anhedral 0.4.1 → 0.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "anhedral",
-  "version": "0.4.1",
-  "description": "Generate a complete, readable TypeScript product stack with Next.js, Expo, Fastify, Neon, Drizzle, Clerk, R2, Electron updates, WXT, and Vercel.",
+  "version": "0.6.0",
+  "description": "Initialize client-owned applications with shadcn, pnpm, Turborepo, and Cloudflare-first services.",
   "type": "module",
   "exports": {
     ".": {
@@ -12,28 +12,18 @@
   "types": "./dist/index.d.ts",
   "sideEffects": false,
   "bin": {
-    "anhedral": "bin/anhedral.js"
+    "anhedral": "dist/bin.js"
   },
   "files": [
-    "bin",
     "dist",
-    "docs/conventions.md",
     "assets/anhedral-cli-init.svg",
-    "assets/images/svg/ably-symbol-color.svg",
+    "assets/anhedral-cli-init-technical.svg",
     "assets/images/svg/logo-white-subtract.svg",
-    "docs/master-stack-map.md",
-    "docs/output-tree-contract.md",
-    "docs/references",
-    "scripts/render-master-stack-map.mjs",
-    "templates",
-    "SKILL.md",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
     "LICENSE",
     "README.md",
-    "SECURITY.md",
     "anhedral.svg",
-    "favicon.ico"
+    "favicon.ico",
+    "docs/application-stack-standard.md"
   ],
   "homepage": "https://github.com/anhedral/anhedral-init#readme",
   "repository": {
@@ -53,7 +43,7 @@
   "scripts": {
     "scaffold": "node dist/bin.js init",
     "clean": "node scripts/clean.mjs",
-    "build": "pnpm clean && tsc",
+    "build": "pnpm clean && tsc && node scripts/prepare-cli.mjs",
     "prepare": "pnpm build",
     "typecheck": "tsc --noEmit",
     "check:hygiene": "node scripts/check-source-hygiene.mjs",
@@ -61,56 +51,51 @@
     "check:release-policy": "node scripts/check-release-policy.mjs",
     "check:release-secrets": "node scripts/check-release-secrets.mjs",
     "lint": "pnpm typecheck && pnpm check:hygiene && pnpm check:release-policy",
-    "audit:osv": "pnpm build && node scripts/audit-osv.mjs --generator",
-    "test": "pnpm test:cli",
-    "test:coverage": "pnpm build && c8 --all --include='dist/**/*.js' --reporter=text --reporter=json-summary --check-coverage --lines 84 --statements 84 --functions 84 --branches 80 node tests/test-cli.js",
+    "audit:osv": "node scripts/audit-osv.mjs",
+    "test": "pnpm test:unit",
     "pretest": "pnpm build",
     "prepublishOnly": "pnpm test:all",
-    "test:cli": "node tests/test-cli.js",
-    "test:cli:validation": "node tests/test-cli-validation.js",
-    "test:deps": "pnpm build && node tests/test-dependency-manifest.js",
-    "test:vercel-schema": "pnpm build && node tests/test-vercel-services-schema.js",
+    "test:cli:validation": "node --test tests/test-cli-validation.test.mjs",
     "test:pack": "pnpm build && node tests/test-packed-cli.js",
-    "test:pack:exact": "node tests/test-packed-cli.js release-artifact/metadata.json",
+    "test:pack:exact": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
     "test:packlist": "pnpm build && node tests/test-packlist.js",
-    "test:release-tooling": "node tests/test-release-tooling.js",
-    "test:topologies": "pnpm build && node tests/test-module-topology-invariants.js",
-    "test:templates": "pnpm build && node tests/test-template-source.js",
-    "pretest:e2e": "pnpm build",
-    "test:e2e": "node tests/test-e2e-public-stacks.js",
-    "pretest:e2e:latest": "pnpm build",
-    "test:e2e:latest": "node tests/test-e2e-public-stacks.js --toolchain latest",
-    "test:acceptance:desktop": "pnpm build && node tests/test-runtime-acceptance.js desktop",
-    "test:acceptance:extension": "pnpm build && node tests/test-runtime-acceptance.js extension",
-    "test:acceptance:mobile": "pnpm build && node tests/test-runtime-acceptance.js mobile",
-    "test:all": "pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:coverage && pnpm test:deps && pnpm test:templates && pnpm test:vercel-schema && pnpm test:pack && pnpm test:packlist && pnpm test:e2e",
-    "release:check": "pnpm check:release-policy && pnpm test:all && npm pack --dry-run --ignore-scripts",
-    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs release-artifact/metadata.json",
-    "release:artifact:verify": "node scripts/verify-release-artifact.mjs release-artifact/metadata.json && node scripts/check-release-secrets.mjs release-artifact/metadata.json",
-    "release:artifact:smoke": "node tests/test-packed-cli.js release-artifact/metadata.json",
-    "demo:refresh": "pnpm build && node tests/refresh-demo.js",
-    "docs:stack-map": "node scripts/render-master-stack-map.mjs"
+    "test:release-tooling": "node tests/test-release-tooling.test.mjs",
+    "test:all": "pnpm build && pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:unit && node tests/test-packed-cli.js && node tests/test-packlist.js",
+    "release:check": "pnpm test:all",
+    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:artifact:verify": "node scripts/verify-release-artifact.mjs .artifacts/release/metadata.json && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:artifact:smoke": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
+    "docs:stack-map": "node scripts/render-master-stack-map.mjs",
+    "docs:technical-stack-map": "node scripts/render-master-stack-map.mjs --technical",
+    "docs:stack-maps": "pnpm docs:stack-map && pnpm docs:technical-stack-map",
+    "test:standard": "pnpm build && node --test tests/test-standard.test.mjs",
+    "test:unit": "node --test --test-concurrency=4 --test-reporter=spec tests/*.test.mjs"
   },
   "keywords": [
     "cli",
     "scaffold",
     "typescript",
     "nextjs",
-    "fastify",
+    "hono",
+    "cloudflare",
+    "opennext",
     "expo",
     "electron",
-    "clerk",
-    "drizzle",
-    "neondb",
-    "revenuecat",
     "wxt",
-    "vercel"
+    "neon",
+    "drizzle",
+    "shadcn",
+    "turborepo"
   ],
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.34.5",
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@<=5.0.7": "5.0.8"
+    }
+  },
   "devDependencies": {
     "@types/node": "20.19.43",
-    "c8": "11.0.0",
     "simple-icons": "16.27.0",
     "typescript": "5.9.3"
   }

package/CHANGELOG.md

@@ -1,132 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## Unreleased
-
-## 0.4.1 - 2026-07-22
-
-### Added
-
-- Add the public launch artwork, reusable stack-map renderer, and expanded brand asset library to the repository and published package.
-
-### Changed
-
-- Present Anhedral as a cross-platform, modular product stack that lets teams build once, ship everywhere, and scale without repeating framework setup.
-- Automatically create patch versions for ordinary changes merged to `main`, while preserving explicitly declared minor and major releases.
-- Keep project upgrades compatible across automatic patch releases and retain the supported 0.3-to-0.4 ownership migration.
-- Publish from the exact generated release commit and attach npm provenance now that the source repository is public.
-
-## 0.4.0 - 2026-07-22
-
-### Added
-
-- Add the `electron-updater` feature module, including packaged-app update checks, private R2 storage, a read-only bound Cloudflare Worker on a custom domain, ordered architecture-specific publishing commands, and a complete generated release runbook.
-- Make the `anhedral-init` coding-agent skill the recommended setup path, with project/domain intake, Computer Use and subagent orchestration, provider provisioning order, authentication and secret-generation stops, and verified Cloudflare/Vercel domain handoffs.
-- Add the canonical fixed-width master stack map to the published documentation and route the coding-agent skill through it for whole-platform planning and explanation.
-- Add a transactional project-upgrade path so compatible 0.3 projects can adopt 0.4 without regeneration.
-- Add a focused default development loop for the primary web and API surfaces, with `dev:all` available for intentionally launching every selected client.
-
-### Changed
-
-- Make generated onboarding follow the real environment, managed-Neon, verification, and framework source layout instead of promising an unconfigured one-command boot.
-- Treat developer extension points as user-owned source while retaining conflict protection for generated wiring and mergeable workspace configuration.
-- Publish the skill's provisioning references from their canonical `docs/references` location and validate every packed local documentation link.
-- Upgrade GitHub artifact transfer actions to their Node.js 24-native releases and keep manual npm publication routed through the trusted-publisher workflow identity.
-
-### Fixed
-
-- Canonicalize module ordering when an incremental feature contributes a previously absent dependency.
-- Attach release integrity metadata beside the npm tarball in GitHub Releases.
-
-## 0.3.0 - 2026-07-21
-
-### Added
-
-- Add a unified `anhedral ui add` workflow that routes DOM clients to shadcn/ui and Expo clients to React Native Reusables.
-- Add interactive starter-component selection after app surfaces and feature sets, with NativeWind or Uniwind selection for Expo.
-- Add React Native Reusables-ready Expo configuration, theme CSS, aliases, utilities, Metro integration, and portal hosting.
-- Add manifest schema v5 UI configuration and per-client component installation records.
-- Add staged provider execution, dry-run plans, duplicate-install detection, target validation, and provider routing tests.
-- Add `anhedral new <directory>` as the primary complete-stack creation flow while retaining `init` for an empty current directory.
-- Generate selection-aware `README.md`, `docs/DEVELOPMENT.md`, `docs/STACK.md`, and `SKILL.md` guidance that maps product tasks to ordinary framework source.
-- Publish the repository skill, manual scaffolding reference, conventions, and output-tree contract with the npm package.
-
-### Changed
-
-- Pin the component installer to shadcn 4.13.0 and run all provider mutations inside Anhedral transaction staging.
-- Preserve Anhedral's exact Expo SDK dependency while resolving React Native Reusables registry dependencies before the root workspace install.
-- Present Anhedral as a readable TypeScript stack generator with native Next.js, Expo, Fastify, Drizzle, Electron, and WXT conventions rather than a proprietary application runtime.
-- Use argument-vector process execution for workspace installation instead of invoking a command through a shell.
-- Remove the retired one-app compiler experiment from the production CLI and package surface.
-
-### Security
-
-- Reject symbolic-link scaffold roots before creating transaction metadata or modifying their targets.
-- Override vulnerable `shell-quote` and `sharp` dependency ranges in generated workspaces.
-
-## 0.2.1 - 2026-07-16
-
-### Added
-
-- Add integrity-checked bundled framework substrates, typed module contributions, deterministic root composers, and manifest schema v4 template provenance.
-- Add template tamper, symbolic-link, package-content, and contribution-composition regression tests.
-- Add exact-artifact portability checks at the minimum Node.js 20 and 22 releases and the pinned Node.js 24 release on macOS and Windows.
-- Add scheduled and release-gated Electron, WXT, and Expo native runtime acceptance lanes.
-- Add deterministic workflow, Renovate extraction, release declaration, registry recovery, and module-topology policy tests.
-
-### Security
-
-- Reject altered template catalogs, mismatched substrate digests, symbolic links, forbidden generated artifacts, and oversized template trees before transactional commit.
-- Scan all tracked text, built output, and final package tarballs for high-confidence secret formats before publication.
-- Clarify that public package availability grants no installation, execution, or generated-output rights without a separate written agreement.
-
-## 0.2.0 - 2026-07-15
-
-### Added
-
-- Add manifest schema v3 with deterministic module dependency resolution, file ownership, hashes, modes, and an explicit toolchain channel.
-- Add transactional `init` and `add` operations with locking, journaling, rollback, dry-run plans, and JSON output.
-- Add the `anhedral doctor` command.
-- Add deterministic output-tree contracts for representative scaffold combinations.
-
-### Changed
-
-- Generate only the dependencies, source files, environment keys, apps, and shared packages required by selected modules.
-- Align Vercel Services output with the current `services` schema and mount Fastify routes under the preserved `/api` path.
-- Refresh the verified Next.js, Expo, Clerk, Electron, WXT, Vite, and RevenueCat integration matrix.
-- Separate the side-effect-free package API from the executable CLI entry point.
-- Preserve user-owned documentation, workflows, package fields, and mergeable root configuration during incremental adds.
-- Build from a clean `dist/` directory before tests and packaging.
-- Publish one verified tarball and compare its integrity with npm before tagging.
-- Pin the release Node.js/npm packer so recovery rebuilds remain reproducible.
-- Install the exact release artifact and run its `.bin/anhedral` shim in package smoke tests.
-- Enforce an explicit npm package allowlist and artifact size policy.
-- Test the CLI on Node.js 20, 22, and 24 in CI.
-- Wire Clerk controls and token-aware API helpers into web and mobile templates, and make the desktop account action open Clerk sign-in or profile UI.
-- Bootstrap RevenueCat only for `native-subscriptions`, connect native purchases to the authenticated user, and expose a native paywall action.
-- Put pnpm overrides, build permissions, and peer policy in `pnpm-workspace.yaml`, with conflict-safe structural merges.
-- Keep public API GET requests simple by omitting unused platform and content-type headers.
-- Remove unused provider dependencies and environment placeholders from generated clients.
-- Wire Tailwind CSS v4 into generated web and desktop builds, including semantic shadcn color tokens.
-- Keep canonical module IDs and valid RFC 3986 URI schemes in generated project metadata and documentation.
-- Refresh generator-owned Node.js and pnpm policy during incremental adds when the recorded package manifest is unmodified.
-
-### Removed
-
-- Remove pre-schema-v3 manifest migration, generated-layout adoption, deprecated module aliases, and duplicate `stack.json` output. Projects must be generated with the current CLI and use canonical module IDs.
-
-### Security
-
-- Reject modified managed files and unowned path collisions before committing incremental changes.
-- Validate recovery journals, reject symlink traversal, and persist transaction intent before moving files.
-- Audit every locked CLI dependency through OSV after pnpm's retired audit endpoint became unavailable.
-- Make RevenueCat webhook processing fail closed and persist idempotency records when billing is selected.
-- Scope npm credentials to the single publish step in the protected release job.
-- Separate read-only release verification from npm publication and Git tag creation.
-- Pin GitHub Actions to verified upstream commit SHAs.
-- Default Fastify proxy trust to off, require an explicit bounded trusted-hop count, and minimize conditional Chrome permissions.
-- Reconcile exact package versions against detailed OSV advisory ranges when the batch index is over-broad.
-- Reject manifest-recorded directories and other non-regular paths during project health checks.

package/CONTRIBUTING.md

@@ -1,73 +0,0 @@
-# Contributing
-
-## Local setup
-
-Anhedral requires Node.js 20.19+ or 22.12+ and pnpm 10.34.5.
-
-```sh
-pnpm install --frozen-lockfile
-pnpm build
-pnpm lint
-pnpm check:security
-pnpm check:release-policy
-pnpm audit:osv
-pnpm test
-```
-
-## Before opening a pull request
-
-Run the checks relevant to the files you changed:
-
-```sh
-pnpm typecheck
-pnpm test
-pnpm test:pack
-pnpm test:packlist
-pnpm test:release-tooling
-```
-
-Changes to generated templates or dependency pins should also run:
-
-```sh
-pnpm test:deps
-pnpm test:e2e
-```
-
-The E2E test installs upstream packages in a disposable operating-system temp directory, so it requires network access and may take several minutes. It removes the workspace in a `finally` block; set `ANHEDRAL_E2E_KEEP=1` only when you intentionally need to inspect a failed or completed run.
-
-After an intentional scaffold-output change, regenerate and review the path/mode/SHA-256 contracts and generated tree documentation:
-
-```sh
-pnpm build
-node tests/update-output-tree-contracts.js
-```
-
-## Package changes
-
-- Keep the public package allowlist narrow.
-- Do not commit `dist/`, tarballs, `release-artifact/`, or temporary E2E/demo workspaces.
-- Add or update a regression test for CLI behavior and generated configuration changes.
-- Keep stable toolchain commands pinned; mutable upstream versions belong only in the `latest` lane.
-- Run the OSV audit against a newly installed representative generated lockfile when changing framework or runtime pins.
-
-## Ownership and required review
-
-Repository administrators must map the following roles to real maintainers in branch protection, the protected `npm` environment, private vulnerability reporting, and workflow-failure notifications:
-
-- **Generator owner:** core architecture, transactions, manifests, and generated-file ownership.
-- **Runtime owner:** application templates, provider integrations, and the stable dependency manifest.
-- **Release owner:** package metadata, CI workflows, registry publication, tags, and recovery.
-- **Security responder:** vulnerability intake, secret-exposure response, and supply-chain incidents.
-
-No `CODEOWNERS` file is committed until an actual GitHub user or team slug is selected. A placeholder would create false confidence without enforcing review. Require at least one appropriate owner review for generator/runtime changes and a release-owner review for `.github/workflows/`, `scripts/`, `package.json`, `renovate.json`, `SECURITY.md`, or `docs/RELEASING.md`.
-
-Scheduled Toolchain Drift failures and release-workflow failures must alert the release owner. Security-policy, secret-scan, or OSV failures must additionally alert the security responder. Configure those routes in repository notification settings and test them after changing ownership.
-
-## Releases
-
-Do not run `npm publish` from a development checkout. Version changes are reviewed before release, and CI publishes the verified tarball. See [docs/RELEASING.md](docs/RELEASING.md).
-
-This repository and package are licensed under the Apache License 2.0. Unless
-explicitly stated otherwise, contributions intentionally submitted for
-inclusion in Anhedral are provided under the same license, as described in
-Section 5 of [LICENSE](LICENSE).

package/SECURITY.md

@@ -1,37 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes are made on the current development branch and released as a new npm version. Consumers should use the latest version published under the `latest` dist-tag.
-
-## Reporting a vulnerability
-
-Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting or security-advisory flow for this repository. If repository access is unavailable, contact the package maintainers through the owner information on the [anhedral npm package](https://www.npmjs.com/package/anhedral).
-
-Include the affected version, reproduction steps, impact, and any suggested mitigation. Please avoid accessing data that is not yours and allow maintainers time to investigate before public disclosure.
-
-## Supply-chain policy
-
-- Release artifacts are built and tested in a read-only job.
-- The exact tarball uploaded by CI is the artifact submitted to npm.
-- npm integrity is checked before and after publication.
-- npm publication uses Trusted Publishing: GitHub exchanges an OIDC identity for a short-lived credential only in the publish step of the protected `npm` environment. No npm write token is stored in GitHub.
-- A Git tag and GitHub release are created only after npm confirms the expected artifact integrity.
-- GitHub Actions are pinned to reviewed commit SHAs, and the release Node.js/npm packer is pinned to an exact version.
-- CI queries OSV for every exact package version in `pnpm-lock.yaml` and every dependency version shipped by the generator; it fails closed if the service remains unavailable after bounded retries or reports a finding.
-- Local policy scans every tracked or non-ignored working-tree text file and built `dist/` file for high-confidence credential formats. Release jobs repeat the scan against the exact gzip tarball before it crosses the publish boundary. Placeholder examples use explicit non-secret values rather than allowlisting token-shaped strings.
-- Release declarations must be valid Semantic Versioning and have a matching `CHANGELOG.md` section. Local deterministic checks validate workflow policy and confirm every Renovate custom manager still extracts a maintained pin.
-
-Generated projects pin their stable dependency manifest, explicitly allow only required dependency build scripts, and record the selected toolchain channel in `anhedral.json`. The `latest` channel is for upstream-drift testing and is not the reproducible default.
-
-Incremental generation rejects path traversal, symbolic-link targets, unowned collisions, modified managed files, and managed-file permission drift. Transaction journals are validated before recovery, fsynced before filesystem moves, and advanced only around durable rename barriers where the host filesystem supports directory synchronization.
-
-UI component installation is an explicit networked supply-chain operation. Anhedral pins the shadcn installer version, routes Expo only to the official HTTPS React Native Reusables registry, validates component names and target paths, and runs provider mutation inside transaction staging. Provider-generated files and dependency manifests must pass ownership checks before commit. Users should review `--dry-run` output and the resulting source diff; registry content is upstream-maintained and is not part of Anhedral's immutable bundled-template catalog.
-
-## Secret response
-
-If a secret-shaped finding is real, do not merely remove it from the latest commit. Revoke or rotate the credential first, identify every log, artifact, cache, fork, and package version that may contain it, and coordinate history or artifact cleanup with the security responder. Treat false positives by changing the example to an unmistakable placeholder; do not add broad path exclusions.
-
-Anhedral is licensed under the Apache License 2.0. Security research must still
-comply with applicable law and the systems owner's authorization; the software
-license does not authorize testing infrastructure or accounts you do not own.

package/SKILL.md

@@ -1,244 +0,0 @@
----
-name: anhedral-init
-description: Guide a user through creating, provisioning, extending, explaining, or diagnosing a complete Anhedral TypeScript stack. Use for skill-led new/init/add/ui/doctor workflows; Computer Use or subagent-assisted cloud setup; domains, DNS, Vercel, Cloudflare, Neon, Clerk, R2, billing, stores, and Electron updates; development inside a generated workspace; ownership interpretation; manual reproduction; or verification.
----
-
-# Anhedral Init
-
-Anhedral is a stack generator, not an application runtime or programming language. Generated projects use ordinary framework source and expose the complete integration code. Do not invent Anhedral-specific models, routes, queries, components, or client hooks when the selected framework already has a documented convention.
-
-For every new project or provisioning request, begin by asking for the project
-name and whether the user already owns a custom domain for it. Do not run init
-or create provider resources until those answers establish canonical names.
-
-Use Node.js 20.19+ or 22.12+ and pnpm. `new` creates a destination directory; `init` works in an empty current directory where `.git`, `.gitignore`, and `.DS_Store` are allowed.
-
-## Choose the construction path
-
-- Use the manual path whenever the user asks to avoid the Anhedral CLI, the CLI is unavailable, or the task requires explaining/reproducing the scaffold itself.
-- Before creating or changing files manually, read [docs/references/manual-scaffolding.md](docs/references/manual-scaffolding.md) completely and follow its ordered procedure. Treat it as the canonical manual checklist, including its source-file matrix and feature gates.
-- Use the CLI path only when the user permits it. Do not silently substitute `anhedral init`, `anhedral add`, imported generator code, or a generated demo for the manual path.
-- For an exact-version scaffold inside the Anhedral source repository, render from the current `src/templates/*.ts`, `src/scaffold.ts`, and `src/dependencies.ts`; do not copy stale demo output. Outside that repository, implement the behavior and file contract in the manual reference and pin a mutually compatible toolchain.
-
-The manual path must leave a complete working workspace, not merely a directory tree or list of commands. Write the source, configuration, tests, environment examples, CI, deployment configuration, and database migration gate selected by the module plan. Install and verify when the environment permits it.
-
-## Select modules
-
-Choose app surfaces from `web`, `mobile`, `api`, `desktop`, and `extension`.
-
-Choose features from `db`, `auth`, `billing`, `storage`, `native-subscriptions`, and `electron-updater`.
-
-Apply these dependency rules automatically:
-
-```text
-auth                 -> api + db
-billing              -> auth
-storage              -> auth
-native-subscriptions -> mobile + billing
-electron-updater     -> desktop
-```
-
-With no module flags, generate the full stack.
-
-## Master stack map
-
-Read [docs/master-stack-map.md](docs/master-stack-map.md) completely before
-explaining the whole platform, selecting modules for a complete product, or
-planning cross-provider provisioning. Treat it as the canonical map of the
-stack, command surface, runtime connections, agent workflow, and release path.
-
-```text
-project + domain intake
-          |
-          v
-1 select + plan -> 2 generate safely -> 3 one pnpm/Turborepo workspace
-                                              |
-                                              v
-4 connected product capabilities -> 5 provision cloud + DNS
-                                              |
-                                              v
-6 generated package.json commands -> 7 developer/agent/Computer Use
-                                              |
-                                              v
-                               8 verify, release, and operate
-```
-
-Use the full fixed-width ASCII map from the document when the user asks for the
-master stack map. Do not redraw it from memory or omit unselected modules when
-describing Anhedral's complete capability surface; mark modules as selected or
-unselected separately.
-
-## Run the guided init workflow
-
-Read [docs/references/provisioning.md](docs/references/provisioning.md) completely before
-starting a new project or provisioning any provider. Follow its intake,
-capability discovery, Computer Use, subagent, authentication, secret-handling,
-domain, provider-order, and verification gates.
-
-The lead agent must:
-
-1. Ask for project name and existing/custom-domain status first.
-2. Discover whether Computer Use/browser control and subagents are available.
-3. Resolve modules and show the user canonical project/resource names.
-4. Run the explicit CLI command, then read the generated `PRODUCTION.md`.
-5. Provision only selected providers, pausing for sign-in, MFA, secret
-   generation, purchases, and final submissions exactly as the reference says.
-6. Keep secrets out of chat and tool output; have the user paste them directly
-   into uncommitted environment files and protected provider fields.
-7. Verify code, cloud resources, DNS, TLS, and provider health before handoff.
-
-## Initialize
-
-```sh
-pnpm dlx anhedral@latest new my-product
-cd my-product
-```
-
-Prefer explicit modules when the user requests a smaller stack:
-
-```sh
-pnpm dlx anhedral@latest new my-product --web --api --db --auth
-pnpm dlx anhedral@latest new my-product --web --mobile --ui button,dialog --native-styling nativewind
-pnpm dlx anhedral@latest new my-api --api --skip-install
-```
-
-Use the stable toolchain for normal generation. The `latest` value is retained only as a metadata compatibility channel for maintainer investigations:
-
-```sh
-pnpm dlx anhedral@latest new my-product --toolchain stable
-pnpm dlx anhedral@latest new my-product --toolchain latest
-```
-
-Both channels generate the same exact verified dependencies and integrity-checked bundled templates; `latest` only records investigation intent in `anhedral.json`. Upstream refreshes happen outside user projects and are shipped only after review and checksum verification. Neither channel invokes mutable upstream framework generators inside a user project.
-
-Do not run any command in this section during the manual path.
-
-## Develop inside a generated project
-
-Read these files before changing product code:
-
-1. `README.md` for the selected modules, first run, and source-location map.
-2. `docs/DEVELOPMENT.md` for end-to-end feature recipes.
-3. `docs/STACK.md` for responsibility boundaries and official tool documentation.
-4. `PRODUCTION.md` only for provisioning, deployment, DNS, stores, or release work.
-
-Use the native source conventions:
-
-- Next.js code belongs in `apps/web/app`, `apps/web/components`, and `apps/web/lib`.
-- Expo Router code belongs in `apps/mobile/app` and `apps/mobile/components`.
-- Product Fastify route registration belongs in `apps/api/src/routes/app.ts`. Server-only feature modules live alongside the managed integrations in `apps/api/src`.
-- Product Zod network schemas belong in `packages/contracts/src/app.ts`.
-- Product client-safe HTTP methods belong in `packages/api-client/src/app.ts`.
-- Product Drizzle tables belong in `packages/db/src/app-schema.ts`; generate and review SQL migrations.
-
-Implement an end-to-end feature as `contracts -> database/service -> route -> API client -> frontend`. Frontends may import contracts and client-safe packages, never API services, database connections, or server environments. This stack uses managed Neon and intentionally has no local Postgres service.
-
-## Add modules safely
-
-Run `add` only from a project containing `anhedral.json` schema v5 at the current generator version. If `doctor` identifies a supported older generator, preview and apply its transactional upgrade first:
-
-```sh
-pnpm dlx anhedral@latest upgrade --dry-run
-pnpm dlx anhedral@latest upgrade
-pnpm dlx anhedral@latest add desktop extension
-pnpm dlx anhedral@latest add storage --dry-run
-```
-
-Use `--dry-run` before a consequential add. Use `--json` when another program needs the plan; JSON failures include a stable `code` and a human-readable `error`. Use `--verbose` for interactive child-command diagnostics. Anhedral preserves recorded user-owned extension files and intentionally refuses modified managed files, symlinks, and unowned collisions; do not bypass those conflicts.
-
-For a 0.3 upgrade blocked by a modified managed file, preserve the change in source control, restore that file to its recorded 0.3 content, apply the upgrade, and port the product behavior into the corresponding 0.4 user-owned extension seam. Never approve the upgrade by rewriting manifest hashes.
-
-Require the manifest generator version to match the running CLI. Regenerate projects created by another version; do not add compatibility branches.
-
-Do not rewrite a generated project's README or custom workflows while adding modules. Preserve custom package fields and mergeable root configuration.
-
-For manual projects without a trustworthy schema-v5 `anhedral.json`, add modules with the manual reference instead. Never fabricate manifest ownership records, template provenance, UI installation records, or hashes. A manually authored workspace is valid as an application workspace but is not CLI-managed until it has been regenerated by a matching Anhedral version.
-
-## Add UI components
-
-Use the unified UI wrapper for source-owned components:
-
-```sh
-pnpm dlx anhedral@latest ui add button dialog
-pnpm dlx anhedral@latest ui add select --target mobile
-pnpm dlx anhedral@latest ui add data-table --target web --dry-run
-```
-
-Anhedral routes web, desktop, and extension targets to shadcn/ui. It routes Expo mobile to React Native Reusables using the manifest's NativeWind or Uniwind selection. Omit `--target` to add the provider-specific implementation to every selected UI client. Provider writes occur in transaction staging and must pass the same ownership checks as module additions.
-
-## Diagnose
-
-Dry-runs never perform transaction recovery. If a recovery journal is pending, rerun the original command without `--dry-run` before requesting a new preview.
-
-Check recorded files and hashes with:
-
-```sh
-pnpm dlx anhedral@latest doctor
-pnpm dlx anhedral@latest doctor --json
-```
-
-Explain that warnings can represent mergeable or user-owned drift, while modified or missing managed files make the project unhealthy.
-
-## Configure the generated project
-
-Copy environment examples, fill only selected provider values, install, and verify:
-
-```sh
-cp apps/api/.env.example apps/api/.env
-cp packages/db/.env.example packages/db/.env
-pnpm install
-pnpm verify
-```
-
-Copy only examples that exist for the selected surfaces. Client packages use package-local runtime files (for example, copy `apps/web/.env.example` to `apps/web/.env.local` and `apps/desktop/.env.example` to `apps/desktop/.env`); the root `.env.example` is an inventory, not a runtime environment file.
-
-Common selected keys are:
-
-- Neon: `DATABASE_URL`
-- Clerk server: `CLERK_PUBLISHABLE_KEY`, `CLERK_SECRET_KEY`
-- Clerk clients: `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY`, `EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY`, `VITE_CLERK_PUBLISHABLE_KEY`
-- RevenueCat: `RC_WEBHOOK_SECRET`, `RC_SECRET_API_KEY`, `RC_ENTITLEMENT_ID`, `EXPO_PUBLIC_RC_*`
-- Ably billing synchronization: server-only `ABLY_API_KEY`; clients obtain scoped tokens from the API
-- R2: `BASE_URL`, `R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`, `R2_PREFIX=storage`, `R2_PROXY_READ_URL_TTL_SECONDS=600`; keep `CLOUDFLARE_API_TOKEN` operations/CI-only
-- Internal billing/storage jobs: high-entropy server-only `CRON_SECRET`
-- Electron updates: `DESKTOP_UPDATE_BASE_URL` in `apps/desktop/electron-builder.env`; the private R2 binding needs no credential in the packaged application
-
-Never commit real `.env` files. Keep `ANHEDRAL_DEMO=false` in production.
-
-Run only scripts present for installed modules. `pnpm dev` starts the primary
-product loop—web plus API when web is selected, otherwise the first selected
-surface. A multi-surface project also exposes `pnpm dev:all`; use it only when
-the user wants every selected development server. Typical focused commands
-include `dev:web`, `dev:mobile`, `dev:api`, `dev:desktop`, `dev:extension`,
-corresponding `verify:*` scripts, and database scripts for `db` projects.
-
-## Understand deployment
-
-Treat the root `vercel.json` as the only Vercel Services configuration. It uses the current `services` schema, declares `apps/api` and `apps/web` as independent service roots, and routes `/api/(.*)` before the web catch-all. Vercel preserves the original path, so Fastify mounts its routes under `/api` locally and in deployment. Select the Services framework preset before deploying.
-
-For billing, keep Neon authoritative: RevenueCat reconciliation writes the subscription revision and realtime outbox atomically, Ably carries only per-user invalidations, and every client refetches the entitlement. Schedule the authenticated outbox flush every five minutes and verify purchase, webhook, reconnect, and foreground recovery paths.
-
-Use `apps/mobile` for EAS, `pnpm desktop:build` for a current-host Electron artifact, matching platform-specific desktop scripts in CI, and `pnpm extension:zip` for the WXT archive.
-
-For `electron-updater`, provision the generated private R2 bucket and
-`desktop-updater` Worker at `updates.<domain>`. Keep the Worker custom domain and
-`DESKTOP_UPDATE_BASE_URL` identical. Build signed artifacts on each native
-platform and publish artifacts before mutable channel metadata.
-
-For storage, generate `apps/assets-private-proxy` plus `cloudflare/r2-cors.template.json` and keep the R2 bucket private. The Worker must be named `assets-private-proxy`, bind the normalized `<project>-assets` bucket as `ASSETS`, disable `workers.dev`, and own `assets.<domain>` as a Worker Custom Domain. Presigned uploads continue on the R2 S3 API hostname. Root every key below `R2_PREFIX=storage`; expose only `storage/confirmed/` through the Worker and reject staging plus `generation-inputs`. Authenticated private reads must verify upload ownership and return a presigned GET URL bounded by `R2_PROXY_READ_URL_TTL_SECONDS`.
-
-When explaining domains, distinguish DNS delegation from registrar transfer. A GoDaddy registration can use Cloudflare authoritative nameservers immediately; transferring registration/billing to Cloudflare Registrar is optional and subject to eligibility locks. Keep Vercel app/API A or CNAME records DNS-only in Cloudflare, while Worker Custom Domains stay Cloudflare-managed and proxied.
-
-## Verify outcomes
-
-After generation or repair, run the strongest practical checks:
-
-```sh
-pnpm typecheck
-pnpm verify
-pnpm build
-```
-
-Use `pnpm --filter ./apps/api test` when the API exists. If verification fails, report the exact package and command rather than replacing generated ownership records manually.
-
-For exact representative trees, consult `docs/output-tree-contract.md` in the Anhedral repository. During manual construction, also compare the finished workspace with the file matrix in [docs/references/manual-scaffolding.md](docs/references/manual-scaffolding.md); every selected conditional file must exist and every unselected provider integration must be absent.

package/assets/images/svg/ably-symbol-color.svg

@@ -1,8 +0,0 @@
-<svg width="78" height="64" viewBox="0 0 78 64" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M38.5717 0L6.29575 59.0738L0 54.6586L29.8639 0H38.5717ZM39.0214 0L71.2973 59.0738L77.5931 54.6586L47.7292 0H39.0214Z" fill="url(#ably-symbol-a)"/>
-<path d="M70.8477 59.4213L38.7966 34.3201L6.74548 59.4213L13.2865 64L38.7966 44.0294L64.3066 64L70.8477 59.4213Z" fill="url(#ably-symbol-b)"/>
-<defs>
-<linearGradient id="ably-symbol-a" x1="10.9472" y1="74.8439" x2="64.9206" y2="14.9005" gradientUnits="userSpaceOnUse"><stop stop-color="#FF5416"/><stop offset="0.461" stop-color="#FF4712"/><stop offset="1" stop-color="#FF0000"/></linearGradient>
-<linearGradient id="ably-symbol-b" x1="21.4169" y1="78.7187" x2="53.3166" y2="43.2904" gradientUnits="userSpaceOnUse"><stop stop-color="#FF5416"/><stop offset="0.461" stop-color="#FF4712"/><stop offset="1" stop-color="#FF0000"/></linearGradient>
-</defs>
-</svg>

package/bin/anhedral.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import '../dist/bin.js';