anhedral 0.8.5 → 0.8.6

package/assets/security/manifest.json

@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "packages": [
+    {
+      "name": "node-forge",
+      "version": "1.4.0",
+      "advisoryIds": [
+        "GHSA-86w9-cpqp-85rv"
+      ],
+      "patch": "node-forge@1.4.0.patch",
+      "patchSha256": "1b5e41ae73d70d18d2541c50e67d5b408eda4cdd52a426c3d085ec17b8f9b2a9",
+      "installedTreeSha256": "bb76d231d6aba9cad2da5f1ec1dee54b64c6720c5fb0b0c6aa0119b661d541c0",
+      "provenanceUrls": [
+        "https://github.com/digitalbazaar/forge/pull/1152",
+        "https://github.com/digitalbazaar/forge/commit/ceba34402e329f0365134f23fe19898756527d65",
+        "https://github.com/advisories/GHSA-86w9-cpqp-85rv"
+      ],
+      "origin": "Upstream PR1152 cardinality backport plus Anhedral strict DER NULL payload validation"
+    },
+    {
+      "name": "braces",
+      "version": "3.0.3",
+      "advisoryIds": [
+        "GHSA-vfj7-8cjw-p6xm"
+      ],
+      "patch": "braces@3.0.3.patch",
+      "patchSha256": "7274fa48b0167311b25a1ef8cf34f4bfe45f6ef58a0cc2813712fb7bb26e2e6a",
+      "installedTreeSha256": "c3d6d7c5bc0b6a578effc6d0e4bf6b384cbf04c6a81cfd2c8af10c185acdb0fb",
+      "provenanceUrls": [
+        "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
+        "https://github.com/micromatch/braces/commit/74b2db2938fad48a2ea54a9c8bf27a37a62c350d",
+        "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz"
+      ],
+      "origin": "Anhedral local guarded backport; upstream advisory still lists no patched release"
+    },
+    {
+      "name": "decode-uri-component",
+      "version": "0.2.2",
+      "advisoryIds": [
+        "GHSA-vcc3-ghjq-m6fr"
+      ],
+      "patch": "decode-uri-component@0.2.2.patch",
+      "patchSha256": "f6a891bfb1a3d59b5b72602d4f6e5de5b6f5ee64467a9a24a1e182a3b07f8c54",
+      "installedTreeSha256": "821832e5d3622308a9159706eebb0b9ac702576b39e0cd4ea4fcb15cb9d7cbfb",
+      "provenanceUrls": [
+        "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
+        "https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0",
+        "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr"
+      ],
+      "origin": "Official 0.5.0 security scanner backported to 0.2.2 while preserving its CommonJS API and plus-to-space behavior"
+    }
+  ]
+}

package/assets/security/node-forge@1.4.0.patch

@@ -0,0 +1,26 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+index a4264822b..430905451 100644
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1168,11 +1168,19 @@ pki.setRsaPublicKey = pki.rsa.setPublicKey = function(n, e) {
+             parseAllBytes: options._parseAllDigestBytes
+           });
+ 
+-          // validate DigestInfo structure and element count
++          // validate DigestInfo structure and element counts (outer DigestInfo
++          // and nested DigestAlgorithm). asn1.validate ignores extra children,
++          // so length must be checked explicitly at each nesting level to
++          // prevent low-exponent PKCS#1 v1.5 signature forgery (CVE-2026-85393).
++          // Anhedral additionally rejects nonempty primitive NULL parameters:
++          // DER NULL has zero content octets; child counts do not check this.
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            obj.value[0].value.length !==
++              (('parameters' in capture) ? 2 : 1) ||
++            (('parameters' in capture) && capture.parameters !== '')) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/dist/bin.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import path from 'node:path';
+import { closeSync, openSync, readSync } from 'node:fs';
+import { readProjectProgress, reportProjectProgress, validateProgressReport } from './progress.js';
 import { inspectProject } from './readiness.js';
 import { argv } from 'node:process';
 import { STANDARD_USAGE, parseStandardOptions, scaffoldStandardProject } from './standard.js';
@@ -16,12 +18,16 @@ async function main() {
         console.log(json ? JSON.stringify({ version: GENERATOR_VERSION }) : GENERATOR_VERSION);
         return;
     }
+    if (command === 'progress') {
+        runProgress(args);
+        return;
+    }
     if (command === 'doctor') {
         runDoctor(args);
         return;
     }
     if (command !== 'new' && command !== 'init') {
-        throw new Error(`Unknown command: ${command}. Use new, init, doctor, --help, or --version.`);
+        throw new Error(`Unknown command: ${command}. Use new, init, doctor, progress, --help, or --version.`);
     }
     if (args.some((arg) => ['--help', '-h'].includes(arg))) {
         console.log(json ? JSON.stringify({ usage: STANDARD_USAGE }) : STANDARD_USAGE);
@@ -31,6 +37,37 @@ async function main() {
     if (options)
         await scaffoldStandardProject(options);
 }
+function runProgress(args) {
+    const positional = args.filter(arg => arg !== '--json');
+    const [operation, directory, input, ...extra] = positional;
+    if (extra.length || !['show', 'report'].includes(operation) || !directory || (operation === 'show' && input) || (operation === 'report' && !input))
+        throw new Error('Usage: anhedral progress show <directory> | progress report <directory> <report.json|-> [--json]');
+    const root = path.resolve(directory);
+    const result = operation === 'show' ? readProjectProgress(root) : reportProjectProgress(root, validateProgressReport(JSON.parse(readProgressInput(input))));
+    console.log(JSON.stringify(result, null, 2));
+}
+function readProgressInput(input) {
+    const fd = input === '-' ? 0 : openSync(path.resolve(input), 'r');
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const chunk = Buffer.alloc(8192);
+            const length = readSync(fd, chunk, 0, chunk.length, null);
+            if (!length)
+                break;
+            total += length;
+            if (total > 262144)
+                throw new Error('Progress report exceeds size limit.');
+            chunks.push(chunk.subarray(0, length));
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    finally {
+        if (fd !== 0)
+            closeSync(fd);
+    }
+}
 function runDoctor(args) {
     const positional = args.filter((arg) => arg !== '--json');
     if (positional.length > 1 || positional.some((arg) => arg.startsWith('-')))
@@ -57,7 +94,7 @@ try {
 catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const code = error instanceof PostCommitError ? 'POST_COMMIT_FAILED'
-        : command === 'doctor' ? 'INVALID_ARGUMENT'
+        : command === 'doctor' || command === 'progress' ? 'INVALID_ARGUMENT'
             : command === 'new' || command === 'init' ? 'GENERATION_FAILED' : 'UNKNOWN_COMMAND';
     console.error(json ? JSON.stringify({ error: message, code }) : `Error: ${message}`);
     process.exitCode = 1;

package/dist/capabilities.d.ts

@@ -9,6 +9,7 @@ export interface Selection {
 }
 export interface Capability {
     purpose: string;
+    delivery: 'starter' | 'sdk-factory' | 'integration-boundary';
     tools: string[];
     access: string[];
     credentials: string[];
@@ -25,13 +26,6 @@ export declare const CAPABILITY_REGISTRY: {
     capabilities: Record<"next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", Capability>;
 };
 export declare function createSetupPlan(options: StandardOptions): {
-    schemaVersion: number;
-    cliVersion: string;
-    registryVersion: number;
-    standard: string;
-    root: string;
-    products: ("next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
-    hosting: "cloudflare" | "vercel";
     bootstrap: string[];
     dryRun: boolean;
     setup: {
@@ -40,6 +34,7 @@ export declare function createSetupPlan(options: StandardOptions): {
         capabilities: {
             status: "starter" | "planned";
             purpose: string;
+            delivery: "starter" | "sdk-factory" | "integration-boundary";
             tools: string[];
             access: string[];
             credentials: string[];
@@ -51,4 +46,13 @@ export declare function createSetupPlan(options: StandardOptions): {
         completion: string[];
         resourcesProvisioned: boolean;
     };
+    extensionSurface?: "sidepanel" | "popup" | undefined;
+    schemaVersion: number;
+    cliVersion: string;
+    registryVersion: number;
+    standard: string;
+    root: string;
+    products: ("next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+    hosting: "cloudflare" | "vercel";
+    layout: "workspace" | "single";
 };

package/dist/capabilities.js

@@ -1,19 +1,20 @@
 import { GENERATOR_VERSION } from './version.js';
 import { PACKAGE_MANAGER } from './dependencies.js';
-function capability(purpose, tools, access, credentials, resources, verify, selection = {}) {
-    return { purpose, tools, access, credentials, resources, verify, selection };
+import { SHADCN_BOOTSTRAP } from './foundation.js';
+function capability(purpose, tools, access, credentials, resources, verify, selection = {}, delivery = 'starter') {
+    return { purpose, delivery, tools, access, credentials, resources, verify, selection };
 }
 /** Setup requirements describe unfinished starters; they never grant authority or claim readiness. */
 export const CAPABILITIES = {
-    next: capability('Web application', ['Browser control'], [], [], ['Next.js app; configure the selected hosting provider'], ['Web flows, accessibility, production hosting build and deployed preview'], { app: true }),
-    expo: capability('Mobile application', ['Expo/EAS CLI', 'Xcode or Android SDK'], ['Client-owned Apple/Google developer accounts for store delivery'], ['Platform signing credentials; EAS access when used'], ['Expo app; native adapters, signing, store configuration'], ['Native simulator/device flows and signed native build; web export alone is insufficient'], { app: true }),
-    electron: capability('Desktop application', ['Electron tooling', 'Platform packaging tools'], ['Signing/notarization account for the target platform'], ['Signing credentials; notarization credentials when required'], ['Electron app; packaging and distribution configuration'], ['Packaged desktop app, permissions, update/recovery behavior'], { app: true }),
-    wxt: capability('Chrome side-panel extension', ['Chrome', 'WXT'], ['Extension store publisher access for distribution'], ['Store publishing credentials when required'], ['Extension app; minimal browser permissions and store package'], ['Installed side panel, background/content messaging and permission behavior'], { app: true }),
+    next: capability('Web application with Next.js rendering, routing and server integration', ['Browser testing where applicable'], [], [], ['Next.js app; configure the selected hosting provider'], ['Web flows, accessibility, production hosting build and deployed preview'], { app: true }),
+    expo: capability('Mobile application starter with Expo and native platform adapters', ['Expo/EAS CLI', 'Xcode or Android SDK'], ['Client-owned Apple/Google developer accounts for store delivery'], ['Platform signing credentials; EAS access when used'], ['Expo app; native adapters, signing, store configuration'], ['Pass the installed-byte dependency gate; maintain reviewed backports until supported upstream replacements are available', 'Native simulator/device flows and signed native build; web export alone is insufficient'], { app: true }),
+    electron: capability('Electron desktop starter for web UI reuse; assess memory, native integration, security and distribution', ['Electron tooling', 'Platform packaging tools'], ['Signing/notarization account for the target platform'], ['Signing credentials; notarization credentials when required'], ['Electron app; packaging and distribution configuration'], ['Packaged desktop app, permissions, update/recovery behavior'], { app: true }),
+    wxt: capability('WXT Chrome extension starter; select sidepanel or popup for the task', ['Chrome', 'WXT'], ['Extension store publisher access for distribution'], ['Store publishing credentials when required'], ['Extension app; minimal browser permissions and store package'], ['Installed selected surface, relevant messaging and minimal permission behavior'], { app: true }),
     hono: capability('Shared OpenAPI backend', ['Wrangler'], ['Cloudflare Workers deployment access'], [], ['API Worker; application routes and authorization'], ['Contract validation, unauthenticated rejection and resource ownership'], { app: true }),
-    neon: capability('PostgreSQL persistence through Drizzle and Hyperdrive', ['Neon integration or API', 'Wrangler'], ['Neon project/branch access; Cloudflare Hyperdrive configuration access'], ['DATABASE_URL for migrations; separate least-privilege Hyperdrive origin credentials'], ['Neon project/branches, database roles, migrations, HYPERDRIVE binding'], ['Migration and runtime connectivity; disable query caching for correctness-sensitive reads'], { conflicts: ['d1'], workerBinding: true }),
+    neon: capability('PostgreSQL persistence through Drizzle and Hyperdrive', ['Neon integration or API', 'Wrangler'], ['Neon project/branch access; Cloudflare Hyperdrive configuration access'], ['DATABASE_URL for migrations; separate least-privilege Hyperdrive origin credentials'], ['Generated Drizzle + Hyperdrive recipe: schema/client factories, migration config and HYPERDRIVE binding; direct Neon serverless access is an existing-project adaptation'], ['Migration and runtime connectivity; disable query caching for correctness-sensitive reads'], { conflicts: ['d1'], workerBinding: true }),
     d1: capability('SQLite-compatible hosted persistence', ['Wrangler'], ['Cloudflare D1 access'], [], ['D1 database, DB binding and reviewed migrations'], ['Migration, constraints, transactional behavior and runtime queries'], { conflicts: ['neon'], workerBinding: true }),
-    'local-data': capability('Device-local SQLite and files', ['Selected platform database/filesystem tooling'], [], [], ['Integration boundary; implement platform adapters and explicit synchronization if needed'], ['Persistence, offline writes and recovery on the selected device']),
-    clerk: capability('Managed identity', ['Clerk integration or dashboard'], ['Client-owned Clerk project access'], ['Clerk publishable key; server secret key; webhook secret when used'], ['Identity project, allowed URLs, SDK setup and protected routes'], ['Sign-in/out, session expiry, resource authorization and selected native client flows'], { conflicts: ['better-auth'], requiresAny: ['next', 'hono'] }),
+    'local-data': capability('Device-local SQLite and files', ['Selected platform database/filesystem tooling'], [], [], ['Integration boundary; implement platform adapters and explicit synchronization if needed'], ['Persistence, offline writes and recovery on the selected device'], {}, 'integration-boundary'),
+    clerk: capability('Managed identity', ['Clerk integration or dashboard'], ['Client-owned Clerk project access'], ['Clerk publishable key; server secret key; webhook secret when used'], ['Identity project, allowed URLs, SDK setup and protected routes'], ['Sign-in/out, session expiry, server-side authorization and selected native flows; route-group names do not authorize requests'], { conflicts: ['better-auth'], requiresAny: ['next', 'hono'] }),
     'better-auth': capability('Application-managed identity', ['Selected database tooling'], ['Selected database migration/runtime access'], ['BETTER_AUTH_SECRET; BETTER_AUTH_URL'], ['Selected Neon or D1 database, auth schema, trusted origins and application routes'], ['Sign-in/out, session expiry, sign-up policy and resource authorization'], { conflicts: ['clerk'], requiresAny: ['neon', 'd1'], workerBinding: true }),
     r2: capability('Private remote files', ['Wrangler'], ['Cloudflare R2 bucket/binding access'], [], ['Private R2 bucket and FILES binding; authorized upload/download endpoints'], ['Public bucket access disabled; file ownership enforced; clients receive no storage credentials'], { workerBinding: true }),
     kv: capability('Eventually consistent cache/configuration', ['Wrangler'], ['Cloudflare KV namespace access'], [], ['KV namespace and CONFIG binding'], ['TTL and propagation behavior; never use KV as transactional authority'], { workerBinding: true }),
@@ -21,16 +22,16 @@ export const CAPABILITIES = {
     queues: capability('Deferred jobs', ['Wrangler'], ['Cloudflare Queues configuration access'], [], ['Queue, producer/consumer bindings and failure handling'], ['Retries, idempotency, concurrency and dead-letter recovery']),
     cron: capability('Scheduled work', ['Wrangler'], ['Cloudflare Worker deployment access'], [], ['Scheduled Worker and environment-specific Cron Triggers'], ['Schedule, idempotency, failure visibility and overlapping runs']),
     workflows: capability('Durable multi-step processing', ['Wrangler'], ['Cloudflare Workflows deployment access'], [], ['Workflow Worker/binding and resumable steps'], ['Retry/resume, idempotency, cancellation and failure recovery']),
-    openai: capability('Direct OpenAI integration', ['OpenAI integration or API'], ['Client-owned OpenAI project and model access'], ['OPENAI_API_KEY'], ['Server SDK factory; implement application behavior and spending limits'], ['Selected model, failure handling, private inputs and cost controls'], { conflicts: ['ai-sdk'] }),
-    'ai-sdk': capability('Streaming AI and provider abstraction', ['Selected AI provider integration or API'], ['Selected provider project/model access'], ['OPENAI_API_KEY for the generated default; selected provider credentials otherwise'], ['Server SDK factory; implement streaming, tools and application behavior'], ['Streaming, tool authorization, interruption and spending limits'], { conflicts: ['openai'] }),
+    openai: capability('Direct OpenAI integration', ['OpenAI integration or API'], ['Client-owned OpenAI project and model access'], ['OPENAI_API_KEY'], ['Server SDK factory; implement application behavior and spending limits'], ['Selected model, failure handling, private inputs and cost controls'], { conflicts: ['ai-sdk'] }, 'sdk-factory'),
+    'ai-sdk': capability('Streaming AI and provider abstraction', ['Selected AI provider integration or API'], ['Selected provider project/model access'], ['OPENAI_API_KEY for the generated default; selected provider credentials otherwise'], ['Server SDK factory; implement streaming, tools and application behavior'], ['Streaming, tool authorization, interruption and spending limits'], { conflicts: ['openai'] }, 'sdk-factory'),
     'workers-ai': capability('Cloudflare-hosted inference', ['Wrangler'], ['Cloudflare Workers AI model access'], [], ['AI binding and selected model invocation'], ['Supported model behavior, authorization and usage limits'], { workerBinding: true }),
-    resend: capability('Outbound application email', ['Resend integration or API'], ['Client-owned Resend project; sending-domain DNS access'], ['RESEND_API_KEY; webhook secret when used'], ['Verified sending domain, sender and server integration'], ['Delivery, suppression/bounce handling and webhook verification; inbound routing is separate']),
-    stripe: capability('Web payments and subscriptions', ['Stripe integration or CLI'], ['Client-owned Stripe account; test/live access as required'], ['STRIPE_SECRET_KEY; STRIPE_WEBHOOK_SECRET'], ['Products/prices, signed webhooks and entitlement implementation'], ['Test purchase/cancellation, webhook replay and transactional idempotency']),
-    revenuecat: capability('Cross-store subscription entitlements alongside Stripe', ['RevenueCat integration or API', 'Selected mobile store tooling'], ['RevenueCat project; App Store/Play Store product access'], ['Platform public SDK keys; server API/webhook credentials as required'], ['Integration guidance only; install platform SDKs and configure offerings/store products'], ['Sandbox purchase/restore, verified webhooks and entitlement reconciliation'], { requiresAll: ['stripe'] }),
-    sentry: capability('Additional runtime/crash diagnostics', ['Sentry integration or API'], ['Client-owned Sentry project access'], ['SENTRY_DSN; source-map upload token when required'], ['Integration boundary; install/init runtime SDKs and configure private source-map uploads'], ['Captured runtime errors, source maps, privacy filtering and alert delivery']),
-    basin: capability('Cloudflare analytical events', ['Wrangler', 'Cloudflare integration or API'], ['Cloudflare analytics/Pipelines access; plan supporting selected services; Pipelines Setup grant for managed R2 sink setup'], [], ['Basin dataset/stream, ANALYTICS binding, optional private R2 sink and authorized sink writes'], ['Private ingestion, event delivery, query results and archive retrieval when selected'], { workerBinding: true }),
-    posthog: capability('Specialized product analytics', ['PostHog integration or API'], ['Client-owned PostHog project access'], ['POSTHOG_API_KEY; POSTHOG_HOST; separate privileged key if needed'], ['Analytics client factory; implement consent, event schema and privacy filtering'], ['Event receipt, consent behavior and redaction of private data']),
-    styling: capability('Shared styling definitions', [], [], [], ['Styling package; implement actual shared colors, typography, spacing and themes'], ['Consistency across selected interfaces; preserve platform-specific components']),
+    resend: capability('Outbound application email', ['Resend integration or API'], ['Client-owned Resend project; sending-domain DNS access'], ['RESEND_API_KEY; webhook secret when used'], ['Verified sending domain, sender and server integration'], ['Delivery, suppression/bounce handling and webhook verification; inbound routing is separate'], {}, 'sdk-factory'),
+    stripe: capability('Web payments and subscriptions', ['Stripe integration or CLI'], ['Client-owned Stripe account; test/live access as required'], ['STRIPE_SECRET_KEY; STRIPE_WEBHOOK_SECRET'], ['Server SDK factory; implement products/prices, signed webhooks and entitlements'], ['Test purchase/cancellation, webhook replay and transactional idempotency'], {}, 'sdk-factory'),
+    revenuecat: capability('Cross-store subscription entitlements alongside Stripe', ['RevenueCat integration or API', 'Selected mobile store tooling'], ['RevenueCat project; App Store/Play Store product access'], ['Platform public SDK keys; server API/webhook credentials as required'], ['Integration guidance only; install platform SDKs and configure offerings/store products'], ['Sandbox purchase/restore, verified webhooks and entitlement reconciliation'], { requiresAll: ['stripe'] }, 'integration-boundary'),
+    sentry: capability('Additional runtime/crash diagnostics', ['Sentry integration or API'], ['Client-owned Sentry project access'], ['SENTRY_DSN; source-map upload token when required'], ['Integration boundary; install/init runtime SDKs and configure private source-map uploads'], ['Captured runtime errors, source maps, privacy filtering and alert delivery'], {}, 'integration-boundary'),
+    basin: capability('Basin ingestion and analytical SQL; product analytics needs its own event model and reports', ['Wrangler', 'Cloudflare integration or API'], ['Cloudflare analytics/Pipelines access; plan supporting selected services; Pipelines Setup grant for managed R2 sink setup'], [], ['EventStream interface and ANALYTICS binding; provision Basin stream, pipeline/table, retention and reports separately; optional private R2 sink'], ['Private ingestion, event delivery, query results and archive retrieval when selected'], { workerBinding: true }, 'integration-boundary'),
+    posthog: capability('Specialized product analytics', ['PostHog integration or API'], ['Client-owned PostHog project access'], ['POSTHOG_API_KEY; POSTHOG_HOST; separate privileged key if needed'], ['Analytics client factory; implement consent, event schema and privacy filtering'], ['Event receipt, consent behavior and redaction of private data'], {}, 'sdk-factory'),
+    styling: capability('Shared styling definitions', [], [], [], ['Styling package; implement actual shared colors, typography, spacing and themes'], ['Consistency across selected interfaces; preserve platform-specific components'], {}, 'integration-boundary'),
 };
 export function resolveStandardProducts(selected, hosting, hostingSpecified) {
     if (![...selected].some((id) => CAPABILITIES[id].selection.app))
@@ -64,7 +65,7 @@ const HOSTING_SETUP = {
     },
     vercel: {
         tools: ['Vercel integration or CLI'],
-        access: ['Client-owned Vercel project access; approved architecture exception'],
+        access: ['Client-owned Vercel project access'],
     },
 };
 export function createSetupPlan(options) {
@@ -76,14 +77,17 @@ export function createSetupPlan(options) {
     return {
         schemaVersion: 1, cliVersion: GENERATOR_VERSION, registryVersion: CAPABILITY_REGISTRY.schemaVersion,
         standard: 'anhedral-application-stack', root: options.root, products: options.products, hosting: options.hosting,
-        bootstrap: ['pnpm', 'dlx', 'shadcn@latest', 'init', '--monorepo', '--template', 'next'], dryRun: options.dryRun,
+        layout: options.layout ?? 'workspace',
+        ...(options.products.includes('wxt') ? { extensionSurface: options.extensionSurface ?? 'sidepanel' } : {}),
+        bootstrap: options.products.includes('next') ? [...SHADCN_BOOTSTRAP] : [], dryRun: options.dryRun,
         setup: {
-            tools: [...new Set(['Git', 'Node.js 22.13+ for generated workspaces', PACKAGE_MANAGER.replace('@', ' '), 'GitHub integration or gh', 'Fallow', 'Cloudflare security audit skill',
+            tools: [...new Set(['Git', 'Node.js 22.22+ for generated workspaces', PACKAGE_MANAGER.replace('@', ' '), 'GitHub integration or gh', 'Fallow',
+                    ...(providers.includes(HOSTING_SETUP.cloudflare) ? ['Cloudflare security audit skill'] : []),
                     ...providers.flatMap((provider) => provider.tools), ...capabilities.flatMap((item) => item.tools)])],
             access: ['Client-owned repository and CI access', ...providers.flatMap((provider) => provider.access)],
             capabilities,
             completion: ['Discover available plugins and fallbacks; verify the selected account and scope', 'Configure separate environments, bindings and server-side secrets',
-                'Implement starter behavior and meaningful tests', 'Run pnpm check plus platform/provider verification', 'Verify deployed preview; obtain required production authorization; record rollback and operating ownership'],
+                'Implement starter behavior and meaningful tests', 'Run repeatable local gates and separately record time-sensitive advisory/provider checks; verify platform behavior', 'Verify deployed preview; obtain required production authorization; record rollback and operating ownership'],
             resourcesProvisioned: false,
         },
     };

package/dist/dependencies.d.ts

@@ -6,5 +6,6 @@ export declare const DESKTOP_DEPENDENCIES: DependencyGroup;
 export declare const EXTENSION_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_APP_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_NATIVEWIND_DEPENDENCIES: DependencyGroup;
-export declare const PACKAGE_MANAGER = "pnpm@10.34.5";
-export declare const EAS_CLI_VERSION = "21.0.1";
+export declare const PACKAGE_MANAGER = "pnpm@12.9.1";
+export declare const EAS_CLI_VERSION = "24.11.0";
+export declare const TURBO_VERSION = "2.11.7";

package/dist/dependencies.js

@@ -1,86 +1,86 @@
 export const DESKTOP_DEPENDENCIES = {
     "dependencies": {
         // renovate: datasource=npm depName=react
-        "react": '19.2.7',
+        "react": '19.3.0',
         // renovate: datasource=npm depName=react-dom
-        "react-dom": '19.2.7',
+        "react-dom": '19.3.0',
         // renovate: datasource=npm depName=clsx
         "clsx": '2.1.1',
         // renovate: datasource=npm depName=tailwind-merge
-        "tailwind-merge": '3.4.0'
+        "tailwind-merge": '3.7.0'
     },
     "devDependencies": {
         // renovate: datasource=npm depName=@tailwindcss/postcss
-        "@tailwindcss/postcss": '4.1.18',
+        "@tailwindcss/postcss": '4.3.3',
         // renovate: datasource=npm depName=@vitejs/plugin-react
-        "@vitejs/plugin-react": '5.2.0',
+        "@vitejs/plugin-react": '6.1.2',
         // renovate: datasource=npm depName=@types/node
         "@types/node": '20.19.43',
         // renovate: datasource=npm depName=@types/react
-        "@types/react": '19.2.7',
+        "@types/react": '19.3.0',
         // renovate: datasource=npm depName=@types/react-dom
-        "@types/react-dom": '19.2.3',
+        "@types/react-dom": '19.3.0',
         // renovate: datasource=npm depName=electron
-        "electron": '43.7.8',
+        "electron": '44.6.0',
         // renovate: datasource=npm depName=electron-builder
         "electron-builder": '26.15.3',
-        "eslint": '10.0.3',
+        "eslint": '9.39.5',
         // renovate: datasource=npm depName=tailwindcss
-        "tailwindcss": '4.1.18',
+        "tailwindcss": '4.3.3',
         // renovate: datasource=npm depName=postcss
-        "postcss": '8.5.23',
+        "postcss": '8.5.29',
         // renovate: datasource=npm depName=typescript
-        "typescript": '5.9.3',
+        "typescript": '6.0.3',
         // renovate: datasource=npm depName=vite
-        "vite": '7.3.6'
+        "vite": '8.3.3'
     }
 };
 export const EXTENSION_DEPENDENCIES = {
     "dependencies": {
         // renovate: datasource=npm depName=react
-        "react": '19.2.7',
+        "react": '19.3.0',
         // renovate: datasource=npm depName=react-dom
-        "react-dom": '19.2.7',
+        "react-dom": '19.3.0',
         // renovate: datasource=npm depName=clsx
         "clsx": '2.1.1',
         // renovate: datasource=npm depName=tailwind-merge
-        "tailwind-merge": '3.4.0'
+        "tailwind-merge": '3.7.0'
     },
     "devDependencies": {
         // renovate: datasource=npm depName=@types/chrome
-        "@types/chrome": '0.1.9',
+        "@types/chrome": '0.3.4',
         // renovate: datasource=npm depName=@types/react
-        "@types/react": '19.2.7',
+        "@types/react": '19.3.0',
         // renovate: datasource=npm depName=@types/react-dom
-        "@types/react-dom": '19.2.3',
+        "@types/react-dom": '19.3.0',
         // renovate: datasource=npm depName=@wxt-dev/module-react
         "@wxt-dev/module-react": '1.2.2',
-        // renovate: datasource=npm depName=autoprefixer
-        "autoprefixer": '10.4.23',
+        // renovate: datasource=npm depName=@tailwindcss/postcss
+        "@tailwindcss/postcss": '4.3.3',
         // renovate: datasource=npm depName=postcss
-        "postcss": '8.5.23',
+        "postcss": '8.5.29',
         // renovate: datasource=npm depName=tailwindcss
-        "tailwindcss": '3.4.19',
+        "tailwindcss": '4.3.3',
         // renovate: datasource=npm depName=typescript
-        "typescript": '5.9.3',
+        "typescript": '6.0.3',
         // renovate: datasource=npm depName=wxt
-        "wxt": '0.20.27',
+        "wxt": '0.21.4',
         // renovate: datasource=npm depName=vite
-        "vite": '7.3.6'
+        "vite": '8.3.3'
     }
 };
 export const MOBILE_APP_DEPENDENCIES = {
     "dependencies": {
         // renovate: datasource=npm depName=@rn-primitives/portal
-        "@rn-primitives/portal": '1.5.2',
+        "@rn-primitives/portal": '1.5.3',
         // renovate: datasource=npm depName=clsx
         "clsx": '2.1.1',
         // renovate: datasource=npm depName=expo
-        "expo": '57.0.8',
+        "expo": '57.0.27',
         // renovate: datasource=npm depName=expo-linking
-        "expo-linking": '57.0.4',
+        "expo-linking": '57.0.12',
         // renovate: datasource=npm depName=expo-router
-        "expo-router": '57.0.8',
+        "expo-router": '57.0.25',
         // renovate: datasource=npm depName=expo-status-bar
         "expo-status-bar": '57.0.1',
         // renovate: datasource=npm depName=react
@@ -88,31 +88,33 @@ export const MOBILE_APP_DEPENDENCIES = {
         // renovate: datasource=npm depName=react-dom
         "react-dom": '19.2.3',
         // renovate: datasource=npm depName=react-native
-        "react-native": '0.86.0',
+        "react-native": '0.86.3',
         // renovate: datasource=npm depName=react-native-reanimated
-        "react-native-reanimated": '4.5.0',
+        "react-native-reanimated": '4.5.1',
         // renovate: datasource=npm depName=react-native-safe-area-context
         "react-native-safe-area-context": '5.7.0',
         // renovate: datasource=npm depName=react-native-screens
         "react-native-screens": '4.26.2',
         // renovate: datasource=npm depName=react-native-worklets
-        "react-native-worklets": '0.10.0',
+        "react-native-worklets": '0.10.1',
         // renovate: datasource=npm depName=react-native-web
         "react-native-web": '0.21.2',
         // renovate: datasource=npm depName=tailwind-merge
-        "tailwind-merge": '3.5.0',
+        "tailwind-merge": '3.7.0',
         // renovate: datasource=npm depName=tailwindcss-animate
         "tailwindcss-animate": '1.0.7'
     },
     "devDependencies": {
         // renovate: datasource=npm depName=@babel/core
         "@babel/core": '7.29.7',
+        // renovate: datasource=npm depName=@babel/plugin-transform-react-jsx
+        "@babel/plugin-transform-react-jsx": '7.29.7',
         // renovate: datasource=npm depName=babel-preset-expo
         "babel-preset-expo": '57.0.14',
         // renovate: datasource=npm depName=@testing-library/dom
-        "@testing-library/dom": '10.4.1',
+        "@testing-library/dom": '10.4.2',
         // renovate: datasource=npm depName=@react-native/metro-config
-        "@react-native/metro-config": '0.86.0',
+        "@react-native/metro-config": '0.86.3',
         // renovate: datasource=npm depName=@types/react
         "@types/react": '19.2.10',
         // renovate: datasource=npm depName=typescript
@@ -122,13 +124,15 @@ export const MOBILE_APP_DEPENDENCIES = {
 export const MOBILE_NATIVEWIND_DEPENDENCIES = {
     "dependencies": {
         // renovate: datasource=npm depName=nativewind
-        "nativewind": '4.2.6',
+        "nativewind": '4.2.7',
         // renovate: datasource=npm depName=react-native-css-interop
-        "react-native-css-interop": '0.2.6',
+        "react-native-css-interop": '0.2.7',
         // renovate: datasource=npm depName=tailwindcss
         "tailwindcss": '3.4.19'
     }
 };
-export const PACKAGE_MANAGER = 'pnpm@10.34.5';
+export const PACKAGE_MANAGER = 'pnpm@12.9.1';
 // renovate: datasource=npm depName=eas-cli
-export const EAS_CLI_VERSION = '21.0.1';
+export const EAS_CLI_VERSION = '24.11.0';
+// renovate: datasource=npm depName=turbo
+export const TURBO_VERSION = '2.11.7';

package/dist/evidence-validation.d.ts

@@ -0,0 +1,2 @@
+export declare function isNonSecretEvidence(value: string): boolean;
+export declare function isProgressEnvironment(value: string): boolean;

package/dist/evidence-validation.js

@@ -0,0 +1,18 @@
+/** Shared, dependency-free validation for public progress and plugin evidence. */
+const forbiddenEvidence = /(?:postgres(?:ql)?:\/\/|bearer\s+\S+|(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+|\b(?:sk|pk)_(?:live|test|proj)_\S+|\bsk-(?:proj-|live_|test_)?[a-zA-Z0-9_-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bAKIA[A-Z0-9]{16}\b|\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]+|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/i;
+export function isNonSecretEvidence(value) {
+    if (/[\x00-\x08\x0b-\x1f]/.test(value) || forbiddenEvidence.test(value))
+        return false;
+    for (const candidate of value.matchAll(/\b(?:https?|wss?):[^\s<>"']+/gi)) {
+        try {
+            const target = new URL(candidate[0]);
+            if (target.username || target.password)
+                return false;
+        }
+        catch { /* Non-URL prose is validated by the bounded text contract. */ }
+    }
+    return true;
+}
+export function isProgressEnvironment(value) {
+    return /^[a-zA-Z0-9_-][a-zA-Z0-9._-]{0,79}$/.test(value) && !['__proto__', 'constructor', 'prototype'].includes(value);
+}

package/dist/foundation.d.ts

@@ -0,0 +1,6 @@
+export declare const SHADCN_VERSION = "4.21.3";
+export declare const SHADCN_BOOTSTRAP: string[];
+/** A shared JS workspace is independent of any UI framework bootstrap. */
+export declare function scaffoldFoundation(root: string): void;
+/** The intentionally small single-app recipe has no shared packages or task runner. */
+export declare function flattenSingleApi(root: string, name: string): void;

package/dist/foundation.js

@@ -0,0 +1,49 @@
+import { cpSync, readFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { writeFile } from './util.js';
+import { PACKAGE_MANAGER, TURBO_VERSION } from './dependencies.js';
+import { generatedPnpmPolicy, setPnpmPolicy } from './pnpm-policy.js';
+// Curated input version; upstream registry templates still require compatibility checks.
+export const SHADCN_VERSION = '4.21.3';
+export const SHADCN_BOOTSTRAP = ['pnpm', 'dlx', `shadcn@${SHADCN_VERSION}`, 'init', '--monorepo', '--template', 'next'];
+const json = (root, file, value) => writeFile(path.join(root, file), JSON.stringify(value, null, 2) + '\n');
+/** A shared JS workspace is independent of any UI framework bootstrap. */
+export function scaffoldFoundation(root) {
+    json(root, 'package.json', { name: 'anhedral-workspace', private: true, packageManager: PACKAGE_MANAGER, devDependencies: { turbo: TURBO_VERSION } });
+    writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages:\n  - "apps/*"\n  - "packages/*"\n');
+    json(root, 'turbo.json', { $schema: 'https://turbo.build/schema.json', tasks: { build: { dependsOn: ['^build'] }, lint: { dependsOn: ['^lint'] }, typecheck: { dependsOn: ['^typecheck'] }, dev: { cache: false, persistent: true } } });
+    json(root, 'packages/eslint-config/package.json', { name: '@workspace/eslint-config', private: true, type: 'module', exports: { './base': './base.js', './react-internal': './react-internal.js' }, devDependencies: { eslint: '9.39.5', '@eslint/js': '9.39.5', 'typescript-eslint': '8.71.1', 'eslint-plugin-react-hooks': '7.1.1', typescript: '6.0.3' } });
+    writeFile(path.join(root, 'packages/eslint-config/base.js'), `import js from '@eslint/js';
+import ts from 'typescript-eslint';
+export const config = [js.configs.recommended, ...ts.configs.recommended, { ignores: ['**/dist/**', '**/.output/**', '**/.wxt/**', '**/.expo/**', '**/node_modules/**'] }];
+`);
+    writeFile(path.join(root, 'packages/eslint-config/react-internal.js'), `import { config as base } from './base.js';
+import hooks from 'eslint-plugin-react-hooks';
+export const config = [...base, { files: ['**/*.{tsx,jsx}'], plugins: { 'react-hooks': hooks }, rules: { 'react-hooks/rules-of-hooks': 'error', 'react-hooks/exhaustive-deps': 'warn' } }];
+`);
+    json(root, 'packages/typescript-config/package.json', { name: '@workspace/typescript-config', private: true, exports: { './base.json': './base.json' } });
+    json(root, 'packages/typescript-config/base.json', { compilerOptions: { target: 'ES2022', module: 'ESNext', moduleResolution: 'Bundler', strict: true, skipLibCheck: true, noEmit: true } });
+}
+/** The intentionally small single-app recipe has no shared packages or task runner. */
+export function flattenSingleApi(root, name) {
+    const read = (file) => JSON.parse(readFileSync(path.join(root, file), 'utf8'));
+    const workspace = read('package.json');
+    const app = read('apps/api/package.json');
+    cpSync(path.join(root, 'apps/api'), root, { recursive: true });
+    delete app.devDependencies['@workspace/eslint-config'];
+    const config = read('packages/eslint-config/package.json');
+    delete config.devDependencies['eslint-plugin-react-hooks'];
+    // The standalone API has no React/Babel browser-target dependency chain.
+    const overrides = generatedPnpmPolicy(root, 'overrides');
+    for (const key of ['baseline-browser-mapping@<2.11.0', 'browserslist@<4.28.7'])
+        delete overrides[key];
+    const scripts = { ...workspace.scripts, ...app.scripts, test: 'node --test', 'audit:full': 'fallow --fail-on-issues' };
+    json(root, 'package.json', { ...app, name, packageManager: PACKAGE_MANAGER, engines: workspace.engines, scripts, devDependencies: { ...config.devDependencies, ...app.devDependencies, eslint: '9.39.5', fallow: workspace.devDependencies.fallow } });
+    writeFile(path.join(root, 'eslint.config.mjs'), `import js from '@eslint/js';
+import ts from 'typescript-eslint';
+export default [js.configs.recommended, ...ts.configs.recommended, { ignores: ['dist/**', '.wrangler/**', 'worker-configuration.d.ts'] }, { files: ['**/*.mjs'], languageOptions: { globals: { process: 'readonly' } } }, { files: ['**/*.ts'], rules: { 'no-undef': 'off', 'no-unused-vars': 'off' } }];
+`);
+    for (const file of ['apps', 'packages', 'turbo.json', 'pnpm-workspace.yaml'])
+        rmSync(path.join(root, file), { recursive: true, force: true });
+    setPnpmPolicy(root, { allowBuilds: { esbuild: true, workerd: true }, overrides });
+}

package/dist/index.d.ts

@@ -4,3 +4,5 @@ export { GENERATOR_VERSION } from './version.js';
 export { CAPABILITIES, CAPABILITY_REGISTRY, createSetupPlan } from './capabilities.js';
 export type { Capability } from './capabilities.js';
 export { inspectProject, validateSetupPlan } from './readiness.js';
+export { PROGRESS_FILE, MILESTONES, readProjectProgress, reportProjectProgress, validateProgressReport, validateProjectProgress, projectFingerprint, evaluateProjectProgress } from './progress.js';
+export type { ProjectProgress, ProgressEnvironment, ProgressReport, ProgressObservation, DiscoveryObservation, Milestone } from './progress.js';

package/dist/index.js

@@ -2,3 +2,4 @@ export { STANDARD_PRODUCTS, STANDARD_USAGE, parseStandardOptions, applyStandardO
 export { GENERATOR_VERSION } from './version.js';
 export { CAPABILITIES, CAPABILITY_REGISTRY, createSetupPlan } from './capabilities.js';
 export { inspectProject, validateSetupPlan } from './readiness.js';
+export { PROGRESS_FILE, MILESTONES, readProjectProgress, reportProjectProgress, validateProgressReport, validateProjectProgress, projectFingerprint, evaluateProjectProgress } from './progress.js';

package/dist/platforms/desktop.js

@@ -142,8 +142,8 @@ function stop(child) {
   if (child && child.exitCode === null && !child.killed) child.kill('SIGTERM');
 }
 
-async function isServerReady(url) {
-  try { return (await fetch(url)).ok; }
+async function isServerReady(url, timeoutMs) {
+  try { return (await fetch(url, { signal: AbortSignal.timeout(timeoutMs) })).ok; }
   catch { return false; }
 }
 
@@ -151,7 +151,7 @@ async function waitForServer(server, url, timeoutMs = 30_000) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (server.exitCode !== null) throw new Error('Vite exited before the dev server was ready.');
-    if (await isServerReady(url)) return;
+    if (await isServerReady(url, Math.max(1, Math.min(1000, deadline - Date.now())))) return;
     await new Promise((resolve) => setTimeout(resolve, 150));
   }
   throw new Error('Timed out waiting for Vite at ' + url + '.');