@stardeck-customer-apps/compose 0.9.0 → 0.10.0

package/dist/index.js

@@ -2027,6 +2027,7 @@ var require_semver2 = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BUILD_TSCONFIG_PATH: () => BUILD_TSCONFIG_PATH,
   COMPOSE_INPUTS_PATH: () => COMPOSE_INPUTS_PATH,
   assertSupportedTypescript: () => assertSupportedTypescript,
   compose: () => compose,
@@ -2098,11 +2099,54 @@ function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
-// ../../packages/lib/src/shared/module-composition.ts
-var import_zod6 = require("zod");
+// ../../packages/lib/src/shared/compose-inputs.ts
+var import_zod = require("zod");
+var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
+var composeInputsSchema = import_zod.z.strictObject({
+  connectedStores: import_zod.z.array(
+    import_zod.z.strictObject({
+      storeId: import_zod.z.string().min(1),
+      slug: import_zod.z.string().min(1),
+      // A row with an empty binding key must not fail a deploy: the rail
+      // treats falsy as "no binding key", so normalise rather than reject.
+      bindingKey: import_zod.z.string().nullish().transform((value) => value || null),
+      accessLevel: import_zod.z.enum(["read", "write", "admin"]),
+      // Defaulted so a file written before the platform emitted store types
+      // (database rows only) still parses. The platform starts writing
+      // storage rows, with `type` set, once forks run a compose that reads it.
+      type: import_zod.z.enum(["database", "storage"]).default("database")
+    })
+  ).default([]),
+  installs: import_zod.z.record(
+    import_zod.z.string(),
+    import_zod.z.strictObject({
+      installedVersion: import_zod.z.string().min(1),
+      datastoreBindings: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).nullish()
+    })
+  ).default({})
+});
+var STUB_IGNORE_PATH = "apps/web/src/app/.gitignore";
+var STUB_IGNORE_HEADER = "# Generated by stardeck-compose \u2014 Module-rail stubs are build outputs; do not edit or commit them.";
+function escapeStubIgnorePattern(pattern) {
+  const escaped = pattern.replace(/[\\[\]*?]/g, (char) => `\\${char}`);
+  return /^[#!]/.test(escaped) ? `\\${escaped}` : escaped;
+}
+function buildStubIgnore(artifactPaths) {
+  const prefix = "apps/web/src/app/";
+  const entries = artifactPaths.filter((artifact) => artifact.startsWith(prefix)).map((artifact) => escapeStubIgnorePattern(`/${artifact.slice(prefix.length)}`)).sort();
+  return [STUB_IGNORE_HEADER, ...entries].join("\n") + "\n";
+}
+
+// ../../packages/lib/src/shared/module-enablement.ts
+function isModuleEnabledByList(raw, name, kindOf) {
+  if (!raw) return true;
+  const kind = kindOf(name);
+  if (kind != null && kind !== "feature") return true;
+  return raw.split(",").includes(name);
+}
 
 // ../../packages/module-contract/src/module-manifest.ts
-var import_zod = require("zod");
+var import_zod2 = require("zod");
 
 // ../../packages/module-contract/src/slug.ts
 function validateSlug(slug) {
@@ -2137,13 +2181,13 @@ var ROUTE_GROUP_REGEX = /^\([a-z0-9-]+\)$/;
 var ENDPOINT_STATIC_SEGMENT_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var ENDPOINT_PARAM_NAME_REGEX = /^[a-z][a-z0-9_-]*$/;
 var ENDPOINT_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-var moduleNameSchema = import_zod.z.string().max(40).regex(KEBAB_SLUG_REGEX, "must be a kebab-case slug (lowercase letters, digits, hyphens)");
+var moduleNameSchema = import_zod2.z.string().max(40).regex(KEBAB_SLUG_REGEX, "must be a kebab-case slug (lowercase letters, digits, hyphens)");
 function isValidModuleName(value) {
   return moduleNameSchema.safeParse(value).success;
 }
-var projectSlugSchema = import_zod.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
-var moduleKindSchema = import_zod.z.enum(["feature", "library", "contract"]);
-var endpointMethodSchema = import_zod.z.enum(ENDPOINT_METHODS);
+var projectSlugSchema = import_zod2.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
+var moduleKindSchema = import_zod2.z.enum(["feature", "library", "contract"]);
+var endpointMethodSchema = import_zod2.z.enum(ENDPOINT_METHODS);
 function endpointPathValidationError(path4) {
   if (!path4.startsWith("/api/")) {
     return 'must begin with "/api/"';
@@ -2228,21 +2272,21 @@ function normalizeEndpointPathForCollision(path4) {
     return segment;
   }).join("/");
 }
-var endpointPathSchema = import_zod.z.string().superRefine((path4, ctx) => {
+var endpointPathSchema = import_zod2.z.string().superRefine((path4, ctx) => {
   const error = endpointPathValidationError(path4);
   if (error != null) {
-    ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: import_zod2.z.ZodIssueCode.custom, message: error });
   }
 });
-var endpointClaimSchema = import_zod.z.object({
+var endpointClaimSchema = import_zod2.z.object({
   path: endpointPathSchema,
-  methods: import_zod.z.array(endpointMethodSchema).min(1, "methods must be non-empty").superRefine((methods, ctx) => {
+  methods: import_zod2.z.array(endpointMethodSchema).min(1, "methods must be non-empty").superRefine((methods, ctx) => {
     const seen = /* @__PURE__ */ new Set();
     for (let i = 0; i < methods.length; i += 1) {
       const method = methods[i];
       if (seen.has(method)) {
         ctx.addIssue({
-          code: import_zod.z.ZodIssueCode.custom,
+          code: import_zod2.z.ZodIssueCode.custom,
           message: `duplicate method "${method}"`,
           path: [i]
         });
@@ -2279,14 +2323,14 @@ function mountSegmentValidationError(segment) {
   }
   return null;
 }
-var mountSegmentSchema = import_zod.z.string().superRefine((segment, ctx) => {
+var mountSegmentSchema = import_zod2.z.string().superRefine((segment, ctx) => {
   const error = mountSegmentValidationError(segment);
   if (error != null) {
-    ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: import_zod2.z.ZodIssueCode.custom, message: error });
   }
 });
-var mountSchema = import_zod.z.object({
-  group: import_zod.z.string().regex(ROUTE_GROUP_REGEX, 'must be a Next.js route group like "(admin)"'),
+var mountSchema = import_zod2.z.object({
+  group: import_zod2.z.string().regex(ROUTE_GROUP_REGEX, 'must be a Next.js route group like "(admin)"'),
   segment: mountSegmentSchema
 }).strict();
 function splitMountSegment(segment) {
@@ -2299,21 +2343,21 @@ function splitMountSegment(segment) {
   }
   return segment.split("/");
 }
-var tableNameSchema = import_zod.z.string().regex(SNAKE_TABLE_REGEX, "must be snake_case");
+var tableNameSchema = import_zod2.z.string().regex(SNAKE_TABLE_REGEX, "must be snake_case");
 var NPM_PACKAGE_NAME_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-var npmPackageNameSchema = import_zod.z.string().max(214).regex(NPM_PACKAGE_NAME_REGEX, "must be a valid npm package name");
-var descriptionSchema = import_zod.z.string().max(200, "must be at most 200 characters").refine((value) => value.trim().length > 0, "must be non-empty after trimming");
-var crossAppSchema = import_zod.z.object({
-  exposes: import_zod.z.array(import_zod.z.unknown()).max(0, "must be empty until cross-app contracts are defined"),
-  consumes: import_zod.z.array(import_zod.z.unknown()).max(0, "must be empty until cross-app contracts are defined")
+var npmPackageNameSchema = import_zod2.z.string().max(214).regex(NPM_PACKAGE_NAME_REGEX, "must be a valid npm package name");
+var descriptionSchema = import_zod2.z.string().max(200, "must be at most 200 characters").refine((value) => value.trim().length > 0, "must be non-empty after trimming");
+var crossAppSchema = import_zod2.z.object({
+  exposes: import_zod2.z.array(import_zod2.z.unknown()).max(0, "must be empty until cross-app contracts are defined"),
+  consumes: import_zod2.z.array(import_zod2.z.unknown()).max(0, "must be empty until cross-app contracts are defined")
 }).strict();
-var enhancementWorkflowsSchema = import_zod.z.record(moduleNameSchema, import_zod.z.array(import_zod.z.string().min(1))).default({});
-var enhancementEndpointsSchema = import_zod.z.record(moduleNameSchema, import_zod.z.array(endpointClaimSchema)).default({});
-var datastoreRequirementSchema = import_zod.z.object({
+var enhancementWorkflowsSchema = import_zod2.z.record(moduleNameSchema, import_zod2.z.array(import_zod2.z.string().min(1))).default({});
+var enhancementEndpointsSchema = import_zod2.z.record(moduleNameSchema, import_zod2.z.array(endpointClaimSchema)).default({});
+var datastoreRequirementSchema = import_zod2.z.object({
   /** Logical name, module-local, snake_case. Never a physical store key. */
   id: tableNameSchema,
   /** "app" = this project's app-local store; "org" = an org-level shared store. */
-  scope: import_zod.z.enum(["app", "org"]).default("app"),
+  scope: import_zod2.z.enum(["app", "org"]).default("app"),
   /**
    * Which kind of connected store satisfies this requirement. A "database"
    * requirement only ever binds to a database store and a "storage" one
@@ -2321,34 +2365,34 @@ var datastoreRequirementSchema = import_zod.z.object({
    * rail never crosses the two. Defaults to "database", the only kind the
    * rail resolved before this field existed.
    */
-  type: import_zod.z.enum(["database", "storage"]).default("database"),
+  type: import_zod2.z.enum(["database", "storage"]).default("database"),
   /** true → install fails when no store resolves; false → binding omitted, module degrades. */
-  required: import_zod.z.boolean().default(true),
+  required: import_zod2.z.boolean().default(true),
   /** Checked against the connected store's accessLevel at install. */
-  access: import_zod.z.enum(["read", "write", "admin"]).default("write")
+  access: import_zod2.z.enum(["read", "write", "admin"]).default("write")
 }).strict();
-var permissionClaimSchema = import_zod.z.object({
+var permissionClaimSchema = import_zod2.z.object({
   /**
    * Lowercase resource:action with one colon and no underscores. This grammar
    * is deliberately narrower than the platform permission tool's charset.
    */
-  key: import_zod.z.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
+  key: import_zod2.z.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
   /** Human label for the deployment auth config row. */
   description: descriptionSchema
 }).strict();
-var seedBundleSchema = import_zod.z.object({
+var seedBundleSchema = import_zod2.z.object({
   table: tableNameSchema,
   /** Columns forming the ON CONFLICT key — must appear in every row. */
-  conflictTarget: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+  conflictTarget: import_zod2.z.array(import_zod2.z.string().min(1)).min(1),
   /** Scalar JSON values only (no nested objects/arrays). */
-  rows: import_zod.z.array(import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.string(), import_zod.z.number(), import_zod.z.boolean(), import_zod.z.null()]))).min(1)
+  rows: import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number(), import_zod2.z.boolean(), import_zod2.z.null()]))).min(1)
 }).strict().superRefine((bundle, ctx) => {
   const rowKeys = bundle.rows.map((row) => Object.keys(row).sort().join("\0"));
   const canonical = rowKeys[0];
   for (let i = 1; i < rowKeys.length; i += 1) {
     if (rowKeys[i] !== canonical) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "all rows in a seed bundle must have identical key sets",
         path: ["rows", i]
       });
@@ -2360,7 +2404,7 @@ var seedBundleSchema = import_zod.z.object({
     for (const col of bundle.conflictTarget) {
       if (!keys.has(col)) {
         ctx.addIssue({
-          code: import_zod.z.ZodIssueCode.custom,
+          code: import_zod2.z.ZodIssueCode.custom,
           message: `conflictTarget column "${col}" must be present in every row`,
           path: ["rows", i]
         });
@@ -2368,35 +2412,35 @@ var seedBundleSchema = import_zod.z.object({
     }
   }
 });
-var moduleManifestSchema = import_zod.z.object({
+var moduleManifestSchema = import_zod2.z.object({
   name: moduleNameSchema,
   kind: moduleKindSchema,
   // Release versions are platform-owned in module_versions. Accept this
   // legacy field while existing Module source ages out, but strip it from the
   // parsed contract so no runtime can treat module.json as version authority.
-  version: import_zod.z.unknown().optional(),
+  version: import_zod2.z.unknown().optional(),
   home: projectSlugSchema,
   /** Machine-checkable purpose line — required, ≤200 code units, non-blank when trimmed. */
   description: descriptionSchema,
-  uses: import_zod.z.array(moduleNameSchema).default([]),
+  uses: import_zod2.z.array(moduleNameSchema).default([]),
   /**
    * Soft peers: this module ships `enhancements/<peer>/` directories that are
    * composition-pruned — the installer includes them only when the peer is
    * present, so the peer is NOT an install-time requirement. Disjoint from
    * `uses`; entries may name modules absent from the composition.
    */
-  enhancements: import_zod.z.array(moduleNameSchema).default([]),
-  tables: import_zod.z.array(tableNameSchema).default([]),
-  mounts: import_zod.z.array(mountSchema).default([]),
-  integration: import_zod.z.array(import_zod.z.string()).default([]),
-  workflows: import_zod.z.array(import_zod.z.string().min(1)).default([]),
+  enhancements: import_zod2.z.array(moduleNameSchema).default([]),
+  tables: import_zod2.z.array(tableNameSchema).default([]),
+  mounts: import_zod2.z.array(mountSchema).default([]),
+  integration: import_zod2.z.array(import_zod2.z.string()).default([]),
+  workflows: import_zod2.z.array(import_zod2.z.string().min(1)).default([]),
   /**
    * Slice-scoped workflow names keyed by peer. Keys must be ⊆ `enhancements`;
    * names must be unique across root `workflows` and every slice list.
    */
   enhancementWorkflows: enhancementWorkflowsSchema,
   /** Root API endpoint path claims. */
-  endpoints: import_zod.z.array(endpointClaimSchema).default([]),
+  endpoints: import_zod2.z.array(endpointClaimSchema).default([]),
   /**
    * Slice-scoped endpoint claims keyed by peer. Keys must be ⊆ `enhancements`;
    * normalized paths must be unique across root and every slice.
@@ -2412,38 +2456,38 @@ var moduleManifestSchema = import_zod.z.object({
    * to a physical connected store and generates module-datastores.gen.ts;
    * unlike seeds, this field drives generated output.
    */
-  datastores: import_zod.z.array(datastoreRequirementSchema).optional(),
+  datastores: import_zod2.z.array(datastoreRequirementSchema).optional(),
   /**
    * Keys this module's guards enforce. Install registers them in deployment
    * auth config; registration only — declaring is never granting.
    */
-  permissions: import_zod.z.array(permissionClaimSchema).optional(),
+  permissions: import_zod2.z.array(permissionClaimSchema).optional(),
   /**
    * Optional starter rows for tables this module owns. Replay is
    * `INSERT ... ON CONFLICT (conflictTarget) DO NOTHING` — idempotent by
    * construction; the rail (not this schema) performs the replay.
    */
-  seeds: import_zod.z.array(seedBundleSchema).optional(),
+  seeds: import_zod2.z.array(seedBundleSchema).optional(),
   /** npm packages the source imports beyond the base app. Names only; the rail installs each at the home app's range. */
-  packages: import_zod.z.array(npmPackageNameSchema).optional(),
+  packages: import_zod2.z.array(npmPackageNameSchema).optional(),
   /**
    * UI-layer contract. `separable: true` asserts the Module's components/ and
    * routes/ hold presentation only — the Blueprint's
    * `module-boundaries/ui-layer` lint rule enforces it — so a fork may
    * soft-eject them. See docs/module-ui-soft-eject-plan.md.
    */
-  ui: import_zod.z.object({ separable: import_zod.z.boolean() }).strict().optional()
+  ui: import_zod2.z.object({ separable: import_zod2.z.boolean() }).strict().optional()
 }).strict().superRefine((manifest, ctx) => {
   if (manifest.uses.includes(manifest.name)) {
     ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
+      code: import_zod2.z.ZodIssueCode.custom,
       message: "a module cannot list itself in uses",
       path: ["uses"]
     });
   }
   if (manifest.enhancements.includes(manifest.name)) {
     ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
+      code: import_zod2.z.ZodIssueCode.custom,
       message: "a module cannot list itself in enhancements",
       path: ["enhancements"]
     });
@@ -2451,7 +2495,7 @@ var moduleManifestSchema = import_zod.z.object({
   const hardAndSoft = manifest.enhancements.filter((peer) => manifest.uses.includes(peer));
   if (hardAndSoft.length > 0) {
     ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
+      code: import_zod2.z.ZodIssueCode.custom,
       message: `uses and enhancements must be disjoint (a peer is either a hard dep or a soft one): ${hardAndSoft.join(", ")}`,
       path: ["enhancements"]
     });
@@ -2460,7 +2504,7 @@ var moduleManifestSchema = import_zod.z.object({
   for (const peer of Object.keys(manifest.enhancementWorkflows)) {
     if (!enhancementPeers.has(peer)) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `enhancementWorkflows key "${peer}" must be listed in enhancements`,
         path: ["enhancementWorkflows", peer]
       });
@@ -2469,7 +2513,7 @@ var moduleManifestSchema = import_zod.z.object({
   for (const peer of Object.keys(manifest.enhancementEndpoints)) {
     if (!enhancementPeers.has(peer)) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `enhancementEndpoints key "${peer}" must be listed in enhancements`,
         path: ["enhancementEndpoints", peer]
       });
@@ -2480,7 +2524,7 @@ var moduleManifestSchema = import_zod.z.object({
     const existing = seenWorkflows.get(name);
     if (existing != null) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `duplicate workflow name "${name}" (also at ${existing})`,
         path: path4
       });
@@ -2507,7 +2551,7 @@ var moduleManifestSchema = import_zod.z.object({
     const existing = seenEndpointKeys.get(key);
     if (existing != null) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `duplicate normalized endpoint path "${key}" (also at ${existing})`,
         path: path4
       });
@@ -2529,7 +2573,7 @@ var moduleManifestSchema = import_zod.z.object({
       const id = manifest.datastores[i].id;
       if (seenDatastoreIds.has(id)) {
         ctx.addIssue({
-          code: import_zod.z.ZodIssueCode.custom,
+          code: import_zod2.z.ZodIssueCode.custom,
           message: `duplicate datastore id "${id}"`,
           path: ["datastores", i, "id"]
         });
@@ -2544,7 +2588,7 @@ var moduleManifestSchema = import_zod.z.object({
       const key = manifest.permissions[i].key;
       if (seenPermissionKeys.has(key)) {
         ctx.addIssue({
-          code: import_zod.z.ZodIssueCode.custom,
+          code: import_zod2.z.ZodIssueCode.custom,
           message: `duplicate permission key "${key}"`,
           path: ["permissions", i, "key"]
         });
@@ -2556,35 +2600,35 @@ var moduleManifestSchema = import_zod.z.object({
   if (manifest.kind === "library") {
     if (manifest.tables.length > 0) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "library modules must not declare tables",
         path: ["tables"]
       });
     }
     if (manifest.mounts.length > 0) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "library modules must not declare mounts",
         path: ["mounts"]
       });
     }
     if (manifest.seeds != null && manifest.seeds.length > 0) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "library modules must not declare seeds",
         path: ["seeds"]
       });
     }
     if (manifest.datastores != null && manifest.datastores.length > 0) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "library modules must not declare datastores",
         path: ["datastores"]
       });
     }
     if (manifest.permissions != null && manifest.permissions.length > 0) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: "library modules must not declare permissions",
         path: ["permissions"]
       });
@@ -2592,7 +2636,7 @@ var moduleManifestSchema = import_zod.z.object({
   }
   if (manifest.kind === "contract" && manifest.mounts.length > 0) {
     ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
+      code: import_zod2.z.ZodIssueCode.custom,
       message: "contract modules must not declare mounts",
       path: ["mounts"]
     });
@@ -2603,7 +2647,7 @@ var moduleManifestSchema = import_zod.z.object({
       const bundle = manifest.seeds[i];
       if (!ownedTables.has(bundle.table)) {
         ctx.addIssue({
-          code: import_zod.z.ZodIssueCode.custom,
+          code: import_zod2.z.ZodIssueCode.custom,
           message: `seeds may only target tables listed in tables (got "${bundle.table}")`,
           path: ["seeds", i, "table"]
         });
@@ -2654,10 +2698,10 @@ var MANDATORY_MODULE_CHECK_DESCRIPTORS = Object.freeze([
 ]);
 
 // ../../packages/module-contract/src/module-structure.ts
-var import_zod3 = require("zod");
+var import_zod4 = require("zod");
 
 // ../../packages/module-contract/src/module-e2e-manifest.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 function e2eSpecFileValidationError(file) {
   if (file.length === 0) {
     return "must be a non-empty relative path ending in .spec.ts";
@@ -2685,22 +2729,22 @@ function e2eSpecFileValidationError(file) {
   }
   return null;
 }
-var e2eSpecFileSchema = import_zod2.z.string().superRefine((file, ctx) => {
+var e2eSpecFileSchema = import_zod3.z.string().superRefine((file, ctx) => {
   const error = e2eSpecFileValidationError(file);
   if (error != null) {
-    ctx.addIssue({ code: import_zod2.z.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: import_zod3.z.ZodIssueCode.custom, message: error });
   }
 });
-var e2eSpecSchema = import_zod2.z.object({
+var e2eSpecSchema = import_zod3.z.object({
   file: e2eSpecFileSchema,
-  requires: import_zod2.z.array(moduleNameSchema).min(1, "requires must be non-empty")
+  requires: import_zod3.z.array(moduleNameSchema).min(1, "requires must be non-empty")
 }).strict().superRefine((spec, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (let i = 0; i < spec.requires.length; i += 1) {
     const name = spec.requires[i];
     if (seen.has(name)) {
       ctx.addIssue({
-        code: import_zod2.z.ZodIssueCode.custom,
+        code: import_zod3.z.ZodIssueCode.custom,
         message: `duplicate requirement "${name}"`,
         path: ["requires", i]
       });
@@ -2709,15 +2753,15 @@ var e2eSpecSchema = import_zod2.z.object({
     }
   }
 });
-var moduleE2eManifestSchema = import_zod2.z.object({
-  specs: import_zod2.z.array(e2eSpecSchema).min(1, "specs must contain at least one entry")
+var moduleE2eManifestSchema = import_zod3.z.object({
+  specs: import_zod3.z.array(e2eSpecSchema).min(1, "specs must contain at least one entry")
 }).strict().superRefine((manifest, ctx) => {
   const seenFiles = /* @__PURE__ */ new Set();
   for (let i = 0; i < manifest.specs.length; i += 1) {
     const file = manifest.specs[i].file;
     if (seenFiles.has(file)) {
       ctx.addIssue({
-        code: import_zod2.z.ZodIssueCode.custom,
+        code: import_zod3.z.ZodIssueCode.custom,
         message: `duplicate file "${file}"`,
         path: ["specs", i, "file"]
       });
@@ -2959,7 +3003,7 @@ function compareCodeUnit(a, b) {
 // ../../packages/module-contract/src/module-structure.ts
 var MODULE_STRUCTURE_JSON_BYTE_CAP = 64 * 1024;
 function uniqueSortedStringArray(label) {
-  return import_zod3.z.array(import_zod3.z.string()).superRefine((arr, ctx) => {
+  return import_zod4.z.array(import_zod4.z.string()).superRefine((arr, ctx) => {
     if (new Set(arr).size !== arr.length) {
       ctx.addIssue({ code: "custom", message: `${label} must be unique` });
       return;
@@ -2975,10 +3019,10 @@ function uniqueSortedStringArray(label) {
   });
 }
 function contributionPermissionsSchema(label) {
-  return import_zod3.z.array(
-    import_zod3.z.object({
-      contributionId: import_zod3.z.string().min(1),
-      permission: import_zod3.z.string().min(1)
+  return import_zod4.z.array(
+    import_zod4.z.object({
+      contributionId: import_zod4.z.string().min(1),
+      permission: import_zod4.z.string().min(1)
     }).strict()
   ).superRefine((entries, ctx) => {
     const keys = entries.map((entry) => `${entry.contributionId}\0${entry.permission}`);
@@ -2996,17 +3040,17 @@ function contributionPermissionsSchema(label) {
     }
   }).optional();
 }
-var collectedFilePayloadSchema = import_zod3.z.discriminatedUnion("status", [
-  import_zod3.z.object({ status: import_zod3.z.literal("ok"), text: import_zod3.z.string() }).strict(),
-  import_zod3.z.object({ status: import_zod3.z.literal("missing") }).strict(),
-  import_zod3.z.object({ status: import_zod3.z.literal("too-large") }).strict(),
-  import_zod3.z.object({ status: import_zod3.z.literal("unreadable") }).strict()
+var collectedFilePayloadSchema = import_zod4.z.discriminatedUnion("status", [
+  import_zod4.z.object({ status: import_zod4.z.literal("ok"), text: import_zod4.z.string() }).strict(),
+  import_zod4.z.object({ status: import_zod4.z.literal("missing") }).strict(),
+  import_zod4.z.object({ status: import_zod4.z.literal("too-large") }).strict(),
+  import_zod4.z.object({ status: import_zod4.z.literal("unreadable") }).strict()
 ]);
-var collectedLocaleFileSchema = import_zod3.z.object({
-  locale: import_zod3.z.string().min(1),
+var collectedLocaleFileSchema = import_zod4.z.object({
+  locale: import_zod4.z.string().min(1),
   payload: collectedFilePayloadSchema
 }).strict();
-var collectedE2eFactsSchema = import_zod3.z.object({
+var collectedE2eFactsSchema = import_zod4.z.object({
   manifest: collectedFilePayloadSchema,
   specFiles: uniqueSortedStringArray("specFiles"),
   escapingSymlinks: uniqueSortedStringArray("escapingSymlinks")
@@ -3028,20 +3072,20 @@ function validateRouteExportEvidenceCongruence(input) {
     }
   }
 }
-var collectedEnhancementFactsSchema = import_zod3.z.object({
-  peer: import_zod3.z.string().min(1),
-  hasContributionsTs: import_zod3.z.boolean(),
+var collectedEnhancementFactsSchema = import_zod4.z.object({
+  peer: import_zod4.z.string().min(1),
+  hasContributionsTs: import_zod4.z.boolean(),
   contributionPermissions: contributionPermissionsSchema("enhancement contributionPermissions"),
-  hasInitializeServerTs: import_zod3.z.boolean(),
+  hasInitializeServerTs: import_zod4.z.boolean(),
   contributionsCollectionErrors: uniqueSortedStringArray(
     "enhancement contributionsCollectionErrors"
   ),
   initializeServerCollectionErrors: uniqueSortedStringArray(
     "enhancement initializeServerCollectionErrors"
   ),
-  hasRoutesDir: import_zod3.z.boolean(),
+  hasRoutesDir: import_zod4.z.boolean(),
   routeCollectionErrors: uniqueSortedStringArray("enhancement routeCollectionErrors"),
-  locales: import_zod3.z.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
+  locales: import_zod4.z.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
     const names = locales.map((l) => l.locale);
     if (new Set(names).size !== names.length) {
       ctx.addIssue({ code: "custom", message: "enhancement locales must be unique by locale" });
@@ -3056,27 +3100,27 @@ var collectedEnhancementFactsSchema = import_zod3.z.object({
   }),
   e2e: collectedE2eFactsSchema.nullable()
 }).strict();
-var moduleStructureFactsSchema = import_zod3.z.object({
-  collected: import_zod3.z.literal(true),
-  dirName: import_zod3.z.string().min(1),
-  hasIndexTs: import_zod3.z.boolean(),
-  hasContributionsTs: import_zod3.z.boolean(),
+var moduleStructureFactsSchema = import_zod4.z.object({
+  collected: import_zod4.z.literal(true),
+  dirName: import_zod4.z.string().min(1),
+  hasIndexTs: import_zod4.z.boolean(),
+  hasContributionsTs: import_zod4.z.boolean(),
   contributionPermissions: contributionPermissionsSchema("contributionPermissions"),
-  hasSlotsTs: import_zod3.z.boolean(),
+  hasSlotsTs: import_zod4.z.boolean(),
   contributionsCollectionErrors: uniqueSortedStringArray("contributionsCollectionErrors"),
   slotsCollectionErrors: uniqueSortedStringArray("slotsCollectionErrors"),
-  hasTestsDir: import_zod3.z.boolean(),
-  hasDatastoreDir: import_zod3.z.boolean(),
-  datastoreFileCount: import_zod3.z.number().int().nonnegative(),
-  hasServerIndexTs: import_zod3.z.boolean(),
-  hasOtherServerTs: import_zod3.z.boolean(),
-  hasE2eDir: import_zod3.z.boolean(),
-  hasRoutesDir: import_zod3.z.boolean(),
+  hasTestsDir: import_zod4.z.boolean(),
+  hasDatastoreDir: import_zod4.z.boolean(),
+  datastoreFileCount: import_zod4.z.number().int().nonnegative(),
+  hasServerIndexTs: import_zod4.z.boolean(),
+  hasOtherServerTs: import_zod4.z.boolean(),
+  hasE2eDir: import_zod4.z.boolean(),
+  hasRoutesDir: import_zod4.z.boolean(),
   routeEntries: uniqueSortedStringArray("routeEntries"),
-  routePageExports: import_zod3.z.array(
-    import_zod3.z.object({
-      nextRelativePath: import_zod3.z.string().min(1),
-      hasGenerateMetadata: import_zod3.z.boolean()
+  routePageExports: import_zod4.z.array(
+    import_zod4.z.object({
+      nextRelativePath: import_zod4.z.string().min(1),
+      hasGenerateMetadata: import_zod4.z.boolean()
     }).strict()
   ).superRefine((entries, ctx) => {
     const paths = entries.map((e) => e.nextRelativePath);
@@ -3098,7 +3142,7 @@ var moduleStructureFactsSchema = import_zod3.z.object({
     }
   }),
   routeCollectionErrors: uniqueSortedStringArray("routeCollectionErrors"),
-  rootLocales: import_zod3.z.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
+  rootLocales: import_zod4.z.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
     const names = locales.map((l) => l.locale);
     if (new Set(names).size !== names.length) {
       ctx.addIssue({ code: "custom", message: "rootLocales must be unique by locale" });
@@ -3112,7 +3156,7 @@ var moduleStructureFactsSchema = import_zod3.z.object({
     }
   }),
   rootE2e: collectedE2eFactsSchema.nullable(),
-  enhancements: import_zod3.z.array(collectedEnhancementFactsSchema).superRefine((enhancements, ctx) => {
+  enhancements: import_zod4.z.array(collectedEnhancementFactsSchema).superRefine((enhancements, ctx) => {
     const peers = enhancements.map((e) => e.peer);
     if (new Set(peers).size !== peers.length) {
       ctx.addIssue({ code: "custom", message: "enhancement peers must be unique" });
@@ -3133,10 +3177,10 @@ var moduleStructureFactsSchema = import_zod3.z.object({
     onIssue: (message) => ctx.addIssue({ code: "custom", message })
   });
 });
-var moduleStructureCollectionSchema = import_zod3.z.object({
+var moduleStructureCollectionSchema = import_zod4.z.object({
   homeLocales: uniqueSortedStringArray("homeLocales"),
-  modules: import_zod3.z.array(moduleStructureFactsSchema),
-  truncated: import_zod3.z.boolean().optional(),
+  modules: import_zod4.z.array(moduleStructureFactsSchema),
+  truncated: import_zod4.z.boolean().optional(),
   collectionErrors: uniqueSortedStringArray("collectionErrors").optional()
 }).strict().superRefine((collection, ctx) => {
   const dirs = collection.modules.map((m) => m.dirName);
@@ -3153,9 +3197,9 @@ var moduleStructureCollectionSchema = import_zod3.z.object({
 });
 
 // ../../packages/module-contract/src/locale.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 var LOCALE_BASENAME_REGEX = /^[a-z]{2,3}(-[A-Za-z0-9]+)*$/;
-var localeBasenameSchema = import_zod4.z.string().max(35).regex(LOCALE_BASENAME_REGEX, "must be a BCP47-like locale tag (e.g. en, th, en-US)");
+var localeBasenameSchema = import_zod5.z.string().max(35).regex(LOCALE_BASENAME_REGEX, "must be a BCP47-like locale tag (e.g. en, th, en-US)");
 function isValidLocaleBasename(value) {
   return localeBasenameSchema.safeParse(value).success;
 }
@@ -3558,43 +3602,43 @@ function formatRoutePageExportErrors(nextRelativePath, validation) {
 var import_typescript2 = __toESM(require("typescript"), 1);
 
 // ../../packages/module-contract/src/module-registry.ts
-var import_zod5 = require("zod");
-var projectSlugSchema2 = import_zod5.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
-var registryEnhancementSchema = import_zod5.z.object({
+var import_zod6 = require("zod");
+var projectSlugSchema2 = import_zod6.z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
+var registryEnhancementSchema = import_zod6.z.object({
   peer: moduleNameSchema,
-  active: import_zod5.z.boolean()
+  active: import_zod6.z.boolean()
 }).strict();
-var registryModuleSchema = import_zod5.z.object({
+var registryModuleSchema = import_zod6.z.object({
   name: moduleNameSchema,
   /** Installed version as recorded by the rail (non-empty string). */
-  version: import_zod5.z.string().min(1),
+  version: import_zod6.z.string().min(1),
   home: projectSlugSchema2,
   kind: moduleKindSchema,
-  mounts: import_zod5.z.array(mountSchema),
-  enhancements: import_zod5.z.array(registryEnhancementSchema)
+  mounts: import_zod6.z.array(mountSchema),
+  enhancements: import_zod6.z.array(registryEnhancementSchema)
 }).strict().superRefine((mod, ctx) => {
   for (let i = 0; i < mod.enhancements.length; i += 1) {
     if (mod.enhancements[i].peer === mod.name) {
       ctx.addIssue({
-        code: import_zod5.z.ZodIssueCode.custom,
+        code: import_zod6.z.ZodIssueCode.custom,
         message: "enhancement peer must not equal the module's own name",
         path: ["enhancements", i, "peer"]
       });
     }
   }
 });
-var generatedModuleRegistrySchema = import_zod5.z.object({
-  registryVersion: import_zod5.z.literal(1),
+var generatedModuleRegistrySchema = import_zod6.z.object({
+  registryVersion: import_zod6.z.literal(1),
   /** Rail run id, or `"manual"` for fixtures. */
-  generatedBy: import_zod5.z.string().min(1),
-  modules: import_zod5.z.array(registryModuleSchema)
+  generatedBy: import_zod6.z.string().min(1),
+  modules: import_zod6.z.array(registryModuleSchema)
 }).strict().superRefine((registry, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (let i = 0; i < registry.modules.length; i += 1) {
     const name = registry.modules[i].name;
     if (seen.has(name)) {
       ctx.addIssue({
-        code: import_zod5.z.ZodIssueCode.custom,
+        code: import_zod6.z.ZodIssueCode.custom,
         message: `duplicate module name "${name}"`,
         path: ["modules", i, "name"]
       });
@@ -3965,169 +4009,6 @@ function analyzeClientSafeEntryImports(sourceText, fileName) {
   return analyzeClientSafeEntryImportsWithTs(import_typescript3.default, sourceText, fileName);
 }
 
-// ../../packages/lib/src/shared/module-composition.ts
-var moduleRefSchema = import_zod6.z.object({
-  homeProjectId: import_zod6.z.string().uuid(),
-  moduleName: moduleNameSchema
-});
-var creationSourceBlankSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("blank")
-});
-var creationSourceBlueprintSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("blueprint"),
-  /** Internal template/fork project id — keep template naming in identifiers. */
-  blueprintProjectId: import_zod6.z.string().uuid(),
-  /**
-   * `null`/absent means every feature Module. `[]` is refused: the platform
-   * serialises it to an empty `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the
-   * enablement parser reads back as "all" (`module-enablement.ts`) — the
-   * opposite of what an empty selection means.
-   */
-  enabledModules: import_zod6.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
-});
-var creationSourceModulesSchema = import_zod6.z.object({
-  type: import_zod6.z.literal("modules"),
-  requested: import_zod6.z.array(moduleRefSchema).min(1)
-});
-var creationSourceSchema = import_zod6.z.discriminatedUnion("type", [
-  creationSourceBlankSchema,
-  creationSourceBlueprintSchema,
-  creationSourceModulesSchema
-]);
-var moduleCompositionStatusSchema = import_zod6.z.enum([
-  "pending",
-  "installing",
-  "ready",
-  "partial",
-  "failed"
-]);
-var resolvedModuleSnapshotSchema = moduleRefSchema.extend({
-  version: import_zod6.z.string().min(1),
-  homeCommitSha: import_zod6.z.string().min(1)
-});
-var moduleInstallHandoffSchema = import_zod6.z.object({
-  moduleName: import_zod6.z.string().min(1),
-  homeProjectId: import_zod6.z.string().uuid(),
-  installedVersion: import_zod6.z.string().min(1),
-  baselineSha: import_zod6.z.string().min(1),
-  mounts: import_zod6.z.array(
-    import_zod6.z.object({
-      group: import_zod6.z.string(),
-      segment: import_zod6.z.string()
-    })
-  ),
-  integration: import_zod6.z.array(import_zod6.z.string()),
-  workflows: import_zod6.z.array(import_zod6.z.string()),
-  prunedEnhancements: import_zod6.z.array(import_zod6.z.string()),
-  restoredEnhancements: import_zod6.z.array(import_zod6.z.string()).optional(),
-  permissions: import_zod6.z.array(
-    import_zod6.z.object({
-      key: import_zod6.z.string().min(1),
-      description: import_zod6.z.string().min(1)
-    })
-  ).optional()
-});
-var moduleCompositionRunAttemptSchema = import_zod6.z.object({
-  module: moduleRefSchema,
-  runId: import_zod6.z.string().min(1),
-  status: import_zod6.z.string().min(1),
-  schemaApplied: import_zod6.z.boolean(),
-  error: import_zod6.z.string().optional(),
-  /** Prefer full ModuleInstallHandoff; identity fields optional for older rows. */
-  handoff: moduleInstallHandoffSchema.partial({ moduleName: true, homeProjectId: true }).optional()
-});
-var initialModuleCompositionSchema = import_zod6.z.object({
-  version: import_zod6.z.literal(1),
-  status: moduleCompositionStatusSchema,
-  requested: import_zod6.z.array(moduleRefSchema).min(1),
-  resolved: import_zod6.z.array(resolvedModuleSnapshotSchema),
-  installOrder: import_zod6.z.array(moduleRefSchema),
-  runs: import_zod6.z.array(moduleCompositionRunAttemptSchema).default([]),
-  /**
-   * True when any failed/partial attempt applied schema before failing.
-   * Never claim transactional rollback across git/schema.
-   */
-  schemaApplied: import_zod6.z.boolean().default(false),
-  /**
-   * Present when retry would silently change pinned home SHAs — caller must
-   * reconfirm the new plan rather than continue.
-   */
-  reconfirmationRequired: import_zod6.z.object({
-    reason: import_zod6.z.string(),
-    previous: import_zod6.z.array(resolvedModuleSnapshotSchema),
-    next: import_zod6.z.array(resolvedModuleSnapshotSchema)
-  }).optional(),
-  error: import_zod6.z.string().optional(),
-  /**
-   * First-turn system handoff lifecycle. Absent/`pending` means inject when
-   * status is ready; `consumed` means a successful agent turn already used it.
-   */
-  systemHandoffStatus: import_zod6.z.enum(["pending", "consumed"]).optional(),
-  /**
-   * CAS ownership token for concurrent retry attempts. Only the attempt that
-   * currently owns this value may reset or compensate durable composition state.
-   */
-  retryAttemptId: import_zod6.z.string().min(1).optional(),
-  /**
-   * When the current `installing` attempt was claimed. A setup run that dies
-   * with its host (a killed Vercel instance) leaves the composition `installing`
-   * forever, and the creating page's poll only stops on ready/partial/failed —
-   * so staleness, not a queue's stall detector, is what settles it. Absent on
-   * rows claimed before this field existed; treated as stale.
-   */
-  attemptStartedAt: import_zod6.z.string().datetime().optional(),
-  /** Outside-module files the agent changed during connection work. */
-  integrationFiles: import_zod6.z.array(import_zod6.z.string()).optional(),
-  verificationSummary: import_zod6.z.string().optional()
-});
-var MODULE_SETUP_ATTEMPT_STALE_MS = 10 * 60 * 1e3;
-
-// ../../packages/lib/src/shared/compose-inputs.ts
-var import_zod7 = require("zod");
-var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
-var composeInputsSchema = import_zod7.z.strictObject({
-  connectedStores: import_zod7.z.array(
-    import_zod7.z.strictObject({
-      storeId: import_zod7.z.string().min(1),
-      slug: import_zod7.z.string().min(1),
-      // A row with an empty binding key must not fail a deploy: the rail
-      // treats falsy as "no binding key", so normalise rather than reject.
-      bindingKey: import_zod7.z.string().nullish().transform((value) => value || null),
-      accessLevel: import_zod7.z.enum(["read", "write", "admin"]),
-      // Defaulted so a file written before the platform emitted store types
-      // (database rows only) still parses. The platform starts writing
-      // storage rows, with `type` set, once forks run a compose that reads it.
-      type: import_zod7.z.enum(["database", "storage"]).default("database")
-    })
-  ).default([]),
-  installs: import_zod7.z.record(
-    import_zod7.z.string(),
-    import_zod7.z.strictObject({
-      installedVersion: import_zod7.z.string().min(1),
-      datastoreBindings: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).nullish()
-    })
-  ).default({})
-});
-var STUB_IGNORE_PATH = "apps/web/src/app/.gitignore";
-var STUB_IGNORE_HEADER = "# Generated by stardeck-compose \u2014 Module-rail stubs are build outputs; do not edit or commit them.";
-function escapeStubIgnorePattern(pattern) {
-  const escaped = pattern.replace(/[\\[\]*?]/g, (char) => `\\${char}`);
-  return /^[#!]/.test(escaped) ? `\\${escaped}` : escaped;
-}
-function buildStubIgnore(artifactPaths) {
-  const prefix = "apps/web/src/app/";
-  const entries = artifactPaths.filter((artifact) => artifact.startsWith(prefix)).map((artifact) => escapeStubIgnorePattern(`/${artifact.slice(prefix.length)}`)).sort();
-  return [STUB_IGNORE_HEADER, ...entries].join("\n") + "\n";
-}
-
-// ../../packages/lib/src/shared/module-enablement.ts
-function isModuleEnabledByList(raw, name, kindOf) {
-  if (!raw) return true;
-  const kind = kindOf(name);
-  if (kind != null && kind !== "feature") return true;
-  return raw.split(",").includes(name);
-}
-
 // ../../packages/lib/src/shared/platform-owned-paths.ts
 var APP_WEB_PREFIX = "apps/web/";
 var MODULE_STUB_MARKER = "@stardeck-module-rail-generated";
@@ -6054,6 +5935,50 @@ function rejectPseudoModuleEntries(entries, parentDir, label) {
   return dirs;
 }
 
+// ../../packages/lib/src/shared/module-composition.ts
+var import_zod7 = require("zod");
+var creationSourceBlankSchema = import_zod7.z.object({
+  type: import_zod7.z.literal("blank")
+});
+var creationSourceBlueprintSchema = import_zod7.z.object({
+  type: import_zod7.z.literal("blueprint"),
+  /** Internal template/fork project id — keep template naming in identifiers. */
+  blueprintProjectId: import_zod7.z.string().uuid(),
+  /**
+   * `null`/absent means every feature Module. `[]` is refused: the platform
+   * serialises it to an empty `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the
+   * enablement parser reads back as "all" (`module-enablement.ts`) — the
+   * opposite of what an empty selection means.
+   */
+  enabledModules: import_zod7.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+});
+var creationSourceSchema = import_zod7.z.discriminatedUnion("type", [
+  creationSourceBlankSchema,
+  creationSourceBlueprintSchema
+]);
+var moduleInstallHandoffSchema = import_zod7.z.object({
+  moduleName: import_zod7.z.string().min(1),
+  homeProjectId: import_zod7.z.string().uuid(),
+  installedVersion: import_zod7.z.string().min(1),
+  baselineSha: import_zod7.z.string().min(1),
+  mounts: import_zod7.z.array(
+    import_zod7.z.object({
+      group: import_zod7.z.string(),
+      segment: import_zod7.z.string()
+    })
+  ),
+  integration: import_zod7.z.array(import_zod7.z.string()),
+  workflows: import_zod7.z.array(import_zod7.z.string()),
+  prunedEnhancements: import_zod7.z.array(import_zod7.z.string()),
+  restoredEnhancements: import_zod7.z.array(import_zod7.z.string()).optional(),
+  permissions: import_zod7.z.array(
+    import_zod7.z.object({
+      key: import_zod7.z.string().min(1),
+      description: import_zod7.z.string().min(1)
+    })
+  ).optional()
+});
+
 // ../../packages/lib/src/shared/schema-ops.ts
 var import_zod8 = require("zod");
 var columnSpecSchema = import_zod8.z.object({
@@ -7517,6 +7442,9 @@ async function reconcileCompositionArtifacts(context, options = {}) {
 var HOME_I18N_SUBSTRATE_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/substrate`;
 var HOME_I18N_MESSAGES_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/messages`;
 
+// src/index.ts
+var import_typescript6 = __toESM(require("typescript"));
+
 // src/module-boundaries.ts
 var import_node_fs2 = __toESM(require("fs"));
 var import_node_path2 = __toESM(require("path"));
@@ -7786,6 +7714,41 @@ function assertNoAppLayerImporters(cwd, excluded) {
     );
   }
 }
+var TSCONFIG_PATH = "apps/web/tsconfig.json";
+var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
+var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+function writeBuildTsconfig(cwd, excluded) {
+  const baseFile = import_node_path3.default.join(cwd, TSCONFIG_PATH);
+  if (!import_node_fs3.default.existsSync(import_node_path3.default.join(cwd, MODULES_DIR2)) || !import_node_fs3.default.existsSync(baseFile)) return;
+  const base = import_typescript6.default.readConfigFile(baseFile, import_typescript6.default.sys.readFile);
+  if (base.error) {
+    throw new Error(
+      `[compose] cannot read ${TSCONFIG_PATH}: ${import_typescript6.default.flattenDiagnosticMessageText(base.error.messageText, "\n")}`
+    );
+  }
+  const baseExclude = base.config?.exclude ?? ["node_modules"];
+  const modulesDir = import_node_path3.default.posix.relative("apps/web", MODULES_DIR2);
+  const config = {
+    extends: "./tsconfig.json",
+    exclude: [
+      ...baseExclude,
+      ...excluded.flatMap((name) => [
+        `${modulesDir}/${name}`,
+        `${modulesDir}/*/enhancements/${name}`
+      ])
+    ]
+  };
+  const content = `${BUILD_TSCONFIG_HEADER}
+${JSON.stringify(config, null, 2)}
+`;
+  const file = import_node_path3.default.join(cwd, BUILD_TSCONFIG_PATH);
+  if (!import_node_fs3.default.existsSync(file) || import_node_fs3.default.readFileSync(file, "utf8") !== content) {
+    import_node_fs3.default.writeFileSync(file, content);
+  }
+  console.log(
+    `[compose] ${BUILD_TSCONFIG_PATH} excludes ${excluded.length} Module(s): ${excluded.join(",") || "none"}`
+  );
+}
 function removeDir(absolute) {
   if (!import_node_fs3.default.existsSync(absolute)) return false;
   import_node_fs3.default.rmSync(absolute, { recursive: true, force: true });
@@ -7833,6 +7796,7 @@ async function compose(options) {
     skipComposeInputs: true
   });
   const gitignoreEntries = options.enabled ? null : writeStubGitignore(options.cwd, result.artifactPaths);
+  writeBuildTsconfig(options.cwd, result.excludedModules);
   let pruned = 0;
   if (options.prune) {
     for (const name of result.excludedModules) {
@@ -7855,6 +7819,7 @@ async function compose(options) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BUILD_TSCONFIG_PATH,
   COMPOSE_INPUTS_PATH,
   assertSupportedTypescript,
   compose,