geonosis 3.1.0 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # geonosis
 
+## 3.3.0
+
+### Minor Changes
+
+- fb08b28: The metapackage declares the `geonosis` command itself (#68). pnpm links only the bins of a direct dependency, so with `pnpm add -D geonosis` alone the documented door did not exist; `npx` found it only because npm hoists. `geonosis` now ships `bin/geonosis.mjs`, which runs `@geonosis/cli`'s command through its new `@geonosis/cli/bin` export, and answers exactly as the cli does.
+
+### Patch Changes
+
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [de03c7c]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+- Updated dependencies [fb08b28]
+  - @geonosis/cli@3.3.0
+
+## 3.2.0
+
+### Minor Changes
+
+- deef511: `geonosis-ledger shape lock --from <manifest>` validates a brief's manifest, resolves its red commit to a full hash and writes the runner-owned `.geonosis/brief.json`, a path the plugin refuses an agent's write to, so the engineer cannot loosen the lock it works under. `geonosis-ledger shape check [--brief <manifest>]` judges an engineer's diff against the RED commit a brief was committed as (D-072). The manifest names `ticket`, `red`, `files`, `locked` and optional `exports`; every path that differs from the red commit, committed, staged, unstaged or untracked, is judged. A locked test that was changed, deleted or moved, a file the manifest does not list, an exported name the red commit held and the file no longer exports, and an exported name neither the red commit nor `exports` names are each refused by path (exit 1); a body-only diff passes; a missing or malformed manifest, or a red commit the tree cannot diff against, is exit 2. New exports of `@geonosis/ledger`: `shapeCheck`, `lockManifest`, `readManifest`, `formatShape`, `MANIFEST_PATH`, `BriefManifest`, `ShapeOutcome`, `ShapeRefusal`. `@geonosis/ratchet` gains `exportedNamesOf(path, source)`, the sorted names a TypeScript or JavaScript source exports (types, destructured bindings, re-exports and `export *` included), read with the parser the counters use.
+  The plugin's Bash guard runs `shape check` on `git commit` while `.geonosis/brief.json` is present and refuses the commit with the lock's own lines; a lock that could not run lets the commit through and says so. The engineer definition says to start on the RED commit and that the shape lock is the gate, and the `geonosis-plan` skill says how to commit the applied brief and lock the manifest.
+- deef511: A repo whose `geonosis.json → stack` is not TypeScript passes the doctor with a SKIP that names the language, and gets the method scaffolded without the TypeScript stack. `geonosis-doctor` SKIPs `exercised` as it already did `loaded` (`stack.language is "py"`, so there is no oxlint rule for a corpus to be asked to reach), and `drift` SKIPs, instead of warning "no manifest declares it", a `geonosis.json` block of a kit package in a repo with no package manifest at all; the doctor no longer refuses a tree with no `package.json` and no `.oxlintrc.json` as "nothing here to examine" when `geonosis.json` declares a stack oxlint does not read. `stack` gains `extensions` (`.py .pyi`), the files `stack.format` and `stack.parse` own: with it, the plugin formats only those with `stack.format`, and `pre-edit` and `post-bash` parse them with `stack.parse` (exit non-zero is a parse error; a parser that cannot run says nothing). `stack.parse` without `extensions` applies to no file. A repo with no `stack` behaves as before.
+  `create-geonosis <dir> --language py` writes a uv project (`pyproject.toml`, a package, a test), `geonosis.json` with the stack, three `fast` steps with plants and a `full` tier that proves and runs the ratchet (`ruff format --check`, `ruff check`, `pytest`), `LAW.md` from the new `pythonLawSummary` of `@geonosis/cli`, the two language-neutral counters and their baseline, the kit's rule files, `.claude/settings.json` and a CI workflow; it refuses `--runtime`, `--backend`, `--ui`, `--domains`, `--medusa`, `--themekit`, `--brand`, `--kit`, `--presets` and `--check` by name.
+
+### Patch Changes
+
+- 5404b2a: Dependencies move to their newest release the install policy accepts: `@modelcontextprotocol/sdk` 1.32.1 (`@geonosis/mcp`), `oxc-parser` 0.153.0 (`@geonosis/ratchet`, `@geonosis/verify`), and the `squawk-cli` 2.68.0 that `@geonosis/release` and `geonosis` ask for as an exact optional peer, so the install line a refusal prints is `squawk-cli@2.68.0`. A scaffold written by `create-geonosis` pins `oxlint` ^1.87.0, `oxfmt` ^0.72.0, `vitest` ^5.0.3 and `@types/node` ^26.6.4.
+- dd5f57a: The `geonosis` package ships `GROUP-CHANGELOG.md`: what one group version bought, every sentence any member carries once with the members that carry it. A member whose version heading held nothing of its own now points there instead of standing blank, which read as "nothing changed" (#356). `pnpm release:cut` writes both.
+- Updated dependencies [f5632b7]
+- Updated dependencies [dd5f57a]
+- Updated dependencies [f5632b7]
+- Updated dependencies [9b1ce78]
+- Updated dependencies [a4a7bba]
+- Updated dependencies [58eaf3a]
+- Updated dependencies [58eaf3a]
+- Updated dependencies [58eaf3a]
+- Updated dependencies [58eaf3a]
+- Updated dependencies [58eaf3a]
+- Updated dependencies [deef511]
+- Updated dependencies [58eaf3a]
+  - @geonosis/cli@3.2.0
+
 ## 3.1.0
 
 ### Patch Changes

package/README.md

@@ -7,10 +7,11 @@ pnpm add -D geonosis     # or: bun add -d geonosis
 npx geonosis --help
 ```
 
-That line installs `@geonosis/cli` and every gate it runs — the plugin, the doctor, the ratchet,
-verify, verify-arch, lint-parity, the ledger, release, review, testbed, observability, walk and
-visual-diff — all on the same version, because the whole group publishes as one fixed set. The
-commands come from the packages it pins; this package ships no bin of its own.
+That line installs `@geonosis/cli` and every gate it runs — `@geonosis/base`, the helpers they
+share, the plugin, the doctor, the ratchet, verify, verify-arch, lint-parity, the ledger, release,
+review, testbed, observability, walk and visual-diff — all on the same version, because the whole
+group publishes as one fixed set. The commands come from the packages it pins; this package ships no
+bin of its own.
 
 `geonosis update --to <version>` bumps every pin in every workspace afterwards, in one command.
 
@@ -26,7 +27,7 @@ for everyone, whatever it is called.
 |---|---|---|
 | `playwright` | `@geonosis/walk` | `pnpm add -D playwright` · `bun add -d playwright` |
 | `posthog-node` | `@geonosis/observability` | `pnpm add -D posthog-node` · `bun add -d posthog-node` |
-| `squawk-cli` | `@geonosis/release` (postgres, mikro-orm-ts) | `pnpm add -D squawk-cli@2.66.0` |
+| `squawk-cli` | `@geonosis/release` (postgres, mikro-orm-ts) | `pnpm add -D squawk-cli@2.68.0` |
 
 The peers everybody does pay for are `oxlint`, because every gate lints and oxlint is what loads the
 plugin, and `zod` and `better-result`, because `@geonosis/review` and `@geonosis/observability`

package/bin/geonosis.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env bun
+// Generated by pnpm generate:shims. In the kit's own tree src/ sits beside dist/, and a dist older
+// than src once answered for a fix it did not carry (#62); a published package ships no src/.
+import { existsSync } from 'node:fs'
+
+if (existsSync(new URL('../src', import.meta.url))) {
+  const { guardBuild } = await import('../../../tooling/bin-guard.mjs')
+  guardBuild(new URL('..', import.meta.url), 'geonosis')
+}
+
+await import('../dist/geonosis.js')

package/dist/geonosis.js

@@ -0,0 +1,2 @@
+// src/geonosis.ts
+import"@geonosis/cli/bin";

package/dist/toolchain.d.ts

@@ -1,44 +1,14 @@
-/**
- * What `geonosis` in a manifest actually brings, as data.
- *
- * The list is checked against the workspace by this package's own test rather than remembered,
- * because a metapackage is the one place where "we added a package and nobody updated the list" is
- * invisible from the outside: it installs whatever its dependency happens to depend on.
- */
 export declare const TOOLCHAIN: string[];
-/**
- * Published in the same fixed group and NOT installed by this one line: libraries a repo imports
- * from its own source, and the scaffolder, which is run with `npm create` rather than depended on.
- * They move on the same version, so `geonosis@1.4.0` still tells you which one to add.
- *
- * A FLOOR package is not here and cannot be: `@geonosis/events` versions on a line of its own
- * (D-053), so this number says nothing about which one to install.
- */
+/** Floor packages are absent: each versions on its own line (D-053). */
 export declare const BY_NAME: string[];
-/**
- * A peer everybody pays for, and the reason. Anything not here is optional, and a command that
- * needs it refuses at run time with the install line rather than making every consumer carry it.
- *
- * Measured while this package was written, on a scratch consumer against a local registry: **bun
- * 1.4.0 installs a non-optional peer without being asked**, pnpm 11.8.0 does not. On the bun
- * consumer a required peer IS a dependency for everyone — which is what makes this list a cost and
- * not a note.
- */
+/** bun 1.4.0 installs a non-optional peer unasked; pnpm 11.8.0 does not. */
 export declare const REQUIRED_PEERS: Record<string, string>;
 export type OptionalBinary = {
-    /** The install line, in both managers' spellings. */
     install: string;
     name: string;
-    /** The package that refuses without it, at run time, naming this line. */
     needs: string;
     why: string;
 };
-/**
- * #73 — `@geonosis/release` brought a pinned `squawk-cli` with platform binaries for three
- * architectures, and a Medusa storefront's lockfile grew 395 lines for a Postgres linter it had no
- * dialect for. One manifest line multiplies that by the whole group, so every binary that only some
- * consumers need is an OPTIONAL peer here and the command that wants it prints this line.
- */
+/** #73: a pinned `squawk-cli` grew a Medusa storefront's lockfile by 395 lines. */
 export declare const OPTIONAL_BINARIES: OptionalBinary[];
-/** The line to print when a command refuses for want of a binary nobody was made to install. */
 export declare const installLineFor: (name: string) => string | undefined;

package/dist/toolchain.js

@@ -1,5 +1,6 @@
 // src/toolchain.ts
 var TOOLCHAIN = [
+  "@geonosis/base",
   "@geonosis/cli",
   "@geonosis/doctor",
   "@geonosis/ledger",
@@ -43,7 +44,7 @@ var OPTIONAL_BINARIES = [
     why: "the sink is one exporter among several, and a repo with no sink configured should not carry its client"
   },
   {
-    install: "pnpm add -D squawk-cli@2.66.0   ·   bun add -d squawk-cli@2.66.0",
+    install: "pnpm add -D squawk-cli@2.68.0   ·   bun add -d squawk-cli@2.68.0",
     name: "squawk-cli",
     needs: "@geonosis/release",
     why: "the postgres and mikro-orm-ts migration dialects need it; a repo whose release.migrations names only sqlite needs none of it"

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "geonosis",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "geonosis": "bin/geonosis.mjs"
+  },
   "description": "One manifest line pins the whole toolchain: the geonosis CLI and every gate it runs, on one version.",
   "keywords": [
     "monorepo",
@@ -29,16 +32,17 @@
   },
   "files": [
     "CHANGELOG.md",
+    "bin",
     "dist"
   ],
   "dependencies": {
-    "@geonosis/cli": "3.1.0"
+    "@geonosis/cli": "3.3.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77",
     "playwright": ">=1.40.0",
     "posthog-node": ">=5.49.0",
-    "squawk-cli": "2.66.0"
+    "squawk-cli": "2.68.0"
   },
   "peerDependenciesMeta": {
     "playwright": {
@@ -54,6 +58,19 @@
   "engines": {
     "node": ">=22"
   },
+  "devEngines": {
+    "runtime": [
+      {
+        "name": "bun",
+        "version": "^1.4.2",
+        "onFail": "download"
+      },
+      {
+        "name": "node",
+        "onFail": "ignore"
+      }
+    ]
+  },
   "publishConfig": {
     "access": "public"
   },