create-geonosis 2.3.1 → 2.4.3

package/CHANGELOG.md

@@ -0,0 +1,290 @@
+# create-geonosis
+
+## 2.4.3
+
+### Patch Changes
+
+- @geonosis/cli@2.4.3
+
+## 2.4.2
+
+### Patch Changes
+
+- @geonosis/cli@2.4.2
+
+## 2.4.1
+
+### Patch Changes
+
+- @geonosis/cli@2.4.1
+
+## 2.4.0
+
+### Patch Changes
+
+- Updated dependencies [4962ed6]
+- Updated dependencies [bef73fb]
+  - @geonosis/cli@2.4.0
+
+## 2.3.1
+
+### Patch Changes
+
+- @geonosis/cli@2.3.1
+
+## 2.3.0
+
+### Minor Changes
+
+- 3dac9a7: **`create-geonosis --plan <dir>` (#92, #98).** The hand-written adoption brief becomes a computed
+  report over the tree it is about: the files and keys `--check` reads as missing, the rules each
+  preset brings against the ones already enabled, the rules left out until somebody answers their
+  option, the counters, the tiers and the doors a block needs declared. Runtime and backend are read
+  off the lockfile and the manifests; a `packages/ui` with no `--ui` is refused rather than guessed,
+  because the tier decides which half of the rule set the plan proposes. Writes nothing.
+- 3dac9a7: **A typecheck step that has been watched failing (#296).** The first step of every fast tier — the
+  kit's own and every scaffolded repo's — declared no plant, so it read `PASS (unproven)` for ever and
+  nobody asked which step for a week. A scaffolded tier now plants a type error into a workspace
+  `src/` and requires `TS2322`: unlike a lint rule it needs no preset, no option and no engine, so it
+  holds on any repo.
+  
+  The scaffolded ratchet also gains one `testFailures` counter per workspace, running that
+  workspace's own test script and reading the report that script writes — the reports the scaffold
+  was already writing and nothing was reading.
+
+### Patch Changes
+
+- 3dac9a7: `rulesFor` writes an answer for any rule the presets bring, not only for one that would refuse without it — an inert default is still a default the scaffold owns (D-031). The scaffold hands `no-runtime-dead-affordance` the same element→atom map it gives `no-raw-html-atoms`; the doctor over a scaffolded tree stops answering UNJUDGED for a control no probe could render.
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+- Updated dependencies [3dac9a7]
+  - @geonosis/cli@2.3.0
+
+## 2.2.0
+
+### Minor Changes
+
+- d15a654: **The scaffold installs its hooks, and a worktree does not fail the install (#271).** The scaffold
+  shipped `lefthook` and a `lefthook.yml` and nothing that installed the hooks — measured: the root
+  manifest declared no `prepare` at all. It writes one now, `scripts/install-hooks.mjs`, built for the
+  tree every Opus agent works in: a worktree's `.git` is a FILE and `git rev-parse --git-common-dir`
+  answers with the ORIGINAL checkout's, so hooks installed from inside a worktree land in the tree
+  somebody else is in. The installer skips there with the sentence saying where to install them
+  instead, says so when lefthook is not on disk yet, and never fails the install that ran it.
+- d15a654: **A `--backend medusa` scaffold declares the engine its rules presume (#228, decided).** The scaffold
+  turned the Medusa rules on over a tree that declared no `@medusajs/*` anywhere, so the doctor's
+  `exercised` check WARNed nine times out of the box — nine rules with no possible finding, which read
+  exactly like a clean tree. The backend workspace now declares `@medusajs/framework` and
+  `@medusajs/medusa` at `^2.19.0`, the version the one Medusa consumer of this kit runs (measured
+  2026-09-02), and `--medusa <range>` is how a repo on another one says so. `--kit` no longer drops a
+  workspace's third-party declarations along with the kit's own floors: an engine dropped there is an
+  engine the doctor cannot find. The scaffolded-doctor gate holds the Medusa shape at zero WARNs.
+
+### Patch Changes
+
+- Updated dependencies [d15a654]
+- Updated dependencies [d15a654]
+- Updated dependencies [d15a654]
+- Updated dependencies [d15a654]
+  - @geonosis/cli@2.2.0
+
+## 2.1.0
+
+### Patch Changes
+
+- e0da9a3: **D-060 made mechanical, and the sweep it found (#220).** A published README or dist comment may name a consumer as the SOURCE of a pattern — that is attribution of the user's own products — and may not describe what is inside one. `tooling/provenance.ts` reads every publishable package's README and `dist/`, and fails on a consumer's name followed within the sentence by an internals noun (table, plane, column, schema, migration, incident, outage, postmortem, `apps/`, `packages/`) with no provenance phrase between them; the consumer names come from `geonosis.json`'s declared smoke snapshots, never from a list of its own — the kit's `no-brand-names` rule refuses a brand written into this repo, so a name enters that vocabulary only by being declared a consumer. It found nineteen sentences across nine packages — their file paths, their table and selector names, their line counts, their incident — and every one is reworded rather than stripped of its attribution.
+- 849f72e: **A scaffolded tree earns no WARN of its own (#215).** `create-geonosis` and `geonosis init` left six out of the box, and a scaffold whose own doctor is dirty teaches every repo it makes that a WARN is scenery. The root now declares a `prove` script and the `full` tier names it when the root has one, so the counters are proved rather than only compared; `sync:graph` names the ledger bin the scaffold already runs, from the same one list `finish` runs it from; and `--kit` declares at the root exactly what a registry install would, instead of every package it linked so the bins resolve. Two of the six were the doctor contradicting itself: a `jsPlugins` entry is a caller with no bin to call — pnpm 11.8.0 resolves only DIRECT dependencies from a directory, so dropping that declaration is how a root config stops linting — and a `geonosis.json` block whose reader the declared door brings is read by something, which is the shape #177 asks a root to have.
+- Updated dependencies [c1f894d]
+- Updated dependencies [849f72e]
+- Updated dependencies [f252d95]
+- Updated dependencies [511b449]
+- Updated dependencies [c54d6a9]
+  - @geonosis/cli@2.1.0
+
+## 2.0.0
+
+### Minor Changes
+
+- 233b21d: `create-geonosis <dir> --check` says what an existing repo is missing of what the scaffold writes
+  today — files it never had and keys inside the JSON it has — and writes nothing. Contents and
+  values are never compared, and the sample workspaces are out of the question.
+- e9a41a7: **One scaffold source, two doors (#198).** `geonosis init` and `create-geonosis` each built the
+  `verify` tiers from their own literals, so a repo's gates depended on which command had made it: one
+  door planted the lint proof and skipped the formatter, the other did the reverse. Both now write
+  from `tiersFor` in `@geonosis/cli`, and `build` / `format:check` are named only when the root
+  declares that script — `pnpm build` in a `create-geonosis` tree exits 1 with "Command build not
+  found". `tooling/one-scaffold-source.test.ts` runs both doors over one tree and reads the tiers back
+  through verify's own reader.
+- 55fd4e3: **`--domains <a,b>` writes the composition root.** The app workspace gets `src/platform.ts` in the
+  two lifetimes it has: `definitionsOf` once per isolate — the emit door with `source` spelled ONCE
+  from runtime config (D-057) and the `@geonosis/db` session seam — and `inScope` per request, where
+  the tenant transaction opens FIRST and every domain store is built inside it, so a store that could
+  run outside the session that named its tenant does not exist to be held (D-014, structural). The
+  domains it takes are the ones the kit ships (`search` today); a name nothing publishes is refused
+  before a file is written. `--kit` links the floors too, and repoints the declaring workspace's
+  manifest rather than only the root's. `tooling/scaffolded-platform.test.ts` typechecks the generated
+  file in a scratch consumer with the workspace linked, through the real `tsc`.
+
+### Patch Changes
+
+- 9c80a99: **`--check` sees the composition root.** Every file under a seeded workspace is skipped, because
+  `packages/core/src/money.ts` is a sample a repo is entitled to have thrown away. The composition
+  root is not: it is what `--domains` was asked for, and the file the doctor's uncomposed-battery line
+  sends a repo to write. A repo that asked for a domain and has no `src/platform.ts` is now named,
+  with the seeded sample beside it still out of the question.
+- Updated dependencies [bcf0788]
+- Updated dependencies [38889b1]
+- Updated dependencies [35502e0]
+- Updated dependencies [e9a41a7]
+- Updated dependencies [539a96c]
+- Updated dependencies [3258f5f]
+- Updated dependencies [ccfc3c3]
+- Updated dependencies [533f24d]
+- Updated dependencies [6d14aa2]
+  - @geonosis/cli@2.0.0
+
+## 1.4.0
+
+### Patch Changes
+
+- @geonosis/cli@1.4.0
+
+## 1.3.0
+
+### Minor Changes
+
+- 2d1d841: **An unknown flag became `true` and vanished (#66).** Anything starting with `--` outside the valued
+  set was recorded as a switch nobody reads, so a misspelled `--runtim pnpm` refused with "--runtime is
+  required" and never named the typo. A flag in neither the valued set nor the switch set is now
+  refused by name, pointing at `--help`.
+  
+  **It also answers `--print-config-shape` (#75)**, naming the files it writes and where to ask for each shape.
+
+### Patch Changes
+
+- c340de0: **`drift`: a geonosis bin a git hook cannot start (#106).** dielime's first hooked commit was
+  "refused" on 2026-08-30 and the ledger never ran: a git hook's PATH is not the shell's — no nvm
+  shim, no corepack shim — so `pnpm` was not FOUND, and the sentence its author read was a version
+  manager's failure wearing a gate's refusal costume. That is the worst shape a gate has, because it
+  is indistinguishable from the gate working. The fix was one word: call
+  `./node_modules/.bin/geonosis-ledger` directly.
+  
+  Every committed hook — `lefthook.yml`, `.husky/*`, `.githooks/*` — is now read, and a line running a
+  geonosis bin through `pnpm`, `npx`, `bunx` or `yarn` is a FAIL naming the direct call that replaces
+  it. A hook file naming no geonosis bin is a SKIP with the sentence, never a vacuous OK.
+  
+  **And the hook `create-geonosis` writes follows its own rule.** It wrote `npx oxfmt` / `bunx oxlint`
+  into the `lefthook.yml` it scaffolds — the same shape, printed by the kit, into the file where it
+  breaks. Both lines are now `node_modules/.bin/…`, with the reason in a comment above them.
+- Updated dependencies [0a7673c]
+  - @geonosis/cli@1.3.0
+
+## 1.2.0
+
+### Patch Changes
+
+- @geonosis/cli@1.2.0
+
+## 1.1.0
+
+### Patch Changes
+
+- Updated dependencies [7fca7b6]
+- Updated dependencies [749239a]
+  - @geonosis/cli@1.1.0
+
+## 1.0.1
+
+### Patch Changes
+
+- 1c2ee0b: **Every package ships its declarations and says where they are.** `@geonosis/visual-diff` and
+  `@geonosis/verify` emitted no `.d.ts` at all (TS7016 in a consumer: the comparator every visual test
+  calls became `any` at the one seam that decides whether a screenshot regressed), and no package
+  declared `types` — the nineteen that worked did so through the sibling-file fallback, which ends the
+  day `exports` gains a condition. Every export now carries a `types` condition beside `default`, every
+  manifest a `types` field, and `tooling/types.test.ts` holds all twenty-one to it after the build.
+  
+  `geonosis-verify-arch` prints a check once when its label is its id ("direction, orphan", not
+  "direction direction").
+- Updated dependencies [1c2ee0b]
+- Updated dependencies [7dcae6a]
+  - @geonosis/cli@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- 75f613e: **`create-geonosis` — a third repo that passes its own gates on day one.** `create-geonosis <dir>
+  --runtime pnpm|bun --backend medusa|sagaflow-cf|none --ui tiered-shadcn|atoms-only|none` writes a
+  workspace with one catalog of shared versions, an `exports` map and no barrel in every package,
+  `typecheck` + `lint` + `test` in EVERY workspace (each asking vitest for its own JSON report), a law
+  under sixty lines, the five config files, a lefthook, a CI workflow with nothing switched off in it,
+  an empty skills lock and a `.claude/settings.json` that installs the plugin.
+  
+  There is no default for the three answers that decide the shape of the tree. A default borrowed from
+  dielime or during.day would be one repo's stack hardcoded into every repo this ever writes.
+  
+  - **The edges table is the one place the graph is written.** `docs/architecture.md` carries it, and
+    the scaffold runs `geonosis-ledger sync --target turbo` and `--target layer-walls` over it, so
+    turbo's boundaries and the linter's layers are generated from the same table and cannot drift.
+  - **The baseline starts at zero, except where zero would be a lie**: `lawLineCount` starts at the
+    measured length of the `CLAUDE.md` just written.
+  - **`lint-corpus/`** is a reach corpus in the new repo's own vocabulary, for the three rules whose
+    reach is repo-specific — `layer-walls`, `no-brand-names`, `plugin-route-namespaced` — because the
+    plugin's shipped corpus says `acme` and `layers/core` and is no evidence about anybody else.
+  
+  `@geonosis/cli`'s `rulesFor` now takes a map of pre-built rule options instead of a brand, so `init`
+  and the scaffold answer the same question in one place. The plugin gains a `create` layer, walled
+  against every gate it configures; planted in `dogfood.test.ts`.
+- f60a869: **The six defects the 1.0.0 reviews filed, before the release: two of them about being installable
+  at all, three about refusing honestly, one about counting a finding twice.**
+  
+  `geonosis-review` read its command line OUTSIDE `main`'s try, so `--definitely-not-a-flag` reached
+  node uncaught: a stack trace and exit **1** — the one code the contract reserves for "the review was
+  read and REFUSED", so a caller branching on the code read a typo as a rejection. Parsing happens
+  inside now, every command-line mistake is 2 on one line, and the README's exit codes are a table
+  that says which is which (#50).
+  
+  `@geonosis/testbed`'s `bin` named `dist/cli.js`, the only bin in the kit that pointed at a build
+  output. `pnpm install` links bins BEFORE anything is built, so a fresh clone printed
+  `Failed to create bin … ENOENT` and had no `geonosis-testbed` — including the copy `@geonosis/cli`
+  spawns for its `testbed` door. It has a committed `bin/geonosis-testbed.mjs` shim like every other
+  package, and `tooling/bins.test.ts` holds every `bin` entry to a file git carries (#51).
+  
+  Two shims — `create-geonosis` and `geonosis-mcp` — were **committed at mode 644**. pnpm sets the
+  executable bit on the link it creates, so the mode was right everywhere except where it is kept, and
+  the flip only ever surfaced as an unrelated diff in somebody else's commit. Both are 755, and the
+  test reads the mode **git records**, which is the mode a clone gets (#52). Measured on this base:
+  `doctor` and `verify-arch`, the two the review named, were already executable.
+  
+  `geonosis-testbed matrix` crashed on a malformed `testbed.matrix`: a block spelling `majors` as
+  `postgres` reached the renderer, which read `.length` off `undefined` — a TypeError at exit 1 for a
+  config error one line long. `readDbMatrix` checks the block first and refuses with **2**, naming
+  every wrong key at once (a missing one and an unknown one are two findings, and being told one at a
+  time means editing the file twice). Hand-rolled, not Zod: this package has no runtime dependencies
+  and a test that keeps it that way (#45).
+  
+  `no-mock-db-in-integration` reported an imported handle **twice at one position**: an
+  ImportSpecifier's `imported` and its `local` are two nodes over the same span when nothing is
+  renamed. One report per place now — the corpus carries the fixture that shows it, and a finding
+  counted twice is a finding a ratchet counter banks twice (#46).
+  
+  `geonosis-ledger sync --write` refused a config that did not already carry the fragment
+  (`"boundaries": no such key`), so the command whose job is to write the config could not write the
+  first one and hand-authoring the generated shape was the way in. It creates the key now — in a
+  `turbo.json` with no `boundaries`, in a config that has never named `layer-walls`, in a package with
+  no `no-restricted-imports`, and the `rules` object itself if that is missing too — and still writes
+  only that fragment. A rule is grown as `["error", { … }]`, the severity being the one thing no
+  generator can read off the table (#34).
+
+### Patch Changes
+
+- Updated dependencies [88d7bf6]
+- Updated dependencies [75f613e]
+- Updated dependencies [40cc71c]
+  - @geonosis/cli@1.0.0

package/bin/create-geonosis.mjs

@@ -17,11 +17,25 @@ const newest = (dir) =>
       }, 0)
     : 0
 const src = join(here, '..', 'src')
-if (existsSync(src) && newest(src) > newest(join(here, '..', 'dist'))) {
-  process.stderr.write(
-    'create-geonosis: dist is older than src — run pnpm build before trusting this bin.\n',
-  )
-  process.exit(2)
+const dist = join(here, '..', 'dist')
+// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
+// two conditions were one comparison and one sentence — and the staleness sentence was printed
+// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
+// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
+if (existsSync(src)) {
+  const built = newest(dist)
+  if (built === 0) {
+    process.stderr.write(
+      'create-geonosis: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n',
+    )
+    process.exit(2)
+  }
+  if (newest(src) > built) {
+    process.stderr.write(
+      'create-geonosis: dist is older than src — run pnpm build before trusting this bin.\n',
+    )
+    process.exit(2)
+  }
 }
 
 await import('../dist/create-geonosis-cli.js')

package/dist/{chunk-CT3CTASI.js → chunk-PQVSQ44M.js}

@@ -24,12 +24,25 @@ var SEARCH = {
     "import { pgFtsSearchIndex, type SearchIndex, type SearchProjections } from '@geonosis/search'"
   ],
   name: "@geonosis/search",
-  version: "0.3.5"
+  version: "0.3.6"
 };
-var DOMAINS = [SEARCH];
+var DOCUMENT = {
+  at: "domains/document",
+  built: ["      document: DOCUMENT_ENTITIES,"],
+  declarations: [
+    "/** Every `Document.extend` this repo declares, by the name its rows carry \u2014 grow this map. */",
+    "const DOCUMENT_ENTITIES = documentEntities({})"
+  ],
+  field: "document",
+  fieldType: "ReturnType<typeof documentEntities>",
+  imports: ["import { documentEntities } from '@geonosis/document'"],
+  name: "@geonosis/document",
+  version: "0.1.0"
+};
+var DOMAINS = [SEARCH, DOCUMENT];
 var DOMAIN_NAMES = DOMAINS.map((one) => one.field);
 var FOUNDATIONS = [
-  { at: "foundations/db", name: "@geonosis/db", version: "0.6.0" },
+  { at: "foundations/db", name: "@geonosis/db", version: "0.7.0" },
   { at: "foundations/events", name: "@geonosis/events", version: "2.1.0" }
 ];
 var domainsNamed = (named) => named.map((one) => {
@@ -408,7 +421,7 @@ var workspacesOf = (answers) => {
 
 // src/files.ts
 import { countersFor, LAW_SOURCE, rulesFor, tiersFor } from "@geonosis/cli";
-var VERSION = "2.3.1";
+var VERSION = "2.4.3";
 var SCHEMA = "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json";
 var CATALOG = {
   "@types/node": "^24.3.0",

package/dist/create-geonosis-cli.js

@@ -11,7 +11,7 @@ import {
   parseArgs,
   wantsInstall,
   writeScaffold
-} from "./chunk-CT3CTASI.js";
+} from "./chunk-PQVSQ44M.js";
 
 // src/create-geonosis-cli.ts
 import { existsSync as existsSync2 } from "fs";

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   wantsInstall,
   workspacesOf,
   writeScaffold
-} from "./chunk-CT3CTASI.js";
+} from "./chunk-PQVSQ44M.js";
 export {
   BACKENDS,
   CORPUS_DIR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-geonosis",
-  "version": "2.3.1",
+  "version": "2.4.3",
   "types": "./dist/index.d.ts",
   "description": "Scaffold a microcompany repo that passes its own geonosis gates on day one.",
   "keywords": [
@@ -30,11 +30,12 @@
     }
   },
   "files": [
+    "CHANGELOG.md",
     "bin",
     "dist"
   ],
   "dependencies": {
-    "@geonosis/cli": "2.3.1"
+    "@geonosis/cli": "2.4.3"
   },
   "engines": {
     "node": ">=22"