create-geonosis 2.10.0 → 2.11.1

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # create-geonosis
 
+## 2.11.1
+
+### Patch Changes
+
+- Updated dependencies [08611c4]
+  - @geonosis/cli@2.11.1
+
+## 2.11.0
+
+### Patch Changes
+
+- 0f99e26: Every bin's stale-build guard now sees the workspace dependencies its build read. A `dist`
+  current against its own `src` could still have been built against an older dependency's `dist` —
+  literally, where tsup inlined a workspace devDependency into it — and a dependency whose own `src`
+  had moved past its `dist` was read stale by every bin above it; the guard answered "current" for
+  both. Now each shim holds every `workspace:` dependency, transitively, to the same reading as its
+  own package (never built, stale against its src, current), and refuses when this `dist` is older
+  than a dependency's — by content, so a dependency rebuilt to the same bytes with
+  `--force --filter` is the same build and does not poison the tree. Unknown is still stale: the
+  first run over a tree where a dependency was rebuilt alone, before any record, refuses once and
+  names `--force --filter=<this package>`. Only a checkout with `src/` beside `dist/` sees any of
+  this; the published package ships no `src/` and the guard is skipped. Measured: within noise for a
+  bin with one dependency, +8 ms for `geonosis`, which walks fourteen.
+- 0f99e26: Every bin's stale-build guard decides, and never throws. The digest guard's refusal read
+  `package.json` to name `pnpm build --force --filter=<name>`; over a checkout with no manifest
+  beside the bin it ended with exit 1 and a `node:fs` frame instead of exit 2 and a sentence. The
+  name is now a courtesy the refusal does without. The contract, stated: a source newer by mtime whose
+  content the bin saw beside a current dist is not stale; one whose content differs is, and the
+  refusal names the fix; one the bin has no record for is stale — unknown is stale; a missing dist is
+  "never built". Each is exit 2 with a sentence. Only a checkout with `src/` beside `dist/` sees any
+  of this; the published package ships no `src/` and the guard is skipped.
+- 0f99e26: The kit names no consumer. Docs, doc comments and messages describe the repos a pattern was measured in by their stack (a Medusa storefront, a Workers + D1 app, a Mercur v1 marketplace). Example configs are named the same way: `examples/medusa-storefront.*.json`, `examples/workers-app.*.json`. No behaviour changes.
+- 0f99e26: `create-geonosis` refuses a flag it would have ignored. A misspelled flag written with `=`
+  (`--runtim=pnpm`) was taken and dropped, where the same flag written with a space was refused; and
+  `--presets` outside `--plan` was accepted and ignored, because a scaffold's presets follow from
+  `--backend` and `--ui`.
+- 0f99e26: The `backend-sagaflow-cf` deprecation line says the old preset name resolves "until the next major", which is what the 2.3.0 changelog promised. It used to say "for one release", seven minor releases on. The retired-rule docs and RULES.md now use the same wording.
+- 0f99e26: `--backend sagaflow-cf` now enables the `backend-workflows-cf` preset instead of the deprecated
+  `backend-sagaflow-cf` alias (#197 in the plugin) — a scaffolded repo's `.oxlintrc.json` no longer
+  goes stale the release the alias is dropped. Same rules today; no change for other backends.
+- 0f99e26: A bun repo's scaffolded `LAW.md` says `bun run format` and `bun run format:check`; it said `pnpm`
+  whatever the runtime.
+  
+  The README says the scaffold writes `LAW.md` with `CLAUDE.md` importing it, which it has since
+  D-054, and lists `--domains`, `--medusa`, `--check` and `--plan` in the flag table.
+- 0f99e26: A scaffolded repo pins vitest `^4.1.11`, the major the kit itself runs; a test holds every catalog tool to the kit's own major.
+- 0f99e26: Every order a tool writes, compares or applies — generated files, migration order, listings, cursors — sorts with the `en-US` collation, named rather than inherited from the machine. On an `en-US` machine nothing moves; on one set to another language (Estonian sorts `z` before `t`) the output is now the same one.
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+  - @geonosis/cli@2.11.0
+
 ## 2.10.0
 
 ### Patch Changes

package/README.md

@@ -15,11 +15,15 @@ and a default borrowed from another repo would be that repo's stack hardcoded in
 | `--runtime` | `pnpm` · `bun` |
 | `--backend` | `medusa` · `sagaflow-cf` · `none` |
 | `--ui` | `tiered-shadcn` · `atoms-only` · `none` |
+| `--domains <a,b>` | the domains the app composes, written into its `src/platform.ts` |
+| `--medusa <range>` | the Medusa a `--backend medusa` tree declares |
 | `--brand <name>` | turns on `no-brand-names` for that word |
 | `--themekit <name>` | consumes a themekit **by version**, never by copying it |
 | `--marketplace <path>` | install the plugin from a local marketplace instead of GitHub |
 | `--kit <path>` | read the kit from a workspace instead of the registry — a proof aid |
 | `--no-install` | write the files and stop |
+| `--check` | say what an existing repo lacks of what the scaffold writes today; write nothing |
+| `--plan` | what adopting an existing repo would take, computed off its tree; write nothing |
 
 ## What it writes
 
@@ -34,7 +38,8 @@ and a default borrowed from another repo would be that repo's stack hardcoded in
   `geonosis-ledger sync` generates turbo's `boundaries.tags` AND the linter's `layer-walls` layers
   from it, so a tag added there reaches both gates and neither can drift from the other. The
   scaffold runs both splices for you.
-- **`CLAUDE.md` under 60 lines**, plus a `docs/pipelines/` page template.
+- **`LAW.md` under 60 lines**, with `CLAUDE.md` the one line that imports it, plus a
+  `docs/pipelines/` page template.
 - **The five config files**: `geonosis.json` (verify tiers, ledger, walk, testbed, doctor),
   `.oxlintrc.json` with the presets the answers imply, `geonosis.ratchet.json`, `gate-baseline.json`,
   `.oxfmtrc.json`.
@@ -45,16 +50,16 @@ and a default borrowed from another repo would be that repo's stack hardcoded in
 ## The baseline, and the one number that is not zero
 
 Every counter starts at **0**: a new repo has earned no debt. `lawLineCount` starts at the measured
-length of the `CLAUDE.md` that was just written, because it counts something that already exists and
-a 0 there would fail the first `ratchet` run over a clean tree.
+length of the `LAW.md` that was just written, because it counts something that already exists and a
+0 there would fail the first `ratchet` run over a clean tree.
 
 ## `lint-corpus/` — the reach corpus a shipped one cannot be
 
 `geonosis-doctor` asks whether every enabled rule can fire at all, against the corpus the **plugin**
-ships. That answers for most rules and cannot answer for three: `layer-walls` fires on a repo's own
-layer names, `no-brand-names` on its own brand, `plugin-route-namespaced` on its own package root —
-and the plugin's corpus says `acme` and `layers/core`. So the scaffold writes a small corpus in
-**this** repo's vocabulary, with a `manifest.json` naming exactly the rules it is evidence about.
+ships. That cannot answer for a rule whose reach is the repo's own vocabulary — its layer names, its
+brand, its plugin package root, the `within` its sagas live in — and the plugin's corpus says `acme`
+and `layers/core`. So the scaffold writes a small corpus in **this** repo's vocabulary, with a
+`manifest.json` naming exactly the rules it is evidence about.
 
 It is deliberately broken code, so it is excluded from the repo's own lint, format and typecheck —
 the same treatment the plugin gives its own fixtures. The corpus run copies it to a temp root and
@@ -90,13 +95,12 @@ Two things are compared and two are deliberately not:
 new repo compile, not a shape a repo must hold. Measured over a consumer: including them turned 24 real
 findings into 52, thirty of them about a sample workspace that repo does not have.
 
-Over dielime — a repo scaffolded before D-054 moved the law — it reads 24, among them `LAW.md`,
-`geonosis.json → law.file`, three architecture rules the plugin has since added, and
-`gate-baseline.json`. `proofs/024-W31a-create-check/` has the whole run and the before/after hash.
+Over a repo scaffolded before D-054 moved the law it reads `LAW.md`, `geonosis.json → law.file`
+and the rest of what the scaffold has learned since; `proofs/024-W31a-create-check/` has a whole run
+and the before/after hash.
 
-A JSON file the repo has that is not plain JSON — dielime's `tsconfig.json` carries `//` comments,
-legal JSONC — is reported rather than skipped. A check that could not read a file has not passed
-over it.
+A JSON file the repo has that is not plain JSON — a `tsconfig.json` with `//` comments, legal
+JSONC — is reported rather than skipped. A check that could not read a file has not passed over it.
 
 ## Proven, not claimed
 

package/bin/create-geonosis.mjs

@@ -1,14 +1,24 @@
 #!/usr/bin/env node
-// Committed, so `pnpm install` can link the bin on a fresh clone — before `pnpm build` has
-// produced dist/. A bin that only exists after a build is a bin that is missing when you need it.
-//
-// In the repo, `src/` sits beside `dist/`, and a dist older than src answered for a fix it did not
-// carry once (#62). The published package ships no src, so there the check is skipped.
-import { existsSync, readdirSync, statSync } from 'node:fs'
+// Every packages/*/bin shim is packages/cli/bin/geonosis.mjs with its own name and entry: edit that
+// one, then `pnpm generate:shims`. Committed so `pnpm install` can link the bin on a fresh clone,
+// before `pnpm build` has made dist/. In the repo `src/` sits beside `dist/`, and a dist older
+// than src answered for a fix it did not carry once (#62); the published package ships no src, so
+// there the check is skipped.
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = dirname(fileURLToPath(import.meta.url))
+const own = join(here, '..')
 // tsup never reads a test file, so one counting as source made every bin refuse a build that had
 // not gone stale (#399).
 const NOT_SOURCE = (name) =>
@@ -24,25 +34,162 @@ const newest = (dir, skip) =>
         return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
       }, 0)
     : 0
-const src = join(here, '..', 'src')
-const dist = join(here, '..', 'dist')
+const digestOf = (dir, hash) => {
+  for (const name of readdirSync(dir).toSorted()) {
+    if (NOT_SOURCE(name)) continue
+    const at = join(dir, name)
+    if (statSync(at).isDirectory()) {
+      digestOf(at, hash)
+      continue
+    }
+    hash.update(name).update('\0').update(readFileSync(at)).update('\0')
+  }
+  return hash
+}
+const digest = (...dirs) => {
+  const hash = createHash('sha256')
+  for (const dir of dirs) if (existsSync(dir)) digestOf(dir, hash)
+  return hash.digest('hex')
+}
+// mtime says a source file was WRITTEN, not that it CHANGED. A checkout rewrites it with the same
+// content, and the next `pnpm build` is a cache hit that leaves the current dist exactly as it
+// was — so every bin refused with "run pnpm build", the action that had just changed nothing and
+// would change nothing again. So a digest of the sources is kept from the last run that found
+// dist current: the same digest later is the same sources, whatever their timestamps say, and a
+// different one is the staleness this guard exists for. The newest mtime is kept beside it so a
+// run over untouched sources need not hash them again. The second line is the same record for
+// the dists of the workspace dependencies this build read (row 584, below).
+const recordOf = (pkg) => join(pkg, '.turbo', 'geonosis-src-digest')
+const recorded = (pkg) => {
+  try {
+    const [first = '', second = ''] = readFileSync(recordOf(pkg), 'utf8').split('\n')
+    const [seen = '', sum = ''] = first.trim().split(' ')
+    const [depsSeen = '', depsSum = ''] = second.trim().split(' ')
+    return { depsSeen: Number(depsSeen), depsSum, seen: Number(seen), sum }
+  } catch {
+    return { depsSeen: 0, depsSum: '', seen: 0, sum: '' }
+  }
+}
+const remember = (pkg, known) => {
+  try {
+    mkdirSync(dirname(recordOf(pkg)), { recursive: true })
+    writeFileSync(recordOf(pkg), `${known.seen} ${known.sum}\n${known.depsSeen} ${known.depsSum}\n`)
+  } catch {
+    // A record nothing could write costs one more hash next time, never a wrong answer.
+  }
+}
+// The refusal names a package for turbo's --filter. A manifest that cannot be read costs the
+// name, never the decision: the first digest shim threw here — exit 1 and a node:fs frame — over a
+// tree with no package.json, and a guard that throws neither answers nor refuses.
+const manifestOf = (pkg) => {
+  try {
+    return JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8'))
+  } catch {
+    return {}
+  }
+}
+const refuse = (sentence) => {
+  process.stderr.write(`create-geonosis: ${sentence}\n`)
+  process.exit(2)
+}
+// Whether one package's dist reflects its src: 'unbuilt', 'stale' or 'current'. The same reading
+// for this package and for each workspace dependency, off that package's own record.
+const standing = (pkg) => {
+  const src = join(pkg, 'src')
+  const dist = join(pkg, 'dist')
+  if (!existsSync(src)) return 'current'
+  const built = newest(dist)
+  if (built === 0) return 'unbuilt'
+  const written = newest(src, NOT_SOURCE)
+  const known = recorded(pkg)
+  if (written > built) {
+    const sum = known.seen === written ? known.sum : digest(src)
+    if (sum !== known.sum) return 'stale'
+    if (known.seen !== written) remember(pkg, { ...known, seen: written, sum })
+  } else if (known.seen !== written) {
+    remember(pkg, { ...known, seen: written, sum: digest(src) })
+  }
+  return 'current'
+}
+// Row 584: a dist current against its own src can still have been built against an OLDER
+// dependency's dist — literally, when tsup inlined a workspace devDependency into it — and a
+// dependency whose src has moved past its dist is read by this dist stale, inlined or imported.
+// So every workspace dependency this manifest names (`workspace:`, resolved through the link pnpm
+// made, transitively) is held to the same reading as this package, and this dist must not be
+// older than any of theirs — by content: a dependency rebuilt to the same bytes is the same build,
+// so the `--force --filter` escape below cannot poison the tree it was run in.
+const workspaceDependencies = (pkg, found = new Map()) => {
+  const manifest = manifestOf(pkg)
+  for (const block of [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+    manifest.peerDependencies
+  ]) {
+    for (const [name, range] of Object.entries(block ?? {})) {
+      if (typeof range !== 'string' || !range.startsWith('workspace:')) continue
+      let dir
+      try {
+        dir = realpathSync(join(pkg, 'node_modules', name))
+      } catch {
+        continue // Not linked: the import will say so far more loudly than this guard can.
+      }
+      if (found.has(dir)) continue
+      found.set(dir, name)
+      workspaceDependencies(dir, found)
+    }
+  }
+  return found
+}
 // `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
 // two conditions were one comparison and one sentence — and the staleness sentence was printed
 // over trees that had never been built at all, blocking a turn in a fresh git worktree, which
 // has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
-if (existsSync(src)) {
-  const built = newest(dist)
+if (existsSync(join(own, 'src'))) {
+  const built = newest(join(own, 'dist'))
   if (built === 0) {
-    process.stderr.write(
-      'create-geonosis: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n'
+    refuse(
+      'this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.'
     )
-    process.exit(2)
   }
-  if (newest(src, NOT_SOURCE) > built) {
-    process.stderr.write(
-      'create-geonosis: dist is older than src — run pnpm build before trusting this bin.\n'
+  const name = manifestOf(own).name ?? '<this package>'
+  if (standing(own) === 'stale') {
+    refuse(
+      `dist is older than src — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left a current dist with its old timestamp and this bin had not yet recorded the sources it was current for: pnpm build --force --filter=${name} rebuilds this one package and clears it.`
     )
-    process.exit(2)
+  }
+  const dependencies = workspaceDependencies(own)
+  const dists = new Map()
+  for (const [dir, dependency] of dependencies) {
+    const state = standing(dir)
+    if (state === 'unbuilt') {
+      refuse(
+        `${dependency}, which this dist reads, has never been built — run pnpm build. No dist there at all; nothing is stale.`
+      )
+    }
+    if (state === 'stale') {
+      refuse(
+        `${dependency}'s dist is older than its src, and this dist reads that dist — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left that dist current with its old timestamp and nothing had yet recorded the sources it was current for: pnpm build --force --filter=${dependency} rebuilds that one package and clears it.`
+      )
+    }
+    dists.set(join(dir, 'dist'), dependency)
+  }
+  if (dists.size > 0) {
+    const known = recorded(own)
+    const theirs = [...dists.keys()].toSorted()
+    const depsNewest = theirs.reduce((most, dist) => Math.max(most, newest(dist)), 0)
+    if (depsNewest > built) {
+      const depsSum = known.depsSeen === depsNewest ? known.depsSum : digest(...theirs)
+      if (depsSum !== known.depsSum) {
+        const newer = theirs.filter((dist) => newest(dist) > built).map((dist) => dists.get(dist))
+        refuse(
+          `dist was built before the current dist of ${newer.join(', ')}, which it reads — run pnpm build before trusting this bin. If that build just said FULL TURBO, the dependency was rebuilt alone and this bin had not yet recorded the build it was current against: pnpm build --force --filter=${name} rebuilds this one package against it.`
+        )
+      }
+      if (known.depsSeen !== depsNewest) remember(own, { ...known, depsSeen: depsNewest, depsSum })
+    } else if (known.depsSeen !== depsNewest) {
+      remember(own, { ...known, depsSeen: depsNewest, depsSum: digest(...theirs) })
+    }
   }
 }
 

package/dist/{chunk-5AQ755XJ.js → chunk-YF4AX76D.js}

@@ -24,7 +24,7 @@ var SEARCH = {
     "import { pgFtsSearchIndex, type SearchIndex, type SearchProjections } from '@geonosis/search'"
   ],
   name: "@geonosis/search",
-  version: "0.3.11"
+  version: "0.4.1"
 };
 var DOCUMENT = {
   at: "domains/document",
@@ -37,13 +37,13 @@ var DOCUMENT = {
   fieldType: "typeof DOCUMENT_ENTITIES",
   imports: ["import { documentEntities } from '@geonosis/document'"],
   name: "@geonosis/document",
-  version: "0.7.0"
+  version: "0.9.0"
 };
 var DOMAINS = [SEARCH, DOCUMENT];
 var DOMAIN_NAMES = DOMAINS.map((one) => one.field);
 var FOUNDATIONS = [
-  { at: "foundations/db", name: "@geonosis/db", version: "0.12.0" },
-  { at: "foundations/events", name: "@geonosis/events", version: "2.1.0" }
+  { at: "foundations/db", name: "@geonosis/db", version: "0.14.0" },
+  { at: "foundations/events", name: "@geonosis/events", version: "2.2.0" }
 ];
 var domainsNamed = (named) => named.map((one) => {
   const found = DOMAINS.find((domain) => domain.field === one);
@@ -55,7 +55,7 @@ var domainsNamed = (named) => named.map((one) => {
   return found;
 });
 var floorDependencies = (named) => named.length === 0 ? {} : Object.fromEntries(
-  [...FOUNDATIONS, ...domainsNamed(named)].map((one) => [one.name, `^${one.version}`]).toSorted(([a], [b]) => String(a).localeCompare(String(b)))
+  [...FOUNDATIONS, ...domainsNamed(named)].map((one) => [one.name, `^${one.version}`]).toSorted(([a], [b]) => String(a).localeCompare(String(b), "en-US"))
 );
 var floorDirectories = (named) => named.length === 0 ? [] : [...FOUNDATIONS, ...domainsNamed(named)].map((one) => one.at);
 var platformSource = (named) => {
@@ -144,8 +144,7 @@ var VALUED = /* @__PURE__ */ new Set([
   "--ui"
 ]);
 var SWITCHES = /* @__PURE__ */ new Set(["--check", "--help", "-h", "--no-install", "--plan"]);
-var parseArgs = (argv) => read(argv);
-var read = (argv) => {
+var parseArgs = (argv) => {
   const flags = {};
   let dir;
   for (let at = 0; at < argv.length; at += 1) {
@@ -155,16 +154,17 @@ var read = (argv) => {
       continue;
     }
     const equals = token.indexOf("=");
+    const flag = equals === -1 ? token : token.slice(0, equals);
+    if (!VALUED.has(flag) && !SWITCHES.has(flag)) {
+      throw new Error(
+        `${flag} is not an option create-geonosis takes. Run create-geonosis --help for the ones it does.`
+      );
+    }
     if (equals !== -1) {
-      flags[token.slice(0, equals)] = token.slice(equals + 1);
+      flags[flag] = token.slice(equals + 1);
       continue;
     }
-    if (!VALUED.has(token)) {
-      if (!SWITCHES.has(token)) {
-        throw new Error(
-          `${token} is not an option create-geonosis takes. Run create-geonosis --help for the ones it does.`
-        );
-      }
+    if (SWITCHES.has(token)) {
       flags[token] = "true";
       continue;
     }
@@ -191,10 +191,15 @@ var domainsFrom = (given) => {
   return named;
 };
 var parseAnswers = (argv, cwd) => {
-  const { dir, flags } = read(argv);
+  const { dir, flags } = parseArgs(argv);
   if (dir === void 0) {
     throw new Error("create-geonosis needs a directory to write the repo into");
   }
+  if (flags["--presets"] !== void 0) {
+    throw new Error(
+      "--presets is a --plan option: a scaffold takes its presets from --backend and --ui, and would ignore the ones named here"
+    );
+  }
   const name = basename(resolve(cwd, dir));
   const domains = domainsFrom(flags["--domains"]);
   return {
@@ -420,27 +425,37 @@ var workspacesOf = (answers) => {
 };
 
 // src/files.ts
-import { countersFor, LAW_SOURCE, rulesFor, tiersFor } from "@geonosis/cli";
-var VERSION = "2.10.0";
-var SCHEMA = "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json";
+import {
+  countersFor,
+  LAW_SOURCE,
+  LOADED_VERSION,
+  oxlintConfigFor,
+  rulesFor,
+  tiersFor
+} from "@geonosis/cli";
+var VERSION = LOADED_VERSION;
 var CATALOG = {
   "@types/node": "^24.3.0",
   oxfmt: "^0.62.0",
   oxlint: "^1.80.0",
   typescript: "^5.9.2",
-  vitest: "^3.2.4"
+  vitest: "^4.1.11"
 };
 var REACT = { "@types/react": "^19.0.0", react: "^19.0.0" };
 var json = (value) => `${JSON.stringify(value, void 0, 2)}
 `;
 var exec = (runtime) => runtime === "bun" ? "bunx" : "npx";
+var run = (runtime) => runtime === "bun" ? "bun run" : "pnpm";
 var everyWorkspace = (runtime, script) => runtime === "bun" ? `bun run --filter '*' ${script}` : `pnpm -r ${script}`;
 var presetsFor = (answers) => [
   "tooling",
   ...answers.ui === "none" ? [] : ["frontend"],
   ...answers.backend === "none" ? [] : ["tenant-scoping"],
   ...answers.backend === "medusa" ? ["backend-medusa"] : [],
-  ...answers.backend === "sagaflow-cf" ? ["backend-sagaflow-cf"] : [],
+  // #197 (plugin): `backend-sagaflow-cf` is a deprecated alias for `backend-workflows-cf` that
+  // resolves to the same rules until the next major, then goes — ask for the current name, never
+  // the alias, so a scaffolded repo's config does not go stale the day the alias is dropped.
+  ...answers.backend === "sagaflow-cf" ? ["backend-workflows-cf"] : [],
   ...answers.themekit === void 0 ? [] : ["themekit"]
 ];
 var tokenPrefix = (name) => `--${name.toLowerCase().replaceAll(/[^a-z]/g, "").slice(0, 3)}-`;
@@ -645,7 +660,7 @@ var workspaceYaml = (answers) => [
   "# One version of a shared dependency, named once. A repo whose workspaces each pin their own",
   "# typescript is a repo where one of them typechecks against a compiler the others do not run.",
   "catalog:",
-  ...Object.entries({ ...CATALOG, ...answers.ui === "none" ? {} : REACT }).toSorted(([a], [b]) => a.localeCompare(b)).map(([name, spec]) => `  '${name}': '${spec}'`),
+  ...Object.entries({ ...CATALOG, ...answers.ui === "none" ? {} : REACT }).toSorted(([a], [b]) => a.localeCompare(b, "en-US")).map(([name, spec]) => `  '${name}': '${spec}'`),
   "",
   "# pnpm 11 runs no dependency's install script unless it is named here. esbuild fetches its",
   "# platform binary in one, and without it vitest cannot start \u2014 a test suite that cannot run",
@@ -713,8 +728,8 @@ var law = (answers) => [
   "",
   "**3. No suppression.** No `@ts-ignore`, no `@ts-expect-error`. Fix the type, or ask.",
   "",
-  "**4. oxfmt only.** `pnpm format` writes, `pnpm format:check` verifies. Never prettier: it is",
-  "not a dependency here, so it downloads itself and reformats with its own defaults.",
+  `**4. oxfmt only.** \`${run(answers.runtime)} format\` writes, \`${run(answers.runtime)} format:check\` verifies. Never`,
+  "prettier: it is not a dependency here, so it downloads itself and reformats with its own defaults.",
   "",
   "**5. Nothing is hardcoded to a repo.** Every list a rule needs is an option.",
   "",
@@ -845,14 +860,7 @@ var filesFor = (answers) => {
         CORPUS_DIR
       ]
     }),
-    ".oxlintrc.json": json({
-      $schema: SCHEMA,
-      plugins: ["typescript", "unicorn"],
-      jsPlugins: ["@geonosis/oxlint-plugin-biological-architecture"],
-      categories: { correctness: "error", suspicious: "error" },
-      rules,
-      ignorePatterns: ["node_modules", "dist", "coverage", CORPUS_DIR]
-    }),
+    ".oxlintrc.json": json(oxlintConfigFor(rules, [CORPUS_DIR])),
     "geonosis.json": json({
       verify: tiersFor({
         rules,
@@ -996,7 +1004,15 @@ var describeDrift = (drift) => drift.map((one) => SAID[one.kind](one));
 
 // src/scaffold.ts
 import { spawnSync } from "child_process";
-import { chmodSync, existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  readdirSync,
+  readFileSync as readFileSync2,
+  symlinkSync,
+  writeFileSync
+} from "fs";
 import { dirname, join as join2 } from "path";
 var KIT_PACKAGES = [
   "cli",
@@ -1023,7 +1039,7 @@ var writeScaffold = (answers) => {
   for (const [file, body] of Object.entries(files)) write(answers.dir, file, body);
   return Object.keys(files).toSorted();
 };
-var run = (what, dir, command, args) => {
+var run2 = (what, dir, command, args) => {
   const done = spawnSync(command, args, { cwd: dir, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
   return {
     code: done.error === void 0 ? done.status ?? 2 : 2,
@@ -1081,7 +1097,7 @@ var linkKit = (answers, kit) => {
     const declared = readJson(join2(from, "package.json"));
     if (declared.name === void 0) continue;
     const to = join2(scope, declared.name.replace("@geonosis/", ""));
-    if (!existsSync2(to)) spawnSync("ln", ["-s", from, to]);
+    if (!existsSync2(to)) symlinkSync(from, to);
     for (const [called, entry] of binsOf(from)) {
       const shim = join2(bin, called);
       writeFileSync(shim, `#!/bin/sh
@@ -1117,10 +1133,10 @@ var finish = ({ answers, install }) => {
   if (install) {
     const [command, args] = installer(answers);
     const offline = answers.runtime === "pnpm" ? [...args, "--offline"] : args;
-    const first = run(`${command} install (offline)`, answers.dir, command, offline);
+    const first = run2(`${command} install (offline)`, answers.dir, command, offline);
     steps.push(first);
     if (first.code !== 0) {
-      steps.push(run(`${command} install (network)`, answers.dir, command, args));
+      steps.push(run2(`${command} install (network)`, answers.dir, command, args));
     }
   }
   if (answers.kit !== void 0) {
@@ -1136,7 +1152,7 @@ var finish = ({ answers, install }) => {
   if (existsSync2(ledger)) {
     for (const { target, write: into } of GRAPH_SYNCS) {
       steps.push(
-        run(`sync the edges table into ${into}`, answers.dir, ledger, [
+        run2(`sync the edges table into ${into}`, answers.dir, ledger, [
           "sync",
           "--target",
           target,
@@ -1148,7 +1164,7 @@ var finish = ({ answers, install }) => {
   }
   const oxfmt = join2(answers.dir, "node_modules/.bin/oxfmt");
   if (existsSync2(oxfmt)) {
-    steps.push(run("format", answers.dir, oxfmt, ["--config", ".oxfmtrc.json", "."]));
+    steps.push(run2("format", answers.dir, oxfmt, ["--config", ".oxfmtrc.json", "."]));
   }
   return steps;
 };
@@ -1167,6 +1183,7 @@ export {
   UIS,
   MEDUSA_RANGE,
   parseArgs,
+  scopeOf,
   parseAnswers,
   wantsInstall,
   CORPUS_DIR,

package/dist/create-geonosis-cli.js

@@ -9,9 +9,10 @@ import {
   finish,
   parseAnswers,
   parseArgs,
+  scopeOf,
   wantsInstall,
   writeScaffold
-} from "./chunk-5AQ755XJ.js";
+} from "./chunk-YF4AX76D.js";
 
 // src/create-geonosis-cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -86,7 +87,7 @@ var planAdoption = ({ backend, dir, presets, runtime, ui }) => {
     domains: [],
     name: basename(at),
     runtime: chosenRuntime,
-    scope: `@${basename(at).toLowerCase()}`,
+    scope: scopeOf(basename(at)),
     ui: uiOf(at, chosen("--ui", ui, UIS))
   };
   const drift = checkScaffold(answers);
@@ -118,7 +119,7 @@ var planAdoption = ({ backend, dir, presets, runtime, ui }) => {
       return { declared: declaredCounters.has(key), key };
     }),
     dir: at,
-    doors: [.../* @__PURE__ */ new Set([...KIT_OWNED_BLOCKS, ...Object.keys(config)])].filter((block) => KIT_OWNED_BLOCKS.includes(block)).toSorted().map((block) => ({
+    doors: KIT_OWNED_BLOCKS.map((block) => ({
       block,
       declared: declaredPackages.has(doorFor(block)),
       package: doorFor(block)
@@ -189,7 +190,7 @@ var formatPlan = (plan) => [
 
 // src/create-geonosis-cli.ts
 var USAGE = `create-geonosis <dir> --runtime pnpm|bun --backend medusa|sagaflow-cf|none --ui tiered-shadcn|atoms-only|none
-                     [--medusa <range>]
+                [--medusa <range>]
                 [--domains <a,b>] [--brand <name>] [--themekit <name>] [--marketplace <path>] [--kit <path>] [--no-install]
                 [--check]
 create-geonosis --plan <dir> [--presets <a,b>] [--runtime \u2026] [--backend \u2026] [--ui \u2026]

package/dist/index.d.ts

@@ -118,10 +118,10 @@ declare const CORPUS_DIR = "lint-corpus";
  * A reach corpus a shipped one cannot be.
  *
  * `geonosis-doctor` asks whether every enabled rule can fire at all, and it asks the corpus the
- * PLUGIN ships. That answers for most rules and cannot answer for three: `layer-walls` fires on a
- * repo's own layer names, `no-brand-names` on its own brand, `plugin-route-namespaced` on its own
- * package root. The plugin's corpus says "acme" and `layers/core`, so it is no evidence either way
- * about a repo that says anything else — and today those rules read as firing nowhere.
+ * PLUGIN ships. That cannot answer for a rule whose reach is the repo's own vocabulary: its layer
+ * names, its brand, its plugin package root, the `within` its sagas live in. The plugin's corpus
+ * says "acme" and `layers/core`, so it is no evidence either way about a repo that says anything
+ * else — and those rules would read as firing nowhere.
  *
  * So the repo ships its own, in ITS vocabulary. The corpus is copied to a temp root and linted with
  * `--no-ignore`, so the fixture paths mirror the repo's real ones and the layer patterns match.

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   wantsInstall,
   workspacesOf,
   writeScaffold
-} from "./chunk-5AQ755XJ.js";
+} from "./chunk-YF4AX76D.js";
 export {
   BACKENDS,
   CORPUS_DIR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-geonosis",
-  "version": "2.10.0",
+  "version": "2.11.1",
   "types": "./dist/index.d.ts",
   "description": "Scaffold a microcompany repo that passes its own geonosis gates on day one.",
   "keywords": [
@@ -35,7 +35,7 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/cli": "2.10.0"
+    "@geonosis/cli": "2.11.1"
   },
   "engines": {
     "node": ">=22"
@@ -44,7 +44,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsx ../../tooling/build-step.ts tsup",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint --config ../../.oxlintrc.json .",
     "test:unit": "vitest run --project unit --root ../.. --passWithNoTests \"$PWD\"",