create-ailk 0.3.0 → 0.5.0

package/dist/lib/fetch-guard.js

@@ -0,0 +1,101 @@
+/**
+ * Shared network-safety guards for `fetch-template.ts` / `fetch-module.ts`
+ * (issue #5514, Lows 2 and 5 — a post-merge backstop on #5510's
+ * `create-ailk --template` feature).
+ *
+ * A plain internal helper module, not a shared package: both callers already
+ * state at length (see their file docs) why `create-ailk` — the one package
+ * in this monorepo published to public npm — cannot take a runtime
+ * dependency on anything `restricted`-tier. A sibling file inside
+ * `packages/create-ailk/src/lib/` carries no such dependency and is exactly
+ * the right place for logic the two fetchers would otherwise duplicate a
+ * second time.
+ *
+ * Three guards live here:
+ *   - `REQUEST_TIMEOUT_MS` / `fetchTimeoutSignal()` — neither fetcher had a
+ *     request timeout before this; a hung or slow-drip response could block
+ *     `create-ailk` forever.
+ *   - `assertHttpsRegistryUrl()` — neither fetcher validated the scheme of
+ *     the registry URL (env-var-overridable) it was about to send a bearer
+ *     JWT to. Rejects any non-`https:` origin, UNLESS the test-mode seam
+ *     (`NODE_ENV === "test"`) is active — the same seam
+ *     `template-scaffold.test.ts`'s `run()` helper already relies on when it
+ *     spreads `process.env` into the CLI subprocess it spawns against the
+ *     loopback mock registry (`http://127.0.0.1:<port>`). Confirmed
+ *     empirically: Jest sets `NODE_ENV=test` for its own process (and thus
+ *     every child it spawns, since `run()` inherits `process.env`) whenever
+ *     the ambient environment does not already set it — there is no other
+ *     test-mode flag anywhere in this codebase (`AILK_ALLOW*`, `insecure`,
+ *     `__TEST__`, etc. do not exist).
+ *   - `assertContentLengthWithinLimit()` — neither fetcher checked a
+ *     response's declared size against `MAX_TOTAL_SIZE_BYTES` before buffering
+ *     the WHOLE body via `.arrayBuffer()`. That cap was previously enforced
+ *     only downstream, against tar entries, in
+ *     `extract-module-bundle.ts`'s `safeExtractTarGz` — too late to stop an
+ *     oversized response from being held in memory first.
+ */
+import { MAX_TOTAL_SIZE_BYTES } from "./extract-module-bundle.js";
+/**
+ * Per-request timeout applied to every template/module registry fetch.
+ * 30s is generous for a small tarball fetch over a real network while still
+ * bounding a hung connection or slow-drip response.
+ */
+export const REQUEST_TIMEOUT_MS = 30_000;
+/** `AbortSignal.timeout(REQUEST_TIMEOUT_MS)` — one call site, one constant. */
+export function fetchTimeoutSignal() {
+    return AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+}
+/**
+ * `true` iff `hostname` is a loopback host — the ONLY hosts a plain `http:`
+ * registry URL is accepted for. The test suite spawns its mock registry on
+ * `127.0.0.1`; nothing else needs cleartext. (An earlier revision keyed this
+ * on `NODE_ENV=test`, an ambient variable any environment can export — a
+ * security control in a public npm package must not carry a kill switch.)
+ */
+function isLoopbackHost(hostname) {
+    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]" || hostname === "::1";
+}
+/**
+ * Reject a registry URL whose origin is not `https:`, unless its host is
+ * loopback (above) — the mock registry the test suite spawns is deliberately
+ * plain `http://127.0.0.1:<port>`. `ErrorCtor` lets each
+ * caller throw its own error class (`FetchTemplateError` / `FetchModuleError`)
+ * so this is a new FAILURE MODE, never a new error type from the caller's
+ * point of view — and never a licence error (`isLicenseError` stays false).
+ */
+export function assertHttpsRegistryUrl(registryUrl, ErrorCtor) {
+    let scheme;
+    let hostname;
+    try {
+        const parsed = new URL(registryUrl);
+        scheme = parsed.protocol;
+        hostname = parsed.hostname;
+    }
+    catch {
+        throw new ErrorCtor(`refusing to use registry URL "${registryUrl}": not a valid URL`);
+    }
+    if (scheme !== "https:" && !isLoopbackHost(hostname)) {
+        throw new ErrorCtor(`refusing to use registry URL "${registryUrl}": scheme must be https:, got "${scheme}"`);
+    }
+}
+/**
+ * Reject a `Response` whose `Content-Length` header declares a size larger
+ * than `MAX_TOTAL_SIZE_BYTES` — called by the caller right after its
+ * existing status-code checks succeed, BEFORE `.arrayBuffer()` ever runs, so
+ * an oversized body is never buffered into memory. A missing or unparseable
+ * `Content-Length` is not itself a violation (a chunked/streamed response may
+ * omit it) — this is defense in depth against a declared size, not a
+ * replacement for the tar-entry cumulative-size cap `extract-module-bundle.ts`
+ * still enforces downstream.
+ */
+export function assertContentLengthWithinLimit(response, ErrorCtor) {
+    const header = response.headers.get("content-length");
+    if (header === null)
+        return;
+    const declared = Number(header);
+    if (!Number.isFinite(declared))
+        return;
+    if (declared > MAX_TOTAL_SIZE_BYTES) {
+        throw new ErrorCtor(`refusing response: declared Content-Length ${declared} exceeds the ${MAX_TOTAL_SIZE_BYTES}-byte limit`);
+    }
+}

package/dist/lib/fetch-module.js

@@ -36,6 +36,7 @@
  * exit uniformly.
  */
 import pkg from "../../package.json" with { type: "json" };
+import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
 export const DEFAULT_AILK_MODULE_REGISTRY_URL = "https://ailaunchkit.ai/api/modules";
 /**
  * This package's own `package.json` `"version"`. Deliberately a static JSON
@@ -79,6 +80,7 @@ export async function fetchModule(options) {
     const registryUrl = options.registryUrl ??
         process.env["AILK_MODULE_REGISTRY_URL"] ??
         DEFAULT_AILK_MODULE_REGISTRY_URL;
+    assertHttpsRegistryUrl(registryUrl, FetchModuleError);
     const url = buildUrl(registryUrl, moduleName, version);
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     let response;
@@ -90,6 +92,7 @@ export async function fetchModule(options) {
                 Accept: "application/gzip, application/octet-stream",
             },
             redirect: "error",
+            signal: fetchTimeoutSignal(),
         });
     }
     catch (err) {
@@ -111,6 +114,7 @@ export async function fetchModule(options) {
         const body = await safeReadBody(response);
         throw new FetchModuleError(`module registry returned ${response.status} for "${moduleName}": ${body}`);
     }
+    assertContentLengthWithinLimit(response, FetchModuleError);
     const buf = await response.arrayBuffer();
     return new Uint8Array(buf);
 }

package/dist/lib/fetch-template.d.ts

@@ -0,0 +1,20 @@
+export declare const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
+export interface FetchTemplateOptions {
+    templateName: string;
+    /** JWT used as `Authorization: Bearer <token>`. Must be non-empty. */
+    token: string;
+    /** Registry root; `<name>/<version>` is appended as two path segments. */
+    registryUrl?: string;
+    /** The template version to request. Defaults to this package's own version. */
+    version?: string;
+    /** Override for tests; defaults to `globalThis.fetch`. Never a live call in CI. */
+    fetchImpl?: typeof fetch;
+}
+export declare class FetchTemplateError extends Error {
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
+    readonly isLicenseError: boolean;
+    constructor(message: string, 
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
+    isLicenseError?: boolean);
+}
+export declare function fetchTemplate(options: FetchTemplateOptions): Promise<Uint8Array>;

package/dist/lib/fetch-template.js

@@ -0,0 +1,133 @@
+/**
+ * Authenticated site-template-bundle fetch (spec 5481 § 4; parent record
+ * D1, § 6).
+ *
+ * The client half of `GET /v1/templates/:name/:version` (#5480's route),
+ * reached publicly at `/api/templates/:path*`. Posture is
+ * `fetch-module.ts`'s, mirrored one-for-one rather than generalised into a
+ * shared helper: bearer-JWT auth, `redirect: "error"` so a redirected
+ * response cannot drop the bearer token onto an unintended host, an
+ * empty-token guard before any network call, and the same status mapping —
+ * 401 → licence invalid/revoked/lapsed, 403 → not included / term ended,
+ * 404 → content not yet available, other non-2xx → the upstream body.
+ *
+ * ONE word differs, and it is the whole reason this is a sibling rather
+ * than a second call site of `fetchModule` (spec 5481 § 3 DD5): the 404
+ * sentence names its subject, and the subject here is a TEMPLATE. Parent
+ * record D17 makes that sentence a specified outcome rather than an
+ * incidental one, so the fourth refusal reuses it — with the noun
+ * parameterised, since left alone it would call the template a module.
+ *
+ * Deliberately depends on neither `@working-theory/license` nor
+ * `@working-theory/cli`, for the reason `fetch-module.ts`'s file doc states
+ * at length: both are `publishConfig.access: "restricted"` and this is the
+ * one package published to PUBLIC npm, so a runtime dependency on either
+ * would break `pnpm install` for every Free consumer rather than merely
+ * gate the paid path. The registry's own 401 IS the licence verdict.
+ */
+import pkg from "../../package.json" with { type: "json" };
+import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
+export const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
+/**
+ * This package's own `package.json` `"version"` — a static JSON import for
+ * the reason `fetch-module.ts`'s `CREATE_AILK_VERSION` doc gives: `import.meta`
+ * is a SyntaxError under ts-jest's CommonJS transform, and this file is
+ * reachable from jest. A template bundle overlays the scaffold this
+ * `create-ailk` just wrote, so the default version request is the running
+ * package's own.
+ */
+const CREATE_AILK_VERSION = pkg.version;
+export class FetchTemplateError extends Error {
+    isLicenseError;
+    constructor(message, 
+    /** True iff the failure was a license-gating signal (HTTP 401 or 403). */
+    isLicenseError = false) {
+        super(message);
+        this.isLicenseError = isLicenseError;
+        this.name = "FetchTemplateError";
+    }
+}
+/**
+ * Join `registryUrl` with `templateName` and `version` as two trailing path
+ * segments. `encodeURIComponent` on each is defense in depth —
+ * `parse-args.ts` already restricts `templateName` to `TEMPLATE_MANIFESTS`'s
+ * keys, but a hostile value can never smuggle a path separator or query
+ * string here regardless.
+ */
+function buildUrl(registryUrl, templateName, version) {
+    const trimmed = registryUrl.replace(/\/+$/, "");
+    return `${trimmed}/${encodeURIComponent(templateName)}/${encodeURIComponent(version)}`;
+}
+export async function fetchTemplate(options) {
+    const { templateName, token } = options;
+    if (token.length === 0) {
+        throw new FetchTemplateError("internal error: fetchTemplate called without a token");
+    }
+    const version = options.version ?? CREATE_AILK_VERSION;
+    const registryUrl = options.registryUrl ??
+        process.env["AILK_TEMPLATE_REGISTRY_URL"] ??
+        DEFAULT_AILK_TEMPLATE_REGISTRY_URL;
+    assertHttpsRegistryUrl(registryUrl, FetchTemplateError);
+    const url = buildUrl(registryUrl, templateName, version);
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/gzip, application/octet-stream",
+            },
+            redirect: "error",
+            signal: fetchTimeoutSignal(),
+        });
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new FetchTemplateError(`template registry unreachable: ${detail}`);
+    }
+    if (response.status === 401) {
+        throw new FetchTemplateError(`your licence does not cover the "${templateName}" template (invalid, revoked, or lapsed)`, 
+        /* isLicenseError */ true);
+    }
+    if (response.status === 403) {
+        throw new FetchTemplateError(`your licence does not include the "${templateName}" template, or its term ended before create-ailk ${version} was released — use a create-ailk version released during your term`, 
+        /* isLicenseError */ true);
+    }
+    if (response.status === 404) {
+        throw new FetchTemplateError(`"${templateName}" template content not yet available — ping us at hello@ailaunchkit.ai`);
+    }
+    if (!response.ok) {
+        const body = await safeReadBody(response);
+        throw new FetchTemplateError(`template registry returned ${response.status} for "${templateName}": ${body}`);
+    }
+    assertContentLengthWithinLimit(response, FetchTemplateError);
+    const buf = await response.arrayBuffer();
+    return new Uint8Array(buf);
+}
+/**
+ * Best-effort error body extraction — the registry uses `{ error: "..." }`
+ * shapes, falls back to text, and swallows any read failure so the caller's
+ * message stays useful. `fetch-module.ts`'s helper of the same name.
+ */
+async function safeReadBody(response) {
+    try {
+        const text = await response.text();
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed !== null &&
+                typeof parsed === "object" &&
+                "error" in parsed &&
+                typeof parsed.error === "string") {
+                return parsed.error;
+            }
+        }
+        catch {
+            /* not JSON — fall through to raw text */
+        }
+        return text || response.statusText;
+    }
+    catch {
+        return response.statusText;
+    }
+}

package/dist/lib/module-license-gate.d.ts

@@ -39,6 +39,14 @@ export interface ResolvePaidModulesOptions {
     version?: string;
     /** Forwarded to `fetchModule`; defaults to `globalThis.fetch`. Never a live call in tests. */
     fetchImpl?: typeof fetch;
+    /**
+     * The site template whose `requires` put these modules in `paidModules`
+     * (spec 5481 § 3 DD5 rows 1-2). Present ⟹ every refusal below names it
+     * alongside the specific module, because the buyer asked for a TEMPLATE and
+     * a message naming only a module they never typed does not tell them what
+     * to do. Absent ⟹ a plain `--modules` run, whose messages are unchanged.
+     */
+    templateName?: string;
 }
 /**
  * Resolve every requested paid module to its fetched bundle bytes, or throw

package/dist/lib/module-license-gate.js

@@ -28,7 +28,7 @@ export async function resolvePaidModules(options) {
     }
     const token = options.licenseKey ?? process.env["AILK_LICENSE_KEY"];
     if (token === undefined || token.length === 0) {
-        throw new LicenseRequiredError(conversionHint(paidModules));
+        throw new LicenseRequiredError(conversionHint(paidModules, options.templateName));
     }
     const bundles = new Map();
     for (const moduleName of paidModules) {
@@ -49,7 +49,12 @@ export async function resolvePaidModules(options) {
         catch (err) {
             if (err instanceof FetchModuleError) {
                 if (err.isLicenseError) {
-                    throw new LicenseRequiredError(`${err.message} → ${CONVERSION_HINT_URL}`);
+                    // DD5 row 2: the mapped 401/403 already names the module the key
+                    // does not cover; the template is appended so the buyer can see
+                    // WHICH of the things they asked for needs it.
+                    throw new LicenseRequiredError(options.templateName !== undefined
+                        ? `${err.message}, required by template "${options.templateName}" → ${CONVERSION_HINT_URL}`
+                        : `${err.message} → ${CONVERSION_HINT_URL}`);
                 }
                 // Not a license-gating signal (e.g. 404 "not yet available", or the
                 // registry unreachable) — a generic failure, not the honest-denial
@@ -62,7 +67,10 @@ export async function resolvePaidModules(options) {
     }
     return bundles;
 }
-function conversionHint(paidModules) {
+function conversionHint(paidModules, templateName) {
     const list = paidModules.join(", ");
-    return `Pro module(s) requested (${list}) — set AILK_LICENSE_KEY first → ${CONVERSION_HINT_URL}`;
+    const requested = templateName !== undefined
+        ? `template "${templateName}" requires Pro module(s) (${list})`
+        : `Pro module(s) requested (${list})`;
+    return `${requested} — set AILK_LICENSE_KEY first → ${CONVERSION_HINT_URL}`;
 }

package/dist/module-architecture.d.ts

@@ -29,6 +29,39 @@ export interface ArchNamespaces {
     members: Record<string, ArchNamespaceMember>;
     rules: string[];
 }
+/**
+ * One page a site template's roster declares (spec 5478 § D1).
+ *
+ * Both producers emit this same row type: a template's BASE roster
+ * (`TemplateManifest.roster`, template-manifest.ts) and a module's
+ * `pageContributions` below. One vocabulary, so the merge has exactly one
+ * collision key to reconcile rather than two (§ D1/D2).
+ *
+ * Declared HERE rather than in `template-manifest.ts` (§ D3) because
+ * `ModuleSlice` carries it and `template-manifest.ts` already imports
+ * `MODULE_SLICES` + `normalizeModules` from this file — so the dependency
+ * stays a DAG (`parse-args` ← `module-architecture` ← `template-manifest`)
+ * instead of becoming a cycle in the value graph.
+ *
+ * A row carries no nav label: `GATEABLE_SURFACES` already carries
+ * `navLabelKey?` per surface (`surfaces.ts`) and the nav is derived from the
+ * roster (parent spec 5462 § D9), so a label here would be a second authority
+ * for one fact.
+ */
+export interface PageRosterRow {
+    /**
+     * Site-relative route path, e.g. `/blog` or `/flows/[slug]/start`. This is
+     * the row's IDENTITY and the merge's collision key (§ D2): a path claimed by
+     * two sources is refused at build time, never resolved by a precedence rule
+     * (parent § D8).
+     */
+    route: string;
+    /**
+     * Repo-relative seed content this row renders. Absent for an API-backed row
+     * (`/meet` renders from the scheduling API, not from an MDX file).
+     */
+    content?: readonly string[];
+}
 /**
  * The architecture fragment one module contributes.
  *
@@ -72,7 +105,7 @@ export interface ModuleSlice {
      * disappears just because one module's slice of it does).
      *
      * One entry in the arrays below is deliberately a GLOB
-     * (`"apps-paid/workspace/**"`) rather than enumerated file-by-file — a
+     * (`"apps-paid/admin/**"`) rather than enumerated file-by-file — a
      * whole app with dozens of files, owned outright by one module; every other
      * entry is a literal file
      * path. A file that a module's own docs mention but that lives inside a
@@ -95,7 +128,7 @@ export interface ModuleSlice {
      *     app, never a customer opt-in (see `apps/api/src/config/modules.ts`).
      *   - Two are this-list-only and the manifest simply never recorded them:
      *     `apps/web/app/[locale]/docs/[[...slug]]/page.tsx` and
-     *     `apps/web/app/[locale]/schedule/confirmed/page.tsx`.
+     *     `apps/web/app/[locale]/meet/confirmed/page.tsx`.
      *
      * A file's TEST and STORY companions are never listed here (the
      * SOURCE-files-only rule above still holds) but DO carry the marker. They
@@ -104,18 +137,67 @@ export interface ModuleSlice {
      * which miss eleven and over-mark three.
      */
     ownedFiles?: string[];
+    /**
+     * The page rows and seed content this module contributes to any site
+     * template that takes it (spec 5478; parent spec 5462 § D5) — `ownedFiles`'s
+     * sibling, and a DIFFERENT kind of fact again from every field above.
+     * `ownedFiles` names which files in THIS monorepo physically belong to the
+     * module; `pageContributions` names which PAGES the module brings to a
+     * template's roster. `template-manifest.ts`'s `mergeRoster` reads it.
+     *
+     * A contribution never carries route CODE. How the route code reaches a
+     * scaffold is a property of the module, not of the contribution (parent
+     * § D6): `docs-blog` and `scheduling` list their route files in `ownedFiles`
+     * so the code rides their own licence-checked bundle, while
+     * `signal-collectors` deliberately does not — its `flows` routes reach a
+     * scaffold from the `templates/` snapshot, retained because
+     * `MODULE_SURFACES` enables the surface (see this file's
+     * `signal-collectors.ownedFiles` comment for why listing them there broke
+     * `sync-routes`, #5366). Both shapes declare their rows here identically.
+     *
+     * Unset for a module that brings no pages to any declared template:
+     * `marketing` (base, no `ownedFiles` and `MODULE_SURFACES.marketing` is
+     * `[]`), and — deferred, not absent — `multi-tenant` and `commerce`, whose
+     * rows are their own instances' to enumerate. An unset field contributes
+     * zero rows openly; it is not a partial merge.
+     */
+    pageContributions?: readonly PageRosterRow[];
     /**
      * Bundle-relative source → scaffold-relative destination (spec 5373 § D7).
      * Every source must be a file the validated tar extraction produced in the
      * bundle producer's staging directory — repo-relative, coinciding with the
      * `ownedFiles`/`installMap`-source paths this module's producer step
-     * stages at, by construction. `extractModuleBundle` applies this map after
-     * the tar entries are validated: an absolute path, a `..` segment, or a
-     * path absent from staging rejects the whole bundle, as does a destination
-     * that resolves outside the scaffold. A mapped source is copied to its
-     * destination only, never also to its original path.
+     * stages at, by construction. ONE exception: `build-module-bundles.mjs`
+     * also stages the proprietary licence-client LICENSE at the archive root
+     * as `LICENSE` and adds its own `installMap["LICENSE"]` entry (never a
+     * slice field — the producer adds it uniformly, #5552 D1), so a slice's
+     * own `installMap` must not declare a `"LICENSE"` key. `extractModuleBundle`
+     * applies this map after the tar entries are validated: an absolute path, a
+     * `..` segment, or a path absent from staging rejects the whole bundle, as
+     * does a destination that resolves outside the scaffold. A mapped source is
+     * copied to its destination only, never also to its original path.
      */
     installMap?: Record<string, string>;
+    /**
+     * Rename root for this slice's whole-app glob `ownedFiles` entry(ies)
+     * (a `"<dir>/**"` entry — see `ownedFiles`'s own doc above) — the glob
+     * sibling of `installMap` (#5644 D1). Every file `expandEntry` yields
+     * under `<dir>/` installs at `installRoot + <rel-path-under-dir>` instead
+     * of its repo-relative path. `build-module-bundles.mjs`'s
+     * `deriveGlobInstallMap` derives one `installMap` entry per file from this
+     * rule at bundle-build time, and the mock registry fixture
+     * (`__tests__/fixtures/mock-module-registry-server.mjs`) calls the SAME
+     * function so its served manifest cannot drift from the producer's.
+     * Undefined for a slice with no glob `ownedFiles` entry, or one whose glob
+     * files install unchanged at their repo-relative path.
+     *
+     * `installMap` above stays the mechanism for hand-enumerated, non-glob
+     * remaps (see `commerce.installMap`) — a literal map is fine there because
+     * enumerating ten skill files costs ten lines; a whole app's worth of
+     * files committed one line per file into this OSS-shipped source is the
+     * leak class `scripts/check-oss-strip.sh` exists to catch (#5644).
+     */
+    installRoot?: string;
     /**
      * Plain text `extractModuleBundle` prints to stdout after a successful
      * merge, with C0/C1 control characters (other than newline) stripped
@@ -288,4 +370,31 @@ export declare function normalizeModules(modules: string[]): ModuleName[];
  *   Passed in rather than derived from `import.meta.url`, which ts-jest cannot
  *   load — the same reason `sync-routes.ts` documents for staying pure.
  */
+/**
+ * Scaffold destinations that MORE THAN ONE module's `ownedFiles` declares —
+ * the co-ownership the `#5618 D4` install-time ownership registry must treat
+ * as intentional rather than as an overwrite (#5702 follow-up).
+ *
+ * Co-ownership is how a file reaches a scaffold under either of two modules
+ * without being transferred away from the other. #5677 needed it for the
+ * submissions review surface: the routes register under
+ * `multi-tenant || signal-collectors`, so BOTH bundles must be able to
+ * deliver them, or the module that lacks them throws
+ * `ERR_MODULE_NOT_FOUND` during `build()`.
+ *
+ * `validateLayerOwnership` (`lib/extract-module-bundle.ts`) refuses a
+ * destination an earlier layer already wrote, because a silent
+ * last-writer-wins between two modules that disagree is the bug `#5618 D4`
+ * exists to catch. Two modules that both DECLARE the same repo file are not
+ * that case: they stage the same bytes from the same source, so whichever
+ * lands second writes what is already there. Without this allowance a
+ * scaffold selecting both modules — `saas-product`, whose `requires` names
+ * `signal-collectors` AND `multi-tenant` — aborts mid-install, after the
+ * first module's files are on disk.
+ *
+ * Only a DECLARED overlap is allowed. A destination two layers collide on
+ * without both naming it in `ownedFiles` is still refused, which is the
+ * whole invariant.
+ */
+export declare function coOwnedModuleDestinations(): ReadonlySet<string>;
 export declare function paidModuleTemplateExclusions(snapshotRoots: readonly string[], repoRoot: string): string[];