@stardeck-customer-apps/compose 0.9.0 → 0.11.0

package/dist/index.mjs

@@ -2080,11 +2080,54 @@ function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
-// ../../packages/lib/src/shared/module-composition.ts
-import { z as z6 } from "zod";
+// ../../packages/lib/src/shared/compose-inputs.ts
+import { z } from "zod";
+var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
+var composeInputsSchema = z.strictObject({
+  connectedStores: z.array(
+    z.strictObject({
+      storeId: z.string().min(1),
+      slug: z.string().min(1),
+      // A row with an empty binding key must not fail a deploy: the rail
+      // treats falsy as "no binding key", so normalise rather than reject.
+      bindingKey: z.string().nullish().transform((value) => value || null),
+      accessLevel: z.enum(["read", "write", "admin"]),
+      // Defaulted so a file written before the platform emitted store types
+      // (database rows only) still parses. The platform starts writing
+      // storage rows, with `type` set, once forks run a compose that reads it.
+      type: z.enum(["database", "storage"]).default("database")
+    })
+  ).default([]),
+  installs: z.record(
+    z.string(),
+    z.strictObject({
+      installedVersion: z.string().min(1),
+      datastoreBindings: z.record(z.string(), z.string()).nullish()
+    })
+  ).default({})
+});
+var STUB_IGNORE_PATH = "apps/web/src/app/.gitignore";
+var STUB_IGNORE_HEADER = "# Generated by stardeck-compose \u2014 Module-rail stubs are build outputs; do not edit or commit them.";
+function escapeStubIgnorePattern(pattern) {
+  const escaped = pattern.replace(/[\\[\]*?]/g, (char) => `\\${char}`);
+  return /^[#!]/.test(escaped) ? `\\${escaped}` : escaped;
+}
+function buildStubIgnore(artifactPaths) {
+  const prefix = "apps/web/src/app/";
+  const entries = artifactPaths.filter((artifact) => artifact.startsWith(prefix)).map((artifact) => escapeStubIgnorePattern(`/${artifact.slice(prefix.length)}`)).sort();
+  return [STUB_IGNORE_HEADER, ...entries].join("\n") + "\n";
+}
+
+// ../../packages/lib/src/shared/module-enablement.ts
+function isModuleEnabledByList(raw, name, kindOf) {
+  if (!raw) return true;
+  const kind = kindOf(name);
+  if (kind != null && kind !== "feature") return true;
+  return raw.split(",").includes(name);
+}
 
 // ../../packages/module-contract/src/module-manifest.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // ../../packages/module-contract/src/slug.ts
 function validateSlug(slug) {
@@ -2119,13 +2162,13 @@ var ROUTE_GROUP_REGEX = /^\([a-z0-9-]+\)$/;
 var ENDPOINT_STATIC_SEGMENT_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var ENDPOINT_PARAM_NAME_REGEX = /^[a-z][a-z0-9_-]*$/;
 var ENDPOINT_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-var moduleNameSchema = z.string().max(40).regex(KEBAB_SLUG_REGEX, "must be a kebab-case slug (lowercase letters, digits, hyphens)");
+var moduleNameSchema = z2.string().max(40).regex(KEBAB_SLUG_REGEX, "must be a kebab-case slug (lowercase letters, digits, hyphens)");
 function isValidModuleName(value) {
   return moduleNameSchema.safeParse(value).success;
 }
-var projectSlugSchema = z.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
-var moduleKindSchema = z.enum(["feature", "library", "contract"]);
-var endpointMethodSchema = z.enum(ENDPOINT_METHODS);
+var projectSlugSchema = z2.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
+var moduleKindSchema = z2.enum(["feature", "library", "contract"]);
+var endpointMethodSchema = z2.enum(ENDPOINT_METHODS);
 function endpointPathValidationError(path4) {
   if (!path4.startsWith("/api/")) {
     return 'must begin with "/api/"';
@@ -2210,21 +2253,21 @@ function normalizeEndpointPathForCollision(path4) {
     return segment;
   }).join("/");
 }
-var endpointPathSchema = z.string().superRefine((path4, ctx) => {
+var endpointPathSchema = z2.string().superRefine((path4, ctx) => {
   const error = endpointPathValidationError(path4);
   if (error != null) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: error });
   }
 });
-var endpointClaimSchema = z.object({
+var endpointClaimSchema = z2.object({
   path: endpointPathSchema,
-  methods: z.array(endpointMethodSchema).min(1, "methods must be non-empty").superRefine((methods, ctx) => {
+  methods: z2.array(endpointMethodSchema).min(1, "methods must be non-empty").superRefine((methods, ctx) => {
     const seen = /* @__PURE__ */ new Set();
     for (let i = 0; i < methods.length; i += 1) {
       const method = methods[i];
       if (seen.has(method)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `duplicate method "${method}"`,
           path: [i]
         });
@@ -2261,14 +2304,14 @@ function mountSegmentValidationError(segment) {
   }
   return null;
 }
-var mountSegmentSchema = z.string().superRefine((segment, ctx) => {
+var mountSegmentSchema = z2.string().superRefine((segment, ctx) => {
   const error = mountSegmentValidationError(segment);
   if (error != null) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: error });
   }
 });
-var mountSchema = z.object({
-  group: z.string().regex(ROUTE_GROUP_REGEX, 'must be a Next.js route group like "(admin)"'),
+var mountSchema = z2.object({
+  group: z2.string().regex(ROUTE_GROUP_REGEX, 'must be a Next.js route group like "(admin)"'),
   segment: mountSegmentSchema
 }).strict();
 function splitMountSegment(segment) {
@@ -2281,21 +2324,21 @@ function splitMountSegment(segment) {
   }
   return segment.split("/");
 }
-var tableNameSchema = z.string().regex(SNAKE_TABLE_REGEX, "must be snake_case");
+var tableNameSchema = z2.string().regex(SNAKE_TABLE_REGEX, "must be snake_case");
 var NPM_PACKAGE_NAME_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-var npmPackageNameSchema = z.string().max(214).regex(NPM_PACKAGE_NAME_REGEX, "must be a valid npm package name");
-var descriptionSchema = z.string().max(200, "must be at most 200 characters").refine((value) => value.trim().length > 0, "must be non-empty after trimming");
-var crossAppSchema = z.object({
-  exposes: z.array(z.unknown()).max(0, "must be empty until cross-app contracts are defined"),
-  consumes: z.array(z.unknown()).max(0, "must be empty until cross-app contracts are defined")
+var npmPackageNameSchema = z2.string().max(214).regex(NPM_PACKAGE_NAME_REGEX, "must be a valid npm package name");
+var descriptionSchema = z2.string().max(200, "must be at most 200 characters").refine((value) => value.trim().length > 0, "must be non-empty after trimming");
+var crossAppSchema = z2.object({
+  exposes: z2.array(z2.unknown()).max(0, "must be empty until cross-app contracts are defined"),
+  consumes: z2.array(z2.unknown()).max(0, "must be empty until cross-app contracts are defined")
 }).strict();
-var enhancementWorkflowsSchema = z.record(moduleNameSchema, z.array(z.string().min(1))).default({});
-var enhancementEndpointsSchema = z.record(moduleNameSchema, z.array(endpointClaimSchema)).default({});
-var datastoreRequirementSchema = z.object({
+var enhancementWorkflowsSchema = z2.record(moduleNameSchema, z2.array(z2.string().min(1))).default({});
+var enhancementEndpointsSchema = z2.record(moduleNameSchema, z2.array(endpointClaimSchema)).default({});
+var datastoreRequirementSchema = z2.object({
   /** Logical name, module-local, snake_case. Never a physical store key. */
   id: tableNameSchema,
   /** "app" = this project's app-local store; "org" = an org-level shared store. */
-  scope: z.enum(["app", "org"]).default("app"),
+  scope: z2.enum(["app", "org"]).default("app"),
   /**
    * Which kind of connected store satisfies this requirement. A "database"
    * requirement only ever binds to a database store and a "storage" one
@@ -2303,34 +2346,34 @@ var datastoreRequirementSchema = z.object({
    * rail never crosses the two. Defaults to "database", the only kind the
    * rail resolved before this field existed.
    */
-  type: z.enum(["database", "storage"]).default("database"),
+  type: z2.enum(["database", "storage"]).default("database"),
   /** true → install fails when no store resolves; false → binding omitted, module degrades. */
-  required: z.boolean().default(true),
+  required: z2.boolean().default(true),
   /** Checked against the connected store's accessLevel at install. */
-  access: z.enum(["read", "write", "admin"]).default("write")
+  access: z2.enum(["read", "write", "admin"]).default("write")
 }).strict();
-var permissionClaimSchema = z.object({
+var permissionClaimSchema = z2.object({
   /**
    * Lowercase resource:action with one colon and no underscores. This grammar
    * is deliberately narrower than the platform permission tool's charset.
    */
-  key: z.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
+  key: z2.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
   /** Human label for the deployment auth config row. */
   description: descriptionSchema
 }).strict();
-var seedBundleSchema = z.object({
+var seedBundleSchema = z2.object({
   table: tableNameSchema,
   /** Columns forming the ON CONFLICT key — must appear in every row. */
-  conflictTarget: z.array(z.string().min(1)).min(1),
+  conflictTarget: z2.array(z2.string().min(1)).min(1),
   /** Scalar JSON values only (no nested objects/arrays). */
-  rows: z.array(z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()]))).min(1)
+  rows: z2.array(z2.record(z2.string(), z2.union([z2.string(), z2.number(), z2.boolean(), z2.null()]))).min(1)
 }).strict().superRefine((bundle, ctx) => {
   const rowKeys = bundle.rows.map((row) => Object.keys(row).sort().join("\0"));
   const canonical = rowKeys[0];
   for (let i = 1; i < rowKeys.length; i += 1) {
     if (rowKeys[i] !== canonical) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "all rows in a seed bundle must have identical key sets",
         path: ["rows", i]
       });
@@ -2342,7 +2385,7 @@ var seedBundleSchema = z.object({
     for (const col of bundle.conflictTarget) {
       if (!keys.has(col)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `conflictTarget column "${col}" must be present in every row`,
           path: ["rows", i]
         });
@@ -2350,35 +2393,35 @@ var seedBundleSchema = z.object({
     }
   }
 });
-var moduleManifestSchema = z.object({
+var moduleManifestSchema = z2.object({
   name: moduleNameSchema,
   kind: moduleKindSchema,
   // Release versions are platform-owned in module_versions. Accept this
   // legacy field while existing Module source ages out, but strip it from the
   // parsed contract so no runtime can treat module.json as version authority.
-  version: z.unknown().optional(),
+  version: z2.unknown().optional(),
   home: projectSlugSchema,
   /** Machine-checkable purpose line — required, ≤200 code units, non-blank when trimmed. */
   description: descriptionSchema,
-  uses: z.array(moduleNameSchema).default([]),
+  uses: z2.array(moduleNameSchema).default([]),
   /**
    * Soft peers: this module ships `enhancements/<peer>/` directories that are
    * composition-pruned — the installer includes them only when the peer is
    * present, so the peer is NOT an install-time requirement. Disjoint from
    * `uses`; entries may name modules absent from the composition.
    */
-  enhancements: z.array(moduleNameSchema).default([]),
-  tables: z.array(tableNameSchema).default([]),
-  mounts: z.array(mountSchema).default([]),
-  integration: z.array(z.string()).default([]),
-  workflows: z.array(z.string().min(1)).default([]),
+  enhancements: z2.array(moduleNameSchema).default([]),
+  tables: z2.array(tableNameSchema).default([]),
+  mounts: z2.array(mountSchema).default([]),
+  integration: z2.array(z2.string()).default([]),
+  workflows: z2.array(z2.string().min(1)).default([]),
   /**
    * Slice-scoped workflow names keyed by peer. Keys must be ⊆ `enhancements`;
    * names must be unique across root `workflows` and every slice list.
    */
   enhancementWorkflows: enhancementWorkflowsSchema,
   /** Root API endpoint path claims. */
-  endpoints: z.array(endpointClaimSchema).default([]),
+  endpoints: z2.array(endpointClaimSchema).default([]),
   /**
    * Slice-scoped endpoint claims keyed by peer. Keys must be ⊆ `enhancements`;
    * normalized paths must be unique across root and every slice.
@@ -2394,38 +2437,44 @@ var moduleManifestSchema = z.object({
    * to a physical connected store and generates module-datastores.gen.ts;
    * unlike seeds, this field drives generated output.
    */
-  datastores: z.array(datastoreRequirementSchema).optional(),
+  datastores: z2.array(datastoreRequirementSchema).optional(),
   /**
    * Keys this module's guards enforce. Install registers them in deployment
    * auth config; registration only — declaring is never granting.
    */
-  permissions: z.array(permissionClaimSchema).optional(),
+  permissions: z2.array(permissionClaimSchema).optional(),
   /**
    * Optional starter rows for tables this module owns. Replay is
    * `INSERT ... ON CONFLICT (conflictTarget) DO NOTHING` — idempotent by
    * construction; the rail (not this schema) performs the replay.
    */
-  seeds: z.array(seedBundleSchema).optional(),
+  seeds: z2.array(seedBundleSchema).optional(),
   /** npm packages the source imports beyond the base app. Names only; the rail installs each at the home app's range. */
-  packages: z.array(npmPackageNameSchema).optional(),
+  packages: z2.array(npmPackageNameSchema).optional(),
   /**
    * UI-layer contract. `separable: true` asserts the Module's components/ and
    * routes/ hold presentation only — the Blueprint's
    * `module-boundaries/ui-layer` lint rule enforces it — so a fork may
    * soft-eject them. See docs/module-ui-soft-eject-plan.md.
    */
-  ui: z.object({ separable: z.boolean() }).strict().optional()
+  ui: z2.object({ separable: z2.boolean() }).strict().optional(),
+  /**
+   * `false` keeps a feature Module off in a new Blueprint fork unless the
+   * creator ticks it: the fork picker leaves it unchecked and "every Module"
+   * is written out without it. Omitted means on. Library Modules are always on.
+   */
+  defaultEnabled: z2.boolean().optional()
 }).strict().superRefine((manifest, ctx) => {
   if (manifest.uses.includes(manifest.name)) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "a module cannot list itself in uses",
       path: ["uses"]
     });
   }
   if (manifest.enhancements.includes(manifest.name)) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "a module cannot list itself in enhancements",
       path: ["enhancements"]
     });
@@ -2433,7 +2482,7 @@ var moduleManifestSchema = z.object({
   const hardAndSoft = manifest.enhancements.filter((peer) => manifest.uses.includes(peer));
   if (hardAndSoft.length > 0) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: `uses and enhancements must be disjoint (a peer is either a hard dep or a soft one): ${hardAndSoft.join(", ")}`,
       path: ["enhancements"]
     });
@@ -2442,7 +2491,7 @@ var moduleManifestSchema = z.object({
   for (const peer of Object.keys(manifest.enhancementWorkflows)) {
     if (!enhancementPeers.has(peer)) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: `enhancementWorkflows key "${peer}" must be listed in enhancements`,
         path: ["enhancementWorkflows", peer]
       });
@@ -2451,7 +2500,7 @@ var moduleManifestSchema = z.object({
   for (const peer of Object.keys(manifest.enhancementEndpoints)) {
     if (!enhancementPeers.has(peer)) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: `enhancementEndpoints key "${peer}" must be listed in enhancements`,
         path: ["enhancementEndpoints", peer]
       });
@@ -2462,7 +2511,7 @@ var moduleManifestSchema = z.object({
     const existing = seenWorkflows.get(name);
     if (existing != null) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: `duplicate workflow name "${name}" (also at ${existing})`,
         path: path4
       });
@@ -2489,7 +2538,7 @@ var moduleManifestSchema = z.object({
     const existing = seenEndpointKeys.get(key);
     if (existing != null) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: `duplicate normalized endpoint path "${key}" (also at ${existing})`,
         path: path4
       });
@@ -2511,7 +2560,7 @@ var moduleManifestSchema = z.object({
       const id = manifest.datastores[i].id;
       if (seenDatastoreIds.has(id)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `duplicate datastore id "${id}"`,
           path: ["datastores", i, "id"]
         });
@@ -2526,7 +2575,7 @@ var moduleManifestSchema = z.object({
       const key = manifest.permissions[i].key;
       if (seenPermissionKeys.has(key)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `duplicate permission key "${key}"`,
           path: ["permissions", i, "key"]
         });
@@ -2538,35 +2587,35 @@ var moduleManifestSchema = z.object({
   if (manifest.kind === "library") {
     if (manifest.tables.length > 0) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "library modules must not declare tables",
         path: ["tables"]
       });
     }
     if (manifest.mounts.length > 0) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "library modules must not declare mounts",
         path: ["mounts"]
       });
     }
     if (manifest.seeds != null && manifest.seeds.length > 0) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "library modules must not declare seeds",
         path: ["seeds"]
       });
     }
     if (manifest.datastores != null && manifest.datastores.length > 0) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "library modules must not declare datastores",
         path: ["datastores"]
       });
     }
     if (manifest.permissions != null && manifest.permissions.length > 0) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: "library modules must not declare permissions",
         path: ["permissions"]
       });
@@ -2574,7 +2623,7 @@ var moduleManifestSchema = z.object({
   }
   if (manifest.kind === "contract" && manifest.mounts.length > 0) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "contract modules must not declare mounts",
       path: ["mounts"]
     });
@@ -2585,7 +2634,7 @@ var moduleManifestSchema = z.object({
       const bundle = manifest.seeds[i];
       if (!ownedTables.has(bundle.table)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `seeds may only target tables listed in tables (got "${bundle.table}")`,
           path: ["seeds", i, "table"]
         });
@@ -2636,10 +2685,10 @@ var MANDATORY_MODULE_CHECK_DESCRIPTORS = Object.freeze([
 ]);
 
 // ../../packages/module-contract/src/module-structure.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // ../../packages/module-contract/src/module-e2e-manifest.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 function e2eSpecFileValidationError(file) {
   if (file.length === 0) {
     return "must be a non-empty relative path ending in .spec.ts";
@@ -2667,22 +2716,22 @@ function e2eSpecFileValidationError(file) {
   }
   return null;
 }
-var e2eSpecFileSchema = z2.string().superRefine((file, ctx) => {
+var e2eSpecFileSchema = z3.string().superRefine((file, ctx) => {
   const error = e2eSpecFileValidationError(file);
   if (error != null) {
-    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: z3.ZodIssueCode.custom, message: error });
   }
 });
-var e2eSpecSchema = z2.object({
+var e2eSpecSchema = z3.object({
   file: e2eSpecFileSchema,
-  requires: z2.array(moduleNameSchema).min(1, "requires must be non-empty")
+  requires: z3.array(moduleNameSchema).min(1, "requires must be non-empty")
 }).strict().superRefine((spec, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (let i = 0; i < spec.requires.length; i += 1) {
     const name = spec.requires[i];
     if (seen.has(name)) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         message: `duplicate requirement "${name}"`,
         path: ["requires", i]
       });
@@ -2691,15 +2740,15 @@ var e2eSpecSchema = z2.object({
     }
   }
 });
-var moduleE2eManifestSchema = z2.object({
-  specs: z2.array(e2eSpecSchema).min(1, "specs must contain at least one entry")
+var moduleE2eManifestSchema = z3.object({
+  specs: z3.array(e2eSpecSchema).min(1, "specs must contain at least one entry")
 }).strict().superRefine((manifest, ctx) => {
   const seenFiles = /* @__PURE__ */ new Set();
   for (let i = 0; i < manifest.specs.length; i += 1) {
     const file = manifest.specs[i].file;
     if (seenFiles.has(file)) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         message: `duplicate file "${file}"`,
         path: ["specs", i, "file"]
       });
@@ -2941,7 +2990,7 @@ function compareCodeUnit(a, b) {
 // ../../packages/module-contract/src/module-structure.ts
 var MODULE_STRUCTURE_JSON_BYTE_CAP = 64 * 1024;
 function uniqueSortedStringArray(label) {
-  return z3.array(z3.string()).superRefine((arr, ctx) => {
+  return z4.array(z4.string()).superRefine((arr, ctx) => {
     if (new Set(arr).size !== arr.length) {
       ctx.addIssue({ code: "custom", message: `${label} must be unique` });
       return;
@@ -2957,10 +3006,10 @@ function uniqueSortedStringArray(label) {
   });
 }
 function contributionPermissionsSchema(label) {
-  return z3.array(
-    z3.object({
-      contributionId: z3.string().min(1),
-      permission: z3.string().min(1)
+  return z4.array(
+    z4.object({
+      contributionId: z4.string().min(1),
+      permission: z4.string().min(1)
     }).strict()
   ).superRefine((entries, ctx) => {
     const keys = entries.map((entry) => `${entry.contributionId}\0${entry.permission}`);
@@ -2978,17 +3027,17 @@ function contributionPermissionsSchema(label) {
     }
   }).optional();
 }
-var collectedFilePayloadSchema = z3.discriminatedUnion("status", [
-  z3.object({ status: z3.literal("ok"), text: z3.string() }).strict(),
-  z3.object({ status: z3.literal("missing") }).strict(),
-  z3.object({ status: z3.literal("too-large") }).strict(),
-  z3.object({ status: z3.literal("unreadable") }).strict()
+var collectedFilePayloadSchema = z4.discriminatedUnion("status", [
+  z4.object({ status: z4.literal("ok"), text: z4.string() }).strict(),
+  z4.object({ status: z4.literal("missing") }).strict(),
+  z4.object({ status: z4.literal("too-large") }).strict(),
+  z4.object({ status: z4.literal("unreadable") }).strict()
 ]);
-var collectedLocaleFileSchema = z3.object({
-  locale: z3.string().min(1),
+var collectedLocaleFileSchema = z4.object({
+  locale: z4.string().min(1),
   payload: collectedFilePayloadSchema
 }).strict();
-var collectedE2eFactsSchema = z3.object({
+var collectedE2eFactsSchema = z4.object({
   manifest: collectedFilePayloadSchema,
   specFiles: uniqueSortedStringArray("specFiles"),
   escapingSymlinks: uniqueSortedStringArray("escapingSymlinks")
@@ -3010,20 +3059,20 @@ function validateRouteExportEvidenceCongruence(input) {
     }
   }
 }
-var collectedEnhancementFactsSchema = z3.object({
-  peer: z3.string().min(1),
-  hasContributionsTs: z3.boolean(),
+var collectedEnhancementFactsSchema = z4.object({
+  peer: z4.string().min(1),
+  hasContributionsTs: z4.boolean(),
   contributionPermissions: contributionPermissionsSchema("enhancement contributionPermissions"),
-  hasInitializeServerTs: z3.boolean(),
+  hasInitializeServerTs: z4.boolean(),
   contributionsCollectionErrors: uniqueSortedStringArray(
     "enhancement contributionsCollectionErrors"
   ),
   initializeServerCollectionErrors: uniqueSortedStringArray(
     "enhancement initializeServerCollectionErrors"
   ),
-  hasRoutesDir: z3.boolean(),
+  hasRoutesDir: z4.boolean(),
   routeCollectionErrors: uniqueSortedStringArray("enhancement routeCollectionErrors"),
-  locales: z3.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
+  locales: z4.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
     const names = locales.map((l) => l.locale);
     if (new Set(names).size !== names.length) {
       ctx.addIssue({ code: "custom", message: "enhancement locales must be unique by locale" });
@@ -3038,27 +3087,27 @@ var collectedEnhancementFactsSchema = z3.object({
   }),
   e2e: collectedE2eFactsSchema.nullable()
 }).strict();
-var moduleStructureFactsSchema = z3.object({
-  collected: z3.literal(true),
-  dirName: z3.string().min(1),
-  hasIndexTs: z3.boolean(),
-  hasContributionsTs: z3.boolean(),
+var moduleStructureFactsSchema = z4.object({
+  collected: z4.literal(true),
+  dirName: z4.string().min(1),
+  hasIndexTs: z4.boolean(),
+  hasContributionsTs: z4.boolean(),
   contributionPermissions: contributionPermissionsSchema("contributionPermissions"),
-  hasSlotsTs: z3.boolean(),
+  hasSlotsTs: z4.boolean(),
   contributionsCollectionErrors: uniqueSortedStringArray("contributionsCollectionErrors"),
   slotsCollectionErrors: uniqueSortedStringArray("slotsCollectionErrors"),
-  hasTestsDir: z3.boolean(),
-  hasDatastoreDir: z3.boolean(),
-  datastoreFileCount: z3.number().int().nonnegative(),
-  hasServerIndexTs: z3.boolean(),
-  hasOtherServerTs: z3.boolean(),
-  hasE2eDir: z3.boolean(),
-  hasRoutesDir: z3.boolean(),
+  hasTestsDir: z4.boolean(),
+  hasDatastoreDir: z4.boolean(),
+  datastoreFileCount: z4.number().int().nonnegative(),
+  hasServerIndexTs: z4.boolean(),
+  hasOtherServerTs: z4.boolean(),
+  hasE2eDir: z4.boolean(),
+  hasRoutesDir: z4.boolean(),
   routeEntries: uniqueSortedStringArray("routeEntries"),
-  routePageExports: z3.array(
-    z3.object({
-      nextRelativePath: z3.string().min(1),
-      hasGenerateMetadata: z3.boolean()
+  routePageExports: z4.array(
+    z4.object({
+      nextRelativePath: z4.string().min(1),
+      hasGenerateMetadata: z4.boolean()
     }).strict()
   ).superRefine((entries, ctx) => {
     const paths = entries.map((e) => e.nextRelativePath);
@@ -3080,7 +3129,7 @@ var moduleStructureFactsSchema = z3.object({
     }
   }),
   routeCollectionErrors: uniqueSortedStringArray("routeCollectionErrors"),
-  rootLocales: z3.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
+  rootLocales: z4.array(collectedLocaleFileSchema).superRefine((locales, ctx) => {
     const names = locales.map((l) => l.locale);
     if (new Set(names).size !== names.length) {
       ctx.addIssue({ code: "custom", message: "rootLocales must be unique by locale" });
@@ -3094,7 +3143,7 @@ var moduleStructureFactsSchema = z3.object({
     }
   }),
   rootE2e: collectedE2eFactsSchema.nullable(),
-  enhancements: z3.array(collectedEnhancementFactsSchema).superRefine((enhancements, ctx) => {
+  enhancements: z4.array(collectedEnhancementFactsSchema).superRefine((enhancements, ctx) => {
     const peers = enhancements.map((e) => e.peer);
     if (new Set(peers).size !== peers.length) {
       ctx.addIssue({ code: "custom", message: "enhancement peers must be unique" });
@@ -3115,10 +3164,10 @@ var moduleStructureFactsSchema = z3.object({
     onIssue: (message) => ctx.addIssue({ code: "custom", message })
   });
 });
-var moduleStructureCollectionSchema = z3.object({
+var moduleStructureCollectionSchema = z4.object({
   homeLocales: uniqueSortedStringArray("homeLocales"),
-  modules: z3.array(moduleStructureFactsSchema),
-  truncated: z3.boolean().optional(),
+  modules: z4.array(moduleStructureFactsSchema),
+  truncated: z4.boolean().optional(),
   collectionErrors: uniqueSortedStringArray("collectionErrors").optional()
 }).strict().superRefine((collection, ctx) => {
   const dirs = collection.modules.map((m) => m.dirName);
@@ -3135,9 +3184,9 @@ var moduleStructureCollectionSchema = z3.object({
 });
 
 // ../../packages/module-contract/src/locale.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var LOCALE_BASENAME_REGEX = /^[a-z]{2,3}(-[A-Za-z0-9]+)*$/;
-var localeBasenameSchema = z4.string().max(35).regex(LOCALE_BASENAME_REGEX, "must be a BCP47-like locale tag (e.g. en, th, en-US)");
+var localeBasenameSchema = z5.string().max(35).regex(LOCALE_BASENAME_REGEX, "must be a BCP47-like locale tag (e.g. en, th, en-US)");
 function isValidLocaleBasename(value) {
   return localeBasenameSchema.safeParse(value).success;
 }
@@ -3540,43 +3589,43 @@ function formatRoutePageExportErrors(nextRelativePath, validation) {
 import ts2 from "typescript";
 
 // ../../packages/module-contract/src/module-registry.ts
-import { z as z5 } from "zod";
-var projectSlugSchema2 = z5.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
-var registryEnhancementSchema = z5.object({
+import { z as z6 } from "zod";
+var projectSlugSchema2 = z6.string().refine((value) => validateSlug(value).valid, "must be a valid project slug");
+var registryEnhancementSchema = z6.object({
   peer: moduleNameSchema,
-  active: z5.boolean()
+  active: z6.boolean()
 }).strict();
-var registryModuleSchema = z5.object({
+var registryModuleSchema = z6.object({
   name: moduleNameSchema,
   /** Installed version as recorded by the rail (non-empty string). */
-  version: z5.string().min(1),
+  version: z6.string().min(1),
   home: projectSlugSchema2,
   kind: moduleKindSchema,
-  mounts: z5.array(mountSchema),
-  enhancements: z5.array(registryEnhancementSchema)
+  mounts: z6.array(mountSchema),
+  enhancements: z6.array(registryEnhancementSchema)
 }).strict().superRefine((mod, ctx) => {
   for (let i = 0; i < mod.enhancements.length; i += 1) {
     if (mod.enhancements[i].peer === mod.name) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         message: "enhancement peer must not equal the module's own name",
         path: ["enhancements", i, "peer"]
       });
     }
   }
 });
-var generatedModuleRegistrySchema = z5.object({
-  registryVersion: z5.literal(1),
+var generatedModuleRegistrySchema = z6.object({
+  registryVersion: z6.literal(1),
   /** Rail run id, or `"manual"` for fixtures. */
-  generatedBy: z5.string().min(1),
-  modules: z5.array(registryModuleSchema)
+  generatedBy: z6.string().min(1),
+  modules: z6.array(registryModuleSchema)
 }).strict().superRefine((registry, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (let i = 0; i < registry.modules.length; i += 1) {
     const name = registry.modules[i].name;
     if (seen.has(name)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         message: `duplicate module name "${name}"`,
         path: ["modules", i, "name"]
       });
@@ -3947,171 +3996,9 @@ function analyzeClientSafeEntryImports(sourceText, fileName) {
   return analyzeClientSafeEntryImportsWithTs(ts3, sourceText, fileName);
 }
 
-// ../../packages/lib/src/shared/module-composition.ts
-var moduleRefSchema = z6.object({
-  homeProjectId: z6.string().uuid(),
-  moduleName: moduleNameSchema
-});
-var creationSourceBlankSchema = z6.object({
-  type: z6.literal("blank")
-});
-var creationSourceBlueprintSchema = z6.object({
-  type: z6.literal("blueprint"),
-  /** Internal template/fork project id — keep template naming in identifiers. */
-  blueprintProjectId: z6.string().uuid(),
-  /**
-   * `null`/absent means every feature Module. `[]` is refused: the platform
-   * serialises it to an empty `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the
-   * enablement parser reads back as "all" (`module-enablement.ts`) — the
-   * opposite of what an empty selection means.
-   */
-  enabledModules: z6.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
-});
-var creationSourceModulesSchema = z6.object({
-  type: z6.literal("modules"),
-  requested: z6.array(moduleRefSchema).min(1)
-});
-var creationSourceSchema = z6.discriminatedUnion("type", [
-  creationSourceBlankSchema,
-  creationSourceBlueprintSchema,
-  creationSourceModulesSchema
-]);
-var moduleCompositionStatusSchema = z6.enum([
-  "pending",
-  "installing",
-  "ready",
-  "partial",
-  "failed"
-]);
-var resolvedModuleSnapshotSchema = moduleRefSchema.extend({
-  version: z6.string().min(1),
-  homeCommitSha: z6.string().min(1)
-});
-var moduleInstallHandoffSchema = z6.object({
-  moduleName: z6.string().min(1),
-  homeProjectId: z6.string().uuid(),
-  installedVersion: z6.string().min(1),
-  baselineSha: z6.string().min(1),
-  mounts: z6.array(
-    z6.object({
-      group: z6.string(),
-      segment: z6.string()
-    })
-  ),
-  integration: z6.array(z6.string()),
-  workflows: z6.array(z6.string()),
-  prunedEnhancements: z6.array(z6.string()),
-  restoredEnhancements: z6.array(z6.string()).optional(),
-  permissions: z6.array(
-    z6.object({
-      key: z6.string().min(1),
-      description: z6.string().min(1)
-    })
-  ).optional()
-});
-var moduleCompositionRunAttemptSchema = z6.object({
-  module: moduleRefSchema,
-  runId: z6.string().min(1),
-  status: z6.string().min(1),
-  schemaApplied: z6.boolean(),
-  error: z6.string().optional(),
-  /** Prefer full ModuleInstallHandoff; identity fields optional for older rows. */
-  handoff: moduleInstallHandoffSchema.partial({ moduleName: true, homeProjectId: true }).optional()
-});
-var initialModuleCompositionSchema = z6.object({
-  version: z6.literal(1),
-  status: moduleCompositionStatusSchema,
-  requested: z6.array(moduleRefSchema).min(1),
-  resolved: z6.array(resolvedModuleSnapshotSchema),
-  installOrder: z6.array(moduleRefSchema),
-  runs: z6.array(moduleCompositionRunAttemptSchema).default([]),
-  /**
-   * True when any failed/partial attempt applied schema before failing.
-   * Never claim transactional rollback across git/schema.
-   */
-  schemaApplied: z6.boolean().default(false),
-  /**
-   * Present when retry would silently change pinned home SHAs — caller must
-   * reconfirm the new plan rather than continue.
-   */
-  reconfirmationRequired: z6.object({
-    reason: z6.string(),
-    previous: z6.array(resolvedModuleSnapshotSchema),
-    next: z6.array(resolvedModuleSnapshotSchema)
-  }).optional(),
-  error: z6.string().optional(),
-  /**
-   * First-turn system handoff lifecycle. Absent/`pending` means inject when
-   * status is ready; `consumed` means a successful agent turn already used it.
-   */
-  systemHandoffStatus: z6.enum(["pending", "consumed"]).optional(),
-  /**
-   * CAS ownership token for concurrent retry attempts. Only the attempt that
-   * currently owns this value may reset or compensate durable composition state.
-   */
-  retryAttemptId: z6.string().min(1).optional(),
-  /**
-   * When the current `installing` attempt was claimed. A setup run that dies
-   * with its host (a killed Vercel instance) leaves the composition `installing`
-   * forever, and the creating page's poll only stops on ready/partial/failed —
-   * so staleness, not a queue's stall detector, is what settles it. Absent on
-   * rows claimed before this field existed; treated as stale.
-   */
-  attemptStartedAt: z6.string().datetime().optional(),
-  /** Outside-module files the agent changed during connection work. */
-  integrationFiles: z6.array(z6.string()).optional(),
-  verificationSummary: z6.string().optional()
-});
-var MODULE_SETUP_ATTEMPT_STALE_MS = 10 * 60 * 1e3;
-
-// ../../packages/lib/src/shared/compose-inputs.ts
-import { z as z7 } from "zod";
-var COMPOSE_INPUTS_PATH = "apps/web/stardeck.compose.json";
-var composeInputsSchema = z7.strictObject({
-  connectedStores: z7.array(
-    z7.strictObject({
-      storeId: z7.string().min(1),
-      slug: z7.string().min(1),
-      // A row with an empty binding key must not fail a deploy: the rail
-      // treats falsy as "no binding key", so normalise rather than reject.
-      bindingKey: z7.string().nullish().transform((value) => value || null),
-      accessLevel: z7.enum(["read", "write", "admin"]),
-      // Defaulted so a file written before the platform emitted store types
-      // (database rows only) still parses. The platform starts writing
-      // storage rows, with `type` set, once forks run a compose that reads it.
-      type: z7.enum(["database", "storage"]).default("database")
-    })
-  ).default([]),
-  installs: z7.record(
-    z7.string(),
-    z7.strictObject({
-      installedVersion: z7.string().min(1),
-      datastoreBindings: z7.record(z7.string(), z7.string()).nullish()
-    })
-  ).default({})
-});
-var STUB_IGNORE_PATH = "apps/web/src/app/.gitignore";
-var STUB_IGNORE_HEADER = "# Generated by stardeck-compose \u2014 Module-rail stubs are build outputs; do not edit or commit them.";
-function escapeStubIgnorePattern(pattern) {
-  const escaped = pattern.replace(/[\\[\]*?]/g, (char) => `\\${char}`);
-  return /^[#!]/.test(escaped) ? `\\${escaped}` : escaped;
-}
-function buildStubIgnore(artifactPaths) {
-  const prefix = "apps/web/src/app/";
-  const entries = artifactPaths.filter((artifact) => artifact.startsWith(prefix)).map((artifact) => escapeStubIgnorePattern(`/${artifact.slice(prefix.length)}`)).sort();
-  return [STUB_IGNORE_HEADER, ...entries].join("\n") + "\n";
-}
-
-// ../../packages/lib/src/shared/module-enablement.ts
-function isModuleEnabledByList(raw, name, kindOf) {
-  if (!raw) return true;
-  const kind = kindOf(name);
-  if (kind != null && kind !== "feature") return true;
-  return raw.split(",").includes(name);
-}
-
 // ../../packages/lib/src/shared/platform-owned-paths.ts
 var APP_WEB_PREFIX = "apps/web/";
+var BLUEPRINT_LINT_MARKER = `${APP_WEB_PREFIX}eslint-rules/module-boundaries.mjs`;
 var MODULE_STUB_MARKER = "@stardeck-module-rail-generated";
 var ENABLED_MODULES_ENV = "NEXT_PUBLIC_STARDECK_ENABLED_MODULES";
 var HEADLESS_MOUNTS_ENV = "NEXT_PUBLIC_STARDECK_HEADLESS_MOUNTS";
@@ -6036,6 +5923,52 @@ function rejectPseudoModuleEntries(entries, parentDir, label) {
   return dirs;
 }
 
+// ../../packages/lib/src/shared/module-composition.ts
+import { z as z7 } from "zod";
+var creationSourceBlankSchema = z7.object({
+  type: z7.literal("blank")
+});
+var creationSourceBlueprintSchema = z7.object({
+  type: z7.literal("blueprint"),
+  /** Internal template/fork project id — keep template naming in identifiers. */
+  blueprintProjectId: z7.string().uuid(),
+  /**
+   * `null`/absent means every feature Module: the platform stores that as the
+   * explicit list of feature Modules in the published Blueprint version the fork
+   * is cut from, so a Module a later Blueprint update adds arrives off. `[]` is
+   * refused: the platform serialises it to an empty
+   * `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the enablement parser reads
+   * back as "all" (`module-enablement.ts`) — the opposite of an empty selection.
+   */
+  enabledModules: z7.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+});
+var creationSourceSchema = z7.discriminatedUnion("type", [
+  creationSourceBlankSchema,
+  creationSourceBlueprintSchema
+]);
+var moduleInstallHandoffSchema = z7.object({
+  moduleName: z7.string().min(1),
+  homeProjectId: z7.string().uuid(),
+  installedVersion: z7.string().min(1),
+  baselineSha: z7.string().min(1),
+  mounts: z7.array(
+    z7.object({
+      group: z7.string(),
+      segment: z7.string()
+    })
+  ),
+  integration: z7.array(z7.string()),
+  workflows: z7.array(z7.string()),
+  prunedEnhancements: z7.array(z7.string()),
+  restoredEnhancements: z7.array(z7.string()).optional(),
+  permissions: z7.array(
+    z7.object({
+      key: z7.string().min(1),
+      description: z7.string().min(1)
+    })
+  ).optional()
+});
+
 // ../../packages/lib/src/shared/schema-ops.ts
 import { z as z8 } from "zod";
 var columnSpecSchema = z8.object({
@@ -7499,6 +7432,9 @@ async function reconcileCompositionArtifacts(context, options = {}) {
 var HOME_I18N_SUBSTRATE_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/substrate`;
 var HOME_I18N_MESSAGES_DIR = `${APP_PACKAGE_DIR}/src/lib/i18n/messages`;
 
+// src/index.ts
+import ts6 from "typescript";
+
 // src/module-boundaries.ts
 import fs2 from "fs";
 import path2 from "path";
@@ -7768,6 +7704,41 @@ function assertNoAppLayerImporters(cwd, excluded) {
     );
   }
 }
+var TSCONFIG_PATH = "apps/web/tsconfig.json";
+var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
+var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+function writeBuildTsconfig(cwd, excluded) {
+  const baseFile = path3.join(cwd, TSCONFIG_PATH);
+  if (!fs3.existsSync(path3.join(cwd, MODULES_DIR2)) || !fs3.existsSync(baseFile)) return;
+  const base = ts6.readConfigFile(baseFile, ts6.sys.readFile);
+  if (base.error) {
+    throw new Error(
+      `[compose] cannot read ${TSCONFIG_PATH}: ${ts6.flattenDiagnosticMessageText(base.error.messageText, "\n")}`
+    );
+  }
+  const baseExclude = base.config?.exclude ?? ["node_modules"];
+  const modulesDir = path3.posix.relative("apps/web", MODULES_DIR2);
+  const config = {
+    extends: "./tsconfig.json",
+    exclude: [
+      ...baseExclude,
+      ...excluded.flatMap((name) => [
+        `${modulesDir}/${name}`,
+        `${modulesDir}/*/enhancements/${name}`
+      ])
+    ]
+  };
+  const content = `${BUILD_TSCONFIG_HEADER}
+${JSON.stringify(config, null, 2)}
+`;
+  const file = path3.join(cwd, BUILD_TSCONFIG_PATH);
+  if (!fs3.existsSync(file) || fs3.readFileSync(file, "utf8") !== content) {
+    fs3.writeFileSync(file, content);
+  }
+  console.log(
+    `[compose] ${BUILD_TSCONFIG_PATH} excludes ${excluded.length} Module(s): ${excluded.join(",") || "none"}`
+  );
+}
 function removeDir(absolute) {
   if (!fs3.existsSync(absolute)) return false;
   fs3.rmSync(absolute, { recursive: true, force: true });
@@ -7815,6 +7786,7 @@ async function compose(options) {
     skipComposeInputs: true
   });
   const gitignoreEntries = options.enabled ? null : writeStubGitignore(options.cwd, result.artifactPaths);
+  writeBuildTsconfig(options.cwd, result.excludedModules);
   let pruned = 0;
   if (options.prune) {
     for (const name of result.excludedModules) {
@@ -7836,6 +7808,7 @@ async function compose(options) {
   };
 }
 export {
+  BUILD_TSCONFIG_PATH,
   COMPOSE_INPUTS_PATH,
   assertSupportedTypescript,
   compose,