create-geonosis 1.3.0 → 2.0.0

package/README.md

@@ -68,6 +68,36 @@ verify. It is done by hand because neither package manager can do it: pnpm resol
 and bun refuses both `link:` and `file:` here, because it follows into the target and tries to
 resolve the `workspace:*` specifiers the kit's own packages use.
 
+## `--check` — what an existing repo never received
+
+```bash
+npx create-geonosis . --check --runtime pnpm --backend medusa --ui tiered-shadcn
+```
+
+A repo is scaffolded once and the scaffold keeps learning, so the divergence is permanent and
+one-way. `--check` closes the loop in the only direction that is safe: it says what is missing and
+**writes nothing** — no file created, no file opened for writing, no `writeScaffold` on the path at
+all. Exit 0 when nothing drifted, 1 with a line per drift.
+
+Two things are compared and two are deliberately not:
+
+- **a file the scaffold writes that the repo has never had** — drift;
+- **a key inside a JSON file the repo does have** — drift, named as `file → a.b.c`;
+- a file's **contents** — never. A repo that has been worked in has rewritten them and was entitled to;
+- a **value** — never. `doctor.corpus` pointing somewhere else is that repo's answer, not a drift.
+
+**The workspaces are out of the question.** `packages/core/src/money.ts` is a sample that makes a
+new repo compile, not a shape a repo must hold. Measured over dielime: including them turned 24 real
+findings into 52, thirty of which were about a `packages/ui` that repo does not have.
+
+Over dielime — a repo scaffolded before D-054 moved the law — it reads 24, among them `LAW.md`,
+`geonosis.json → law.file`, three architecture rules the plugin has since added, and
+`gate-baseline.json`. `proofs/024-W31a-create-check/` has the whole run and the before/after hash.
+
+A JSON file the repo has that is not plain JSON — dielime's `tsconfig.json` carries `//` comments,
+legal JSONC — is reported rather than skipped. A check that could not read a file has not passed
+over it.
+
 ## Proven, not claimed
 
 A repo scaffolded on **both** runtimes passes its own `geonosis-verify full` in a temp directory —

package/dist/{chunk-3FX4T27X.js → chunk-PRX7MKFZ.js}

@@ -1,3 +1,116 @@
+// src/composition.ts
+var PLATFORM_FILE = "src/platform.ts";
+var SEARCH = {
+  at: "domains/search",
+  built: [
+    "      search: pgFtsSearchIndex({",
+    "        executor: tx,",
+    "        nowMs: definitions.nowMs,",
+    "        projections: SEARCH_PROJECTIONS,",
+    "      }),"
+  ],
+  declarations: [
+    "/** How each kind this repo indexes becomes searchable text \u2014 declared once, never per call. */",
+    "const SEARCH_PROJECTIONS: SearchProjections<'note'> = {",
+    "  note: {",
+    "    body: (fields) => fields.notes ?? '',",
+    "    title: (fields) => fields.heading ?? '',",
+    "  },",
+    "}"
+  ],
+  field: "search",
+  fieldType: "SearchIndex<'note'>",
+  imports: [
+    "import { pgFtsSearchIndex, type SearchIndex, type SearchProjections } from '@geonosis/search'"
+  ],
+  name: "@geonosis/search",
+  version: "0.1.1"
+};
+var DOMAINS = [SEARCH];
+var DOMAIN_NAMES = DOMAINS.map((one) => one.field);
+var FOUNDATIONS = [
+  { at: "foundations/db", name: "@geonosis/db", version: "0.2.0" },
+  { at: "foundations/events", name: "@geonosis/events", version: "1.5.0" }
+];
+var domainsNamed = (named) => named.map((one) => {
+  const found = DOMAINS.find((domain) => domain.field === one);
+  if (found === void 0) {
+    throw new Error(
+      `--domains "${one}" is not a domain this kit ships \u2014 it ships ${DOMAIN_NAMES.join(", ")}. A domain nothing publishes cannot be composed, and a scaffold that wrote the import anyway would leave a repo that does not install.`
+    );
+  }
+  return found;
+});
+var floorDependencies = (named) => named.length === 0 ? {} : Object.fromEntries(
+  [...FOUNDATIONS, ...domainsNamed(named)].map((one) => [one.name, `^${one.version}`]).toSorted(([a], [b]) => String(a).localeCompare(String(b)))
+);
+var floorDirectories = (named) => named.length === 0 ? [] : [...FOUNDATIONS, ...domainsNamed(named)].map((one) => one.at);
+var platformSource = (named) => {
+  const domains = domainsNamed(named);
+  return [
+    "import { createSessionSeam, type Executor, type SessionSeam } from '@geonosis/db'",
+    "import { createEmitDoor, type EmitDoor, type Extensions } from '@geonosis/events'",
+    ...domains.flatMap((one) => one.imports),
+    "",
+    "/** Every name a foundation cannot pick for this repo, answered here and only here. */",
+    "export type PlatformConfig = {",
+    "  newId: () => string",
+    "  nowMs: () => number",
+    "  /** What maintenance sets to see every tenant, through a lever no request path reaches. */",
+    "  opsSetting: string",
+    "  /** The producer every envelope names (D-057) \u2014 spelled here, never at an emit call. */",
+    "  source: string",
+    "  /** What a transaction sets to name its tenant, and what the RLS policies read. */",
+    "  tenantSetting: string",
+    "}",
+    "",
+    "export type Definitions = {",
+    "  emit: EmitDoor<Extensions>",
+    "  nowMs: () => number",
+    "  session: SessionSeam",
+    "}",
+    "",
+    "/** Once per isolate: what this platform is, before anybody has asked it anything. */",
+    "export const definitionsOf = (config: PlatformConfig): Definitions => ({",
+    "  emit: createEmitDoor({",
+    "    extensions: [],",
+    "    newId: config.newId,",
+    "    now: config.nowMs,",
+    "    source: config.source,",
+    "  }),",
+    "  nowMs: config.nowMs,",
+    "  session: createSessionSeam({",
+    "    settings: { opsSetting: config.opsSetting, tenantSetting: config.tenantSetting },",
+    "  }),",
+    "})",
+    "",
+    ...domains.flatMap((one) => [...one.declarations, ""]),
+    "/** Who is asking, and the connection they may ask on. */",
+    "export type Caller = { connection: Executor; tenantId: string }",
+    "",
+    "/** Every domain this repo composed, built for one caller. */",
+    "export type Scope = {",
+    ...domains.map((one) => `  ${one.field}: ${one.fieldType}`),
+    "}",
+    "",
+    "/**",
+    " * Per request. The tenant session opens FIRST and the stores are built inside it, so a store",
+    " * that could run outside the transaction that named its tenant does not exist to be held.",
+    " */",
+    "export const inScope = async <Result>(",
+    "  definitions: Definitions,",
+    "  caller: Caller,",
+    "  run: (scope: Scope) => Promise<Result>,",
+    "): Promise<Result> =>",
+    "  definitions.session.inTenant(caller.connection, caller.tenantId, async (tx) =>",
+    "    run({",
+    ...domains.flatMap((one) => [...one.built]),
+    "    }),",
+    "  )",
+    ""
+  ].join("\n");
+};
+
 // src/answers.ts
 import { basename, resolve } from "path";
 var RUNTIMES = ["bun", "pnpm"];
@@ -6,13 +119,14 @@ var UIS = ["atoms-only", "none", "tiered-shadcn"];
 var VALUED = /* @__PURE__ */ new Set([
   "--backend",
   "--brand",
+  "--domains",
   "--kit",
   "--marketplace",
   "--runtime",
   "--themekit",
   "--ui"
 ]);
-var SWITCHES = /* @__PURE__ */ new Set(["--help", "-h", "--no-install"]);
+var SWITCHES = /* @__PURE__ */ new Set(["--check", "--help", "-h", "--no-install"]);
 var read = (argv) => {
   const flags = {};
   let dir;
@@ -53,16 +167,23 @@ var choose = (flag, given, allowed) => {
   return given;
 };
 var scopeOf = (name) => `@${name.toLowerCase().replaceAll(/[^a-z0-9-]/g, "-")}`;
+var domainsFrom = (given) => {
+  const named = (given ?? "").split(",").map((one) => one.trim()).filter((one) => one !== "");
+  domainsNamed(named);
+  return named;
+};
 var parseAnswers = (argv, cwd) => {
   const { dir, flags } = read(argv);
   if (dir === void 0) {
     throw new Error("create-geonosis needs a directory to write the repo into");
   }
   const name = basename(resolve(cwd, dir));
+  const domains = domainsFrom(flags["--domains"]);
   return {
     backend: choose("--backend", flags["--backend"], BACKENDS),
     ...flags["--brand"] === void 0 ? {} : { brand: flags["--brand"] },
     dir: resolve(cwd, dir),
+    domains,
     ...flags["--kit"] === void 0 ? {} : { kit: resolve(cwd, flags["--kit"]) },
     ...flags["--marketplace"] === void 0 ? {} : { marketplace: flags["--marketplace"] },
     name,
@@ -263,15 +384,20 @@ var workspacesOf = (answers) => {
     dir: "apps/web",
     mayDependOn: list.map((one) => one.tag),
     name: `${scope}/web`,
-    sources: { "src/boot.ts": APP(scope, ui !== "none"), "src/boot.test.ts": APP_TEST },
+    packages: floorDependencies(answers.domains),
+    sources: {
+      "src/boot.ts": APP(scope, ui !== "none"),
+      "src/boot.test.ts": APP_TEST,
+      ...answers.domains.length === 0 ? {} : { [PLATFORM_FILE]: platformSource(answers.domains) }
+    },
     tag: "app"
   });
   return list;
 };
 
 // src/files.ts
-import { countersFor, rulesFor } from "@geonosis/cli";
-var VERSION = "1.3.0";
+import { countersFor, LAW_SOURCE, rulesFor, tiersFor } from "@geonosis/cli";
+var VERSION = "2.0.0";
 var SCHEMA = "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json";
 var CATALOG = {
   "@types/node": "^24.3.0",
@@ -364,12 +490,17 @@ var workspaceManifest = (workspace, answers, workspaces) => {
       typescript: "catalog:",
       vitest: "catalog:"
     },
-    dependencies: Object.fromEntries(
-      workspace.mayDependOn.flatMap((tag) => {
-        const found = workspaces.find((one) => one.tag === tag);
-        return found === void 0 || found.name === workspace.name ? [] : [[found.name, "workspace:*"]];
-      })
-    )
+    dependencies: {
+      ...Object.fromEntries(
+        workspace.mayDependOn.flatMap((tag) => {
+          const found = workspaces.find((one) => one.tag === tag);
+          return found === void 0 || found.name === workspace.name ? [] : [[found.name, "workspace:*"]];
+        })
+      ),
+      // With --kit the floors are linked from a workspace AFTER the install, and the manifest is
+      // rewritten to say so — the same reason the root's kit versions are left out.
+      ...answers.kit === void 0 ? workspace.packages : {}
+    }
   });
 };
 var kitDependencies = (answers) => ({
@@ -381,6 +512,17 @@ var kitDependencies = (answers) => ({
   "@geonosis/verify": `^${VERSION}`,
   ...answers.themekit === void 0 ? {} : { "@geonosis/themekit": `^${VERSION}` }
 });
+var rootScripts = ({ runtime }) => ({
+  doctor: "geonosis-doctor",
+  "format:check": "oxfmt --config .oxfmtrc.json --check .",
+  format: "oxfmt --config .oxfmtrc.json .",
+  lint: "oxlint --config .oxlintrc.json .",
+  ratchet: "geonosis-ratchet",
+  sync: "geonosis sync",
+  test: everyWorkspace(runtime, "test"),
+  typecheck: everyWorkspace(runtime, "typecheck"),
+  verify: "geonosis-verify"
+});
 var rootManifest = (answers) => {
   const { runtime } = answers;
   const globs = ["apps/*", "packages/*"];
@@ -395,17 +537,7 @@ var rootManifest = (answers) => {
         packages: globs
       }
     } : {},
-    scripts: {
-      doctor: "geonosis-doctor",
-      "format:check": "oxfmt --config .oxfmtrc.json --check .",
-      format: "oxfmt --config .oxfmtrc.json .",
-      lint: "oxlint --config .oxlintrc.json .",
-      ratchet: "geonosis-ratchet",
-      sync: "geonosis sync",
-      test: everyWorkspace(runtime, "test"),
-      typecheck: everyWorkspace(runtime, "typecheck"),
-      verify: "geonosis-verify"
-    },
+    scripts: rootScripts(answers),
     devDependencies: {
       // With --kit the kit is linked from a workspace AFTER the install, and the manifest is
       // rewritten to say so. Declaring published versions here would make the install go looking
@@ -540,6 +672,9 @@ var ci = (answers) => [
   "jobs:",
   "  verify:",
   "    runs-on: ubuntu-latest",
+  // #161: a job with no ceiling ran three hours before failing in a consumer. The runner's
+  // timeout is not the repo's budget — it is what stops a gate nobody can see from billing.
+  "    timeout-minutes: 30",
   "    steps:",
   "      - uses: actions/checkout@v4",
   ...answers.runtime === "bun" ? ["      - uses: oven-sh/setup-bun@v2", "      - run: bun install --frozen-lockfile"] : [
@@ -587,12 +722,16 @@ var tsconfigBase = (answers) => json({
 });
 var filesFor = (answers) => {
   const workspaces = workspacesOf(answers);
-  const counters = countersFor(answers.runtime);
+  const counters = countersFor(answers.runtime, LAW_SOURCE);
   const { rules } = rulesFor(presetsFor(answers), answersForRules(answers));
   const files = {
     "package.json": rootManifest(answers),
     ...answers.runtime === "pnpm" ? { "pnpm-workspace.yaml": workspaceYaml(answers) } : {},
-    "CLAUDE.md": law(answers),
+    // D-054 from day one: the law is written once, CLAUDE.md imports it, and the three
+    // declarations below point at the same file — a repo with nothing to migrate later.
+    [LAW_SOURCE]: law(answers),
+    "CLAUDE.md": `@${LAW_SOURCE}
+`,
     "docs/architecture.md": architecture(answers, workspaces),
     "docs/pipelines/order-placed.md": pipeline(answers),
     ".github/workflows/ci.yml": ci(answers),
@@ -628,19 +767,16 @@ var filesFor = (answers) => {
       ignorePatterns: ["node_modules", "dist", "coverage", CORPUS_DIR]
     }),
     "geonosis.json": json({
-      verify: {
-        fast: ["pnpm typecheck", "pnpm lint", "pnpm test"].map(
-          (one) => answers.runtime === "bun" ? one.replace("pnpm ", "bun run ") : one
-        ),
-        full: [
-          "fast",
-          answers.runtime === "bun" ? "bun run format:check" : "pnpm format:check",
-          answers.runtime === "bun" ? "bun run ratchet" : "pnpm ratchet"
-        ]
-      },
+      verify: tiersFor({
+        rules,
+        runtime: answers.runtime,
+        scripts: Object.keys(rootScripts(answers))
+      }),
       doctor: { corpus: CORPUS_DIR },
+      law: { file: LAW_SOURCE },
       ledger: {
         architecture: "docs/architecture.md",
+        law: LAW_SOURCE,
         plans: "plans",
         progress: "plans/PROGRESS.md",
         proofs: "proofs"
@@ -718,10 +854,62 @@ var filesFor = (answers) => {
 };
 var presetsChosenBy = presetsFor;
 
+// src/check.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var pathsIn = (value, prefix = "") => {
+  if (!isRecord(value)) return [];
+  return Object.entries(value).flatMap(([key, child]) => {
+    const here = prefix === "" ? key : `${prefix}.${key}`;
+    return [here, ...pathsIn(child, here)];
+  });
+};
+var parsed = (body) => {
+  try {
+    const value = JSON.parse(body);
+    return isRecord(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var missingPaths = (want, has) => {
+  const held = new Set(pathsIn(has));
+  return pathsIn(want).filter((path) => !held.has(path));
+};
+var isCompositionRoot = (file) => file.endsWith(`/${PLATFORM_FILE}`);
+var checkScaffold = (answers) => {
+  const drift = [];
+  const seeded = workspacesOf(answers).map((one) => `${one.dir}/`);
+  for (const [file, body] of Object.entries(filesFor(answers))) {
+    if (!isCompositionRoot(file) && seeded.some((prefix) => file.startsWith(prefix))) continue;
+    const at = join(answers.dir, file);
+    if (!existsSync(at)) {
+      drift.push({ at: "", file, kind: "missing" });
+      continue;
+    }
+    const want = parsed(body);
+    if (want === void 0) continue;
+    const has = parsed(readFileSync(at, "utf8"));
+    if (has === void 0) {
+      drift.push({ at: "", file, kind: "unreadable" });
+      continue;
+    }
+    for (const path of missingPaths(want, has)) drift.push({ at: path, file, kind: "key" });
+  }
+  return drift;
+};
+var SAID = {
+  key: (one) => `${one.file} \u2192 ${one.at} \u2014 the scaffold writes this key and your file has none`,
+  missing: (one) => `${one.file} \u2014 the scaffold writes this file and your repo has none`,
+  unreadable: (one) => `${one.file} \u2014 the scaffold writes plain JSON here and yours is not (comments? trailing commas?), so this check could not read its keys`
+};
+var describeDrift = (drift) => drift.map((one) => SAID[one.kind](one));
+
 // src/scaffold.ts
 import { spawnSync } from "child_process";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 var KIT_PACKAGES = [
   "cli",
   "doctor",
@@ -733,12 +921,12 @@ var KIT_PACKAGES = [
   "verify"
 ];
 var write = (dir, file, body) => {
-  const path = join(dir, file);
+  const path = join2(dir, file);
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, body);
 };
 var writeScaffold = (answers) => {
-  if (existsSync(answers.dir) && readdirSync(answers.dir).length > 0) {
+  if (existsSync2(answers.dir) && readdirSync(answers.dir).length > 0) {
     throw new Error(`${answers.dir} is not empty \u2014 nothing was written`);
   }
   const files = filesFor(answers);
@@ -755,38 +943,77 @@ var run = (what, dir, command, args) => {
   };
 };
 var binsOf = (dir) => {
-  const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+  const manifest = JSON.parse(readFileSync2(join2(dir, "package.json"), "utf8"));
   if (typeof manifest.bin === "string") return [[manifest.name ?? "", manifest.bin]];
   return Object.entries(manifest.bin ?? {});
 };
+var repoint = (path, at, owed) => {
+  if (!existsSync2(path)) return [];
+  const manifest = JSON.parse(readFileSync2(path, "utf8"));
+  const moved = [];
+  for (const block of ["dependencies", "devDependencies"]) {
+    const declared = manifest[block];
+    if (declared === void 0) continue;
+    for (const name of Object.keys(declared)) {
+      const from = at.get(name);
+      if (from === void 0) continue;
+      declared[name] = `link:${from}`;
+      moved.push(name);
+    }
+  }
+  for (const name of owed) {
+    const from = at.get(name);
+    if (from === void 0 || moved.includes(name)) continue;
+    manifest.dependencies = { ...manifest.dependencies, [name]: `link:${from}` };
+    moved.push(name);
+  }
+  if (moved.length > 0) writeFileSync(path, `${JSON.stringify(manifest, void 0, 2)}
+`);
+  return moved;
+};
 var linkKit = (answers, kit) => {
-  const modules = join(answers.dir, "node_modules");
-  const scope = join(modules, "@geonosis");
-  const bin = join(modules, ".bin");
+  const modules = join2(answers.dir, "node_modules");
+  const scope = join2(modules, "@geonosis");
+  const bin = join2(modules, ".bin");
   mkdirSync(scope, { recursive: true });
   mkdirSync(bin, { recursive: true });
   const linked = [];
-  const manifestPath = join(answers.dir, "package.json");
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-  for (const name of KIT_PACKAGES) {
-    const from = join(kit, "packages", name);
-    if (!existsSync(from)) continue;
-    const at = join(scope, name);
-    if (!existsSync(at)) {
-      spawnSync("ln", ["-s", from, at]);
-    }
-    for (const [called, relative] of binsOf(from)) {
-      const shim = join(bin, called);
+  const at = /* @__PURE__ */ new Map();
+  const manifestPath = join2(answers.dir, "package.json");
+  const manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+  for (const relative of [
+    ...KIT_PACKAGES.map((name) => `packages/${name}`),
+    ...floorDirectories(answers.domains)
+  ]) {
+    const from = join2(kit, relative);
+    if (!existsSync2(from)) continue;
+    const declared = JSON.parse(readFileSync2(join2(from, "package.json"), "utf8"));
+    if (declared.name === void 0) continue;
+    const to = join2(scope, declared.name.replace("@geonosis/", ""));
+    if (!existsSync2(to)) spawnSync("ln", ["-s", from, to]);
+    for (const [called, entry] of binsOf(from)) {
+      const shim = join2(bin, called);
       writeFileSync(shim, `#!/bin/sh
-exec node "${join(from, relative)}" "$@"
+exec node "${join2(from, entry)}" "$@"
 `);
       chmodSync(shim, 493);
     }
-    const declared = JSON.parse(readFileSync(join(from, "package.json"), "utf8"));
-    if (declared.name !== void 0) {
-      manifest.devDependencies = { ...manifest.devDependencies, [declared.name]: `link:${from}` };
+    at.set(declared.name, from);
+    linked.push(relative);
+  }
+  const owned = new Set(
+    workspacesOf(answers).flatMap(
+      (workspace) => repoint(
+        join2(answers.dir, workspace.dir, "package.json"),
+        at,
+        Object.keys(workspace.packages ?? {})
+      )
+    )
+  );
+  for (const [name, from] of at) {
+    if (!owned.has(name)) {
+      manifest.devDependencies = { ...manifest.devDependencies, [name]: `link:${from}` };
     }
-    linked.push(name);
   }
   writeFileSync(manifestPath, `${JSON.stringify(manifest, void 0, 2)}
 `);
@@ -813,8 +1040,8 @@ var finish = ({ answers, install }) => {
       what: `link the kit from ${answers.kit}`
     });
   }
-  const ledger = join(answers.dir, "node_modules/.bin/geonosis-ledger");
-  if (existsSync(ledger)) {
+  const ledger = join2(answers.dir, "node_modules/.bin/geonosis-ledger");
+  if (existsSync2(ledger)) {
     steps.push(
       run("sync the edges table into turbo.json", answers.dir, ledger, [
         "sync",
@@ -832,14 +1059,22 @@ var finish = ({ answers, install }) => {
       ])
     );
   }
-  const oxfmt = join(answers.dir, "node_modules/.bin/oxfmt");
-  if (existsSync(oxfmt)) {
+  const oxfmt = join2(answers.dir, "node_modules/.bin/oxfmt");
+  if (existsSync2(oxfmt)) {
     steps.push(run("format", answers.dir, oxfmt, ["--config", ".oxfmtrc.json", "."]));
   }
   return steps;
 };
 
 export {
+  PLATFORM_FILE,
+  DOMAINS,
+  DOMAIN_NAMES,
+  FOUNDATIONS,
+  domainsNamed,
+  floorDependencies,
+  floorDirectories,
+  platformSource,
   RUNTIMES,
   BACKENDS,
   UIS,
@@ -850,6 +1085,8 @@ export {
   workspacesOf,
   filesFor,
   presetsChosenBy,
+  checkScaffold,
+  describeDrift,
   KIT_PACKAGES,
   writeScaffold,
   linkKit,

package/dist/create-geonosis-cli.js

@@ -1,13 +1,19 @@
 import {
+  DOMAIN_NAMES,
+  PLATFORM_FILE,
+  checkScaffold,
+  describeDrift,
   finish,
   parseAnswers,
   wantsInstall,
   writeScaffold
-} from "./chunk-3FX4T27X.js";
+} from "./chunk-PRX7MKFZ.js";
 
 // src/create-geonosis-cli.ts
+import { existsSync } from "fs";
 var USAGE = `create-geonosis <dir> --runtime pnpm|bun --backend medusa|sagaflow-cf|none --ui tiered-shadcn|atoms-only|none
-                [--brand <name>] [--themekit <name>] [--marketplace <path>] [--kit <path>] [--no-install]
+                [--domains <a,b>] [--brand <name>] [--themekit <name>] [--marketplace <path>] [--kit <path>] [--no-install]
+                [--check]
 
 Writes a repo that passes its own gates on day one: a workspace with one catalog of shared versions,
 an exports map and no barrel in every package, typecheck + lint + test scripts in every workspace,
@@ -18,13 +24,20 @@ skills lock, and a reach corpus in this repo's own vocabulary so the doctor can
 There is no default for --runtime, --backend or --ui. Each one decides the shape of the tree, and a
 default borrowed from another repo would be that repo's stack hardcoded into this one.
 
+  --domains      the domains this repo composes \u2014 ${DOMAIN_NAMES.join(", ")}. Each one writes its
+                 store into the app's ${PLATFORM_FILE}: the composition root, in two lifetimes, with
+                 the tenant session opened before any store is built. A name nothing ships is refused.
   --kit <path>   read the kit from a workspace instead of the registry. A proof aid: it symlinks the
                  packages after the install and rewrites the manifest to say so.
   --no-install   write the files and stop. The gates cannot run until the two "geonosis sync
                  --target" commands below have been run, and they are printed for you.
+  --check        say what an EXISTING repo is missing of what the scaffold writes today, and WRITE
+                 NOTHING. Files it has never had, and keys inside the JSON it has. Contents and
+                 values are never compared: a repo that has been worked in has rewritten them, and
+                 it was entitled to. Exit 1 when anything drifted.
 
-Exit: 0 written \xB7 1 refused (a directory with something in it, an answer that is not one) \xB7 2 a run
-that could not be made at all.`;
+Exit: 0 written (or, under --check, no drift) \xB7 1 refused (a directory with something in it, an
+answer that is not one) or drift found \xB7 2 a run that could not be made at all.`;
 var CONFIG_SHAPE = `create-geonosis reads no configuration file.
 
 It WRITES them: geonosis.json, .oxlintrc.json, geonosis.ratchet.json and gate-baseline.json, from
@@ -45,6 +58,24 @@ var main = () => {
     return argv.length === 0 ? 2 : 0;
   }
   const answers = parseAnswers(argv, process.cwd());
+  if (argv.includes("--check")) {
+    if (!existsSync(answers.dir)) {
+      throw new Error(`${answers.dir} is not there \u2014 --check reads a repo, it never makes one`);
+    }
+    const drift = checkScaffold(answers);
+    if (drift.length === 0) {
+      process.stdout.write(`create-geonosis --check ${answers.dir} \u2014 no drift
+`);
+      return 0;
+    }
+    for (const line of describeDrift(drift)) process.stderr.write(`  ${line}
+`);
+    process.stderr.write(
+      `create-geonosis --check ${answers.dir} \u2014 ${drift.length} drift, nothing written
+`
+    );
+    return 1;
+  }
   const written = writeScaffold(answers);
   process.stdout.write(`create-geonosis \u2014 ${written.length} file(s) into ${answers.dir}
 `);

package/dist/index.d.ts

@@ -8,6 +8,8 @@ type Answers = {
     backend: Backend;
     brand?: string;
     dir: string;
+    /** The domains this repo composes at its composition root. Empty until the flag names one. */
+    domains: string[];
     /** The kit read from a workspace instead of the registry — a proof aid, never the default. */
     kit?: string;
     marketplace?: string;
@@ -20,11 +22,84 @@ type Answers = {
 declare const parseAnswers: (argv: readonly string[], cwd: string) => Answers;
 declare const wantsInstall: (argv: readonly string[]) => boolean;
 
+/**
+ * What an existing repo never receives: whatever the scaffold has learned since it was run.
+ *
+ * The comparison is over SHAPE and not over content, because a repo that has been worked in has
+ * legitimately rewritten every file the scaffold gave it. What it cannot have legitimately done is
+ * lose a file the scaffold now writes, or miss a declaration a new gate reads — so a missing path is
+ * drift and a changed value never is.
+ */
+type DriftKind = 'key' | 'missing' | 'unreadable';
+type Drift = {
+    /** The key path inside the file, or `''` when the fact is about the whole file. */
+    at: string;
+    file: string;
+    kind: DriftKind;
+};
+/**
+ * The drift between a tree and what the scaffold would write into it today. Reads only.
+ *
+ * Nothing in this module opens a file for writing, and nothing calls `writeScaffold`. That is the
+ * whole contract of `--check`: it is run against a repo somebody is working in.
+ */
+declare const checkScaffold: (answers: Answers) => Drift[];
+declare const describeDrift: (drift: readonly Drift[]) => string[];
+
+/** Where the composition root lives, relative to the workspace that composes: the app. */
+declare const PLATFORM_FILE = "src/platform.ts";
+/**
+ * A domain the kit ships, and the two lines composing it takes.
+ *
+ * A domain is added here and nowhere else: the flag's vocabulary, the app's dependencies and the
+ * generated file all read this table, so a domain that ships without a way to compose it cannot be
+ * offered by name. `version` is the floor package's OWN line — the method's number says nothing
+ * about it (D-053) — and `tooling/floor-scaffold-versions.test.ts` holds each against the workspace.
+ */
+type DomainScaffold = {
+    /** Where the package sits in the kit's tree, for `--kit`'s workspace links. */
+    at: string;
+    /** What the scope field is called, and the type it is annotated with. */
+    field: string;
+    /** Everything the generated file needs above the composition itself. */
+    declarations: readonly string[];
+    fieldType: string;
+    imports: readonly string[];
+    name: string;
+    /** How the store is built, once the tenant's transaction is already open. */
+    built: readonly string[];
+    version: string;
+};
+declare const DOMAINS: readonly DomainScaffold[];
+declare const DOMAIN_NAMES: readonly string[];
+/** The two foundations a composition root is built from, whichever domains it composes. */
+declare const FOUNDATIONS: readonly {
+    at: string;
+    name: string;
+    version: string;
+}[];
+declare const domainsNamed: (named: readonly string[]) => DomainScaffold[];
+/** What the composing workspace declares once a domain is named. */
+declare const floorDependencies: (named: readonly string[]) => Record<string, string>;
+/** Every kit directory a `--kit` link has to reach for the domains this repo named. */
+declare const floorDirectories: (named: readonly string[]) => string[];
+/**
+ * The composition root, in the two lifetimes it has.
+ *
+ * DEFINITIONS are what this deployment IS — wired once per isolate, before anybody has asked
+ * anything. SCOPE is who is asking, bound per request. Keeping them apart is what lets the session
+ * come first: the stores are built INSIDE the tenant's transaction, so a caller cannot hold one
+ * that was made without a session to run in (D-014 — structural, never an assertion).
+ */
+declare const platformSource: (named: readonly string[]) => string;
+
 type Workspace = {
     dir: string;
     /** The files under this workspace, keyed by path relative to the workspace. */
     sources: Record<string, string>;
     name: string;
+    /** Packages outside the workspace this one declares, spec and all. */
+    packages?: Record<string, string>;
     tag: string;
     mayDependOn: string[];
 };
@@ -74,7 +149,7 @@ type Step = {
  * and tries to resolve the `workspace:*` specifiers the kit's own packages use. Symlinking the
  * directories and writing the bin shims is the one form of the answer that is true on both.
  *
- * The manifest is then told what is on disk, because `geonosis-doctor` FAILS a config whose plugin
+ * The manifests are then told what is on disk, because `geonosis-doctor` FAILS a config whose plugin
  * no manifest declares — and it should. A link is a declaration it accepts and can verify.
  */
 declare const linkKit: (answers: Answers, kit: string) => string[];
@@ -90,4 +165,4 @@ declare const finish: ({ answers, install }: {
     install: boolean;
 }) => Step[];
 
-export { type Answers, BACKENDS, type Backend, CORPUS_DIR, KIT_PACKAGES, RUNTIMES, type Runtime, type Step, UIS, type Ui, type Workspace, corpusFor, filesFor, finish, linkKit, parseAnswers, presetsChosenBy, wantsInstall, workspacesOf, writeScaffold };
+export { type Answers, BACKENDS, type Backend, CORPUS_DIR, DOMAINS, DOMAIN_NAMES, type DomainScaffold, type Drift, type DriftKind, FOUNDATIONS, KIT_PACKAGES, PLATFORM_FILE, RUNTIMES, type Runtime, type Step, UIS, type Ui, type Workspace, checkScaffold, corpusFor, describeDrift, domainsNamed, filesFor, finish, floorDependencies, floorDirectories, linkKit, parseAnswers, platformSource, presetsChosenBy, wantsInstall, workspacesOf, writeScaffold };

package/dist/index.js

@@ -1,30 +1,50 @@
 import {
   BACKENDS,
   CORPUS_DIR,
+  DOMAINS,
+  DOMAIN_NAMES,
+  FOUNDATIONS,
   KIT_PACKAGES,
+  PLATFORM_FILE,
   RUNTIMES,
   UIS,
+  checkScaffold,
   corpusFor,
+  describeDrift,
+  domainsNamed,
   filesFor,
   finish,
+  floorDependencies,
+  floorDirectories,
   linkKit,
   parseAnswers,
+  platformSource,
   presetsChosenBy,
   wantsInstall,
   workspacesOf,
   writeScaffold
-} from "./chunk-3FX4T27X.js";
+} from "./chunk-PRX7MKFZ.js";
 export {
   BACKENDS,
   CORPUS_DIR,
+  DOMAINS,
+  DOMAIN_NAMES,
+  FOUNDATIONS,
   KIT_PACKAGES,
+  PLATFORM_FILE,
   RUNTIMES,
   UIS,
+  checkScaffold,
   corpusFor,
+  describeDrift,
+  domainsNamed,
   filesFor,
   finish,
+  floorDependencies,
+  floorDirectories,
   linkKit,
   parseAnswers,
+  platformSource,
   presetsChosenBy,
   wantsInstall,
   workspacesOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-geonosis",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "types": "./dist/index.d.ts",
   "description": "Scaffold a microcompany repo that passes its own geonosis gates on day one.",
   "keywords": [
@@ -34,7 +34,7 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/cli": "1.3.0"
+    "@geonosis/cli": "2.0.0"
   },
   "engines": {
     "node": ">=22"