anhedral 0.8.6 → 0.10.0

package/dist/scaffold/integrations.js

@@ -0,0 +1,7 @@
+import { put } from './files.js';
+export function scaffoldPrivateFiles({ root, runtimeApp }) {
+    put(root, `apps/${runtimeApp}/private-files.md`, '# Private files\n\nFILES is a private R2 Worker binding. Authenticate the request and enforce file-level product authorization before calling get/put/delete. No public buckets, R2 keys, generic download endpoints, or client credentials are generated. Use the binding directly in Hono or import env from cloudflare:workers in Vinext; explicit OpenNext uses getCloudflareContext.\n');
+}
+export function scaffoldRevenueCat({ root }) {
+    put(root, 'packages/billing/revenuecat.md', '# RevenueCat + Stripe\n\nConfigure web/App Store/Play Store products and offerings in client-owned accounts. Add the platform SDK to each selected app. Verify signed provider webhooks, reconcile entitlement authority, and keep transactional idempotent credits/quotas separate from subscription status. No payment activation occurs during init.\n');
+}

package/dist/scaffold/services.d.ts

@@ -0,0 +1,5 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldRealtime({ root, options }: RecipeContext): void;
+export declare function scaffoldQueues({ root, options }: RecipeContext): void;
+export declare function scaffoldCron({ root, options }: RecipeContext): void;
+export declare function scaffoldWorkflows({ root, options }: RecipeContext): void;

package/dist/scaffold/services.js

@@ -0,0 +1,84 @@
+import { workerConfig, worker } from './files.js';
+export function scaffoldRealtime({ root, options }) {
+    worker(root, 'realtime', {
+        ...workerConfig(`${options.name}-realtime`),
+        durable_objects: { bindings: [{ name: 'ROOMS', class_name: 'Room' }] },
+        migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+    }, `import { DurableObject } from 'cloudflare:workers';
+export class Room extends DurableObject<Env> {
+  async fetch(request: Request): Promise<Response> {
+    if (request.headers.get('Upgrade') !== 'websocket') return new Response('WebSocket required', { status: 426 });
+    const pair = new WebSocketPair();
+    this.ctx.acceptWebSocket(pair[1]);
+    return new Response(null, { status: 101, webSocket: pair[0] });
+  }
+  webSocketMessage(sender: WebSocket, message: string | ArrayBuffer) {
+    if ((typeof message === 'string' ? new TextEncoder().encode(message).byteLength : message.byteLength) > 16384) { sender.close(1009, 'Message too large'); return; }
+    this.ctx.getWebSockets().filter((socket) => socket !== sender).forEach((socket) => socket.send(message));
+  }
+}
+export default {
+  async fetch(): Promise<Response> {
+    // Authenticate and authorize room membership, then forward to env.ROOMS.getByName(room).fetch(request).
+    // Use short-lived single-use tickets for browser WebSockets. Never expose a long-lived service secret.
+    return new Response('Configure room authorization before enabling connections', { status: 501 });
+  },
+};
+`);
+}
+export function scaffoldQueues({ root, options }) {
+    worker(root, 'jobs', {
+        ...workerConfig(`${options.name}-jobs`),
+        queues: {
+            producers: [{ binding: 'JOBS', queue: `${options.name}-jobs` }],
+            consumers: [
+                {
+                    queue: `${options.name}-jobs`,
+                    max_batch_size: 10,
+                    max_retries: 3,
+                    dead_letter_queue: `${options.name}-jobs-dlq`,
+                },
+            ],
+        },
+    }, `export default {
+  async queue(batch: MessageBatch<unknown>): Promise<void> {
+    for (const message of batch.messages) {
+      // Add transactional idempotency and product processing before acknowledging.
+      console.error('Job handler requires product implementation', message.id);
+      message.retry({ delaySeconds: 60 });
+    }
+  },
+};
+`);
+}
+export function scaffoldCron({ root, options }) {
+    worker(root, 'scheduled', { ...workerConfig(`${options.name}-scheduled`), triggers: { crons: ['0 * * * *'] } }, `export default {
+  async scheduled(controller: ScheduledController): Promise<void> {
+    // Define a product schedule, idempotency key, overlap policy, and failure alerts before release.
+    console.log('Scheduled trigger', controller.scheduledTime);
+  },
+};
+`);
+}
+export function scaffoldWorkflows({ root, options }) {
+    worker(root, 'workflows', {
+        ...workerConfig(`${options.name}-workflows`),
+        workflows: [
+            {
+                name: `${options.name}-workflow`,
+                binding: 'WORKFLOW',
+                class_name: 'ApplicationWorkflow',
+            },
+        ],
+    }, `import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
+export class ApplicationWorkflow extends WorkflowEntrypoint<Env, { operationId: string }> {
+  async run(event: WorkflowEvent<{ operationId: string }>, step: WorkflowStep) {
+    return step.do('validate', { retries: { limit: 3, delay: '10 seconds', backoff: 'exponential' } }, async () => {
+      if (!event.payload.operationId) throw new Error('operationId required');
+      return { operationId: event.payload.operationId };
+    });
+  }
+}
+export default { async fetch() { return new Response('Use an authorized server binding to create workflows', { status: 403 }); } };
+`);
+}

package/dist/scaffold/web.d.ts

@@ -0,0 +1,2 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldWeb({ root, options, bindings, runtimeApp, has }: RecipeContext): void;

package/dist/scaffold/web.js

@@ -0,0 +1,102 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { configureVinext } from '../vinext.js';
+import { json, put, readJson, patchPackage, workerConfig } from './files.js';
+function cleanWorkspaceManifest(root, directory) {
+    const manifestPath = `${directory}/package.json`;
+    if (!existsSync(path.join(root, manifestPath)))
+        return;
+    const manifest = readJson(root, manifestPath);
+    const sources = [];
+    const collect = (folder) => {
+        for (const entry of readdirSync(folder, { withFileTypes: true })) {
+            if (['node_modules', '.next', '.open-next', '.git'].includes(entry.name))
+                continue;
+            const file = path.join(folder, entry.name);
+            if (entry.isDirectory())
+                collect(file);
+            else if (/\.(tsx?|m?js|css)$/.test(entry.name))
+                sources.push(readFileSync(file, 'utf8'));
+        }
+    };
+    collect(path.join(root, directory));
+    for (const name of ['lucide-react', 'zod', 'next-themes']) {
+        if (!sources.some((source) => source.includes(`"${name}`) || source.includes(`'${name}`)))
+            delete manifest.dependencies?.[name];
+    }
+    if (directory === 'packages/ui') {
+        if (!sources.some((source) => source.includes('@turbo/gen')) &&
+            !Object.values(manifest.scripts ?? {}).some((script) => String(script).includes('turbo gen')))
+            delete manifest.devDependencies?.['@turbo/gen'];
+        manifest.devDependencies = {
+            ...manifest.devDependencies,
+            'postcss-load-config': STACK_DEPENDENCIES['postcss-load-config'],
+        };
+        if (manifest.dependencies?.shadcn) {
+            manifest.devDependencies.shadcn = manifest.dependencies.shadcn;
+            delete manifest.dependencies.shadcn;
+        }
+    }
+    json(root, manifestPath, manifest);
+}
+function cleanShadcnStarter(root) {
+    for (const directory of ['apps/web', 'packages/ui'])
+        cleanWorkspaceManifest(root, directory);
+    const themePath = 'apps/web/components/theme-provider.tsx';
+    if (existsSync(path.join(root, themePath))) {
+        const source = readFileSync(path.join(root, themePath), 'utf8');
+        // Preserve the upstream keyboard behavior while reducing branching in its guards.
+        put(root, themePath, source
+            .replace(/target.tagName === "INPUT" \|\|\s*target.tagName === "TEXTAREA" \|\|\s*target.tagName === "SELECT"/, '["INPUT", "TEXTAREA", "SELECT"].includes(target.tagName)')
+            .replace(/if \(event.defaultPrevented \|\| event.repeat\) \{\s*return\s*\}\s*if \(event.metaKey \|\| event.ctrlKey \|\| event.altKey\) \{\s*return\s*\}\s*if \(event.key.toLowerCase\(\) !== "d"\) \{\s*return\s*\}\s*if \(isTypingTarget\(event.target\)\) \{\s*return\s*\}/, 'if ([event.defaultPrevented, event.repeat, event.metaKey, event.ctrlKey, event.altKey, event.key.toLowerCase() !== "d", isTypingTarget(event.target)].some(Boolean)) { return }'));
+    }
+}
+export function scaffoldWeb({ root, options, bindings, runtimeApp, has }) {
+    cleanShadcnStarter(root);
+    put(root, 'apps/web/eslint.config.js', 'import { nextJsConfig } from "@workspace/eslint-config/next-js";\nexport default [...nextJsConfig, { ignores: [".open-next/**", ".wrangler/**", "cloudflare-env.d.ts"] }];\n');
+    patchPackage(root, 'apps/web/package.json', {
+        scripts: { typecheck: 'tsc --noEmit', lint: 'eslint . --max-warnings 0' },
+    });
+    if (has('vinext')) {
+        configureVinext(root, `${options.name}-web`, runtimeApp === 'web' ? bindings : {});
+    }
+    else if (options.hosting === 'cloudflare') {
+        patchPackage(root, 'apps/web/package.json', {
+            dependencies: {
+                '@opennextjs/cloudflare': STACK_DEPENDENCIES['@opennextjs/cloudflare'],
+                next: '16.3.8',
+            },
+            devDependencies: { wrangler: STACK_DEPENDENCIES['wrangler'] },
+            scripts: {
+                preview: 'opennextjs-cloudflare build && opennextjs-cloudflare preview',
+                deploy: 'opennextjs-cloudflare build && opennextjs-cloudflare deploy',
+                'build:worker': 'opennextjs-cloudflare build',
+                'cf:typegen': 'wrangler types --env-interface CloudflareEnv cloudflare-env.d.ts',
+            },
+        });
+        json(root, 'apps/web/wrangler.jsonc', {
+            ...workerConfig(`${options.name}-web`),
+            compatibility_flags: ['nodejs_compat', 'global_fetch_strictly_public'],
+            main: '.open-next/worker.js',
+            assets: { directory: '.open-next/assets', binding: 'ASSETS' },
+            services: [{ binding: 'WORKER_SELF_REFERENCE', service: `${options.name}-web` }],
+            ...(runtimeApp === 'web' ? bindings : {}),
+        });
+        const nextConfig = ['next.config.ts', 'next.config.mjs', 'next.config.js'].find((file) => existsSync(path.join(root, 'apps/web', file)));
+        if (nextConfig) {
+            const source = readFileSync(path.join(root, 'apps/web', nextConfig), 'utf8');
+            put(root, `apps/web/${nextConfig}`, `import { initOpenNextCloudflareForDev } from '@opennextjs/cloudflare';\n${source}\ninitOpenNextCloudflareForDev();\n`);
+        }
+        put(root, 'apps/web/open-next.config.ts', 'import { defineCloudflareConfig } from "@opennextjs/cloudflare";\nexport default defineCloudflareConfig();\n');
+        put(root, 'apps/web/public/_headers', '/_next/static/*\n  Cache-Control: public,max-age=31536000,immutable\n');
+        put(root, 'apps/web/.dev.vars.example', 'NEXTJS_ENV=development\n');
+    }
+    else {
+        patchPackage(root, 'apps/web/package.json', { dependencies: { next: '16.4.0' } });
+        put(root, 'apps/web/next.config.ts', 'import type { NextConfig } from "next";\nconst config: NextConfig = { transpilePackages: ["@workspace/ui"], cacheComponents: true, partialPrefetching: true };\nexport default config;\n');
+        for (const file of ['next.config.js', 'next.config.mjs'])
+            rmSync(path.join(root, 'apps/web', file), { force: true });
+        json(root, 'apps/web/vercel.json', { framework: 'nextjs' });
+    }
+}

package/dist/scaffold/workspace.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedStackRegistry } from '../registry/resolve.js';
+import type { StandardOptions } from '../registry/types.js';
+export declare function writeStandardRoot(root: string, options: StandardOptions, registry: ResolvedStackRegistry, updating?: boolean): void;

package/dist/scaffold/workspace.js

@@ -0,0 +1,150 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { setPnpmPolicy } from '../pnpm-policy.js';
+import { writeSecurityBackports } from '../security-backports.js';
+import { BOOTSTRAP_COMMAND } from '../registry/bootstrap.js';
+import { appendGitignore } from '../util.js';
+import { PACKAGE_MANAGER } from '../dependencies.js';
+import { createSetupPlan } from '../capabilities.js';
+import { json, put, readJson, patchPackage, } from './files.js';
+import { writeSetupDocumentation, workerBuildSuffix } from './documentation.js';
+import { writeEnvironmentExample } from './environment.js';
+export function writeStandardRoot(root, options, registry, updating = false) {
+    const has = (value) => options.products.includes(value);
+    const existing = readJson(root, 'package.json');
+    const securityOverrides = {
+        ...(has('wxt') ? { '@wxt-dev/module-react>@vitejs/plugin-react': '5.2.0' } : {}),
+        ...(has('next') || has('vinext') ? { 'sharp@<0.35.5': '0.35.5' } : {}),
+        'source-map-js@<1.2.2': '1.2.2',
+        ...(has('next') && options.hosting === 'cloudflare'
+            ? { 'glob@>=10.2.0 <10.5.0': '10.5.0', 'glob@>=11.0.0 <11.1.0': '11.1.0' }
+            : {}),
+        ...(has('wxt')
+            ? { 'shell-quote@<1.12.0': '1.12.0', 'tmp@<0.2.7': '0.2.7', 'adm-zip@<0.6.1': '0.6.1' }
+            : {}),
+        'baseline-browser-mapping@<2.11.0': '2.11.27',
+        'browserslist@<4.28.7': '4.29.3',
+        ...(((has('next') || has('vinext')) && options.hosting === 'cloudflare') ||
+            has('hono') ||
+            has('electron') ||
+            has('wxt')
+            ? { 'esbuild@<0.25.0': '0.25.12' }
+            : {}),
+        'brace-expansion@<2': '1.1.21',
+        'brace-expansion@>=2 <3': '2.1.7',
+        'brace-expansion@>=3 <4': '3.0.9',
+        'brace-expansion@>=4 <5.0.12': '5.0.12',
+    };
+    patchPackage(root, 'package.json', {
+        name: options.name,
+        private: true,
+        packageManager: PACKAGE_MANAGER,
+        engines: { node: '>=22.13.0' },
+        scripts: {
+            dev: 'turbo dev',
+            build: 'turbo build',
+            ...((has('next') || has('vinext')) && options.hosting === 'cloudflare'
+                ? { 'build:worker': 'pnpm --dir apps/web run build:worker' }
+                : {}),
+            lint: 'turbo lint',
+            typecheck: 'turbo typecheck',
+            test: 'turbo test',
+            audit: 'node scripts/audit.mjs',
+            'audit:full': 'fallow --fail-on-issues',
+            'audit:deps': 'node scripts/security/audit-deps.mjs',
+            check: `pnpm lint && pnpm typecheck && pnpm run audit && pnpm audit:deps && pnpm test && pnpm build${workerBuildSuffix(options)}`,
+        },
+        devDependencies: { fallow: STACK_DEPENDENCIES['fallow'] },
+        // Upstream starter lockfiles can retain vulnerable transitive versions. Keep fixes within compatible majors.
+        pnpm: { ...existing.pnpm, overrides: { ...existing.pnpm?.overrides, ...securityOverrides } },
+    });
+    put(root, 'scripts/audit.mjs', `import { spawnSync } from 'node:child_process';
+const base = process.env.AUDIT_BASE;
+const hasBase = base || ['origin/main', 'main'].find((ref) => spawnSync('git', ['rev-parse', '--verify', ref], { stdio: 'ignore' }).status === 0);
+const args = hasBase ? ['exec', 'fallow', 'audit', '--base', hasBase] : ['exec', 'fallow', '--fail-on-issues'];
+const entry = process.env.npm_execpath;
+if (!entry) throw new Error('Run this check through pnpm run audit.');
+const result = spawnSync(process.execPath, [entry, ...args], { stdio: 'inherit', shell: false });
+if (result.error) throw result.error;
+process.exitCode = result.status ?? 1;
+`);
+    json(root, '.fallowrc.json', {
+        ...(has('electron') ? { entry: ['apps/desktop/src/main/preload.cts'] } : {}),
+        // Expo web export and NativeWind load these runtime dependencies dynamically.
+        ...(has('expo')
+            ? {
+                ignoreDependencies: [
+                    'react-native-web',
+                    'react-native-css-interop',
+                    'react-native-reanimated',
+                    'react-native-worklets',
+                ],
+            }
+            : {}),
+        ignorePatterns: [
+            '**/next-env.d.ts',
+            '**/.next/**',
+            '**/.open-next/**',
+            '**/.wrangler/**',
+            '**/dist/**',
+            '**/worker-configuration.d.ts',
+            '**/cloudflare-env.d.ts',
+        ],
+    });
+    const turbo = readJson(root, 'turbo.json');
+    turbo.globalEnv = [...new Set(registry.items.flatMap((item) => item.environment))].sort();
+    turbo.tasks = {
+        ...turbo.tasks,
+        dev: { ...turbo.tasks.dev, cache: false, persistent: true },
+        lint: { ...turbo.tasks.lint, dependsOn: ['^lint'] },
+        typecheck: { ...turbo.tasks.typecheck, dependsOn: ['^typecheck'] },
+        test: { dependsOn: ['^build'], outputs: ['coverage/**'] },
+        build: {
+            ...turbo.tasks.build,
+            dependsOn: [...new Set(['^build', ...(turbo.tasks.build?.dependsOn ?? [])])],
+            outputs: ['.next/**', '!.next/cache/**', '.open-next/**', 'dist/**', '.output/**'],
+        },
+    };
+    json(root, 'turbo.json', turbo);
+    setPnpmPolicy(root, {
+        allowBuilds: undefined,
+        onlyBuiltDependencies: [
+            'esbuild',
+            'sharp',
+            'unrs-resolver',
+            'workerd',
+            ...(has('electron') ? ['electron'] : []),
+        ],
+    });
+    writeSecurityBackports(root);
+    appendGitignore(root, [
+        'node_modules/',
+        '.open-next/',
+        '.wrangler/',
+        '.dev.vars',
+        '.dev.vars.*',
+        '!.dev.vars.example',
+        '.env',
+        '.env.*',
+        '!.env.example',
+        '.fallow/',
+        '.anhedral/',
+    ]);
+    writeEnvironmentExample(root, registry);
+    json(root, 'anhedral.standard.json', {
+        schemaVersion: 1,
+        standard: 'anhedral-application-stack',
+        products: options.products,
+        hosting: has('next') || has('vinext') ? options.hosting : null,
+        bootstrap: updating
+            ? readJson(root, 'anhedral.standard.json').bootstrap
+            : {
+                command: BOOTSTRAP_COMMAND.join(' '),
+                upstreamPackageManager: existing.packageManager,
+            },
+        status: 'starter',
+        resourcesProvisioned: false,
+    });
+    json(root, 'anhedral.setup.json', createSetupPlan({ ...options, dryRun: false }, registry));
+    if (!updating)
+        writeSetupDocumentation(root, options);
+}

package/dist/security-backports.js

@@ -16,6 +16,11 @@ export function configureSecurityBackports(root) {
     });
     if (!entries.length)
         return false;
-    mergePnpmPatches(root, Object.fromEntries(entries.map(({ name, version, patch }) => [`${name}@${version}`, `scripts/security/${patch}`])));
-    return true;
+    const workspaceFile = path.join(root, 'pnpm-workspace.yaml');
+    const before = readFileSync(workspaceFile, 'utf8');
+    mergePnpmPatches(root, Object.fromEntries(entries.map(({ name, version, patch }) => [
+        `${name}@${version}`,
+        `scripts/security/${patch}`,
+    ])));
+    return readFileSync(workspaceFile, 'utf8') !== before;
 }

package/dist/stack-registry.d.ts

@@ -0,0 +1,80 @@
+import type { ItemDefinition, StackRegistryItem, RecipeContext } from './registry/types.js';
+/** Every product owns its source recipe, setup requirements and composition policy here. */
+declare const PRODUCT_ITEMS: {
+    vinext: ItemDefinition;
+    next: ItemDefinition;
+    expo: ItemDefinition;
+    electron: ItemDefinition;
+    wxt: ItemDefinition;
+    hono: ItemDefinition;
+    neon: ItemDefinition;
+    d1: ItemDefinition;
+    'local-data': ItemDefinition;
+    clerk: ItemDefinition;
+    'better-auth': ItemDefinition;
+    r2: ItemDefinition;
+    kv: ItemDefinition;
+    realtime: ItemDefinition;
+    queues: ItemDefinition;
+    cron: ItemDefinition;
+    workflows: ItemDefinition;
+    openai: ItemDefinition;
+    'ai-sdk': ItemDefinition;
+    'workers-ai': ItemDefinition;
+    resend: ItemDefinition;
+    stripe: ItemDefinition;
+    revenuecat: ItemDefinition;
+    sentry: ItemDefinition;
+    basin: ItemDefinition;
+    posthog: ItemDefinition;
+    styling: ItemDefinition;
+};
+export type StandardProduct = keyof typeof PRODUCT_ITEMS;
+export declare const STANDARD_PRODUCTS: readonly ("realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+declare const DEFINITIONS: {
+    vinext: ItemDefinition;
+    next: ItemDefinition;
+    expo: ItemDefinition;
+    electron: ItemDefinition;
+    wxt: ItemDefinition;
+    hono: ItemDefinition;
+    neon: ItemDefinition;
+    d1: ItemDefinition;
+    'local-data': ItemDefinition;
+    clerk: ItemDefinition;
+    'better-auth': ItemDefinition;
+    r2: ItemDefinition;
+    kv: ItemDefinition;
+    realtime: ItemDefinition;
+    queues: ItemDefinition;
+    cron: ItemDefinition;
+    workflows: ItemDefinition;
+    openai: ItemDefinition;
+    'ai-sdk': ItemDefinition;
+    'workers-ai': ItemDefinition;
+    resend: ItemDefinition;
+    stripe: ItemDefinition;
+    revenuecat: ItemDefinition;
+    sentry: ItemDefinition;
+    basin: ItemDefinition;
+    posthog: ItemDefinition;
+    styling: ItemDefinition;
+    workspace: ItemDefinition;
+    typescript: ItemDefinition;
+    eslint: ItemDefinition;
+    ui: ItemDefinition;
+};
+export type StackItemId = keyof typeof DEFINITIONS;
+export declare function getStackDefinition(name: string): ItemDefinition;
+export declare function getStackItem(name: string): StackRegistryItem;
+export declare const STACK_ITEMS: Record<"realtime" | "electron" | "eslint" | "typescript" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "workspace" | "ui" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", StackRegistryItem>;
+export declare const STACK_REGISTRY: {
+    schemaVersion: number;
+    name: string;
+    cliVersion: string;
+    items: StackRegistryItem[];
+};
+export declare function installStackItem(item: StackRegistryItem, context: RecipeContext): void | Promise<void>;
+/** Validate authored definitions during build, before shipping either catalog. */
+export declare function validateStackCatalog(): void;
+export {};