create-ailk 0.2.0 → 0.4.0

package/dist/module-architecture.js

@@ -21,6 +21,9 @@
  * `architecture.yaml` template files — a fixed template IS the drift this
  * removes.
  */
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { PAID_MODULES } from "./lib/module-tier.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
 /**
  * The standalone-site "no upstream-monorepo import" forbidden pattern, assembled
@@ -65,6 +68,19 @@ const PUBLIC_SCHEDULING_VAR_PATTERN = [
     "CAL",
     "_|CALCOM|CALENDAR|SCHEDUL|BOOKING)",
 ].join("");
+/**
+ * The commerce module's one credential-boundary pattern: a live-mode Stripe
+ * key shape (`sk_`/`pk_`/`rk_` + the live-mode infix), assembled from
+ * fragments for the same reason as CAL_KEY_PATTERN above — a literal
+ * live-key-shaped token in this file's source would itself trip the repo's
+ * own live-key hard block (`rules/environment-boundaries.md`). `apps/api` is
+ * excluded because `STRIPE_SECRET_KEY` legitimately lives there, gated by
+ * `assertSandboxKey`'s sandbox-only allow-list at request time and by
+ * `assertCommerceSandboxKey` at boot (server.ts) — this pattern catches a
+ * live-shaped key leaking anywhere ELSE (a fixture, a client component, a
+ * `NEXT_PUBLIC_` var).
+ */
+const STRIPE_LIVE_KEY_PATTERN = ["(sk|pk|rk)_li", "ve_[A-Za-z0-9]"].join("");
 /**
  * The module-independent base: `apps/web` (the Next.js presentation shell every
  * AILK site has) plus the standalone forbidden-pattern floor. `may_import_from`
@@ -193,8 +209,8 @@ export const MODULE_SLICES = {
             },
         },
     },
-    // ── docs — mountable presentation surface (fumadocs) ─────────────────────
-    docs: {
+    // ── docs-blog — Pro module: both fumadocs surfaces (D-46) ────────────────
+    "docs-blog": {
         webImports: ["packages/fumadocs-schema"],
         packages: {
             "fumadocs-schema": {
@@ -202,27 +218,179 @@ export const MODULE_SLICES = {
                 may_import_from: ["packages/schema", "packages/validation"],
             },
         },
-        // ownedFiles (S1, #5088). packages/fumadocs-schema/** is deliberately NOT
-        // listed: it is a JSON-LD bridge over the oss `packages/schema`, consumed
-        // by the Free `/blog` route, and was tiered `oss` in architecture.yaml
-        // (Sam, 2026-09-10, REL-015 #5182 Q3). The docs module owns its ROUTES,
-        // not that helper — the strip keeps the package in the public tree.
-        // (`webImports` above still names it, so a docs scaffold still installs it.)
+        // ownedFiles (S1, #5088; widened by #5365). The standing reason to list
+        // only the `/docs` route was that `/blog` was a FREE route, which made
+        // `lib/source.ts` and `source.config.ts` genuinely mixed files a strip
+        // tool could not touch without breaking every OSS build. D-46 removed
+        // that premise: docs and blog are ONE Pro module and Free has no blog, so
+        // both files are wholly module-owned and move whole (#5365 D3). Nothing
+        // in a Free `apps/web` resolves a Fumadocs collection afterwards, which is
+        // also why `apps/web/content/<locale>/{blog,docs}` no longer has to exist
+        // in every scaffold — see `programmatic.ts`'s note and #5365 D3.
+        //
+        // `packages/fumadocs-schema/**` is still deliberately NOT listed. It is a
+        // permission, not a physical slice: `webImports` above names it so a
+        // scaffold that installs this module declares the import, while the
+        // package itself stays in the tree for this repo's own marketing site. Its
+        // tier, licence and npm access flip together under #5363 (D-43) — after
+        // this extraction, because architecture.yaml's recorded reason for the
+        // current `oss` tier is the Free `/blog` route this card just retired.
+        //
+        // SOURCE files only (the rule above): the three `content/en/**` MDX files
+        // and every test/story companion carry the `oss: false` marker but are not
+        // listed here.
+        ownedFiles: [
+            // The two route surfaces the module mounts.
+            "apps/web/app/[locale]/blog/[[...slug]]/page.tsx",
+            "apps/web/app/[locale]/docs/[[...slug]]/page.tsx",
+            // The Fumadocs source pair — both whole, both loaders (D3).
+            "apps/web/source.config.ts",
+            "apps/web/lib/source.ts",
+            // The route adapters and the jest stub for the codegen output.
+            "apps/web/lib/blog-list-data.ts",
+            "apps/web/lib/blog-post-data.ts",
+            "apps/web/lib/__mocks__/source-server.js",
+            // The module's own /llms.txt variant; the bundle installs it onto
+            // app/llms.txt/route.ts (#5365 D9, install-path mapping owned by #5373).
+            "apps/web/lib/slices/docs-blog/llms-route.ts",
+            // The two shells and the six components, each off its public barrel and
+            // reachable only from the slice barrel that leaves with them (D-45, D5).
+            "packages/templates/src/shells/BlogShell.tsx",
+            "packages/templates/src/shells/DocsShell.tsx",
+            "packages/templates/src/shells/slices/docs-blog.ts",
+            "packages/ui/src/blocks/DocsActionBar.tsx",
+            "packages/ui/src/blocks/DocsArticleHeader.tsx",
+            "packages/ui/src/blocks/DocsFeedback.tsx",
+            "packages/ui/src/blocks/DocsSearch.tsx",
+            "packages/ui/src/blocks/DocsTocButton.tsx",
+            "packages/ui/src/chrome/DocsSidebar.tsx",
+            "packages/ui/src/chrome/slices/docs-blog.ts",
+        ],
+        // pageContributions (spec 5478; parent § D6 shape 1) — the two route
+        // surfaces this module mounts, each with the seed MDX it renders. The
+        // three MDX files are exactly the three on the tree and cannot come from
+        // the `templates/` snapshot: `apps/web/content` is in build-templates.mjs's
+        // EXCLUDE_TEMPLATE_DIRS and `template-overlay/` carries no blog or docs
+        // stub. They ride this module's own bundle, consistent with the route
+        // files above — STAGING them into it is #5481's change to
+        // build-module-bundles.mjs, since `collectModuleFiles` unions `ownedFiles`
+        // with `installMap` keys and nothing else. This unit only DECLARES them.
+        pageContributions: [
+            {
+                route: "/blog",
+                content: [
+                    "apps/web/content/en/blog/index.mdx",
+                    "apps/web/content/en/blog/launching-ailk.mdx",
+                ],
+            },
+            {
+                route: "/docs",
+                content: ["apps/web/content/en/docs/getting-started.mdx"],
+            },
+        ],
+        // patches (spec 5418 § 3 D1, Group G) — every Group G row that edits a
+        // file the buyer's scaffold already has. Values transcribed verbatim
+        // from docs/specs/5365-docs-blog-module-spec.md § 4 Group G via
+        // docs/specs/5418-module-bundle-patch-set-spec.md § 3 D1's table; the
+        // fumadocs-core/fumadocs-mdx version strings are read from this repo's
+        // own apps/web/package.json at HEAD.
         //
-        // apps/web's own `/docs` catch-all route IS module-owned and IS listed
-        // (verified against the filesystem — it exists today, contrary to this
-        // slice's header comment suggesting docs may have "zero apps/web files
-        // today"). Its two closest neighbors are deliberately NOT listed, because
-        // both are genuinely mixed with the base `/blog` route rather than
-        // docs-exclusive (checked by reading each file in full):
-        //   - apps/web/lib/source.ts        — exports BOTH `blogSource` and
-        //     `docsSource` from one file; `/blog` (base) needs the former.
-        //   - apps/web/source.config.ts     — defines BOTH the `blog` and `docs`
-        //     Fumadocs collections in one `defineDocs` pair.
-        // A strip tool cannot delete either without breaking `/blog`, which ships
-        // in every OSS build regardless of the docs module. apps/web/content/en/docs/
-        // (the MDX content itself, not source) is also excluded — content, not code.
-        ownedFiles: ["apps/web/app/[locale]/docs/[[...slug]]/page.tsx"],
+        // Group G's tsconfig.json row (D1 row 8 — restoring the
+        // `../../packages/fumadocs-schema` project reference) is deliberately
+        // NOT included here. Re-anchoring D1 against a real keyless scaffold
+        // (5418 build, Deliverable 0) found `apps/web/tsconfig.json` carries no
+        // `references` key at all in ANY scaffold, regardless of `--modules`
+        // selection: `build-templates.mjs`'s `stripDanglingProjectReferences()`
+        // runs once over the fixed templates/ snapshot, which never contains a
+        // `packages/` directory, so every one of the monorepo's 15 references
+        // (including `fumadocs-schema`, position 6) resolves to a nonexistent
+        // path and the whole property is dropped. `@working-theory/fumadocs-schema`
+        // is delivered to a scaffold as an npm/bundle dependency under
+        // `node_modules/`, never as a `packages/fumadocs-schema` source sibling
+        // (see this slice's own `ownedFiles` comment above), so restoring the
+        // reference would immediately be dangling again in every scaffold — the
+        // exact condition `stripDanglingProjectReferences()` exists to prevent,
+        // which breaks `next build`'s TypeScript pass (#4090 item 2). This is
+        // the same reasoning the commerce row (5418 D1 row 9) already applies to
+        // its own tsconfig.json omission; applied here for consistency.
+        //
+        // Group G's fourth jest.config.cjs item (the `import.meta` transform
+        // entry) needs no patch either — the scaffold already ships it
+        // untouched (5418 D1 row 7b) — so `add-transform` has no concrete use
+        // here.
+        patches: [
+            {
+                target: "apps/web/package.json",
+                kind: "json",
+                ops: [
+                    {
+                        op: "merge-keys",
+                        path: ["dependencies"],
+                        entries: {
+                            "fumadocs-core": "^16.10.4",
+                            "fumadocs-mdx": "^15.0.12",
+                            "@working-theory/fumadocs-schema": "workspace:*",
+                        },
+                    },
+                    {
+                        op: "merge-keys",
+                        path: ["scripts"],
+                        entries: {
+                            prebuild: "fumadocs-mdx",
+                            pretypecheck: "fumadocs-mdx",
+                            pretest: "fumadocs-mdx",
+                        },
+                    },
+                ],
+            },
+            {
+                target: "apps/web/next.config.mjs",
+                kind: "next-config",
+                ops: [
+                    {
+                        op: "add-transpile-package",
+                        package: "@working-theory/fumadocs-schema",
+                    },
+                    {
+                        op: "wrap-export-with",
+                        importLine: 'import { createMDX } from "fumadocs-mdx/next";\n',
+                        find: "withNextIntl(nextConfig)",
+                        replaceWith: "withNextIntl(createMDX()(nextConfig))",
+                    },
+                ],
+            },
+            {
+                target: "apps/web/jest.config.cjs",
+                kind: "jest-config",
+                ops: [
+                    {
+                        op: "add-transform-ignore-pattern",
+                        find: '"/node_modules/(?!(\\\\.pnpm/)?@working-theory(?:\\\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))"',
+                        replaceWith: '"/node_modules/(?!(\\\\.pnpm/)?(fumadocs-[^/]*?@?[^/]*?|@working-theory(?:\\\\+[^/]*?@?[^/]*?|/[^/]+))(/|$))"',
+                    },
+                    {
+                        op: "add-module-name-mapper",
+                        pattern: "^@/\\\\.source/server$",
+                        value: "<rootDir>/lib/__mocks__/source-server.js",
+                    },
+                    {
+                        op: "add-module-name-mapper",
+                        pattern: "^@/\\\\.source$",
+                        value: "<rootDir>/.source/index.ts",
+                    },
+                    {
+                        op: "add-module-name-mapper",
+                        pattern: "^@working-theory/fumadocs-schema$",
+                        value: "<rootDir>/node_modules/@working-theory/fumadocs-schema/dist/index.js",
+                    },
+                ],
+            },
+        ],
+        // postInstall shrinks to what patches cannot express (D5): the patch
+        // step edits package.json but never runs a package manager on the
+        // buyer's behalf, so a fresh pnpm-lock.yaml resolution is still the
+        // buyer's own next step.
+        postInstall: "run pnpm install",
     },
     // ── multi-tenant — full-stack module (data + api + presentation) ─────────
     //
@@ -241,6 +409,12 @@ export const MODULE_SLICES = {
                     "packages/theme",
                     "packages/ui",
                     "packages/validation",
+                    // The `workspace` module's shared settings components (#5371 req. 6)
+                    // — the scaffolded-site twin of the root architecture.yaml grant on
+                    // `apps_paid.workspace`. Pro Plus inherits Pro's module set, so a
+                    // saas-product scaffold carries both modules and this app composes
+                    // the identical panels apps/web does, with no forked copy.
+                    "packages/workspace-ui",
                 ],
                 may_not_import_from: [
                     "apps/api",
@@ -252,7 +426,7 @@ export const MODULE_SLICES = {
             },
             api: {
                 path: "apps/api",
-                description: "Public HTTP API — routes + services (Fastify). Owns webhooks, checkout, email, server-side analytics.",
+                description: "Public HTTP API — routes + services (Fastify). Owns webhooks, email, server-side analytics — checkout moved to the commerce module (D-47).",
                 may_import_from: [
                     "database",
                     "packages/analytics",
@@ -317,7 +491,7 @@ export const MODULE_SLICES = {
             // Object.assign merge in deriveArchitecture is order-independent (a
             // multi-tenant-only selection stays self-consistent).
             templates: {
-                description: "Shell/Chrome composition — WorkspaceShell + ArtifactEditorShell (tier-5 shells)",
+                description: "Shell/Chrome composition — AppShell (tier-5 shell); WorkspaceShell + ArtifactEditorShell ship inside this module itself, not the public package (D-45)",
                 may_import_from: ["packages/theme", "packages/ui", "packages/validation"],
             },
             theme: {
@@ -435,6 +609,24 @@ export const MODULE_SLICES = {
         // not a documented module boundary — flagged for reviewer judgment
         // rather than asserted here.
         //
+        // apps/web/app/[locale]/(authed)/waitlist/** (#5367 FR4, D8): the operator
+        // waitlist-experiments dashboard UI. Reads GET /v1/waitlist-experiments,
+        // whose API half is already listed above. No prior module claimed
+        // apps/web at all for multi-tenant — #5182 §8 flagged this gap and left
+        // it for this card. Presentation follows its API (D-48: "Operator review
+        // dashboards stay in Pro Plus").
+        //
+        // ESCALATION (§5.3, posted to Epic #5378): the spec's §4.3 file list names
+        // 12 files including format.ts and components/ForbiddenState.tsx as
+        // multi-tenant-owned. Both are imported by the FREE
+        // apps/web/app/[locale]/(authed)/account/page.tsx (lines 55-56) — D-49
+        // keeps that page in Free. Listing them here would remove a Free
+        // consumer's dependency from the starter (§5.3's stop condition). Treated
+        // the same as this slice's own project-listings/index.ts + respond.ts
+        // precedent immediately above: a file shared between the free and paid
+        // surfaces stays OUT of ownedFiles. Only the other 10 of the 12 are
+        // listed below.
+        //
         // database/auth/ and database/content/ — investigated, NOT listed.
         // Both namespaces DO have their own schema.prisma file (a real
         // filesystem split via Prisma's multi-file schema feature), but each
@@ -472,9 +664,103 @@ export const MODULE_SLICES = {
             "apps/api/src/services/waitlist-dashboard.ts",
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/lib/ws-token.ts",
+            "apps/web/app/[locale]/(authed)/waitlist/page.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/[experimentId]/page.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/[experimentId]/signups/[leadId]/page.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/ExperimentsTable.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/OfferFunnelTable.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/RollupTicker.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/ScoreTrace.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/SignupsTable.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/WaitlistComparisonTabs.tsx",
+            "apps/web/app/[locale]/(authed)/waitlist/components/status-badges.tsx",
             "apps-paid/workspace/**",
         ],
     },
+    // ── workspace — Pro module: the single-workspace settings shell (D-27/D-49)
+    //
+    // `/workspace` in apps/web's `(authed)` segment — General (rename), Site
+    // (identity / SEO / theme, over the already-shipped apps/api config routes)
+    // and Team (a read-only roster). The three panels live in the shared
+    // `packages/workspace-ui` package so the multi-tenant workspace app (the
+    // Pro Plus app) composes the identical components rather than a fork.
+    //
+    // No `apps` / `namespaces` / `forbiddenPatterns` block: this module
+    // contributes to already-declared apps only (apps/web is BASE; apps/api is
+    // declared by multi-tenant / scheduling / commerce and is snapshotted whole).
+    workspace: {
+        // A PERMISSION, not a physical slice (#5371 D1a) — the identical shape
+        // docs-blog uses for `packages/fumadocs-schema`. `packages/` is never in
+        // SNAPSHOT_DIRS, so the package reaches a buyer as an npm/bundle
+        // dependency under `node_modules/`, never as a `packages/workspace-ui`
+        // source sibling; the `patches` entry below is what puts it in the
+        // buyer's apps/web/package.json.
+        webImports: ["packages/workspace-ui"],
+        packages: {
+            "workspace-ui": {
+                description: "Shared workspace-settings components — the settings shell plus the General / Site / Team panels, presentational only (data + save callbacks as props)",
+                // packages/templates is required because WorkspaceSettingsShell
+                // composes AppShell from @working-theory/templates/shells — the same
+                // composition apps/web's own account page uses.
+                may_import_from: [
+                    "packages/templates",
+                    "packages/theme",
+                    "packages/ui",
+                    "packages/validation",
+                ],
+            },
+        },
+        // SOURCE files only, and only the ones this module physically owns: the
+        // three apps/web route files and the two apps/api route files.
+        //
+        // `packages/workspace-ui/**` is deliberately NOT listed (D1a). It is a
+        // whole package that is paid end to end, whose strip disposition is
+        // carried by architecture.yaml's `commercial_tier_moves_to` field (its
+        // future paid-tree home) rather than by a per-file inventory —
+        // exactly the disposition `packages/fumadocs-schema` carries for
+        // docs-blog. `multi-tenant`'s whole-app glob (above) works because
+        // SNAPSHOT_DIRS physically copies apps wholesale; a package is never in a
+        // snapshot root, so an ownedFiles enumeration would add nothing.
+        //
+        // `packages/api-client/src/workspace.ts` is NOT listed either (D1b):
+        // api-client is a base package every scaffold receives regardless of
+        // `--modules`, and the field doc above names it by name as a shared
+        // package deliberately left out even when genuinely single-purpose. The
+        // wrapper is harmless on a scaffold without this module — its calls 404,
+        // the same non-event any client wrapper produces against an unregistered
+        // route.
+        //
+        // Test companions (`__tests__/`) are never listed — the SOURCE-files-only
+        // rule above.
+        ownedFiles: [
+            "apps/web/app/[locale]/(authed)/workspace/page.tsx",
+            "apps/web/app/[locale]/(authed)/workspace/site/page.tsx",
+            "apps/web/app/[locale]/(authed)/workspace/team/page.tsx",
+            "apps/api/src/routes/workspaces/general.ts",
+            "apps/api/src/routes/workspaces/members.ts",
+        ],
+        // patches — the dependency add that delivers the shared package to the
+        // buyer's apps/web, mirroring docs-blog's own fumadocs-schema merge-keys
+        // op. No next.config.mjs `add-transpile-package` op: the package ships
+        // compiled ESM in dist/ the same way every other @working-theory/*
+        // dependency apps/web already consumes does, and docs-blog's transpile op
+        // exists for the fumadocs SDK boundary, not for the dependency add itself.
+        patches: [
+            {
+                target: "apps/web/package.json",
+                kind: "json",
+                ops: [
+                    {
+                        op: "merge-keys",
+                        path: ["dependencies"],
+                        entries: {
+                            "@working-theory/workspace-ui": "workspace:*",
+                        },
+                    },
+                ],
+            },
+        ],
+    },
     // ── scheduling — full-stack module (provider + routes + booker pages) ────
     //
     // The #4416 scheduling seam, made installable. Three tiers into the
@@ -511,7 +797,7 @@ export const MODULE_SLICES = {
         apps: {
             api: {
                 path: "apps/api",
-                description: "Public HTTP API — routes + services (Fastify). Owns webhooks, checkout, email, server-side analytics.",
+                description: "Public HTTP API — routes + services (Fastify). Owns webhooks, email, server-side analytics — checkout moved to the commerce module (D-47).",
                 may_import_from: [
                     "database",
                     "packages/analytics",
@@ -642,6 +928,377 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/schedule/page.tsx",
             "apps/web/app/[locale]/schedule/confirmed/page.tsx",
         ],
+        // pageContributions (spec 5478; parent § D6 shape 1) — the booker and its
+        // confirmation page, whose route files `ownedFiles` above already carries.
+        // Neither row names seed content: both render from the /v1/schedule/*
+        // routes, not from an MDX file.
+        pageContributions: [
+            { route: "/schedule" },
+            { route: "/schedule/confirmed" },
+        ],
+    },
+    // ── signal-collectors — flows, deliverables, project listings, waitlist
+    // signups (D-48, #5366) ───────────────────────────────────────────────
+    //
+    // ownedFiles verified against the current filesystem, server.ts's
+    // module-conditional registration (isModuleEnabled('signal-collectors')),
+    // and a repo-wide grep of every importer of each candidate file (an
+    // independent re-grep, not carried over from the spec's own table).
+    //
+    // apps/api/src/routes/project-listings/index.ts is MIXED (D4): it holds
+    // this module's five anonymous/founder-read re-exports (lines 1-55) AND
+    // multi-tenant's TENANT_HANDLERS table + projectListingTenantRoutes
+    // (lines 57-139) in one file. NOT listed here — never deleted/edited on
+    // its own, exactly like the scheduling/multi-tenant precedent for a mixed
+    // barrel above.
+    //
+    // apps/api/src/routes/project-listings/respond.ts (`sendValidated`) IS
+    // listed, even though it is ALSO imported directly by the tenant routes
+    // get.ts/list.ts/patch.ts/patch-copy.ts (multi-tenant, Pro Plus territory
+    // — grep-verified, four direct importers outside this module). Same D6
+    // reasoning as the services below: every non-territory consumer is a
+    // strictly higher (Pro Plus) level, never Free, so this module owns the
+    // file and #5367 records the prerequisite.
+    //
+    // Ten services below are reached from Pro Plus's project-listings tenant
+    // routes (get.ts/list.ts/patch.ts/patch-copy.ts) or commerce's recommender,
+    // directly or transitively through project-listing-decision.ts /
+    // project-listing-flow.ts — grep-verified, not carried over from the
+    // spec's table (which independently reaches the same eight; this pass adds
+    // waitlist-scoring.ts and playbook-compile.ts, both of which the finalize
+    // scorecard already flagged as under-described). D6's rule: this module
+    // owns the shared file because every OTHER consumer is a superset level
+    // (OFFERINGS.md §4a Table 1 — Pro Plus contains Pro; the commerce add-on is
+    // never sold at Free); #5364/#5367 each record this module as a
+    // prerequisite of the routes that reach it rather than re-homing the file.
+    //   - flow-engine.ts       — pro-plus, via project-listing-flow.ts:49 ←
+    //                            project-listing-decision.ts:81 ← patch.ts:38
+    //   - waitlist-scoring.ts  — pro-plus, transitively (sole importer is
+    //                            flow-engine.ts:56, which is itself shared)
+    //   - playbook-compile.ts  — pro-plus, transitively (imported by
+    //                            waitlist-scoring.ts:33 and, in-module, by
+    //                            playbook-render.ts:62 and
+    //                            routes/deliverables/index.ts:44)
+    //   - project-listings.ts, listing-config.ts, project-listing-decision.ts,
+    //     project-listing-flow.ts, project-listing-issue.ts,
+    //     waitlist-experiments.ts — pro-plus, direct or transitive via the
+    //     decision/flow chain above
+    //   - deliverable-fulfillment.ts — commerce, via recommender-capture.ts:70.
+    //     NOT ADDED to ownedFiles below, unlike the rest of this list — spec
+    //     §5.4's escalation boundary fires for this ONE file: D6's premise is
+    //     "every OTHER consumer is a superset level, never Free," but
+    //     recommender-capture.ts (and recommender.ts above it, and server.ts
+    //     above THAT via a plain static import) is UNCONDITIONAL today — #5364
+    //     has not landed to gate it behind isModuleEnabled("commerce"). Adding
+    //     this file to ownedFiles made `paidModuleTemplateExclusions()`'s
+    //     import-graph closure exclude recommender.ts, then server.ts itself,
+    //     from every keyless scaffold (empirically found, #5366 resume pass) —
+    //     a base-breaking regression a template snapshot must never produce.
+    //     Revert this line once #5364 lands and gates the recommender routes;
+    //     until then the file ships in every scaffold regardless of module
+    //     selection, exactly as it did before this card (a narrower, temporary
+    //     miss than the one D6 accepts on purpose for the other nine).
+    //
+    // apps/api/src/services/listing-promotion.ts has ZERO production
+    // importers anywhere in the repo (only its own test) — confirmed dead code
+    // (spec §7 Q5). Listed anyway: it is listing code by subject, D-48 places
+    // the instrument here, and a reachability grep cannot place an unreached
+    // file — this is a recorded pre-existing defect, not fixed by this card.
+    //
+    // apps/api/src/bin/deliverable-upload.ts imports only `prisma` (no moved
+    // service) but is a deliverables CLI a Free starter should not ship —
+    // listed by subject, not by the import-criterion the other six bins meet.
+    //
+    // apps/web: FlowStepperClient.tsx, ResultsClient.tsx and
+    // ListingApplicationClient.tsx are this module's OWN files (below), so
+    // their packages/ui imports (FlowStepper, FlowSidePanel,
+    // ListingApplicationFlow) are in-module edges, not Free ones, despite
+    // living under apps/web rather than apps-paid.
+    //
+    // packages/ui: eleven components (D8) plus the NEW slice registration
+    // entry point (D8a, mirroring sections/slices/scheduling.ts). Four of the
+    // eleven (ProjectListingShelves, ListingPrivacyNotice, ProjectListingCard,
+    // ResultsReveal) had no consumer anywhere IN THIS REPO at D8 authoring
+    // time — grep-confirmed, a module-boundary fact only in-repo. Three of the
+    // four (ProjectListingShelves, ProjectListingCard, ListingPrivacyNotice —
+    // plus the ListingWindowBand type ProjectListingCard exports) are, in
+    // fact, consumed CROSS-ORG: the samhenry site (salessmyth org) imports all
+    // four from the signal-collectors slice's re-export entry point
+    // (packages/ui/src/sections/slices/signal-collectors.ts, rules/cross-org-
+    // sharing.md), which #5488 additionally re-exports them from so that
+    // consumer can reach them by subpath. "No consumer anywhere in the repo"
+    // was therefore true in-repo and false across the org boundary — not a
+    // reachability fact a repo-scoped grep can see. ResultsReveal remains the
+    // one component of the four with no known consumer anywhere (in-repo or
+    // out) and is NOT re-exported by #5488 — it is not this card's claim to
+    // make it non-orphaned. D8's placement rule (by subject — project-listing
+    // / results-reveal UI — rather than by reachability, since reachability
+    // cannot place an unreached file either) is unchanged and still governs
+    // where all eleven live.
+    "signal-collectors": {
+        ownedFiles: [
+            "apps/api/src/routes/flows/index.ts",
+            // README.md documents the flows rate-limit rationale (#4730) — not a
+            // test/generated file, and its absence is exactly what left a stray
+            // apps/api/src/routes/flows/ directory in a keyless templates/ snapshot
+            // (empirically found, #5366) since the import-graph closure below only
+            // scans source extensions, never markdown.
+            "apps/api/src/routes/flows/README.md",
+            "apps/api/src/routes/deliverables/index.ts",
+            "apps/api/src/routes/slack/index.ts",
+            "apps/api/src/routes/slack/actions.ts",
+            "apps/api/src/routes/waitlist-signups/index.ts",
+            // apps/api/src/routes/project-listings/{start,patch-draft,submit,public,
+            // me,respond,resume-token}.ts and services/{project-listings,
+            // listing-config}.ts deliberately NOT listed — see the comment above
+            // this array (D-48/#5366 escalation: the mixed-barrel `index.ts` in
+            // that directory is reached from server.ts by a plain, literal
+            // `import()` for multi-tenant's tenant routes, and statically imports
+            // all nine of these files itself, so `paidModuleTemplateExclusions()`'s
+            // import-graph closure excluded `index.ts`, then `server.ts` itself,
+            // from every keyless scaffold (empirically found, #5366 resume pass,
+            // same failure mode as the deliverable-fulfillment.ts case below but a
+            // permanent structural one rather than a temporal gap pending another
+            // PR). This is also the ORIGINAL multi-tenant/#5088 card's own
+            // conclusion about these same nine files (lines 556-571 above) —
+            // D-48 moves their tier ownership to signal-collectors but not their
+            // must-ship-unconditionally constraint. Registration of every route
+            // that reaches them stays gated by `isModuleEnabled("signal-collectors")`
+            // in server.ts; only the source files themselves ship regardless.
+            "apps/api/src/services/flow-engine.ts",
+            "apps/api/src/services/flow-aggregate.ts",
+            "apps/api/src/services/waitlist-signups.ts",
+            "apps/api/src/services/waitlist-scoring.ts",
+            "apps/api/src/services/playbook-compile.ts",
+            "apps/api/src/services/playbook-render.ts",
+            "apps/api/src/services/listing-csv-sweep.ts",
+            "apps/api/src/services/waitlist-followup.ts",
+            "apps/api/src/services/listing-promotion.ts",
+            "apps/api/src/services/project-listing-decision.ts",
+            "apps/api/src/services/project-listing-flow.ts",
+            "apps/api/src/services/project-listing-issue.ts",
+            "apps/api/src/services/waitlist-experiments.ts",
+            // deliverable-fulfillment.ts deliberately NOT listed — see the comment
+            // above this array (spec §5.4 escalation boundary, temporary pending #5364).
+            "apps/api/src/bin/deliverable-resend.ts",
+            "apps/api/src/bin/deliverable-upload.ts",
+            "apps/api/src/bin/session-retention-sweep.ts",
+            "apps/api/src/bin/seed-presets.ts",
+            "apps/api/src/bin/listing-csv-sweep.ts",
+            "apps/api/src/bin/followup-sweep.ts",
+            "apps/api/src/bin/seed-waitlist-experiments.ts",
+            "apps/mcp/src/tools/get_flow.ts",
+            "apps/mcp/src/tools/submit_flow_step.ts",
+            // apps/web/app/[locale]/flows/** deliberately NOT listed here (unlike
+            // the docs-blog precedent's own `blog`/`docs` page.tsx entries above),
+            // even though every file under it is signal-collectors territory and
+            // still carries its own `oss: false` marker for the OSS-strip. Every
+            // one of these files is ALREADY excluded from a keyless scaffold by the
+            // pre-existing, independent `MODULE_SURFACES["signal-collectors"] =
+            // ["flows"]` → `excludedRoutePaths()` mechanism (#4154), which removes
+            // the WHOLE `apps/web/app/[locale]/flows` directory at copy time
+            // whenever the "flows" surface isn't selected — and `resolveSurfaces`
+            // refuses `--surfaces flows` without the module (#5365 FR5/D12), so
+            // there is no way to reach "flows carried, signal-collectors absent".
+            // Adding them to `ownedFiles` ALSO excludes them from `templates/`
+            // itself (build-templates.mjs), which broke `sync-routes`'s pre-#5366
+            // upgrade-path fixture (`flows/[slug]/results/[payload]`, #4891/#4986)
+            // and — more importantly — would silently strip a REAL consumer's
+            // `sync-routes` tool of the ability to ever restore these files after
+            // scaffolding, since that tool diffs against `templates/` alone and has
+            // no module/licence concept of its own (empirically found, #5366 resume
+            // pass). `projects/apply/ListingApplicationClient.tsx` below is
+            // different in kind: it sits under the UNRELATED "projects" content
+            // surface's URL segment, which `excludedRoutePaths` does not gate on
+            // signal-collectors at all, so it genuinely needs `ownedFiles` to be
+            // excluded from a keyless scaffold — see `sync-routes.ts`'s
+            // `NESTED_FOREIGN_MODULE_ENTRIES` for the companion fix that keeps its
+            // presence from falsely reading as "projects carried".
+            "apps/web/app/[locale]/projects/apply/ListingApplicationClient.tsx",
+            "packages/ui/src/sections/ListingApplicationFlow.tsx",
+            "packages/ui/src/sections/ProjectListingShelves.tsx",
+            "packages/ui/src/sections/FlowStepper.tsx",
+            "packages/ui/src/blocks/FlowSidePanel.tsx",
+            "packages/ui/src/blocks/ListingFullPreview.tsx",
+            "packages/ui/src/blocks/ListingQuestionReview.tsx",
+            "packages/ui/src/blocks/ListingTilePreview.tsx",
+            "packages/ui/src/blocks/ListingPrivacyNotice.tsx",
+            "packages/ui/src/blocks/ProjectListingCard.tsx",
+            "packages/ui/src/blocks/ResponseChart.tsx",
+            "packages/ui/src/blocks/ResultsReveal.tsx",
+            "packages/ui/src/sections/slices/signal-collectors.ts",
+        ],
+        // pageContributions (spec 5478; parent § D6 shape 2) — the three flow
+        // routes, named exactly as `surfaces.ts`'s ROUTE_SINCE keys name them.
+        // ROWS AND SEED ONLY: unlike docs-blog and scheduling above, this module's
+        // route code is deliberately NOT in `ownedFiles` (see the comment inside
+        // that array). The first two rows' code reaches a scaffold from the
+        // `templates/` snapshot, retained because the `flows` surface is enabled;
+        // the results row's code is `commerce`'s (`commerce.ownedFiles` carries
+        // `results/[payload]/page.tsx` + its two client files below, and
+        // `paidModuleTemplateExclusions` strips every paid module's owned files
+        // from the snapshot unconditionally), so that one row rides a DIFFERENT
+        // module's bundle — recorded in spec 5478 § 8 item 1, whose delivery
+        // consequence is #5481's and #5464's. Declaring the rows here changes none
+        // of it: a contribution is data, and which delivery shape carries the code
+        // is a property of the module, not of the contribution.
+        pageContributions: [
+            { route: "/flows/[slug]" },
+            { route: "/flows/[slug]/start" },
+            { route: "/flows/[slug]/results/[payload]" },
+        ],
+    },
+    // ── commerce — per-site paid add-on (D-47, amending D-26) ─────────────────
+    //
+    // Checkout, the Stripe webhook receiver, flow checkouts and the recommender
+    // (D-47's disposition sentence, verbatim). The base API keeps only
+    // `isModuleEnabled("commerce")`; every registration loads through
+    // `SLICE_PLUGINS` (server.ts). `apps.api.may_import_from` names
+    // `packages/stripe-client` — the module's own package (D5) — mirroring the
+    // `multi-tenant`/`scheduling` slices' identical entry, which already
+    // document "checkout moved to the commerce module (D-47)" for the same
+    // reason those two slices state theirs: `deriveArchitecture` merges `api`
+    // blocks with `Object.assign`, so every slice declaring `api` must agree.
+    //
+    // Q1 (spec §7): a `multi-tenant` deployment using the Stripe billing portal
+    // or org-scoped webhook routing (`routes/billing/portal.ts`,
+    // `routes/webhooks/stripe.ts`'s org-billing branch) also depends on
+    // `lib/stripe.ts` and the webhook receiver this module owns — declared
+    // here, not engineered around.
+    commerce: {
+        apps: {
+            api: {
+                path: "apps/api",
+                description: "Public HTTP API — routes + services (Fastify). Owns checkout, the Stripe webhook receiver, flow checkouts and the recommender (D-47) — the Stripe setup and stripe-client's sole apps/api reach.",
+                may_import_from: [
+                    "database",
+                    "packages/analytics",
+                    "packages/email",
+                    "packages/license",
+                    "packages/schema",
+                    "packages/site-config",
+                    "packages/stripe-client",
+                    "packages/validation",
+                ],
+                may_not_import_from: [
+                    "apps/mcp",
+                    "apps/web",
+                    "packages/theme",
+                    "packages/ui",
+                ],
+            },
+        },
+        packages: {
+            // Duplicated VERBATIM from the multi-tenant slice's own "stripe-client"
+            // entry (§7 Q1 — a multi-tenant deployment using the Stripe billing
+            // portal or org-billing webhook routing also installs commerce, so
+            // both slices can be selected together) — the same order-independence
+            // reason the multi-tenant/scheduling slices state for `validation`
+            // below: `deriveArchitecture` merges `packages` blocks with
+            // `Object.assign`, so two slices declaring this key differently would
+            // make the derivation depend on module order.
+            "stripe-client": {
+                description: "Stripe SDK wrapper + webhook signature verification",
+                may_import_from: ["packages/validation"],
+            },
+            // Duplicated VERBATIM from the marketing slice for the same
+            // order-independence reason the multi-tenant/scheduling slices state.
+            validation: {
+                description: "Zod schemas + shared types",
+                may_import_from: [],
+            },
+        },
+        // webImports omitted (§4.4): no commerce component reaches apps/web
+        // through a package apps/web does not already import — packages/ui is
+        // base, and architecture.yaml already forbids apps/web -> stripe-client.
+        forbiddenPatterns: [
+            {
+                pattern: STRIPE_LIVE_KEY_PATTERN,
+                paths_excluded: ["apps/api/**"],
+                reason: "The commerce credential belongs to apps/api, behind assertSandboxKey's sandbox-only allow-list. A live-mode-shaped key anywhere else is a leak, not a config choice",
+            },
+        ],
+        // ownedFiles (S1, #5088). SOURCE files only (#5182 D6) — no __tests__/,
+        // no .stories.tsx, no .text.ts... except .text.ts siblings ARE source
+        // (they ship as runtime copy modules, not test fixtures), so the ten
+        // annotated below are listed. 42 in all: 9 apps/api + 26 packages/ui
+        // (15 components + 10 .text.ts siblings + this slice's own
+        // sections/slices/commerce.ts) + 7 apps/web.
+        ownedFiles: [
+            "apps/api/src/lib/stripe.ts",
+            "apps/api/src/routes/checkout/index.ts",
+            "apps/api/src/routes/checkout/sessions.ts",
+            "apps/api/src/routes/webhooks/index.ts",
+            "apps/api/src/routes/webhooks/stripe.ts",
+            // README.md documents the Stripe webhook receiver — not a test/
+            // generated file, and its absence is exactly what left a stray
+            // apps/api/src/routes/webhooks/ directory in a keyless templates/
+            // snapshot (empirically found, #5364 build pass): the import-graph
+            // closure only scans source extensions, never markdown, so once
+            // index.ts and stripe.ts are excluded this is the one file left
+            // behind. Same defect class #5366 found and fixed the same way for
+            // routes/flows/README.md — see that entry above.
+            "apps/api/src/routes/webhooks/README.md",
+            "apps/api/src/routes/flow-checkouts/index.ts",
+            "apps/api/src/routes/flows/recommender.ts",
+            "apps/api/src/services/recommender-capture.ts",
+            "apps/api/src/services/flow-checkouts.ts",
+            "packages/ui/src/blocks/CheckoutForm.tsx",
+            "packages/ui/src/blocks/CheckoutForm.text.ts",
+            "packages/ui/src/blocks/CheckoutPriceCard.tsx",
+            "packages/ui/src/blocks/PaymentLinkCard.tsx",
+            "packages/ui/src/blocks/PaymentLinkCard.text.ts",
+            "packages/ui/src/blocks/PaymentLinkForm.tsx",
+            "packages/ui/src/blocks/PaymentLinkForm.text.ts",
+            "packages/ui/src/blocks/PaymentLinkList.tsx",
+            "packages/ui/src/blocks/InvoiceForm.tsx",
+            "packages/ui/src/blocks/InvoiceForm.text.ts",
+            "packages/ui/src/blocks/InvoiceList.tsx",
+            "packages/ui/src/blocks/InvoiceList.text.ts",
+            "packages/ui/src/blocks/SubscriptionStatus.tsx",
+            "packages/ui/src/blocks/SubscriptionStatus.text.ts",
+            "packages/ui/src/blocks/StripeActionButton.tsx",
+            "packages/ui/src/blocks/PaymentStatusBadge.tsx",
+            "packages/ui/src/blocks/PaymentStatusBadge.text.ts",
+            "packages/ui/src/blocks/PaymentResult.tsx",
+            "packages/ui/src/blocks/PaymentResult.text.ts",
+            "packages/ui/src/blocks/PortalEntry.tsx",
+            "packages/ui/src/panels/InvoiceDetail.tsx",
+            "packages/ui/src/panels/InvoiceDetail.text.ts",
+            "packages/ui/src/sections/PaymentReceipt.tsx",
+            "packages/ui/src/sections/PricingTable.tsx",
+            "packages/ui/src/sections/PricingTable.text.ts",
+            "packages/ui/src/sections/slices/commerce.ts",
+            "apps/web/app/[locale]/flows/[slug]/checkout.actions.ts",
+            "apps/web/app/[locale]/flows/[slug]/results/[payload]/page.tsx",
+            "apps/web/app/[locale]/flows/[slug]/results/[payload]/ResultsClient.tsx",
+            "apps/web/app/[locale]/flows/[slug]/results/[payload]/ResultsEmailStep.tsx",
+            "apps/web/app/[locale]/dev/purchase/page.tsx",
+            "apps/web/app/[locale]/dev/purchase/error.tsx",
+            "apps/web/app/[locale]/dev/purchase/purchase.actions.ts",
+        ],
+        // The scaffold-commerce authoring skill (D-47, #5449): moved by `git mv`
+        // out of the Free starter's `templates/.claude/skills/` (never stripped —
+        // it sits outside build-templates.mjs's SNAPSHOT_DIRS/overlay, so
+        // ownedFiles/paidModuleTemplateExclusions cannot reach it) to
+        // `module-templates/commerce/.claude/skills/scaffold-commerce/`, and
+        // delivered into a keyed scaffold by `installMap` instead. Ten literal
+        // entries, not one directory entry: `extractModuleBundle`'s
+        // `validateInstallMap` requires every source to be a FILE the bundle
+        // produced (`extract-module-bundle.ts`'s `!sourceStat.isFile()` check) —
+        // a directory source is rejected outright.
+        installMap: {
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/SKILL.md": ".claude/skills/scaffold-commerce/SKILL.md",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/references/lookup-keys-template.md": ".claude/skills/scaffold-commerce/references/lookup-keys-template.md",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/references/marketplace-brand-pages.md": ".claude/skills/scaffold-commerce/references/marketplace-brand-pages.md",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/checkout-route.template.ts": ".claude/skills/scaffold-commerce/templates/checkout-route.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/invoice-route.template.ts": ".claude/skills/scaffold-commerce/templates/invoice-route.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/marketplace-cta-route.tsx.tmpl": ".claude/skills/scaffold-commerce/templates/marketplace-cta-route.tsx.tmpl",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/payment-link-route.template.ts": ".claude/skills/scaffold-commerce/templates/payment-link-route.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/portal-route.template.ts": ".claude/skills/scaffold-commerce/templates/portal-route.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/stripe-config.template.ts": ".claude/skills/scaffold-commerce/templates/stripe-config.template.ts",
+            "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/subscription-route.template.ts": ".claude/skills/scaffold-commerce/templates/subscription-route.template.ts",
+        },
     },
 };
 /**
@@ -661,3 +1318,141 @@ export function normalizeModules(modules) {
     }
     return RECOGNIZED_MODULES.filter((m) => requested.has(m));
 }
+/**
+ * Template-relative paths that must never be written into `templates/` for a
+ * keyless starter: every PAID module's `ownedFiles` entry that resolves under
+ * a `build-templates` snapshot root, plus every file under those roots that
+ * imports one (transitively), which would otherwise ship dangling.
+ *
+ * This is the SINGLE starter-removal input for all four R1 extractions
+ * (#5364 commerce, #5365 docs + blog, #5366 signal-collectors, #5367 Pro Plus
+ * + scheduling). A module joins by gaining `ownedFiles` entries — never by
+ * adding a path to a list here.
+ *
+ * The input is `ownedFiles`, NOT the `oss: false` marker set. The two answer
+ * different questions: the strip's authority is their union (see the
+ * `ownedFiles` doc above), while the STARTER's authority is `ownedFiles`
+ * alone. The marker set includes the content-write trio, which D-44 keeps in
+ * public code licence-checked at runtime — deriving the starter exclusion from
+ * markers would remove a surface D-44 says must ship.
+ *
+ * Entries outside the snapshot roots — every `packages/**` path, and the paid
+ * app roots — are not snapshotted at all and are filtered here rather than
+ * special-cased at the call site. Today every glob entry is also out-of-root,
+ * so globs never reach the literal-path matcher below.
+ *
+ * @param snapshotRoots repo-relative roots `build-templates.mjs` snapshots.
+ * @param repoRoot absolute path to the monorepo root, for the import scan.
+ *   Passed in rather than derived from `import.meta.url`, which ts-jest cannot
+ *   load — the same reason `sync-routes.ts` documents for staying pure.
+ */
+export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
+    const roots = new Set(snapshotRoots);
+    const excluded = new Set();
+    for (const moduleName of PAID_MODULES) {
+        for (const owned of MODULE_SLICES[moduleName]?.ownedFiles ?? []) {
+            const rel = owned.split(sep).join("/");
+            if (!roots.has(rel.split("/")[0] ?? ""))
+                continue;
+            if (rel.includes("*"))
+                continue;
+            excluded.add(rel);
+        }
+    }
+    // Companion closure by import graph, to a fixed point — never a filename
+    // stem rule (#5182 D7), which misses eleven files and over-marks three.
+    const candidates = listFilesUnder(repoRoot, [...roots]);
+    for (;;) {
+        let grew = false;
+        for (const file of candidates) {
+            if (excluded.has(file))
+                continue;
+            const imports = relativeImportsOf(join(repoRoot, file));
+            for (const spec of imports) {
+                const target = resolveRelativeImport(file, spec, candidates);
+                if (target !== undefined && excluded.has(target)) {
+                    excluded.add(file);
+                    grew = true;
+                    break;
+                }
+            }
+        }
+        if (!grew)
+            break;
+    }
+    return [...excluded].sort();
+}
+const SOURCE_EXTS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+/** Every source file under the given repo-relative roots, as "/"-joined paths. */
+function listFilesUnder(repoRoot, roots) {
+    const out = new Set();
+    const skip = new Set(["node_modules", ".next", "dist", ".turbo", ".source"]);
+    const stack = roots.map((r) => r);
+    while (stack.length > 0) {
+        const rel = stack.pop();
+        const abs = join(repoRoot, rel);
+        let entries;
+        try {
+            entries = readdirSync(abs, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (skip.has(entry.name))
+                continue;
+            const childRel = `${rel}/${entry.name}`;
+            if (entry.isDirectory())
+                stack.push(childRel);
+            else if (SOURCE_EXTS.some((e) => entry.name.endsWith(e)))
+                out.add(childRel);
+        }
+    }
+    return out;
+}
+/** The relative import specifiers a source file names (static imports + re-exports). */
+function relativeImportsOf(absPath) {
+    let src;
+    try {
+        src = readFileSync(absPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const m of src.matchAll(/(?:^|\n)\s*(?:import|export)[\s\S]{0,400}?from\s*["'](\.[^"']*)["']/g))
+        out.push(m[1]);
+    for (const m of src.matchAll(/\bimport\s*\(\s*["'](\.[^"']*)["']\s*\)/g))
+        out.push(m[1]);
+    return out;
+}
+/**
+ * Resolve a relative specifier against the candidate set. TypeScript ESM writes
+ * `./x.js` for `./x.ts`, so the `.js` → `.ts`/`.tsx` rewrite is the common case.
+ */
+function resolveRelativeImport(fromFile, spec, candidates) {
+    const base = posixJoin(dirname(fromFile.split("/").join(sep)), spec);
+    const stem = base.replace(/\.(js|jsx|mjs|cjs)$/, "");
+    for (const cand of [
+        base,
+        ...SOURCE_EXTS.map((e) => stem + e),
+        ...SOURCE_EXTS.map((e) => `${stem}/index${e}`),
+    ])
+        if (candidates.has(cand))
+            return cand;
+    return undefined;
+}
+/** Join and normalize a "/"-separated path, resolving `.` and `..` segments. */
+function posixJoin(dir, spec) {
+    const parts = `${dir.split(sep).join("/")}/${spec}`.split("/");
+    const out = [];
+    for (const part of parts) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..")
+            out.pop();
+        else
+            out.push(part);
+    }
+    return out.join("/");
+}