anhedral 0.4.2 → 0.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "anhedral",
-  "version": "0.4.2",
-  "description": "Generate a complete, readable TypeScript product stack with Next.js, Expo, Fastify, Neon, Drizzle, Clerk, R2, Electron updates, WXT, and Vercel.",
+  "version": "0.6.0",
+  "description": "Initialize client-owned applications with shadcn, pnpm, Turborepo, and Cloudflare-first services.",
   "type": "module",
   "exports": {
     ".": {
@@ -12,30 +12,18 @@
   "types": "./dist/index.d.ts",
   "sideEffects": false,
   "bin": {
-    "anhedral": "bin/anhedral.js"
+    "anhedral": "dist/bin.js"
   },
   "files": [
-    "bin",
     "dist",
-    "docs/conventions.md",
-    "docs/engineering-principles.md",
     "assets/anhedral-cli-init.svg",
-    "assets/images/svg/ably-symbol-color.svg",
+    "assets/anhedral-cli-init-technical.svg",
     "assets/images/svg/logo-white-subtract.svg",
-    "docs/master-stack-map.md",
-    "docs/NORTHSTAR.md",
-    "docs/output-tree-contract.md",
-    "docs/references",
-    "scripts/render-master-stack-map.mjs",
-    "templates",
-    "SKILL.md",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
     "LICENSE",
     "README.md",
-    "SECURITY.md",
     "anhedral.svg",
-    "favicon.ico"
+    "favicon.ico",
+    "docs/application-stack-standard.md"
   ],
   "homepage": "https://github.com/anhedral/anhedral-init#readme",
   "repository": {
@@ -55,7 +43,7 @@
   "scripts": {
     "scaffold": "node dist/bin.js init",
     "clean": "node scripts/clean.mjs",
-    "build": "pnpm clean && tsc",
+    "build": "pnpm clean && tsc && node scripts/prepare-cli.mjs",
     "prepare": "pnpm build",
     "typecheck": "tsc --noEmit",
     "check:hygiene": "node scripts/check-source-hygiene.mjs",
@@ -63,56 +51,51 @@
     "check:release-policy": "node scripts/check-release-policy.mjs",
     "check:release-secrets": "node scripts/check-release-secrets.mjs",
     "lint": "pnpm typecheck && pnpm check:hygiene && pnpm check:release-policy",
-    "audit:osv": "pnpm build && node scripts/audit-osv.mjs --generator",
-    "test": "pnpm test:cli",
-    "test:coverage": "pnpm build && c8 --all --include='dist/**/*.js' --reporter=text --reporter=json-summary --check-coverage --lines 84 --statements 84 --functions 84 --branches 80 node tests/test-cli.js",
+    "audit:osv": "node scripts/audit-osv.mjs",
+    "test": "pnpm test:unit",
     "pretest": "pnpm build",
     "prepublishOnly": "pnpm test:all",
-    "test:cli": "node tests/test-cli.js",
-    "test:cli:validation": "node tests/test-cli-validation.js",
-    "test:deps": "pnpm build && node tests/test-dependency-manifest.js",
-    "test:vercel-schema": "pnpm build && node tests/test-vercel-services-schema.js",
+    "test:cli:validation": "node --test tests/test-cli-validation.test.mjs",
     "test:pack": "pnpm build && node tests/test-packed-cli.js",
-    "test:pack:exact": "node tests/test-packed-cli.js release-artifact/metadata.json",
+    "test:pack:exact": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
     "test:packlist": "pnpm build && node tests/test-packlist.js",
-    "test:release-tooling": "node tests/test-release-tooling.js",
-    "test:topologies": "pnpm build && node tests/test-module-topology-invariants.js",
-    "test:templates": "pnpm build && node tests/test-template-source.js",
-    "pretest:e2e": "pnpm build",
-    "test:e2e": "node tests/test-e2e-public-stacks.js",
-    "pretest:e2e:latest": "pnpm build",
-    "test:e2e:latest": "node tests/test-e2e-public-stacks.js --toolchain latest",
-    "test:acceptance:desktop": "pnpm build && node tests/test-runtime-acceptance.js desktop",
-    "test:acceptance:extension": "pnpm build && node tests/test-runtime-acceptance.js extension",
-    "test:acceptance:mobile": "pnpm build && node tests/test-runtime-acceptance.js mobile",
-    "test:all": "pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:coverage && pnpm test:deps && pnpm test:templates && pnpm test:vercel-schema && pnpm test:pack && pnpm test:packlist && pnpm test:e2e",
-    "release:check": "pnpm check:release-policy && pnpm test:all && npm pack --dry-run --ignore-scripts",
-    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs release-artifact/metadata.json",
-    "release:artifact:verify": "node scripts/verify-release-artifact.mjs release-artifact/metadata.json && node scripts/check-release-secrets.mjs release-artifact/metadata.json",
-    "release:artifact:smoke": "node tests/test-packed-cli.js release-artifact/metadata.json",
-    "demo:refresh": "pnpm build && node tests/refresh-demo.js",
-    "docs:stack-map": "node scripts/render-master-stack-map.mjs"
+    "test:release-tooling": "node tests/test-release-tooling.test.mjs",
+    "test:all": "pnpm build && pnpm lint && pnpm check:security && pnpm audit:osv && pnpm test:unit && node tests/test-packed-cli.js && node tests/test-packlist.js",
+    "release:check": "pnpm test:all",
+    "release:pack": "pnpm build && node scripts/create-release-artifact.mjs && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:artifact:verify": "node scripts/verify-release-artifact.mjs .artifacts/release/metadata.json && node scripts/check-release-secrets.mjs .artifacts/release/metadata.json",
+    "release:artifact:smoke": "node tests/test-packed-cli.js .artifacts/release/metadata.json",
+    "docs:stack-map": "node scripts/render-master-stack-map.mjs",
+    "docs:technical-stack-map": "node scripts/render-master-stack-map.mjs --technical",
+    "docs:stack-maps": "pnpm docs:stack-map && pnpm docs:technical-stack-map",
+    "test:standard": "pnpm build && node --test tests/test-standard.test.mjs",
+    "test:unit": "node --test --test-concurrency=4 --test-reporter=spec tests/*.test.mjs"
   },
   "keywords": [
     "cli",
     "scaffold",
     "typescript",
     "nextjs",
-    "fastify",
+    "hono",
+    "cloudflare",
+    "opennext",
     "expo",
     "electron",
-    "clerk",
-    "drizzle",
-    "neondb",
-    "revenuecat",
     "wxt",
-    "vercel"
+    "neon",
+    "drizzle",
+    "shadcn",
+    "turborepo"
   ],
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.34.5",
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@<=5.0.7": "5.0.8"
+    }
+  },
   "devDependencies": {
     "@types/node": "20.19.43",
-    "c8": "11.0.0",
     "simple-icons": "16.27.0",
     "typescript": "5.9.3"
   }

package/CHANGELOG.md

@@ -1,178 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## Unreleased
-
-## 0.4.2 - 2026-07-23
-
-### Added
-
-- Add idempotent `pnpm first-run` setup plus a secret-safe `pnpm ready` gate with
-  human and JSON output, required/optional variable awareness, and truthful exit
-  status.
-- Generate a working items feature across Drizzle, Zod contracts, Fastify
-  routes, the shared API client, and idiomatic Next.js, Expo, Electron, and WXT
-  interfaces for every selected client.
-- Add explicit `--all`, automatic Git initialization for `new`, dependency-resolution previews, confirmation, exact generated lifecycle scripts, UI-provider command previews, and actionable `doctor` recommendations.
-- Add a published DX north star that defines measurable discovery, creation,
-  configuration, development, extension, diagnosis, upgrade, and shipping
-  journeys.
-
-### Changed
-
-- Default interactive creation to a focused web app with optional capabilities while preserving the complete-stack default for noninteractive compatibility.
-- Replace deprecated Turborepo development commands, make cache outputs package-specific, and let typechecks depend on upstream typechecks instead of builds.
-- Track bundled UI primitives in the project manifest and make generated onboarding, deployment, provider, and source-location guidance selection-aware.
-- Include status, generator version, project root, resolved modules, and next
-  steps in machine-readable plans; make human lifecycle output concise unless a
-  dry-run or verbose path listing is requested.
-
-### Fixed
-
-- Allow Next.js client API factories to render safely during production prerendering while preserving HTTPS enforcement for non-loopback production endpoints.
-- Make generated lifecycle commands reproducible even though Anhedral is intentionally not installed in application dependencies.
-- Forward arguments through generated pnpm lifecycle scripts without inserting a literal `--` that the Anhedral or provider CLI would reject.
-- Treat generated Clerk placeholder keys as unconfigured on every client instead
-  of mounting providers with knowingly invalid values.
-- Keep Electron starter features synchronized with Clerk sign-in changes instead
-  of treating an opened account dialog as an authenticated session.
-- Put reviewed database migration generation, Git staging, verification, and
-  application in one consistent onboarding order.
-- Detect required environment variables that were deleted from an existing
-  package-local configuration file.
-
-### Security
-
-- Scope generated starter-item reads and writes to the authenticated Clerk user
-  whenever authentication is selected.
-- Reject local home-directory paths and email addresses in source and packed
-  release artifacts while continuing to allow documentation placeholders and
-  public GitHub noreply contributor identities.
-
-## 0.4.1 - 2026-07-22
-
-### Added
-
-- Add the public launch artwork, reusable stack-map renderer, and expanded brand asset library to the repository and published package.
-
-### Changed
-
-- Present Anhedral as a cross-platform, modular product stack that lets teams build once, ship everywhere, and scale without repeating framework setup.
-- Automatically create patch versions for ordinary changes merged to `main`, while preserving explicitly declared minor and major releases.
-- Keep project upgrades compatible across automatic patch releases and retain the supported 0.3-to-0.4 ownership migration.
-- Publish from the exact generated release commit and attach npm provenance now that the source repository is public.
-
-## 0.4.0 - 2026-07-22
-
-### Added
-
-- Add the `electron-updater` feature module, including packaged-app update checks, private R2 storage, a read-only bound Cloudflare Worker on a custom domain, ordered architecture-specific publishing commands, and a complete generated release runbook.
-- Make the `anhedral-init` coding-agent skill the recommended setup path, with project/domain intake, Computer Use and subagent orchestration, provider provisioning order, authentication and secret-generation stops, and verified Cloudflare/Vercel domain handoffs.
-- Add the canonical fixed-width master stack map to the published documentation and route the coding-agent skill through it for whole-platform planning and explanation.
-- Add a transactional project-upgrade path so compatible 0.3 projects can adopt 0.4 without regeneration.
-- Add a focused default development loop for the primary web and API surfaces, with `dev:all` available for intentionally launching every selected client.
-
-### Changed
-
-- Make generated onboarding follow the real environment, managed-Neon, verification, and framework source layout instead of promising an unconfigured one-command boot.
-- Treat developer extension points as user-owned source while retaining conflict protection for generated wiring and mergeable workspace configuration.
-- Publish the skill's provisioning references from their canonical `docs/references` location and validate every packed local documentation link.
-- Upgrade GitHub artifact transfer actions to their Node.js 24-native releases and keep manual npm publication routed through the trusted-publisher workflow identity.
-
-### Fixed
-
-- Canonicalize module ordering when an incremental feature contributes a previously absent dependency.
-- Attach release integrity metadata beside the npm tarball in GitHub Releases.
-
-## 0.3.0 - 2026-07-21
-
-### Added
-
-- Add a unified `anhedral ui add` workflow that routes DOM clients to shadcn/ui and Expo clients to React Native Reusables.
-- Add interactive starter-component selection after app surfaces and feature sets, with NativeWind or Uniwind selection for Expo.
-- Add React Native Reusables-ready Expo configuration, theme CSS, aliases, utilities, Metro integration, and portal hosting.
-- Add manifest schema v5 UI configuration and per-client component installation records.
-- Add staged provider execution, dry-run plans, duplicate-install detection, target validation, and provider routing tests.
-- Add `anhedral new <directory>` as the primary complete-stack creation flow while retaining `init` for an empty current directory.
-- Generate selection-aware `README.md`, `docs/DEVELOPMENT.md`, `docs/STACK.md`, and `SKILL.md` guidance that maps product tasks to ordinary framework source.
-- Publish the repository skill, manual scaffolding reference, conventions, and output-tree contract with the npm package.
-
-### Changed
-
-- Pin the component installer to shadcn 4.13.0 and run all provider mutations inside Anhedral transaction staging.
-- Preserve Anhedral's exact Expo SDK dependency while resolving React Native Reusables registry dependencies before the root workspace install.
-- Present Anhedral as a readable TypeScript stack generator with native Next.js, Expo, Fastify, Drizzle, Electron, and WXT conventions rather than a proprietary application runtime.
-- Use argument-vector process execution for workspace installation instead of invoking a command through a shell.
-- Remove the retired one-app compiler experiment from the production CLI and package surface.
-
-### Security
-
-- Reject symbolic-link scaffold roots before creating transaction metadata or modifying their targets.
-- Override vulnerable `shell-quote` and `sharp` dependency ranges in generated workspaces.
-
-## 0.2.1 - 2026-07-16
-
-### Added
-
-- Add integrity-checked bundled framework substrates, typed module contributions, deterministic root composers, and manifest schema v4 template provenance.
-- Add template tamper, symbolic-link, package-content, and contribution-composition regression tests.
-- Add exact-artifact portability checks at the minimum Node.js 20 and 22 releases and the pinned Node.js 24 release on macOS and Windows.
-- Add scheduled and release-gated Electron, WXT, and Expo native runtime acceptance lanes.
-- Add deterministic workflow, Renovate extraction, release declaration, registry recovery, and module-topology policy tests.
-
-### Security
-
-- Reject altered template catalogs, mismatched substrate digests, symbolic links, forbidden generated artifacts, and oversized template trees before transactional commit.
-- Scan all tracked text, built output, and final package tarballs for high-confidence secret formats before publication.
-- Clarify that public package availability grants no installation, execution, or generated-output rights without a separate written agreement.
-
-## 0.2.0 - 2026-07-15
-
-### Added
-
-- Add manifest schema v3 with deterministic module dependency resolution, file ownership, hashes, modes, and an explicit toolchain channel.
-- Add transactional `init` and `add` operations with locking, journaling, rollback, dry-run plans, and JSON output.
-- Add the `anhedral doctor` command.
-- Add deterministic output-tree contracts for representative scaffold combinations.
-
-### Changed
-
-- Generate only the dependencies, source files, environment keys, apps, and shared packages required by selected modules.
-- Align Vercel Services output with the current `services` schema and mount Fastify routes under the preserved `/api` path.
-- Refresh the verified Next.js, Expo, Clerk, Electron, WXT, Vite, and RevenueCat integration matrix.
-- Separate the side-effect-free package API from the executable CLI entry point.
-- Preserve user-owned documentation, workflows, package fields, and mergeable root configuration during incremental adds.
-- Build from a clean `dist/` directory before tests and packaging.
-- Publish one verified tarball and compare its integrity with npm before tagging.
-- Pin the release Node.js/npm packer so recovery rebuilds remain reproducible.
-- Install the exact release artifact and run its `.bin/anhedral` shim in package smoke tests.
-- Enforce an explicit npm package allowlist and artifact size policy.
-- Test the CLI on Node.js 20, 22, and 24 in CI.
-- Wire Clerk controls and token-aware API helpers into web and mobile templates, and make the desktop account action open Clerk sign-in or profile UI.
-- Bootstrap RevenueCat only for `native-subscriptions`, connect native purchases to the authenticated user, and expose a native paywall action.
-- Put pnpm overrides, build permissions, and peer policy in `pnpm-workspace.yaml`, with conflict-safe structural merges.
-- Keep public API GET requests simple by omitting unused platform and content-type headers.
-- Remove unused provider dependencies and environment placeholders from generated clients.
-- Wire Tailwind CSS v4 into generated web and desktop builds, including semantic shadcn color tokens.
-- Keep canonical module IDs and valid RFC 3986 URI schemes in generated project metadata and documentation.
-- Refresh generator-owned Node.js and pnpm policy during incremental adds when the recorded package manifest is unmodified.
-
-### Removed
-
-- Remove pre-schema-v3 manifest migration, generated-layout adoption, deprecated module aliases, and duplicate `stack.json` output. Projects must be generated with the current CLI and use canonical module IDs.
-
-### Security
-
-- Reject modified managed files and unowned path collisions before committing incremental changes.
-- Validate recovery journals, reject symlink traversal, and persist transaction intent before moving files.
-- Audit every locked CLI dependency through OSV after pnpm's retired audit endpoint became unavailable.
-- Make RevenueCat webhook processing fail closed and persist idempotency records when billing is selected.
-- Scope npm credentials to the single publish step in the protected release job.
-- Separate read-only release verification from npm publication and Git tag creation.
-- Pin GitHub Actions to verified upstream commit SHAs.
-- Default Fastify proxy trust to off, require an explicit bounded trusted-hop count, and minimize conditional Chrome permissions.
-- Reconcile exact package versions against detailed OSV advisory ranges when the batch index is over-broad.
-- Reject manifest-recorded directories and other non-regular paths during project health checks.

package/CONTRIBUTING.md

@@ -1,77 +0,0 @@
-# Contributing
-
-Changes should follow the repository's
-[engineering principles](docs/engineering-principles.md): explicit behavior,
-one source of truth, narrow namespaces, visible failures, and focused tests.
-
-## Local setup
-
-Anhedral requires Node.js 20.19+ or 22.12+ and pnpm 10.34.5.
-
-```sh
-pnpm install --frozen-lockfile
-pnpm build
-pnpm lint
-pnpm check:security
-pnpm check:release-policy
-pnpm audit:osv
-pnpm test
-```
-
-## Before opening a pull request
-
-Run the checks relevant to the files you changed:
-
-```sh
-pnpm typecheck
-pnpm test
-pnpm test:pack
-pnpm test:packlist
-pnpm test:release-tooling
-```
-
-Changes to generated templates or dependency pins should also run:
-
-```sh
-pnpm test:deps
-pnpm test:e2e
-```
-
-The E2E test installs upstream packages in a disposable operating-system temp directory, so it requires network access and may take several minutes. It removes the workspace in a `finally` block; set `ANHEDRAL_E2E_KEEP=1` only when you intentionally need to inspect a failed or completed run.
-
-After an intentional scaffold-output change, regenerate and review the path/mode/SHA-256 contracts and generated tree documentation:
-
-```sh
-pnpm build
-node tests/update-output-tree-contracts.js
-```
-
-## Package changes
-
-- Keep the public package allowlist narrow.
-- Do not commit `dist/`, tarballs, `release-artifact/`, or temporary E2E/demo workspaces.
-- Add or update a regression test for CLI behavior and generated configuration changes.
-- Keep stable toolchain commands pinned; mutable upstream versions belong only in the `latest` lane.
-- Run the OSV audit against a newly installed representative generated lockfile when changing framework or runtime pins.
-
-## Ownership and required review
-
-Repository administrators must map the following roles to real maintainers in branch protection, the protected `npm` environment, private vulnerability reporting, and workflow-failure notifications:
-
-- **Generator owner:** core architecture, transactions, manifests, and generated-file ownership.
-- **Runtime owner:** application templates, provider integrations, and the stable dependency manifest.
-- **Release owner:** package metadata, CI workflows, registry publication, tags, and recovery.
-- **Security responder:** vulnerability intake, secret-exposure response, and supply-chain incidents.
-
-No `CODEOWNERS` file is committed until an actual GitHub user or team slug is selected. A placeholder would create false confidence without enforcing review. Require at least one appropriate owner review for generator/runtime changes and a release-owner review for `.github/workflows/`, `scripts/`, `package.json`, `renovate.json`, `SECURITY.md`, or `docs/RELEASING.md`.
-
-Scheduled Toolchain Drift failures and release-workflow failures must alert the release owner. Security-policy, secret-scan, or OSV failures must additionally alert the security responder. Configure those routes in repository notification settings and test them after changing ownership.
-
-## Releases
-
-Do not run `npm publish` from a development checkout. Version changes are reviewed before release, and CI publishes the verified tarball. See [docs/RELEASING.md](docs/RELEASING.md).
-
-This repository and package are licensed under the Apache License 2.0. Unless
-explicitly stated otherwise, contributions intentionally submitted for
-inclusion in Anhedral are provided under the same license, as described in
-Section 5 of [LICENSE](LICENSE).

package/SECURITY.md

@@ -1,37 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes are made on the current development branch and released as a new npm version. Consumers should use the latest version published under the `latest` dist-tag.
-
-## Reporting a vulnerability
-
-Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting or security-advisory flow for this repository. If repository access is unavailable, contact the package maintainers through the owner information on the [anhedral npm package](https://www.npmjs.com/package/anhedral).
-
-Include the affected version, reproduction steps, impact, and any suggested mitigation. Please avoid accessing data that is not yours and allow maintainers time to investigate before public disclosure.
-
-## Supply-chain policy
-
-- Release artifacts are built and tested in a read-only job.
-- The exact tarball uploaded by CI is the artifact submitted to npm.
-- npm integrity is checked before and after publication.
-- npm publication uses Trusted Publishing: GitHub exchanges an OIDC identity for a short-lived credential only in the publish step of the protected `npm` environment. No npm write token is stored in GitHub.
-- A Git tag and GitHub release are created only after npm confirms the expected artifact integrity.
-- GitHub Actions are pinned to reviewed commit SHAs, and the release Node.js/npm packer is pinned to an exact version.
-- CI queries OSV for every exact package version in `pnpm-lock.yaml` and every dependency version shipped by the generator; it fails closed if the service remains unavailable after bounded retries or reports a finding.
-- Local policy scans every tracked or non-ignored working-tree text file and built `dist/` file for high-confidence credential formats. Release jobs repeat the scan against the exact gzip tarball before it crosses the publish boundary. Placeholder examples use explicit non-secret values rather than allowlisting token-shaped strings.
-- Release declarations must be valid Semantic Versioning and have a matching `CHANGELOG.md` section. Local deterministic checks validate workflow policy and confirm every Renovate custom manager still extracts a maintained pin.
-
-Generated projects pin their stable dependency manifest, explicitly allow only required dependency build scripts, and record the selected toolchain channel in `anhedral.json`. The `latest` channel is for upstream-drift testing and is not the reproducible default.
-
-Incremental generation rejects path traversal, symbolic-link targets, unowned collisions, modified managed files, and managed-file permission drift. Transaction journals are validated before recovery, fsynced before filesystem moves, and advanced only around durable rename barriers where the host filesystem supports directory synchronization.
-
-UI component installation is an explicit networked supply-chain operation. Anhedral pins the shadcn installer version, routes Expo only to the official HTTPS React Native Reusables registry, validates component names and target paths, and runs provider mutation inside transaction staging. Provider-generated files and dependency manifests must pass ownership checks before commit. Users should review `--dry-run` output and the resulting source diff; registry content is upstream-maintained and is not part of Anhedral's immutable bundled-template catalog.
-
-## Secret response
-
-If a secret-shaped finding is real, do not merely remove it from the latest commit. Revoke or rotate the credential first, identify every log, artifact, cache, fork, and package version that may contain it, and coordinate history or artifact cleanup with the security responder. Treat false positives by changing the example to an unmistakable placeholder; do not add broad path exclusions.
-
-Anhedral is licensed under the Apache License 2.0. Security research must still
-comply with applicable law and the systems owner's authorization; the software
-license does not authorize testing infrastructure or accounts you do not own.