anhedral 0.8.6 → 0.10.0

package/dist/capabilities.js

@@ -1,93 +1,91 @@
+import { resolveStackRegistry } from './registry/resolve.js';
+import { BOOTSTRAP_COMMAND } from './registry/bootstrap.js';
 import { GENERATOR_VERSION } from './version.js';
 import { PACKAGE_MANAGER } from './dependencies.js';
-import { SHADCN_BOOTSTRAP } from './foundation.js';
-function capability(purpose, tools, access, credentials, resources, verify, selection = {}, delivery = 'starter') {
-    return { purpose, delivery, tools, access, credentials, resources, verify, selection };
-}
-/** Setup requirements describe unfinished starters; they never grant authority or claim readiness. */
-export const CAPABILITIES = {
-    next: capability('Web application with Next.js rendering, routing and server integration', ['Browser testing where applicable'], [], [], ['Next.js app; configure the selected hosting provider'], ['Web flows, accessibility, production hosting build and deployed preview'], { app: true }),
-    expo: capability('Mobile application starter with Expo and native platform adapters', ['Expo/EAS CLI', 'Xcode or Android SDK'], ['Client-owned Apple/Google developer accounts for store delivery'], ['Platform signing credentials; EAS access when used'], ['Expo app; native adapters, signing, store configuration'], ['Pass the installed-byte dependency gate; maintain reviewed backports until supported upstream replacements are available', 'Native simulator/device flows and signed native build; web export alone is insufficient'], { app: true }),
-    electron: capability('Electron desktop starter for web UI reuse; assess memory, native integration, security and distribution', ['Electron tooling', 'Platform packaging tools'], ['Signing/notarization account for the target platform'], ['Signing credentials; notarization credentials when required'], ['Electron app; packaging and distribution configuration'], ['Packaged desktop app, permissions, update/recovery behavior'], { app: true }),
-    wxt: capability('WXT Chrome extension starter; select sidepanel or popup for the task', ['Chrome', 'WXT'], ['Extension store publisher access for distribution'], ['Store publishing credentials when required'], ['Extension app; minimal browser permissions and store package'], ['Installed selected surface, relevant messaging and minimal permission behavior'], { app: true }),
-    hono: capability('Shared OpenAPI backend', ['Wrangler'], ['Cloudflare Workers deployment access'], [], ['API Worker; application routes and authorization'], ['Contract validation, unauthenticated rejection and resource ownership'], { app: true }),
-    neon: capability('PostgreSQL persistence through Drizzle and Hyperdrive', ['Neon integration or API', 'Wrangler'], ['Neon project/branch access; Cloudflare Hyperdrive configuration access'], ['DATABASE_URL for migrations; separate least-privilege Hyperdrive origin credentials'], ['Generated Drizzle + Hyperdrive recipe: schema/client factories, migration config and HYPERDRIVE binding; direct Neon serverless access is an existing-project adaptation'], ['Migration and runtime connectivity; disable query caching for correctness-sensitive reads'], { conflicts: ['d1'], workerBinding: true }),
-    d1: capability('SQLite-compatible hosted persistence', ['Wrangler'], ['Cloudflare D1 access'], [], ['D1 database, DB binding and reviewed migrations'], ['Migration, constraints, transactional behavior and runtime queries'], { conflicts: ['neon'], workerBinding: true }),
-    'local-data': capability('Device-local SQLite and files', ['Selected platform database/filesystem tooling'], [], [], ['Integration boundary; implement platform adapters and explicit synchronization if needed'], ['Persistence, offline writes and recovery on the selected device'], {}, 'integration-boundary'),
-    clerk: capability('Managed identity', ['Clerk integration or dashboard'], ['Client-owned Clerk project access'], ['Clerk publishable key; server secret key; webhook secret when used'], ['Identity project, allowed URLs, SDK setup and protected routes'], ['Sign-in/out, session expiry, server-side authorization and selected native flows; route-group names do not authorize requests'], { conflicts: ['better-auth'], requiresAny: ['next', 'hono'] }),
-    'better-auth': capability('Application-managed identity', ['Selected database tooling'], ['Selected database migration/runtime access'], ['BETTER_AUTH_SECRET; BETTER_AUTH_URL'], ['Selected Neon or D1 database, auth schema, trusted origins and application routes'], ['Sign-in/out, session expiry, sign-up policy and resource authorization'], { conflicts: ['clerk'], requiresAny: ['neon', 'd1'], workerBinding: true }),
-    r2: capability('Private remote files', ['Wrangler'], ['Cloudflare R2 bucket/binding access'], [], ['Private R2 bucket and FILES binding; authorized upload/download endpoints'], ['Public bucket access disabled; file ownership enforced; clients receive no storage credentials'], { workerBinding: true }),
-    kv: capability('Eventually consistent cache/configuration', ['Wrangler'], ['Cloudflare KV namespace access'], [], ['KV namespace and CONFIG binding'], ['TTL and propagation behavior; never use KV as transactional authority'], { workerBinding: true }),
-    realtime: capability('Rooms and collaboration', ['Wrangler', 'Browser control'], ['Cloudflare Durable Objects deployment access'], [], ['Realtime Worker, Durable Object namespace/migration and WebSocket authorization'], ['Authorized room isolation, disconnect/reconnect and deployed WebSockets']),
-    queues: capability('Deferred jobs', ['Wrangler'], ['Cloudflare Queues configuration access'], [], ['Queue, producer/consumer bindings and failure handling'], ['Retries, idempotency, concurrency and dead-letter recovery']),
-    cron: capability('Scheduled work', ['Wrangler'], ['Cloudflare Worker deployment access'], [], ['Scheduled Worker and environment-specific Cron Triggers'], ['Schedule, idempotency, failure visibility and overlapping runs']),
-    workflows: capability('Durable multi-step processing', ['Wrangler'], ['Cloudflare Workflows deployment access'], [], ['Workflow Worker/binding and resumable steps'], ['Retry/resume, idempotency, cancellation and failure recovery']),
-    openai: capability('Direct OpenAI integration', ['OpenAI integration or API'], ['Client-owned OpenAI project and model access'], ['OPENAI_API_KEY'], ['Server SDK factory; implement application behavior and spending limits'], ['Selected model, failure handling, private inputs and cost controls'], { conflicts: ['ai-sdk'] }, 'sdk-factory'),
-    'ai-sdk': capability('Streaming AI and provider abstraction', ['Selected AI provider integration or API'], ['Selected provider project/model access'], ['OPENAI_API_KEY for the generated default; selected provider credentials otherwise'], ['Server SDK factory; implement streaming, tools and application behavior'], ['Streaming, tool authorization, interruption and spending limits'], { conflicts: ['openai'] }, 'sdk-factory'),
-    'workers-ai': capability('Cloudflare-hosted inference', ['Wrangler'], ['Cloudflare Workers AI model access'], [], ['AI binding and selected model invocation'], ['Supported model behavior, authorization and usage limits'], { workerBinding: true }),
-    resend: capability('Outbound application email', ['Resend integration or API'], ['Client-owned Resend project; sending-domain DNS access'], ['RESEND_API_KEY; webhook secret when used'], ['Verified sending domain, sender and server integration'], ['Delivery, suppression/bounce handling and webhook verification; inbound routing is separate'], {}, 'sdk-factory'),
-    stripe: capability('Web payments and subscriptions', ['Stripe integration or CLI'], ['Client-owned Stripe account; test/live access as required'], ['STRIPE_SECRET_KEY; STRIPE_WEBHOOK_SECRET'], ['Server SDK factory; implement products/prices, signed webhooks and entitlements'], ['Test purchase/cancellation, webhook replay and transactional idempotency'], {}, 'sdk-factory'),
-    revenuecat: capability('Cross-store subscription entitlements alongside Stripe', ['RevenueCat integration or API', 'Selected mobile store tooling'], ['RevenueCat project; App Store/Play Store product access'], ['Platform public SDK keys; server API/webhook credentials as required'], ['Integration guidance only; install platform SDKs and configure offerings/store products'], ['Sandbox purchase/restore, verified webhooks and entitlement reconciliation'], { requiresAll: ['stripe'] }, 'integration-boundary'),
-    sentry: capability('Additional runtime/crash diagnostics', ['Sentry integration or API'], ['Client-owned Sentry project access'], ['SENTRY_DSN; source-map upload token when required'], ['Integration boundary; install/init runtime SDKs and configure private source-map uploads'], ['Captured runtime errors, source maps, privacy filtering and alert delivery'], {}, 'integration-boundary'),
-    basin: capability('Basin ingestion and analytical SQL; product analytics needs its own event model and reports', ['Wrangler', 'Cloudflare integration or API'], ['Cloudflare analytics/Pipelines access; plan supporting selected services; Pipelines Setup grant for managed R2 sink setup'], [], ['EventStream interface and ANALYTICS binding; provision Basin stream, pipeline/table, retention and reports separately; optional private R2 sink'], ['Private ingestion, event delivery, query results and archive retrieval when selected'], { workerBinding: true }, 'integration-boundary'),
-    posthog: capability('Specialized product analytics', ['PostHog integration or API'], ['Client-owned PostHog project access'], ['POSTHOG_API_KEY; POSTHOG_HOST; separate privileged key if needed'], ['Analytics client factory; implement consent, event schema and privacy filtering'], ['Event receipt, consent behavior and redaction of private data'], {}, 'sdk-factory'),
-    styling: capability('Shared styling definitions', [], [], [], ['Styling package; implement actual shared colors, typography, spacing and themes'], ['Consistency across selected interfaces; preserve platform-specific components'], {}, 'integration-boundary'),
+import { STANDARD_PRODUCTS, getStackDefinition } from './stack-registry.js';
+export const CAPABILITIES = Object.fromEntries(STANDARD_PRODUCTS.map((id) => {
+    const definition = getStackDefinition(id);
+    return [id, { ...definition.setup, selection: definition.selection }];
+}));
+export const CAPABILITY_REGISTRY = {
+    schemaVersion: 1,
+    cliVersion: GENERATOR_VERSION,
+    capabilities: CAPABILITIES,
 };
-export function resolveStandardProducts(selected, hosting, hostingSpecified) {
-    if (![...selected].some((id) => CAPABILITIES[id].selection.app))
-        selected.add('next');
-    for (const id of selected)
-        validateSelection(id, selected);
-    const needsWorker = [...selected].some((id) => CAPABILITIES[id].selection.workerBinding);
-    if (needsWorker && !selected.has('hono') && (!selected.has('next') || hosting !== 'cloudflare')) {
-        throw new Error('Selected server bindings need a Cloudflare Next.js app or an explicitly selected Hono Worker.');
-    }
-    if (hostingSpecified && !selected.has('next'))
-        throw new Error('--hosting applies to the Next.js app.');
-}
-function validateSelection(id, selected) {
-    const { conflicts = [], requiresAny = [], requiresAll = [] } = CAPABILITIES[id].selection;
-    const conflict = conflicts.find((other) => selected.has(other));
-    if (conflict)
-        throw new Error(`Choose one of ${[id, conflict].join(' / ')}.`);
-    if (requiresAny.length && !requiresAny.some((other) => selected.has(other))) {
-        throw new Error(`${id} requires an explicitly selected ${requiresAny.join(' or ')} capability.`);
-    }
-    const missing = requiresAll.filter((other) => !selected.has(other));
-    if (missing.length)
-        throw new Error(`${id} requires ${missing.join(', ')}; select it explicitly.`);
-}
-export const CAPABILITY_REGISTRY = { schemaVersion: 1, cliVersion: GENERATOR_VERSION, capabilities: CAPABILITIES };
 const HOSTING_SETUP = {
     cloudflare: {
         tools: ['Cloudflare integration or API', 'Wrangler'],
-        access: ['Client-owned Cloudflare account; account ID; scoped OAuth/API access; service-compatible plan; DNS access only when needed'],
+        access: [
+            'Client-owned Cloudflare account; account ID; scoped OAuth/API access; service-compatible plan; DNS access only when needed',
+        ],
     },
     vercel: {
         tools: ['Vercel integration or CLI'],
-        access: ['Client-owned Vercel project access'],
+        access: [
+            'Client-owned Vercel team/project access; Hobby only for personal non-commercial use; suitable authorized plan for commercial apps',
+        ],
     },
 };
-export function createSetupPlan(options) {
-    const capabilities = options.products.map((id) => ({ id, ...CAPABILITIES[id], status: options.dryRun ? 'planned' : 'starter' }));
-    const providers = [...new Set([
-            ...(options.products.includes('next') ? [options.hosting] : []),
+export function createSetupPlan(options, registry = resolveStackRegistry(options)) {
+    const items = new Map(registry.items.map((item) => [item.name, item]));
+    const capabilities = options.products.map((id) => {
+        const item = items.get(id);
+        return {
+            id,
+            ...item.setup,
+            selection: item.selection,
+            status: options.dryRun ? 'planned' : 'starter',
+        };
+    });
+    const providers = [
+        ...new Set([
+            ...(options.products.includes('next') || options.products.includes('vinext')
+                ? [options.hosting]
+                : []),
             ...capabilities.flatMap(({ tools }) => tools.includes('Wrangler') ? ['cloudflare'] : []),
-        ])].map((provider) => HOSTING_SETUP[provider]);
+        ]),
+    ].map((provider) => HOSTING_SETUP[provider]);
     return {
-        schemaVersion: 1, cliVersion: GENERATOR_VERSION, registryVersion: CAPABILITY_REGISTRY.schemaVersion,
-        standard: 'anhedral-application-stack', root: options.root, products: options.products, hosting: options.hosting,
-        layout: options.layout ?? 'workspace',
-        ...(options.products.includes('wxt') ? { extensionSurface: options.extensionSurface ?? 'sidepanel' } : {}),
-        bootstrap: options.products.includes('next') ? [...SHADCN_BOOTSTRAP] : [], dryRun: options.dryRun,
+        schemaVersion: 1,
+        cliVersion: GENERATOR_VERSION,
+        registryVersion: CAPABILITY_REGISTRY.schemaVersion,
+        standard: 'anhedral-application-stack',
+        root: options.root,
+        name: options.name,
+        products: options.products,
+        hosting: options.hosting,
+        registry,
+        bootstrap: [...BOOTSTRAP_COMMAND],
+        dryRun: options.dryRun,
         setup: {
-            tools: [...new Set(['Git', 'Node.js 22.22+ for generated workspaces', PACKAGE_MANAGER.replace('@', ' '), 'GitHub integration or gh', 'Fallow',
-                    ...(providers.includes(HOSTING_SETUP.cloudflare) ? ['Cloudflare security audit skill'] : []),
-                    ...providers.flatMap((provider) => provider.tools), ...capabilities.flatMap((item) => item.tools)])],
-            access: ['Client-owned repository and CI access', ...providers.flatMap((provider) => provider.access)],
+            tools: [
+                ...new Set([
+                    'Git',
+                    'Node.js 22.13+ for generated workspaces',
+                    PACKAGE_MANAGER.replace('@', ' '),
+                    'GitHub integration or gh',
+                    'Fallow',
+                    'Cloudflare security audit skill',
+                    ...providers.flatMap((provider) => provider.tools),
+                    ...capabilities.flatMap((item) => item.tools),
+                ]),
+            ],
+            access: [
+                'User-owned GitHub repository and CI access',
+                ...(options.hosting === 'vercel' && options.products.includes('next')
+                    ? ['Vercel GitHub installation access for the selected web repository']
+                    : []),
+                ...providers.flatMap((provider) => provider.access),
+            ],
             capabilities,
-            completion: ['Discover available plugins and fallbacks; verify the selected account and scope', 'Configure separate environments, bindings and server-side secrets',
-                'Implement starter behavior and meaningful tests', 'Run repeatable local gates and separately record time-sensitive advisory/provider checks; verify platform behavior', 'Verify deployed preview; obtain required production authorization; record rollback and operating ownership'],
+            completion: [
+                'Guide GitHub authentication, own local Git checkout, reviewed initial commit and private user-owned remote; verify the selected deployment source connection',
+                'Discover available plugins and fallbacks; verify the selected account and scope',
+                'Configure separate environments, bindings and server-side secrets',
+                'Implement starter behavior and meaningful tests',
+                'Run pnpm check plus platform/provider verification',
+                'Verify deployed preview; obtain required production authorization; record rollback and operating ownership',
+            ],
             resourcesProvisioned: false,
         },
     };

package/dist/cloudflare.d.ts

@@ -0,0 +1,14 @@
+import type { ApplicationProject, DeliveryRunner } from './project-state.js';
+export interface CloudflareResponse {
+    result: unknown;
+    result_info?: {
+        page?: number;
+        total_pages?: number;
+        count?: number;
+        per_page?: number;
+    };
+}
+export type CloudflareRequest = (method: 'GET' | 'POST', endpoint: string, body?: unknown) => Promise<CloudflareResponse>;
+/** Credentials stay in this closure, never in returned receipts, arguments or files. */
+export declare function cloudflareRequest(project: ApplicationProject, directory: string, run: DeliveryRunner, env: NodeJS.ProcessEnv): Promise<CloudflareRequest>;
+export declare function listCloudflare(request: CloudflareRequest, endpoint: string): Promise<Record<string, unknown>[]>;

package/dist/cloudflare.js

@@ -0,0 +1,66 @@
+/** Credentials stay in this closure, never in returned receipts, arguments or files. */
+export async function cloudflareRequest(project, directory, run, env) {
+    let credentials;
+    try {
+        credentials = JSON.parse(await run('pnpm', ['exec', 'wrangler', 'auth', 'token', '--json'], directory, env));
+    }
+    catch {
+        throw new Error('Cannot retrieve structured Wrangler credentials; update Wrangler and check authentication.');
+    }
+    if (!['oauth', 'api_token'].includes(credentials.type) ||
+        typeof credentials.token !== 'string' ||
+        !credentials.token)
+        throw new Error('Cloudflare operations require scoped API-token or Wrangler OAuth access.');
+    return async (method, endpoint, body) => {
+        if (!project.accountId ||
+            !endpoint.startsWith('/') ||
+            endpoint.includes('..') ||
+            endpoint.includes('#'))
+            throw new Error('Invalid account-scoped provider request.');
+        let response;
+        try {
+            response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${project.accountId}${endpoint}`, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${credentials.token}`,
+                    'Content-Type': 'application/json',
+                },
+                body: body === undefined ? undefined : JSON.stringify(body),
+                redirect: 'error',
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch {
+            throw new Error('Cloudflare request failed; check connectivity and account permissions.');
+        }
+        let data;
+        try {
+            data = (await response.json());
+        }
+        catch {
+            throw new Error(`Cloudflare returned unsupported output (HTTP ${response.status}).`);
+        }
+        if (!response.ok || data.success !== true) {
+            const codes = (data.errors ?? [])
+                .map((item) => item.code)
+                .filter((code) => typeof code === 'number')
+                .join(',');
+            throw new Error(`Cloudflare operation failed (HTTP ${response.status}${codes ? `; codes ${codes}` : ''}). Check scoped permissions and service eligibility; no paid plan is activated automatically.`);
+        }
+        return { result: data.result, result_info: data.result_info };
+    };
+}
+export async function listCloudflare(request, endpoint) {
+    const result = [];
+    for (let page = 1; page <= 1000; page++) {
+        const response = await request('GET', `${endpoint}${endpoint.includes('?') ? '&' : '?'}page=${page}&per_page=100`);
+        if (!Array.isArray(response.result) ||
+            response.result.some((item) => !item || typeof item !== 'object'))
+            throw new Error('Unsupported provider resource list.');
+        result.push(...response.result);
+        const info = response.result_info;
+        if (info?.total_pages !== undefined ? page >= info.total_pages : response.result.length < 100)
+            return result;
+    }
+    throw new Error('Provider resource listing exceeded pagination limit.');
+}

package/dist/command.js

@@ -5,11 +5,20 @@ export function resolveCommand(command, args, platform = process.platform, searc
     if (platform !== 'win32' || !['pnpm', 'pnpm.cmd'].includes(command))
         return { command, args: [...args] };
     const directories = searchPath.split(';').filter(Boolean);
-    const executable = directories.map((directory) => path.join(directory, 'pnpm.exe')).find(existsSync);
+    const executable = directories
+        .map((directory) => path.join(directory, 'pnpm.exe'))
+        .find(existsSync);
     if (executable)
         return { command: executable, args: [...args] };
-    const entries = ['node_modules/pnpm/bin/pnpm.cjs', 'node_modules/corepack/dist/pnpm.js', 'pnpm.cjs', '../pnpm/bin/pnpm.cjs'];
-    const entry = directories.flatMap((directory) => entries.map((file) => path.join(directory, file))).find(existsSync);
+    const entries = [
+        'node_modules/pnpm/bin/pnpm.cjs',
+        'node_modules/corepack/dist/pnpm.js',
+        'pnpm.cjs',
+        '../pnpm/bin/pnpm.cjs',
+    ];
+    const entry = directories
+        .flatMap((directory) => entries.map((file) => path.join(directory, file)))
+        .find(existsSync);
     if (!entry)
         throw new Error('Cannot locate a direct pnpm entry point. Install pnpm or enable Corepack.');
     return { command: process.execPath, args: [entry, ...args] };

package/dist/delivery.d.ts

@@ -0,0 +1,118 @@
+import { type CloudflareRequest } from './cloudflare.js';
+import { type ApplicationProject } from './project-state.js';
+export { registerApplication, readApplication, defaultRunner, environment, targetDirectory, } from './project-state.js';
+export type { ApplicationProject, DeploymentTarget, DeliveryRunner } from './project-state.js';
+import type { DeploymentTarget } from './project-state.js';
+interface TargetRelease {
+    target: string;
+    versionId: string;
+    urls: string[];
+    providerConfirmed: boolean;
+}
+interface Release {
+    id: string;
+    commit: string;
+    startedAt: string;
+    finishedAt?: string;
+    state: 'running' | 'checked' | 'deployed' | 'failed';
+    targets: TargetRelease[];
+    failure?: string;
+    operation?: 'ship' | 'rollback';
+    restoredReleaseId?: string;
+    verification?: {
+        state: 'passed' | 'failed';
+        checkedAt: string;
+        command: 'pnpm run test:live';
+    };
+}
+export declare function connectApplication(root: string, accountId: string | undefined, audience: 'public' | 'private' | undefined, run?: import("./project-state.js").DeliveryRunner, emails?: string[]): Promise<ApplicationProject>;
+export declare function planDelivery(root: string): {
+    project: ApplicationProject;
+    checks: string[][];
+    deployments: {
+        target: string;
+        directory: string;
+        command: string[];
+    }[];
+    resourcesProvisioned: boolean;
+    audience: "unconfigured" | "public" | "private";
+};
+export declare function parseDeploymentOutput(source: string, target: DeploymentTarget): TargetRelease;
+interface ActiveVersion {
+    versionId: string;
+    percentage: number;
+}
+export declare function shipApplication(root: string, run?: import("./project-state.js").DeliveryRunner, suppliedRequest?: CloudflareRequest): Promise<{
+    projectId: string;
+    release: Release;
+    managementFile: string;
+    productVerification: string;
+    management: string;
+}>;
+export declare function applicationStatus(root: string, refresh?: boolean, run?: import("./project-state.js").DeliveryRunner): Promise<{
+    project: ApplicationProject;
+    access: import("./access.js").AccessReceipt[] | undefined;
+    architecture: {
+        target: string;
+        workerName: string;
+        directory: string;
+        bindings: {
+            kind: string;
+            binding: string;
+        }[];
+        scheduled: string[];
+    }[];
+    releases: Release[];
+    provider: {
+        target: string;
+        activeRecordedVersion: boolean;
+        versions: ActiveVersion[];
+    }[];
+    evidence: string;
+    productVerification: string;
+    management: string | null;
+}>;
+export declare function verifyApplication(root: string, run?: import("./project-state.js").DeliveryRunner): Promise<{
+    projectId: string;
+    releaseId: string;
+    verification: {
+        state: "passed" | "failed";
+        checkedAt: string;
+        command: "pnpm run test:live";
+    };
+    managementFile: string;
+}>;
+export declare function rollbackApplication(root: string, releaseId: string, dataCompatible: boolean, run?: import("./project-state.js").DeliveryRunner, suppliedRequest?: CloudflareRequest): Promise<{
+    projectId: string;
+    release: Release;
+    managementFile: string;
+    productVerification: string;
+    dataRestored: boolean;
+}>;
+/** Recover current provider evidence, never fabricate a historical release or source-to-version mapping. */
+export declare function recoverApplication(root: string, run?: import("./project-state.js").DeliveryRunner, suppliedRequest?: CloudflareRequest): Promise<{
+    schemaVersion: number;
+    projectId: string;
+    accountId: string | null;
+    checkedAt: string;
+    evidence: string;
+    localCommit: string;
+    sourceProvenance: string;
+    replayableReleaseId: string | null;
+    productVerification: string;
+    provider: {
+        target: string;
+        versions: ActiveVersion[];
+        bindingsConfirmed: boolean;
+    }[];
+    resources: {
+        kind: string;
+        name: string;
+        id: string;
+        target: string;
+    }[];
+    access: import("./access.js").AccessReceipt[] | undefined;
+    audience: "public" | "private";
+    audienceEvidence: string;
+    limitations: string[];
+}>;