create-geonosis 2.12.0 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # create-geonosis
 
+## 3.0.0
+
+### Major Changes
+
+- 670f7c1: Every bin runs on bun: its shebang is `#!/usr/bin/env bun`, so a repo that runs the tools needs bun on `PATH`. On pnpm 12, `devEngines.runtime` names it and the install puts it in `node_modules/.bin`:
+  
+  ```json
+  "devEngines": { "runtime": { "name": "bun", "version": "^1.4.2", "onFail": "download" } }
+  ```
+  
+  The runtime floors (foundations, domains, kits) are unchanged: they declare no runtime of their own and run on Node, Workers or a browser bundle.
+
+### Minor Changes
+
+- 0f272e2: A tree says which bun the kit's bins start on. Every package with a bin declares `engines.bun`, at the range the kit itself runs. `create-geonosis` writes a pnpm repo's `devEngines.runtime` and `packageManager` as the kit's own manifest has them, so pnpm 12 installs that bun. `geonosis-doctor`'s drift check WARNs, on the `tool runtime` line, where an installed kit package asks for bun and the root neither runs on it nor declares it, and prints the block to add.
+- 29a4820: TypeScript 7. A scaffold pins the tools at the ranges the kit itself runs, read from the kit's own manifest when a cut is made, so the two cannot drift: `typescript` ^7, `oxlint` ^1.85, `oxfmt` ^0.70.
+
+### Patch Changes
+
+- 1e38e4e: `geonosis-themekit`, `geonosis-rails` and `geonosis-evals` read their arguments with `node:util`'s `parseArgs`. A flag one does not know is refused by name, exit 2, where the hand-written readers ignored it and ran without it; a flag given twice keeps its last value in all three (evals kept the first). `geonosis-evals compare --tolerance x=0.1 a.json b.json` reads `a.json` and `b.json` as the scores: the old reader took the tolerance's value for the first score file. `geonosis-ratchet` and `geonosis-verify`, which already refused what they did not know, read their flags the same way; verify still refuses a flag that belongs to another of its commands. `geonosis-doctor` reads its flags with `parseArgs` too, its optional `--baseline-against` ref through the parser's tokens. `@geonosis/ledger`'s exported `parseArgs(argv, valued, switches)` is `node:util`'s underneath and takes the switches it accepts, refusing an undeclared one and a valued flag followed by another flag (`--note --plan 3` used to store `--plan` as the note); `rejectUnknownSwitches` is gone. `geonosis-walk`, `geonosis-review` and `geonosis-lint-parity` parse the same way; parity keeps its own words for a bare `--corpus` or `--expect-changed`. `geonosis-observability`, `geonosis-verify-arch`, `geonosis-testbed` and `geonosis-visual-diff` follow; the last two used to accept a flag they did not know (testbed ignored it, visual-diff read it as a switch) and now refuse it. `@geonosis/release`'s exported `parseArgs` keeps its `Parsed` shape over `node:util`'s. `@geonosis/cli`'s `parseArgv` and `create-geonosis`'s `parseArgs` are built on it too, keeping their own refusals; `parseArgv` now refuses a valued flag followed by another flag instead of taking that flag as its value.
+- Updated dependencies [1e38e4e]
+  - @geonosis/cli@3.0.0
+
+## 2.13.0
+
+### Patch Changes
+
+- Updated dependencies [f422aea]
+  - @geonosis/cli@2.13.0
+
 ## 2.12.0
 
 ### Patch Changes

package/bin/create-geonosis.mjs

@@ -1,196 +1,11 @@
-#!/usr/bin/env node
-// Every packages/*/bin shim is packages/cli/bin/geonosis.mjs with its own name and entry: edit that
-// one, then `pnpm generate:shims`. Committed so `pnpm install` can link the bin on a fresh clone,
-// before `pnpm build` has made dist/. In the repo `src/` sits beside `dist/`, and a dist older
-// than src answered for a fix it did not carry once (#62); the published package ships no src, so
-// there the check is skipped.
-import { createHash } from 'node:crypto'
-import {
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  statSync,
-  writeFileSync
-} from 'node:fs'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+#!/usr/bin/env bun
+// Generated by pnpm generate:shims. In the kit's own tree src/ sits beside dist/, and a dist older
+// than src once answered for a fix it did not carry (#62); a published package ships no src/.
+import { existsSync } from 'node:fs'
 
-const here = dirname(fileURLToPath(import.meta.url))
-const own = join(here, '..')
-// tsup never reads a test file, so one counting as source made every bin refuse a build that had
-// not gone stale (#399).
-const NOT_SOURCE = (name) =>
-  name.endsWith('.test.ts') ||
-  name.endsWith('.test.tsx') ||
-  name === '__tests__' ||
-  name === '__fixtures__'
-const newest = (dir, skip) =>
-  existsSync(dir)
-    ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
-        if (skip !== undefined && skip(entry.name)) return most
-        const at = join(dir, entry.name)
-        return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
-      }, 0)
-    : 0
-const digestOf = (dir, hash) => {
-  for (const name of readdirSync(dir).toSorted()) {
-    if (NOT_SOURCE(name)) continue
-    const at = join(dir, name)
-    if (statSync(at).isDirectory()) {
-      digestOf(at, hash)
-      continue
-    }
-    hash.update(name).update('\0').update(readFileSync(at)).update('\0')
-  }
-  return hash
-}
-const digest = (...dirs) => {
-  const hash = createHash('sha256')
-  for (const dir of dirs) if (existsSync(dir)) digestOf(dir, hash)
-  return hash.digest('hex')
-}
-// mtime says a source file was WRITTEN, not that it CHANGED. A checkout rewrites it with the same
-// content, and the next `pnpm build` is a cache hit that leaves the current dist exactly as it
-// was — so every bin refused with "run pnpm build", the action that had just changed nothing and
-// would change nothing again. So a digest of the sources is kept from the last run that found
-// dist current: the same digest later is the same sources, whatever their timestamps say, and a
-// different one is the staleness this guard exists for. The newest mtime is kept beside it so a
-// run over untouched sources need not hash them again. The second line is the same record for
-// the dists of the workspace dependencies this build read (row 584, below).
-const recordOf = (pkg) => join(pkg, '.turbo', 'geonosis-src-digest')
-const recorded = (pkg) => {
-  try {
-    const [first = '', second = ''] = readFileSync(recordOf(pkg), 'utf8').split('\n')
-    const [seen = '', sum = ''] = first.trim().split(' ')
-    const [depsSeen = '', depsSum = ''] = second.trim().split(' ')
-    return { depsSeen: Number(depsSeen), depsSum, seen: Number(seen), sum }
-  } catch {
-    return { depsSeen: 0, depsSum: '', seen: 0, sum: '' }
-  }
-}
-const remember = (pkg, known) => {
-  try {
-    mkdirSync(dirname(recordOf(pkg)), { recursive: true })
-    writeFileSync(recordOf(pkg), `${known.seen} ${known.sum}\n${known.depsSeen} ${known.depsSum}\n`)
-  } catch {
-    // A record nothing could write costs one more hash next time, never a wrong answer.
-  }
-}
-// The refusal names a package for turbo's --filter. A manifest that cannot be read costs the
-// name, never the decision: the first digest shim threw here — exit 1 and a node:fs frame — over a
-// tree with no package.json, and a guard that throws neither answers nor refuses.
-const manifestOf = (pkg) => {
-  try {
-    return JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8'))
-  } catch {
-    return {}
-  }
-}
-const refuse = (sentence) => {
-  process.stderr.write(`create-geonosis: ${sentence}\n`)
-  process.exit(2)
-}
-// Whether one package's dist reflects its src: 'unbuilt', 'stale' or 'current'. The same reading
-// for this package and for each workspace dependency, off that package's own record.
-const standing = (pkg) => {
-  const src = join(pkg, 'src')
-  const dist = join(pkg, 'dist')
-  if (!existsSync(src)) return 'current'
-  const built = newest(dist)
-  if (built === 0) return 'unbuilt'
-  const written = newest(src, NOT_SOURCE)
-  const known = recorded(pkg)
-  if (written > built) {
-    const sum = known.seen === written ? known.sum : digest(src)
-    if (sum !== known.sum) return 'stale'
-    if (known.seen !== written) remember(pkg, { ...known, seen: written, sum })
-  } else if (known.seen !== written) {
-    remember(pkg, { ...known, seen: written, sum: digest(src) })
-  }
-  return 'current'
-}
-// Row 584: a dist current against its own src can still have been built against an OLDER
-// dependency's dist — literally, when tsup inlined a workspace devDependency into it — and a
-// dependency whose src has moved past its dist is read by this dist stale, inlined or imported.
-// So every workspace dependency this manifest names (`workspace:`, resolved through the link pnpm
-// made, transitively) is held to the same reading as this package, and this dist must not be
-// older than any of theirs — by content: a dependency rebuilt to the same bytes is the same build,
-// so the `--force --filter` escape below cannot poison the tree it was run in.
-const workspaceDependencies = (pkg, found = new Map()) => {
-  const manifest = manifestOf(pkg)
-  for (const block of [
-    manifest.dependencies,
-    manifest.devDependencies,
-    manifest.optionalDependencies,
-    manifest.peerDependencies
-  ]) {
-    for (const [name, range] of Object.entries(block ?? {})) {
-      if (typeof range !== 'string' || !range.startsWith('workspace:')) continue
-      let dir
-      try {
-        dir = realpathSync(join(pkg, 'node_modules', name))
-      } catch {
-        continue // Not linked: the import will say so far more loudly than this guard can.
-      }
-      if (found.has(dir)) continue
-      found.set(dir, name)
-      workspaceDependencies(dir, found)
-    }
-  }
-  return found
-}
-// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
-// two conditions were one comparison and one sentence — and the staleness sentence was printed
-// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
-// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
-if (existsSync(join(own, 'src'))) {
-  const built = newest(join(own, 'dist'))
-  if (built === 0) {
-    refuse(
-      'this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.'
-    )
-  }
-  const name = manifestOf(own).name ?? '<this package>'
-  if (standing(own) === 'stale') {
-    refuse(
-      `dist is older than src — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left a current dist with its old timestamp and this bin had not yet recorded the sources it was current for: pnpm build --force --filter=${name} rebuilds this one package and clears it.`
-    )
-  }
-  const dependencies = workspaceDependencies(own)
-  const dists = new Map()
-  for (const [dir, dependency] of dependencies) {
-    const state = standing(dir)
-    if (state === 'unbuilt') {
-      refuse(
-        `${dependency}, which this dist reads, has never been built — run pnpm build. No dist there at all; nothing is stale.`
-      )
-    }
-    if (state === 'stale') {
-      refuse(
-        `${dependency}'s dist is older than its src, and this dist reads that dist — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left that dist current with its old timestamp and nothing had yet recorded the sources it was current for: pnpm build --force --filter=${dependency} rebuilds that one package and clears it.`
-      )
-    }
-    dists.set(join(dir, 'dist'), dependency)
-  }
-  if (dists.size > 0) {
-    const known = recorded(own)
-    const theirs = [...dists.keys()].toSorted()
-    const depsNewest = theirs.reduce((most, dist) => Math.max(most, newest(dist)), 0)
-    if (depsNewest > built) {
-      const depsSum = known.depsSeen === depsNewest ? known.depsSum : digest(...theirs)
-      if (depsSum !== known.depsSum) {
-        const newer = theirs.filter((dist) => newest(dist) > built).map((dist) => dists.get(dist))
-        refuse(
-          `dist was built before the current dist of ${newer.join(', ')}, which it reads — run pnpm build before trusting this bin. If that build just said FULL TURBO, the dependency was rebuilt alone and this bin had not yet recorded the build it was current against: pnpm build --force --filter=${name} rebuilds this one package against it.`
-        )
-      }
-      if (known.depsSeen !== depsNewest) remember(own, { ...known, depsSeen: depsNewest, depsSum })
-    } else if (known.depsSeen !== depsNewest) {
-      remember(own, { ...known, depsSeen: depsNewest, depsSum: digest(...theirs) })
-    }
-  }
+if (existsSync(new URL('../src', import.meta.url))) {
+  const { guardBuild } = await import('../../../tooling/bin-guard.mjs')
+  guardBuild(new URL('..', import.meta.url), 'create-geonosis')
 }
 
 await import('../dist/create-geonosis-cli.js')

package/dist/adopt.js

@@ -0,0 +1,144 @@
+// src/adopt.ts
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { countersFor, rulesFor, runtimeOf, tiersFor } from "@geonosis/cli";
+import { BACKENDS, scopeOf, UIS } from "./answers.js";
+import { checkScaffold } from "./check.js";
+var ADOPT_USAGE = "create-geonosis --plan <dir> [--presets <a,b>] [--runtime pnpm|bun] [--backend medusa|sagaflow-cf|none] [--ui tiered-shadcn|atoms-only|none] — what adopting this repo would take, computed off the tree. Writes nothing.";
+var LOCKFILES = ["bun.lock", "bun.lockb", "pnpm-lock.yaml"];
+var MEDUSA = "@medusajs/";
+var WORKERS = ["wrangler", "@cloudflare/workers-types", "sagaflow-js"];
+var readJson = (at) => {
+  if (!existsSync(at))
+    return;
+  try {
+    return JSON.parse(readFileSync(at, "utf8"));
+  } catch {
+    return;
+  }
+};
+var manifestsIn = (dir) => {
+  const found = [readJson(join(dir, "package.json"))];
+  for (const group of ["apps", "packages"]) {
+    const at = join(dir, group);
+    if (!existsSync(at))
+      continue;
+    for (const entry of readdirSync(at, { withFileTypes: true })) {
+      if (entry.isDirectory())
+        found.push(readJson(join(at, entry.name, "package.json")));
+    }
+  }
+  return found.filter((one) => one !== undefined);
+};
+var dependencyNames = (manifests) => manifests.flatMap((one) => [
+  ...Object.keys(one.dependencies ?? {}),
+  ...Object.keys(one.devDependencies ?? {})
+]);
+var backendOf = (manifests) => {
+  const names = dependencyNames(manifests);
+  if (names.some((one) => one.startsWith(MEDUSA)))
+    return "medusa";
+  if (names.some((one) => WORKERS.includes(one)))
+    return "sagaflow-cf";
+  return "none";
+};
+var chosen = (flag, given, allowed) => {
+  if (given === undefined)
+    return;
+  if (!allowed.includes(given)) {
+    throw new Error(`${flag} "${given}" is not one of ${allowed.join(", ")}`);
+  }
+  return given;
+};
+var uiOf = (dir, given) => {
+  if (given !== undefined)
+    return given;
+  if (!existsSync(join(dir, "packages/ui")))
+    return "none";
+  throw new Error(`${dir} has a packages/ui and no --ui was given — the tier decides which rules the plan proposes, and a directory listing cannot say which tier it is. Name --ui ${UIS.join("|")}.`);
+};
+var doorFor = (block) => `@geonosis/${block}`;
+var KIT_OWNED_BLOCKS = ["ledger", "review", "testbed", "verify", "walk"];
+var planAdoption = ({ backend, dir, presets, runtime, ui }) => {
+  const at = resolve(dir);
+  if (!existsSync(at))
+    throw new Error(`${at} is not there — --plan reads a repo, it never makes one`);
+  const manifests = manifestsIn(at);
+  const chosenRuntime = chosen("--runtime", runtime, ["bun", "pnpm"]) ?? runtimeOf(at);
+  if (chosenRuntime === undefined) {
+    throw new Error(`${at} has none of ${LOCKFILES.join(", ")}, so nothing there says which package manager it runs — name --runtime pnpm|bun.`);
+  }
+  const answers = {
+    backend: chosen("--backend", backend, BACKENDS) ?? backendOf(manifests),
+    dir: at,
+    domains: [],
+    name: basename(at),
+    runtime: chosenRuntime,
+    scope: scopeOf(basename(at)),
+    ui: uiOf(at, chosen("--ui", ui, UIS))
+  };
+  const drift = checkScaffold(answers);
+  const enabled = new Set(Object.keys(readJson(join(at, ".oxlintrc.json"))?.rules ?? {}));
+  const config = readJson(join(at, "geonosis.json")) ?? {};
+  const declaredTiers = config["verify"] ?? {};
+  const declaredCounters = new Set((readJson(join(at, "geonosis.ratchet.json"))?.counters ?? []).map((one) => one.key ?? one.counter ?? ""));
+  const declaredPackages = new Set(dependencyNames(manifests));
+  const { unanswered } = rulesFor(presets);
+  const tiers = tiersFor({
+    rules: {},
+    runtime: chosenRuntime,
+    scripts: Object.keys(readJson(join(at, "package.json"))?.scripts ?? {})
+  });
+  return {
+    backend: answers.backend,
+    counters: countersFor(chosenRuntime, "LAW.md").map((one) => {
+      const key = typeof one["key"] === "string" ? one["key"] : String(one["counter"]);
+      return { declared: declaredCounters.has(key), key };
+    }),
+    dir: at,
+    doors: KIT_OWNED_BLOCKS.map((block) => ({
+      block,
+      declared: declaredPackages.has(doorFor(block)),
+      package: doorFor(block)
+    })),
+    files: drift.filter((one) => one.kind === "missing"),
+    keys: drift.filter((one) => one.kind === "key"),
+    presets: presets.map((name) => {
+      const brings = Object.keys(rulesFor([name]).rules);
+      return {
+        brings: brings.length,
+        enabled: brings.filter((id) => enabled.has(id)),
+        name
+      };
+    }),
+    runtime: chosenRuntime,
+    tiers: Object.entries(tiers).map(([name, steps]) => ({
+      declared: Object.hasOwn(declaredTiers, name),
+      name,
+      steps
+    })),
+    ui: answers.ui,
+    unanswered,
+    unreadable: drift.filter((one) => one.kind === "unreadable")
+  };
+};
+var section = (title, lines) => lines.length === 0 ? [`${title} — none`, ""] : [`${title} (${lines.length})`, ...lines, ""];
+var formatPlan = (plan) => [
+  `adoption plan for ${plan.dir}`,
+  `  runtime ${plan.runtime} · backend ${plan.backend} · ui ${plan.ui}`,
+  "",
+  ...section("FILES the scaffold writes and this repo has none of", plan.files.map((one) => `  ${one.file}`)),
+  ...section("KEYS the scaffold declares inside a file this repo has", plan.keys.map((one) => `  ${one.file} → ${one.at}`)),
+  ...section("RULES the presets bring", plan.presets.map((one) => `  ${one.name}: ${one.brings} rules, ${one.enabled.length} already enabled here`)),
+  ...section("RULES left out until somebody answers their option", plan.unanswered.map(([rule, option]) => `  ${rule} needs \`${option}\``)),
+  ...section("COUNTERS the ratchet would run", plan.counters.map((one) => `  ${one.key}${one.declared ? " — declared" : ""}`)),
+  ...section("TIERS", plan.tiers.map((one) => `  ${one.name}${one.declared ? " — declared" : ""}`)),
+  ...section("DOORS a block needs declared", plan.doors.map((one) => `  ${one.package} for "${one.block}"${one.declared ? " — declared" : ""}`)),
+  ...plan.unreadable.length === 0 ? [] : section("FILES this check could not read as JSON", plan.unreadable.map((one) => `  ${one.file}`))
+].join(`
+`);
+export {
+  ADOPT_USAGE,
+  formatPlan,
+  planAdoption
+};

package/dist/answers.d.ts

@@ -0,0 +1,42 @@
+export declare const RUNTIMES: readonly ['bun', 'pnpm'];
+export declare const BACKENDS: readonly ['medusa', 'none', 'sagaflow-cf'];
+export declare const UIS: readonly ['atoms-only', 'none', 'tiered-shadcn'];
+export type Runtime = (typeof RUNTIMES)[number];
+export type Backend = (typeof BACKENDS)[number];
+export type Ui = (typeof UIS)[number];
+/**
+ * The Medusa the `--backend medusa` scaffold declares.
+ *
+ * MEASURED 2026-09-02: the one Medusa consumer of this kit runs `^2.19.0`. The scaffold turns the
+ * Medusa rules on, and a tree that enables them while declaring no `@medusajs/*` earns nine
+ * `exercised` WARNs — rules with no possible finding, which read exactly like a clean tree (#228).
+ * A range nobody has measured against is worse than none, so this one is the default and
+ * `--medusa <range>` is how a repo on another one says so.
+ */
+export declare const MEDUSA_RANGE = "^2.19.0";
+export declare const MEDUSA_PACKAGES: readonly ['@medusajs/framework', '@medusajs/medusa'];
+export type Answers = {
+    backend: Backend;
+    brand?: string;
+    dir: string;
+    /** The domains this repo composes at its composition root. Empty until the flag names one. */
+    domains: string[];
+    /** The kit read from a workspace instead of the registry — a proof aid, never the default. */
+    kit?: string;
+    marketplace?: string;
+    /** The Medusa range a `--backend medusa` tree declares. `MEDUSA_RANGE` unless one is named. */
+    medusa?: string;
+    name: string;
+    runtime: Runtime;
+    scope: string;
+    themekit?: string;
+    ui: Ui;
+};
+export declare const parseArgs: (argv: readonly string[]) => {
+    flags: Record<string, string>;
+    dir?: string;
+};
+/** A package scope from the repo's own name, lowercased, so `@Pinecone/core` is never written. */
+export declare const scopeOf: (name: string) => string;
+export declare const parseAnswers: (argv: readonly string[], cwd: string) => Answers;
+export declare const wantsInstall: (argv: readonly string[]) => boolean;

package/dist/answers.js

@@ -0,0 +1,111 @@
+// src/answers.ts
+import { basename, resolve } from "node:path";
+import { parseArgs as readArgv } from "node:util";
+import { domainsNamed } from "./composition.js";
+var RUNTIMES = ["bun", "pnpm"];
+var BACKENDS = ["medusa", "none", "sagaflow-cf"];
+var UIS = ["atoms-only", "none", "tiered-shadcn"];
+var MEDUSA_RANGE = "^2.19.0";
+var MEDUSA_PACKAGES = ["@medusajs/framework", "@medusajs/medusa"];
+var VALUED = new Set([
+  "--backend",
+  "--presets",
+  "--brand",
+  "--domains",
+  "--kit",
+  "--marketplace",
+  "--medusa",
+  "--runtime",
+  "--themekit",
+  "--ui"
+]);
+var SWITCHES = new Set(["--check", "--help", "-h", "--no-install", "--plan"]);
+var OPTIONS = Object.fromEntries([
+  ...[...VALUED].map((flag) => [flag.slice(2), { type: "string" }]),
+  ...[...SWITCHES].filter((flag) => flag.startsWith("--")).map((flag) => [
+    flag.slice(2),
+    flag === "--help" ? { short: "h", type: "boolean" } : { type: "boolean" }
+  ])
+]);
+var parseArgs = (argv) => {
+  const { tokens } = readArgv({
+    allowPositionals: true,
+    args: [...argv],
+    options: OPTIONS,
+    strict: false,
+    tokens: true
+  });
+  for (const token of tokens) {
+    if (token.kind === "option" && !(token.name in OPTIONS)) {
+      throw new Error(`${token.rawName} is not an option create-geonosis takes. Run create-geonosis --help for the ones it does.`);
+    }
+  }
+  const { positionals, values } = readArgv({
+    allowPositionals: true,
+    args: [...argv],
+    options: OPTIONS,
+    strict: true
+  });
+  const flags = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (typeof value === "string")
+      flags[`--${name}`] = value;
+    if (value === true)
+      flags[`--${name}`] = "true";
+  }
+  const [dir] = positionals;
+  return { ...dir === undefined ? {} : { dir }, flags };
+};
+var choose = (flag, given, allowed) => {
+  if (given === undefined) {
+    throw new Error(`${flag} is required — it is one of ${allowed.join(", ")}, and never a default`);
+  }
+  const chosen = allowed.find((one) => one === given);
+  if (chosen === undefined) {
+    throw new Error(`${flag} "${given}" is not one of ${allowed.join(", ")}`);
+  }
+  return chosen;
+};
+var scopeOf = (name) => `@${name.toLowerCase().replaceAll(/[^a-z0-9-]/g, "-")}`;
+var domainsFrom = (given) => {
+  const named = (given ?? "").split(",").map((one) => one.trim()).filter((one) => one !== "");
+  domainsNamed(named);
+  return named;
+};
+var parseAnswers = (argv, cwd) => {
+  const { dir, flags } = parseArgs(argv);
+  if (dir === undefined) {
+    throw new Error("create-geonosis needs a directory to write the repo into");
+  }
+  if (flags["--presets"] !== undefined) {
+    throw new Error("--presets is a --plan option: a scaffold takes its presets from --backend and --ui, and would ignore the ones named here");
+  }
+  const name = basename(resolve(cwd, dir));
+  const domains = domainsFrom(flags["--domains"]);
+  return {
+    backend: choose("--backend", flags["--backend"], BACKENDS),
+    ...flags["--brand"] === undefined ? {} : { brand: flags["--brand"] },
+    dir: resolve(cwd, dir),
+    domains,
+    ...flags["--kit"] === undefined ? {} : { kit: resolve(cwd, flags["--kit"]) },
+    ...flags["--marketplace"] === undefined ? {} : { marketplace: flags["--marketplace"] },
+    ...flags["--medusa"] === undefined ? {} : { medusa: flags["--medusa"] },
+    name,
+    runtime: choose("--runtime", flags["--runtime"], RUNTIMES),
+    scope: scopeOf(name),
+    ...flags["--themekit"] === undefined ? {} : { themekit: flags["--themekit"] },
+    ui: choose("--ui", flags["--ui"], UIS)
+  };
+};
+var wantsInstall = (argv) => !argv.includes("--no-install");
+export {
+  BACKENDS,
+  MEDUSA_PACKAGES,
+  MEDUSA_RANGE,
+  RUNTIMES,
+  UIS,
+  parseAnswers,
+  parseArgs,
+  scopeOf,
+  wantsInstall
+};

package/dist/check.d.ts

@@ -0,0 +1,24 @@
+import type { Answers } from './answers.js';
+/**
+ * What an existing repo never receives: whatever the scaffold has learned since it was run.
+ *
+ * The comparison is over SHAPE and not over content, because a repo that has been worked in has
+ * legitimately rewritten every file the scaffold gave it. What it cannot have legitimately done is
+ * lose a file the scaffold now writes, or miss a declaration a new gate reads — so a missing path is
+ * drift and a changed value never is.
+ */
+export type DriftKind = 'key' | 'missing' | 'unreadable';
+export type Drift = {
+    /** The key path inside the file, or `''` when the fact is about the whole file. */
+    at: string;
+    file: string;
+    kind: DriftKind;
+};
+/**
+ * The drift between a tree and what the scaffold would write into it today. Reads only.
+ *
+ * Nothing in this module opens a file for writing, and nothing calls `writeScaffold`. That is the
+ * whole contract of `--check`: it is run against a repo somebody is working in.
+ */
+export declare const checkScaffold: (answers: Answers) => Drift[];
+export declare const describeDrift: (drift: readonly Drift[]) => string[];

package/dist/check.js

@@ -0,0 +1,62 @@
+// src/check.ts
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PLATFORM_FILE } from "./composition.js";
+import { filesFor } from "./files.js";
+import { workspacesOf } from "./layout.js";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var pathsIn = (value, prefix = "") => {
+  if (!isRecord(value))
+    return [];
+  return Object.entries(value).flatMap(([key, child]) => {
+    const here = prefix === "" ? key : `${prefix}.${key}`;
+    return [here, ...pathsIn(child, here)];
+  });
+};
+var parsed = (body) => {
+  try {
+    const value = JSON.parse(body);
+    return isRecord(value) ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var missingPaths = (want, has) => {
+  const held = new Set(pathsIn(has));
+  return pathsIn(want).filter((path) => !held.has(path));
+};
+var isCompositionRoot = (file) => file.endsWith(`/${PLATFORM_FILE}`);
+var checkScaffold = (answers) => {
+  const drift = [];
+  const seeded = workspacesOf(answers).map((one) => `${one.dir}/`);
+  for (const [file, body] of Object.entries(filesFor(answers))) {
+    if (!isCompositionRoot(file) && seeded.some((prefix) => file.startsWith(prefix)))
+      continue;
+    const at = join(answers.dir, file);
+    if (!existsSync(at)) {
+      drift.push({ at: "", file, kind: "missing" });
+      continue;
+    }
+    const want = parsed(body);
+    if (want === undefined)
+      continue;
+    const has = parsed(readFileSync(at, "utf8"));
+    if (has === undefined) {
+      drift.push({ at: "", file, kind: "unreadable" });
+      continue;
+    }
+    for (const path of missingPaths(want, has))
+      drift.push({ at: path, file, kind: "key" });
+  }
+  return drift;
+};
+var SAID = {
+  key: (one) => `${one.file} → ${one.at} — the scaffold writes this key and your file has none`,
+  missing: (one) => `${one.file} — the scaffold writes this file and your repo has none`,
+  unreadable: (one) => `${one.file} — the scaffold writes plain JSON here and yours is not (comments? trailing commas?), so this check could not read its keys`
+};
+var describeDrift = (drift) => drift.map((one) => SAID[one.kind](one));
+export {
+  checkScaffold,
+  describeDrift
+};