anhedral 0.8.5 → 0.9.0

package/dist/registry/commands.js

@@ -0,0 +1,99 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { addStackItems } from './add.js';
+import { buildSourceRegistry, loadSourceRegistry } from './remote.js';
+import { STACK_REGISTRY, getStackItem } from '../stack-registry.js';
+export async function runRegistry(args, json) {
+    if (args[0] === 'build') {
+        args = args.filter((arg) => arg !== '--json');
+        if (args.length !== 4 || args[2] !== '--output' || !args[1] || !args[3])
+            throw new Error('Use registry build <manifest> --output <registry.json>.');
+        const source = path.resolve(args[1]);
+        const output = path.resolve(args[3]);
+        if (source === output)
+            throw new Error('Registry output must differ from its authored manifest.');
+        const registry = buildSourceRegistry(source);
+        mkdirSync(path.dirname(output), { recursive: true });
+        writeFileSync(output, JSON.stringify(registry, null, 2) + '\n');
+        console.log(JSON.stringify({ output, items: registry.items.length }));
+        return;
+    }
+    const registryFlag = args.indexOf('--registry');
+    if (registryFlag >= 0) {
+        const source = args[registryFlag + 1];
+        if (!source || source.startsWith('-'))
+            throw new Error('Missing registry source.');
+        const positional = args.filter((arg, index) => index !== registryFlag && index !== registryFlag + 1 && arg !== '--json');
+        const registry = await loadSourceRegistry(source);
+        if (positional.length === 1 && positional[0] === 'list')
+            console.log(JSON.stringify(registry, null, 2));
+        else if (positional.length === 2 && positional[0] === 'view') {
+            const item = registry.registry.items.find((item) => item.name === positional[1]);
+            if (!item)
+                throw new Error('Unknown remote registry item.');
+            console.log(JSON.stringify({ source: registry.source, integrity: registry.integrity, item }, null, 2));
+        }
+        else
+            throw new Error('Use registry list|view [item] --registry <file|https-url>.');
+        return;
+    }
+    const positional = args.filter((arg) => arg !== '--json');
+    if (positional.includes('--help') || positional.includes('-h')) {
+        console.log('anhedral registry list|view [item] [--json]');
+        return;
+    }
+    if (positional.some((arg) => arg.startsWith('-')))
+        throw new Error('Unknown registry option.');
+    const [action = 'list', name, ...extra] = positional;
+    if (action === 'list' && !name && !extra.length) {
+        console.log(json
+            ? JSON.stringify(STACK_REGISTRY, null, 2)
+            : STACK_REGISTRY.items
+                .map((item) => `${item.name} (${item.type}) — ${item.description}`)
+                .join('\n'));
+        return;
+    }
+    if (action === 'view' && name && !extra.length) {
+        console.log(JSON.stringify(getStackItem(name), null, 2));
+        return;
+    }
+    throw new Error('Use registry list or registry view <item>.');
+}
+export async function runAdd(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        console.log('anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]');
+        return;
+    }
+    let source;
+    let integrity;
+    const positional = [];
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (['--dry-run', '--skip-install', '--json'].includes(arg))
+            continue;
+        if (arg === '--integrity') {
+            if (integrity || !args[index + 1] || !/^sha256-[A-Za-z0-9+/]{43}=$/.test(args[index + 1]))
+                throw new Error('Specify one SHA-256 registry integrity.');
+            integrity = args[++index];
+        }
+        else if (arg === '--registry') {
+            if (source || !args[index + 1] || args[index + 1].startsWith('-'))
+                throw new Error('Specify one registry source.');
+            source = args[++index];
+        }
+        else if (arg.startsWith('-'))
+            throw new Error('Unknown add option.');
+        else
+            positional.push(arg);
+    }
+    const [directory, ...items] = positional;
+    if (!directory || !items.length)
+        throw new Error('Use add <directory> <items...>.');
+    console.log(JSON.stringify(await addStackItems(path.resolve(directory), {
+        items,
+        registry: source,
+        integrity,
+        dryRun: args.includes('--dry-run'),
+        skipInstall: args.includes('--skip-install'),
+    }), null, 2));
+}

package/dist/registry/context.d.ts

@@ -0,0 +1,3 @@
+import type { RecipeContext, StandardOptions } from './types.js';
+export declare function createRecipeContext(root: string, options: StandardOptions): RecipeContext;
+export declare function createResolutionContext(selection: Pick<StandardOptions, 'products' | 'hosting'> & Partial<Pick<StandardOptions, 'name'>>): RecipeContext;

package/dist/registry/context.js

@@ -0,0 +1,21 @@
+export function createRecipeContext(root, options) {
+    const selected = new Set(options.products);
+    return {
+        root,
+        options,
+        has: (product) => selected.has(product),
+        runtimeApp: selected.has('hono') ? 'api' : 'web',
+        bindings: {},
+    };
+}
+export function createResolutionContext(selection) {
+    return createRecipeContext('', {
+        root: '',
+        name: selection.name ?? 'app',
+        skipInstall: true,
+        dryRun: true,
+        json: false,
+        initializeGit: false,
+        ...selection,
+    });
+}

package/dist/registry/options.d.ts

@@ -0,0 +1,2 @@
+import type { StandardOptions } from './types.js';
+export declare function parseStandardOptions(command: 'new' | 'init', args: readonly string[]): StandardOptions;

package/dist/registry/options.js

@@ -0,0 +1,65 @@
+import { resolveStandardProducts } from './resolve.js';
+import path from 'node:path';
+import { packageNameFromText } from '../render.js';
+import { STANDARD_PRODUCTS } from '../stack-registry.js';
+function readGitFlag(token, previous) {
+    const value = token === '--git';
+    if (previous !== undefined && value !== previous)
+        throw new Error('Conflicting Git options.');
+    return value;
+}
+function readHostingFlag(value, previous, specified) {
+    if (value !== 'cloudflare' && value !== 'vercel')
+        throw new Error('hosting must be cloudflare or vercel.');
+    if (specified && previous !== value)
+        throw new Error('Conflicting hosting options.');
+    return value;
+}
+function parseStandardFlags(remaining) {
+    const products = new Set();
+    let hosting = 'cloudflare';
+    let hostingSpecified = false;
+    let gitSpecified;
+    for (let index = 0; index < remaining.length; index++) {
+        const token = remaining[index];
+        if (['--skip-install', '--dry-run', '--json', '--verbose'].includes(token))
+            continue;
+        if (token === '--git' || token === '--no-git') {
+            gitSpecified = readGitFlag(token, gitSpecified);
+            continue;
+        }
+        if (token === '--hosting' || token.startsWith('--hosting=')) {
+            const value = token === '--hosting' ? remaining[++index] : token.slice('--hosting='.length);
+            hosting = readHostingFlag(value, hosting, hostingSpecified);
+            hostingSpecified = true;
+            continue;
+        }
+        const value = token.replace(/^--/, '');
+        if (!STANDARD_PRODUCTS.includes(value)) {
+            throw new Error(`Unknown standard product: ${token}. Select only required products.`);
+        }
+        products.add(value);
+    }
+    if (!hostingSpecified && products.has('next'))
+        hosting = 'vercel';
+    return { products, hosting, hostingSpecified, gitSpecified };
+}
+export function parseStandardOptions(command, args) {
+    const remaining = [...args];
+    const directory = command === 'new' ? remaining.shift() : process.cwd();
+    if (!directory || directory.startsWith('-'))
+        throw new Error('new requires a destination directory.');
+    const root = path.resolve(directory);
+    const { products, hosting, hostingSpecified, gitSpecified } = parseStandardFlags(remaining);
+    resolveStandardProducts(products, hosting, hostingSpecified);
+    return {
+        root,
+        name: packageNameFromText(path.basename(root)),
+        products: [...products].sort(),
+        hosting,
+        skipInstall: remaining.includes('--skip-install'),
+        dryRun: remaining.includes('--dry-run'),
+        json: remaining.includes('--json'),
+        initializeGit: gitSpecified ?? command === 'new',
+    };
+}

package/dist/registry/receipt.d.ts

@@ -0,0 +1,3 @@
+export declare function sourceFiles(root: string): Map<string, string>;
+export declare function recordScaffoldFiles(root: string): void;
+export declare function assertSafeTarget(root: string, relative: string): void;

package/dist/registry/receipt.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { json, readJson } from '../scaffold/files.js';
+const excluded = new Set([
+    '.pnpm-store',
+    '.artifacts',
+    '.git',
+    'node_modules',
+    '.next',
+    '.open-next',
+    '.wrangler',
+    '.turbo',
+    'dist',
+    '.output',
+    '.expo',
+    '.fallow',
+    '.anhedral',
+    '.anhedral.lock',
+    '.anhedral-txn',
+    'anhedral.registry.json',
+]);
+export function sourceFiles(root) {
+    const files = new Map();
+    const visit = (directory) => {
+        for (const entry of readdirSync(path.join(root, directory), { withFileTypes: true })) {
+            if (excluded.has(entry.name))
+                continue;
+            const relative = directory ? `${directory}/${entry.name}` : entry.name;
+            // Local credentials are never seeded into an addition transaction or fingerprint receipt.
+            if (/^(?:\.env|\.dev\.vars)(?:\.|$)/.test(entry.name) && !entry.name.endsWith('.example'))
+                continue;
+            if (entry.isSymbolicLink())
+                throw new Error(`Source symlinks are unsupported: ${relative}.`);
+            if (entry.isDirectory())
+                visit(relative);
+            else if (entry.isFile())
+                files.set(relative, createHash('sha256')
+                    .update(readFileSync(path.join(root, relative)))
+                    .digest('hex'));
+        }
+    };
+    visit('');
+    return files;
+}
+export function recordScaffoldFiles(root) {
+    const receipt = readJson(root, 'anhedral.registry.json');
+    json(root, 'anhedral.registry.json', {
+        ...receipt,
+        files: Object.fromEntries(sourceFiles(root)),
+    });
+}
+export function assertSafeTarget(root, relative) {
+    if (!relative ||
+        path.isAbsolute(relative) ||
+        relative.includes('\\') ||
+        relative
+            .split('/')
+            .some((part) => !part ||
+            part === '.' ||
+            part === '..' ||
+            part.includes(':') ||
+            /[\x00-\x1f]/.test(part) ||
+            /[. ]$/.test(part) ||
+            /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(part)))
+        throw new Error(`Unsafe registry target: ${relative}.`);
+    let current = root;
+    for (const part of relative.split('/')) {
+        current = path.join(current, part);
+        if (existsSync(current) && lstatSync(current).isSymbolicLink())
+            throw new Error(`Registry target traverses a symlink: ${relative}.`);
+    }
+}

package/dist/registry/remote.d.ts

@@ -0,0 +1,25 @@
+export interface SourceItem {
+    name: string;
+    version: string;
+    registryDependencies: string[];
+    files: {
+        target: string;
+        content: string;
+    }[];
+}
+export interface SourceRegistry {
+    schemaVersion: 1;
+    name: string;
+    items: SourceItem[];
+}
+export interface RemoteRegistry {
+    source: string;
+    integrity: string;
+    registry: SourceRegistry;
+}
+/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
+export declare function validateSourceRegistry(value: unknown): SourceRegistry;
+export declare function loadSourceRegistry(source: string, fetcher?: typeof fetch): Promise<RemoteRegistry>;
+export declare function resolveSourceItems(registry: SourceRegistry, selected: readonly string[]): SourceItem[];
+/** Compile repository-relative source paths into a distributable JSON payload. */
+export declare function buildSourceRegistry(manifestFile: string): SourceRegistry;

package/dist/registry/remote.js

@@ -0,0 +1,168 @@
+import { createHash } from 'node:crypto';
+import { readBoundedFile } from '../bounded-file.js';
+import path from 'node:path';
+import { dependencyOrder } from '../dependency-order.js';
+import { assertSafeTarget } from './receipt.js';
+const identifier = /^[a-z][a-z0-9-]{0,62}$/;
+const limit = 2 * 1024 * 1024;
+/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
+export function validateSourceRegistry(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Invalid source registry.');
+    const registry = value;
+    if (registry.schemaVersion !== 1 ||
+        typeof registry.name !== 'string' ||
+        !identifier.test(registry.name) ||
+        !Array.isArray(registry.items) ||
+        !registry.items.length ||
+        registry.items.length > 100)
+        throw new Error('Unsupported source registry schema.');
+    const names = new Set();
+    const files = new Set();
+    for (const item of registry.items) {
+        if (!item ||
+            typeof item.name !== 'string' ||
+            !identifier.test(item.name) ||
+            names.has(item.name) ||
+            typeof item.version !== 'string' ||
+            !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(item.version) ||
+            !Array.isArray(item.registryDependencies) ||
+            !item.registryDependencies.every((id) => typeof id === 'string' && identifier.test(id)) ||
+            !Array.isArray(item.files) ||
+            !item.files.length)
+            throw new Error('Invalid or duplicate source registry item.');
+        names.add(item.name);
+        for (const file of item.files) {
+            if (!file || typeof file.target !== 'string' || typeof file.content !== 'string')
+                throw new Error('Invalid registry file.');
+            assertSafeTarget('/registry-validation', file.target);
+            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.target) ||
+                file.target
+                    .split('/')
+                    .some((part) => part.startsWith('.') ||
+                    ['node_modules', 'dist', 'release', 'anhedral.registry.json'].includes(part)) ||
+                files.has(file.target))
+                throw new Error(`Unsafe or duplicate source target: ${file.target}.`);
+            files.add(file.target);
+            if (path.basename(file.target) === 'package.json') {
+                const manifest = JSON.parse(file.content);
+                if (!manifest ||
+                    typeof manifest !== 'object' ||
+                    Array.isArray(manifest) ||
+                    manifest.private !== true ||
+                    typeof manifest.name !== 'string' ||
+                    !/^@workspace\/[a-z][a-z0-9-]*$/.test(manifest.name))
+                    throw new Error('Remote workspace manifests must be private @workspace packages.');
+                if (manifest.scripts &&
+                    Object.keys(manifest.scripts).some((key) => /^(?:preinstall|install|postinstall|preprepare|prepare|postprepare|prepublish|prepublishOnly|pnpm:devPreinstall)$/.test(key)))
+                    throw new Error('Remote installation hooks are unsupported.');
+                for (const field of [
+                    'dependencies',
+                    'devDependencies',
+                    'optionalDependencies',
+                    'peerDependencies',
+                ]) {
+                    if (manifest[field] &&
+                        (typeof manifest[field] !== 'object' ||
+                            Array.isArray(manifest[field]) ||
+                            Object.values(manifest[field]).some((version) => typeof version !== 'string' ||
+                                !/^(?:workspace:[*^~]|[~^]?\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?)$/.test(version))))
+                        throw new Error('Remote dependencies require versioned npm or workspace references.');
+                }
+            }
+        }
+    }
+    dependencyOrder(new Map(registry.items.map((item) => [item.name, item.registryDependencies])), 'Remote registry');
+    return structuredClone(registry);
+}
+export async function loadSourceRegistry(source, fetcher = fetch) {
+    let bytes;
+    if (/^https?:/.test(source)) {
+        const url = new URL(source);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            url.search ||
+            !/^[a-z0-9.-]+$/i.test(url.hostname) ||
+            url.hostname === 'localhost' ||
+            !url.hostname.includes('.') ||
+            /^\d+(?:\.\d+){3}$/.test(url.hostname))
+            throw new Error('Remote registries require a public HTTPS URL without credentials or query parameters.');
+        const response = await fetcher(url, { redirect: 'error', signal: AbortSignal.timeout(15_000) });
+        if (!response.ok || !response.body)
+            throw new Error('Cannot retrieve source registry.');
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const result = await reader.read();
+                if (result.done)
+                    break;
+                size += result.value.byteLength;
+                if (size > limit)
+                    throw new Error('Source registry exceeds 2 MiB.');
+                chunks.push(result.value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        bytes = Buffer.concat(chunks);
+        source = url.href;
+    }
+    else {
+        source = path.resolve(source);
+        bytes = readBoundedFile(source, limit);
+    }
+    if (bytes.length > limit)
+        throw new Error('Source registry exceeds 2 MiB.');
+    return {
+        source,
+        integrity: `sha256-${createHash('sha256').update(bytes).digest('base64')}`,
+        registry: validateSourceRegistry(JSON.parse(bytes.toString('utf8'))),
+    };
+}
+export function resolveSourceItems(registry, selected) {
+    const catalog = new Map(registry.items.map((item) => [item.name, item]));
+    const graph = new Map();
+    const collect = (name) => {
+        if (graph.has(name))
+            return;
+        const item = catalog.get(name);
+        if (!item)
+            throw new Error(`Unknown remote registry item: ${name}.`);
+        graph.set(name, item.registryDependencies);
+        item.registryDependencies.forEach(collect);
+    };
+    selected.forEach(collect);
+    return dependencyOrder(graph, 'Remote registry').map((name) => catalog.get(name));
+}
+/** Compile repository-relative source paths into a distributable JSON payload. */
+export function buildSourceRegistry(manifestFile) {
+    const root = path.dirname(path.resolve(manifestFile));
+    const registry = JSON.parse(readBoundedFile(manifestFile, limit).toString('utf8'));
+    if (!Array.isArray(registry.items))
+        throw new Error('Invalid source registry manifest.');
+    for (const item of registry.items) {
+        if (!Array.isArray(item.files))
+            throw new Error('Invalid registry file list.');
+        for (const file of item.files) {
+            if (file.path === undefined)
+                continue;
+            if (typeof file.path !== 'string' || file.content !== undefined)
+                throw new Error('Declare one source path or embedded content.');
+            assertSafeTarget(root, file.path);
+            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.path) ||
+                file.path.split('/').some((part) => part.startsWith('.') || part === 'node_modules'))
+                throw new Error('Registry source paths must stay in application or package source.');
+            const source = path.join(root, file.path);
+            file.content = readBoundedFile(source, limit).toString('utf8');
+            delete file.path;
+        }
+    }
+    if (Buffer.byteLength(JSON.stringify(registry)) > limit)
+        throw new Error('Source registry exceeds 2 MiB.');
+    return validateSourceRegistry(registry);
+}

package/dist/registry/resolve.d.ts

@@ -0,0 +1,10 @@
+import type { Hosting, StandardOptions, StandardProduct, StackRegistryItem } from './types.js';
+/** Apply default selections once. All callers then use the same strict graph resolver. */
+export declare function resolveStandardProducts(selected: Set<StandardProduct>, hosting: Hosting, hostingSpecified: boolean): void;
+export interface ResolvedStackRegistry {
+    schemaVersion: number;
+    name: string;
+    cliVersion: string;
+    items: StackRegistryItem[];
+}
+export declare function resolveStackRegistry(options: Pick<StandardOptions, 'products' | 'hosting'> & Partial<Pick<StandardOptions, 'name'>>): ResolvedStackRegistry;

package/dist/registry/resolve.js

@@ -0,0 +1,98 @@
+import { dependencyOrder } from '../dependency-order.js';
+import { STANDARD_PRODUCTS, STACK_REGISTRY, getStackDefinition, getStackItem, } from '../stack-registry.js';
+import { createResolutionContext } from './context.js';
+function hasServer(context) {
+    return context.has('hono') || context.has('vinext') || context.has('next');
+}
+function needsWorker(name, context) {
+    const definition = getStackDefinition(name);
+    return (definition.runtime === 'worker' ||
+        (definition.runtime === 'optional-worker' && hasServer(context)));
+}
+function validateProducts(selected, hosting) {
+    if (!['cloudflare', 'vercel'].includes(hosting))
+        throw new Error('hosting must be cloudflare or vercel.');
+    for (const id of selected) {
+        if (!STANDARD_PRODUCTS.includes(id))
+            throw new Error(`Unknown stack product: ${id}.`);
+        const { conflicts = [], requiresAny = [], requiresAll = [] } = getStackDefinition(id).selection;
+        const conflict = conflicts.find((other) => selected.has(other));
+        if (conflict)
+            throw new Error(`Choose one of ${id} / ${conflict}.`);
+        if (requiresAny.length && !requiresAny.some((other) => selected.has(other)))
+            throw new Error(`${id} requires an explicitly selected ${requiresAny.join(' or ')} capability.`);
+        const missing = requiresAll.filter((other) => !selected.has(other));
+        if (missing.length)
+            throw new Error(`${id} requires ${missing.join(', ')}; select it explicitly.`);
+    }
+    if (selected.has('vinext') && hosting !== 'cloudflare')
+        throw new Error('Vinext requires Cloudflare hosting; select --next for Vercel.');
+}
+/** Apply default selections once. All callers then use the same strict graph resolver. */
+export function resolveStandardProducts(selected, hosting, hostingSpecified) {
+    for (const id of selected)
+        getStackDefinition(id);
+    if (![...selected].some((id) => getStackDefinition(id).type === 'application'))
+        selected.add(hosting === 'vercel' ? 'next' : 'vinext');
+    for (const id of selected) {
+        const definition = getStackDefinition(id);
+        const alternatives = definition.selection.requiresAny ?? [];
+        if (definition.fallbackDependency &&
+            !alternatives.some((other) => selected.has(other)))
+            selected.add(definition.fallbackDependency);
+    }
+    const context = createResolutionContext({ products: [...selected], hosting });
+    if (context.has('next') &&
+        hosting === 'vercel' &&
+        [...selected].some((id) => needsWorker(id, context)))
+        selected.add('hono');
+    if (hostingSpecified && !selected.has('next') && !selected.has('vinext'))
+        throw new Error('--hosting applies to the web application.');
+    resolveStackRegistry({ products: [...selected], hosting });
+}
+export function resolveStackRegistry(options) {
+    const selected = new Set(options.products);
+    validateProducts(selected, options.hosting);
+    if (![...selected].some((id) => getStackDefinition(id).type === 'application'))
+        throw new Error('Stack registry requires an application.');
+    const context = createResolutionContext(options);
+    const resolved = new Map();
+    const collect = (name) => {
+        if (resolved.has(name))
+            return;
+        const definition = getStackDefinition(name);
+        const metadata = getStackItem(name);
+        const dependencies = new Set(definition.registryDependencies);
+        if (definition.runtime) {
+            if (!hasServer(context) && definition.runtime !== 'optional-worker')
+                throw new Error(`${name} requires a server runtime.`);
+            if (needsWorker(name, context) &&
+                !context.has('hono') &&
+                !(options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
+                throw new Error(`${name} requires a Cloudflare runtime.`);
+            if (hasServer(context))
+                dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
+        }
+        for (const dependency of definition.resolveDependencies?.(context) ?? [])
+            dependencies.add(dependency);
+        metadata.registryDependencies = [...dependencies];
+        metadata.targets = definition.resolveTargets?.(context) ?? metadata.targets;
+        if (definition.configure)
+            metadata.bindings = definition.configure(context);
+        if (definition.package)
+            metadata.package =
+                definition.resolvePackage?.(context, definition.package) ?? definition.package;
+        resolved.set(name, metadata);
+        for (const dependency of dependencies)
+            collect(dependency);
+    };
+    for (const name of ['workspace', 'typescript', 'eslint', ...[...selected].sort()])
+        collect(name);
+    const graph = new Map([...resolved].map(([name, item]) => [name, item.registryDependencies]));
+    return {
+        schemaVersion: STACK_REGISTRY.schemaVersion,
+        name: STACK_REGISTRY.name,
+        cliVersion: STACK_REGISTRY.cliVersion,
+        items: dependencyOrder(graph, 'Stack registry').map((name) => resolved.get(name)),
+    };
+}

package/dist/registry/types.d.ts

@@ -0,0 +1,64 @@
+import type { StandardProduct } from '../stack-registry.js';
+import type { Json } from '../scaffold/files.js';
+export type { StandardProduct } from '../stack-registry.js';
+export type Hosting = 'cloudflare' | 'vercel';
+export interface StandardOptions {
+    root: string;
+    name: string;
+    products: StandardProduct[];
+    hosting: Hosting;
+    skipInstall: boolean;
+    dryRun: boolean;
+    json: boolean;
+    initializeGit: boolean;
+}
+export type StandardRunner = (command: string, args: string[], cwd: string) => void;
+export interface StackSelection {
+    conflicts?: readonly string[];
+    requiresAny?: readonly string[];
+    requiresAll?: readonly string[];
+}
+export interface SetupRequirements {
+    purpose: string;
+    tools: readonly string[];
+    access: readonly string[];
+    credentials: readonly string[];
+    resources: readonly string[];
+    verify: readonly string[];
+}
+export interface RecipeContext {
+    root: string;
+    options: StandardOptions;
+    runtimeApp: 'api' | 'web';
+    bindings: Json;
+    has: (product: string) => boolean;
+}
+export type Recipe = (context: RecipeContext) => void | Promise<void>;
+export interface PackageRecipe {
+    name: string;
+    source: string;
+    dependencies: Record<string, string>;
+}
+export interface StackRegistryItem {
+    name: string;
+    version: string;
+    type: 'foundation' | 'application' | 'service' | 'package' | 'integration';
+    description: string;
+    registryDependencies: readonly string[];
+    targets: readonly string[];
+    selection: StackSelection;
+    installer: 'bootstrap' | 'recipe' | 'configuration';
+    runtime?: 'server' | 'worker' | 'optional-worker';
+    environment: readonly string[];
+    setup?: SetupRequirements;
+    package?: PackageRecipe;
+    bindings?: Json;
+}
+export interface ItemDefinition extends Omit<StackRegistryItem, 'bindings'> {
+    install?: Recipe;
+    configure?: (context: RecipeContext) => Json;
+    resolveTargets?: (context: RecipeContext) => string[];
+    resolvePackage?: (context: RecipeContext, recipe: PackageRecipe) => PackageRecipe;
+    resolveDependencies?: (context: RecipeContext) => string[];
+    fallbackDependency?: string;
+}

package/dist/registry/usage.d.ts

@@ -0,0 +1 @@
+export declare const STANDARD_USAGE: string;