anhedral 0.10.0 → 0.11.0

package/dist/providers/provision.js

@@ -0,0 +1,76 @@
+import { realpathSync } from 'node:fs';
+import { defaultRunner, withApplicationLock } from '../project-state.js';
+import { CREDENTIALS, providerApi, digest } from './api.js';
+import { PROVIDER_ADAPTERS } from './adapters.js';
+import { providerConfiguration, providerRequirements, selectedIntegrations } from './config.js';
+import { privateStateDirectory, ProvisioningState } from './state.js';
+import { configureRuntime } from './runtime.js';
+export function planProviderProvisioning(root) {
+    const configuration = providerConfiguration(root);
+    const providers = selectedIntegrations(root).map((id) => {
+        const settings = configuration.providers[id] ?? {};
+        return {
+            provider: id,
+            settings,
+            credential: CREDENTIALS[id],
+            missing: providerRequirements(id, settings),
+        };
+    });
+    return {
+        schemaVersion: 1,
+        providers,
+        configured: providers.every((provider) => !provider.missing.length),
+        mutation: false,
+    };
+}
+export async function provisionSelectedProviders(root, dryRun = false, run = defaultRunner, send = fetch, environment = process.env) {
+    root = realpathSync(root);
+    const plan = planProviderProvisioning(root);
+    const fingerprint = digest(providerConfiguration(root));
+    const assertConfiguration = () => {
+        if (digest(providerConfiguration(root)) !== fingerprint)
+            throw new Error('Provider configuration changed during provisioning; inspect recorded resources before retrying.');
+    };
+    if (dryRun || !plan.providers.length)
+        return { ...plan, ready: plan.configured, results: [], configuredFiles: [] };
+    for (const provider of plan.providers) {
+        if (provider.missing.length)
+            throw new Error(`${provider.provider}: complete anhedral.providers.json (${provider.missing.join(', ')}).`);
+        if (!environment[provider.credential])
+            throw new Error(`${provider.provider}: supply ${provider.credential} before provisioning.`);
+    }
+    const directory = await privateStateDirectory(root, run);
+    return withApplicationLock(root, async () => {
+        const state = new ProvisioningState(directory);
+        for (const provider of plan.providers)
+            state.context(provider.provider, provider.settings);
+        const results = [];
+        const values = {};
+        for (const provider of plan.providers) {
+            assertConfiguration();
+            const response = await PROVIDER_ADAPTERS[provider.provider]({
+                id: provider.provider,
+                settings: provider.settings,
+                state,
+                environment,
+                api: providerApi(provider.provider, provider.settings, environment, send),
+            });
+            Object.assign(values, response.runtime);
+            results.push({
+                provider: provider.provider,
+                resources: response.resources,
+                ready: response.ready,
+                nextActions: response.nextActions,
+            });
+        }
+        assertConfiguration();
+        const configuredFiles = await configureRuntime(root, values, run);
+        return {
+            schemaVersion: 1,
+            results,
+            ready: results.every((result) => result.ready),
+            configuredFiles,
+            mutation: true,
+        };
+    });
+}

package/dist/providers/receipts.d.ts

@@ -0,0 +1,20 @@
+import { type ApiObject } from './api.js';
+import type { IntegrationProvider } from './config.js';
+export type CredentialField = 'token' | 'secret' | 'api_key';
+export type OperationCredentials = Partial<Record<CredentialField, string>>;
+export interface MinimalReceipt {
+    id?: string | number;
+    application_id?: string | number;
+    project?: {
+        id: string | number;
+    };
+}
+/** Keep only identities required for adapter retries and separately retain supported
+ * one-time credentials. Provider responses often include unrelated secrets or metadata. */
+export declare function splitReceipt(id: IntegrationProvider, value: unknown): {
+    receipt: MinimalReceipt;
+    credentials: Partial<Record<CredentialField, string>>;
+};
+export declare function validReceipt(id: IntegrationProvider, value: unknown): value is MinimalReceipt;
+export declare function validCredentials(id: IntegrationProvider, value: unknown): value is OperationCredentials;
+export declare function restoreReceipt(receipt: MinimalReceipt, credentials: OperationCredentials): ApiObject;

package/dist/providers/receipts.js

@@ -0,0 +1,66 @@
+import { object, resourceId, text } from './api.js';
+const allowedCredentials = {
+    resend: 'token',
+    stripe: 'secret',
+    openai: 'api_key',
+};
+function identity(value) {
+    resourceId(value);
+    return value;
+}
+/** Keep only identities required for adapter retries and separately retain supported
+ * one-time credentials. Provider responses often include unrelated secrets or metadata. */
+export function splitReceipt(id, value) {
+    const response = object(value);
+    const receipt = {};
+    if (Object.hasOwn(response, 'id'))
+        receipt.id = identity(response.id);
+    if (id === 'neon' && Object.hasOwn(response, 'project'))
+        receipt.project = { id: identity(object(response.project).id) };
+    if (id === 'clerk' && Object.hasOwn(response, 'application_id'))
+        receipt.application_id = identity(response.application_id);
+    if (!Object.keys(receipt).length)
+        throw new Error('Provider returned no creation identity.');
+    const credentials = {};
+    const field = allowedCredentials[id];
+    if (field && Object.hasOwn(response, field))
+        credentials[field] = text(field === 'api_key' ? object(response.api_key).value : response[field]);
+    return { receipt, credentials };
+}
+export function validReceipt(id, value) {
+    try {
+        const response = object(value);
+        const allowed = [
+            'id',
+            ...(id === 'neon' ? ['project'] : []),
+            ...(id === 'clerk' ? ['application_id'] : []),
+        ];
+        if (Object.keys(response).some((key) => !allowed.includes(key)))
+            return false;
+        if (response.project && Object.keys(object(response.project)).some((key) => key !== 'id'))
+            return false;
+        splitReceipt(id, response);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function validCredentials(id, value) {
+    try {
+        const credentials = object(value);
+        const allowed = allowedCredentials[id];
+        return Object.entries(credentials).every(([field, value]) => field === allowed && text(value) === value);
+    }
+    catch {
+        return false;
+    }
+}
+export function restoreReceipt(receipt, credentials) {
+    return {
+        ...receipt,
+        ...(credentials.token ? { token: credentials.token } : {}),
+        ...(credentials.secret ? { secret: credentials.secret } : {}),
+        ...(credentials.api_key ? { api_key: { value: credentials.api_key } } : {}),
+    };
+}

package/dist/providers/recovery-verification.d.ts

@@ -0,0 +1,7 @@
+import { type ApiRequest } from './api.js';
+import { type IntegrationProvider, type ProviderSettings } from './config.js';
+import type { OperationDescriptor } from './state.js';
+import type { MinimalReceipt } from './receipts.js';
+/** Only verified identities may finish a pending journal operation. Every request is
+ * GET; key creation cannot be recovered by inventing a one-time credential. */
+export declare function verifyRecoveredResource(provider: IntegrationProvider, descriptor: OperationDescriptor, requested: string, settings: ProviderSettings, api: ApiRequest): Promise<MinimalReceipt>;

package/dist/providers/recovery-verification.js

@@ -0,0 +1,112 @@
+import { object, list, resourceId } from './api.js';
+import { setting } from './config.js';
+function same(actual, expected, label) {
+    if (!expected || actual !== expected)
+        throw new Error(`Recovered provider ${label} does not match the desired configuration.`);
+}
+function route(descriptor, key, expected) {
+    if (descriptor.key !== key || descriptor.route !== expected)
+        throw new Error('Pending provider operation does not match the supported recovery route.');
+}
+/** Only verified identities may finish a pending journal operation. Every request is
+ * GET; key creation cannot be recovered by inventing a one-time credential. */
+export async function verifyRecoveredResource(provider, descriptor, requested, settings, api) {
+    const id = resourceId(requested);
+    if (['sending-key', 'webhook', 'service-account'].includes(descriptor.key))
+        throw new Error('This operation creates a one-time credential. Restore its securely retained credential and verify it with the provider; resource-only recovery is unavailable.');
+    if (provider === 'neon') {
+        route(descriptor, 'project', '/api/v2/projects');
+        const project = object(object(await api(`/api/v2/projects/${id}`)).project);
+        same(resourceId(project.id), id, 'Neon identity');
+        same(project.org_id, setting(settings, 'organizationId'), 'Neon organization');
+        same(project.name, setting(settings, 'name'), 'Neon project name');
+        same(project.region_id, setting(settings, 'region'), 'Neon region');
+        return { project: { id } };
+    }
+    if (provider === 'clerk') {
+        route(descriptor, 'application', '/v1/platform/applications');
+        same(object(await api('/v1/platform/me')).subject, setting(settings, 'workspaceId'), 'Clerk workspace');
+        const application = object(await api(`/v1/platform/applications/${id}`));
+        same(application.application_id, id, 'Clerk application identity');
+        same(application.name, setting(settings, 'name'), 'Clerk application name');
+        const instances = list(application.instances).filter((entry) => entry.environment_type === settings.environment);
+        if (instances.length !== 1)
+            throw new Error('Recovered Clerk application does not have exactly one selected environment.');
+        return { application_id: id };
+    }
+    if (provider === 'resend') {
+        route(descriptor, 'domain', '/domains');
+        const domain = object(await api(`/domains/${id}`));
+        same(domain.id, id, 'Resend domain identity');
+        same(domain.name, setting(settings, 'domain'), 'Resend domain name');
+        if (setting(settings, 'region'))
+            same(domain.region, setting(settings, 'region'), 'Resend region');
+        return { id };
+    }
+    if (provider === 'posthog') {
+        const organization = resourceId(setting(settings, 'organizationId'));
+        route(descriptor, 'project', `/api/organizations/${organization}/projects/`);
+        const project = object(await api(`/api/organizations/${organization}/projects/${id}/`));
+        same(resourceId(project.id), id, 'PostHog project identity');
+        same(project.organization, organization, 'PostHog organization');
+        same(project.name, setting(settings, 'name'), 'PostHog project name');
+        return { id };
+    }
+    if (provider === 'openai') {
+        route(descriptor, 'project', '/v1/organization/projects');
+        const project = object(await api(`/v1/organization/projects/${id}`));
+        same(project.id, id, 'OpenAI project identity');
+        same(project.name, setting(settings, 'name'), 'OpenAI project name');
+        same(project.status, 'active', 'OpenAI project status');
+        return { id };
+    }
+    if (provider === 'sentry') {
+        const organization = resourceId(setting(settings, 'organization'));
+        const team = resourceId(setting(settings, 'team'));
+        const slug = resourceId(setting(settings, 'project'));
+        route(descriptor, 'project', `/api/0/teams/${organization}/${team}/projects/`);
+        const project = object(await api(`/api/0/projects/${organization}/${slug}/`));
+        same(resourceId(project.id), id, 'Sentry project identity');
+        same(object(project.organization).slug, organization, 'Sentry organization');
+        same(project.slug, slug, 'Sentry project slug');
+        same(project.platform, setting(settings, 'platform'), 'Sentry platform');
+        if (!list(project.teams).some((entry) => entry.slug === team))
+            throw new Error('Recovered Sentry project does not belong to the selected team.');
+        return { id };
+    }
+    if (provider === 'revenuecat') {
+        if (descriptor.key === 'project') {
+            route(descriptor, 'project', '/v2/projects');
+            const project = object(await api(`/v2/projects/${id}`));
+            same(project.id, id, 'RevenueCat project identity');
+            same(project.name, setting(settings, 'name'), 'RevenueCat project name');
+            return { id };
+        }
+        // Recovery of an app requires an explicit parent project choice. Never infer
+        // that parent from whichever project the current credential most recently used.
+        const project = resourceId(setting(settings, 'projectId'));
+        if (!['ios-app', 'android-app', 'web-app'].includes(descriptor.key))
+            throw new Error('Unsupported RevenueCat recovery operation.');
+        route(descriptor, descriptor.key, `/v2/projects/${project}/apps`);
+        const app = object(await api(`/v2/projects/${project}/apps/${id}`));
+        same(app.id, id, 'RevenueCat app identity');
+        const type = descriptor.key === 'ios-app'
+            ? 'app_store'
+            : descriptor.key === 'android-app'
+                ? 'play_store'
+                : 'stripe';
+        same(app.type, type, 'RevenueCat app platform');
+        const field = type === 'app_store'
+            ? 'bundle_id'
+            : type === 'play_store'
+                ? 'package_name'
+                : 'stripe_account_id';
+        same(object(app[type])[field], setting(settings, type === 'app_store'
+            ? 'bundleId'
+            : type === 'play_store'
+                ? 'packageName'
+                : 'stripeAccountId'), 'RevenueCat app identifier');
+        return { id };
+    }
+    throw new Error('Resource-only recovery is unsupported for this provider operation.');
+}

package/dist/providers/recovery.d.ts

@@ -0,0 +1,30 @@
+import { type DeliveryRunner } from '../project-state.js';
+import { type IntegrationProvider } from './config.js';
+export declare function integrationStatus(root: string): {
+    mutation: boolean;
+    schemaVersion: number;
+    providers: {
+        provider: string;
+        operations: {
+            recovery: string;
+            descriptor?: import("./state.js").OperationDescriptor | undefined;
+            resources?: import("./receipts.js").MinimalReceipt | undefined;
+            operation: string;
+            status: "pending" | "complete";
+        }[];
+    }[];
+};
+export interface IntegrationRecoveryRequest {
+    provider: IntegrationProvider;
+    operation: string;
+    resourceId: string;
+}
+/** Explicitly reconcile a verified resource; never recreate or delete it. Local
+ * receipt writes are authorized by this action, provider calls remain read-only. */
+export declare function recoverIntegrationResource(root: string, request: IntegrationRecoveryRequest, run?: DeliveryRunner, send?: typeof fetch, environment?: NodeJS.ProcessEnv): Promise<{
+    provider: keyof import("./definitions.js").ProviderSettingsById;
+    operation: string;
+    status: string;
+    resources: import("./receipts.js").MinimalReceipt;
+    mutation: string;
+}>;

package/dist/providers/recovery.js

@@ -0,0 +1,34 @@
+import path from 'node:path';
+import { existsSync, realpathSync } from 'node:fs';
+import { defaultRunner, withApplicationLock } from '../project-state.js';
+import { providerApi, resourceId, digest } from './api.js';
+import { providerConfiguration, selectedIntegrations, INTEGRATION_PROVIDERS, } from './config.js';
+import { privateStateDirectory, ProvisioningState, readProviderStateStatus } from './state.js';
+export function integrationStatus(root) {
+    root = realpathSync(root);
+    return { ...readProviderStateStatus(path.join(root, '.anhedral')), mutation: false };
+}
+/** Explicitly reconcile a verified resource; never recreate or delete it. Local
+ * receipt writes are authorized by this action, provider calls remain read-only. */
+export async function recoverIntegrationResource(root, request, run = defaultRunner, send = fetch, environment = process.env) {
+    root = realpathSync(root);
+    if (!INTEGRATION_PROVIDERS.includes(request.provider) ||
+        !/^[a-f0-9]{64}$/.test(request.operation))
+        throw new Error('Select a supported provider and an exact pending operation hash.');
+    const id = resourceId(request.resourceId);
+    if (!selectedIntegrations(root).includes(request.provider))
+        throw new Error('Recovery requires a selected provider.');
+    const configuration = providerConfiguration(root);
+    const settings = configuration.providers[request.provider] ?? {};
+    const fingerprint = digest(configuration);
+    if (!existsSync(path.join(root, '.anhedral/providers.json')))
+        throw new Error('There is no pending provider journal to reconcile.');
+    const directory = await privateStateDirectory(root, run);
+    return withApplicationLock(root, async () => {
+        const state = new ProvisioningState(directory);
+        return state.recoverResource(request.provider, request.operation, id, settings, providerApi(request.provider, settings, environment, send), () => {
+            if (digest(providerConfiguration(root)) !== fingerprint)
+                throw new Error('Provider configuration changed during recovery; no completion receipt was written.');
+        });
+    });
+}

package/dist/providers/runtime.d.ts

@@ -0,0 +1,10 @@
+import { type DeliveryRunner } from '../project-state.js';
+export type RuntimeValues = Record<string, string>;
+export declare const RUNTIME_KEYS: string[];
+export declare function runtimeTargets(root: string, values: RuntimeValues): Record<string, RuntimeValues>;
+/** Preflight every destination before writing any file; preserve unrelated configuration verbatim. */
+export declare function configureRuntime(root: string, values: RuntimeValues, run: DeliveryRunner): Promise<string[]>;
+export declare function configuredRuntime(root: string): RuntimeValues;
+/** Read application-owned credentials separately from integration receipts. Never write,
+ * return unrelated environment keys, or copy authentication secrets to other targets. */
+export declare function applicationRuntime(root: string, run: DeliveryRunner): Promise<Record<string, RuntimeValues>>;

package/dist/providers/runtime.js

@@ -0,0 +1,231 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from '../bounded-file.js';
+import { atomicJson, readConfig } from '../project-state.js';
+import { digest } from './api.js';
+import { validateSetupPlan } from '../readiness.js';
+import { isIP } from 'node:net';
+import { providerConfiguration } from './config.js';
+export const RUNTIME_KEYS = [
+    'BETTER_AUTH_SECRET',
+    'BETTER_AUTH_URL',
+    'DATABASE_URL',
+    'CLERK_SECRET_KEY',
+    'CLERK_PUBLISHABLE_KEY',
+    'NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY',
+    'RESEND_API_KEY',
+    'STRIPE_SECRET_KEY',
+    'STRIPE_WEBHOOK_SECRET',
+    'SENTRY_DSN',
+    'POSTHOG_API_KEY',
+    'POSTHOG_HOST',
+    'OPENAI_API_KEY',
+    'EXPO_PUBLIC_REVENUECAT_IOS_API_KEY',
+    'EXPO_PUBLIC_REVENUECAT_ANDROID_API_KEY',
+];
+function validateValues(values) {
+    if (!values ||
+        typeof values !== 'object' ||
+        Array.isArray(values) ||
+        Object.entries(values).some(([key, value]) => !RUNTIME_KEYS.includes(key) ||
+            typeof value !== 'string' ||
+            !value ||
+            value.length > 16384 ||
+            /[\r\n\x00]/.test(value)))
+        throw new Error('Invalid provider runtime configuration.');
+}
+export function runtimeTargets(root, values) {
+    validateValues(values);
+    const setup = JSON.parse(readBoundedFile(path.join(root, 'anhedral.setup.json'), MAX_PROJECT_JSON_BYTES).toString('utf8'));
+    validateSetupPlan(setup);
+    const targets = {};
+    const runtime = setup.products.includes('hono') ? 'api' : 'web';
+    const server = Object.fromEntries(Object.entries(values).filter(([key]) => !key.startsWith('EXPO_PUBLIC_')));
+    if (existsSync(path.join(root, `apps/${runtime}`)))
+        targets[`apps/${runtime}/${runtime === 'web' && setup.hosting === 'vercel' ? '.env.local' : '.dev.vars'}`] = server;
+    if (runtime === 'api' &&
+        existsSync(path.join(root, 'apps/web')) &&
+        values.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY)
+        targets[`apps/web/${setup.hosting === 'vercel' ? '.env.local' : '.dev.vars'}`] = {
+            NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: values.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
+            ...(values.CLERK_SECRET_KEY ? { CLERK_SECRET_KEY: values.CLERK_SECRET_KEY } : {}),
+        };
+    if (values.DATABASE_URL && existsSync(path.join(root, 'packages/db')))
+        targets['packages/db/.env'] = { DATABASE_URL: values.DATABASE_URL };
+    if (setup.products.includes('expo')) {
+        const mobile = Object.fromEntries(Object.entries(values).filter(([key]) => key.startsWith('EXPO_PUBLIC_')));
+        if (values.CLERK_PUBLISHABLE_KEY)
+            mobile.EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY = values.CLERK_PUBLISHABLE_KEY;
+        if (Object.keys(mobile).length)
+            targets['apps/mobile/.env.local'] = mobile;
+    }
+    return targets;
+}
+/** Preflight every destination before writing any file; preserve unrelated configuration verbatim. */
+export async function configureRuntime(root, values, run) {
+    root = realpathSync(root);
+    const writes = [];
+    for (const [relative, entries] of Object.entries(runtimeTargets(root, values))) {
+        if (!Object.keys(entries).length)
+            continue;
+        const file = path.join(root, relative);
+        if (realpathSync(path.dirname(file)) !== path.dirname(file) ||
+            (existsSync(file) && lstatSync(file).isSymbolicLink()))
+            throw new Error('Runtime environment destination must not contain symbolic links.');
+        if ((await run('git', ['ls-files', '--', relative], root, process.env)).trim())
+            throw new Error('Runtime environment files must not be tracked.');
+        if ((await run('git', ['check-ignore', '--no-index', '--', relative], root, process.env)).trim() !== relative)
+            throw new Error('Ignore runtime environment files before provisioning.');
+        let content = existsSync(file)
+            ? readBoundedFile(file, MAX_PROJECT_JSON_BYTES).toString('utf8')
+            : '';
+        for (const [key, value] of Object.entries(entries)) {
+            const existing = content
+                .split(/\r?\n/)
+                .filter((line) => new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=`).test(line));
+            if (existing.length > 1)
+                throw new Error(`Duplicate runtime value for ${key}; reconcile before configuring.`);
+            if (existing.length) {
+                let previous = existing[0].slice(existing[0].indexOf('=') + 1).trim();
+                if (previous.startsWith('"')) {
+                    try {
+                        previous = JSON.parse(previous);
+                    }
+                    catch {
+                        /* Conflicting formats require review. */
+                    }
+                }
+                else if (previous.startsWith("'") && previous.endsWith("'"))
+                    previous = previous.slice(1, -1);
+                if (previous !== value)
+                    throw new Error(`Existing runtime value for ${key} differs. Reconcile it before configuring.`);
+            }
+            else
+                content += `${content && !content.endsWith('\n') ? '\n' : ''}${key}=${JSON.stringify(value)}\n`;
+        }
+        writes.push({ file, content, relative });
+    }
+    for (const { file, content } of writes) {
+        const temporary = `${file}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(temporary, content, { mode: 0o600, flag: 'wx' });
+            renameSync(temporary, file);
+        }
+        finally {
+            rmSync(temporary, { force: true });
+        }
+    }
+    atomicJson(path.join(root, '.anhedral/runtime.json'), {
+        schemaVersion: 1,
+        configuration: digest(providerConfiguration(root)),
+        values,
+    });
+    return writes.map((write) => write.relative);
+}
+export function configuredRuntime(root) {
+    const file = path.join(root, '.anhedral/runtime.json');
+    if (!existsSync(file))
+        return {};
+    if (realpathSync(path.dirname(file)) !== path.join(realpathSync(root), '.anhedral'))
+        throw new Error('Runtime state directory must not be a symbolic link.');
+    if (process.platform !== 'win32' && lstatSync(file).mode & 0o077)
+        throw new Error('Runtime state permissions must be 0600.');
+    const state = JSON.parse(readBoundedFile(file, MAX_PROJECT_JSON_BYTES).toString('utf8'));
+    if (state.schemaVersion !== 1 || state.configuration !== digest(providerConfiguration(root)))
+        throw new Error('Runtime configuration does not match the selected provider configuration.');
+    validateValues(state.values);
+    return state.values;
+}
+function applicationValue(content, key) {
+    const matches = content
+        .split(/\r?\n/)
+        .filter((line) => new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=`).test(line));
+    if (matches.length !== 1)
+        throw new Error(`Configure exactly one ${key} in the application's private runtime file.`);
+    const raw = matches[0].slice(matches[0].indexOf('=') + 1).trim();
+    let value;
+    if (raw.startsWith('"')) {
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`Use a valid quoted value for ${key}.`);
+        }
+    }
+    else if (raw.startsWith("'")) {
+        if (!raw.endsWith("'") || raw.length < 2)
+            throw new Error(`Use a valid quoted value for ${key}.`);
+        value = raw.slice(1, -1);
+    }
+    else
+        value = raw.replace(/\s+#.*$/, '').trim();
+    if (typeof value !== 'string' || !value || value.length > 16384 || /[\r\n\x00]/.test(value))
+        throw new Error(`Configure a valid ${key} in the application's private runtime file.`);
+    return value;
+}
+function publicAuthOrigin(value) {
+    if (/[\\\s]/.test(value))
+        return false;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    // Authentication callbacks must target a public deployment, not local development.
+    return (url.protocol === 'https:' &&
+        !url.username &&
+        !url.password &&
+        !url.search &&
+        !url.hash &&
+        url.pathname === '/' &&
+        !isIP(hostname.replace(/^\[|\]$/g, '')) &&
+        hostname.includes('.') &&
+        !['localhost', 'local', 'internal', 'test', 'invalid', 'example'].some((suffix) => hostname === suffix || hostname.endsWith(`.${suffix}`)));
+}
+/** Read application-owned credentials separately from integration receipts. Never write,
+ * return unrelated environment keys, or copy authentication secrets to other targets. */
+export async function applicationRuntime(root, run) {
+    root = realpathSync(root);
+    const setup = JSON.parse(readBoundedFile(path.join(root, 'anhedral.setup.json'), MAX_PROJECT_JSON_BYTES).toString('utf8'));
+    validateSetupPlan(setup);
+    if (!setup.products.includes('better-auth'))
+        return {};
+    const runtime = setup.products.includes('hono') ? 'api' : 'web';
+    const relative = `apps/${runtime}/${runtime === 'web' && setup.hosting === 'vercel' ? '.env.local' : '.dev.vars'}`;
+    const file = path.join(root, relative);
+    if (!existsSync(file))
+        throw new Error(`Configure BETTER_AUTH_SECRET and BETTER_AUTH_URL in ignored ${relative} before shipping.`);
+    if (realpathSync(path.dirname(file)) !== path.dirname(file) ||
+        !lstatSync(file).isFile() ||
+        lstatSync(file).isSymbolicLink())
+        throw new Error('Application runtime files must be regular files without symbolic links.');
+    if (process.platform !== 'win32' && lstatSync(file).mode & 0o077)
+        throw new Error('Application runtime file permissions must be 0600 before shipping.');
+    if ((await run('git', ['ls-files', '--', relative], root, process.env)).trim())
+        throw new Error('Application runtime files must not be tracked.');
+    if ((await run('git', ['check-ignore', '--no-index', '--', relative], root, process.env)).trim() !==
+        relative)
+        throw new Error('Ignore application runtime files before shipping.');
+    if (relative.endsWith('/.dev.vars') &&
+        existsSync(path.join(path.dirname(file), 'wrangler.jsonc'))) {
+        const config = readConfig(path.dirname(file));
+        if (config.vars &&
+            typeof config.vars === 'object' &&
+            ['BETTER_AUTH_SECRET', 'BETTER_AUTH_URL'].some((key) => Object.hasOwn(config.vars, key)))
+            throw new Error('Remove Better Auth values from tracked Wrangler vars, review and commit that change, then configure the private runtime file before shipping.');
+    }
+    const content = readBoundedFile(file, MAX_PROJECT_JSON_BYTES).toString('utf8');
+    const secret = applicationValue(content, 'BETTER_AUTH_SECRET');
+    if (secret.length < 32 ||
+        /change.?me|replace.?me|placeholder|your.?secret|example|generate.?me/i.test(secret) ||
+        new Set(secret).size < 8)
+        throw new Error('BETTER_AUTH_SECRET requires a generated nonplaceholder secret of at least 32 characters.');
+    const origin = applicationValue(content, 'BETTER_AUTH_URL');
+    if (!publicAuthOrigin(origin))
+        throw new Error('BETTER_AUTH_URL must be an HTTPS public origin without credentials, path, query or fragment.');
+    return { [relative]: { BETTER_AUTH_SECRET: secret, BETTER_AUTH_URL: origin } };
+}

package/dist/providers/schema.d.ts

@@ -0,0 +1,28 @@
+/** Editor schema validates syntax; selected-stack and provisioning readiness checks
+ * remain application rules, since templates deliberately contain empty choices. */
+export declare const PROVIDER_CONFIGURATION_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly title: "Anhedral provider configuration";
+    readonly description: "Nonsecret resource choices. Supply credentials through the environment.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["schemaVersion", "providers"];
+    readonly properties: {
+        readonly schemaVersion: {
+            readonly const: 1;
+        };
+        readonly providers: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                [k: string]: {
+                    type: string;
+                    additionalProperties: boolean;
+                    properties: {
+                        [k: string]: Record<string, unknown>;
+                    };
+                };
+            };
+        };
+    };
+};