create-keboola-app 0.1.1 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # create-keboola-app
 
+## 0.2.1
+
+### Patch Changes
+
+- Internal code satisfies the `anti-slop` lint rules; public APIs and behaviour are unchanged.
+
+  - `Reflect.get`, parameters typed `object` and accumulator-copying reducers give way to narrowing, precise types, `filter` and `flatMap`.
+  - `@keboola/api-client` keeps its `as unknown as` bridges from OpenAPI to domain types.
+
+- Scaffolded apps get route trees from `@tanstack/router-generator` 1.167.46, the generator of the TanStack Router 1.170.46 line.
+
+## 0.2.0
+
+### Minor Changes
+
+- New `auth` block: a generated app can now arrive with its signed-out screen already built.
+
+  Four apps in the platform hand-build the same pre-auth screen, and a Storybook pattern does not
+  stop a fifth from doing it again — new apps come from this generator, so that is where the screen
+  has to arrive. Pick `auth` and the app gets `/signed-out`, rendered without the app chrome: brand
+  lockup from `BrandLogo`, one centred card, a colour-scheme control, correct landmarks and heading
+  level, and the four pre-project states — signed out, restoring, expired, service unreachable —
+  under one piece of chrome, so the common path does not jump when one replaces another. The
+  emitted `gate:ui` scores that route as well as `/`.
+
+  The block is the screen and nothing behind it: no dependency, no network. Only the app knows what
+  it authenticates against, so wiring it up is two edits — the form's `onSubmit`, and where the
+  state comes from instead of the `?state=` search param. `--blocks none` still yields an app that
+  builds, type-checks and passes its own gate.
+
+  A routed block now brings the whole brief for its own route rather than a shared suffix. The
+  suffix described a searchable table, which graded a signed-out screen against qualities it is
+  supposed not to have.
+
+- A generated app keeps `src/routes/` for route files. Everything else — hooks, fixtures, types, a
+  module's rail entry — arrives in a domain directory beside it.
+
+  TanStack Router excludes a file from the route tree when its name starts with `-`, and the
+  emitted layout leaned on that to keep a module's code inside its route folder. It does not scale:
+  one app grew to six route files and fifty-four dashed ones, and route folders that own domain code
+  end up importing across each other, which is the coupling the co-location was meant to prevent. A
+  marker on nine files out of ten marks nothing.
+
+  So the crud block now emits `routes/<kebab>/{index,new,$id}.tsx` and `<kebab>/{hooks,fixtures,
+types,nav}.ts`, and the overview's hooks and fixtures sit at `src/overview-*.ts`. Nothing emitted
+  carries the `-` prefix.
+
+  A route's test is the one thing that stays with its route, because that is the file it exercises.
+  It exports no `Route`, so the emitted `vite.config.ts` declares
+  `routeFileIgnorePattern: '\\.test\\.tsx?$'`. Without it the generator prints a
+  `does not export a Route` warning for every such file on every build, which is what makes the
+  prefix feel obligatory in the first place. The CLI passes the same pattern when it writes the
+  first `routeTree.gen.ts`, which happens before the app has a Vite build to read the config from.
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -25,22 +25,27 @@ npm create keboola-app -- --name my-app --blocks kpi,grid --yes --json
 
 ## Blocks
 
-| Block       | What you get                                                                           |
-| ----------- | -------------------------------------------------------------------------------------- |
-| `kpi`       | A KPI card row on the overview.                                                        |
-| `chart`     | A token-themed line chart card on the overview.                                        |
-| `grid`      | An editable per-row budget grid (TanStack Table + design `Table`).                     |
-| `crud`      | A list → detail → form slice over `/tokens`, exercising router params, Query and Form. |
-| `assistant` | A docked assistant rail, a page composer and an explain-on-selection floater.          |
+| Block       | What you get                                                                              |
+| ----------- | ----------------------------------------------------------------------------------------- |
+| `kpi`       | A KPI card row on the overview.                                                           |
+| `chart`     | A token-themed line chart card on the overview.                                           |
+| `grid`      | An editable per-row budget grid (TanStack Table + design `Table`).                        |
+| `crud`      | A list → detail → form slice over `/tokens`, exercising router params, Query and Form.    |
+| `assistant` | A docked assistant rail, a page composer and an explain-on-selection floater.             |
+| `auth`      | A signed-out screen at `/signed-out`, with the restoring, expired and unreachable states. |
 
 Every block is independent — none imports another, so any combination compiles. Blocks are
 additive: pick what you need rather than taking everything and deleting, since an unpicked
 block costs no files and pulls none of its npm dependencies.
 
-Blocks join the shell through three files the generator writes rather than patches:
-`src/nav.ts` (the nav tuple), `src/overview-sections.tsx` (the ordered section registry) and
-`src/store.ts` (the shell slice plus the selected block slices). Add a section to a generated
-app by editing those, not the app chrome.
+Blocks join the shell through four files the generator writes rather than patches: `src/nav.ts`
+(the nav tuple), `src/overview-sections.tsx` (the ordered section registry), `src/store.ts` (the
+shell slice plus the selected block slices) and `src/routes/__root.tsx` (whether a route gets the
+app chrome). Add a section to a generated app by editing those, not the app chrome.
+
+`auth` is the screen and nothing behind it. It renders with no dependency and reaches no network,
+because only your app knows what it authenticates against — swap the form's `onSubmit` and pick
+the state from your session instead of from the `?state=` search param.
 
 ## Naming
 

package/dist/{blocks-DYU5Ke29.js → blocks-BdJaEmz1.js}

@@ -1,10 +1,11 @@
-//#region src/blocks.ts
+// src/blocks.ts
 const BLOCK_IDS = [
 	"kpi",
 	"chart",
 	"grid",
 	"crud",
-	"assistant"
+	"assistant",
+	"auth"
 ];
 const isBlockId = (value) => BLOCK_IDS.includes(value);
 const BLOCKS = {
@@ -55,19 +56,19 @@ const BLOCKS = {
 		label: "CRUD slice",
 		summary: "List → detail → form over `/tokens`: router params, Query and Form in one flow.",
 		files: [
-			"src/routes/tokens/-fixtures.test.ts",
-			"src/routes/tokens/-fixtures.ts",
-			"src/routes/tokens/-hooks.ts",
-			"src/routes/tokens/-index.test.tsx",
-			"src/routes/tokens/-nav.ts",
-			"src/routes/tokens/-types.ts",
 			"src/routes/tokens/$id.tsx",
+			"src/routes/tokens/index.test.tsx",
 			"src/routes/tokens/index.tsx",
-			"src/routes/tokens/new.tsx"
+			"src/routes/tokens/new.tsx",
+			"src/tokens/fixtures.test.ts",
+			"src/tokens/fixtures.ts",
+			"src/tokens/hooks.ts",
+			"src/tokens/nav.ts",
+			"src/tokens/types.ts"
 		],
 		deps: ["@tanstack/react-form", "zod"],
 		glue: ["src/nav.ts"],
-		brief: "a list page reachable from the rail",
+		brief: "tokens list page: on-brand @keboola/design shell, a searchable table of API tokens, no runtime or a11y errors",
 		route: "/tokens"
 	},
 	assistant: {
@@ -87,6 +88,24 @@ const BLOCKS = {
 		glue: ["src/store.ts"],
 		brief: "a prompt input and a docked assistant rail",
 		route: null
+	},
+	auth: {
+		id: "auth",
+		label: "Signed-out screen",
+		summary: "The pre-project screen: brand lockup, one centred card, and the signed-out, restoring, expired and unreachable states.",
+		files: [
+			"src/auth/AuthScreen.test.tsx",
+			"src/auth/AuthScreen.tsx",
+			"src/auth/session.test.tsx",
+			"src/auth/session.ts",
+			"src/auth/states.tsx",
+			"src/routes/signed-out.test.tsx",
+			"src/routes/signed-out.tsx"
+		],
+		deps: [],
+		glue: ["src/routes/__root.tsx"],
+		brief: "signed-out screen: a brand lockup over one centred sign-in card on a muted page, no navigation rail and no breadcrumb, a colour-scheme control in the corner, no runtime or a11y errors",
+		route: "/signed-out"
 	}
 };
 /** Files every emitted app carries, whatever the selection. */
@@ -103,12 +122,12 @@ const SHELL_FILES = [
 	"src/main.tsx",
 	"src/nav.test.ts",
 	"src/nav.ts",
+	"src/overview-fixtures.ts",
+	"src/overview-hooks.ts",
 	"src/overview-sections.test.tsx",
 	"src/overview-sections.tsx",
-	"src/routes/-fixtures.ts",
-	"src/routes/-hooks.ts",
-	"src/routes/-index.test.tsx",
 	"src/routes/__root.tsx",
+	"src/routes/index.test.tsx",
 	"src/routes/index.tsx",
 	"src/slices/shell.ts",
 	"src/store.test.tsx",
@@ -125,13 +144,11 @@ const SHELL_FILES = [
 	"vitest.config.ts"
 ];
 /**
-* Tracked boilerplate files the template deliberately does not carry.
+* Tracked boilerplate files the template does not carry.
 *
-* - `AGENTS.md`, `README.md`, `.gitignore` — replaced by this package's `templates/`, because
-*   the boilerplate's versions point at monorepo paths.
-* - `turbo.json` — there is no turbo outside the monorepo.
-* - `src/routeTree.gen.ts` — regenerated per selection by the CLI; the committed one lists
-*   routes a shell-only app does not have.
+* - `AGENTS.md`, `README.md`, `.gitignore`: replaced by `templates/` (the originals cite monorepo paths).
+* - `turbo.json`: no turbo outside the monorepo.
+* - `src/routeTree.gen.ts`: regenerated per selection by the CLI.
 */
 const NOT_IN_TEMPLATE = [
 	".gitignore",
@@ -143,5 +160,4 @@ const NOT_IN_TEMPLATE = [
 const OWNER = new Map([...SHELL_FILES.map((file) => [file, "shell"]), ...BLOCK_IDS.flatMap((id) => BLOCKS[id].files.map((file) => [file, id]))]);
 /** The block that owns `path`, `'shell'`, or `null` when nothing claims it. */
 const ownerOf = (path) => NOT_IN_TEMPLATE.includes(path) ? "shell" : OWNER.get(path) ?? null;
-//#endregion
 export { isBlockId as a, SHELL_FILES as i, BLOCK_IDS as n, ownerOf as o, NOT_IN_TEMPLATE as r, BLOCKS as t };

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { a as isBlockId, n as BLOCK_IDS, o as ownerOf, t as BLOCKS } from "./blocks-DYU5Ke29.js";
-import { a as substitute, i as renderRegions, n as assertNoMarkers, r as blockIdOf } from "./regions-B3r5LhXl.js";
+import { a as isBlockId, n as BLOCK_IDS, o as ownerOf, t as BLOCKS } from "./blocks-BdJaEmz1.js";
+import { a as substitute, i as renderRegions, n as assertNoMarkers, o as isRecord, r as blockIdOf } from "./regions-BNl4QsPP.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { argv, cwd, exit, stderr, stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-//#region src/args.ts
+// src/args.ts
 /**
 * Accepted app names: kebab-case, starting with a letter, not ending in `-`.
 *
@@ -113,8 +113,7 @@ const parseArgs = (argv) => {
 		options
 	};
 };
-//#endregion
-//#region src/scaffold.ts
+// src/scaffold.ts
 /** Template files that describe the template rather than belong to the app. */
 const TEMPLATE_METADATA = /* @__PURE__ */ new Set(["workspace-deps.json", "package.json"]);
 /** Files this package's `templates/` contributes, which the boilerplate manifest does not claim. */
@@ -130,11 +129,8 @@ const evalCommand = (route, brief) => `npx --yes @keboola/ui-gen-bench eval --se
 /**
 * The emitted `gate:ui` script: one `ui-gen-bench eval` per scored route.
 *
-* - The overview's brief names the blocks that are actually on the page, because the score's
-*   brief-conformance axis marks down a page for missing what the brief promises.
-* - A block with a `route` adds a second invocation for it.
-* - Not wired into `test`: it needs a model key, and a first run that fails on a missing
-*   credential is a worse welcome than an opt-in gate.
+* - Each brief names only its route's blocks: the brief-conformance axis grades against it.
+* - Not wired into `test`: it needs a model key.
 */
 const gateUiScript = (appTitle, blocks) => {
 	const clauses = blocks.filter((id) => BLOCKS[id].route === null).map((id) => BLOCKS[id].brief);
@@ -143,7 +139,7 @@ const gateUiScript = (appTitle, blocks) => {
 		...clauses,
 		"no runtime or a11y errors"
 	].join(", ");
-	const extras = blocks.filter((id) => BLOCKS[id].route !== null).map((id) => evalCommand(BLOCKS[id].route ?? "/", `${appTitle} ${BLOCKS[id].brief}: on-brand @keboola/design shell, searchable table, no runtime or a11y errors`));
+	const extras = blocks.filter((id) => BLOCKS[id].route !== null).map((id) => evalCommand(BLOCKS[id].route ?? "/", `${appTitle} ${BLOCKS[id].brief}`));
 	return [evalCommand("/", overview), ...extras].join(" && ");
 };
 const walk = (root, dir, out) => {
@@ -156,11 +152,7 @@ const walk = (root, dir, out) => {
 /**
 * `_gitignore` → `.gitignore`: npm strips a real `.gitignore` out of every tarball.
 *
-* - Applied only to `TEMPLATE_DOCS`, the files this package's `templates/` contributes. The
-*   rule exists for them and nothing else.
-* - Not a bare "basename starts with `_`" rule: TanStack's root route is `src/routes/__root.tsx`,
-*   which such a rule renames to `.root.tsx` — the route tree then has no root and the emitted
-*   app fails to generate one.
+* - `TEMPLATE_DOCS` only: a bare leading-`_` rule would rename `src/routes/__root.tsx`.
 */
 const outputPath = (file) => {
 	const name = basename(file);
@@ -199,10 +191,8 @@ const writeManifest = (opts) => {
 /**
 * `pnpm-workspace.yaml` for a standalone app.
 *
-* - It is the only file pnpm 11 reads `overrides` from; the `pnpm` field in `package.json` is
-*   ignored with a warning.
-* - Written only outside a monorepo. Under `--workspace` the app inherits the root's file, and a
-*   nested one would declare a second workspace root inside the first.
+* - pnpm 11 reads `overrides` only from it.
+* - Skipped under `--workspace`: a nested one would declare a second workspace root.
 */
 const writeWorkspaceConfig = (targetDir) => {
 	writeFileSync(join(targetDir, "pnpm-workspace.yaml"), `# pnpm reads \`overrides\` from this file only — the \`pnpm\` field in package.json is ignored.
@@ -266,16 +256,13 @@ const scaffold = (opts) => {
 		files: written.sort()
 	};
 };
-//#endregion
-//#region src/cli.ts
+// src/cli.ts
 const TEMPLATE_DIR = fileURLToPath(new URL("./template/", import.meta.url));
 /**
 * What to do when there is nobody to ask.
 *
-* - A missing `--name` is an error: there is no sane default for it, and a prompt an agent
-*   cannot answer is worse than a non-zero exit.
-* - A missing `--blocks` defaults to every block, which is the shape `apps/boilerplate` has and
-*   the most useful thing to hand someone who did not choose.
+* - A missing `--name` is an error: no sane default, and an unanswerable prompt is worse.
+* - A missing `--blocks` defaults to every block, the shape of `apps/boilerplate`.
 */
 const resolveNonInteractive = (options) => {
 	if (options.name === null) return {
@@ -302,11 +289,9 @@ const nextSteps = (result, workspace) => workspace ? [
 /**
 * Writes `src/routeTree.gen.ts` for the routes that were actually copied.
 *
-* - Same code path the Vite plugin takes, so the tree matches what `pnpm dev` would write.
-* - Run now rather than left to the first build, so the emitted app type-checks before it is
-*   ever built.
-* - A failure is fatal: an app whose `pnpm type-check` fails on a missing route tree is not a
-*   deliverable, and the message says how to recover.
+* - Same code path as the Vite plugin, so it matches what `pnpm dev` writes.
+* - Runs now so the emitted app type-checks before its first build.
+* - A failure is fatal.
 */
 const generateRouteTree = async (appDir) => {
 	try {
@@ -314,7 +299,8 @@ const generateRouteTree = async (appDir) => {
 		await new Generator({
 			config: getConfig({
 				quoteStyle: "single",
-				semicolons: true
+				semicolons: true,
+				routeFileIgnorePattern: "\\.test\\.tsx?$"
 			}, appDir),
 			root: appDir
 		}).run();
@@ -325,32 +311,29 @@ const generateRouteTree = async (appDir) => {
 /**
 * Adds the new app to the monorepo's knip config.
 *
-* - knip keys its per-workspace entry and project globs by path, so an unregistered app
-*   inherits knip's defaults and reports its postcss config as unused.
-* - The boilerplate's block is copied as-is: every scaffolded app has the same `src/` layout.
+* - Unregistered, knip's defaults report the app's postcss config as unused.
+* - Copies the boilerplate's entry as-is: every scaffolded app shares its `src/` layout.
 */
 const registerKnipWorkspace = (repoRoot, appName) => {
 	const knipPath = join(repoRoot, "knip.json");
 	if (!existsSync(knipPath)) return;
 	const config = JSON.parse(readFileSync(knipPath, "utf8"));
-	const workspaces = Reflect.get(config, "workspaces");
-	if (typeof workspaces !== "object" || workspaces === null) return;
-	const source = Reflect.get(workspaces, "apps/boilerplate");
-	if (source === void 0) return;
-	Reflect.set(workspaces, `apps/${appName}`, JSON.parse(JSON.stringify(source)));
+	if (!isRecord(config) || !isRecord(config.workspaces)) return;
+	const { workspaces } = config;
+	if (!("apps/boilerplate" in workspaces)) return;
+	workspaces[`apps/${appName}`] = structuredClone(workspaces["apps/boilerplate"]);
 	writeFileSync(knipPath, `${JSON.stringify(config, null, 2)}\n`);
 };
 /**
 * The monorepo root's own `engines`, for the emitted app to inherit under `--workspace`.
 *
-* - syncpack (`pnpm deps:check`) compares `engines.node` across every workspace, so an app
-*   carrying the template's standalone floor makes the whole repo's check red.
+* - syncpack compares `engines.node` across workspaces; the template's floor would fail it.
 * - `undefined` when the root declares none — `scaffold` then keeps the template's value.
 */
 const monorepoEngines = (root) => {
 	const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	const engines = Reflect.get(manifest, "engines");
-	if (typeof engines !== "object" || engines === null) return void 0;
+	if (!isRecord(manifest) || !isRecord(manifest.engines)) return void 0;
+	const { engines } = manifest;
 	return Object.fromEntries(Object.entries(engines).filter((entry) => typeof entry[1] === "string"));
 };
 const promptFor = async (options) => {
@@ -450,13 +433,8 @@ const main = async () => {
 /**
 * Whether this module is the process entry point.
 *
-* - `realpathSync` on both sides, because the installed `bin` is a symlink: npm and pnpm invoke
-*   `node_modules/.bin/create-keboola-app`, so `argv[1]` is the link, not `dist/cli.js`. An
-*   `endsWith('cli.js')` check — which is enough for `extract.ts` and `sanitize.ts`, both
-*   invoked by path — would answer `false` for every real install.
-* - Guarded at all so importing the module does not run it: `cli.test.ts` imports
-*   `resolveNonInteractive` and `nextSteps`, and an unguarded `main()` would scaffold, then
-*   `exit(1)` out of the test worker.
+* - `realpathSync` on both sides: the installed `bin` is a symlink, so `argv[1]` is the link.
+* - Guarded so `cli.test.ts` can import the module without running `main()`.
 */
 const isEntryPoint = () => {
 	const entry = argv[1];
@@ -474,5 +452,4 @@ if (isEntryPoint()) try {
 	stderr.write(`✗ ${error instanceof Error ? error.message : String(error)}\n`);
 	exit(1);
 }
-//#endregion
 export { nextSteps, resolveNonInteractive };

package/dist/extract.js

@@ -1,10 +1,10 @@
-import { a as isBlockId, i as SHELL_FILES, n as BLOCK_IDS, r as NOT_IN_TEMPLATE, t as BLOCKS } from "./blocks-DYU5Ke29.js";
-import { i as renderRegions, r as blockIdOf } from "./regions-B3r5LhXl.js";
-import { r as scan, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
+import { a as isBlockId, i as SHELL_FILES, n as BLOCK_IDS, r as NOT_IN_TEMPLATE, t as BLOCKS } from "./blocks-BdJaEmz1.js";
+import { i as renderRegions, r as blockIdOf } from "./regions-BNl4QsPP.js";
+import { r as scan, t as formatFindings } from "./sanitize-DVFBkv8b.js";
 import { cpSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-//#region src/extract.ts
+// src/extract.ts
 /** The scripts the emitted app keeps, keyed the way its `package.json` will hold them. */
 const APP_SCRIPTS = {
 	build: "vite build",
@@ -36,10 +36,9 @@ const workspaceVersions = (packagesDir) => new Map(readdirSync(packagesDir).flat
 /**
 * The decision applied to every region while extracting.
 *
-* - `internal` is dropped: it is the marker for text that is true in the monorepo only.
+* - `internal` (monorepo-only text) is dropped.
 * - `block:<id>` is kept **with** its markers — the CLI decides per scaffold.
-* - Anything else throws, so a typo in a marker fails the build instead of shipping a region
-*   nobody will ever keep.
+* - Anything else throws, so a marker typo fails the build.
 */
 const decideRegion = (regionId) => {
 	if (regionId === "internal") return "drop";
@@ -50,16 +49,13 @@ const decideRegion = (regionId) => {
 /**
 * Per-file rewrites that turn this app's identity into placeholders.
 *
-* - Every rewrite has a matching assertion in `extract.test.ts`, and the sanitize scan fails
-*   the build on any surviving mention of this app's name — a rewrite that stops matching is
-*   a red build, not a scaffold that quietly names itself after the template.
-* - Match structurally, not by the literal name. The name must not appear here: the packed
-*   tarball is scanned too, and a rewrite that spells its own needle makes the scanner match
-*   its own implementation.
+* - Each has an assertion in `extract.test.ts`; the sanitize scan fails on any surviving name.
+* - Match structurally, never by the literal name: the tarball is scanned too.
 */
 const parameterise = (file, text) => {
 	if (file === "index.html") return text.replace(/<title>[^<]*<\/title>/, "<title>__APP_TITLE__</title>");
 	if (file === "src/components/AppChrome.tsx") return text.replace(/(<Link to="\/">)[^<]*(<\/Link>)/, "$1__APP_TITLE__$2");
+	if (file === "src/auth/AuthScreen.tsx") return text.replace(/^const PRODUCT = '[^']*';$/m, "const PRODUCT = '__APP_TITLE__';");
 	if (file === "src/store.ts") return text.replaceAll(/'boilerplate\/([^']+)'/g, "'__APP_NAME__/$1'");
 	return text;
 };
@@ -139,5 +135,4 @@ const main = () => {
 	console.log(`✓ extracted ${files.length} files into dist/template (${workspaceDeps.length} @keboola deps pinned to published ranges)`);
 };
 if (process.argv[1]?.endsWith("extract.js") === true) main();
-//#endregion
 export { extractTemplate };

package/dist/{regions-B3r5LhXl.js → regions-BNl4QsPP.js}

@@ -1,14 +1,14 @@
-//#region src/regions.ts
+// src/isRecord.ts
+/** A non-null object, readable by key — for parsed JSON. */
+const isRecord = (value) => typeof value === "object" && value !== null;
+// src/regions.ts
 const MARKER = String.raw`#(region|endregion)\s+(\S+)`;
 new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)#region\s+(\S+)`);
 const MARKER_LINE_RE = new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)${MARKER}`);
 /**
 * The block name in a region id, or `null` for any other shape.
 *
-* - Only an exact `block:<name>` matches. `block:kpi:extra` is a typo, not the `kpi` block —
-*   resolving it to the block whose name it happens to start with would let a malformed
-*   marker decide a real region, which is how a marker leaks into an emitted app.
-* - `internal` and every other id are the caller's business; this answers one question.
+* - Only an exact `block:<name>` matches; `block:kpi:extra` is a typo, not the `kpi` block.
 */
 const blockIdOf = (regionId) => /^block:([^:\s]+)$/.exec(regionId)?.[1] ?? null;
 const markerOf = (line) => {
@@ -22,11 +22,9 @@ const markerOf = (line) => {
 	};
 };
 /**
-* Removes the blank-line debris a dropped region leaves.
+* Collapses blank-line runs and drops a leading blank line.
 *
-* - Runs of two or more blank lines collapse to one: dropping an import region between two
-*   groups otherwise leaves a double gap, and the emitted app's `oxfmt --check` fails on it.
-* - A leading blank line is dropped for the same reason.
+* - Dropped regions leave that debris, and the emitted app's `oxfmt --check` fails on it.
 */
 const tidy = (lines) => {
 	const out = [];
@@ -68,21 +66,14 @@ const renderRegions = (source, decide) => {
 /**
 * Any marker, in any dialect, anywhere on a line.
 *
-* - Deliberately looser than `markerOf`: this is the containment check, so an *unrecognised*
-*   marker — misspelt dialect, indented into a continuation line, left inside a string — has to
-*   match too. `markerOf` would skip exactly those and let them through.
+* - Looser than `markerOf` on purpose: containment must catch unrecognised markers too.
 */
 const MARKER_RE = /#(?:region|endregion)\b/;
 /**
-* Fails when rendered text still carries a marker.
+* Fails when rendered text still carries a marker: no `#region` may reach an emitted app.
 *
-* - The invariant: no `#region block:` may reach an emitted app. Markers are a build-time
-*   mechanism, and one surviving into generated source is how that mechanism fails silently —
-*   the app compiles, the region is dead text, and nobody finds out until a reader asks.
-* - Called on every file the scaffolder writes, so a stray, mis-nested or unknown-block marker
-*   aborts the scaffold instead of shipping.
-* - Not called on the extract's output: that keeps its markers on purpose, for the CLI to
-*   decide per scaffold.
+* - Called on every file the scaffolder writes.
+* - Not on the extract's output, which keeps markers for the CLI to decide per scaffold.
 */
 const assertNoMarkers = (file, text) => {
 	const line = text.split("\n").findIndex((candidate) => MARKER_RE.test(candidate));
@@ -91,5 +82,4 @@ const assertNoMarkers = (file, text) => {
 };
 /** Replaces `__KEY__` with `vars[KEY]`. An unlisted placeholder is left in place. */
 const substitute = (source, vars) => Object.entries(vars).reduce((acc, [key, value]) => acc.replaceAll(`__${key}__`, value), source);
-//#endregion
-export { substitute as a, renderRegions as i, assertNoMarkers as n, blockIdOf as r, MARKER_RE as t };
+export { substitute as a, renderRegions as i, assertNoMarkers as n, isRecord as o, blockIdOf as r, MARKER_RE as t };

package/dist/{sanitize-CKs8pAzZ.js → sanitize-DVFBkv8b.js}

@@ -1,8 +1,8 @@
-import { t as MARKER_RE } from "./regions-B3r5LhXl.js";
+import { o as isRecord, t as MARKER_RE } from "./regions-BNl4QsPP.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-//#region src/sanitize.ts
+// src/sanitize.ts
 const PATTERNS_PATH = fileURLToPath(new URL("../sanitize-patterns.json", import.meta.url));
 const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -12,9 +12,8 @@ const SKIP_DIRS = /* @__PURE__ */ new Set([
 /**
 * The pattern table, compiled.
 *
-* - Read from JSON on purpose: the table is not in `files[]`, so no published copy of this
-*   scanner carries the patterns it looks for.
-* - Absent means the caller is running from an installed package, which the gates never do.
+* - JSON on purpose: it is not in `files[]`, so no published scanner carries its patterns.
+* - Absent only when run from an installed package, which the gates never do.
 */
 const loadPatterns = () => {
 	let raw;
@@ -69,11 +68,9 @@ const scanTree = (root, patterns = loadPatterns()) => {
 	});
 };
 /**
-* Structural check on every `package.json` under `root`: no dependency may keep pnpm's
-* `workspace:` protocol.
+* Findings for any `package.json` dependency still on pnpm's `workspace:` protocol.
 *
-* - Parsed rather than grepped, so the rule is about specifiers and not about the string
-*   appearing anywhere in a file. The CLI legitimately holds that literal for `--workspace`.
+* - Parsed, not grepped: the CLI legitimately holds that literal for `--workspace`.
 */
 const scanManifests = (root) => {
 	const files = [];
@@ -86,8 +83,9 @@ const scanManifests = (root) => {
 	];
 	return files.filter((file) => file === "package.json" || file.endsWith("/package.json")).flatMap((file) => {
 		const manifest = JSON.parse(readFileSync(join(root, file), "utf8"));
+		if (!isRecord(manifest)) return [];
 		return groups.flatMap((group) => {
-			const deps = Reflect.get(manifest, group);
+			const deps = manifest[group];
 			if (typeof deps !== "object" || deps === null) return [];
 			return Object.entries(deps).filter(([, range]) => typeof range === "string" && range.startsWith("workspace:")).map(([name, range]) => ({
 				file,
@@ -101,15 +99,10 @@ const scanManifests = (root) => {
 };
 const scan = (root) => [...scanTree(root), ...scanManifests(root)];
 /**
-* Region markers surviving into emitted source.
+* Region markers surviving into an emitted app.
 *
-* - Separate from `scan`, and never part of it: the tarball's own `dist/template/` carries
-*   markers on purpose, so a pattern-table rule for them would fail every run.
-* - Run against an **emitted app** instead — the one place the invariant applies. A marker
-*   there is dead text that compiles, which is how the mechanism fails without telling anyone.
-* - `assertNoMarkers` already aborts a scaffold in-process; this is the same rule applied to
-*   output on disk, so the gates can prove it about a real `pnpm pack` → scaffold run rather
-*   than trusting the code path.
+* - Never part of `scan`: the tarball's `dist/template/` carries markers on purpose.
+* - The on-disk twin of `assertNoMarkers`, so gates prove it on a real `pnpm pack` → scaffold.
 */
 const scanMarkers = (root) => {
 	const files = [];
@@ -130,12 +123,10 @@ const scanMarkers = (root) => {
 };
 const formatFindings = (findings) => findings.map((f) => `  ${f.file}:${f.line}  [${f.pattern}] ${f.match}\n      ${f.why}`).join("\n");
 /**
-* Two modes, because the two things being proved are opposites.
+* Two modes:
 *
-* 1. Default — internal references and credential shapes under a directory. Run on `pnpm pack`
-*    output, which still holds the marked-up template.
-* 2. `--markers` — region markers under a directory. Run on an **emitted app**, where a marker
-*    must never appear.
+* - Default — internal references and credential shapes; run on `pnpm pack` output.
+* - `--markers` — region markers; run on an emitted app.
 */
 const main = () => {
 	const args = process.argv.slice(2);
@@ -154,5 +145,4 @@ const main = () => {
 	console.log(markersOnly ? `✓ no region markers under ${root}` : `✓ no internal references or credential shapes under ${root}`);
 };
 if (process.argv[1]?.endsWith("sanitize.js") === true) main();
-//#endregion
 export { scanMarkers as a, scanManifests as i, loadPatterns as n, scanText as o, scan as r, scanTree as s, formatFindings as t };

package/dist/sanitize.js

@@ -1,2 +1 @@
-import { a as scanMarkers, i as scanManifests, n as loadPatterns, o as scanText, r as scan, s as scanTree, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
-export { formatFindings, loadPatterns, scan, scanManifests, scanMarkers, scanText, scanTree };
+export { t as formatFindings, n as loadPatterns, r as scan, i as scanManifests, a as scanMarkers, o as scanText, s as scanTree } from "./sanitize-DVFBkv8b.js";