anhedral 0.10.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anhedral",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Build and deliver applications with Cloudflare-first Vinext, selected services, optional Next.js on Vercel, and verified release evidence.",
   "type": "module",
   "exports": {
@@ -16,8 +16,8 @@
   },
   "files": [
     "dist",
-    "assets/anhedral-cli-init.svg",
-    "assets/anhedral-cli-init-technical.svg",
+    "assets/anhedral-stack.svg",
+    "assets/anhedral-stack-technical.svg",
     "assets/anhedral-mark.svg",
     "LICENSE",
     "README.md",
@@ -25,17 +25,18 @@
     "assets/favicon.ico",
     "docs/application-stack-standard.md",
     "docs/delivery-workflow.md",
-    "docs/sponsorships.md",
-    "docs/managed-hosting-architecture.md",
-    "assets/security"
+    "docs/provider-configuration.md",
+    "docs/cli-design.md",
+    "assets/security",
+    "docs/plugin-ui.md"
   ],
-  "homepage": "https://github.com/anhedral/anhedral-init#readme",
+  "homepage": "https://github.com/anhedral/anhedral-cli#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/anhedral/anhedral-init.git"
+    "url": "git+https://github.com/anhedral/anhedral-cli.git"
   },
   "bugs": {
-    "url": "https://github.com/anhedral/anhedral-init/issues"
+    "url": "https://github.com/anhedral/anhedral-cli/issues"
   },
   "author": "Anhedral, Inc.",
   "publishConfig": {
@@ -66,7 +67,7 @@
     "test:release-tooling": "node tests/test-release-tooling.test.mjs",
     "test:all": "pnpm build && pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:unit && node tests/test-packed-cli.js && node tests/test-packlist.js",
     "release:check": "pnpm test:all",
-    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:pack": "pnpm build && pnpm plugin:build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
     "release:artifact:verify": "node scripts/verify-release-artifact.mjs .artifacts/release/metadata.json && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
     "release:artifact:smoke": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
     "docs:stack-map": "node scripts/render-master-stack-map.mjs",
@@ -78,8 +79,11 @@
     "test:live:delivery": "pnpm build && node tests/test-live-delivery.mjs",
     "test:live:vercel": "pnpm build && node tests/test-live-vercel.mjs",
     "test:live:vercel:git": "pnpm build && node tests/test-live-vercel-git.mjs",
-    "format": "prettier --write src scripts tests",
-    "format:check": "prettier --check src scripts tests"
+    "format": "prettier --write src scripts tests plugin-app",
+    "format:check": "prettier --check src scripts tests plugin-app",
+    "plugin:build": "pnpm --dir plugin-app build",
+    "plugin:check": "pnpm --dir plugin-app check",
+    "plugin:preview": "pnpm --dir plugin-app start"
   },
   "keywords": [
     "cli",

package/dist/managed-hosting.d.ts

@@ -1,49 +0,0 @@
-export interface ManagedProject {
-    schemaVersion: 1;
-    id: string;
-    name: string;
-    provider: 'anhedral';
-    ownerId: string | null;
-    projectId: string | null;
-    audience: 'private' | 'public';
-    hostingOrigin?: string;
-}
-export interface ManagedVersion {
-    schemaVersion: 1;
-    projectId: string;
-    commit: string;
-    sourceSha256: string;
-    artifactSha256: string;
-    sourceBytes: number;
-    artifactBytes: number;
-    stageId: string;
-    state: 'staged' | 'saved';
-    versionId?: string;
-}
-export type ManagedFetch = typeof fetch;
-export declare function registerManagedApplication(root: string, audience?: 'private' | 'public'): ManagedProject;
-export declare function stageManagedVersion(root: string, artifactDirectory: string): Promise<ManagedVersion>;
-export declare function saveManagedVersion(root: string, stageId: string, send?: ManagedFetch): Promise<ManagedVersion>;
-export declare function deployManagedVersion(root: string, stageId: string, send?: ManagedFetch): Promise<{
-    productVerification: string;
-    url?: unknown;
-    projectId: string;
-    ownerId: string;
-    audience: "public" | "private";
-    deploymentId: string;
-    versionId: string;
-    commit: string;
-    artifactSha256: string;
-    state: unknown;
-}>;
-export declare function managedApplicationStatus(root: string, send?: ManagedFetch): Promise<{
-    project: ManagedProject;
-    state: string;
-    productVerification: string;
-    evidence?: undefined;
-} | {
-    project: ManagedProject;
-    evidence: string;
-    state: unknown;
-    productVerification: string;
-}>;

package/dist/managed-hosting.js

@@ -1,373 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
-import path from 'node:path';
-import { atomicJson, withApplicationLock } from './project-state.js';
-const manifest = 'anhedral.hosting.json';
-const identifier = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
-const maxBytes = 64 * 1024 * 1024;
-const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
-function origin() {
-    const raw = process.env.ANHEDRAL_HOSTING_ORIGIN;
-    if (!raw)
-        throw new Error('Managed hosting backend is not configured. Set ANHEDRAL_HOSTING_ORIGIN to an operated Anhedral service; no hosting service is implied by the CLI.');
-    const url = new URL(raw);
-    if (url.protocol !== 'https:' ||
-        url.username ||
-        url.password ||
-        url.port ||
-        url.search ||
-        url.hash ||
-        url.pathname !== '/' ||
-        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
-        throw new Error('Managed hosting requires an HTTPS origin without credentials, path, query or port.');
-    return url.origin;
-}
-function readProject(root) {
-    const project = JSON.parse(readFileSync(path.join(root, manifest), 'utf8'));
-    if (project.schemaVersion !== 1 ||
-        project.provider !== 'anhedral' ||
-        !identifier.test(project.id) ||
-        typeof project.name !== 'string' ||
-        !project.name.trim() ||
-        !['private', 'public'].includes(project.audience) ||
-        !(project.ownerId === null || identifier.test(project.ownerId)) ||
-        !(project.projectId === null || identifier.test(project.projectId)))
-        throw new Error('Invalid managed hosting manifest.');
-    return project;
-}
-export function registerManagedApplication(root, audience = 'private') {
-    root = realpathSync(root);
-    if (existsSync(path.join(root, manifest)))
-        return readProject(root);
-    if (!['private', 'public'].includes(audience))
-        throw new Error('Select private or public hosting.');
-    const name = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8')).name;
-    if (typeof name !== 'string' || !name.trim())
-        throw new Error('Application requires a package name.');
-    const project = {
-        schemaVersion: 1,
-        id: randomUUID(),
-        name,
-        provider: 'anhedral',
-        ownerId: null,
-        projectId: null,
-        audience,
-    };
-    const ignore = path.join(root, '.gitignore');
-    const previous = existsSync(ignore) ? readFileSync(ignore, 'utf8') : '';
-    if (!previous.split(/\r?\n/).includes('.anhedral/'))
-        writeFileSync(ignore, previous + (previous && !previous.endsWith('\n') ? '\n' : '') + '.anhedral/\n');
-    atomicJson(path.join(root, manifest), project);
-    return project;
-}
-function git(root, args) {
-    return execFileSync('git', args, {
-        cwd: root,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-        maxBuffer: maxBytes,
-        stdio: ['ignore', 'pipe', 'ignore'],
-    });
-}
-function source(root) {
-    if (realpathSync(git(root, ['rev-parse', '--show-toplevel']).toString().trim()) !== root ||
-        git(root, ['status', '--porcelain']).toString().trim())
-        throw new Error('Managed versions require a clean application repository.');
-    const commit = git(root, ['rev-parse', 'HEAD']).toString().trim();
-    if (!/^[a-f0-9]{40,64}$/.test(commit))
-        throw new Error('Invalid source commit.');
-    return commit;
-}
-function files(root, directory) {
-    const entries = [];
-    let size = 0;
-    const visit = (current) => {
-        for (const entry of readdirSync(current, { withFileTypes: true })) {
-            const file = path.join(current, entry.name);
-            const stat = lstatSync(file);
-            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
-                throw new Error('Build artifacts must contain only regular files and directories.');
-            if (entry.name === '.git' || entry.name.startsWith('.env'))
-                throw new Error('Build artifacts must not contain source credentials, Git state or dependencies.');
-            if (stat.isDirectory())
-                visit(file);
-            else {
-                size += stat.size;
-                if (size > maxBytes || entries.length >= 10000)
-                    throw new Error('Managed artifact exceeds staging limits.');
-                entries.push(`${path.relative(root, file)}:${digest(readFileSync(file))}`);
-            }
-        }
-    };
-    visit(directory);
-    if (!entries.length)
-        throw new Error('Build artifact directory is empty.');
-    return digest(Buffer.from(entries.sort().join('\n')));
-}
-export async function stageManagedVersion(root, artifactDirectory) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const project = readProject(root);
-        const commit = source(root);
-        const artifact = realpathSync(path.resolve(root, artifactDirectory));
-        if (!artifact.startsWith(root + path.sep) ||
-            !lstatSync(artifact).isDirectory() ||
-            artifact.startsWith(path.join(root, '.anhedral') + path.sep))
-            throw new Error('Select an application build directory within the repository.');
-        const fingerprint = files(root, artifact);
-        for (const file of git(root, ['ls-files', '-z']).toString().split('\0').filter(Boolean)) {
-            if (path.basename(file).startsWith('.env') && path.basename(file) !== '.env.example')
-                throw new Error('Tracked environment credentials cannot be uploaded as source.');
-            if (lstatSync(path.join(root, file)).isSymbolicLink() ||
-                !lstatSync(path.join(root, file)).isFile())
-                throw new Error('Managed source archives do not support symlinks or submodules.');
-        }
-        if (!git(root, ['show', `HEAD:${manifest}`]).equals(readFileSync(path.join(root, manifest))))
-            throw new Error('Commit the exact managed manifest before staging.');
-        const archive = git(root, ['archive', '--format=tar', commit]);
-        const staging = path.join(root, '.anhedral', 'managed');
-        mkdirSync(staging, { recursive: true, mode: 0o700 });
-        if (realpathSync(staging) !== staging)
-            throw new Error('Managed staging must not be a symbolic link.');
-        const stageId = randomUUID();
-        const directory = path.join(staging, stageId);
-        mkdirSync(directory, { mode: 0o700 });
-        try {
-            writeFileSync(path.join(directory, 'source.tar'), archive, { mode: 0o600 });
-            execFileSync('tar', ['-cf', path.join(directory, 'artifact.tar'), '-C', artifact, '.'], {
-                stdio: 'ignore',
-            });
-            const build = readFileSync(path.join(directory, 'artifact.tar'));
-            if (build.length > maxBytes || archive.length > maxBytes)
-                throw new Error('Managed archives exceed staging limits.');
-            if (files(root, artifact) !== fingerprint || source(root) !== commit)
-                throw new Error('Source or build artifact changed during staging.');
-            const version = {
-                schemaVersion: 1,
-                projectId: project.id,
-                commit,
-                sourceSha256: digest(archive),
-                artifactSha256: digest(build),
-                sourceBytes: archive.length,
-                artifactBytes: build.length,
-                stageId,
-                state: 'staged',
-            };
-            atomicJson(path.join(directory, 'version.json'), version);
-            return version;
-        }
-        catch (error) {
-            rmSync(directory, { recursive: true, force: true });
-            throw error;
-        }
-    });
-}
-async function request(send, method, route, key, body) {
-    const token = process.env.ANHEDRAL_HOSTING_TOKEN;
-    if (!token || /[\r\n]/.test(token))
-        throw new Error('Sign in to the configured managed hosting service; ANHEDRAL_HOSTING_TOKEN is required and never stored.');
-    const endpoint = `${origin()}/v1${route}`;
-    let response;
-    try {
-        response = await send(endpoint, {
-            method,
-            redirect: 'error',
-            signal: AbortSignal.timeout(30000),
-            headers: {
-                Authorization: `Bearer ${token}`,
-                ...(key ? { 'Idempotency-Key': key } : {}),
-                'Content-Type': Buffer.isBuffer(body) ? 'application/x-tar' : 'application/json',
-            },
-            body: body === undefined
-                ? undefined
-                : Buffer.isBuffer(body)
-                    ? new Uint8Array(body)
-                    : JSON.stringify(body),
-        });
-    }
-    catch {
-        throw new Error('Managed hosting request failed; inspect connectivity and authentication.');
-    }
-    let value;
-    try {
-        value = (await response.json());
-    }
-    catch {
-        throw new Error('Managed hosting returned unsupported output.');
-    }
-    if (!response.ok || !value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error(`Managed hosting operation failed (HTTP ${response.status}); no deployment success was recorded.`);
-    return value;
-}
-async function context(root, send) {
-    const project = readProject(root);
-    if (project.hostingOrigin && project.hostingOrigin !== origin())
-        throw new Error('Managed hosting origin differs from the recorded service.');
-    const session = await request(send, 'GET', '/session');
-    if (typeof session.ownerId !== 'string' ||
-        !identifier.test(session.ownerId) ||
-        (project.ownerId && session.ownerId !== project.ownerId))
-        throw new Error('Managed hosting session differs from the application owner.');
-    return { project, ownerId: session.ownerId };
-}
-function identity(value, projectId, ownerId, audience) {
-    if (value.projectId !== projectId || value.ownerId !== ownerId || value.audience !== audience)
-        throw new Error('Managed hosting receipt differs from project ownership or audience.');
-}
-function staged(root, stageId, project) {
-    if (!identifier.test(stageId))
-        throw new Error('Invalid stage identity.');
-    const directory = path.join(root, '.anhedral', 'managed', stageId);
-    if (realpathSync(directory) !== directory)
-        throw new Error('Managed staging directory must not be a symbolic link.');
-    if (!lstatSync(path.join(directory, 'version.json')).isFile() ||
-        lstatSync(path.join(directory, 'version.json')).isSymbolicLink())
-        throw new Error('Invalid staged metadata file.');
-    const version = JSON.parse(readFileSync(path.join(directory, 'version.json'), 'utf8'));
-    if (version.schemaVersion !== 1 ||
-        version.projectId !== project.id ||
-        version.stageId !== stageId ||
-        !/^[a-f0-9]{40,64}$/.test(version.commit))
-        throw new Error('Managed stage belongs to another project.');
-    for (const [file, expected, bytes] of [
-        ['source.tar', version.sourceSha256, version.sourceBytes],
-        ['artifact.tar', version.artifactSha256, version.artifactBytes],
-    ]) {
-        if (!lstatSync(path.join(directory, file)).isFile() ||
-            lstatSync(path.join(directory, file)).isSymbolicLink())
-            throw new Error('Invalid staged archive file.');
-        const archive = readFileSync(path.join(directory, file));
-        if (archive.length !== bytes ||
-            archive.length > maxBytes ||
-            digest(archive) !== expected ||
-            lstatSync(path.join(directory, file)).isSymbolicLink())
-            throw new Error('Managed staged archive changed.');
-    }
-    return { version, directory };
-}
-export async function saveManagedVersion(root, stageId, send = fetch) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const { project, ownerId } = await context(root, send);
-        const { version, directory } = staged(root, stageId, project);
-        const key = digest(Buffer.from(`${project.id}:${version.commit}:${version.sourceSha256}:${version.artifactSha256}`));
-        const created = await request(send, 'POST', '/projects', project.id, {
-            clientProjectId: project.id,
-            name: project.name,
-            audience: project.audience,
-        });
-        if (typeof created.projectId !== 'string' ||
-            !identifier.test(created.projectId) ||
-            (project.projectId && created.projectId !== project.projectId))
-            throw new Error('Managed project identity changed.');
-        identity(created, created.projectId, ownerId, project.audience);
-        if (created.clientProjectId !== project.id)
-            throw new Error('Backend project differs from the registered client identity.');
-        const connected = {
-            ...project,
-            projectId: created.projectId,
-            ownerId,
-            hostingOrigin: origin(),
-        };
-        atomicJson(path.join(root, manifest), connected);
-        const base = `/projects/${created.projectId}`;
-        const receipt = await request(send, 'POST', `${base}/versions`, key, {
-            commit: version.commit,
-            sourceSha256: version.sourceSha256,
-            artifactSha256: version.artifactSha256,
-            sourceBytes: version.sourceBytes,
-            artifactBytes: version.artifactBytes,
-        });
-        identity(receipt, created.projectId, ownerId, project.audience);
-        if (typeof receipt.versionId !== 'string' || !identifier.test(receipt.versionId))
-            throw new Error('Managed version identity is missing.');
-        for (const kind of ['source', 'artifact']) {
-            const bytes = readFileSync(path.join(directory, `${kind}.tar`));
-            const uploaded = await request(send, 'PUT', `${base}/versions/${receipt.versionId}/${kind}`, `${key}:${kind}`, bytes);
-            identity(uploaded, created.projectId, ownerId, project.audience);
-            if (uploaded.versionId !== receipt.versionId ||
-                uploaded.sha256 !== digest(bytes) ||
-                uploaded.bytes !== bytes.length)
-                throw new Error('Managed upload receipt differs from the staged archive.');
-        }
-        const saved = await request(send, 'GET', `${base}/versions/${receipt.versionId}`);
-        identity(saved, created.projectId, ownerId, project.audience);
-        if (saved.versionId !== receipt.versionId ||
-            saved.commit !== version.commit ||
-            saved.sourceSha256 !== version.sourceSha256 ||
-            saved.artifactSha256 !== version.artifactSha256 ||
-            saved.state !== 'saved')
-            throw new Error('Backend has not confirmed an exact saved source/build version.');
-        const result = { ...version, state: 'saved', versionId: receipt.versionId };
-        atomicJson(path.join(directory, 'version.json'), result);
-        return result;
-    });
-}
-export async function deployManagedVersion(root, stageId, send = fetch) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const { project, ownerId } = await context(root, send);
-        const { version } = staged(root, stageId, project);
-        if (!project.projectId ||
-            version.state !== 'saved' ||
-            !version.versionId ||
-            !identifier.test(version.versionId))
-            throw new Error('Save the exact managed version before requesting deployment.');
-        const base = `/projects/${project.projectId}`;
-        identity(await request(send, 'GET', base), project.projectId, ownerId, project.audience);
-        const receipt = await request(send, 'POST', `${base}/deployments`, `${version.versionId}:${project.audience}`, {
-            versionId: version.versionId,
-            audience: project.audience,
-            commit: version.commit,
-            artifactSha256: version.artifactSha256,
-        });
-        if (typeof receipt.deploymentId !== 'string' || !identifier.test(receipt.deploymentId))
-            throw new Error('Backend did not return a deployment identity.');
-        const result = await request(send, 'GET', `${base}/deployments/${receipt.deploymentId}`);
-        identity(result, project.projectId, ownerId, project.audience);
-        if (result.deploymentId !== receipt.deploymentId ||
-            result.versionId !== version.versionId ||
-            result.commit !== version.commit ||
-            result.artifactSha256 !== version.artifactSha256 ||
-            !['queued', 'building', 'deployed', 'failed'].includes(String(result.state)))
-            throw new Error('Managed deployment evidence differs from the saved version.');
-        if (result.state === 'deployed') {
-            if (typeof result.url !== 'string')
-                throw new Error('A deployed result requires a confirmed URL.');
-            const url = new URL(result.url);
-            if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.search)
-                throw new Error('Invalid managed deployment URL.');
-        }
-        else
-            delete result.url;
-        const confirmed = {
-            projectId: project.projectId,
-            ownerId,
-            audience: project.audience,
-            deploymentId: result.deploymentId,
-            versionId: version.versionId,
-            commit: version.commit,
-            artifactSha256: version.artifactSha256,
-            state: result.state,
-            ...(result.state === 'deployed' ? { url: result.url } : {}),
-        };
-        atomicJson(path.join(root, '.anhedral', 'managed-deployment.json'), confirmed);
-        return { ...confirmed, productVerification: 'required' };
-    });
-}
-export async function managedApplicationStatus(root, send = fetch) {
-    root = realpathSync(root);
-    const { project, ownerId } = await context(root, send);
-    if (!project.projectId)
-        return { project, state: 'not-connected', productVerification: 'unverified' };
-    const result = await request(send, 'GET', `/projects/${project.projectId}`);
-    identity(result, project.projectId, ownerId, project.audience);
-    return {
-        project,
-        evidence: 'provider-refresh',
-        state: ['registered', 'queued', 'building', 'deployed', 'failed'].includes(String(result.state))
-            ? result.state
-            : 'unknown',
-        productVerification: 'unverified',
-    };
-}

package/docs/managed-hosting-architecture.md

@@ -1,87 +0,0 @@
-# Anhedral Cloud: setup and deployment contract
-
-The CLI has `cloud register|stage|save|deploy|status` and a locally tested API client. There is no operated hosting backend, platform login, issued app hostname or managed provisioning service. Everything marked **planned** below is a design requirement, not an available command. Customer-account delivery remains independent; never silently substitute it for requested managed hosting.
-
-## Product boundaries
-
-Anhedral is the B2B managed software services business. Anhedral Cloud is its hosting/operations service and client workspace. Anhedral Init (`anhedral` on npm) is the open-source application foundation and CLI; customer-account deployments must work without an Anhedral subscription. Managed delivery is an optional provider adapter, not a dependency hidden in generated application code.
-
-Keep `anhedral-landing` as the public website and existing portal frontend initially; retain working Next.js/Vercel hosting while the Hono/Workers control plane is built. Both portal and CLI should consume that same API. One durable model should connect organizations, memberships/roles, engagements, applications, environments, resources, releases and usage. A services project can contain multiple applications; product users are distinct from portal members. The current portal's email-primary membership permits one team per person; expand membership deliberately before multi-organization operator/client access. Private file links need storage-side authorization, not just a private portal page.
-
-Use the portal for client progress, approvals, application access, operating status, invoices and exports; expose technical controls according to role. Keep hosted customer code on a separate origin/domain from staff/client sessions. Sell engineering and managed operations with explicit responsibilities and bounded infrastructure usage. Source/data export, recovery and the customer-account deployment path should remain usable when managed hosting ends.
-
-Sequence: align released CLI/docs; connect portal organizations to the control-plane registry; ship one independently recoverable private application; prove updates, isolation, backups and cost controls; then add operational/billing UI and selected distribution features. Begin as a managed service for invited clients; expand self-service only after those paths are repeatable.
-
-## Accounts and paid activation
-
-Managed users should need Anhedral sign-in only for ordinary hosted apps. Anhedral operates the infrastructure and bills its customers; customer-account hosting keeps providers and bills in the customer's account. Product login remains separate from platform/hosting access.
-
-| Owner | Account/service | When and gate |
-| --- | --- | --- |
-| Anhedral | [Cloudflare Workers for Platforms](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/pricing/), DNS zone and scoped deployment credentials | Required managed runtime. Published baseline is $25/month plus overages; purchase currently uses the dashboard. Verify account, subscription and permissions before provisioning. |
-| Anhedral | [Neon serverless driver](https://neon.com/docs/serverless/serverless-driver); optional [Hyperdrive](https://developers.cloudflare.com/hyperdrive/platform/pricing/) | Default direct HTTP Postgres; provision isolated app credentials/data boundaries. Add Hyperdrive only for measured needs, using the non-pooled Neon endpoint. D1 is the SQLite option. Free quotas are not production capacity guarantees. Hyperdrive is included in Workers plans; Neon has separate billing. |
-| Anhedral | [R2](https://developers.cloudflare.com/r2/pricing/), selected Cloudflare services | Source/build archives and app files; compute/storage/operations/AI/media have separate meters. Enable only selected services. |
-| Anhedral | Better Auth, verified sender and optional OAuth provider registrations | Platform identity, recovery and login mail. No customer Clerk account required; selected app identity providers can differ. |
-| Anhedral | Stripe merchant account | Anhedral subscriptions and usage billing. Customer app payments require the app owner's merchant account or deliberate Stripe Connect onboarding; never mix ledgers. |
-| App owner, when selected | RevenueCat, Apple/Google store products; external AI, mail or other providers | Own commercial identity and app integrations. Verification, terms, billing and OAuth consent may require a human; the CLI reports the exact remaining step. |
-| App owner, when distributed | [Apple](https://developer.apple.com/help/account/basics/about-your-developer-account), [Play](https://support.google.com/googleplay/android-developer/answer/6112435), [Chrome](https://developer.chrome.com/docs/webstore/register) publisher accounts | Paid enrollment/registration and identity checks. Native signing/builds and review remain platform-specific; cloud backend deployment does not publish clients. |
-| Optional | GitHub; custom domain/registrar | GitHub export/connection, not a prerequisite for managed source recovery. Platform subdomains use Anhedral DNS; [customer domains](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/) require ownership validation and hostname limits. |
-
-Prices/eligibility must be rechecked at activation. Current numeric baseline is a dated October 8, 2026 check, not an app quote. Paid activation requires authorized spending; an agent can prepare setup and resume after enrollment without recreating resources.
-
-## Platform architecture
-
-Use separate control-plane and dispatch Workers. Better Auth identifies platform users; Neon holds owners, apps, permissions, resource identities, versions, deployments and billing ledgers. R2 stores immutable source/build archives. Queues/Workflows execute resumable build/provision/deploy jobs. The dispatch Worker maps an authorized hostname to an isolated user Worker; it must not trust a caller-selected worker name.
-
-[Workers for Platforms bindings](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/configuration/bindings/) support app resources including D1/R2/KV, Durable Objects, Queues, Workflows and Hyperdrive. Attach only that app's resources; use separate credentials and migration/runtime roles for Postgres. Never give user code platform deployment, billing or shared-admin credentials. Build untrusted code in an isolated runner; export only reviewed executable artifacts. Resolve resources on the server from a declared capability manifest, not arbitrary account IDs from uploaded code.
-
-Private previews and production enforce platform audience at dispatch, including assets, APIs and WebSocket upgrades. In-app authorization is still the application's responsibility. Test the chosen framework in the actual dispatch runtime: [platform limits](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/limits/) include disabled `caches.default` and restricted `request.cf` in untrusted namespaces. Do not enable trusted mode for customer code to bypass compatibility failures. User Workers currently lack gradual deployments; use immutable versioned Worker names plus an authorized routing switch for previews/rollback, and verify WebSocket/stateful-version compatibility.
-
-## Agent workflow
-
-**Planned interface:** `cloud login` → `cloud plan --json` → implement/check/commit → `cloud ship --json --wait` → `cloud verify`. Login should use a browser/device authorization flow and OS-protected renewable credentials. CI uses revocable project-scoped credentials. JSON output should distinguish setup required, payment required, queued, failed, deployed and verified, with resumable operation IDs and non-secret next actions.
-
-`plan` must identify owner/environment, declared resources, provider access, compatibility, estimated cost and authorized limits without mutations. `ship` should check source/build provenance, resolve resources, stage/save, apply reviewed compatible migrations, deploy, poll to completion and return the independently confirmed URL. Neither command exists yet. `new --hosting anhedral` is also not supported; generation currently selects Cloudflare or Vercel.
-
-The current low-level sequence is executable only with an operated compatible backend and configured `ANHEDRAL_HOSTING_ORIGIN` / `ANHEDRAL_HOSTING_TOKEN`:
-
-```sh
-anhedral cloud register my-app --audience private --json
-# Review source/secrets and commit the managed manifest in the app's own Git repo.
-git -C my-app add <reviewed-paths>
-git -C my-app commit -m "Prepare application version"
-pnpm --dir my-app run check
-# Build a complete self-contained Worker bundle/assets into an ignored app directory.
-anhedral cloud stage my-app --artifact /absolute/path/my-app/build --json
-anhedral cloud save my-app --version <returned-stage-id> --json
-anhedral cloud deploy my-app --version <returned-stage-id> --json
-anhedral cloud status my-app --json
-```
-
-Current `deploy` requests deployment and checks once; it may return queued/building. It does not wait for completion, run product acceptance or implement managed rollback/export. `save` writes connected identity into the tracked manifest; review/commit that change before staging a subsequent version. A staged artifact is not proven to originate from its source merely because both were archived: the planned build receipt must bind source commit, lockfile, toolchain and artifact digest.
-
-## Source and API contract
-
-Local Git remains the working source of truth. Save the exact clean commit plus complete build tree; retain immutable version IDs, SHA-256 hashes and byte lengths. Current staging permits regular files only, at most 64 MiB per archive and 10,000 build files; it rejects symlinks/submodules and credential files. Restore/clone/export must preserve history and allow exit; optional [Artifacts](https://developers.cloudflare.com/artifacts/platform/pricing/) can add Git-compatible managed history but is Paid-plan-only and has separately published metering.
-
-Current API routes are under `/v1`. Authenticate every route, derive ownership from the session, preserve audience and validate project/version identity. Pin service origin and owner after connection; forbid redirects and credential-bearing origins.
-
-| Route | Contract |
-| --- | --- |
-| `GET /session` | Authenticated owner identity. |
-| `POST /projects`, `GET /projects/:id` | Idempotent registration/current owned project state. |
-| `POST /projects/:id/versions` | Immutable commit, hashes/lengths and version identity. |
-| `PUT /projects/:id/versions/:version/source` or `/artifact` | Independently verify uploaded hashes/lengths. |
-| `GET /projects/:id/versions/:version` | Saved only when both verified archives exist. |
-| `POST /projects/:id/deployments` | Idempotent deployment of exact saved version/audience. |
-| `GET /projects/:id/deployments/:deployment` | Independently confirmed state/source/artifact; HTTPS URL only when deployed. |
-
-Validate archives again server-side before extraction, including traversal, links, duplicate paths and decompression/size limits. Preserve incomplete upload/job evidence for safe retries. Saving source, deploying code and passing product tests remain separate states.
-
-## Limits and completion gates
-
-Enforce [dispatch CPU/subrequest limits](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/configuration/custom-limits/) plus application-owned request, storage, SQL, job, AI/media and outbound budgets. Provider alerts are not hard spend caps. Reserve costly work transactionally before execution; reconcile completion/failure idempotently. Rate-limit platform API jobs with bounded retry/backoff for provider throttling. Limit previews/builds, concurrent jobs and retention; define grace/suspension/export policies. Do not delete customer data merely because billing fails. Optional paid/beta/enterprise services need explicit eligibility checks and adapters; free analytics does not make the rest free.
-
-Build in this order: platform identity and account/subscription preflight; durable registry/archive API; isolated build/resource provisioning; dispatch/private routes; resumable deployment polling; logs/secrets/recovery/export; billing/quotas; signed client distribution where requested. First acceptance fixture: two owners, independent private apps, persistence, file upload, one bounded job and repeated update. Prove cross-tenant rejection, anonymous denial, interrupted-save/deploy retry, source restoration, quota rejection and code rollback/data compatibility before onboarding.
-
-Maintain this single contract as capabilities ship: replace planned claims with verified command/API behavior and update account/limit links. Keep dated test evidence in existing release/test artifacts, not new analysis documents. Deployment and publication remain unproven until the operated service and installed agent workflow pass acceptance.

package/docs/sponsorships.md

@@ -1,25 +0,0 @@
-# Support Anhedral Init
-
-## Help more people build applications they own
-
-Anhedral Init is free and open source. We build tools that help developers turn an idea into an application with source code, infrastructure, and data in their own accounts.
-
-If Anhedral Init helps you build, saves you time, or makes your work easier, consider supporting its continued development. Your support helps us improve the tools, maintain integrations, fix bugs, and write clearer documentation.
-
-## GitHub Sponsors — coming soon
-
-Support can be a thank-you for something useful today or an ongoing contribution to the project's future. Every contribution helps us spend more time improving Anhedral Init for the people who use it.
-
-We plan to offer donations and ongoing sponsorships through GitHub Sponsors. Our sponsorship profile is not available yet; we'll add the link here when it launches.
-
-In the meantime, [contact us at business@anhedral.com](mailto:business@anhedral.com?subject=Support%20Anhedral%20Init) if you'd like to support the project.
-
-## Company sponsorships
-
-Does your company use Anhedral Init or want to support its development? We'd love to hear from you. Get in touch to discuss a sponsorship and how we can recognize your support.
-
-**[Become a sponsor](mailto:business@anhedral.com?subject=Anhedral%20Init%20sponsorship)**
-
-Thank you for helping us keep Anhedral Init free, open source, and improving.
-
-[Back to Anhedral Init](../README.md)