@stardeck-customer-apps/compose 0.8.0 → 0.10.0

package/dist/cli.js

@@ -2066,23 +2066,23 @@ function isValidModuleName(value) {
 var projectSlugSchema = import_zod.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
 var moduleKindSchema = import_zod.z.enum(["feature", "library", "contract"]);
 var endpointMethodSchema = import_zod.z.enum(ENDPOINT_METHODS);
-function endpointPathValidationError(path3) {
-  if (!path3.startsWith("/api/")) {
+function endpointPathValidationError(path5) {
+  if (!path5.startsWith("/api/")) {
     return 'must begin with "/api/"';
   }
-  if (path3.endsWith("/")) {
+  if (path5.endsWith("/")) {
     return "must not end with a trailing slash";
   }
-  if (path3.includes("?") || path3.includes("#")) {
+  if (path5.includes("?") || path5.includes("#")) {
     return "must not include query or hash";
   }
-  if (path3.includes("\\")) {
+  if (path5.includes("\\")) {
     return "must not include backslashes";
   }
-  if (path3.includes("%")) {
+  if (path5.includes("%")) {
     return "must not include percent-encoded segments";
   }
-  const parts = path3.split("/");
+  const parts = path5.split("/");
   if (parts.length < 3 || parts[0] !== "" || parts[1] !== "api") {
     return 'must begin with "/api/"';
   }
@@ -2132,12 +2132,12 @@ function endpointPathValidationError(path3) {
   }
   return null;
 }
-function normalizeEndpointPathForCollision(path3) {
-  const error = endpointPathValidationError(path3);
+function normalizeEndpointPathForCollision(path5) {
+  const error = endpointPathValidationError(path5);
   if (error != null) {
     throw new Error(`invalid endpoint path: ${error}`);
   }
-  return path3.split("/").map((segment, index) => {
+  return path5.split("/").map((segment, index) => {
     if (index < 2) {
       return segment;
     }
@@ -2150,8 +2150,8 @@ function normalizeEndpointPathForCollision(path3) {
     return segment;
   }).join("/");
 }
-var endpointPathSchema = import_zod.z.string().superRefine((path3, ctx) => {
-  const error = endpointPathValidationError(path3);
+var endpointPathSchema = import_zod.z.string().superRefine((path5, ctx) => {
+  const error = endpointPathValidationError(path5);
   if (error != null) {
     ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, message: error });
   }
@@ -2398,16 +2398,16 @@ var moduleManifestSchema = import_zod.z.object({
     }
   }
   const seenWorkflows = /* @__PURE__ */ new Map();
-  const noteWorkflow = (name, path3) => {
+  const noteWorkflow = (name, path5) => {
     const existing = seenWorkflows.get(name);
     if (existing != null) {
       ctx.addIssue({
         code: import_zod.z.ZodIssueCode.custom,
         message: `duplicate workflow name "${name}" (also at ${existing})`,
-        path: path3
+        path: path5
       });
     } else {
-      seenWorkflows.set(name, path3.join("."));
+      seenWorkflows.set(name, path5.join("."));
     }
   };
   for (let i = 0; i < manifest.workflows.length; i += 1) {
@@ -2419,7 +2419,7 @@ var moduleManifestSchema = import_zod.z.object({
     }
   }
   const seenEndpointKeys = /* @__PURE__ */ new Map();
-  const noteEndpoint = (claim, path3) => {
+  const noteEndpoint = (claim, path5) => {
     let key;
     try {
       key = normalizeEndpointPathForCollision(claim.path);
@@ -2431,10 +2431,10 @@ var moduleManifestSchema = import_zod.z.object({
       ctx.addIssue({
         code: import_zod.z.ZodIssueCode.custom,
         message: `duplicate normalized endpoint path "${key}" (also at ${existing})`,
-        path: path3
+        path: path5
       });
     } else {
-      seenEndpointKeys.set(key, path3.join("."));
+      seenEndpointKeys.set(key, path5.join("."));
     }
   };
   for (let i = 0; i < manifest.endpoints.length; i += 1) {
@@ -2535,8 +2535,8 @@ var moduleManifestSchema = import_zod.z.object({
 }).transform(({ version: _legacyVersion, ...manifest }) => manifest);
 function formatZodErrors(error) {
   return error.issues.map((issue) => {
-    const path3 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `${path3}: ${issue.message}`;
+    const path5 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `${path5}: ${issue.message}`;
   });
 }
 function parseModuleManifest(raw) {
@@ -2936,16 +2936,16 @@ var collectedE2eFactsSchema = import_zod3.z.object({
 function validateRouteExportEvidenceCongruence(input) {
   const entrySet = new Set(input.routeEntries);
   const exportPaths = input.routePageExports.map((e) => e.nextRelativePath);
-  for (const path3 of exportPaths) {
-    if (!entrySet.has(path3)) {
-      input.onIssue(`routePageExports path "${path3}" is not listed in routeEntries`);
+  for (const path5 of exportPaths) {
+    if (!entrySet.has(path5)) {
+      input.onIssue(`routePageExports path "${path5}" is not listed in routeEntries`);
     }
   }
   if (input.routeCollectionErrors.length === 0) {
     const exportSet = new Set(exportPaths);
-    for (const path3 of input.routeEntries) {
-      if (!exportSet.has(path3)) {
-        input.onIssue(`routeEntries path "${path3}" is missing from routePageExports`);
+    for (const path5 of input.routeEntries) {
+      if (!exportSet.has(path5)) {
+        input.onIssue(`routeEntries path "${path5}" is missing from routePageExports`);
       }
     }
   }
@@ -3901,12 +3901,13 @@ var MODULES_GEN_PATH = `${APP_WEB_PREFIX}src/modules.gen.ts`;
 var APP_EXTENSIONS_PATH = `${APP_WEB_PREFIX}src/lib/modules/app-extensions.ts`;
 
 // src/cli.ts
-var import_typescript5 = __toESM(require("typescript"));
+var import_typescript7 = __toESM(require("typescript"));
+var import_node_path4 = __toESM(require("path"));
 
 // src/index.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs2 = __toESM(require("fs"));
-var import_node_path2 = __toESM(require("path"));
+var import_node_fs3 = __toESM(require("fs"));
+var import_node_path3 = __toESM(require("path"));
 
 // ../../packages/lib/src/server/module-rail/local-fs-sandbox.ts
 var import_node_child_process = require("child_process");
@@ -3965,147 +3966,29 @@ function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
-// ../../packages/lib/src/shared/module-composition.ts
-var import_zod6 = require("zod");
-var moduleRefSchema = import_zod6.z.object({
-  homeProjectId: import_zod6.z.string().uuid(),
-  moduleName: moduleNameSchema
-});
-var creationSourceBlankSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("blank")
-});
-var creationSourceBlueprintSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("blueprint"),
-  /** Internal template/fork project id — keep template naming in identifiers. */
-  blueprintProjectId: import_zod6.z.string().uuid(),
-  /**
-   * `null`/absent means every feature Module. `[]` is refused: the platform
-   * serialises it to an empty `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the
-   * enablement parser reads back as "all" (`module-enablement.ts`) — the
-   * opposite of what an empty selection means.
-   */
-  enabledModules: import_zod6.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
-});
-var creationSourceModulesSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("modules"),
-  requested: import_zod6.z.array(moduleRefSchema).min(1)
-});
-var creationSourceSchema = import_zod6.z.discriminatedUnion("type", [
-  creationSourceBlankSchema,
-  creationSourceBlueprintSchema,
-  creationSourceModulesSchema
-]);
-var moduleCompositionStatusSchema = import_zod6.z.enum([
-  "pending",
-  "installing",
-  "ready",
-  "partial",
-  "failed"
-]);
-var resolvedModuleSnapshotSchema = moduleRefSchema.extend({
-  version: import_zod6.z.string().min(1),
-  homeCommitSha: import_zod6.z.string().min(1)
-});
-var moduleInstallHandoffSchema = import_zod6.z.object({
-  moduleName: import_zod6.z.string().min(1),
-  homeProjectId: import_zod6.z.string().uuid(),
-  installedVersion: import_zod6.z.string().min(1),
-  baselineSha: import_zod6.z.string().min(1),
-  mounts: import_zod6.z.array(
-    import_zod6.z.object({
-      group: import_zod6.z.string(),
-      segment: import_zod6.z.string()
-    })
-  ),
-  integration: import_zod6.z.array(import_zod6.z.string()),
-  workflows: import_zod6.z.array(import_zod6.z.string()),
-  prunedEnhancements: import_zod6.z.array(import_zod6.z.string()),
-  restoredEnhancements: import_zod6.z.array(import_zod6.z.string()).optional(),
-  permissions: import_zod6.z.array(
-    import_zod6.z.object({
-      key: import_zod6.z.string().min(1),
-      description: import_zod6.z.string().min(1)
-    })
-  ).optional()
-});
-var moduleCompositionRunAttemptSchema = import_zod6.z.object({
-  module: moduleRefSchema,
-  runId: import_zod6.z.string().min(1),
-  status: import_zod6.z.string().min(1),
-  schemaApplied: import_zod6.z.boolean(),
-  error: import_zod6.z.string().optional(),
-  /** Prefer full ModuleInstallHandoff; identity fields optional for older rows. */
-  handoff: moduleInstallHandoffSchema.partial({ moduleName: true, homeProjectId: true }).optional()
-});
-var initialModuleCompositionSchema = import_zod6.z.object({
-  version: import_zod6.z.literal(1),
-  status: moduleCompositionStatusSchema,
-  requested: import_zod6.z.array(moduleRefSchema).min(1),
-  resolved: import_zod6.z.array(resolvedModuleSnapshotSchema),
-  installOrder: import_zod6.z.array(moduleRefSchema),
-  runs: import_zod6.z.array(moduleCompositionRunAttemptSchema).default([]),
-  /**
-   * True when any failed/partial attempt applied schema before failing.
-   * Never claim transactional rollback across git/schema.
-   */
-  schemaApplied: import_zod6.z.boolean().default(false),
-  /**
-   * Present when retry would silently change pinned home SHAs — caller must
-   * reconfirm the new plan rather than continue.
-   */
-  reconfirmationRequired: import_zod6.z.object({
-    reason: import_zod6.z.string(),
-    previous: import_zod6.z.array(resolvedModuleSnapshotSchema),
-    next: import_zod6.z.array(resolvedModuleSnapshotSchema)
-  }).optional(),
-  error: import_zod6.z.string().optional(),
-  /**
-   * First-turn system handoff lifecycle. Absent/`pending` means inject when
-   * status is ready; `consumed` means a successful agent turn already used it.
-   */
-  systemHandoffStatus: import_zod6.z.enum(["pending", "consumed"]).optional(),
-  /**
-   * CAS ownership token for concurrent retry attempts. Only the attempt that
-   * currently owns this value may reset or compensate durable composition state.
-   */
-  retryAttemptId: import_zod6.z.string().min(1).optional(),
-  /**
-   * When the current `installing` attempt was claimed. A setup run that dies
-   * with its host (a killed Vercel instance) leaves the composition `installing`
-   * forever, and the creating page's poll only stops on ready/partial/failed —
-   * so staleness, not a queue's stall detector, is what settles it. Absent on
-   * rows claimed before this field existed; treated as stale.
-   */
-  attemptStartedAt: import_zod6.z.string().datetime().optional(),
-  /** Outside-module files the agent changed during connection work. */
-  integrationFiles: import_zod6.z.array(import_zod6.z.string()).optional(),
-  verificationSummary: import_zod6.z.string().optional()
-});
-var MODULE_SETUP_ATTEMPT_STALE_MS = 10 * 60 * 1e3;
-
 // ../../packages/lib/src/shared/compose-inputs.ts
-var import_zod7 = require("zod");
+var import_zod6 = require("zod");
 var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
-var composeInputsSchema = import_zod7.z.strictObject({
-  connectedStores: import_zod7.z.array(
-    import_zod7.z.strictObject({
-      storeId: import_zod7.z.string().min(1),
-      slug: import_zod7.z.string().min(1),
+var composeInputsSchema = import_zod6.z.strictObject({
+  connectedStores: import_zod6.z.array(
+    import_zod6.z.strictObject({
+      storeId: import_zod6.z.string().min(1),
+      slug: import_zod6.z.string().min(1),
       // A row with an empty binding key must not fail a deploy: the rail
       // treats falsy as "no binding key", so normalise rather than reject.
-      bindingKey: import_zod7.z.string().nullish().transform((value) => value || null),
-      accessLevel: import_zod7.z.enum(["read", "write", "admin"]),
+      bindingKey: import_zod6.z.string().nullish().transform((value) => value || null),
+      accessLevel: import_zod6.z.enum(["read", "write", "admin"]),
       // Defaulted so a file written before the platform emitted store types
       // (database rows only) still parses. The platform starts writing
       // storage rows, with `type` set, once forks run a compose that reads it.
-      type: import_zod7.z.enum(["database", "storage"]).default("database")
+      type: import_zod6.z.enum(["database", "storage"]).default("database")
     })
   ).default([]),
-  installs: import_zod7.z.record(
-    import_zod7.z.string(),
-    import_zod7.z.strictObject({
-      installedVersion: import_zod7.z.string().min(1),
-      datastoreBindings: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).nullish()
+  installs: import_zod6.z.record(
+    import_zod6.z.string(),
+    import_zod6.z.strictObject({
+      installedVersion: import_zod6.z.string().min(1),
+      datastoreBindings: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).nullish()
     })
   ).default({})
 });
@@ -4262,13 +4145,13 @@ function assertClientSafeConventionalEntryImports(source, pathLabel, kind) {
 function createMessageTree() {
   return /* @__PURE__ */ Object.create(null);
 }
-function assertMessageTree(value, path3) {
+function assertMessageTree(value, path5) {
   if (typeof value === "string") return;
   if (value === null || Array.isArray(value) || typeof value !== "object") {
-    throw new Error(`Invalid message at ${path3}: expected string or nested object`);
+    throw new Error(`Invalid message at ${path5}: expected string or nested object`);
   }
   for (const [key, child] of Object.entries(value)) {
-    assertMessageTree(child, `${path3}.${key}`);
+    assertMessageTree(child, `${path5}.${key}`);
   }
 }
 function cloneTree(value) {
@@ -4278,17 +4161,17 @@ function cloneTree(value) {
   }
   return clone;
 }
-function collectLeafPaths(value, path3, out) {
+function collectLeafPaths(value, path5, out) {
   if (typeof value === "string") {
-    out.push(path3);
+    out.push(path5);
     return;
   }
-  assertMessageTree(value, path3);
-  for (const [key, child] of Object.entries(value)) collectLeafPaths(child, `${path3}.${key}`, out);
+  assertMessageTree(value, path5);
+  for (const [key, child] of Object.entries(value)) collectLeafPaths(child, `${path5}.${key}`, out);
 }
-function overrideInto(target, source, owner, path3, missing) {
+function overrideInto(target, source, owner, path5, missing) {
   for (const [key, value] of Object.entries(source)) {
-    const nextPath = path3 ? `${path3}.${key}` : key;
+    const nextPath = path5 ? `${path5}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(target, key)) {
       collectLeafPaths(value, nextPath, missing);
       continue;
@@ -4315,9 +4198,9 @@ function overrideInto(target, source, owner, path3, missing) {
 function composeLocaleMessagesForPlan(layers) {
   const result = createMessageTree();
   const leafOwners = /* @__PURE__ */ new Map();
-  function mergeInto(target, source, owner, path3) {
+  function mergeInto(target, source, owner, path5) {
     for (const [key, value] of Object.entries(source)) {
-      const nextPath = path3 ? `${path3}.${key}` : key;
+      const nextPath = path5 ? `${path5}.${key}` : key;
       const hasExisting = Object.prototype.hasOwnProperty.call(target, key);
       const existing = hasExisting ? target[key] : void 0;
       if (typeof value === "string") {
@@ -4861,8 +4744,8 @@ var METHOD_ORDER = {
 function compareNames2(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
 }
-function endpointPairKey(method, path3) {
-  return `${method} ${path3}`;
+function endpointPairKey(method, path5) {
+  return `${method} ${path5}`;
 }
 function apiPathToRouteFile(apiPath) {
   if (!apiPath.startsWith("/api/")) {
@@ -4876,11 +4759,11 @@ function routeEntryToAppPageFile(nextRelativePath) {
 }
 var APP_ROUTE_FILE_PREFIX = `${APP_PACKAGE_DIR}/src/app/`;
 var API_ROUTE_FILE_SUFFIXES = ["/route.ts", "/route.tsx", "/route.jsx", "/route.js"];
-function appRouteFileToNextRelativePath(path3) {
-  const pagePath = appPageFileToNextRelativePath(path3, APP_PACKAGE_DIR);
+function appRouteFileToNextRelativePath(path5) {
+  const pagePath = appPageFileToNextRelativePath(path5, APP_PACKAGE_DIR);
   if (pagePath != null) return pagePath;
-  if (!path3.startsWith(APP_ROUTE_FILE_PREFIX)) return null;
-  const relative = path3.slice(APP_ROUTE_FILE_PREFIX.length);
+  if (!path5.startsWith(APP_ROUTE_FILE_PREFIX)) return null;
+  const relative = path5.slice(APP_ROUTE_FILE_PREFIX.length);
   if (!relative.startsWith("api/")) return null;
   const suffix = API_ROUTE_FILE_SUFFIXES.find((candidate) => relative.endsWith(candidate));
   if (!suffix) return null;
@@ -4972,9 +4855,9 @@ function legacyHandlerPropertyMatchesPath(property, method, physicalPath, bindin
   const expectedTokens = knownAliases[`${binding} ${method} ${physicalPath}`] ?? pathTokens;
   return handlerTokens.length === expectedTokens.length && handlerTokens.every((token, index) => token === expectedTokens[index]);
 }
-function parseLegacyApiAdapter(path3, source) {
-  const physicalPath = appRouteFileToNextRelativePath(path3);
-  if (expectedMarkerKindForPath(path3) !== "endpoint" || physicalPath == null) return null;
+function parseLegacyApiAdapter(path5, source) {
+  const physicalPath = appRouteFileToNextRelativePath(path5);
+  if (expectedMarkerKindForPath(path5) !== "endpoint" || physicalPath == null) return null;
   const firstLine = source.split(/\r?\n/, 1)[0]?.trim() ?? "";
   const match = firstLine.match(
     new RegExp(
@@ -4984,7 +4867,7 @@ function parseLegacyApiAdapter(path3, source) {
   if (!match || match[2] !== physicalPath) return null;
   const owner = match[1];
   if (!isValidModuleName(owner)) return null;
-  const file = import_typescript4.default.createSourceFile(path3, source, import_typescript4.default.ScriptTarget.Latest, false, import_typescript4.default.ScriptKind.TS);
+  const file = import_typescript4.default.createSourceFile(path5, source, import_typescript4.default.ScriptTarget.Latest, false, import_typescript4.default.ScriptKind.TS);
   if (file.parseDiagnostics.length > 0) {
     return null;
   }
@@ -5026,9 +4909,9 @@ function parseLegacyApiAdapter(path3, source) {
   }
   return handlerBinding != null && methods.size > 0 ? { owner, methods: [...methods] } : null;
 }
-function parseLegacyRouteAdapter(path3, source) {
-  const physicalPath = appRouteFileToNextRelativePath(path3);
-  if (expectedMarkerKindForPath(path3) !== "route" || physicalPath == null) return null;
+function parseLegacyRouteAdapter(path5, source) {
+  const physicalPath = appRouteFileToNextRelativePath(path5);
+  if (expectedMarkerKindForPath(path5) !== "route" || physicalPath == null) return null;
   const normalized = source.replace(/\r\n/g, "\n");
   const match = normalized.match(
     new RegExp(
@@ -5040,30 +4923,30 @@ function parseLegacyRouteAdapter(path3, source) {
   const nextRelativePath = match[2];
   return isValidModuleName(owner) && nextRelativePath === physicalPath ? { owner, nextRelativePath } : null;
 }
-function legacyRouteAdapterMatchesStub(path3, source, stub) {
-  const legacy = parseLegacyRouteAdapter(path3, source);
+function legacyRouteAdapterMatchesStub(path5, source, stub) {
+  const legacy = parseLegacyRouteAdapter(path5, source);
   return legacy != null && legacy.owner === stub.owner;
 }
 var API_ROUTE_DIR_PREFIX = `${APP_PACKAGE_DIR}/src/app/api/`;
 var APP_DIR_PREFIX = `${APP_PACKAGE_DIR}/src/app/`;
 var PAGE_FILE_SUFFIXES = ["/page.tsx", "/page.ts", "/page.jsx", "/page.js"];
-function expectedMarkerKindForPath(path3) {
-  if (path3 === MODULES_GEN_PATH) return "registry";
-  if (path3 === MODULE_CONTRIBUTIONS_GEN_PATH) return "contributions";
-  if (path3 === MODULE_DATASTORES_GEN_PATH) return "datastores";
-  if (path3 === MODULE_I18N_GEN_PATH) return "i18n";
-  if (path3 === MODULE_INIT_SERVER_GEN_PATH) return "init";
-  if (path3 === MODULE_SERVER_GEN_PATH) return "server";
-  if (path3.startsWith(API_ROUTE_DIR_PREFIX) && path3.endsWith("/route.ts")) return "endpoint";
-  if (path3.startsWith(APP_DIR_PREFIX) && !path3.startsWith(API_ROUTE_DIR_PREFIX) && PAGE_FILE_SUFFIXES.some((suffix) => path3.endsWith(suffix))) {
+function expectedMarkerKindForPath(path5) {
+  if (path5 === MODULES_GEN_PATH) return "registry";
+  if (path5 === MODULE_CONTRIBUTIONS_GEN_PATH) return "contributions";
+  if (path5 === MODULE_DATASTORES_GEN_PATH) return "datastores";
+  if (path5 === MODULE_I18N_GEN_PATH) return "i18n";
+  if (path5 === MODULE_INIT_SERVER_GEN_PATH) return "init";
+  if (path5 === MODULE_SERVER_GEN_PATH) return "server";
+  if (path5.startsWith(API_ROUTE_DIR_PREFIX) && path5.endsWith("/route.ts")) return "endpoint";
+  if (path5.startsWith(APP_DIR_PREFIX) && !path5.startsWith(API_ROUTE_DIR_PREFIX) && PAGE_FILE_SUFFIXES.some((suffix) => path5.endsWith(suffix))) {
     return "route";
   }
   return null;
 }
-function markerCongruentWithPath(path3, marker) {
-  if (expectedMarkerKindForPath(path3) !== marker.kind) return false;
+function markerCongruentWithPath(path5, marker) {
+  if (expectedMarkerKindForPath(path5) !== marker.kind) return false;
   if (marker.kind === "route") {
-    const derived = appPageFileToNextRelativePath(path3, APP_PACKAGE_DIR);
+    const derived = appPageFileToNextRelativePath(path5, APP_PACKAGE_DIR);
     return derived != null && derived === marker.nextRelativePath;
   }
   return true;
@@ -5334,8 +5217,8 @@ function buildGeneratedModuleRegistry(input) {
 function activeEnhancementPeers(registryModule) {
   return new Set(registryModule.enhancements.filter((e) => e.active).map((e) => e.peer));
 }
-function endpointBucketKey(path3, owner, scope) {
-  return `${path3}\0${owner}\0${scopeLabel(scope)}`;
+function endpointBucketKey(path5, owner, scope) {
+  return `${path5}\0${owner}\0${scopeLabel(scope)}`;
 }
 function planRouteStubs(input) {
   const endpointBuckets = /* @__PURE__ */ new Map();
@@ -5459,7 +5342,7 @@ function planRouteStubs(input) {
     for (const entry of entries) {
       const nextRelativePath = entry.nextRelativePath;
       const destination = normalizeAppRouterDestinationPattern(nextRelativePath);
-      const path3 = routeEntryToAppPageFile(nextRelativePath);
+      const path5 = routeEntryToAppPageFile(nextRelativePath);
       const existing = routeDestinationOwners.get(destination);
       if (existing) {
         throw new Error(
@@ -5469,13 +5352,13 @@ function planRouteStubs(input) {
       routeDestinationOwners.set(destination, {
         owner: regMod.name,
         nextRelativePath,
-        path: path3
+        path: path5
       });
       const importModule = routeEntryImport(regMod.name, nextRelativePath);
       const analyzed = analyzeRouteEntryPath(nextRelativePath);
       const mount = mounts.find((claim) => routeEntryCoveredByMountClaim(analyzed, claim));
       routeStubs.push({
-        path: path3,
+        path: path5,
         owner: regMod.name,
         nextRelativePath,
         importModule,
@@ -5536,16 +5419,16 @@ function planCompositionArtifacts(input) {
     ...stubs.routeStubs.map((stub) => stub.path)
   ]);
   const existingGeneratedPathSet = new Set(input.existingGeneratedPaths);
-  const isProvenStaleDeletionCandidate = (path3, content) => {
-    if (path3 === MODULES_GEN_PATH) return false;
-    if (COMPOSITION_RUNTIME_GEN_PATHS.includes(path3)) return false;
-    if (desiredPaths.has(path3)) return false;
-    if (!existingGeneratedPathSet.has(path3)) return false;
-    const legacy = parseLegacyApiAdapter(path3, content);
+  const isProvenStaleDeletionCandidate = (path5, content) => {
+    if (path5 === MODULES_GEN_PATH) return false;
+    if (COMPOSITION_RUNTIME_GEN_PATHS.includes(path5)) return false;
+    if (desiredPaths.has(path5)) return false;
+    if (!existingGeneratedPathSet.has(path5)) return false;
+    const legacy = parseLegacyApiAdapter(path5, content);
     if (legacy) return true;
-    if (parseLegacyRouteAdapter(path3, content)) return true;
+    if (parseLegacyRouteAdapter(path5, content)) return true;
     const marker = parseCompositionArtifactMarker(content);
-    return marker != null && markerCongruentWithPath(path3, marker);
+    return marker != null && markerCongruentWithPath(path5, marker);
   };
   const plannedByDestination = /* @__PURE__ */ new Map();
   for (const stub of stubs.routeStubs) {
@@ -5699,13 +5582,13 @@ function planCompositionArtifacts(input) {
   for (const stub of stubs.routeStubs) desired.set(stub.path, stub.content);
   const endpointStubByPath = new Map(stubs.endpointStubs.map((stub) => [stub.path, stub]));
   const routeStubByPath = new Map(stubs.routeStubs.map((stub) => [stub.path, stub]));
-  for (const [path3] of desired) {
-    const existing = input.existingFiles[path3];
+  for (const [path5] of desired) {
+    const existing = input.existingFiles[path5];
     if (existing == null) continue;
     let marker = parseCompositionArtifactMarker(existing);
-    const plannedEndpoint = endpointStubByPath.get(path3);
-    const plannedRoute = routeStubByPath.get(path3);
-    const legacy = parseLegacyApiAdapter(path3, existing);
+    const plannedEndpoint = endpointStubByPath.get(path5);
+    const plannedRoute = routeStubByPath.get(path5);
+    const legacy = parseLegacyApiAdapter(path5, existing);
     if (legacy && plannedEndpoint) {
       marker = {
         kind: "endpoint",
@@ -5713,66 +5596,66 @@ function planCompositionArtifacts(input) {
         scope: plannedEndpoint.scope
       };
     }
-    if (!marker && plannedRoute && legacyRouteAdapterMatchesStub(path3, existing, plannedRoute)) {
+    if (!marker && plannedRoute && legacyRouteAdapterMatchesStub(path5, existing, plannedRoute)) {
       marker = {
         kind: "route",
         owner: plannedRoute.owner,
         nextRelativePath: plannedRoute.nextRelativePath
       };
     }
-    const isGenRuntimePath = COMPOSITION_RUNTIME_GEN_PATHS.includes(path3);
+    const isGenRuntimePath = COMPOSITION_RUNTIME_GEN_PATHS.includes(path5);
     if (!marker) {
       return {
         ok: false,
-        error: path3 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path3}` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path3}` : `[ModuleRail] composition artifacts: refusing to overwrite unmanaged route at ${path3}`,
-        path: path3
+        error: path5 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path5}` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path5}` : `[ModuleRail] composition artifacts: refusing to overwrite unmanaged route at ${path5}`,
+        path: path5
       };
     }
-    const expectedKind = expectedMarkerKindForPath(path3);
+    const expectedKind = expectedMarkerKindForPath(path5);
     if (marker.kind !== expectedKind) {
       return {
         ok: false,
-        error: path3 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path3} (incongruent marker ownership: found ${marker.kind} marker)` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path3} (incongruent marker ownership: found ${marker.kind} marker)` : `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path3} (expected ${expectedKind ?? "no"} marker, found ${marker.kind} marker)`,
-        path: path3
+        error: path5 === MODULES_GEN_PATH ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged registry at ${path5} (incongruent marker ownership: found ${marker.kind} marker)` : isGenRuntimePath ? `[ModuleRail] composition artifacts: refusing to overwrite unmanaged generated file at ${path5} (incongruent marker ownership: found ${marker.kind} marker)` : `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (expected ${expectedKind ?? "no"} marker, found ${marker.kind} marker)`,
+        path: path5
       };
     }
     if (marker.kind === "endpoint") {
-      const stub = endpointStubByPath.get(path3);
+      const stub = endpointStubByPath.get(path5);
       const ownerMatches = stub != null && marker.owner === stub.owner;
       const scopeMatches = stub != null && scopeLabel(marker.scope) === scopeLabel(stub.scope);
       if (!ownerMatches || !scopeMatches) {
         return {
           ok: false,
-          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path3} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
-          path: path3,
+          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (existing owner=${marker.owner} scope=${scopeLabel(marker.scope)} vs planned owner=${stub?.owner ?? "?"} scope=${stub ? scopeLabel(stub.scope) : "?"})`,
+          path: path5,
           owner: stub?.owner
         };
       }
     } else if (marker.kind === "route") {
-      const stub = routeStubByPath.get(path3);
+      const stub = routeStubByPath.get(path5);
       const ownerMatches = stub != null && marker.owner === stub.owner;
       const pathMatches = stub != null && marker.nextRelativePath === stub.nextRelativePath;
       if (!ownerMatches || !pathMatches) {
         return {
           ok: false,
-          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path3} (existing owner=${marker.owner} path=${marker.nextRelativePath} vs planned owner=${stub?.owner ?? "?"} path=${stub?.nextRelativePath ?? "?"})`,
-          path: path3,
+          error: `[ModuleRail] composition artifacts: refusing to overwrite incongruent marker ownership at ${path5} (existing owner=${marker.owner} path=${marker.nextRelativePath} vs planned owner=${stub?.owner ?? "?"} path=${stub?.nextRelativePath ?? "?"})`,
+          path: path5,
           owner: stub?.owner
         };
       }
     }
   }
   const deletes = [];
-  for (const path3 of input.existingGeneratedPaths) {
-    const existing = input.existingFiles[path3];
+  for (const path5 of input.existingGeneratedPaths) {
+    const existing = input.existingFiles[path5];
     if (existing == null) continue;
-    if (!isProvenStaleDeletionCandidate(path3, existing)) {
+    if (!isProvenStaleDeletionCandidate(path5, existing)) {
       continue;
     }
-    deletes.push(path3);
+    deletes.push(path5);
   }
   deletes.sort(compareNames2);
-  const writes = [...desired.entries()].filter(([path3, content]) => input.existingFiles[path3] !== content).map(([path3, content]) => ({ path: path3, content })).sort((a, b) => compareNames2(a.path, b.path));
+  const writes = [...desired.entries()].filter(([path5, content]) => input.existingFiles[path5] !== content).map(([path5, content]) => ({ path: path5, content })).sort((a, b) => compareNames2(a.path, b.path));
   return {
     ok: true,
     plan: {
@@ -5801,8 +5684,16 @@ async function checkoutParsesTypedStores(sandbox) {
   try {
     if (!await sandbox.fileExists(APP_PACKAGE_JSON_PATH)) return false;
     const pkg = JSON.parse(await sandbox.readFile(APP_PACKAGE_JSON_PATH));
-    const range = pkg.devDependencies?.[COMPOSE_PACKAGE] ?? pkg.dependencies?.[COMPOSE_PACKAGE];
-    if (!range) return false;
+    return composeRangeParsesTypedStores(
+      pkg.devDependencies?.[COMPOSE_PACKAGE] ?? pkg.dependencies?.[COMPOSE_PACKAGE]
+    );
+  } catch {
+    return false;
+  }
+}
+function composeRangeParsesTypedStores(range) {
+  if (!range) return false;
+  try {
     const lowest = import_semver.default.minVersion(range);
     return lowest != null && import_semver.default.gte(lowest, TYPED_STORES_MIN_COMPOSE_VERSION);
   } catch {
@@ -6034,6 +5925,50 @@ function rejectPseudoModuleEntries(entries, parentDir, label) {
   return dirs;
 }
 
+// ../../packages/lib/src/shared/module-composition.ts
+var import_zod7 = require("zod");
+var creationSourceBlankSchema = import_zod7.z.object({
+  type: import_zod7.z.literal("blank")
+});
+var creationSourceBlueprintSchema = import_zod7.z.object({
+  type: import_zod7.z.literal("blueprint"),
+  /** Internal template/fork project id — keep template naming in identifiers. */
+  blueprintProjectId: import_zod7.z.string().uuid(),
+  /**
+   * `null`/absent means every feature Module. `[]` is refused: the platform
+   * serialises it to an empty `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the
+   * enablement parser reads back as "all" (`module-enablement.ts`) — the
+   * opposite of what an empty selection means.
+   */
+  enabledModules: import_zod7.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+});
+var creationSourceSchema = import_zod7.z.discriminatedUnion("type", [
+  creationSourceBlankSchema,
+  creationSourceBlueprintSchema
+]);
+var moduleInstallHandoffSchema = import_zod7.z.object({
+  moduleName: import_zod7.z.string().min(1),
+  homeProjectId: import_zod7.z.string().uuid(),
+  installedVersion: import_zod7.z.string().min(1),
+  baselineSha: import_zod7.z.string().min(1),
+  mounts: import_zod7.z.array(
+    import_zod7.z.object({
+      group: import_zod7.z.string(),
+      segment: import_zod7.z.string()
+    })
+  ),
+  integration: import_zod7.z.array(import_zod7.z.string()),
+  workflows: import_zod7.z.array(import_zod7.z.string()),
+  prunedEnhancements: import_zod7.z.array(import_zod7.z.string()),
+  restoredEnhancements: import_zod7.z.array(import_zod7.z.string()).optional(),
+  permissions: import_zod7.z.array(
+    import_zod7.z.object({
+      key: import_zod7.z.string().min(1),
+      description: import_zod7.z.string().min(1)
+    })
+  ).optional()
+});
+
 // ../../packages/lib/src/shared/schema-ops.ts
 var import_zod8 = require("zod");
 var columnSpecSchema = import_zod8.z.object({
@@ -6247,11 +6182,11 @@ function countedCompositionContext(context) {
           counts.sandboxExecs += 1;
           return context.sandbox.exec(...args);
         },
-        readFile: (path3) => {
+        readFile: (path5) => {
           counts.sandboxReads += 1;
-          return context.sandbox.readFile(path3);
+          return context.sandbox.readFile(path5);
         },
-        fileExists: (path3) => context.sandbox.fileExists(path3),
+        fileExists: (path5) => context.sandbox.fileExists(path5),
         fetchRemoteRef: (...args) => context.sandbox.fetchRemoteRef(...args),
         addDependencies: (specs) => context.sandbox.addDependencies(specs)
       }
@@ -6463,14 +6398,14 @@ async function discoverModuleRouteEntries(context, moduleName) {
   }
   return pages.sort((a, b) => a.nextRelativePath.localeCompare(b.nextRelativePath));
 }
-async function writeSandboxFileAtomic(target, path3, content) {
-  const dir = dirnamePosix(path3);
-  const tmp = `${path3}.tmp.${target.runId}`;
+async function writeSandboxFileAtomic(target, path5, content) {
+  const dir = dirnamePosix(path5);
+  const tmp = `${path5}.tmp.${target.runId}`;
   const b64 = Buffer.from(content, "utf8").toString("base64");
   const cmd = [
     `mkdir -p ${shellQuote(dir)}`,
     `printf '%s' ${shellQuote(b64)} | base64 -d > ${shellQuote(tmp)}`,
-    `mv -f ${shellQuote(tmp)} ${shellQuote(path3)}`
+    `mv -f ${shellQuote(tmp)} ${shellQuote(path5)}`
   ].join(" && ");
   const result = await target.sandbox.exec(cmd, { raiseOnError: false });
   if (result.exitCode !== 0) {
@@ -6485,14 +6420,14 @@ async function writeSandboxFileAtomic(target, path3, content) {
     }
     const detail = typeof result.error === "string" && result.error.trim() || result.output.trim() || `exit ${result.exitCode}`;
     throw new Error(
-      `[ModuleRail] composition artifacts: failed to write ${redactSecrets(path3)}: ${redactSecrets(detail)}`
+      `[ModuleRail] composition artifacts: failed to write ${redactSecrets(path5)}: ${redactSecrets(detail)}`
     );
   }
 }
 async function collectAbsentWriteParentDirs(context, writePaths) {
   const absent = /* @__PURE__ */ new Set();
-  for (const path3 of writePaths) {
-    let dir = dirnamePosix(path3);
+  for (const path5 of writePaths) {
+    let dir = dirnamePosix(path5);
     while (dir !== "." && dir !== "") {
       if (absent.has(dir)) {
         dir = dirnamePosix(dir);
@@ -6529,12 +6464,12 @@ async function removeAbsentWriteParentDirsOnRollback(context, dirsDeepestFirst)
     );
   }
 }
-async function deleteSandboxFile(context, path3) {
-  const result = await context.sandbox.exec(`rm -f ${shellQuote(path3)}`, { raiseOnError: false });
+async function deleteSandboxFile(context, path5) {
+  const result = await context.sandbox.exec(`rm -f ${shellQuote(path5)}`, { raiseOnError: false });
   if (result.exitCode !== 0) {
     const detail = typeof result.error === "string" && result.error.trim() || result.output.trim() || `exit ${result.exitCode}`;
     throw new Error(
-      `[ModuleRail] composition artifacts: failed to delete ${redactSecrets(path3)}: ${redactSecrets(detail)}`
+      `[ModuleRail] composition artifacts: failed to delete ${redactSecrets(path5)}: ${redactSecrets(detail)}`
     );
   }
 }
@@ -6601,37 +6536,37 @@ async function applyCompositionArtifactMutations(context, plan, existingFiles) {
       await writeSandboxFileAtomic(context, write.path, write.content);
       appliedWrites.push({ path: write.path, previous });
     }
-    for (const path3 of plan.deletes) {
-      const previous = existingFiles[path3];
+    for (const path5 of plan.deletes) {
+      const previous = existingFiles[path5];
       if (previous == null) continue;
-      await deleteSandboxFile(context, path3);
-      appliedDeletes.push({ path: path3, previous });
+      await deleteSandboxFile(context, path5);
+      appliedDeletes.push({ path: path5, previous });
     }
   } catch (error) {
     console.log(
       `[ModuleRail] runId=${context.runId} composition artifacts mid-apply failure; rolling back writes=${appliedWrites.length} deletes=${appliedDeletes.length} newDirs=${newlyCreatedParentDirs.length}`
     );
-    for (const { path: path3, previous } of [...appliedDeletes].reverse()) {
+    for (const { path: path5, previous } of [...appliedDeletes].reverse()) {
       try {
-        await writeSandboxFileAtomic(context, path3, previous);
+        await writeSandboxFileAtomic(context, path5, previous);
       } catch (rollbackError) {
         console.log(
-          `[ModuleRail] runId=${context.runId} composition artifacts rollback restore failed for ${redactSecrets(path3)}: ${redactSecrets(
+          `[ModuleRail] runId=${context.runId} composition artifacts rollback restore failed for ${redactSecrets(path5)}: ${redactSecrets(
             rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
           )}`
         );
       }
     }
-    for (const { path: path3, previous } of [...appliedWrites].reverse()) {
+    for (const { path: path5, previous } of [...appliedWrites].reverse()) {
       try {
         if (previous == null) {
-          await deleteSandboxFile(context, path3);
+          await deleteSandboxFile(context, path5);
         } else {
-          await writeSandboxFileAtomic(context, path3, previous);
+          await writeSandboxFileAtomic(context, path5, previous);
         }
       } catch (rollbackError) {
         console.log(
-          `[ModuleRail] runId=${context.runId} composition artifacts rollback write failed for ${redactSecrets(path3)}: ${redactSecrets(
+          `[ModuleRail] runId=${context.runId} composition artifacts rollback write failed for ${redactSecrets(path5)}: ${redactSecrets(
             rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
           )}`
         );
@@ -6665,39 +6600,39 @@ async function listExistingGeneratedStubPaths(context) {
     COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN
   );
   const presentPaths = [];
-  for (const path3 of candidates) {
+  for (const path5 of candidates) {
     const presence = assertRealCompositionArtifactFilePresence(
-      path3,
-      kinds.get(path3) ?? "unreadable"
+      path5,
+      kinds.get(path5) ?? "unreadable"
     );
-    if (presence === "file") presentPaths.push(path3);
+    if (presence === "file") presentPaths.push(path5);
   }
   let contents;
   try {
     contents = await readFilesMany(context, presentPaths);
   } catch (error) {
-    const path3 = readFailurePath(error);
+    const path5 = readFailurePath(error);
     throw new Error(
-      `[ModuleRail] composition artifacts: cannot read candidate stub ${redactSecrets(path3)}: ${redactSecrets(
+      `[ModuleRail] composition artifacts: cannot read candidate stub ${redactSecrets(path5)}: ${redactSecrets(
         error instanceof Error ? error.message : String(error)
       )}`
     );
   }
   const owned = [];
-  for (const path3 of presentPaths) {
-    const content = contents.get(path3);
+  for (const path5 of presentPaths) {
+    const content = contents.get(path5);
     const marker = parseCompositionArtifactMarker(content);
-    if (parseLegacyApiAdapter(path3, content) || parseLegacyRouteAdapter(path3, content)) {
-      owned.push(path3);
+    if (parseLegacyApiAdapter(path5, content) || parseLegacyRouteAdapter(path5, content)) {
+      owned.push(path5);
       continue;
     }
     if (marker == null) continue;
-    if (!markerCongruentWithPath(path3, marker)) {
+    if (!markerCongruentWithPath(path5, marker)) {
       throw new Error(
-        `[ModuleRail] composition artifacts: incongruent marker at ${redactSecrets(path3)} (found ${marker.kind} marker on a path shaped for ${expectedMarkerKindForPath(path3) ?? "no"} artifacts; refusing to reconcile a swapped marker)`
+        `[ModuleRail] composition artifacts: incongruent marker at ${redactSecrets(path5)} (found ${marker.kind} marker on a path shaped for ${expectedMarkerKindForPath(path5) ?? "no"} artifacts; refusing to reconcile a swapped marker)`
       );
     }
-    owned.push(path3);
+    owned.push(path5);
   }
   return owned;
 }
@@ -6830,7 +6765,7 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
       { raiseOnError: false }
     );
     if (result.exitCode !== 0) {
-      for (const path3 of chunk) kinds.set(path3, "unreadable");
+      for (const path5 of chunk) kinds.set(path5, "unreadable");
       continue;
     }
     const lines = result.output.split("\n").filter(Boolean);
@@ -6841,31 +6776,31 @@ async function classifySandboxPathPresenceKindMany(context, paths, probeToken) {
       }
     } else {
       for (const line of lines) {
-        const [rawKind, path3] = line.split("	", 2);
+        const [rawKind, path5] = line.split("	", 2);
         const kind = rawKind?.replace(/^entry-kind:/, "");
-        if (path3 && chunk.includes(path3) && CONVENTIONAL_ENTRY_PRESENCE_KINDS.includes(kind ?? "")) {
-          kinds.set(path3, kind);
+        if (path5 && chunk.includes(path5) && CONVENTIONAL_ENTRY_PRESENCE_KINDS.includes(kind ?? "")) {
+          kinds.set(path5, kind);
         }
       }
     }
-    for (const path3 of chunk) {
-      if (!kinds.has(path3)) kinds.set(path3, "unreadable");
+    for (const path5 of chunk) {
+      if (!kinds.has(path5)) kinds.set(path5, "unreadable");
     }
   }
   return kinds;
 }
-async function classifySandboxPathPresenceKind(context, path3, probeToken) {
-  return (await classifySandboxPathPresenceKindMany(context, [path3], probeToken)).get(path3);
+async function classifySandboxPathPresenceKind(context, path5, probeToken) {
+  return (await classifySandboxPathPresenceKindMany(context, [path5], probeToken)).get(path5);
 }
 var LOCALE_JSON_KIND_PROBE_TOKEN = "locale-json-kind";
-function assertRealLocaleJsonFilePresence(path3, presence) {
+function assertRealLocaleJsonFilePresence(path5, presence) {
   if (presence === "file") return;
   if (presence === "absent") {
-    throw new Error(`[ModuleRail] composition artifacts: locale file missing at ${path3}`);
+    throw new Error(`[ModuleRail] composition artifacts: locale file missing at ${path5}`);
   }
-  const presenceError = formatConventionalEntryPresenceError(path3, presence);
+  const presenceError = formatConventionalEntryPresenceError(path5, presence);
   throw new Error(
-    `[ModuleRail] composition artifacts: ${presenceError ?? `${path3} is not a real locale JSON file`}`
+    `[ModuleRail] composition artifacts: ${presenceError ?? `${path5} is not a real locale JSON file`}`
   );
 }
 function splitTaggedLine(line) {
@@ -6940,11 +6875,11 @@ async function listLocaleBasenamesIfDirMany(context, dirs) {
 }
 async function readFilesMany(context, paths) {
   const sortedPaths = [...paths].sort((a, b) => a.localeCompare(b));
-  const settled = await mapConcurrent(sortedPaths, SANDBOX_READ_CONCURRENCY, async (path3) => {
+  const settled = await mapConcurrent(sortedPaths, SANDBOX_READ_CONCURRENCY, async (path5) => {
     try {
-      return { path: path3, value: await context.sandbox.readFile(path3) };
+      return { path: path5, value: await context.sandbox.readFile(path5) };
     } catch (error) {
-      return { path: path3, error };
+      return { path: path5, error };
     }
   });
   const files = /* @__PURE__ */ new Map();
@@ -6967,58 +6902,58 @@ function readFailurePath(error) {
 var CONVENTIONAL_ENTRY_KIND_PROBE_TOKEN = "conventional-entry-kind";
 var SERVER_REGISTRATIONS_FILE = "server/registrations.ts";
 var COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN = "composition-artifact-kind";
-async function classifyCompositionArtifactPathKind(context, path3) {
-  return classifySandboxPathPresenceKind(context, path3, COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN);
+async function classifyCompositionArtifactPathKind(context, path5) {
+  return classifySandboxPathPresenceKind(context, path5, COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN);
 }
-function assertRealCompositionArtifactFilePresence(path3, presence) {
+function assertRealCompositionArtifactFilePresence(path5, presence) {
   if (presence === "file") return "file";
   if (presence === "absent") return "absent";
-  const presenceError = formatConventionalEntryPresenceError(path3, presence);
+  const presenceError = formatConventionalEntryPresenceError(path5, presence);
   throw new Error(
-    `[ModuleRail] composition artifacts: ${presenceError ?? `${path3} is not a real composition artifact file`}`
+    `[ModuleRail] composition artifacts: ${presenceError ?? `${path5} is not a real composition artifact file`}`
   );
 }
-async function readConventionalEntryIfRealFile(path3, kind, presences, files) {
-  const presence = presences.get(path3) ?? "unreadable";
-  const presenceError = formatConventionalEntryPresenceError(path3, presence);
+async function readConventionalEntryIfRealFile(path5, kind, presences, files) {
+  const presence = presences.get(path5) ?? "unreadable";
+  const presenceError = formatConventionalEntryPresenceError(path5, presence);
   if (presenceError) {
     throw new Error(`[ModuleRail] composition artifacts: ${presenceError}`);
   }
   if (presence === "absent") {
     return null;
   }
-  const source = files.get(path3);
+  const source = files.get(path5);
   switch (kind) {
     case "contributions":
-      assertContributionsExport(source, path3);
-      assertClientSafeConventionalEntryImports(source, path3, "contributions");
+      assertContributionsExport(source, path5);
+      assertClientSafeConventionalEntryImports(source, path5, "contributions");
       break;
     case "slotCatalogs":
-      assertSlotCatalogsExport(source, path3);
-      assertClientSafeConventionalEntryImports(source, path3, "slotCatalogs");
+      assertSlotCatalogsExport(source, path5);
+      assertClientSafeConventionalEntryImports(source, path5, "slotCatalogs");
       break;
     case "initializeEnhancement":
-      assertInitializeEnhancementExport(source, path3);
+      assertInitializeEnhancementExport(source, path5);
       break;
   }
   return source;
 }
 function hasRealServerRegistrations(modulePath, presences) {
-  const path3 = `${modulePath}/${SERVER_REGISTRATIONS_FILE}`;
-  return assertRealCompositionArtifactFilePresence(path3, presences.get(path3) ?? "unreadable") === "file";
+  const path5 = `${modulePath}/${SERVER_REGISTRATIONS_FILE}`;
+  return assertRealCompositionArtifactFilePresence(path5, presences.get(path5) ?? "unreadable") === "file";
 }
-async function readJsonObjectFile(path3, files) {
-  const raw = files.get(path3);
+async function readJsonObjectFile(path5, files) {
+  const raw = files.get(path5);
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (error) {
     throw new Error(
-      `[ModuleRail] composition artifacts: invalid JSON at ${path3}: ${error instanceof Error ? error.message : String(error)}`
+      `[ModuleRail] composition artifacts: invalid JSON at ${path5}: ${error instanceof Error ? error.message : String(error)}`
     );
   }
   if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
-    throw new Error(`[ModuleRail] composition artifacts: ${path3} root must be an object`);
+    throw new Error(`[ModuleRail] composition artifacts: ${path5} root must be an object`);
   }
   return parsed;
 }
@@ -7067,11 +7002,11 @@ async function collectCompositionEntryFacts(context, registry) {
     classifySandboxPathPresenceKindMany(context, localePaths, LOCALE_JSON_KIND_PROBE_TOKEN)
   ]);
   const presentConventionalPaths = [];
-  for (const path3 of conventionalPaths) {
-    const presence = conventionalPresences.get(path3) ?? "unreadable";
-    if (presence === "file") presentConventionalPaths.push(path3);
+  for (const path5 of conventionalPaths) {
+    const presence = conventionalPresences.get(path5) ?? "unreadable";
+    if (presence === "file") presentConventionalPaths.push(path5);
   }
-  const presentLocalePaths = localePaths.filter((path3) => localePresences.get(path3) === "file");
+  const presentLocalePaths = localePaths.filter((path5) => localePresences.get(path5) === "file");
   const files = await readFilesMany(context, [...presentConventionalPaths, ...presentLocalePaths]);
   const substrateLocales = [];
   for (const locale of substrateNames) {
@@ -7169,8 +7104,8 @@ async function collectCompositionEntryFacts(context, registry) {
     });
     if (rootLocales.length > 0) {
       for (const locale of rootLocales) {
-        const path3 = `${modulePath}/i18n/${locale}.json`;
-        assertRealLocaleJsonFilePresence(path3, localePresences.get(path3) ?? "unreadable");
+        const path5 = `${modulePath}/i18n/${locale}.json`;
+        assertRealLocaleJsonFilePresence(path5, localePresences.get(path5) ?? "unreadable");
       }
       const enMessages = await readJsonObjectFile(`${modulePath}/i18n/en.json`, files);
       const localeMessages = { en: enMessages };
@@ -7194,8 +7129,8 @@ async function collectCompositionEntryFacts(context, registry) {
       if (!enh.active || enh.locales.length === 0) continue;
       const peerDir = `${modulePath}/enhancements/${enh.peer}`;
       for (const locale of enh.locales) {
-        const path3 = `${peerDir}/i18n/${locale}.json`;
-        assertRealLocaleJsonFilePresence(path3, localePresences.get(path3) ?? "unreadable");
+        const path5 = `${peerDir}/i18n/${locale}.json`;
+        assertRealLocaleJsonFilePresence(path5, localePresences.get(path5) ?? "unreadable");
       }
       const enMessages = await readJsonObjectFile(`${peerDir}/i18n/en.json`, files);
       const localeMessages = { en: enMessages };
@@ -7396,16 +7331,16 @@ async function reconcileCompositionArtifacts(context, options = {}) {
   for (const stub of probePlan.plan.routeStubs) candidatePaths.add(stub.path);
   const existingFiles = {};
   const remainingCandidatePaths = [];
-  for (const path3 of [...candidatePaths].sort((a, b) => a.localeCompare(b))) {
-    if (Object.prototype.hasOwnProperty.call(existingAppPages, path3)) {
-      existingFiles[path3] = existingAppPages[path3];
+  for (const path5 of [...candidatePaths].sort((a, b) => a.localeCompare(b))) {
+    if (Object.prototype.hasOwnProperty.call(existingAppPages, path5)) {
+      existingFiles[path5] = existingAppPages[path5];
       continue;
     }
-    if (Object.prototype.hasOwnProperty.call(existingAppRoutes, path3)) {
-      existingFiles[path3] = existingAppRoutes[path3];
+    if (Object.prototype.hasOwnProperty.call(existingAppRoutes, path5)) {
+      existingFiles[path5] = existingAppRoutes[path5];
       continue;
     }
-    remainingCandidatePaths.push(path3);
+    remainingCandidatePaths.push(path5);
   }
   const candidateKinds = await classifySandboxPathPresenceKindMany(
     context,
@@ -7413,12 +7348,12 @@ async function reconcileCompositionArtifacts(context, options = {}) {
     COMPOSITION_ARTIFACT_KIND_PROBE_TOKEN
   );
   const presentCandidatePaths = [];
-  for (const path3 of remainingCandidatePaths) {
+  for (const path5 of remainingCandidatePaths) {
     const presence = assertRealCompositionArtifactFilePresence(
-      path3,
-      candidateKinds.get(path3) ?? "unreadable"
+      path5,
+      candidateKinds.get(path5) ?? "unreadable"
     );
-    if (presence === "file") presentCandidatePaths.push(path3);
+    if (presence === "file") presentCandidatePaths.push(path5);
   }
   try {
     Object.assign(
@@ -7426,9 +7361,9 @@ async function reconcileCompositionArtifacts(context, options = {}) {
       Object.fromEntries(await readFilesMany(context, presentCandidatePaths))
     );
   } catch (error) {
-    const path3 = readFailurePath(error);
+    const path5 = readFailurePath(error);
     throw new Error(
-      `[ModuleRail] composition artifacts: cannot read ${redactSecrets(path3)} during preflight: ${redactSecrets(
+      `[ModuleRail] composition artifacts: cannot read ${redactSecrets(path5)} during preflight: ${redactSecrets(
         error instanceof Error ? error.message : String(error)
       )}`
     );
@@ -7497,14 +7432,142 @@ async function reconcileCompositionArtifacts(context, options = {}) {
 var HOME_I18N_SUBSTRATE_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/substrate`;
 var HOME_I18N_MESSAGES_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/messages`;
 
+// src/index.ts
+var import_typescript6 = __toESM(require("typescript"));
+
+// src/module-boundaries.ts
+var import_node_fs2 = __toESM(require("fs"));
+var import_node_path2 = __toESM(require("path"));
+var import_typescript5 = __toESM(require("typescript"));
+var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
+var RESOLVE_SUFFIXES = ["", ".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.tsx", "/index.js"];
+var DATA_FILE = /\.(?:sql|json)$/;
+function dataPathsIn(fileName, source) {
+  if (!/\.(?:sql|json)["'`]/.test(source)) return [];
+  const paths = [];
+  const visit = (node) => {
+    if ((import_typescript5.default.isStringLiteralLike(node) || import_typescript5.default.isTemplateTail(node)) && DATA_FILE.test(node.text)) {
+      paths.push(node.text);
+    }
+    import_typescript5.default.forEachChild(node, visit);
+  };
+  visit(import_typescript5.default.createSourceFile(fileName, source, import_typescript5.default.ScriptTarget.Latest, false));
+  return paths;
+}
+function scanModule(modulesDir, module2) {
+  const scanned = /* @__PURE__ */ new Map();
+  const moduleDir = import_node_path2.default.join(modulesDir, module2);
+  if (!import_node_fs2.default.existsSync(moduleDir)) return scanned;
+  const files = import_node_fs2.default.readdirSync(moduleDir, { recursive: true, encoding: "utf8" }).filter((relative) => SOURCE_FILE.test(relative) && !relative.includes("node_modules"));
+  for (const relative of files) {
+    const absolute = import_node_path2.default.join(moduleDir, relative);
+    if (!import_node_fs2.default.statSync(absolute).isFile()) continue;
+    const source = import_node_fs2.default.readFileSync(absolute, "utf8");
+    const specifiers = import_typescript5.default.preProcessFile(source, true, true).importedFiles.map((f) => f.fileName);
+    const dataPaths = dataPathsIn(absolute, source);
+    const targets = [...specifiers, ...dataPaths].flatMap((spec) => {
+      if (spec.startsWith("@/modules/"))
+        return [import_node_path2.default.join(modulesDir, spec.slice("@/modules/".length))];
+      if (spec.startsWith("./") || spec.startsWith("../")) {
+        return [import_node_path2.default.resolve(import_node_path2.default.dirname(absolute), spec)];
+      }
+      return [];
+    });
+    scanned.set(absolute, {
+      module: module2,
+      relative: relative.split(import_node_path2.default.sep).join("/"),
+      targets,
+      dataPaths
+    });
+  }
+  return scanned;
+}
+function findModuleBoundaryViolations(modulesDir, peersByModule, { pruning = false } = {}) {
+  const files = /* @__PURE__ */ new Map();
+  for (const [module2, peers] of Object.entries(peersByModule)) {
+    if (peers.length === 0) continue;
+    for (const [absolute, file] of scanModule(modulesDir, module2)) files.set(absolute, file);
+  }
+  const exempt = (file, peer) => (pruning ? peersByModule[file.module] ?? [] : [peer]).some(
+    (q) => file.relative.startsWith(`enhancements/${q}/`)
+  );
+  const goneWith = (target, peer) => {
+    const relative = import_node_path2.default.relative(modulesDir, target).split(import_node_path2.default.sep).join("/");
+    return relative === peer || relative.startsWith(`${peer}/`) || new RegExp(`^[^/]+/enhancements/${peer}(/|$)`).test(relative);
+  };
+  const tainted = /* @__PURE__ */ new Map();
+  const queue = [];
+  const taint = (absolute, peer) => {
+    const peers = tainted.get(absolute) ?? /* @__PURE__ */ new Set();
+    if (peers.has(peer)) return;
+    peers.add(peer);
+    tainted.set(absolute, peers);
+    queue.push([absolute, peer]);
+  };
+  const importers = /* @__PURE__ */ new Map();
+  for (const [absolute, file] of files) {
+    for (const target of file.targets) {
+      const hit = RESOLVE_SUFFIXES.map((suffix) => target + suffix).find((c) => files.has(c));
+      if (hit) importers.set(hit, [...importers.get(hit) ?? [], absolute]);
+    }
+    for (const peer of peersByModule[file.module] ?? []) {
+      if (exempt(file, peer)) continue;
+      if (file.targets.some((target) => goneWith(target, peer)) || file.dataPaths.some(
+        (p) => p.startsWith(`modules/${peer}/`) || p.includes(`/modules/${peer}/`)
+      )) {
+        taint(absolute, peer);
+      }
+    }
+  }
+  for (let next = queue.shift(); next; next = queue.shift()) {
+    const [target, peer] = next;
+    for (const importer of importers.get(target) ?? []) {
+      const file = files.get(importer);
+      if ((peersByModule[file.module] ?? []).includes(peer) && !exempt(file, peer)) {
+        taint(importer, peer);
+      }
+    }
+  }
+  const violations = [];
+  for (const [absolute, peers] of tainted) {
+    const file = files.get(absolute);
+    for (const peer of peers) {
+      violations.push({ file: `${file.module}/${file.relative}`, module: file.module, peer });
+    }
+  }
+  return violations.sort((a, b) => a.file.localeCompare(b.file) || a.peer.localeCompare(b.peer));
+}
+function findOptionalPeerViolations(modulesDir) {
+  if (!import_node_fs2.default.existsSync(modulesDir)) return [];
+  const manifests = {};
+  for (const name of import_node_fs2.default.readdirSync(modulesDir)) {
+    const manifestPath = import_node_path2.default.join(modulesDir, name, "module.json");
+    if (!import_node_fs2.default.existsSync(manifestPath)) continue;
+    manifests[name] = JSON.parse(import_node_fs2.default.readFileSync(manifestPath, "utf8"));
+  }
+  const features = Object.keys(manifests).filter((name) => manifests[name].kind === "feature");
+  const peersByModule = {};
+  for (const [name, manifest] of Object.entries(manifests)) {
+    const uses = new Set(manifest.uses ?? []);
+    peersByModule[name] = features.filter((peer) => peer !== name && !uses.has(peer));
+  }
+  return findModuleBoundaryViolations(modulesDir, peersByModule);
+}
+function formatBoundaryViolations(modulesDirLabel, violations) {
+  const files = new Set(violations.map((v) => v.file)).size;
+  return `${files} Module file(s) import a peer Module that may be absent (not in the Module's \`uses\`, or excluded by --enabled).
+\`next build\` type-checks them after the peer is gone. For each line, move the file into ${modulesDirLabel}/<module>/enhancements/<peer>/ or declare <peer> in the module's module.json \`uses\` (and enable it).
+` + violations.map((v) => `${modulesDirLabel}/${v.file}: ${v.peer}`).join("\n");
+}
+
 // src/index.ts
 var MODULES_DIR2 = MODULES_SANDBOX_DIR;
 function readComposeInputs(cwd) {
-  const file = import_node_path2.default.join(cwd, COMPOSE_INPUTS_PATH);
-  if (!import_node_fs2.default.existsSync(file)) return { connectedStores: [], installs: {} };
+  const file = import_node_path3.default.join(cwd, COMPOSE_INPUTS_PATH);
+  if (!import_node_fs3.default.existsSync(file)) return { connectedStores: [], installs: {} };
   let raw;
   try {
-    raw = JSON.parse(import_node_fs2.default.readFileSync(file, "utf8"));
+    raw = JSON.parse(import_node_fs3.default.readFileSync(file, "utf8"));
   } catch (error) {
     throw new Error(
       `[compose] ${file} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -7546,18 +7609,18 @@ function stubGitignoreEntries(artifactPaths) {
 function writeStubGitignore(cwd, artifactPaths) {
   const entries = stubGitignoreEntries(artifactPaths);
   const content = [STUB_GITIGNORE_HEADER, ...entries].join("\n") + "\n";
-  const file = import_node_path2.default.join(cwd, STUB_GITIGNORE_PATH);
-  const existing = import_node_fs2.default.existsSync(file) ? import_node_fs2.default.readFileSync(file, "utf8") : null;
+  const file = import_node_path3.default.join(cwd, STUB_GITIGNORE_PATH);
+  const existing = import_node_fs3.default.existsSync(file) ? import_node_fs3.default.readFileSync(file, "utf8") : null;
   if (existing !== content) {
-    import_node_fs2.default.mkdirSync(import_node_path2.default.dirname(file), { recursive: true });
-    import_node_fs2.default.writeFileSync(file, content);
+    import_node_fs3.default.mkdirSync(import_node_path3.default.dirname(file), { recursive: true });
+    import_node_fs3.default.writeFileSync(file, content);
   }
   return entries.length;
 }
 function assertStubGitignoreOwned(cwd) {
-  const file = import_node_path2.default.join(cwd, STUB_GITIGNORE_PATH);
-  if (!import_node_fs2.default.existsSync(file)) return;
-  const firstLine = import_node_fs2.default.readFileSync(file, "utf8").split("\n", 1)[0] ?? "";
+  const file = import_node_path3.default.join(cwd, STUB_GITIGNORE_PATH);
+  if (!import_node_fs3.default.existsSync(file)) return;
+  const firstLine = import_node_fs3.default.readFileSync(file, "utf8").split("\n", 1)[0] ?? "";
   if (firstLine !== STUB_GITIGNORE_HEADER) {
     throw new Error(
       `[compose] refusing to overwrite ${STUB_GITIGNORE_PATH}: it is not compose-generated (line 1 is not the generated header)`
@@ -7565,8 +7628,8 @@ function assertStubGitignoreOwned(cwd) {
   }
 }
 function assertAppRoot(cwd) {
-  const appPath = import_node_path2.default.join(cwd, APP_PACKAGE_JSON);
-  if (!import_node_fs2.default.existsSync(appPath)) {
+  const appPath = import_node_path3.default.join(cwd, APP_PACKAGE_JSON);
+  if (!import_node_fs3.default.existsSync(appPath)) {
     throw new Error(
       `[compose] ${appPath} not found \u2014 run this from the repo root of a Stardeck app`
     );
@@ -7612,9 +7675,9 @@ ${porcelain.trim()}`
 }
 var APP_SRC_DIR = "apps/web/src";
 function walkSources(dir, skip, out) {
-  if (!import_node_fs2.default.existsSync(dir)) return;
-  for (const entry of import_node_fs2.default.readdirSync(dir, { withFileTypes: true })) {
-    const full = import_node_path2.default.join(dir, entry.name);
+  if (!import_node_fs3.default.existsSync(dir)) return;
+  for (const entry of import_node_fs3.default.readdirSync(dir, { withFileTypes: true })) {
+    const full = import_node_path3.default.join(dir, entry.name);
     if (full === skip) continue;
     if (entry.isDirectory()) walkSources(full, skip, out);
     else if (/\.[cm]?[jt]sx?$/.test(entry.name)) out.push(full);
@@ -7623,13 +7686,13 @@ function walkSources(dir, skip, out) {
 function assertNoAppLayerImporters(cwd, excluded) {
   if (excluded.length === 0) return;
   const files = [];
-  walkSources(import_node_path2.default.join(cwd, APP_SRC_DIR), import_node_path2.default.join(cwd, MODULES_DIR2), files);
+  walkSources(import_node_path3.default.join(cwd, APP_SRC_DIR), import_node_path3.default.join(cwd, MODULES_DIR2), files);
   const offenders = [];
   for (const file of files) {
-    const source = import_node_fs2.default.readFileSync(file, "utf8");
+    const source = import_node_fs3.default.readFileSync(file, "utf8");
     for (const name of excluded) {
       if (new RegExp(`@/modules/${name}(?=["'\`/])`).test(source)) {
-        offenders.push(`${import_node_path2.default.relative(cwd, file)}: ${name}`);
+        offenders.push(`${import_node_path3.default.relative(cwd, file)}: ${name}`);
       }
     }
   }
@@ -7641,9 +7704,44 @@ function assertNoAppLayerImporters(cwd, excluded) {
     );
   }
 }
+var TSCONFIG_PATH = "apps/web/tsconfig.json";
+var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
+var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+function writeBuildTsconfig(cwd, excluded) {
+  const baseFile = import_node_path3.default.join(cwd, TSCONFIG_PATH);
+  if (!import_node_fs3.default.existsSync(import_node_path3.default.join(cwd, MODULES_DIR2)) || !import_node_fs3.default.existsSync(baseFile)) return;
+  const base = import_typescript6.default.readConfigFile(baseFile, import_typescript6.default.sys.readFile);
+  if (base.error) {
+    throw new Error(
+      `[compose] cannot read ${TSCONFIG_PATH}: ${import_typescript6.default.flattenDiagnosticMessageText(base.error.messageText, "\n")}`
+    );
+  }
+  const baseExclude = base.config?.exclude ?? ["node_modules"];
+  const modulesDir = import_node_path3.default.posix.relative("apps/web", MODULES_DIR2);
+  const config = {
+    extends: "./tsconfig.json",
+    exclude: [
+      ...baseExclude,
+      ...excluded.flatMap((name) => [
+        `${modulesDir}/${name}`,
+        `${modulesDir}/*/enhancements/${name}`
+      ])
+    ]
+  };
+  const content = `${BUILD_TSCONFIG_HEADER}
+${JSON.stringify(config, null, 2)}
+`;
+  const file = import_node_path3.default.join(cwd, BUILD_TSCONFIG_PATH);
+  if (!import_node_fs3.default.existsSync(file) || import_node_fs3.default.readFileSync(file, "utf8") !== content) {
+    import_node_fs3.default.writeFileSync(file, content);
+  }
+  console.log(
+    `[compose] ${BUILD_TSCONFIG_PATH} excludes ${excluded.length} Module(s): ${excluded.join(",") || "none"}`
+  );
+}
 function removeDir(absolute) {
-  if (!import_node_fs2.default.existsSync(absolute)) return false;
-  import_node_fs2.default.rmSync(absolute, { recursive: true, force: true });
+  if (!import_node_fs3.default.existsSync(absolute)) return false;
+  import_node_fs3.default.rmSync(absolute, { recursive: true, force: true });
   return true;
 }
 async function compose(options) {
@@ -7670,6 +7768,16 @@ async function compose(options) {
       dryRun: true
     });
     assertNoAppLayerImporters(options.cwd, preview.excludedModules);
+    const violations = findModuleBoundaryViolations(
+      import_node_path3.default.join(options.cwd, MODULES_DIR2),
+      Object.fromEntries(preview.composedModules.map((name) => [name, preview.excludedModules])),
+      { pruning: true }
+    );
+    if (violations.length > 0) {
+      throw new Error(
+        `[compose] refusing --prune: ${formatBoundaryViolations(MODULES_DIR2, violations)}`
+      );
+    }
   }
   const result = await reconcileCompositionArtifacts(context, {
     enabledModulesRaw: options.enabled,
@@ -7678,14 +7786,15 @@ async function compose(options) {
     skipComposeInputs: true
   });
   const gitignoreEntries = options.enabled ? null : writeStubGitignore(options.cwd, result.artifactPaths);
+  writeBuildTsconfig(options.cwd, result.excludedModules);
   let pruned = 0;
   if (options.prune) {
     for (const name of result.excludedModules) {
-      if (removeDir(import_node_path2.default.join(options.cwd, MODULES_DIR2, name))) pruned++;
+      if (removeDir(import_node_path3.default.join(options.cwd, MODULES_DIR2, name))) pruned++;
     }
     for (const owner of result.composedModules) {
       for (const peer of result.excludedModules) {
-        if (removeDir(import_node_path2.default.join(options.cwd, MODULES_DIR2, owner, "enhancements", peer))) pruned++;
+        if (removeDir(import_node_path3.default.join(options.cwd, MODULES_DIR2, owner, "enhancements", peer))) pruned++;
       }
     }
   }
@@ -7701,15 +7810,28 @@ async function compose(options) {
 
 // src/cli.ts
 async function main() {
-  assertSupportedTypescript(import_typescript5.default.versionMajorMinor);
+  assertSupportedTypescript(import_typescript7.default.versionMajorMinor);
   const { values } = (0, import_node_util.parseArgs)({
     options: {
       enabled: { type: "string" },
       prune: { type: "boolean", default: false },
-      cwd: { type: "string" }
+      cwd: { type: "string" },
+      "check-boundaries": { type: "boolean", default: false }
     },
     strict: true
   });
+  if (values["check-boundaries"]) {
+    const violations = findOptionalPeerViolations(
+      import_node_path4.default.join(values.cwd ?? process.cwd(), MODULES_SANDBOX_DIR)
+    );
+    if (violations.length > 0) {
+      throw new Error(
+        `[compose] --check-boundaries: ${formatBoundaryViolations(MODULES_SANDBOX_DIR, violations)}`
+      );
+    }
+    console.log("[compose] --check-boundaries: no Module file reaches a peer outside its `uses`");
+    return;
+  }
   const enabled = values.enabled ?? process.env[ENABLED_MODULES_ENV];
   if (values.prune && !enabled) {
     throw new Error(