anhedral 0.8.6 → 0.10.0

package/dist/provider-readiness.d.ts

@@ -0,0 +1,30 @@
+import { type DeliveryRunner } from './project-state.js';
+/** Explicit opt-in: checks local tools and existing provider context without setup or deployment. */
+export declare function inspectProviderReadiness(root: string, run?: DeliveryRunner): Promise<{
+    prerequisiteChecks: {
+        id: string;
+        ok: boolean;
+        detail: string;
+        nextAction?: string;
+    }[];
+    prerequisitesReady: boolean;
+    providers: {
+        provider: "vercel" | "cloudflare";
+        connection: "verified" | "blocked";
+        deployment: "active-recorded" | "unverified";
+        nextAction?: string;
+    }[];
+    providerVerification: string;
+    connectionEvidence: string;
+    externalIntegrations: string;
+    productionReady: boolean;
+    mutation: boolean;
+    schemaVersion: number;
+    root: string;
+    checks: {
+        id: string;
+        ok: boolean;
+        detail: string;
+    }[];
+    localReady: boolean;
+}>;

package/dist/provider-readiness.js

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { inspectProject } from './readiness.js';
+import { defaultRunner } from './project-state.js';
+import { vercelApplicationStatus } from './vercel.js';
+import { applicationStatus } from './delivery.js';
+/** Explicit opt-in: checks local tools and existing provider context without setup or deployment. */
+export async function inspectProviderReadiness(root, run = defaultRunner) {
+    root = path.resolve(root);
+    const local = inspectProject(root);
+    const checks = [];
+    const environment = {
+        ...process.env,
+        CI: '1',
+        GH_PROMPT_DISABLED: '1',
+        GIT_TERMINAL_PROMPT: '0',
+        NO_COLOR: '1',
+    };
+    const check = async (id, operation, detail, nextAction) => {
+        try {
+            checks.push({ id, ok: await operation(), detail, nextAction });
+        }
+        catch {
+            checks.push({ id, ok: false, detail, nextAction });
+        }
+    };
+    const [major, minor] = process.versions.node.split('.').map(Number);
+    checks.push({
+        id: 'node',
+        ok: major > 22 || (major === 22 && minor >= 13),
+        detail: 'Generated framework apps require Node 22.13 or newer; the CLI itself supports older Node versions.',
+    });
+    await check('pnpm', async () => /^\d+\.\d+\.\d+/.test((await run('pnpm', ['--version'], root, environment)).trim()), 'pnpm is available', 'Install the project-pinned pnpm version.');
+    await check('git', async () => (await run('git', ['--version'], root, environment)).startsWith('git version '), 'Git is available', 'Install Git.');
+    await check('git-identity', async () => Boolean((await run('git', ['var', 'GIT_AUTHOR_IDENT'], root, environment)).trim()), 'Git author identity is configured; its value is not recorded', 'Configure your own Git name and email locally.');
+    await check('github', async () => {
+        if (process.env.GH_HOST && process.env.GH_HOST !== 'github.com')
+            return false;
+        const user = JSON.parse(await run('gh', ['api', 'user'], root, { ...environment, GH_HOST: 'github.com' }));
+        return typeof user.login === 'string' && /^[a-zA-Z0-9-]+$/.test(user.login);
+    }, 'GitHub CLI can identify its authenticated account', 'Complete gh auth login locally for the intended GitHub account.');
+    const providers = [];
+    for (const provider of ['vercel', 'cloudflare']) {
+        const file = path.join(root, provider === 'vercel' ? 'anhedral.web.json' : 'anhedral.project.json');
+        if (!existsSync(file))
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(file, 'utf8'));
+            const connected = provider === 'vercel' ? manifest.projectId && manifest.teamId : manifest.accountId;
+            if (!connected || manifest.audience === 'unconfigured')
+                throw new Error('unconfigured');
+            const status = provider === 'vercel'
+                ? await vercelApplicationStatus(root, true, run)
+                : await applicationStatus(root, true, run);
+            const active = 'activeRecordedVersion' in status
+                ? status.activeRecordedVersion === true
+                : status.provider.length > 0 &&
+                    status.provider.every((target) => target.activeRecordedVersion);
+            providers.push({
+                provider,
+                connection: 'verified',
+                deployment: active ? 'active-recorded' : 'unverified',
+            });
+        }
+        catch {
+            providers.push({
+                provider,
+                connection: 'blocked',
+                deployment: 'unverified',
+                nextAction: `Inspect ${path.basename(file)} and sign in to its recorded account. Connect an unconfigured app or run recover for a fresh clone; do not change the audience to bypass access checks.`,
+            });
+        }
+    }
+    return {
+        ...local,
+        prerequisiteChecks: checks,
+        prerequisitesReady: checks.every((item) => item.ok),
+        providers,
+        providerVerification: providers.length && providers.every((item) => item.connection === 'verified')
+            ? 'verified-existing-context'
+            : 'unverified',
+        connectionEvidence: 'Account, configuration and deployment context only; resource IDs and bindings require separate recovery/provisioning checks.',
+        externalIntegrations: 'Require separate actual service setup and product tests; this report does not inspect secrets or certify integrations.',
+        productionReady: false,
+        mutation: false,
+    };
+}

package/dist/provision.d.ts

@@ -0,0 +1,46 @@
+import { type DeliveryRunner } from './project-state.js';
+import { type CloudflareRequest } from './cloudflare.js';
+interface Resource {
+    kind: 'd1' | 'r2' | 'kv' | 'queue';
+    name: string;
+    id?: string;
+    target: string;
+    field?: (string | number)[];
+}
+export declare function planProvisioning(root: string): {
+    projectId: string;
+    accountId: string | null;
+    resources: Resource[];
+    externalIntegrations: string[];
+};
+export declare function provisionApplication(root: string, dryRun?: boolean, run?: DeliveryRunner, suppliedRequest?: CloudflareRequest): Promise<{
+    schemaVersion: number;
+    projectId: string;
+    accountId: string | null;
+    checkedAt: string;
+    resources: {
+        kind: string;
+        name: string;
+        id: string;
+        reused: boolean;
+    }[];
+    state: string;
+    externalIntegrations: string[];
+} | {
+    mutation: boolean;
+    projectId: string;
+    accountId: string | null;
+    resources: Resource[];
+    externalIntegrations: string[];
+}>;
+/** Reconcile committed identities against the customer account without creating resources or rewriting configuration. */
+export declare function inspectApplicationResources(root: string, request: CloudflareRequest): Promise<{
+    resources: {
+        kind: string;
+        name: string;
+        id: string;
+        target: string;
+    }[];
+    externalIntegrations: string[];
+}>;
+export {};

package/dist/provision.js

@@ -0,0 +1,197 @@
+import { readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { applyEdits, modify } from 'jsonc-parser';
+import { atomicJson, authenticate, defaultRunner, environment, readApplication, readConfig, targetDirectory, withApplicationLock, } from './project-state.js';
+import { cloudflareRequest, listCloudflare } from './cloudflare.js';
+const resourceTypes = {
+    d1: { endpoint: '/d1/database', nameField: 'name', idField: 'uuid' },
+    r2: { endpoint: '/r2/buckets', nameField: 'name', idField: 'name' },
+    kv: { endpoint: '/storage/kv/namespaces', nameField: 'title', idField: 'id' },
+    queue: { endpoint: '/queues', nameField: 'queue_name', idField: 'queue_id' },
+};
+async function listResources(request, kind) {
+    const { endpoint } = resourceTypes[kind];
+    if (kind !== 'r2')
+        return listCloudflare(request, endpoint);
+    const value = (await request('GET', endpoint)).result;
+    if (!Array.isArray(value?.buckets) || value.truncated)
+        throw new Error('Unsupported or truncated R2 bucket listing; select resources explicitly with provider tooling.');
+    return value.buckets;
+}
+/** Provisioning and recovery use the same independently verified private-storage policy. */
+async function assertPrivateBucket(request, name) {
+    const endpoint = `${resourceTypes.r2.endpoint}/${encodeURIComponent(name)}/domains`;
+    const managed = (await request('GET', `${endpoint}/managed`)).result;
+    const custom = (await request('GET', `${endpoint}/custom`)).result;
+    if (managed?.enabled !== false ||
+        !Array.isArray(custom?.domains) ||
+        custom.domains.some((domain) => domain.enabled !== false))
+        throw new Error('Selected R2 bucket has public or unknown domain access; resolve it before using private storage.');
+}
+function resourceName(value) {
+    if (typeof value !== 'string' || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value))
+        throw new Error('Resources require explicit lowercase names of at most 63 characters.');
+    return value;
+}
+export function planProvisioning(root) {
+    const project = readApplication(root);
+    const resources = [];
+    for (const target of project.targets) {
+        const config = readConfig(targetDirectory(root, target));
+        if ((config.env && Object.keys(config.env).length) ||
+            (config.account_id && config.account_id !== project.accountId))
+            throw new Error('Reconcile target account/environment before provisioning.');
+        for (const [kind, field] of [
+            ['d1', 'd1_databases'],
+            ['r2', 'r2_buckets'],
+            ['kv', 'kv_namespaces'],
+        ]) {
+            const entries = config[field];
+            if (entries === undefined)
+                continue;
+            if (!Array.isArray(entries))
+                throw new Error(`Invalid ${field} configuration.`);
+            entries.forEach((entry, index) => {
+                if (!entry || typeof entry.binding !== 'string' || entry.jurisdiction)
+                    throw new Error('Use an explicit provider workflow for jurisdiction-specific resources.');
+                const name = resourceName(kind === 'd1'
+                    ? entry.database_name
+                    : kind === 'r2'
+                        ? entry.bucket_name
+                        : (entry.anhedral_name ?? `${project.name}-${entry.binding.toLowerCase()}`));
+                const id = kind === 'd1' ? entry.database_id : kind === 'kv' ? entry.id : undefined;
+                resources.push({
+                    kind,
+                    name,
+                    target: target.id,
+                    id: typeof id === 'string' && !id.startsWith('REPLACE_WITH_') ? id : undefined,
+                    field: kind === 'r2' ? undefined : [field, index, kind === 'd1' ? 'database_id' : 'id'],
+                });
+            });
+        }
+        const queues = config.queues;
+        for (const entry of [...(queues?.producers ?? []), ...(queues?.consumers ?? [])]) {
+            resources.push({ kind: 'queue', name: resourceName(entry.queue), target: target.id });
+            if ('dead_letter_queue' in entry && entry.dead_letter_queue)
+                resources.push({
+                    kind: 'queue',
+                    name: resourceName(entry.dead_letter_queue),
+                    target: target.id,
+                });
+        }
+    }
+    return {
+        projectId: project.id,
+        accountId: project.accountId,
+        resources,
+        externalIntegrations: ['hyperdrive', 'pipelines'].filter((key) => project.targets.some((target) => key in readConfig(targetDirectory(root, target)))),
+    };
+}
+export async function provisionApplication(root, dryRun = false, run = defaultRunner, suppliedRequest) {
+    root = realpathSync(root);
+    const plan = planProvisioning(root);
+    if (dryRun)
+        return { ...plan, mutation: false };
+    return withApplicationLock(root, async () => {
+        const project = readApplication(root);
+        const plan = planProvisioning(root);
+        const configured = new Map(project.targets.map((target) => {
+            const file = path.join(targetDirectory(root, target), 'wrangler.jsonc');
+            return [file, readFileSync(file, 'utf8')];
+        }));
+        const assertConfiguration = () => {
+            if (JSON.stringify(readApplication(root)) !== JSON.stringify(project) ||
+                [...configured].some(([file, content]) => readFileSync(file, 'utf8') !== content))
+                throw new Error('Configuration changed during provisioning; inspect resource receipts before retrying.');
+        };
+        await authenticate(root, project, run);
+        const request = suppliedRequest ??
+            (await cloudflareRequest(project, targetDirectory(root, project.targets[0]), run, environment(project)));
+        const receipts = [];
+        const resources = new Map();
+        for (const resource of plan.resources) {
+            assertConfiguration();
+            const key = `${resource.kind}:${resource.name}`;
+            let receipt = resources.get(key);
+            if (!receipt) {
+                const { endpoint, nameField, idField } = resourceTypes[resource.kind];
+                const existing = await listResources(request, resource.kind);
+                const matches = existing.filter((item) => item[nameField] === resource.name);
+                if (matches.length > 1)
+                    throw new Error('Ambiguous provider resource name.');
+                let value = matches[0];
+                const reused = !!value;
+                if (resource.id && (!value || value[idField] !== resource.id))
+                    throw new Error('Configured resource ID does not match its account/name; no replacement was created.');
+                assertConfiguration();
+                if (!value)
+                    value = (await request('POST', endpoint, { [nameField]: resource.name }))
+                        .result;
+                if (!value || typeof value[idField] !== 'string' || !value[idField])
+                    throw new Error('Provider did not return a resource identity; inspect provider state before retrying.');
+                receipt = {
+                    kind: resource.kind,
+                    name: resource.name,
+                    id: value[idField],
+                    reused,
+                };
+                resources.set(key, receipt);
+                receipts.push(receipt);
+                // Save identities immediately: a subsequent operation can fail without losing creation evidence.
+                atomicJson(path.join(root, '.anhedral/resources.json'), {
+                    schemaVersion: 1,
+                    projectId: project.id,
+                    accountId: project.accountId,
+                    checkedAt: new Date().toISOString(),
+                    resources: receipts,
+                    state: 'reconciling',
+                });
+                if (resource.kind === 'r2')
+                    await assertPrivateBucket(request, resource.name);
+            }
+            assertConfiguration();
+            if (resource.id && receipt.id !== resource.id)
+                throw new Error('Targets disagree about a shared resource ID.');
+            if (resource.field) {
+                const target = project.targets.find((item) => item.id === resource.target);
+                const file = path.join(targetDirectory(root, target), 'wrangler.jsonc');
+                const before = readFileSync(file, 'utf8');
+                const after = applyEdits(before, modify(before, resource.field, receipt.id, {
+                    formattingOptions: { insertSpaces: true, tabSize: 2 },
+                }));
+                writeFileSync(file, after);
+                configured.set(file, after);
+            }
+        }
+        const result = {
+            schemaVersion: 1,
+            projectId: project.id,
+            accountId: project.accountId,
+            checkedAt: new Date().toISOString(),
+            resources: receipts,
+            state: 'reconciled',
+            externalIntegrations: plan.externalIntegrations,
+        };
+        atomicJson(path.join(root, '.anhedral/resources.json'), result);
+        return result;
+    });
+}
+/** Reconcile committed identities against the customer account without creating resources or rewriting configuration. */
+export async function inspectApplicationResources(root, request) {
+    const plan = planProvisioning(root);
+    const receipts = [];
+    for (const resource of plan.resources) {
+        const { nameField, idField } = resourceTypes[resource.kind];
+        const existing = await listResources(request, resource.kind);
+        const matches = existing.filter((item) => item[nameField] === resource.name);
+        if (matches.length !== 1 || typeof matches[0][idField] !== 'string' || !matches[0][idField])
+            throw new Error('Committed resource is missing or ambiguous in the registered account.');
+        const id = matches[0][idField];
+        if ((resource.field && !resource.id) || (resource.id && resource.id !== id))
+            throw new Error('Committed resource identity differs from the registered account; recovery will not replace it.');
+        if (resource.kind === 'r2')
+            await assertPrivateBucket(request, resource.name);
+        receipts.push({ kind: resource.kind, name: resource.name, id, target: resource.target });
+    }
+    return { resources: receipts, externalIntegrations: plan.externalIntegrations };
+}

package/dist/readiness.d.ts

@@ -1,4 +1,5 @@
-import { type StandardProduct } from './standard-products.js';
+import type { ResolvedStackRegistry } from './registry/resolve.js';
+import { type StandardProduct } from './stack-registry.js';
 export declare function inspectProject(root: string): {
     schemaVersion: number;
     root: string;
@@ -17,5 +18,6 @@ export declare function validateSetupPlan(plan: unknown): asserts plan is {
     registryVersion: 1;
     products: StandardProduct[];
     hosting: 'cloudflare' | 'vercel';
-    layout?: 'workspace' | 'single';
+    name?: string;
+    registry: ResolvedStackRegistry;
 };

package/dist/readiness.js

@@ -1,52 +1,100 @@
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { CAPABILITY_REGISTRY, resolveStandardProducts } from './capabilities.js';
-import { STANDARD_PRODUCTS } from './standard-products.js';
+import { isDeepStrictEqual } from 'node:util';
+import { inspectWorkspaceGraph } from './workspace-graph.js';
+import { resolveStackRegistry, resolveStandardProducts } from './registry/resolve.js';
+import { CAPABILITY_REGISTRY } from './capabilities.js';
+import { STANDARD_PRODUCTS } from './stack-registry.js';
 export function inspectProject(root) {
     const checks = [];
     const record = (id, ok, detail) => checks.push({ id, ok, detail });
     const read = (file) => JSON.parse(readFileSync(path.join(root, file), 'utf8'));
+    record('workspace', existsSync(path.join(root, 'pnpm-workspace.yaml')), 'pnpm workspace manifest');
     record('lockfile', existsSync(path.join(root, 'pnpm-lock.yaml')), 'Committed dependency resolution required');
     try {
         const plan = read('anhedral.setup.json');
         validateSetupPlan(plan);
         const standard = read('anhedral.standard.json');
-        const layout = plan.layout ?? 'workspace';
-        record('foundation', layout === 'single' ? existsSync(path.join(root, 'package.json')) && existsSync(path.join(root, 'src/index.ts')) : existsSync(path.join(root, 'pnpm-workspace.yaml')), layout === 'single' ? 'Standalone Hono application' : 'pnpm workspace manifest');
         record('setup-plan', true, `Requirements recorded by CLI ${plan.cliVersion}`);
+        try {
+            const installed = read('anhedral.registry.json');
+            const { status, workspaces: _workspaces, files: _files, resourcesProvisioned, ...snapshot } = installed;
+            if (status !== 'scaffolded' ||
+                resourcesProvisioned !== false ||
+                !isDeepStrictEqual(snapshot, plan.registry))
+                throw new Error('Registry provenance differs from the setup plan.');
+            for (const item of plan.registry.items)
+                for (const target of item.targets) {
+                    if (!existsSync(path.join(root, target)))
+                        throw new Error(`Registry target missing: ${item.name}.`);
+                }
+            record('stack-registry', true, 'Registry provenance and resolved targets match the setup plan');
+        }
+        catch {
+            record('stack-registry', false, 'Missing registry provenance or targets; inspect before regenerating');
+        }
+        try {
+            const workspaces = inspectWorkspaceGraph(root);
+            record('workspace-graph', workspaces.length > 0, 'Workspace names and dependencies resolve without cycles');
+        }
+        catch {
+            record('workspace-graph', false, 'Invalid workspace manifests, references or dependency cycles');
+        }
         record('cli-compatibility', plan.cliVersion === CAPABILITY_REGISTRY.cliVersion, 'Use the project CLI version or review upgrade differences');
-        record('selection', standard.schemaVersion === 1 && JSON.stringify(standard.products) === JSON.stringify(plan.products) && standard.hosting === (plan.products.includes('next') ? plan.hosting : null) && (standard.layout ?? 'workspace') === layout, 'Setup plan matches project selection');
+        record('selection', standard.schemaVersion === 1 &&
+            JSON.stringify(standard.products) === JSON.stringify(plan.products) &&
+            standard.hosting ===
+                (plan.products.includes('next') || plan.products.includes('vinext')
+                    ? plan.hosting
+                    : null), 'Setup plan matches project selection');
     }
     catch {
         record('setup-plan', false, 'Missing, invalid or unsupported setup plan; inspect the project before changing it');
     }
-    return { schemaVersion: 1, root, checks, localReady: checks.every((check) => check.ok), providerVerification: 'unverified', productionReady: false };
+    return {
+        schemaVersion: 1,
+        root,
+        checks,
+        localReady: checks.every((check) => check.ok),
+        providerVerification: 'unverified',
+        productionReady: false,
+    };
 }
 export function validateSetupPlan(plan) {
     if (!plan || typeof plan !== 'object')
         throw new Error('Invalid setup plan.');
     const value = plan;
-    if (value.schemaVersion !== 1 || value.registryVersion !== 1 || typeof value.cliVersion !== 'string')
+    if (value.schemaVersion !== 1 ||
+        value.registryVersion !== 1 ||
+        typeof value.cliVersion !== 'string')
         throw new Error('Unsupported setup plan version.');
-    if (!Array.isArray(value.products) || !value.products.length || !value.products.every((id) => STANDARD_PRODUCTS.includes(id)))
+    if (!Array.isArray(value.products) ||
+        !value.products.length ||
+        !value.products.every((id) => STANDARD_PRODUCTS.includes(id)))
         throw new Error('Unknown setup capabilities.');
     if (value.hosting !== 'cloudflare' && value.hosting !== 'vercel')
         throw new Error('Invalid hosting.');
-    if (value.layout !== undefined && value.layout !== 'workspace' && value.layout !== 'single')
-        throw new Error('Invalid layout.');
-    if (value.layout === 'single' && (value.products.length !== 1 || value.products[0] !== 'hono'))
-        throw new Error('Unsupported standalone recipe.');
     validateRequirements(value.setup, value.products);
     const selected = new Set(value.products);
     resolveStandardProducts(selected, value.hosting, false);
     if (selected.size !== value.products.length)
         throw new Error('Invalid or incomplete setup selection.');
+    if (value.name !== undefined && typeof value.name !== 'string')
+        throw new Error('Invalid setup project name.');
+    if (!isDeepStrictEqual(value.registry, resolveStackRegistry({
+        products: value.products,
+        hosting: value.hosting,
+        name: value.name,
+    })))
+        throw new Error('Invalid or inconsistent stack registry.');
 }
 function validateRequirements(setup, products) {
     if (!setup || typeof setup !== 'object')
         throw new Error('Missing setup requirements.');
     const value = setup;
-    if (value.resourcesProvisioned !== false || !Array.isArray(value.capabilities) || value.capabilities.length !== products.length)
+    if (value.resourcesProvisioned !== false ||
+        !Array.isArray(value.capabilities) ||
+        value.capabilities.length !== products.length)
         throw new Error('Invalid capability requirements.');
     const ids = value.capabilities.map((item) => validateCapability(item));
     if (new Set(ids).size !== products.length || !products.every((id) => ids.includes(id)))
@@ -56,7 +104,9 @@ function validateCapability(item) {
     if (!item || typeof item !== 'object')
         throw new Error('Invalid capability.');
     const value = item;
-    if (typeof value.id !== 'string' || typeof value.purpose !== 'string' || !['planned', 'starter'].includes(String(value.status)))
+    if (typeof value.id !== 'string' ||
+        typeof value.purpose !== 'string' ||
+        !['planned', 'starter'].includes(String(value.status)))
         throw new Error('Invalid capability metadata.');
     for (const key of ['tools', 'access', 'credentials', 'resources', 'verify']) {
         if (!Array.isArray(value[key]) || !value[key].every((entry) => typeof entry === 'string'))

package/dist/registry/add.d.ts

@@ -0,0 +1,18 @@
+import type { StandardRunner } from './types.js';
+export interface AddRequest {
+    items: string[];
+    dryRun?: boolean;
+    skipInstall?: boolean;
+}
+/** Add recipes to an initialized workspace, refusing edits to customer-owned source. */
+export declare function addStackItems(root: string, request: AddRequest, run?: StandardRunner): Promise<{
+    schemaVersion: number;
+    root: string;
+    dryRun: boolean;
+    items: string[];
+    bootstrapRequired: boolean;
+    filesChecked: boolean;
+    targets: string[];
+    files: string[];
+    conflicts: string[];
+}>;