@o3co/create-auth-policy-verifier 0.3.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 1o1 Co. Ltd.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.ja.md

@@ -0,0 +1,94 @@
+# @o3co/create-auth-policy-verifier
+
+auth.policy-verifier 用の CLI スキャフォルダーです。組み込みテンプレートから新しいスタンドアロンサーバープロジェクトを生成します。
+
+## 使い方
+
+```sh
+npx @o3co/create-auth-policy-verifier <project-name> [--dir <dir-name>]
+```
+
+`<project-name>` はスコープ付き npm 名 (`@scope/pkg`) とスコープなしの名前 (`pkg`) のどちらでも指定できます。
+
+スコープなしの例:
+
+```sh
+npx @o3co/create-auth-policy-verifier my-verifier
+cd my-verifier
+npm install
+npm run debug
+```
+
+スコープ付きの例（ディレクトリ名はパッケージ部分がデフォルト）:
+
+```sh
+npx @o3co/create-auth-policy-verifier @my-org/auth.policy-verifier
+cd auth.policy-verifier
+npm install
+npm run debug
+```
+
+`--dir` でディレクトリ名を明示指定:
+
+```sh
+npx @o3co/create-auth-policy-verifier @my-org/auth.policy-verifier --dir verifier
+cd verifier
+```
+
+## 処理内容
+
+1. `<project-name>` を検証する（バリデーションルール参照）。
+2. 生成先ディレクトリ名を決定する: `--dir <value>` が指定されていればその値、そうでなければスコープ付き名のパッケージ部分、最終的には入力値そのもの。
+3. 生成先ディレクトリがすでに存在する場合はエラーを出力して終了する。
+4. `templates/standalone/` を生成先ディレクトリにコピーする（`node_modules/` と `dist/` は除外）。
+5. `package.json` を書き換える: `name` を `<project-name>` をそのまま設定し（スコープを保持）、`private` を削除し、`workspace:*` のバージョン参照を `templates/versions.json` の公開 semver バージョンに置き換える。
+6. 次のステップの手順を表示する。
+
+## バリデーションルール
+
+`<project-name>` は以下のいずれかに一致する必要があります:
+
+- スコープなし: `^[a-z0-9][a-z0-9-._~]*$`
+- スコープ付き: `^@[a-z0-9][a-z0-9-._~]*/[a-z0-9][a-z0-9-._~]*$`
+
+いずれも空文字・`.`・`..` は不可、最大 214 文字。
+
+`--dir <value>` はスコープなしのパターンと同じ制約です。
+
+## 既知の制約
+
+内包されているテンプレートの `README.md` / `README.ja.md` の見出しは `@o3co/auth-policy-verifier-standalone` のままです。スコープ付きでプロジェクトを生成した場合、この見出しは生成された `package.json` の `name` と一致しません。必要に応じて手動で修正してください。
+
+## 生成される構造
+
+```
+<project-name>/
+├── config/
+│   └── application.conf    # HOCON 設定ファイル（環境変数で上書き可）
+├── src/
+│   └── main.mts            # コンポジションルート — 設定を読み込みサーバーを起動する
+├── Dockerfile
+├── Makefile
+├── docker-compose.yml
+├── docker-compose.test.yml
+├── package.json
+└── tsconfig.json
+```
+
+## プログラム API
+
+スキャフォルダーは内部実装をエクスポートしており、プログラムから利用できます。
+
+```ts
+import { scaffold, main } from "@o3co/create-auth-policy-verifier";
+```
+
+| エクスポート | シグネチャ | 説明 |
+|---|---|---|
+| `scaffold` | `(targetDir: string, projectName: string): void` | テンプレートをコピーして `package.json` を書き換える |
+| `main` | `(): void` | CLI エントリポイント — `process.argv` を解析して `scaffold` を呼び出す |
+
+## 関連
+
+- [`@o3co/auth-policy-verifier-standalone`](../templates/standalone) — このツールが生成するテンプレート
+- [`@o3co/auth.policy-verifier.server`](../packages/server) — 生成されたプロジェクトが使用する Express アプリファクトリ

package/README.md

@@ -0,0 +1,94 @@
+# @o3co/create-auth-policy-verifier
+
+CLI scaffolder for auth.policy-verifier. Generates a new standalone server project from the built-in template.
+
+## Usage
+
+```sh
+npx @o3co/create-auth-policy-verifier <project-name> [--dir <dir-name>]
+```
+
+`<project-name>` may be either a scoped npm name (`@scope/pkg`) or an unscoped name (`pkg`).
+
+Unscoped example:
+
+```sh
+npx @o3co/create-auth-policy-verifier my-verifier
+cd my-verifier
+npm install
+npm run debug
+```
+
+Scoped example (directory defaults to the package portion):
+
+```sh
+npx @o3co/create-auth-policy-verifier @my-org/auth.policy-verifier
+cd auth.policy-verifier
+npm install
+npm run debug
+```
+
+Override the directory name with `--dir`:
+
+```sh
+npx @o3co/create-auth-policy-verifier @my-org/auth.policy-verifier --dir verifier
+cd verifier
+```
+
+## What It Does
+
+1. Validates `<project-name>` (see Validation Rules).
+2. Derives the target directory name: `--dir <value>` if given, else the unscoped part of a scoped name, else the name itself.
+3. Aborts with an error if the target directory already exists.
+4. Copies `templates/standalone/` to the target directory, excluding `node_modules/` and `dist/`.
+5. Rewrites `package.json`: sets `name` to `<project-name>` verbatim (scope-preserving), removes `private`, and replaces `workspace:*` dependency versions with published semver versions from `templates/versions.json`.
+6. Prints next-step instructions.
+
+## Validation Rules
+
+`<project-name>` must match one of:
+
+- Unscoped: `^[a-z0-9][a-z0-9-._~]*$`
+- Scoped: `^@[a-z0-9][a-z0-9-._~]*/[a-z0-9][a-z0-9-._~]*$`
+
+Both forms must be non-empty, not `.` or `..`, and ≤ 214 characters.
+
+`--dir <value>` must match the unscoped pattern above (same constraints).
+
+## Known Limitations
+
+The bundled template's `README.md` / `README.ja.md` still carry the upstream title `@o3co/auth-policy-verifier-standalone`. When generating a scoped project, that title will not match your `package.json` name; edit it manually if it matters for your use case.
+
+## Generated Structure
+
+```
+<project-name>/
+├── config/
+│   └── application.conf    # HOCON config (env var overrides)
+├── src/
+│   └── main.mts            # Composition root — loads config and starts server
+├── Dockerfile
+├── Makefile
+├── docker-compose.yml
+├── docker-compose.test.yml
+├── package.json
+└── tsconfig.json
+```
+
+## Programmatic API
+
+The scaffolder also exports its internals for programmatic use:
+
+```ts
+import { scaffold, main } from "@o3co/create-auth-policy-verifier";
+```
+
+| Export | Signature | Description |
+|---|---|---|
+| `scaffold` | `(targetDir: string, projectName: string): void` | Copies the template and rewrites `package.json` |
+| `main` | `(): void` | CLI entry point — parses `process.argv` and calls `scaffold` |
+
+## See Also
+
+- [`@o3co/auth-policy-verifier-standalone`](../templates/standalone) — the template that this tool generates
+- [`@o3co/auth.policy-verifier.server`](../packages/server) — Express app factory used by the generated project

package/dist/__tests__/index.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.mts.map

package/dist/__tests__/index.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.mts","sourceRoot":"","sources":["../../src/__tests__/index.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/index.test.mjs

@@ -0,0 +1,213 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { isValidDirName, isValidProjectName, main, scaffold } from "../index.mjs";
+describe("scaffold", () => {
+    let tempDir;
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "create-policy-verifier-test-"));
+    });
+    afterEach(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it("copies template files to target directory", () => {
+        const targetDir = join(tempDir, "verifier");
+        scaffold(targetDir, "verifier");
+        expect(existsSync(join(targetDir, "package.json"))).toBe(true);
+        expect(existsSync(join(targetDir, "tsconfig.json"))).toBe(true);
+        expect(existsSync(join(targetDir, "src", "main.mts"))).toBe(true);
+        expect(existsSync(join(targetDir, "config", "application.conf"))).toBe(true);
+    });
+    it("rewrites package.json name to project name", () => {
+        const targetDir = join(tempDir, "verifier");
+        scaffold(targetDir, "verifier");
+        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
+        expect(pkg.name).toBe("verifier");
+    });
+    it("replaces all workspace:* dependencies with caret versions", () => {
+        const targetDir = join(tempDir, "verifier");
+        scaffold(targetDir, "verifier");
+        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
+        for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+            const deps = pkg[section];
+            if (!deps)
+                continue;
+            for (const [name, version] of Object.entries(deps)) {
+                expect(version, `${section}.${name} should not be workspace:*`).not.toBe("workspace:*");
+            }
+        }
+    });
+    it("removes private field from package.json", () => {
+        const targetDir = join(tempDir, "verifier");
+        scaffold(targetDir, "verifier");
+        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
+        expect(pkg.private).toBeUndefined();
+    });
+    it("writes scoped project name verbatim into package.json", () => {
+        const targetDir = join(tempDir, "auth.policy-verifier");
+        scaffold(targetDir, "@piratis-blossoms/auth.policy-verifier");
+        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
+        expect(pkg.name).toBe("@piratis-blossoms/auth.policy-verifier");
+    });
+});
+describe("isValidProjectName", () => {
+    it.each([
+        ["my-verifier"],
+        ["auth.policy-verifier"],
+        ["a"],
+        ["foo_bar~baz.1"],
+        ["@piratis-blossoms/auth.policy-verifier"],
+        ["@foo-bar/baz_qux~1"],
+    ])("accepts %s", (name) => {
+        expect(isValidProjectName(name)).toBe(true);
+    });
+    it.each([
+        [""],
+        ["."],
+        [".."],
+        ["UPPER"],
+        ["with space"],
+        ["with/slash"],
+        ["with\\back"],
+        ["@"],
+        ["@/"],
+        ["@scope"],
+        ["@/pkg"],
+        ["@scope/"],
+        ["@scope//pkg"],
+        ["@SCOPE/pkg"],
+        ["a".repeat(215)],
+    ])("rejects %s", (name) => {
+        expect(isValidProjectName(name)).toBe(false);
+    });
+});
+describe("isValidDirName", () => {
+    it.each([
+        ["my-verifier"],
+        ["auth.policy-verifier"],
+        ["a"],
+        ["foo_bar~baz.1"],
+    ])("accepts %s", (name) => {
+        expect(isValidDirName(name)).toBe(true);
+    });
+    it.each([
+        [""],
+        ["."],
+        [".."],
+        ["@scope/pkg"],
+        ["with/slash"],
+        ["with\\back"],
+        ["@piratis-blossoms"],
+        ["UPPER"],
+        ["a".repeat(215)],
+    ])("rejects %s", (name) => {
+        expect(isValidDirName(name)).toBe(false);
+    });
+});
+describe("main (argv parsing and directory derivation)", () => {
+    let cwdBackup;
+    let workdir;
+    let argvBackup;
+    beforeEach(() => {
+        cwdBackup = process.cwd();
+        workdir = mkdtempSync(join(tmpdir(), "create-policy-verifier-main-"));
+        process.chdir(workdir);
+        argvBackup = process.argv;
+    });
+    afterEach(() => {
+        process.chdir(cwdBackup);
+        process.argv = argvBackup;
+        rmSync(workdir, { recursive: true, force: true });
+    });
+    const runMain = (args) => {
+        process.argv = ["node", "cli", ...args];
+        const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code) => {
+            throw new Error(`__exit__:${code ?? 0}`);
+        }));
+        const errSpy = vi.spyOn(console, "error").mockImplementation(() => { });
+        const logSpy = vi.spyOn(console, "log").mockImplementation(() => { });
+        let exitCode = 0;
+        try {
+            main();
+        }
+        catch (e) {
+            const m = /__exit__:(\d+)/.exec(e.message);
+            exitCode = m ? Number(m[1]) : null;
+        }
+        const stderr = errSpy.mock.calls.map((c) => c.join(" ")).join("\n");
+        exitSpy.mockRestore();
+        errSpy.mockRestore();
+        logSpy.mockRestore();
+        return { exitCode, stderr };
+    };
+    it("unscoped name: dir = name, pkg.name = name", () => {
+        const r = runMain(["my-verifier"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "my-verifier", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("my-verifier");
+    });
+    it("scoped name: dir = pkg part, pkg.name = full scoped", () => {
+        const r = runMain(["@piratis-blossoms/auth.policy-verifier"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "auth.policy-verifier", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("@piratis-blossoms/auth.policy-verifier");
+    });
+    it("scoped name with --dir <val>: dir = val, pkg.name = full scoped", () => {
+        const r = runMain(["@piratis-blossoms/auth.policy-verifier", "--dir", "verifier"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "verifier", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("@piratis-blossoms/auth.policy-verifier");
+    });
+    it("scoped name with --dir=<val>: dir = val, pkg.name = full scoped", () => {
+        const r = runMain(["@piratis-blossoms/auth.policy-verifier", "--dir=verifier2"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "verifier2", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("@piratis-blossoms/auth.policy-verifier");
+    });
+    it("unscoped name with --dir <val>: dir = val, pkg.name = unscoped", () => {
+        const r = runMain(["my-verifier", "--dir", "custom"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "custom", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("my-verifier");
+    });
+    it("flags before positional: --dir custom my-verifier", () => {
+        const r = runMain(["--dir", "custom", "my-verifier"]);
+        expect(r.exitCode).toBe(0);
+        const pkg = JSON.parse(readFileSync(join(workdir, "custom", "package.json"), "utf-8"));
+        expect(pkg.name).toBe("my-verifier");
+    });
+    it.each([
+        { case: "no args", args: [] },
+        { case: "two positionals", args: ["foo", "bar"] },
+        { case: "dot", args: ["."] },
+        { case: "dotdot", args: [".."] },
+        { case: "backslash in name", args: ["back\\slash"] },
+        { case: "empty scope", args: ["@/pkg"] },
+        { case: "empty pkg", args: ["@scope/"] },
+        { case: "double slash", args: ["@scope//pkg"] },
+        { case: "name too long", args: ["a".repeat(215)] },
+        { case: "--dir invalid (dot)", args: ["foo", "--dir", "."] },
+        { case: "--dir invalid (slash)", args: ["foo", "--dir", "a/b"] },
+        { case: "--dir invalid (at)", args: ["foo", "--dir", "@foo"] },
+        { case: "--dir invalid (back)", args: ["foo", "--dir", "a\\b"] },
+        { case: "--dir empty space form", args: ["foo", "--dir", ""] },
+        { case: "--dir empty equals form", args: ["foo", "--dir="] },
+        { case: "--dir missing value", args: ["foo", "--dir"] },
+        { case: "--dir duplicated", args: ["foo", "--dir", "a", "--dir", "b"] },
+        { case: "unknown flag", args: ["foo", "--unknown"] },
+        { case: "literal double-dash", args: ["foo", "--"] },
+    ])("rejects: $case", ({ args }) => {
+        const r = runMain(args);
+        expect(r.exitCode).toBe(1);
+        expect(r.stderr.length).toBeGreaterThan(0);
+    });
+    it("target directory already exists", () => {
+        mkdirSync(join(workdir, "foo"));
+        const r = runMain(["foo"]);
+        expect(r.exitCode).toBe(1);
+        expect(r.stderr.length).toBeGreaterThan(0);
+    });
+});

package/dist/cli.d.mts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.mts.map

package/dist/cli.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.mts","sourceRoot":"","sources":["../src/cli.mts"],"names":[],"mappings":""}

package/dist/cli.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { main } from "./index.mjs";
+main();

package/dist/index.d.mts

@@ -0,0 +1,18 @@
+export declare const isValidProjectName: (name: string) => boolean;
+export declare const isValidDirName: (name: string) => boolean;
+/**
+ * Copies the bundled standalone template into `targetDir`, rewrites
+ * `package.json` with the new `projectName`, and replaces every `workspace:*`
+ * dependency with the concrete published version from `versions.json`.
+ *
+ * Throws if the template directory is missing (unprebuilt) or if any
+ * workspace dependency is not pinned in `versions.json`.
+ */
+export declare const scaffold: (targetDir: string, projectName: string) => void;
+/**
+ * CLI entry point: parses argv, validates project name and optional --dir flag,
+ * ensures the target directory does not exist, and scaffolds the template.
+ * Exits with non-zero on any validation failure.
+ */
+export declare const main: () => void;
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,OAIjD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAI7C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAI,WAAW,MAAM,EAAE,aAAa,MAAM,KAAG,IA0CjE,CAAC;AAqDF;;;;GAIG;AACH,eAAO,MAAM,IAAI,QAAO,IA4CvB,CAAC"}