anhedral 0.6.0 → 0.6.1

package/README.md

@@ -1,5 +1,9 @@
 # Anhedral
 
+[![CI](https://github.com/anhedral/anhedral-init/actions/workflows/ci.yml/badge.svg)](https://github.com/anhedral/anhedral-init/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/anhedral)](https://www.npmjs.com/package/anhedral)
+[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
+
 Initialize client-owned applications using the [Anhedral Application Stack & Delivery Standard](docs/application-stack-standard.md).
 
 Every new project starts from the official **shadcn pnpm/Turborepo monorepo**. The default creates **Next.js + React + TypeScript + Tailwind + shadcn/ui**, hosted on **Cloudflare Workers through OpenNext**. Select additional apps and services only when needed.
@@ -33,12 +37,18 @@ Provider packages and services are **starters**, not finished product features.
 
 The CLI supports `new`, `init`, `--help`, and `--version`. Use `anhedral --help` for options.
 
+Requires Node.js 20.19+ in the 20 series or 22.12+ and pnpm 10.34.5. Version 0.6 replaces the legacy generator and builder with the Cloudflare-first initializer; earlier generator commands and templates are retired. Existing applications are not automatically migrated. Pin a CLI version for reproducible initialization and review upgrades before use.
+
+## Contributing and security
+
+Anhedral is maintainer-led, with a small contribution surface. Focused bug fixes, tests, and documentation corrections are welcome; discuss larger changes before implementation. See [contributing](https://github.com/anhedral/anhedral-init/blob/main/.github/CONTRIBUTING.md), the [code of conduct](https://github.com/anhedral/anhedral-init/blob/main/.github/CODE_OF_CONDUCT.md), and [security reporting](https://github.com/anhedral/anhedral-init/blob/main/.github/SECURITY.md). Use [issues](https://github.com/anhedral/anhedral-init/issues) for reproducible CLI problems and [private reporting](https://github.com/anhedral/anhedral-init/security/advisories/new) for vulnerabilities.
+
 ## Workspace layout
 
 ```text
 demo/
 ├── anhedral-factory/        Factory application and service workspaces
-└── default-stack-demo/      Preserved, tested default stack snapshot
+└── default-stack-demo/      Default stack snapshot with security maintenance
 
 src/                        Current initializer implementation
 dist/                       Generated JavaScript + declarations
@@ -53,4 +63,4 @@ pnpm --dir demo/anhedral-factory dev
 pnpm --dir demo/anhedral-factory check
 ```
 
-Anhedral is open source under the [Apache License 2.0](LICENSE). Generated applications remain ordinary project source that their developers can customize and license for their products.
+Anhedral is open source under the [Apache License 2.0](LICENSE). Generated applications remain ordinary project source that their developers can customize and license for their products. Preserve applicable license notices for upstream code and dependencies.

package/dist/dependencies.js

@@ -21,7 +21,7 @@ export const DESKTOP_DEPENDENCIES = {
         // renovate: datasource=npm depName=@types/react-dom
         "@types/react-dom": '19.2.3',
         // renovate: datasource=npm depName=electron
-        "electron": '43.1.1',
+        "electron": '43.7.8',
         // renovate: datasource=npm depName=electron-builder
         "electron-builder": '26.15.3',
         // renovate: datasource=npm depName=electron-builder-squirrel-windows
@@ -29,7 +29,7 @@ export const DESKTOP_DEPENDENCIES = {
         // renovate: datasource=npm depName=tailwindcss
         "tailwindcss": '4.1.18',
         // renovate: datasource=npm depName=postcss
-        "postcss": '8.5.19',
+        "postcss": '8.5.23',
         // renovate: datasource=npm depName=typescript
         "typescript": '5.9.3',
         // renovate: datasource=npm depName=vite
@@ -59,7 +59,7 @@ export const EXTENSION_DEPENDENCIES = {
         // renovate: datasource=npm depName=autoprefixer
         "autoprefixer": '10.4.23',
         // renovate: datasource=npm depName=postcss
-        "postcss": '8.5.19',
+        "postcss": '8.5.23',
         // renovate: datasource=npm depName=tailwindcss
         "tailwindcss": '3.4.19',
         // renovate: datasource=npm depName=typescript

package/dist/standard.js

@@ -149,6 +149,10 @@ function cleanShadcnStarter(root) {
             if (!sources.some((source) => source.includes('@turbo/gen')) && !Object.values(manifest.scripts ?? {}).some((script) => String(script).includes('turbo gen')))
                 delete manifest.devDependencies?.['@turbo/gen'];
             manifest.devDependencies = { ...manifest.devDependencies, 'postcss-load-config': '^6.0.1' };
+            if (manifest.dependencies?.shadcn) {
+                manifest.devDependencies.shadcn = manifest.dependencies.shadcn;
+                delete manifest.dependencies.shadcn;
+            }
         }
         json(root, manifestPath, manifest);
     }
@@ -230,7 +234,7 @@ export function createDatabase(connectionString: string) {
 ` : `import { drizzle } from 'drizzle-orm/d1';
 import * as schema from './schema.js';
 export function createDatabase(binding: Parameters<typeof drizzle>[0]) { return drizzle(binding, { schema }); }
-`, { 'drizzle-orm': '^0.44.0', ...(has('neon') ? { postgres: '^3.4.0' } : {}) });
+`, { 'drizzle-orm': '^0.45.3', ...(has('neon') ? { postgres: '^3.4.0' } : {}) });
         put(root, 'packages/db/src/schema.ts', '// Define product tables here; generate and review SQL before migration.\nexport {};\n');
         put(root, 'packages/db/drizzle.config.ts', has('neon') ? `import { defineConfig } from 'drizzle-kit';
 export default defineConfig({ dialect: 'postgresql', schema: './src/schema.ts', out: './migrations', dbCredentials: { url: process.env.DATABASE_URL! } });
@@ -270,7 +274,7 @@ async function handler(request: Request) {
 export { handler as GET, handler as POST };
 `);
             put(root, 'apps/web/cloudflare-env.d.ts', `interface CloudflareEnv { ${has('neon') ? 'HYPERDRIVE: { connectionString: string };' : "DB: Parameters<typeof import('drizzle-orm/d1').drizzle>[0];"} }\n`);
-            patchPackage(root, 'apps/web/package.json', { dependencies: { 'drizzle-orm': '^0.44.0' } });
+            patchPackage(root, 'apps/web/package.json', { dependencies: { 'drizzle-orm': '^0.45.3' } });
         }
         put(root, `apps/${runtimeApp}/.dev.vars.example`, 'BETTER_AUTH_SECRET=\nBETTER_AUTH_URL=http://localhost:8787\n');
         if (has('hono'))
@@ -402,10 +406,23 @@ export async function recordEvents(stream: EventStream, events: Record<string, u
 function writeStandardRoot(root, options) {
     const has = (value) => options.products.includes(value);
     const existing = readJson(root, 'package.json');
+    const securityOverrides = {
+        "sharp@<0.35.5": "0.35.5",
+        "source-map-js@<1.2.2": "1.2.2",
+        "baseline-browser-mapping@<2.11.0": "2.11.27",
+        "browserslist@<4.28.7": "4.29.3",
+        "esbuild@<0.25.0": "0.25.12",
+        "brace-expansion@<2": "1.1.21",
+        "brace-expansion@>=2 <3": "2.1.7",
+        "brace-expansion@>=3 <4": "3.0.9",
+        "brace-expansion@>=4 <5.0.12": "5.0.12"
+    };
     patchPackage(root, 'package.json', { name: options.name, packageManager: PACKAGE_MANAGER, engines: { node: '>=22.13.0' },
         scripts: { dev: 'turbo dev', build: 'turbo build', lint: 'turbo lint', typecheck: 'turbo typecheck',
-            test: 'turbo test', audit: 'node scripts/audit.mjs', 'audit:full': 'fallow --fail-on-issues', check: 'pnpm lint && pnpm typecheck && pnpm run audit && pnpm test && pnpm build' },
-        devDependencies: { fallow: '^3.31.0' } });
+            test: 'turbo test', audit: 'node scripts/audit.mjs', 'audit:full': 'fallow --fail-on-issues', 'audit:deps': 'pnpm audit --prod --audit-level high', check: 'pnpm lint && pnpm typecheck && pnpm run audit && pnpm audit:deps && pnpm test && pnpm build' },
+        devDependencies: { fallow: '^3.31.0' },
+        // Upstream starter lockfiles can retain vulnerable transitive versions. Keep fixes within compatible majors.
+        pnpm: { ...existing.pnpm, overrides: { ...existing.pnpm?.overrides, ...securityOverrides } } });
     put(root, 'scripts/audit.mjs', `import { spawnSync } from 'node:child_process';
 const base = process.env.AUDIT_BASE;
 const hasBase = base || ['origin/main', 'main'].find((ref) => spawnSync('git', ['rev-parse', '--verify', ref], { stdio: 'ignore' }).status === 0);
@@ -414,7 +431,7 @@ const result = spawnSync('pnpm', args, { stdio: 'inherit', shell: false });
 if (result.error) throw result.error;
 process.exitCode = result.status ?? 1;
 `);
-    json(root, '.fallowrc.json', { ignorePatterns: ['**/.next/**', '**/.open-next/**', '**/.wrangler/**', '**/dist/**', '**/worker-configuration.d.ts', '**/cloudflare-env.d.ts'] });
+    json(root, '.fallowrc.json', { ignorePatterns: ['**/next-env.d.ts', '**/.next/**', '**/.open-next/**', '**/.wrangler/**', '**/dist/**', '**/worker-configuration.d.ts', '**/cloudflare-env.d.ts'] });
     const turbo = readJson(root, 'turbo.json');
     turbo.globalEnv = ['DATABASE_URL', 'NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY', 'CLERK_SECRET_KEY', 'BETTER_AUTH_SECRET', 'BETTER_AUTH_URL', 'OPENAI_API_KEY', 'RESEND_API_KEY', 'STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET', 'POSTHOG_API_KEY', 'POSTHOG_HOST', 'SENTRY_DSN'];
     turbo.tasks = { ...turbo.tasks, test: { dependsOn: ['^build'], outputs: ['coverage/**'] },
@@ -496,7 +513,7 @@ jobs:
           node-version: '22'
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm lint && pnpm typecheck
+      - run: pnpm lint && pnpm typecheck && pnpm audit:deps
       - name: Audit pull request
         if: github.event_name == 'pull_request'
         env:

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Kept in sync with package.json by tests/release checks. */
-export declare const GENERATOR_VERSION = "0.6.0";
+export declare const GENERATOR_VERSION = "0.6.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Kept in sync with package.json by tests/release checks. */
-export const GENERATOR_VERSION = '0.6.0';
+export const GENERATOR_VERSION = '0.6.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anhedral",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Initialize client-owned applications with shadcn, pnpm, Turborepo, and Cloudflare-first services.",
   "type": "module",
   "exports": {
@@ -89,11 +89,6 @@
   ],
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.34.5",
-  "pnpm": {
-    "overrides": {
-      "brace-expansion@<=5.0.7": "5.0.8"
-    }
-  },
   "devDependencies": {
     "@types/node": "20.19.43",
     "simple-icons": "16.27.0",