anhedral 0.8.6 → 0.10.0

package/dist/platforms/extension.js

@@ -3,24 +3,28 @@ import { writeReactLintConfig } from './lint.js';
 import { writeFile } from '../util.js';
 import { EXTENSION_DEPENDENCIES } from '../dependencies.js';
 import { childPackageName, htmlText, jsString, markdownHeading } from '../render.js';
-export async function scaffoldExtension(root, options) {
-    const { projectName, displayName, extensionSurface = 'sidepanel' } = options;
+export async function scaffoldWxt({ root, options }) {
+    const projectName = options.name;
+    const displayName = options.name;
     const dir = path.join(root, 'apps/extension');
     writePackageJson(dir, projectName);
-    writeFile(path.join(dir, 'tsconfig.json'), JSON.stringify({ extends: './.wxt/tsconfig.json', compilerOptions: { strict: true, jsx: 'react-jsx', paths: { '@/*': ['./src/*'] } } }, null, 2) + '\n');
+    writeFile(path.join(dir, 'tsconfig.json'), JSON.stringify({
+        extends: './.wxt/tsconfig.json',
+        compilerOptions: { strict: true, jsx: 'react-jsx', paths: { '@/*': ['./src/*'] } },
+    }, null, 2) + '\n');
     writeReactLintConfig(dir);
-    writeWxtConfig(dir, displayName, extensionSurface);
+    writeWxtConfig(dir, displayName);
     writeEnvExample(dir);
     writePostcssConfig(dir);
+    writeTailwindConfig(dir);
     writeShadcnConfig(dir);
-    writeReadme(dir, displayName, extensionSurface);
+    writeReadme(dir, displayName);
     writeCnUtil(dir);
     writeButtonComponent(dir);
-    if (extensionSurface === 'sidepanel')
-        writeBackground(dir);
-    writeSurfaceEntry(dir, extensionSurface);
-    writeSurfaceHtml(dir, displayName, extensionSurface);
-    writeSurfaceApp(dir, extensionSurface);
+    writeBackground(dir);
+    writeSidepanelEntry(dir);
+    writeSidepanelHtml(dir, displayName);
+    writeSidepanelApp(dir);
     writeStyles(dir);
 }
 function writePackageJson(dir, projectName) {
@@ -38,10 +42,14 @@ function writePackageJson(dir, projectName) {
             lint: 'eslint src --max-warnings 0',
         },
         dependencies: EXTENSION_DEPENDENCIES.dependencies,
-        devDependencies: { ...EXTENSION_DEPENDENCIES.devDependencies, '@workspace/eslint-config': 'workspace:*', eslint: '9.39.5' },
+        devDependencies: {
+            ...EXTENSION_DEPENDENCIES.devDependencies,
+            '@workspace/eslint-config': 'workspace:*',
+            eslint: '10.0.3',
+        },
     }, null, 2) + '\n');
 }
-function writeWxtConfig(dir, displayName, surface) {
+function writeWxtConfig(dir, displayName) {
     const nameLiteral = jsString(displayName);
     const descriptionLiteral = jsString(`${displayName} Chrome Extension`);
     const actionTitleLiteral = jsString(`Open ${displayName}`);
@@ -59,14 +67,15 @@ export default defineConfig({
       description: ${descriptionLiteral},
       version: '0.1.0',
       ...(crxPublicKey ? { key: crxPublicKey } : {}),
-      ${surface === 'sidepanel' ? "minimum_chrome_version: '114'," : ''}
-      permissions: ${surface === 'sidepanel' ? "['activeTab', 'scripting', 'sidePanel']" : "['activeTab', 'scripting']"},
+      minimum_chrome_version: '114',
+      permissions: ['activeTab', 'scripting', 'sidePanel'],
       host_permissions: [],
       action: {
         default_title: ${actionTitleLiteral},
-        ${surface === 'popup' ? "default_popup: 'popup.html'," : ''}
       },
-      ${surface === 'sidepanel' ? "side_panel: { default_path: 'sidepanel.html' }," : ''}
+      side_panel: {
+        default_path: 'sidepanel.html',
+      },
     };
   },
   modules: ['@wxt-dev/module-react'],
@@ -90,7 +99,8 @@ function writeEnvExample(dir) {
 function writePostcssConfig(dir) {
     writeFile(path.join(dir, 'postcss.config.cjs'), `module.exports = {
   plugins: {
-    "@tailwindcss/postcss": {},
+    tailwindcss: {},
+    autoprefixer: {},
   },
 };
 `);
@@ -162,10 +172,62 @@ export const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
 Button.displayName = 'Button';
 `);
 }
-function writeReadme(dir, displayName, surface) {
+function writeTailwindConfig(dir) {
+    writeFile(path.join(dir, 'tailwind.config.cjs'), `/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ['./src/**/*.{ts,tsx,html}'],
+  theme: {
+    extend: {
+      colors: {
+        border: 'hsl(var(--border))',
+        input: 'hsl(var(--input))',
+        ring: 'hsl(var(--ring))',
+        background: 'hsl(var(--background))',
+        foreground: 'hsl(var(--foreground))',
+        primary: {
+          DEFAULT: 'hsl(var(--primary))',
+          foreground: 'hsl(var(--primary-foreground))',
+        },
+        secondary: {
+          DEFAULT: 'hsl(var(--secondary))',
+          foreground: 'hsl(var(--secondary-foreground))',
+        },
+        destructive: {
+          DEFAULT: 'hsl(var(--destructive))',
+          foreground: 'hsl(var(--destructive-foreground))',
+        },
+        muted: {
+          DEFAULT: 'hsl(var(--muted))',
+          foreground: 'hsl(var(--muted-foreground))',
+        },
+        accent: {
+          DEFAULT: 'hsl(var(--accent))',
+          foreground: 'hsl(var(--accent-foreground))',
+        },
+        popover: {
+          DEFAULT: 'hsl(var(--popover))',
+          foreground: 'hsl(var(--popover-foreground))',
+        },
+        card: {
+          DEFAULT: 'hsl(var(--card))',
+          foreground: 'hsl(var(--card-foreground))',
+        },
+      },
+      borderRadius: {
+        lg: 'var(--radius)',
+        md: 'calc(var(--radius) - 2px)',
+        sm: 'calc(var(--radius) - 4px)',
+      },
+    },
+  },
+  plugins: [],
+};
+`);
+}
+function writeReadme(dir, displayName) {
     writeFile(path.join(dir, 'README.md'), `# ${markdownHeading(displayName)} Chrome Extension
 
-WXT ${surface} extension generated by anhedral. Choose the surface for the task; content UI, options pages and background-only behavior require targeted implementation.
+WXT side-panel extension generated by anhedral.
 
 ## Development
 
@@ -182,25 +244,29 @@ Run these commands from \`apps/extension\`. Anhedral generates only \`.env.examp
 
 Run \`pnpm build\`, then load \`.output/chrome-mv3\` as an unpacked extension from \`chrome://extensions\`.
 
-${surface === 'sidepanel' ? "The browser action opens the Side Panel API surface (Chrome 114+) with the sidePanel permission." : "The browser action opens popup.html; no sidePanel permission or panel background handler is generated."} Active-page reads use a user-triggered activeTab + scripting grant instead of persistent site access. Remove these permissions and the example read action if the product does not need page inspection.
+The extension uses Chrome's Side Panel API. The browser action opens \`sidepanel.html\`, \`wxt.config.ts\` declares the \`sidePanel\` permission and Chrome 114+ minimum version, and active-page reads use a user-triggered \`activeTab\` + \`scripting\` grant instead of persistent site access.
 `);
 }
 function writeBackground(dir) {
-    writeFile(path.join(dir, 'src/entrypoints/background.ts'), `import { browser } from 'wxt/browser';
+    writeFile(path.join(dir, 'src/entrypoints/background.ts'), `type ChromeWithSidePanel = typeof chrome & {
+  sidePanel: {
+    setPanelBehavior: (behavior: { openPanelOnActionClick: boolean }) => Promise<void>;
+  };
+};
 
 export default defineBackground(() => {
 
   // Open the side panel when the extension icon is clicked.
-  browser.sidePanel
+  (chrome as ChromeWithSidePanel).sidePanel
     .setPanelBehavior({ openPanelOnActionClick: true })
     .catch(() => {});
 });
 `);
 }
-function writeSurfaceEntry(dir, surface) {
-    writeFile(path.join(dir, `src/entrypoints/${surface}/main.tsx`), `import * as React from 'react';
+function writeSidepanelEntry(dir) {
+    writeFile(path.join(dir, 'src/entrypoints/sidepanel/main.tsx'), `import * as React from 'react';
 import { createRoot } from 'react-dom/client';
-import { ExtensionApp } from './app';
+import { SidePanelApp } from './app';
 import '../../styles/main.css';
 
 const container = document.getElementById('root');
@@ -208,14 +274,14 @@ if (container) {
   const root = createRoot(container);
   root.render(
     <React.StrictMode>
-      <ExtensionApp />
+      <SidePanelApp />
     </React.StrictMode>
   );
 }
 `);
 }
-function writeSurfaceHtml(dir, displayName, surface) {
-    writeFile(path.join(dir, `src/entrypoints/${surface}/index.html`), `<!DOCTYPE html>
+function writeSidepanelHtml(dir, displayName) {
+    writeFile(path.join(dir, 'src/entrypoints/sidepanel/index.html'), `<!DOCTYPE html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
@@ -229,9 +295,8 @@ function writeSurfaceHtml(dir, displayName, surface) {
 </html>
 `);
 }
-function writeSurfaceApp(dir, surface) {
-    writeFile(path.join(dir, `src/entrypoints/${surface}/app.tsx`), `import * as React from 'react';
-import { browser } from 'wxt/browser';
+function writeSidepanelApp(dir) {
+    writeFile(path.join(dir, 'src/entrypoints/sidepanel/app.tsx'), `import * as React from 'react';
 import { Button } from '../../components/ui/button';
 
 type PageSnapshot = {
@@ -240,21 +305,17 @@ type PageSnapshot = {
 };
 
 async function readPageSnapshot(): Promise<PageSnapshot> {
-  const [tab] = await browser.tabs.query({ active: true, currentWindow: true });
+  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
   if (!tab?.id) throw new Error('No active tab is available.');
-  const [injection] = await browser.scripting.executeScript({
+  const [{ result }] = await chrome.scripting.executeScript({
     target: { tabId: tab.id },
     func: () => ({ title: document.title, location: window.location.href }),
   });
-  return requireSnapshot(injection?.result);
-}
-
-function requireSnapshot(result: PageSnapshot | undefined): PageSnapshot {
   if (!result) throw new Error('The active page did not return a snapshot.');
-  return result;
+  return result as PageSnapshot;
 }
 
-export function ExtensionApp() {
+export function SidePanelApp() {
   const [page, setPage] = React.useState<PageSnapshot | null>(null);
   const [pageError, setPageError] = React.useState<string | null>(null);
 
@@ -269,7 +330,7 @@ export function ExtensionApp() {
 
 
   return (
-    <div style={{ padding: 24${surface === 'popup' ? ', minWidth: 320' : ''} }}>
+    <div style={{ padding: 24 }}>
       <h2>Welcome!</h2>
       <Button type="button" onClick={() => void readActivePage()}>Read active page</Button>
       {page ? (
@@ -285,32 +346,9 @@ export function ExtensionApp() {
 `);
 }
 function writeStyles(dir) {
-    writeFile(path.join(dir, 'src/styles/main.css'), `@import "tailwindcss";
-
-@theme inline {
-  --color-background: hsl(var(--background));
-  --color-foreground: hsl(var(--foreground));
-  --color-card: hsl(var(--card));
-  --color-card-foreground: hsl(var(--card-foreground));
-  --color-popover: hsl(var(--popover));
-  --color-popover-foreground: hsl(var(--popover-foreground));
-  --color-primary: hsl(var(--primary));
-  --color-primary-foreground: hsl(var(--primary-foreground));
-  --color-secondary: hsl(var(--secondary));
-  --color-secondary-foreground: hsl(var(--secondary-foreground));
-  --color-muted: hsl(var(--muted));
-  --color-muted-foreground: hsl(var(--muted-foreground));
-  --color-accent: hsl(var(--accent));
-  --color-accent-foreground: hsl(var(--accent-foreground));
-  --color-destructive: hsl(var(--destructive));
-  --color-destructive-foreground: hsl(var(--destructive-foreground));
-  --color-border: hsl(var(--border));
-  --color-input: hsl(var(--input));
-  --color-ring: hsl(var(--ring));
-  --radius-lg: var(--radius);
-  --radius-md: calc(var(--radius) - 2px);
-  --radius-sm: calc(var(--radius) - 4px);
-}
+    writeFile(path.join(dir, 'src/styles/main.css'), `@tailwind base;
+@tailwind components;
+@tailwind utilities;
 
 @layer base {
   :root {

package/dist/platforms/mobile.d.ts

@@ -1,2 +1,2 @@
-import type { ProjectOptions } from '../project.js';
-export declare function scaffoldMobile(root: string, options: ProjectOptions): Promise<void>;
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldExpo({ root, options }: RecipeContext): Promise<void>;

package/dist/platforms/mobile.js

@@ -118,9 +118,7 @@ module.exports = {
 }
 function expoScheme(projectName) {
     const unscoped = projectName.replace(/^@[^/]+\//, '');
-    const safe = unscoped
-        .toLowerCase()
-        .replace(/[^a-z0-9+.-]+/g, '-');
+    const safe = unscoped.toLowerCase().replace(/[^a-z0-9+.-]+/g, '-');
     let start = 0;
     let end = safe.length;
     while (start < end && '+.-'.includes(safe[start]))
@@ -131,9 +129,10 @@ function expoScheme(projectName) {
     const candidate = normalized || 'app';
     return /^[a-z]/.test(candidate) ? candidate : `app-${candidate}`;
 }
-export async function scaffoldMobile(root, options) {
+export async function scaffoldExpo({ root, options }) {
     const dir = path.join(root, 'apps/mobile');
-    const { projectName, displayName } = options;
+    const projectName = options.name;
+    const displayName = options.name;
     const nameLiteral = jsString(displayName);
     writeReactLintConfig(dir);
     writeFile(path.join(dir, 'package.json'), JSON.stringify({
@@ -158,8 +157,15 @@ export async function scaffoldMobile(root, options) {
             typecheck: 'tsc --noEmit',
             lint: 'eslint app components lib --max-warnings 0',
         },
-        dependencies: { ...MOBILE_APP_DEPENDENCIES.dependencies, ...MOBILE_NATIVEWIND_DEPENDENCIES.dependencies },
-        devDependencies: { ...MOBILE_APP_DEPENDENCIES.devDependencies, '@workspace/eslint-config': 'workspace:*', eslint: '9.39.5' },
+        dependencies: {
+            ...MOBILE_APP_DEPENDENCIES.dependencies,
+            ...MOBILE_NATIVEWIND_DEPENDENCIES.dependencies,
+        },
+        devDependencies: {
+            ...MOBILE_APP_DEPENDENCIES.devDependencies,
+            '@workspace/eslint-config': 'workspace:*',
+            eslint: '10.0.3',
+        },
     }, null, 2) + '\n');
     writeFile(path.join(dir, 'app.json'), JSON.stringify({
         expo: {

package/dist/pnpm-policy.d.ts

@@ -1,6 +1,4 @@
 /** Preserve unrelated starter YAML while replacing the settings this initializer owns. */
 export declare function setPnpmPolicy(root: string, policy: Record<string, unknown>): void;
-/** Only reads the JSON-compatible values written above, never arbitrary client YAML. */
-export declare function generatedPnpmPolicy(root: string, key: string): Record<string, string>;
 /** Merge reviewed patches without deleting starter-maintained mappings. */
 export declare function mergePnpmPatches(root: string, patches: Record<string, string>): void;

package/dist/pnpm-policy.js

@@ -17,12 +17,6 @@ export function setPnpmPolicy(root, policy) {
     }
     writeFile(file, source);
 }
-/** Only reads the JSON-compatible values written above, never arbitrary client YAML. */
-export function generatedPnpmPolicy(root, key) {
-    const source = readFileSync(path.join(root, 'pnpm-workspace.yaml'), 'utf8');
-    const value = source.match(new RegExp(`^${key}: (.+)$`, 'm'))?.[1];
-    return value ? JSON.parse(value) : {};
-}
 /** Merge reviewed patches without deleting starter-maintained mappings. */
 export function mergePnpmPatches(root, patches) {
     const file = path.join(root, 'pnpm-workspace.yaml');
@@ -32,8 +26,11 @@ export function mergePnpmPatches(root, patches) {
         throw new Error('Duplicate patchedDependencies configuration');
     const block = blocks[0]?.[0] ?? '';
     const existing = patchRows(block, patches);
-    const replacement = 'patchedDependencies:\n' + existing + Object.entries(patches)
-        .map(([key, value]) => `  ${JSON.stringify(key)}: ${JSON.stringify(value)}\n`).join('');
+    const replacement = 'patchedDependencies:\n' +
+        existing +
+        Object.entries(patches)
+            .map(([key, value]) => `  ${JSON.stringify(key)}: ${JSON.stringify(value)}\n`)
+            .join('');
     const remaining = source.replace(policyBlock('patchedDependencies'), '');
     writeFile(file, remaining + `${remaining.endsWith('\n') || !remaining ? '' : '\n'}${replacement}`);
 }
@@ -44,18 +41,26 @@ function patchRows(block, patches) {
     const value = header.slice(header.indexOf(':') + 1).trim();
     if (value && !value.startsWith('#')) {
         const object = JSON.parse(value);
-        if (!object || Array.isArray(object) || typeof object !== 'object' ||
+        if (!object ||
+            Array.isArray(object) ||
+            typeof object !== 'object' ||
             Object.values(object).some((entry) => typeof entry !== 'string'))
             throw new Error('Unsupported patchedDependencies mapping');
-        return Object.entries(object).filter(([key]) => !Object.hasOwn(patches, key))
-            .map(([key, entry]) => `  ${JSON.stringify(key)}: ${JSON.stringify(entry)}\n`).join('');
+        return Object.entries(object)
+            .filter(([key]) => !Object.hasOwn(patches, key))
+            .map(([key, entry]) => `  ${JSON.stringify(key)}: ${JSON.stringify(entry)}\n`)
+            .join('');
     }
-    return rows.filter((row) => {
+    return rows
+        .filter((row) => {
         if (!row.trim() || row.trimStart().startsWith('#'))
             return true;
         const match = row.match(/^  (?:"([^"\\]+)"|'([^']+)'|([^\s:'"]+)):\s*(?:"[^"\\]+"|'[^']+'|[^\s{}[\]&*!|>]+)(?:\s+#.*)?\s*$/);
         if (!match)
             throw new Error('Unsupported patchedDependencies mapping');
         return !Object.hasOwn(patches, match[1] ?? match[2] ?? match[3]);
-    }).filter((row, index, rows) => row || index < rows.length - 1).map((row) => `${row}\n`).join('');
+    })
+        .filter((row, index, rows) => row || index < rows.length - 1)
+        .map((row) => `${row}\n`)
+        .join('');
 }

package/dist/project-state.d.ts

@@ -0,0 +1,28 @@
+export interface DeploymentTarget {
+    id: string;
+    directory: string;
+    workerName: string;
+}
+export interface ApplicationProject {
+    schemaVersion: 1;
+    id: string;
+    name: string;
+    ownership: 'customer';
+    provider: 'cloudflare';
+    accountId: string | null;
+    audience: 'unconfigured' | 'public' | 'private';
+    access?: {
+        emails: string[];
+    };
+    targets: DeploymentTarget[];
+}
+export type DeliveryRunner = (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv) => Promise<string>;
+export declare function atomicJson(file: string, value: unknown): void;
+export declare function readConfig(directory: string): Record<string, unknown>;
+export declare function targetDirectory(root: string, target: DeploymentTarget): string;
+export declare function registerApplication(root: string, extendTargets?: boolean): ApplicationProject;
+export declare function readApplication(root: string): ApplicationProject;
+export declare const defaultRunner: DeliveryRunner;
+export declare function environment(project: ApplicationProject): NodeJS.ProcessEnv;
+export declare function authenticate(root: string, project: ApplicationProject, run: DeliveryRunner): Promise<void>;
+export declare function withApplicationLock<T>(root: string, operation: () => Promise<T>): Promise<T>;

package/dist/project-state.js

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { parse } from 'jsonc-parser';
+import { resolveCommand } from './command.js';
+const manifestName = 'anhedral.project.json';
+const stateDirectory = '.anhedral';
+const accountPattern = /^[a-f0-9]{32}$/i;
+const workerPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function atomicJson(file, value) {
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function readConfig(directory) {
+    const errors = [];
+    const value = parse(readFileSync(path.join(directory, 'wrangler.jsonc'), 'utf8'), errors);
+    if (errors.length || !value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid Wrangler JSONC configuration.');
+    return value;
+}
+export function targetDirectory(root, target) {
+    if (!/^apps\/[a-z0-9-]+$/.test(target.directory))
+        throw new Error('Deployment targets must be direct apps/* directories.');
+    const directory = realpathSync(path.join(root, target.directory));
+    if (!directory.startsWith(realpathSync(root) + path.sep))
+        throw new Error('Deployment target escapes the project.');
+    return directory;
+}
+export function registerApplication(root, extendTargets = false) {
+    root = realpathSync(root);
+    const existing = existsSync(path.join(root, manifestName)) ? readApplication(root) : undefined;
+    if (existing && !extendTargets)
+        return existing;
+    const setup = JSON.parse(readFileSync(path.join(root, 'anhedral.setup.json'), 'utf8'));
+    if (!['cloudflare', 'vercel'].includes(setup.hosting))
+        throw new Error('Automatic delivery currently supports Cloudflare projects.');
+    const targets = readdirSync(path.join(root, 'apps'), { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .filter((entry) => existsSync(path.join(root, 'apps', entry.name, 'wrangler.jsonc')))
+        .map((entry) => {
+        const workerName = readConfig(path.join(root, 'apps', entry.name)).name;
+        if (typeof workerName !== 'string' || !workerPattern.test(workerName))
+            throw new Error('Invalid Worker name.');
+        return { id: entry.name, directory: `apps/${entry.name}`, workerName };
+    })
+        .sort((a, b) => (a.id === 'web' ? 1 : b.id === 'web' ? -1 : a.id.localeCompare(b.id)));
+    if (existing) {
+        if (existing.targets.some((target) => !targets.some((candidate) => candidate.id === target.id &&
+            candidate.directory === target.directory &&
+            candidate.workerName === target.workerName)))
+            throw new Error('Addition cannot replace existing delivery targets.');
+        const extended = { ...existing, targets };
+        atomicJson(path.join(root, manifestName), extended);
+        return extended;
+    }
+    const project = {
+        schemaVersion: 1,
+        id: randomUUID(),
+        name: JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8')).name ?? path.basename(root),
+        ownership: 'customer',
+        provider: 'cloudflare',
+        accountId: null,
+        audience: 'unconfigured',
+        targets,
+    };
+    const ignoreFile = path.join(root, '.gitignore');
+    const ignored = existsSync(ignoreFile) ? readFileSync(ignoreFile, 'utf8') : '';
+    if (!ignored.split(/\r?\n/).includes('.anhedral/'))
+        writeFileSync(ignoreFile, ignored + (ignored.endsWith('\n') || !ignored ? '' : '\n') + '.anhedral/\n');
+    atomicJson(path.join(root, manifestName), project);
+    return project;
+}
+export function readApplication(root) {
+    const project = JSON.parse(readFileSync(path.join(root, manifestName), 'utf8'));
+    if (project.schemaVersion !== 1 ||
+        typeof project.id !== 'string' ||
+        !/^[a-f0-9-]{36}$/i.test(project.id) ||
+        project.ownership !== 'customer' ||
+        project.provider !== 'cloudflare' ||
+        !(project.accountId === null || accountPattern.test(project.accountId)) ||
+        !['unconfigured', 'public', 'private'].includes(project.audience) ||
+        !Array.isArray(project.targets))
+        throw new Error('Invalid application manifest.');
+    if (project.access &&
+        (!Array.isArray(project.access.emails) ||
+            project.access.emails.some((email) => typeof email !== 'string')))
+        throw new Error('Invalid private audience configuration.');
+    if (project.audience === 'private' && !project.access?.emails.length)
+        throw new Error('Private delivery requires explicit allowed members.');
+    const ids = new Set();
+    const workers = new Set();
+    for (const target of project.targets) {
+        if (!target ||
+            typeof target.id !== 'string' ||
+            typeof target.workerName !== 'string' ||
+            !/^[a-z0-9-]+$/.test(target.id) ||
+            ids.has(target.id) ||
+            workers.has(target.workerName) ||
+            !workerPattern.test(target.workerName))
+            throw new Error('Invalid or duplicate deployment target.');
+        ids.add(target.id);
+        workers.add(target.workerName);
+        targetDirectory(root, target);
+    }
+    return project;
+}
+export const defaultRunner = (command, args, cwd, env) => new Promise((resolve, reject) => {
+    const invocation = resolveCommand(command, args);
+    const child = spawn(invocation.command, invocation.args, {
+        cwd,
+        env,
+        detached: process.platform !== 'win32',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let output = '';
+    let oversized = false;
+    let interrupted = false;
+    let timedOut = false;
+    let forceTimer;
+    const kill = (signal) => {
+        if (!child.pid)
+            return;
+        if (process.platform === 'win32')
+            spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' });
+        else {
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch {
+                /* The process group already exited. */
+            }
+        }
+    };
+    const stop = () => {
+        kill('SIGTERM');
+        forceTimer ??= setTimeout(() => kill('SIGKILL'), 2000);
+        forceTimer.unref();
+    };
+    const interrupt = () => {
+        interrupted = true;
+        stop();
+    };
+    process.once('SIGINT', interrupt);
+    process.once('SIGTERM', interrupt);
+    child.stdout.on('data', (chunk) => {
+        if (!oversized)
+            output += chunk.toString();
+        if (output.length > 8 * 1024 * 1024) {
+            oversized = true;
+            stop();
+        }
+    });
+    // Do not persist raw build/provider output: it can contain credentials or customer data.
+    child.stderr.resume();
+    const timer = setTimeout(() => {
+        timedOut = true;
+        stop();
+    }, 20 * 60 * 1000);
+    const clean = () => {
+        clearTimeout(timer);
+        if (forceTimer)
+            clearTimeout(forceTimer);
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', interrupt);
+    };
+    child.on('error', () => {
+        clean();
+        reject(new Error(`Cannot run ${command}; check local tooling.`));
+    });
+    child.on('close', (code) => {
+        clean();
+        if (code === 0 && !oversized && !interrupted && !timedOut)
+            resolve(output);
+        else
+            reject(new Error(`${command} ${args.slice(0, 3).join(' ')} ${interrupted ? 'was interrupted' : timedOut ? 'timed out' : 'failed'}; inspect the project command locally.`));
+    });
+});
+export function environment(project) {
+    if (!project.accountId)
+        throw new Error('Connect the intended Cloudflare account first.');
+    if (process.env.CLOUDFLARE_ACCOUNT_ID && process.env.CLOUDFLARE_ACCOUNT_ID !== project.accountId)
+        throw new Error('Cloudflare environment account conflicts with the registered account.');
+    if (process.env.CLOUDFLARE_ENV)
+        throw new Error('Register a separate project configuration for the intended environment; CLOUDFLARE_ENV overrides are unsupported.');
+    return {
+        ...process.env,
+        CLOUDFLARE_ACCOUNT_ID: project.accountId,
+        CI: 'true',
+        NO_COLOR: '1',
+        FORCE_COLOR: '0',
+    };
+}
+export async function authenticate(root, project, run) {
+    const identity = JSON.parse(await run('pnpm', ['exec', 'wrangler', 'whoami', '--json'], targetDirectory(root, project.targets[0]), environment(project)));
+    if (identity.loggedIn !== true ||
+        !Array.isArray(identity.accounts) ||
+        !identity.accounts.some((account) => account.id === project.accountId))
+        throw new Error('Wrangler cannot access the registered Cloudflare account. Run wrangler login or configure scoped credentials.');
+}
+export async function withApplicationLock(root, operation) {
+    root = realpathSync(root);
+    const state = path.join(root, stateDirectory);
+    mkdirSync(state, { recursive: true });
+    if (realpathSync(state) !== path.join(root, stateDirectory))
+        throw new Error('Delivery state directory must not be a symbolic link.');
+    const lock = path.join(state, 'ship.lock');
+    try {
+        mkdirSync(lock);
+    }
+    catch {
+        throw new Error('Another delivery is running or was interrupted. Inspect provider status and remove .anhedral/ship.lock only after confirming no delivery is active.');
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        rmSync(lock, { recursive: true, force: true });
+    }
+}