create-ailk 0.2.0 → 0.4.0

package/dist/lib/fetch-template.js

@@ -0,0 +1,129 @@
+/**
+ * Authenticated site-template-bundle fetch (spec 5481 § 4; parent record
+ * D1, § 6).
+ *
+ * The client half of `GET /v1/templates/:name/:version` (#5480's route),
+ * reached publicly at `/api/templates/:path*`. Posture is
+ * `fetch-module.ts`'s, mirrored one-for-one rather than generalised into a
+ * shared helper: bearer-JWT auth, `redirect: "error"` so a redirected
+ * response cannot drop the bearer token onto an unintended host, an
+ * empty-token guard before any network call, and the same status mapping —
+ * 401 → licence invalid/revoked/lapsed, 403 → not included / term ended,
+ * 404 → content not yet available, other non-2xx → the upstream body.
+ *
+ * ONE word differs, and it is the whole reason this is a sibling rather
+ * than a second call site of `fetchModule` (spec 5481 § 3 DD5): the 404
+ * sentence names its subject, and the subject here is a TEMPLATE. Parent
+ * record D17 makes that sentence a specified outcome rather than an
+ * incidental one, so the fourth refusal reuses it — with the noun
+ * parameterised, since left alone it would call the template a module.
+ *
+ * Deliberately depends on neither `@working-theory/license` nor
+ * `@working-theory/cli`, for the reason `fetch-module.ts`'s file doc states
+ * at length: both are `publishConfig.access: "restricted"` and this is the
+ * one package published to PUBLIC npm, so a runtime dependency on either
+ * would break `pnpm install` for every Free consumer rather than merely
+ * gate the paid path. The registry's own 401 IS the licence verdict.
+ */
+import pkg from "../../package.json" with { type: "json" };
+export const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
+/**
+ * This package's own `package.json` `"version"` — a static JSON import for
+ * the reason `fetch-module.ts`'s `CREATE_AILK_VERSION` doc gives: `import.meta`
+ * is a SyntaxError under ts-jest's CommonJS transform, and this file is
+ * reachable from jest. A template bundle overlays the scaffold this
+ * `create-ailk` just wrote, so the default version request is the running
+ * package's own.
+ */
+const CREATE_AILK_VERSION = pkg.version;
+export class FetchTemplateError extends Error {
+    isLicenseError;
+    constructor(message, 
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
+    isLicenseError = false) {
+        super(message);
+        this.isLicenseError = isLicenseError;
+        this.name = "FetchTemplateError";
+    }
+}
+/**
+ * Join `registryUrl` with `templateName` and `version` as two trailing path
+ * segments. `encodeURIComponent` on each is defense in depth —
+ * `parse-args.ts` already restricts `templateName` to `TEMPLATE_MANIFESTS`'s
+ * keys, but a hostile value can never smuggle a path separator or query
+ * string here regardless.
+ */
+function buildUrl(registryUrl, templateName, version) {
+    const trimmed = registryUrl.replace(/\/+$/, "");
+    return `${trimmed}/${encodeURIComponent(templateName)}/${encodeURIComponent(version)}`;
+}
+export async function fetchTemplate(options) {
+    const { templateName, token } = options;
+    if (token.length === 0) {
+        throw new FetchTemplateError("internal error: fetchTemplate called without a token");
+    }
+    const version = options.version ?? CREATE_AILK_VERSION;
+    const registryUrl = options.registryUrl ??
+        process.env["AILK_TEMPLATE_REGISTRY_URL"] ??
+        DEFAULT_AILK_TEMPLATE_REGISTRY_URL;
+    const url = buildUrl(registryUrl, templateName, version);
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/gzip, application/octet-stream",
+            },
+            redirect: "error",
+        });
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new FetchTemplateError(`template registry unreachable: ${detail}`);
+    }
+    if (response.status === 401) {
+        throw new FetchTemplateError(`your licence does not cover the "${templateName}" template (invalid, revoked, or lapsed)`, 
+        /* isLicenseError */ true);
+    }
+    if (response.status === 403) {
+        throw new FetchTemplateError(`your licence does not include the "${templateName}" template, or its term ended before create-ailk ${version} was released — use a create-ailk version released during your term`, 
+        /* isLicenseError */ true);
+    }
+    if (response.status === 404) {
+        throw new FetchTemplateError(`"${templateName}" template content not yet available — ping us at hello@ailaunchkit.ai`);
+    }
+    if (!response.ok) {
+        const body = await safeReadBody(response);
+        throw new FetchTemplateError(`template registry returned ${response.status} for "${templateName}": ${body}`);
+    }
+    const buf = await response.arrayBuffer();
+    return new Uint8Array(buf);
+}
+/**
+ * Best-effort error body extraction — the registry uses `{ error: "..." }`
+ * shapes, falls back to text, and swallows any read failure so the caller's
+ * message stays useful. `fetch-module.ts`'s helper of the same name.
+ */
+async function safeReadBody(response) {
+    try {
+        const text = await response.text();
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed !== null &&
+                typeof parsed === "object" &&
+                "error" in parsed &&
+                typeof parsed.error === "string") {
+                return parsed.error;
+            }
+        }
+        catch {
+            /* not JSON — fall through to raw text */
+        }
+        return text || response.statusText;
+    }
+    catch {
+        return response.statusText;
+    }
+}

package/dist/lib/module-license-gate.d.ts

@@ -35,8 +35,18 @@ export interface ResolvePaidModulesOptions {
     licenseKey?: string | undefined;
     /** Forwarded to `fetchModule`; defaults to `AILK_MODULE_REGISTRY_URL` / the built-in default. */
     registryUrl?: string;
+    /** Forwarded to `fetchModule`; defaults to this package's own version. */
+    version?: string;
     /** Forwarded to `fetchModule`; defaults to `globalThis.fetch`. Never a live call in tests. */
     fetchImpl?: typeof fetch;
+    /**
+     * The site template whose `requires` put these modules in `paidModules`
+     * (spec 5481 § 3 DD5 rows 1-2). Present ⟹ every refusal below names it
+     * alongside the specific module, because the buyer asked for a TEMPLATE and
+     * a message naming only a module they never typed does not tell them what
+     * to do. Absent ⟹ a plain `--modules` run, whose messages are unchanged.
+     */
+    templateName?: string;
 }
 /**
  * Resolve every requested paid module to its fetched bundle bytes, or throw

package/dist/lib/module-license-gate.js

@@ -28,7 +28,7 @@ export async function resolvePaidModules(options) {
     }
     const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (token === undefined || token.length === 0) {
-        throw new LicenseRequiredError(conversionHint(paidModules));
+        throw new LicenseRequiredError(conversionHint(paidModules, options.templateName));
     }
     const bundles = new Map();
     for (const moduleName of paidModules) {
@@ -39,6 +39,7 @@ export async function resolvePaidModules(options) {
                 ...(options.registryUrl !== undefined
                     ? { registryUrl: options.registryUrl }
                     : {}),
+                ...(options.version !== undefined ? { version: options.version } : {}),
                 ...(options.fetchImpl !== undefined
                     ? { fetchImpl: options.fetchImpl }
                     : {}),
@@ -48,7 +49,12 @@ export async function resolvePaidModules(options) {
         catch (err) {
             if (err instanceof FetchModuleError) {
                 if (err.isLicenseError) {
-                    throw new LicenseRequiredError(`${err.message} → ${CONVERSION_HINT_URL}`);
+                    // DD5 row 2: the mapped 401/403 already names the module the key
+                    // does not cover; the template is appended so the buyer can see
+                    // WHICH of the things they asked for needs it.
+                    throw new LicenseRequiredError(options.templateName !== undefined
+                        ? `${err.message}, required by template "${options.templateName}" → ${CONVERSION_HINT_URL}`
+                        : `${err.message} → ${CONVERSION_HINT_URL}`);
                 }
                 // Not a license-gating signal (e.g. 404 "not yet available", or the
                 // registry unreachable) — a generic failure, not the honest-denial
@@ -61,7 +67,10 @@ export async function resolvePaidModules(options) {
     }
     return bundles;
 }
-function conversionHint(paidModules) {
+function conversionHint(paidModules, templateName) {
     const list = paidModules.join(", ");
-    return `Pro module(s) requested (${list}) — set AILK_LICENSE_KEY first → ${CONVERSION_HINT_URL}`;
+    const requested = templateName !== undefined
+        ? `template "${templateName}" requires Pro module(s) (${list})`
+        : `Pro module(s) requested (${list})`;
+    return `${requested} — set AILK_LICENSE_KEY first → ${CONVERSION_HINT_URL}`;
 }

package/dist/lib/paid-paths.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The derived set of scaffold-relative paths a keyless scaffold must not
+ * contain — sorted, deduped.
+ *
+ * Throws if the result is empty: `PAID_MODULES` is never empty (it is
+ * `RECOGNIZED_MODULES` minus `FREE_MODULES`) and every paid module registered
+ * today owns at least one file under `apps/` or a whole app, so an empty
+ * result means the derivation itself broke — not that there is nothing to
+ * check (DEF-007: a silent `[]` must fail loudly, not pass the gate).
+ */
+export declare function derivePaidScaffoldPaths(): string[];
+/**
+ * Every derived paid path that exists under `scaffoldDir` — the leaked set,
+ * sorted. Empty means the scaffold is clean.
+ */
+export declare function findLeakedPaidPaths(scaffoldDir: string): string[];

package/dist/lib/paid-paths.js

@@ -0,0 +1,90 @@
+/**
+ * Derived paid-path list (R2-5374 — the no-paid-code CI gate, D-44).
+ *
+ * The set of scaffold-relative paths a keyless (Free) `create-ailk` scaffold
+ * must never contain, computed from `MODULE_SLICES` / `PAID_MODULES` at call
+ * time — never hand-maintained, so it grows automatically once commerce
+ * (D-47) and signal-collectors (D-48) gain their own `MODULE_SLICES` entries.
+ *
+ * Only two of `ModuleSlice`'s shapes name a path that can actually appear in a
+ * scaffold's own output tree (`build-templates.mjs`'s `SNAPSHOT_DIRS` is
+ * `["apps", "database"]` — see its own header comment; `packages/*` is never
+ * copied into a scaffold, it is consumed as an npm dependency):
+ *
+ *   - `ownedFiles` entries that already sit under `apps/` — the scaffold
+ *     copies that tree verbatim, so the path is identical on both sides.
+ *   - `apps[name].path` — a paid module's OWN app directory. Multi-tenant's
+ *     `workspace` app has been extracted out of this repo's own `apps/` tree
+ *     into a sibling paid-apps root (its `ownedFiles` entry is a
+ *     whole-directory glob naming that monorepo-internal location, not a
+ *     scaffold one), so the app it introduces into a SCAFFOLD is named here
+ *     instead, via the slice's own declared path. `api` / `mcp` / `web` are
+ *     excluded: they are base apps present in
+ *     EVERY scaffold regardless of licence — a module only ever grants
+ *     import permissions into them, never introduces the directory, and the
+ *     paid FILES inside them are already covered by the `ownedFiles` branch
+ *     above.
+ *
+ * `ownedFiles` entries under `packages/` are excluded for the reason above.
+ * `namespaces` (database/*) are excluded too: each slice's own doc comment
+ * (see multi-tenant's in `module-architecture.ts`) records that a namespace
+ * directory mixes base and paid Prisma models in one `schema.prisma` file, so
+ * the DIRECTORY itself is not paid-owned even though some models inside it
+ * are — asserting it absent would be wrong on every scaffold, paid or free.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { MODULE_SLICES } from "../module-architecture.js";
+import { PAID_MODULES } from "./module-tier.js";
+/** Base app paths present in every scaffold regardless of the selected modules. */
+const BASE_APP_PATHS = new Set([
+    "apps/web",
+    "apps/api",
+    "apps/mcp",
+]);
+/** A slice's `ownedFiles` entries that live under `apps/` — copied verbatim into a scaffold. */
+function ownedFilesUnderApps(slice) {
+    return (slice.ownedFiles ?? [])
+        .filter((entry) => entry.startsWith("apps/"))
+        .map((entry) => entry.endsWith("/**") ? entry.slice(0, -"/**".length) : entry);
+}
+/** A slice's own app directories, excluding the base apps every scaffold ships. */
+function introducedAppPaths(slice) {
+    return Object.values(slice.apps ?? {})
+        .map((app) => app.path)
+        .filter((path) => !BASE_APP_PATHS.has(path));
+}
+/**
+ * The derived set of scaffold-relative paths a keyless scaffold must not
+ * contain — sorted, deduped.
+ *
+ * Throws if the result is empty: `PAID_MODULES` is never empty (it is
+ * `RECOGNIZED_MODULES` minus `FREE_MODULES`) and every paid module registered
+ * today owns at least one file under `apps/` or a whole app, so an empty
+ * result means the derivation itself broke — not that there is nothing to
+ * check (DEF-007: a silent `[]` must fail loudly, not pass the gate).
+ */
+export function derivePaidScaffoldPaths() {
+    const paths = new Set();
+    for (const moduleName of PAID_MODULES) {
+        const slice = MODULE_SLICES[moduleName];
+        for (const p of ownedFilesUnderApps(slice))
+            paths.add(p);
+        for (const p of introducedAppPaths(slice))
+            paths.add(p);
+    }
+    const sorted = [...paths].sort();
+    if (sorted.length === 0) {
+        throw new Error("derivePaidScaffoldPaths() computed an empty list — MODULE_SLICES and " +
+            "PAID_MODULES have drifted out of sync (DEF-007: this must never " +
+            "silently pass the no-paid-code gate)");
+    }
+    return sorted;
+}
+/**
+ * Every derived paid path that exists under `scaffoldDir` — the leaked set,
+ * sorted. Empty means the scaffold is clean.
+ */
+export function findLeakedPaidPaths(scaffoldDir) {
+    return derivePaidScaffoldPaths().filter((relPath) => existsSync(join(scaffoldDir, relPath)));
+}

package/dist/module-architecture.d.ts

@@ -1,26 +1,3 @@
-/**
- * Module → architecture-slice registry.
- *
- * The single source that turns the `--modules` selection into a scaffolded
- * site's `architecture.yaml` (its code-boundary config — the apps/packages/
- * namespaces the linter walks + the import rules it enforces). Each recognized
- * module maps to the architecture FRAGMENT it contributes; `deriveArchitecture`
- * (derive-architecture.ts) composes a module-independent BASE + the selected
- * slices into one deterministic document.
- *
- * Grounded in the root AILK `architecture.yaml` `composition_model`: a customer
- * site is the three-tier AILK app (data · api · presentation) COMPOSED of the
- * selected modules. `marketing` is the thin presentation default and is
- * validated end-to-end; `docs` (a mountable presentation surface) and
- * `multi-tenant` (a full-stack module) are registry-defined ahead of their
- * template trees (per spec #3787 D3). `scheduling` (#4633) contributes all
- * three tiers — the provider client, the /v1/schedule/* routes, and the
- * booker + confirmation pages — into the marketing surface.
- *
- * Design (spec #3787 D1): a code registry, NOT N hand-maintained per-module
- * `architecture.yaml` template files — a fixed template IS the drift this
- * removes.
- */
 import { type ModuleName } from "./parse-args.js";
 /** A forbidden import/usage pattern the architecture linter enforces. */
 export interface ForbiddenPattern {
@@ -52,6 +29,39 @@ export interface ArchNamespaces {
     members: Record<string, ArchNamespaceMember>;
     rules: string[];
 }
+/**
+ * One page a site template's roster declares (spec 5478 § D1).
+ *
+ * Both producers emit this same row type: a template's BASE roster
+ * (`TemplateManifest.roster`, template-manifest.ts) and a module's
+ * `pageContributions` below. One vocabulary, so the merge has exactly one
+ * collision key to reconcile rather than two (§ D1/D2).
+ *
+ * Declared HERE rather than in `template-manifest.ts` (§ D3) because
+ * `ModuleSlice` carries it and `template-manifest.ts` already imports
+ * `MODULE_SLICES` + `normalizeModules` from this file — so the dependency
+ * stays a DAG (`parse-args` ← `module-architecture` ← `template-manifest`)
+ * instead of becoming a cycle in the value graph.
+ *
+ * A row carries no nav label: `GATEABLE_SURFACES` already carries
+ * `navLabelKey?` per surface (`surfaces.ts`) and the nav is derived from the
+ * roster (parent spec 5462 § D9), so a label here would be a second authority
+ * for one fact.
+ */
+export interface PageRosterRow {
+    /**
+     * Site-relative route path, e.g. `/blog` or `/flows/[slug]/start`. This is
+     * the row's IDENTITY and the merge's collision key (§ D2): a path claimed by
+     * two sources is refused at build time, never resolved by a precedence rule
+     * (parent § D8).
+     */
+    route: string;
+    /**
+     * Repo-relative seed content this row renders. Absent for an API-backed row
+     * (`/schedule` renders from the scheduling API, not from an MDX file).
+     */
+    content?: readonly string[];
+}
 /**
  * The architecture fragment one module contributes.
  *
@@ -127,6 +137,141 @@ export interface ModuleSlice {
      * which miss eleven and over-mark three.
      */
     ownedFiles?: string[];
+    /**
+     * The page rows and seed content this module contributes to any site
+     * template that takes it (spec 5478; parent spec 5462 § D5) — `ownedFiles`'s
+     * sibling, and a DIFFERENT kind of fact again from every field above.
+     * `ownedFiles` names which files in THIS monorepo physically belong to the
+     * module; `pageContributions` names which PAGES the module brings to a
+     * template's roster. `template-manifest.ts`'s `mergeRoster` reads it.
+     *
+     * A contribution never carries route CODE. How the route code reaches a
+     * scaffold is a property of the module, not of the contribution (parent
+     * § D6): `docs-blog` and `scheduling` list their route files in `ownedFiles`
+     * so the code rides their own licence-checked bundle, while
+     * `signal-collectors` deliberately does not — its `flows` routes reach a
+     * scaffold from the `templates/` snapshot, retained because
+     * `MODULE_SURFACES` enables the surface (see this file's
+     * `signal-collectors.ownedFiles` comment for why listing them there broke
+     * `sync-routes`, #5366). Both shapes declare their rows here identically.
+     *
+     * Unset for a module that brings no pages to any declared template:
+     * `marketing` (base, no `ownedFiles` and `MODULE_SURFACES.marketing` is
+     * `[]`), and — deferred, not absent — `multi-tenant` and `commerce`, whose
+     * rows are their own instances' to enumerate. An unset field contributes
+     * zero rows openly; it is not a partial merge.
+     */
+    pageContributions?: readonly PageRosterRow[];
+    /**
+     * Bundle-relative source → scaffold-relative destination (spec 5373 § D7).
+     * Every source must be a file the validated tar extraction produced in the
+     * bundle producer's staging directory — repo-relative, coinciding with the
+     * `ownedFiles`/`installMap`-source paths this module's producer step
+     * stages at, by construction. `extractModuleBundle` applies this map after
+     * the tar entries are validated: an absolute path, a `..` segment, or a
+     * path absent from staging rejects the whole bundle, as does a destination
+     * that resolves outside the scaffold. A mapped source is copied to its
+     * destination only, never also to its original path.
+     */
+    installMap?: Record<string, string>;
+    /**
+     * Plain text `extractModuleBundle` prints to stdout after a successful
+     * merge, with C0/C1 control characters (other than newline) stripped
+     * first so a bundle cannot inject terminal escape sequences.
+     */
+    postInstall?: string;
+    /**
+     * Declarative, all-or-nothing edits to files the buyer's scaffold already
+     * has (spec 5418 § 3 D1) — a sibling of `installMap`/`postInstall` above.
+     * `installMap`/`postInstall` can only ADD or PRINT; `patches` is the only
+     * mechanism that edits an existing scaffolded file (`package.json`,
+     * `tsconfig.json`, `next.config.mjs`, `jest.config.cjs`). Applied by
+     * `applyModulePatches` after `installMap`, before `postInstall` (D5).
+     */
+    patches?: ModulePatch[];
+}
+/**
+ * The four target-file kinds a patch can address (spec 5418 § 3 D1).
+ * `"json"` covers both `package.json` (object-shaped fields: `dependencies`,
+ * `devDependencies`, `scripts`) and `tsconfig.json` (array-shaped:
+ * `references`) — distinguished by which op shape a `path` pairs with, not
+ * by a fourth kind. `next.config.mjs`/`jest.config.cjs` are code, not data,
+ * so each gets its own kind: a `next-config` op has no meaning against
+ * `jest.config.cjs`, and vice versa.
+ */
+export type ModulePatchKind = "json" | "next-config" | "jest-config";
+/** One target file's patch set — every op in `ops` applies to `target`. */
+export interface ModulePatch {
+    /**
+     * Scaffold-relative destination, e.g. "apps/web/package.json". Validated
+     * the same way an `installMap` destination is (D6): `resolve(targetDir,
+     * target)` must stay inside `targetDir`.
+     */
+    target: string;
+    kind: ModulePatchKind;
+    ops: ModulePatchOp[];
+}
+export type ModulePatchOp = JsonMergeKeysOp | JsonAppendUniqueOp | AddTranspilePackageOp | WrapExportWithOp | AddModuleNameMapperOp | AddTransformIgnorePatternOp | AddTransformOp;
+/** kind: "json" — object-shaped field (package.json dependencies/devDependencies/scripts). */
+export interface JsonMergeKeysOp {
+    op: "merge-keys";
+    /** JSON-pointer segments to an OBJECT, e.g. ["dependencies"]. */
+    path: string[];
+    /** key -> value; each key is added, never overwritten (D2). */
+    entries: Record<string, string>;
+}
+/** kind: "json" — array-shaped field (tsconfig.json references). */
+export interface JsonAppendUniqueOp {
+    op: "append-unique";
+    /** Segments to an ARRAY, e.g. ["references"]. */
+    path: string[];
+    /** Appended iff not already deep-equal-present (D2). */
+    items: unknown[];
+}
+/** kind: "next-config". */
+export interface AddTranspilePackageOp {
+    op: "add-transpile-package";
+    /** e.g. "@working-theory/fumadocs-schema". */
+    package: string;
+}
+/** kind: "next-config". */
+export interface WrapExportWithOp {
+    op: "wrap-export-with";
+    /** Exact line, e.g. 'import { createMDX } from "fumadocs-mdx/next";\n'. */
+    importLine: string;
+    /** Exact substring to wrap, e.g. "withNextIntl(nextConfig)". */
+    find: string;
+    /** e.g. "withNextIntl(createMDX()(nextConfig))". */
+    replaceWith: string;
+}
+/** kind: "jest-config". */
+export interface AddModuleNameMapperOp {
+    op: "add-module-name-mapper";
+    /**
+     * The moduleNameMapper KEY, e.g. "^@/\\.source$" — the runtime value this
+     * op carries has two backslash characters, matching jest.config.cjs's own
+     * bytes (D3's escaping rule: the value is the literal text as it occurs in
+     * the target file, never re-escaped for a notation layer above it).
+     */
+    pattern: string;
+    /** The mapped value. */
+    value: string;
+}
+/** kind: "jest-config". */
+export interface AddTransformIgnorePatternOp {
+    op: "add-transform-ignore-pattern";
+    /** The CURRENT array-element string. */
+    find: string;
+    /** The WIDENED replacement. */
+    replaceWith: string;
+}
+/** kind: "jest-config". */
+export interface AddTransformOp {
+    op: "add-transform";
+    /** The transform object's KEY (a regex string). */
+    pattern: string;
+    /** The mapped value, verbatim source text. */
+    value: string;
 }
 /**
  * The module-independent base: `apps/web` (the Next.js presentation shell every
@@ -173,3 +318,32 @@ export declare const MODULE_SLICES: Record<ModuleName, ModuleSlice>;
  *   rejects unrecognized values upstream before they reach derivation).
  */
 export declare function normalizeModules(modules: string[]): ModuleName[];
+/**
+ * Template-relative paths that must never be written into `templates/` for a
+ * keyless starter: every PAID module's `ownedFiles` entry that resolves under
+ * a `build-templates` snapshot root, plus every file under those roots that
+ * imports one (transitively), which would otherwise ship dangling.
+ *
+ * This is the SINGLE starter-removal input for all four R1 extractions
+ * (#5364 commerce, #5365 docs + blog, #5366 signal-collectors, #5367 Pro Plus
+ * + scheduling). A module joins by gaining `ownedFiles` entries — never by
+ * adding a path to a list here.
+ *
+ * The input is `ownedFiles`, NOT the `oss: false` marker set. The two answer
+ * different questions: the strip's authority is their union (see the
+ * `ownedFiles` doc above), while the STARTER's authority is `ownedFiles`
+ * alone. The marker set includes the content-write trio, which D-44 keeps in
+ * public code licence-checked at runtime — deriving the starter exclusion from
+ * markers would remove a surface D-44 says must ship.
+ *
+ * Entries outside the snapshot roots — every `packages/**` path, and the paid
+ * app roots — are not snapshotted at all and are filtered here rather than
+ * special-cased at the call site. Today every glob entry is also out-of-root,
+ * so globs never reach the literal-path matcher below.
+ *
+ * @param snapshotRoots repo-relative roots `build-templates.mjs` snapshots.
+ * @param repoRoot absolute path to the monorepo root, for the import scan.
+ *   Passed in rather than derived from `import.meta.url`, which ts-jest cannot
+ *   load — the same reason `sync-routes.ts` documents for staying pure.
+ */
+export declare function paidModuleTemplateExclusions(snapshotRoots: readonly string[], repoRoot: string): string[];