create-thally-docs 0.10.99 → 0.10.101

package/dist/{chunk-LBDWCRKT.js → chunk-55ZVJIVO.js}

@@ -8,7 +8,7 @@ import {
   installDeps,
   runProjectCommand,
   scaffold
-} from "./chunk-HPYS4ZXZ.js";
+} from "./chunk-L76B6AVG.js";
 import {
   pruneMissingSiteLinks
 } from "./chunk-UG3OXVLE.js";

package/dist/{chunk-53BTIUGV.js → chunk-KYNWR6UI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   downloadStarter
-} from "./chunk-KC7QI76U.js";
+} from "./chunk-M3XOQJOE.js";
 import {
   applyStarterRuntimeSyncPlan,
   captureTargetPrecondition,
@@ -10,11 +10,11 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-BVAPRROZ.js";
+} from "./chunk-Y6BBUB3O.js";
 import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 
 // src/starter-update.ts
 import {
@@ -256,13 +256,58 @@ function assertRecoveryPackages(targetDir, baselineDir, packages) {
     }
   }
 }
+function hasArchivePackageIdentity(targetDir, baselineDir) {
+  const installed = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf8"));
+  const canonical = JSON.parse(readFileSync(join(baselineDir, "package.json"), "utf8"));
+  const hasLock = existsSync(join(baselineDir, "package-lock.json"));
+  if (hasLock && !existsSync(join(targetDir, "package-lock.json"))) return false;
+  const baselineLock = hasLock ? JSON.parse(readFileSync(join(baselineDir, "package-lock.json"), "utf8")) : void 0;
+  const installedLock = hasLock ? JSON.parse(readFileSync(join(targetDir, "package-lock.json"), "utf8")) : void 0;
+  const fields = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const names = new Set(fields.flatMap((field) => Object.keys(canonical[field] ?? {})));
+  for (const name of names) {
+    for (const field of fields) {
+      if (installed[field]?.[name] !== canonical[field]?.[name]) return false;
+      if (hasLock && installedLock.packages?.[""]?.[field]?.[name] !== baselineLock.packages?.[""]?.[field]?.[name]) return false;
+    }
+    if (hasLock) {
+      const path = `node_modules/${name}`;
+      if (!baselineLock.packages?.[path] || !isDeepStrictEqual2(installedLock.packages?.[path], baselineLock.packages[path])) return false;
+    }
+  }
+  return true;
+}
 async function resolveStarterUpdateBase(options) {
   const releases = options.releases ?? SUPPORTED_SCAFFOLD_RELEASES;
   const manifestPath = STABLE_SCAFFOLD_RELEASE.source.manifestPath;
   const source = readDownstreamManifest(options.targetDir, manifestPath);
   const manifestSha256 = starterManifestSha256(source);
   const exact = releases.filter((release) => release.source.manifestSha256 === manifestSha256);
-  if (exact.length) return { release: resolveStarterReleaseFromManifest(source, releases), recoveredProvenance: false, manifestSha256 };
+  if (exact.length === 1) return { release: resolveStarterReleaseFromManifest(source, releases), recoveredProvenance: false, manifestSha256 };
+  if (exact.length > 1) {
+    const download2 = options.download ?? (async (directory, release) => {
+      await downloadStarter(directory, void 0, release, { announce: false });
+    });
+    const workspace2 = mkdtempSync(join(tmpdir(), "thally-starter-exact-base-"));
+    try {
+      const proven = [];
+      const candidates2 = exact.filter((release, index, all) => all.findIndex((other) => isDeepStrictEqual2(other, release)) === index);
+      for (const [index, release] of candidates2.entries()) {
+        const baselineDir = join(workspace2, String(index));
+        mkdirSync(baselineDir);
+        await download2(baselineDir, release);
+        const baseline = readStarterReleaseManifest(baselineDir, release);
+        const ownership = mergeStarterOwnershipContracts(baseline.ownership, baseline.ownership);
+        const proof = planStarterRuntimeSync(baselineDir, baselineDir, options.targetDir, ownership);
+        if (proof.copyPaths.length || proof.deletePaths.length || proof.preservedPaths.length || proof.conflictPaths.length) continue;
+        if (hasArchivePackageIdentity(options.targetDir, baselineDir)) proven.push(release);
+      }
+      if (proven.length !== 1) throw new Error("The project starter manifest has no unique verified archive baseline; refusing to update.");
+      return { release: proven[0], recoveredProvenance: false, manifestSha256 };
+    } finally {
+      rmSync(workspace2, { recursive: true, force: true });
+    }
+  }
   if (Buffer.byteLength(source, "utf8") > 256 * 1024) throw new Error("The project starter manifest is too large.");
   let candidate;
   try {

package/dist/{chunk-HPYS4ZXZ.js → chunk-L76B6AVG.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-J7255UQA.js";
 import {
   downloadStarter
-} from "./chunk-KC7QI76U.js";
+} from "./chunk-M3XOQJOE.js";
 import {
   terminal
 } from "./chunk-L2YCVQBR.js";

package/dist/{chunk-KC7QI76U.js → chunk-M3XOQJOE.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-L2YCVQBR.js";
 import {
   readStarterReleaseManifest
-} from "./chunk-BVAPRROZ.js";
+} from "./chunk-Y6BBUB3O.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 
 // src/download.ts
 import { Readable, Transform, pipeline } from "stream";

package/dist/{chunk-Q2CL6GEI.js → chunk-WSJUSRXL.js}

@@ -3,19 +3,19 @@
 // src/stable-scaffold-release.json
 var stable_scaffold_release_default = {
   schemaVersion: 1,
-  id: "2026-10-16.9da45779.7bbdec81",
+  id: "2026-10-17.c017c9b8.ba0f9e2d",
   source: {
     repository: "thallylabs/starter",
-    commitSha: "9da457794031d6429f99123084d252abc80f867c",
-    treeSha: "7fa2539d64718f8c20cf066194d204b5965a7024",
-    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/9da457794031d6429f99123084d252abc80f867c",
+    commitSha: "c017c9b88f78f310418219409bcda334cf8d3cf0",
+    treeSha: "03b91ca58e6cda916e2afb2c4c84d559c3cd6e99",
+    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/c017c9b88f78f310418219409bcda334cf8d3cf0",
     manifestPath: "starter-release.json",
-    manifestSha256: "1973b1729c8067924021d02cbc68df95a9cae8bf125fe53d744f963713aaf44e"
+    manifestSha256: "3185c7b1923840d80d10c24b229ef8450c00ba057a641efda1030df33d31ec96"
   },
   runtime: {
     repository: "thallylabs/thally",
-    commitSha: "7bbdec81ba4932831ee4a1d0c7e5aa20e47d7d6c",
-    treeSha: "1033799748f20310c85054707ff11ab16f0fccd6",
+    commitSha: "ba0f9e2d7e07dd1589b57c48c50229bad77da688",
+    treeSha: "1394878c2ab4955a5a6e233aa6d7dc6273015516",
     contentSource: "assets",
     identityContractVersion: 1
   },
@@ -24,6 +24,26 @@ var stable_scaffold_release_default = {
 
 // src/previous-scaffold-releases.json
 var previous_scaffold_releases_default = [
+  {
+    schemaVersion: 1,
+    id: "2026-10-16.9da45779.7bbdec81",
+    source: {
+      repository: "thallylabs/starter",
+      commitSha: "9da457794031d6429f99123084d252abc80f867c",
+      treeSha: "7fa2539d64718f8c20cf066194d204b5965a7024",
+      archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/9da457794031d6429f99123084d252abc80f867c",
+      manifestPath: "starter-release.json",
+      manifestSha256: "1973b1729c8067924021d02cbc68df95a9cae8bf125fe53d744f963713aaf44e"
+    },
+    runtime: {
+      repository: "thallylabs/thally",
+      commitSha: "7bbdec81ba4932831ee4a1d0c7e5aa20e47d7d6c",
+      treeSha: "1033799748f20310c85054707ff11ab16f0fccd6",
+      contentSource: "assets",
+      identityContractVersion: 1
+    },
+    starterVersion: 2
+  },
   {
     schemaVersion: 1,
     id: "2026-10-14.ec81d6cd.6b1843c8",

package/dist/{chunk-BVAPRROZ.js → chunk-Y6BBUB3O.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 
 // src/starter-sync.ts
 import { createHash } from "crypto";

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   migrateDocs
-} from "./chunk-LBDWCRKT.js";
+} from "./chunk-55ZVJIVO.js";
 import {
   parseFrontmatter,
   runCheck
@@ -13,17 +13,17 @@ import {
   scaffold,
   slugify,
   success
-} from "./chunk-HPYS4ZXZ.js";
+} from "./chunk-L76B6AVG.js";
 import "./chunk-UG3OXVLE.js";
 import "./chunk-J7255UQA.js";
-import "./chunk-KC7QI76U.js";
+import "./chunk-M3XOQJOE.js";
 import {
   acquireTerminalAccent,
   formatHelp,
   terminal
 } from "./chunk-L2YCVQBR.js";
-import "./chunk-BVAPRROZ.js";
-import "./chunk-Q2CL6GEI.js";
+import "./chunk-Y6BBUB3O.js";
+import "./chunk-WSJUSRXL.js";
 
 // src/index.ts
 import { existsSync as existsSync2, readdirSync } from "fs";

package/dist/migrate/index.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   migrateDocs
-} from "../chunk-LBDWCRKT.js";
+} from "../chunk-55ZVJIVO.js";
 import "../chunk-KDLP27DS.js";
-import "../chunk-HPYS4ZXZ.js";
+import "../chunk-L76B6AVG.js";
 import "../chunk-UG3OXVLE.js";
 import "../chunk-J7255UQA.js";
-import "../chunk-KC7QI76U.js";
+import "../chunk-M3XOQJOE.js";
 import "../chunk-L2YCVQBR.js";
-import "../chunk-BVAPRROZ.js";
-import "../chunk-Q2CL6GEI.js";
+import "../chunk-Y6BBUB3O.js";
+import "../chunk-WSJUSRXL.js";
 export {
   migrateDocs
 };

package/dist/release.js

@@ -3,7 +3,7 @@ import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,
   isStableScaffoldRelease
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,

package/dist/scaffold.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scaffold
-} from "./chunk-HPYS4ZXZ.js";
+} from "./chunk-L76B6AVG.js";
 import "./chunk-UG3OXVLE.js";
 import "./chunk-J7255UQA.js";
 import {
@@ -9,12 +9,12 @@ import {
   STARTER_COMMIT_SHA,
   STARTER_REPOSITORY,
   validateStarterArchiveEntry
-} from "./chunk-KC7QI76U.js";
+} from "./chunk-M3XOQJOE.js";
 import "./chunk-L2YCVQBR.js";
-import "./chunk-BVAPRROZ.js";
+import "./chunk-Y6BBUB3O.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   STARTER_ARCHIVE_ROOT,

package/dist/starter-sync.js

@@ -9,8 +9,8 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-BVAPRROZ.js";
-import "./chunk-Q2CL6GEI.js";
+} from "./chunk-Y6BBUB3O.js";
+import "./chunk-WSJUSRXL.js";
 export {
   applyStarterRuntimeSyncPlan,
   captureTargetPrecondition,

package/dist/starter-update.js

@@ -6,11 +6,11 @@ import {
   resolveStarterUpdateBase,
   starterReleaseProviderError,
   updateStarterProject
-} from "./chunk-53BTIUGV.js";
-import "./chunk-KC7QI76U.js";
+} from "./chunk-KYNWR6UI.js";
+import "./chunk-M3XOQJOE.js";
 import "./chunk-L2YCVQBR.js";
-import "./chunk-BVAPRROZ.js";
-import "./chunk-Q2CL6GEI.js";
+import "./chunk-Y6BBUB3O.js";
+import "./chunk-WSJUSRXL.js";
 export {
   fetchStarterReleaseHint,
   resolveManualReviewMutations,

package/dist/starter-upgrade-canary.js

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import {
   updateStarterProject
-} from "./chunk-53BTIUGV.js";
+} from "./chunk-KYNWR6UI.js";
 import {
   downloadStarter
-} from "./chunk-KC7QI76U.js";
+} from "./chunk-M3XOQJOE.js";
 import "./chunk-L2YCVQBR.js";
 import {
   classifyStarterPath,
   mergeStarterOwnershipContracts,
   readStarterReleaseManifest
-} from "./chunk-BVAPRROZ.js";
+} from "./chunk-Y6BBUB3O.js";
 import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES
-} from "./chunk-Q2CL6GEI.js";
+} from "./chunk-WSJUSRXL.js";
 
 // src/starter-upgrade-canary.ts
 import { createHash } from "crypto";
@@ -22,6 +22,27 @@ import { cpSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, r
 import { tmpdir } from "os";
 import { dirname, join } from "path";
 import { isDeepStrictEqual } from "util";
+function releaseIdentity(release) {
+  return JSON.stringify([
+    release.schemaVersion,
+    release.id,
+    release.starterVersion,
+    release.source.repository,
+    release.source.commitSha,
+    release.source.treeSha,
+    release.source.archiveUrl,
+    release.source.manifestPath,
+    release.source.manifestSha256,
+    release.runtime.repository,
+    release.runtime.commitSha,
+    release.runtime.treeSha,
+    release.runtime.contentSource,
+    release.runtime.identityContractVersion
+  ]);
+}
+function distinctReleases(releases) {
+  return releases.filter((release, index, all) => all.findIndex((other) => releaseIdentity(other) === releaseIdentity(release)) === index);
+}
 function files(root, prefix = "") {
   const result = /* @__PURE__ */ new Map();
   for (const entry of readdirSync(join(root, prefix))) {
@@ -44,27 +65,28 @@ async function verifyScaffoldUpgrades(options) {
   assertCanonicalScaffoldUpgradeRelease(target);
   const targetManifest = readStarterReleaseManifest(options.candidateDirectory, target);
   const targetFiles = files(options.candidateDirectory);
-  const history = [...options.releases ?? SUPPORTED_SCAFFOLD_RELEASES].filter((release) => release.source.manifestSha256 !== target.source.manifestSha256);
+  const history = [...options.releases ?? SUPPORTED_SCAFFOLD_RELEASES].filter((release) => releaseIdentity(release) !== releaseIdentity(target));
   if (!history.length) throw new Error("Historical upgrade canary has no retained baseline.");
   const current = options.current ?? STABLE_SCAFFOLD_RELEASE;
-  const bases = [current, history.at(-1)].filter((release, index, all) => all.findIndex((other) => other.source.manifestSha256 === release.source.manifestSha256) === index);
-  const catalog = [target, ...bases, ...history].filter((release, index, all) => all.findIndex((other) => other.source.manifestSha256 === release.source.manifestSha256) === index);
+  const bases = distinctReleases([current, history.at(-1)]);
+  const catalog = distinctReleases([target, ...bases, ...history]);
   catalog.forEach(assertCanonicalScaffoldUpgradeRelease);
   const workspace = mkdtempSync(join(tmpdir(), "thally-upgrade-canary-"));
   const snapshots = /* @__PURE__ */ new Map();
   const download = async (destination, release) => {
-    if (!catalog.some((known) => known.id === release.id && known.source.manifestSha256 === release.source.manifestSha256)) throw new Error("Canary requested an uncatalogued release.");
-    if (release.source.manifestSha256 === target.source.manifestSha256) cpSync(options.candidateDirectory, destination, { recursive: true });
+    if (!catalog.some((known) => releaseIdentity(known) === releaseIdentity(release))) throw new Error("Canary requested an uncatalogued release.");
+    if (releaseIdentity(release) === releaseIdentity(target)) cpSync(options.candidateDirectory, destination, { recursive: true });
     else if (options.download) await options.download(destination, release);
     else {
-      let snapshot = snapshots.get(release.source.manifestSha256);
+      const identity = releaseIdentity(release);
+      let snapshot = snapshots.get(identity);
       if (!snapshot) {
-        snapshot = join(workspace, "archives", release.source.manifestSha256);
+        snapshot = join(workspace, "archives", createHash("sha256").update(identity).digest("hex"));
         mkdirSync(snapshot, { recursive: true });
         await downloadStarter(snapshot, void 0, release, { announce: false });
         readStarterReleaseManifest(snapshot, release);
         files(snapshot);
-        snapshots.set(release.source.manifestSha256, snapshot);
+        snapshots.set(identity, snapshot);
       }
       cpSync(snapshot, destination, { recursive: true });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-thally-docs",
-  "version": "0.10.99",
+  "version": "0.10.101",
   "description": "Scaffold an open-source Thally docs site for people, search engines, and AI tools.",
   "type": "module",
   "engines": {