@decohere/create 0.0.1-dev.20 → 0.0.1-dev.20261105.46

package/es6/src/resolve-launch.js

@@ -0,0 +1,87 @@
+import { basename, resolve } from "node:path";
+const HOST_FLAGS_WITH_VALUE = new Set([
+    "--config-file",
+    "--log-level"
+]);
+/**
+ * Map host / npm-create argv onto the product CLI (`create webapi` / `add api`).
+ * `npm create @decohere webapi` already says “create”, so we prepend `create`
+ * rather than making users type `create create webapi`.
+ */ export function toProductArgv(tokens) {
+    if (tokens[0] === "webapi" && tokens[1] === "add") {
+        return [
+            "add",
+            "api",
+            ...tokens.slice(2)
+        ];
+    }
+    if (tokens[0] === "webapi") {
+        return [
+            "create",
+            "webapi",
+            ...tokens.slice(1)
+        ];
+    }
+    return tokens;
+}
+export function containerArgvFromHost(argv) {
+    const user = argv[0]?.includes("node") || argv[0]?.endsWith("node") ? argv.slice(2) : argv;
+    const stripped = [];
+    for(let i = 0; i < user.length; i++){
+        const arg = user[i];
+        if (arg != null && HOST_FLAGS_WITH_VALUE.has(arg)) {
+            i++;
+            continue;
+        }
+        if (arg != null) stripped.push(arg);
+    }
+    return toProductArgv(stripped);
+}
+/**
+ * Host argv → directory to mount and argv for the in-image `decohere` entrypoint.
+ * Positional `webapi my-app` / `create webapi my-app` wins over `-d` (npm treats `-d`
+ * as its own loglevel).
+ */ export function resolveLaunch(argv, cwd = process.cwd()) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h" || argv[0] === "--version")) {
+        return {
+            targetDir: cwd,
+            containerArgv: argv,
+            projectName: basename(cwd),
+            kind: "scaffold"
+        };
+    }
+    let directoryFlag;
+    const withoutD = [];
+    for(let i = 0; i < argv.length; i++){
+        const arg = argv[i];
+        if (arg === "-d") {
+            directoryFlag = argv[i + 1];
+            i++;
+            continue;
+        }
+        if (arg != null) withoutD.push(arg);
+    }
+    const product = toProductArgv(withoutD);
+    const isAdd = product[0] === "add";
+    let positional;
+    let withoutPositional = product;
+    if (!isAdd && product[0] === "create" && product[1] === "webapi" && product[2] != null && !product[2].startsWith("-")) {
+        positional = product[2];
+        withoutPositional = [
+            product[0],
+            product[1],
+            ...product.slice(3)
+        ];
+    }
+    const targetDir = resolve(cwd, positional?.trim() || directoryFlag?.trim() || ".");
+    return {
+        targetDir,
+        containerArgv: [
+            ...withoutPositional,
+            "-d",
+            "."
+        ],
+        projectName: basename(targetDir),
+        kind: product[0] === "auth0" ? "auth0" : "scaffold"
+    };
+}

package/es6/src/runner.js

@@ -1,23 +1,23 @@
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { CREATE_VERSION } from "./version.js";
-const BUILDER_IMAGE = `ghcr.io/decohere/scaffold:${CREATE_VERSION}`;
+import { resolveLaunch } from "./resolve-launch.js";
+import { CREATE_IMAGE_REPOSITORY, CREATE_VERSION } from "./version.js";
+const BUILDER_IMAGE = `${CREATE_IMAGE_REPOSITORY}:${CREATE_VERSION}`;
 /**
- * Run the scaffold inside a pre-built Docker builder image.
- *
- * Called when `DECOHERE_BUILDER` is not set — i.e. the CLI is running on the
- * host, outside the container. Mounts the target directory as `/workspace` so
- * the scaffolded files are written back to the host filesystem.
- *
- * If `~/.config/auth0` exists on the host the directory is also mounted so
- * the auth0 CLI inside the container can reuse existing credentials silently.
- */ export function runInBuilder(opts) {
-    const targetDir = resolve(opts.d ?? ".");
+ * Pull/run the Decohere scaffolder image. Host `@decohere/create` does not load
+ * the `@decohere/scaffold` dependency tree — that lives in the image only.
+ */ export function runInBuilder(argv) {
+    const { targetDir, containerArgv, projectName, kind } = resolveLaunch(argv);
     mkdirSync(targetDir, {
         recursive: true
     });
-    // Ensure Docker is available.
+    if (kind === "scaffold") {
+        mkdirSync(resolve(targetDir, ".devcontainer", "npm-auth"), {
+            recursive: true
+        });
+    }
     try {
         execFileSync("docker", [
             "info"
@@ -28,28 +28,71 @@ const BUILDER_IMAGE = `ghcr.io/decohere/scaffold:${CREATE_VERSION}`;
         console.error("\n  Docker is required to scaffold a Decohere project.\n" + "  Install Docker Desktop: https://www.docker.com/products/docker-desktop\n");
         process.exit(1);
     }
+    const hostUid = process.getuid?.();
+    const hostGid = process.getgid?.() ?? hostUid;
+    const runAsHostUser = hostUid != null && hostGid != null;
+    const npmCacheDir = resolve(homedir(), ".cache/decohere-create/npm");
+    mkdirSync(npmCacheDir, {
+        recursive: true
+    });
+    const builderHome = "/tmp/decohere-create-home";
     const volumes = [
         "-v",
-        `${targetDir}:/workspace`
+        `${targetDir}:/workspace`,
+        "-v",
+        `${npmCacheDir}:/npm-cache`
+    ];
+    const envArgs = [
+        "-e",
+        "DECOHERE_BUILDER=1",
+        "-e",
+        `DECOHERE_PROJECT_NAME=${projectName}`,
+        "-e",
+        "NPM_CONFIG_CACHE=/npm-cache",
+        "-e",
+        "NPM_CONFIG_PREFER_OFFLINE=true",
+        "-e",
+        `HOME=${builderHome}`
+    ];
+    const npmrcPath = resolve(homedir(), ".npmrc");
+    if (existsSync(npmrcPath)) {
+        volumes.push("-v", `${npmrcPath}:/tmp/host-npmrc:ro`);
+        envArgs.push("-e", "NPM_CONFIG_USERCONFIG=/tmp/host-npmrc");
+    }
+    const auth0ConfigDir = resolve(homedir(), ".config/auth0");
+    mkdirSync(auth0ConfigDir, {
+        recursive: true
+    });
+    volumes.push("-v", `${auth0ConfigDir}:${builderHome}/.config/auth0`);
+    const userArgs = [];
+    if (runAsHostUser) {
+        userArgs.push("--user", `${hostUid}:${hostGid}`);
+    } else if (hostUid != null) {
+        envArgs.push("-e", `HOST_UID=${hostUid}`);
+        if (hostGid != null) envArgs.push("-e", `HOST_GID=${hostGid}`);
+    }
+    console.log(kind === "auth0" ? "  Running Auth0 CLI in the scaffolder image...\n" : "  Running scaffolding in a sandboxed container...\n");
+    const ttyFlags = process.stdin.isTTY ? [
+        "-it"
+    ] : [
+        "-i"
     ];
-    console.log("  Running scaffolding in a sandboxed container...\n");
     const result = spawnSync("docker", [
         "run",
         "--rm",
-        "-it",
+        ...ttyFlags,
+        ...userArgs,
         ...volumes,
-        "-e",
-        "DECOHERE_BUILDER=1",
+        ...envArgs,
         "-w",
         "/workspace",
         BUILDER_IMAGE,
-        "webapi",
-        "-d",
-        "."
+        ...containerArgv
     ], {
         stdio: "inherit"
     });
+    if (result.status === 0 && kind === "scaffold") {
+        console.log(`\n  Scaffold complete!\n\n  Open your project:\n\n    code ${targetDir}\n`);
+    }
     process.exit(result.status ?? 0);
 }
-
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9ob21lL3J1bm5lci93b3JrL2RlY29oZXJlL2RlY29oZXJlL3Byb2plY3RzL2NyZWF0ZS9zcmMvcnVubmVyLnRzIl0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4ZWNGaWxlU3luYywgc3Bhd25TeW5jIH0gZnJvbSBcIm5vZGU6Y2hpbGRfcHJvY2Vzc1wiO1xuaW1wb3J0IHsgbWtkaXJTeW5jIH0gZnJvbSBcIm5vZGU6ZnNcIjtcbmltcG9ydCB7IHJlc29sdmUgfSBmcm9tIFwibm9kZTpwYXRoXCI7XG5pbXBvcnQgeyBDUkVBVEVfVkVSU0lPTiB9IGZyb20gXCIuL3ZlcnNpb24uanNcIjtcblxuY29uc3QgQlVJTERFUl9JTUFHRSA9IGBnaGNyLmlvL2RlY29oZXJlL3NjYWZmb2xkOiR7Q1JFQVRFX1ZFUlNJT059YDtcblxuLyoqXG4gKiBSdW4gdGhlIHNjYWZmb2xkIGluc2lkZSBhIHByZS1idWlsdCBEb2NrZXIgYnVpbGRlciBpbWFnZS5cbiAqXG4gKiBDYWxsZWQgd2hlbiBgREVDT0hFUkVfQlVJTERFUmAgaXMgbm90IHNldCDigJQgaS5lLiB0aGUgQ0xJIGlzIHJ1bm5pbmcgb24gdGhlXG4gKiBob3N0LCBvdXRzaWRlIHRoZSBjb250YWluZXIuIE1vdW50cyB0aGUgdGFyZ2V0IGRpcmVjdG9yeSBhcyBgL3dvcmtzcGFjZWAgc29cbiAqIHRoZSBzY2FmZm9sZGVkIGZpbGVzIGFyZSB3cml0dGVuIGJhY2sgdG8gdGhlIGhvc3QgZmlsZXN5c3RlbS5cbiAqXG4gKiBJZiBgfi8uY29uZmlnL2F1dGgwYCBleGlzdHMgb24gdGhlIGhvc3QgdGhlIGRpcmVjdG9yeSBpcyBhbHNvIG1vdW50ZWQgc29cbiAqIHRoZSBhdXRoMCBDTEkgaW5zaWRlIHRoZSBjb250YWluZXIgY2FuIHJldXNlIGV4aXN0aW5nIGNyZWRlbnRpYWxzIHNpbGVudGx5LlxuICovXG5leHBvcnQgZnVuY3Rpb24gcnVuSW5CdWlsZGVyKG9wdHM6IHsgZD86IHN0cmluZyB9KTogbmV2ZXIge1xuXHRjb25zdCB0YXJnZXREaXIgPSByZXNvbHZlKG9wdHMuZCA/PyBcIi5cIik7XG5cdG1rZGlyU3luYyh0YXJnZXREaXIsIHsgcmVjdXJzaXZlOiB0cnVlIH0pO1xuXG5cdC8vIEVuc3VyZSBEb2NrZXIgaXMgYXZhaWxhYmxlLlxuXHR0cnkge1xuXHRcdGV4ZWNGaWxlU3luYyhcImRvY2tlclwiLCBbXCJpbmZvXCJdLCB7IHN0ZGlvOiBcInBpcGVcIiB9KTtcblx0fSBjYXRjaCB7XG5cdFx0Y29uc29sZS5lcnJvcihcblx0XHRcdFwiXFxuICBEb2NrZXIgaXMgcmVxdWlyZWQgdG8gc2NhZmZvbGQgYSBEZWNvaGVyZSBwcm9qZWN0LlxcblwiICtcblx0XHRcdFx0XCIgIEluc3RhbGwgRG9ja2VyIERlc2t0b3A6IGh0dHBzOi8vd3d3LmRvY2tlci5jb20vcHJvZHVjdHMvZG9ja2VyLWRlc2t0b3BcXG5cIixcblx0XHQpO1xuXHRcdHByb2Nlc3MuZXhpdCgxKTtcblx0fVxuXG5cdGNvbnN0IHZvbHVtZXM6IHN0cmluZ1tdID0gW1wiLXZcIiwgYCR7dGFyZ2V0RGlyfTovd29ya3NwYWNlYF07XG5cblx0Y29uc29sZS5sb2coXCIgIFJ1bm5pbmcgc2NhZmZvbGRpbmcgaW4gYSBzYW5kYm94ZWQgY29udGFpbmVyLi4uXFxuXCIpO1xuXG5cdGNvbnN0IHJlc3VsdCA9IHNwYXduU3luYyhcblx0XHRcImRvY2tlclwiLFxuXHRcdFtcblx0XHRcdFwicnVuXCIsXG5cdFx0XHRcIi0tcm1cIixcblx0XHRcdFwiLWl0XCIsXG5cdFx0XHQuLi52b2x1bWVzLFxuXHRcdFx0XCItZVwiLFxuXHRcdFx0XCJERUNPSEVSRV9CVUlMREVSPTFcIixcblx0XHRcdFwiLXdcIixcblx0XHRcdFwiL3dvcmtzcGFjZVwiLFxuXHRcdFx0QlVJTERFUl9JTUFHRSxcblx0XHRcdFwid2ViYXBpXCIsXG5cdFx0XHRcIi1kXCIsXG5cdFx0XHRcIi5cIixcblx0XHRdLFxuXHRcdHsgc3RkaW86IFwiaW5oZXJpdFwiIH0sXG5cdCk7XG5cblx0cHJvY2Vzcy5leGl0KHJlc3VsdC5zdGF0dXMgPz8gMCk7XG59XG4iXSwibmFtZXMiOlsiZXhlY0ZpbGVTeW5jIiwic3Bhd25TeW5jIiwibWtkaXJTeW5jIiwicmVzb2x2ZSIsIkNSRUFURV9WRVJTSU9OIiwiQlVJTERFUl9JTUFHRSIsInJ1bkluQnVpbGRlciIsIm9wdHMiLCJ0YXJnZXREaXIiLCJkIiwicmVjdXJzaXZlIiwic3RkaW8iLCJjb25zb2xlIiwiZXJyb3IiLCJwcm9jZXNzIiwiZXhpdCIsInZvbHVtZXMiLCJsb2ciLCJyZXN1bHQiLCJzdGF0dXMiXSwibWFwcGluZ3MiOiJBQUFBLFNBQVNBLFlBQVksRUFBRUMsU0FBUyxRQUFRLHFCQUFxQjtBQUM3RCxTQUFTQyxTQUFTLFFBQVEsVUFBVTtBQUNwQyxTQUFTQyxPQUFPLFFBQVEsWUFBWTtBQUNwQyxTQUFTQyxjQUFjLFFBQVEsZUFBZTtBQUU5QyxNQUFNQyxnQkFBZ0IsQ0FBQywwQkFBMEIsRUFBRUQsZ0JBQWdCO0FBRW5FOzs7Ozs7Ozs7Q0FTQyxHQUNELE9BQU8sU0FBU0UsYUFBYUMsSUFBb0I7SUFDaEQsTUFBTUMsWUFBWUwsUUFBUUksS0FBS0UsQ0FBQyxJQUFJO0lBQ3BDUCxVQUFVTSxXQUFXO1FBQUVFLFdBQVc7SUFBSztJQUV2Qyw4QkFBOEI7SUFDOUIsSUFBSTtRQUNIVixhQUFhLFVBQVU7WUFBQztTQUFPLEVBQUU7WUFBRVcsT0FBTztRQUFPO0lBQ2xELEVBQUUsT0FBTTtRQUNQQyxRQUFRQyxLQUFLLENBQ1osNkRBQ0M7UUFFRkMsUUFBUUMsSUFBSSxDQUFDO0lBQ2Q7SUFFQSxNQUFNQyxVQUFvQjtRQUFDO1FBQU0sR0FBR1IsVUFBVSxXQUFXLENBQUM7S0FBQztJQUUzREksUUFBUUssR0FBRyxDQUFDO0lBRVosTUFBTUMsU0FBU2pCLFVBQ2QsVUFDQTtRQUNDO1FBQ0E7UUFDQTtXQUNHZTtRQUNIO1FBQ0E7UUFDQTtRQUNBO1FBQ0FYO1FBQ0E7UUFDQTtRQUNBO0tBQ0EsRUFDRDtRQUFFTSxPQUFPO0lBQVU7SUFHcEJHLFFBQVFDLElBQUksQ0FBQ0csT0FBT0MsTUFBTSxJQUFJO0FBQy9CIn0=

package/es6/src/version.js

@@ -2,21 +2,29 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 const _require = createRequire(import.meta.url);
-function resolveCreateVersion() {
+const DEFAULT_CREATE_VERSION = "0.0.1-dev";
+const DEFAULT_CREATE_IMAGE_REPOSITORY = "ghcr.io/typesmiths/decohere/create";
+function resolveCreateMetadata() {
     let dir = dirname(fileURLToPath(import.meta.url));
     for(let i = 0; i < 5; i++){
         try {
             const pkg = _require(join(dir, "package.json"));
             if (pkg.name === "@decohere/create") {
-                return pkg.version ?? "0.0.1-dev";
+                return {
+                    version: pkg.version ?? DEFAULT_CREATE_VERSION,
+                    imageRepository: pkg.decohere?.dockerImageRepository ?? DEFAULT_CREATE_IMAGE_REPOSITORY
+                };
             }
         } catch  {}
         const parent = dirname(dir);
         if (parent === dir) break;
         dir = parent;
     }
-    return "0.0.1-dev";
+    return {
+        version: DEFAULT_CREATE_VERSION,
+        imageRepository: DEFAULT_CREATE_IMAGE_REPOSITORY
+    };
 }
-/** Version of @decohere/create, used to pin scaffolded @decohere/* dependencies. */ export const CREATE_VERSION = resolveCreateVersion();
-
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9ob21lL3J1bm5lci93b3JrL2RlY29oZXJlL2RlY29oZXJlL3Byb2plY3RzL2NyZWF0ZS9zcmMvdmVyc2lvbi50cyJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBjcmVhdGVSZXF1aXJlIH0gZnJvbSBcIm5vZGU6bW9kdWxlXCI7XG5pbXBvcnQgeyBkaXJuYW1lLCBqb2luIH0gZnJvbSBcIm5vZGU6cGF0aFwiO1xuaW1wb3J0IHsgZmlsZVVSTFRvUGF0aCB9IGZyb20gXCJub2RlOnVybFwiO1xuXG5jb25zdCBfcmVxdWlyZSA9IGNyZWF0ZVJlcXVpcmUoaW1wb3J0Lm1ldGEudXJsKTtcblxuZnVuY3Rpb24gcmVzb2x2ZUNyZWF0ZVZlcnNpb24oKTogc3RyaW5nIHtcblx0bGV0IGRpciA9IGRpcm5hbWUoZmlsZVVSTFRvUGF0aChpbXBvcnQubWV0YS51cmwpKTtcblx0Zm9yIChsZXQgaSA9IDA7IGkgPCA1OyBpKyspIHtcblx0XHR0cnkge1xuXHRcdFx0Y29uc3QgcGtnID0gX3JlcXVpcmUoam9pbihkaXIsIFwicGFja2FnZS5qc29uXCIpKSBhcyB7XG5cdFx0XHRcdG5hbWU/OiBzdHJpbmc7XG5cdFx0XHRcdHZlcnNpb24/OiBzdHJpbmc7XG5cdFx0XHR9O1xuXHRcdFx0aWYgKHBrZy5uYW1lID09PSBcIkBkZWNvaGVyZS9jcmVhdGVcIikge1xuXHRcdFx0XHRyZXR1cm4gcGtnLnZlcnNpb24gPz8gXCIwLjAuMS1kZXZcIjtcblx0XHRcdH1cblx0XHR9IGNhdGNoIHt9XG5cdFx0Y29uc3QgcGFyZW50ID0gZGlybmFtZShkaXIpO1xuXHRcdGlmIChwYXJlbnQgPT09IGRpcikgYnJlYWs7XG5cdFx0ZGlyID0gcGFyZW50O1xuXHR9XG5cdHJldHVybiBcIjAuMC4xLWRldlwiO1xufVxuXG4vKiogVmVyc2lvbiBvZiBAZGVjb2hlcmUvY3JlYXRlLCB1c2VkIHRvIHBpbiBzY2FmZm9sZGVkIEBkZWNvaGVyZS8qIGRlcGVuZGVuY2llcy4gKi9cbmV4cG9ydCBjb25zdCBDUkVBVEVfVkVSU0lPTiA9IHJlc29sdmVDcmVhdGVWZXJzaW9uKCk7XG4iXSwibmFtZXMiOlsiY3JlYXRlUmVxdWlyZSIsImRpcm5hbWUiLCJqb2luIiwiZmlsZVVSTFRvUGF0aCIsIl9yZXF1aXJlIiwidXJsIiwicmVzb2x2ZUNyZWF0ZVZlcnNpb24iLCJkaXIiLCJpIiwicGtnIiwibmFtZSIsInZlcnNpb24iLCJwYXJlbnQiLCJDUkVBVEVfVkVSU0lPTiJdLCJtYXBwaW5ncyI6IkFBQUEsU0FBU0EsYUFBYSxRQUFRLGNBQWM7QUFDNUMsU0FBU0MsT0FBTyxFQUFFQyxJQUFJLFFBQVEsWUFBWTtBQUMxQyxTQUFTQyxhQUFhLFFBQVEsV0FBVztBQUV6QyxNQUFNQyxXQUFXSixjQUFjLFlBQVlLLEdBQUc7QUFFOUMsU0FBU0M7SUFDUixJQUFJQyxNQUFNTixRQUFRRSxjQUFjLFlBQVlFLEdBQUc7SUFDL0MsSUFBSyxJQUFJRyxJQUFJLEdBQUdBLElBQUksR0FBR0EsSUFBSztRQUMzQixJQUFJO1lBQ0gsTUFBTUMsTUFBTUwsU0FBU0YsS0FBS0ssS0FBSztZQUkvQixJQUFJRSxJQUFJQyxJQUFJLEtBQUssb0JBQW9CO2dCQUNwQyxPQUFPRCxJQUFJRSxPQUFPLElBQUk7WUFDdkI7UUFDRCxFQUFFLE9BQU0sQ0FBQztRQUNULE1BQU1DLFNBQVNYLFFBQVFNO1FBQ3ZCLElBQUlLLFdBQVdMLEtBQUs7UUFDcEJBLE1BQU1LO0lBQ1A7SUFDQSxPQUFPO0FBQ1I7QUFFQSxrRkFBa0YsR0FDbEYsT0FBTyxNQUFNQyxpQkFBaUJQLHVCQUF1QiJ9
+const createMetadata = resolveCreateMetadata();
+export const CREATE_VERSION = createMetadata.version;
+export const CREATE_IMAGE_REPOSITORY = createMetadata.imageRepository;

package/pack-builder-tgz.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+/**
+ * Vendor `@decohere/scaffold` for the builder image: resolve `@decohere/*` from
+ * dist/release via `file:` (not `overrides`), `npm install --install-links`,
+ * then tar the installed tree including `node_modules`. `--install-links`
+ * materializes `file:` packages (and their deps) instead of leaving symlinks
+ * whose nested installs live outside the packed directory.
+ */
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * @typedef {{ name: string, dir: string }} WorkspacePackage
+ */
+
+/**
+ * @param {string} rootDir
+ * @returns {WorkspacePackage[]}
+ */
+export function collectWorkspacePackages(rootDir) {
+	/** @type {WorkspacePackage[]} */
+	const found = [];
+	const walk = (dir) => {
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (entry.name === "node_modules" || entry.name === ".git") continue;
+			const path = join(dir, entry.name);
+			if (entry.isDirectory()) {
+				walk(path);
+				continue;
+			}
+			if (entry.name !== "package.json") continue;
+			const pkg = JSON.parse(readFileSync(path, "utf8"));
+			if (typeof pkg.name === "string" && pkg.name.startsWith("@decohere/")) {
+				found.push({ name: pkg.name, dir });
+			}
+		}
+	};
+	walk(rootDir);
+	return found;
+}
+
+/**
+ * @param {string} fromDir
+ * @param {string} pkgDir
+ */
+export function fileSpec(fromDir, pkgDir) {
+	let rel = relative(fromDir, pkgDir) || ".";
+	rel = rel.replaceAll("\\", "/");
+	if (!rel.startsWith(".")) rel = `./${rel}`;
+	return `file:${rel}`;
+}
+
+/**
+ * Rewrite `@decohere/*` dependency specs to local `file:` paths.
+ * Must mutate `dependencies` (not `overrides`) — npm throws EOVERRIDE when an
+ * override conflicts with a direct dependency.
+ *
+ * @param {Record<string, unknown>} pkg
+ * @param {string} fromDir
+ * @param {WorkspacePackage[]} packages
+ */
+export function rewriteDecohereDepsToFile(pkg, fromDir, packages) {
+	const byName = new Map(packages.map((item) => [item.name, item.dir]));
+	const from = resolve(fromDir);
+	const rewrite = (deps) => {
+		if (deps == null || typeof deps !== "object" || Array.isArray(deps)) return deps;
+		const next = { .../** @type {Record<string, unknown>} */ (deps) };
+		for (const name of Object.keys(next)) {
+			const dir = byName.get(name);
+			if (dir == null || resolve(dir) === from) continue;
+			next[name] = fileSpec(fromDir, dir);
+		}
+		return next;
+	};
+	return {
+		...pkg,
+		dependencies: rewrite(pkg.dependencies),
+		optionalDependencies: rewrite(pkg.optionalDependencies),
+	};
+}
+
+function writeJson(path, value) {
+	writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function runNpm(cwd, args) {
+	const result = spawnSync("npm", args, { cwd, encoding: "utf8" });
+	if (result.status !== 0) {
+		throw new Error(
+			`npm ${args.join(" ")} failed (exit ${result.status}):\n${result.stderr}${result.stdout}`,
+		);
+	}
+	return result.stdout.trim();
+}
+
+function packInstalledTree(outDir, dest) {
+	const result = spawnSync(
+		"tar",
+		["--create", "--gzip", "--dereference", "--file", dest, "-C", outDir, "."],
+		{ encoding: "utf8" },
+	);
+	if (result.status !== 0) {
+		throw new Error(`tar failed (exit ${result.status}):\n${result.stderr}${result.stdout}`);
+	}
+}
+
+export function packBuilderTgz(options) {
+	const outDir = resolve(options.outDir);
+	const workspaceOut = resolve(options.workspaceOut);
+	const dest = resolve(options.dest);
+	const packageJsonPath = join(outDir, "package.json");
+	const packages = collectWorkspacePackages(workspaceOut);
+	const originals = packages.map((pkg) => {
+		const path = join(pkg.dir, "package.json");
+		return { path, original: JSON.parse(readFileSync(path, "utf8")) };
+	});
+	const createOriginal = originals.find((entry) => entry.path === packageJsonPath)?.original;
+	if (createOriginal == null) {
+		throw new Error(`No @decohere package.json at ${packageJsonPath}`);
+	}
+
+	try {
+		for (const { path, original } of originals) {
+			writeJson(path, rewriteDecohereDepsToFile(original, dirname(path), packages));
+		}
+		runNpm(outDir, ["install", "--omit=dev", "--ignore-scripts", "--install-links"]);
+	} finally {
+		for (const { path, original } of originals) {
+			writeJson(path, original);
+		}
+	}
+
+	packInstalledTree(outDir, dest);
+	return dest;
+}
+
+function parseArgs(argv) {
+	/** @type {Record<string, string>} */
+	const parsed = {};
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (arg == null || !arg.startsWith("--")) continue;
+		const key = arg.slice(2);
+		const value = argv[i + 1];
+		if (value == null || value.startsWith("--")) {
+			throw new Error(`Missing value for --${key}`);
+		}
+		parsed[key] = value;
+		i++;
+	}
+	return parsed;
+}
+
+function main() {
+	const args = parseArgs(process.argv.slice(2));
+	const outDir = args["out-dir"];
+	const workspaceOut = args["workspace-out"];
+	const dest = args.dest;
+	if (outDir == null || workspaceOut == null || dest == null) {
+		throw new Error(
+			"Usage: pack-builder-tgz.mjs --out-dir <dir> --workspace-out <dir> --dest <create.tgz>",
+		);
+	}
+	packBuilderTgz({ outDir, workspaceOut, dest });
+}
+
+if (process.argv[1] != null && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+	main();
+}

package/package.json

@@ -1,28 +1,40 @@
 {
   "name": "@decohere/create",
-  "version": "0.0.1-dev.20",
-  "description": "Scaffold a new Decohere project — build with Forge, serve with Flux",
+  "version": "0.0.1-dev.20261105.46",
+  "description": "Download the Decohere scaffolder image and run it (npm create @decohere)",
   "keywords": [
     "decohere",
     "create",
     "scaffold",
-    "cli",
-    "forge",
-    "flux",
-    "typescript"
+    "cli"
   ],
+  "homepage": "https://github.com/typesmiths/decohere/tree/main/projects/create#readme",
+  "bugs": {
+    "url": "https://github.com/typesmiths/decohere/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/typesmiths/decohere.git",
+    "directory": "projects/create"
+  },
   "license": "ISC",
   "author": "Typesmiths",
   "type": "module",
+  "exports": {
+    ".": {
+      "types": "./types/src/index.d.ts",
+      "import": "./es6/src/index.js"
+    }
+  },
   "bin": {
     "create-decohere": "./es6/src/cli.js"
   },
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
-  "dependencies": {
-    "@decohere/nexus": "0.0.1-dev.20",
-    "commander": "^13.1.0"
-  },
-  "devDependencies": {}
+  "dependencies": {},
+  "devDependencies": {},
+  "decohere": {
+    "dockerImageRepository": "ghcr.io/typesmiths/decohere/create"
+  }
 }

package/types/src/index.d.ts

@@ -0,0 +1,3 @@
+export type { LaunchKind, LaunchPlan } from "./resolve-launch.js";
+export { containerArgvFromHost, resolveLaunch, toProductArgv } from "./resolve-launch.js";
+export { runInBuilder } from "./runner.js";

package/types/src/resolve-launch.d.ts

@@ -0,0 +1,20 @@
+export type LaunchKind = "scaffold" | "auth0";
+export type LaunchPlan = {
+    targetDir: string;
+    containerArgv: string[];
+    projectName: string;
+    kind: LaunchKind;
+};
+/**
+ * Map host / npm-create argv onto the product CLI (`create webapi` / `add api`).
+ * `npm create @decohere webapi` already says “create”, so we prepend `create`
+ * rather than making users type `create create webapi`.
+ */
+export declare function toProductArgv(tokens: string[]): string[];
+export declare function containerArgvFromHost(argv: string[]): string[];
+/**
+ * Host argv → directory to mount and argv for the in-image `decohere` entrypoint.
+ * Positional `webapi my-app` / `create webapi my-app` wins over `-d` (npm treats `-d`
+ * as its own loglevel).
+ */
+export declare function resolveLaunch(argv: string[], cwd?: string): LaunchPlan;

package/types/src/runner.d.ts

@@ -1,13 +1,5 @@
 /**
- * Run the scaffold inside a pre-built Docker builder image.
- *
- * Called when `DECOHERE_BUILDER` is not set — i.e. the CLI is running on the
- * host, outside the container. Mounts the target directory as `/workspace` so
- * the scaffolded files are written back to the host filesystem.
- *
- * If `~/.config/auth0` exists on the host the directory is also mounted so
- * the auth0 CLI inside the container can reuse existing credentials silently.
+ * Pull/run the Decohere scaffolder image. Host `@decohere/create` does not load
+ * the `@decohere/scaffold` dependency tree — that lives in the image only.
  */
-export declare function runInBuilder(opts: {
-    d?: string;
-}): never;
+export declare function runInBuilder(argv: string[]): never;

package/types/src/version.d.ts

@@ -1,2 +1,2 @@
-/** Version of @decohere/create, used to pin scaffolded @decohere/* dependencies. */
 export declare const CREATE_VERSION: string;
+export declare const CREATE_IMAGE_REPOSITORY: string;

package/commonjs/src/domain/prompt.js

@@ -1,55 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get ask () {
-        return ask;
-    },
-    get pick () {
-        return pick;
-    }
-});
-const _nodereadline = require("node:readline");
-// readline/promises rl.question() has a race condition with piped (non-TTY) stdin
-// in Node ≥ 22: after the first line is read, stdin emits 'end', readline closes,
-// and all subsequent question() calls resolve to "".
-// Fix: use the async-iterator API, which buffers all lines before the close event fires.
-let _lines = null;
-function getLines() {
-    if (_lines == null) {
-        const rl = (0, _nodereadline.createInterface)({
-            input: process.stdin,
-            terminal: false
-        });
-        _lines = rl[Symbol.asyncIterator]();
-    }
-    return _lines;
-}
-async function readLine(prompt) {
-    process.stdout.write(prompt);
-    const { value, done } = await getLines().next();
-    return done ? "" : value.trim();
-}
-async function ask(question, fallback = "") {
-    const answer = await readLine(question);
-    return answer || fallback;
-}
-async function pick(label, items, display) {
-    console.log(label.trimEnd());
-    for (const [i, item] of items.entries()){
-        console.log(`    ${i + 1}. ${display(item)}`);
-    }
-    const answer = await readLine("  > ");
-    const idx = Number.parseInt(answer, 10);
-    if (Number.isNaN(idx) || idx < 1 || idx > items.length) return null;
-    return items[idx - 1];
-}
-
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9ob21lL3J1bm5lci93b3JrL2RlY29oZXJlL2RlY29oZXJlL3Byb2plY3RzL2NyZWF0ZS9zcmMvZG9tYWluL3Byb21wdC50cyJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBjcmVhdGVJbnRlcmZhY2UgfSBmcm9tIFwibm9kZTpyZWFkbGluZVwiO1xuXG4vLyByZWFkbGluZS9wcm9taXNlcyBybC5xdWVzdGlvbigpIGhhcyBhIHJhY2UgY29uZGl0aW9uIHdpdGggcGlwZWQgKG5vbi1UVFkpIHN0ZGluXG4vLyBpbiBOb2RlIOKJpSAyMjogYWZ0ZXIgdGhlIGZpcnN0IGxpbmUgaXMgcmVhZCwgc3RkaW4gZW1pdHMgJ2VuZCcsIHJlYWRsaW5lIGNsb3Nlcyxcbi8vIGFuZCBhbGwgc3Vic2VxdWVudCBxdWVzdGlvbigpIGNhbGxzIHJlc29sdmUgdG8gXCJcIi5cbi8vIEZpeDogdXNlIHRoZSBhc3luYy1pdGVyYXRvciBBUEksIHdoaWNoIGJ1ZmZlcnMgYWxsIGxpbmVzIGJlZm9yZSB0aGUgY2xvc2UgZXZlbnQgZmlyZXMuXG5cbmxldCBfbGluZXM6IEFzeW5jSXRlcmF0b3I8c3RyaW5nPiB8IG51bGwgPSBudWxsO1xuXG5mdW5jdGlvbiBnZXRMaW5lcygpOiBBc3luY0l0ZXJhdG9yPHN0cmluZz4ge1xuXHRpZiAoX2xpbmVzID09IG51bGwpIHtcblx0XHRjb25zdCBybCA9IGNyZWF0ZUludGVyZmFjZSh7IGlucHV0OiBwcm9jZXNzLnN0ZGluLCB0ZXJtaW5hbDogZmFsc2UgfSk7XG5cdFx0X2xpbmVzID0gcmxbU3ltYm9sLmFzeW5jSXRlcmF0b3JdKCk7XG5cdH1cblx0cmV0dXJuIF9saW5lcztcbn1cblxuYXN5bmMgZnVuY3Rpb24gcmVhZExpbmUocHJvbXB0OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuXHRwcm9jZXNzLnN0ZG91dC53cml0ZShwcm9tcHQpO1xuXHRjb25zdCB7IHZhbHVlLCBkb25lIH0gPSBhd2FpdCBnZXRMaW5lcygpLm5leHQoKTtcblx0cmV0dXJuIGRvbmUgPyBcIlwiIDogdmFsdWUudHJpbSgpO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYXNrKHF1ZXN0aW9uOiBzdHJpbmcsIGZhbGxiYWNrID0gXCJcIik6IFByb21pc2U8c3RyaW5nPiB7XG5cdGNvbnN0IGFuc3dlciA9IGF3YWl0IHJlYWRMaW5lKHF1ZXN0aW9uKTtcblx0cmV0dXJuIGFuc3dlciB8fCBmYWxsYmFjaztcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHBpY2s8VD4oXG5cdGxhYmVsOiBzdHJpbmcsXG5cdGl0ZW1zOiBUW10sXG5cdGRpc3BsYXk6IChpdGVtOiBUKSA9PiBzdHJpbmcsXG4pOiBQcm9taXNlPFQgfCBudWxsPiB7XG5cdGNvbnNvbGUubG9nKGxhYmVsLnRyaW1FbmQoKSk7XG5cdGZvciAoY29uc3QgW2ksIGl0ZW1dIG9mIGl0ZW1zLmVudHJpZXMoKSkge1xuXHRcdGNvbnNvbGUubG9nKGAgICAgJHtpICsgMX0uICR7ZGlzcGxheShpdGVtKX1gKTtcblx0fVxuXHRjb25zdCBhbnN3ZXIgPSBhd2FpdCByZWFkTGluZShcIiAgPiBcIik7XG5cdGNvbnN0IGlkeCA9IE51bWJlci5wYXJzZUludChhbnN3ZXIsIDEwKTtcblx0aWYgKE51bWJlci5pc05hTihpZHgpIHx8IGlkeCA8IDEgfHwgaWR4ID4gaXRlbXMubGVuZ3RoKSByZXR1cm4gbnVsbDtcblx0cmV0dXJuIGl0ZW1zW2lkeCAtIDFdO1xufVxuIl0sIm5hbWVzIjpbImFzayIsInBpY2siLCJfbGluZXMiLCJnZXRMaW5lcyIsInJsIiwiY3JlYXRlSW50ZXJmYWNlIiwiaW5wdXQiLCJwcm9jZXNzIiwic3RkaW4iLCJ0ZXJtaW5hbCIsIlN5bWJvbCIsImFzeW5jSXRlcmF0b3IiLCJyZWFkTGluZSIsInByb21wdCIsInN0ZG91dCIsIndyaXRlIiwidmFsdWUiLCJkb25lIiwibmV4dCIsInRyaW0iLCJxdWVzdGlvbiIsImZhbGxiYWNrIiwiYW5zd2VyIiwibGFiZWwiLCJpdGVtcyIsImRpc3BsYXkiLCJjb25zb2xlIiwibG9nIiwidHJpbUVuZCIsImkiLCJpdGVtIiwiZW50cmllcyIsImlkeCIsIk51bWJlciIsInBhcnNlSW50IiwiaXNOYU4iLCJsZW5ndGgiXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7O1FBdUJzQkE7ZUFBQUE7O1FBS0FDO2VBQUFBOzs7OEJBNUJVO0FBRWhDLGtGQUFrRjtBQUNsRixrRkFBa0Y7QUFDbEYscURBQXFEO0FBQ3JELHlGQUF5RjtBQUV6RixJQUFJQyxTQUF1QztBQUUzQyxTQUFTQztJQUNSLElBQUlELFVBQVUsTUFBTTtRQUNuQixNQUFNRSxLQUFLQyxJQUFBQSw2QkFBZSxFQUFDO1lBQUVDLE9BQU9DLFFBQVFDLEtBQUs7WUFBRUMsVUFBVTtRQUFNO1FBQ25FUCxTQUFTRSxFQUFFLENBQUNNLE9BQU9DLGFBQWEsQ0FBQztJQUNsQztJQUNBLE9BQU9UO0FBQ1I7QUFFQSxlQUFlVSxTQUFTQyxNQUFjO0lBQ3JDTixRQUFRTyxNQUFNLENBQUNDLEtBQUssQ0FBQ0Y7SUFDckIsTUFBTSxFQUFFRyxLQUFLLEVBQUVDLElBQUksRUFBRSxHQUFHLE1BQU1kLFdBQVdlLElBQUk7SUFDN0MsT0FBT0QsT0FBTyxLQUFLRCxNQUFNRyxJQUFJO0FBQzlCO0FBRU8sZUFBZW5CLElBQUlvQixRQUFnQixFQUFFQyxXQUFXLEVBQUU7SUFDeEQsTUFBTUMsU0FBUyxNQUFNVixTQUFTUTtJQUM5QixPQUFPRSxVQUFVRDtBQUNsQjtBQUVPLGVBQWVwQixLQUNyQnNCLEtBQWEsRUFDYkMsS0FBVSxFQUNWQyxPQUE0QjtJQUU1QkMsUUFBUUMsR0FBRyxDQUFDSixNQUFNSyxPQUFPO0lBQ3pCLEtBQUssTUFBTSxDQUFDQyxHQUFHQyxLQUFLLElBQUlOLE1BQU1PLE9BQU8sR0FBSTtRQUN4Q0wsUUFBUUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFRSxJQUFJLEVBQUUsRUFBRSxFQUFFSixRQUFRSyxPQUFPO0lBQzdDO0lBQ0EsTUFBTVIsU0FBUyxNQUFNVixTQUFTO0lBQzlCLE1BQU1vQixNQUFNQyxPQUFPQyxRQUFRLENBQUNaLFFBQVE7SUFDcEMsSUFBSVcsT0FBT0UsS0FBSyxDQUFDSCxRQUFRQSxNQUFNLEtBQUtBLE1BQU1SLE1BQU1ZLE1BQU0sRUFBRSxPQUFPO0lBQy9ELE9BQU9aLEtBQUssQ0FBQ1EsTUFBTSxFQUFFO0FBQ3RCIn0=