@stardeck-customer-apps/compose 0.14.0 → 0.15.0

package/dist/index.mjs

@@ -1143,16 +1143,16 @@ var require_range = __commonJS({
     };
     var replaceTilde = (comp, options) => {
       const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
-      const z10 = options.includePrerelease ? "-0" : "";
+      const z11 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("tilde", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z10} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z11} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
-          ret = `>=${M}.${m}.0${z10} <${M}.${+m + 1}.0-0`;
+          ret = `>=${M}.${m}.0${z11} <${M}.${+m + 1}.0-0`;
         } else if (pr) {
           debug("replaceTilde pr", pr);
           ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
@@ -1169,19 +1169,19 @@ var require_range = __commonJS({
     var replaceCaret = (comp, options) => {
       debug("caret", comp, options);
       const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
-      const z10 = options.includePrerelease ? "-0" : "";
+      const z11 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("caret", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z10} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z11} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m}.0${z10} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.0${z11} <${M}.${+m + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m}.0${z10} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.0${z11} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug("replaceCaret pr", pr);
@@ -2078,6 +2078,7 @@ var JSON_SECRET_PAIR = new RegExp(
   "g"
 );
 var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
+var SHELL_QUOTE_CONTINUATION = String.raw`\''`;
 function redactSecrets(text) {
   return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
@@ -2369,10 +2370,12 @@ var modulePermissionClaimSchema = z2.object({
   /** Human label for the deployment auth config row. */
   description: descriptionSchema,
   /**
-   * The default organization roles that hold this key when the platform
-   * first registers it on an app (a Blueprint fork, a Module install). Admin
-   * holds every key without being listed; External Viewer never holds one.
-   * Changing a role's grants afterwards is the organization's business.
+   * The standard organization roles that hold this key. The platform sets them on every app
+   * (a Blueprint fork, a Module install or uninstall, every Blueprint update), so this list is
+   * the truth: a role added here gains the key, a role removed loses it, and nobody can edit a
+   * standard role's grants on a Module key. Admin holds every key without being listed;
+   * External Viewer never holds one. An organization that wants different access duplicates the
+   * standard role and edits the copy.
    */
   roles: z2.array(z2.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
@@ -4014,6 +4017,24 @@ function analyzeClientSafeEntryImports(sourceText, fileName) {
   return analyzeClientSafeEntryImportsWithTs(ts3, sourceText, fileName);
 }
 
+// ../../packages/lib/src/shared/ownership-record.ts
+import { z as z7 } from "zod";
+var OWNERSHIP_RECORD_VERSION = 1;
+var moduleList = z7.array(z7.string().refine(isValidModuleName, "not a Module name"));
+var ownershipRecordSchema = z7.object({
+  version: z7.literal(OWNERSHIP_RECORD_VERSION),
+  /** False once the app stopped all Stardeck updates: then every file is the app's. */
+  stardeckUpdates: z7.boolean(),
+  /** projects.ejected_modules: updates stopped for these Modules, so their folders are the app's. */
+  updatesStoppedModules: moduleList,
+  /** projects.ui_ejected_modules: Customize UI, so their screens are the app's. */
+  customizedUiModules: moduleList,
+  /** projects.external_modules: installed from another app, so the app owns the copy. */
+  externalModules: moduleList,
+  /** projects.removed_modules names: uninstalled on purpose. */
+  uninstalledModules: moduleList
+});
+
 // ../../packages/lib/src/shared/platform-owned-paths.ts
 var APP_WEB_PREFIX = "apps/web/";
 var BLUEPRINT_LINT_MARKER = `${APP_WEB_PREFIX}eslint-rules/module-boundaries.mjs`;
@@ -4818,6 +4839,9 @@ function enhancementImport(owner, peer) {
 function scopeLabel(scope) {
   return scope.kind === "root" ? "root" : `enhancement:${scope.peer}`;
 }
+function endpointMarkerOwnsStub(marker, stub) {
+  return stub != null && marker?.kind === "endpoint" && marker.owner === stub.owner;
+}
 function formatEndpointMarker(owner, scope) {
   return `// ${MODULE_STUB_MARKER} owner=${owner} scope=${scopeLabel(scope)}`;
 }
@@ -5519,7 +5543,7 @@ function planCompositionArtifacts(input) {
     const legacy = parseLegacyApiAdapter(pagePath, content);
     const plannedRoute = plannedRouteByPath.get(pagePath);
     const plannedEndpoint = plannedEndpointByPath.get(pagePath);
-    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (marker != null && marker.kind === "endpoint" && marker.owner === plannedEndpoint.owner && scopeLabel(marker.scope) === scopeLabel(plannedEndpoint.scope) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
+    const isExactPlannedMatch = plannedRoute != null && marker != null && marker.kind === "route" && marker.owner === plannedRoute.owner && marker.nextRelativePath === plannedRoute.nextRelativePath || plannedEndpoint != null && (endpointMarkerOwnsStub(marker, plannedEndpoint) || legacy != null) || plannedRoute != null && legacyRouteAdapterMatchesStub(pagePath, content, plannedRoute);
     if (isExactPlannedMatch) {
       continue;
     }
@@ -5662,9 +5686,7 @@ function planCompositionArtifacts(input) {
     }
     if (marker.kind === "endpoint") {
       const stub = endpointStubByPath.get(path4);
-      const ownerMatches = stub != null && marker.owner === stub.owner;
-      const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
-      if (!ownerMatches || !scopeMatches) {
+      if (!endpointMarkerOwnsStub(marker, stub)) {
         return {
           ok: false,
           error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path4} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
@@ -5967,14 +5989,14 @@ function rejectPseudoModuleEntries(entries, parentDir, label) {
 }
 
 // ../../packages/lib/src/shared/module-composition.ts
-import { z as z7 } from "zod";
-var creationSourceBlankSchema = z7.object({
-  type: z7.literal("blank")
+import { z as z8 } from "zod";
+var creationSourceBlankSchema = z8.object({
+  type: z8.literal("blank")
 });
-var creationSourceBlueprintSchema = z7.object({
-  type: z7.literal("blueprint"),
+var creationSourceBlueprintSchema = z8.object({
+  type: z8.literal("blueprint"),
   /** Internal template/fork project id — keep template naming in identifiers. */
-  blueprintProjectId: z7.string().uuid(),
+  blueprintProjectId: z8.string().uuid(),
   /**
    * `null`/absent means every feature Module: the platform stores that as the
    * explicit list of feature Modules in the published Blueprint version the fork
@@ -5982,192 +6004,197 @@ var creationSourceBlueprintSchema = z7.object({
    * a custom app: no feature Module, Library Modules only (`resolvePlatformEnv`
    * emits it as a set value naming no Module).
    */
-  enabledModules: z7.array(moduleNameSchema).max(100).nullable().optional()
+  enabledModules: z8.array(moduleNameSchema).max(100).nullable().optional(),
+  /**
+   * The kind of business (a preset id the published version defines). Its Modules are built
+   * and `enabledModules` adds extras on top; for the general kind `enabledModules` is the pick.
+   */
+  businessKind: z8.string().regex(/^[a-z][a-z0-9-]{0,39}$/).optional()
 });
-var creationSourceSchema = z7.discriminatedUnion("type", [
+var creationSourceSchema = z8.discriminatedUnion("type", [
   creationSourceBlankSchema,
   creationSourceBlueprintSchema
 ]);
-var moduleInstallHandoffSchema = z7.object({
-  moduleName: z7.string().min(1),
-  homeProjectId: z7.string().uuid(),
-  installedVersion: z7.string().min(1),
-  baselineSha: z7.string().min(1),
-  mounts: z7.array(
-    z7.object({
-      group: z7.string(),
-      segment: z7.string()
+var moduleInstallHandoffSchema = z8.object({
+  moduleName: z8.string().min(1),
+  homeProjectId: z8.string().uuid(),
+  installedVersion: z8.string().min(1),
+  baselineSha: z8.string().min(1),
+  mounts: z8.array(
+    z8.object({
+      group: z8.string(),
+      segment: z8.string()
     })
   ),
-  integration: z7.array(z7.string()),
-  workflows: z7.array(z7.string()),
-  prunedEnhancements: z7.array(z7.string()),
-  restoredEnhancements: z7.array(z7.string()).optional(),
-  permissions: z7.array(
-    z7.object({
-      key: z7.string().min(1),
-      description: z7.string().min(1)
+  integration: z8.array(z8.string()),
+  workflows: z8.array(z8.string()),
+  prunedEnhancements: z8.array(z8.string()),
+  restoredEnhancements: z8.array(z8.string()).optional(),
+  permissions: z8.array(
+    z8.object({
+      key: z8.string().min(1),
+      description: z8.string().min(1)
     })
   ).optional()
 });
 
 // ../../packages/lib/src/shared/schema-ops.ts
-import { z as z8 } from "zod";
-var columnSpecSchema = z8.object({
-  name: z8.string().min(1).max(63),
-  pgType: z8.string().min(1),
-  nullable: z8.boolean(),
+import { z as z9 } from "zod";
+var columnSpecSchema = z9.object({
+  name: z9.string().min(1).max(63),
+  pgType: z9.string().min(1),
+  nullable: z9.boolean(),
   /**
    * A SQL expression used as the column default, as a raw string (e.g. `'t'`,
    * `0`, `now()`, `gen_random_uuid()`). `null` or omitted means no default.
    * NOT a JS literal — must already be a valid SQL expression.
    */
-  default: z8.string().nullable().optional(),
-  fieldType: z8.string().optional(),
-  fieldConfig: z8.record(z8.string(), z8.unknown()).optional()
+  default: z9.string().nullable().optional(),
+  fieldType: z9.string().optional(),
+  fieldConfig: z9.record(z9.string(), z9.unknown()).optional()
 });
-var referentialActionSchema = z8.enum([
+var referentialActionSchema = z9.enum([
   "cascade",
   "set null",
   "set default",
   "restrict",
   "no action"
 ]);
-var schemaOpSchema = z8.discriminatedUnion("type", [
+var schemaOpSchema = z9.discriminatedUnion("type", [
   // Tables
-  z8.object({
-    type: z8.literal("createTable"),
-    table: z8.string().min(1).max(63),
-    columns: z8.array(columnSpecSchema).min(1),
-    primaryKey: z8.array(z8.string()).optional(),
-    ifNotExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("createTable"),
+    table: z9.string().min(1).max(63),
+    columns: z9.array(columnSpecSchema).min(1),
+    primaryKey: z9.array(z9.string()).optional(),
+    ifNotExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("dropTable"),
-    table: z8.string().min(1).max(63),
-    cascade: z8.boolean().optional(),
-    ifExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("dropTable"),
+    table: z9.string().min(1).max(63),
+    cascade: z9.boolean().optional(),
+    ifExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("renameTable"),
-    from: z8.string().min(1).max(63),
-    to: z8.string().min(1).max(63)
+  z9.object({
+    type: z9.literal("renameTable"),
+    from: z9.string().min(1).max(63),
+    to: z9.string().min(1).max(63)
   }),
   // Columns
-  z8.object({
-    type: z8.literal("addColumn"),
-    table: z8.string().min(1).max(63),
+  z9.object({
+    type: z9.literal("addColumn"),
+    table: z9.string().min(1).max(63),
     column: columnSpecSchema,
-    ifNotExists: z8.boolean().optional()
+    ifNotExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("dropColumn"),
-    table: z8.string().min(1).max(63),
-    column: z8.string().min(1).max(63),
-    cascade: z8.boolean().optional(),
-    ifExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("dropColumn"),
+    table: z9.string().min(1).max(63),
+    column: z9.string().min(1).max(63),
+    cascade: z9.boolean().optional(),
+    ifExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("renameColumn"),
-    table: z8.string().min(1).max(63),
-    from: z8.string().min(1).max(63),
-    to: z8.string().min(1).max(63)
+  z9.object({
+    type: z9.literal("renameColumn"),
+    table: z9.string().min(1).max(63),
+    from: z9.string().min(1).max(63),
+    to: z9.string().min(1).max(63)
   }),
-  z8.object({
-    type: z8.literal("alterColumnType"),
-    table: z8.string().min(1).max(63),
-    column: z8.string().min(1).max(63),
-    newType: z8.string().min(1),
+  z9.object({
+    type: z9.literal("alterColumnType"),
+    table: z9.string().min(1).max(63),
+    column: z9.string().min(1).max(63),
+    newType: z9.string().min(1),
     /** Optional USING expression for potentially-lossy casts */
-    using: z8.string().optional()
+    using: z9.string().optional()
   }),
-  z8.object({
-    type: z8.literal("alterColumnNullable"),
-    table: z8.string().min(1).max(63),
-    column: z8.string().min(1).max(63),
-    nullable: z8.boolean()
+  z9.object({
+    type: z9.literal("alterColumnNullable"),
+    table: z9.string().min(1).max(63),
+    column: z9.string().min(1).max(63),
+    nullable: z9.boolean()
   }),
-  z8.object({
-    type: z8.literal("alterColumnDefault"),
-    table: z8.string().min(1).max(63),
-    column: z8.string().min(1).max(63),
+  z9.object({
+    type: z9.literal("alterColumnDefault"),
+    table: z9.string().min(1).max(63),
+    column: z9.string().min(1).max(63),
     /** null means drop the default; otherwise a SQL expression string. */
-    default: z8.string().nullable()
+    default: z9.string().nullable()
   }),
   // Indexes
-  z8.object({
-    type: z8.literal("addIndex"),
-    table: z8.string().min(1).max(63),
-    name: z8.string().min(1).max(63),
-    columns: z8.array(z8.string().min(1)).min(1),
-    unique: z8.boolean().optional(),
+  z9.object({
+    type: z9.literal("addIndex"),
+    table: z9.string().min(1).max(63),
+    name: z9.string().min(1).max(63),
+    columns: z9.array(z9.string().min(1)).min(1),
+    unique: z9.boolean().optional(),
     /** Partial-index WHERE clause, as a raw SQL expression */
-    where: z8.string().optional(),
-    ifNotExists: z8.boolean().optional()
+    where: z9.string().optional(),
+    ifNotExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("dropIndex"),
-    name: z8.string().min(1).max(63),
-    cascade: z8.boolean().optional(),
-    ifExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("dropIndex"),
+    name: z9.string().min(1).max(63),
+    cascade: z9.boolean().optional(),
+    ifExists: z9.boolean().optional()
   }),
   // Constraints
-  z8.object({
-    type: z8.literal("addForeignKey"),
-    table: z8.string().min(1).max(63),
-    name: z8.string().min(1).max(63),
-    columns: z8.array(z8.string().min(1)).min(1),
-    refTable: z8.string().min(1).max(63),
-    refColumns: z8.array(z8.string().min(1)).min(1),
+  z9.object({
+    type: z9.literal("addForeignKey"),
+    table: z9.string().min(1).max(63),
+    name: z9.string().min(1).max(63),
+    columns: z9.array(z9.string().min(1)).min(1),
+    refTable: z9.string().min(1).max(63),
+    refColumns: z9.array(z9.string().min(1)).min(1),
     onDelete: referentialActionSchema.optional(),
     onUpdate: referentialActionSchema.optional()
   }),
-  z8.object({
-    type: z8.literal("addUniqueConstraint"),
-    table: z8.string().min(1).max(63),
-    name: z8.string().min(1).max(63),
-    columns: z8.array(z8.string().min(1)).min(1)
+  z9.object({
+    type: z9.literal("addUniqueConstraint"),
+    table: z9.string().min(1).max(63),
+    name: z9.string().min(1).max(63),
+    columns: z9.array(z9.string().min(1)).min(1)
   }),
-  z8.object({
-    type: z8.literal("addCheckConstraint"),
-    table: z8.string().min(1).max(63),
-    name: z8.string().min(1).max(63),
-    expression: z8.string().min(1)
+  z9.object({
+    type: z9.literal("addCheckConstraint"),
+    table: z9.string().min(1).max(63),
+    name: z9.string().min(1).max(63),
+    expression: z9.string().min(1)
   }),
-  z8.object({
-    type: z8.literal("dropConstraint"),
-    table: z8.string().min(1).max(63),
-    name: z8.string().min(1).max(63),
-    cascade: z8.boolean().optional(),
-    ifExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("dropConstraint"),
+    table: z9.string().min(1).max(63),
+    name: z9.string().min(1).max(63),
+    cascade: z9.boolean().optional(),
+    ifExists: z9.boolean().optional()
   }),
   // Enum types
-  z8.object({
-    type: z8.literal("createEnum"),
-    name: z8.string().min(1).max(63),
-    values: z8.array(z8.string().min(1)).min(1)
+  z9.object({
+    type: z9.literal("createEnum"),
+    name: z9.string().min(1).max(63),
+    values: z9.array(z9.string().min(1)).min(1)
   }),
-  z8.object({
-    type: z8.literal("alterEnumAddValue"),
-    name: z8.string().min(1).max(63),
-    value: z8.string().min(1),
+  z9.object({
+    type: z9.literal("alterEnumAddValue"),
+    name: z9.string().min(1).max(63),
+    value: z9.string().min(1),
     /** Position the new value before an existing one (mutually exclusive with `after`) */
-    before: z8.string().optional(),
+    before: z9.string().optional(),
     /** Position the new value after an existing one (mutually exclusive with `before`) */
-    after: z8.string().optional(),
-    ifNotExists: z8.boolean().optional()
+    after: z9.string().optional(),
+    ifNotExists: z9.boolean().optional()
   }),
-  z8.object({
-    type: z8.literal("dropEnum"),
-    name: z8.string().min(1).max(63),
-    cascade: z8.boolean().optional(),
-    ifExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("dropEnum"),
+    name: z9.string().min(1).max(63),
+    cascade: z9.boolean().optional(),
+    ifExists: z9.boolean().optional()
   }),
   // Extensions
-  z8.object({
-    type: z8.literal("createExtension"),
-    name: z8.string().min(1),
-    ifNotExists: z8.boolean().optional()
+  z9.object({
+    type: z9.literal("createExtension"),
+    name: z9.string().min(1),
+    ifNotExists: z9.boolean().optional()
   }),
   // Data operations
   /**
@@ -6175,26 +6202,26 @@ var schemaOpSchema = z8.discriminatedUnion("type", [
    * destructive — requires explicit confirm to replay on prod. The
    * `description` is what the agent/user sees at confirm time.
    */
-  z8.object({
-    type: z8.literal("backfill"),
-    description: z8.string().min(1),
-    sql: z8.string().min(1)
+  z9.object({
+    type: z9.literal("backfill"),
+    description: z9.string().min(1),
+    sql: z9.string().min(1)
   }),
   /**
    * Escape hatch for DDL the structured ops can't express. `destructive`
    * forces classification — use false only for genuinely additive-only SQL
    * (e.g. CREATE EXTENSION variants the structured op doesn't cover).
    */
-  z8.object({
-    type: z8.literal("rawSql"),
-    description: z8.string().min(1),
-    sql: z8.string().min(1),
-    destructive: z8.boolean()
+  z9.object({
+    type: z9.literal("rawSql"),
+    description: z9.string().min(1),
+    sql: z9.string().min(1),
+    destructive: z9.boolean()
   })
 ]);
 
 // ../../packages/lib/src/server/module-rail/ops.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // ../../packages/lib/src/server/module-rail/reconcile.ts
 var SANDBOX_BATCH_SIZE = 200;
@@ -6307,39 +6334,24 @@ async function assertNoRootRoutesWhenMountsEmpty(context, moduleName) {
     );
   }
 }
-async function assertNoEnhancementRoutes(context, moduleName) {
-  const enhancementsDir = `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements`;
-  const enhancementEntries = await listImmediateEntries(context.sandbox, enhancementsDir, {
-    optional: true,
-    label: `enhancements for ${moduleName}`
-  });
-  for (const entry of enhancementEntries) {
-    if (entry.kind !== "dir") continue;
-    const sliceRoutes = `${enhancementsDir}/${entry.name}/routes`;
-    const sliceProbe = await context.sandbox.exec(
-      [
-        `p=${shellQuote(sliceRoutes)}`,
-        `if test -L "$p" || test -e "$p"; then exit 2; else exit 0; fi`
-      ].join("\n"),
-      { raiseOnError: false }
-    );
-    if (sliceProbe.exitCode === 2) {
+async function assertNoEnhancementRoutePaths(context, paths) {
+  const kinds = await classifySandboxPathPresenceKindMany(context, paths, "enhancement-route-kind");
+  for (const sliceRoutes of paths) {
+    const kind = kinds.get(sliceRoutes);
+    if (kind === "absent") continue;
+    if (kind !== "unreadable" && kind !== void 0) {
       throw new Error(
         `[ModuleRail] composition artifacts: enhancement slice routes/ are forbidden at ${sliceRoutes}`
       );
     }
-    if (sliceProbe.exitCode !== 0) {
-      const detail = typeof sliceProbe.error === "string" && sliceProbe.error.trim() || sliceProbe.output.trim() || `exit ${sliceProbe.exitCode}`;
-      throw new Error(
-        `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: ${redactSecrets(detail)}`
-      );
-    }
+    throw new Error(
+      `[ModuleRail] composition artifacts: cannot probe ${sliceRoutes}: entry-kind:${kind ?? "missing"}`
+    );
   }
 }
-async function discoverModuleRouteEntries(context, moduleName) {
+async function discoverRootRouteEntries(context, moduleName) {
   const modulePath = `${MODULES_SANDBOX_DIR}/${moduleName}`;
   const routesDir = `${modulePath}/routes`;
-  await assertNoEnhancementRoutes(context, moduleName);
   const quotedRoutes = shellQuote(routesDir);
   const listResult = await context.sandbox.exec(
     [
@@ -6793,7 +6805,8 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
         `# Leaf is missing. A missing intermediate parent means the path is simply`,
         `# absent (new nested writes). Only an existing-but-inaccessible parent`,
         `# is unreadable \u2014 never conflate ENOENT parents with EACCES.`,
-        `parent=$(dirname -- "$p")`,
+        // Probe paths are nested repo-relative paths; do not spawn dirname per missing file.
+        `parent=\${p%/*}`,
         `if test ! -e "$parent" && test ! -L "$parent"; then`,
         `  printf 'entry-kind:absent\\t%s\\n' "$p"`,
         `elif ls -ld -- "$parent" >/dev/null 2>&1; then`,
@@ -7338,14 +7351,21 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     manifestsByName
   );
   const routeEntriesByOwner = {};
+  await assertNoEnhancementRoutePaths(
+    context,
+    moduleRuntimeFacts.flatMap(
+      ({ moduleName, onDiskEnhancementDirs }) => onDiskEnhancementDirs.map(
+        (peer) => `${MODULES_SANDBOX_DIR}/${moduleName}/enhancements/${peer}/routes`
+      )
+    )
+  );
   for (const moduleName of composedNames) {
     const manifest = manifestsByName[moduleName];
-    await assertNoEnhancementRoutes(context, moduleName);
     if (manifest.mounts.length === 0) {
       await assertNoRootRoutesWhenMountsEmpty(context, moduleName);
       routeEntriesByOwner[moduleName] = [];
     } else {
-      routeEntriesByOwner[moduleName] = await discoverModuleRouteEntries(context, moduleName);
+      routeEntriesByOwner[moduleName] = await discoverRootRouteEntries(context, moduleName);
     }
   }
   const existingGeneratedPaths = await listExistingGeneratedStubPaths(context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/compose",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Regenerates a Stardeck app's Module-rail artifacts — the six src/*.gen.ts registries and every route/endpoint stub — from src/modules/*/module.json",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -34,7 +34,7 @@
     "build": "rm -rf dist && tsup",
     "dev": "tsup --watch",
     "format": "prettier --write . && oxlint . --fix",
-    "typecheck": "tsgo -p tsconfig.test.json",
+    "typecheck": "node ../../scripts/typecheck.mjs -p tsconfig.test.json",
     "lint": "oxlint src/",
     "test": "vitest run",
     "test:watch": "vitest"