anhedral 0.9.0 → 0.10.0

package/README.md

@@ -53,22 +53,18 @@ Anhedral Init is free and open source. Sponsorship helps fund ongoing developmen
 
 The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time.
 
-Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports bundled items and versioned source registries from local files or HTTPS. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
+Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports only the bundled catalog maintained and tested by Anhedral. External registries and customer-authored registry payloads are unsupported. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
 
 Use additions after initialization:
 
 ```sh
 anhedral add my-app resend stripe --dry-run --json
 anhedral add my-app resend stripe
-anhedral registry list --registry https://example.com/registry.json --json
-anhedral add my-app feature --registry https://example.com/registry.json --dry-run --json
+anhedral registry list --json
+anhedral registry view resend --json
 ```
 
-Review the dry-run file list and conflicts, then run the same addition without `--dry-run`. For external registries, pass the returned SHA-256 value with `--integrity` to require the reviewed payload. `--skip-install` still resolves the lockfile. Addition installs disable dependency lifecycle scripts; enable only reviewed native build scripts separately when required. Projects must have matching CLI versions and scaffold fingerprints; older projects need a deliberate migration. Existing provider identities stay intact, and no provider resources are created.
-
-Author registries with `anhedral registry build registry.source.json --output registry.json`: each file can declare a repository-relative `path` instead of embedded `content`. Build validates and embeds source before producing the distributable payload.
-
-External registries use Anhedral's declarative source schema: `schemaVersion: 1`, a registry `name`, and `items`. Each item declares `name`, semver `version`, `registryDependencies` (item names in the same registry), and `files` containing explicit `target` and UTF-8 `content`. Targets are confined to `apps/<name>/` and `packages/<name>/`; manifests must be private `@workspace` packages with versioned npm/workspace dependencies and no install hooks. Registries are limited to 2 MiB and 100 items. The receipt records the source, SHA-256 integrity, item versions, targets and generated-file hashes. This schema does not accept executable recipes or shadcn payloads. Review registry source as application code before using it.
+Review the dry-run file list and conflicts, then run the same addition without `--dry-run`. A preview that needs a new web foundation reports `bootstrapRequired: true` and `filesChecked: false`; it describes the selection and targets without running the upstream generator or checking generated-file conflicts. The actual addition checks conflicts in an isolated transaction before committing files. `--skip-install` still resolves the lockfile; run `pnpm install --frozen-lockfile` afterward to prepare dependencies. Final installs run the bundled workspace's dependency preparation hooks, including WXT and Electron setup. Projects must have matching CLI versions and scaffold fingerprints; older projects and receipts containing external items need a deliberate migration. Existing provider identities stay intact, and no provider resources are created.
 
 Application recipes start from the official **shadcn pnpm/Turborepo monorepo**. The default creates **Vinext + React + TypeScript + Tailwind + shadcn/ui + Lucide**, targeting **Cloudflare Workers**. Select additional apps and services only when needed.
 

package/dist/bin.js

@@ -110,7 +110,7 @@ async function main() {
         return;
     }
     if (command !== 'new' && command !== 'init') {
-        throw new Error(`Unknown command: ${command}. Use new, init, registry, doctor, repository, cloud, register, connect, provision, ship, status, manage, verify, rollback, adopt, recover, --help, or --version.`);
+        throw new Error(`Unknown command: ${command}. Use new, init, add, registry, doctor, repository, cloud, register, connect, provision, ship, status, manage, verify, rollback, adopt, recover, --help, or --version.`);
     }
     if (args.some((arg) => ['--help', '-h'].includes(arg))) {
         console.log(json ? JSON.stringify({ usage: STANDARD_USAGE }) : STANDARD_USAGE);
@@ -401,7 +401,11 @@ catch (error) {
                     ? 'INVALID_ARGUMENT'
                     : command === 'new' || command === 'init'
                         ? 'GENERATION_FAILED'
-                        : 'UNKNOWN_COMMAND';
+                        : command === 'add'
+                            ? 'ADDITION_FAILED'
+                            : command === 'registry'
+                                ? 'REGISTRY_FAILED'
+                                : 'UNKNOWN_COMMAND';
     console.error(json ? JSON.stringify({ error: message, code }) : `Error: ${message}`);
     process.exitCode = 1;
 }

package/dist/index.d.ts

@@ -18,6 +18,4 @@ export { inspectWorkspaceGraph } from './workspace-graph.js';
 export { resolveStackRegistry } from './registry/resolve.js';
 export type { ResolvedStackRegistry } from './registry/resolve.js';
 export { addStackItems } from './registry/add.js';
-export { buildSourceRegistry, loadSourceRegistry, validateSourceRegistry, resolveSourceItems, } from './registry/remote.js';
-export type { SourceRegistry, SourceItem, RemoteRegistry } from './registry/remote.js';
 export type { AddRequest } from './registry/add.js';

package/dist/index.js

@@ -12,4 +12,3 @@ export { STACK_REGISTRY, STACK_ITEMS, getStackItem } from './stack-registry.js';
 export { inspectWorkspaceGraph } from './workspace-graph.js';
 export { resolveStackRegistry } from './registry/resolve.js';
 export { addStackItems } from './registry/add.js';
-export { buildSourceRegistry, loadSourceRegistry, validateSourceRegistry, resolveSourceItems, } from './registry/remote.js';

package/dist/readiness.js

@@ -1,4 +1,3 @@
-import { assertSafeTarget } from './registry/receipt.js';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
@@ -19,7 +18,7 @@ export function inspectProject(root) {
         record('setup-plan', true, `Requirements recorded by CLI ${plan.cliVersion}`);
         try {
             const installed = read('anhedral.registry.json');
-            const { status, workspaces: _workspaces, files: _files, remoteItems, resourcesProvisioned, ...snapshot } = installed;
+            const { status, workspaces: _workspaces, files: _files, resourcesProvisioned, ...snapshot } = installed;
             if (status !== 'scaffolded' ||
                 resourcesProvisioned !== false ||
                 !isDeepStrictEqual(snapshot, plan.registry))
@@ -29,22 +28,6 @@ export function inspectProject(root) {
                     if (!existsSync(path.join(root, target)))
                         throw new Error(`Registry target missing: ${item.name}.`);
                 }
-            if (remoteItems !== undefined) {
-                if (!Array.isArray(remoteItems))
-                    throw new Error('Invalid remote registry receipt.');
-                for (const item of remoteItems) {
-                    if (!item ||
-                        typeof item.source !== 'string' ||
-                        typeof item.integrity !== 'string' ||
-                        !Array.isArray(item.targets))
-                        throw new Error('Invalid remote registry provenance.');
-                    for (const target of item.targets) {
-                        assertSafeTarget(root, target);
-                        if (!existsSync(path.join(root, target)))
-                            throw new Error('Missing remote registry target.');
-                    }
-                }
-            }
             record('stack-registry', true, 'Registry provenance and resolved targets match the setup plan');
         }
         catch {

package/dist/registry/add.d.ts

@@ -1,22 +1,18 @@
 import type { StandardRunner } from './types.js';
 export interface AddRequest {
     items: string[];
-    registry?: string;
-    integrity?: string;
     dryRun?: boolean;
     skipInstall?: boolean;
 }
 /** Add recipes to an initialized workspace, refusing edits to customer-owned source. */
 export declare function addStackItems(root: string, request: AddRequest, run?: StandardRunner): Promise<{
-    files: string[];
-    conflicts: string[];
-    registry?: {
-        source: string;
-        integrity: string;
-    } | undefined;
     schemaVersion: number;
     root: string;
     dryRun: boolean;
     items: string[];
-    remoteItems: string[];
+    bootstrapRequired: boolean;
+    filesChecked: boolean;
+    targets: string[];
+    files: string[];
+    conflicts: string[];
 }>;

package/dist/registry/add.js

@@ -16,10 +16,12 @@ import { json, put, readJson } from '../scaffold/files.js';
 import { writeStandardRoot } from '../scaffold/workspace.js';
 import { createRecipeContext } from './context.js';
 import { resolveStackRegistry, resolveStandardProducts } from './resolve.js';
-import { sourceFiles, assertSafeTarget } from './receipt.js';
-import { loadSourceRegistry, resolveSourceItems } from './remote.js';
+import { sourceFiles } from './receipt.js';
 /** Add recipes to an initialized workspace, refusing edits to customer-owned source. */
 export async function addStackItems(root, request, run = execFile) {
+    for (const key of Object.keys(request))
+        if (!['items', 'dryRun', 'skipInstall'].includes(key))
+            throw new Error(`Unknown add option: ${key}. Only bundled registry items are supported.`);
     root = realpathSync(root);
     if (!request.items.length)
         throw new Error('Select at least one registry item.');
@@ -34,17 +36,11 @@ export async function addStackItems(root, request, run = execFile) {
         throw new Error('This project has no scaffold fingerprints; migrate it deliberately before using add.');
     const baseline = receipt.files;
     const selected = new Set(plan.products);
-    let remote;
-    if (request.registry)
-        remote = await loadSourceRegistry(request.registry);
-    else
-        for (const id of request.items) {
-            if (!STANDARD_PRODUCTS.includes(id))
-                throw new Error(`Unknown stack product: ${id}.`);
-            selected.add(id);
-        }
-    if (request.integrity && (!remote || remote.integrity !== request.integrity))
-        throw new Error('Source registry integrity differs from the reviewed payload.');
+    for (const id of request.items) {
+        if (!STANDARD_PRODUCTS.includes(id))
+            throw new Error(`Unknown stack product: ${id}.`);
+        selected.add(id);
+    }
     resolveStandardProducts(selected, plan.hosting, false);
     const options = {
         root,
@@ -65,22 +61,6 @@ export async function addStackItems(root, request, run = execFile) {
         if (before && before.targets.some((target) => !item.targets.includes(target)))
             throw new Error(`Adding this selection relocates ${item.name}; migrate its existing source explicitly.`);
     }
-    const remoteItems = remote ? resolveSourceItems(remote.registry, request.items) : [];
-    if (remote) {
-        const previous = Array.isArray(receipt.remoteItems) ? receipt.remoteItems : [];
-        for (const item of remoteItems) {
-            const identity = `${remote.source}#${item.name}`;
-            const targets = item.files.map((file) => file.target);
-            for (const installed of previous) {
-                if (installed.identity === identity &&
-                    installed.targets.some((target) => !targets.includes(target)))
-                    throw new Error(`Remote update relocates ${item.name}; migrate its source explicitly.`);
-                if (installed.identity !== identity &&
-                    installed.targets.some((target) => targets.includes(target)))
-                    throw new Error(`Remote target is already owned by ${installed.name}.`);
-            }
-        }
-    }
     const before = sourceFiles(root);
     const receiptText = readFileSync(path.join(root, 'anhedral.registry.json'), 'utf8');
     const commitPaths = [];
@@ -92,11 +72,19 @@ export async function addStackItems(root, request, run = execFile) {
         items: registry.items
             .filter((item) => !isDeepStrictEqual(oldItems.get(item.name), item))
             .map((item) => item.name),
-        remoteItems: remoteItems.map((item) => item.name),
-        ...(remote ? { registry: { source: remote.source, integrity: remote.integrity } } : {}),
+        bootstrapRequired: recipes.some((item) => ['vinext', 'next'].includes(item.name)) &&
+            !existsSync(path.join(root, 'apps/web/package.json')),
+        filesChecked: true,
+        targets: recipes.flatMap((item) => item.targets),
         files: commitPaths,
         conflicts,
     };
+    // The upstream web generator requires network access and executes package scripts.
+    // A preview reports the resolved selection without invoking that generator.
+    if (request.dryRun && result.bootstrapRequired) {
+        result.filesChecked = false;
+        return result;
+    }
     await runStagedTransaction(root, {
         dryRun: !!request.dryRun,
         commitPaths,
@@ -126,11 +114,6 @@ export async function addStackItems(root, request, run = execFile) {
                     }
                 put(stage, file, content);
             }
-            for (const item of remoteItems)
-                for (const file of item.files) {
-                    assertSafeTarget(stage, file.target);
-                    put(stage, file.target, file.content);
-                }
             writeStandardRoot(stage, options, registry, true);
             if (options.products.includes('next') && options.hosting === 'vercel')
                 registerVercelApplication(stage);
@@ -158,30 +141,12 @@ export async function addStackItems(root, request, run = execFile) {
                     conflicts.push(file);
             if (conflicts.length && !request.dryRun)
                 throw new Error(`Addition conflicts with edited or untracked source: ${conflicts.join(', ')}. No files were installed.`);
-            const remoteReceipts = Array.isArray(receipt.remoteItems) ? [...receipt.remoteItems] : [];
-            for (const item of remoteItems) {
-                const identity = `${remote.source}#${item.name}`;
-                const previous = remoteReceipts.findIndex((entry) => entry.identity === identity);
-                const entry = {
-                    identity,
-                    name: item.name,
-                    version: item.version,
-                    source: remote.source,
-                    integrity: remote.integrity,
-                    targets: item.files.map((file) => file.target),
-                };
-                if (previous >= 0)
-                    remoteReceipts[previous] = entry;
-                else
-                    remoteReceipts.push(entry);
-            }
             json(stage, 'anhedral.registry.json', {
                 ...registry,
                 status: 'scaffolded',
                 resourcesProvisioned: false,
                 workspaces: inspectWorkspaceGraph(stage),
                 files,
-                ...(remoteReceipts.length ? { remoteItems: remoteReceipts } : {}),
             });
             commitPaths.push('anhedral.registry.json');
             // Detect concurrent changes even to source that this addition would otherwise preserve.
@@ -191,7 +156,7 @@ export async function addStackItems(root, request, run = execFile) {
         },
         afterCommit: () => {
             if (!request.skipInstall)
-                run('pnpm', ['install', '--frozen-lockfile', '--ignore-scripts'], root);
+                run('pnpm', ['install', '--frozen-lockfile'], root);
         },
     });
     return result;

package/dist/registry/commands.js

@@ -1,42 +1,7 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { addStackItems } from './add.js';
-import { buildSourceRegistry, loadSourceRegistry } from './remote.js';
 import { STACK_REGISTRY, getStackItem } from '../stack-registry.js';
 export async function runRegistry(args, json) {
-    if (args[0] === 'build') {
-        args = args.filter((arg) => arg !== '--json');
-        if (args.length !== 4 || args[2] !== '--output' || !args[1] || !args[3])
-            throw new Error('Use registry build <manifest> --output <registry.json>.');
-        const source = path.resolve(args[1]);
-        const output = path.resolve(args[3]);
-        if (source === output)
-            throw new Error('Registry output must differ from its authored manifest.');
-        const registry = buildSourceRegistry(source);
-        mkdirSync(path.dirname(output), { recursive: true });
-        writeFileSync(output, JSON.stringify(registry, null, 2) + '\n');
-        console.log(JSON.stringify({ output, items: registry.items.length }));
-        return;
-    }
-    const registryFlag = args.indexOf('--registry');
-    if (registryFlag >= 0) {
-        const source = args[registryFlag + 1];
-        if (!source || source.startsWith('-'))
-            throw new Error('Missing registry source.');
-        const positional = args.filter((arg, index) => index !== registryFlag && index !== registryFlag + 1 && arg !== '--json');
-        const registry = await loadSourceRegistry(source);
-        if (positional.length === 1 && positional[0] === 'list')
-            console.log(JSON.stringify(registry, null, 2));
-        else if (positional.length === 2 && positional[0] === 'view') {
-            const item = registry.registry.items.find((item) => item.name === positional[1]);
-            if (!item)
-                throw new Error('Unknown remote registry item.');
-            console.log(JSON.stringify({ source: registry.source, integrity: registry.integrity, item }, null, 2));
-        }
-        else
-            throw new Error('Use registry list|view [item] --registry <file|https-url>.');
-        return;
-    }
     const positional = args.filter((arg) => arg !== '--json');
     if (positional.includes('--help') || positional.includes('-h')) {
         console.log('anhedral registry list|view [item] [--json]');
@@ -61,38 +26,22 @@ export async function runRegistry(args, json) {
 }
 export async function runAdd(args) {
     if (args.includes('--help') || args.includes('-h')) {
-        console.log('anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]');
+        console.log('anhedral add <directory> <items...> [--dry-run] [--skip-install] [--json]');
         return;
     }
-    let source;
-    let integrity;
     const positional = [];
-    for (let index = 0; index < args.length; index++) {
-        const arg = args[index];
+    for (const arg of args) {
         if (['--dry-run', '--skip-install', '--json'].includes(arg))
             continue;
-        if (arg === '--integrity') {
-            if (integrity || !args[index + 1] || !/^sha256-[A-Za-z0-9+/]{43}=$/.test(args[index + 1]))
-                throw new Error('Specify one SHA-256 registry integrity.');
-            integrity = args[++index];
-        }
-        else if (arg === '--registry') {
-            if (source || !args[index + 1] || args[index + 1].startsWith('-'))
-                throw new Error('Specify one registry source.');
-            source = args[++index];
-        }
-        else if (arg.startsWith('-'))
-            throw new Error('Unknown add option.');
-        else
-            positional.push(arg);
+        if (arg.startsWith('-'))
+            throw new Error(`Unknown add option: ${arg}.`);
+        positional.push(arg);
     }
     const [directory, ...items] = positional;
     if (!directory || !items.length)
         throw new Error('Use add <directory> <items...>.');
     console.log(JSON.stringify(await addStackItems(path.resolve(directory), {
         items,
-        registry: source,
-        integrity,
         dryRun: args.includes('--dry-run'),
         skipInstall: args.includes('--skip-install'),
     }), null, 2));

package/dist/registry/receipt.d.ts

@@ -1,3 +1,2 @@
 export declare function sourceFiles(root: string): Map<string, string>;
 export declare function recordScaffoldFiles(root: string): void;
-export declare function assertSafeTarget(root: string, relative: string): void;

package/dist/registry/receipt.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { json, readJson } from '../scaffold/files.js';
 const excluded = new Set([
@@ -50,24 +50,3 @@ export function recordScaffoldFiles(root) {
         files: Object.fromEntries(sourceFiles(root)),
     });
 }
-export function assertSafeTarget(root, relative) {
-    if (!relative ||
-        path.isAbsolute(relative) ||
-        relative.includes('\\') ||
-        relative
-            .split('/')
-            .some((part) => !part ||
-            part === '.' ||
-            part === '..' ||
-            part.includes(':') ||
-            /[\x00-\x1f]/.test(part) ||
-            /[. ]$/.test(part) ||
-            /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(part)))
-        throw new Error(`Unsafe registry target: ${relative}.`);
-    let current = root;
-    for (const part of relative.split('/')) {
-        current = path.join(current, part);
-        if (existsSync(current) && lstatSync(current).isSymbolicLink())
-            throw new Error(`Registry target traverses a symlink: ${relative}.`);
-    }
-}

package/dist/registry/usage.js

@@ -2,7 +2,7 @@ import { STANDARD_PRODUCTS } from '../stack-registry.js';
 export const STANDARD_USAGE = `Anhedral Application Stack & Delivery Standard
 
 anhedral new <directory> [products...] [--hosting cloudflare|vercel] [--skip-install] [--no-git] [--dry-run] [--json]
-anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]
+anhedral add <directory> <items...> [--dry-run] [--skip-install] [--json]
 anhedral init [products...] [--hosting cloudflare|vercel] [--skip-install] [--git] [--dry-run] [--json]
 
 Default: Vinext on Cloudflare Workers, from the official shadcn pnpm/Turborepo monorepo.
@@ -15,8 +15,7 @@ Examples:
   anhedral new website --next --stripe --resend
   anhedral init --wxt
   anhedral cloud register|stage|save|deploy|status [directory] (managed service API required)
-  anhedral registry build <manifest> --output <registry.json>
-  anhedral registry list|view [item] [--registry <file|https-url>] [--json]
+  anhedral registry list|view [item] [--json]
   anhedral doctor [directory] [--providers] --json
   anhedral repository [directory] [--owner <github-account>] [--name <repo>] [--visibility private|public] [--create]
   anhedral register [directory]

package/dist/scaffold/bootstrap.d.ts

@@ -1,2 +1,3 @@
 import type { StandardRunner } from '../registry/types.js';
+export declare function assertBootstrapPlatform(run: StandardRunner, platform?: NodeJS.Platform): void;
 export declare function bootstrapWorkspace(root: string, name: string, run: StandardRunner, webOnly?: boolean): void;

package/dist/scaffold/bootstrap.js

@@ -1,8 +1,13 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import path from 'node:path';
-import { appendGitignore } from '../util.js';
+import { execFile, appendGitignore } from '../util.js';
 import { bootstrapArguments } from '../registry/bootstrap.js';
+export function assertBootstrapPlatform(run, platform = process.platform) {
+    if (platform === 'win32' && run === execFile)
+        throw new Error('Native Windows initialization is blocked because the upstream shadcn monorepo bootstrap writes component files outside the project. Run Anhedral inside WSL. Planning and doctor remain available on Windows.');
+}
 export function bootstrapWorkspace(root, name, run, webOnly = false) {
+    assertBootstrapPlatform(run);
     const temporary = path.join(root, '.bootstrap');
     mkdirSync(temporary);
     try {

package/dist/standard.js

@@ -8,19 +8,13 @@ import { registerVercelApplication } from './vercel.js';
 import { registerApplication } from './delivery.js';
 import { runStagedTransaction } from './transaction.js';
 import { createSetupPlan } from './capabilities.js';
-import { bootstrapWorkspace } from './scaffold/bootstrap.js';
+import { bootstrapWorkspace, assertBootstrapPlatform } from './scaffold/bootstrap.js';
 import { composeStack } from './scaffold/compose.js';
 import { parseStandardOptions } from './registry/options.js';
 import { STANDARD_USAGE } from './registry/usage.js';
 export { parseStandardOptions, STANDARD_USAGE };
 export { STANDARD_PRODUCTS } from './stack-registry.js';
-const defaultRunner = (command, args, cwd) => execFile(command, args, cwd);
-function assertBootstrapPlatform(run) {
-    if (process.platform === 'win32' && run === defaultRunner) {
-        throw new Error('Native Windows initialization is blocked because the upstream shadcn monorepo bootstrap writes component files outside the project. Run Anhedral inside WSL. Planning and doctor remain available on Windows.');
-    }
-}
-export async function scaffoldStandardProject(options, run = defaultRunner) {
+export async function scaffoldStandardProject(options, run = execFile) {
     const plan = createSetupPlan(options);
     if (options.dryRun) {
         console.log(options.json ? JSON.stringify(plan, null, 2) : JSON.stringify(plan));

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "0.9.0";
+export declare const GENERATOR_VERSION = "0.10.0";

package/dist/version.js

@@ -1 +1 @@
-export const GENERATOR_VERSION = '0.9.0';
+export const GENERATOR_VERSION = '0.10.0';

package/docs/delivery-workflow.md

@@ -6,7 +6,7 @@ Codex implements the product; the CLI supplies scaffolding, selected resource re
 
 1. Choose only needed components from the [stack standard](application-stack-standard.md). Record decisions, ownership, environment/cost assumptions and actual connections in the application's `docs/architecture.md`.
 2. Match installed plugin, registry `cliVersion` and executable versions. Check Node/pnpm, Git identity, toolchains and customer provider access. For unpublished development use `pnpm build` and `node dist/bin.js`; never silently substitute `@latest`.
-3. Inspect `new <unused-directory> <flags> --dry-run --json`, then generate with those choices. Review README, AGENTS, setup manifests and resolved lockfile. For initialized apps, preview `add <directory> <items...> --dry-run --json`; additions protect edited source and record registry provenance. Use `--registry <file|https-url>` for reviewed declarative registries. Older projects and runtime relocation require explicit migration. `doctor --providers --json` checks access without configuring infrastructure or certifying production.
+3. Inspect `new <unused-directory> <flags> --dry-run --json`, then generate with those choices. Review README, AGENTS, setup manifests and resolved lockfile. For initialized apps, preview `add <directory> <items...> --dry-run --json`; additions protect edited source and record registry provenance. Select only items from the bundled Anhedral catalog. If a web addition reports `filesChecked: false`, the preview covers selection and targets only; the actual transaction checks generated-file conflicts before committing. Older projects and runtime relocation require explicit migration. `doctor --providers --json` checks access without configuring infrastructure or certifying production.
 4. Implement screens, APIs, persistence, authorization and integration behavior. Replace placeholders with working flows. Configure real secrets, origins and reviewed migrations using provider tools; starters do not establish setup completion. Keep credentials out of source, logs and handoffs.
 
 ## Source and release authority

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anhedral",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Build and deliver applications with Cloudflare-first Vinext, selected services, optional Next.js on Vercel, and verified release evidence.",
   "type": "module",
   "exports": {

package/dist/registry/remote.d.ts

@@ -1,25 +0,0 @@
-export interface SourceItem {
-    name: string;
-    version: string;
-    registryDependencies: string[];
-    files: {
-        target: string;
-        content: string;
-    }[];
-}
-export interface SourceRegistry {
-    schemaVersion: 1;
-    name: string;
-    items: SourceItem[];
-}
-export interface RemoteRegistry {
-    source: string;
-    integrity: string;
-    registry: SourceRegistry;
-}
-/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
-export declare function validateSourceRegistry(value: unknown): SourceRegistry;
-export declare function loadSourceRegistry(source: string, fetcher?: typeof fetch): Promise<RemoteRegistry>;
-export declare function resolveSourceItems(registry: SourceRegistry, selected: readonly string[]): SourceItem[];
-/** Compile repository-relative source paths into a distributable JSON payload. */
-export declare function buildSourceRegistry(manifestFile: string): SourceRegistry;

package/dist/registry/remote.js

@@ -1,168 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readBoundedFile } from '../bounded-file.js';
-import path from 'node:path';
-import { dependencyOrder } from '../dependency-order.js';
-import { assertSafeTarget } from './receipt.js';
-const identifier = /^[a-z][a-z0-9-]{0,62}$/;
-const limit = 2 * 1024 * 1024;
-/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
-export function validateSourceRegistry(value) {
-    if (!value || typeof value !== 'object')
-        throw new Error('Invalid source registry.');
-    const registry = value;
-    if (registry.schemaVersion !== 1 ||
-        typeof registry.name !== 'string' ||
-        !identifier.test(registry.name) ||
-        !Array.isArray(registry.items) ||
-        !registry.items.length ||
-        registry.items.length > 100)
-        throw new Error('Unsupported source registry schema.');
-    const names = new Set();
-    const files = new Set();
-    for (const item of registry.items) {
-        if (!item ||
-            typeof item.name !== 'string' ||
-            !identifier.test(item.name) ||
-            names.has(item.name) ||
-            typeof item.version !== 'string' ||
-            !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(item.version) ||
-            !Array.isArray(item.registryDependencies) ||
-            !item.registryDependencies.every((id) => typeof id === 'string' && identifier.test(id)) ||
-            !Array.isArray(item.files) ||
-            !item.files.length)
-            throw new Error('Invalid or duplicate source registry item.');
-        names.add(item.name);
-        for (const file of item.files) {
-            if (!file || typeof file.target !== 'string' || typeof file.content !== 'string')
-                throw new Error('Invalid registry file.');
-            assertSafeTarget('/registry-validation', file.target);
-            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.target) ||
-                file.target
-                    .split('/')
-                    .some((part) => part.startsWith('.') ||
-                    ['node_modules', 'dist', 'release', 'anhedral.registry.json'].includes(part)) ||
-                files.has(file.target))
-                throw new Error(`Unsafe or duplicate source target: ${file.target}.`);
-            files.add(file.target);
-            if (path.basename(file.target) === 'package.json') {
-                const manifest = JSON.parse(file.content);
-                if (!manifest ||
-                    typeof manifest !== 'object' ||
-                    Array.isArray(manifest) ||
-                    manifest.private !== true ||
-                    typeof manifest.name !== 'string' ||
-                    !/^@workspace\/[a-z][a-z0-9-]*$/.test(manifest.name))
-                    throw new Error('Remote workspace manifests must be private @workspace packages.');
-                if (manifest.scripts &&
-                    Object.keys(manifest.scripts).some((key) => /^(?:preinstall|install|postinstall|preprepare|prepare|postprepare|prepublish|prepublishOnly|pnpm:devPreinstall)$/.test(key)))
-                    throw new Error('Remote installation hooks are unsupported.');
-                for (const field of [
-                    'dependencies',
-                    'devDependencies',
-                    'optionalDependencies',
-                    'peerDependencies',
-                ]) {
-                    if (manifest[field] &&
-                        (typeof manifest[field] !== 'object' ||
-                            Array.isArray(manifest[field]) ||
-                            Object.values(manifest[field]).some((version) => typeof version !== 'string' ||
-                                !/^(?:workspace:[*^~]|[~^]?\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?)$/.test(version))))
-                        throw new Error('Remote dependencies require versioned npm or workspace references.');
-                }
-            }
-        }
-    }
-    dependencyOrder(new Map(registry.items.map((item) => [item.name, item.registryDependencies])), 'Remote registry');
-    return structuredClone(registry);
-}
-export async function loadSourceRegistry(source, fetcher = fetch) {
-    let bytes;
-    if (/^https?:/.test(source)) {
-        const url = new URL(source);
-        if (url.protocol !== 'https:' ||
-            url.username ||
-            url.password ||
-            url.hash ||
-            url.search ||
-            !/^[a-z0-9.-]+$/i.test(url.hostname) ||
-            url.hostname === 'localhost' ||
-            !url.hostname.includes('.') ||
-            /^\d+(?:\.\d+){3}$/.test(url.hostname))
-            throw new Error('Remote registries require a public HTTPS URL without credentials or query parameters.');
-        const response = await fetcher(url, { redirect: 'error', signal: AbortSignal.timeout(15_000) });
-        if (!response.ok || !response.body)
-            throw new Error('Cannot retrieve source registry.');
-        const reader = response.body.getReader();
-        const chunks = [];
-        let size = 0;
-        try {
-            while (true) {
-                const result = await reader.read();
-                if (result.done)
-                    break;
-                size += result.value.byteLength;
-                if (size > limit)
-                    throw new Error('Source registry exceeds 2 MiB.');
-                chunks.push(result.value);
-            }
-        }
-        finally {
-            await reader.cancel();
-        }
-        bytes = Buffer.concat(chunks);
-        source = url.href;
-    }
-    else {
-        source = path.resolve(source);
-        bytes = readBoundedFile(source, limit);
-    }
-    if (bytes.length > limit)
-        throw new Error('Source registry exceeds 2 MiB.');
-    return {
-        source,
-        integrity: `sha256-${createHash('sha256').update(bytes).digest('base64')}`,
-        registry: validateSourceRegistry(JSON.parse(bytes.toString('utf8'))),
-    };
-}
-export function resolveSourceItems(registry, selected) {
-    const catalog = new Map(registry.items.map((item) => [item.name, item]));
-    const graph = new Map();
-    const collect = (name) => {
-        if (graph.has(name))
-            return;
-        const item = catalog.get(name);
-        if (!item)
-            throw new Error(`Unknown remote registry item: ${name}.`);
-        graph.set(name, item.registryDependencies);
-        item.registryDependencies.forEach(collect);
-    };
-    selected.forEach(collect);
-    return dependencyOrder(graph, 'Remote registry').map((name) => catalog.get(name));
-}
-/** Compile repository-relative source paths into a distributable JSON payload. */
-export function buildSourceRegistry(manifestFile) {
-    const root = path.dirname(path.resolve(manifestFile));
-    const registry = JSON.parse(readBoundedFile(manifestFile, limit).toString('utf8'));
-    if (!Array.isArray(registry.items))
-        throw new Error('Invalid source registry manifest.');
-    for (const item of registry.items) {
-        if (!Array.isArray(item.files))
-            throw new Error('Invalid registry file list.');
-        for (const file of item.files) {
-            if (file.path === undefined)
-                continue;
-            if (typeof file.path !== 'string' || file.content !== undefined)
-                throw new Error('Declare one source path or embedded content.');
-            assertSafeTarget(root, file.path);
-            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.path) ||
-                file.path.split('/').some((part) => part.startsWith('.') || part === 'node_modules'))
-                throw new Error('Registry source paths must stay in application or package source.');
-            const source = path.join(root, file.path);
-            file.content = readBoundedFile(source, limit).toString('utf8');
-            delete file.path;
-        }
-    }
-    if (Buffer.byteLength(JSON.stringify(registry)) > limit)
-        throw new Error('Source registry exceeds 2 MiB.');
-    return validateSourceRegistry(registry);
-}