anhedral 0.8.6 → 0.9.0

package/dist/scaffold/auth.js

@@ -0,0 +1,95 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { writeBetterAuthSchema } from '../auth-schema.js';
+import { json, put, readJson, patchPackage, sharedPackage } from './files.js';
+export function scaffoldBetterAuth({ root, options, runtimeApp, has }) {
+    writeBetterAuthSchema(root, has('neon'));
+    sharedPackage(root, 'auth', `import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from '@better-auth/drizzle-adapter';
+import type { createDatabase } from '@workspace/db';
+export function createAuth(db: ReturnType<typeof createDatabase>, secret: string, baseURL: string) {
+  return betterAuth({ database: drizzleAdapter(db, { provider: '${has('neon') ? 'pg' : 'sqlite'}', transaction: false }), secret, baseURL, emailAndPassword: { enabled: true } });
+}
+`, {
+        'better-auth': '1.7.7',
+        '@better-auth/drizzle-adapter': '1.7.7',
+        '@workspace/db': 'workspace:*',
+    });
+    patchPackage(root, `apps/${runtimeApp}/package.json`, {
+        dependencies: { '@workspace/auth': 'workspace:*' },
+    });
+    const connection = has('neon') ? 'createDatabase(env.DATABASE_URL)' : 'createDatabase(env.DB)';
+    if (has('hono')) {
+        const source = readFileSync(path.join(root, 'apps/api/src/index.ts'), 'utf8');
+        put(root, 'apps/api/src/index.ts', `import { createAuth } from '@workspace/auth';\nimport { createDatabase } from '@workspace/db';\n` +
+            source.replace('export default app;', `app.on(['GET', 'POST'], '/api/auth/*', async (c) => {\n  const env = c.env;\n  const database = ${connection};\n  return await createAuth(database, env.BETTER_AUTH_SECRET, env.BETTER_AUTH_URL).handler(c.req.raw);\n});\nexport default app;`));
+        const config = readJson(root, 'apps/api/wrangler.jsonc');
+        json(root, 'apps/api/wrangler.jsonc', {
+            ...config,
+            vars: { BETTER_AUTH_URL: 'http://localhost:8787' },
+        });
+    }
+    else {
+        put(root, 'apps/web/app/api/auth/[...all]/route.ts', `${has('vinext') ? "import { env } from 'cloudflare:workers';" : options.hosting === 'cloudflare' ? "import { getCloudflareContext } from '@opennextjs/cloudflare';" : ''}
+import { createAuth } from '@workspace/auth';
+import { createDatabase } from '@workspace/db';
+async function handler(request: Request) {
+  ${options.hosting === 'cloudflare' && !has('vinext') ? 'const { env } = await getCloudflareContext({ async: true });' : ''}
+  const database = ${options.hosting === 'vercel' ? 'createDatabase(process.env.DATABASE_URL!)' : connection};
+  return await createAuth(database, ${options.hosting === 'cloudflare' ? 'env.BETTER_AUTH_SECRET, env.BETTER_AUTH_URL' : 'process.env.BETTER_AUTH_SECRET!, process.env.BETTER_AUTH_URL!'}).handler(request);
+}
+export { handler as GET, handler as POST };
+`);
+        if (options.hosting === 'cloudflare' && !has('vinext'))
+            put(root, 'apps/web/cloudflare-env.d.ts', `interface CloudflareEnv { BETTER_AUTH_SECRET: string; BETTER_AUTH_URL: string; ${has('neon') ? 'DATABASE_URL: string;' : "DB: Parameters<typeof import('drizzle-orm/d1').drizzle>[0];"} }\n`);
+        if (has('vinext')) {
+            put(root, 'apps/web/secrets.d.ts', 'declare namespace Cloudflare { interface Env { BETTER_AUTH_SECRET: string } }\n');
+            const config = readJson(root, 'apps/web/wrangler.jsonc');
+            json(root, 'apps/web/wrangler.jsonc', {
+                ...config,
+                vars: { BETTER_AUTH_URL: 'http://localhost:3000' },
+            });
+        }
+        patchPackage(root, 'apps/web/package.json', {
+            dependencies: { 'drizzle-orm': STACK_DEPENDENCIES['drizzle-orm'] },
+        });
+    }
+    put(root, `apps/${runtimeApp}/${runtimeApp === 'web' && options.hosting === 'vercel' ? '.env.example' : '.dev.vars.example'}`, `${has('neon') ? 'DATABASE_URL=\n' : ''}BETTER_AUTH_SECRET=\nBETTER_AUTH_URL=http://localhost:${runtimeApp === 'web' && (options.hosting === 'vercel' || has('vinext')) ? '3000' : '8787'}\n`);
+    if (has('hono'))
+        put(root, 'apps/api/src/secrets.d.ts', 'interface Env { BETTER_AUTH_SECRET: string }\n');
+}
+export function scaffoldClerk({ root, has }) {
+    if (has('next') || has('vinext')) {
+        patchPackage(root, 'apps/web/package.json', {
+            dependencies: { '@clerk/nextjs': STACK_DEPENDENCIES['@clerk/nextjs'] },
+        });
+        const layoutPath = path.join(root, 'apps/web/app/layout.tsx');
+        if (existsSync(layoutPath)) {
+            const layout = readFileSync(layoutPath, 'utf8');
+            if (!layout.includes('ClerkProvider')) {
+                const wrapped = layout.replace(/(<body\b[^>]*>)([\s\S]*?)(<\/body>)/, '$1<ClerkProvider>$2</ClerkProvider>$3');
+                if (wrapped === layout)
+                    throw new Error('Cannot configure ClerkProvider: the web layout must contain a body element.');
+                put(root, 'apps/web/app/layout.tsx', 'import { ClerkProvider } from "@clerk/nextjs";\n' + wrapped);
+            }
+        }
+        put(root, 'apps/web/app/sign-in/[[...sign-in]]/page.tsx', 'import { SignIn } from "@clerk/nextjs";\nexport default function SignInPage() { return <SignIn />; }\n');
+        put(root, 'apps/web/app/sign-up/[[...sign-up]]/page.tsx', 'import { SignUp } from "@clerk/nextjs";\nexport default function SignUpPage() { return <SignUp />; }\n');
+        put(root, 'apps/web/proxy.ts', `import { clerkMiddleware } from '@clerk/nextjs/server';
+export default clerkMiddleware();
+export const config = { matcher: ['/((?!_next|[^?]*\\\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)', '/(api|trpc)(.*)'] };
+`);
+        // Middleware makes auth available; product routes must explicitly require identity and authorization.
+    }
+    if (has('hono')) {
+        patchPackage(root, 'apps/api/package.json', {
+            dependencies: { '@clerk/backend': STACK_DEPENDENCIES['@clerk/backend'] },
+        });
+        put(root, 'apps/api/src/identity.ts', `import { createClerkClient } from '@clerk/backend';
+export async function authenticate(request: Request, secretKey: string, authorizedParties: string[]) {
+  return createClerkClient({ secretKey }).authenticateRequest(request, { authorizedParties });
+}
+`);
+    }
+}

package/dist/scaffold/bootstrap.d.ts

@@ -0,0 +1,2 @@
+import type { StandardRunner } from '../registry/types.js';
+export declare function bootstrapWorkspace(root: string, name: string, run: StandardRunner, webOnly?: boolean): void;

package/dist/scaffold/bootstrap.js

@@ -0,0 +1,34 @@
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { appendGitignore } from '../util.js';
+import { bootstrapArguments } from '../registry/bootstrap.js';
+export function bootstrapWorkspace(root, name, run, webOnly = false) {
+    const temporary = path.join(root, '.bootstrap');
+    mkdirSync(temporary);
+    try {
+        run('pnpm', bootstrapArguments(name, temporary), root);
+        const generated = path.join(temporary, name);
+        if (!existsSync(path.join(generated, 'pnpm-workspace.yaml')) ||
+            !existsSync(path.join(generated, 'apps/web/package.json')))
+            throw new Error('Official shadcn bootstrap did not produce the expected monorepo.');
+        const ignored = ['.git', 'node_modules', '.next', '.turbo'];
+        const seed = !webOnly && existsSync(path.join(root, '.gitignore'))
+            ? readFileSync(path.join(root, '.gitignore'), 'utf8')
+            : '';
+        for (const entry of webOnly ? ['apps/web', 'packages/ui'] : readdirSync(generated)) {
+            if (ignored.includes(entry))
+                continue;
+            if (webOnly && existsSync(path.join(root, entry)))
+                throw new Error(`Web foundation target already exists: ${entry}.`);
+            cpSync(path.join(generated, entry), path.join(root, entry), {
+                recursive: true,
+                filter: (source) => !ignored.includes(path.basename(source)),
+            });
+        }
+        if (seed)
+            appendGitignore(root, seed.split(/\r?\n/));
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}

package/dist/scaffold/compose.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedStackRegistry } from '../registry/resolve.js';
+import type { StandardOptions } from '../registry/types.js';
+/** Only used in a fresh staged workspace. Existing applications are never overlaid. */
+export declare function composeStack(root: string, options: StandardOptions, registry: ResolvedStackRegistry): Promise<void>;

package/dist/scaffold/compose.js

@@ -0,0 +1,34 @@
+import { existsSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { installStackItem } from '../stack-registry.js';
+import { createRecipeContext } from '../registry/context.js';
+import { inspectWorkspaceGraph } from '../workspace-graph.js';
+import { writeStandardRoot } from './workspace.js';
+import { json } from './files.js';
+/** Only used in a fresh staged workspace. Existing applications are never overlaid. */
+export async function composeStack(root, options, registry) {
+    const context = createRecipeContext(root, options);
+    if (!context.has('next') && !context.has('vinext')) {
+        for (const directory of ['apps/web', 'packages/ui'])
+            rmSync(path.join(root, directory), { recursive: true, force: true });
+    }
+    for (const item of registry.items)
+        Object.assign(context.bindings, item.bindings);
+    for (const item of registry.items) {
+        if (item.installer === 'recipe')
+            await installStackItem(item, context);
+    }
+    writeStandardRoot(root, options, registry);
+    for (const item of registry.items) {
+        for (const target of item.targets) {
+            if (!existsSync(path.join(root, target)))
+                throw new Error(`Registry target missing: ${item.name} -> ${target}.`);
+        }
+    }
+    json(root, 'anhedral.registry.json', {
+        ...registry,
+        status: 'scaffolded',
+        workspaces: inspectWorkspaceGraph(root),
+        resourcesProvisioned: false,
+    });
+}

package/dist/scaffold/database.d.ts

@@ -0,0 +1,2 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldDatabase({ root, options, runtimeApp, has }: RecipeContext): void;

package/dist/scaffold/database.js

@@ -0,0 +1,43 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { put, patchPackage, sharedPackage } from './files.js';
+export function scaffoldDatabase({ root, options, runtimeApp, has }) {
+    sharedPackage(root, 'db', has('neon')
+        ? `import { drizzle } from 'drizzle-orm/neon-http';
+import { neon } from '@neondatabase/serverless';
+import * as schema from './schema';
+export function createDatabase(connectionString: string) {
+  // HTTP supports independent queries and batches; choose a reviewed WebSocket adapter for interactive transactions.
+  return drizzle(neon(connectionString), { schema });
+}
+`
+        : `import { drizzle } from 'drizzle-orm/d1';
+import * as schema from './schema';
+export function createDatabase(binding: Parameters<typeof drizzle>[0]) { return drizzle(binding, { schema }); }
+`, {
+        'drizzle-orm': STACK_DEPENDENCIES['drizzle-orm'],
+        ...(has('neon') ? { '@neondatabase/serverless': '1.2.0' } : {}),
+    });
+    if (has('neon')) {
+        const native = runtimeApp === 'web' && options.hosting === 'vercel';
+        put(root, `apps/${runtimeApp}/${native ? '.env.example' : '.dev.vars.example'}`, 'DATABASE_URL=\n');
+        if (!native)
+            put(root, `apps/${runtimeApp}/${runtimeApp === 'api' ? 'src/' : ''}database-secrets.d.ts`, runtimeApp === 'api'
+                ? 'interface Env { DATABASE_URL: string }\n'
+                : 'declare namespace Cloudflare { interface Env { DATABASE_URL: string } }\n');
+    }
+    put(root, 'packages/db/src/schema.ts', '// Define product tables here; generate and review SQL before migration.\nexport {};\n');
+    put(root, 'packages/db/drizzle.config.ts', has('neon')
+        ? `import { defineConfig } from 'drizzle-kit';
+export default defineConfig({ dialect: 'postgresql', schema: './src/schema.ts', out: './migrations', dbCredentials: { url: process.env.DATABASE_URL! } });
+`
+        : `import { defineConfig } from 'drizzle-kit';
+export default defineConfig({ dialect: 'sqlite', schema: './src/schema.ts', out: './migrations' });
+`);
+    patchPackage(root, 'packages/db/package.json', {
+        devDependencies: { 'drizzle-kit': STACK_DEPENDENCIES['drizzle-kit'] },
+        scripts: { 'db:generate': 'drizzle-kit generate' },
+    });
+    patchPackage(root, `apps/${runtimeApp}/package.json`, {
+        dependencies: { '@workspace/db': 'workspace:*' },
+    });
+}

package/dist/scaffold/documentation.d.ts

@@ -0,0 +1,3 @@
+import type { StandardOptions } from '../registry/types.js';
+export declare function workerBuildSuffix(options: StandardOptions): string;
+export declare function writeSetupDocumentation(root: string, options: StandardOptions): void;

package/dist/scaffold/documentation.js

@@ -0,0 +1,91 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { put } from './files.js';
+export function workerBuildSuffix(options) {
+    return options.products.includes('next') && options.hosting === 'cloudflare'
+        ? ' && pnpm build:worker'
+        : '';
+}
+export function writeSetupDocumentation(root, options) {
+    const has = (product) => options.products.includes(product);
+    const agentsFile = path.join(root, 'AGENTS.md');
+    const existingAgents = existsSync(agentsFile) && (has('next') || has('vinext'))
+        ? readFileSync(agentsFile, 'utf8') + '\n'
+        : '';
+    put(root, 'AGENTS.md', existingAgents +
+        `# Anhedral delivery standard
+
+Keep accounts, source, infrastructure, billing, and recovery client-owned. Use macOS, OpenAI/Codex, Computer Use and Control Chrome during implementation and verification. Use provider plugins, APIs/MCP and CLIs for operations; Cloudflare plugin + cf where available, Wrangler for project commands.
+
+Vinext on Cloudflare Workers by default; native Next.js on Vercel is an explicit option. Free-to-start where suitable, within provider eligibility and limits. Respect the existing account, budget, audience and release authorization. Request only missing approval for paid activation, material spending, architecture changes or release. Do not deploy or activate providers as part of initialization.
+
+Add apps and shared packages only when needed. All services belong in apps/*, reusable code in packages/*. Shared styling is named styling. Keep secrets and privileged integrations out of client bundles. Use Clerk, Better Auth, or no auth according to project needs. Protect product routes explicitly and implement resource authorization.
+
+Use private R2 Worker bindings. KV is eventually consistent configuration/cache, never transactional authority. Neon uses Drizzle and direct serverless HTTP with a server-only DATABASE_URL. HTTP supports independent queries and batches; interactive transactions require a reviewed WebSocket or PostgreSQL adapter. Define job retries, concurrency, idempotency and failure handling. Review SQL migrations before applying them.
+
+Developer tooling includes Cloudflare’s security-audit skill (https://github.com/cloudflare/security-audit-skill) for repository security reviews.
+
+For new projects, guide GitHub sign-in and the user's Git identity. Review files and secret ignores, commit the initial source, then use anhedral repository --create for a private repository under the authenticated user. Preserve existing origins and visibility; use an explicitly selected organization when requested. Connect Vercel with --git and verify actual GitHub installation access. For Git delivery, commit and push reviewed changes, wait for production, then use anhedral adopt and anhedral verify. Adoption checks exact repository, production branch and commit without uploading again. Use anhedral ship only for an explicit CLI delivery. Recover a fresh clone with anhedral recover; rerun product verification because prior test evidence is not recovered. Use anhedral doctor --providers to inspect installed tools and recorded provider context.
+
+Maintain docs/architecture.md with selected components, rationale, alternatives, data/access boundaries, and a diagram of actual connections. Maintain docs/verification.md with product acceptance criteria, exercised flows, evidence, and blockers. Generated setup is a starter, not implemented product behavior.
+
+Run pnpm check. Use pnpm exec fallow during development and pnpm exec fallow audit for changes. Fix legitimate findings; use narrow documented exceptions. Verify real UI flows with Computer Use and Control Chrome, plus relevant integrations, native apps/simulators, and deployed previews. Carry an authorized build-and-ship request through deployment and live verification; ask only for authorization that is still missing.
+`);
+    put(root, 'README.md', `# ${options.name}
+
+Initialized from the official shadcn pnpm/Turborepo monorepo, with the Anhedral Application Stack & Delivery Standard.
+
+Initial selection: ${options.products.join(', ')}. Current selections and additions are recorded in anhedral.setup.json and anhedral.registry.json. ${has('vinext') ? 'Vinext App Router on Cloudflare Workers.' : has('next') ? `Next.js hosting: ${options.hosting === 'cloudflare' ? 'Cloudflare Workers + OpenNext' : 'Vercel (native Next.js default)'}.` : ''}
+
+Run pnpm install, commit pnpm-lock.yaml, then pnpm dev. Run pnpm check for lint, types, Fallow audit, tests and build. Without a Git comparison base, audit runs the full Fallow gate. Add meaningful product tests and integration checks as behavior is implemented. The tests task runs only workspaces that define tests; init does not claim product verification.
+
+${has('next') && options.hosting === 'vercel' ? 'Native Next.js uses customer-owned Vercel. Connect with the intended scope and personal/commercial use before shipping. Default to private all-deployment protection unless public access was requested; verify protection before linking Git or uploading code. Run anhedral doctor --providers for prerequisites and recorded provider context. Configure server secrets in that project; use cache components, partial prefetching, Link navigation and Suspense deliberately. ' : ''}${options.hosting === 'cloudflare' || has('hono') ? 'Cloudflare bindings contain REPLACE_WITH_* IDs. Reconcile resources in the client account and generate Worker types before development. Workers expose local dev and explicit deploy scripts. ' : ''}${has('vinext') ? 'Build with pnpm build, then pnpm --dir apps/web preview to exercise the production Worker. Vinext provides a Next-compatible API surface; native Next.js is an explicit framework option. ' : ''}${has('next') && options.hosting === 'cloudflare' ? 'Use the web preview script to exercise the actual OpenNext Worker runtime. ' : ''}Initialization does not provision infrastructure or deploy.
+
+Security gate: pnpm audit:deps audits all dependencies. Reviewed backports in scripts/security are accepted only after patch hashes, installed package hashes and regression checks match. Unknown advisories and modified patches remain blocking.
+
+${has('next') && options.hosting === 'cloudflare' ? 'OpenNext is configured without a provisioned incremental-cache bucket. Choose and configure a cache adapter before using ISR or cache features that require shared persistence.\n' : ''}
+${has('neon') ? 'Configure server-only DATABASE_URL for the intended Neon branch and role. Direct HTTP needs no Hyperdrive or connection cleanup. Review migrations and authorization; interactive transactions require a reviewed WebSocket or PostgreSQL adapter.\n' : ''}
+${has('better-auth') ? 'Core Better Auth tables are included in the Drizzle schema. Review and apply migrations before using /api/auth. Configure BETTER_AUTH_SECRET, BETTER_AUTH_URL and trusted origins for the correct environment.\n' : ''}
+${has('clerk') ? 'Clerk middleware exposes server identity; protect selected routes explicitly. The web starter includes ClerkProvider and sign-in/sign-up pages. Configure the selected native SDKs when implementing account flows.\n' : ''}
+${has('r2') ? 'FILES is a private R2 binding. Implement authentication and file-level authorization before exposing file routes. Clients never receive R2 credentials.\n' : ''}
+${has('realtime') ? 'Durable Object rooms support hibernating WebSockets; the public entrypoint remains disabled until room authorization and short-lived tickets are implemented.\n' : ''}
+${has('queues') ? 'Queue processing retries unimplemented jobs and uses a dead-letter queue. Add product processing and transactional idempotency before acknowledging messages.\n' : ''}
+${has('basin') ? 'Basin uses a Pipelines stream binding. Configure its stream, sink, R2/catalog and SQL in client-owned infrastructure; it is distinct from operational logs.\n' : ''}
+Provider packages are SDK factories or integration boundaries, not finished business features. Connect only needed packages to server entrypoints. Billing needs verified webhooks and idempotent consumption; RevenueCat adds cross-store entitlement configuration. Local data needs a platform-specific SQLite/filesystem adapter. Sentry needs a platform SDK and runtime initialization. Native auth and subscriptions need platform-specific setup.
+
+Purchase the domain in the client's GoDaddy account, then add its zone to the client's Cloudflare account and configure Cloudflare nameservers. The client retains registration, renewal, billing and recovery ownership. Verify DNS records and zone activation before connecting application domains and mail. Inbound mail uses Cloudflare Email Routing. Outbound business and application mail defaults to Cloudflare Email Sending; Resend is an alternative when selected. Configure the selected mail provider before use; init does not provision domains or mail services. GitHub Actions runs PR checks and never deploys automatically. Respect existing authorization; request only missing approval for paid activation, material spending, architecture changes or release.
+`);
+    put(root, '.github/workflows/check.yml', `name: Check
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: '22'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint && pnpm typecheck && pnpm audit:deps
+      - name: Audit pull request
+        if: github.event_name == 'pull_request'
+        env:
+          AUDIT_BASE: \${{ github.event.pull_request.base.sha }}
+        run: pnpm exec fallow audit --base "$AUDIT_BASE"
+      - name: Audit branch
+        if: github.event_name != 'pull_request'
+        run: pnpm audit:full
+      - run: pnpm test && pnpm build${workerBuildSuffix(options)}
+`);
+}

package/dist/scaffold/environment.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedStackRegistry } from '../registry/resolve.js';
+export declare function writeEnvironmentExample(root: string, registry: ResolvedStackRegistry): void;

package/dist/scaffold/environment.js

@@ -0,0 +1,5 @@
+import { put } from './files.js';
+export function writeEnvironmentExample(root, registry) {
+    const names = [...new Set(registry.items.flatMap((item) => item.environment))].sort();
+    put(root, '.env.example', names.map((name) => `${name}=`).join('\n') + '\n');
+}

package/dist/scaffold/files.d.ts

@@ -0,0 +1,25 @@
+export type Json = Record<string, unknown>;
+export interface PackageManifest extends Json {
+    name?: string;
+    packageManager?: string;
+    scripts?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    pnpm?: {
+        overrides?: Record<string, string>;
+    };
+}
+export interface TurboConfig extends Json {
+    tasks: Record<string, {
+        dependsOn?: string[];
+        outputs?: string[];
+        [key: string]: unknown;
+    }>;
+}
+export declare function readJson<T extends Json = Json>(root: string, file: string): T;
+export declare function json(root: string, file: string, value: unknown): void;
+export declare function put(root: string, file: string, value: string): void;
+export declare function patchPackage(root: string, file: string, patch: PackageManifest): void;
+export declare function workerConfig(name: string): Json;
+export declare function worker(root: string, app: string, config: Json, source: string, dependencies?: Record<string, string>): void;
+export declare function sharedPackage(root: string, name: string, source: string, dependencies: Record<string, string>): void;

package/dist/scaffold/files.js

@@ -0,0 +1,108 @@
+import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { writeFile } from '../util.js';
+export function readJson(root, file) {
+    const value = JSON.parse(readFileSync(path.join(root, file), 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`Expected a JSON object: ${file}.`);
+    return value;
+}
+export function json(root, file, value) {
+    writeFile(path.join(root, file), JSON.stringify(value, null, 2) + '\n');
+}
+export function put(root, file, value) {
+    writeFile(path.join(root, file), value);
+}
+export function patchPackage(root, file, patch) {
+    const current = readJson(root, file);
+    const merged = { ...current, ...patch };
+    for (const key of ['scripts', 'dependencies', 'devDependencies']) {
+        if (patch[key])
+            merged[key] = { ...current[key], ...patch[key] };
+    }
+    json(root, file, merged);
+}
+export function workerConfig(name) {
+    return {
+        $schema: 'node_modules/wrangler/config-schema.json',
+        name,
+        main: 'src/index.ts',
+        compatibility_date: '2026-10-05',
+        compatibility_flags: ['nodejs_compat'],
+        observability: { enabled: true },
+    };
+}
+export function worker(root, app, config, source, dependencies = {}) {
+    json(root, `apps/${app}/package.json`, {
+        name: `@workspace/${app}`,
+        private: true,
+        type: 'module',
+        scripts: {
+            dev: 'wrangler dev',
+            build: 'wrangler deploy --dry-run --outdir dist',
+            deploy: 'wrangler deploy',
+            typecheck: 'wrangler types && tsc --noEmit',
+            lint: 'eslint . --max-warnings 0',
+        },
+        dependencies,
+        devDependencies: {
+            wrangler: STACK_DEPENDENCIES['wrangler'],
+            typescript: STACK_DEPENDENCIES['typescript'],
+            '@types/node': STACK_DEPENDENCIES['@types/node'],
+            eslint: STACK_DEPENDENCIES['eslint'],
+            '@workspace/eslint-config': 'workspace:*',
+        },
+    });
+    json(root, `apps/${app}/wrangler.jsonc`, config);
+    json(root, `apps/${app}/tsconfig.json`, {
+        compilerOptions: {
+            target: 'ES2022',
+            lib: ['ES2022'],
+            module: 'ESNext',
+            moduleResolution: 'Bundler',
+            strict: true,
+            noUnusedLocals: true,
+            noUnusedParameters: true,
+            skipLibCheck: true,
+            noEmit: true,
+            types: ['node'],
+        },
+        include: ['src/**/*.ts', 'worker-configuration.d.ts'],
+    });
+    put(root, `apps/${app}/eslint.config.mjs`, 'import { config } from "@workspace/eslint-config/base";\nexport default [...config, { ignores: ["dist/**", ".wrangler/**", "worker-configuration.d.ts"] }, { files: ["**/*.ts"], rules: { "no-undef": "off", "no-unused-vars": "off" } }];\n');
+    put(root, `apps/${app}/src/index.ts`, source);
+}
+export function sharedPackage(root, name, source, dependencies) {
+    json(root, `packages/${name}/package.json`, {
+        name: `@workspace/${name}`,
+        private: true,
+        type: 'module',
+        exports: { '.': './src/index.ts' },
+        scripts: { typecheck: 'tsc --noEmit', lint: 'eslint . --max-warnings 0' },
+        dependencies,
+        devDependencies: {
+            typescript: STACK_DEPENDENCIES['typescript'],
+            '@types/node': STACK_DEPENDENCIES['@types/node'],
+            eslint: STACK_DEPENDENCIES['eslint'],
+            '@workspace/eslint-config': 'workspace:*',
+        },
+    });
+    json(root, `packages/${name}/tsconfig.json`, {
+        compilerOptions: {
+            target: 'ES2022',
+            lib: ['ES2022', 'DOM'],
+            module: 'ESNext',
+            moduleResolution: 'Bundler',
+            strict: true,
+            noUnusedLocals: true,
+            noUnusedParameters: true,
+            skipLibCheck: true,
+            noEmit: true,
+            types: ['node'],
+        },
+        include: ['src/**/*.ts'],
+    });
+    put(root, `packages/${name}/eslint.config.mjs`, 'import { config } from "@workspace/eslint-config/base";\nexport default [...config, { ignores: ["dist/**", ".wrangler/**", "worker-configuration.d.ts"] }, { files: ["**/*.ts"], rules: { "no-undef": "off", "no-unused-vars": "off" } }];\n');
+    put(root, `packages/${name}/src/index.ts`, source);
+}

package/dist/scaffold/integrations.d.ts

@@ -0,0 +1,3 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldPrivateFiles({ root, runtimeApp }: RecipeContext): void;
+export declare function scaffoldRevenueCat({ root }: RecipeContext): void;

package/dist/scaffold/integrations.js

@@ -0,0 +1,7 @@
+import { put } from './files.js';
+export function scaffoldPrivateFiles({ root, runtimeApp }) {
+    put(root, `apps/${runtimeApp}/private-files.md`, '# Private files\n\nFILES is a private R2 Worker binding. Authenticate the request and enforce file-level product authorization before calling get/put/delete. No public buckets, R2 keys, generic download endpoints, or client credentials are generated. Use the binding directly in Hono or import env from cloudflare:workers in Vinext; explicit OpenNext uses getCloudflareContext.\n');
+}
+export function scaffoldRevenueCat({ root }) {
+    put(root, 'packages/billing/revenuecat.md', '# RevenueCat + Stripe\n\nConfigure web/App Store/Play Store products and offerings in client-owned accounts. Add the platform SDK to each selected app. Verify signed provider webhooks, reconcile entitlement authority, and keep transactional idempotent credits/quotas separate from subscription status. No payment activation occurs during init.\n');
+}

package/dist/scaffold/services.d.ts

@@ -0,0 +1,5 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldRealtime({ root, options }: RecipeContext): void;
+export declare function scaffoldQueues({ root, options }: RecipeContext): void;
+export declare function scaffoldCron({ root, options }: RecipeContext): void;
+export declare function scaffoldWorkflows({ root, options }: RecipeContext): void;

package/dist/scaffold/services.js

@@ -0,0 +1,84 @@
+import { workerConfig, worker } from './files.js';
+export function scaffoldRealtime({ root, options }) {
+    worker(root, 'realtime', {
+        ...workerConfig(`${options.name}-realtime`),
+        durable_objects: { bindings: [{ name: 'ROOMS', class_name: 'Room' }] },
+        migrations: [{ tag: 'v1', new_sqlite_classes: ['Room'] }],
+    }, `import { DurableObject } from 'cloudflare:workers';
+export class Room extends DurableObject<Env> {
+  async fetch(request: Request): Promise<Response> {
+    if (request.headers.get('Upgrade') !== 'websocket') return new Response('WebSocket required', { status: 426 });
+    const pair = new WebSocketPair();
+    this.ctx.acceptWebSocket(pair[1]);
+    return new Response(null, { status: 101, webSocket: pair[0] });
+  }
+  webSocketMessage(sender: WebSocket, message: string | ArrayBuffer) {
+    if ((typeof message === 'string' ? new TextEncoder().encode(message).byteLength : message.byteLength) > 16384) { sender.close(1009, 'Message too large'); return; }
+    this.ctx.getWebSockets().filter((socket) => socket !== sender).forEach((socket) => socket.send(message));
+  }
+}
+export default {
+  async fetch(): Promise<Response> {
+    // Authenticate and authorize room membership, then forward to env.ROOMS.getByName(room).fetch(request).
+    // Use short-lived single-use tickets for browser WebSockets. Never expose a long-lived service secret.
+    return new Response('Configure room authorization before enabling connections', { status: 501 });
+  },
+};
+`);
+}
+export function scaffoldQueues({ root, options }) {
+    worker(root, 'jobs', {
+        ...workerConfig(`${options.name}-jobs`),
+        queues: {
+            producers: [{ binding: 'JOBS', queue: `${options.name}-jobs` }],
+            consumers: [
+                {
+                    queue: `${options.name}-jobs`,
+                    max_batch_size: 10,
+                    max_retries: 3,
+                    dead_letter_queue: `${options.name}-jobs-dlq`,
+                },
+            ],
+        },
+    }, `export default {
+  async queue(batch: MessageBatch<unknown>): Promise<void> {
+    for (const message of batch.messages) {
+      // Add transactional idempotency and product processing before acknowledging.
+      console.error('Job handler requires product implementation', message.id);
+      message.retry({ delaySeconds: 60 });
+    }
+  },
+};
+`);
+}
+export function scaffoldCron({ root, options }) {
+    worker(root, 'scheduled', { ...workerConfig(`${options.name}-scheduled`), triggers: { crons: ['0 * * * *'] } }, `export default {
+  async scheduled(controller: ScheduledController): Promise<void> {
+    // Define a product schedule, idempotency key, overlap policy, and failure alerts before release.
+    console.log('Scheduled trigger', controller.scheduledTime);
+  },
+};
+`);
+}
+export function scaffoldWorkflows({ root, options }) {
+    worker(root, 'workflows', {
+        ...workerConfig(`${options.name}-workflows`),
+        workflows: [
+            {
+                name: `${options.name}-workflow`,
+                binding: 'WORKFLOW',
+                class_name: 'ApplicationWorkflow',
+            },
+        ],
+    }, `import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
+export class ApplicationWorkflow extends WorkflowEntrypoint<Env, { operationId: string }> {
+  async run(event: WorkflowEvent<{ operationId: string }>, step: WorkflowStep) {
+    return step.do('validate', { retries: { limit: 3, delay: '10 seconds', backoff: 'exponential' } }, async () => {
+      if (!event.payload.operationId) throw new Error('operationId required');
+      return { operationId: event.payload.operationId };
+    });
+  }
+}
+export default { async fetch() { return new Response('Use an authorized server binding to create workflows', { status: 403 }); } };
+`);
+}

package/dist/scaffold/web.d.ts

@@ -0,0 +1,2 @@
+import type { RecipeContext } from '../registry/types.js';
+export declare function scaffoldWeb({ root, options, bindings, runtimeApp, has }: RecipeContext): void;