create-ailk 0.9.0 → 0.11.0

package/README.md

@@ -52,9 +52,9 @@ pnpm create ailk@latest my-site --shape organization-service --license <key>
 
 `--design minimalism` picks the other look and needs a Pro or Pro Plus key;
 `standard` (the default) needs none. `--template <alias>` scaffolds one of the
-four named aliases (`marketing-site-free`, `marketing-site`, `saas-product`,
-`minimalism-site`) — each fixes a shape, a design and its own module list — and
-cannot be combined with `--shape` or `--design`.
+three named aliases (`marketing-site-free`, `marketing-site`, `saas-product`) —
+each fixes a shape, a design and its own module list — and cannot be combined
+with `--shape` or `--design`.
 
 ### Add a purchased module to an existing site
 
@@ -275,8 +275,13 @@ gate runs before anything is copied (`scaffold()` in `src/programmatic.ts`), so
 a refused run leaves no partial scaffold behind.
 
 `AILK_MODULE_REGISTRY_URL` is optional: `fetchModule` uses an explicitly passed
-`registryUrl`, then that variable, then the built-in
-`DEFAULT_AILK_MODULE_REGISTRY_URL` (`src/lib/fetch-module.ts`).
+`registryUrl`, then that variable, then `https://api.ailaunchkit.ai/v1/modules`
+(`DEFAULT_AILK_MODULE_REGISTRY_URL`, `src/lib/fetch-module.ts`).
+`AILK_TEMPLATE_REGISTRY_URL` is optional the same way: `fetchTemplate` uses an
+explicitly passed `registryUrl`, then that variable, then
+`https://api.ailaunchkit.ai/v1/templates` (`DEFAULT_AILK_TEMPLATE_REGISTRY_URL`,
+`src/lib/fetch-template.ts`). Neither client follows a redirect: a 3xx from
+either registry fails the fetch before any second request is sent.
 
 ```bash
 # free-only — no key read, no network call

package/dist/cli.js

@@ -43,9 +43,10 @@ import { ADD_ROUTE_HELP, AddRouteRefusedError, addRouteToScaffold, formatAddRout
 import { APPLY_DESIGN_HELP, applyDesign, formatApplyDesignReport, parseApplyDesignArgs, } from "./apply-design.js";
 import { CLAUDE_MD_CHECK_PATH } from "./claude-md.js";
 import { buildScaffoldMarkers } from "./copy.js";
+import { assertReleased } from "./lib/module-license-gate.js";
 import { FREE_PREREQUISITES_NOTE, LICENSED_PREREQUISITES_NOTE, isLicensedInstall, proCallout, } from "./lib/pro-callout.js";
 import { LICENSE_SET_HELP, runLicenseSet } from "./license-set.js";
-import { helpText, parseCliArgs, parseModules, resolveCliShape, toScaffoldOptions, } from "./parse-args.js";
+import { PLUGIN_INSTALL_LINES, helpText, parseCliArgs, parseModules, resolveCliShape, toScaffoldOptions, } from "./parse-args.js";
 import { addModule, formatSurfaceDrift, scaffold, syncArchitectureSync, syncCatalogSync, syncClaudeMdSync, syncRoutesSync, } from "./programmatic.js";
 import { CORE_SURFACE_PATHS, SURFACE_ALIASES } from "./surfaces.js";
 import { SYNC_ROUTES_HELP, formatSyncRoutesReport, parseSyncRoutesArgs, } from "./sync-routes.js";
@@ -207,7 +208,17 @@ async function main() {
     }
     // No silent default (#6754 D2/D3): a scaffold run naming neither --shape
     // nor --template asks for a shape on a terminal and is refused without one.
-    const opts = await resolveCliShape(parseCliArgs(argv, { interactive: process.stdin.isTTY === true }), { input: process.stdin, output: process.stdout });
+    // A --design or --modules outside the release scope is refused before that
+    // prompt asks anything (#6984); scaffold() checks the full run again.
+    const parsed = parseCliArgs(argv, { interactive: process.stdin.isTTY === true });
+    if (parsed.needsShapePrompt && !parsed.help && !parsed.version) {
+        assertReleased("designs", [parsed.design]);
+        assertReleased("modules", parsed.modules ?? []);
+    }
+    const opts = await resolveCliShape(parsed, {
+        input: process.stdin,
+        output: process.stdout,
+    });
     // Deprecation notice for a retired `--surfaces` id (#5563 D2). `surfaces.ts`
     // stays pure — `canonicalizeSurface` only resolves the alias — so this is
     // the one place that prints: compare the raw `--surfaces` argv token
@@ -370,6 +381,10 @@ async function main() {
     lines.push("Open http://localhost:3000 to see the home page.");
     lines.push("Adding auth, saved flows, checkout or database-backed content later? README.md \u00a7 \"When you need a database\" has the one-command setup.");
     lines.push("");
+    lines.push("Claude Code: the AI Launch Kit skills come from the ailk plugin. Trust this folder and Claude Code loads it, or run in a session:");
+    for (const line of PLUGIN_INSTALL_LINES)
+        lines.push(`  ${line}`);
+    lines.push("");
     lines.push(`Route surfaces: ${CORE_SURFACE_PATHS.join(", ")}` +
         (surfaces.length > 0 ? ` + ${surfaces.join(", ")}` : ""));
     lines.push("Add another with `create-ailk add-route <id>`, or re-run with --surfaces <id>.");

package/dist/content-payloads.d.ts

@@ -0,0 +1,37 @@
+/** The issuer's content kinds (spec 7110 § R1), pinned equal to CONTENT_KINDS by the issuer's test. */
+export declare const CONTENT_PAYLOAD_KINDS: readonly ["skill", "profile", "template-set", "instructions"];
+export type ContentPayloadKind = (typeof CONTENT_PAYLOAD_KINDS)[number];
+export interface ContentPayload {
+    readonly kind: ContentPayloadKind;
+    /** ^[a-z0-9][a-z0-9-]*$ — the route's :name and the store's path segment. */
+    readonly name: string;
+    /** The ONE paid feature the issuer's CONTENT_FEATURES row maps this name to. */
+    readonly feature: string;
+    /** SemVer — the content version, never create-ailk's (spec 7131 § D1). */
+    readonly version: string;
+    /**
+     * 64-hex `contentDigest` of `files` at `version` (§ D5). A change to any
+     * payload byte needs a new `version` AND a new `digest`; the build refuses
+     * until this agrees with the tree.
+     */
+    readonly digest: string;
+    /** Repo-relative, POSIX; each file's source is `${sourceRoot}/${file}`. */
+    readonly sourceRoot: string;
+    /** Archive paths, POSIX, relative, sorted, unique — listed, never globbed. */
+    readonly files: readonly string[];
+}
+export declare const CONTENT_PAYLOADS: readonly ContentPayload[];
+/** The producer-side cap on one payload's archive (spec 7131 § D6). */
+export declare const MAX_CONTENT_PAYLOAD_BYTES: number;
+/** The keyed route's public base; `AILK_CONTENT_REGISTRY_URL` overrides it. */
+export declare const DEFAULT_AILK_CONTENT_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/content";
+/**
+ * sha256 over the sorted `${path}\0${sha256hex(bytes)}\n` lines (§ D5).
+ * Covers archive paths and file bytes, never the archive's own bytes — gzip
+ * and tar headers differ between machines and must not decide whether the
+ * content changed.
+ */
+export declare function contentDigest(files: ReadonlyArray<{
+    path: string;
+    bytes: Uint8Array;
+}>): string;

package/dist/content-payloads.js

@@ -0,0 +1,64 @@
+/**
+ * The content-payload manifest (spec 7131 § D2): every licence-gated content
+ * payload the issuer's keyed route `GET /v1/content/:kind/:name/:version`
+ * serves (spec 7110) — its kind, name, feature, content version, content
+ * digest and source files. The ONE place the builder
+ * (`scripts/build-content-payloads.mjs`), its `--verify` leg and the issuer's
+ * `CONTENT_FEATURES` agreement test read.
+ *
+ * A build-time registry, not programmatic API: deliberately not exported from
+ * `src/index.ts`. It carries names, a feature, a version and a digest — never
+ * a payload byte — so the public tarball's `dist/content-payloads.js` ships no
+ * paid content (spec 7131 § 7, AC-SPB-05).
+ *
+ * create-ailk is `oss`-tier and cannot import the issuer or the licence
+ * manifest, so the kind list is a pinned COPY of the issuer's `CONTENT_KINDS`
+ * and `feature` is a plain string; the issuer's `module-features.test.ts`
+ * fails when either drifts.
+ */
+import { createHash } from "node:crypto";
+/** The issuer's content kinds (spec 7110 § R1), pinned equal to CONTENT_KINDS by the issuer's test. */
+export const CONTENT_PAYLOAD_KINDS = [
+    "skill",
+    "profile",
+    "template-set",
+    "instructions",
+];
+export const CONTENT_PAYLOADS = Object.freeze([
+    Object.freeze({
+        kind: "template-set",
+        name: "scaffold-commerce",
+        feature: "commerce",
+        version: "1.0.0",
+        digest: "baa4ac6e86ec7e3b367eb67e77c3407da90c7ff9ef51d5f4e1185615194543ee",
+        sourceRoot: "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce",
+        files: Object.freeze([
+            "references/lookup-keys-template.md",
+            "references/marketplace-brand-pages.md",
+            "templates/checkout-route.template.ts",
+            "templates/invoice-route.template.ts",
+            "templates/marketplace-cta-route.tsx.tmpl",
+            "templates/payment-link-route.template.ts",
+            "templates/portal-route.template.ts",
+            "templates/stripe-config.template.ts",
+            "templates/subscription-route.template.ts",
+        ]),
+    }),
+]);
+/** The producer-side cap on one payload's archive (spec 7131 § D6). */
+export const MAX_CONTENT_PAYLOAD_BYTES = 256 * 1024;
+/** The keyed route's public base; `AILK_CONTENT_REGISTRY_URL` overrides it. */
+export const DEFAULT_AILK_CONTENT_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/content";
+const sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/**
+ * sha256 over the sorted `${path}\0${sha256hex(bytes)}\n` lines (§ D5).
+ * Covers archive paths and file bytes, never the archive's own bytes — gzip
+ * and tar headers differ between machines and must not decide whether the
+ * content changed.
+ */
+export function contentDigest(files) {
+    const lines = files
+        .map(({ path, bytes }) => `${path}\0${sha256Hex(bytes)}\n`)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    return sha256Hex(lines.join(""));
+}

package/dist/lib/fetch-module.d.ts

@@ -1,4 +1,4 @@
-export declare const DEFAULT_AILK_MODULE_REGISTRY_URL = "https://ailaunchkit.ai/api/modules";
+export declare const DEFAULT_AILK_MODULE_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/modules";
 export interface FetchModuleOptions {
     moduleName: string;
     /** JWT used as `Authorization: Bearer <token>`. Must be non-empty. */
@@ -11,10 +11,10 @@ export interface FetchModuleOptions {
     fetchImpl?: typeof fetch;
 }
 export declare class FetchModuleError extends Error {
-    /** True iff the failure was a license-gating signal (HTTP 401). */
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
     readonly isLicenseError: boolean;
     constructor(message: string, 
-    /** True iff the failure was a license-gating signal (HTTP 401). */
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
     isLicenseError?: boolean);
 }
 export declare function fetchModule(options: FetchModuleOptions): Promise<Uint8Array>;

package/dist/lib/fetch-module.js

@@ -9,8 +9,14 @@
  *     distribution only.
  *   - Empty-token guard before any network call (defense in depth — the
  *     caller should already have gated on an empty/absent key).
- *   - Status-code mapping: 401 → license invalid/revoked/lapsed, 404 →
- *     module content not yet available, other 4xx/5xx → upstream body.
+ *   - Status-code mapping: 401 → license invalid/revoked/lapsed, 403 →
+ *     not included / term ended, 404 → included, but that release's bundle
+ *     not yet uploaded, other 4xx/5xx → upstream body. The issuer answers
+ *     403 before 404 (spec 7110 § D4), so a 404 reaches only a key that
+ *     holds the module's feature.
+ *   - Default registry: the product API gateway (`api.ailaunchkit.ai`, routed
+ *     to the licence issuer's `/v1/modules`); `AILK_MODULE_REGISTRY_URL`
+ *     overrides it.
  *
  * Deliberately DOES NOT depend on `@working-theory/license` or
  * `@working-theory/cli` — both are `publishConfig.access: "restricted"` and
@@ -37,7 +43,7 @@
  */
 import pkg from "../../package.json" with { type: "json" };
 import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
-export const DEFAULT_AILK_MODULE_REGISTRY_URL = "https://ailaunchkit.ai/api/modules";
+export const DEFAULT_AILK_MODULE_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/modules";
 /**
  * This package's own `package.json` `"version"`. Deliberately a static JSON
  * import (`resolveJsonModule`), not `import.meta.url` + `fileURLToPath` (the
@@ -53,7 +59,7 @@ const CREATE_AILK_VERSION = pkg.version;
 export class FetchModuleError extends Error {
     isLicenseError;
     constructor(message, 
-    /** True iff the failure was a license-gating signal (HTTP 401). */
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
     isLicenseError = false) {
         super(message);
         this.isLicenseError = isLicenseError;
@@ -108,7 +114,7 @@ export async function fetchModule(options) {
         /* isLicenseError */ true);
     }
     if (response.status === 404) {
-        throw new FetchModuleError(`"${moduleName}" module content not yet available — ping us at hello@ailaunchkit.ai`);
+        throw new FetchModuleError(`"${moduleName}" module content not yet available for create-ailk ${version} — your licence includes it, but that release's bundle has not been uploaded yet; ping us at hello@ailaunchkit.ai`);
     }
     if (!response.ok) {
         const body = await safeReadBody(response);

package/dist/lib/fetch-template.d.ts

@@ -1,4 +1,4 @@
-export declare const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
+export declare const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/templates";
 export interface FetchTemplateOptions {
     templateName: string;
     /** JWT used as `Authorization: Bearer <token>`. Must be non-empty. */

package/dist/lib/fetch-template.js

@@ -3,13 +3,16 @@
  * D1, § 6).
  *
  * The client half of `GET /v1/templates/:name/:version` (#5480's route),
- * reached publicly at `/api/templates/:path*`. Posture is
+ * reached at `https://api.ailaunchkit.ai/v1/templates/:name/:version` through
+ * the product API gateway. Posture is
  * `fetch-module.ts`'s, mirrored one-for-one rather than generalised into a
  * shared helper: bearer-JWT auth, `redirect: "error"` so a redirected
  * response cannot drop the bearer token onto an unintended host, an
  * empty-token guard before any network call, and the same status mapping —
  * 401 → licence invalid/revoked/lapsed, 403 → not included / term ended,
- * 404 → content not yet available, other non-2xx → the upstream body.
+ * 404 → included, but that release's bundle not yet uploaded, other non-2xx
+ * → the upstream body. The issuer answers 403 before 404 (spec 7110 § D4),
+ * so a 404 reaches only a key that holds the template's whole union.
  *
  * ONE word differs, and it is the whole reason this is a sibling rather
  * than a second call site of `fetchModule` (spec 5481 § 3 DD5): the 404
@@ -27,7 +30,7 @@
  */
 import pkg from "../../package.json" with { type: "json" };
 import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
-export const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
+export const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://api.ailaunchkit.ai/v1/templates";
 /**
  * This package's own `package.json` `"version"` — a static JSON import for
  * the reason `fetch-module.ts`'s `CREATE_AILK_VERSION` doc gives: `import.meta`
@@ -95,7 +98,7 @@ export async function fetchTemplate(options) {
         /* isLicenseError */ true);
     }
     if (response.status === 404) {
-        throw new FetchTemplateError(`"${templateName}" template content not yet available — ping us at hello@ailaunchkit.ai`);
+        throw new FetchTemplateError(`"${templateName}" template content not yet available for create-ailk ${version} — your licence includes it, but that release's bundle has not been uploaded yet; ping us at hello@ailaunchkit.ai`);
     }
     if (!response.ok) {
         const body = await safeReadBody(response);

package/dist/lib/module-license-gate.d.ts

@@ -1,26 +1,3 @@
-/**
- * Paid-module license gate (K1, #5089 — Flavor 3). Orchestrates
- * `module-tier.ts`'s classification + `fetch-module.ts`'s authenticated
- * fetch into the three honest states the CLI must surface:
- *
- *   (a) no key + a paid module requested  → conversion hint, non-zero, ZERO
- *       network (mirrors `install-skill.ts`'s free-tier short-circuit).
- *   (b) a lapsed/invalid key + a paid module → "your licence does not cover
- *       this", non-zero (the module distribution's own 401 — see
- *       `fetch-module.ts`'s file doc for why there is no local JWT
- *       pre-check here).
- *   (c) a valid key → every requested paid module's bundle bytes, ready for
- *       `extract-module-bundle.ts` to merge into the scaffold.
- *
- * A Free-only request (no paid modules) never reaches the key check at all —
- * `resolvePaidModules` returns immediately, before touching `process.env` or
- * the network, so a bare/all-Free scaffold is provably unaffected by this
- * gate (K1's regression floor).
- *
- * Also carries the design gate (#6760): `assertDesignAllowed` refuses a
- * non-`standard` design at the `free` level, naming the design and the
- * run's level, before `scaffold()`'s first disk write.
- */
 import type { ModuleName } from "../parse-args.js";
 import { type Level } from "./module-tier.js";
 /**
@@ -38,6 +15,35 @@ export declare const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pricing";
 export declare class LicenseRequiredError extends Error {
     constructor(message: string);
 }
+/** The five axes `release-scope.json` declares (spec 6977 D3). */
+export type ReleaseAxis = "templates" | "shapes" | "designs" | "modules" | "levels";
+/** `gated` and `deferred` are both refused; only a `gated` one gets negative checks. */
+export type ReleaseStatus = "released" | "gated" | "deferred";
+export type ReleaseScope = Readonly<Record<ReleaseAxis, Readonly<Record<string, ReleaseStatus>>>>;
+/**
+ * The package-root `release-scope.json` (shipped in `files`). A static JSON
+ * import, not an `import.meta.url` read, for `fetch-module.ts`'s reason: jest
+ * loads this module directly. `release-scope.test.ts` pins every registry
+ * name to an entry here (R5).
+ */
+export declare const RELEASE_SCOPE: ReleaseScope;
+/** Thrown for a surface outside the release scope — a refusal, not a licence state. */
+export declare class ReleaseScopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Refuse any of `names` that `scope[axis]` marks `gated` or `deferred`, with
+ * the not-available message `parse-args.ts` gives a reserved shape. A name
+ * the scope does not list (a customer's own design, say) is not refused.
+ * Bypassed when `AILK_RELEASE_SCOPE=ignore` — this package's jest setup and
+ * an operator's own run; a published CLI never sets it.
+ *
+ * Called on the scaffold path only (`scaffold()`, `cli.ts`, and the level
+ * check in `resolveModuleSet`) — never from `parseModules`, so `add-module`
+ * and `--sync-architecture` keep working on a site that already carries a
+ * gated module.
+ */
+export declare function assertReleased(axis: ReleaseAxis, names: readonly (string | undefined)[], scope?: ReleaseScope): void;
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by

package/dist/lib/module-license-gate.js

@@ -1,3 +1,31 @@
+/**
+ * Paid-module license gate (K1, #5089 — Flavor 3). Orchestrates
+ * `module-tier.ts`'s classification + `fetch-module.ts`'s authenticated
+ * fetch into the three honest states the CLI must surface:
+ *
+ *   (a) no key + a paid module requested  → conversion hint, non-zero, ZERO
+ *       network (mirrors `install-skill.ts`'s free-tier short-circuit).
+ *   (b) a lapsed/invalid key + a paid module → "your licence does not cover
+ *       this", non-zero (the module distribution's own 401 — see
+ *       `fetch-module.ts`'s file doc for why there is no local JWT
+ *       pre-check here).
+ *   (c) a valid key → every requested paid module's bundle bytes, ready for
+ *       `extract-module-bundle.ts` to merge into the scaffold.
+ *
+ * A Free-only request (no paid modules) never reaches the key check at all —
+ * `resolvePaidModules` returns immediately, before touching `process.env` or
+ * the network, so a bare/all-Free scaffold is provably unaffected by this
+ * gate (K1's regression floor).
+ *
+ * Also carries the design gate (#6760): `assertDesignAllowed` refuses a
+ * non-`standard` design at the `free` level, naming the design and the
+ * run's level, before `scaffold()`'s first disk write.
+ *
+ * And the release-scope gate (#6984, spec 6977 D3): `assertReleased` refuses
+ * a template, shape, design, module or level that `release-scope.json` marks
+ * `gated` or `deferred`, on the scaffold path only.
+ */
+import releaseScopeJson from "../../release-scope.json" with { type: "json" };
 import { FetchModuleError, fetchModule } from "./fetch-module.js";
 import { assertLicenseKeyShape } from "./license-key-files.js";
 import { ADD_ONS, LEVEL_LABEL, LEVEL_MODULES, OPT_IN_MODULES, PAID_MODULES, classifyModules, composeModuleSet, levelOf, } from "./module-tier.js";
@@ -19,6 +47,74 @@ export class LicenseRequiredError extends Error {
         this.name = "LicenseRequiredError";
     }
 }
+/**
+ * The package-root `release-scope.json` (shipped in `files`). A static JSON
+ * import, not an `import.meta.url` read, for `fetch-module.ts`'s reason: jest
+ * loads this module directly. `release-scope.test.ts` pins every registry
+ * name to an entry here (R5).
+ */
+export const RELEASE_SCOPE = releaseScopeJson;
+const AXIS_NOUN = {
+    templates: "template",
+    shapes: "shape",
+    designs: "design",
+    modules: "module",
+    levels: "level",
+};
+/** Thrown for a surface outside the release scope — a refusal, not a licence state. */
+export class ReleaseScopeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ReleaseScopeError";
+    }
+}
+const RELEASE_STATUSES = ["released", "gated", "deferred"];
+/**
+ * Refuse a scope carrying a status other than `released`, `gated` or
+ * `deferred` — fail closed: a misspelled status never reads as released.
+ */
+function assertValidScope(scope) {
+    for (const [axis, statuses] of Object.entries(scope)) {
+        for (const [name, status] of Object.entries(statuses)) {
+            if (!RELEASE_STATUSES.includes(status)) {
+                throw new ReleaseScopeError(`release-scope.json ${axis}."${name}" is "${String(status)}" — expected one of: ${RELEASE_STATUSES.join(", ")}`);
+            }
+        }
+    }
+}
+/**
+ * Refuse any of `names` that `scope[axis]` marks `gated` or `deferred`, with
+ * the not-available message `parse-args.ts` gives a reserved shape. A name
+ * the scope does not list (a customer's own design, say) is not refused.
+ * Bypassed when `AILK_RELEASE_SCOPE=ignore` — this package's jest setup and
+ * an operator's own run; a published CLI never sets it.
+ *
+ * Called on the scaffold path only (`scaffold()`, `cli.ts`, and the level
+ * check in `resolveModuleSet`) — never from `parseModules`, so `add-module`
+ * and `--sync-architecture` keep working on a site that already carries a
+ * gated module.
+ */
+export function assertReleased(axis, names, scope = RELEASE_SCOPE) {
+    if (process.env["AILK_RELEASE_SCOPE"] === "ignore")
+        return;
+    assertValidScope(scope);
+    const statuses = scope[axis];
+    for (const name of names) {
+        if (name === undefined)
+            continue;
+        const status = statuses[name];
+        if (status !== "gated" && status !== "deferred")
+            continue;
+        const released = Object.keys(statuses).filter((n) => statuses[n] === "released");
+        // A level comes from the key, never a flag — so it points at what the run CAN choose.
+        const choose = axis === "levels"
+            ? `Your licence key's level is ${name}; name the modules you want with --modules (one of: ${Object.keys(scope.modules)
+                .filter((m) => scope.modules[m] === "released")
+                .join(", ")}).`
+            : `Choose one of: ${released.join(", ")}.`;
+        throw new ReleaseScopeError(`${AXIS_NOUN[axis]} "${name}" is not available yet. ${choose}`);
+    }
+}
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by
@@ -223,6 +319,8 @@ export async function resolveModuleSet(options) {
         return { modules, bundles };
     }
     const { level, bundles } = await deriveLevel(options);
+    // #6984 — a gated level (Pro Plus) is refused before its defaults compose.
+    assertReleased("levels", [level]);
     const modules = composeModuleSet(namedList, level);
     const { paid } = classifyModules(modules);
     const missing = paid.filter((m) => !bundles.has(m));

package/dist/module-architecture.d.ts

@@ -212,6 +212,15 @@ export interface ModuleSlice {
      * leak class `scripts/check-oss-strip.sh` exists to catch (#5644).
      */
     installRoot?: string;
+    /**
+     * Paths this module's keyed content payloads occupy (src/content-payloads.ts):
+     * each payload file's monorepo source AND the scaffold path its skill's fetch
+     * writes it to. Never delivered — no build, extract or patch step reads this
+     * field. Declared so the paid-path leak guards, which derive from
+     * `ownedFiles`/`installMap`, still recognise a leaked copy after the files
+     * left `installMap` (#7133).
+     */
+    contentPayloadPaths?: string[];
     /**
      * Plain text `extractModuleBundle` prints to stdout after a successful
      * merge, with C0/C1 control characters (other than newline) stripped

package/dist/module-architecture.js

@@ -23,6 +23,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join, sep } from "node:path";
+import { CONTENT_PAYLOADS, } from "./content-payloads.js";
 import { importClosure } from "./lib/import-graph.js";
 import { PAID_MODULES } from "./lib/module-tier.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
@@ -183,6 +184,21 @@ const ASSET_STORE_FILES = [
  * tools/lint-architecture.ts fails on (#6649).
  */
 const WEB_AUTH_ADAPTER_IMPORT = "database";
+/**
+ * A content payload's paths for `ModuleSlice.contentPayloadPaths` (#7133):
+ * each file's `${sourceRoot}/${file}` and the `${destRoot}/${file}` its
+ * skill's keyed fetch writes it to — read off `CONTENT_PAYLOADS`, never
+ * hand-listed, so the leak guards cannot drift from the manifest.
+ */
+function payloadPaths(kind, name, destRoot) {
+    const payload = CONTENT_PAYLOADS.find((p) => p.kind === kind && p.name === name);
+    if (!payload)
+        throw new Error(`no content payload ${kind}/${name}`);
+    return payload.files.flatMap((file) => [
+        `${payload.sourceRoot}/${file}`,
+        `${destRoot}/${file}`,
+    ]);
+}
 /**
  * The per-module slices. Authored for every `RECOGNIZED_MODULES` value; only
  * `marketing` (the default) is validated end-to-end against a golden.
@@ -1503,8 +1519,8 @@ export const MODULE_SLICES = {
         // module's own `pageContributions`/`starter-grid.ts` rows respectively,
         // so this module installs its own seeds for them directly, unlike the
         // sample rows above. `/referral`'s seed and flow move here the same way,
-        // moved out of the retired `minimalism-site` tree (spec 6892 D3), which
-        // owned no code of its own for either route.
+        // moved out of a retired template tree (spec 6892 D3), which owned no
+        // code of its own for either route.
         // `generate-sample-report.py` keeps its root-level destination
         // (finding 1 — AC7 forbids changing the Pro file set).
         installMap: {
@@ -1661,30 +1677,31 @@ export const MODULE_SLICES = {
         // it sits outside build-templates.mjs's SNAPSHOT_DIRS/overlay, so
         // ownedFiles/paidModuleTemplateExclusions cannot reach it) to
         // `module-templates/commerce/.claude/skills/scaffold-commerce/`, and
-        // delivered into a keyed scaffold by `installMap` instead. Ten literal
+        // delivered into a keyed scaffold by `installMap` instead. Five literal
         // entries, not one directory entry: `extractModuleBundle`'s
         // `validateInstallMap` requires every source to be a FILE the bundle
         // produced (`extract-module-bundle.ts`'s `!sourceStat.isFile()` check) —
-        // a directory source is rejected outright.
+        // a directory source is rejected outright. The skill ships as steps only
+        // (#7133): its `templates/` and `references/` are the keyed content
+        // payload `template-set/scaffold-commerce` (src/content-payloads.ts),
+        // which `scripts/fetch-templates.ts` fetches with the site's licence key;
+        // `link/` carries byte copies of the link path's two files, which need no
+        // key.
         installMap: {
             "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/SKILL.md": ".claude/skills/scaffold-commerce/SKILL.md",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/references/lookup-keys-template.md": ".claude/skills/scaffold-commerce/references/lookup-keys-template.md",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/references/marketplace-brand-pages.md": ".claude/skills/scaffold-commerce/references/marketplace-brand-pages.md",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/checkout-route.template.ts": ".claude/skills/scaffold-commerce/templates/checkout-route.template.ts",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/invoice-route.template.ts": ".claude/skills/scaffold-commerce/templates/invoice-route.template.ts",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/marketplace-cta-route.tsx.tmpl": ".claude/skills/scaffold-commerce/templates/marketplace-cta-route.tsx.tmpl",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/payment-link-route.template.ts": ".claude/skills/scaffold-commerce/templates/payment-link-route.template.ts",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/portal-route.template.ts": ".claude/skills/scaffold-commerce/templates/portal-route.template.ts",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/stripe-config.template.ts": ".claude/skills/scaffold-commerce/templates/stripe-config.template.ts",
-            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/subscription-route.template.ts": ".claude/skills/scaffold-commerce/templates/subscription-route.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/link/marketplace-brand-pages.md": ".claude/skills/scaffold-commerce/link/marketplace-brand-pages.md",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/link/marketplace-cta-route.tsx.tmpl": ".claude/skills/scaffold-commerce/link/marketplace-cta-route.tsx.tmpl",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/scripts/fetch-templates.ts": ".claude/skills/scaffold-commerce/scripts/fetch-templates.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/scripts/stripe-catalog.ts": ".claude/skills/scaffold-commerce/scripts/stripe-catalog.ts",
             // The commerce-boundary rule (#6039/#6070, this entry #6041): ships to
             // a commerce-keyed scaffold's project root so an agent working there
             // reads the money/live-mode/personal-data classification before it
-            // acts. One more literal entry alongside the ten scaffold-commerce
+            // acts. One more literal entry alongside the five scaffold-commerce
             // skill entries above, for the same reason — a directory source is
             // rejected by `validateInstallMap`.
             "packages/create-ailk/module-templates/commerce/.claude/rules/commerce-boundary.md": ".claude/rules/commerce-boundary.md",
         },
+        contentPayloadPaths: payloadPaths("template-set", "scaffold-commerce", ".claude/skills/scaffold-commerce"),
         // patches (#5581 U5, D5) — delivers the extracted component package to a
         // keyed scaffold's apps/web, mirroring the workspace slice's identical
         // merge-keys op above.
@@ -1832,12 +1849,27 @@ export function coOwnedModuleDestinations() {
 //     see that entry, and sync-routes' AC-5 coverage test, which reads this
 //     list so the resulting ROUTE_SINCE-vs-template absence is justified
 //     rather than reported stale.
+//   - the three app-side suites of the API ↔ MCP parity guard (#7135, spec
+//     docs/specs/7135-an-api-mcp-parity-guard-spec.md D11) — file entries,
+//     matched exactly by `isExcludedTemplatePath`. Each imports the guard's
+//     core from the monorepo's root `tests/parity/api-parity/` by relative
+//     path, which a scaffold does not carry. A test that imports a slice file
+//     is a dependent, not an import-graph companion, so
+//     `paidModuleTemplateExclusions` never sweeps these along.
+//   - apps/mcp/__tests__/pro-tool-call-gate.test.ts (#7315, spec
+//     docs/specs/7315-a-gated-pro-tool-re-spec.md D4) — same reason as the
+//     three suites above: it imports `SITE_ARGS` from the monorepo's root
+//     `tests/parity/` tree, which no scaffold carries.
 export const EXCLUDE_TEMPLATE_DIRS = [
     "apps/web/__tests__",
     "apps/web/app/__tests__",
     "apps/web/app/[locale]/__tests__",
     "apps/web/app/[locale]/(authed)/edit",
     "apps/web/content",
+    "apps/api/src/__tests__/api-parity.test.ts",
+    "apps/api/src/__tests__/api-parity-paid.test.ts",
+    "apps/mcp/__tests__/api-parity.test.ts",
+    "apps/mcp/__tests__/pro-tool-call-gate.test.ts",
 ];
 export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
     const roots = new Set(snapshotRoots);

package/dist/parse-args.d.ts

@@ -103,6 +103,8 @@ export interface ParseEnv {
     /** A human can answer a prompt: `process.stdin.isTTY === true` in cli.ts. */
     interactive: boolean;
 }
+/** The two lines that install the `ailk` plugin in a Claude Code session (#7298). */
+export declare const PLUGIN_INSTALL_LINES: readonly ["/plugin marketplace add working-theory-labs/claude-plugins", "/plugin install ailk@working-theory"];
 export declare const helpText: string;
 /**
  * Parse `create-ailk` argv. `env.interactive` defaults to false —

package/dist/parse-args.js

@@ -65,6 +65,11 @@ export class ParseError extends Error {
         this.name = "ParseError";
     }
 }
+/** The two lines that install the `ailk` plugin in a Claude Code session (#7298). */
+export const PLUGIN_INSTALL_LINES = [
+    "/plugin marketplace add working-theory-labs/claude-plugins",
+    "/plugin install ailk@working-theory",
+];
 export const helpText = `create-ailk — scaffold a new AI Launch Kit site.
 
 Usage:
@@ -166,6 +171,8 @@ Next steps after a successful scaffold:
   cd <target-dir>
   pnpm install
   pnpm dev
+Then, in Claude Code, install the ailk plugin:
+${PLUGIN_INSTALL_LINES.map((line) => `  ${line}`).join("\n")}
 
 Reference: ADR 0007 — \`pnpm create ailk@latest\` is the canonical install path.
 `;