anhedral 0.8.6 → 0.9.0

package/docs/managed-hosting-architecture.md

@@ -0,0 +1,87 @@
+# Anhedral Cloud: setup and deployment contract
+
+The CLI has `cloud register|stage|save|deploy|status` and a locally tested API client. There is no operated hosting backend, platform login, issued app hostname or managed provisioning service. Everything marked **planned** below is a design requirement, not an available command. Customer-account delivery remains independent; never silently substitute it for requested managed hosting.
+
+## Product boundaries
+
+Anhedral is the B2B managed software services business. Anhedral Cloud is its hosting/operations service and client workspace. Anhedral Init (`anhedral` on npm) is the open-source application foundation and CLI; customer-account deployments must work without an Anhedral subscription. Managed delivery is an optional provider adapter, not a dependency hidden in generated application code.
+
+Keep `anhedral-landing` as the public website and existing portal frontend initially; retain working Next.js/Vercel hosting while the Hono/Workers control plane is built. Both portal and CLI should consume that same API. One durable model should connect organizations, memberships/roles, engagements, applications, environments, resources, releases and usage. A services project can contain multiple applications; product users are distinct from portal members. The current portal's email-primary membership permits one team per person; expand membership deliberately before multi-organization operator/client access. Private file links need storage-side authorization, not just a private portal page.
+
+Use the portal for client progress, approvals, application access, operating status, invoices and exports; expose technical controls according to role. Keep hosted customer code on a separate origin/domain from staff/client sessions. Sell engineering and managed operations with explicit responsibilities and bounded infrastructure usage. Source/data export, recovery and the customer-account deployment path should remain usable when managed hosting ends.
+
+Sequence: align released CLI/docs; connect portal organizations to the control-plane registry; ship one independently recoverable private application; prove updates, isolation, backups and cost controls; then add operational/billing UI and selected distribution features. Begin as a managed service for invited clients; expand self-service only after those paths are repeatable.
+
+## Accounts and paid activation
+
+Managed users should need Anhedral sign-in only for ordinary hosted apps. Anhedral operates the infrastructure and bills its customers; customer-account hosting keeps providers and bills in the customer's account. Product login remains separate from platform/hosting access.
+
+| Owner | Account/service | When and gate |
+| --- | --- | --- |
+| Anhedral | [Cloudflare Workers for Platforms](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/pricing/), DNS zone and scoped deployment credentials | Required managed runtime. Published baseline is $25/month plus overages; purchase currently uses the dashboard. Verify account, subscription and permissions before provisioning. |
+| Anhedral | [Neon serverless driver](https://neon.com/docs/serverless/serverless-driver); optional [Hyperdrive](https://developers.cloudflare.com/hyperdrive/platform/pricing/) | Default direct HTTP Postgres; provision isolated app credentials/data boundaries. Add Hyperdrive only for measured needs, using the non-pooled Neon endpoint. D1 is the SQLite option. Free quotas are not production capacity guarantees. Hyperdrive is included in Workers plans; Neon has separate billing. |
+| Anhedral | [R2](https://developers.cloudflare.com/r2/pricing/), selected Cloudflare services | Source/build archives and app files; compute/storage/operations/AI/media have separate meters. Enable only selected services. |
+| Anhedral | Better Auth, verified sender and optional OAuth provider registrations | Platform identity, recovery and login mail. No customer Clerk account required; selected app identity providers can differ. |
+| Anhedral | Stripe merchant account | Anhedral subscriptions and usage billing. Customer app payments require the app owner's merchant account or deliberate Stripe Connect onboarding; never mix ledgers. |
+| App owner, when selected | RevenueCat, Apple/Google store products; external AI, mail or other providers | Own commercial identity and app integrations. Verification, terms, billing and OAuth consent may require a human; the CLI reports the exact remaining step. |
+| App owner, when distributed | [Apple](https://developer.apple.com/help/account/basics/about-your-developer-account), [Play](https://support.google.com/googleplay/android-developer/answer/6112435), [Chrome](https://developer.chrome.com/docs/webstore/register) publisher accounts | Paid enrollment/registration and identity checks. Native signing/builds and review remain platform-specific; cloud backend deployment does not publish clients. |
+| Optional | GitHub; custom domain/registrar | GitHub export/connection, not a prerequisite for managed source recovery. Platform subdomains use Anhedral DNS; [customer domains](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/) require ownership validation and hostname limits. |
+
+Prices/eligibility must be rechecked at activation. Current numeric baseline is a dated October 8, 2026 check, not an app quote. Paid activation requires authorized spending; an agent can prepare setup and resume after enrollment without recreating resources.
+
+## Platform architecture
+
+Use separate control-plane and dispatch Workers. Better Auth identifies platform users; Neon holds owners, apps, permissions, resource identities, versions, deployments and billing ledgers. R2 stores immutable source/build archives. Queues/Workflows execute resumable build/provision/deploy jobs. The dispatch Worker maps an authorized hostname to an isolated user Worker; it must not trust a caller-selected worker name.
+
+[Workers for Platforms bindings](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/configuration/bindings/) support app resources including D1/R2/KV, Durable Objects, Queues, Workflows and Hyperdrive. Attach only that app's resources; use separate credentials and migration/runtime roles for Postgres. Never give user code platform deployment, billing or shared-admin credentials. Build untrusted code in an isolated runner; export only reviewed executable artifacts. Resolve resources on the server from a declared capability manifest, not arbitrary account IDs from uploaded code.
+
+Private previews and production enforce platform audience at dispatch, including assets, APIs and WebSocket upgrades. In-app authorization is still the application's responsibility. Test the chosen framework in the actual dispatch runtime: [platform limits](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/limits/) include disabled `caches.default` and restricted `request.cf` in untrusted namespaces. Do not enable trusted mode for customer code to bypass compatibility failures. User Workers currently lack gradual deployments; use immutable versioned Worker names plus an authorized routing switch for previews/rollback, and verify WebSocket/stateful-version compatibility.
+
+## Agent workflow
+
+**Planned interface:** `cloud login` → `cloud plan --json` → implement/check/commit → `cloud ship --json --wait` → `cloud verify`. Login should use a browser/device authorization flow and OS-protected renewable credentials. CI uses revocable project-scoped credentials. JSON output should distinguish setup required, payment required, queued, failed, deployed and verified, with resumable operation IDs and non-secret next actions.
+
+`plan` must identify owner/environment, declared resources, provider access, compatibility, estimated cost and authorized limits without mutations. `ship` should check source/build provenance, resolve resources, stage/save, apply reviewed compatible migrations, deploy, poll to completion and return the independently confirmed URL. Neither command exists yet. `new --hosting anhedral` is also not supported; generation currently selects Cloudflare or Vercel.
+
+The current low-level sequence is executable only with an operated compatible backend and configured `ANHEDRAL_HOSTING_ORIGIN` / `ANHEDRAL_HOSTING_TOKEN`:
+
+```sh
+anhedral cloud register my-app --audience private --json
+# Review source/secrets and commit the managed manifest in the app's own Git repo.
+git -C my-app add <reviewed-paths>
+git -C my-app commit -m "Prepare application version"
+pnpm --dir my-app run check
+# Build a complete self-contained Worker bundle/assets into an ignored app directory.
+anhedral cloud stage my-app --artifact /absolute/path/my-app/build --json
+anhedral cloud save my-app --version <returned-stage-id> --json
+anhedral cloud deploy my-app --version <returned-stage-id> --json
+anhedral cloud status my-app --json
+```
+
+Current `deploy` requests deployment and checks once; it may return queued/building. It does not wait for completion, run product acceptance or implement managed rollback/export. `save` writes connected identity into the tracked manifest; review/commit that change before staging a subsequent version. A staged artifact is not proven to originate from its source merely because both were archived: the planned build receipt must bind source commit, lockfile, toolchain and artifact digest.
+
+## Source and API contract
+
+Local Git remains the working source of truth. Save the exact clean commit plus complete build tree; retain immutable version IDs, SHA-256 hashes and byte lengths. Current staging permits regular files only, at most 64 MiB per archive and 10,000 build files; it rejects symlinks/submodules and credential files. Restore/clone/export must preserve history and allow exit; optional [Artifacts](https://developers.cloudflare.com/artifacts/platform/pricing/) can add Git-compatible managed history but is Paid-plan-only and has separately published metering.
+
+Current API routes are under `/v1`. Authenticate every route, derive ownership from the session, preserve audience and validate project/version identity. Pin service origin and owner after connection; forbid redirects and credential-bearing origins.
+
+| Route | Contract |
+| --- | --- |
+| `GET /session` | Authenticated owner identity. |
+| `POST /projects`, `GET /projects/:id` | Idempotent registration/current owned project state. |
+| `POST /projects/:id/versions` | Immutable commit, hashes/lengths and version identity. |
+| `PUT /projects/:id/versions/:version/source` or `/artifact` | Independently verify uploaded hashes/lengths. |
+| `GET /projects/:id/versions/:version` | Saved only when both verified archives exist. |
+| `POST /projects/:id/deployments` | Idempotent deployment of exact saved version/audience. |
+| `GET /projects/:id/deployments/:deployment` | Independently confirmed state/source/artifact; HTTPS URL only when deployed. |
+
+Validate archives again server-side before extraction, including traversal, links, duplicate paths and decompression/size limits. Preserve incomplete upload/job evidence for safe retries. Saving source, deploying code and passing product tests remain separate states.
+
+## Limits and completion gates
+
+Enforce [dispatch CPU/subrequest limits](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/configuration/custom-limits/) plus application-owned request, storage, SQL, job, AI/media and outbound budgets. Provider alerts are not hard spend caps. Reserve costly work transactionally before execution; reconcile completion/failure idempotently. Rate-limit platform API jobs with bounded retry/backoff for provider throttling. Limit previews/builds, concurrent jobs and retention; define grace/suspension/export policies. Do not delete customer data merely because billing fails. Optional paid/beta/enterprise services need explicit eligibility checks and adapters; free analytics does not make the rest free.
+
+Build in this order: platform identity and account/subscription preflight; durable registry/archive API; isolated build/resource provisioning; dispatch/private routes; resumable deployment polling; logs/secrets/recovery/export; billing/quotas; signed client distribution where requested. First acceptance fixture: two owners, independent private apps, persistence, file upload, one bounded job and repeated update. Prove cross-tenant rejection, anonymous denial, interrupted-save/deploy retry, source restoration, quota rejection and code rollback/data compatibility before onboarding.
+
+Maintain this single contract as capabilities ship: replace planned claims with verified command/API behavior and update account/limit links. Keep dated test evidence in existing release/test artifacts, not new analysis documents. Deployment and publication remain unproven until the operated service and installed agent workflow pass acceptance.

package/docs/sponsorships.md

@@ -0,0 +1,25 @@
+# Support Anhedral Init
+
+## Help more people build applications they own
+
+Anhedral Init is free and open source. We build tools that help developers turn an idea into an application with source code, infrastructure, and data in their own accounts.
+
+If Anhedral Init helps you build, saves you time, or makes your work easier, consider supporting its continued development. Your support helps us improve the tools, maintain integrations, fix bugs, and write clearer documentation.
+
+## GitHub Sponsors — coming soon
+
+Support can be a thank-you for something useful today or an ongoing contribution to the project's future. Every contribution helps us spend more time improving Anhedral Init for the people who use it.
+
+We plan to offer donations and ongoing sponsorships through GitHub Sponsors. Our sponsorship profile is not available yet; we'll add the link here when it launches.
+
+In the meantime, [contact us at business@anhedral.com](mailto:business@anhedral.com?subject=Support%20Anhedral%20Init) if you'd like to support the project.
+
+## Company sponsorships
+
+Does your company use Anhedral Init or want to support its development? We'd love to hear from you. Get in touch to discuss a sponsorship and how we can recognize your support.
+
+**[Become a sponsor](mailto:business@anhedral.com?subject=Anhedral%20Init%20sponsorship)**
+
+Thank you for helping us keep Anhedral Init free, open source, and improving.
+
+[Back to Anhedral Init](../README.md)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "anhedral",
-  "version": "0.8.6",
-  "description": "Initialize client-owned applications from curated platform recipes and selected services.",
+  "version": "0.9.0",
+  "description": "Build and deliver applications with Cloudflare-first Vinext, selected services, optional Next.js on Vercel, and verified release evidence.",
   "type": "module",
   "exports": {
     ".": {
@@ -18,12 +18,15 @@
     "dist",
     "assets/anhedral-cli-init.svg",
     "assets/anhedral-cli-init-technical.svg",
-    "assets/images/svg/logo-white-subtract.svg",
+    "assets/anhedral-mark.svg",
     "LICENSE",
     "README.md",
     "assets/anhedral.svg",
     "assets/favicon.ico",
     "docs/application-stack-standard.md",
+    "docs/delivery-workflow.md",
+    "docs/sponsorships.md",
+    "docs/managed-hosting-architecture.md",
     "assets/security"
   ],
   "homepage": "https://github.com/anhedral/anhedral-init#readme",
@@ -44,14 +47,14 @@
   "scripts": {
     "scaffold": "node dist/bin.js init",
     "clean": "node scripts/clean.mjs",
-    "build": "pnpm clean && tsc && node scripts/prepare-cli.mjs && node scripts/build-control-panel.mjs",
+    "build": "pnpm clean && tsc && node scripts/prepare-cli.mjs",
     "prepare": "pnpm build",
-    "typecheck": "tsc --noEmit && tsc -p apps/control-panel/tsconfig.json",
+    "typecheck": "tsc --noEmit",
     "check:hygiene": "node scripts/check-source-hygiene.mjs",
     "check:security": "node scripts/check-security-policy.mjs",
     "check:release-policy": "node scripts/check-release-policy.mjs",
     "check:release-secrets": "node scripts/check-release-secrets.mjs",
-    "lint": "pnpm typecheck && pnpm check:hygiene && pnpm check:release-policy",
+    "lint": "pnpm typecheck && pnpm format:check && pnpm check:hygiene && pnpm check:release-policy",
     "audit:osv": "node scripts/audit-osv.mjs",
     "test": "pnpm test:unit",
     "pretest": "pnpm build",
@@ -72,7 +75,11 @@
     "test:standard": "pnpm build && node --test tests/test-standard.test.mjs",
     "test:unit": "node --test --test-concurrency=4 --test-reporter=spec tests/*.test.mjs",
     "test:integration": "pnpm build && node tests/test-generated-apps.mjs",
-    "dev:panel": "node .artifacts/control-panel/preview.js"
+    "test:live:delivery": "pnpm build && node tests/test-live-delivery.mjs",
+    "test:live:vercel": "pnpm build && node tests/test-live-vercel.mjs",
+    "test:live:vercel:git": "pnpm build && node tests/test-live-vercel-git.mjs",
+    "format": "prettier --write src scripts tests",
+    "format:check": "prettier --check src scripts tests"
   },
   "keywords": [
     "cli",
@@ -88,31 +95,18 @@
     "neon",
     "drizzle",
     "shadcn",
-    "turborepo"
+    "turborepo",
+    "vinext"
   ],
   "license": "Apache-2.0",
-  "packageManager": "pnpm@12.9.1",
+  "packageManager": "pnpm@10.34.5",
   "devDependencies": {
-    "@base-ui/react": "1.8.0",
-    "@modelcontextprotocol/ext-apps": "1.7.5",
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "@openai/mcp-extensions": "0.1.0",
-    "@tailwindcss/node": "4.3.3",
-    "@tailwindcss/oxide": "4.3.3",
     "@types/node": "20.19.43",
-    "@types/react": "19.3.0",
-    "@types/react-dom": "19.3.0",
-    "class-variance-authority": "0.7.1",
-    "cn": "0.4.0",
-    "esbuild": "0.28.2",
-    "jsonc-parser": "3.3.1",
-    "lucide-react": "1.52.0",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
-    "simple-icons": "16.34.0",
-    "tailwindcss": "4.3.3",
-    "tw-animate-css": "1.4.0",
-    "typescript": "6.0.3",
-    "zod": "4.6.5"
+    "prettier": "3.9.10",
+    "simple-icons": "16.27.0",
+    "typescript": "5.9.3"
+  },
+  "dependencies": {
+    "jsonc-parser": "3.3.1"
   }
 }

package/dist/evidence-validation.d.ts

@@ -1,2 +0,0 @@
-export declare function isNonSecretEvidence(value: string): boolean;
-export declare function isProgressEnvironment(value: string): boolean;

package/dist/evidence-validation.js

@@ -1,18 +0,0 @@
-/** Shared, dependency-free validation for public progress and plugin evidence. */
-const forbiddenEvidence = /(?:postgres(?:ql)?:\/\/|bearer\s+\S+|(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+|\b(?:sk|pk)_(?:live|test|proj)_\S+|\bsk-(?:proj-|live_|test_)?[a-zA-Z0-9_-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bAKIA[A-Z0-9]{16}\b|\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]+|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/i;
-export function isNonSecretEvidence(value) {
-    if (/[\x00-\x08\x0b-\x1f]/.test(value) || forbiddenEvidence.test(value))
-        return false;
-    for (const candidate of value.matchAll(/\b(?:https?|wss?):[^\s<>"']+/gi)) {
-        try {
-            const target = new URL(candidate[0]);
-            if (target.username || target.password)
-                return false;
-        }
-        catch { /* Non-URL prose is validated by the bounded text contract. */ }
-    }
-    return true;
-}
-export function isProgressEnvironment(value) {
-    return /^[a-zA-Z0-9_-][a-zA-Z0-9._-]{0,79}$/.test(value) && !['__proto__', 'constructor', 'prototype'].includes(value);
-}

package/dist/foundation.d.ts

@@ -1,6 +0,0 @@
-export declare const SHADCN_VERSION = "4.21.3";
-export declare const SHADCN_BOOTSTRAP: string[];
-/** A shared JS workspace is independent of any UI framework bootstrap. */
-export declare function scaffoldFoundation(root: string): void;
-/** The intentionally small single-app recipe has no shared packages or task runner. */
-export declare function flattenSingleApi(root: string, name: string): void;

package/dist/foundation.js

@@ -1,49 +0,0 @@
-import { cpSync, readFileSync, rmSync } from 'node:fs';
-import path from 'node:path';
-import { writeFile } from './util.js';
-import { PACKAGE_MANAGER, TURBO_VERSION } from './dependencies.js';
-import { generatedPnpmPolicy, setPnpmPolicy } from './pnpm-policy.js';
-// Curated input version; upstream registry templates still require compatibility checks.
-export const SHADCN_VERSION = '4.21.3';
-export const SHADCN_BOOTSTRAP = ['pnpm', 'dlx', `shadcn@${SHADCN_VERSION}`, 'init', '--monorepo', '--template', 'next'];
-const json = (root, file, value) => writeFile(path.join(root, file), JSON.stringify(value, null, 2) + '\n');
-/** A shared JS workspace is independent of any UI framework bootstrap. */
-export function scaffoldFoundation(root) {
-    json(root, 'package.json', { name: 'anhedral-workspace', private: true, packageManager: PACKAGE_MANAGER, devDependencies: { turbo: TURBO_VERSION } });
-    writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages:\n  - "apps/*"\n  - "packages/*"\n');
-    json(root, 'turbo.json', { $schema: 'https://turbo.build/schema.json', tasks: { build: { dependsOn: ['^build'] }, lint: { dependsOn: ['^lint'] }, typecheck: { dependsOn: ['^typecheck'] }, dev: { cache: false, persistent: true } } });
-    json(root, 'packages/eslint-config/package.json', { name: '@workspace/eslint-config', private: true, type: 'module', exports: { './base': './base.js', './react-internal': './react-internal.js' }, devDependencies: { eslint: '9.39.5', '@eslint/js': '9.39.5', 'typescript-eslint': '8.71.1', 'eslint-plugin-react-hooks': '7.1.1', typescript: '6.0.3' } });
-    writeFile(path.join(root, 'packages/eslint-config/base.js'), `import js from '@eslint/js';
-import ts from 'typescript-eslint';
-export const config = [js.configs.recommended, ...ts.configs.recommended, { ignores: ['**/dist/**', '**/.output/**', '**/.wxt/**', '**/.expo/**', '**/node_modules/**'] }];
-`);
-    writeFile(path.join(root, 'packages/eslint-config/react-internal.js'), `import { config as base } from './base.js';
-import hooks from 'eslint-plugin-react-hooks';
-export const config = [...base, { files: ['**/*.{tsx,jsx}'], plugins: { 'react-hooks': hooks }, rules: { 'react-hooks/rules-of-hooks': 'error', 'react-hooks/exhaustive-deps': 'warn' } }];
-`);
-    json(root, 'packages/typescript-config/package.json', { name: '@workspace/typescript-config', private: true, exports: { './base.json': './base.json' } });
-    json(root, 'packages/typescript-config/base.json', { compilerOptions: { target: 'ES2022', module: 'ESNext', moduleResolution: 'Bundler', strict: true, skipLibCheck: true, noEmit: true } });
-}
-/** The intentionally small single-app recipe has no shared packages or task runner. */
-export function flattenSingleApi(root, name) {
-    const read = (file) => JSON.parse(readFileSync(path.join(root, file), 'utf8'));
-    const workspace = read('package.json');
-    const app = read('apps/api/package.json');
-    cpSync(path.join(root, 'apps/api'), root, { recursive: true });
-    delete app.devDependencies['@workspace/eslint-config'];
-    const config = read('packages/eslint-config/package.json');
-    delete config.devDependencies['eslint-plugin-react-hooks'];
-    // The standalone API has no React/Babel browser-target dependency chain.
-    const overrides = generatedPnpmPolicy(root, 'overrides');
-    for (const key of ['baseline-browser-mapping@<2.11.0', 'browserslist@<4.28.7'])
-        delete overrides[key];
-    const scripts = { ...workspace.scripts, ...app.scripts, test: 'node --test', 'audit:full': 'fallow --fail-on-issues' };
-    json(root, 'package.json', { ...app, name, packageManager: PACKAGE_MANAGER, engines: workspace.engines, scripts, devDependencies: { ...config.devDependencies, ...app.devDependencies, eslint: '9.39.5', fallow: workspace.devDependencies.fallow } });
-    writeFile(path.join(root, 'eslint.config.mjs'), `import js from '@eslint/js';
-import ts from 'typescript-eslint';
-export default [js.configs.recommended, ...ts.configs.recommended, { ignores: ['dist/**', '.wrangler/**', 'worker-configuration.d.ts'] }, { files: ['**/*.mjs'], languageOptions: { globals: { process: 'readonly' } } }, { files: ['**/*.ts'], rules: { 'no-undef': 'off', 'no-unused-vars': 'off' } }];
-`);
-    for (const file of ['apps', 'packages', 'turbo.json', 'pnpm-workspace.yaml'])
-        rmSync(path.join(root, file), { recursive: true, force: true });
-    setPnpmPolicy(root, { allowBuilds: { esbuild: true, workerd: true }, overrides });
-}

package/dist/progress-view.d.ts

@@ -1,57 +0,0 @@
-import type { evaluateProjectProgress } from "./progress.js";
-export type EnvironmentProgress = ReturnType<typeof evaluateProjectProgress>["environments"][number];
-interface ProgressNode {
-    label?: string;
-    id: string;
-    capability?: string;
-    resourceId?: string;
-    status: "planned" | "building" | "configured" | "verified" | "blocked";
-}
-export interface ProviderObservation {
-    id: string;
-    name: string;
-    status: string;
-}
-export declare function componentResources<T extends ProviderObservation>(node: ProgressNode, resources: readonly T[]): T[];
-export declare function providerAttention(resources: readonly ProviderObservation[]): boolean;
-export declare function componentObservations(progress: EnvironmentProgress | undefined, node: ProgressNode): {
-    stale: boolean;
-    capability: string;
-    milestone: import("./progress.js").Milestone;
-    configurationFingerprint: string;
-    resourceRef?: string;
-    revisionRef?: string;
-    outcome: "passed" | "failed" | "blocked";
-    source: "agent" | "independent";
-    observedAt: string;
-    evidence: string;
-    accountRef?: string;
-}[];
-export declare function latestObservations(observations: EnvironmentProgress["observations"]): {
-    stale: boolean;
-    capability: string;
-    milestone: import("./progress.js").Milestone;
-    configurationFingerprint: string;
-    resourceRef?: string;
-    revisionRef?: string;
-    outcome: "passed" | "failed" | "blocked";
-    source: "agent" | "independent";
-    observedAt: string;
-    evidence: string;
-    accountRef?: string;
-}[];
-export declare function componentState(progress: EnvironmentProgress | undefined, node: ProgressNode, resources?: readonly ProviderObservation[]): "blocked" | "planned" | "building" | "configured" | "verified";
-/** A failed optional route does not block a working alternative for the same scope. */
-export declare function discoveryAttention(discovery: EnvironmentProgress["discovery"]): {
-    stale: boolean;
-    provider: string;
-    route: "plugin" | "api" | "cli" | "browser";
-    check: "installed" | "callable" | "local-working" | "authorized" | "integration-tested";
-    expiresAt: string;
-    outcome: "passed" | "failed" | "blocked";
-    source: "agent" | "independent";
-    observedAt: string;
-    evidence: string;
-    accountRef?: string;
-}[];
-export {};

package/dist/progress-view.js

@@ -1,69 +0,0 @@
-export function componentResources(node, resources) {
-    return resources.filter((resource) => node.resourceId
-        ? resource.id === node.resourceId
-        : resource.id === node.id ||
-            (!!node.label && resource.name === node.label));
-}
-export function providerAttention(resources) {
-    return resources.some((resource) => resource.status === "missing" || resource.status === "error");
-}
-export function componentObservations(progress, node) {
-    return (progress?.observations.filter((item) => (item.capability === (node.capability || node.id) &&
-        (!node.resourceId ||
-            !item.resourceRef ||
-            item.resourceRef === node.resourceId)) ||
-        (!!node.resourceId && item.resourceRef === node.resourceId)) || []);
-}
-export function latestObservations(observations) {
-    const latest = new Map();
-    for (const observation of observations) {
-        const key = JSON.stringify([
-            observation.capability,
-            observation.milestone,
-            observation.source,
-            observation.accountRef,
-            observation.resourceRef,
-        ]);
-        const previous = latest.get(key);
-        if (!previous ||
-            Date.parse(observation.observedAt) >= Date.parse(previous.observedAt))
-            latest.set(key, observation);
-    }
-    return [...latest.values()];
-}
-export function componentState(progress, node, resources = []) {
-    if (providerAttention(componentResources(node, resources)))
-        return "blocked";
-    const observations = latestObservations(componentObservations(progress, node));
-    const current = observations.filter((item) => !item.stale);
-    if (current.some((item) => item.outcome !== "passed"))
-        return "blocked";
-    if (current.some((item) => item.milestone === "tested"))
-        return "verified";
-    if (current.some((item) => ["provisioned", "connected"].includes(item.milestone)))
-        return "configured";
-    if (current.some((item) => item.milestone === "generated"))
-        return "building";
-    if (observations.length)
-        return "planned";
-    return node.status;
-}
-/** A failed optional route does not block a working alternative for the same scope. */
-export function discoveryAttention(discovery) {
-    const level = {
-        installed: 0,
-        callable: 1,
-        "local-working": 1,
-        authorized: 2,
-        "integration-tested": 3,
-    };
-    const current = discovery.filter((item) => !item.stale);
-    return current.filter((item) => item.outcome !== "passed" &&
-        !current.some((other) => other.outcome === "passed" &&
-            other.provider === item.provider &&
-            other.route !== item.route &&
-            (!item.accountRef || other.accountRef === item.accountRef) &&
-            (item.source !== "independent" || other.source === "independent") &&
-            level[other.check] >= level[item.check] &&
-            level[other.check] >= 2));
-}

package/dist/progress.d.ts

@@ -1,95 +0,0 @@
-export declare const PROGRESS_FILE = "anhedral.progress.json";
-export declare const MILESTONES: readonly ["generated", "provisioned", "connected", "tested", "deployed"];
-export type Milestone = typeof MILESTONES[number];
-type Outcome = 'passed' | 'failed' | 'blocked';
-type Source = 'agent' | 'independent';
-interface Evidence {
-    outcome: Outcome;
-    source: Source;
-    observedAt: string;
-    evidence: string;
-    accountRef?: string;
-}
-export interface ProgressObservation extends Evidence {
-    capability: string;
-    milestone: Milestone;
-    configurationFingerprint: string;
-    resourceRef?: string;
-    revisionRef?: string;
-}
-export interface DiscoveryObservation extends Evidence {
-    provider: string;
-    route: 'plugin' | 'api' | 'cli' | 'browser';
-    check: 'installed' | 'callable' | 'local-working' | 'authorized' | 'integration-tested';
-    expiresAt: string;
-}
-export interface ProgressEnvironment {
-    id: string;
-    observations: ProgressObservation[];
-    discovery: DiscoveryObservation[];
-    blockers: string[];
-    nextAction?: string;
-    previewUrl?: string;
-    liveUrl?: string;
-}
-export interface ProjectProgress {
-    schemaVersion: 1;
-    revision: number;
-    updatedAt: string;
-    environments: ProgressEnvironment[];
-}
-export interface ProgressReport {
-    revision: number;
-    environment: string;
-    observations?: ProgressObservation[];
-    discovery?: DiscoveryObservation[];
-    blockers?: string[];
-    nextAction?: string | null;
-    previewUrl?: string | null;
-    liveUrl?: string | null;
-}
-export declare function validateProgressReport(value: unknown): ProgressReport;
-export declare function validateProjectProgress(value: unknown): ProjectProgress;
-export declare function readProjectProgress(root: string): ProjectProgress | null;
-/** Bounded source/configuration digest; secrets, dependencies and generated output are excluded. */
-export declare function projectFingerprint(root: string): string;
-/** Reports are caller assertions. Only actual checking adapters should use source: independent. */
-export declare function reportProjectProgress(root: string, input: ProgressReport): ProjectProgress;
-export declare function evaluateProjectProgress(record: ProjectProgress, fingerprint: string, now?: number): {
-    environments: {
-        observations: {
-            stale: boolean;
-            capability: string;
-            milestone: Milestone;
-            configurationFingerprint: string;
-            resourceRef?: string;
-            revisionRef?: string;
-            outcome: Outcome;
-            source: Source;
-            observedAt: string;
-            evidence: string;
-            accountRef?: string;
-        }[];
-        discovery: {
-            stale: boolean;
-            provider: string;
-            route: "plugin" | "api" | "cli" | "browser";
-            check: "installed" | "callable" | "local-working" | "authorized" | "integration-tested";
-            expiresAt: string;
-            outcome: Outcome;
-            source: Source;
-            observedAt: string;
-            evidence: string;
-            accountRef?: string;
-        }[];
-        id: string;
-        blockers: string[];
-        nextAction?: string;
-        previewUrl?: string;
-        liveUrl?: string;
-    }[];
-    schemaVersion: 1;
-    revision: number;
-    updatedAt: string;
-};
-export {};