anhedral 0.8.5 → 0.9.0

package/dist/bin.js

@@ -1,5 +1,14 @@
 #!/usr/bin/env node
+import { runAdd, runRegistry } from './registry/commands.js';
+import { registerManagedApplication, stageManagedVersion, saveManagedVersion, deployManagedVersion, managedApplicationStatus, } from './managed-hosting.js';
+import { setupRepository } from './repository.js';
 import path from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { registerVercelApplication, connectVercelApplication, planVercelDelivery, shipVercelApplication, vercelApplicationStatus, verifyVercelApplication, rollbackVercelApplication, adoptVercelApplication, recoverVercelApplication, writeVercelOverview, } from './vercel.js';
+import { registerApplication, connectApplication, planDelivery, shipApplication, applicationStatus, verifyApplication, rollbackApplication, recoverApplication, } from './delivery.js';
+import { planProvisioning, provisionApplication } from './provision.js';
+import { writeManagementOverview } from './management.js';
+import { inspectProviderReadiness } from './provider-readiness.js';
 import { inspectProject } from './readiness.js';
 import { argv } from 'node:process';
 import { STANDARD_USAGE, parseStandardOptions, scaffoldStandardProject } from './standard.js';
@@ -16,12 +25,92 @@ async function main() {
         console.log(json ? JSON.stringify({ version: GENERATOR_VERSION }) : GENERATOR_VERSION);
         return;
     }
+    if (command === 'add') {
+        await runAdd(args);
+        return;
+    }
+    if (command === 'registry') {
+        await runRegistry(args, json);
+        return;
+    }
+    if (command === 'cloud') {
+        await runCloud(args);
+        return;
+    }
+    if (command === 'repository') {
+        if (args.includes('--help') || args.includes('-h')) {
+            console.log(STANDARD_USAGE);
+            return;
+        }
+        let owner;
+        let name;
+        let visibility = 'private';
+        let create = false;
+        const directories = [];
+        for (let index = 0; index < args.length; index++) {
+            const flag = args[index];
+            if (flag === '--json')
+                continue;
+            if (flag === '--create') {
+                create = true;
+                continue;
+            }
+            if (flag === '--owner' || flag === '--name' || flag === '--visibility') {
+                const value = args[++index];
+                if (!value || value.startsWith('-'))
+                    throw new Error('Missing repository option value.');
+                if (flag === '--owner') {
+                    if (owner)
+                        throw new Error('Specify one GitHub owner.');
+                    owner = value;
+                }
+                else if (flag === '--name') {
+                    if (name)
+                        throw new Error('Specify one repository name.');
+                    name = value;
+                }
+                else {
+                    if (!['private', 'public'].includes(value))
+                        throw new Error('Visibility must be private or public.');
+                    visibility = value;
+                }
+                continue;
+            }
+            if (flag.startsWith('-'))
+                throw new Error('Unknown repository option.');
+            directories.push(flag);
+        }
+        if (directories.length > 1)
+            throw new Error('Specify one application directory.');
+        console.log(JSON.stringify(await setupRepository(path.resolve(directories[0] ?? process.cwd()), {
+            owner,
+            name,
+            visibility,
+            create,
+        }), null, 2));
+        return;
+    }
+    if ([
+        'register',
+        'connect',
+        'provision',
+        'ship',
+        'status',
+        'manage',
+        'verify',
+        'rollback',
+        'adopt',
+        'recover',
+    ].includes(command ?? '')) {
+        await runDelivery(command, args);
+        return;
+    }
     if (command === 'doctor') {
-        runDoctor(args);
+        await runDoctor(args);
         return;
     }
     if (command !== 'new' && command !== 'init') {
-        throw new Error(`Unknown command: ${command}. Use new, init, doctor, --help, or --version.`);
+        throw new Error(`Unknown command: ${command}. Use new, init, registry, doctor, repository, cloud, register, connect, provision, ship, status, manage, verify, rollback, adopt, recover, --help, or --version.`);
     }
     if (args.some((arg) => ['--help', '-h'].includes(arg))) {
         console.log(json ? JSON.stringify({ usage: STANDARD_USAGE }) : STANDARD_USAGE);
@@ -31,13 +120,247 @@ async function main() {
     if (options)
         await scaffoldStandardProject(options);
 }
-function runDoctor(args) {
-    const positional = args.filter((arg) => arg !== '--json');
+async function runCloud(args) {
+    const [action, ...flags] = args;
+    if (!action || flags.includes('--help') || action === '--help') {
+        console.log('anhedral cloud register|stage|save|deploy|status [directory] [--artifact directory] [--version stage-id] [--audience private|public] [--json]');
+        return;
+    }
+    let artifact;
+    let version;
+    let audience = 'private';
+    const directories = [];
+    for (let index = 0; index < flags.length; index++) {
+        const flag = flags[index];
+        if (flag === '--json')
+            continue;
+        if ((flag === '--artifact' && action === 'stage') ||
+            (flag === '--version' && ['save', 'deploy'].includes(action)) ||
+            (flag === '--audience' && action === 'register')) {
+            const value = flags[++index];
+            if (!value || value.startsWith('-'))
+                throw new Error('Missing cloud option value.');
+            if (flag === '--artifact') {
+                if (artifact)
+                    throw new Error('Specify one artifact.');
+                artifact = value;
+            }
+            else if (flag === '--version') {
+                if (version)
+                    throw new Error('Specify one version.');
+                version = value;
+            }
+            else {
+                if (value !== 'private' && value !== 'public')
+                    throw new Error('Audience must be private or public.');
+                audience = value;
+            }
+            continue;
+        }
+        if (flag.startsWith('-'))
+            throw new Error('Unknown cloud option.');
+        directories.push(flag);
+    }
+    if (directories.length > 1)
+        throw new Error('Specify one application directory.');
+    const root = path.resolve(directories[0] ?? process.cwd());
+    let result;
+    if (action === 'register')
+        result = registerManagedApplication(root, audience);
+    else if (action === 'stage') {
+        if (!artifact)
+            throw new Error('Stage requires --artifact <complete-build-directory>.');
+        result = await stageManagedVersion(root, path.resolve(artifact));
+    }
+    else if (action === 'save' || action === 'deploy') {
+        if (!version)
+            throw new Error('Save/deploy requires --version <stage-id>.');
+        result = await (action === 'save'
+            ? saveManagedVersion(root, version)
+            : deployManagedVersion(root, version));
+    }
+    else if (action === 'status')
+        result = await managedApplicationStatus(root);
+    else
+        throw new Error('Unknown cloud action.');
+    console.log(JSON.stringify(result, null, 2));
+}
+async function runDelivery(command, args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        console.log(STANDARD_USAGE);
+        return;
+    }
+    const positional = [];
+    let account;
+    let audience;
+    const emails = [];
+    let releaseId;
+    let provider;
+    let scope;
+    let use;
+    let create = false;
+    let git = false;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === '--provider') {
+            const value = args[++index];
+            if (!['vercel', 'cloudflare'].includes(value) || provider)
+                throw new Error('Specify one provider: vercel or cloudflare.');
+            provider = value;
+            continue;
+        }
+        if (command === 'connect' && arg === '--scope') {
+            if (scope)
+                throw new Error('Specify one Vercel scope.');
+            scope = args[++index];
+            if (!scope || scope.startsWith('-'))
+                throw new Error('Missing Vercel scope.');
+            continue;
+        }
+        if (command === 'connect' && arg === '--use') {
+            const value = args[++index];
+            if (!['personal', 'commercial'].includes(value) || use)
+                throw new Error('Specify --use personal or commercial.');
+            use = value;
+            continue;
+        }
+        if (command === 'connect' && arg === '--git') {
+            git = true;
+            continue;
+        }
+        if (command === 'connect' && arg === '--create') {
+            create = true;
+            continue;
+        }
+        if (command === 'rollback' && arg === '--release') {
+            releaseId = args[++index];
+            if (!releaseId || releaseId.startsWith('-'))
+                throw new Error('Missing release ID.');
+            continue;
+        }
+        if (command === 'rollback' && arg === '--data-compatible')
+            continue;
+        if (arg === '--json' ||
+            (['ship', 'provision'].includes(command) && arg === '--dry-run') ||
+            (['status', 'manage', 'verify', 'rollback', 'adopt', 'recover'].includes(command) &&
+                arg === '--refresh') ||
+            (command === 'manage' && arg === '--local'))
+            continue;
+        if (command === 'connect' && arg === '--account') {
+            if (account)
+                throw new Error('Specify one account.');
+            account = args[++index];
+            if (!account || account.startsWith('-'))
+                throw new Error('Missing account ID.');
+            continue;
+        }
+        if (command === 'connect' &&
+            arg === '--audience' &&
+            ['public', 'private'].includes(args[index + 1])) {
+            audience = args[index + 1];
+            index++;
+            continue;
+        }
+        if (command === 'connect' && arg === '--allow-email') {
+            const email = args[++index];
+            if (!email || email.startsWith('-'))
+                throw new Error('Missing allowed email address.');
+            emails.push(email);
+            continue;
+        }
+        if (arg.startsWith('-'))
+            throw new Error(`Unknown ${command} option: ${arg}`);
+        positional.push(arg);
+    }
+    if (positional.length > 1)
+        throw new Error('Specify at most one application directory.');
+    const root = path.resolve(positional[0] ?? process.cwd());
+    let result;
+    const web = provider === 'vercel' ||
+        (provider !== 'cloudflare' &&
+            (existsSync(path.join(root, 'anhedral.web.json')) ||
+                (command === 'register' &&
+                    existsSync(path.join(root, 'anhedral.setup.json')) &&
+                    JSON.parse(readFileSync(path.join(root, 'anhedral.setup.json'), 'utf8')).hosting ===
+                        'vercel')));
+    if (web) {
+        if (account || emails.length)
+            throw new Error('Cloudflare account/member flags require --provider cloudflare.');
+        if (command === 'register')
+            result = registerVercelApplication(root);
+        else if (command === 'connect') {
+            if (!audience || !use)
+                throw new Error('Vercel connect requires --audience public|private and --use personal|commercial.');
+            result = await connectVercelApplication(root, { scope, audience, use, create, git });
+        }
+        else if (command === 'ship')
+            result = args.includes('--dry-run')
+                ? planVercelDelivery(root)
+                : await shipVercelApplication(root);
+        else if (command === 'adopt')
+            result = await adoptVercelApplication(root);
+        else if (command === 'recover')
+            result = await recoverVercelApplication(root);
+        else if (command === 'verify')
+            result = await verifyVercelApplication(root);
+        else if (command === 'rollback') {
+            if (!releaseId)
+                throw new Error('Rollback requires --release <recorded-id>.');
+            result = await rollbackVercelApplication(root, releaseId, args.includes('--data-compatible'));
+        }
+        else if (command === 'status')
+            result = await vercelApplicationStatus(root, args.includes('--refresh'));
+        else if (command === 'manage') {
+            const snapshot = await vercelApplicationStatus(root, !args.includes('--local'));
+            result = { file: writeVercelOverview(root, snapshot), evidence: snapshot.evidence };
+        }
+        else
+            throw new Error('Vercel project creation is handled by connect --create; Cloudflare resource provisioning requires --provider cloudflare.');
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (scope || use || create || git)
+        throw new Error('Vercel connect options require a Vercel web manifest or --provider vercel.');
+    if (command === 'register')
+        result = registerApplication(root);
+    else if (command === 'connect') {
+        result = await connectApplication(root, account, audience, undefined, emails);
+    }
+    else if (command === 'provision')
+        result = args.includes('--dry-run') ? planProvisioning(root) : await provisionApplication(root);
+    else if (command === 'ship')
+        result = args.includes('--dry-run') ? planDelivery(root) : await shipApplication(root);
+    else if (command === 'adopt')
+        throw new Error('Git deployment adoption requires --provider vercel.');
+    else if (command === 'recover')
+        result = await recoverApplication(root);
+    else if (command === 'verify')
+        result = await verifyApplication(root);
+    else if (command === 'rollback') {
+        if (!releaseId)
+            throw new Error('Rollback requires --release <recorded-id>.');
+        result = await rollbackApplication(root, releaseId, args.includes('--data-compatible'));
+    }
+    else if (command === 'manage') {
+        const snapshot = await applicationStatus(root, !args.includes('--local'));
+        result = { file: writeManagementOverview(root, snapshot), evidence: snapshot.evidence };
+    }
+    else
+        result = await applicationStatus(root, args.includes('--refresh'));
+    console.log(JSON.stringify(result, null, 2));
+}
+async function runDoctor(args) {
+    const positional = args.filter((arg) => arg !== '--json' && arg !== '--providers');
     if (positional.length > 1 || positional.some((arg) => arg.startsWith('-')))
-        throw new Error('Usage: anhedral doctor [directory] [--json]');
-    const report = inspectProject(path.resolve(positional[0] ?? process.cwd()));
+        throw new Error('Usage: anhedral doctor [directory] [--providers] [--json]');
+    const root = path.resolve(positional[0] ?? process.cwd());
+    const report = args.includes('--providers')
+        ? await inspectProviderReadiness(root)
+        : inspectProject(root);
     console.log(JSON.stringify(report, null, json ? 2 : undefined));
-    if (!report.localReady)
+    if (!report.localReady ||
+        ('prerequisitesReady' in report &&
+            (!report.prerequisitesReady || report.providerVerification !== 'verified-existing-context')))
         process.exitCode = 1;
 }
 function readOptions(command, args) {
@@ -56,9 +379,29 @@ try {
 }
 catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    const code = error instanceof PostCommitError ? 'POST_COMMIT_FAILED'
-        : command === 'doctor' ? 'INVALID_ARGUMENT'
-            : command === 'new' || command === 'init' ? 'GENERATION_FAILED' : 'UNKNOWN_COMMAND';
+    const code = error instanceof PostCommitError
+        ? 'POST_COMMIT_FAILED'
+        : [
+            'repository',
+            'register',
+            'connect',
+            'provision',
+            'ship',
+            'status',
+            'manage',
+            'verify',
+            'rollback',
+            'adopt',
+            'recover',
+        ].includes(command ?? '')
+            ? 'DELIVERY_FAILED'
+            : command === 'cloud'
+                ? 'HOSTING_FAILED'
+                : command === 'doctor'
+                    ? 'INVALID_ARGUMENT'
+                    : command === 'new' || command === 'init'
+                        ? 'GENERATION_FAILED'
+                        : 'UNKNOWN_COMMAND';
     console.error(json ? JSON.stringify({ error: message, code }) : `Error: ${message}`);
     process.exitCode = 1;
 }

package/dist/bounded-file.d.ts

@@ -0,0 +1,2 @@
+/** Reject devices, links and oversized or growing files before parsing local input. */
+export declare function readBoundedFile(filePath: string, maximumBytes: number): Buffer;

package/dist/bounded-file.js

@@ -0,0 +1,30 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from 'node:fs';
+/** Reject devices, links and oversized or growing files before parsing local input. */
+export function readBoundedFile(filePath, maximumBytes) {
+    const stat = lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`Input file must be a regular file: ${filePath}`);
+    const descriptor = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile())
+            throw new Error(`Input file must be a regular file: ${filePath}`);
+        if (opened.size > maximumBytes)
+            throw new Error(`Input file exceeds size limit: ${filePath}`);
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const chunk = Buffer.alloc(Math.min(8192, maximumBytes + 1 - total));
+            const length = readSync(descriptor, chunk, 0, chunk.length, null);
+            if (!length)
+                return Buffer.concat(chunks);
+            total += length;
+            if (total > maximumBytes)
+                throw new Error(`Input file exceeds size limit: ${filePath}`);
+            chunks.push(chunk.subarray(0, length));
+        }
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}

package/dist/capabilities.d.ts

@@ -1,52 +1,38 @@
-import type { StandardProduct } from './standard-products.js';
-import type { StandardOptions } from './standard.js';
-export interface Selection {
-    app?: boolean;
-    conflicts?: StandardProduct[];
-    requiresAny?: StandardProduct[];
-    requiresAll?: StandardProduct[];
-    workerBinding?: boolean;
-}
-export interface Capability {
-    purpose: string;
-    tools: string[];
-    access: string[];
-    credentials: string[];
-    resources: string[];
-    verify: string[];
-    selection: Selection;
-}
-/** Setup requirements describe unfinished starters; they never grant authority or claim readiness. */
+import type { StandardOptions, StandardProduct, SetupRequirements, StackSelection } from './registry/types.js';
+export type Capability = SetupRequirements & {
+    selection: StackSelection;
+};
 export declare const CAPABILITIES: Record<StandardProduct, Capability>;
-export declare function resolveStandardProducts(selected: Set<StandardProduct>, hosting: StandardOptions['hosting'], hostingSpecified: boolean): void;
 export declare const CAPABILITY_REGISTRY: {
     schemaVersion: number;
     cliVersion: string;
-    capabilities: Record<"next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", Capability>;
+    capabilities: Record<"realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", Capability>;
 };
-export declare function createSetupPlan(options: StandardOptions): {
+export declare function createSetupPlan(options: StandardOptions, registry?: import("./registry/resolve.js").ResolvedStackRegistry): {
     schemaVersion: number;
     cliVersion: string;
     registryVersion: number;
     standard: string;
     root: string;
-    products: ("next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
-    hosting: "cloudflare" | "vercel";
-    bootstrap: string[];
+    name: string;
+    products: ("realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+    hosting: import("./registry/types.js").Hosting;
+    registry: import("./registry/resolve.js").ResolvedStackRegistry;
+    bootstrap: ("pnpm" | "shadcn@4.21.4" | "dlx" | "init" | "--monorepo" | "--template" | "next")[];
     dryRun: boolean;
     setup: {
         tools: string[];
         access: string[];
         capabilities: {
-            status: "starter" | "planned";
+            selection: StackSelection;
+            status: "planned" | "starter";
             purpose: string;
-            tools: string[];
-            access: string[];
-            credentials: string[];
-            resources: string[];
-            verify: string[];
-            selection: Selection;
-            id: "next" | "expo" | "electron" | "wxt" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "realtime" | "queues" | "cron" | "workflows" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling";
+            tools: readonly string[];
+            access: readonly string[];
+            credentials: readonly string[];
+            resources: readonly string[];
+            verify: readonly string[];
+            id: "realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling";
         }[];
         completion: string[];
         resourcesProvisioned: boolean;