "CORE FEATURES"                                                                                             | The eyebrow role bakes in uppercase and tracking                                                         |
+| Whitespace between sections, not rules            | no rule between bands                                                                                                            | Section dividers share the one `border` colour with card outlines, so black outlines make black dividers |
+| Outlined steps in "how it works"                  | three plain outlined columns                                                                                                     | The steps section renders dark filled cards; no outlined variant                                         |
+
+## Do's and Don'ts
+
+- **Do** keep every page built from registered sections. If a section you need does not exist, request it rather than writing one-off markup.
+- **Do** change colours in `content/_site.mdx` `theme.colors`; they reach every section.
+- **Don't** add a colour accent. The foundation's one idea is black on white; a brand pass adds colour deliberately, through the theme.
+- **Don't** replace a black rule with a shadow or a grey fill.
+- **Don't** hard-code the "heading toward" values above into a page. They arrive through the platform, or not at all.