create-ailk 0.4.0 → 0.5.0

package/dist/lib/fetch-template.js

@@ -26,6 +26,7 @@
  * gate the paid path. The registry's own 401 IS the licence verdict.
  */
 import pkg from "../../package.json" with { type: "json" };
+import { assertContentLengthWithinLimit, assertHttpsRegistryUrl, fetchTimeoutSignal, } from "./fetch-guard.js";
 export const DEFAULT_AILK_TEMPLATE_REGISTRY_URL = "https://ailaunchkit.ai/api/templates";
 /**
  * This package's own `package.json` `"version"` — a static JSON import for
@@ -66,6 +67,7 @@ export async function fetchTemplate(options) {
     const registryUrl = options.registryUrl ??
         process.env["AILK_TEMPLATE_REGISTRY_URL"] ??
         DEFAULT_AILK_TEMPLATE_REGISTRY_URL;
+    assertHttpsRegistryUrl(registryUrl, FetchTemplateError);
     const url = buildUrl(registryUrl, templateName, version);
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     let response;
@@ -77,6 +79,7 @@ export async function fetchTemplate(options) {
                 Accept: "application/gzip, application/octet-stream",
             },
             redirect: "error",
+            signal: fetchTimeoutSignal(),
         });
     }
     catch (err) {
@@ -98,6 +101,7 @@ export async function fetchTemplate(options) {
         const body = await safeReadBody(response);
         throw new FetchTemplateError(`template registry returned ${response.status} for "${templateName}": ${body}`);
     }
+    assertContentLengthWithinLimit(response, FetchTemplateError);
     const buf = await response.arrayBuffer();
     return new Uint8Array(buf);
 }

package/dist/module-architecture.d.ts

@@ -58,7 +58,7 @@ export interface PageRosterRow {
     route: string;
     /**
      * Repo-relative seed content this row renders. Absent for an API-backed row
-     * (`/schedule` renders from the scheduling API, not from an MDX file).
+     * (`/meet` renders from the scheduling API, not from an MDX file).
      */
     content?: readonly string[];
 }
@@ -105,7 +105,7 @@ export interface ModuleSlice {
      * disappears just because one module's slice of it does).
      *
      * One entry in the arrays below is deliberately a GLOB
-     * (`"apps-paid/workspace/**"`) rather than enumerated file-by-file — a
+     * (`"apps-paid/admin/**"`) rather than enumerated file-by-file — a
      * whole app with dozens of files, owned outright by one module; every other
      * entry is a literal file
      * path. A file that a module's own docs mention but that lives inside a
@@ -128,7 +128,7 @@ export interface ModuleSlice {
      *     app, never a customer opt-in (see `apps/api/src/config/modules.ts`).
      *   - Two are this-list-only and the manifest simply never recorded them:
      *     `apps/web/app/[locale]/docs/[[...slug]]/page.tsx` and
-     *     `apps/web/app/[locale]/schedule/confirmed/page.tsx`.
+     *     `apps/web/app/[locale]/meet/confirmed/page.tsx`.
      *
      * A file's TEST and STORY companions are never listed here (the
      * SOURCE-files-only rule above still holds) but DO carry the marker. They
@@ -167,13 +167,37 @@ export interface ModuleSlice {
      * Every source must be a file the validated tar extraction produced in the
      * bundle producer's staging directory — repo-relative, coinciding with the
      * `ownedFiles`/`installMap`-source paths this module's producer step
-     * stages at, by construction. `extractModuleBundle` applies this map after
-     * the tar entries are validated: an absolute path, a `..` segment, or a
-     * path absent from staging rejects the whole bundle, as does a destination
-     * that resolves outside the scaffold. A mapped source is copied to its
-     * destination only, never also to its original path.
+     * stages at, by construction. ONE exception: `build-module-bundles.mjs`
+     * also stages the proprietary licence-client LICENSE at the archive root
+     * as `LICENSE` and adds its own `installMap["LICENSE"]` entry (never a
+     * slice field — the producer adds it uniformly, #5552 D1), so a slice's
+     * own `installMap` must not declare a `"LICENSE"` key. `extractModuleBundle`
+     * applies this map after the tar entries are validated: an absolute path, a
+     * `..` segment, or a path absent from staging rejects the whole bundle, as
+     * does a destination that resolves outside the scaffold. A mapped source is
+     * copied to its destination only, never also to its original path.
      */
     installMap?: Record<string, string>;
+    /**
+     * Rename root for this slice's whole-app glob `ownedFiles` entry(ies)
+     * (a `"<dir>/**"` entry — see `ownedFiles`'s own doc above) — the glob
+     * sibling of `installMap` (#5644 D1). Every file `expandEntry` yields
+     * under `<dir>/` installs at `installRoot + <rel-path-under-dir>` instead
+     * of its repo-relative path. `build-module-bundles.mjs`'s
+     * `deriveGlobInstallMap` derives one `installMap` entry per file from this
+     * rule at bundle-build time, and the mock registry fixture
+     * (`__tests__/fixtures/mock-module-registry-server.mjs`) calls the SAME
+     * function so its served manifest cannot drift from the producer's.
+     * Undefined for a slice with no glob `ownedFiles` entry, or one whose glob
+     * files install unchanged at their repo-relative path.
+     *
+     * `installMap` above stays the mechanism for hand-enumerated, non-glob
+     * remaps (see `commerce.installMap`) — a literal map is fine there because
+     * enumerating ten skill files costs ten lines; a whole app's worth of
+     * files committed one line per file into this OSS-shipped source is the
+     * leak class `scripts/check-oss-strip.sh` exists to catch (#5644).
+     */
+    installRoot?: string;
     /**
      * Plain text `extractModuleBundle` prints to stdout after a successful
      * merge, with C0/C1 control characters (other than newline) stripped
@@ -346,4 +370,31 @@ export declare function normalizeModules(modules: string[]): ModuleName[];
  *   Passed in rather than derived from `import.meta.url`, which ts-jest cannot
  *   load — the same reason `sync-routes.ts` documents for staying pure.
  */
+/**
+ * Scaffold destinations that MORE THAN ONE module's `ownedFiles` declares —
+ * the co-ownership the `#5618 D4` install-time ownership registry must treat
+ * as intentional rather than as an overwrite (#5702 follow-up).
+ *
+ * Co-ownership is how a file reaches a scaffold under either of two modules
+ * without being transferred away from the other. #5677 needed it for the
+ * submissions review surface: the routes register under
+ * `multi-tenant || signal-collectors`, so BOTH bundles must be able to
+ * deliver them, or the module that lacks them throws
+ * `ERR_MODULE_NOT_FOUND` during `build()`.
+ *
+ * `validateLayerOwnership` (`lib/extract-module-bundle.ts`) refuses a
+ * destination an earlier layer already wrote, because a silent
+ * last-writer-wins between two modules that disagree is the bug `#5618 D4`
+ * exists to catch. Two modules that both DECLARE the same repo file are not
+ * that case: they stage the same bytes from the same source, so whichever
+ * lands second writes what is already there. Without this allowance a
+ * scaffold selecting both modules — `saas-product`, whose `requires` names
+ * `signal-collectors` AND `multi-tenant` — aborts mid-install, after the
+ * first module's files are on disk.
+ *
+ * Only a DECLARED overlap is allowed. A destination two layers collide on
+ * without both naming it in `ownedFiles` is still refused, which is the
+ * whole invariant.
+ */
+export declare function coOwnedModuleDestinations(): ReadonlySet<string>;
 export declare function paidModuleTemplateExclusions(snapshotRoots: readonly string[], repoRoot: string): string[];