anhedral 0.10.1 → 0.11.0

package/docs/provider-configuration.md

@@ -0,0 +1,117 @@
+# Provider configuration
+
+Anhedral scaffolds source, guides authentication, and provisions and configures the selected stack before deployment. The application and accounts belong to the developer or client. Feature development, design, custom integrations, and ongoing maintenance are Anhedral's services.
+
+## Setup
+
+1. Run `anhedral init <directory> <stack-flags>`. Review the generated source and install dependencies.
+2. Fill in `anhedral.providers.json`. It contains only selected integrations, nonsecret resource names, account identifiers, regions, and desired webhook settings. Empty account/domain fields require an explicit choice. Commit this file with the application source. To use an existing resource, set its ID instead of requesting a new project by name.
+3. Supply management credentials through the process environment and run `anhedral auth <directory>`. `--status` performs checks without opening login. Cloudflare, Vercel, and Expo support interactive CLI login; API integrations show their required credentials. A successful read does not prove every write permission.
+4. Connect the intended hosting account, project, plan, and audience using `anhedral connect`. Review and commit the connection manifest. Expo uses the explicit `owner` and `slug` in `apps/mobile/app.json`.
+5. Inspect `anhedral registry capabilities --json` for implemented scope and evidence limits, then inspect `anhedral ship <directory> --dry-run`. It reports missing provider settings without login, network requests, writes, provisioning, or deployment. Run `ship` after reviewing the plan and authorizing the provider operations.
+
+The manifest uses a typed, provider-specific configuration contract. It rejects unsupported providers, foreign fields, unknown enum choices, and duplicate webhook events before network operations. Empty fields are accepted for scaffolding but must be completed when required for provisioning. The exported `PROVIDER_CONFIGURATION_SCHEMA` matches these fields and enums; no generated `$schema` URL is currently installed in projects.
+
+Authentication results label verified access as `session`, `management`, or `runtime`; unsuccessful checks use `none`. Clerk and OpenAI management credentials take precedence over runtime credentials. A runtime probe is never reported as management access. Vercel and Expo session probes require bounded, single-identity output from the pinned CLI; diagnostic paragraphs do not count as a session. These probes do not verify the selected project, all write permissions, account enrollment, or remaining owner prerequisites.
+
+Management keys do not belong in this manifest or application source. Runtime credentials returned by providers are configured in ignored application environment files and private `.anhedral/` state. API errors and CLI results omit credential values. Never attach this private state to an issue or commit it.
+
+## Adapters
+
+| Provider | Management credential | Automated configuration | Owner prerequisites and remaining application work |
+| --- | --- | --- | --- |
+| Neon | `NEON_API_KEY` | Create or select an explicitly scoped organization/project; check outstanding operations; obtain the selected database/role's pooled connection URI; configure runtime and migration environment files | An eligible account/region; reviewed schema and migrations; application data access |
+| Clerk | `CLERK_PLATFORM_API_KEY` | Verify the selected workspace; create or select an application and environment; retrieve its matching publishable and secret keys | Platform API access; production domain/DNS/OAuth setup; application authorization. `CLERK_SECRET_KEY` alone verifies runtime access and cannot create an application |
+| Resend | `RESEND_API_KEY` with management access | Create or select the explicit sending domain; request verification; report required DNS records; issue a domain-scoped sending key only after verification | Domain ownership and DNS publication/propagation; sending eligibility; templates and delivery behavior |
+| Stripe | `STRIPE_SECRET_KEY` | Verify the explicit account and test/live key mode; configure a webhook with explicitly listed events when requested; securely retain its signing secret | Account activation for live payments; product/price decisions and webhook handlers. Provisioning does not invent a billing model or create financial commitments |
+| RevenueCat | `RC_API_KEY` with v2 configuration access | Create or select a project; create/select iOS, Android, or connected Stripe apps; retrieve platform public SDK keys | Store credentials or Stripe account connection; products, offerings, entitlements, SDK installation, and purchase verification |
+| Sentry | `SENTRY_AUTH_TOKEN` | Select organization/team/project; create a project if absent; verify the team/platform; select a single active client key or create one if absent; configure DSN | Appropriate organization/team permissions; platform SDK initialization, source maps, privacy filtering, and alerts |
+| PostHog | `POSTHOG_PERSONAL_API_KEY` | Select US/EU region and organization; create/select a project; retrieve its ingestion key and matching ingestion host | Project permissions; product events, privacy/consent rules, and SDK initialization. Personal management keys never become ingestion keys |
+| OpenAI | `OPENAI_ADMIN_KEY` | Create or select an active project; create a named service account; retain its one-time runtime key privately | Organization administration access, provider billing eligibility, limits, and application AI behavior. `OPENAI_API_KEY` alone cannot create projects |
+
+The adapters implement a bounded scaffolding setup, not every administration endpoint a provider exposes. Account enrollment, required billing acceptance, DNS ownership, OAuth consent, store enrollment, and product-specific design remain explicit owner steps. Provisioning success does not certify those steps or finished product functionality.
+
+### Example manifest
+
+For a selected Hono + Neon + PostHog stack:
+
+```json
+{
+  "schemaVersion": 1,
+  "providers": {
+    "neon": {
+      "name": "customer-app",
+      "organizationId": "org-example",
+      "region": "aws-us-east-1",
+      "database": "app",
+      "role": "app_owner"
+    },
+    "posthog": {
+      "name": "customer-app",
+      "organizationId": "00000000-0000-0000-0000-000000000000",
+      "region": "eu"
+    }
+  }
+}
+```
+
+Replace example organization IDs with the intended account's actual identifiers. Existing resources use `projectId`; Clerk uses `applicationId` and `workspaceId`; Resend uses `domainId`; RevenueCat can select `iosAppId`, `androidAppId`, or `webAppId`. New RevenueCat native apps use `bundleId` / `packageName`; a new Stripe app requires a previously connected `stripeAccountId`. Sentry selects `organization`, `team`, `project`, and `platform`. Stripe requires `accountId` and `mode`; optional `webhookUrl` must use HTTPS and `webhookEvents` must explicitly name the handled events. A webhook endpoint and handler must already be designed before registering it.
+
+## Delivery and retries
+
+Cloudflare reconciles D1, private R2 buckets, KV, Queues, and private JSON Basin streams. Basin HTTP ingestion stays disabled; the Worker binding is enabled. Sinks and transformations require application-specific design. Durable Objects, schedules, Workflows, and Workers AI bindings are configured through Worker deployment. Hyperdrive configurations added by a developer still require an explicit provider workflow.
+
+If resource provisioning changes tracked binding IDs, `ship` returns `configuration-required` and stops before deployment. Review and commit those changes, then repeat the command. It never commits code automatically. Pending Neon operations or unverified Resend DNS return `provider-configuration-required` and stop deployment. The configured integrations' remaining product setup appears in their results.
+
+Review the generated database schema and apply the selected database migrations before testing application features or authentication. Generated tables and SDK factories are starting points; provisioning resources does not migrate the application database or implement its authorization rules.
+
+For selected Better Auth applications, shipping first reads `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` from the primary server's ignored, untracked runtime file. Configure a generated nonplaceholder secret of at least 32 characters and the intended HTTPS public origin. On POSIX systems this file must have mode `0600`; keep equivalent private file access on other systems. Tracked or symlinked files, broad file permissions, missing values, placeholder secrets, and unsafe origins stop shipping before provider mutations. For older generated Workers, remove `BETTER_AUTH_URL` or `BETTER_AUTH_SECRET` from tracked `wrangler.jsonc` `vars`, review and commit that change, then configure both values in the private runtime file. Wrangler cannot deploy a same-named plain variable and secret. The preflight does not generate a secret, choose a domain, modify files, configure OAuth, or verify application-user authorization.
+
+Cloudflare uploads runtime credentials with the code using Wrangler's `--secrets-file`; it does not make a separate secret update that deploys an old Worker. Temporary credential files are private and removed after the operation. Vercel configures only the selected web runtime's production environment, checks every returned result for success, and then performs the checked deployment. In mixed Vercel/Cloudflare projects, default `ship` coordinates Cloudflare services first, then the Vercel web application under one operation lock. `ship --provider cloudflare` or `ship --provider vercel` explicitly selects only that hosting target. A setup gate stops before the dependent web deployment. If Cloudflare completes and Vercel fails, the result is partial; no atomic provider or data rollback is attempted. Repeating `ship` rechecks both targets and reuses provider receipts where available; it does not skip completed phases merely because the diagnostic operation journal says they completed.
+
+Shipping records nonsecret phases and outcome in ignored `.anhedral/operation.json`. This is a diagnostic journal, not a resumable transaction or proof of live product behavior. `status --json` and the dashboard can show the recorded operation; resource replay protection remains in the provider journals and deployment/build receipts. A new run records a new operation and revalidates current prerequisites.
+
+Creation receipts are saved immediately in ignored `.anhedral/providers.json`. Schema 2 keeps minimal creation identities and status there; supported one-time credentials are stored separately in ignored `.anhedral/provider-credentials.json` with private file permissions. Legacy schema 1 journals migrate credentials before replacing their full-response receipts, preserving recovery evidence if receipt writing is interrupted. Subsequent runs verify existing resources and reuse saved credentials. Ignored `.anhedral/runtime.json` contains deployment runtime values and must also remain private. A confirmed 4xx rejection can be retried after access is corrected. A timeout, malformed success response, rate limit, or server error can leave an unknown creation outcome: the CLI stops rather than replaying the mutation. Inspect the provider and preserve a secure backup of the receipt before reconciling the pending operation. Desired configuration changes also stop and require reconciliation. Never remove state blindly to bypass this check.
+
+Read-only API requests retry bounded transient failures (429, 502, 503, 504, transport interruptions and timeouts) within a 30-second overall deadline, with at most three attempts. Short provider retry delays are respected; longer delays return an actionable failure instead of retrying early. Invalid or oversized JSON is not retried. Mutating POST/PATCH requests are never replayed automatically, including requests carrying an idempotency key.
+
+Keep secure backups of `.anhedral/` and runtime environment files when moving machines. A fresh clone does not carry one-time credentials or provisioning receipts. Configure explicitly selected existing resource IDs and recover runtime credentials through authorized provider tooling rather than treating it as the original provisioning session. The CLI does not automatically delete, rotate, or replace resources. `integrations status` reads the journal without migration or writes. `integrations recover --provider <provider> --operation <exact hash> --resource <id>` verifies a supported existing resource against the unchanged recorded configuration, then writes only its local completion receipt. It never recreates or deletes a provider resource. Recovery is unavailable for legacy pending entries without operation metadata, changed desired configuration, and one-time credential creation when the original credential is missing; inspect the provider and retain secure backups. RevenueCat application recovery requires the parent project ID recorded explicitly in the original configuration.
+
+```sh
+anhedral integrations status my-app --json
+anhedral integrations recover my-app --provider neon --operation <exact-64-character-hash> --resource <verified-project-id> --json
+```
+
+Copy the operation hash from status and supply the intended resource ID yourself. Supported recovery checks cover known Neon projects, Clerk applications/workspace/environment, Resend domains, PostHog projects/organizations, active OpenAI projects, Sentry projects/teams/platform, and RevenueCat projects or explicitly scoped apps. They perform provider GET requests and then update only the local completion receipt. Status does not migrate old journals or create directories. It shows missing descriptors and one-time-credential operations as blocked. Resend sending keys, Stripe webhook signing secrets, and OpenAI service-account keys cannot be recovered from a resource ID alone; securely retained credentials and explicit provider inspection are required. Never paste credentials into the command or conversation.
+
+
+## Mobile delivery
+
+Use `anhedral ship <directory> --platform ios|android --profile <profile>`. Set the intended Expo `owner` and `slug` in static `apps/mobile/app.json`. The pinned EAS CLI creates/links the project when needed, then stops for review and a source commit. Subsequent builds independently check the linked project identity. Inherited profiles require explicit resolution before automatic delivery.
+
+Only public mobile keys are uploaded to the selected EAS environment; server credentials are excluded. Queued builds return a build-page link and `building` state. Repeat the same command to inspect the saved build ID without creating another build. Completed builds must match the selected project and source commit before returning the download link. Failed/cancelled builds require provider inspection before removing the pending record and requesting another build.
+
+Android preview builds produce APKs; production builds produce AABs. iOS simulator artifacts need no device signing; signed iOS builds need the developer's Apple credentials and enrollment. Anhedral never runs `eas submit`. Store uploads and approvals belong to the owner.
+
+## Verification scope
+
+Local contract tests cover selected-stack planning, API request/response shapes, resource reuse, one-time credentials, account mismatch, pending operations, DNS gates, unknown outcomes, private file safety, runtime partitioning, and deployment handoff. These tests do not establish live account eligibility, quota, permissions, billing, DNS, signing, or production product behavior. Verify those in explicitly authorized accounts before release.
+
+Provider contracts: [Neon API](https://api-docs.neon.tech/reference/createproject), [Clerk Platform schema](https://github.com/clerk/openapi-specs/blob/main/platform/beta.yml), [Resend API](https://resend.com/docs/api-reference/introduction), [Stripe API](https://docs.stripe.com/api), [RevenueCat API v2](https://www.revenuecat.com/docs/api-v2), [Sentry API](https://docs.sentry.io/api/), [PostHog API](https://posthog.com/docs/api), [OpenAI administration](https://developers.openai.com/api/reference/resources/admin/), [Cloudflare secrets](https://developers.cloudflare.com/workers/configuration/secrets/), [Vercel OpenAPI](https://openapi.vercel.sh), and [pinned EAS source](https://github.com/expo/eas-cli/tree/v21.0.1/packages/eas-cli/src/commands).
+
+## Authorized staging acceptance
+
+Use a dedicated, explicitly selected account/project for live verification. Before the first mutation, record its owner, region, resource names, permitted operations, spending limit, cleanup responsibility, and retention period in the application's verification notes. Never use production credentials for routine tests or treat access to an account as permission to incur unspecified costs.
+
+For each selected provider, verify the following against the exact candidate CLI:
+
+1. Missing, expired, and insufficient credentials produce an actionable state without leaking keys or starting creation.
+2. The selected account, organization, environment and region match the manifest before provisioning.
+3. First creation and repeated configuration use the intended resources, with no duplicate creation.
+4. Pending DNS, provider operations or enrollment produce an explicit blocked state before deployment.
+5. An interrupted or unknown creation outcome preserves evidence and stops automatic replay; recovery requires inspected provider state.
+6. Runtime credentials reach only their intended server or public client target. Check runtime access through a bounded application flow, without publishing the credential value.
+7. The actual deployed service or build matches the selected project and checked source commit. Test its promised user flow independently of build success.
+8. Record provider/resource IDs, source revision, nonsecret verification results, unresolved owner steps, and cleanup results. Keep credential files and complete provider responses out of public logs and issues.
+
+A completed local contract test, an accessible API endpoint, a created resource, a successful deployment, and a verified product flow are separate evidence levels. Release notes must name the level actually established; do not promote one to another.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anhedral",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Build and deliver applications with Cloudflare-first Vinext, selected services, optional Next.js on Vercel, and verified release evidence.",
   "type": "module",
   "exports": {
@@ -16,8 +16,8 @@
   },
   "files": [
     "dist",
-    "assets/anhedral-cli-init.svg",
-    "assets/anhedral-cli-init-technical.svg",
+    "assets/anhedral-stack.svg",
+    "assets/anhedral-stack-technical.svg",
     "assets/anhedral-mark.svg",
     "LICENSE",
     "README.md",
@@ -25,17 +25,18 @@
     "assets/favicon.ico",
     "docs/application-stack-standard.md",
     "docs/delivery-workflow.md",
-    "docs/sponsorships.md",
-    "docs/managed-hosting-architecture.md",
-    "assets/security"
+    "docs/provider-configuration.md",
+    "docs/cli-design.md",
+    "assets/security",
+    "docs/plugin-ui.md"
   ],
-  "homepage": "https://github.com/anhedral/anhedral-init#readme",
+  "homepage": "https://github.com/anhedral/anhedral-cli#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/anhedral/anhedral-init.git"
+    "url": "git+https://github.com/anhedral/anhedral-cli.git"
   },
   "bugs": {
-    "url": "https://github.com/anhedral/anhedral-init/issues"
+    "url": "https://github.com/anhedral/anhedral-cli/issues"
   },
   "author": "Anhedral, Inc.",
   "publishConfig": {
@@ -66,7 +67,7 @@
     "test:release-tooling": "node tests/test-release-tooling.test.mjs",
     "test:all": "pnpm build && pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:unit && node tests/test-packed-cli.js && node tests/test-packlist.js",
     "release:check": "pnpm test:all",
-    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:pack": "pnpm build && pnpm plugin:build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
     "release:artifact:verify": "node scripts/verify-release-artifact.mjs .artifacts/release/metadata.json && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
     "release:artifact:smoke": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
     "docs:stack-map": "node scripts/render-master-stack-map.mjs",
@@ -78,8 +79,11 @@
     "test:live:delivery": "pnpm build && node tests/test-live-delivery.mjs",
     "test:live:vercel": "pnpm build && node tests/test-live-vercel.mjs",
     "test:live:vercel:git": "pnpm build && node tests/test-live-vercel-git.mjs",
-    "format": "prettier --write src scripts tests",
-    "format:check": "prettier --check src scripts tests"
+    "format": "prettier --write src scripts tests plugin-app",
+    "format:check": "prettier --check src scripts tests plugin-app",
+    "plugin:build": "pnpm --dir plugin-app build",
+    "plugin:check": "pnpm --dir plugin-app check",
+    "plugin:preview": "pnpm --dir plugin-app start"
   },
   "keywords": [
     "cli",

package/dist/managed-hosting.d.ts

@@ -1,49 +0,0 @@
-export interface ManagedProject {
-    schemaVersion: 1;
-    id: string;
-    name: string;
-    provider: 'anhedral';
-    ownerId: string | null;
-    projectId: string | null;
-    audience: 'private' | 'public';
-    hostingOrigin?: string;
-}
-export interface ManagedVersion {
-    schemaVersion: 1;
-    projectId: string;
-    commit: string;
-    sourceSha256: string;
-    artifactSha256: string;
-    sourceBytes: number;
-    artifactBytes: number;
-    stageId: string;
-    state: 'staged' | 'saved';
-    versionId?: string;
-}
-export type ManagedFetch = typeof fetch;
-export declare function registerManagedApplication(root: string, audience?: 'private' | 'public'): ManagedProject;
-export declare function stageManagedVersion(root: string, artifactDirectory: string): Promise<ManagedVersion>;
-export declare function saveManagedVersion(root: string, stageId: string, send?: ManagedFetch): Promise<ManagedVersion>;
-export declare function deployManagedVersion(root: string, stageId: string, send?: ManagedFetch): Promise<{
-    productVerification: string;
-    url?: unknown;
-    projectId: string;
-    ownerId: string;
-    audience: "public" | "private";
-    deploymentId: string;
-    versionId: string;
-    commit: string;
-    artifactSha256: string;
-    state: unknown;
-}>;
-export declare function managedApplicationStatus(root: string, send?: ManagedFetch): Promise<{
-    project: ManagedProject;
-    state: string;
-    productVerification: string;
-    evidence?: undefined;
-} | {
-    project: ManagedProject;
-    evidence: string;
-    state: unknown;
-    productVerification: string;
-}>;

package/dist/managed-hosting.js

@@ -1,373 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
-import path from 'node:path';
-import { atomicJson, withApplicationLock } from './project-state.js';
-const manifest = 'anhedral.hosting.json';
-const identifier = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
-const maxBytes = 64 * 1024 * 1024;
-const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
-function origin() {
-    const raw = process.env.ANHEDRAL_HOSTING_ORIGIN;
-    if (!raw)
-        throw new Error('Managed hosting backend is not configured. Set ANHEDRAL_HOSTING_ORIGIN to an operated Anhedral service; no hosting service is implied by the CLI.');
-    const url = new URL(raw);
-    if (url.protocol !== 'https:' ||
-        url.username ||
-        url.password ||
-        url.port ||
-        url.search ||
-        url.hash ||
-        url.pathname !== '/' ||
-        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
-        throw new Error('Managed hosting requires an HTTPS origin without credentials, path, query or port.');
-    return url.origin;
-}
-function readProject(root) {
-    const project = JSON.parse(readFileSync(path.join(root, manifest), 'utf8'));
-    if (project.schemaVersion !== 1 ||
-        project.provider !== 'anhedral' ||
-        !identifier.test(project.id) ||
-        typeof project.name !== 'string' ||
-        !project.name.trim() ||
-        !['private', 'public'].includes(project.audience) ||
-        !(project.ownerId === null || identifier.test(project.ownerId)) ||
-        !(project.projectId === null || identifier.test(project.projectId)))
-        throw new Error('Invalid managed hosting manifest.');
-    return project;
-}
-export function registerManagedApplication(root, audience = 'private') {
-    root = realpathSync(root);
-    if (existsSync(path.join(root, manifest)))
-        return readProject(root);
-    if (!['private', 'public'].includes(audience))
-        throw new Error('Select private or public hosting.');
-    const name = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8')).name;
-    if (typeof name !== 'string' || !name.trim())
-        throw new Error('Application requires a package name.');
-    const project = {
-        schemaVersion: 1,
-        id: randomUUID(),
-        name,
-        provider: 'anhedral',
-        ownerId: null,
-        projectId: null,
-        audience,
-    };
-    const ignore = path.join(root, '.gitignore');
-    const previous = existsSync(ignore) ? readFileSync(ignore, 'utf8') : '';
-    if (!previous.split(/\r?\n/).includes('.anhedral/'))
-        writeFileSync(ignore, previous + (previous && !previous.endsWith('\n') ? '\n' : '') + '.anhedral/\n');
-    atomicJson(path.join(root, manifest), project);
-    return project;
-}
-function git(root, args) {
-    return execFileSync('git', args, {
-        cwd: root,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-        maxBuffer: maxBytes,
-        stdio: ['ignore', 'pipe', 'ignore'],
-    });
-}
-function source(root) {
-    if (realpathSync(git(root, ['rev-parse', '--show-toplevel']).toString().trim()) !== root ||
-        git(root, ['status', '--porcelain']).toString().trim())
-        throw new Error('Managed versions require a clean application repository.');
-    const commit = git(root, ['rev-parse', 'HEAD']).toString().trim();
-    if (!/^[a-f0-9]{40,64}$/.test(commit))
-        throw new Error('Invalid source commit.');
-    return commit;
-}
-function files(root, directory) {
-    const entries = [];
-    let size = 0;
-    const visit = (current) => {
-        for (const entry of readdirSync(current, { withFileTypes: true })) {
-            const file = path.join(current, entry.name);
-            const stat = lstatSync(file);
-            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
-                throw new Error('Build artifacts must contain only regular files and directories.');
-            if (entry.name === '.git' || entry.name.startsWith('.env'))
-                throw new Error('Build artifacts must not contain source credentials, Git state or dependencies.');
-            if (stat.isDirectory())
-                visit(file);
-            else {
-                size += stat.size;
-                if (size > maxBytes || entries.length >= 10000)
-                    throw new Error('Managed artifact exceeds staging limits.');
-                entries.push(`${path.relative(root, file)}:${digest(readFileSync(file))}`);
-            }
-        }
-    };
-    visit(directory);
-    if (!entries.length)
-        throw new Error('Build artifact directory is empty.');
-    return digest(Buffer.from(entries.sort().join('\n')));
-}
-export async function stageManagedVersion(root, artifactDirectory) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const project = readProject(root);
-        const commit = source(root);
-        const artifact = realpathSync(path.resolve(root, artifactDirectory));
-        if (!artifact.startsWith(root + path.sep) ||
-            !lstatSync(artifact).isDirectory() ||
-            artifact.startsWith(path.join(root, '.anhedral') + path.sep))
-            throw new Error('Select an application build directory within the repository.');
-        const fingerprint = files(root, artifact);
-        for (const file of git(root, ['ls-files', '-z']).toString().split('\0').filter(Boolean)) {
-            if (path.basename(file).startsWith('.env') && path.basename(file) !== '.env.example')
-                throw new Error('Tracked environment credentials cannot be uploaded as source.');
-            if (lstatSync(path.join(root, file)).isSymbolicLink() ||
-                !lstatSync(path.join(root, file)).isFile())
-                throw new Error('Managed source archives do not support symlinks or submodules.');
-        }
-        if (!git(root, ['show', `HEAD:${manifest}`]).equals(readFileSync(path.join(root, manifest))))
-            throw new Error('Commit the exact managed manifest before staging.');
-        const archive = git(root, ['archive', '--format=tar', commit]);
-        const staging = path.join(root, '.anhedral', 'managed');
-        mkdirSync(staging, { recursive: true, mode: 0o700 });
-        if (realpathSync(staging) !== staging)
-            throw new Error('Managed staging must not be a symbolic link.');
-        const stageId = randomUUID();
-        const directory = path.join(staging, stageId);
-        mkdirSync(directory, { mode: 0o700 });
-        try {
-            writeFileSync(path.join(directory, 'source.tar'), archive, { mode: 0o600 });
-            execFileSync('tar', ['-cf', path.join(directory, 'artifact.tar'), '-C', artifact, '.'], {
-                stdio: 'ignore',
-            });
-            const build = readFileSync(path.join(directory, 'artifact.tar'));
-            if (build.length > maxBytes || archive.length > maxBytes)
-                throw new Error('Managed archives exceed staging limits.');
-            if (files(root, artifact) !== fingerprint || source(root) !== commit)
-                throw new Error('Source or build artifact changed during staging.');
-            const version = {
-                schemaVersion: 1,
-                projectId: project.id,
-                commit,
-                sourceSha256: digest(archive),
-                artifactSha256: digest(build),
-                sourceBytes: archive.length,
-                artifactBytes: build.length,
-                stageId,
-                state: 'staged',
-            };
-            atomicJson(path.join(directory, 'version.json'), version);
-            return version;
-        }
-        catch (error) {
-            rmSync(directory, { recursive: true, force: true });
-            throw error;
-        }
-    });
-}
-async function request(send, method, route, key, body) {
-    const token = process.env.ANHEDRAL_HOSTING_TOKEN;
-    if (!token || /[\r\n]/.test(token))
-        throw new Error('Sign in to the configured managed hosting service; ANHEDRAL_HOSTING_TOKEN is required and never stored.');
-    const endpoint = `${origin()}/v1${route}`;
-    let response;
-    try {
-        response = await send(endpoint, {
-            method,
-            redirect: 'error',
-            signal: AbortSignal.timeout(30000),
-            headers: {
-                Authorization: `Bearer ${token}`,
-                ...(key ? { 'Idempotency-Key': key } : {}),
-                'Content-Type': Buffer.isBuffer(body) ? 'application/x-tar' : 'application/json',
-            },
-            body: body === undefined
-                ? undefined
-                : Buffer.isBuffer(body)
-                    ? new Uint8Array(body)
-                    : JSON.stringify(body),
-        });
-    }
-    catch {
-        throw new Error('Managed hosting request failed; inspect connectivity and authentication.');
-    }
-    let value;
-    try {
-        value = (await response.json());
-    }
-    catch {
-        throw new Error('Managed hosting returned unsupported output.');
-    }
-    if (!response.ok || !value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error(`Managed hosting operation failed (HTTP ${response.status}); no deployment success was recorded.`);
-    return value;
-}
-async function context(root, send) {
-    const project = readProject(root);
-    if (project.hostingOrigin && project.hostingOrigin !== origin())
-        throw new Error('Managed hosting origin differs from the recorded service.');
-    const session = await request(send, 'GET', '/session');
-    if (typeof session.ownerId !== 'string' ||
-        !identifier.test(session.ownerId) ||
-        (project.ownerId && session.ownerId !== project.ownerId))
-        throw new Error('Managed hosting session differs from the application owner.');
-    return { project, ownerId: session.ownerId };
-}
-function identity(value, projectId, ownerId, audience) {
-    if (value.projectId !== projectId || value.ownerId !== ownerId || value.audience !== audience)
-        throw new Error('Managed hosting receipt differs from project ownership or audience.');
-}
-function staged(root, stageId, project) {
-    if (!identifier.test(stageId))
-        throw new Error('Invalid stage identity.');
-    const directory = path.join(root, '.anhedral', 'managed', stageId);
-    if (realpathSync(directory) !== directory)
-        throw new Error('Managed staging directory must not be a symbolic link.');
-    if (!lstatSync(path.join(directory, 'version.json')).isFile() ||
-        lstatSync(path.join(directory, 'version.json')).isSymbolicLink())
-        throw new Error('Invalid staged metadata file.');
-    const version = JSON.parse(readFileSync(path.join(directory, 'version.json'), 'utf8'));
-    if (version.schemaVersion !== 1 ||
-        version.projectId !== project.id ||
-        version.stageId !== stageId ||
-        !/^[a-f0-9]{40,64}$/.test(version.commit))
-        throw new Error('Managed stage belongs to another project.');
-    for (const [file, expected, bytes] of [
-        ['source.tar', version.sourceSha256, version.sourceBytes],
-        ['artifact.tar', version.artifactSha256, version.artifactBytes],
-    ]) {
-        if (!lstatSync(path.join(directory, file)).isFile() ||
-            lstatSync(path.join(directory, file)).isSymbolicLink())
-            throw new Error('Invalid staged archive file.');
-        const archive = readFileSync(path.join(directory, file));
-        if (archive.length !== bytes ||
-            archive.length > maxBytes ||
-            digest(archive) !== expected ||
-            lstatSync(path.join(directory, file)).isSymbolicLink())
-            throw new Error('Managed staged archive changed.');
-    }
-    return { version, directory };
-}
-export async function saveManagedVersion(root, stageId, send = fetch) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const { project, ownerId } = await context(root, send);
-        const { version, directory } = staged(root, stageId, project);
-        const key = digest(Buffer.from(`${project.id}:${version.commit}:${version.sourceSha256}:${version.artifactSha256}`));
-        const created = await request(send, 'POST', '/projects', project.id, {
-            clientProjectId: project.id,
-            name: project.name,
-            audience: project.audience,
-        });
-        if (typeof created.projectId !== 'string' ||
-            !identifier.test(created.projectId) ||
-            (project.projectId && created.projectId !== project.projectId))
-            throw new Error('Managed project identity changed.');
-        identity(created, created.projectId, ownerId, project.audience);
-        if (created.clientProjectId !== project.id)
-            throw new Error('Backend project differs from the registered client identity.');
-        const connected = {
-            ...project,
-            projectId: created.projectId,
-            ownerId,
-            hostingOrigin: origin(),
-        };
-        atomicJson(path.join(root, manifest), connected);
-        const base = `/projects/${created.projectId}`;
-        const receipt = await request(send, 'POST', `${base}/versions`, key, {
-            commit: version.commit,
-            sourceSha256: version.sourceSha256,
-            artifactSha256: version.artifactSha256,
-            sourceBytes: version.sourceBytes,
-            artifactBytes: version.artifactBytes,
-        });
-        identity(receipt, created.projectId, ownerId, project.audience);
-        if (typeof receipt.versionId !== 'string' || !identifier.test(receipt.versionId))
-            throw new Error('Managed version identity is missing.');
-        for (const kind of ['source', 'artifact']) {
-            const bytes = readFileSync(path.join(directory, `${kind}.tar`));
-            const uploaded = await request(send, 'PUT', `${base}/versions/${receipt.versionId}/${kind}`, `${key}:${kind}`, bytes);
-            identity(uploaded, created.projectId, ownerId, project.audience);
-            if (uploaded.versionId !== receipt.versionId ||
-                uploaded.sha256 !== digest(bytes) ||
-                uploaded.bytes !== bytes.length)
-                throw new Error('Managed upload receipt differs from the staged archive.');
-        }
-        const saved = await request(send, 'GET', `${base}/versions/${receipt.versionId}`);
-        identity(saved, created.projectId, ownerId, project.audience);
-        if (saved.versionId !== receipt.versionId ||
-            saved.commit !== version.commit ||
-            saved.sourceSha256 !== version.sourceSha256 ||
-            saved.artifactSha256 !== version.artifactSha256 ||
-            saved.state !== 'saved')
-            throw new Error('Backend has not confirmed an exact saved source/build version.');
-        const result = { ...version, state: 'saved', versionId: receipt.versionId };
-        atomicJson(path.join(directory, 'version.json'), result);
-        return result;
-    });
-}
-export async function deployManagedVersion(root, stageId, send = fetch) {
-    root = realpathSync(root);
-    return withApplicationLock(root, async () => {
-        const { project, ownerId } = await context(root, send);
-        const { version } = staged(root, stageId, project);
-        if (!project.projectId ||
-            version.state !== 'saved' ||
-            !version.versionId ||
-            !identifier.test(version.versionId))
-            throw new Error('Save the exact managed version before requesting deployment.');
-        const base = `/projects/${project.projectId}`;
-        identity(await request(send, 'GET', base), project.projectId, ownerId, project.audience);
-        const receipt = await request(send, 'POST', `${base}/deployments`, `${version.versionId}:${project.audience}`, {
-            versionId: version.versionId,
-            audience: project.audience,
-            commit: version.commit,
-            artifactSha256: version.artifactSha256,
-        });
-        if (typeof receipt.deploymentId !== 'string' || !identifier.test(receipt.deploymentId))
-            throw new Error('Backend did not return a deployment identity.');
-        const result = await request(send, 'GET', `${base}/deployments/${receipt.deploymentId}`);
-        identity(result, project.projectId, ownerId, project.audience);
-        if (result.deploymentId !== receipt.deploymentId ||
-            result.versionId !== version.versionId ||
-            result.commit !== version.commit ||
-            result.artifactSha256 !== version.artifactSha256 ||
-            !['queued', 'building', 'deployed', 'failed'].includes(String(result.state)))
-            throw new Error('Managed deployment evidence differs from the saved version.');
-        if (result.state === 'deployed') {
-            if (typeof result.url !== 'string')
-                throw new Error('A deployed result requires a confirmed URL.');
-            const url = new URL(result.url);
-            if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.search)
-                throw new Error('Invalid managed deployment URL.');
-        }
-        else
-            delete result.url;
-        const confirmed = {
-            projectId: project.projectId,
-            ownerId,
-            audience: project.audience,
-            deploymentId: result.deploymentId,
-            versionId: version.versionId,
-            commit: version.commit,
-            artifactSha256: version.artifactSha256,
-            state: result.state,
-            ...(result.state === 'deployed' ? { url: result.url } : {}),
-        };
-        atomicJson(path.join(root, '.anhedral', 'managed-deployment.json'), confirmed);
-        return { ...confirmed, productVerification: 'required' };
-    });
-}
-export async function managedApplicationStatus(root, send = fetch) {
-    root = realpathSync(root);
-    const { project, ownerId } = await context(root, send);
-    if (!project.projectId)
-        return { project, state: 'not-connected', productVerification: 'unverified' };
-    const result = await request(send, 'GET', `/projects/${project.projectId}`);
-    identity(result, project.projectId, ownerId, project.audience);
-    return {
-        project,
-        evidence: 'provider-refresh',
-        state: ['registered', 'queued', 'building', 'deployed', 'failed'].includes(String(result.state))
-            ? result.state
-            : 'unknown',
-        productVerification: 'unverified',
-    };
-}