@clubedge/create-clubedge-app 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.6.0
+
+- Default to Starter `v0.6.0`, which adds the local infrastructure module and `pnpm check:services`.
+- Add `--infra docker|supabase|none`: Docker Compose services, the Supabase CLI's local stack, or no local services. The environment examples point at the chosen services.
+- Let module options set root `package.json` scripts; scripts that only left-out options define are removed, so each project gets the `infra:*` scripts for its option.
+- Fix Starter tag verification on Windows, where an annotated tag resolved to the tag object instead of its commit and scaffolding a downloaded Starter release failed.
+
+## 0.5.0
+
+- Default to Starter `v0.5.0`, which adds optional modules, Better Auth, and template schema 3.
+- Add `--auth`, `--storage`, and `--cache`, and offer to customize them interactively. Options whose requirements are not met (Supabase Storage without Supabase Auth) are refused with an explanation.
+- Read template schema 3 modules: unselected options' packages, files, provider dependencies, environment variables, and lockfile entries are removed, and selected variants replace the default files.
+- Process `clubedge:if` blocks in the Starter's documentation, environment examples, and sources, so a project only describes what it contains.
+- Support Mermaid (`%%`) markers and single-line `clubedge:only` conditions, and leave no blank lines at file edges after removing blocks.
+- Record the selected modules in the generated `package.json` and `README.md`. The smoke test skips the sign-up check for projects without authentication.
+
 ## 0.4.0
 
 - Default to Starter `v0.4.0`, which adds the TanStack Start app and template schema 2.

package/README.md

@@ -12,27 +12,27 @@ The CLI downloads a tested Starter release, names the generated project, creates
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.4.0
+create-clubedge-app v0.6.0
         |
         v
-Clubedge Starter v0.4.0
-commit fc01d33bb1a3944e099a1750679be87a96ff9a22
+Clubedge Starter v0.6.0
+commit bf5a5e801254816455cbb837902283b788ab7595
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.4.0` | `clubedge-starter@v0.4.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.6.0` | `clubedge-starter@v0.6.0` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.4.0` tag is expected to resolve to commit
-`fc01d33bb1a3944e099a1750679be87a96ff9a22`. The CLI verifies this before
+The `v0.6.0` tag is expected to resolve to commit
+`bf5a5e801254816455cbb837902283b788ab7595`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.4.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.6.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 ## Requirements
 
@@ -83,12 +83,34 @@ pnpm dlx @clubedge/create-clubedge-app my-app --framework tanstack-start
 
 Either way, the app lives in `apps/web` and uses the same shared packages, so the project layout, root scripts, and Docker commands are identical.
 
+### Choosing services
+
+Authentication, file storage, and caching are modules. Each has a default, and anything you leave out is removed completely: its package, its provider SDK, its environment variables, its documentation, and its lockfile entries.
+
+| Flag        | Options                                    | Default    |
+| ----------- | ------------------------------------------ | ---------- |
+| `--auth`    | `supabase`, `better-auth`, `none`          | `supabase` |
+| `--storage` | `s3`, `supabase` (needs Supabase Auth), `none` | `s3`   |
+| `--cache`   | `redis` (falls back to memory without `REDIS_URL`), `memory` | `redis` |
+| `--infra`   | `docker` (Docker Compose), `supabase` (Supabase CLI), `none` | `docker` |
+
+```sh
+# Only the monorepo, UI, database, and tooling
+pnpm dlx @clubedge/create-clubedge-app my-app --auth none --storage none --cache memory
+```
+
+Interactive runs ask whether to customize these after the framework question. The options come from the Starter's manifest, so `--help` lists the ones the bundled Starter offers.
+
 ## Options
 
 ```text
 Usage: pnpm dlx @clubedge/create-clubedge-app [project-directory] [options]
 
 --framework <id>        App framework: next (default) or tanstack-start
+--auth <id>             Authentication: supabase (default), better-auth, or none
+--storage <id>          File storage: s3 (default), supabase, or none
+--cache <id>            Cache and rate limits: redis (default) or memory
+--infra <id>            Local services: docker (default), supabase, or none
 --ref <ref>             Download this Starter tag, branch, or commit from GitHub instead
 --template-dir <path>   Scaffold from a local Starter checkout (for Starter development)
 --dry-run               Show what would be created without writing anything
@@ -101,7 +123,7 @@ Usage: pnpm dlx @clubedge/create-clubedge-app [project-directory] [options]
 
 The target directory must be empty or not exist. The CLI never deletes or overwrites existing files, and if scaffolding fails it removes whatever it wrote, so a failed run leaves nothing behind.
 
-Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, and framework in `package.json` and `README.md`.
+Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
 ```sh
 # Preview the files and edits without writing anything
@@ -114,7 +136,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.4.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.6.0
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -125,7 +147,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --template-dir ../clubedge-starter
 
 Each CLI release bundles one Starter release. When the release is built, `scripts/bundle-template.mjs` clones the pinned Starter tag, verifies that it resolves to the pinned commit, and copies its tracked files into the package (`template/` and `template.lock.json`). Running the CLI then needs no GitHub access for the default Starter.
 
-The Starter describes itself in `clubedge.template.json`: its app directory, site config, environment files, Docker image name, and files that stay out of generated projects. Schema 2 manifests also list each framework's app directory, environment example, and Dockerfile. The CLI moves the selected framework's app to `apps/web` (renaming its package to `@clubedge/web`), moves its environment example and Dockerfile to the project root, leaves the other frameworks out, and removes their entries from `pnpm-lock.yaml` so `pnpm install --frozen-lockfile` keeps working. The CLI refuses a Starter whose manifest schema is newer than it understands and asks you to update. Starters before v0.3.0 have no manifest and use the previous layout.
+The Starter describes itself in `clubedge.template.json`: its app directory, site config, environment files, Docker image name, and files that stay out of generated projects. Schema 2 manifests also list each framework's app directory, environment example, and Dockerfile. The CLI moves the selected framework's app to `apps/web` (renaming its package to `@clubedge/web`), moves its environment example and Dockerfile to the project root, leaves the other frameworks out, and removes their entries from `pnpm-lock.yaml` so `pnpm install --frozen-lockfile` keeps working. Schema 3 adds `modules`: for each option, the workspace packages it uses, the files it owns, the variant files that replace defaults, the root `package.json` scripts it sets, and the options it requires. Files listed under `conditional` contain `clubedge:if <condition>` / `clubedge:end` blocks (in `#`, `//`, `<!-- -->`, or JSX comments) that the CLI keeps or drops for the selection, always removing the markers; `clubedge:if starter-repository` marks sections for Starter maintainers only. The CLI refuses a Starter whose manifest schema is newer than it understands and asks you to update. Starters before v0.3.0 have no manifest and use the previous layout.
 
 The CLI first builds a plan (the files to copy and the edits to make), which `--dry-run` prints, and then applies it. The source is organized the same way:
 
@@ -159,7 +181,7 @@ CI packs the CLI with `npm pack`, scaffolds a clean project from the packed tarb
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.4.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.6.0`, and publish the Starter release.
 
 ### CLI maintainers
 

package/dist/cli/args.js

@@ -1,4 +1,6 @@
 import { parseArgs } from "node:util";
+/** Module flags the CLI accepts. Which options exist is up to the Starter's manifest. */
+export const MODULE_FLAGS = ["auth", "storage", "cache", "infra"];
 export class UsageError extends Error {
     name = "UsageError";
 }
@@ -12,6 +14,10 @@ export function parseCliArgs(argv) {
             strict: true,
             options: {
                 framework: { type: "string" },
+                auth: { type: "string" },
+                storage: { type: "string" },
+                cache: { type: "string" },
+                infra: { type: "string" },
                 ref: { type: "string" },
                 "template-dir": { type: "string" },
                 install: { type: "boolean", default: true },
@@ -33,6 +39,15 @@ export function parseCliArgs(argv) {
     if (values.framework !== undefined && !values.framework.trim()) {
         throw new UsageError("--framework requires a framework id, such as next or tanstack-start.");
     }
+    const modules = {};
+    for (const module of MODULE_FLAGS) {
+        const value = values[module];
+        if (value === undefined)
+            continue;
+        if (!value.trim())
+            throw new UsageError(`--${module} requires an option, such as none.`);
+        modules[module] = value.trim();
+    }
     if (values.ref !== undefined && !values.ref.trim()) {
         throw new UsageError("--ref requires a tag, branch, or commit.");
     }
@@ -42,6 +57,7 @@ export function parseCliArgs(argv) {
     return {
         projectDirectory: positionals[0],
         framework: values.framework?.trim(),
+        modules,
         ref: values.ref,
         templateDir: values["template-dir"],
         install: values.install,

package/dist/cli/ui.js

@@ -64,6 +64,10 @@ Usage:
 
 Options:
   --framework <id>        App framework: next (default) or tanstack-start
+  --auth <id>             Authentication: supabase (default), better-auth, or none
+  --storage <id>          File storage: s3 (default), supabase, or none
+  --cache <id>            Cache and rate limits: redis (default) or memory
+  --infra <id>            Local services: docker (default), supabase, or none
   --ref <ref>             Download this Starter tag, branch, or commit from GitHub instead
   --template-dir <path>   Scaffold from a local Starter checkout (for Starter development)
   --dry-run               Show what would be created without writing anything
@@ -76,6 +80,7 @@ Options:
 Examples:
   pnpm dlx @clubedge/create-clubedge-app my-app
   pnpm dlx @clubedge/create-clubedge-app my-app --framework tanstack-start
+  pnpm dlx @clubedge/create-clubedge-app my-app --auth none --storage none --cache memory
   pnpm dlx @clubedge/create-clubedge-app my-app --dry-run
   pnpm dlx @clubedge/create-clubedge-app my-app --ref main
   pnpm dlx @clubedge/create-clubedge-app my-app --template-dir ../clubedge-starter

package/dist/core/customize.js

@@ -1,15 +1,22 @@
 // Pure text transforms applied to template files. Keeping them free of I/O makes each one easy
 // to test and lets --dry-run describe them without touching the disk.
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
-export function customizeRootManifest(source, { packageName }, provenance, dockerImage) {
+export function customizeRootManifest(source, { packageName }, provenance, dockerImage, scripts = { set: {}, remove: [] }) {
     const manifest = JSON.parse(source);
     manifest.name = packageName;
+    if (manifest.scripts && typeof manifest.scripts === "object") {
+        for (const name of scripts.remove)
+            delete manifest.scripts[name];
+    }
+    if (Object.keys(scripts.set).length)
+        manifest.scripts = { ...manifest.scripts, ...scripts.set };
     manifest.clubedge = {
         cliVersion: provenance.cliVersion,
         starterRepository: provenance.starterRepository,
         starterRef: provenance.starterRef,
         ...(provenance.starterCommit ? { starterCommit: provenance.starterCommit } : {}),
         ...(provenance.framework ? { framework: provenance.framework } : {}),
+        ...(provenance.modules ? { modules: provenance.modules } : {}),
     };
     for (const script of ["docker:build", "docker:start"]) {
         if (typeof manifest.scripts?.[script] === "string") {
@@ -23,9 +30,12 @@ export function customizeReadme(source, { displayName }, provenance) {
         ? `\n- Starter commit: \`${provenance.starterCommit}\``
         : "";
     const frameworkLine = provenance.frameworkName ? `\n- Framework: ${provenance.frameworkName}` : "";
+    const modulesLine = provenance.moduleSummary?.length
+        ? `\n- Modules: ${provenance.moduleSummary.join(", ")}`
+        : "";
     const origin = `## Generated from\n\n` +
         `- Starter repository: \`${provenance.starterRepository}\`\n` +
-        `- Starter ref: \`${provenance.starterRef}\`${commitLine}${frameworkLine}\n` +
+        `- Starter ref: \`${provenance.starterRef}\`${commitLine}${frameworkLine}${modulesLine}\n` +
         `- CLI version: \`${provenance.cliVersion}\``;
     // Only the first heading is the project title; leave every other line as written.
     return source.replace(/^# .+$/m, `# ${displayName}\n\n${origin}`);
@@ -67,29 +77,152 @@ export function customizeAppManifest(source, appPackage) {
  * works. Importers are keyed by workspace path at two-space indentation; package entries that
  * are no longer used are harmless, and pnpm prunes them on the next lockfile update.
  */
-export function customizeLockfile(source, { remove, rename }) {
+export function customizeLockfile(source, { remove, rename, removeDependencies = [] }) {
     const output = [];
     let inImporters = false;
-    let skipping = false;
+    let skippingImporter = false;
+    let skippingDependency = false;
+    // A dependency group header ("    dependencies:") is held until it gets an entry, so a group
+    // whose entries were all removed disappears instead of becoming an empty YAML value.
+    let pendingGroup = null;
     for (const line of source.split("\n")) {
         if (/^\S/.test(line)) {
             inImporters = line === "importers:";
-            skipping = false;
+            skippingImporter = skippingDependency = false;
+            pendingGroup = null;
+            output.push(line);
+            continue;
         }
-        else if (inImporters) {
-            // An importer key, with its value on the next lines or inline ("packages/core: {}").
-            const key = /^ {2}([^\s:][^:]*):(?: |$)/.exec(line)?.[1];
-            if (key !== undefined) {
-                skipping = remove.includes(key);
-                if (!skipping && key === rename?.from) {
-                    output.push(`  ${rename.to}:`);
-                    continue;
-                }
-            }
-            if (skipping)
+        if (!inImporters) {
+            output.push(line);
+            continue;
+        }
+        // An importer key, with its value on the next lines or inline ("packages/core: {}").
+        const importer = /^ {2}([^\s:][^:]*):(?: |$)/.exec(line)?.[1];
+        if (importer !== undefined) {
+            skippingImporter = remove.includes(importer);
+            skippingDependency = false;
+            pendingGroup = null;
+            if (!skippingImporter)
+                output.push(importer === rename?.from ? `  ${rename.to}:` : line);
+            continue;
+        }
+        if (skippingImporter)
+            continue;
+        if (/^ {4}\S/.test(line)) {
+            skippingDependency = false;
+            pendingGroup = line;
+            continue;
+        }
+        const dependency = /^ {6}(['"]?)([^'":]+)\1:\s*$/.exec(line)?.[2];
+        if (dependency !== undefined) {
+            skippingDependency = removeDependencies.includes(dependency);
+            if (skippingDependency)
                 continue;
+            if (pendingGroup !== null) {
+                output.push(pendingGroup);
+                pendingGroup = null;
+            }
+            output.push(line);
+            continue;
+        }
+        if (skippingDependency && /^ {8}/.test(line))
+            continue;
+        if (pendingGroup !== null && line.trim() !== "") {
+            output.push(pendingGroup);
+            pendingGroup = null;
         }
+        skippingDependency = false;
         output.push(line);
     }
     return output.join("\n");
 }
+export class ConditionalError extends Error {
+    name = "ConditionalError";
+}
+// A marker line in any comment style the Starter uses: //, #, %% (Mermaid), <!-- -->, /* */,
+// or {/* */}.
+const MARKER = /^\s*(?:\/\/|#|%%|<!--|\{?\/\*)\s*clubedge:(if|end)\b\s*(.*?)\s*(?:-->|\*\/\}?)?\s*$/;
+// A single line kept only when its condition holds: "- Item <!-- clubedge:only auth=supabase -->".
+const LINE_MARKER = /\s*(?:\/\/|#|<!--|\{?\/\*)\s*clubedge:only\s+(.+?)\s*(?:-->|\*\/\}?)?\s*$/;
+function evaluateCondition(expression, selection, location) {
+    // Maintainer-only sections of the Starter repository never reach a generated project.
+    if (expression.trim() === "starter-repository")
+        return false;
+    return expression.split("&&").every((part) => {
+        const match = /^\s*([a-z][a-z0-9-]*)\s*(!?=)\s*([a-z0-9|-]+)\s*$/.exec(part);
+        if (!match)
+            throw new ConditionalError(`${location}: cannot read the condition "${expression}".`);
+        const [, key, operator, values] = match;
+        const selected = selection[key];
+        if (selected === undefined)
+            throw new ConditionalError(`${location}: unknown key "${key}".`);
+        const matches = values.split("|").includes(selected);
+        return operator === "=" ? matches : !matches;
+    });
+}
+/**
+ * Keeps or drops `clubedge:if <condition>` ... `clubedge:end` blocks for the selection and
+ * always removes the marker lines. Conditions look like `auth=none`, `storage!=none`,
+ * `auth=supabase|better-auth`, or several joined with `&&`. Blocks do not nest.
+ */
+export function applyConditionals(source, selection, path = "file") {
+    const output = [];
+    let open = null;
+    let removed = false;
+    source.split("\n").forEach((line, index) => {
+        const marker = MARKER.exec(line);
+        const location = `${path}:${index + 1}`;
+        if (marker?.[1] === "if") {
+            if (open)
+                throw new ConditionalError(`${location}: clubedge:if blocks cannot nest.`);
+            open = { keep: evaluateCondition(marker[2] ?? "", selection, location), line: index + 1 };
+            removed = removed || !open.keep;
+            return;
+        }
+        if (marker?.[1] === "end") {
+            if (!open)
+                throw new ConditionalError(`${location}: clubedge:end without clubedge:if.`);
+            open = null;
+            return;
+        }
+        if (open && !open.keep)
+            return;
+        const lineMarker = LINE_MARKER.exec(line);
+        if (lineMarker && line.trim() !== lineMarker[0].trim()) {
+            if (!evaluateCondition(lineMarker[1], selection, location)) {
+                removed = true;
+                return;
+            }
+            output.push(line.slice(0, lineMarker.index));
+            return;
+        }
+        output.push(line);
+    });
+    if (open)
+        throw new ConditionalError(`${path}:${open.line}: clubedge:if is never closed.`);
+    const text = output.join("\n");
+    if (!removed)
+        return text;
+    // A removed block can leave two blank lines in a row, or blank lines at the start or end of
+    // the file; formatted sources never have them.
+    const collapsed = text.replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "");
+    return source.endsWith("\n") ? collapsed.replace(/\n+$/, "\n") : collapsed;
+}
+/** Removes dependencies on workspace packages that were left out of the project. */
+export function removePackageDependencies(source, names) {
+    const manifest = JSON.parse(source);
+    let changed = false;
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+        const dependencies = manifest[field];
+        if (!dependencies || typeof dependencies !== "object")
+            continue;
+        for (const name of names) {
+            if (name in dependencies) {
+                delete dependencies[name];
+                changed = true;
+            }
+        }
+    }
+    return changed ? json(manifest) : source;
+}

package/dist/core/manifest.js

@@ -1,7 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 export const MANIFEST_FILE = "clubedge.template.json";
-export const SUPPORTED_SCHEMA_VERSION = 2;
+export const SUPPORTED_SCHEMA_VERSION = 3;
 /** Schema 1 Starters ship a single Next.js app at the generated location. */
 function singleNextFramework(app, envExample) {
     return {
@@ -19,6 +19,8 @@ export const legacyManifest = {
     env: { example: ".env.example", target: "apps/web/.env.local" },
     dockerImage: "clubedge-starter",
     ...singleNextFramework("apps/web", ".env.example"),
+    modules: {},
+    conditional: [],
     exclude: [],
 };
 export class ManifestError extends Error {
@@ -63,9 +65,97 @@ export function parseTemplateManifest(source) {
         env: { example: envExample, target: requireString(env, "target", "env.") },
         dockerImage: requireString(data, "dockerImage"),
         ...(schemaVersion >= 2 ? parseFrameworks(data) : singleNextFramework(app, envExample)),
+        modules: schemaVersion >= 3 ? parseModules(data.modules) : {},
+        conditional: schemaVersion >= 3 ? optionalStringArray(data, "conditional") : [],
         exclude: data.exclude ?? [],
     };
 }
+const ID = /^[a-z][a-z0-9-]*$/;
+function parseModules(value) {
+    if (value === undefined)
+        return {};
+    if (!isRecord(value))
+        throw new ManifestError(`${MANIFEST_FILE}: modules must be an object.`);
+    const modules = {};
+    for (const [id, entry] of Object.entries(value)) {
+        if (!ID.test(id) || id === "framework") {
+            throw new ManifestError(`${MANIFEST_FILE}: "${id}" is not a valid module id.`);
+        }
+        if (!isRecord(entry))
+            throw new ManifestError(`${MANIFEST_FILE}: modules.${id} must be an object.`);
+        const prefix = `modules.${id}.`;
+        const optionsValue = entry.options;
+        if (!isRecord(optionsValue) || Object.keys(optionsValue).length === 0) {
+            throw new ManifestError(`${MANIFEST_FILE}: ${prefix}options must describe at least one option.`);
+        }
+        const options = {};
+        for (const [optionId, option] of Object.entries(optionsValue)) {
+            const optionPrefix = `${prefix}options.${optionId}.`;
+            if (!ID.test(optionId)) {
+                throw new ManifestError(`${MANIFEST_FILE}: "${optionId}" is not a valid option id in ${prefix.slice(0, -1)}.`);
+            }
+            if (!isRecord(option))
+                throw new ManifestError(`${MANIFEST_FILE}: ${optionPrefix.slice(0, -1)} must be an object.`);
+            options[optionId] = {
+                name: requireString(option, "name", optionPrefix),
+                packages: optionalStringRecord(option, "packages", optionPrefix),
+                files: optionalStringArray(option, "files", optionPrefix),
+                replace: optionalStringRecord(option, "replace", optionPrefix),
+                requires: parseRequires(option.requires, optionPrefix),
+                scripts: optionalStringRecord(option, "scripts", optionPrefix),
+            };
+        }
+        const defaultOption = requireString(entry, "default", prefix);
+        if (!options[defaultOption]) {
+            throw new ManifestError(`${MANIFEST_FILE}: ${prefix}default "${defaultOption}" is not in its options.`);
+        }
+        modules[id] = { name: requireString(entry, "name", prefix), default: defaultOption, options };
+    }
+    // Requirements must name real modules and options, or a selection could never be valid.
+    for (const [id, module] of Object.entries(modules)) {
+        for (const [optionId, option] of Object.entries(module.options)) {
+            for (const [requiredModule, allowed] of Object.entries(option.requires)) {
+                const unknown = allowed.find((value) => !modules[requiredModule]?.options[value]);
+                if (unknown !== undefined) {
+                    throw new ManifestError(`${MANIFEST_FILE}: modules.${id}.options.${optionId}.requires names unknown option ${requiredModule}=${unknown}.`);
+                }
+            }
+        }
+    }
+    return modules;
+}
+function parseRequires(value, prefix) {
+    if (value === undefined)
+        return {};
+    if (!isRecord(value))
+        throw new ManifestError(`${MANIFEST_FILE}: ${prefix}requires must be an object.`);
+    const requires = {};
+    for (const [module, allowed] of Object.entries(value)) {
+        const list = typeof allowed === "string" ? [allowed] : allowed;
+        if (!isStringArray(list) || list.length === 0) {
+            throw new ManifestError(`${MANIFEST_FILE}: ${prefix}requires.${module} must name one or more options.`);
+        }
+        requires[module] = list;
+    }
+    return requires;
+}
+function optionalStringArray(record, key, prefix = "") {
+    const value = record[key];
+    if (value === undefined)
+        return [];
+    if (!isStringArray(value))
+        throw new ManifestError(`${MANIFEST_FILE}: ${prefix}${key} must be an array of paths.`);
+    return value;
+}
+function optionalStringRecord(record, key, prefix = "") {
+    const value = record[key];
+    if (value === undefined)
+        return {};
+    if (!isRecord(value) || !Object.values(value).every((item) => typeof item === "string" && item)) {
+        throw new ManifestError(`${MANIFEST_FILE}: ${prefix}${key} must map names to paths.`);
+    }
+    return value;
+}
 function parseFrameworks(data) {
     const { frameworks } = data;
     if (!isRecord(frameworks) || Object.keys(frameworks).length === 0) {
@@ -73,7 +163,7 @@ function parseFrameworks(data) {
     }
     const parsed = {};
     for (const [id, entry] of Object.entries(frameworks)) {
-        if (!/^[a-z][a-z0-9-]*$/.test(id)) {
+        if (!ID.test(id)) {
             throw new ManifestError(`${MANIFEST_FILE}: "${id}" is not a valid framework id.`);
         }
         if (!isRecord(entry))