create-ailk 0.5.0 → 0.6.1

package/dist/module-architecture.js

@@ -21,8 +21,8 @@
  * `architecture.yaml` template files — a fixed template IS the drift this
  * removes.
  */
-import { readFileSync, readdirSync } from "node:fs";
-import { dirname, join, sep } from "node:path";
+import { sep } from "node:path";
+import { importClosure } from "./lib/import-graph.js";
 import { PAID_MODULES } from "./lib/module-tier.js";
 import { RECOGNIZED_MODULES } from "./parse-args.js";
 /**
@@ -124,6 +124,31 @@ export const ARCHITECTURE_BASE = {
         },
     ],
 };
+/**
+ * The workspace asset store (#5854), CO-OWNED by the `workspace` and
+ * `multi-tenant` slices.
+ *
+ * `server.ts` registers both of its routes under
+ * `isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")`, and a file
+ * behind a two-module disjunction must be deliverable by BOTH bundles — or
+ * whichever module lacks it throws ERR_MODULE_NOT_FOUND during `build()`. One
+ * array spread into both `ownedFiles` lists makes the two copies incapable of
+ * drifting, which matters because a drift only surfaces in a scaffolded
+ * customer repo rather than here.
+ *
+ * `routes/assets/index.ts` is listed although it registers nothing: the
+ * template-exclusion closure runs over IMPORTERS, so a shared-constants module
+ * that is imported BY the routes and imports neither of them is never reached
+ * from them, and an unlisted one would ship into the keyless Free starter.
+ */
+const ASSET_STORE_FILES = [
+    "apps/api/src/routes/assets/index.ts",
+    "apps/api/src/routes/assets/upload.ts",
+    "apps/api/src/routes/assets/read.ts",
+    // The manage routes — list, PATCH, DELETE (#6093 D16).
+    "apps/api/src/routes/assets/manage.ts",
+    "apps/api/src/lib/asset-store.ts",
+];
 /**
  * The per-module slices. Authored for every `RECOGNIZED_MODULES` value; only
  * `marketing` (the default) is validated end-to-end against a golden.
@@ -246,6 +271,11 @@ export const MODULE_SLICES = {
             // The Fumadocs source pair — both whole, both loaders (D3).
             "apps/web/source.config.ts",
             "apps/web/lib/source.ts",
+            // The runtime source `lib/source.ts` resolves to under
+            // CONTENT_ADAPTER=database (#5878). Listed explicitly: the exclusion
+            // closure grows over DEPENDENTS, not dependencies, so being imported by
+            // `lib/source.ts` does not pull this file into the bundle by itself.
+            "apps/web/lib/runtime-source.ts",
             // The route adapters and the jest stub for the codegen output.
             "apps/web/lib/blog-list-data.ts",
             "apps/web/lib/blog-post-data.ts",
@@ -656,6 +686,11 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/workspaces/index.ts",
             "apps/api/src/routes/workspaces/sessions.ts",
             "apps/api/src/routes/workspaces/config.ts",
+            // Co-owned with `workspace` (#5853): the content-write scope is gated on
+            // content-write AND (workspace || multi-tenant) and this file imports
+            // lib/tenant-db.ts, so each tenancy slice must deliver it.
+            "apps/api/src/routes/workspaces/content.ts",
+            ...ASSET_STORE_FILES,
             "apps/api/src/routes/billing/index.ts",
             "apps/api/src/routes/billing/portal.ts",
             "apps/api/src/routes/billing/read.ts",
@@ -672,8 +707,42 @@ export const MODULE_SLICES = {
             "apps/api/src/middleware/tenant.ts",
             "apps/api/src/services/tenant-context.ts",
             "apps/api/src/services/waitlist-dashboard.ts",
+            // #6258 — the file waitlist-dashboard.ts imports for the pinned
+            // platform-operator read scope. It rides BOTH slices for the same
+            // reason its importer does: an unlisted import target breaks a
+            // signal-collectors-without-multi-tenant scaffold at build() time.
+            "apps/api/src/services/waitlist-operator-reads.ts",
+            // #6204/#6280 CI fix — `listUnhandledMessages`/`markMessageHandled`
+            // (the "Needs-you" message read/write over `tenantDb(tenant).leads`)
+            // moved here off `services/leads-inbox.ts`, a BASE-tier file every
+            // scaffold ships. Importing `lib/tenant-db.ts` from that base file
+            // walked `paidModuleTemplateExclusions()`'s companion closure
+            // (`lib/import-graph.ts`) BACKWARD into `leads-inbox.ts` itself and
+            // then into every one of `apps/api/src/{server,cli,index,
+            // vercel-handler}.ts` — all of which reach it through
+            // `routes/leads/list.ts` — dropping them from a keyless scaffold
+            // (`__tests__/paid-module-exclusions.test.ts`'s `MUST_SHIP` guard,
+            // #5678's cascade shape recurring a third time).
+            //
+            // #6216 — now reached: `routes/workspaces/messages.ts` (below)
+            // consumes `getMessage` alongside the two functions above. That route
+            // registers under `isModuleEnabled("workspace") ||
+            // isModuleEnabled("multi-tenant")` — the SAME gate
+            // `workspaces/general.ts`/`members.ts` register under, NOT the
+            // multi-tenant-only family `workspaces/meetings.ts`/`config.ts` sit
+            // in — so this file and `routes/workspaces/messages.ts` are now
+            // CO-OWNED with `workspace` too (see that slice's entry below), the
+            // asset-store precedent: a file behind an OR gate must be
+            // deliverable by BOTH bundles.
+            "apps/api/src/services/inbox-messages.ts",
+            "apps/api/src/routes/workspaces/messages.ts",
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/lib/ws-token.ts",
+            // #6157 D16 — the magnet Admin authoring surface, co-owned with
+            // `signal-collectors` below for the SAME reason #5677 co-owns the
+            // review surface under both: its scope is registered under the
+            // widened `multi-tenant || signal-collectors` gate.
+            "apps/api/src/routes/magnets/index.ts",
             "apps/web/app/[locale]/(authed)/waitlist/page.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/[experimentId]/page.tsx",
             "apps/web/app/[locale]/(authed)/waitlist/[experimentId]/signups/[leadId]/page.tsx",
@@ -769,6 +838,16 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/admin/team/page.tsx",
             "apps/api/src/routes/workspaces/general.ts",
             "apps/api/src/routes/workspaces/members.ts",
+            // Co-owned with `multi-tenant` (#6216) — see that slice's entry: the
+            // route registers under the SAME workspace||multi-tenant gate as the
+            // two lines above, and its service function imports `lib/tenant-db.ts`
+            // (a multi-tenant-owned file), so both must be deliverable by either
+            // bundle alone.
+            "apps/api/src/routes/workspaces/messages.ts",
+            "apps/api/src/services/inbox-messages.ts",
+            // Co-owned with `multi-tenant` (#5853) — see that slice's entry.
+            "apps/api/src/routes/workspaces/content.ts",
+            ...ASSET_STORE_FILES,
         ],
         // patches — the dependency add that delivers the shared package to the
         // buyer's apps/web, mirroring docs-blog's own fumadocs-schema merge-keys
@@ -951,12 +1030,67 @@ export const MODULE_SLICES = {
             "apps/api/src/services/scheduling/index.ts",
             "apps/api/src/services/scheduling/cal-provider.ts",
             "apps/api/src/services/scheduling/types.ts",
+            // #6182 (S9a) — the Cal adapter's own suite. Individually, never as a
+            // glob (§ D12 above, property 1: a glob entry is a silent no-op, so
+            // `__tests__/**` would ship no test at all to a keyed scaffold).
+            "apps/api/src/services/scheduling/__tests__/cal-provider.test.ts",
             "apps/mcp/src/tools/list_availability.ts",
             "apps/mcp/src/tools/get_event_meta.ts",
             "apps/mcp/src/tools/create_booking.ts",
             "apps/web/app/[locale]/meet/page.tsx",
             "apps/web/app/[locale]/meet/[slug]/page.tsx",
             "apps/web/app/[locale]/meet/confirmed/page.tsx",
+            // #6085 (brief H7) — the six files the webhook receiver + the
+            // tenant-guarded appointments read add. Individually, never as a
+            // glob (§ D12 / this card's own comment above, property 1: a glob
+            // entry is a silent no-op, so __tests__/** would ship no test at all
+            // to a keyed scaffold). `apps/api/src/routes/webhooks/index.ts` is
+            // NOT added — it is the mixed barrel that also registers the Stripe
+            // receiver, the same "mixed barrel is never listed" precedent this
+            // slice already records for `routes/project-listings/index.ts`.
+            // `apps/api/src/routes/schedule/index.ts` is already listed above and
+            // stays (it re-exports `listAppointmentsRoute` alongside the three
+            // anonymous routes it already re-exports).
+            "apps/api/src/routes/webhooks/calcom.ts",
+            "apps/api/src/routes/webhooks/__tests__/calcom.test.ts",
+            "apps/api/src/services/scheduling/appointments.ts",
+            "apps/api/src/services/scheduling/__tests__/appointments.test.ts",
+            "apps/api/src/routes/schedule/appointments.ts",
+            "apps/api/src/routes/schedule/__tests__/appointments.test.ts",
+            // #6086 (brief H7) — the SITE's appointments page, the visible half of
+            // the read above. The co-located suite is listed EXPLICITLY alongside
+            // its page: `EXCLUDE_TEMPLATE_DIRS` below drops only the three
+            // top-level `apps/web/**/__tests__` directories, and the import-graph
+            // closure walks FORWARD from an owned file — a test that imports
+            // `../page` is a dependent, not a companion, so it is never swept
+            // along. Without the second entry a keyless scaffold would carry a
+            // test for a page it does not have.
+            "apps/web/app/[locale]/(authed)/appointments/page.tsx",
+            "apps/web/app/[locale]/(authed)/appointments/__tests__/page.test.tsx",
+            // #6183 S9b — the enabled-meeting-slugs gate. `meetings.ts` is its own
+            // file (not folded into `routes/workspaces/config.ts`, which is
+            // `workspace`/`multi-tenant`-owned) precisely because its GET reaches
+            // `services/scheduling/` — the SAME reason `routes/schedule/
+            // appointments.ts` above is its own file rather than a row on an
+            // existing route. `lib/public-meetings-config.ts` is the public-read
+            // boundary `routes/schedule/meeting-types.ts` (the anonymous read,
+            // already reached via the already-listed `routes/schedule/index.ts`)
+            // calls into.
+            "apps/api/src/routes/workspaces/meetings.ts",
+            "apps/api/src/routes/workspaces/__tests__/meetings.test.ts",
+            "apps/api/src/lib/public-meetings-config.ts",
+            "apps/api/src/routes/schedule/meeting-types.ts",
+            "apps/api/src/routes/schedule/__tests__/meeting-types.test.ts",
+            // meetings.ts is the FIRST scheduling-gated route to use the generic
+            // tenantDb() scope layer directly (its sibling, appointments.ts, does
+            // its own scoped read in services/scheduling/appointments.ts instead)
+            // — and `workspaceMeetings` is now in architecture.yaml's tenant-scope
+            // forbidden_pattern (#6183), so meetings.ts cannot bypass tenantDb()
+            // with a raw prisma call. Co-owned with `multi-tenant` below (the
+            // SAME two files, same reason `content.ts`'s own comment there
+            // records: "each tenancy slice must deliver it").
+            "apps/api/src/lib/tenant-db.ts",
+            "apps/api/src/services/tenant-context.ts",
         ],
         // pageContributions (spec 5478; parent § D6 shape 1) — the booker, the
         // per-booking-type page and the confirmation page, whose route files
@@ -966,6 +1100,10 @@ export const MODULE_SLICES = {
             { route: "/meet" },
             { route: "/meet/[slug]" },
             { route: "/meet/confirmed" },
+            // #6086 — the authed appointments page. Bracket (roster) grammar and no
+            // `content` key, for the same reason the three /meet rows carry none:
+            // it renders from `/v1/schedule/appointments`, not from an MDX file.
+            { route: "/appointments" },
         ],
         // patches (#5581 U3, D5) — delivers the extracted component package to a
         // keyed scaffold's apps/web, mirroring the signal-collectors slice's
@@ -1183,6 +1321,28 @@ export const MODULE_SLICES = {
             "apps/api/src/routes/waitlist-experiments/signups.ts",
             "apps/api/src/routes/waitlist-experiments/respond.ts",
             "apps/api/src/services/waitlist-dashboard.ts",
+            // #6258 — the file waitlist-dashboard.ts imports for the pinned
+            // platform-operator read scope. It rides BOTH slices for the same
+            // reason its importer does: an unlisted import target breaks a
+            // signal-collectors-without-multi-tenant scaffold at build() time.
+            "apps/api/src/services/waitlist-operator-reads.ts",
+            // #6157 D14/D16 — the magnet Admin authoring surface's own sibling
+            // tenant scope is gated `multi-tenant || signal-collectors` (D4,
+            // the SAME expression this review-surface block co-owns files
+            // under), so both its route file AND `lib/tenant-db.ts` (the ONE
+            // data path it reads/writes through, FR3) must be delivered here
+            // too. `lib/tenant-db.ts` is ALSO listed under `multi-tenant` above
+            // — additive, not a transfer (the same reasoning this array's own
+            // header comment already states for every other file in it).
+            //
+            // The closure stays tight WITHOUT dragging in `tenant-context.ts` or
+            // the multi-tenant guard assembly behind it, because `tenant-db.ts`'s
+            // own type import was retargeted from `tenant-context.js` to the
+            // BASE-tree `services/default-tenant.js` in this same unit (D15) —
+            // the identical one-line class of move #5677 made for
+            // `waitlist-dashboard.ts` two paragraphs above this one.
+            "apps/api/src/routes/magnets/index.ts",
+            "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/routes/project-listings/get.ts",
             "apps/api/src/routes/project-listings/list.ts",
             "apps/api/src/routes/project-listings/patch.ts",
@@ -1370,18 +1530,14 @@ export const MODULE_SLICES = {
             },
         },
         packages: {
-            // Duplicated VERBATIM from the multi-tenant slice's own "stripe-client"
-            // entry (§7 Q1 — a multi-tenant deployment using the Stripe billing
-            // portal or org-billing webhook routing also installs commerce, so
-            // both slices can be selected together) — the same order-independence
-            // reason the multi-tenant/scheduling slices state for `validation`
-            // below: `deriveArchitecture` merges `packages` blocks with
-            // `Object.assign`, so two slices declaring this key differently would
-            // make the derivation depend on module order.
-            "stripe-client": {
-                description: "Stripe SDK wrapper + webhook signature verification",
-                may_import_from: ["packages/validation"],
-            },
+            // `stripe-client` is deliberately NOT declared here (#5823). It was,
+            // duplicated verbatim from the multi-tenant slice, while the package was
+            // paid and commerce-owned. Since #5810 it is `commercial_tier: oss`,
+            // published public, and since #5812 its sole `apps/api` importer
+            // (`lib/stripe.ts`) is a base file — so the package is base, not a
+            // commerce slice member. The `packages/stripe-client` entries in the
+            // `may_import_from` lists above and in the base/multi-tenant slices are
+            // unaffected: those declare who may reach the package, not who owns it.
             // Duplicated VERBATIM from the marketing slice for the same
             // order-independence reason the multi-tenant/scheduling slices state.
             validation: {
@@ -1402,28 +1558,36 @@ export const MODULE_SLICES = {
         // ownedFiles (S1, #5088). SOURCE files only (#5182 D6) — no __tests__/,
         // no .stories.tsx, no .text.ts... except .text.ts siblings ARE source
         // (they ship as runtime copy modules, not test fixtures), so the ten
-        // annotated below are listed. 42 in all: 9 apps/api + 26 packages/ui
+        // annotated below are listed. 36 in all: 4 apps/api + 26 packages/ui
         // (15 components + 10 .text.ts siblings + this slice's own
         // sections/slices/commerce.ts) + 7 apps/web.
+        //
+        // THE PRIMITIVES LEFT THIS SLICE (D-64, epic #5770, #5796). The checkout
+        // launcher, the Stripe webhook receiver, customer mapping and the
+        // `lib/stripe.ts` shim are BASE TREE now: `apps/api/src/server.ts`
+        // registers them unconditionally and gates them at CALL time on the JWT
+        // `commerce` claim (`apps/api/src/lib/require-commerce-claim.ts`), so a
+        // keyless scaffold must CARRY them. Claiming them here is what deleted
+        // them from that scaffold while the server still loaded them —
+        // ERR_MODULE_NOT_FOUND inside build(), every route 500ing, which is the
+        // exact defect `tools/lint-slice-registration.ts` (#5701) exists to
+        // catch. The six that left: lib/stripe.ts,
+        // routes/checkout/{index,sessions}.ts, routes/webhooks/{index,stripe}.ts
+        // and routes/webhooks/README.md. The four below STAY — they are commerce
+        // OVERLAY, still registered behind `isModuleEnabled("commerce")` and
+        // still carrying their `// oss: false` markers.
         ownedFiles: [
-            "apps/api/src/lib/stripe.ts",
-            "apps/api/src/routes/checkout/index.ts",
-            "apps/api/src/routes/checkout/sessions.ts",
-            "apps/api/src/routes/webhooks/index.ts",
-            "apps/api/src/routes/webhooks/stripe.ts",
-            // README.md documents the Stripe webhook receiver — not a test/
-            // generated file, and its absence is exactly what left a stray
-            // apps/api/src/routes/webhooks/ directory in a keyless templates/
-            // snapshot (empirically found, #5364 build pass): the import-graph
-            // closure only scans source extensions, never markdown, so once
-            // index.ts and stripe.ts are excluded this is the one file left
-            // behind. Same defect class #5366 found and fixed the same way for
-            // routes/flows/README.md — see that entry above.
-            "apps/api/src/routes/webhooks/README.md",
             "apps/api/src/routes/flow-checkouts/index.ts",
             "apps/api/src/routes/flows/recommender.ts",
             "apps/api/src/services/recommender-capture.ts",
             "apps/api/src/services/flow-checkouts.ts",
+            // #6038 — the buyer-scoped subscription-status route pair (the
+            // update-your-card banner's read + portal handoff). Commerce OVERLAY,
+            // same posture as the four flow-checkouts/recommender entries above.
+            "apps/api/src/routes/subscription/index.ts",
+            "apps/api/src/routes/subscription/me.ts",
+            "apps/api/src/routes/subscription/portal.ts",
+            "apps/api/src/services/subscription.ts",
             // #5581 U5 — the fifteen commerce components (+ ten .text.ts extractors
             // + the slice's own re-export entry point) moved to
             // packages-paid/ui-commerce; the package is delivered to a keyed
@@ -1457,6 +1621,13 @@ export const MODULE_SLICES = {
             "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/portal-route.template.ts": ".claude/skills/scaffold-commerce/templates/portal-route.template.ts",
             "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/stripe-config.template.ts": ".claude/skills/scaffold-commerce/templates/stripe-config.template.ts",
             "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce/templates/subscription-route.template.ts": ".claude/skills/scaffold-commerce/templates/subscription-route.template.ts",
+            // The commerce-boundary rule (#6039/#6070, this entry #6041): ships to
+            // a commerce-keyed scaffold's project root so an agent working there
+            // reads the money/live-mode/personal-data classification before it
+            // acts. One more literal entry alongside the ten scaffold-commerce
+            // skill entries above, for the same reason — a directory source is
+            // rejected by `validateInstallMap`.
+            "packages/create-ailk/module-templates/commerce/.claude/rules/commerce-boundary.md": ".claude/rules/commerce-boundary.md",
         },
         // patches (#5581 U5, D5) — delivers the extracted component package to a
         // keyed scaffold's apps/web, mirroring the workspace slice's identical
@@ -1565,9 +1736,56 @@ export function coOwnedModuleDestinations() {
     }
     return coOwned;
 }
+// Template-relative directories excluded from the snapshot outright (#4154).
+//   - apps/web/__tests__ — this repo's own harness tests. Several import route
+//     modules across multiple surfaces (resources-downloads-integrations-phase2,
+//     standalone-informational-routes, routes/blog-route, blog-dir-resolution),
+//     so they fail outright in a scaffold whose surfaces are gated off. The
+//     co-located app/[locale]/<surface>/__tests__ suites travel with their
+//     surface and are unaffected.
+//   - apps/web/app/[locale]/__tests__ — same class: page-renderer-migration
+//     reaches across surfaces (`../launch-service/page`), so it breaks in a
+//     scaffold that gated launch-service off. The PER-SURFACE co-located
+//     suites (app/[locale]/<surface>/__tests__) import only their own route and
+//     travel with their surface, so they are kept.
+//   - apps/web/content — the blog/docs sample posts (the launching-ailk class).
+//     Replaced by neutral stubs from template-overlay/.
+//   - apps/web/app/[locale]/(authed)/edit — the Pro content host's editor
+//     routes (#5977; added to apps/web by #5957, spec 5872 FR1/FR2). Both
+//     pages are `// oss: false` and the [type]/[slug] page imports
+//     `@working-theory/admin-ui`, which a keyless (Free) scaffold does not
+//     carry — so shipping them puts two files importing an absent package
+//     into the scaffold and fails both co-located `__tests__` suites under
+//     verify-scaffold's `apps/web` jest run. The directory is taken whole,
+//     `__tests__` with it, since a test of an excluded route has nothing to
+//     test.
+//
+//     WHY AN EXCLUSION AND NOT A MODULE SLICE. Spec 5872 D11 settled the two
+//     constraints that rule out the alternatives, quoted rather than
+//     re-derived:
+//       1. "content-write cannot be a MODULE_SLICES key"
+//          (`module-architecture.ts:214-222` — a key would make
+//          `--modules content-write` a valid selection).
+//       2. "the workspace slice is the wrong owner" (#5853 §4.2/D14 — it
+//          would bind the Pro editor to a Pro Plus bundle).
+//     So there is no correct `ownedFiles` owner for these files today. This
+//     entry is the INTERIM: a flat exclusion that keeps the keyless scaffold
+//     honest until a content-write delivery path exists, at which point the
+//     routes move to that path's owner and this entry comes back out. The
+//     routes stay registered in `ROUTE_SINCE` (src/surfaces.ts) meanwhile —
+//     see that entry, and sync-routes' AC-5 coverage test, which reads this
+//     list so the resulting ROUTE_SINCE-vs-template absence is justified
+//     rather than reported stale.
+export const EXCLUDE_TEMPLATE_DIRS = [
+    "apps/web/__tests__",
+    "apps/web/app/__tests__",
+    "apps/web/app/[locale]/__tests__",
+    "apps/web/app/[locale]/(authed)/edit",
+    "apps/web/content",
+];
 export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
     const roots = new Set(snapshotRoots);
-    const excluded = new Set();
+    const seeds = new Set();
     for (const moduleName of PAID_MODULES) {
         for (const owned of MODULE_SLICES[moduleName]?.ownedFiles ?? []) {
             const rel = owned.split(sep).join("/");
@@ -1575,103 +1793,11 @@ export function paidModuleTemplateExclusions(snapshotRoots, repoRoot) {
                 continue;
             if (rel.includes("*"))
                 continue;
-            excluded.add(rel);
+            seeds.add(rel);
         }
     }
-    // Companion closure by import graph, to a fixed point — never a filename
-    // stem rule (#5182 D7), which misses eleven files and over-marks three.
-    const candidates = listFilesUnder(repoRoot, [...roots]);
-    for (;;) {
-        let grew = false;
-        for (const file of candidates) {
-            if (excluded.has(file))
-                continue;
-            const imports = relativeImportsOf(join(repoRoot, file));
-            for (const spec of imports) {
-                const target = resolveRelativeImport(file, spec, candidates);
-                if (target !== undefined && excluded.has(target)) {
-                    excluded.add(file);
-                    grew = true;
-                    break;
-                }
-            }
-        }
-        if (!grew)
-            break;
-    }
-    return [...excluded].sort();
-}
-const SOURCE_EXTS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
-/** Every source file under the given repo-relative roots, as "/"-joined paths. */
-function listFilesUnder(repoRoot, roots) {
-    const out = new Set();
-    const skip = new Set(["node_modules", ".next", "dist", ".turbo", ".source"]);
-    const stack = roots.map((r) => r);
-    while (stack.length > 0) {
-        const rel = stack.pop();
-        const abs = join(repoRoot, rel);
-        let entries;
-        try {
-            entries = readdirSync(abs, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (skip.has(entry.name))
-                continue;
-            const childRel = `${rel}/${entry.name}`;
-            if (entry.isDirectory())
-                stack.push(childRel);
-            else if (SOURCE_EXTS.some((e) => entry.name.endsWith(e)))
-                out.add(childRel);
-        }
-    }
-    return out;
-}
-/** The relative import specifiers a source file names (static imports + re-exports). */
-function relativeImportsOf(absPath) {
-    let src;
-    try {
-        src = readFileSync(absPath, "utf8");
-    }
-    catch {
-        return [];
-    }
-    const out = [];
-    for (const m of src.matchAll(/(?:^|\n)\s*(?:import|export)[\s\S]{0,400}?from\s*["'](\.[^"']*)["']/g))
-        out.push(m[1]);
-    for (const m of src.matchAll(/\bimport\s*\(\s*["'](\.[^"']*)["']\s*\)/g))
-        out.push(m[1]);
-    return out;
-}
-/**
- * Resolve a relative specifier against the candidate set. TypeScript ESM writes
- * `./x.js` for `./x.ts`, so the `.js` → `.ts`/`.tsx` rewrite is the common case.
- */
-function resolveRelativeImport(fromFile, spec, candidates) {
-    const base = posixJoin(dirname(fromFile.split("/").join(sep)), spec);
-    const stem = base.replace(/\.(js|jsx|mjs|cjs)$/, "");
-    for (const cand of [
-        base,
-        ...SOURCE_EXTS.map((e) => stem + e),
-        ...SOURCE_EXTS.map((e) => `${stem}/index${e}`),
-    ])
-        if (candidates.has(cand))
-            return cand;
-    return undefined;
-}
-/** Join and normalize a "/"-separated path, resolving `.` and `..` segments. */
-function posixJoin(dir, spec) {
-    const parts = `${dir.split(sep).join("/")}/${spec}`.split("/");
-    const out = [];
-    for (const part of parts) {
-        if (part === "" || part === ".")
-            continue;
-        if (part === "..")
-            out.pop();
-        else
-            out.push(part);
-    }
-    return out.join("/");
+    // Companion closure by import graph, to a fixed point — the shared walker
+    // (`lib/import-graph.ts`), so `tools/lint-slice-registration.ts` asks the
+    // question with the same resolution this answer was computed with (#5701).
+    return [...importClosure(repoRoot, [...roots], seeds)].sort();
 }

package/dist/programmatic.js

@@ -19,7 +19,7 @@ import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, } from
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CATALOG_TARGET_PATH, writeComponentCatalog, } from "./component-catalog.js";
-import { copyTemplate } from "./copy.js";
+import { buildScaffoldMarkers, copyTemplate } from "./copy.js";
 import { deriveArchitecture } from "./derive-architecture.js";
 import { extractModuleBundle, installBundleTree, } from "./lib/extract-module-bundle.js";
 import { fetchTemplate } from "./lib/fetch-template.js";
@@ -92,15 +92,7 @@ export function scaffoldSync(opts) {
         targetDir: targetAbs,
         versions,
         excludePaths: excludedRoutePaths(enabledSurfaces),
-        markers: {
-            PROJECT_NAME: projectName,
-            COMPANY_NAME: "Your Company",
-            COMPANY_DOMAIN: "example.com",
-            // The social-profile handle the Free chrome's footer links carry
-            // (`https://x.com/{{COMPANY_HANDLE}}`, #5469 D5) — a placeholder the
-            // site owner replaces, never the kit vendor's own handle.
-            COMPANY_HANDLE: "yourcompany",
-        },
+        markers: buildScaffoldMarkers(projectName),
     });
     // Derive + write the module-set-driven architecture.yaml (spec #3787). This
     // is the single source of the scaffolded site's code-boundary config and
@@ -241,6 +233,14 @@ export async function scaffold(opts) {
     // `scaffoldSync` already reads for `copyTemplate`, re-read here since
     // `scaffold()` doesn't share `scaffoldSync`'s call frame.
     const versions = readVersionMap();
+    // #6460 — the SAME marker map `scaffoldSync` just substituted the base
+    // `templates/` copy with, rebuilt here from the same inputs (`scaffold()`
+    // does not share `scaffoldSync`'s call frame, exactly as `versions` above
+    // does not) and threaded into every layer that lands on top of it. Without
+    // it a `{{MARKER}}` authored in a base-layer or site-template file would
+    // survive into the scaffold verbatim — the state before this card, and the
+    // reason a template file could not carry the version stamp.
+    const markers = buildScaffoldMarkers(opts.projectName ?? basename(result.targetDir));
     // #5618 D4 — the file-grain ownership registry for THIS scaffold: which
     // layer wrote which destination. Call-scoped (a fresh Map per scaffold(),
     // never module-level), threaded through every layer install below in the
@@ -267,6 +267,7 @@ export async function scaffold(opts) {
             name: BASE_LAYER_DIR,
             templateRequires: [],
             versions,
+            markers,
             ownership,
         });
     }
@@ -276,6 +277,7 @@ export async function scaffold(opts) {
             targetDir: result.targetDir,
             moduleName,
             versions,
+            markers,
             ownership,
         });
     }
@@ -305,6 +307,7 @@ export async function scaffold(opts) {
                 templateRequires: template.requires,
                 templateExtends: template.extends,
                 versions,
+                markers,
                 ownership,
             })
             : (() => {
@@ -319,6 +322,7 @@ export async function scaffold(opts) {
                     templateRequires: template.requires,
                     templateExtends: template.extends,
                     versions,
+                    markers,
                     ownership,
                 });
             })();