anhedral 0.8.6 → 0.9.0

package/dist/registry/remote.js

@@ -0,0 +1,168 @@
+import { createHash } from 'node:crypto';
+import { readBoundedFile } from '../bounded-file.js';
+import path from 'node:path';
+import { dependencyOrder } from '../dependency-order.js';
+import { assertSafeTarget } from './receipt.js';
+const identifier = /^[a-z][a-z0-9-]{0,62}$/;
+const limit = 2 * 1024 * 1024;
+/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
+export function validateSourceRegistry(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Invalid source registry.');
+    const registry = value;
+    if (registry.schemaVersion !== 1 ||
+        typeof registry.name !== 'string' ||
+        !identifier.test(registry.name) ||
+        !Array.isArray(registry.items) ||
+        !registry.items.length ||
+        registry.items.length > 100)
+        throw new Error('Unsupported source registry schema.');
+    const names = new Set();
+    const files = new Set();
+    for (const item of registry.items) {
+        if (!item ||
+            typeof item.name !== 'string' ||
+            !identifier.test(item.name) ||
+            names.has(item.name) ||
+            typeof item.version !== 'string' ||
+            !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(item.version) ||
+            !Array.isArray(item.registryDependencies) ||
+            !item.registryDependencies.every((id) => typeof id === 'string' && identifier.test(id)) ||
+            !Array.isArray(item.files) ||
+            !item.files.length)
+            throw new Error('Invalid or duplicate source registry item.');
+        names.add(item.name);
+        for (const file of item.files) {
+            if (!file || typeof file.target !== 'string' || typeof file.content !== 'string')
+                throw new Error('Invalid registry file.');
+            assertSafeTarget('/registry-validation', file.target);
+            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.target) ||
+                file.target
+                    .split('/')
+                    .some((part) => part.startsWith('.') ||
+                    ['node_modules', 'dist', 'release', 'anhedral.registry.json'].includes(part)) ||
+                files.has(file.target))
+                throw new Error(`Unsafe or duplicate source target: ${file.target}.`);
+            files.add(file.target);
+            if (path.basename(file.target) === 'package.json') {
+                const manifest = JSON.parse(file.content);
+                if (!manifest ||
+                    typeof manifest !== 'object' ||
+                    Array.isArray(manifest) ||
+                    manifest.private !== true ||
+                    typeof manifest.name !== 'string' ||
+                    !/^@workspace\/[a-z][a-z0-9-]*$/.test(manifest.name))
+                    throw new Error('Remote workspace manifests must be private @workspace packages.');
+                if (manifest.scripts &&
+                    Object.keys(manifest.scripts).some((key) => /^(?:preinstall|install|postinstall|preprepare|prepare|postprepare|prepublish|prepublishOnly|pnpm:devPreinstall)$/.test(key)))
+                    throw new Error('Remote installation hooks are unsupported.');
+                for (const field of [
+                    'dependencies',
+                    'devDependencies',
+                    'optionalDependencies',
+                    'peerDependencies',
+                ]) {
+                    if (manifest[field] &&
+                        (typeof manifest[field] !== 'object' ||
+                            Array.isArray(manifest[field]) ||
+                            Object.values(manifest[field]).some((version) => typeof version !== 'string' ||
+                                !/^(?:workspace:[*^~]|[~^]?\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?)$/.test(version))))
+                        throw new Error('Remote dependencies require versioned npm or workspace references.');
+                }
+            }
+        }
+    }
+    dependencyOrder(new Map(registry.items.map((item) => [item.name, item.registryDependencies])), 'Remote registry');
+    return structuredClone(registry);
+}
+export async function loadSourceRegistry(source, fetcher = fetch) {
+    let bytes;
+    if (/^https?:/.test(source)) {
+        const url = new URL(source);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            url.search ||
+            !/^[a-z0-9.-]+$/i.test(url.hostname) ||
+            url.hostname === 'localhost' ||
+            !url.hostname.includes('.') ||
+            /^\d+(?:\.\d+){3}$/.test(url.hostname))
+            throw new Error('Remote registries require a public HTTPS URL without credentials or query parameters.');
+        const response = await fetcher(url, { redirect: 'error', signal: AbortSignal.timeout(15_000) });
+        if (!response.ok || !response.body)
+            throw new Error('Cannot retrieve source registry.');
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const result = await reader.read();
+                if (result.done)
+                    break;
+                size += result.value.byteLength;
+                if (size > limit)
+                    throw new Error('Source registry exceeds 2 MiB.');
+                chunks.push(result.value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        bytes = Buffer.concat(chunks);
+        source = url.href;
+    }
+    else {
+        source = path.resolve(source);
+        bytes = readBoundedFile(source, limit);
+    }
+    if (bytes.length > limit)
+        throw new Error('Source registry exceeds 2 MiB.');
+    return {
+        source,
+        integrity: `sha256-${createHash('sha256').update(bytes).digest('base64')}`,
+        registry: validateSourceRegistry(JSON.parse(bytes.toString('utf8'))),
+    };
+}
+export function resolveSourceItems(registry, selected) {
+    const catalog = new Map(registry.items.map((item) => [item.name, item]));
+    const graph = new Map();
+    const collect = (name) => {
+        if (graph.has(name))
+            return;
+        const item = catalog.get(name);
+        if (!item)
+            throw new Error(`Unknown remote registry item: ${name}.`);
+        graph.set(name, item.registryDependencies);
+        item.registryDependencies.forEach(collect);
+    };
+    selected.forEach(collect);
+    return dependencyOrder(graph, 'Remote registry').map((name) => catalog.get(name));
+}
+/** Compile repository-relative source paths into a distributable JSON payload. */
+export function buildSourceRegistry(manifestFile) {
+    const root = path.dirname(path.resolve(manifestFile));
+    const registry = JSON.parse(readBoundedFile(manifestFile, limit).toString('utf8'));
+    if (!Array.isArray(registry.items))
+        throw new Error('Invalid source registry manifest.');
+    for (const item of registry.items) {
+        if (!Array.isArray(item.files))
+            throw new Error('Invalid registry file list.');
+        for (const file of item.files) {
+            if (file.path === undefined)
+                continue;
+            if (typeof file.path !== 'string' || file.content !== undefined)
+                throw new Error('Declare one source path or embedded content.');
+            assertSafeTarget(root, file.path);
+            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.path) ||
+                file.path.split('/').some((part) => part.startsWith('.') || part === 'node_modules'))
+                throw new Error('Registry source paths must stay in application or package source.');
+            const source = path.join(root, file.path);
+            file.content = readBoundedFile(source, limit).toString('utf8');
+            delete file.path;
+        }
+    }
+    if (Buffer.byteLength(JSON.stringify(registry)) > limit)
+        throw new Error('Source registry exceeds 2 MiB.');
+    return validateSourceRegistry(registry);
+}

package/dist/registry/resolve.d.ts

@@ -0,0 +1,10 @@
+import type { Hosting, StandardOptions, StandardProduct, StackRegistryItem } from './types.js';
+/** Apply default selections once. All callers then use the same strict graph resolver. */
+export declare function resolveStandardProducts(selected: Set<StandardProduct>, hosting: Hosting, hostingSpecified: boolean): void;
+export interface ResolvedStackRegistry {
+    schemaVersion: number;
+    name: string;
+    cliVersion: string;
+    items: StackRegistryItem[];
+}
+export declare function resolveStackRegistry(options: Pick<StandardOptions, 'products' | 'hosting'> & Partial<Pick<StandardOptions, 'name'>>): ResolvedStackRegistry;

package/dist/registry/resolve.js

@@ -0,0 +1,98 @@
+import { dependencyOrder } from '../dependency-order.js';
+import { STANDARD_PRODUCTS, STACK_REGISTRY, getStackDefinition, getStackItem, } from '../stack-registry.js';
+import { createResolutionContext } from './context.js';
+function hasServer(context) {
+    return context.has('hono') || context.has('vinext') || context.has('next');
+}
+function needsWorker(name, context) {
+    const definition = getStackDefinition(name);
+    return (definition.runtime === 'worker' ||
+        (definition.runtime === 'optional-worker' && hasServer(context)));
+}
+function validateProducts(selected, hosting) {
+    if (!['cloudflare', 'vercel'].includes(hosting))
+        throw new Error('hosting must be cloudflare or vercel.');
+    for (const id of selected) {
+        if (!STANDARD_PRODUCTS.includes(id))
+            throw new Error(`Unknown stack product: ${id}.`);
+        const { conflicts = [], requiresAny = [], requiresAll = [] } = getStackDefinition(id).selection;
+        const conflict = conflicts.find((other) => selected.has(other));
+        if (conflict)
+            throw new Error(`Choose one of ${id} / ${conflict}.`);
+        if (requiresAny.length && !requiresAny.some((other) => selected.has(other)))
+            throw new Error(`${id} requires an explicitly selected ${requiresAny.join(' or ')} capability.`);
+        const missing = requiresAll.filter((other) => !selected.has(other));
+        if (missing.length)
+            throw new Error(`${id} requires ${missing.join(', ')}; select it explicitly.`);
+    }
+    if (selected.has('vinext') && hosting !== 'cloudflare')
+        throw new Error('Vinext requires Cloudflare hosting; select --next for Vercel.');
+}
+/** Apply default selections once. All callers then use the same strict graph resolver. */
+export function resolveStandardProducts(selected, hosting, hostingSpecified) {
+    for (const id of selected)
+        getStackDefinition(id);
+    if (![...selected].some((id) => getStackDefinition(id).type === 'application'))
+        selected.add(hosting === 'vercel' ? 'next' : 'vinext');
+    for (const id of selected) {
+        const definition = getStackDefinition(id);
+        const alternatives = definition.selection.requiresAny ?? [];
+        if (definition.fallbackDependency &&
+            !alternatives.some((other) => selected.has(other)))
+            selected.add(definition.fallbackDependency);
+    }
+    const context = createResolutionContext({ products: [...selected], hosting });
+    if (context.has('next') &&
+        hosting === 'vercel' &&
+        [...selected].some((id) => needsWorker(id, context)))
+        selected.add('hono');
+    if (hostingSpecified && !selected.has('next') && !selected.has('vinext'))
+        throw new Error('--hosting applies to the web application.');
+    resolveStackRegistry({ products: [...selected], hosting });
+}
+export function resolveStackRegistry(options) {
+    const selected = new Set(options.products);
+    validateProducts(selected, options.hosting);
+    if (![...selected].some((id) => getStackDefinition(id).type === 'application'))
+        throw new Error('Stack registry requires an application.');
+    const context = createResolutionContext(options);
+    const resolved = new Map();
+    const collect = (name) => {
+        if (resolved.has(name))
+            return;
+        const definition = getStackDefinition(name);
+        const metadata = getStackItem(name);
+        const dependencies = new Set(definition.registryDependencies);
+        if (definition.runtime) {
+            if (!hasServer(context) && definition.runtime !== 'optional-worker')
+                throw new Error(`${name} requires a server runtime.`);
+            if (needsWorker(name, context) &&
+                !context.has('hono') &&
+                !(options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
+                throw new Error(`${name} requires a Cloudflare runtime.`);
+            if (hasServer(context))
+                dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
+        }
+        for (const dependency of definition.resolveDependencies?.(context) ?? [])
+            dependencies.add(dependency);
+        metadata.registryDependencies = [...dependencies];
+        metadata.targets = definition.resolveTargets?.(context) ?? metadata.targets;
+        if (definition.configure)
+            metadata.bindings = definition.configure(context);
+        if (definition.package)
+            metadata.package =
+                definition.resolvePackage?.(context, definition.package) ?? definition.package;
+        resolved.set(name, metadata);
+        for (const dependency of dependencies)
+            collect(dependency);
+    };
+    for (const name of ['workspace', 'typescript', 'eslint', ...[...selected].sort()])
+        collect(name);
+    const graph = new Map([...resolved].map(([name, item]) => [name, item.registryDependencies]));
+    return {
+        schemaVersion: STACK_REGISTRY.schemaVersion,
+        name: STACK_REGISTRY.name,
+        cliVersion: STACK_REGISTRY.cliVersion,
+        items: dependencyOrder(graph, 'Stack registry').map((name) => resolved.get(name)),
+    };
+}

package/dist/registry/types.d.ts

@@ -0,0 +1,64 @@
+import type { StandardProduct } from '../stack-registry.js';
+import type { Json } from '../scaffold/files.js';
+export type { StandardProduct } from '../stack-registry.js';
+export type Hosting = 'cloudflare' | 'vercel';
+export interface StandardOptions {
+    root: string;
+    name: string;
+    products: StandardProduct[];
+    hosting: Hosting;
+    skipInstall: boolean;
+    dryRun: boolean;
+    json: boolean;
+    initializeGit: boolean;
+}
+export type StandardRunner = (command: string, args: string[], cwd: string) => void;
+export interface StackSelection {
+    conflicts?: readonly string[];
+    requiresAny?: readonly string[];
+    requiresAll?: readonly string[];
+}
+export interface SetupRequirements {
+    purpose: string;
+    tools: readonly string[];
+    access: readonly string[];
+    credentials: readonly string[];
+    resources: readonly string[];
+    verify: readonly string[];
+}
+export interface RecipeContext {
+    root: string;
+    options: StandardOptions;
+    runtimeApp: 'api' | 'web';
+    bindings: Json;
+    has: (product: string) => boolean;
+}
+export type Recipe = (context: RecipeContext) => void | Promise<void>;
+export interface PackageRecipe {
+    name: string;
+    source: string;
+    dependencies: Record<string, string>;
+}
+export interface StackRegistryItem {
+    name: string;
+    version: string;
+    type: 'foundation' | 'application' | 'service' | 'package' | 'integration';
+    description: string;
+    registryDependencies: readonly string[];
+    targets: readonly string[];
+    selection: StackSelection;
+    installer: 'bootstrap' | 'recipe' | 'configuration';
+    runtime?: 'server' | 'worker' | 'optional-worker';
+    environment: readonly string[];
+    setup?: SetupRequirements;
+    package?: PackageRecipe;
+    bindings?: Json;
+}
+export interface ItemDefinition extends Omit<StackRegistryItem, 'bindings'> {
+    install?: Recipe;
+    configure?: (context: RecipeContext) => Json;
+    resolveTargets?: (context: RecipeContext) => string[];
+    resolvePackage?: (context: RecipeContext, recipe: PackageRecipe) => PackageRecipe;
+    resolveDependencies?: (context: RecipeContext) => string[];
+    fallbackDependency?: string;
+}

package/dist/registry/usage.d.ts

@@ -0,0 +1 @@
+export declare const STANDARD_USAGE: string;

package/dist/registry/usage.js

@@ -0,0 +1,38 @@
+import { STANDARD_PRODUCTS } from '../stack-registry.js';
+export const STANDARD_USAGE = `Anhedral Application Stack & Delivery Standard
+
+anhedral new <directory> [products...] [--hosting cloudflare|vercel] [--skip-install] [--no-git] [--dry-run] [--json]
+anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]
+anhedral init [products...] [--hosting cloudflare|vercel] [--skip-install] [--git] [--dry-run] [--json]
+
+Default: Vinext on Cloudflare Workers, from the official shadcn pnpm/Turborepo monorepo.
+Web hosting: Vinext on Cloudflare by default; native Next.js on Vercel is an explicit option.
+Products: ${STANDARD_PRODUCTS.join(', ')}
+Examples:
+  anhedral new client-app
+  anhedral new mobile-app --expo
+  anhedral new product --next --expo --hono --neon --clerk --r2
+  anhedral new website --next --stripe --resend
+  anhedral init --wxt
+  anhedral cloud register|stage|save|deploy|status [directory] (managed service API required)
+  anhedral registry build <manifest> --output <registry.json>
+  anhedral registry list|view [item] [--registry <file|https-url>] [--json]
+  anhedral doctor [directory] [--providers] --json
+  anhedral repository [directory] [--owner <github-account>] [--name <repo>] [--visibility private|public] [--create]
+  anhedral register [directory]
+  anhedral connect [directory] [--scope <team>] --audience public|private --use personal|commercial [--create] [--git]
+  anhedral connect [directory] --provider cloudflare [--account <id>] --audience public|private [--allow-email <email>]
+  anhedral provision [directory] [--dry-run] [--json]
+  anhedral ship [directory] [--dry-run] [--json]
+  anhedral adopt [directory] --provider vercel [--json]
+  anhedral recover [directory] [--provider vercel|cloudflare] [--json]
+  anhedral status [directory] [--refresh] [--json]
+  anhedral manage [directory] [--local] [--json]
+  anhedral verify [directory] [--json]
+  anhedral rollback [directory] --release <id> --data-compatible [--json]
+
+--skip-install skips the final workspace install; the official shadcn bootstrap
+still requires network access and may install its own dependencies.
+--all is intentionally unsupported: select only required capabilities.
+Vercel Hobby is personal/non-commercial with limits; commercial apps need a suitable existing plan.
+`;

package/dist/render.d.ts

@@ -8,7 +8,3 @@ export declare function markdownHeading(value: string): string;
 export declare function packageNameFromText(value: string): string;
 export declare function childPackageName(projectName: string, suffix: string): string;
 export declare function identifierSegment(value: string): string;
-/** Project names also become bootstrap directory components; scoped names are not supported. */
-export declare function assertProjectName(value: string): string;
-/** Provider identifiers obey DNS/R2 limits independently of valid npm names. */
-export declare function resourceName(projectName: string, suffix: string): string;

package/dist/render.js

@@ -22,9 +22,9 @@ export function markdownHeading(value) {
 }
 function assertPackageName(value) {
     const leafName = value.slice(value.lastIndexOf('/') + 1);
-    if (value.length > MAX_PACKAGE_NAME_LENGTH
-        || !PACKAGE_NAME_PATTERN.test(value)
-        || RESERVED_PACKAGE_NAMES.has(leafName)) {
+    if (value.length > MAX_PACKAGE_NAME_LENGTH ||
+        !PACKAGE_NAME_PATTERN.test(value) ||
+        RESERVED_PACKAGE_NAMES.has(leafName)) {
         throw new Error(`Invalid package name: ${value}`);
     }
     return value;
@@ -72,16 +72,3 @@ export function identifierSegment(value) {
         .replace(/^-+|-+$/g, '');
     return segment || 'app';
 }
-/** Project names also become bootstrap directory components; scoped names are not supported. */
-export function assertProjectName(value) {
-    if (typeof value !== 'string' || value.includes('/'))
-        throw new Error('Project name must be a valid unscoped npm package name.');
-    return assertPackageName(value);
-}
-/** Provider identifiers obey DNS/R2 limits independently of valid npm names. */
-export function resourceName(projectName, suffix) {
-    const normalized = identifierSegment(projectName);
-    const digest = createHash('sha256').update(projectName, 'utf8').digest('hex').slice(0, 8);
-    const distinct = normalized === projectName ? normalized : `${normalized}-${digest}`;
-    return `${compactPackageSegment(distinct, 63 - suffix.length - 1)}-${suffix}`;
-}

package/dist/repository.d.ts

@@ -0,0 +1,24 @@
+import { type DeliveryRunner } from './project-state.js';
+interface Repository {
+    repoId: number;
+    nameWithOwner: string;
+    url: string;
+    isPrivate: boolean;
+    viewerPermission: string;
+    owner: {
+        login: string;
+    };
+}
+export declare function githubRepository(root: string, run?: DeliveryRunner): Promise<Repository>;
+export declare function setupRepository(root: string, options: {
+    owner?: string;
+    name?: string;
+    create?: boolean;
+    visibility: 'private' | 'public';
+}, run?: DeliveryRunner): Promise<{
+    repository: Repository;
+    branch: string;
+    commit: string;
+    ownership: string;
+}>;
+export {};

package/dist/repository.js

@@ -0,0 +1,96 @@
+import { realpathSync } from 'node:fs';
+import { defaultRunner, withApplicationLock } from './project-state.js';
+function environment() {
+    if (process.env.GH_HOST && process.env.GH_HOST !== 'github.com')
+        throw new Error('Repository automation supports github.com; reconcile the selected GitHub host explicitly.');
+    return {
+        ...process.env,
+        GH_HOST: 'github.com',
+        GH_PROMPT_DISABLED: '1',
+        GIT_TERMINAL_PROMPT: '0',
+    };
+}
+function identity(remote) {
+    const match = /^(?:https:\/\/github\.com\/|git@github\.com:)([a-zA-Z0-9-]+\/[a-zA-Z0-9_.-]+?)(?:\.git)?$/.exec(remote);
+    if (!match || match[1].endsWith('/.') || match[1].endsWith('/..'))
+        throw new Error('Origin must identify one GitHub repository without embedded credentials.');
+    return match[1];
+}
+async function ownCheckout(root, run) {
+    if (realpathSync((await run('git', ['rev-parse', '--show-toplevel'], root, environment())).trim()) !== root)
+        throw new Error('Initialize the app in its own Git repository; do not use a parent repository.');
+}
+export async function githubRepository(root, run = defaultRunner) {
+    root = realpathSync(root);
+    await ownCheckout(root, run);
+    const remotes = (await run('git', ['remote', 'get-url', '--all', 'origin'], root, environment()))
+        .trim()
+        .split(/\r?\n/);
+    const pushes = (await run('git', ['remote', 'get-url', '--push', '--all', 'origin'], root, environment()))
+        .trim()
+        .split(/\r?\n/);
+    if (remotes.length !== 1 || pushes.length !== 1 || identity(remotes[0]) !== identity(pushes[0]))
+        throw new Error('Reconcile ambiguous or mismatched GitHub fetch/push origins.');
+    const name = identity(remotes[0]);
+    const repository = JSON.parse(await run('gh', ['repo', 'view', name, '--json', 'nameWithOwner,url,isPrivate,viewerPermission,owner'], root, environment()));
+    if (repository.nameWithOwner?.toLowerCase() !== name.toLowerCase() ||
+        repository.url?.toLowerCase() !== `https://github.com/${name}`.toLowerCase() ||
+        repository.owner?.login?.toLowerCase() !== name.split('/')[0].toLowerCase() ||
+        !['ADMIN', 'MAINTAIN', 'WRITE'].includes(repository.viewerPermission) ||
+        typeof repository.isPrivate !== 'boolean')
+        throw new Error('GitHub did not verify the selected repository identity and write access.');
+    repository.repoId = JSON.parse(await run('gh', ['api', `repos/${name}`, '--jq', '.id'], root, environment()));
+    if (!Number.isSafeInteger(repository.repoId) || repository.repoId <= 0)
+        throw new Error('GitHub did not return a stable repository ID.');
+    return repository;
+}
+export async function setupRepository(root, options, run = defaultRunner) {
+    root = realpathSync(root);
+    return withApplicationLock(root, async () => {
+        await ownCheckout(root, run);
+        if ((await run('git', ['status', '--porcelain'], root, environment())).trim())
+            throw new Error('Review files and commit the application before repository setup; secrets must remain ignored.');
+        const commit = (await run('git', ['rev-parse', 'HEAD'], root, environment())).trim();
+        if (!/^[a-f0-9]{40,64}$/.test(commit))
+            throw new Error('Create a reviewed initial source commit first.');
+        const user = JSON.parse(await run('gh', ['api', 'user'], root, environment()));
+        const owner = options.owner ?? user.login;
+        const name = options.name ?? root.split('/').at(-1);
+        if (!/^[a-zA-Z0-9-]+$/.test(owner ?? '') ||
+            !/^[a-zA-Z0-9_.-]+$/.test(name) ||
+            ['.', '..'].includes(name))
+            throw new Error('Select a valid GitHub account and repository name.');
+        const remotes = (await run('git', ['remote'], root, environment())).trim().split(/\r?\n/);
+        if (!remotes.includes('origin')) {
+            if (!options.create)
+                throw new Error('No origin: use --create for an authorized new GitHub repository.');
+            await run('gh', [
+                'repo',
+                'create',
+                `${owner}/${name}`,
+                `--${options.visibility}`,
+                '--source',
+                '.',
+                '--remote',
+                'origin',
+            ], root, environment());
+        }
+        const repository = await githubRepository(root, run);
+        if (repository.nameWithOwner.toLowerCase() !== `${owner}/${name}`.toLowerCase() ||
+            repository.isPrivate !== (options.visibility === 'private'))
+            throw new Error('Existing repository ownership/name/visibility differs; origin and visibility were not replaced.');
+        if ((await run('git', ['status', '--porcelain'], root, environment())).trim() ||
+            (await run('git', ['rev-parse', 'HEAD'], root, environment())).trim() !== commit)
+            throw new Error('Source changed during repository setup; nothing was pushed.');
+        const branch = (await run('git', ['symbolic-ref', '--short', 'HEAD'], root, environment())).trim();
+        if (!branch || branch.startsWith('-'))
+            throw new Error('Select the intended source branch before pushing.');
+        await run('git', ['push', '--set-upstream', 'origin', `HEAD:refs/heads/${branch}`], root, environment());
+        const remote = (await run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], root, environment()))
+            .trim()
+            .split(/\s+/);
+        if (remote[0] !== commit || remote[1] !== `refs/heads/${branch}`)
+            throw new Error('GitHub did not confirm the pushed source commit.');
+        return { repository, branch, commit, ownership: 'customer' };
+    });
+}

package/dist/scaffold/api.d.ts

@@ -0,0 +1,2 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldApi({ root, options, bindings }: RecipeContext): void;

package/dist/scaffold/api.js

@@ -0,0 +1,13 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { workerConfig, worker } from './files.js';
+export function scaffoldApi({ root, options, bindings }) {
+    worker(root, 'api', { ...workerConfig(`${options.name}-api`), ...bindings }, `import { OpenAPIHono, createRoute, z } from '@hono/zod-openapi';
+const app = new OpenAPIHono<{ Bindings: Env }>();
+app.openapi(createRoute({ method: 'get', path: '/health', responses: { 200: { description: 'Healthy', content: { 'application/json': { schema: z.object({ ok: z.literal(true) }) } } } } }), (c) => c.json({ ok: true as const }, 200));
+app.doc('/openapi.json', { openapi: '3.0.0', info: { title: '${options.name}', version: '1.0.0' } });
+export default app;
+`, {
+        hono: STACK_DEPENDENCIES['hono'],
+        '@hono/zod-openapi': STACK_DEPENDENCIES['@hono/zod-openapi'],
+    });
+}

package/dist/scaffold/auth.d.ts

@@ -0,0 +1,3 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldBetterAuth({ root, options, runtimeApp, has }: RecipeContext): void;
+export declare function scaffoldClerk({ root, has }: RecipeContext): void;