anhedral 0.8.4 → 0.8.6

package/README.md

@@ -8,9 +8,13 @@ Anhedral guides the development lifecycle through a ChatGPT/Codex plugin: planni
 
 The plugin source lives in `plugins/anhedral`. It guides recommended plugins, CLI tooling, client-owned accounts, infrastructure and scoped permissions for the selected stack. It uses available integrations and documented alternatives; installation does not grant provider access. Install the repository plugin with `codex plugin marketplace add anhedral/anhedral-init`, then `codex plugin add anhedral@anhedral`. Releases include a self-contained plugin ZIP with the same version as the CLI. A public ChatGPT directory listing requires separate submission.
 
-The plugin includes a native control panel with Overview, Infrastructure, Readiness, Delivery, and Settings. Open Anhedral from the plugin menu or ask it to open the control panel, then register an existing project folder. The self-contained Node MCP server reads configuration and checks supported Cloudflare resources, Neon project access, and GitHub Actions on refresh. Provider credentials stay server-side; selected environment identifiers are saved locally. Resource availability, local readiness, and released product behavior remain separate states. Local desktop plugins support this panel; a public ChatGPT directory app requires a separately hosted HTTPS MCP service and submission.
+The plugin includes a single architecture view. Describe an app to Codex; the agent chooses the needed stack, builds it and updates its components, connections and status through the control-panel tools. Select a component for evidence and details. Setup and lifecycle tracking stay behind the scenes. Existing projects are inspected rather than reinitialized.
 
-Every new project starts from the official **shadcn pnpm/Turborepo monorepo**. The default creates **Next.js + React + TypeScript + Tailwind + shadcn/ui**, hosted on **Cloudflare Workers through OpenNext**. Select additional apps and services only when needed.
+The self-contained Node MCP server saves plans locally and checks supported Cloudflare resources, Neon project access and GitHub Actions on refresh. Credential values stay server-side. Agent-recorded stack progress, configured bindings, provider availability and verified product behavior are distinct. A local preview copies agent requests instead of executing them; a host without the necessary tools needs those integrations connected. Local desktop plugins support this panel; a public ChatGPT directory app requires a separately hosted HTTPS MCP service and submission.
+
+`anhedral.progress.json` stores non-secret milestones, discovery observations, blockers and app links separately from generated requirements. Read it with `anhedral progress show <directory>`; report validated evidence with `anhedral progress report <directory> <report.json|->`. Plugin reports share this contract. Source/configuration changes, provider-scope changes and expired discovery require rechecking. Deployment and product tests remain separate outcomes.
+
+The default web recipe creates **Next.js + React + TypeScript + Tailwind + shadcn/ui**, hosted on **Cloudflare Workers through OpenNext**. Non-web recipes initialize their own foundations without an unrelated Next.js bootstrap. Choose applications and services for workload, compatibility, client constraints, operations, and cost; preserve suitable existing architecture.
 
 ![Anhedral CLI init stack](assets/anhedral-cli-init.svg)
 
@@ -19,6 +23,7 @@ pnpm dlx anhedral@latest new my-app
 pnpm dlx anhedral@latest new mobile-app --expo
 pnpm dlx anhedral@latest new product --next --expo --hono --neon --clerk --r2
 pnpm dlx anhedral@latest init --wxt
+pnpm dlx anhedral@latest new api --hono --layout single
 ```
 
 To use a local checkout, run `pnpm build`, then `node dist/bin.js new <directory>`.
@@ -27,23 +32,23 @@ Applications: `next`, `expo`, `electron`, `wxt`, `hono`.
 
 Optional capabilities: `neon`, `d1`, `local-data`, `clerk`, `better-auth`, `r2`, `kv`, `realtime`, `queues`, `cron`, `workflows`, `openai`, `ai-sdk`, `workers-ai`, `resend`, `stripe`, `revenuecat`, `sentry`, `basin`, `posthog`, `styling`.
 
-Hono provides an OpenAPI Worker when a shared API is selected. Web-only endpoints belong in Next.js route handlers; `apps/api` is never added automatically. Workers services live under `apps/*`, reusable code under `packages/*`. Mobile-only, desktop-only, extension-only and API-only selections remove the unused Next.js starter after the shadcn bootstrap.
+Hono provides an OpenAPI Worker when a shared API is selected. Web-only endpoints belong in Next.js route handlers; `apps/api` is never added automatically. Workspace recipes use `apps/*` for applications/services and `packages/*` for reusable code, with pnpm/Turborepo. `--layout single` provides a root Hono API without workspace orchestration; unsupported shared/platform combinations are rejected. WXT generates a side panel by default or a selected popup; other extension surfaces require targeted implementation.
 
-Choose either Neon + Drizzle + Hyperdrive or D1 + Drizzle. Authentication is optional; Clerk and Better Auth are mutually exclusive. Better Auth requires an explicit database selection. Stripe is the web billing choice; RevenueCat is an optional addition for cross-store entitlements. Private files use R2 Worker bindings; clients never receive R2 credentials.
+The generated database recipes are Neon + Drizzle + Hyperdrive or D1 + Drizzle; direct Neon serverless access is another project-specific integration choice. Authentication is optional; Clerk and Better Auth are mutually exclusive. Better Auth requires an explicit database selection. Stripe is the web billing choice; RevenueCat is an optional addition for cross-store entitlements. Private files use R2 Worker bindings; clients never receive R2 credentials.
 
-`--hosting=vercel` explicitly selects Vercel for Next.js. It requires project approval as an architecture exception. Vinext, GPUI/Rust, Containers and alternative source/CI platforms remain deliberate project adaptations rather than generated templates.
+`--hosting=vercel` explicitly selects Vercel for Next.js. Select hosting for compatibility, operations, and cost. Vinext, GPUI/Rust, Containers and alternative source/CI platforms remain deliberate project adaptations rather than generated templates.
 
-`--dry-run --json` prints a plan without writes or network calls. `--skip-install` skips the final workspace installation; the official shadcn bootstrap still needs network access and can install dependencies. Generation resolves and retains a workspace lockfile. Commit it with the source.
+`--dry-run --json` prints a plan without writes or network calls. `--skip-install` skips the final workspace installation; the pinned web bootstrap still needs network access and can install dependencies. Non-web foundations do not invoke shadcn. Generation resolves and retains a workspace lockfile. Commit it with the source.
 
-Generated projects include `dev`, `build`, `lint`, `typecheck`, `test`, `audit`, `audit:full`, and `check`, plus GitHub Actions PR checks. Fallow is part of the deterministic gate. Tests run in workspaces that define them; add meaningful product and integration tests as behavior is implemented.
+Generated projects include `dev`, `build`, `lint`, `typecheck`, `test`, `audit`, `audit:full`, and `check`, plus GitHub Actions PR checks. The pinned Fallow audit is part of the local gate; external integration and advisory checks remain time-sensitive evidence. Tests run in workspaces that define them; add meaningful product and integration tests as behavior is implemented.
 
-Provider packages and services are **starters**, not finished product features. Generated READMEs identify the remaining setup: resource IDs, migrations, product authorization, webhooks, native adapters and runtime SDK initialization. Initialization does not create cloud resources, activate billing, or deploy. Human approval is required for paid activation, material spending, architecture exceptions and production releases.
+Provider packages and services are **starters**, not finished product features. Generated READMEs identify the remaining setup: resource IDs, migrations, product authorization, webhooks, native adapters and runtime SDK initialization. Initialization does not create cloud resources, activate billing, or deploy. Honor existing authorization and the project budget; obtain missing authority for paid activation, material spending, broader access, terms, and production changes. A local-only development instruction does not authorize shipping.
 
-The CLI supports `new`, `init`, `doctor`, `--help`, and `--version`. `anhedral doctor <directory> --json` checks local setup requirements without writes; provider access and production readiness remain unverified. Use `anhedral --help` for options. Its JSON plan includes versioned setup requirements, and generated projects include `anhedral.setup.json`. Requirements do not imply that accounts or resources are configured. The CLI and plugin registry share one source in `src/capabilities.ts`; `pnpm build` refreshes the plugin's bundled registry and stack standard.
+The CLI supports `new`, `init`, `doctor`, `progress`, `--help`, and `--version`. `anhedral doctor <directory> --json` checks local setup requirements without writes; provider access and production readiness remain unverified. Use `anhedral --help` for options. Its JSON plan includes versioned setup requirements, and generated projects include `anhedral.setup.json`. Requirements do not imply that accounts or resources are configured. The CLI and plugin registry share one source in `src/capabilities.ts`; `pnpm build` refreshes the plugin's bundled registry and stack standard.
 
-Requires Node.js 20.19+ in the 20 series or 22.12+ and pnpm 10.34.5. Version 0.6 replaces the legacy generator and builder with the Cloudflare-first initializer; earlier generator commands and templates are retired. Existing applications are not automatically migrated. Pin the CLI version and commit the generated lockfile. The `shadcn@latest` bootstrap can change between generation dates; review upgrades before use.
+Requires Node.js 20.19+ in the 20 series or 22.12+ and pnpm 12.9.1. Version 0.6 replaces the legacy generator and builder with the Cloudflare-first initializer; earlier generator commands and templates are retired. Existing applications are not automatically migrated. Pin the CLI version and commit the generated lockfile. The web bootstrap pins `shadcn@4.21.3`; upstream templates/registries can still change. Review output and compatibility when upgrading generator inputs. Cloudflare currently recommends beta vinext, but this CLI retains its tested OpenNext recipe; no existing projects are automatically migrated.
 
-Initialize from Linux, macOS, or WSL. Native Windows initialization fails before writes because upstream shadcn currently resolves monorepo component paths outside the project; planning and `doctor` remain portable. Expo's release gate currently blocks unpatched `node-forge` and `braces` advisories in its CLI/Metro dependencies. Application releases require resolving or explicitly reviewing those risks; the initializer does not waive them.
+Initialize from Linux, macOS, or WSL. Web initialization on native Windows fails before writes because upstream shadcn resolves monorepo component paths outside the project; use WSL for that recipe. Other recipes have their own platform/build requirements; planning and `doctor` remain portable. Generated dependency checks retain the raw upstream audit and verify reviewed backports against exact installed bytes. Unremediated high/critical findings block delivery. Expo additionally requires native simulator/device flows and a signed native build.
 
 ## Contributing and security
 

package/assets/anhedral-cli-init-technical.svg

@@ -1,6 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1660" viewBox="0 0 1920 1660" role="img" aria-labelledby="title description">
 <title id="title">Anhedral Application service contracts</title>
-<desc id="description">Client-owned shadcn, pnpm and Turborepo monorepo. Next.js uses OpenNext on Cloudflare Workers; Hono and OpenAPI provide optional shared APIs. Select Neon with Drizzle and Hyperdrive or D1, authentication, private R2, KV, realtime, jobs, workflows, AI, email, billing, observability and analytics only when required. Dashed yellow lines show publication; white lines show application runtime and service bindings.</desc>
+<desc id="description">Client-owned, selected application recipes. A workspace is used for shared packages and multiple apps; a single API recipe is also supported. Next.js uses OpenNext on Cloudflare Workers; Hono and OpenAPI provide optional shared APIs. Select Neon with Drizzle and Hyperdrive or D1, authentication, private R2, KV, realtime, jobs, workflows, AI, email, billing, observability and analytics only when required. Dashed yellow lines show publication; white lines show application runtime and service bindings.</desc>
 <defs>
   <linearGradient id="card-fill" x1="0" y1="0" x2="1" y2="1">
     <stop offset="0" stop-color="#0d1b29"/>
@@ -30,7 +30,7 @@
 <text x="532" y="176" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="78" font-weight="700" text-anchor="start" letter-spacing="0">Stack</text>
 <path d="M 533 195 L 747 195" fill="none" stroke="#e9f600" stroke-width="6" stroke-linecap="round"/>
 <text x="34" y="240" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">Client-owned apps. Cloudflare-first. Add only what you need.</text>
-<text x="34" y="274" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">shadcn monorepo init → pnpm + Turborepo → apps/* + packages/*</text>
+<text x="34" y="274" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">Select the recipe → initialize source → connect only needed services</text>
 <text x="1525" y="52" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">DX TOOLS</text>
 <rect x="1187" y="76" width="88" height="92" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1214 90) scale(1.4166666666666667)"><path d="M12.001,4.8c-3.2,0-5.2,1.6-6,4.8c1.2-1.6,2.6-2.2,4.2-1.8c0.913,0.228,1.565,0.89,2.288,1.624 C13.666,10.618,15.027,12,18.001,12c3.2,0,5.2-1.6,6-4.8c-1.2,1.6-2.6,2.2-4.2,1.8c-0.913-0.228-1.565-0.89-2.288-1.624 C16.337,6.182,14.976,4.8,12.001,4.8z M6.001,12c-3.2,0-5.2,1.6-6,4.8c1.2-1.6,2.6-2.2,4.2-1.8c0.913,0.228,1.565,0.89,2.288,1.624 c1.177,1.194,2.538,2.576,5.512,2.576c3.2,0,5.2-1.6,6-4.8c-1.2,1.6-2.6,2.2-4.2,1.8c-0.913-0.228-1.565-0.89-2.288-1.624 C10.337,13.382,8.976,12,6.001,12z" fill="#06b6d4"/></g>
@@ -58,7 +58,7 @@
 <text x="1819" y="148" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="11" font-weight="500" text-anchor="middle" letter-spacing="0">Codex + Skills</text>
 <text x="1187" y="210" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">macOS · OpenAI / Codex · Computer Use + Control Chrome</text>
 <text x="1187" y="240" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="16" font-weight="400" text-anchor="start" letter-spacing="0">GitHub Actions · Fallow audit · Cloudflare plugin + cf + API/MCP</text>
-<text x="1187" y="270" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare-first · free-first · client-owned delivery</text>
+<text x="1187" y="270" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">Suitable workloads · economical operation · client-owned delivery</text>
 <text x="252" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">DEPLOY &amp; DISTRIBUTE</text>
 <text x="805" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">CLIENT SURFACES</text>
 <text x="1497.5" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">CLOUDFLARE SERVICE BINDINGS</text>
@@ -143,7 +143,7 @@
 <path d="M 734 1148 L 734 1232" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="758" y="1176" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="22" font-weight="500" text-anchor="start" letter-spacing="0">Electron Desktop</text>
 <text x="758" y="1204" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="16" font-weight="400" text-anchor="start" letter-spacing="0">macOS · Windows · Linux</text>
-<text x="758" y="1225" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="start" letter-spacing="0">shadcn/ui · GPUI / Rust by choice</text>
+<text x="758" y="1225" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="start" letter-spacing="0">Native alternatives are project adaptations</text>
 <rect x="1130" y="718" width="208" height="400" rx="14" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1190" y="734" width="88" height="88" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1200 744) scale(2.8333333333333335)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
@@ -233,8 +233,8 @@
 <g transform="translate(1455 1250) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
 <path d="M 1519 1248 L 1519 1300" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Domain + Mail</text>
-<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">GoDaddy broker · Cloudflare nameservers</text>
-<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare Routing + Sending / Resend alternative</text>
+<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Client registrar · selected DNS provider</text>
+<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Routing ≠ mailbox · selected transactional mail</text>
 <rect x="1435" y="1322" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1334" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1338) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
@@ -246,9 +246,9 @@
 <rect x="1451" y="1422" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1426) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
 <path d="M 1519 1424 L 1519 1476" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
-<text x="1539" y="1441" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Basin Analytics</text>
-<text x="1539" y="1465" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Product events · datasets · queries</text>
-<text x="1539" y="1485" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Pipelines → R2 / PostHog when required</text>
+<text x="1539" y="1441" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Basin</text>
+<text x="1539" y="1465" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Pipelines · tables · distributed SQL</text>
+<text x="1539" y="1485" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Define event model, reports and retention</text>
 <path d="M 620 410 C 541.8 410 528.2 405 450 405" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>
 <path d="M 620 670 C 541.8 670 528.2 611 450 611" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>
 <path d="M 620 670 C 541.8 670 528.2 817 450 817" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>

package/assets/anhedral-cli-init.svg

@@ -1,6 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1660" viewBox="0 0 1920 1660" role="img" aria-labelledby="title description">
 <title id="title">Anhedral Init Stack</title>
-<desc id="description">Client-owned shadcn, pnpm and Turborepo monorepo. Next.js uses OpenNext on Cloudflare Workers; Hono and OpenAPI provide optional shared APIs. Select Neon with Drizzle and Hyperdrive or D1, authentication, private R2, KV, realtime, jobs, workflows, AI, email, billing, observability and analytics only when required. Dashed yellow lines show publication; white lines show application runtime and service bindings.</desc>
+<desc id="description">Client-owned, selected application recipes. A workspace is used for shared packages and multiple apps; a single API recipe is also supported. Next.js uses OpenNext on Cloudflare Workers; Hono and OpenAPI provide optional shared APIs. Select Neon with Drizzle and Hyperdrive or D1, authentication, private R2, KV, realtime, jobs, workflows, AI, email, billing, observability and analytics only when required. Dashed yellow lines show publication; white lines show application runtime and service bindings.</desc>
 <defs>
   <linearGradient id="card-fill" x1="0" y1="0" x2="1" y2="1">
     <stop offset="0" stop-color="#0d1b29"/>
@@ -30,7 +30,7 @@
 <text x="532" y="176" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="78" font-weight="700" text-anchor="start" letter-spacing="0">Stack</text>
 <path d="M 533 195 L 747 195" fill="none" stroke="#e9f600" stroke-width="6" stroke-linecap="round"/>
 <text x="34" y="240" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">Client-owned apps. Cloudflare-first. Add only what you need.</text>
-<text x="34" y="274" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">shadcn monorepo init → pnpm + Turborepo → apps/* + packages/*</text>
+<text x="34" y="274" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="24" font-weight="400" text-anchor="start" letter-spacing="0">Select the recipe → initialize source → connect only needed services</text>
 <text x="1525" y="52" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">DX TOOLS</text>
 <rect x="1187" y="76" width="88" height="92" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1214 90) scale(1.4166666666666667)"><path d="M12.001,4.8c-3.2,0-5.2,1.6-6,4.8c1.2-1.6,2.6-2.2,4.2-1.8c0.913,0.228,1.565,0.89,2.288,1.624 C13.666,10.618,15.027,12,18.001,12c3.2,0,5.2-1.6,6-4.8c-1.2,1.6-2.6,2.2-4.2,1.8c-0.913-0.228-1.565-0.89-2.288-1.624 C16.337,6.182,14.976,4.8,12.001,4.8z M6.001,12c-3.2,0-5.2,1.6-6,4.8c1.2-1.6,2.6-2.2,4.2-1.8c0.913,0.228,1.565,0.89,2.288,1.624 c1.177,1.194,2.538,2.576,5.512,2.576c3.2,0,5.2-1.6,6-4.8c-1.2,1.6-2.6,2.2-4.2,1.8c-0.913-0.228-1.565-0.89-2.288-1.624 C10.337,13.382,8.976,12,6.001,12z" fill="#06b6d4"/></g>
@@ -58,7 +58,7 @@
 <text x="1819" y="148" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="11" font-weight="500" text-anchor="middle" letter-spacing="0">Codex + Skills</text>
 <text x="1187" y="210" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">macOS · OpenAI / Codex · Computer Use + Control Chrome</text>
 <text x="1187" y="240" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="16" font-weight="400" text-anchor="start" letter-spacing="0">GitHub Actions · Fallow audit · Cloudflare plugin + cf + API/MCP</text>
-<text x="1187" y="270" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare-first · free-first · client-owned delivery</text>
+<text x="1187" y="270" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="400" text-anchor="start" letter-spacing="0">Suitable workloads · economical operation · client-owned delivery</text>
 <text x="252" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">DEPLOY &amp; DISTRIBUTE</text>
 <text x="805" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">CLIENT SURFACES</text>
 <text x="1497.5" y="318" fill="#e9f600" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="17" font-weight="600" text-anchor="middle" letter-spacing="3.2">BACKEND + SERVICES</text>
@@ -143,7 +143,7 @@
 <path d="M 734 1148 L 734 1232" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="758" y="1176" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="22" font-weight="500" text-anchor="start" letter-spacing="0">Electron Desktop</text>
 <text x="758" y="1204" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="16" font-weight="400" text-anchor="start" letter-spacing="0">macOS · Windows · Linux</text>
-<text x="758" y="1225" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="start" letter-spacing="0">shadcn/ui · GPUI / Rust by choice</text>
+<text x="758" y="1225" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="13" font-weight="400" text-anchor="start" letter-spacing="0">Native alternatives are project adaptations</text>
 <rect x="1130" y="718" width="208" height="400" rx="14" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1190" y="734" width="88" height="88" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1200 744) scale(2.8333333333333335)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
@@ -233,8 +233,8 @@
 <g transform="translate(1455 1250) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
 <path d="M 1519 1248 L 1519 1300" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
 <text x="1539" y="1265" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Domain + Mail</text>
-<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">GoDaddy broker · Cloudflare nameservers</text>
-<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Cloudflare Routing + Sending / Resend alternative</text>
+<text x="1539" y="1289" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Client registrar · selected DNS provider</text>
+<text x="1539" y="1309" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Routing ≠ mailbox · selected transactional mail</text>
 <rect x="1435" y="1322" width="430" height="80" rx="12" fill="url(#card-fill)" stroke="#73777b" stroke-width="1.15"/>
 <rect x="1451" y="1334" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1338) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
@@ -246,9 +246,9 @@
 <rect x="1451" y="1422" width="56" height="56" rx="11" fill="#07121d" stroke="#34424e" stroke-width="1.15"/>
 <g transform="translate(1455 1426) scale(2)"><path d="M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-8.6592-.1123a.1559.1559 0 0 1-.1333-.0713c-.0283-.042-.0351-.0986-.021-.1553.0278-.084.1123-.1484.2036-.1562l8.7359-.1123c1.0351-.0489 2.1601-.8868 2.5537-1.9136l.499-1.3013c.0215-.0561.0293-.1128.0147-.168-.5625-2.5463-2.835-4.4453-5.5499-4.4453-2.5039 0-4.6284 1.6177-5.3876 3.8614-.4927-.3658-1.1187-.5625-1.794-.499-1.2026.119-2.1665 1.083-2.2861 2.2856-.0283.31-.0069.6128.0635.894C1.5683 13.171 0 14.7754 0 16.752c0 .1748.0142.3515.0352.5273.0141.083.0844.1475.1689.1475h15.9814c.0909 0 .1758-.0645.2032-.1553l.12-.4268zm2.7568-5.5634c-.0771 0-.1611 0-.2383.0112-.0566 0-.1054.0415-.127.0976l-.3378 1.1744c-.1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498 1.0625.5195l1.8437.1133c.0557 0 .1055.0263.1329.0703.0283.043.0351.1074.0214.1562-.0283.084-.1132.1485-.204.1553l-1.921.1123c-1.041.0488-2.1582.8867-2.5527 1.914l-.1406.3585c-.0283.0713.0215.1416.0986.1416h6.5977c.0771 0 .1474-.0489.169-.126.1122-.4082.1757-.837.1757-1.2803 0-2.6025-2.125-4.727-4.7344-4.727" fill="#f48120"/></g>
 <path d="M 1519 1424 L 1519 1476" fill="none" stroke="#34424e" stroke-width="1" stroke-linecap="round"/>
-<text x="1539" y="1441" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Basin Analytics</text>
-<text x="1539" y="1465" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Product events · datasets · queries</text>
-<text x="1539" y="1485" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Pipelines → R2 / PostHog when required</text>
+<text x="1539" y="1441" fill="#f7f5f0" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="18" font-weight="500" text-anchor="start" letter-spacing="0">Basin</text>
+<text x="1539" y="1465" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="14" font-weight="400" text-anchor="start" letter-spacing="0">Pipelines · tables · distributed SQL</text>
+<text x="1539" y="1485" fill="#c4c7ca" font-family="Inter, Helvetica Neue, Arial, sans-serif" font-size="12" font-weight="400" text-anchor="start" letter-spacing="0">Define event model, reports and retention</text>
 <path d="M 620 410 C 541.8 410 528.2 405 450 405" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>
 <path d="M 620 670 C 541.8 670 528.2 611 450 611" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>
 <path d="M 620 670 C 541.8 670 528.2 817 450 817" fill="none" stroke="#e9f600" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="10 8" marker-end="url(#arrow-yellow)"/>

package/assets/security/LICENSES.txt

@@ -0,0 +1,63 @@
+Vendored security backports retain their upstream notices.
+
+node-forge: BSD-3-Clause (selected from upstream dual license)
+New BSD License (3-clause)
+Copyright (c) 2010, Digital Bazaar, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of Digital Bazaar, Inc. nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL DIGITAL BAZAAR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+decode-uri-component: MIT
+The MIT License (MIT)
+
+Copyright (c) 2017, Sam Verschueren <sam.verschueren@gmail.com> (github.com/SamVerschueren)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+braces: MIT
+The MIT License (MIT)
+
+Copyright (c) 2014-present, Jon Schlinkert.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/assets/security/audit-deps.mjs

@@ -0,0 +1,295 @@
+import console from 'node:console';
+import { createHash } from 'node:crypto';
+import { readdir, readFile, lstat, writeFile, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { setTimeout, clearTimeout } from 'node:timers';
+import { fileURLToPath } from 'node:url';
+import { verifyForge } from './forge-regression.mjs';
+import { verifyBraces } from './braces-regression.mjs';
+import { verifyDecoder } from './decoder-regression.mjs';
+
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const assetRoot = path.dirname(fileURLToPath(import.meta.url));
+const severities = ['info', 'low', 'moderate', 'high', 'critical'];
+const supported = {
+  'node-forge': { version: '1.4.0', advisory: 'GHSA-86w9-cpqp-85rv', verify: verifyForge },
+  braces: { version: '3.0.3', advisory: 'GHSA-vfj7-8cjw-p6xm', verify: verifyBraces },
+  'decode-uri-component': { version: '0.2.2', advisory: 'GHSA-vcc3-ghjq-m6fr', verify: verifyDecoder },
+};
+
+function ensure(condition, message) {
+  if (!condition) throw new Error(message);
+}
+const nonemptyString = (value) => typeof value === 'string' && value.length > 0;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const strings = (value) => Array.isArray(value) && value.length > 0 && value.every(nonemptyString);
+
+async function collectPackageFiles(directory, relative, files) {
+  const names = (await readdir(directory)).sort().filter((name) => relative || name !== 'node_modules');
+  for (const name of names) {
+    const key = relative ? `${relative}/${name}` : name;
+    await collectPackageEntry(path.join(directory, name), key, files);
+  }
+}
+
+async function collectPackageEntry(location, key, files) {
+  const entry = await lstat(location);
+  ensure(!entry.isSymbolicLink(), `Unexpected package symlink: ${key}`);
+  if (entry.isDirectory()) return collectPackageFiles(location, key, files);
+  ensure(entry.isFile(), `Unexpected package file type: ${key}`);
+  files.push([key, sha256(await readFile(location))]);
+}
+
+export async function hashPackageTree(packageRoot) {
+  const files = [];
+  await collectPackageFiles(packageRoot, '', files);
+  // Use code-unit ordering independently of the host locale.
+  const sortedNames = files.map(([name]) => name).sort();
+  const hashes = new Map(files);
+  return sha256(sortedNames.map((name) => `${name}\0${hashes.get(name)}\n`).join(''));
+}
+
+async function optionalStat(location) {
+  try { return await lstat(location); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+
+async function discoverCopy(directory, name, copies, links) {
+  const candidate = path.join(directory, name);
+  const stat = await optionalStat(candidate);
+  if (!stat) return;
+  if (stat.isSymbolicLink()) return links.push(candidate);
+  ensure(stat.isDirectory(), `Unexpected package location: ${candidate}`);
+  copies.add(await realpath(candidate));
+}
+
+function insideRoot(root, target) {
+  const relative = path.relative(root, target);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+async function discoverLinkedDirectory(location, name, copies, links, state) {
+  const target = await realpath(location);
+  const stat = await lstat(target);
+  if (!stat.isDirectory()) return;
+  ensure(insideRoot(state.root, target), `Directory link escapes dependency inspection: ${location}`);
+  await discoverPackages(location, name, copies, links, state);
+}
+
+async function discoverPackages(directory, name, copies, links, state) {
+  // Inspect logical node_modules aliases before deduplicating physical traversal.
+  if (path.basename(directory) === 'node_modules') await discoverCopy(directory, name, copies, links);
+  const physical = await realpath(directory);
+  if (state.visited.has(physical)) return;
+  state.visited.add(physical);
+  const entries = (await readdir(directory, { withFileTypes: true })).filter((entry) => entry.name !== '.git');
+  for (const entry of entries) await discoverEntry(directory, entry, name, copies, links, state);
+
+}
+
+async function discoverEntry(directory, entry, name, copies, links, state) {
+  const location = path.join(directory, entry.name);
+  if (entry.isDirectory()) return discoverPackages(location, name, copies, links, state);
+  if (entry.isSymbolicLink()) return discoverLinkedDirectory(location, name, copies, links, state);
+}
+
+async function packageCopies(projectRoot, name) {
+  const copies = new Set();
+  const links = [];
+  const state = { root: await realpath(projectRoot), visited: new Set() };
+  await discoverPackages(projectRoot, name, copies, links, state);
+  const storeCopies = new Set([...copies].filter((copy) => copy.split(path.sep).includes('.pnpm')));
+  for (const link of links) ensure(storeCopies.has(await realpath(link)), `Package link escapes verified pnpm copies: ${link}`);
+  return [...copies];
+}
+
+function validateFinding(finding) {
+  ensure(nonemptyString(finding?.version), 'Malformed pnpm advisory');
+  ensure(strings(finding.paths), 'Malformed pnpm advisory');
+}
+
+function validateAdvisory(advisory) {
+  ensure(nonemptyString(advisory?.module_name), 'Malformed pnpm advisory');
+  ensure(severities.includes(advisory.severity), 'Malformed pnpm advisory');
+  ensure(Array.isArray(advisory.findings), 'Malformed pnpm advisory');
+  ensure(advisory.findings.length > 0, 'Malformed pnpm advisory');
+  advisory.findings.forEach(validateFinding);
+}
+
+function validateCount(advisories, severity, count) {
+  ensure(Number.isInteger(count) && count >= 0, 'Malformed pnpm vulnerability counts');
+  const details = advisories.filter((advisory) => advisory.severity === severity).length;
+  ensure(count === details, `Missing ${severity} advisory details: count ${count}, details ${details}`);
+}
+
+function validateReport(report) {
+  ensure(record(report), 'Malformed pnpm audit report');
+  ensure(record(report.advisories), 'Malformed pnpm audit report');
+  ensure(record(report.metadata?.vulnerabilities), 'Malformed pnpm audit report');
+  ensure(!report.error, 'Malformed pnpm audit report');
+  const advisories = Object.values(report.advisories);
+  advisories.forEach(validateAdvisory);
+  for (const severity of severities) validateCount(advisories, severity, report.metadata.vulnerabilities[severity]);
+}
+
+function validateEntry(entry) {
+  const message = 'Malformed remediation entry';
+  ensure(record(entry), message);
+  ensure(Object.hasOwn(supported, entry.name), message);
+  const expected = supported[entry.name];
+  ensure(entry.version === expected.version, message);
+  ensure(Array.isArray(entry.advisoryIds), message);
+  ensure(entry.advisoryIds.length === 1, message);
+  ensure(entry.advisoryIds[0] === expected.advisory, message);
+  ensure(/^[a-f0-9]{64}$/.test(entry.patchSha256 ?? ''), message);
+  ensure(/^[a-f0-9]{64}$/.test(entry.installedTreeSha256 ?? ''), message);
+  ensure(entry.patch === `${entry.name}@${entry.version}.patch`, message);
+}
+
+function validateManifest(manifest) {
+  ensure(manifest?.schemaVersion === 1, 'Malformed remediation manifest');
+  ensure(Array.isArray(manifest.packages), 'Malformed remediation manifest');
+  manifest.packages.forEach(validateEntry);
+  const names = manifest.packages.map((entry) => entry.name);
+  ensure(new Set(names).size === names.length, 'Duplicate remediation entries');
+  ensure(names.length === Object.keys(supported).length, 'Incomplete remediation manifest');
+}
+
+async function optionalFile(file) {
+  try { return await readFile(file, 'utf8'); }
+  catch (error) { if (error.code === 'ENOENT') return ''; throw error; }
+}
+
+function parsePatchLine(line) {
+  const match = line.match(/^\s+['"]?([^'"\s]+)['"]?:\s*['"]?([^'"\s#]+)['"]?\s*(?:#.*)?$/);
+  return match?.slice(1);
+}
+
+function patchSection(workspace) {
+  const lines = workspace.split(/\r?\n/);
+  const headers = lines.flatMap((line, index) => /^(?:patchedDependencies|"patchedDependencies"|'patchedDependencies')\s*:\s*(?:#.*)?$/.test(line) ? [index] : []);
+  ensure(headers.length <= 1, 'Duplicate patchedDependencies sections');
+  if (headers.length === 0) return [];
+  const remainder = lines.slice(headers[0] + 1);
+  const end = remainder.findIndex((line) => /^\S/.test(line) && !line.startsWith('#'));
+  return (end < 0 ? remainder : remainder.slice(0, end)).map(parsePatchLine).filter(Boolean);
+}
+
+async function hasPatchMapping(projectRoot, entry) {
+  const section = patchSection(await optionalFile(path.join(projectRoot, 'pnpm-workspace.yaml')));
+  const key = `${entry.name}@${entry.version}`;
+  const matches = section.filter(([name]) => name === key);
+  ensure(matches.length <= 1, `Duplicate patch mapping: ${key}`);
+  return matches[0]?.[1] === path.posix.join('scripts/security', entry.patch);
+}
+
+async function verifyPatch(projectRoot, securityRoot, entry) {
+  ensure(await hasPatchMapping(projectRoot, entry), `Missing patch mapping: ${entry.name}@${entry.version}`);
+  const patch = path.join(securityRoot, entry.patch);
+  ensure((await lstat(patch)).isFile(), `Unexpected patch file: ${entry.name}`);
+  ensure(sha256(await readFile(patch)) === entry.patchSha256, `Patch checksum mismatch: ${entry.name}`);
+}
+
+async function verifyCopy(copy, entry, verify) {
+  const pkg = JSON.parse(await readFile(path.join(copy, 'package.json'), 'utf8'));
+  ensure(pkg.name === entry.name && pkg.version === entry.version, `Unexpected installed version: ${entry.name} at ${copy}`);
+  ensure(await hashPackageTree(copy) === entry.installedTreeSha256, `Installed package bytes differ: ${copy}`);
+  await verify(copy);
+}
+
+async function verifyEntry(entry, options) {
+  const copies = await packageCopies(options.projectRoot, entry.name);
+  if (copies.length === 0) return false;
+  await verifyPatch(options.projectRoot, options.securityRoot, entry);
+  const verify = options.regressions[entry.name] ?? supported[entry.name].verify;
+  ensure(typeof verify === 'function', `Missing regression verifier: ${entry.name}`);
+  for (const copy of copies) await verifyCopy(copy, entry, verify);
+  return true;
+}
+
+function matchesAdvisory(entry, advisory) {
+  return entry.name === advisory.module_name && entry.advisoryIds.includes(advisory.github_advisory_id);
+}
+
+function advisoryFixed(entry, advisory, verified) {
+  return Boolean(entry && verified.has(entry.name) && advisory.findings.every((finding) => finding.version === entry.version));
+}
+
+function advisoryVerdict(advisory, manifest, verified) {
+  const entry = manifest.packages.find((item) => matchesAdvisory(item, advisory));
+  const fixed = advisoryFixed(entry, advisory, verified);
+  const id = advisory.github_advisory_id ?? String(advisory.id);
+  const state = fixed ? 'verified local backport; upstream audit remains affected' : 'unremediated';
+  return { text: `${advisory.severity}: ${id} (${advisory.module_name}) — ${state}`, blocked: !fixed && ['high', 'critical'].includes(advisory.severity), id };
+}
+
+export async function verifyAuditReport(report, { projectRoot, manifest, securityRoot = assetRoot, regressions = {} }) {
+  validateReport(report);
+  validateManifest(manifest);
+  const verified = new Set();
+  for (const entry of manifest.packages) {
+    if (await verifyEntry(entry, { projectRoot, securityRoot, regressions })) verified.add(entry.name);
+  }
+  const results = Object.values(report.advisories).map((advisory) => advisoryVerdict(advisory, manifest, verified));
+  const verdicts = results.map((result) => result.text);
+  const blocked = results.filter((result) => result.blocked).map((result) => result.id);
+  ensure(blocked.length === 0, `Unremediated high/critical advisories: ${blocked.join(', ')}\n${verdicts.join('\n')}`);
+  return { verdicts, verified: [...verified] };
+}
+
+function parseAuditResult(stdout, stderr, code, signal) {
+  ensure(!signal && [0, 1].includes(code), `pnpm audit failed (${signal ?? code}): ${stderr.slice(0, 2000)}`);
+  let report;
+  try { report = JSON.parse(stdout); }
+  catch { throw new Error(`pnpm audit returned malformed JSON: ${stderr.slice(0, 2000)}`); }
+  validateReport(report);
+  const clean = Object.values(report.metadata.vulnerabilities).every((count) => count === 0);
+  ensure((code === 0) === clean, 'pnpm audit exit status disagrees with vulnerability counts');
+  return { report, raw: stdout };
+}
+
+function collectAuditProcess(child) {
+  return new Promise((resolve, reject) => {
+    let stdout = '', stderr = '';
+    const fail = (error) => { clearTimeout(timer); child.kill(); reject(error); };
+    const timer = setTimeout(() => fail(new Error('pnpm audit timed out')), 120_000);
+    child.stdout.on('data', (data) => {
+      stdout += data;
+      if (stdout.length > 16_000_000) fail(new Error('pnpm audit output exceeds limit'));
+    });
+    child.stderr.on('data', (data) => { stderr = (stderr + data).slice(-16_000); });
+    child.on('error', fail);
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      try { resolve(parseAuditResult(stdout, stderr, code, signal)); }
+      catch (error) { reject(error); }
+    });
+  });
+}
+
+export function runAudit(projectRoot, all = true) {
+  const pnpm = process.env.npm_execpath;
+  ensure(nonemptyString(pnpm), 'Run this check through pnpm');
+  ensure(/pnpm/i.test(path.basename(pnpm)), 'Run this check through pnpm');
+  const args = ['audit', '--json', '--audit-level', 'low', ...(all ? [] : ['--prod'])];
+  const javascript = /\.[cm]?js$/i.test(pnpm);
+  const child = spawn(javascript ? process.execPath : pnpm, javascript ? [pnpm, ...args] : args, { cwd: projectRoot, stdio: ['ignore', 'pipe', 'pipe'] });
+  return collectAuditProcess(child);
+}
+
+async function main() {
+  const projectRoot = process.cwd();
+  const { report, raw } = await runAudit(projectRoot);
+  const reportPath = path.join(projectRoot, '.anhedral-audit-report.json');
+  await writeFile(reportPath, raw);
+  console.log(`Unmodified pnpm audit report (all dependencies): ${reportPath}`);
+  const manifest = JSON.parse(await readFile(path.join(assetRoot, 'manifest.json'), 'utf8'));
+  const result = await verifyAuditReport(report, { projectRoot, manifest });
+  result.verdicts.forEach((verdict) => console.log(verdict));
+  console.log('Dependency gate passed: no unremediated high/critical findings.');
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error) => { console.error(error.message); process.exitCode = 1; });
+}