anhedral 0.9.0 → 0.10.1

package/dist/registry/add.d.ts

@@ -1,22 +1,18 @@
 import type { StandardRunner } from './types.js';
 export interface AddRequest {
     items: string[];
-    registry?: string;
-    integrity?: string;
     dryRun?: boolean;
     skipInstall?: boolean;
 }
 /** Add recipes to an initialized workspace, refusing edits to customer-owned source. */
 export declare function addStackItems(root: string, request: AddRequest, run?: StandardRunner): Promise<{
-    files: string[];
-    conflicts: string[];
-    registry?: {
-        source: string;
-        integrity: string;
-    } | undefined;
     schemaVersion: number;
     root: string;
     dryRun: boolean;
     items: string[];
-    remoteItems: string[];
+    bootstrapRequired: boolean;
+    filesChecked: boolean;
+    targets: string[];
+    files: string[];
+    conflicts: string[];
 }>;

package/dist/registry/add.js

@@ -1,5 +1,6 @@
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from '../bounded-file.js';
 import { configureSecurityBackports } from '../security-backports.js';
-import { bootstrapWorkspace } from '../scaffold/bootstrap.js';
+import { bootstrapWorkspace, assertWorkspaceRuntime } from '../scaffold/bootstrap.js';
 import { registerApplication } from '../project-state.js';
 import { registerVercelApplication } from '../vercel.js';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
@@ -16,10 +17,14 @@ import { json, put, readJson } from '../scaffold/files.js';
 import { writeStandardRoot } from '../scaffold/workspace.js';
 import { createRecipeContext } from './context.js';
 import { resolveStackRegistry, resolveStandardProducts } from './resolve.js';
-import { sourceFiles, assertSafeTarget } from './receipt.js';
-import { loadSourceRegistry, resolveSourceItems } from './remote.js';
+import { sourceFiles } from './receipt.js';
 /** Add recipes to an initialized workspace, refusing edits to customer-owned source. */
 export async function addStackItems(root, request, run = execFile) {
+    for (const key of Object.keys(request))
+        if (!['items', 'dryRun', 'skipInstall'].includes(key))
+            throw new Error(`Unknown add option: ${key}. Only bundled registry items are supported.`);
+    if (!request.dryRun)
+        assertWorkspaceRuntime(run);
     root = realpathSync(root);
     if (!request.items.length)
         throw new Error('Select at least one registry item.');
@@ -34,17 +39,11 @@ export async function addStackItems(root, request, run = execFile) {
         throw new Error('This project has no scaffold fingerprints; migrate it deliberately before using add.');
     const baseline = receipt.files;
     const selected = new Set(plan.products);
-    let remote;
-    if (request.registry)
-        remote = await loadSourceRegistry(request.registry);
-    else
-        for (const id of request.items) {
-            if (!STANDARD_PRODUCTS.includes(id))
-                throw new Error(`Unknown stack product: ${id}.`);
-            selected.add(id);
-        }
-    if (request.integrity && (!remote || remote.integrity !== request.integrity))
-        throw new Error('Source registry integrity differs from the reviewed payload.');
+    for (const id of request.items) {
+        if (!STANDARD_PRODUCTS.includes(id))
+            throw new Error(`Unknown stack product: ${id}.`);
+        selected.add(id);
+    }
     resolveStandardProducts(selected, plan.hosting, false);
     const options = {
         root,
@@ -65,24 +64,8 @@ export async function addStackItems(root, request, run = execFile) {
         if (before && before.targets.some((target) => !item.targets.includes(target)))
             throw new Error(`Adding this selection relocates ${item.name}; migrate its existing source explicitly.`);
     }
-    const remoteItems = remote ? resolveSourceItems(remote.registry, request.items) : [];
-    if (remote) {
-        const previous = Array.isArray(receipt.remoteItems) ? receipt.remoteItems : [];
-        for (const item of remoteItems) {
-            const identity = `${remote.source}#${item.name}`;
-            const targets = item.files.map((file) => file.target);
-            for (const installed of previous) {
-                if (installed.identity === identity &&
-                    installed.targets.some((target) => !targets.includes(target)))
-                    throw new Error(`Remote update relocates ${item.name}; migrate its source explicitly.`);
-                if (installed.identity !== identity &&
-                    installed.targets.some((target) => targets.includes(target)))
-                    throw new Error(`Remote target is already owned by ${installed.name}.`);
-            }
-        }
-    }
     const before = sourceFiles(root);
-    const receiptText = readFileSync(path.join(root, 'anhedral.registry.json'), 'utf8');
+    const receiptText = readBoundedFile(path.join(root, 'anhedral.registry.json'), MAX_PROJECT_JSON_BYTES).toString('utf8');
     const commitPaths = [];
     const conflicts = [];
     const result = {
@@ -92,11 +75,19 @@ export async function addStackItems(root, request, run = execFile) {
         items: registry.items
             .filter((item) => !isDeepStrictEqual(oldItems.get(item.name), item))
             .map((item) => item.name),
-        remoteItems: remoteItems.map((item) => item.name),
-        ...(remote ? { registry: { source: remote.source, integrity: remote.integrity } } : {}),
+        bootstrapRequired: recipes.some((item) => ['vinext', 'next'].includes(item.name)) &&
+            !existsSync(path.join(root, 'apps/web/package.json')),
+        filesChecked: true,
+        targets: recipes.flatMap((item) => item.targets),
         files: commitPaths,
         conflicts,
     };
+    // The upstream web generator requires network access and executes package scripts.
+    // A preview reports the resolved selection without invoking that generator.
+    if (request.dryRun && result.bootstrapRequired) {
+        result.filesChecked = false;
+        return result;
+    }
     await runStagedTransaction(root, {
         dryRun: !!request.dryRun,
         commitPaths,
@@ -126,11 +117,6 @@ export async function addStackItems(root, request, run = execFile) {
                     }
                 put(stage, file, content);
             }
-            for (const item of remoteItems)
-                for (const file of item.files) {
-                    assertSafeTarget(stage, file.target);
-                    put(stage, file.target, file.content);
-                }
             writeStandardRoot(stage, options, registry, true);
             if (options.products.includes('next') && options.hosting === 'vercel')
                 registerVercelApplication(stage);
@@ -158,40 +144,22 @@ export async function addStackItems(root, request, run = execFile) {
                     conflicts.push(file);
             if (conflicts.length && !request.dryRun)
                 throw new Error(`Addition conflicts with edited or untracked source: ${conflicts.join(', ')}. No files were installed.`);
-            const remoteReceipts = Array.isArray(receipt.remoteItems) ? [...receipt.remoteItems] : [];
-            for (const item of remoteItems) {
-                const identity = `${remote.source}#${item.name}`;
-                const previous = remoteReceipts.findIndex((entry) => entry.identity === identity);
-                const entry = {
-                    identity,
-                    name: item.name,
-                    version: item.version,
-                    source: remote.source,
-                    integrity: remote.integrity,
-                    targets: item.files.map((file) => file.target),
-                };
-                if (previous >= 0)
-                    remoteReceipts[previous] = entry;
-                else
-                    remoteReceipts.push(entry);
-            }
             json(stage, 'anhedral.registry.json', {
                 ...registry,
                 status: 'scaffolded',
                 resourcesProvisioned: false,
                 workspaces: inspectWorkspaceGraph(stage),
                 files,
-                ...(remoteReceipts.length ? { remoteItems: remoteReceipts } : {}),
             });
             commitPaths.push('anhedral.registry.json');
             // Detect concurrent changes even to source that this addition would otherwise preserve.
             if (!isDeepStrictEqual(sourceFiles(root), before) ||
-                readFileSync(path.join(root, 'anhedral.registry.json'), 'utf8') !== receiptText)
+                readBoundedFile(path.join(root, 'anhedral.registry.json'), MAX_PROJECT_JSON_BYTES).toString('utf8') !== receiptText)
                 throw new Error('Workspace changed during addition; retry after reviewing source.');
         },
         afterCommit: () => {
             if (!request.skipInstall)
-                run('pnpm', ['install', '--frozen-lockfile', '--ignore-scripts'], root);
+                run('pnpm', ['install', '--frozen-lockfile'], root);
         },
     });
     return result;

package/dist/registry/commands.js

@@ -1,42 +1,7 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { addStackItems } from './add.js';
-import { buildSourceRegistry, loadSourceRegistry } from './remote.js';
 import { STACK_REGISTRY, getStackItem } from '../stack-registry.js';
 export async function runRegistry(args, json) {
-    if (args[0] === 'build') {
-        args = args.filter((arg) => arg !== '--json');
-        if (args.length !== 4 || args[2] !== '--output' || !args[1] || !args[3])
-            throw new Error('Use registry build <manifest> --output <registry.json>.');
-        const source = path.resolve(args[1]);
-        const output = path.resolve(args[3]);
-        if (source === output)
-            throw new Error('Registry output must differ from its authored manifest.');
-        const registry = buildSourceRegistry(source);
-        mkdirSync(path.dirname(output), { recursive: true });
-        writeFileSync(output, JSON.stringify(registry, null, 2) + '\n');
-        console.log(JSON.stringify({ output, items: registry.items.length }));
-        return;
-    }
-    const registryFlag = args.indexOf('--registry');
-    if (registryFlag >= 0) {
-        const source = args[registryFlag + 1];
-        if (!source || source.startsWith('-'))
-            throw new Error('Missing registry source.');
-        const positional = args.filter((arg, index) => index !== registryFlag && index !== registryFlag + 1 && arg !== '--json');
-        const registry = await loadSourceRegistry(source);
-        if (positional.length === 1 && positional[0] === 'list')
-            console.log(JSON.stringify(registry, null, 2));
-        else if (positional.length === 2 && positional[0] === 'view') {
-            const item = registry.registry.items.find((item) => item.name === positional[1]);
-            if (!item)
-                throw new Error('Unknown remote registry item.');
-            console.log(JSON.stringify({ source: registry.source, integrity: registry.integrity, item }, null, 2));
-        }
-        else
-            throw new Error('Use registry list|view [item] --registry <file|https-url>.');
-        return;
-    }
     const positional = args.filter((arg) => arg !== '--json');
     if (positional.includes('--help') || positional.includes('-h')) {
         console.log('anhedral registry list|view [item] [--json]');
@@ -61,38 +26,22 @@ export async function runRegistry(args, json) {
 }
 export async function runAdd(args) {
     if (args.includes('--help') || args.includes('-h')) {
-        console.log('anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]');
+        console.log('anhedral add <directory> <items...> [--dry-run] [--skip-install] [--json]');
         return;
     }
-    let source;
-    let integrity;
     const positional = [];
-    for (let index = 0; index < args.length; index++) {
-        const arg = args[index];
+    for (const arg of args) {
         if (['--dry-run', '--skip-install', '--json'].includes(arg))
             continue;
-        if (arg === '--integrity') {
-            if (integrity || !args[index + 1] || !/^sha256-[A-Za-z0-9+/]{43}=$/.test(args[index + 1]))
-                throw new Error('Specify one SHA-256 registry integrity.');
-            integrity = args[++index];
-        }
-        else if (arg === '--registry') {
-            if (source || !args[index + 1] || args[index + 1].startsWith('-'))
-                throw new Error('Specify one registry source.');
-            source = args[++index];
-        }
-        else if (arg.startsWith('-'))
-            throw new Error('Unknown add option.');
-        else
-            positional.push(arg);
+        if (arg.startsWith('-'))
+            throw new Error(`Unknown add option: ${arg}.`);
+        positional.push(arg);
     }
     const [directory, ...items] = positional;
     if (!directory || !items.length)
         throw new Error('Use add <directory> <items...>.');
     console.log(JSON.stringify(await addStackItems(path.resolve(directory), {
         items,
-        registry: source,
-        integrity,
         dryRun: args.includes('--dry-run'),
         skipInstall: args.includes('--skip-install'),
     }), null, 2));

package/dist/registry/receipt.d.ts

@@ -1,3 +1,2 @@
 export declare function sourceFiles(root: string): Map<string, string>;
 export declare function recordScaffoldFiles(root: string): void;
-export declare function assertSafeTarget(root: string, relative: string): void;

package/dist/registry/receipt.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { json, readJson } from '../scaffold/files.js';
 const excluded = new Set([
@@ -16,6 +16,7 @@ const excluded = new Set([
     '.expo',
     '.fallow',
     '.anhedral',
+    '.anhedral-audit-report.json',
     '.anhedral.lock',
     '.anhedral-txn',
     'anhedral.registry.json',
@@ -50,24 +51,3 @@ export function recordScaffoldFiles(root) {
         files: Object.fromEntries(sourceFiles(root)),
     });
 }
-export function assertSafeTarget(root, relative) {
-    if (!relative ||
-        path.isAbsolute(relative) ||
-        relative.includes('\\') ||
-        relative
-            .split('/')
-            .some((part) => !part ||
-            part === '.' ||
-            part === '..' ||
-            part.includes(':') ||
-            /[\x00-\x1f]/.test(part) ||
-            /[. ]$/.test(part) ||
-            /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(part)))
-        throw new Error(`Unsafe registry target: ${relative}.`);
-    let current = root;
-    for (const part of relative.split('/')) {
-        current = path.join(current, part);
-        if (existsSync(current) && lstatSync(current).isSymbolicLink())
-            throw new Error(`Registry target traverses a symlink: ${relative}.`);
-    }
-}

package/dist/registry/resolve.js

@@ -50,6 +50,23 @@ export function resolveStandardProducts(selected, hosting, hostingSpecified) {
         throw new Error('--hosting applies to the web application.');
     resolveStackRegistry({ products: [...selected], hosting });
 }
+function itemDependencies(name, context) {
+    const definition = getStackDefinition(name);
+    const dependencies = new Set(definition.registryDependencies);
+    if (definition.runtime) {
+        if (!hasServer(context) && definition.runtime !== 'optional-worker')
+            throw new Error(`${name} requires a server runtime.`);
+        if (needsWorker(name, context) &&
+            !context.has('hono') &&
+            !(context.options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
+            throw new Error(`${name} requires a Cloudflare runtime.`);
+        if (hasServer(context))
+            dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
+    }
+    for (const dependency of definition.resolveDependencies?.(context) ?? [])
+        dependencies.add(dependency);
+    return dependencies;
+}
 export function resolveStackRegistry(options) {
     const selected = new Set(options.products);
     validateProducts(selected, options.hosting);
@@ -62,20 +79,9 @@ export function resolveStackRegistry(options) {
             return;
         const definition = getStackDefinition(name);
         const metadata = getStackItem(name);
-        const dependencies = new Set(definition.registryDependencies);
-        if (definition.runtime) {
-            if (!hasServer(context) && definition.runtime !== 'optional-worker')
-                throw new Error(`${name} requires a server runtime.`);
-            if (needsWorker(name, context) &&
-                !context.has('hono') &&
-                !(options.hosting === 'cloudflare' && (context.has('vinext') || context.has('next'))))
-                throw new Error(`${name} requires a Cloudflare runtime.`);
-            if (hasServer(context))
-                dependencies.add(context.has('hono') ? 'hono' : context.has('vinext') ? 'vinext' : 'next');
-        }
-        for (const dependency of definition.resolveDependencies?.(context) ?? [])
-            dependencies.add(dependency);
+        const dependencies = itemDependencies(name, context);
         metadata.registryDependencies = [...dependencies];
+        metadata.environment = definition.resolveEnvironment?.(context) ?? metadata.environment;
         metadata.targets = definition.resolveTargets?.(context) ?? metadata.targets;
         if (definition.configure)
             metadata.bindings = definition.configure(context);

package/dist/registry/types.d.ts

@@ -57,6 +57,7 @@ export interface StackRegistryItem {
 export interface ItemDefinition extends Omit<StackRegistryItem, 'bindings'> {
     install?: Recipe;
     configure?: (context: RecipeContext) => Json;
+    resolveEnvironment?: (context: RecipeContext) => string[];
     resolveTargets?: (context: RecipeContext) => string[];
     resolvePackage?: (context: RecipeContext, recipe: PackageRecipe) => PackageRecipe;
     resolveDependencies?: (context: RecipeContext) => string[];

package/dist/registry/usage.js

@@ -2,7 +2,7 @@ import { STANDARD_PRODUCTS } from '../stack-registry.js';
 export const STANDARD_USAGE = `Anhedral Application Stack & Delivery Standard
 
 anhedral new <directory> [products...] [--hosting cloudflare|vercel] [--skip-install] [--no-git] [--dry-run] [--json]
-anhedral add <directory> <items...> [--registry <file|https-url>] [--integrity sha256-...] [--dry-run] [--skip-install] [--json]
+anhedral add <directory> <items...> [--dry-run] [--skip-install] [--json]
 anhedral init [products...] [--hosting cloudflare|vercel] [--skip-install] [--git] [--dry-run] [--json]
 
 Default: Vinext on Cloudflare Workers, from the official shadcn pnpm/Turborepo monorepo.
@@ -15,8 +15,7 @@ Examples:
   anhedral new website --next --stripe --resend
   anhedral init --wxt
   anhedral cloud register|stage|save|deploy|status [directory] (managed service API required)
-  anhedral registry build <manifest> --output <registry.json>
-  anhedral registry list|view [item] [--registry <file|https-url>] [--json]
+  anhedral registry list|view [item] [--json]
   anhedral doctor [directory] [--providers] --json
   anhedral repository [directory] [--owner <github-account>] [--name <repo>] [--visibility private|public] [--create]
   anhedral register [directory]

package/dist/render.d.ts

@@ -8,3 +8,5 @@ export declare function markdownHeading(value: string): string;
 export declare function packageNameFromText(value: string): string;
 export declare function childPackageName(projectName: string, suffix: string): string;
 export declare function identifierSegment(value: string): string;
+/** Keep provider resource names within the shared Workers/R2/Queues naming limits. */
+export declare function resourceName(projectName: string, suffix: string): string;

package/dist/render.js

@@ -72,3 +72,13 @@ export function identifierSegment(value) {
         .replace(/^-+|-+$/g, '');
     return segment || 'app';
 }
+/** Keep provider resource names within the shared Workers/R2/Queues naming limits. */
+export function resourceName(projectName, suffix) {
+    const segment = identifierSegment(projectName);
+    const qualifier = identifierSegment(suffix);
+    if (qualifier.length > 40)
+        throw new Error('Resource suffix is too long.');
+    const digest = createHash('sha256').update(projectName).digest('hex').slice(0, 8);
+    const base = segment === projectName ? segment : `${segment}-${digest}`;
+    return `${compactPackageSegment(base, 62 - qualifier.length)}-${qualifier}`;
+}

package/dist/scaffold/api.js

@@ -1,10 +1,27 @@
+import { resourceName, jsString } from '../render.js';
 import { STACK_DEPENDENCIES } from '../dependencies.js';
 import { workerConfig, worker } from './files.js';
 export function scaffoldApi({ root, options, bindings }) {
-    worker(root, 'api', { ...workerConfig(`${options.name}-api`), ...bindings }, `import { OpenAPIHono, createRoute, z } from '@hono/zod-openapi';
+    worker(root, 'api', { ...workerConfig(resourceName(options.name, 'api')), ...bindings }, `import { OpenAPIHono, createRoute, z } from '@hono/zod-openapi';
+
 const app = new OpenAPIHono<{ Bindings: Env }>();
-app.openapi(createRoute({ method: 'get', path: '/health', responses: { 200: { description: 'Healthy', content: { 'application/json': { schema: z.object({ ok: z.literal(true) }) } } } } }), (c) => c.json({ ok: true as const }, 200));
-app.doc('/openapi.json', { openapi: '3.0.0', info: { title: '${options.name}', version: '1.0.0' } });
+const health = createRoute({
+  method: 'get',
+  path: '/health',
+  responses: {
+    200: {
+      description: 'Healthy',
+      content: { 'application/json': { schema: z.object({ ok: z.literal(true) }) } },
+    },
+  },
+});
+
+app.openapi(health, (c) => c.json({ ok: true as const }, 200));
+app.doc('/openapi.json', {
+  openapi: '3.0.0',
+  info: { title: ${jsString(options.name)}, version: '1.0.0' },
+});
+
 export default app;
 `, {
         hono: STACK_DEPENDENCIES['hono'],

package/dist/scaffold/auth.js

@@ -1,3 +1,4 @@
+import { writeEnvironmentFile } from './environment.js';
 import { STACK_DEPENDENCIES } from '../dependencies.js';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
@@ -9,15 +10,20 @@ export function scaffoldBetterAuth({ root, options, runtimeApp, has }) {
 import { drizzleAdapter } from '@better-auth/drizzle-adapter';
 import type { createDatabase } from '@workspace/db';
 export function createAuth(db: ReturnType<typeof createDatabase>, secret: string, baseURL: string) {
-  return betterAuth({ database: drizzleAdapter(db, { provider: '${has('neon') ? 'pg' : 'sqlite'}', transaction: false }), secret, baseURL, emailAndPassword: { enabled: true } });
+  return betterAuth({
+    database: drizzleAdapter(db, { provider: '${has('neon') ? 'pg' : 'sqlite'}', transaction: false }),
+    secret,
+    baseURL,
+    emailAndPassword: { enabled: true },
+  });
 }
 `, {
-        'better-auth': '1.7.7',
-        '@better-auth/drizzle-adapter': '1.7.7',
+        'better-auth': STACK_DEPENDENCIES['better-auth'],
+        '@better-auth/drizzle-adapter': STACK_DEPENDENCIES['@better-auth/drizzle-adapter'],
         '@workspace/db': 'workspace:*',
     });
     patchPackage(root, `apps/${runtimeApp}/package.json`, {
-        dependencies: { '@workspace/auth': 'workspace:*' },
+        dependencies: { '@workspace/auth': 'workspace:*', '@workspace/db': 'workspace:*' },
     });
     const connection = has('neon') ? 'createDatabase(env.DATABASE_URL)' : 'createDatabase(env.DB)';
     if (has('hono')) {
@@ -27,7 +33,10 @@ export function createAuth(db: ReturnType<typeof createDatabase>, secret: string
         const config = readJson(root, 'apps/api/wrangler.jsonc');
         json(root, 'apps/api/wrangler.jsonc', {
             ...config,
-            vars: { BETTER_AUTH_URL: 'http://localhost:8787' },
+            vars: {
+                BETTER_AUTH_URL: 'http://localhost:8787',
+                ...(config.vars ?? {}),
+            },
         });
     }
     else {
@@ -48,14 +57,21 @@ export { handler as GET, handler as POST };
             const config = readJson(root, 'apps/web/wrangler.jsonc');
             json(root, 'apps/web/wrangler.jsonc', {
                 ...config,
-                vars: { BETTER_AUTH_URL: 'http://localhost:3000' },
+                vars: {
+                    BETTER_AUTH_URL: 'http://localhost:3000',
+                    ...(config.vars ?? {}),
+                },
             });
         }
         patchPackage(root, 'apps/web/package.json', {
             dependencies: { 'drizzle-orm': STACK_DEPENDENCIES['drizzle-orm'] },
         });
     }
-    put(root, `apps/${runtimeApp}/${runtimeApp === 'web' && options.hosting === 'vercel' ? '.env.example' : '.dev.vars.example'}`, `${has('neon') ? 'DATABASE_URL=\n' : ''}BETTER_AUTH_SECRET=\nBETTER_AUTH_URL=http://localhost:${runtimeApp === 'web' && (options.hosting === 'vercel' || has('vinext')) ? '3000' : '8787'}\n`);
+    writeEnvironmentFile(root, `apps/${runtimeApp}/${runtimeApp === 'web' && options.hosting === 'vercel' ? '.env.example' : '.dev.vars.example'}`, {
+        ...(has('neon') ? { DATABASE_URL: '' } : {}),
+        BETTER_AUTH_SECRET: '',
+        BETTER_AUTH_URL: `http://localhost:${runtimeApp === 'web' ? '3000' : '8787'}`,
+    });
     if (has('hono'))
         put(root, 'apps/api/src/secrets.d.ts', 'interface Env { BETTER_AUTH_SECRET: string }\n');
 }
@@ -74,22 +90,62 @@ export function scaffoldClerk({ root, has }) {
                 put(root, 'apps/web/app/layout.tsx', 'import { ClerkProvider } from "@clerk/nextjs";\n' + wrapped);
             }
         }
-        put(root, 'apps/web/app/sign-in/[[...sign-in]]/page.tsx', 'import { SignIn } from "@clerk/nextjs";\nexport default function SignInPage() { return <SignIn />; }\n');
-        put(root, 'apps/web/app/sign-up/[[...sign-up]]/page.tsx', 'import { SignUp } from "@clerk/nextjs";\nexport default function SignUpPage() { return <SignUp />; }\n');
+        put(root, 'apps/web/app/sign-in/[[...sign-in]]/page.tsx', `import { Suspense } from 'react';
+import { SignIn } from '@clerk/nextjs';
+
+export default function SignInPage() {
+  return (
+    <Suspense fallback={<p role="status">Loading sign in…</p>}>
+      <SignIn />
+    </Suspense>
+  );
+}
+`);
+        put(root, 'apps/web/app/sign-up/[[...sign-up]]/page.tsx', `import { Suspense } from 'react';
+import { SignUp } from '@clerk/nextjs';
+
+export default function SignUpPage() {
+  return (
+    <Suspense fallback={<p role="status">Loading sign up…</p>}>
+      <SignUp />
+    </Suspense>
+  );
+}
+`);
         put(root, 'apps/web/proxy.ts', `import { clerkMiddleware } from '@clerk/nextjs/server';
-export default clerkMiddleware();
+import type { NextMiddleware } from 'next/server';
+
+const proxy: NextMiddleware = clerkMiddleware();
+export default proxy;
 export const config = { matcher: ['/((?!_next|[^?]*\\\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)', '/(api|trpc)(.*)'] };
 `);
         // Middleware makes auth available; product routes must explicitly require identity and authorization.
     }
     if (has('hono')) {
-        patchPackage(root, 'apps/api/package.json', {
-            dependencies: { '@clerk/backend': STACK_DEPENDENCIES['@clerk/backend'] },
-        });
-        put(root, 'apps/api/src/identity.ts', `import { createClerkClient } from '@clerk/backend';
-export async function authenticate(request: Request, secretKey: string, authorizedParties: string[]) {
-  return createClerkClient({ secretKey }).authenticateRequest(request, { authorizedParties });
+        sharedPackage(root, 'auth', `import { createClerkClient } from '@clerk/backend';
+
+export async function authenticate(
+  request: Request,
+  secretKey: string,
+  publishableKey: string,
+  authorizedParties: string[],
+) {
+  if (!secretKey || !publishableKey || authorizedParties.length === 0) {
+    throw new Error('Configure Clerk keys and explicit authorized origins before authenticating.');
+  }
+  return createClerkClient({ secretKey, publishableKey }).authenticateRequest(request, {
+    authorizedParties,
+  });
 }
-`);
+`, { '@clerk/backend': STACK_DEPENDENCIES['@clerk/backend'] });
+        writeEnvironmentFile(root, 'apps/api/.dev.vars.example', {
+            CLERK_SECRET_KEY: '',
+            CLERK_PUBLISHABLE_KEY: '',
+        });
     }
+    if (has('next') || has('vinext'))
+        writeEnvironmentFile(root, 'apps/web/.env.example', {
+            NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: '',
+            CLERK_SECRET_KEY: '',
+        });
 }

package/dist/scaffold/bootstrap.d.ts

@@ -1,2 +1,5 @@
 import type { StandardRunner } from '../registry/types.js';
+export declare function assertBootstrapPlatform(run: StandardRunner, platform?: NodeJS.Platform): void;
+/** Planning and diagnostics support older Node releases; generated dependencies do not. */
+export declare function assertWorkspaceRuntime(run: StandardRunner, version?: string): void;
 export declare function bootstrapWorkspace(root: string, name: string, run: StandardRunner, webOnly?: boolean): void;

package/dist/scaffold/bootstrap.js

@@ -1,8 +1,22 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import path from 'node:path';
-import { appendGitignore } from '../util.js';
+import { execFile, appendGitignore } from '../util.js';
 import { bootstrapArguments } from '../registry/bootstrap.js';
+export function assertBootstrapPlatform(run, platform = process.platform) {
+    if (platform === 'win32' && run === execFile)
+        throw new Error('Native Windows initialization is blocked because the upstream shadcn monorepo bootstrap writes component files outside the project. Run Anhedral inside WSL. Planning and doctor remain available on Windows.');
+}
+/** Planning and diagnostics support older Node releases; generated dependencies do not. */
+export function assertWorkspaceRuntime(run, version = process.versions.node) {
+    if (run !== execFile)
+        return;
+    const [major, minor] = version.split('.').map(Number);
+    if (!((major === 22 && minor >= 13) || major >= 24))
+        throw new Error('Generated workspaces require Node.js 22.13+ on the 22.x line or Node.js 24+. Planning and doctor remain available on older CLI-supported versions.');
+}
 export function bootstrapWorkspace(root, name, run, webOnly = false) {
+    assertBootstrapPlatform(run);
+    assertWorkspaceRuntime(run);
     const temporary = path.join(root, '.bootstrap');
     mkdirSync(temporary);
     try {