anhedral 0.10.0 → 0.11.0

package/README.md

@@ -1,12 +1,14 @@
-# Anhedral Init
+# Anhedral
 
-[![CI](https://github.com/anhedral/anhedral-init/actions/workflows/ci.yml/badge.svg)](https://github.com/anhedral/anhedral-init/actions/workflows/ci.yml)
+[![CI](https://github.com/anhedral/anhedral-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/anhedral/anhedral-cli/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/anhedral)](https://www.npmjs.com/package/anhedral)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
+Anhedral scaffolds source code, guides authentication, then provisions, configures, and deploys the supported stack automatically wherever provider APIs allow. Application features, design, custom integrations and business workflows remain development work; Anhedral offers development and ongoing maintenance services for businesses that want that work delivered for them.
+
 1. **Describe the app** — Anhedral clarifies its purpose, users and essential features.
 2. **Choose the architecture** — Explain the stack decisions; default web apps use Vinext on Cloudflare Workers.
-3. **Set up ownership** — Choose customer-account or managed hosting; set up only the accounts that profile requires.
+3. **Set up ownership** — Use your own source repository and provider accounts; configure only the selected services.
 4. **Build the app** — Implement the requested features, data, authentication and integrations.
 5. **Check and ship** — Run checks, deploy, open the real URL and verify the live user flows.
 6. **Maintain it** — Keep architecture, deployment history and verification visible; update or roll back as needed.
@@ -17,50 +19,84 @@ Anhedral initializes a Vinext, React, TypeScript, Tailwind, shadcn/ui and Lucide
 
 ## Try it
 
-Install the plugin and select **Try now**. Use the CLI version pinned by its bundled registry. A local rewrite or ZIP does not update an installed plugin; unpublished development versions require their matching local CLI and skill.
+Use `anhedral help <command>` for focused options and examples. Human output shows concise outcomes and next steps; `--json` preserves the complete result for scripts. `--cwd` / `-c` selects a project, and `--quiet` / `-q` suppresses human output while retaining errors and JSON. [CLI behavior and design](docs/cli-design.md) explains the comparison with shadcn, GitHub CLI and uv, and the source preview contract.
+
+Use the CLI independently, or install the optional Codex plugin:
+
+```sh
+codex plugin marketplace add anhedral/anhedral-cli
+codex plugin add anhedral@anhedral
+```
+
+Select **Try now** in Codex. The plugin uses the CLI version pinned by its bundled registry. A local rebuild does not update an installed plugin; development versions require their matching local CLI and plugin.
 
 Starter prompt:
 
-> Create a new app with [@Anhedral](plugin://anhedral@anhedral). Start by asking me what it should do.
+> Create a new project using [@Anhedral](plugin://anhedral@anhedral). Start by explaining the stack and asking me what it should be about.
 
 Codex asks about the app, explains the stack, implements the product, configures selected services, and delivers into your authorized accounts. The CLI commands below are also available independently.
 
-Use Node.js 22.13+ and pnpm 10.34.5 for generated workspaces. Generate on Linux, macOS, or WSL.
+Use Node.js 22.13+ on the 22.x line or Node.js 24+, with pnpm 10.34.5, for generated workspaces. Generate on Linux, macOS, or WSL.
 
 ```sh
 # Inspect a plan first: no project files or cloud resources are created
-pnpm dlx anhedral@latest new my-app --dry-run --json
+pnpm dlx anhedral@latest init my-app --dry-run --json
 
 # Generate the default Vinext/Workers workspace
-pnpm dlx anhedral@latest new my-app
+pnpm dlx anhedral@latest init my-app
 cd my-app
 pnpm dev
 ```
 
 The first command downloads the CLI through pnpm; the CLI's dry run performs no writes or network calls. Generation needs network access for the official shadcn bootstrap. The default selects Vinext on Cloudflare; add capabilities only when needed. Follow the generated README for provider setup, Worker builds, and preview deployment.
 
-**If Anhedral is useful to you, [star the repository](https://github.com/anhedral/anhedral-init) to help other developers discover it.**
+**If Anhedral is useful to you, [star the repository](https://github.com/anhedral/anhedral-cli) to help other developers discover it.**
 
-## Sponsors
+## Initialize, authenticate and deliver
 
-### Help keep Anhedral Init free and open source
+Install the CLI with `npm install --global anhedral`, or run these commands through `pnpm dlx anhedral@latest`.
+
+```sh
+anhedral init my-app --hono --d1 --better-auth --r2
+anhedral auth my-app
+anhedral auth my-app --status --json
+anhedral ship my-app --dry-run --json
+anhedral ship my-app --json
+```
 
-Anhedral Init is free and open source. Sponsorship helps fund ongoing development, maintenance, and documentation so more developers can build and deliver applications they own.
+`init` accepts a destination directory or initializes the current directory. Authentication requirements derive from the selected stack; Cloudflare requirements are deduplicated. Interactive authentication can open the supported Cloudflare, Vercel and Expo login flows. API-backed checks use credentials supplied through the environment; they do not read or print application secret files. Missing access and insufficient permissions remain explicit. A verified session or API endpoint does not establish every provisioning permission, the intended account connection or configured application secrets. Use the supported `connect` workflow to select hosting account, project and audience before delivery.
 
-**[♡ Become a sponsor](docs/sponsorships.md)**
+`init` writes a nonsecret `anhedral.providers.json` for the selected integrations. Complete its account/resource choices before shipping. Adapters provision and configure Neon, Clerk, Resend, Stripe webhooks, RevenueCat apps, Sentry, PostHog and OpenAI project/service-account resources. Management access, provider eligibility and owner prerequisites remain explicit. See [provider configuration](docs/provider-configuration.md) for supported operations, credentials, runtime configuration, recovery and verification limits.
+
+Cloudflare `ship` runs checks before reconciling D1, R2, KV, Queue and private Basin stream resources. If provisioning changes tracked binding IDs, it stops before deployment: review and commit the configuration, then repeat `ship`. It never commits source automatically. Runtime credentials accompany the checked code deployment; Vercel receives the selected web runtime's production variables. In mixed projects default `ship` runs Cloudflare services before the Vercel web target; use `--provider cloudflare` or `--provider vercel` for an explicit target. Partial delivery is reported without an automatic cross-provider rollback. The operation journal records diagnostics; retries recheck prerequisites and use resource receipts rather than skipping recorded phases. Pending provider setup stops deployment. Authentication alone does not establish completed setup.
+
+For an Expo project with an explicit owner/slug in `app.json` and the required signing configuration:
+
+```sh
+anhedral ship my-app --platform android --profile preview --json
+anhedral ship my-app --platform ios --profile simulator --json
+```
+
+EAS project creation/linking stops for review and a source commit. Queued builds return their build-page link; repeat the same command to inspect the existing build without submitting another. Completed builds return their ID, artifact type and download URL after checking project and source identity. Android preview produces an APK; production normally produces an AAB. The simulator profile produces an iOS Simulator artifact, not a TestFlight upload. Production iOS builds require Apple signing credentials. No store submission is performed. Build success does not verify the app's feature behavior.
+
+Private provisioning receipts and credentials stay in ignored `.anhedral/` state. Inspect them with `anhedral integrations status my-app --json`; its output is redacted and read-only. `integrations recover` verifies an explicitly selected pending resource and writes only its local completion receipt. Legacy entries without descriptors, changed configuration, and missing one-time credentials remain blocked. See [provider configuration](docs/provider-configuration.md) before attempting recovery or moving machines.
+
+For Better Auth, configure the primary server's ignored private runtime file with a generated secret of at least 32 characters and its HTTPS public origin; POSIX file permissions must be `0600`. Older Wrangler configs must remove same-named plain auth variables before secrets can be deployed. Review and apply the generated database migrations; resource provisioning does not establish application authorization or completed features.
 
 ## Choose your stack
 
-The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time.
+The bundled stack registry drives composition of every supported stack part. Run `anhedral inspect --json` for read-only stack/setup/delivery evidence. Run `anhedral registry capabilities --json` for the implemented scope, local evidence, and owner prerequisites. Live provider acceptance remains separate; Electron/WXT distribution and plugin live readers are not automated, and Expo delivery returns EAS artifacts without store submission. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `init --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time. Generated `docs/stack.md` lists the current resolved options, targets, environment names, required setup and verification; additions refresh it without rewriting the application README.
 
 Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports only the bundled catalog maintained and tested by Anhedral. External registries and customer-authored registry payloads are unsupported. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
 
 Use additions after initialization:
 
 ```sh
-anhedral add my-app resend stripe --dry-run --json
-anhedral add my-app resend stripe
+anhedral add resend stripe --cwd my-app --dry-run --json
+anhedral add resend stripe --cwd my-app --diff
+anhedral add resend stripe --cwd my-app
 anhedral registry list --json
+anhedral registry capabilities --json
 anhedral registry view resend --json
 ```
 
@@ -69,15 +105,15 @@ Review the dry-run file list and conflicts, then run the same addition without `
 Application recipes start from the official **shadcn pnpm/Turborepo monorepo**. The default creates **Vinext + React + TypeScript + Tailwind + shadcn/ui + Lucide**, targeting **Cloudflare Workers**. Select additional apps and services only when needed.
 
 ```sh
-pnpm dlx anhedral@latest new my-app
-pnpm dlx anhedral@latest new mobile-app --expo
-pnpm dlx anhedral@latest new product --next --expo --hono --neon --clerk --r2
+pnpm dlx anhedral@latest init my-app
+pnpm dlx anhedral@latest init mobile-app --expo
+pnpm dlx anhedral@latest init product --next --expo --hono --neon --clerk --r2
 pnpm dlx anhedral@latest init --wxt
 ```
 
-To use a local checkout, run `pnpm build`, then `node dist/bin.js new <directory>`.
+To use a local checkout, run `pnpm build`, then `node dist/bin.js init <directory>`.
 
-![Anhedral CLI init stack](assets/anhedral-cli-init.svg)
+![Anhedral stack](assets/anhedral-stack.svg)
 
 Applications: `vinext`, `next`, `expo`, `electron`, `wxt`, `hono`.
 
@@ -99,18 +135,18 @@ Provider packages and services are **starters**, not finished product features.
 
 Anhedral's stack must make unexpected spending and runaway work difficult to trigger, easy to detect, and possible to stop. Choosing Vercel, Cloudflare, or another provider does not establish those protections. Treat the following as delivery requirements for each selected service; **the initializer does not automatically configure or verify all of them**.
 
-| Common mistake | Basic instruction |
-| --- | --- |
-| Assuming a free tier or budget alert caps spending | Check what each service charges for. Set available spending limits and alerts, allow for enforcement delays, and identify costs without a hard cap. |
-| Creating infinite loops in jobs, queues, schedules or alarms | Define a stopping condition, deadline and maximum amount of work. Keep job processing separate from enqueueing, and prevent overlapping scheduled runs. |
-| Retrying forever or processing the same job twice | Limit retries and concurrency, add backoff, and make repeated processing safe. Move failed jobs to a dead-letter queue for investigation before replay. |
-| Scanning an entire database or writing repeatedly on every request | Use indexed lookups, bounded pagination and batches. Measure storage operations per user action and remove unnecessary work. |
-| Letting public traffic trigger unlimited paid operations | Authorize expensive actions. Set user, tenant and total usage quotas for email, AI, uploads and background jobs; rate-limit public entry points. |
-| Assuming caching or DDoS protection eliminates traffic costs | Check request, bandwidth and image-processing charges. Optimize media, restrict transformations and protect direct access to origins. |
-| Collecting unlimited logs, analytics or session recordings | Collect only necessary events, sample high-volume data, and limit retention and ingestion. Keep test traffic separate. |
-| Testing with unrestricted production credentials | Separate environments and credentials. Mock paid services in routine tests and bound live test traffic. Review generated code and test failure paths before release. |
-| Discovering runaway usage only when the bill arrives | Monitor usage spikes and retries, assign an alert owner, and test an emergency stop for both web requests and background work. |
-| Assuming code rollback restores data | Keep backups and test restoration. Document how to stop work, recover data and resume safely. |
+| Common mistake                                                     | Basic instruction                                                                                                                                                    |
+| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Assuming a free tier or budget alert caps spending                 | Check what each service charges for. Set available spending limits and alerts, allow for enforcement delays, and identify costs without a hard cap.                  |
+| Creating infinite loops in jobs, queues, schedules or alarms       | Define a stopping condition, deadline and maximum amount of work. Keep job processing separate from enqueueing, and prevent overlapping scheduled runs.              |
+| Retrying forever or processing the same job twice                  | Limit retries and concurrency, add backoff, and make repeated processing safe. Move failed jobs to a dead-letter queue for investigation before replay.              |
+| Scanning an entire database or writing repeatedly on every request | Use indexed lookups, bounded pagination and batches. Measure storage operations per user action and remove unnecessary work.                                         |
+| Letting public traffic trigger unlimited paid operations           | Authorize expensive actions. Set user, tenant and total usage quotas for email, AI, uploads and background jobs; rate-limit public entry points.                     |
+| Assuming caching or DDoS protection eliminates traffic costs       | Check request, bandwidth and image-processing charges. Optimize media, restrict transformations and protect direct access to origins.                                |
+| Collecting unlimited logs, analytics or session recordings         | Collect only necessary events, sample high-volume data, and limit retention and ingestion. Keep test traffic separate.                                               |
+| Testing with unrestricted production credentials                   | Separate environments and credentials. Mock paid services in routine tests and bound live test traffic. Review generated code and test failure paths before release. |
+| Discovering runaway usage only when the bill arrives               | Monitor usage spikes and retries, assign an alert owner, and test an emergency stop for both web requests and background work.                                       |
+| Assuming code rollback restores data                               | Keep backups and test restoration. Document how to stop work, recover data and resume safely.                                                                        |
 
 Before delivery, record the budget and limits in the app's `docs/architecture.md`, and the tested controls, alert owner and recovery steps in `docs/verification.md`. Verify behavior under traffic spikes, duplicate jobs and service failures. Resolve exposure beyond the customer's authorized budget before enabling the workload.
 
@@ -131,11 +167,10 @@ anhedral verify my-app --json
 anhedral manage my-app --json
 ```
 
-Anhedral-managed hosting is under implementation. Its intended profile uses Workers for Platforms, Anhedral sign-in, an app registry, durable source/build versions and private routing; customer Cloudflare/GitHub/Vercel accounts should not be prerequisites. GitHub connection/export is optional for this managed profile. The local foundation is not yet a deployed service, a verified managed URL or a promise of free hosting. The [managed-hosting contract](docs/managed-hosting-architecture.md) defines required accounts, paid activation, source/version storage and the planned agent CLI. Use the supported customer-account path when that is the agreed destination; do not silently substitute it for unavailable managed hosting.
 
 For explicit Next.js/Vercel, connect the intended customer scope and private audience with `--git`, run checks before an authorized source push, then `adopt --json` and `verify --json` after the actual production deployment. Use `ship` only when selecting CLI delivery rather than deploying the same Git change twice.
 
-Account discovery selects the sole accessible account; use `--account <id>` for multiple accounts. D1, private R2, KV and Queues are reconciled idempotently. Selected external providers use their actual tools. Private hosting requires Cloudflare Zero Trust and scoped Access permissions; protection covers the whole Worker before product deployment. Whole-Worker Access currently excludes WebSockets, which need a deliberate alternative access workflow.
+Account discovery selects the sole accessible account; use `--account <id>` for multiple accounts. D1, private R2, KV and Queues are reconciled idempotently. Selected API integrations use the bounded adapters documented in [provider configuration](docs/provider-configuration.md). Private hosting requires Cloudflare Zero Trust and scoped Access permissions; protection covers the whole Worker before product deployment. Whole-Worker Access currently excludes WebSockets, which need a deliberate alternative access workflow.
 
 Shipping requires a clean app source commit, runs checks, captures actual URLs and versions, and confirms 100% provider traffic. Failures preserve partial-operation evidence. `status --refresh` verifies current state. `rollback --release <id> --data-compatible` restores recorded code versions after schema/resource compatibility review; it does not restore data.
 
@@ -143,7 +178,7 @@ For a Git-triggered production release, run checks before pushing, then `adopt -
 
 ## Inspect setup and compatibility
 
-The CLI supports `new`, `init`, `add`, `registry`, `doctor`, `repository`, `register`, `connect`, `provision`, `ship`, `adopt`, `recover`, `status`, `manage`, `verify`, `rollback`, `--help`, and `--version`. `anhedral doctor <directory> --json` checks registry provenance, generated targets, workspace dependencies and local setup requirements without writes. Add `--providers` for read-only tool/account readiness; production product behavior remains unverified. Use `anhedral --help` for options. Its JSON plan includes versioned setup requirements, and generated projects include `anhedral.setup.json`. Requirements do not imply that accounts or resources are configured. The CLI and plugin catalogs derive from `src/stack-registry.ts`; `pnpm build` refreshes the plugin's bundled registry and stack standard.
+The CLI supports `init`, `auth`, `new`, `add`, `registry`, `doctor`, `repository`, `register`, `connect`, `provision`, `ship`, `adopt`, `recover`, `status`, `manage`, `verify`, `rollback`, `integrations`, `--help`, and `--version`. `anhedral doctor <directory> --json` checks registry provenance, generated targets, workspace dependencies and local setup requirements without writes. Add `--providers` for read-only tool/account readiness; production product behavior remains unverified. Use `anhedral --help` for options. Its JSON plan includes versioned setup requirements, and generated projects include `anhedral.setup.json`. Requirements do not imply that accounts or resources are configured. The CLI and plugin catalogs derive from `src/stack-registry.ts`; `pnpm build` refreshes the plugin's bundled registry and stack standard.
 
 Requires Node.js 20.19+ in the 20 series or 22.12+ and pnpm 10.34.5. Pin the CLI version and commit the generated lockfile. The shadcn bootstrap version is pinned in `src/dependencies.ts`; review its upgrades and generated output before use.
 
@@ -153,26 +188,30 @@ Initialize from Linux, macOS, or WSL. Native Windows initialization fails before
 
 The workflow follows the [Anhedral Application Stack & Delivery Standard](docs/application-stack-standard.md).
 
-Install the plugin with `codex plugin marketplace add anhedral/anhedral-init`, then `codex plugin add anhedral@anhedral`. Releases include a self-contained skill plugin ZIP matching the CLI version. A public ChatGPT listing requires separate submission.
+Install the plugin with `codex plugin marketplace add anhedral/anhedral-cli`, then `codex plugin add anhedral@anhedral`. The marketplace pins an immutable plugin source tag containing the same self-contained runtime as the release ZIP. Released plugin ZIPs match the CLI version. The headless-first plugin includes an optional MCP-backed project inspector with Overview, Stack, Setup and Delivery sections; see [plugin UI development](docs/plugin-ui.md) for preview, packaging and host integration. A public ChatGPT listing requires separate submission.
 
 Ask: **“Build a team request dashboard with Anhedral. Include sign-in, persistent requests, ownership, status updates, and filters. Implement and verify the complete app.”**
 
 The plugin guides Codex through requirement inference, stack selection, CLI planning and generation, implementation, and verification. It records decisions in the app's `docs/architecture.md` and evidence in `docs/verification.md`. The CLI maintains deployment records and reads provider status. Provider access uses the tools and CLIs available in the session.
 
-Anhedral carries one request through to a shipped product with editable source in your accounts. Initialization generates a starter; delivery also requires implementation, provider access and live verification.
+The plugin guides development toward an application with editable source in your accounts. Initialization generates a starter; delivery also requires feature implementation, provider access and live verification. A successful scaffold or build is not evidence of a working product.
 
 ## Contributing and security
 
-Anhedral is maintainer-led, with a small contribution surface. Focused bug fixes, tests, and documentation corrections are welcome; discuss larger changes before implementation. See [contributing](https://github.com/anhedral/anhedral-init/blob/main/.github/CONTRIBUTING.md), the [code of conduct](https://github.com/anhedral/anhedral-init/blob/main/.github/CODE_OF_CONDUCT.md), and [security reporting](https://github.com/anhedral/anhedral-init/blob/main/.github/SECURITY.md). Use [issues](https://github.com/anhedral/anhedral-init/issues) for reproducible CLI problems and [private reporting](https://github.com/anhedral/anhedral-init/security/advisories/new) for vulnerabilities.
+Anhedral is maintainer-led, with a small contribution surface. Focused bug fixes, tests, and documentation corrections are welcome; discuss larger changes before implementation. See [contributing](https://github.com/anhedral/anhedral-cli/blob/main/.github/CONTRIBUTING.md), the [code of conduct](https://github.com/anhedral/anhedral-cli/blob/main/.github/CODE_OF_CONDUCT.md), and [security reporting](https://github.com/anhedral/anhedral-cli/blob/main/.github/SECURITY.md). Use [issues](https://github.com/anhedral/anhedral-cli/issues) for reproducible CLI problems and [private reporting](https://github.com/anhedral/anhedral-cli/security/advisories/new) for vulnerabilities.
 
 ## Development
 
+Match the CLI, plugin and registry versions when developing or reviewing changes. Unpublished changes require the locally built CLI and matching plugin rather than the public npm release. Local tests and packaged-artifact checks do not establish live provider acceptance or native plugin installation.
+
 ```sh
 pnpm install --frozen-lockfile
 pnpm test:all
 pnpm test:integration   # Generate and validate fresh application workspaces
 ```
 
+The project inspector lives in `plugin-app/` with its own dependency lockfile and Node 22.13+/24 toolchain. Run `pnpm --dir plugin-app install --frozen-lockfile`, then `pnpm plugin:check`.
+
 Implementation lives in `src/`, plugin instructions in `plugins/anhedral/`, and validation in `scripts/` and `tests/`. `dist/` and `.artifacts/release/` are generated and ignored.
 
 Anhedral is open source under the [Apache License 2.0](LICENSE). Generated applications remain ordinary project source that their developers can customize and license for their products. Preserve applicable license notices for upstream code and dependencies.

package/assets/{anhedral-cli-init-technical.svg → anhedral-stack-technical.svg}

@@ -154,7 +154,7 @@
 <text x="1234" y="1004" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="19" font-weight="500" text-anchor="middle" letter-spacing="0">Hono + OpenAPI</text>
 <text x="1234" y="1030" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="15" font-weight="400" text-anchor="middle" letter-spacing="0">optional shared API</text>
 <text x="1234" y="1066" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Web-only: route handlers</text>
-<text x="1234" y="1094" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Containers when required</text>
+<text x="1234" y="1094" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Selected Worker bindings</text>
 <rect x="1435" y="354" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="366" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1456 382.5) scale(0.9583333333333334)"><path d="M24 0V24l-9.365-8.045V24H0V0ZM2.942 21.087h8.751V9.563l9.365 8.204V2.919L2.942 2.914Z" fill="#35d6a8"/></g>
@@ -168,7 +168,7 @@
 <g transform="translate(1455 458) scale(2)"><path d="M21.678.521c-1.032-.92-2.28-.55-3.513.544a8.71 8.71 0 0 0-.547.535c-2.109 2.237-4.066 6.38-4.674 9.544.237.48.422 1.093.544 1.561a13.044 13.044 0 0 1 .164.703s-.019-.071-.096-.296l-.05-.146a1.689 1.689 0 0 0-.033-.08c-.138-.32-.518-.995-.686-1.289-.143.423-.27.818-.376 1.176.484.884.778 2.4.778 2.4s-.025-.099-.147-.442c-.107-.303-.644-1.244-.772-1.464-.217.804-.304 1.346-.226 1.478.152.256.296.698.422 1.186.286 1.1.485 2.44.485 2.44l.017.224a22.41 22.41 0 0 0 .056 2.748c.095 1.146.273 2.13.5 2.657l.155-.084c-.334-1.038-.47-2.399-.41-3.967.09-2.398.642-5.29 1.661-8.304 1.723-4.55 4.113-8.201 6.3-9.945-1.993 1.8-4.692 7.63-5.5 9.788-.904 2.416-1.545 4.684-1.931 6.857.666-2.037 2.821-2.912 2.821-2.912s1.057-1.304 2.292-3.166c-.74.169-1.955.458-2.362.629-.6.251-.762.337-.762.337s1.945-1.184 3.613-1.72C21.695 7.9 24.195 2.767 21.678.521m-18.573.543A1.842 1.842 0 0 0 1.27 2.9v16.608a1.84 1.84 0 0 0 1.835 1.834h9.418a22.953 22.953 0 0 1-.052-2.707c-.006-.062-.011-.141-.016-.2a27.01 27.01 0 0 0-.473-2.378c-.121-.47-.275-.898-.369-1.057-.116-.197-.098-.31-.097-.432 0-.12.015-.245.037-.386a9.98 9.98 0 0 1 .234-1.045l.217-.028c-.017-.035-.014-.065-.031-.097l-.041-.381a32.8 32.8 0 0 1 .382-1.194l.2-.019c-.008-.016-.01-.038-.018-.053l-.043-.316c.63-3.28 2.587-7.443 4.8-9.791.066-.069.133-.128.198-.194Z" fill="#51dce9"/></g>
 <path d="M 1519 456 L 1519 508" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="1539" y="473" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">D1 + Local Data</text>
-<text x="1539" y="497" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">D1 + Drizzle · or local SQLite</text>
+<text x="1539" y="497" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">D1 + Drizzle · local adapter interface</text>
 <text x="1539" y="517" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Choose persistence per product</text>
 <rect x="1435" y="530" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="542" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
@@ -230,11 +230,11 @@
 <text x="1539" y="1221" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Workers AI when advantageous</text>
 <rect x="1435" y="1234" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1246" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
-<g transform="translate(1455 1250) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
+<g transform="translate(1455 1250) scale(2)"><path d="M14.679 0c4.648 0 7.413 2.765 7.413 6.434s-2.765 6.434-7.413 6.434H12.33L24 24h-8.245l-8.88-8.44c-.636-.588-.93-1.273-.93-1.86 0-.831.587-1.565 1.713-1.883l4.574-1.224c1.737-.465 2.936-1.81 2.936-3.572 0-2.153-1.761-3.4-3.939-3.4H0V0z" fill="#f48120"/></g>
 <path d="M 1519 1248 L 1519 1300" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
-<text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Domain + Mail</text>
-<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">GoDaddy broker · Cloudflare nameservers</text>
-<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare Routing + Sending / Resend alternative</text>
+<text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Resend Email</text>
+<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Transactional email client</text>
+<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Configure API key and verified sender</text>
 <rect x="1435" y="1322" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1334" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1338) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>

package/assets/{anhedral-cli-init.svg → anhedral-stack.svg}

@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1660" viewBox="0 0 1920 1660" role="img" aria-labelledby="title description">
-<title id="title">Anhedral Init Stack</title>
+<title id="title">Anhedral Stack</title>
 <desc id="description">Client-owned shadcn, pnpm and Turborepo monorepo. Vinext on Cloudflare Workers is the web default; native Next.js on Vercel and OpenNext on Workers are optional; Hono and OpenAPI provide optional shared APIs. Select direct Neon HTTP with Drizzle or D1, authentication, private R2, KV, realtime, jobs, workflows, AI, email, billing, observability and analytics only when required. Dashed yellow lines show publication; white lines show application runtime and service bindings.</desc>
 <defs>
   <linearGradient id="card-fill" x1="0" y1="0" x2="1" y2="1">
@@ -154,7 +154,7 @@
 <text x="1234" y="1004" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="19" font-weight="500" text-anchor="middle" letter-spacing="0">Hono + OpenAPI</text>
 <text x="1234" y="1030" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="15" font-weight="400" text-anchor="middle" letter-spacing="0">optional shared API</text>
 <text x="1234" y="1066" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Web-only: route handlers</text>
-<text x="1234" y="1094" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Containers when required</text>
+<text x="1234" y="1094" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="middle" letter-spacing="0">Selected Worker bindings</text>
 <rect x="1435" y="354" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="366" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1456 382.5) scale(0.9583333333333334)"><path d="M24 0V24l-9.365-8.045V24H0V0ZM2.942 21.087h8.751V9.563l9.365 8.204V2.919L2.942 2.914Z" fill="#35d6a8"/></g>
@@ -168,7 +168,7 @@
 <g transform="translate(1455 458) scale(2)"><path d="M21.678.521c-1.032-.92-2.28-.55-3.513.544a8.71 8.71 0 0 0-.547.535c-2.109 2.237-4.066 6.38-4.674 9.544.237.48.422 1.093.544 1.561a13.044 13.044 0 0 1 .164.703s-.019-.071-.096-.296l-.05-.146a1.689 1.689 0 0 0-.033-.08c-.138-.32-.518-.995-.686-1.289-.143.423-.27.818-.376 1.176.484.884.778 2.4.778 2.4s-.025-.099-.147-.442c-.107-.303-.644-1.244-.772-1.464-.217.804-.304 1.346-.226 1.478.152.256.296.698.422 1.186.286 1.1.485 2.44.485 2.44l.017.224a22.41 22.41 0 0 0 .056 2.748c.095 1.146.273 2.13.5 2.657l.155-.084c-.334-1.038-.47-2.399-.41-3.967.09-2.398.642-5.29 1.661-8.304 1.723-4.55 4.113-8.201 6.3-9.945-1.993 1.8-4.692 7.63-5.5 9.788-.904 2.416-1.545 4.684-1.931 6.857.666-2.037 2.821-2.912 2.821-2.912s1.057-1.304 2.292-3.166c-.74.169-1.955.458-2.362.629-.6.251-.762.337-.762.337s1.945-1.184 3.613-1.72C21.695 7.9 24.195 2.767 21.678.521m-18.573.543A1.842 1.842 0 0 0 1.27 2.9v16.608a1.84 1.84 0 0 0 1.835 1.834h9.418a22.953 22.953 0 0 1-.052-2.707c-.006-.062-.011-.141-.016-.2a27.01 27.01 0 0 0-.473-2.378c-.121-.47-.275-.898-.369-1.057-.116-.197-.098-.31-.097-.432 0-.12.015-.245.037-.386a9.98 9.98 0 0 1 .234-1.045l.217-.028c-.017-.035-.014-.065-.031-.097l-.041-.381a32.8 32.8 0 0 1 .382-1.194l.2-.019c-.008-.016-.01-.038-.018-.053l-.043-.316c.63-3.28 2.587-7.443 4.8-9.791.066-.069.133-.128.198-.194Z" fill="#51dce9"/></g>
 <path d="M 1519 456 L 1519 508" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="1539" y="473" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">D1 + Local Data</text>
-<text x="1539" y="497" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">D1 + Drizzle · or local SQLite</text>
+<text x="1539" y="497" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">D1 + Drizzle · local adapter interface</text>
 <text x="1539" y="517" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Choose persistence per product</text>
 <rect x="1435" y="530" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="542" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
@@ -230,11 +230,11 @@
 <text x="1539" y="1221" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Workers AI when advantageous</text>
 <rect x="1435" y="1234" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1246" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
-<g transform="translate(1455 1250) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
+<g transform="translate(1455 1250) scale(2)"><path d="M14.679 0c4.648 0 7.413 2.765 7.413 6.434s-2.765 6.434-7.413 6.434H12.33L24 24h-8.245l-8.88-8.44c-.636-.588-.93-1.273-.93-1.86 0-.831.587-1.565 1.713-1.883l4.574-1.224c1.737-.465 2.936-1.81 2.936-3.572 0-2.153-1.761-3.4-3.939-3.4H0V0z" fill="#f48120"/></g>
 <path d="M 1519 1248 L 1519 1300" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
-<text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Domain + Mail</text>
-<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">GoDaddy broker · Cloudflare nameservers</text>
-<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare Routing + Sending / Resend alternative</text>
+<text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Resend Email</text>
+<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Transactional email client</text>
+<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Configure API key and verified sender</text>
 <rect x="1435" y="1322" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1334" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1338) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>

package/assets/security/audit-deps.mjs

@@ -115,11 +115,16 @@ function validateAdvisory(advisory) {
   ensure(Array.isArray(advisory.findings), 'Malformed pnpm advisory');
   ensure(advisory.findings.length > 0, 'Malformed pnpm advisory');
   advisory.findings.forEach(validateFinding);
+  const versions = advisory.findings.map((finding) => finding.version);
+  ensure(new Set(versions).size === versions.length, 'Duplicate pnpm advisory versions');
 }
 
 function validateCount(advisories, severity, count) {
   ensure(Number.isInteger(count) && count >= 0, 'Malformed pnpm vulnerability counts');
-  const details = advisories.filter((advisory) => advisory.severity === severity).length;
+  // The pnpm 10 registry endpoint counts affected versions, not unique advisory IDs.
+  const details = advisories
+    .filter((advisory) => advisory.severity === severity)
+    .reduce((total, advisory) => total + advisory.findings.length, 0);
   ensure(count === details, `Missing ${severity} advisory details: count ${count}, details ${details}`);
 }