create-ailk 0.5.0 → 0.6.1

package/dist/lib/extract-module-bundle.js

@@ -83,8 +83,10 @@ import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import * as tar from "tar";
+import { isTextFile } from "../copy.js";
 import { coOwnedModuleDestinations, } from "../module-architecture.js";
 import { validateTemplateLayout, } from "../site-chrome.js";
+import { substituteMarkers, } from "../substitute.js";
 import { computeModulePatches, writeModulePatches } from "./apply-module-patches.js";
 /** Soft limits to prevent decompression-bomb / zip-bomb attacks. Same values as extractBundle. */
 const MAX_ENTRIES = 1000;
@@ -446,6 +448,7 @@ export async function extractModuleBundle(options) {
                 : {}),
             ...(options.ownership !== undefined ? { ownership: options.ownership } : {}),
             ...(options.versions !== undefined ? { versions: options.versions } : {}),
+            ...(options.markers !== undefined ? { markers: options.markers } : {}),
         });
     }
     finally {
@@ -463,7 +466,7 @@ export async function extractModuleBundle(options) {
  * rejected tree leaves `targetDir` exactly as it was.
  */
 export function installBundleTree(options) {
-    const { sourceRoot, name, templateRequires, templateExtends, ownership } = options;
+    const { sourceRoot, name, templateRequires, templateExtends, ownership, markers } = options;
     const targetAbs = resolve(options.targetDir);
     const isTemplate = templateRequires !== undefined;
     const subject = isTemplate ? `template "${name}"` : `module "${name}"`;
@@ -526,6 +529,17 @@ export function installBundleTree(options) {
     // installMap destination) is read from the STAGED tree here, since
     // targetDir would not have it yet at this point.
     const installMapDestinationToSource = new Map(Object.entries(installMap).map(([source, destination]) => [destination, source]));
+    // #6460 — a patch target is read RAW from the staged tree here, while
+    // `copyTree` below writes the same path SUBSTITUTED, and
+    // `writeModulePatches` runs after `copyTree`. So a file a bundle both
+    // delivers as plain content AND patches would end up carrying unsubstituted
+    // markers. Unreachable today and asserted as such rather than guarded: the
+    // only patch targets any slice declares are `apps/web/package.json`,
+    // `next.config.mjs` and `jest.config.cjs`, all three delivered by the base
+    // `templates/` snapshot rather than by a bundle — so this reader falls
+    // through to the `targetAbs` branch and reads already-substituted bytes —
+    // and a template is refused `patches` outright above. A bundle that starts
+    // delivering one of its own patch targets must substitute here too.
     const readPatchTarget = (target) => {
         const mappedSource = installMapDestinationToSource.get(target);
         if (mappedSource !== undefined) {
@@ -550,11 +564,18 @@ export function installBundleTree(options) {
     // every installMap source are excluded from the whole-tree copy — the
     // manifest never lands in the scaffold, and a mapped source lands ONLY
     // at its mapped destination, never also at its original path.
-    copyTree(sourceRoot, targetAbs, excluded);
+    copyTree(sourceRoot, targetAbs, excluded, markers);
     for (const [source, destination] of Object.entries(installMap)) {
         const destAbs = resolve(targetAbs, destination);
         mkdirSync(join(destAbs, ".."), { recursive: true });
-        copyFileSync(resolve(sourceRoot, source), destAbs);
+        // BOTH ends decide text-ness (#6460), because an installMap entry is free
+        // to rename across the boundary and the two mismatches are not
+        // symmetric: a text source landing at a binary name merely misses a
+        // substitution, while a BINARY source landing at a text name would be
+        // read as utf8 and rewritten, turning every invalid byte sequence into
+        // U+FFFD — silent, unrecoverable corruption. Requiring both makes the
+        // safe direction structural rather than a property of today's manifests.
+        writeOneFile(resolve(sourceRoot, source), destAbs, [source, destination], markers);
     }
     // patches write AFTER every file the tree brought is in place (D5) —
     // after installMap, before postInstall — so a patch can never race a
@@ -589,8 +610,11 @@ export function installBundleTree(options) {
  * `safeExtractTarGz` has validated every entry, so no additional
  * path-safety check is needed here — `srcRoot` is our own staging tree, not
  * attacker-controlled input.
+ *
+ * `markers`, when given, is substituted into every TEXT file on the way
+ * through (#6460) — see `InstallBundleTreeOptions.markers`.
  */
-function copyTree(srcRoot, destRoot, excluded = new Set()) {
+function copyTree(srcRoot, destRoot, excluded = new Set(), markers) {
     const stack = [srcRoot];
     while (stack.length > 0) {
         const dir = stack.pop();
@@ -608,12 +632,47 @@ function copyTree(srcRoot, destRoot, excluded = new Set()) {
                 if (excluded.has(rel.split(sep).join("/")))
                     continue;
                 mkdirSync(join(destPath, ".."), { recursive: true });
-                copyFileSync(srcPath, destPath);
+                writeOneFile(srcPath, destPath, [rel], markers);
             }
             // symlinks: never present — safeExtractTarGz rejects them outright.
         }
     }
 }
+/**
+ * Land one file at `destAbs`, substituting `markers` into it when EVERY path
+ * in `relsForType` is text by `copy.ts`'s own `isTextFile` (#6460) — the
+ * source's relative path alone for a plain-content copy, source AND
+ * destination for an installMap entry, which may rename across the
+ * text/binary boundary. Unanimity rather than either-or, so binary content is
+ * never round-tripped through a utf8 string by construction; see the
+ * installMap loop for why the two mismatch directions are not symmetric.
+ *
+ * With no `markers`, or with any non-text path, this is exactly the
+ * `copyFileSync` it replaced.
+ *
+ * `isTextFile` is an allowlist of extensions, NOT "anything that parses as
+ * text": `.css`, `.html`, `.svg`, `.sh`, `.toml` and `.sql` are outside it, so
+ * a marker authored in one of those survives verbatim. That is pre-existing
+ * `copyTemplate` behaviour, deliberately shared rather than forked here.
+ *
+ * The source's mode rides along, because `copyFileSync` preserves it and
+ * `writeFileSync` does not: no tree this installs carries an executable file
+ * today, but a module slice is free to ship one, and a substituted `.mjs`
+ * silently losing its `+x` surfaces as "the scaffold builds but the hook never
+ * runs". Masked to the permission bits — `statSync().mode` carries the
+ * `S_IFREG` type bits too, which `open(2)` ignores but which have no business
+ * being passed. Like `copyFileSync`, this only sets the mode when the file is
+ * CREATED: an overwrite (the layer-over-layer case) keeps the existing one.
+ */
+function writeOneFile(srcAbs, destAbs, relsForType, markers) {
+    if (markers === undefined || !relsForType.every(isTextFile)) {
+        copyFileSync(srcAbs, destAbs);
+        return;
+    }
+    writeFileSync(destAbs, substituteMarkers(readFileSync(srcAbs, "utf8"), markers), {
+        mode: statSync(srcAbs).mode & 0o777,
+    });
+}
 /**
  * `extractBundle`'s validating-filter tar extraction, ported verbatim (see
  * file doc for why this is a port and not an import). Extracts `tarGzPath`

package/dist/lib/import-graph.d.ts

@@ -0,0 +1,29 @@
+export declare const SOURCE_EXTS: string[];
+/** Every source file under the given repo-relative roots, as "/"-joined paths. */
+export declare function listFilesUnder(repoRoot: string, roots: string[]): Set<string>;
+/** The relative import specifiers a source file names (static imports + re-exports). */
+export declare function relativeImportsOf(absPath: string): string[];
+/**
+ * Resolve a relative specifier against the candidate set. TypeScript ESM writes
+ * `./x.js` for `./x.ts`, so the `.js` → `.ts`/`.tsx` rewrite is the common case.
+ */
+export declare function resolveRelativeImport(fromFile: string, spec: string, candidates: Set<string>): string | undefined;
+/**
+ * The companion closure of `seeds` under `roots`: the seeds themselves plus
+ * every source file under `roots` that reaches one transitively through a
+ * relative import, to a fixed point.
+ *
+ * This is the shape both consumers need, and the reason the walk is shared
+ * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
+ * paid module's `ownedFiles` to get the files a keyless starter must not
+ * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
+ *
+ * Never a filename-stem rule (#5182 D7), which misses eleven files and
+ * over-marks three.
+ *
+ * @param repoRoot absolute path to the tree being walked.
+ * @param roots repo-relative roots the walk is confined to.
+ * @param seeds repo-relative, "/"-separated files the closure starts from.
+ */
+export declare function importClosure(repoRoot: string, roots: readonly string[], seeds: Iterable<string>): Set<string>;

package/dist/lib/import-graph.js

@@ -0,0 +1,140 @@
+/**
+ * The relative-import graph walker over a repo-relative source tree.
+ *
+ * Extracted from `module-architecture.ts` (#5701) so the two consumers that
+ * need this resolution share ONE implementation rather than two that can
+ * disagree:
+ *
+ * - `paidModuleTemplateExclusions()` (module-architecture.ts) walks it to take
+ *   the companion closure of every paid module's `ownedFiles` — the files that
+ *   would ship dangling into a keyless starter.
+ * - `tools/lint-slice-registration.ts` walks it to close over the specifiers an
+ *   `isModuleEnabled("X")` branch in `apps/api/src/server.ts` loads, and to
+ *   check every reached file against what module X's slice delivers.
+ *
+ * Both questions are "which files does this one reach through relative
+ * imports", and the answer must be the same function in both mouths: a lint
+ * that resolved specifiers differently from the exclusion set it checks
+ * against would pass on a tree the scaffold cannot boot.
+ *
+ * The resolution is deliberately TEXTUAL — a regex over import/export
+ * specifiers plus a candidate-set lookup, no type-checker and no bundler — so
+ * it runs inside `pnpm preflight`'s memory budget.
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+export const SOURCE_EXTS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+/** Every source file under the given repo-relative roots, as "/"-joined paths. */
+export function listFilesUnder(repoRoot, roots) {
+    const out = new Set();
+    const skip = new Set(["node_modules", ".next", "dist", ".turbo", ".source"]);
+    const stack = roots.map((r) => r);
+    while (stack.length > 0) {
+        const rel = stack.pop();
+        const abs = join(repoRoot, rel);
+        let entries;
+        try {
+            entries = readdirSync(abs, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (skip.has(entry.name))
+                continue;
+            const childRel = `${rel}/${entry.name}`;
+            if (entry.isDirectory())
+                stack.push(childRel);
+            else if (SOURCE_EXTS.some((e) => entry.name.endsWith(e)))
+                out.add(childRel);
+        }
+    }
+    return out;
+}
+/** The relative import specifiers a source file names (static imports + re-exports). */
+export function relativeImportsOf(absPath) {
+    let src;
+    try {
+        src = readFileSync(absPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const m of src.matchAll(/(?:^|\n)\s*(?:import|export)[\s\S]{0,400}?from\s*["'](\.[^"']*)["']/g))
+        out.push(m[1]);
+    for (const m of src.matchAll(/\bimport\s*\(\s*["'](\.[^"']*)["']\s*\)/g))
+        out.push(m[1]);
+    return out;
+}
+/**
+ * Resolve a relative specifier against the candidate set. TypeScript ESM writes
+ * `./x.js` for `./x.ts`, so the `.js` → `.ts`/`.tsx` rewrite is the common case.
+ */
+export function resolveRelativeImport(fromFile, spec, candidates) {
+    const base = posixJoin(dirname(fromFile.split("/").join(sep)), spec);
+    const stem = base.replace(/\.(js|jsx|mjs|cjs)$/, "");
+    for (const cand of [
+        base,
+        ...SOURCE_EXTS.map((e) => stem + e),
+        ...SOURCE_EXTS.map((e) => `${stem}/index${e}`),
+    ])
+        if (candidates.has(cand))
+            return cand;
+    return undefined;
+}
+/** Join and normalize a "/"-separated path, resolving `.` and `..` segments. */
+function posixJoin(dir, spec) {
+    const parts = `${dir.split(sep).join("/")}/${spec}`.split("/");
+    const out = [];
+    for (const part of parts) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..")
+            out.pop();
+        else
+            out.push(part);
+    }
+    return out.join("/");
+}
+/**
+ * The companion closure of `seeds` under `roots`: the seeds themselves plus
+ * every source file under `roots` that reaches one transitively through a
+ * relative import, to a fixed point.
+ *
+ * This is the shape both consumers need, and the reason the walk is shared
+ * rather than copied. `paidModuleTemplateExclusions()` seeds it with every
+ * paid module's `ownedFiles` to get the files a keyless starter must not
+ * carry; `tools/lint-slice-registration.ts` seeds it with the same set to
+ * derive, by subtraction, the files a scaffold ships UNCONDITIONALLY.
+ *
+ * Never a filename-stem rule (#5182 D7), which misses eleven files and
+ * over-marks three.
+ *
+ * @param repoRoot absolute path to the tree being walked.
+ * @param roots repo-relative roots the walk is confined to.
+ * @param seeds repo-relative, "/"-separated files the closure starts from.
+ */
+export function importClosure(repoRoot, roots, seeds) {
+    const closed = new Set(seeds);
+    const candidates = listFilesUnder(repoRoot, [...roots]);
+    for (;;) {
+        let grew = false;
+        for (const file of candidates) {
+            if (closed.has(file))
+                continue;
+            const imports = relativeImportsOf(join(repoRoot, file));
+            for (const spec of imports) {
+                const target = resolveRelativeImport(file, spec, candidates);
+                if (target !== undefined && closed.has(target)) {
+                    closed.add(file);
+                    grew = true;
+                    break;
+                }
+            }
+        }
+        if (!grew)
+            break;
+    }
+    return closed;
+}

package/dist/lib/module-license-gate.d.ts

@@ -18,7 +18,12 @@
  * gate (K1's regression floor).
  */
 import type { ModuleName } from "../parse-args.js";
-export declare const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pro";
+/**
+ * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
+ * `/pro` route and there will not be one (#6439, operator decision OD-2) —
+ * pricing is where every level and the commerce add-on are actually listed.
+ */
+export declare const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pricing";
 /**
  * Thrown for both honest-denial states (no key, and an invalid/lapsed key).
  * The CLI does not distinguish them in its exit code — both are "this run

package/dist/lib/module-license-gate.js

@@ -1,5 +1,10 @@
 import { FetchModuleError, fetchModule } from "./fetch-module.js";
-export const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pro";
+/**
+ * Where a refused run sends the buyer. `/pricing`, not `/pro`: there is no
+ * `/pro` route and there will not be one (#6439, operator decision OD-2) —
+ * pricing is where every level and the commerce add-on are actually listed.
+ */
+export const CONVERSION_HINT_URL = "https://ailaunchkit.ai/pricing";
 /**
  * Thrown for both honest-denial states (no key, and an invalid/lapsed key).
  * The CLI does not distinguish them in its exit code — both are "this run

package/dist/lib/pro-callout.js

@@ -15,6 +15,6 @@ export function proCallout() {
         "your business, generates a vertical-aware page plan, configures",
         "Stripe / auth / lead routing / analytics, and sets up your",
         "GitHub→Vercel deploy — all in one orchestrated flow. Or invoke the",
-        "free scaffolders one at a time → ailaunchkit.ai/pro",
+        "free scaffolders one at a time → ailaunchkit.ai/pricing",
     ].join("\n");
 }

package/dist/module-architecture.d.ts

@@ -397,4 +397,5 @@ export declare function normalizeModules(modules: string[]): ModuleName[];
  * whole invariant.
  */
 export declare function coOwnedModuleDestinations(): ReadonlySet<string>;
+export declare const EXCLUDE_TEMPLATE_DIRS: readonly string[];
 export declare function paidModuleTemplateExclusions(snapshotRoots: readonly string[], repoRoot: string): string[];