create-ailk 0.24.0 → 0.26.0

package/dist/lib/design-checks.js

@@ -25,7 +25,6 @@
  * (#8661 D11); `admitSeededContactPage` admits only those two fields.
  */
 import { execFileSync } from "node:child_process";
-import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { CONTACT_PAGE_PATH } from "../design-home.js";
@@ -189,9 +188,10 @@ export function assessJsonLdDrift(design, before, after) {
     };
 }
 /**
- * Scaffold a keyless `organization-product` site on `standard`, compose its
- * JSON-LD, run `apply-design <design>` on it, and compose again. A non-zero
- * exit at any step throws naming the step and the child's stderr.
+ * Scaffold an `organization-product` site on `standard` — keyed when
+ * `licenseKey` is given — compose its JSON-LD, run `apply-design <design>` on
+ * it, and compose again. A non-zero exit at any step throws naming the step
+ * and the child's stderr.
  */
 export function measureApplyDesignDrift(opts) {
     const baseEnv = { ...process.env };
@@ -223,9 +223,15 @@ export function measureApplyDesignDrift(opts) {
             throw new Error(`drift: ${label} printed no JSON: ${err.message}`, { cause: err });
         }
     };
-    exec("scaffold organization-product on standard", process.execPath, [opts.cliPath, site, "--shape", "organization-product", "--design", "standard"], registryEnv);
-    if (opts.licenseKey !== undefined)
-        writeFileSync(join(site, "ailk.key"), `${opts.licenseKey}\n`);
+    exec("scaffold organization-product on standard", process.execPath, [
+        opts.cliPath,
+        site,
+        "--shape",
+        "organization-product",
+        "--design",
+        "standard",
+        ...(opts.licenseKey === undefined ? [] : ["--license", opts.licenseKey]),
+    ], registryEnv);
     const before = compose("compose JSON-LD before apply-design");
     const applyStdout = exec(`apply-design ${opts.design}`, process.execPath, [opts.cliPath, "apply-design", opts.design, "--target", site], opts.registryUrl === undefined ? {} : { AILK_MODULE_REGISTRY_URL: opts.registryUrl });
     const after = compose("compose JSON-LD after apply-design");

package/dist/lib/extract-module-bundle.js

@@ -23,8 +23,8 @@
  * `extractBundle` extracts into an EMPTY staging dir that then swap-renames
  * over the (possibly pre-existing) install target — appropriate for a single
  * self-contained skill directory. A fetched module's files are scattered
- * across an ALREADY-SCAFFOLDED tree (`apps/api/src/routes/...`,
- * `apps/web/app/...`), so there is no single directory to rename over.
+ * across an ALREADY-SCAFFOLDED tree (`apps/web/app/...`,
+ * `apps/web/lib/...`), so there is no single directory to rename over.
  * `extractModuleBundle` therefore extracts into a throwaway temp dir first
  * (same validation, same guards), and ONLY on full success copies each
  * validated file into its place under `targetDir` — so a rejected or
@@ -386,6 +386,26 @@ function validateLayerOwnership(destinations, ownership, subject, isTemplate, pa
     }
 }
 /** Every regular file under `srcRoot`, as a `/`-separated relative path. */
+const API_SOURCE_ROOT = "apps/api/";
+/**
+ * #9565 D6 — refuse a tree that would write under `apps/api/`, naming the
+ * path. Checked BEFORE any write, beside `validateInstallMap` and
+ * `validatePatches`.
+ */
+function refuseApiSource(sourceRoot, installMap, patches, subject) {
+    const toPosixRel = (p) => normalize(p).split(sep).join("/").replace(/^\.\//, "");
+    // Compared lower-cased: on a case-insensitive filesystem `Apps/API/...` lands
+    // in the same tree.
+    const underApi = (rel) => rel.toLowerCase().startsWith(API_SOURCE_ROOT);
+    const offenders = [
+        ...stagedFiles(sourceRoot).filter(underApi),
+        ...Object.values(installMap).map(toPosixRel).filter(underApi),
+        ...patches.map((patch) => toPosixRel(patch.target)).filter(underApi),
+    ];
+    if (offenders.length > 0) {
+        throw new Error(`${subject}: refuses to write ${offenders[0]} — API source ships in its @working-theory/api-<module> package, never in a bundle (#9565)`);
+    }
+}
 function stagedFiles(srcRoot) {
     const out = [];
     const stack = [srcRoot];
@@ -545,6 +565,13 @@ export function installBundleTree(options) {
     // Every declared patch is validated, skipped or not (#7426 D4), exactly as
     // the installMap is above; only then are the skipped ones dropped.
     validatePatches(declaredPatches, targetAbs, subject);
+    // #9565 D6 — no bundle writes under apps/api/: a module's API source is its
+    // `@working-theory/api-<module>` package, installed from npm, never a copy
+    // in the site's tree. A staged file, a (remapped) installMap destination or
+    // a patch target under apps/api/ refuses the whole tree at this same
+    // fail-closed point, for module and template trees alike — which is what
+    // holds for a bundle built before this change and still at the store.
+    refuseApiSource(sourceRoot, remappedInstallMap, declaredPatches, subject);
     const patches = declaredPatches.filter((patch) => !isSkipped(patch.target));
     options.checkPatches?.(patches);
     // The exclusion set copyTree/the content-only guard both use — built from

package/dist/lib/fetch-template-snapshot.d.ts

@@ -12,7 +12,8 @@ export interface FetchTemplateSnapshotOptions {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree from its published npm tarball.
+ * tree, plus its `templates/database/` boot files and root `templates/tools/`
+ * files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/fetch-template-snapshot.js

@@ -21,6 +21,7 @@ import { createHash } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 import * as tar from "tar";
 import { templateDestination } from "../copy.js";
+import { DATABASE_BOOT_FILES, ROOT_TOOL_FILES } from "../template-record.js";
 import { MAX_TOTAL_SIZE_BYTES } from "./extract-module-bundle.js";
 import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
 export const DEFAULT_AILK_NPM_REGISTRY_URL = "https://registry.npmjs.org";
@@ -29,6 +30,8 @@ const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
 /** The one tar path prefix a snapshot is read from, and the three app roots inside it. */
 const TAR_ROOT = "package/templates/";
 const APP_PREFIXES = ["apps/web/", "apps/api/", "apps/mcp/"];
+/** The paths outside the app roots a snapshot keeps: a hub's three database boot files (#9569 DD8) and the root tools/ files the app configs require (#9654). */
+const BOOT_FILES = new Set([...DATABASE_BOOT_FILES, ...ROOT_TOOL_FILES]);
 export class FetchTemplateSnapshotError extends Error {
     constructor(message) {
         super(message);
@@ -110,13 +113,14 @@ async function fetchTarball(tarballUrl, integrity, version, fetchImpl) {
     }
     return buf;
 }
-/** The app-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees. */
+/** The template-relative path (no `package/templates/` prefix) for a tar entry path, or undefined outside the three app trees, the database boot files and the root tools/ files. */
 function appRelativePath(tarPath) {
     if (!tarPath.startsWith(TAR_ROOT))
         return undefined;
     const rel = tarPath.slice(TAR_ROOT.length);
-    if (!APP_PREFIXES.some((prefix) => rel.startsWith(prefix)))
+    if (!APP_PREFIXES.some((prefix) => rel.startsWith(prefix)) && !BOOT_FILES.has(rel)) {
         return undefined;
+    }
     if (rel.length === 0)
         return undefined;
     const segments = rel.split("/");
@@ -176,7 +180,8 @@ function parseSnapshot(gunzipped, version) {
 }
 /**
  * Fetch and re-materialise create-ailk `version`'s `templates/apps/{web,api,mcp}/`
- * tree from its published npm tarball.
+ * tree, plus its `templates/database/` boot files and root `templates/tools/`
+ * files, from its published npm tarball.
  *
  * @throws FetchTemplateSnapshotError on an invalid version, an unreachable
  *   or malformed registry response, an integrity mismatch, or a symlink /

package/dist/lib/import-graph.d.ts

@@ -16,7 +16,7 @@ export declare function resolveRelativeImport(fromFile: string, spec: string, ca
  * This is the shape both consumers need, and the reason the walk is shared
  * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
  * paid module's `ownedFiles` to get the files a keyless starter must not
- * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * carry; the retired slice-registration lint seeded it with the same set to
  * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
  *
  * Never a filename-stem rule (#5182 D7), which misses eleven files and

package/dist/lib/import-graph.js

@@ -8,9 +8,9 @@
  * - `paidModuleTemplateExclusions()` (module-architecture.ts) walks it to take
  *   the companion closure of every paid module's `ownedFiles` — the files that
  *   would ship dangling into a keyless starter.
- * - `tools/lint-slice-registration.ts` walks it to close over the specifiers an
- *   `isModuleEnabled("X")` branch in `apps/api/src/server.ts` loads, and to
- *   check every reached file against what module X's slice delivers.
+ * - the slice-registration lint walked it (#5701, retired by #9565 D8 once
+ *   no bundle delivered an API file) to close over the specifiers a module
+ *   gate loaded and check each against what the slice delivered.
  *
  * Both questions are "which files does this one reach through relative
  * imports", and the answer must be the same function in both mouths: a lint
@@ -105,7 +105,7 @@ function posixJoin(dir, spec) {
  * This is the shape both consumers need, and the reason the walk is shared
  * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
  * paid module's `ownedFiles` to get the files a keyless starter must not
- * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * carry; the retired slice-registration lint seeded it with the same set to
  * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
  *
  * Never a filename-stem rule (#5182 D7), which misses eleven files and

package/dist/lib/module-license-gate.d.ts

@@ -17,7 +17,7 @@ export declare class LicenseRequiredError extends Error {
 }
 /** The five axes `release-scope.json` declares (spec 6977 D3). */
 export type ReleaseAxis = "templates" | "shapes" | "designs" | "modules" | "levels";
-/** `gated` and `deferred` are both refused; only a `gated` one gets negative checks. */
+/** `gated` and `deferred` are both refused; only a `gated` one gets negative checks (the Free level excepted, #6484). */
 export type ReleaseStatus = "released" | "gated" | "deferred";
 export type ReleaseScope = Readonly<Record<ReleaseAxis, Readonly<Record<string, ReleaseStatus>>>>;
 /**
@@ -44,6 +44,17 @@ export declare class ReleaseScopeError extends Error {
  * gated module.
  */
 export declare function assertReleased(axis: ReleaseAxis, names: readonly (string | undefined)[], scope?: ReleaseScope): void;
+/**
+ * A run with no key is a Free run, and `release-scope.json` says whether Free
+ * is available (#6484, REL-034.1: deferred — held). Refused before any prompt,
+ * fetch or write, with the level gate's message naming the pricing page; zero
+ * network. A keyed run passes through untouched — its level is the registry's
+ * answer (`deriveLevel`), never decided here. Called by `cli.ts` ahead of the
+ * shape prompt, and by `resolvePaidModules` for an all-Free request — the
+ * seam every `scaffold()` branch crosses (alias, keep and default alike),
+ * after the scope-name refusals and before the first write.
+ */
+export declare function assertKeyedOrFreeReleased(licenseKey?: string | undefined): void;
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by

package/dist/lib/module-license-gate.js

@@ -12,10 +12,11 @@
  *   (c) a valid key → every requested paid module's bundle bytes, ready for
  *       `extract-module-bundle.ts` to merge into the scaffold.
  *
- * A Free-only request (no paid modules) never reaches the key check at all —
- * `resolvePaidModules` returns immediately, before touching `process.env` or
- * the network, so a bare/all-Free scaffold is provably unaffected by this
- * gate (K1's regression floor).
+ * A Free-only request (no paid modules) never reaches the network — but since
+ * #6484 (REL-034.1) it does read the key: no key is the Free level, which
+ * `release-scope.json` defers, so `resolvePaidModules` refuses it through
+ * `assertKeyedOrFreeReleased` before returning its empty map. A keyed
+ * all-Free scaffold is unaffected (K1's regression floor, keyed).
  *
  * Also carries the design gate (#6760): `assertDesignAllowed` refuses a
  * non-`standard` design at the `free` level, naming the design and the
@@ -28,7 +29,7 @@
 import releaseScopeJson from "../../release-scope.json" with { type: "json" };
 import { FetchModuleError, fetchModule } from "./fetch-module.js";
 import { assertLicenseKeyShape } from "./license-key-files.js";
-import { ADD_ONS, LEVEL_LABEL, LEVEL_MODULES, OPT_IN_MODULES, PAID_MODULES, classifyModules, composeModuleSet, levelOf, } from "./module-tier.js";
+import { LEVEL_LABEL, LEVEL_MODULES, PAID_MODULES, classifyModules, composeModuleSet, isAddition, levelOf, } from "./module-tier.js";
 /**
  * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
  * `/pro` route and there will not be one (#6439, operator decision OD-2) —
@@ -107,14 +108,32 @@ export function assertReleased(axis, names, scope = RELEASE_SCOPE) {
             continue;
         const released = Object.keys(statuses).filter((n) => statuses[n] === "released");
         // A level comes from the key, never a flag — so it points at what the run CAN choose.
-        const choose = axis === "levels"
-            ? `Your licence key's level is ${name}; name the modules you want with --modules (one of: ${Object.keys(scope.modules)
-                .filter((m) => scope.modules[m] === "released")
-                .join(", ")}).`
-            : `Choose one of: ${released.join(", ")}.`;
+        // `free` is the keyless level (#6484): it points at the pricing page.
+        const choose = axis === "levels" && name === "free"
+            ? `No licence key, so this would be a Free scaffold — pass --license <key> or set AILK_LICENSE_KEY with a Pro key → ${CONVERSION_HINT_URL}`
+            : axis === "levels"
+                ? `Your licence key's level is ${name}; name the modules you want with --modules (one of: ${Object.keys(scope.modules)
+                    .filter((m) => scope.modules[m] === "released")
+                    .join(", ")}).`
+                : `Choose one of: ${released.join(", ")}.`;
         throw new ReleaseScopeError(`${AXIS_NOUN[axis]} "${name}" is not available yet. ${choose}`);
     }
 }
+/**
+ * A run with no key is a Free run, and `release-scope.json` says whether Free
+ * is available (#6484, REL-034.1: deferred — held). Refused before any prompt,
+ * fetch or write, with the level gate's message naming the pricing page; zero
+ * network. A keyed run passes through untouched — its level is the registry's
+ * answer (`deriveLevel`), never decided here. Called by `cli.ts` ahead of the
+ * shape prompt, and by `resolvePaidModules` for an all-Free request — the
+ * seam every `scaffold()` branch crosses (alias, keep and default alike),
+ * after the scope-name refusals and before the first write.
+ */
+export function assertKeyedOrFreeReleased(licenseKey = process.env["AILK_LICENSE_KEY"]) {
+    if (licenseKey === undefined || licenseKey.length === 0) {
+        assertReleased("levels", ["free"]);
+    }
+}
 /**
  * Design names every level renders (#6760 D1). Anything else in
  * `STARTER_DESIGNS` is Pro and up. A path design's Free-ness is decided by
@@ -182,12 +201,15 @@ function licenseErrorMessage(err, moduleName, templateName, level) {
  */
 export async function resolvePaidModules(options) {
     const { paidModules } = options;
+    const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (paidModules.length === 0) {
-        // Regression floor: zero key reads, zero network, for any request that
-        // names no paid module.
+        // Zero network for any request that names no paid module — but no
+        // longer zero key reads (#6484): a keyless all-Free request is the Free
+        // level, which `release-scope.json` holds, and is refused here, after
+        // `scaffold()`'s scope-name refusals and before its first write.
+        assertKeyedOrFreeReleased(token);
         return new Map();
     }
-    const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (token === undefined || token.length === 0) {
         throw new LicenseRequiredError(noKeyMessage(paidModules, options.templateName));
     }
@@ -324,8 +346,7 @@ export async function deriveDesignLevel(options) {
  */
 export async function resolveModuleSet(options) {
     const namedList = options.named ?? [];
-    const additions = [...ADD_ONS, ...OPT_IN_MODULES];
-    const isKeep = namedList.some((m) => !additions.includes(m));
+    const isKeep = namedList.some((m) => !isAddition(m));
     if (isKeep) {
         const modules = composeModuleSet(namedList, "free");
         const { paid } = classifyModules(modules);

package/dist/lib/module-tier.d.ts

@@ -23,13 +23,6 @@ export declare const LEVEL_LABEL: Readonly<Record<Level, string>>;
  * an add-on ON TOP of.
  */
 export declare const ADD_ONS: readonly ModuleName[];
-/**
- * Included at Pro and above (the licence manifest's `pro` tier), but not
- * switched on by default at any level (D1) — an authed app surface
- * contributing no PUBLIC page to a marketing site. Naming it in `--modules`
- * adds it without trimming, exactly like an add-on.
- */
-export declare const OPT_IN_MODULES: readonly ModuleName[];
 /** Whether naming `m` in `--modules` adds it without trimming the level default. */
 export declare function isAddition(m: ModuleName): boolean;
 /**
@@ -42,7 +35,8 @@ export declare const LEVEL_MODULES: Readonly<Record<Level, readonly ModuleName[]
 /**
  * Which level (or add-on status) a module belongs to (D2). `"free"` for
  * `FREE_MODULES`, `"add-on"` for `ADD_ONS`, `"pro-plus"` for
- * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — D1). Pure.
+ * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — in the Pro default
+ * since #9696, the DECISION-LOG row in salessmyth/ailaunchkit-site#134). Pure.
  */
 export declare function levelOf(m: ModuleName): Level | "add-on";
 /**

package/dist/lib/module-tier.js

@@ -43,22 +43,22 @@ export const LEVEL_LABEL = {
  * an add-on ON TOP of.
  */
 export const ADD_ONS = ["commerce"];
-/**
- * Included at Pro and above (the licence manifest's `pro` tier), but not
- * switched on by default at any level (D1) — an authed app surface
- * contributing no PUBLIC page to a marketing site. Naming it in `--modules`
- * adds it without trimming, exactly like an add-on.
- */
-export const OPT_IN_MODULES = ["workspace"];
 /** The Pro Plus membership: what Pro Plus switches on beyond Pro. */
 const PRO_PLUS_MODULES = ["multi-tenant"];
-/** Named modules that never trim the level default when composing a set (D2). */
-const ADDITIONS = [...ADD_ONS, ...OPT_IN_MODULES];
+/**
+ * Named modules that never trim the level default when composing a set (D2):
+ * the add-ons, and `workspace` — the authed /admin surface, which contributes
+ * no PUBLIC page. Since #9696 (reversing #6759 D1; the DECISION-LOG row dated
+ * 2026-10-24, salessmyth/ailaunchkit-site#134) `workspace` is IN the Pro and
+ * Pro Plus defaults, so naming it is a no-op there; below Pro it adds it, and
+ * the gate refuses it naming Pro.
+ */
+const ADDITIONS = [...ADD_ONS, "workspace"];
 /** Whether naming `m` in `--modules` adds it without trimming the level default. */
 export function isAddition(m) {
     return ADDITIONS.includes(m);
 }
-const PRO_EXCLUDED = new Set([...ADDITIONS, ...PRO_PLUS_MODULES]);
+const PRO_EXCLUDED = new Set([...ADD_ONS, ...PRO_PLUS_MODULES]);
 /**
  * What a key at each level switches on with no `--modules` (D2). Derived —
  * every list is `RECOGNIZED_MODULES.filter(...)`, so declaration order is
@@ -70,12 +70,13 @@ export const LEVEL_MODULES = Object.freeze({
     pro: RECOGNIZED_MODULES.filter((m) => FREE_MODULES.includes(m) ||
         (PAID_MODULES.includes(m) && !PRO_EXCLUDED.has(m))),
     "pro-plus": RECOGNIZED_MODULES.filter((m) => FREE_MODULES.includes(m) ||
-        (PAID_MODULES.includes(m) && !ADDITIONS.includes(m))),
+        (PAID_MODULES.includes(m) && !ADD_ONS.includes(m))),
 });
 /**
  * Which level (or add-on status) a module belongs to (D2). `"free"` for
  * `FREE_MODULES`, `"add-on"` for `ADD_ONS`, `"pro-plus"` for
- * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — D1). Pure.
+ * `PRO_PLUS_MODULES`, else `"pro"` (`workspace` included — in the Pro default
+ * since #9696, the DECISION-LOG row in salessmyth/ailaunchkit-site#134). Pure.
  */
 export function levelOf(m) {
     if (FREE_MODULES.includes(m))

package/dist/module-architecture.d.ts

@@ -100,6 +100,15 @@ export interface ModuleSlice {
      * otherwise. Only a module with a BASE-tree consumer sets it.
      */
     paidSectionsPackage?: string;
+    /**
+     * The paid MCP tool packages base code loads through
+     * `apps/mcp/src/lib/paid-tools.generated.ts` (#9460 DD6). Each is one row
+     * in the generated registry: a bundled `import()` when the scaffold's
+     * `apps/mcp/package.json` declares the package, absent otherwise. A
+     * package two modules deliver (`mcp-workspace`) is listed by each and
+     * rendered once.
+     */
+    paidMcpToolPackages?: string[];
     /** Packages this module adds to apps/web.may_import_from (its presentation surface). */
     webImports?: string[];
     /** Apps this module declares (api, mcp replace the base block; admin is new). web is BASE, never here. */
@@ -124,7 +133,7 @@ export interface ModuleSlice {
      * *scaffolded customer site's* `architecture.yaml` — "apps/web MAY import
      * packages/fumadocs-schema." `ownedFiles` instead names, one literal path at
      * a time, which files in *this* monorepo physically belong to the module —
-     * "apps/api/src/routes/schedule/index.ts IS the scheduling module." A
+     * "packages-paid/api-scheduling/src/routes/schedule/index.ts IS the scheduling module." A
      * package can appear in one view and not the other: `packages/fumadocs-schema`
      * is a `webImports` entry (a permission — a docs scaffold installs it) but
      * NOT an `ownedFiles` entry (it is `oss`-tiered; the strip keeps it).
@@ -154,7 +163,7 @@ export interface ModuleSlice {
      *     `RECOGNIZED_MODULES`, so adding a `content-write` key would make
      *     `create-ailk --modules content-write` a valid scaffold selection. It is
      *     not one — content-write is a licence-tier line drawn inside a single
-     *     app, never a customer opt-in (see `apps/api/src/config/modules.ts`).
+     *     app, never a customer opt-in (see `packages/api/src/config/modules.ts`).
      *   - Two are this-list-only and the manifest simply never recorded them:
      *     `apps/web/app/[locale]/docs/[[...slug]]/page.tsx` and
      *     `apps/web/app/[locale]/meet/confirmed/page.tsx`.
@@ -164,6 +173,14 @@ export interface ModuleSlice {
      * are derived from the import graph — a test or story file carries
      * `oss: false` iff it imports a slice file — never from filename stems,
      * which miss eleven and over-mark three.
+     *
+     * Since REL-034.4 (#9565 D6) no entry names an `apps/api/` path: a module's
+     * API source is its `@working-theory/api-<module>` package under
+     * `packages-paid/`, dropped from the public tree wholesale and reached by a
+     * keyed scaffold through npm, never through a bundle. The producer
+     * (`scripts/build-module-bundles.mjs` `stageModule`) refuses to stage, and
+     * the extractor (`lib/extract-module-bundle.ts` `installBundleTree`) refuses
+     * to install, any path under `apps/api/`.
      */
     ownedFiles?: string[];
     /**
@@ -349,7 +366,7 @@ export declare const ARCHITECTURE_BASE: {
     readonly version: 1;
     readonly composition_model: {
         readonly tiers: {
-            readonly data: "database/ — Prisma schema + migrations";
+            readonly data: "database/ — Prisma config + seed; schema and migrations ship in @working-theory/database";
             readonly api: "apps/api (public HTTP API) + apps/mcp (agent tools)";
             readonly presentation: "apps/web — frontend surfaces";
         };