anhedral 0.8.5 → 0.9.0

package/dist/pnpm-policy.js

@@ -0,0 +1,66 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { writeFile } from './util.js';
+function policyBlock(key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^(?:${escaped}|"${escaped}"|'${escaped}')[ \\t]*:.*(?:\\r?\\n|$)(?:[ \\t]+[^\\n]*(?:\\n|$)|#[^\\n]*(?:\\n|$)|[ \\t]*\\n)*`, 'gm');
+}
+/** Preserve unrelated starter YAML while replacing the settings this initializer owns. */
+export function setPnpmPolicy(root, policy) {
+    const file = path.join(root, 'pnpm-workspace.yaml');
+    let source = existsSync(file) ? readFileSync(file, 'utf8') : '';
+    for (const [key, value] of Object.entries(policy)) {
+        source = source.replace(policyBlock(key), '');
+        if (value === undefined)
+            continue;
+        source += `${source.endsWith('\n') || !source ? '' : '\n'}${key}: ${JSON.stringify(value)}\n`;
+    }
+    writeFile(file, source);
+}
+/** Merge reviewed patches without deleting starter-maintained mappings. */
+export function mergePnpmPatches(root, patches) {
+    const file = path.join(root, 'pnpm-workspace.yaml');
+    const source = existsSync(file) ? readFileSync(file, 'utf8') : '';
+    const blocks = [...source.matchAll(policyBlock('patchedDependencies'))];
+    if (blocks.length > 1)
+        throw new Error('Duplicate patchedDependencies configuration');
+    const block = blocks[0]?.[0] ?? '';
+    const existing = patchRows(block, patches);
+    const replacement = 'patchedDependencies:\n' +
+        existing +
+        Object.entries(patches)
+            .map(([key, value]) => `  ${JSON.stringify(key)}: ${JSON.stringify(value)}\n`)
+            .join('');
+    const remaining = source.replace(policyBlock('patchedDependencies'), '');
+    writeFile(file, remaining + `${remaining.endsWith('\n') || !remaining ? '' : '\n'}${replacement}`);
+}
+function patchRows(block, patches) {
+    if (!block)
+        return '';
+    const [header, ...rows] = block.split(/\r?\n/);
+    const value = header.slice(header.indexOf(':') + 1).trim();
+    if (value && !value.startsWith('#')) {
+        const object = JSON.parse(value);
+        if (!object ||
+            Array.isArray(object) ||
+            typeof object !== 'object' ||
+            Object.values(object).some((entry) => typeof entry !== 'string'))
+            throw new Error('Unsupported patchedDependencies mapping');
+        return Object.entries(object)
+            .filter(([key]) => !Object.hasOwn(patches, key))
+            .map(([key, entry]) => `  ${JSON.stringify(key)}: ${JSON.stringify(entry)}\n`)
+            .join('');
+    }
+    return rows
+        .filter((row) => {
+        if (!row.trim() || row.trimStart().startsWith('#'))
+            return true;
+        const match = row.match(/^  (?:"([^"\\]+)"|'([^']+)'|([^\s:'"]+)):\s*(?:"[^"\\]+"|'[^']+'|[^\s{}[\]&*!|>]+)(?:\s+#.*)?\s*$/);
+        if (!match)
+            throw new Error('Unsupported patchedDependencies mapping');
+        return !Object.hasOwn(patches, match[1] ?? match[2] ?? match[3]);
+    })
+        .filter((row, index, rows) => row || index < rows.length - 1)
+        .map((row) => `${row}\n`)
+        .join('');
+}

package/dist/project-state.d.ts

@@ -0,0 +1,28 @@
+export interface DeploymentTarget {
+    id: string;
+    directory: string;
+    workerName: string;
+}
+export interface ApplicationProject {
+    schemaVersion: 1;
+    id: string;
+    name: string;
+    ownership: 'customer';
+    provider: 'cloudflare';
+    accountId: string | null;
+    audience: 'unconfigured' | 'public' | 'private';
+    access?: {
+        emails: string[];
+    };
+    targets: DeploymentTarget[];
+}
+export type DeliveryRunner = (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv) => Promise<string>;
+export declare function atomicJson(file: string, value: unknown): void;
+export declare function readConfig(directory: string): Record<string, unknown>;
+export declare function targetDirectory(root: string, target: DeploymentTarget): string;
+export declare function registerApplication(root: string, extendTargets?: boolean): ApplicationProject;
+export declare function readApplication(root: string): ApplicationProject;
+export declare const defaultRunner: DeliveryRunner;
+export declare function environment(project: ApplicationProject): NodeJS.ProcessEnv;
+export declare function authenticate(root: string, project: ApplicationProject, run: DeliveryRunner): Promise<void>;
+export declare function withApplicationLock<T>(root: string, operation: () => Promise<T>): Promise<T>;

package/dist/project-state.js

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { parse } from 'jsonc-parser';
+import { resolveCommand } from './command.js';
+const manifestName = 'anhedral.project.json';
+const stateDirectory = '.anhedral';
+const accountPattern = /^[a-f0-9]{32}$/i;
+const workerPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function atomicJson(file, value) {
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function readConfig(directory) {
+    const errors = [];
+    const value = parse(readFileSync(path.join(directory, 'wrangler.jsonc'), 'utf8'), errors);
+    if (errors.length || !value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid Wrangler JSONC configuration.');
+    return value;
+}
+export function targetDirectory(root, target) {
+    if (!/^apps\/[a-z0-9-]+$/.test(target.directory))
+        throw new Error('Deployment targets must be direct apps/* directories.');
+    const directory = realpathSync(path.join(root, target.directory));
+    if (!directory.startsWith(realpathSync(root) + path.sep))
+        throw new Error('Deployment target escapes the project.');
+    return directory;
+}
+export function registerApplication(root, extendTargets = false) {
+    root = realpathSync(root);
+    const existing = existsSync(path.join(root, manifestName)) ? readApplication(root) : undefined;
+    if (existing && !extendTargets)
+        return existing;
+    const setup = JSON.parse(readFileSync(path.join(root, 'anhedral.setup.json'), 'utf8'));
+    if (!['cloudflare', 'vercel'].includes(setup.hosting))
+        throw new Error('Automatic delivery currently supports Cloudflare projects.');
+    const targets = readdirSync(path.join(root, 'apps'), { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .filter((entry) => existsSync(path.join(root, 'apps', entry.name, 'wrangler.jsonc')))
+        .map((entry) => {
+        const workerName = readConfig(path.join(root, 'apps', entry.name)).name;
+        if (typeof workerName !== 'string' || !workerPattern.test(workerName))
+            throw new Error('Invalid Worker name.');
+        return { id: entry.name, directory: `apps/${entry.name}`, workerName };
+    })
+        .sort((a, b) => (a.id === 'web' ? 1 : b.id === 'web' ? -1 : a.id.localeCompare(b.id)));
+    if (existing) {
+        if (existing.targets.some((target) => !targets.some((candidate) => candidate.id === target.id &&
+            candidate.directory === target.directory &&
+            candidate.workerName === target.workerName)))
+            throw new Error('Addition cannot replace existing delivery targets.');
+        const extended = { ...existing, targets };
+        atomicJson(path.join(root, manifestName), extended);
+        return extended;
+    }
+    const project = {
+        schemaVersion: 1,
+        id: randomUUID(),
+        name: JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8')).name ?? path.basename(root),
+        ownership: 'customer',
+        provider: 'cloudflare',
+        accountId: null,
+        audience: 'unconfigured',
+        targets,
+    };
+    const ignoreFile = path.join(root, '.gitignore');
+    const ignored = existsSync(ignoreFile) ? readFileSync(ignoreFile, 'utf8') : '';
+    if (!ignored.split(/\r?\n/).includes('.anhedral/'))
+        writeFileSync(ignoreFile, ignored + (ignored.endsWith('\n') || !ignored ? '' : '\n') + '.anhedral/\n');
+    atomicJson(path.join(root, manifestName), project);
+    return project;
+}
+export function readApplication(root) {
+    const project = JSON.parse(readFileSync(path.join(root, manifestName), 'utf8'));
+    if (project.schemaVersion !== 1 ||
+        typeof project.id !== 'string' ||
+        !/^[a-f0-9-]{36}$/i.test(project.id) ||
+        project.ownership !== 'customer' ||
+        project.provider !== 'cloudflare' ||
+        !(project.accountId === null || accountPattern.test(project.accountId)) ||
+        !['unconfigured', 'public', 'private'].includes(project.audience) ||
+        !Array.isArray(project.targets))
+        throw new Error('Invalid application manifest.');
+    if (project.access &&
+        (!Array.isArray(project.access.emails) ||
+            project.access.emails.some((email) => typeof email !== 'string')))
+        throw new Error('Invalid private audience configuration.');
+    if (project.audience === 'private' && !project.access?.emails.length)
+        throw new Error('Private delivery requires explicit allowed members.');
+    const ids = new Set();
+    const workers = new Set();
+    for (const target of project.targets) {
+        if (!target ||
+            typeof target.id !== 'string' ||
+            typeof target.workerName !== 'string' ||
+            !/^[a-z0-9-]+$/.test(target.id) ||
+            ids.has(target.id) ||
+            workers.has(target.workerName) ||
+            !workerPattern.test(target.workerName))
+            throw new Error('Invalid or duplicate deployment target.');
+        ids.add(target.id);
+        workers.add(target.workerName);
+        targetDirectory(root, target);
+    }
+    return project;
+}
+export const defaultRunner = (command, args, cwd, env) => new Promise((resolve, reject) => {
+    const invocation = resolveCommand(command, args);
+    const child = spawn(invocation.command, invocation.args, {
+        cwd,
+        env,
+        detached: process.platform !== 'win32',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let output = '';
+    let oversized = false;
+    let interrupted = false;
+    let timedOut = false;
+    let forceTimer;
+    const kill = (signal) => {
+        if (!child.pid)
+            return;
+        if (process.platform === 'win32')
+            spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' });
+        else {
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch {
+                /* The process group already exited. */
+            }
+        }
+    };
+    const stop = () => {
+        kill('SIGTERM');
+        forceTimer ??= setTimeout(() => kill('SIGKILL'), 2000);
+        forceTimer.unref();
+    };
+    const interrupt = () => {
+        interrupted = true;
+        stop();
+    };
+    process.once('SIGINT', interrupt);
+    process.once('SIGTERM', interrupt);
+    child.stdout.on('data', (chunk) => {
+        if (!oversized)
+            output += chunk.toString();
+        if (output.length > 8 * 1024 * 1024) {
+            oversized = true;
+            stop();
+        }
+    });
+    // Do not persist raw build/provider output: it can contain credentials or customer data.
+    child.stderr.resume();
+    const timer = setTimeout(() => {
+        timedOut = true;
+        stop();
+    }, 20 * 60 * 1000);
+    const clean = () => {
+        clearTimeout(timer);
+        if (forceTimer)
+            clearTimeout(forceTimer);
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', interrupt);
+    };
+    child.on('error', () => {
+        clean();
+        reject(new Error(`Cannot run ${command}; check local tooling.`));
+    });
+    child.on('close', (code) => {
+        clean();
+        if (code === 0 && !oversized && !interrupted && !timedOut)
+            resolve(output);
+        else
+            reject(new Error(`${command} ${args.slice(0, 3).join(' ')} ${interrupted ? 'was interrupted' : timedOut ? 'timed out' : 'failed'}; inspect the project command locally.`));
+    });
+});
+export function environment(project) {
+    if (!project.accountId)
+        throw new Error('Connect the intended Cloudflare account first.');
+    if (process.env.CLOUDFLARE_ACCOUNT_ID && process.env.CLOUDFLARE_ACCOUNT_ID !== project.accountId)
+        throw new Error('Cloudflare environment account conflicts with the registered account.');
+    if (process.env.CLOUDFLARE_ENV)
+        throw new Error('Register a separate project configuration for the intended environment; CLOUDFLARE_ENV overrides are unsupported.');
+    return {
+        ...process.env,
+        CLOUDFLARE_ACCOUNT_ID: project.accountId,
+        CI: 'true',
+        NO_COLOR: '1',
+        FORCE_COLOR: '0',
+    };
+}
+export async function authenticate(root, project, run) {
+    const identity = JSON.parse(await run('pnpm', ['exec', 'wrangler', 'whoami', '--json'], targetDirectory(root, project.targets[0]), environment(project)));
+    if (identity.loggedIn !== true ||
+        !Array.isArray(identity.accounts) ||
+        !identity.accounts.some((account) => account.id === project.accountId))
+        throw new Error('Wrangler cannot access the registered Cloudflare account. Run wrangler login or configure scoped credentials.');
+}
+export async function withApplicationLock(root, operation) {
+    root = realpathSync(root);
+    const state = path.join(root, stateDirectory);
+    mkdirSync(state, { recursive: true });
+    if (realpathSync(state) !== path.join(root, stateDirectory))
+        throw new Error('Delivery state directory must not be a symbolic link.');
+    const lock = path.join(state, 'ship.lock');
+    try {
+        mkdirSync(lock);
+    }
+    catch {
+        throw new Error('Another delivery is running or was interrupted. Inspect provider status and remove .anhedral/ship.lock only after confirming no delivery is active.');
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        rmSync(lock, { recursive: true, force: true });
+    }
+}

package/dist/provider-readiness.d.ts

@@ -0,0 +1,30 @@
+import { type DeliveryRunner } from './project-state.js';
+/** Explicit opt-in: checks local tools and existing provider context without setup or deployment. */
+export declare function inspectProviderReadiness(root: string, run?: DeliveryRunner): Promise<{
+    prerequisiteChecks: {
+        id: string;
+        ok: boolean;
+        detail: string;
+        nextAction?: string;
+    }[];
+    prerequisitesReady: boolean;
+    providers: {
+        provider: "vercel" | "cloudflare";
+        connection: "verified" | "blocked";
+        deployment: "active-recorded" | "unverified";
+        nextAction?: string;
+    }[];
+    providerVerification: string;
+    connectionEvidence: string;
+    externalIntegrations: string;
+    productionReady: boolean;
+    mutation: boolean;
+    schemaVersion: number;
+    root: string;
+    checks: {
+        id: string;
+        ok: boolean;
+        detail: string;
+    }[];
+    localReady: boolean;
+}>;

package/dist/provider-readiness.js

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { inspectProject } from './readiness.js';
+import { defaultRunner } from './project-state.js';
+import { vercelApplicationStatus } from './vercel.js';
+import { applicationStatus } from './delivery.js';
+/** Explicit opt-in: checks local tools and existing provider context without setup or deployment. */
+export async function inspectProviderReadiness(root, run = defaultRunner) {
+    root = path.resolve(root);
+    const local = inspectProject(root);
+    const checks = [];
+    const environment = {
+        ...process.env,
+        CI: '1',
+        GH_PROMPT_DISABLED: '1',
+        GIT_TERMINAL_PROMPT: '0',
+        NO_COLOR: '1',
+    };
+    const check = async (id, operation, detail, nextAction) => {
+        try {
+            checks.push({ id, ok: await operation(), detail, nextAction });
+        }
+        catch {
+            checks.push({ id, ok: false, detail, nextAction });
+        }
+    };
+    const [major, minor] = process.versions.node.split('.').map(Number);
+    checks.push({
+        id: 'node',
+        ok: major > 22 || (major === 22 && minor >= 13),
+        detail: 'Generated framework apps require Node 22.13 or newer; the CLI itself supports older Node versions.',
+    });
+    await check('pnpm', async () => /^\d+\.\d+\.\d+/.test((await run('pnpm', ['--version'], root, environment)).trim()), 'pnpm is available', 'Install the project-pinned pnpm version.');
+    await check('git', async () => (await run('git', ['--version'], root, environment)).startsWith('git version '), 'Git is available', 'Install Git.');
+    await check('git-identity', async () => Boolean((await run('git', ['var', 'GIT_AUTHOR_IDENT'], root, environment)).trim()), 'Git author identity is configured; its value is not recorded', 'Configure your own Git name and email locally.');
+    await check('github', async () => {
+        if (process.env.GH_HOST && process.env.GH_HOST !== 'github.com')
+            return false;
+        const user = JSON.parse(await run('gh', ['api', 'user'], root, { ...environment, GH_HOST: 'github.com' }));
+        return typeof user.login === 'string' && /^[a-zA-Z0-9-]+$/.test(user.login);
+    }, 'GitHub CLI can identify its authenticated account', 'Complete gh auth login locally for the intended GitHub account.');
+    const providers = [];
+    for (const provider of ['vercel', 'cloudflare']) {
+        const file = path.join(root, provider === 'vercel' ? 'anhedral.web.json' : 'anhedral.project.json');
+        if (!existsSync(file))
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(file, 'utf8'));
+            const connected = provider === 'vercel' ? manifest.projectId && manifest.teamId : manifest.accountId;
+            if (!connected || manifest.audience === 'unconfigured')
+                throw new Error('unconfigured');
+            const status = provider === 'vercel'
+                ? await vercelApplicationStatus(root, true, run)
+                : await applicationStatus(root, true, run);
+            const active = 'activeRecordedVersion' in status
+                ? status.activeRecordedVersion === true
+                : status.provider.length > 0 &&
+                    status.provider.every((target) => target.activeRecordedVersion);
+            providers.push({
+                provider,
+                connection: 'verified',
+                deployment: active ? 'active-recorded' : 'unverified',
+            });
+        }
+        catch {
+            providers.push({
+                provider,
+                connection: 'blocked',
+                deployment: 'unverified',
+                nextAction: `Inspect ${path.basename(file)} and sign in to its recorded account. Connect an unconfigured app or run recover for a fresh clone; do not change the audience to bypass access checks.`,
+            });
+        }
+    }
+    return {
+        ...local,
+        prerequisiteChecks: checks,
+        prerequisitesReady: checks.every((item) => item.ok),
+        providers,
+        providerVerification: providers.length && providers.every((item) => item.connection === 'verified')
+            ? 'verified-existing-context'
+            : 'unverified',
+        connectionEvidence: 'Account, configuration and deployment context only; resource IDs and bindings require separate recovery/provisioning checks.',
+        externalIntegrations: 'Require separate actual service setup and product tests; this report does not inspect secrets or certify integrations.',
+        productionReady: false,
+        mutation: false,
+    };
+}

package/dist/provision.d.ts

@@ -0,0 +1,46 @@
+import { type DeliveryRunner } from './project-state.js';
+import { type CloudflareRequest } from './cloudflare.js';
+interface Resource {
+    kind: 'd1' | 'r2' | 'kv' | 'queue';
+    name: string;
+    id?: string;
+    target: string;
+    field?: (string | number)[];
+}
+export declare function planProvisioning(root: string): {
+    projectId: string;
+    accountId: string | null;
+    resources: Resource[];
+    externalIntegrations: string[];
+};
+export declare function provisionApplication(root: string, dryRun?: boolean, run?: DeliveryRunner, suppliedRequest?: CloudflareRequest): Promise<{
+    schemaVersion: number;
+    projectId: string;
+    accountId: string | null;
+    checkedAt: string;
+    resources: {
+        kind: string;
+        name: string;
+        id: string;
+        reused: boolean;
+    }[];
+    state: string;
+    externalIntegrations: string[];
+} | {
+    mutation: boolean;
+    projectId: string;
+    accountId: string | null;
+    resources: Resource[];
+    externalIntegrations: string[];
+}>;
+/** Reconcile committed identities against the customer account without creating resources or rewriting configuration. */
+export declare function inspectApplicationResources(root: string, request: CloudflareRequest): Promise<{
+    resources: {
+        kind: string;
+        name: string;
+        id: string;
+        target: string;
+    }[];
+    externalIntegrations: string[];
+}>;
+export {};