anhedral 0.9.0 → 0.10.1

package/README.md

@@ -25,7 +25,7 @@ Starter prompt:
 
 Codex asks about the app, explains the stack, implements the product, configures selected services, and delivers into your authorized accounts. The CLI commands below are also available independently.
 
-Use Node.js 22.13+ and pnpm 10.34.5 for generated workspaces. Generate on Linux, macOS, or WSL.
+Use Node.js 22.13+ on the 22.x line or Node.js 24+, with pnpm 10.34.5, for generated workspaces. Generate on Linux, macOS, or WSL.
 
 ```sh
 # Inspect a plan first: no project files or cloud resources are created
@@ -51,24 +51,20 @@ Anhedral Init is free and open source. Sponsorship helps fund ongoing developmen
 
 ## Choose your stack
 
-The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time.
+The bundled stack registry drives composition of every supported stack part. Run `anhedral registry list` or `anhedral registry view better-auth --json` to inspect items, destinations, dependencies and selection constraints. `new --dry-run --json` includes the resolved dependency graph. Scaffolding installs recipes in dependency order into `apps/*` and `packages/*`, validates local workspace references and cycles, and writes `anhedral.registry.json` with recipe versions and the resulting workspace graph. The same catalog is bundled with the plugin at build time. Generated `docs/stack.md` lists the current resolved options, targets, environment names, required setup and verification; additions refresh it without rewriting the application README.
 
-Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports bundled items and versioned source registries from local files or HTTPS. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
+Registry items are trusted recipes shipped in the CLI release: foundations, apps, services, shared packages and runtime integrations. They follow shadcn's source ownership and dependency composition practices; this catalog is an Anhedral schema, not a shadcn registry payload. Runtime-aware recipes coordinate bindings, manifests and auth routes across workspaces. Each registry entry owns its recipe, provider requirements, environment variables, bindings and composition rules. Resolved plans name the exact generated destinations, including runtime-dependent packages. Recipe versions follow the CLI release. The official shadcn bootstrap is pinned to 4.21.4; commit the generated source and lockfile to preserve the application artifact. Incremental `add` supports only the bundled catalog maintained and tested by Anhedral. External registries and customer-authored registry payloads are unsupported. Additions refuse to overwrite edited or untracked source; runtime relocation requires a deliberate migration.
 
 Use additions after initialization:
 
 ```sh
 anhedral add my-app resend stripe --dry-run --json
 anhedral add my-app resend stripe
-anhedral registry list --registry https://example.com/registry.json --json
-anhedral add my-app feature --registry https://example.com/registry.json --dry-run --json
+anhedral registry list --json
+anhedral registry view resend --json
 ```
 
-Review the dry-run file list and conflicts, then run the same addition without `--dry-run`. For external registries, pass the returned SHA-256 value with `--integrity` to require the reviewed payload. `--skip-install` still resolves the lockfile. Addition installs disable dependency lifecycle scripts; enable only reviewed native build scripts separately when required. Projects must have matching CLI versions and scaffold fingerprints; older projects need a deliberate migration. Existing provider identities stay intact, and no provider resources are created.
-
-Author registries with `anhedral registry build registry.source.json --output registry.json`: each file can declare a repository-relative `path` instead of embedded `content`. Build validates and embeds source before producing the distributable payload.
-
-External registries use Anhedral's declarative source schema: `schemaVersion: 1`, a registry `name`, and `items`. Each item declares `name`, semver `version`, `registryDependencies` (item names in the same registry), and `files` containing explicit `target` and UTF-8 `content`. Targets are confined to `apps/<name>/` and `packages/<name>/`; manifests must be private `@workspace` packages with versioned npm/workspace dependencies and no install hooks. Registries are limited to 2 MiB and 100 items. The receipt records the source, SHA-256 integrity, item versions, targets and generated-file hashes. This schema does not accept executable recipes or shadcn payloads. Review registry source as application code before using it.
+Review the dry-run file list and conflicts, then run the same addition without `--dry-run`. A preview that needs a new web foundation reports `bootstrapRequired: true` and `filesChecked: false`; it describes the selection and targets without running the upstream generator or checking generated-file conflicts. The actual addition checks conflicts in an isolated transaction before committing files. `--skip-install` still resolves the lockfile; run `pnpm install --frozen-lockfile` afterward to prepare dependencies. Final installs run the bundled workspace's dependency preparation hooks, including WXT and Electron setup. Projects must have matching CLI versions and scaffold fingerprints; older projects and receipts containing external items need a deliberate migration. Existing provider identities stay intact, and no provider resources are created.
 
 Application recipes start from the official **shadcn pnpm/Turborepo monorepo**. The default creates **Vinext + React + TypeScript + Tailwind + shadcn/ui + Lucide**, targeting **Cloudflare Workers**. Select additional apps and services only when needed.
 

package/assets/security/audit-deps.mjs

@@ -115,11 +115,16 @@ function validateAdvisory(advisory) {
   ensure(Array.isArray(advisory.findings), 'Malformed pnpm advisory');
   ensure(advisory.findings.length > 0, 'Malformed pnpm advisory');
   advisory.findings.forEach(validateFinding);
+  const versions = advisory.findings.map((finding) => finding.version);
+  ensure(new Set(versions).size === versions.length, 'Duplicate pnpm advisory versions');
 }
 
 function validateCount(advisories, severity, count) {
   ensure(Number.isInteger(count) && count >= 0, 'Malformed pnpm vulnerability counts');
-  const details = advisories.filter((advisory) => advisory.severity === severity).length;
+  // The pnpm 10 registry endpoint counts affected versions, not unique advisory IDs.
+  const details = advisories
+    .filter((advisory) => advisory.severity === severity)
+    .reduce((total, advisory) => total + advisory.findings.length, 0);
   ensure(count === details, `Missing ${severity} advisory details: count ${count}, details ${details}`);
 }
 

package/dist/bin.js

@@ -110,7 +110,7 @@ async function main() {
         return;
     }
     if (command !== 'new' && command !== 'init') {
-        throw new Error(`Unknown command: ${command}. Use new, init, registry, doctor, repository, cloud, register, connect, provision, ship, status, manage, verify, rollback, adopt, recover, --help, or --version.`);
+        throw new Error(`Unknown command: ${command}. Use new, init, add, registry, doctor, repository, cloud, register, connect, provision, ship, status, manage, verify, rollback, adopt, recover, --help, or --version.`);
     }
     if (args.some((arg) => ['--help', '-h'].includes(arg))) {
         console.log(json ? JSON.stringify({ usage: STANDARD_USAGE }) : STANDARD_USAGE);
@@ -401,7 +401,11 @@ catch (error) {
                     ? 'INVALID_ARGUMENT'
                     : command === 'new' || command === 'init'
                         ? 'GENERATION_FAILED'
-                        : 'UNKNOWN_COMMAND';
+                        : command === 'add'
+                            ? 'ADDITION_FAILED'
+                            : command === 'registry'
+                                ? 'REGISTRY_FAILED'
+                                : 'UNKNOWN_COMMAND';
     console.error(json ? JSON.stringify({ error: message, code }) : `Error: ${message}`);
     process.exitCode = 1;
 }

package/dist/bounded-file.d.ts

@@ -1,2 +1,3 @@
+export declare const MAX_PROJECT_JSON_BYTES: number;
 /** Reject devices, links and oversized or growing files before parsing local input. */
 export declare function readBoundedFile(filePath: string, maximumBytes: number): Buffer;

package/dist/bounded-file.js

@@ -1,4 +1,5 @@
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from 'node:fs';
+export const MAX_PROJECT_JSON_BYTES = 2 * 1024 * 1024;
 /** Reject devices, links and oversized or growing files before parsing local input. */
 export function readBoundedFile(filePath, maximumBytes) {
     const stat = lstatSync(filePath);

package/dist/capabilities.d.ts

@@ -6,7 +6,7 @@ export declare const CAPABILITIES: Record<StandardProduct, Capability>;
 export declare const CAPABILITY_REGISTRY: {
     schemaVersion: number;
     cliVersion: string;
-    capabilities: Record<"realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", Capability>;
+    capabilities: Record<"realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog", Capability>;
 };
 export declare function createSetupPlan(options: StandardOptions, registry?: import("./registry/resolve.js").ResolvedStackRegistry): {
     schemaVersion: number;
@@ -15,10 +15,10 @@ export declare function createSetupPlan(options: StandardOptions, registry?: imp
     standard: string;
     root: string;
     name: string;
-    products: ("realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+    products: ("realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog")[];
     hosting: import("./registry/types.js").Hosting;
     registry: import("./registry/resolve.js").ResolvedStackRegistry;
-    bootstrap: ("pnpm" | "shadcn@4.21.4" | "dlx" | "init" | "--monorepo" | "--template" | "next")[];
+    bootstrap: ("pnpm" | "next" | "shadcn@4.21.4" | "dlx" | "init" | "--monorepo" | "--template")[];
     dryRun: boolean;
     setup: {
         tools: string[];
@@ -32,7 +32,7 @@ export declare function createSetupPlan(options: StandardOptions, registry?: imp
             credentials: readonly string[];
             resources: readonly string[];
             verify: readonly string[];
-            id: "realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling";
+            id: "realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog";
         }[];
         completion: string[];
         resourcesProvisioned: boolean;

package/dist/capabilities.js

@@ -61,7 +61,7 @@ export function createSetupPlan(options, registry = resolveStackRegistry(options
             tools: [
                 ...new Set([
                     'Git',
-                    'Node.js 22.13+ for generated workspaces',
+                    'Node.js 22.13+ on 22.x, or Node.js 24+ for generated workspaces',
                     PACKAGE_MANAGER.replace('@', ' '),
                     'GitHub integration or gh',
                     'Fallow',

package/dist/dependencies.d.ts

@@ -2,14 +2,21 @@ export interface DependencyGroup {
     dependencies?: Record<string, string>;
     devDependencies?: Record<string, string>;
 }
+export declare const NATIVE_ESLINT_VERSION = "10.0.3";
 export declare const DESKTOP_DEPENDENCIES: DependencyGroup;
 export declare const EXTENSION_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_APP_DEPENDENCIES: DependencyGroup;
 export declare const MOBILE_NATIVEWIND_DEPENDENCIES: DependencyGroup;
+export declare const WORKSPACE_NODE_ENGINE = "^22.13.0 || >=24.0.0";
 export declare const PACKAGE_MANAGER = "pnpm@10.34.5";
 export declare const EAS_CLI_VERSION = "21.0.1";
 export declare const SHADCN_VERSION = "4.21.4";
+export declare const NEXT_VERCEL_VERSION = "16.4.0";
+export declare const NEXT_OPENNEXT_VERSION = "16.3.8";
 export declare const STACK_DEPENDENCIES: {
+    readonly 'better-auth': "1.7.7";
+    readonly '@better-auth/drizzle-adapter': "1.7.7";
+    readonly '@neondatabase/serverless': "1.2.0";
     readonly 'drizzle-orm': "0.45.4";
     readonly '@clerk/nextjs': "7.9.14";
     readonly '@clerk/backend': "3.23.2";
@@ -30,3 +37,28 @@ export declare const STACK_DEPENDENCIES: {
     readonly stripe: "20.4.1";
     readonly 'posthog-node': "5.55.2";
 };
+/** Vinext's RSC/React versions form a separately verified compatibility group. */
+export declare const VINEXT_DEPENDENCIES: DependencyGroup;
+/** Separate HTTP and inspector ports let all selected Workers run together. */
+export declare const WORKER_DEV_PORTS: {
+    readonly api: {
+        readonly http: 8787;
+        readonly inspector: 9231;
+    };
+    readonly realtime: {
+        readonly http: 8788;
+        readonly inspector: 9232;
+    };
+    readonly jobs: {
+        readonly http: 8789;
+        readonly inspector: 9233;
+    };
+    readonly scheduled: {
+        readonly http: 8790;
+        readonly inspector: 9234;
+    };
+    readonly workflows: {
+        readonly http: 8791;
+        readonly inspector: 9235;
+    };
+};

package/dist/dependencies.js

@@ -1,3 +1,5 @@
+// renovate: datasource=npm depName=eslint
+export const NATIVE_ESLINT_VERSION = '10.0.3';
 export const DESKTOP_DEPENDENCIES = {
     dependencies: {
         // renovate: datasource=npm depName=react
@@ -24,7 +26,7 @@ export const DESKTOP_DEPENDENCIES = {
         electron: '43.7.8',
         // renovate: datasource=npm depName=electron-builder
         'electron-builder': '26.15.3',
-        eslint: '10.0.3',
+        eslint: NATIVE_ESLINT_VERSION,
         // renovate: datasource=npm depName=tailwindcss
         tailwindcss: '4.1.18',
         // renovate: datasource=npm depName=postcss
@@ -129,12 +131,23 @@ export const MOBILE_NATIVEWIND_DEPENDENCIES = {
         tailwindcss: '3.4.19',
     },
 };
+export const WORKSPACE_NODE_ENGINE = '^22.13.0 || >=24.0.0';
 export const PACKAGE_MANAGER = 'pnpm@10.34.5';
 // renovate: datasource=npm depName=eas-cli
 export const EAS_CLI_VERSION = '21.0.1';
 // renovate: datasource=npm depName=shadcn
 export const SHADCN_VERSION = '4.21.4';
+// renovate: datasource=npm depName=next
+export const NEXT_VERCEL_VERSION = '16.4.0';
+// renovate: datasource=npm depName=next
+export const NEXT_OPENNEXT_VERSION = '16.3.8';
 export const STACK_DEPENDENCIES = {
+    // renovate: datasource=npm depName=better-auth
+    'better-auth': '1.7.7',
+    // renovate: datasource=npm depName=@better-auth/drizzle-adapter
+    '@better-auth/drizzle-adapter': '1.7.7',
+    // renovate: datasource=npm depName=@neondatabase/serverless
+    '@neondatabase/serverless': '1.2.0',
     // renovate: datasource=npm depName=drizzle-orm
     'drizzle-orm': '0.45.4',
     // renovate: datasource=npm depName=@clerk/nextjs
@@ -174,3 +187,36 @@ export const STACK_DEPENDENCIES = {
     // renovate: datasource=npm depName=posthog-node
     'posthog-node': '5.55.2',
 };
+/** Vinext's RSC/React versions form a separately verified compatibility group. */
+export const VINEXT_DEPENDENCIES = {
+    dependencies: {
+        // renovate: datasource=npm depName=vinext
+        vinext: '1.1.0',
+        next: NEXT_VERCEL_VERSION,
+        // renovate: datasource=npm depName=react
+        react: '19.2.8',
+        // renovate: datasource=npm depName=react-dom
+        'react-dom': '19.2.8',
+        // renovate: datasource=npm depName=react-server-dom-webpack
+        'react-server-dom-webpack': '19.2.8',
+    },
+    devDependencies: {
+        // renovate: datasource=npm depName=vite
+        vite: '8.3.4',
+        // renovate: datasource=npm depName=@cloudflare/vite-plugin
+        '@cloudflare/vite-plugin': '1.63.1',
+        // renovate: datasource=npm depName=@vitejs/plugin-rsc
+        '@vitejs/plugin-rsc': '0.5.36',
+        // renovate: datasource=npm depName=@vitejs/plugin-react
+        '@vitejs/plugin-react': '6.1.2',
+        wrangler: STACK_DEPENDENCIES.wrangler,
+    },
+};
+/** Separate HTTP and inspector ports let all selected Workers run together. */
+export const WORKER_DEV_PORTS = {
+    api: { http: 8787, inspector: 9231 },
+    realtime: { http: 8788, inspector: 9232 },
+    jobs: { http: 8789, inspector: 9233 },
+    scheduled: { http: 8790, inspector: 9234 },
+    workflows: { http: 8791, inspector: 9235 },
+};

package/dist/index.d.ts

@@ -18,6 +18,4 @@ export { inspectWorkspaceGraph } from './workspace-graph.js';
 export { resolveStackRegistry } from './registry/resolve.js';
 export type { ResolvedStackRegistry } from './registry/resolve.js';
 export { addStackItems } from './registry/add.js';
-export { buildSourceRegistry, loadSourceRegistry, validateSourceRegistry, resolveSourceItems, } from './registry/remote.js';
-export type { SourceRegistry, SourceItem, RemoteRegistry } from './registry/remote.js';
 export type { AddRequest } from './registry/add.js';

package/dist/index.js

@@ -12,4 +12,3 @@ export { STACK_REGISTRY, STACK_ITEMS, getStackItem } from './stack-registry.js';
 export { inspectWorkspaceGraph } from './workspace-graph.js';
 export { resolveStackRegistry } from './registry/resolve.js';
 export { addStackItems } from './registry/add.js';
-export { buildSourceRegistry, loadSourceRegistry, validateSourceRegistry, resolveSourceItems, } from './registry/remote.js';

package/dist/platforms/desktop.js

@@ -107,9 +107,6 @@ export default defineConfig({
   build: {
     outDir: 'dist/renderer',
     emptyOutDir: true,
-    // Clerk is already loaded behind a dynamic import. Its optional account-management
-    // surface is intentionally a large async chunk and does not inflate initial rendering.
-    chunkSizeWarningLimit: 1600,
   },
 });
 `);
@@ -261,7 +258,7 @@ function isAllowedAppNavigation(value: string): boolean {
 }
 
 // Product-owned window options and navigation policy belong in this file.
-// Anhedral's managed main.ts imports this seam and wires lifecycle integrations around it.
+// main.ts imports this seam and manages application lifecycle.
 export function createAppWindow(): BrowserWindow {
   const window = new BrowserWindow({
     width: 1180,
@@ -306,11 +303,13 @@ export function createAppWindow(): BrowserWindow {
     writeFile(path.join(dir, 'src/main/main.ts'), `import { app, BrowserWindow, session } from 'electron';
 import { createAppWindow } from './app-window.js';
 
-
 app.whenReady().then(() => {
   session.defaultSession.setPermissionCheckHandler(() => false);
   session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false));
   createAppWindow();
+}).catch((error) => {
+  console.error('Unable to start the desktop app:', error);
+  app.quit();
 });
 app.on('window-all-closed', () => {
   if (process.platform !== 'darwin') app.quit();

package/dist/platforms/extension.js

@@ -1,3 +1,4 @@
+import { NATIVE_ESLINT_VERSION } from '../dependencies.js';
 import path from 'node:path';
 import { writeReactLintConfig } from './lint.js';
 import { writeFile } from '../util.js';
@@ -41,11 +42,14 @@ function writePackageJson(dir, projectName) {
             typecheck: 'tsc --noEmit',
             lint: 'eslint src --max-warnings 0',
         },
-        dependencies: EXTENSION_DEPENDENCIES.dependencies,
+        dependencies: {
+            ...EXTENSION_DEPENDENCIES.dependencies,
+            '@workspace/styling': 'workspace:*',
+        },
         devDependencies: {
             ...EXTENSION_DEPENDENCIES.devDependencies,
             '@workspace/eslint-config': 'workspace:*',
-            eslint: '10.0.3',
+            eslint: NATIVE_ESLINT_VERSION,
         },
     }, null, 2) + '\n');
 }
@@ -55,13 +59,12 @@ function writeWxtConfig(dir, displayName) {
     const actionTitleLiteral = jsString(`Open ${displayName}`);
     writeFile(path.join(dir, 'wxt.config.ts'), `import { defineConfig } from 'wxt';
 
-
 export default defineConfig({
   srcDir: 'src',
+  dev: { server: { port: 3001, strictPort: true } },
   manifest: () => {
     const crxPublicKey = import.meta.env.VITE_CRX_PUBLIC_KEY || '';
 
-
     return {
       name: ${nameLiteral},
       description: ${descriptionLiteral},
@@ -176,51 +179,7 @@ function writeTailwindConfig(dir) {
     writeFile(path.join(dir, 'tailwind.config.cjs'), `/** @type {import('tailwindcss').Config} */
 module.exports = {
   content: ['./src/**/*.{ts,tsx,html}'],
-  theme: {
-    extend: {
-      colors: {
-        border: 'hsl(var(--border))',
-        input: 'hsl(var(--input))',
-        ring: 'hsl(var(--ring))',
-        background: 'hsl(var(--background))',
-        foreground: 'hsl(var(--foreground))',
-        primary: {
-          DEFAULT: 'hsl(var(--primary))',
-          foreground: 'hsl(var(--primary-foreground))',
-        },
-        secondary: {
-          DEFAULT: 'hsl(var(--secondary))',
-          foreground: 'hsl(var(--secondary-foreground))',
-        },
-        destructive: {
-          DEFAULT: 'hsl(var(--destructive))',
-          foreground: 'hsl(var(--destructive-foreground))',
-        },
-        muted: {
-          DEFAULT: 'hsl(var(--muted))',
-          foreground: 'hsl(var(--muted-foreground))',
-        },
-        accent: {
-          DEFAULT: 'hsl(var(--accent))',
-          foreground: 'hsl(var(--accent-foreground))',
-        },
-        popover: {
-          DEFAULT: 'hsl(var(--popover))',
-          foreground: 'hsl(var(--popover-foreground))',
-        },
-        card: {
-          DEFAULT: 'hsl(var(--card))',
-          foreground: 'hsl(var(--card-foreground))',
-        },
-      },
-      borderRadius: {
-        lg: 'var(--radius)',
-        md: 'calc(var(--radius) - 2px)',
-        sm: 'calc(var(--radius) - 4px)',
-      },
-    },
-  },
-  plugins: [],
+  presets: [require('@workspace/styling/tailwind')],
 };
 `);
 }
@@ -259,7 +218,7 @@ export default defineBackground(() => {
   // Open the side panel when the extension icon is clicked.
   (chrome as ChromeWithSidePanel).sidePanel
     .setPanelBehavior({ openPanelOnActionClick: true })
-    .catch(() => {});
+    .catch((error) => console.error('Unable to configure the side panel:', error));
 });
 `);
 }
@@ -328,7 +287,6 @@ export function SidePanelApp() {
     }
   }, []);
 
-
   return (
     <div style={{ padding: 24 }}>
       <h2>Welcome!</h2>
@@ -351,28 +309,6 @@ function writeStyles(dir) {
 @tailwind utilities;
 
 @layer base {
-  :root {
-    --background: 0 0% 100%;
-    --foreground: 0 0% 9%;
-    --card: 0 0% 100%;
-    --card-foreground: 0 0% 9%;
-    --popover: 0 0% 100%;
-    --popover-foreground: 0 0% 9%;
-    --primary: 0 0% 9%;
-    --primary-foreground: 0 0% 98%;
-    --secondary: 0 0% 96.1%;
-    --secondary-foreground: 0 0% 9%;
-    --muted: 0 0% 96.1%;
-    --muted-foreground: 0 0% 45.1%;
-    --accent: 0 0% 96.1%;
-    --accent-foreground: 0 0% 9%;
-    --destructive: 0 84.2% 60.2%;
-    --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 89.8%;
-    --input: 0 0% 89.8%;
-    --ring: 0 0% 63.9%;
-    --radius: 0.5rem;
-  }
 
   * {
     border-color: hsl(var(--border));

package/dist/platforms/mobile.js

@@ -1,3 +1,4 @@
+import { NATIVE_ESLINT_VERSION } from '../dependencies.js';
 import path from 'node:path';
 import { writeReactLintConfig } from './lint.js';
 import { appendGitignore, writeFile } from '../util.js';
@@ -62,26 +63,9 @@ module.exports = withNativeWind(config, { input: './global.css', inlineRem: 16 }
 
 /** @type {import('tailwindcss').Config} */
 module.exports = {
-  darkMode: 'class',
   content: ['./app/**/*.{ts,tsx}', './components/**/*.{ts,tsx}'],
-  presets: [require('nativewind/preset')],
-  theme: {
-    extend: {
-      colors: {
-        border: 'hsl(var(--border))', input: 'hsl(var(--input))', ring: 'hsl(var(--ring))',
-        background: 'hsl(var(--background))', foreground: 'hsl(var(--foreground))',
-        primary: { DEFAULT: 'hsl(var(--primary))', foreground: 'hsl(var(--primary-foreground))' },
-        secondary: { DEFAULT: 'hsl(var(--secondary))', foreground: 'hsl(var(--secondary-foreground))' },
-        destructive: { DEFAULT: 'hsl(var(--destructive))', foreground: 'hsl(var(--destructive-foreground))' },
-        muted: { DEFAULT: 'hsl(var(--muted))', foreground: 'hsl(var(--muted-foreground))' },
-        accent: { DEFAULT: 'hsl(var(--accent))', foreground: 'hsl(var(--accent-foreground))' },
-        popover: { DEFAULT: 'hsl(var(--popover))', foreground: 'hsl(var(--popover-foreground))' },
-        card: { DEFAULT: 'hsl(var(--card))', foreground: 'hsl(var(--card-foreground))' },
-      },
-      borderRadius: { lg: 'var(--radius)', md: 'calc(var(--radius) - 2px)', sm: 'calc(var(--radius) - 4px)' },
-      borderWidth: { hairline: hairlineWidth() },
-    },
-  },
+  presets: [require('nativewind/preset'), require('@workspace/styling/tailwind')],
+  theme: { extend: { borderWidth: { hairline: hairlineWidth() } } },
   future: { hoverOnlyWhenSupported: true },
   plugins: [require('tailwindcss-animate')],
 };
@@ -89,31 +73,6 @@ module.exports = {
     writeFile(path.join(dir, 'global.css'), `@tailwind base;
 @tailwind components;
 @tailwind utilities;
-
-@layer base {
-  :root {
-    --background: 0 0% 100%; --foreground: 0 0% 3.9%;
-    --card: 0 0% 100%; --card-foreground: 0 0% 3.9%;
-    --popover: 0 0% 100%; --popover-foreground: 0 0% 3.9%;
-    --primary: 0 0% 9%; --primary-foreground: 0 0% 98%;
-    --secondary: 0 0% 96.1%; --secondary-foreground: 0 0% 9%;
-    --muted: 0 0% 96.1%; --muted-foreground: 0 0% 45.1%;
-    --accent: 0 0% 96.1%; --accent-foreground: 0 0% 9%;
-    --destructive: 0 84.2% 60.2%; --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 89.8%; --input: 0 0% 89.8%; --ring: 0 0% 63%; --radius: 0.625rem;
-  }
-  .dark:root {
-    --background: 0 0% 3.9%; --foreground: 0 0% 98%;
-    --card: 0 0% 3.9%; --card-foreground: 0 0% 98%;
-    --popover: 0 0% 3.9%; --popover-foreground: 0 0% 98%;
-    --primary: 0 0% 98%; --primary-foreground: 0 0% 9%;
-    --secondary: 0 0% 14.9%; --secondary-foreground: 0 0% 98%;
-    --muted: 0 0% 14.9%; --muted-foreground: 0 0% 63.9%;
-    --accent: 0 0% 14.9%; --accent-foreground: 0 0% 98%;
-    --destructive: 0 70.9% 59.4%; --destructive-foreground: 0 0% 98%;
-    --border: 0 0% 14.9%; --input: 0 0% 14.9%; --ring: 300 0% 45%;
-  }
-}
 `);
 }
 function expoScheme(projectName) {
@@ -160,11 +119,12 @@ export async function scaffoldExpo({ root, options }) {
         dependencies: {
             ...MOBILE_APP_DEPENDENCIES.dependencies,
             ...MOBILE_NATIVEWIND_DEPENDENCIES.dependencies,
+            '@workspace/styling': 'workspace:*',
         },
         devDependencies: {
             ...MOBILE_APP_DEPENDENCIES.devDependencies,
             '@workspace/eslint-config': 'workspace:*',
-            eslint: '10.0.3',
+            eslint: NATIVE_ESLINT_VERSION,
         },
     }, null, 2) + '\n');
     writeFile(path.join(dir, 'app.json'), JSON.stringify({
@@ -200,7 +160,6 @@ export async function scaffoldExpo({ root, options }) {
 import { PortalHost } from '@rn-primitives/portal';
 import { Stack } from 'expo-router';
 
-
 export default function RootLayout() {
   return <><Stack /><PortalHost /></>;
 }
@@ -215,7 +174,7 @@ export default function HomeScreen() {
       <StatusBar style="auto" />
       <View style={styles.content}>
         <Text accessibilityRole="header" style={styles.title}>{${nameLiteral}}</Text>
-        <Text selectable style={styles.subtitle}>Deterministic Expo application generated by Anhedral.</Text>
+        <Text selectable style={styles.subtitle}>Expo application scaffold generated by Anhedral.</Text>
         <Button onPress={() => void Linking.openURL('https://docs.expo.dev')}>Learn more</Button>
       </View>
     </ScrollView>

package/dist/readiness.js

@@ -1,5 +1,5 @@
-import { assertSafeTarget } from './registry/receipt.js';
-import { existsSync, readFileSync } from 'node:fs';
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from './bounded-file.js';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { inspectWorkspaceGraph } from './workspace-graph.js';
@@ -9,17 +9,22 @@ import { STANDARD_PRODUCTS } from './stack-registry.js';
 export function inspectProject(root) {
     const checks = [];
     const record = (id, ok, detail) => checks.push({ id, ok, detail });
-    const read = (file) => JSON.parse(readFileSync(path.join(root, file), 'utf8'));
+    const read = (file) => JSON.parse(readBoundedFile(path.join(root, file), MAX_PROJECT_JSON_BYTES).toString('utf8'));
     record('workspace', existsSync(path.join(root, 'pnpm-workspace.yaml')), 'pnpm workspace manifest');
     record('lockfile', existsSync(path.join(root, 'pnpm-lock.yaml')), 'Committed dependency resolution required');
     try {
         const plan = read('anhedral.setup.json');
+        const recordedVersion = plan?.cliVersion;
+        const compatible = recordedVersion === CAPABILITY_REGISTRY.cliVersion;
+        record('cli-compatibility', compatible, /^\d+\.\d+\.\d+$/.test(recordedVersion ?? '')
+            ? `Use anhedral@${recordedVersion} for this project or review upgrade differences`
+            : 'Use the recorded project CLI version or review upgrade differences');
         validateSetupPlan(plan);
         const standard = read('anhedral.standard.json');
         record('setup-plan', true, `Requirements recorded by CLI ${plan.cliVersion}`);
         try {
             const installed = read('anhedral.registry.json');
-            const { status, workspaces: _workspaces, files: _files, remoteItems, resourcesProvisioned, ...snapshot } = installed;
+            const { status, workspaces: _workspaces, files: _files, resourcesProvisioned, ...snapshot } = installed;
             if (status !== 'scaffolded' ||
                 resourcesProvisioned !== false ||
                 !isDeepStrictEqual(snapshot, plan.registry))
@@ -29,22 +34,6 @@ export function inspectProject(root) {
                     if (!existsSync(path.join(root, target)))
                         throw new Error(`Registry target missing: ${item.name}.`);
                 }
-            if (remoteItems !== undefined) {
-                if (!Array.isArray(remoteItems))
-                    throw new Error('Invalid remote registry receipt.');
-                for (const item of remoteItems) {
-                    if (!item ||
-                        typeof item.source !== 'string' ||
-                        typeof item.integrity !== 'string' ||
-                        !Array.isArray(item.targets))
-                        throw new Error('Invalid remote registry provenance.');
-                    for (const target of item.targets) {
-                        assertSafeTarget(root, target);
-                        if (!existsSync(path.join(root, target)))
-                            throw new Error('Missing remote registry target.');
-                    }
-                }
-            }
             record('stack-registry', true, 'Registry provenance and resolved targets match the setup plan');
         }
         catch {
@@ -57,7 +46,6 @@ export function inspectProject(root) {
         catch {
             record('workspace-graph', false, 'Invalid workspace manifests, references or dependency cycles');
         }
-        record('cli-compatibility', plan.cliVersion === CAPABILITY_REGISTRY.cliVersion, 'Use the project CLI version or review upgrade differences');
         record('selection', standard.schemaVersion === 1 &&
             JSON.stringify(standard.products) === JSON.stringify(plan.products) &&
             standard.hosting ===
@@ -85,6 +73,9 @@ export function validateSetupPlan(plan) {
         value.registryVersion !== 1 ||
         typeof value.cliVersion !== 'string')
         throw new Error('Unsupported setup plan version.');
+    if (/^\d+\.\d+\.\d+$/.test(value.cliVersion) &&
+        value.cliVersion !== CAPABILITY_REGISTRY.cliVersion)
+        throw new Error(`Use anhedral@${value.cliVersion} for this project or review upgrade differences.`);
     if (!Array.isArray(value.products) ||
         !value.products.length ||
         !value.products.every((id) => STANDARD_PRODUCTS.includes(id)))