create-ailk 0.19.1 → 0.20.0

package/dist/lib/merge-three-way.js

@@ -0,0 +1,65 @@
+/**
+ * `git merge-file` wrapper — the three-way text merge `create-ailk update`
+ * runs for a copied app file the site owner edited and the template also
+ * changed (#8522 D5).
+ *
+ * `git merge-file` is the reference diff3 merge: every AILK owner already
+ * has `git` on `PATH` (it is how they cloned or will push this site), and
+ * using it adds no new npm dependency. The three versions are written to a
+ * fresh temp directory (never the site's own tree) and read back as text;
+ * nothing is left behind.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Run `git merge-file -p` over the three texts in a `mkdtemp` directory, no
+ * shell, argv holding only temp-file paths and the three labels (#8522 D5).
+ *
+ * Exit 0 is a clean merge (`merged`). Exit 1-127 is a conflicting hunk
+ * (`conflict`) — the file is never written with conflict markers by this
+ * function; the caller decides what to do with a conflict, and nothing here
+ * ever applies one. Any other exit, or a spawn failure (no `git` on `PATH`),
+ * is `error`.
+ */
+export function mergeThreeWay(opts) {
+    const dir = mkdtempSync(join(tmpdir(), "ailk-merge-"));
+    try {
+        const oursPath = join(dir, "ours");
+        const basePath = join(dir, "base");
+        const theirsPath = join(dir, "theirs");
+        writeFileSync(oursPath, opts.ours);
+        writeFileSync(basePath, opts.base);
+        writeFileSync(theirsPath, opts.theirs);
+        const result = spawnSync("git", [
+            "merge-file",
+            "-p",
+            "-L",
+            opts.oursLabel,
+            "-L",
+            opts.baseLabel,
+            "-L",
+            opts.theirsLabel,
+            oursPath,
+            basePath,
+            theirsPath,
+        ], { shell: false });
+        if (result.error !== undefined) {
+            return { status: "error", reason: result.error.message };
+        }
+        if (result.status === 0) {
+            return { status: "merged", text: result.stdout.toString("utf8") };
+        }
+        if (result.status !== null && result.status >= 1 && result.status <= 127) {
+            return { status: "conflict" };
+        }
+        return {
+            status: "error",
+            reason: `git merge-file exited ${result.status ?? `signal ${result.signal}`}`,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/module-architecture.js

@@ -21,7 +21,7 @@
  * `architecture.yaml` template files — a fixed template IS the drift this
  * removes.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { join, sep } from "node:path";
 import { CONTENT_PAYLOADS, } from "./content-payloads.js";
 import { importClosure } from "./lib/import-graph.js";
@@ -183,12 +183,18 @@ const MEMBER_AREA_FILES = [
     "apps/api/src/routes/member/request-form.ts",
     "apps/api/src/routes/member/billing.ts",
     "apps/api/src/routes/member/requests.ts",
+    // #8515 D13 — the client's onboarding read and write.
+    "apps/api/src/routes/member/onboarding.ts",
     "apps/api/src/routes/member/artifact-review.ts",
     "apps/api/src/routes/member/profile.ts",
     "apps/api/src/routes/member/deletion-request.ts",
     // #8438 D6 — the member's own consents; the same gate as the writes above.
     "apps/api/src/routes/member/consents.ts",
     "apps/api/src/services/member-area.ts",
+    // #8516 D8 — whether proposal payment runs, and the Checkout Session;
+    // imported only by member-area files (pieces.ts and the two member
+    // artifact routes), and itself imports only base files.
+    "apps/api/src/services/proposal-payments.ts",
     "apps/api/src/lib/member-store.ts",
     // #8226 D12 — the member-request match CLI; both import member-store.ts,
     // which a build without the member slice does not carry.
@@ -1488,6 +1494,13 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/slack/index.ts",
             "apps/api/src/routes/slack/actions.ts",
             "apps/api/src/routes/waitlist-signups/index.ts",
+            // #7479 — the listing-draft forwarded-visitor suite exercises the three
+            // project-listings draft routes through the real build(), and those
+            // routes register only under isModuleEnabled("signal-collectors"), so
+            // the suite strips with this slice (the #7389 shape for
+            // schedule-forwarded-rate-limit.test.ts under scheduling) instead of
+            // failing every keyless scaffold's apps/api jest gate.
+            "apps/api/src/__tests__/listings-forwarded-rate-limit.test.ts",
             // apps/api/src/routes/project-listings/{start,patch-draft,submit,public,
             // me,respond,resume-token}.ts and services/{project-listings,
             // listing-config}.ts deliberately NOT listed — see the comment above
@@ -2201,11 +2214,51 @@ export function missingArchitectureEnforcement(siteDir) {
         missing.push("package.json scripts.preflight (runs pnpm architecture)");
     }
     const postToolUse = readJson(".claude/settings.json")?.hooks?.PostToolUse ?? [];
+    const ARCH_PNPM_RE = /\bpnpm\b.*\barchitecture\b/;
+    // CloudParity's repo-owned-hook command grammar (#8509 D2/D6): no
+    // $CLAUDE_PROJECT_DIR prefix, no arguments, no shell operators.
+    const ARCH_HOOK_SCRIPT_RE = /^bash \.claude\/hooks\/([A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*)$/;
+    /**
+     * A command "runs architecture" either in today's inline form (matched on
+     * the command string itself, so a pre-#8509 scaffold still verifies) or in
+     * the script form CloudParity's declaration grammar requires — read the
+     * named script's own text, so a deleted or emptied script still reports
+     * missing even though the command string is unchanged.
+     */
+    const commandRunsArchitecture = (command) => {
+        if (ARCH_PNPM_RE.test(command))
+            return true;
+        const match = ARCH_HOOK_SCRIPT_RE.exec(command);
+        if (!match)
+            return false;
+        const scriptRel = match[1];
+        // The charset `ARCH_HOOK_SCRIPT_RE` allows per segment admits "." and
+        // "..", which CloudParity's own grammar forbids (#8509 spec §1) — reject
+        // them here too, so a crafted command string can't walk this read
+        // outside siteDir/.claude/hooks/.
+        if (scriptRel.split("/").some((seg) => seg === "." || seg === ".."))
+            return false;
+        const hooksDir = join(siteDir, ".claude", "hooks");
+        const scriptPath = join(hooksDir, scriptRel);
+        if (!existsSync(scriptPath))
+            return false;
+        try {
+            const realHooksDir = realpathSync(hooksDir);
+            const realScript = realpathSync(scriptPath);
+            if (!realScript.startsWith(realHooksDir + sep) || !lstatSync(realScript).isFile()) {
+                return false;
+            }
+            return ARCH_PNPM_RE.test(readFileSync(realScript, "utf8"));
+        }
+        catch {
+            return false;
+        }
+    };
     const hooked = postToolUse.some((entry) => {
         const tools = (entry.matcher ?? "").split("|");
         return (tools.includes("Edit") &&
             tools.includes("Write") &&
-            (entry.hooks ?? []).some((h) => /\bpnpm\b.*\barchitecture\b/.test(h.command ?? "")));
+            (entry.hooks ?? []).some((h) => commandRunsArchitecture(h.command ?? "")));
     });
     if (!hooked) {
         missing.push(".claude/settings.json PostToolUse hook on Edit|Write (runs pnpm architecture)");

package/dist/programmatic.d.ts

@@ -195,8 +195,14 @@ export interface ScaffoldResult {
  *
  * Throws ValidationError if targetDir already exists and is non-empty.
  * Throws Error if the template copy fails for any other reason.
+ *
+ * @param copied — INTERNAL (#8522 D2): when passed, every recordable path
+ *   `copyTemplate` writes is hashed into this map (destination path -> the
+ *   sha256 of the bytes written), for `scaffold()` to build
+ *   `.ailk-template-files.json` from once every later layer has landed. No
+ *   existing caller passes it, so their behaviour is unchanged.
  */
-export declare function scaffoldSync(opts: ScaffoldOptions): ScaffoldResult;
+export declare function scaffoldSync(opts: ScaffoldOptions, copied?: Map<string, string>): ScaffoldResult;
 /**
  * Scaffold an AI Launch Kit starter project into targetDir (async wrapper).
  *

package/dist/programmatic.js

@@ -48,6 +48,7 @@ import { spokeCheckoutSite, spokeEnvRowOptions, writeSpokeCheckoutSlice, } from
 import { GATEABLE_SURFACES, MODULE_SURFACES, NAV_CONFIG_PATH, excludedRoutePaths, isUnservedSurfaceContent, renderNavConfig, resolveSurfaces, } from "./surfaces.js";
 import { syncRoutes } from "./sync-routes.js";
 import { BASE_LAYER_DIR, SHAPE_STARTERS, TEMPLATE_MANIFESTS, TemplateError, mergeRoster, resolveTemplate, resolveTemplateLineage, rosterDeclares, templateDelivery, templateTreeDir, } from "./template-manifest.js";
+import { TEMPLATE_RECORD_PATH, isRecordable, planTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
 import { SPOKE_ONLY_FILES, TopologyError, applySpokeTransforms, isSpokeExcluded, normalizeHubSignInUrl, normalizeHubUrl, readSiteTopology, spokeExclusions, spokeDestination, spokeModuleRefusal, spokeModules, writeHubOriginEnv, writeHubSignInEnv, } from "./topology.js";
 import { validateTarget } from "./validate.js";
 const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -148,8 +149,14 @@ function resolveShapeTemplate(shape) {
  *
  * Throws ValidationError if targetDir already exists and is non-empty.
  * Throws Error if the template copy fails for any other reason.
+ *
+ * @param copied — INTERNAL (#8522 D2): when passed, every recordable path
+ *   `copyTemplate` writes is hashed into this map (destination path -> the
+ *   sha256 of the bytes written), for `scaffold()` to build
+ *   `.ailk-template-files.json` from once every later layer has landed. No
+ *   existing caller passes it, so their behaviour is unchanged.
  */
-export function scaffoldSync(opts) {
+export function scaffoldSync(opts, copied) {
     // Validate target — throws ValidationError on rejection.
     const targetAbs = validateTarget(opts.targetDir);
     const projectName = opts.projectName ?? basename(targetAbs);
@@ -177,6 +184,14 @@ export function scaffoldSync(opts) {
                 : SPOKE_ONLY_FILES),
         ],
         markers: buildScaffoldMarkers(projectName),
+        ...(copied !== undefined
+            ? {
+                onWrite: (relPath, bytes) => {
+                    if (isRecordable(relPath))
+                        copied.set(relPath, sha256Hex(bytes));
+                },
+            }
+            : {}),
     });
     // #7426 D5/D6 — the root files a spoke rewrites, and the spoke seams.
     if (spoke !== undefined)
@@ -495,6 +510,10 @@ export async function scaffold(opts) {
     const surfaces = template !== undefined
         ? [...new Set([...(opts.surfaces ?? []), ...rosterSurfaces(template)])].sort()
         : opts.surfaces;
+    // #8522 D2 — every recordable path `copyTemplate` writes, hashed as it is
+    // written: the input to the per-file record `scaffold()` writes below,
+    // once every later layer has landed.
+    const copied = new Map();
     const result = scaffoldSync({
         ...opts,
         modules,
@@ -509,7 +528,7 @@ export async function scaffold(opts) {
         // #6813 D8 step 6 — the resolved design's OWN layout (never its name):
         // `resolveSiteChrome` reads a layout object now, not a `StarterDesign`.
         ...(resolvedDesign !== undefined ? { designLayout: resolvedDesign.pkg.layout } : {}),
-    });
+    }, copied);
     // Threaded to extractModuleBundle for `package.json` patch targets'
     // `workspace:*` substitution (spec 5418 § 3 D2) — the same version map
     // `scaffoldSync` already reads for `copyTemplate`, re-read here since
@@ -785,6 +804,17 @@ export async function scaffold(opts) {
                 templatesDir: TEMPLATES_DIR,
                 markers,
             }));
+            // #8522 D2 — the per-file record, as this scaffold's LAST write (same
+            // guard and roster as the site manifest just above): a kept copied
+            // path only when its final bytes still hash to the copy — a later
+            // layer (a module bundle's patch, a generator) that rewrote the file
+            // is absent here too.
+            writeFileSync(join(result.targetDir, TEMPLATE_RECORD_PATH), serializeTemplateRecord(planTemplateRecord({
+                targetDir: result.targetDir,
+                copied,
+                version: markers["CREATE_AILK_VERSION"] ?? "",
+                projectName,
+            })));
         }
     }
     // #7536 D3 — the registry follows `apps/web/package.json`, which a module

package/dist/spoke-checkout.d.ts

@@ -8,6 +8,13 @@ export declare const SPOKE_CHECKOUT_PACKAGE = "@working-theory/spoke-checkout";
 export declare const SPOKE_CHECKOUT_CONFIG_PATH = "apps/web/lib/checkout-config.ts";
 /** The two return pages: Stripe's success URL and every refused buy's target. */
 export declare const SPOKE_CHECKOUT_PAGE_FILES: readonly string[];
+/**
+ * The marker `renderPage()` stamps into both generated return pages' header
+ * comment (D3). `apps/web`'s structured-data test cannot import create-ailk
+ * (the import boundary), so it carries this text as a literal, kept in sync
+ * by `packages/create-ailk/__tests__/spoke-checkout.test.ts` (#8513 AC-5).
+ */
+export declare const SPOKE_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 /** The variables a commerce spoke depends on (D9). The package reads three of them. */
 export declare const SPOKE_CHECKOUT_ENV_CATALOG: Readonly<Record<string, EnvCatalogEntry>>;
 /** The names a commerce spoke declares although only the package reads them (D9). */

package/dist/spoke-checkout.js

@@ -38,6 +38,13 @@ export const SPOKE_CHECKOUT_PAGE_FILES = Object.freeze([
     "apps/web/app/[locale]/checkout/thank-you/page.tsx",
     "apps/web/app/[locale]/checkout/unavailable/page.tsx",
 ]);
+/**
+ * The marker `renderPage()` stamps into both generated return pages' header
+ * comment (D3). `apps/web`'s structured-data test cannot import create-ailk
+ * (the import boundary), so it carries this text as a literal, kept in sync
+ * by `packages/create-ailk/__tests__/spoke-checkout.test.ts` (#8513 AC-5).
+ */
+export const SPOKE_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 /** The variables a commerce spoke depends on (D9). The package reads three of them. */
 export const SPOKE_CHECKOUT_ENV_CATALOG = Object.freeze({
     STRIPE_SECRET_KEY: {
@@ -245,7 +252,7 @@ function renderConfig(site) {
 /** One return page (D7): a server component that reads nothing but its copy. */
 function renderPage(opts) {
     return [
-        `// ${opts.title} — GENERATED by create-ailk (#7838).`,
+        `// ${opts.title} — ${SPOKE_CHECKOUT_PAGE_MARKER}.`,
         ...opts.about.map((line) => `// ${line}`),
         `import { SectionRenderer } from "${UI_SECTIONS_PACKAGE}";`,
         `import type { PageSection } from "${VALIDATION_PACKAGE}";`,

package/dist/surfaces.js

@@ -94,6 +94,11 @@ export const CORE_ROUTE_DIRS = [
     // 404s. Neither `GATEABLE_SURFACES` nor `MODULE_SURFACES.commerce` gains
     // an entry — the claim decides whether the pages serve, not the scaffold.
     `${ROUTE_ROOT}/purchase`,
+    // #8438 D17/D21 — the one unsubscribe landing every signed link calls.
+    // Consent logging is part of the never-gated privacy floor (CLAUDE.md §
+    // License & tier hygiene's never-gate list), so this ships unconditionally
+    // like `/about`/`/contact`/`/faq` above — never a `GATEABLE_SURFACES` entry.
+    `${ROUTE_ROOT}/unsubscribe`,
 ];
 /**
  * Directory names skipped by `listTemplateRouteDirs`'s walker even though they
@@ -666,12 +671,20 @@ export const ROUTE_SINCE = {
     // version, the same rule #7430/#8232 applied.
     "(authed)/account/security": "0.38.0",
     "(authed)/account/notifications": "0.38.0",
+    // #8438 D21 — User settings' fifth tab, Privacy, and the public
+    // unsubscribe landing every signed link calls. Genuinely new, so they
+    // attach at today's fixed-group version, the same rule #8339 applied.
+    "(authed)/account/privacy": "0.40.0",
+    unsubscribe: "0.40.0",
     // #8234 — the member Artifacts pages and a version's file route. Genuinely
     // new, so they attach at today's fixed-group version, the same rule #7430
     // applied.
     "(authed)/account/artifacts": "0.38.0",
     "(authed)/account/artifacts/[pieceId]": "0.38.0",
     "(authed)/account/artifacts/[pieceId]/versions/[version]/file": "0.38.0",
+    // #8515 — the client's onboarding page. Genuinely new, so it attaches at
+    // today's fixed-group version, the same rule #7430 applied.
+    "(authed)/account/onboarding": "0.40.0",
     // The leads inbox (#5678). The ROUTE ships in every scaffold, Free
     // included — lead capture is a never-gate surface, so reading a lead back
     // is one too. Whether it shows a ROW is a separate question with two
@@ -774,7 +787,13 @@ export const ROUTE_DEPENDENCIES = {
         "apps/web/lib/auth-routes.ts",
     ],
     "(auth)/sign-in": ["apps/web/lib/auth-env.ts"],
-    "(auth)/sign-up": ["apps/web/lib/auth-env.ts"],
+    // #8438 D13/D21 — the sign-up card's agreements gate also carries the
+    // carried-cookie mint, `sign-up.actions.ts`, beside it in this route's own
+    // directory.
+    "(auth)/sign-up": [
+        "apps/web/lib/auth-env.ts",
+        `${ROUTE_ROOT}/(auth)/sign-up/sign-up.actions.ts`,
+    ],
     "(auth)/forgot-password": ["apps/web/lib/auth-env.ts"],
     "(auth)/reset-password": ["apps/web/lib/auth-env.ts"],
     // #7430 — the group's layout reads `isAccountPath()` to give the account
@@ -789,6 +808,17 @@ export const ROUTE_DEPENDENCIES = {
         "apps/web/lib/server-api.ts",
         "apps/web/lib/site-brand.tsx",
         "apps/web/lib/site-logo.tsx",
+        // #8438 D13/D21 — two brand-new files in this already-existing route
+        // directory; a scaffold whose `(authed)/account` predates this unit
+        // needs them added, which the directory-level sync alone would not do
+        // (sync never overwrites or adds to a directory it already has).
+        // `acceptCarriedAgreementsAction` (the carried-cookie CONSUME side) lives
+        // in this directory's own `agreements-actions.ts`, never in
+        // `(auth)/sign-up` — see that file's header: `(auth)/**` is a sign-in
+        // seed a sign-in-less spoke drops, so a cross-directory reach from here
+        // into it would dangle.
+        `${ROUTE_ROOT}/(authed)/account/agreements-prompt.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/agreements-actions.ts`,
     ],
     // #7430 — the three child routes also import files in their PARENT's
     // directory. A scaffold whose `(authed)/account` predates #7430 keeps its
@@ -875,12 +905,31 @@ export const ROUTE_DEPENDENCIES = {
         `${ROUTE_ROOT}/(authed)/account/sign-in-method.ts`,
     ],
     // #8339 D11 — Notifications holds the former Privacy section's
-    // cookie-settings link, moved verbatim from General.
+    // cookie-settings link, moved verbatim from General. #8438 D15 — that
+    // link moved on again, to Privacy; Notifications now reads the registry
+    // through `member.consents` instead, so it keeps the same dependency set.
     "(authed)/account/notifications": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/server-api.ts",
         `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
         `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/privacy/actions.ts`,
+    ],
+    // #8438 D14 — Privacy's five sections: the summary, the cookie-choice
+    // read from the browser cookie, data-use consents and read-only
+    // agreements (both through `member.consents`), and Request account
+    // deletion, moved here unchanged from General (D16) — so Privacy needs
+    // General's own deletion files too, the same cross-directory rule #8339
+    // D11 applied to Notifications' cookie-settings link.
+    "(authed)/account/privacy": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/settings-frame.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/sign-in-method.ts`,
+        `${ROUTE_ROOT}/(authed)/account/profile-actions.ts`,
+        `${ROUTE_ROOT}/(authed)/account/general/deletion-request.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/general/profile-source.ts`,
     ],
     "(authed)/account/billing": [
         "apps/web/lib/account-config.ts",
@@ -924,6 +973,17 @@ export const ROUTE_DEPENDENCIES = {
         `${ROUTE_ROOT}/(authed)/account/artifacts/artifact-actions.ts`,
     ],
     "(authed)/account/artifacts/[pieceId]/versions/[version]/file": ["apps/web/lib/server-api.ts"],
+    // #8515 D12 — the onboarding page imports its parent's account-data.ts
+    // and error-row.tsx (which renders retry-button.tsx); its actions forward
+    // the credential `forwardedCookieInit` returns. account-data.ts reads the
+    // account config, as the Artifacts pages' does.
+    "(authed)/account/onboarding": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/error-row.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/retry-button.tsx`,
+    ],
     "(authed)/account/support": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/server-api.ts",
@@ -997,10 +1057,13 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/account/general": ["account"],
     "(authed)/account/security": ["account"],
     "(authed)/account/notifications": ["account"],
+    "(authed)/account/privacy": ["account"],
     "(authed)/account/billing": ["account"],
     // #8234 — the two Artifacts pages; the file route renders no string.
     "(authed)/account/artifacts": ["account"],
     "(authed)/account/artifacts/[pieceId]": ["account"],
+    // #8515 — the onboarding page.
+    "(authed)/account/onboarding": ["account"],
     "(authed)/admin": ["admin"],
     "(authed)/leads": ["leadsInbox"],
     // #5977 — every string on both editor routes comes from the `edit`
@@ -1012,6 +1075,8 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(authed)/waitlist": ["waitlistDashboard.gate"],
     // #7744 — the /team hub's empty state reads the `team` namespace.
     team: ["team"],
+    // #8438 D21 — the unsubscribe landing's own namespace.
+    unsubscribe: ["unsubscribe"],
 };
 /** Template-relative path of the generated site-nav registry. */
 export const NAV_CONFIG_PATH = "apps/web/lib/nav-config.ts";

package/dist/template-record.d.ts

@@ -0,0 +1,59 @@
+/** Where the per-file record lives, beside `.ailk-site-manifest.json`. */
+export declare const TEMPLATE_RECORD_PATH = ".ailk-template-files.json";
+/**
+ * The app paths a generator rewrites after `copyTemplate` lands its copy
+ * (§1): the nav, the site chrome, the site fonts, the paid-sections
+ * registry, and the four spoke seams. Composed from each writer's own
+ * exported path constant, so a renamed constant carries its path along
+ * here too (#8522 D2).
+ */
+export declare const REGENERATED_APP_PATHS: readonly string[];
+/**
+ * Whether a destination path (`/`-separated, as `templateDestination`
+ * returns it) is one `update` ever records or touches (#8522 D2): under one
+ * of the three app trees, not a `package.json`, not an `.env*` file, no
+ * `.claude` segment, and not a path a generator rewrites after the copy.
+ */
+export declare function isRecordable(destRel: string): boolean;
+/** The hex sha256 digest of `bytes` — the one hash every record row uses. */
+export declare function sha256Hex(bytes: Uint8Array): string;
+export interface TemplateFileRow {
+    sha256: string;
+    version: string;
+}
+export interface TemplateRecord {
+    schema: 1;
+    projectName: string;
+    files: Record<string, TemplateFileRow>;
+}
+/** Thrown by `parseTemplateRecord` on a malformed or unsafe record. */
+export declare class TemplateRecordError extends Error {
+    constructor(message: string);
+}
+/**
+ * Parse `.ailk-template-files.json` text, refusing — naming the field — on:
+ * JSON that does not parse; `schema !== 1`; an unknown top-level key; an
+ * empty `projectName`; a `files` key that is not a recordable path; a
+ * `sha256` that is not 64 lowercase hex; a `version` that is not a semver
+ * string (#8522 D1).
+ */
+export declare function parseTemplateRecord(text: string): TemplateRecord;
+/** `record` as `scaffold()` and `update` write it: sorted keys, trailing newline. */
+export declare function serializeTemplateRecord(record: TemplateRecord): string;
+export interface PlanTemplateRecordOptions {
+    /** The freshly scaffolded site. */
+    targetDir: string;
+    /** Destination path -> sha256 of the bytes `copyTemplate`'s `onWrite` wrote, for every recordable path. */
+    copied: ReadonlyMap<string, string>;
+    /** The create-ailk version that wrote this scaffold. */
+    version: string;
+    projectName: string;
+}
+/**
+ * The record a fresh scaffold writes (#8522 D2): one row per copied path
+ * whose file still exists and whose current bytes still hash to the copy —
+ * a later layer (a module bundle's patch, a generator) that rewrote the
+ * file drops it from the record, exactly as it is absent from the record a
+ * `create-ailk update` keeps current for it.
+ */
+export declare function planTemplateRecord(opts: PlanTemplateRecordOptions): TemplateRecord;