@stardeck-customer-apps/compose 0.14.0 → 0.15.0

package/dist/cli.js

@@ -1145,16 +1145,16 @@ var require_range = __commonJS({
     };
     var replaceTilde = (comp, options) => {
       const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
-      const z10 = options.includePrerelease ? "-0" : "";
+      const z11 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("tilde", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z10} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z11} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
-          ret = `>=${M}.${m}.0${z10} <${M}.${+m + 1}.0-0`;
+          ret = `>=${M}.${m}.0${z11} <${M}.${+m + 1}.0-0`;
         } else if (pr) {
           debug("replaceTilde pr", pr);
           ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
@@ -1171,19 +1171,19 @@ var require_range = __commonJS({
     var replaceCaret = (comp, options) => {
       debug("caret", comp, options);
       const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
-      const z10 = options.includePrerelease ? "-0" : "";
+      const z11 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("caret", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z10} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z11} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m}.0${z10} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.0${z11} <${M}.${+m + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m}.0${z10} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.0${z11} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug("replaceCaret pr", pr);
@@ -2021,8 +2021,13 @@ var require_semver2 = __commonJS({
 });
 
 // src/cli.ts
+var import_node_child_process3 = require("child_process");
 var import_node_util = require("util");
 
+// ../../packages/lib/src/server/module-rail/ownership-guard.ts
+var import_node_fs = __toESM(require("fs"));
+var import_node_path = __toESM(require("path"));
+
 // ../../packages/module-contract/src/module-manifest.ts
 var import_zod = require("zod");
 
@@ -2053,6 +2058,13 @@ function validateSlug(slug) {
 var MODULES_DIR = "src/modules";
 var APP_PACKAGE_DIR = "apps/web";
 var MODULES_SANDBOX_DIR = `${APP_PACKAGE_DIR}/${MODULES_DIR}`;
+var MODULE_MANIFEST_FILENAME = "module.json";
+var MODULE_UI_SUBPATHS = [
+  "components/",
+  "routes/",
+  "enhancements/*/components/",
+  "enhancements/*/routes/"
+];
 var KEBAB_SLUG_REGEX = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 var SNAKE_TABLE_REGEX = /^[a-z][a-z0-9_]*$/;
 var ROUTE_GROUP_REGEX = /^\([a-z0-9-]+\)$/;
@@ -2066,23 +2078,23 @@ function isValidModuleName(value) {
 var projectSlugSchema = import_zod.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
 var moduleKindSchema = import_zod.z.enum(["feature", "library", "contract"]);
 var endpointMethodSchema = import_zod.z.enum(ENDPOINT_METHODS);
-function endpointPathValidationError(path5) {
-  if (!path5.startsWith("/api/")) {
+function endpointPathValidationError(path6) {
+  if (!path6.startsWith("/api/")) {
     return 'must begin with "/api/"';
   }
-  if (path5.endsWith("/")) {
+  if (path6.endsWith("/")) {
     return "must not end with a trailing slash";
   }
-  if (path5.includes("?") || path5.includes("#")) {
+  if (path6.includes("?") || path6.includes("#")) {
     return "must not include query or hash";
   }
-  if (path5.includes("\\")) {
+  if (path6.includes("\\")) {
     return "must not include backslashes";
   }
-  if (path5.includes("%")) {
+  if (path6.includes("%")) {
     return "must not include percent-encoded segments";
   }
-  const parts = path5.split("/");
+  const parts = path6.split("/");
   if (parts.length < 3 || parts[0] !== "" || parts[1] !== "api") {
     return 'must begin with "/api/"';
   }
@@ -2132,12 +2144,12 @@ function endpointPathValidationError(path5) {
   }
   return null;
 }
-function normalizeEndpointPathForCollision(path5) {
-  const error = endpointPathValidationError(path5);
+function normalizeEndpointPathForCollision(path6) {
+  const error = endpointPathValidationError(path6);
   if (error != null) {
     throw new Error(`invalid endpoint path: ${error}`);
   }
-  return path5.split("/").map((segment, index) => {
+  return path6.split("/").map((segment, index) => {
     if (index < 2) {
       return segment;
     }
@@ -2150,8 +2162,8 @@ function normalizeEndpointPathForCollision(path5) {
     return segment;
   }).join("/");
 }
-var endpointPathSchema = import_zod.z.string().superRefine((path5, ctx) => {
-  const error = endpointPathValidationError(path5);
+var endpointPathSchema = import_zod.z.string().superRefine((path6, ctx) => {
+  const error = endpointPathValidationError(path6);
   if (error != null) {
     ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, message: error });
   }
@@ -2259,10 +2271,12 @@ var modulePermissionClaimSchema = import_zod.z.object({
   /** Human label for the deployment auth config row. */
   description: descriptionSchema,
   /**
-   * The default organization roles that hold this key when the platform
-   * first registers it on an app (a Blueprint fork, a Module install). Admin
-   * holds every key without being listed; External Viewer never holds one.
-   * Changing a role's grants afterwards is the organization's business.
+   * The standard organization roles that hold this key. The platform sets them on every app
+   * (a Blueprint fork, a Module install or uninstall, every Blueprint update), so this list is
+   * the truth: a role added here gains the key, a role removed loses it, and nobody can edit a
+   * standard role's grants on a Module key. Admin holds every key without being listed;
+   * External Viewer never holds one. An organization that wants different access duplicates the
+   * standard role and edits the copy.
    */
   roles: import_zod.z.array(import_zod.z.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
@@ -2412,16 +2426,16 @@ var moduleManifestSchema = import_zod.z.object({
     }
   }
   const seenWorkflows = /* @__PURE__ */ new Map();
-  const noteWorkflow = (name, path5) => {
+  const noteWorkflow = (name, path6) => {
     const existing = seenWorkflows.get(name);
     if (existing != null) {
       ctx.addIssue({
         code: import_zod.z.ZodIssueCode.custom,
         message: `duplicate workflow name "${name}" (also at ${existing})`,
-        path: path5
+        path: path6
       });
     } else {
-      seenWorkflows.set(name, path5.join("."));
+      seenWorkflows.set(name, path6.join("."));
     }
   };
   for (let i = 0; i < manifest.workflows.length; i += 1) {
@@ -2433,7 +2447,7 @@ var moduleManifestSchema = import_zod.z.object({
     }
   }
   const seenEndpointKeys = /* @__PURE__ */ new Map();
-  const noteEndpoint = (claim, path5) => {
+  const noteEndpoint = (claim, path6) => {
     let key;
     try {
       key = normalizeEndpointPathForCollision(claim.path);
@@ -2445,10 +2459,10 @@ var moduleManifestSchema = import_zod.z.object({
       ctx.addIssue({
         code: import_zod.z.ZodIssueCode.custom,
         message: `duplicate normalized endpoint path "${key}" (also at ${existing})`,
-        path: path5
+        path: path6
       });
     } else {
-      seenEndpointKeys.set(key, path5.join("."));
+      seenEndpointKeys.set(key, path6.join("."));
     }
   };
   for (let i = 0; i < manifest.endpoints.length; i += 1) {
@@ -2549,8 +2563,8 @@ var moduleManifestSchema = import_zod.z.object({
 }).transform(({ version: _legacyVersion, ...manifest }) => manifest);
 function formatZodErrors(error) {
   return error.issues.map((issue) => {
-    const path5 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `${path5}: ${issue.message}`;
+    const path6 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `${path6}: ${issue.message}`;
   });
 }
 function parseModuleManifest(raw) {
@@ -2950,16 +2964,16 @@ var collectedE2eFactsSchema = import_zod3.z.object({
 function validateRouteExportEvidenceCongruence(input) {
   const entrySet = new Set(input.routeEntries);
   const exportPaths = input.routePageExports.map((e) => e.nextRelativePath);
-  for (const path5 of exportPaths) {
-    if (!entrySet.has(path5)) {
-      input.onIssue(`routePageExports path "${path5}" is not listed in routeEntries`);
+  for (const path6 of exportPaths) {
+    if (!entrySet.has(path6)) {
+      input.onIssue(`routePageExports path "${path6}" is not listed in routeEntries`);
     }
   }
   if (input.routeCollectionErrors.length === 0) {
     const exportSet = new Set(exportPaths);
-    for (const path5 of input.routeEntries) {
-      if (!exportSet.has(path5)) {
-        input.onIssue(`routeEntries path "${path5}" is missing from routePageExports`);
+    for (const path6 of input.routeEntries) {
+      if (!exportSet.has(path6)) {
+        input.onIssue(`routeEntries path "${path6}" is missing from routePageExports`);
       }
     }
   }
@@ -3904,6 +3918,50 @@ function analyzeClientSafeEntryImports(sourceText, fileName) {
   return analyzeClientSafeEntryImportsWithTs(import_typescript3.default, sourceText, fileName);
 }
 
+// ../../packages/lib/src/shared/ownership-record.ts
+var import_zod6 = require("zod");
+var OWNERSHIP_RECORD_PATH = "stardeck.ownership.json";
+var OWNERSHIP_RECORD_VERSION = 1;
+var moduleList = import_zod6.z.array(import_zod6.z.string().refine(isValidModuleName, "not a Module name"));
+var ownershipRecordSchema = import_zod6.z.object({
+  version: import_zod6.z.literal(OWNERSHIP_RECORD_VERSION),
+  /** False once the app stopped all Stardeck updates: then every file is the app's. */
+  stardeckUpdates: import_zod6.z.boolean(),
+  /** projects.ejected_modules: updates stopped for these Modules, so their folders are the app's. */
+  updatesStoppedModules: moduleList,
+  /** projects.ui_ejected_modules: Customize UI, so their screens are the app's. */
+  customizedUiModules: moduleList,
+  /** projects.external_modules: installed from another app, so the app owns the copy. */
+  externalModules: moduleList,
+  /** projects.removed_modules names: uninstalled on purpose. */
+  uninstalledModules: moduleList
+});
+function parseOwnershipRecord(content) {
+  let json;
+  try {
+    json = JSON.parse(content);
+  } catch (error) {
+    return { ok: false, error: `${OWNERSHIP_RECORD_PATH} is not valid JSON: ${String(error)}` };
+  }
+  const parsed = ownershipRecordSchema.safeParse(json);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      error: `${OWNERSHIP_RECORD_PATH} is not a record Stardeck wrote: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`
+    };
+  }
+  return { ok: true, record: parsed.data };
+}
+var BLUEPRINT_RELEASE_COMMITTER_EMAIL = "ci@stardeck.ai";
+var BLUEPRINT_RELEASE_SUBJECT_PREFIX = "publish: ";
+var STARDECK_OWNED_ALTERNATIVES = [
+  "If the Module has a setting for this, change the setting.",
+  "If a slot contribution can do it, write it in app code outside the Module folder (`apps/web/src/lib/modules/app-extensions.ts` registers it).",
+  "To rework a Module's screens, the app owner can choose **Customize UI** in the dashboard's Modules tab (run **Sync** there first if it is refused). The app then owns that Module's `components/` and `routes/`, and its logic keeps updating.",
+  "If the Module's logic is wrong for every app, report it to Stardeck so every app gets the fix.",
+  "If the app cannot wait, the app owner can stop Stardeck updates for this Module, or for the whole app, in the Modules tab. Both are permanent."
+];
+
 // ../../packages/lib/src/shared/platform-owned-paths.ts
 var APP_WEB_PREFIX = "apps/web/";
 var BLUEPRINT_LINT_MARKER = `${APP_WEB_PREFIX}eslint-rules/module-boundaries.mjs`;
@@ -3917,20 +3975,217 @@ var MODULE_INIT_SERVER_GEN_PATH = `${APP_WEB_PREFIX}src/module-init.server.gen.t
 var MODULE_SERVER_GEN_PATH = `${APP_WEB_PREFIX}src/module-server.gen.ts`;
 var MODULES_GEN_PATH = `${APP_WEB_PREFIX}src/modules.gen.ts`;
 var APP_EXTENSIONS_PATH = `${APP_WEB_PREFIX}src/lib/modules/app-extensions.ts`;
+var APP_OWNED_PATHS = [APP_EXTENSIONS_PATH];
+function platformOwnedSet(input) {
+  const externalModules = input.externalModules ?? [];
+  const removedModules = input.removedModules ?? [];
+  const moduleNames = [
+    ...input.moduleNames,
+    ...input.ejectedModules,
+    ...input.uiEjectedModules,
+    ...externalModules,
+    ...removedModules
+  ];
+  for (const moduleName of moduleNames) {
+    if (!isValidModuleName(moduleName)) {
+      throw new Error(`Invalid Module name: ${moduleName}`);
+    }
+  }
+  const appOwned = /* @__PURE__ */ new Set([...input.ejectedModules, ...externalModules]);
+  const activeModules = input.moduleNames.filter((name) => !appOwned.has(name));
+  const uiEjectedModules = new Set(input.uiEjectedModules);
+  return {
+    prefixes: [
+      ...activeModules.map((name) => `${APP_WEB_PREFIX}src/modules/${name}/`),
+      `${APP_WEB_PREFIX}src/lib/modules/`
+    ].sort(),
+    // Build outputs, not source: compose regenerates them from Module source on
+    // every dev/build/lint/typecheck/test run and git ignores them, so there is
+    // nothing for the write refusal or the Blueprint updater to protect.
+    files: [],
+    // Detach dominates: a detached Module has no prefix, so it needs no carve-out.
+    carveOuts: activeModules.filter((name) => uiEjectedModules.has(name)).flatMap(
+      (name) => MODULE_UI_SUBPATHS.map((subpath) => `${APP_WEB_PREFIX}src/modules/${name}/${subpath}`)
+    ).sort(),
+    externalModules: [...externalModules].sort(),
+    removedModules: [...removedModules].sort()
+  };
+}
+function appOwnedExcludePathspecs(set) {
+  return [
+    ...APP_OWNED_PATHS.map((file) => `:(exclude)${file}`),
+    ...set.carveOuts.map((carveOut) => `:(glob,exclude)${carveOut}**`)
+  ];
+}
+function platformOwnedDiffPathspecs(set) {
+  return [...set.prefixes, ...set.files, ...appOwnedExcludePathspecs(set)];
+}
+
+// ../../packages/lib/src/server/module-rail/ownership-guard.ts
+var STRICT_RECORD = {
+  version: 1,
+  stardeckUpdates: true,
+  updatesStoppedModules: [],
+  customizedUiModules: [],
+  externalModules: [],
+  uninstalledModules: []
+};
+var MANIFEST_PATH = new RegExp(
+  `^${MODULES_SANDBOX_DIR.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/([^/]+)/${MODULE_MANIFEST_FILENAME.replace(".", "\\.")}$`
+);
+function realpath(dir) {
+  try {
+    return import_node_fs.default.realpathSync(dir);
+  } catch {
+    return import_node_path.default.resolve(dir);
+  }
+}
+function zList(stdout) {
+  return stdout.split("\0").filter(Boolean);
+}
+async function findRelease(git) {
+  const found = await git([
+    "rev-list",
+    "-n1",
+    "--topo-order",
+    `--committer=${BLUEPRINT_RELEASE_COMMITTER_EMAIL.replace(/\./g, "\\.")}`,
+    `--grep=^${BLUEPRINT_RELEASE_SUBJECT_PREFIX}`,
+    "HEAD"
+  ]);
+  const sha = found.status === 0 ? found.stdout.trim() : "";
+  return sha || null;
+}
+async function noReleaseReason(git) {
+  const shallow = await git(["rev-parse", "--is-shallow-repository"]);
+  if (shallow.status === 0 && shallow.stdout.trim() === "true") {
+    return {
+      status: "skipped",
+      warning: true,
+      reason: "this is a shallow clone, so Stardeck's version of the Module files is not in its history. Run `git fetch --unshallow` and lint again to check that no Stardeck-owned file changed."
+    };
+  }
+  return {
+    status: "skipped",
+    warning: false,
+    reason: "no Stardeck release in this repo's history, so it holds no Stardeck-owned files"
+  };
+}
+function readRecord(repoRoot) {
+  let content;
+  try {
+    content = import_node_fs.default.readFileSync(import_node_path.default.join(repoRoot, OWNERSHIP_RECORD_PATH), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { ok: true, record: STRICT_RECORD, found: false };
+    }
+    throw error;
+  }
+  const parsed = parseOwnershipRecord(content);
+  return parsed.ok ? { ok: true, record: parsed.record, found: true } : parsed;
+}
+async function releaseModules(git, release, record) {
+  const listed = await git([
+    "ls-tree",
+    "-r",
+    "-z",
+    "--name-only",
+    release,
+    "--",
+    MODULES_SANDBOX_DIR
+  ]);
+  if (listed.status !== 0) throw new Error(`git ls-tree ${release} failed`);
+  const uninstalled = new Set(record.uninstalledModules);
+  return zList(listed.stdout).map((file) => MANIFEST_PATH.exec(file)?.[1]).filter((name) => !!name && !uninstalled.has(name));
+}
+async function checkStardeckOwnedFiles(input) {
+  const { git, repoRoot } = input;
+  const top = await git(["rev-parse", "--show-toplevel"]);
+  if (top.status !== 0) {
+    return { status: "skipped", warning: false, reason: "not a git checkout" };
+  }
+  if (realpath(top.stdout.trim()) !== realpath(repoRoot)) {
+    return {
+      status: "skipped",
+      warning: false,
+      reason: `${repoRoot} is not the root of its git repo, so it is not an app's own repo`
+    };
+  }
+  const release = await findRelease(git);
+  if (!release) return noReleaseReason(git);
+  const read = readRecord(repoRoot);
+  if (!read.ok) return { status: "invalid-record", error: read.error };
+  const { record } = read;
+  if (!record.stardeckUpdates) {
+    return {
+      status: "skipped",
+      warning: false,
+      reason: "this app stopped all Stardeck updates, so every file is the app's"
+    };
+  }
+  const moduleNames = await releaseModules(git, release, record);
+  const set = platformOwnedSet({
+    moduleNames,
+    ejectedModules: record.updatesStoppedModules,
+    uiEjectedModules: record.customizedUiModules,
+    externalModules: record.externalModules,
+    removedModules: record.uninstalledModules
+  });
+  const pathspecs = [
+    ...platformOwnedDiffPathspecs(set),
+    ...record.uninstalledModules.map(
+      (name) => `:(glob,exclude)${MODULES_SANDBOX_DIR}/*/enhancements/${name}/**`
+    )
+  ];
+  const [changed, added] = await Promise.all([
+    git([
+      "diff",
+      "--name-only",
+      "-z",
+      "--no-renames",
+      "--no-ext-diff",
+      release,
+      "--",
+      ...pathspecs
+    ]),
+    git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...pathspecs])
+  ]);
+  if (changed.status !== 0 || added.status !== 0) {
+    throw new Error(`git could not compare the checkout with Stardeck's version ${release}`);
+  }
+  const paths = [.../* @__PURE__ */ new Set([...zList(changed.stdout), ...zList(added.stdout)])].sort();
+  console.log(
+    `[OwnershipGuard] release=${release.slice(0, 12)} record=${read.found ? "found" : "missing"} modules=${moduleNames.length} carveOuts=${set.carveOuts.length} changed=${paths.length}`
+  );
+  return paths.length > 0 ? { status: "changed", release, paths } : { status: "clean", release };
+}
+function formatOwnershipGuardFailure(result) {
+  if (result.status === "invalid-record") {
+    return `${result.error}
+Restore it with \`git checkout origin/HEAD -- ${OWNERSHIP_RECORD_PATH}\`. Stardeck writes this file; ownership changes in the dashboard's Modules tab.`;
+  }
+  const count = `${result.paths.length} Stardeck-owned ${result.paths.length === 1 ? "file" : "files"}`;
+  return [
+    `${count} changed from Stardeck's version (${result.release.slice(0, 12)}). The next Stardeck update replaces them, so these changes would be lost:`,
+    ...result.paths.map((file) => `  - ${file}`),
+    "",
+    `Undo them (\`git checkout ${result.release.slice(0, 12)} -- <path>\`, or delete a new file) and do one of these instead:`,
+    ...STARDECK_OWNED_ALTERNATIVES.map((line) => `  - ${line.replace(/\*\*/g, "")}`)
+  ].join("\n");
+}
 
 // src/cli.ts
 var import_typescript7 = __toESM(require("typescript"));
-var import_node_path4 = __toESM(require("path"));
+var import_node_path5 = __toESM(require("path"));
 
 // src/index.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = __toESM(require("fs"));
-var import_node_path3 = __toESM(require("path"));
+var import_node_fs4 = __toESM(require("fs"));
+var import_node_path4 = __toESM(require("path"));
 
 // ../../packages/lib/src/server/module-rail/local-fs-sandbox.ts
 var import_node_child_process = require("child_process");
-var import_node_fs = __toESM(require("fs"));
-var import_node_path = __toESM(require("path"));
+var import_node_fs2 = __toESM(require("fs"));
+var import_node_path2 = __toESM(require("path"));
 function localFsSandbox(root) {
   return {
     async exec(command, options) {
@@ -3954,13 +4209,13 @@ ${result.error}`);
     },
     async fileExists(relative) {
       try {
-        return import_node_fs.default.statSync(import_node_path.default.join(root, relative)).isFile();
+        return import_node_fs2.default.statSync(import_node_path2.default.join(root, relative)).isFile();
       } catch {
         return false;
       }
     },
     async readFile(relative) {
-      return import_node_fs.default.readFileSync(import_node_path.default.join(root, relative), "utf8");
+      return import_node_fs2.default.readFileSync(import_node_path2.default.join(root, relative), "utf8");
     },
     async fetchRemoteRef() {
       throw new Error("[ModuleRail] local filesystem sandbox cannot reach the network");
@@ -3982,6 +4237,7 @@ var JSON_SECRET_PAIR = new RegExp(
   "g"
 );
 var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
+var SHELL_QUOTE_CONTINUATION = String.raw`\''`;
 function redactSecrets(text) {
   return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
@@ -3992,28 +4248,28 @@ function shellQuote(value) {
 }
 
 // ../../packages/lib/src/shared/compose-inputs.ts
-var import_zod6 = require("zod");
+var import_zod7 = require("zod");
 var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
-var composeInputsSchema = import_zod6.z.strictObject({
-  connectedStores: import_zod6.z.array(
-    import_zod6.z.strictObject({
-      storeId: import_zod6.z.string().min(1),
-      slug: import_zod6.z.string().min(1),
+var composeInputsSchema = import_zod7.z.strictObject({
+  connectedStores: import_zod7.z.array(
+    import_zod7.z.strictObject({
+      storeId: import_zod7.z.string().min(1),
+      slug: import_zod7.z.string().min(1),
       // A row with an empty binding key must not fail a deploy: the rail
       // treats falsy as "no binding key", so normalise rather than reject.
-      bindingKey: import_zod6.z.string().nullish().transform((value) => value || null),
-      accessLevel: import_zod6.z.enum(["read", "write", "admin"]),
+      bindingKey: import_zod7.z.string().nullish().transform((value) => value || null),
+      accessLevel: import_zod7.z.enum(["read", "write", "admin"]),
       // Defaulted so a file written before the platform emitted store types
       // (database rows only) still parses. The platform starts writing
       // storage rows, with `type` set, once forks run a compose that reads it.
-      type: import_zod6.z.enum(["database", "storage"]).default("database")
+      type: import_zod7.z.enum(["database", "storage"]).default("database")
     })
   ).default([]),
-  installs: import_zod6.z.record(
-    import_zod6.z.string(),
-    import_zod6.z.strictObject({
-      installedVersion: import_zod6.z.string().min(1),
-      datastoreBindings: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).nullish()
+  installs: import_zod7.z.record(
+    import_zod7.z.string(),
+    import_zod7.z.strictObject({
+      installedVersion: import_zod7.z.string().min(1),
+      datastoreBindings: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).nullish()
     })
   ).default({})
 });
@@ -4173,13 +4429,13 @@ function assertClientSafeConventionalEntryImports(source, pathLabel, kind) {
 function createMessageTree() {
   return /* @__PURE__ */ Object.create(null);
 }
-function assertMessageTree(value, path5) {
+function assertMessageTree(value, path6) {
   if (typeof value === "string") return;
   if (value === null || Array.isArray(value) || typeof value !== "object") {
-    throw new Error(`Invalid message at ${path5}: expected string or nested object`);
+    throw new Error(`Invalid message at ${path6}: expected string or nested object`);
   }
   for (const [key, child] of Object.entries(value)) {
-    assertMessageTree(child, `${path5}.${key}`);
+    assertMessageTree(child, `${path6}.${key}`);
   }
 }
 function cloneTree(value) {
@@ -4189,17 +4445,17 @@ function cloneTree(value) {
   }
   return clone;
 }
-function collectLeafPaths(value, path5, out) {
+function collectLeafPaths(value, path6, out) {
   if (typeof value === "string") {
-    out.push(path5);
+    out.push(path6);
     return;
   }
-  assertMessageTree(value, path5);
-  for (const [key, child] of Object.entries(value)) collectLeafPaths(child, `${path5}.${key}`, out);
+  assertMessageTree(value, path6);
+  for (const [key, child] of Object.entries(value)) collectLeafPaths(child, `${path6}.${key}`, out);
 }
-function overrideInto(target, source, owner, path5, missing) {
+function overrideInto(target, source, owner, path6, missing) {
   for (const [key, value] of Object.entries(source)) {
-    const nextPath = path5 ? `${path5}.${key}` : key;
+    const nextPath = path6 ? `${path6}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(target, key)) {
       collectLeafPaths(value, nextPath, missing);
       continue;
@@ -4226,9 +4482,9 @@ function overrideInto(target, source, owner, path5, missing) {
 function composeLocaleMessagesForPlan(layers) {
   const result = createMessageTree();
   const leafOwners = /* @__PURE__ */ new Map();
-  function mergeInto(target, source, owner, path5) {
+  function mergeInto(target, source, owner, path6) {
     for (const [key, value] of Object.entries(source)) {
-      const nextPath = path5 ? `${path5}.${key}` : key;
+      const nextPath = path6 ? `${path6}.${key}` : key;
       const hasExisting = Object.prototype.hasOwnProperty.call(target, key);
       const existing = hasExisting ? target[key] : void 0;
       if (typeof value === "string") {
@@ -4789,8 +5045,8 @@ var METHOD_ORDER = {
 function compareNames2(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
 }
-function endpointPairKey(method, path5) {
-  return `${method} ${path5}`;
+function endpointPairKey(method, path6) {
+  return `${method} ${path6}`;
 }
 function apiPathToRouteFile(apiPath) {
   if (!apiPath.startsWith("/api/")) {
@@ -4804,11 +5060,11 @@ function routeEntryToAppPageFile(nextRelativePath) {
 }
 var APP_ROUTE_FILE_PREFIX = `${APP_PACKAGE_DIR}/src/app/`;
 var API_ROUTE_FILE_SUFFIXES = ["/route.ts", "/route.tsx", "/route.jsx", "/route.js"];
-function appRouteFileToNextRelativePath(path5) {
-  const pagePath = appPageFileToNextRelativePath(path5, APP_PACKAGE_DIR);
+function appRouteFileToNextRelativePath(path6) {
+  const pagePath = appPageFileToNextRelativePath(path6, APP_PACKAGE_DIR);
   if (pagePath != null) return pagePath;
-  if (!path5.startsWith(APP_ROUTE_FILE_PREFIX)) return null;
-  const relative = path5.slice(APP_ROUTE_FILE_PREFIX.length);
+  if (!path6.startsWith(APP_ROUTE_FILE_PREFIX)) return null;
+  const relative = path6.slice(APP_ROUTE_FILE_PREFIX.length);
   if (!relative.startsWith("api/")) return null;
   const suffix = API_ROUTE_FILE_SUFFIXES.find((candidate) => relative.endsWith(candidate));
   if (!suffix) return null;
@@ -4827,6 +5083,9 @@ function enhancementImport(owner, peer) {
 function scopeLabel(scope) {
   return scope.kind === "root" ? "root" : `enhancement:${scope.peer}`;
 }
+function endpointMarkerOwnsStub(marker, stub) {
+  return stub != null && marker?.kind === "endpoint" && marker.owner === stub.owner;
+}
 function formatEndpointMarker(owner, scope) {
   return `// ${MODULE_STUB_MARKER} owner=${owner} scope=${scopeLabel(scope)}`;
 }
@@ -4900,9 +5159,9 @@ function legacyHandlerPropertyMatchesPath(property, method, physicalPath, bindin
   const expectedTokens = knownAliases[`${binding} ${method} ${physicalPath}`] ?? pathTokens;
   return handlerTokens.length === expectedTokens.length && handlerTokens.every((token, index) => token === expectedTokens[index]);
 }
-function parseLegacyApiAdapter(path5, source) {
-  const physicalPath = appRouteFileToNextRelativePath(path5);
-  if (expectedMarkerKindForPath(path5) !== "endpoint" || physicalPath == null) return null;
+function parseLegacyApiAdapter(path6, source) {
+  const physicalPath = appRouteFileToNextRelativePath(path6);
+  if (expectedMarkerKindForPath(path6) !== "endpoint" || physicalPath == null) return null;
   const firstLine = source.split(/\r?\n/, 1)[0]?.trim() ?? "";
   const match = firstLine.match(
     new RegExp(
@@ -4912,7 +5171,7 @@ function parseLegacyApiAdapter(path5, source) {
   if (!match || match[2] !== physicalPath) return null;
   const owner = match[1];
   if (!isValidModuleName(owner)) return null;
-  const file = import_typescript4.default.createSourceFile(path5, source, import_typescript4.default.ScriptTarget.Latest, false, import_typescript4.default.ScriptKind.TS);
+  const file = import_typescript4.default.createSourceFile(path6, source, import_typescript4.default.ScriptTarget.Latest, false, import_typescript4.default.ScriptKind.TS);
   if (file.parseDiagnostics.length > 0) {
     return null;
   }
@@ -4954,9 +5213,9 @@ function parseLegacyApiAdapter(path5, source) {
   }
   return handlerBinding != null && methods.size > 0 ? { owner, methods: [...methods] } : null;
 }
-function parseLegacyRouteAdapter(path5, source) {
-  const physicalPath = appRouteFileToNextRelativePath(path5);
-  if (expectedMarkerKindForPath(path5) !== "route" || physicalPath == null) return null;
+function parseLegacyRouteAdapter(path6, source) {
+  const physicalPath = appRouteFileToNextRelativePath(path6);
+  if (expectedMarkerKindForPath(path6) !== "route" || physicalPath == null) return null;
   const normalized = source.replace(/\r\n/g, "\n");
   const match = normalized.match(
     new RegExp(
@@ -4968,30 +5227,30 @@ function parseLegacyRouteAdapter(path5, source) {
   const nextRelativePath = match[2];
   return isValidModuleName(owner) && nextRelativePath === physicalPath ? { owner, nextRelativePath } : null;
 }
-function legacyRouteAdapterMatchesStub(path5, source, stub) {
-  const legacy = parseLegacyRouteAdapter(path5, source);
+function legacyRouteAdapterMatchesStub(path6, source, stub) {
+  const legacy = parseLegacyRouteAdapter(path6, source);
   return legacy != null && legacy.owner === stub.owner;
 }
 var API_ROUTE_DIR_PREFIX = `${APP_PACKAGE_DIR}/src/app/api/`;
 var APP_DIR_PREFIX = `${APP_PACKAGE_DIR}/src/app/`;
 var PAGE_FILE_SUFFIXES = ["/page.tsx", "/page.ts", "/page.jsx", "/page.js"];
-function expectedMarkerKindForPath(path5) {
-  if (path5 === MODULES_GEN_PATH) return "registry";
-  if (path5 === MODULE_CONTRIBUTIONS_GEN_PATH) return "contributions";
-  if (path5 === MODULE_DATASTORES_GEN_PATH) return "datastores";
-  if (path5 === MODULE_I18N_GEN_PATH) return "i18n";
-  if (path5 === MODULE_INIT_SERVER_GEN_PATH) return "init";
-  if (path5 === MODULE_SERVER_GEN_PATH) return "server";
-  if (path5.startsWith(API_ROUTE_DIR_PREFIX) && path5.endsWith("/route.ts")) return "endpoint";
-  if (path5.startsWith(APP_DIR_PREFIX) && !path5.startsWith(API_ROUTE_DIR_PREFIX) && PAGE_FILE_SUFFIXES.some((suffix) => path5.endsWith(suffix))) {
+function expectedMarkerKindForPath(path6) {
+  if (path6 === MODULES_GEN_PATH) return "registry";
+  if (path6 === MODULE_CONTRIBUTIONS_GEN_PATH) return "contributions";
+  if (path6 === MODULE_DATASTORES_GEN_PATH) return "datastores";
+  if (path6 === MODULE_I18N_GEN_PATH) return "i18n";
+  if (path6 === MODULE_INIT_SERVER_GEN_PATH) return "init";
+  if (path6 === MODULE_SERVER_GEN_PATH) return "server";
+  if (path6.startsWith(API_ROUTE_DIR_PREFIX) && path6.endsWith("/route.ts")) return "endpoint";
+  if (path6.startsWith(APP_DIR_PREFIX) && !path6.startsWith(API_ROUTE_DIR_PREFIX) && PAGE_FILE_SUFFIXES.some((suffix) => path6.endsWith(suffix))) {
     return "route";
   }
   return null;
 }
-function markerCongruentWithPath(path5, marker) {
-  if (expectedMarkerKindForPath(path5) !== marker.kind) return false;
+function markerCongruentWithPath(path6, marker) {
+  if (expectedMarkerKindForPath(path6) !== marker.kind) return false;
   if (marker.kind === "route") {
-    const derived = appPageFileToNextRelativePath(path5, APP_PACKAGE_DIR);
+    const derived = appPageFileToNextRelativePath(path6, APP_PACKAGE_DIR);
     return derived != null && derived === marker.nextRelativePath;
   }
   return true;
@@ -5267,8 +5526,8 @@ function buildGeneratedModuleRegistry(input) {
 function activeEnhancementPeers(registryModule) {
   return new Set(registryModule.enhancements.filter((e) => e.active).map((e) => e.peer));
 }
-function endpointBucketKey(path5, owner, scope) {
-  return `${path5}\0${owner}\0${scopeLabel(scope)}`;
+function endpointBucketKey(path6, owner, scope) {
+  return `${path6}\0${owner}\0${scopeLabel(scope)}`;
 }
 function planRouteStubs(input) {
   const endpointBuckets = /* @__PURE__ */ new Map();
@@ -5392,7 +5651,7 @@ function planRouteStubs(input) {
     for (const entry of entries) {
       const nextRelativePath = entry.nextRelativePath;
       const destination = normalizeAppRouterDestinationPattern(nextRelativePath);
-      const path5 = routeEntryToAppPageFile(nextRelativePath);
+      const path6 = routeEntryToAppPageFile(nextRelativePath);
       const existing = routeDestinationOwners.get(destination);
       if (existing) {
         throw new Error(
@@ -5402,13 +5661,13 @@ function planRouteStubs(input) {
       routeDestinationOwners.set(destination, {
         owner: regMod.name,
         nextRelativePath,
-        path: path5
+        path: path6
       });
       const importModule = routeEntryImport(regMod.name, nextRelativePath);
       const analyzed = analyzeRouteEntryPath(nextRelativePath);
       const mount = mounts.find((claim) => routeEntryCoveredByMountClaim(analyzed, claim));
       routeStubs.push({
-        path: path5,
+        path: path6,
         owner: regMod.name,
         nextRelativePath,
         importModule,
@@ -5469,16 +5728,16 @@ function planCompositionArtifacts(input) {
     ...stubs.routeStubs.map((stub) => stub.path)
   ]);
   const existingGeneratedPathSet = new Set(input.existingGeneratedPaths);
-  const isProvenStaleDeletionCandidate = (path5, content) => {
-    if (path5 === MODULES_GEN_PATH) return false;
-    if (COMPOSITION_RUNTIME_GEN_PATHS.includes(path5)) return false;
-    if (desiredPaths.has(path5)) return false;
-    if (!existingGeneratedPathSet.has(path5)) return false;
-    const legacy = parseLegacyApiAdapter(path5, content);
+  const isProvenStaleDeletionCandidate = (path6, content) => {
+    if (path6 === MODULES_GEN_PATH) return false;
+    if (COMPOSITION_RUNTIME_GEN_PATHS.includes(path6)) return false;
+    if (desiredPaths.has(path6)) return false;
+    if (!existingGeneratedPathSet.has(path6)) return false;
+    const legacy = parseLegacyApiAdapter(path6, content);
     if (legacy) return true;
-    if (parseLegacyRouteAdapter(path5, content)) return true;
+    if (parseLegacyRouteAdapter(path6, content)) return true;
     const marker = parseCompositionArtifactMarker(content);
-    return marker != null && markerCongruentWithPath(path5, marker);
+    return marker != null && markerCongruentWithPath(path6, marker);
   };
   const plannedByDestination = /* @__PURE__ */ new Map();
   for (const stub of stubs.routeStubs) {
@@ -5528,7 +5787,7 @@ function planCompositionArtifacts(input) {
     const legacy = parseLegacyApiAdapter(pagePath, content);
     const plannedRoute = plannedRouteByPath.get(pagePath);
     const plannedEndpoint = plannedEndpointByPath.get(pagePath);
-    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (marker != null && marker.kind === "endpoint" && marker.owner === plannedEndpoint.owner && scopeLabel(marker.scope) === scopeLabel(plannedEndpoint.scope) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
+    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (endpointMarkerOwnsStub(marker, plannedEndpoint) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
     if (isExactPlannedMatch) {
       continue;
     }
@@ -5632,13 +5891,13 @@ function planCompositionArtifacts(input) {
   for (const stub of stubs.routeStubs) desired.set(stub.path, stub.content);
   const endpointStubByPath = new Map(stubs.endpointStubs.map((stub) => [stub.path, stub]));
   const routeStubByPath = new Map(stubs.routeStubs.map((stub) => [stub.path, stub]));
-  for (const [path5] of desired) {
-    const existing = input.existingFiles[path5];
+  for (const [path6] of desired) {
+    const existing = input.existingFiles[path6];
     if (existing == null) continue;
     let marker = parseCompositionArtifactMarker(existing);
-    const plannedEndpoint = endpointStubByPath.get(path5);
-    const plannedRoute = routeStubByPath.get(path5);
-    const legacy = parseLegacyApiAdapter(path5, existing);
+    const plannedEndpoint = endpointStubByPath.get(path6);
+    const plannedRoute = routeStubByPath.get(path6);
+    const legacy = parseLegacyApiAdapter(path6, existing);
     if (legacy && plannedEndpoint) {
       marker = {
         kind: "endpoint",
@@ -5646,66 +5905,64 @@ function planCompositionArtifacts(input) {
         scope: plannedEndpoint.scope
       };
     }
-    if (!marker && plannedRoute && legacyRouteAdapterMatchesStub(path5, existing, plannedRoute)) {
+    if (!marker && plannedRoute && legacyRouteAdapterMatchesStub(path6, existing, plannedRoute)) {
       marker = {
         kind: "route",
         owner: plannedRoute.owner,
         nextRelativePath: plannedRoute.nextRelativePath
       };
     }
-    const isGenRuntimePath = COMPOSITION_RUNTIME_GEN_PATHS.includes(path5);
+    const isGenRuntimePath = COMPOSITION_RUNTIME_GEN_PATHS.includes(path6);
     if (!marker) {
       return {
         ok: false,
-        error: path5 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path5}` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path5}` : `[ModuleRail] composition artifacts: refusing to overwrite unmanaged route at ${path5}`,
-        path: path5
+        error: path6 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path6}` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path6}` : `[ModuleRail] composition artifacts: refusing to overwrite unmanaged route at ${path6}`,
+        path: path6
       };
     }
-    const expectedKind = expectedMarkerKindForPath(path5);
+    const expectedKind = expectedMarkerKindForPath(path6);
     if (marker.kind !== expectedKind) {
       return {
         ok: false,
-        error: path5 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path5} (incongruent marker ownership: found ${marker.kind} marker)` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path5} (incongruent marker ownership: found ${marker.kind} marker)` : `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (expected ${expectedKind ?? "no"} marker, found ${marker.kind} marker)`,
-        path: path5
+        error: path6 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path6} (incongruent marker ownership: found ${marker.kind} marker)` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path6} (incongruent marker ownership: found ${marker.kind} marker)` : `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path6} (expected ${expectedKind ?? "no"} marker, found ${marker.kind} marker)`,
+        path: path6
       };
     }
     if (marker.kind === "endpoint") {
-      const stub = endpointStubByPath.get(path5);
-      const ownerMatches = stub != null && marker.owner === stub.owner;
-      const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
-      if (!ownerMatches || !scopeMatches) {
+      const stub = endpointStubByPath.get(path6);
+      if (!endpointMarkerOwnsStub(marker, stub)) {
         return {
           ok: false,
-          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
-          path: path5,
+          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path6} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
+          path: path6,
           owner: stub?.owner
         };
       }
     } else if (marker.kind === "route") {
-      const stub = routeStubByPath.get(path5);
+      const stub = routeStubByPath.get(path6);
       const ownerMatches = stub != null && marker.owner === stub.owner;
       const pathMatches = stub != null && marker.nextRelativePath === stub.nextRelativePath;
       if (!ownerMatches || !pathMatches) {
         return {
           ok: false,
-          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (existing owner=${marker.owner} path=${marker.nextRelativePath} vs planned owner=${stub?.owner ?? "?"} path=${stub?.nextRelativePath ?? "?"})`,
-          path: path5,
+          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path6} (existing owner=${marker.owner} path=${marker.nextRelativePath} vs planned owner=${stub?.owner ?? "?"} path=${stub?.nextRelativePath ?? "?"})`,
+          path: path6,
           owner: stub?.owner
         };
       }
     }
   }
   const deletes = [];
-  for (const path5 of input.existingGeneratedPaths) {
-    const existing = input.existingFiles[path5];
+  for (const path6 of input.existingGeneratedPaths) {
+    const existing = input.existingFiles[path6];
     if (existing == null) continue;
-    if (!isProvenStaleDeletionCandidate(path5, existing)) {
+    if (!isProvenStaleDeletionCandidate(path6, existing)) {
       continue;
     }
-    deletes.push(path5);
+    deletes.push(path6);
   }
   deletes.sort(compareNames2);
-  const writes = [...desired.entries()].filter(([path5, content]) => input.existingFiles[path5] !== content).map(([path5, content]) => ({ path: path5, content })).sort((a, b) => compareNames2(a.path, b.path));
+  const writes = [...desired.entries()].filter(([path6, content]) => input.existingFiles[path6] !== content).map(([path6, content]) => ({ path: path6, content })).sort((a, b) => compareNames2(a.path, b.path));
   return {
     ok: true,
     plan: {
@@ -5976,14 +6233,14 @@ function rejectPseudoModuleEntries(entries, parentDir, label) {
 }
 
 // ../../packages/lib/src/shared/module-composition.ts
-var import_zod7 = require("zod");
-var creationSourceBlankSchema = import_zod7.z.object({
-  type: import_zod7.z.literal("blank")
+var import_zod8 = require("zod");
+var creationSourceBlankSchema = import_zod8.z.object({
+  type: import_zod8.z.literal("blank")
 });
-var creationSourceBlueprintSchema = import_zod7.z.object({
-  type: import_zod7.z.literal("blueprint"),
+var creationSourceBlueprintSchema = import_zod8.z.object({
+  type: import_zod8.z.literal("blueprint"),
   /** Internal template/fork project id — keep template naming in identifiers. */
-  blueprintProjectId: import_zod7.z.string().uuid(),
+  blueprintProjectId: import_zod8.z.string().uuid(),
   /**
    * `null`/absent means every feature Module: the platform stores that as the
    * explicit list of feature Modules in the published Blueprint version the fork
@@ -5991,192 +6248,197 @@ var creationSourceBlueprintSchema = import_zod7.z.object({
    * a custom app: no feature Module, Library Modules only (`resolvePlatformEnv`
    * emits it as a set value naming no Module).
    */
-  enabledModules: import_zod7.z.array(moduleNameSchema).max(100).nullable().optional()
+  enabledModules: import_zod8.z.array(moduleNameSchema).max(100).nullable().optional(),
+  /**
+   * The kind of business (a preset id the published version defines). Its Modules are built
+   * and `enabledModules` adds extras on top; for the general kind `enabledModules` is the pick.
+   */
+  businessKind: import_zod8.z.string().regex(/^[a-z][a-z0-9-]{0,39}$/).optional()
 });
-var creationSourceSchema = import_zod7.z.discriminatedUnion("type", [
+var creationSourceSchema = import_zod8.z.discriminatedUnion("type", [
   creationSourceBlankSchema,
   creationSourceBlueprintSchema
 ]);
-var moduleInstallHandoffSchema = import_zod7.z.object({
-  moduleName: import_zod7.z.string().min(1),
-  homeProjectId: import_zod7.z.string().uuid(),
-  installedVersion: import_zod7.z.string().min(1),
-  baselineSha: import_zod7.z.string().min(1),
-  mounts: import_zod7.z.array(
-    import_zod7.z.object({
-      group: import_zod7.z.string(),
-      segment: import_zod7.z.string()
+var moduleInstallHandoffSchema = import_zod8.z.object({
+  moduleName: import_zod8.z.string().min(1),
+  homeProjectId: import_zod8.z.string().uuid(),
+  installedVersion: import_zod8.z.string().min(1),
+  baselineSha: import_zod8.z.string().min(1),
+  mounts: import_zod8.z.array(
+    import_zod8.z.object({
+      group: import_zod8.z.string(),
+      segment: import_zod8.z.string()
     })
   ),
-  integration: import_zod7.z.array(import_zod7.z.string()),
-  workflows: import_zod7.z.array(import_zod7.z.string()),
-  prunedEnhancements: import_zod7.z.array(import_zod7.z.string()),
-  restoredEnhancements: import_zod7.z.array(import_zod7.z.string()).optional(),
-  permissions: import_zod7.z.array(
-    import_zod7.z.object({
-      key: import_zod7.z.string().min(1),
-      description: import_zod7.z.string().min(1)
+  integration: import_zod8.z.array(import_zod8.z.string()),
+  workflows: import_zod8.z.array(import_zod8.z.string()),
+  prunedEnhancements: import_zod8.z.array(import_zod8.z.string()),
+  restoredEnhancements: import_zod8.z.array(import_zod8.z.string()).optional(),
+  permissions: import_zod8.z.array(
+    import_zod8.z.object({
+      key: import_zod8.z.string().min(1),
+      description: import_zod8.z.string().min(1)
     })
   ).optional()
 });
 
 // ../../packages/lib/src/shared/schema-ops.ts
-var import_zod8 = require("zod");
-var columnSpecSchema = import_zod8.z.object({
-  name: import_zod8.z.string().min(1).max(63),
-  pgType: import_zod8.z.string().min(1),
-  nullable: import_zod8.z.boolean(),
+var import_zod9 = require("zod");
+var columnSpecSchema = import_zod9.z.object({
+  name: import_zod9.z.string().min(1).max(63),
+  pgType: import_zod9.z.string().min(1),
+  nullable: import_zod9.z.boolean(),
   /**
    * A SQL expression used as the column default, as a raw string (e.g. `'t'`,
    * `0`, `now()`, `gen_random_uuid()`). `null` or omitted means no default.
    * NOT a JS literal — must already be a valid SQL expression.
    */
-  default: import_zod8.z.string().nullable().optional(),
-  fieldType: import_zod8.z.string().optional(),
-  fieldConfig: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.unknown()).optional()
+  default: import_zod9.z.string().nullable().optional(),
+  fieldType: import_zod9.z.string().optional(),
+  fieldConfig: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.unknown()).optional()
 });
-var referentialActionSchema = import_zod8.z.enum([
+var referentialActionSchema = import_zod9.z.enum([
   "cascade",
   "set null",
   "set default",
   "restrict",
   "no action"
 ]);
-var schemaOpSchema = import_zod8.z.discriminatedUnion("type", [
+var schemaOpSchema = import_zod9.z.discriminatedUnion("type", [
   // Tables
-  import_zod8.z.object({
-    type: import_zod8.z.literal("createTable"),
-    table: import_zod8.z.string().min(1).max(63),
-    columns: import_zod8.z.array(columnSpecSchema).min(1),
-    primaryKey: import_zod8.z.array(import_zod8.z.string()).optional(),
-    ifNotExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("createTable"),
+    table: import_zod9.z.string().min(1).max(63),
+    columns: import_zod9.z.array(columnSpecSchema).min(1),
+    primaryKey: import_zod9.z.array(import_zod9.z.string()).optional(),
+    ifNotExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("dropTable"),
-    table: import_zod8.z.string().min(1).max(63),
-    cascade: import_zod8.z.boolean().optional(),
-    ifExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("dropTable"),
+    table: import_zod9.z.string().min(1).max(63),
+    cascade: import_zod9.z.boolean().optional(),
+    ifExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("renameTable"),
-    from: import_zod8.z.string().min(1).max(63),
-    to: import_zod8.z.string().min(1).max(63)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("renameTable"),
+    from: import_zod9.z.string().min(1).max(63),
+    to: import_zod9.z.string().min(1).max(63)
   }),
   // Columns
-  import_zod8.z.object({
-    type: import_zod8.z.literal("addColumn"),
-    table: import_zod8.z.string().min(1).max(63),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("addColumn"),
+    table: import_zod9.z.string().min(1).max(63),
     column: columnSpecSchema,
-    ifNotExists: import_zod8.z.boolean().optional()
+    ifNotExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("dropColumn"),
-    table: import_zod8.z.string().min(1).max(63),
-    column: import_zod8.z.string().min(1).max(63),
-    cascade: import_zod8.z.boolean().optional(),
-    ifExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("dropColumn"),
+    table: import_zod9.z.string().min(1).max(63),
+    column: import_zod9.z.string().min(1).max(63),
+    cascade: import_zod9.z.boolean().optional(),
+    ifExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("renameColumn"),
-    table: import_zod8.z.string().min(1).max(63),
-    from: import_zod8.z.string().min(1).max(63),
-    to: import_zod8.z.string().min(1).max(63)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("renameColumn"),
+    table: import_zod9.z.string().min(1).max(63),
+    from: import_zod9.z.string().min(1).max(63),
+    to: import_zod9.z.string().min(1).max(63)
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("alterColumnType"),
-    table: import_zod8.z.string().min(1).max(63),
-    column: import_zod8.z.string().min(1).max(63),
-    newType: import_zod8.z.string().min(1),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("alterColumnType"),
+    table: import_zod9.z.string().min(1).max(63),
+    column: import_zod9.z.string().min(1).max(63),
+    newType: import_zod9.z.string().min(1),
     /** Optional USING expression for potentially-lossy casts */
-    using: import_zod8.z.string().optional()
+    using: import_zod9.z.string().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("alterColumnNullable"),
-    table: import_zod8.z.string().min(1).max(63),
-    column: import_zod8.z.string().min(1).max(63),
-    nullable: import_zod8.z.boolean()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("alterColumnNullable"),
+    table: import_zod9.z.string().min(1).max(63),
+    column: import_zod9.z.string().min(1).max(63),
+    nullable: import_zod9.z.boolean()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("alterColumnDefault"),
-    table: import_zod8.z.string().min(1).max(63),
-    column: import_zod8.z.string().min(1).max(63),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("alterColumnDefault"),
+    table: import_zod9.z.string().min(1).max(63),
+    column: import_zod9.z.string().min(1).max(63),
     /** null means drop the default; otherwise a SQL expression string. */
-    default: import_zod8.z.string().nullable()
+    default: import_zod9.z.string().nullable()
   }),
   // Indexes
-  import_zod8.z.object({
-    type: import_zod8.z.literal("addIndex"),
-    table: import_zod8.z.string().min(1).max(63),
-    name: import_zod8.z.string().min(1).max(63),
-    columns: import_zod8.z.array(import_zod8.z.string().min(1)).min(1),
-    unique: import_zod8.z.boolean().optional(),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("addIndex"),
+    table: import_zod9.z.string().min(1).max(63),
+    name: import_zod9.z.string().min(1).max(63),
+    columns: import_zod9.z.array(import_zod9.z.string().min(1)).min(1),
+    unique: import_zod9.z.boolean().optional(),
     /** Partial-index WHERE clause, as a raw SQL expression */
-    where: import_zod8.z.string().optional(),
-    ifNotExists: import_zod8.z.boolean().optional()
+    where: import_zod9.z.string().optional(),
+    ifNotExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("dropIndex"),
-    name: import_zod8.z.string().min(1).max(63),
-    cascade: import_zod8.z.boolean().optional(),
-    ifExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("dropIndex"),
+    name: import_zod9.z.string().min(1).max(63),
+    cascade: import_zod9.z.boolean().optional(),
+    ifExists: import_zod9.z.boolean().optional()
   }),
   // Constraints
-  import_zod8.z.object({
-    type: import_zod8.z.literal("addForeignKey"),
-    table: import_zod8.z.string().min(1).max(63),
-    name: import_zod8.z.string().min(1).max(63),
-    columns: import_zod8.z.array(import_zod8.z.string().min(1)).min(1),
-    refTable: import_zod8.z.string().min(1).max(63),
-    refColumns: import_zod8.z.array(import_zod8.z.string().min(1)).min(1),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("addForeignKey"),
+    table: import_zod9.z.string().min(1).max(63),
+    name: import_zod9.z.string().min(1).max(63),
+    columns: import_zod9.z.array(import_zod9.z.string().min(1)).min(1),
+    refTable: import_zod9.z.string().min(1).max(63),
+    refColumns: import_zod9.z.array(import_zod9.z.string().min(1)).min(1),
     onDelete: referentialActionSchema.optional(),
     onUpdate: referentialActionSchema.optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("addUniqueConstraint"),
-    table: import_zod8.z.string().min(1).max(63),
-    name: import_zod8.z.string().min(1).max(63),
-    columns: import_zod8.z.array(import_zod8.z.string().min(1)).min(1)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("addUniqueConstraint"),
+    table: import_zod9.z.string().min(1).max(63),
+    name: import_zod9.z.string().min(1).max(63),
+    columns: import_zod9.z.array(import_zod9.z.string().min(1)).min(1)
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("addCheckConstraint"),
-    table: import_zod8.z.string().min(1).max(63),
-    name: import_zod8.z.string().min(1).max(63),
-    expression: import_zod8.z.string().min(1)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("addCheckConstraint"),
+    table: import_zod9.z.string().min(1).max(63),
+    name: import_zod9.z.string().min(1).max(63),
+    expression: import_zod9.z.string().min(1)
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("dropConstraint"),
-    table: import_zod8.z.string().min(1).max(63),
-    name: import_zod8.z.string().min(1).max(63),
-    cascade: import_zod8.z.boolean().optional(),
-    ifExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("dropConstraint"),
+    table: import_zod9.z.string().min(1).max(63),
+    name: import_zod9.z.string().min(1).max(63),
+    cascade: import_zod9.z.boolean().optional(),
+    ifExists: import_zod9.z.boolean().optional()
   }),
   // Enum types
-  import_zod8.z.object({
-    type: import_zod8.z.literal("createEnum"),
-    name: import_zod8.z.string().min(1).max(63),
-    values: import_zod8.z.array(import_zod8.z.string().min(1)).min(1)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("createEnum"),
+    name: import_zod9.z.string().min(1).max(63),
+    values: import_zod9.z.array(import_zod9.z.string().min(1)).min(1)
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("alterEnumAddValue"),
-    name: import_zod8.z.string().min(1).max(63),
-    value: import_zod8.z.string().min(1),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("alterEnumAddValue"),
+    name: import_zod9.z.string().min(1).max(63),
+    value: import_zod9.z.string().min(1),
     /** Position the new value before an existing one (mutually exclusive with `after`) */
-    before: import_zod8.z.string().optional(),
+    before: import_zod9.z.string().optional(),
     /** Position the new value after an existing one (mutually exclusive with `before`) */
-    after: import_zod8.z.string().optional(),
-    ifNotExists: import_zod8.z.boolean().optional()
+    after: import_zod9.z.string().optional(),
+    ifNotExists: import_zod9.z.boolean().optional()
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("dropEnum"),
-    name: import_zod8.z.string().min(1).max(63),
-    cascade: import_zod8.z.boolean().optional(),
-    ifExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("dropEnum"),
+    name: import_zod9.z.string().min(1).max(63),
+    cascade: import_zod9.z.boolean().optional(),
+    ifExists: import_zod9.z.boolean().optional()
   }),
   // Extensions
-  import_zod8.z.object({
-    type: import_zod8.z.literal("createExtension"),
-    name: import_zod8.z.string().min(1),
-    ifNotExists: import_zod8.z.boolean().optional()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("createExtension"),
+    name: import_zod9.z.string().min(1),
+    ifNotExists: import_zod9.z.boolean().optional()
   }),
   // Data operations
   /**
@@ -6184,26 +6446,26 @@ var schemaOpSchema = import_zod8.z.discriminatedUnion("type", [
    * destructive — requires explicit confirm to replay on prod. The
    * `description` is what the agent/user sees at confirm time.
    */
-  import_zod8.z.object({
-    type: import_zod8.z.literal("backfill"),
-    description: import_zod8.z.string().min(1),
-    sql: import_zod8.z.string().min(1)
+  import_zod9.z.object({
+    type: import_zod9.z.literal("backfill"),
+    description: import_zod9.z.string().min(1),
+    sql: import_zod9.z.string().min(1)
   }),
   /**
    * Escape hatch for DDL the structured ops can't express. `destructive`
    * forces classification — use false only for genuinely additive-only SQL
    * (e.g. CREATE EXTENSION variants the structured op doesn't cover).
    */
-  import_zod8.z.object({
-    type: import_zod8.z.literal("rawSql"),
-    description: import_zod8.z.string().min(1),
-    sql: import_zod8.z.string().min(1),
-    destructive: import_zod8.z.boolean()
+  import_zod9.z.object({
+    type: import_zod9.z.literal("rawSql"),
+    description: import_zod9.z.string().min(1),
+    sql: import_zod9.z.string().min(1),
+    destructive: import_zod9.z.boolean()
   })
 ]);
 
 // ../../packages/lib/src/server/module-rail/ops.ts
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 
 // ../../packages/lib/src/server/module-rail/reconcile.ts
 var SANDBOX_BATCH_SIZE = 200;
@@ -6233,11 +6495,11 @@ function countedCompositionContext(context) {
           counts.sandboxExecs += 1;
           return context.sandbox.exec(...args);
         },
-        readFile: (path5) => {
+        readFile: (path6) => {
           counts.sandboxReads += 1;
-          return context.sandbox.readFile(path5);
+          return context.sandbox.readFile(path6);
         },
-        fileExists: (path5) => context.sandbox.fileExists(path5),
+        fileExists: (path6) => context.sandbox.fileExists(path6),
         fetchRemoteRef: (...args) => context.sandbox.fetchRemoteRef(...args),
         addDependencies: (specs) => context.sandbox.addDependencies(specs)
       }
@@ -6316,39 +6578,24 @@ async function assertNoRootRoutesWhenMountsEmpty(context, moduleName) {
     );
   }
 }
-async function assertNoEnhancementRoutes(context, moduleName) {
-  const enhancementsDir = `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements`;
-  const enhancementEntries = await listImmediateEntries(context.sandbox, enhancementsDir, {
-    optional: true,
-    label: `enhancements for ${moduleName}`
-  });
-  for (const entry of enhancementEntries) {
-    if (entry.kind !== "dir") continue;
-    const sliceRoutes = `${enhancementsDir}/${entry.name}/routes`;
-    const sliceProbe = await context.sandbox.exec(
-      [
-        `p=${shellQuote(sliceRoutes)}`,
-        `if test -L "$p" || test -e "$p"; then exit 2; else exit 0; fi`
-      ].join("\n"),
-      { raiseOnError: false }
-    );
-    if (sliceProbe.exitCode === 2) {
+async function assertNoEnhancementRoutePaths(context, paths) {
+  const kinds = await classifySandboxPathPresenceKindMany(context, paths, "enhancement-route-kind");
+  for (const sliceRoutes of paths) {
+    const kind = kinds.get(sliceRoutes);
+    if (kind === "absent") continue;
+    if (kind !== "unreadable" && kind !== void 0) {
       throw new Error(
         `[ModuleRail] composition artifacts: enhancement slice routes/ are forbidden at ${sliceRoutes}`
       );
     }
-    if (sliceProbe.exitCode !== 0) {
-      const detail = typeof sliceProbe.error === "string" && sliceProbe.error.trim() || sliceProbe.output.trim() || `exit ${sliceProbe.exitCode}`;
-      throw new Error(
-        `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: ${redactSecrets(detail)}`
-      );
-    }
+    throw new Error(
+      `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: entry-kind:${kind ?? "missing"}`
+    );
   }
 }
-async function discoverModuleRouteEntries(context, moduleName) {
+async function discoverRootRouteEntries(context, moduleName) {
   const modulePath = `${MODULES_SANDBOX_DIR}/${moduleName}`;
   const routesDir = `${modulePath}/routes`;
-  await assertNoEnhancementRoutes(context, moduleName);
   const quotedRoutes = shellQuote(routesDir);
   const listResult = await context.sandbox.exec(
     [
@@ -6449,14 +6696,14 @@ async function discoverModuleRouteEntries(context, moduleName) {
   }
   return pages.sort((a, b) => a.nextRelativePath.localeCompare(b.nextRelativePath));
 }
-async function writeSandboxFileAtomic(target, path5, content) {
-  const dir = dirnamePosix(path5);
-  const tmp = `${path5}.tmp.${target.runId}`;
+async function writeSandboxFileAtomic(target, path6, content) {
+  const dir = dirnamePosix(path6);
+  const tmp = `${path6}.tmp.${target.runId}`;
   const b64 = Buffer.from(content, "utf8").toString("base64");
   const cmd = [
     `mkdir -p ${shellQuote(dir)}`,
     `printf '%s' ${shellQuote(b64)} | base64 -d > ${shellQuote(tmp)}`,
-    `mv -f ${shellQuote(tmp)} ${shellQuote(path5)}`
+    `mv -f ${shellQuote(tmp)} ${shellQuote(path6)}`
   ].join(" && ");
   const result = await target.sandbox.exec(cmd, { raiseOnError: false });
   if (result.exitCode !== 0) {
@@ -6471,14 +6718,14 @@ async function writeSandboxFileAtomic(target, path5, content) {
     }
     const detail = typeof result.error === "string" && result.error.trim() || result.output.trim() || `exit ${result.exitCode}`;
     throw new Error(
-      `[ModuleRail] composition artifacts: failed to write ${redactSecrets(path5)}: ${redactSecrets(detail)}`
+      `[ModuleRail] composition artifacts: failed to write ${redactSecrets(path6)}: ${redactSecrets(detail)}`
     );
   }
 }
 async function collectAbsentWriteParentDirs(context, writePaths) {
   const absent = /* @__PURE__ */ new Set();
-  for (const path5 of writePaths) {
-    let dir = dirnamePosix(path5);
+  for (const path6 of writePaths) {
+    let dir = dirnamePosix(path6);
     while (dir !== "." && dir !== "") {
       if (absent.has(dir)) {
         dir = dirnamePosix(dir);
@@ -6515,12 +6762,12 @@ async function removeAbsentWriteParentDirsOnRollback(context, dirsDeepestFirst)
     );
   }
 }
-async function deleteSandboxFile(context, path5) {
-  const result = await context.sandbox.exec(`rm -f ${shellQuote(path5)}`, { raiseOnError: false });
+async function deleteSandboxFile(context, path6) {
+  const result = await context.sandbox.exec(`rm -f ${shellQuote(path6)}`, { raiseOnError: false });
   if (result.exitCode !== 0) {
     const detail = typeof result.error === "string" && result.error.trim() || result.output.trim() || `exit ${result.exitCode}`;
     throw new Error(
-      `[ModuleRail] composition artifacts: failed to delete ${redactSecrets(path5)}: ${redactSecrets(detail)}`
+      `[ModuleRail] composition artifacts: failed to delete ${redactSecrets(path6)}: ${redactSecrets(detail)}`
     );
   }
 }
@@ -6587,37 +6834,37 @@ async function applyCompositionArtifactMutations(context, plan, existingFiles) {
       await writeSandboxFileAtomic(context, write.path, write.content);
       appliedWrites.push({ path: write.path, previous });
     }
-    for (const path5 of plan.deletes) {
-      const previous = existingFiles[path5];
+    for (const path6 of plan.deletes) {
+      const previous = existingFiles[path6];
       if (previous == null) continue;
-      await deleteSandboxFile(context, path5);
-      appliedDeletes.push({ path: path5, previous });
+      await deleteSandboxFile(context, path6);
+      appliedDeletes.push({ path: path6, previous });
     }
   } catch (error) {
     console.log(
       `[ModuleRail] runId=${context.runId} composition artifacts mid-apply failure; rolling back writes=${appliedWrites.length} deletes=${appliedDeletes.length} newDirs=${newlyCreatedParentDirs.length}`
     );
-    for (const { path: path5, previous } of [...appliedDeletes].reverse()) {
+    for (const { path: path6, previous } of [...appliedDeletes].reverse()) {
       try {
-        await writeSandboxFileAtomic(context, path5, previous);
+        await writeSandboxFileAtomic(context, path6, previous);
       } catch (rollbackError) {
         console.log(
-          `[ModuleRail] runId=${context.runId} composition artifacts rollback restore failed for ${redactSecrets(path5)}: ${redactSecrets(
+          `[ModuleRail] runId=${context.runId} composition artifacts rollback restore failed for ${redactSecrets(path6)}: ${redactSecrets(
             rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
           )}`
         );
       }
     }
-    for (const { path: path5, previous } of [...appliedWrites].reverse()) {
+    for (const { path: path6, previous } of [...appliedWrites].reverse()) {
       try {
         if (previous == null) {
-          await deleteSandboxFile(context, path5);
+          await deleteSandboxFile(context, path6);
         } else {
-          await writeSandboxFileAtomic(context, path5, previous);
+          await writeSandboxFileAtomic(context, path6, previous);
         }
       } catch (rollbackError) {
         console.log(
-          `[ModuleRail] runId=${context.runId} composition artifacts rollback write failed for ${redactSecrets(path5)}: ${redactSecrets(
+          `[ModuleRail] runId=${context.runId} composition artifacts rollback write failed for ${redactSecrets(path6)}: ${redactSecrets(
             rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
           )}`
         );
@@ -6651,39 +6898,39 @@ async function listExistingGeneratedStubPaths(context) {
     COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN
   );
   const presentPaths = [];
-  for (const path5 of candidates) {
+  for (const path6 of candidates) {
     const presence = assertRealCompositionArtifactFilePresence(
-      path5,
-      kinds.get(path5) ?? "unreadable"
+      path6,
+      kinds.get(path6) ?? "unreadable"
     );
-    if (presence === "file") presentPaths.push(path5);
+    if (presence === "file") presentPaths.push(path6);
   }
   let contents;
   try {
     contents = await readFilesMany(context, presentPaths);
   } catch (error) {
-    const path5 = readFailurePath(error);
+    const path6 = readFailurePath(error);
     throw new Error(
-      `[ModuleRail] composition artifacts: cannot read candidate stub ${redactSecrets(path5)}: ${redactSecrets(
+      `[ModuleRail] composition artifacts: cannot read candidate stub ${redactSecrets(path6)}: ${redactSecrets(
         error instanceof Error ? error.message : String(error)
       )}`
     );
   }
   const owned = [];
-  for (const path5 of presentPaths) {
-    const content = contents.get(path5);
+  for (const path6 of presentPaths) {
+    const content = contents.get(path6);
     const marker = parseCompositionArtifactMarker(content);
-    if (parseLegacyApiAdapter(path5, content) || parseLegacyRouteAdapter(path5, content)) {
-      owned.push(path5);
+    if (parseLegacyApiAdapter(path6, content) || parseLegacyRouteAdapter(path6, content)) {
+      owned.push(path6);
       continue;
     }
     if (marker == null) continue;
-    if (!markerCongruentWithPath(path5, marker)) {
+    if (!markerCongruentWithPath(path6, marker)) {
       throw new Error(
-        `[ModuleRail] composition artifacts: incongruent marker at ${redactSecrets(path5)} (found ${marker.kind} marker on a path shaped for ${expectedMarkerKindForPath(path5) ?? "no"} artifacts; refusing to reconcile a swapped marker)`
+        `[ModuleRail] composition artifacts: incongruent marker at ${redactSecrets(path6)} (found ${marker.kind} marker on a path shaped for ${expectedMarkerKindForPath(path6) ?? "no"} artifacts; refusing to reconcile a swapped marker)`
       );
     }
-    owned.push(path5);
+    owned.push(path6);
   }
   return owned;
 }
@@ -6802,7 +7049,8 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
         `# Leaf is missing. A missing intermediate parent means the path is simply`,
         `# absent (new nested writes). Only an existing-but-inaccessible parent`,
         `# is unreadable \u2014 never conflate ENOENT parents with EACCES.`,
-        `parent=$(dirname -- "$p")`,
+        // Probe paths are nested repo-relative paths; do not spawn dirname per missing file.
+        `parent=\${p%/*}`,
         `if test ! -e "$parent" && test ! -L "$parent"; then`,
         `  printf 'entry-kind:absent\\t%s\\n' "$p"`,
         `elif ls -ld -- "$parent" >/dev/null 2>&1; then`,
@@ -6816,7 +7064,7 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
       { raiseOnError: false }
     );
     if (result.exitCode !== 0) {
-      for (const path5 of chunk) kinds.set(path5, "unreadable");
+      for (const path6 of chunk) kinds.set(path6, "unreadable");
       continue;
     }
     const lines = result.output.split("\n").filter(Boolean);
@@ -6827,31 +7075,31 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
       }
     } else {
       for (const line of lines) {
-        const [rawKind, path5] = line.split("	", 2);
+        const [rawKind, path6] = line.split("	", 2);
         const kind = rawKind?.replace(/^entry-kind:/, "");
-        if (path5 && chunk.includes(path5) && CONVENTIONAL_ENTRY_PRESENCE_KINDS.includes(kind ?? "")) {
-          kinds.set(path5, kind);
+        if (path6 && chunk.includes(path6) && CONVENTIONAL_ENTRY_PRESENCE_KINDS.includes(kind ?? "")) {
+          kinds.set(path6, kind);
         }
       }
     }
-    for (const path5 of chunk) {
-      if (!kinds.has(path5)) kinds.set(path5, "unreadable");
+    for (const path6 of chunk) {
+      if (!kinds.has(path6)) kinds.set(path6, "unreadable");
     }
   }
   return kinds;
 }
-async function classifySandboxPathPresenceKind(context, path5, probeToken) {
-  return (await classifySandboxPathPresenceKindMany(context, [path5], probeToken)).get(path5);
+async function classifySandboxPathPresenceKind(context, path6, probeToken) {
+  return (await classifySandboxPathPresenceKindMany(context, [path6], probeToken)).get(path6);
 }
 var LOCALE_JSON_KIND_PROBE_TOKEN = "locale-json-kind";
-function assertRealLocaleJsonFilePresence(path5, presence) {
+function assertRealLocaleJsonFilePresence(path6, presence) {
   if (presence === "file") return;
   if (presence === "absent") {
-    throw new Error(`[ModuleRail] composition artifacts: locale file missing at ${path5}`);
+    throw new Error(`[ModuleRail] composition artifacts: locale file missing at ${path6}`);
   }
-  const presenceError = formatConventionalEntryPresenceError(path5, presence);
+  const presenceError = formatConventionalEntryPresenceError(path6, presence);
   throw new Error(
-    `[ModuleRail] composition artifacts: ${presenceError ?? `${path5} is not a real locale JSON file`}`
+    `[ModuleRail] composition artifacts: ${presenceError ?? `${path6} is not a real locale JSON file`}`
   );
 }
 function splitTaggedLine(line) {
@@ -6926,11 +7174,11 @@ async function listLocaleBasenamesIfDirMany(context, dirs) {
 }
 async function readFilesMany(context, paths) {
   const sortedPaths = [...paths].sort((a, b) => a.localeCompare(b));
-  const settled = await mapConcurrent(sortedPaths, SANDBOX_READ_CONCURRENCY, async (path5) => {
+  const settled = await mapConcurrent(sortedPaths, SANDBOX_READ_CONCURRENCY, async (path6) => {
     try {
-      return { path: path5, value: await context.sandbox.readFile(path5) };
+      return { path: path6, value: await context.sandbox.readFile(path6) };
     } catch (error) {
-      return { path: path5, error };
+      return { path: path6, error };
     }
   });
   const files = /* @__PURE__ */ new Map();
@@ -6953,61 +7201,61 @@ function readFailurePath(error) {
 var CONVENTIONAL_ENTRY_KIND_PROBE_TOKEN = "conventional-entry-kind";
 var SERVER_REGISTRATIONS_FILE = "server/registrations.ts";
 var COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN = "composition-artifact-kind";
-async function classifyCompositionArtifactPathKind(context, path5) {
-  return classifySandboxPathPresenceKind(context, path5, COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN);
+async function classifyCompositionArtifactPathKind(context, path6) {
+  return classifySandboxPathPresenceKind(context, path6, COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN);
 }
-function assertRealCompositionArtifactFilePresence(path5, presence) {
+function assertRealCompositionArtifactFilePresence(path6, presence) {
   if (presence === "file") return "file";
   if (presence === "absent") return "absent";
-  const presenceError = formatConventionalEntryPresenceError(path5, presence);
+  const presenceError = formatConventionalEntryPresenceError(path6, presence);
   throw new Error(
-    `[ModuleRail] composition artifacts: ${presenceError ?? `${path5} is not a real composition artifact file`}`
+    `[ModuleRail] composition artifacts: ${presenceError ?? `${path6} is not a real composition artifact file`}`
   );
 }
-async function readConventionalEntryIfRealFile(path5, kind, presences, files) {
-  const presence = presences.get(path5) ?? "unreadable";
-  const presenceError = formatConventionalEntryPresenceError(path5, presence);
+async function readConventionalEntryIfRealFile(path6, kind, presences, files) {
+  const presence = presences.get(path6) ?? "unreadable";
+  const presenceError = formatConventionalEntryPresenceError(path6, presence);
   if (presenceError) {
     throw new Error(`[ModuleRail] composition artifacts: ${presenceError}`);
   }
   if (presence === "absent") {
     return null;
   }
-  const source = files.get(path5);
+  const source = files.get(path6);
   switch (kind) {
     case "contributions":
-      assertContributionsExport(source, path5);
-      assertClientSafeConventionalEntryImports(source, path5, "contributions");
+      assertContributionsExport(source, path6);
+      assertClientSafeConventionalEntryImports(source, path6, "contributions");
       break;
     case "slotCatalogs":
-      assertSlotCatalogsExport(source, path5);
-      assertClientSafeConventionalEntryImports(source, path5, "slotCatalogs");
+      assertSlotCatalogsExport(source, path6);
+      assertClientSafeConventionalEntryImports(source, path6, "slotCatalogs");
       break;
     case "initializeEnhancement":
-      assertInitializeEnhancementExport(source, path5);
+      assertInitializeEnhancementExport(source, path6);
       break;
     case "initializeModule":
-      assertInitializeModuleExport(source, path5);
+      assertInitializeModuleExport(source, path6);
       break;
   }
   return source;
 }
 function hasRealServerRegistrations(modulePath, presences) {
-  const path5 = `${modulePath}/${SERVER_REGISTRATIONS_FILE}`;
-  return assertRealCompositionArtifactFilePresence(path5, presences.get(path5) ?? "unreadable") === "file";
+  const path6 = `${modulePath}/${SERVER_REGISTRATIONS_FILE}`;
+  return assertRealCompositionArtifactFilePresence(path6, presences.get(path6) ?? "unreadable") === "file";
 }
-async function readJsonObjectFile(path5, files) {
-  const raw = files.get(path5);
+async function readJsonObjectFile(path6, files) {
+  const raw = files.get(path6);
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (error) {
     throw new Error(
-      `[ModuleRail] composition artifacts: invalid JSON at ${path5}: ${error instanceof Error ? error.message : String(error)}`
+      `[ModuleRail] composition artifacts: invalid JSON at ${path6}: ${error instanceof Error ? error.message : String(error)}`
     );
   }
   if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
-    throw new Error(`[ModuleRail] composition artifacts: ${path5} root must be an object`);
+    throw new Error(`[ModuleRail] composition artifacts: ${path6} root must be an object`);
   }
   return parsed;
 }
@@ -7060,11 +7308,11 @@ async function collectCompositionEntryFacts(context, registry) {
     classifySandboxPathPresenceKindMany(context, localePaths, LOCALE_JSON_KIND_PROBE_TOKEN)
   ]);
   const presentConventionalPaths = [];
-  for (const path5 of conventionalPaths) {
-    const presence = conventionalPresences.get(path5) ?? "unreadable";
-    if (presence === "file") presentConventionalPaths.push(path5);
+  for (const path6 of conventionalPaths) {
+    const presence = conventionalPresences.get(path6) ?? "unreadable";
+    if (presence === "file") presentConventionalPaths.push(path6);
   }
-  const presentLocalePaths = localePaths.filter((path5) => localePresences.get(path5) === "file");
+  const presentLocalePaths = localePaths.filter((path6) => localePresences.get(path6) === "file");
   const files = await readFilesMany(context, [...presentConventionalPaths, ...presentLocalePaths]);
   const substrateLocales = [];
   for (const locale of substrateNames) {
@@ -7174,8 +7422,8 @@ async function collectCompositionEntryFacts(context, registry) {
     });
     if (rootLocales.length > 0) {
       for (const locale of rootLocales) {
-        const path5 = `${modulePath}/i18n/${locale}.json`;
-        assertRealLocaleJsonFilePresence(path5, localePresences.get(path5) ?? "unreadable");
+        const path6 = `${modulePath}/i18n/${locale}.json`;
+        assertRealLocaleJsonFilePresence(path6, localePresences.get(path6) ?? "unreadable");
       }
       const enMessages = await readJsonObjectFile(`${modulePath}/i18n/en.json`, files);
       const localeMessages = { en: enMessages };
@@ -7199,8 +7447,8 @@ async function collectCompositionEntryFacts(context, registry) {
       if (!enh.active || enh.locales.length === 0) continue;
       const peerDir = `${modulePath}/enhancements/${enh.peer}`;
       for (const locale of enh.locales) {
-        const path5 = `${peerDir}/i18n/${locale}.json`;
-        assertRealLocaleJsonFilePresence(path5, localePresences.get(path5) ?? "unreadable");
+        const path6 = `${peerDir}/i18n/${locale}.json`;
+        assertRealLocaleJsonFilePresence(path6, localePresences.get(path6) ?? "unreadable");
       }
       const enMessages = await readJsonObjectFile(`${peerDir}/i18n/en.json`, files);
       const localeMessages = { en: enMessages };
@@ -7347,14 +7595,21 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     manifestsByName
   );
   const routeEntriesByOwner = {};
+  await assertNoEnhancementRoutePaths(
+    context,
+    moduleRuntimeFacts.flatMap(
+      ({ moduleName, onDiskEnhancementDirs }) => onDiskEnhancementDirs.map(
+        (peer) => `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements/${peer}/routes`
+      )
+    )
+  );
   for (const moduleName of composedNames) {
     const manifest = manifestsByName[moduleName];
-    await assertNoEnhancementRoutes(context, moduleName);
     if (manifest.mounts.length === 0) {
       await assertNoRootRoutesWhenMountsEmpty(context, moduleName);
       routeEntriesByOwner[moduleName] = [];
     } else {
-      routeEntriesByOwner[moduleName] = await discoverModuleRouteEntries(context, moduleName);
+      routeEntriesByOwner[moduleName] = await discoverRootRouteEntries(context, moduleName);
     }
   }
   const existingGeneratedPaths = await listExistingGeneratedStubPaths(context);
@@ -7401,16 +7656,16 @@ async function reconcileCompositionArtifacts(context, options = {}) {
   for (const stub of probePlan.plan.routeStubs) candidatePaths.add(stub.path);
   const existingFiles = {};
   const remainingCandidatePaths = [];
-  for (const path5 of [...candidatePaths].sort((a, b) => a.localeCompare(b))) {
-    if (Object.prototype.hasOwnProperty.call(existingAppPages, path5)) {
-      existingFiles[path5] = existingAppPages[path5];
+  for (const path6 of [...candidatePaths].sort((a, b) => a.localeCompare(b))) {
+    if (Object.prototype.hasOwnProperty.call(existingAppPages, path6)) {
+      existingFiles[path6] = existingAppPages[path6];
       continue;
     }
-    if (Object.prototype.hasOwnProperty.call(existingAppRoutes, path5)) {
-      existingFiles[path5] = existingAppRoutes[path5];
+    if (Object.prototype.hasOwnProperty.call(existingAppRoutes, path6)) {
+      existingFiles[path6] = existingAppRoutes[path6];
       continue;
     }
-    remainingCandidatePaths.push(path5);
+    remainingCandidatePaths.push(path6);
   }
   const candidateKinds = await classifySandboxPathPresenceKindMany(
     context,
@@ -7418,12 +7673,12 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN
   );
   const presentCandidatePaths = [];
-  for (const path5 of remainingCandidatePaths) {
+  for (const path6 of remainingCandidatePaths) {
     const presence = assertRealCompositionArtifactFilePresence(
-      path5,
-      candidateKinds.get(path5) ?? "unreadable"
+      path6,
+      candidateKinds.get(path6) ?? "unreadable"
     );
-    if (presence === "file") presentCandidatePaths.push(path5);
+    if (presence === "file") presentCandidatePaths.push(path6);
   }
   try {
     Object.assign(
@@ -7431,9 +7686,9 @@ async function reconcileCompositionArtifacts(context, options = {}) {
       Object.fromEntries(await readFilesMany(context, presentCandidatePaths))
     );
   } catch (error) {
-    const path5 = readFailurePath(error);
+    const path6 = readFailurePath(error);
     throw new Error(
-      `[ModuleRail] composition artifacts: cannot read ${redactSecrets(path5)} during preflight: ${redactSecrets(
+      `[ModuleRail] composition artifacts: cannot read ${redactSecrets(path6)} during preflight: ${redactSecrets(
         error instanceof Error ? error.message : String(error)
       )}`
     );
@@ -7506,8 +7761,8 @@ var HOME_I18N_MESSAGES_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/messages`;
 var import_typescript6 = __toESM(require("typescript"));
 
 // src/module-boundaries.ts
-var import_node_fs2 = __toESM(require("fs"));
-var import_node_path2 = __toESM(require("path"));
+var import_node_fs3 = __toESM(require("fs"));
+var import_node_path3 = __toESM(require("path"));
 var import_typescript5 = __toESM(require("typescript"));
 var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
 var RESOLVE_SUFFIXES = ["", ".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.tsx", "/index.js"];
@@ -7526,26 +7781,26 @@ function dataPathsIn(fileName, source) {
 }
 function scanModule(modulesDir, module2) {
   const scanned = /* @__PURE__ */ new Map();
-  const moduleDir = import_node_path2.default.join(modulesDir, module2);
-  if (!import_node_fs2.default.existsSync(moduleDir)) return scanned;
-  const files = import_node_fs2.default.readdirSync(moduleDir, { recursive: true, encoding: "utf8" }).filter((relative) => SOURCE_FILE.test(relative) && !relative.includes("node_modules"));
+  const moduleDir = import_node_path3.default.join(modulesDir, module2);
+  if (!import_node_fs3.default.existsSync(moduleDir)) return scanned;
+  const files = import_node_fs3.default.readdirSync(moduleDir, { recursive: true, encoding: "utf8" }).filter((relative) => SOURCE_FILE.test(relative) && !relative.includes("node_modules"));
   for (const relative of files) {
-    const absolute = import_node_path2.default.join(moduleDir, relative);
-    if (!import_node_fs2.default.statSync(absolute).isFile()) continue;
-    const source = import_node_fs2.default.readFileSync(absolute, "utf8");
+    const absolute = import_node_path3.default.join(moduleDir, relative);
+    if (!import_node_fs3.default.statSync(absolute).isFile()) continue;
+    const source = import_node_fs3.default.readFileSync(absolute, "utf8");
     const specifiers = import_typescript5.default.preProcessFile(source, true, true).importedFiles.map((f) => f.fileName);
     const dataPaths = dataPathsIn(absolute, source);
     const targets = [...specifiers, ...dataPaths].flatMap((spec) => {
       if (spec.startsWith("@/modules/"))
-        return [import_node_path2.default.join(modulesDir, spec.slice("@/modules/".length))];
+        return [import_node_path3.default.join(modulesDir, spec.slice("@/modules/".length))];
       if (spec.startsWith("./") || spec.startsWith("../")) {
-        return [import_node_path2.default.resolve(import_node_path2.default.dirname(absolute), spec)];
+        return [import_node_path3.default.resolve(import_node_path3.default.dirname(absolute), spec)];
       }
       return [];
     });
     scanned.set(absolute, {
       module: module2,
-      relative: relative.split(import_node_path2.default.sep).join("/"),
+      relative: relative.split(import_node_path3.default.sep).join("/"),
       targets,
       dataPaths
     });
@@ -7562,7 +7817,7 @@ function findModuleBoundaryViolations(modulesDir, peersByModule, { pruning = fal
     (q) => file.relative.startsWith(`enhancements/${q}/`)
   );
   const goneWith = (target, peer) => {
-    const relative = import_node_path2.default.relative(modulesDir, target).split(import_node_path2.default.sep).join("/");
+    const relative = import_node_path3.default.relative(modulesDir, target).split(import_node_path3.default.sep).join("/");
     return relative === peer || relative.startsWith(`${peer}/`) || new RegExp(`^[^/]+/enhancements/${peer}(/|$)`).test(relative);
   };
   const tainted = /* @__PURE__ */ new Map();
@@ -7608,12 +7863,12 @@ function findModuleBoundaryViolations(modulesDir, peersByModule, { pruning = fal
   return violations.sort((a, b) => a.file.localeCompare(b.file) || a.peer.localeCompare(b.peer));
 }
 function findOptionalPeerViolations(modulesDir) {
-  if (!import_node_fs2.default.existsSync(modulesDir)) return [];
+  if (!import_node_fs3.default.existsSync(modulesDir)) return [];
   const manifests = {};
-  for (const name of import_node_fs2.default.readdirSync(modulesDir)) {
-    const manifestPath = import_node_path2.default.join(modulesDir, name, "module.json");
-    if (!import_node_fs2.default.existsSync(manifestPath)) continue;
-    manifests[name] = JSON.parse(import_node_fs2.default.readFileSync(manifestPath, "utf8"));
+  for (const name of import_node_fs3.default.readdirSync(modulesDir)) {
+    const manifestPath = import_node_path3.default.join(modulesDir, name, "module.json");
+    if (!import_node_fs3.default.existsSync(manifestPath)) continue;
+    manifests[name] = JSON.parse(import_node_fs3.default.readFileSync(manifestPath, "utf8"));
   }
   const features = Object.keys(manifests).filter((name) => manifests[name].kind === "feature");
   const peersByModule = {};
@@ -7633,11 +7888,11 @@ function formatBoundaryViolations(modulesDirLabel, violations) {
 // src/index.ts
 var MODULES_DIR2 = MODULES_SANDBOX_DIR;
 function readComposeInputs(cwd) {
-  const file = import_node_path3.default.join(cwd, COMPOSE_INPUTS_PATH);
-  if (!import_node_fs3.default.existsSync(file)) return { connectedStores: [], installs: {} };
+  const file = import_node_path4.default.join(cwd, COMPOSE_INPUTS_PATH);
+  if (!import_node_fs4.default.existsSync(file)) return { connectedStores: [], installs: {} };
   let raw;
   try {
-    raw = JSON.parse(import_node_fs3.default.readFileSync(file, "utf8"));
+    raw = JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
   } catch (error) {
     throw new Error(
       `[compose] ${file} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -7679,18 +7934,18 @@ function stubGitignoreEntries(artifactPaths) {
 function writeStubGitignore(cwd, artifactPaths) {
   const entries = stubGitignoreEntries(artifactPaths);
   const content = [STUB_GITIGNORE_HEADER, ...entries].join("\n") + "\n";
-  const file = import_node_path3.default.join(cwd, STUB_GITIGNORE_PATH);
-  const existing = import_node_fs3.default.existsSync(file) ? import_node_fs3.default.readFileSync(file, "utf8") : null;
+  const file = import_node_path4.default.join(cwd, STUB_GITIGNORE_PATH);
+  const existing = import_node_fs4.default.existsSync(file) ? import_node_fs4.default.readFileSync(file, "utf8") : null;
   if (existing !== content) {
-    import_node_fs3.default.mkdirSync(import_node_path3.default.dirname(file), { recursive: true });
-    import_node_fs3.default.writeFileSync(file, content);
+    import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(file), { recursive: true });
+    import_node_fs4.default.writeFileSync(file, content);
   }
   return entries.length;
 }
 function assertStubGitignoreOwned(cwd) {
-  const file = import_node_path3.default.join(cwd, STUB_GITIGNORE_PATH);
-  if (!import_node_fs3.default.existsSync(file)) return;
-  const firstLine = import_node_fs3.default.readFileSync(file, "utf8").split("\n", 1)[0] ?? "";
+  const file = import_node_path4.default.join(cwd, STUB_GITIGNORE_PATH);
+  if (!import_node_fs4.default.existsSync(file)) return;
+  const firstLine = import_node_fs4.default.readFileSync(file, "utf8").split("\n", 1)[0] ?? "";
   if (firstLine !== STUB_GITIGNORE_HEADER) {
     throw new Error(
       `[compose] refusing to overwrite ${STUB_GITIGNORE_PATH}: it is not compose-generated (line 1 is not the generated header)`
@@ -7698,8 +7953,8 @@ function assertStubGitignoreOwned(cwd) {
   }
 }
 function assertAppRoot(cwd) {
-  const appPath = import_node_path3.default.join(cwd, APP_PACKAGE_JSON);
-  if (!import_node_fs3.default.existsSync(appPath)) {
+  const appPath = import_node_path4.default.join(cwd, APP_PACKAGE_JSON);
+  if (!import_node_fs4.default.existsSync(appPath)) {
     throw new Error(
       `[compose] ${appPath} not found \u2014 run this from the repo root of a Stardeck app`
     );
@@ -7745,9 +8000,9 @@ ${porcelain.trim()}`
 }
 var APP_SRC_DIR = "apps/web/src";
 function walkSources(dir, skip, out) {
-  if (!import_node_fs3.default.existsSync(dir)) return;
-  for (const entry of import_node_fs3.default.readdirSync(dir, { withFileTypes: true })) {
-    const full = import_node_path3.default.join(dir, entry.name);
+  if (!import_node_fs4.default.existsSync(dir)) return;
+  for (const entry of import_node_fs4.default.readdirSync(dir, { withFileTypes: true })) {
+    const full = import_node_path4.default.join(dir, entry.name);
     if (full === skip) continue;
     if (entry.isDirectory()) walkSources(full, skip, out);
     else if (/\.[cm]?[jt]sx?$/.test(entry.name)) out.push(full);
@@ -7756,13 +8011,13 @@ function walkSources(dir, skip, out) {
 function assertNoAppLayerImporters(cwd, excluded) {
   if (excluded.length === 0) return;
   const files = [];
-  walkSources(import_node_path3.default.join(cwd, APP_SRC_DIR), import_node_path3.default.join(cwd, MODULES_DIR2), files);
+  walkSources(import_node_path4.default.join(cwd, APP_SRC_DIR), import_node_path4.default.join(cwd, MODULES_DIR2), files);
   const offenders = [];
   for (const file of files) {
-    const source = import_node_fs3.default.readFileSync(file, "utf8");
+    const source = import_node_fs4.default.readFileSync(file, "utf8");
     for (const name of excluded) {
       if (new RegExp(`@/modules/${name}(?=["'\`/])`).test(source)) {
-        offenders.push(`${import_node_path3.default.relative(cwd, file)}: ${name}`);
+        offenders.push(`${import_node_path4.default.relative(cwd, file)}: ${name}`);
       }
     }
   }
@@ -7796,8 +8051,8 @@ var BUILD_TYPECHECK_SKIP = [
   "playwright.config.ts"
 ];
 function writeBuildTsconfig(cwd, excluded) {
-  const baseFile = import_node_path3.default.join(cwd, TSCONFIG_PATH);
-  if (!import_node_fs3.default.existsSync(import_node_path3.default.join(cwd, MODULES_DIR2)) || !import_node_fs3.default.existsSync(baseFile)) return;
+  const baseFile = import_node_path4.default.join(cwd, TSCONFIG_PATH);
+  if (!import_node_fs4.default.existsSync(import_node_path4.default.join(cwd, MODULES_DIR2)) || !import_node_fs4.default.existsSync(baseFile)) return;
   const base = import_typescript6.default.readConfigFile(baseFile, import_typescript6.default.sys.readFile);
   if (base.error) {
     throw new Error(
@@ -7805,7 +8060,7 @@ function writeBuildTsconfig(cwd, excluded) {
     );
   }
   const baseExclude = base.config?.exclude ?? ["node_modules"];
-  const modulesDir = import_node_path3.default.posix.relative("apps/web", MODULES_DIR2);
+  const modulesDir = import_node_path4.default.posix.relative("apps/web", MODULES_DIR2);
   const config = {
     extends: "./tsconfig.json",
     exclude: [
@@ -7820,17 +8075,17 @@ function writeBuildTsconfig(cwd, excluded) {
   const content = `${BUILD_TSCONFIG_HEADER}
 ${JSON.stringify(config, null, 2)}
 `;
-  const file = import_node_path3.default.join(cwd, BUILD_TSCONFIG_PATH);
-  if (!import_node_fs3.default.existsSync(file) || import_node_fs3.default.readFileSync(file, "utf8") !== content) {
-    import_node_fs3.default.writeFileSync(file, content);
+  const file = import_node_path4.default.join(cwd, BUILD_TSCONFIG_PATH);
+  if (!import_node_fs4.default.existsSync(file) || import_node_fs4.default.readFileSync(file, "utf8") !== content) {
+    import_node_fs4.default.writeFileSync(file, content);
   }
   console.log(
     `[compose] ${BUILD_TSCONFIG_PATH} excludes ${excluded.length} Module(s): ${excluded.join(",") || "none"}`
   );
 }
 function removeDir(absolute) {
-  if (!import_node_fs3.default.existsSync(absolute)) return false;
-  import_node_fs3.default.rmSync(absolute, { recursive: true, force: true });
+  if (!import_node_fs4.default.existsSync(absolute)) return false;
+  import_node_fs4.default.rmSync(absolute, { recursive: true, force: true });
   return true;
 }
 async function compose(options) {
@@ -7858,7 +8113,7 @@ async function compose(options) {
     });
     assertNoAppLayerImporters(options.cwd, preview.excludedModules);
     const violations = findModuleBoundaryViolations(
-      import_node_path3.default.join(options.cwd, MODULES_DIR2),
+      import_node_path4.default.join(options.cwd, MODULES_DIR2),
       Object.fromEntries(preview.composedModules.map((name) => [name, preview.excludedModules])),
       { pruning: true }
     );
@@ -7879,11 +8134,11 @@ async function compose(options) {
   let pruned = 0;
   if (options.prune) {
     for (const name of result.excludedModules) {
-      if (removeDir(import_node_path3.default.join(options.cwd, MODULES_DIR2, name))) pruned++;
+      if (removeDir(import_node_path4.default.join(options.cwd, MODULES_DIR2, name))) pruned++;
     }
     for (const owner of result.composedModules) {
       for (const peer of result.excludedModules) {
-        if (removeDir(import_node_path3.default.join(options.cwd, MODULES_DIR2, owner, "enhancements", peer))) pruned++;
+        if (removeDir(import_node_path4.default.join(options.cwd, MODULES_DIR2, owner, "enhancements", peer))) pruned++;
       }
     }
   }
@@ -7905,13 +8160,18 @@ async function main() {
       enabled: { type: "string" },
       prune: { type: "boolean", default: false },
       cwd: { type: "string" },
-      "check-boundaries": { type: "boolean", default: false }
+      "check-boundaries": { type: "boolean", default: false },
+      "check-ownership": { type: "boolean", default: false }
     },
     strict: true
   });
+  if (values["check-ownership"]) {
+    await checkOwnership(values.cwd ?? process.cwd());
+    return;
+  }
   if (values["check-boundaries"]) {
     const violations = findOptionalPeerViolations(
-      import_node_path4.default.join(values.cwd ?? process.cwd(), MODULES_SANDBOX_DIR)
+      import_node_path5.default.join(values.cwd ?? process.cwd(), MODULES_SANDBOX_DIR)
     );
     if (violations.length > 0) {
       throw new Error(
@@ -7936,6 +8196,36 @@ async function main() {
     `[compose] modules=${result.composedModules.join(",") || "none"} excluded=${result.excludedModules.join(",") || "none"} writes=${result.writes} deletes=${result.deletes} pruned=${result.pruned} gitignore=${result.gitignoreEntries ?? "kept"} stub paths`
   );
 }
+function gitAt(cwd) {
+  return (args) => new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process3.spawn)("git", ["-c", "core.quotePath=false", ...args], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    child.stdout.setEncoding("utf8").on("data", (chunk) => stdout += chunk);
+    child.on("error", reject);
+    child.on("close", (status) => resolve({ status: status ?? 1, stdout }));
+  });
+}
+async function checkOwnership(cwd) {
+  const repoRoot = import_node_path5.default.resolve(cwd);
+  const result = await checkStardeckOwnedFiles({ repoRoot, git: gitAt(repoRoot) });
+  switch (result.status) {
+    case "skipped":
+      if (result.warning)
+        console.warn(`[compose] --check-ownership: not checked: ${result.reason}`);
+      else console.log(`[compose] --check-ownership: skipped: ${result.reason}`);
+      return;
+    case "clean":
+      console.log(
+        `[compose] --check-ownership: no Stardeck-owned file changed from Stardeck's version (${result.release.slice(0, 12)})`
+      );
+      return;
+    default:
+      throw new Error(`[compose] --check-ownership: ${formatOwnershipGuardFailure(result)}`);
+  }
+}
 main().catch((error) => {
   console.error(error instanceof Error ? error.message : String(error));
   process.exit(1);