anhedral 0.10.0 → 0.10.1

package/README.md

@@ -25,7 +25,7 @@ Starter prompt:
 
 Codex asks about the app, explains the stack, implements the product, configures selected services, and delivers into your authorized accounts. The CLI commands below are also available independently.
 
-Use Node.js 22.13+ and pnpm 10.34.5 for generated workspaces. Generate on Linux, macOS, or WSL.
+Use Node.js 22.13+ on the 22.x line or Node.js 24+, with pnpm 10.34.5, for generated workspaces. Generate on Linux, macOS, or WSL.
 
 ```sh
 # Inspect a plan first: no project files or cloud resources are created
@@ -51,7 +51,7 @@ Anhedral Init is free and open source. Sponsorship helps fund ongoing developmen
 
 ## Choose your stack
 
-The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time.
+The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time. Generated `docs/stack.md` lists the current resolved options, targets, environment names, required setup and verification; additions refresh it without rewriting the application README.
 
 Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports only the bundled catalog maintained and tested by Anhedral. External registries and customer-authored registry payloads are unsupported. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
 

package/assets/security/audit-deps.mjs

@@ -115,11 +115,16 @@ function validateAdvisory(advisory) {
   ensure(Array.isArray(advisory.findings), 'Malformed pnpm advisory');
   ensure(advisory.findings.length > 0, 'Malformed pnpm advisory');
   advisory.findings.forEach(validateFinding);
+  const versions = advisory.findings.map((finding) => finding.version);
+  ensure(new Set(versions).size === versions.length, 'Duplicate pnpm advisory versions');
 }
 
 function validateCount(advisories, severity, count) {
   ensure(Number.isInteger(count) && count >= 0, 'Malformed pnpm vulnerability counts');
-  const details = advisories.filter((advisory) => advisory.severity === severity).length;
+  // The pnpm 10 registry endpoint counts affected versions, not unique advisory IDs.
+  const details = advisories
+    .filter((advisory) => advisory.severity === severity)
+    .reduce((total, advisory) => total + advisory.findings.length, 0);
   ensure(count === details, `Missing ${severity} advisory details: count ${count}, details ${details}`);
 }
 

package/dist/bounded-file.d.ts

@@ -1,2 +1,3 @@
+export declare const MAX_PROJECT_JSON_BYTES: number;
 /** Reject devices, links and oversized or growing files before parsing local input. */
 export declare function readBoundedFile(filePath: string, maximumBytes: number): Buffer;

package/dist/bounded-file.js

@@ -1,4 +1,5 @@
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from 'node:fs';
+export const MAX_PROJECT_JSON_BYTES = 2 * 1024 * 1024;
 /** Reject devices, links and oversized or growing files before parsing local input. */
 export function readBoundedFile(filePath, maximumBytes) {
     const stat = lstatSync(filePath);

package/dist/capabilities.d.ts

@@ -6,7 +6,7 @@ export declare const CAPABILITIES: Record<StandardProduct, Capability>;
 export declare const CAPABILITY_REGISTRY: {
     schemaVersion: number;
     cliVersion: string;
-    capabilities: Record<"realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", Capability>;
+    capabilities: Record<"realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog", Capability>;
 };
 export declare function createSetupPlan(options: StandardOptions, registry?: import("./registry/resolve.js").ResolvedStackRegistry): {
     schemaVersion: number;
@@ -15,10 +15,10 @@ export declare function createSetupPlan(options: StandardOptions, registry?: imp
     standard: string;
     root: string;
     name: string;
-    products: ("realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+    products: ("realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog")[];
     hosting: import("./registry/types.js").Hosting;
     registry: import("./registry/resolve.js").ResolvedStackRegistry;
-    bootstrap: ("pnpm" | "shadcn@4.21.4" | "dlx" | "init" | "--monorepo" | "--template" | "next")[];
+    bootstrap: ("pnpm" | "next" | "shadcn@4.21.4" | "dlx" | "init" | "--monorepo" | "--template")[];
     dryRun: boolean;
     setup: {
         tools: string[];
@@ -32,7 +32,7 @@ export declare function createSetupPlan(options: StandardOptions, registry?: imp
             credentials: readonly string[];
             resources: readonly string[];
             verify: readonly string[];
-            id: "realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling";
+            id: "realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog";
         }[];
         completion: string[];
         resourcesProvisioned: boolean;

package/dist/capabilities.js

@@ -61,7 +61,7 @@ export function createSetupPlan(options, registry = resolveStackRegistry(options
             tools: [
                 ...new Set([
                     'Git',
-                    'Node.js 22.13+ for generated workspaces',
+                    'Node.js 22.13+ on 22.x, or Node.js 24+ for generated workspaces',
                     PACKAGE_MANAGER.replace('@', ' '),
                     'GitHub integration or gh',
                     'Fallow',

package/dist/dependencies.d.ts

@@ -2,14 +2,21 @@ export interface DependencyGroup {
     dependencies?: Record<string, string>;
     devDependencies?: Record<string, string>;
 }
+export declare const NATIVE_ESLINT_VERSION = "10.0.3";
 export declare const DESKTOP_DEPENDENCIES: DependencyGroup;
 export declare const EXTENSION_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_APP_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_NATIVEWIND_DEPENDENCIES: DependencyGroup;
+export declare const WORKSPACE_NODE_ENGINE = "^22.13.0 || >=24.0.0";
 export declare const PACKAGE_MANAGER = "pnpm@10.34.5";
 export declare const EAS_CLI_VERSION = "21.0.1";
 export declare const SHADCN_VERSION = "4.21.4";
+export declare const NEXT_VERCEL_VERSION = "16.4.0";
+export declare const NEXT_OPENNEXT_VERSION = "16.3.8";
 export declare const STACK_DEPENDENCIES: {
+    readonly 'better-auth': "1.7.7";
+    readonly '@better-auth/drizzle-adapter': "1.7.7";
+    readonly '@neondatabase/serverless': "1.2.0";
     readonly 'drizzle-orm': "0.45.4";
     readonly '@clerk/nextjs': "7.9.14";
     readonly '@clerk/backend': "3.23.2";
@@ -30,3 +37,28 @@ export declare const STACK_DEPENDENCIES: {
     readonly stripe: "20.4.1";
     readonly 'posthog-node': "5.55.2";
 };
+/** Vinext's RSC/React versions form a separately verified compatibility group. */
+export declare const VINEXT_DEPENDENCIES: DependencyGroup;
+/** Separate HTTP and inspector ports let all selected Workers run together. */
+export declare const WORKER_DEV_PORTS: {
+    readonly api: {
+        readonly http: 8787;
+        readonly inspector: 9231;
+    };
+    readonly realtime: {
+        readonly http: 8788;
+        readonly inspector: 9232;
+    };
+    readonly jobs: {
+        readonly http: 8789;
+        readonly inspector: 9233;
+    };
+    readonly scheduled: {
+        readonly http: 8790;
+        readonly inspector: 9234;
+    };
+    readonly workflows: {
+        readonly http: 8791;
+        readonly inspector: 9235;
+    };
+};

package/dist/dependencies.js

@@ -1,3 +1,5 @@
+// renovate: datasource=npm depName=eslint
+export const NATIVE_ESLINT_VERSION = '10.0.3';
 export const DESKTOP_DEPENDENCIES = {
     dependencies: {
         // renovate: datasource=npm depName=react
@@ -24,7 +26,7 @@ export const DESKTOP_DEPENDENCIES = {
         electron: '43.7.8',
         // renovate: datasource=npm depName=electron-builder
         'electron-builder': '26.15.3',
-        eslint: '10.0.3',
+        eslint: NATIVE_ESLINT_VERSION,
         // renovate: datasource=npm depName=tailwindcss
         tailwindcss: '4.1.18',
         // renovate: datasource=npm depName=postcss
@@ -129,12 +131,23 @@ export const MOBILE_NATIVEWIND_DEPENDENCIES = {
         tailwindcss: '3.4.19',
     },
 };
+export const WORKSPACE_NODE_ENGINE = '^22.13.0 || >=24.0.0';
 export const PACKAGE_MANAGER = 'pnpm@10.34.5';
 // renovate: datasource=npm depName=eas-cli
 export const EAS_CLI_VERSION = '21.0.1';
 // renovate: datasource=npm depName=shadcn
 export const SHADCN_VERSION = '4.21.4';
+// renovate: datasource=npm depName=next
+export const NEXT_VERCEL_VERSION = '16.4.0';
+// renovate: datasource=npm depName=next
+export const NEXT_OPENNEXT_VERSION = '16.3.8';
 export const STACK_DEPENDENCIES = {
+    // renovate: datasource=npm depName=better-auth
+    'better-auth': '1.7.7',
+    // renovate: datasource=npm depName=@better-auth/drizzle-adapter
+    '@better-auth/drizzle-adapter': '1.7.7',
+    // renovate: datasource=npm depName=@neondatabase/serverless
+    '@neondatabase/serverless': '1.2.0',
     // renovate: datasource=npm depName=drizzle-orm
     'drizzle-orm': '0.45.4',
     // renovate: datasource=npm depName=@clerk/nextjs
@@ -174,3 +187,36 @@ export const STACK_DEPENDENCIES = {
     // renovate: datasource=npm depName=posthog-node
     'posthog-node': '5.55.2',
 };
+/** Vinext's RSC/React versions form a separately verified compatibility group. */
+export const VINEXT_DEPENDENCIES = {
+    dependencies: {
+        // renovate: datasource=npm depName=vinext
+        vinext: '1.1.0',
+        next: NEXT_VERCEL_VERSION,
+        // renovate: datasource=npm depName=react
+        react: '19.2.8',
+        // renovate: datasource=npm depName=react-dom
+        'react-dom': '19.2.8',
+        // renovate: datasource=npm depName=react-server-dom-webpack
+        'react-server-dom-webpack': '19.2.8',
+    },
+    devDependencies: {
+        // renovate: datasource=npm depName=vite
+        vite: '8.3.4',
+        // renovate: datasource=npm depName=@cloudflare/vite-plugin
+        '@cloudflare/vite-plugin': '1.63.1',
+        // renovate: datasource=npm depName=@vitejs/plugin-rsc
+        '@vitejs/plugin-rsc': '0.5.36',
+        // renovate: datasource=npm depName=@vitejs/plugin-react
+        '@vitejs/plugin-react': '6.1.2',
+        wrangler: STACK_DEPENDENCIES.wrangler,
+    },
+};
+/** Separate HTTP and inspector ports let all selected Workers run together. */
+export const WORKER_DEV_PORTS = {
+    api: { http: 8787, inspector: 9231 },
+    realtime: { http: 8788, inspector: 9232 },
+    jobs: { http: 8789, inspector: 9233 },
+    scheduled: { http: 8790, inspector: 9234 },
+    workflows: { http: 8791, inspector: 9235 },
+};

package/dist/platforms/desktop.js

@@ -107,9 +107,6 @@ export default defineConfig({
   build: {
     outDir: 'dist/renderer',
     emptyOutDir: true,
-    // Clerk is already loaded behind a dynamic import. Its optional account-management
-    // surface is intentionally a large async chunk and does not inflate initial rendering.
-    chunkSizeWarningLimit: 1600,
   },
 });
 `);
@@ -261,7 +258,7 @@ function isAllowedAppNavigation(value: string): boolean {
 }
 
 // Product-owned window options and navigation policy belong in this file.
-// Anhedral's managed main.ts imports this seam and wires lifecycle integrations around it.
+// main.ts imports this seam and manages application lifecycle.
 export function createAppWindow(): BrowserWindow {
   const window = new BrowserWindow({
     width: 1180,
@@ -306,11 +303,13 @@ export function createAppWindow(): BrowserWindow {
     writeFile(path.join(dir, 'src/main/main.ts'), `import { app, BrowserWindow, session } from 'electron';
 import { createAppWindow } from './app-window.js';
 
-
 app.whenReady().then(() => {
   session.defaultSession.setPermissionCheckHandler(() => false);
   session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false));
   createAppWindow();
+}).catch((error) => {
+  console.error('Unable to start the desktop app:', error);
+  app.quit();
 });
 app.on('window-all-closed', () => {
   if (process.platform !== 'darwin') app.quit();

package/dist/platforms/extension.js

@@ -1,3 +1,4 @@
+import { NATIVE_ESLINT_VERSION } from '../dependencies.js';
 import path from 'node:path';
 import { writeReactLintConfig } from './lint.js';
 import { writeFile } from '../util.js';
@@ -41,11 +42,14 @@ function writePackageJson(dir, projectName) {
             typecheck: 'tsc --noEmit',
             lint: 'eslint src --max-warnings 0',
         },
-        dependencies: EXTENSION_DEPENDENCIES.dependencies,
+        dependencies: {
+            ...EXTENSION_DEPENDENCIES.dependencies,
+            '@workspace/styling': 'workspace:*',
+        },
         devDependencies: {
             ...EXTENSION_DEPENDENCIES.devDependencies,
             '@workspace/eslint-config': 'workspace:*',
-            eslint: '10.0.3',
+            eslint: NATIVE_ESLINT_VERSION,
         },
     }, null, 2) + '\n');
 }
@@ -55,13 +59,12 @@ function writeWxtConfig(dir, displayName) {
     const actionTitleLiteral = jsString(`Open ${displayName}`);
     writeFile(path.join(dir, 'wxt.config.ts'), `import { defineConfig } from 'wxt';
 
-
 export default defineConfig({
   srcDir: 'src',
+  dev: { server: { port: 3001, strictPort: true } },
   manifest: () => {
     const crxPublicKey = import.meta.env.VITE_CRX_PUBLIC_KEY || '';
 
-
     return {
       name: ${nameLiteral},
       description: ${descriptionLiteral},
@@ -176,51 +179,7 @@ function writeTailwindConfig(dir) {
     writeFile(path.join(dir, 'tailwind.config.cjs'), `/** @type {import('tailwindcss').Config} */
 module.exports = {
   content: ['./src/**/*.{ts,tsx,html}'],
-  theme: {
-    extend: {
-      colors: {
-        border: 'hsl(var(--border))',
-        input: 'hsl(var(--input))',
-        ring: 'hsl(var(--ring))',
-        background: 'hsl(var(--background))',
-        foreground: 'hsl(var(--foreground))',
-        primary: {
-          DEFAULT: 'hsl(var(--primary))',
-          foreground: 'hsl(var(--primary-foreground))',
-        },
-        secondary: {
-          DEFAULT: 'hsl(var(--secondary))',
-          foreground: 'hsl(var(--secondary-foreground))',
-        },
-        destructive: {
-          DEFAULT: 'hsl(var(--destructive))',
-          foreground: 'hsl(var(--destructive-foreground))',
-        },
-        muted: {
-          DEFAULT: 'hsl(var(--muted))',
-          foreground: 'hsl(var(--muted-foreground))',
-        },
-        accent: {
-          DEFAULT: 'hsl(var(--accent))',
-          foreground: 'hsl(var(--accent-foreground))',
-        },
-        popover: {
-          DEFAULT: 'hsl(var(--popover))',
-          foreground: 'hsl(var(--popover-foreground))',
-        },
-        card: {
-          DEFAULT: 'hsl(var(--card))',
-          foreground: 'hsl(var(--card-foreground))',
-        },
-      },
-      borderRadius: {
-        lg: 'var(--radius)',
-        md: 'calc(var(--radius) - 2px)',
-        sm: 'calc(var(--radius) - 4px)',
-      },
-    },
-  },
-  plugins: [],
+  presets: [require('@workspace/styling/tailwind')],
 };
 `);
 }
@@ -259,7 +218,7 @@ export default defineBackground(() => {
   // Open the side panel when the extension icon is clicked.
   (chrome as ChromeWithSidePanel).sidePanel
     .setPanelBehavior({ openPanelOnActionClick: true })
-    .catch(() => {});
+    .catch((error) => console.error('Unable to configure the side panel:', error));
 });
 `);
 }
@@ -328,7 +287,6 @@ export function SidePanelApp() {
     }
   }, []);
 
-
   return (
     <div style={{ padding: 24 }}>
       <h2>Welcome!</h2>
@@ -351,28 +309,6 @@ function writeStyles(dir) {
 @tailwind utilities;
 
 @layer base {
-  :root {
-    --background: 0 0% 100%;
-    --foreground: 0 0% 9%;
-    --card: 0 0% 100%;
-    --card-foreground: 0 0% 9%;
-    --popover: 0 0% 100%;
-    --popover-foreground: 0 0% 9%;
-    --primary: 0 0% 9%;
-    --primary-foreground: 0 0% 98%;
-    --secondary: 0 0% 96.1%;
-    --secondary-foreground: 0 0% 9%;
-    --muted: 0 0% 96.1%;
-    --muted-foreground: 0 0% 45.1%;
-    --accent: 0 0% 96.1%;
-    --accent-foreground: 0 0% 9%;
-    --destructive: 0 84.2% 60.2%;
-    --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 89.8%;
-    --input: 0 0% 89.8%;
-    --ring: 0 0% 63.9%;
-    --radius: 0.5rem;
-  }
 
   * {
     border-color: hsl(var(--border));

package/dist/platforms/mobile.js

@@ -1,3 +1,4 @@
+import { NATIVE_ESLINT_VERSION } from '../dependencies.js';
 import path from 'node:path';
 import { writeReactLintConfig } from './lint.js';
 import { appendGitignore, writeFile } from '../util.js';
@@ -62,26 +63,9 @@ module.exports = withNativeWind(config, { input: './global.css', inlineRem: 16 }
 
 /** @type {import('tailwindcss').Config} */
 module.exports = {
-  darkMode: 'class',
   content: ['./app/**/*.{ts,tsx}', './components/**/*.{ts,tsx}'],
-  presets: [require('nativewind/preset')],
-  theme: {
-    extend: {
-      colors: {
-        border: 'hsl(var(--border))', input: 'hsl(var(--input))', ring: 'hsl(var(--ring))',
-        background: 'hsl(var(--background))', foreground: 'hsl(var(--foreground))',
-        primary: { DEFAULT: 'hsl(var(--primary))', foreground: 'hsl(var(--primary-foreground))' },
-        secondary: { DEFAULT: 'hsl(var(--secondary))', foreground: 'hsl(var(--secondary-foreground))' },
-        destructive: { DEFAULT: 'hsl(var(--destructive))', foreground: 'hsl(var(--destructive-foreground))' },
-        muted: { DEFAULT: 'hsl(var(--muted))', foreground: 'hsl(var(--muted-foreground))' },
-        accent: { DEFAULT: 'hsl(var(--accent))', foreground: 'hsl(var(--accent-foreground))' },
-        popover: { DEFAULT: 'hsl(var(--popover))', foreground: 'hsl(var(--popover-foreground))' },
-        card: { DEFAULT: 'hsl(var(--card))', foreground: 'hsl(var(--card-foreground))' },
-      },
-      borderRadius: { lg: 'var(--radius)', md: 'calc(var(--radius) - 2px)', sm: 'calc(var(--radius) - 4px)' },
-      borderWidth: { hairline: hairlineWidth() },
-    },
-  },
+  presets: [require('nativewind/preset'), require('@workspace/styling/tailwind')],
+  theme: { extend: { borderWidth: { hairline: hairlineWidth() } } },
   future: { hoverOnlyWhenSupported: true },
   plugins: [require('tailwindcss-animate')],
 };
@@ -89,31 +73,6 @@ module.exports = {
     writeFile(path.join(dir, 'global.css'), `@tailwind base;
 @tailwind components;
 @tailwind utilities;
-
-@layer base {
-  :root {
-    --background: 0 0% 100%; --foreground: 0 0% 3.9%;
-    --card: 0 0% 100%; --card-foreground: 0 0% 3.9%;
-    --popover: 0 0% 100%; --popover-foreground: 0 0% 3.9%;
-    --primary: 0 0% 9%; --primary-foreground: 0 0% 98%;
-    --secondary: 0 0% 96.1%; --secondary-foreground: 0 0% 9%;
-    --muted: 0 0% 96.1%; --muted-foreground: 0 0% 45.1%;
-    --accent: 0 0% 96.1%; --accent-foreground: 0 0% 9%;
-    --destructive: 0 84.2% 60.2%; --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 89.8%; --input: 0 0% 89.8%; --ring: 0 0% 63%; --radius: 0.625rem;
-  }
-  .dark:root {
-    --background: 0 0% 3.9%; --foreground: 0 0% 98%;
-    --card: 0 0% 3.9%; --card-foreground: 0 0% 98%;
-    --popover: 0 0% 3.9%; --popover-foreground: 0 0% 98%;
-    --primary: 0 0% 98%; --primary-foreground: 0 0% 9%;
-    --secondary: 0 0% 14.9%; --secondary-foreground: 0 0% 98%;
-    --muted: 0 0% 14.9%; --muted-foreground: 0 0% 63.9%;
-    --accent: 0 0% 14.9%; --accent-foreground: 0 0% 98%;
-    --destructive: 0 70.9% 59.4%; --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 14.9%; --input: 0 0% 14.9%; --ring: 300 0% 45%;
-  }
-}
 `);
 }
 function expoScheme(projectName) {
@@ -160,11 +119,12 @@ export async function scaffoldExpo({ root, options }) {
         dependencies: {
             ...MOBILE_APP_DEPENDENCIES.dependencies,
             ...MOBILE_NATIVEWIND_DEPENDENCIES.dependencies,
+            '@workspace/styling': 'workspace:*',
         },
         devDependencies: {
             ...MOBILE_APP_DEPENDENCIES.devDependencies,
             '@workspace/eslint-config': 'workspace:*',
-            eslint: '10.0.3',
+            eslint: NATIVE_ESLINT_VERSION,
         },
     }, null, 2) + '\n');
     writeFile(path.join(dir, 'app.json'), JSON.stringify({
@@ -200,7 +160,6 @@ export async function scaffoldExpo({ root, options }) {
 import { PortalHost } from '@rn-primitives/portal';
 import { Stack } from 'expo-router';
 
-
 export default function RootLayout() {
   return <><Stack /><PortalHost /></>;
 }
@@ -215,7 +174,7 @@ export default function HomeScreen() {
       <StatusBar style="auto" />
       <View style={styles.content}>
         <Text accessibilityRole="header" style={styles.title}>{${nameLiteral}}</Text>
-        <Text selectable style={styles.subtitle}>Deterministic Expo application generated by Anhedral.</Text>
+        <Text selectable style={styles.subtitle}>Expo application scaffold generated by Anhedral.</Text>
         <Button onPress={() => void Linking.openURL('https://docs.expo.dev')}>Learn more</Button>
       </View>
     </ScrollView>

package/dist/readiness.js

@@ -1,4 +1,5 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from './bounded-file.js';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { inspectWorkspaceGraph } from './workspace-graph.js';
@@ -8,11 +9,16 @@ import { STANDARD_PRODUCTS } from './stack-registry.js';
 export function inspectProject(root) {
     const checks = [];
     const record = (id, ok, detail) => checks.push({ id, ok, detail });
-    const read = (file) => JSON.parse(readFileSync(path.join(root, file), 'utf8'));
+    const read = (file) => JSON.parse(readBoundedFile(path.join(root, file), MAX_PROJECT_JSON_BYTES).toString('utf8'));
     record('workspace', existsSync(path.join(root, 'pnpm-workspace.yaml')), 'pnpm workspace manifest');
     record('lockfile', existsSync(path.join(root, 'pnpm-lock.yaml')), 'Committed dependency resolution required');
     try {
         const plan = read('anhedral.setup.json');
+        const recordedVersion = plan?.cliVersion;
+        const compatible = recordedVersion === CAPABILITY_REGISTRY.cliVersion;
+        record('cli-compatibility', compatible, /^\d+\.\d+\.\d+$/.test(recordedVersion ?? '')
+            ? `Use anhedral@${recordedVersion} for this project or review upgrade differences`
+            : 'Use the recorded project CLI version or review upgrade differences');
         validateSetupPlan(plan);
         const standard = read('anhedral.standard.json');
         record('setup-plan', true, `Requirements recorded by CLI ${plan.cliVersion}`);
@@ -40,7 +46,6 @@ export function inspectProject(root) {
         catch {
             record('workspace-graph', false, 'Invalid workspace manifests, references or dependency cycles');
         }
-        record('cli-compatibility', plan.cliVersion === CAPABILITY_REGISTRY.cliVersion, 'Use the project CLI version or review upgrade differences');
         record('selection', standard.schemaVersion === 1 &&
             JSON.stringify(standard.products) === JSON.stringify(plan.products) &&
             standard.hosting ===
@@ -68,6 +73,9 @@ export function validateSetupPlan(plan) {
         value.registryVersion !== 1 ||
         typeof value.cliVersion !== 'string')
         throw new Error('Unsupported setup plan version.');
+    if (/^\d+\.\d+\.\d+$/.test(value.cliVersion) &&
+        value.cliVersion !== CAPABILITY_REGISTRY.cliVersion)
+        throw new Error(`Use anhedral@${value.cliVersion} for this project or review upgrade differences.`);
     if (!Array.isArray(value.products) ||
         !value.products.length ||
         !value.products.every((id) => STANDARD_PRODUCTS.includes(id)))

package/dist/registry/add.js

@@ -1,5 +1,6 @@
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from '../bounded-file.js';
 import { configureSecurityBackports } from '../security-backports.js';
-import { bootstrapWorkspace } from '../scaffold/bootstrap.js';
+import { bootstrapWorkspace, assertWorkspaceRuntime } from '../scaffold/bootstrap.js';
 import { registerApplication } from '../project-state.js';
 import { registerVercelApplication } from '../vercel.js';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
@@ -22,6 +23,8 @@ export async function addStackItems(root, request, run = execFile) {
     for (const key of Object.keys(request))
         if (!['items', 'dryRun', 'skipInstall'].includes(key))
             throw new Error(`Unknown add option: ${key}. Only bundled registry items are supported.`);
+    if (!request.dryRun)
+        assertWorkspaceRuntime(run);
     root = realpathSync(root);
     if (!request.items.length)
         throw new Error('Select at least one registry item.');
@@ -62,7 +65,7 @@ export async function addStackItems(root, request, run = execFile) {
             throw new Error(`Adding this selection relocates ${item.name}; migrate its existing source explicitly.`);
     }
     const before = sourceFiles(root);
-    const receiptText = readFileSync(path.join(root, 'anhedral.registry.json'), 'utf8');
+    const receiptText = readBoundedFile(path.join(root, 'anhedral.registry.json'), MAX_PROJECT_JSON_BYTES).toString('utf8');
     const commitPaths = [];
     const conflicts = [];
     const result = {
@@ -151,7 +154,7 @@ export async function addStackItems(root, request, run = execFile) {
             commitPaths.push('anhedral.registry.json');
             // Detect concurrent changes even to source that this addition would otherwise preserve.
             if (!isDeepStrictEqual(sourceFiles(root), before) ||
-                readFileSync(path.join(root, 'anhedral.registry.json'), 'utf8') !== receiptText)
+                readBoundedFile(path.join(root, 'anhedral.registry.json'), MAX_PROJECT_JSON_BYTES).toString('utf8') !== receiptText)
                 throw new Error('Workspace changed during addition; retry after reviewing source.');
         },
         afterCommit: () => {

package/dist/registry/receipt.js

@@ -16,6 +16,7 @@ const excluded = new Set([
     '.expo',
     '.fallow',
     '.anhedral',
+    '.anhedral-audit-report.json',
     '.anhedral.lock',
     '.anhedral-txn',
     'anhedral.registry.json',

package/dist/registry/resolve.js

@@ -50,6 +50,23 @@ export function resolveStandardProducts(selected, hosting, hostingSpecified) {
         throw new Error('--hosting applies to the web application.');
     resolveStackRegistry({ products: [...selected], hosting });
 }
+function itemDependencies(name, context) {
+    const definition = getStackDefinition(name);
+    const dependencies = new Set(definition.registryDependencies);
+    if (definition.runtime) {
+        if (!hasServer(context) && definition.runtime !== 'optional-worker')
+            throw new Error(`${name} requires a server runtime.`);
+        if (needsWorker(name, context) &&
+            !context.has('hono') &&
+            !(context.options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
+            throw new Error(`${name} requires a Cloudflare runtime.`);
+        if (hasServer(context))
+            dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
+    }
+    for (const dependency of definition.resolveDependencies?.(context) ?? [])
+        dependencies.add(dependency);
+    return dependencies;
+}
 export function resolveStackRegistry(options) {
     const selected = new Set(options.products);
     validateProducts(selected, options.hosting);
@@ -62,20 +79,9 @@ export function resolveStackRegistry(options) {
             return;
         const definition = getStackDefinition(name);
         const metadata = getStackItem(name);
-        const dependencies = new Set(definition.registryDependencies);
-        if (definition.runtime) {
-            if (!hasServer(context) && definition.runtime !== 'optional-worker')
-                throw new Error(`${name} requires a server runtime.`);
-            if (needsWorker(name, context) &&
-                !context.has('hono') &&
-                !(options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
-                throw new Error(`${name} requires a Cloudflare runtime.`);
-            if (hasServer(context))
-                dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
-        }
-        for (const dependency of definition.resolveDependencies?.(context) ?? [])
-            dependencies.add(dependency);
+        const dependencies = itemDependencies(name, context);
         metadata.registryDependencies = [...dependencies];
+        metadata.environment = definition.resolveEnvironment?.(context) ?? metadata.environment;
         metadata.targets = definition.resolveTargets?.(context) ?? metadata.targets;
         if (definition.configure)
             metadata.bindings = definition.configure(context);

package/dist/registry/types.d.ts

@@ -57,6 +57,7 @@ export interface StackRegistryItem {
 export interface ItemDefinition extends Omit<StackRegistryItem, 'bindings'> {
     install?: Recipe;
     configure?: (context: RecipeContext) => Json;
+    resolveEnvironment?: (context: RecipeContext) => string[];
     resolveTargets?: (context: RecipeContext) => string[];
     resolvePackage?: (context: RecipeContext, recipe: PackageRecipe) => PackageRecipe;
     resolveDependencies?: (context: RecipeContext) => string[];

package/dist/render.d.ts

@@ -8,3 +8,5 @@ export declare function markdownHeading(value: string): string;
 export declare function packageNameFromText(value: string): string;
 export declare function childPackageName(projectName: string, suffix: string): string;
 export declare function identifierSegment(value: string): string;
+/** Keep provider resource names within the shared Workers/R2/Queues naming limits. */
+export declare function resourceName(projectName: string, suffix: string): string;

package/dist/render.js

@@ -72,3 +72,13 @@ export function identifierSegment(value) {
         .replace(/^-+|-+$/g, '');
     return segment || 'app';
 }
+/** Keep provider resource names within the shared Workers/R2/Queues naming limits. */
+export function resourceName(projectName, suffix) {
+    const segment = identifierSegment(projectName);
+    const qualifier = identifierSegment(suffix);
+    if (qualifier.length > 40)
+        throw new Error('Resource suffix is too long.');
+    const digest = createHash('sha256').update(projectName).digest('hex').slice(0, 8);
+    const base = segment === projectName ? segment : `${segment}-${digest}`;
+    return `${compactPackageSegment(base, 62 - qualifier.length)}-${qualifier}`;
+}