anhedral 0.9.0 → 0.10.1

package/dist/scaffold/workspace.js

@@ -1,4 +1,4 @@
-import { STACK_DEPENDENCIES } from '../dependencies.js';
+import { STACK_DEPENDENCIES, WORKSPACE_NODE_ENGINE } from '../dependencies.js';
 import { setPnpmPolicy } from '../pnpm-policy.js';
 import { writeSecurityBackports } from '../security-backports.js';
 import { BOOTSTRAP_COMMAND } from '../registry/bootstrap.js';
@@ -7,14 +7,16 @@ import { PACKAGE_MANAGER } from '../dependencies.js';
 import { createSetupPlan } from '../capabilities.js';
 import { json, put, readJson, patchPackage, } from './files.js';
 import { writeSetupDocumentation, workerBuildSuffix } from './documentation.js';
+import { writeStackDocumentation } from './stack-documentation.js';
 import { writeEnvironmentExample } from './environment.js';
-export function writeStandardRoot(root, options, registry, updating = false) {
+function securityOverrides(options) {
     const has = (value) => options.products.includes(value);
-    const existing = readJson(root, 'package.json');
-    const securityOverrides = {
+    return {
         ...(has('wxt') ? { '@wxt-dev/module-react>@vitejs/plugin-react': '5.2.0' } : {}),
         ...(has('next') || has('vinext') ? { 'sharp@<0.35.5': '0.35.5' } : {}),
-        'source-map-js@<1.2.2': '1.2.2',
+        ...(options.products.some((product) => ['vinext', 'next', 'expo', 'electron', 'wxt', 'neon', 'd1'].includes(product))
+            ? { 'source-map-js@<1.2.2': '1.2.2' }
+            : {}),
         ...(has('next') && options.hosting === 'cloudflare'
             ? { 'glob@>=10.2.0 <10.5.0': '10.5.0', 'glob@>=11.0.0 <11.1.0': '11.1.0' }
             : {}),
@@ -34,11 +36,34 @@ export function writeStandardRoot(root, options, registry, updating = false) {
         'brace-expansion@>=3 <4': '3.0.9',
         'brace-expansion@>=4 <5.0.12': '5.0.12',
     };
+}
+function writeTurboConfiguration(root, registry) {
+    const turbo = readJson(root, 'turbo.json');
+    turbo.globalEnv = [
+        ...new Set([...(turbo.globalEnv ?? []), ...registry.items.flatMap((item) => item.environment)]),
+    ].sort();
+    turbo.tasks = {
+        ...turbo.tasks,
+        dev: { ...turbo.tasks.dev, cache: false, persistent: true },
+        lint: { ...turbo.tasks.lint, dependsOn: ['^lint'] },
+        typecheck: { ...turbo.tasks.typecheck, dependsOn: ['^typecheck'] },
+        test: { dependsOn: ['^build'], outputs: ['coverage/**'] },
+        build: {
+            ...turbo.tasks.build,
+            dependsOn: [...new Set(['^build', ...(turbo.tasks.build?.dependsOn ?? [])])],
+            outputs: ['.next/**', '!.next/cache/**', '.open-next/**', 'dist/**', '.output/**'],
+        },
+    };
+    json(root, 'turbo.json', turbo);
+}
+export function writeStandardRoot(root, options, registry, updating = false) {
+    const has = (value) => options.products.includes(value);
+    const existing = readJson(root, 'package.json');
     patchPackage(root, 'package.json', {
         name: options.name,
         private: true,
         packageManager: PACKAGE_MANAGER,
-        engines: { node: '>=22.13.0' },
+        engines: { node: WORKSPACE_NODE_ENGINE },
         scripts: {
             dev: 'turbo dev',
             build: 'turbo build',
@@ -55,7 +80,10 @@ export function writeStandardRoot(root, options, registry, updating = false) {
         },
         devDependencies: { fallow: STACK_DEPENDENCIES['fallow'] },
         // Upstream starter lockfiles can retain vulnerable transitive versions. Keep fixes within compatible majors.
-        pnpm: { ...existing.pnpm, overrides: { ...existing.pnpm?.overrides, ...securityOverrides } },
+        pnpm: {
+            ...existing.pnpm,
+            overrides: { ...existing.pnpm?.overrides, ...securityOverrides(options) },
+        },
     });
     put(root, 'scripts/audit.mjs', `import { spawnSync } from 'node:child_process';
 const base = process.env.AUDIT_BASE;
@@ -90,21 +118,7 @@ process.exitCode = result.status ?? 1;
             '**/cloudflare-env.d.ts',
         ],
     });
-    const turbo = readJson(root, 'turbo.json');
-    turbo.globalEnv = [...new Set(registry.items.flatMap((item) => item.environment))].sort();
-    turbo.tasks = {
-        ...turbo.tasks,
-        dev: { ...turbo.tasks.dev, cache: false, persistent: true },
-        lint: { ...turbo.tasks.lint, dependsOn: ['^lint'] },
-        typecheck: { ...turbo.tasks.typecheck, dependsOn: ['^typecheck'] },
-        test: { dependsOn: ['^build'], outputs: ['coverage/**'] },
-        build: {
-            ...turbo.tasks.build,
-            dependsOn: [...new Set(['^build', ...(turbo.tasks.build?.dependsOn ?? [])])],
-            outputs: ['.next/**', '!.next/cache/**', '.open-next/**', 'dist/**', '.output/**'],
-        },
-    };
-    json(root, 'turbo.json', turbo);
+    writeTurboConfiguration(root, registry);
     setPnpmPolicy(root, {
         allowBuilds: undefined,
         onlyBuiltDependencies: [
@@ -128,8 +142,10 @@ process.exitCode = result.status ?? 1;
         '!.env.example',
         '.fallow/',
         '.anhedral/',
+        '.anhedral-audit-report.json',
     ]);
     writeEnvironmentExample(root, registry);
+    writeStackDocumentation(root, registry);
     json(root, 'anhedral.standard.json', {
         schemaVersion: 1,
         standard: 'anhedral-application-stack',

package/dist/stack-registry.d.ts

@@ -30,7 +30,7 @@ declare const PRODUCT_ITEMS: {
     styling: ItemDefinition;
 };
 export type StandardProduct = keyof typeof PRODUCT_ITEMS;
-export declare const STANDARD_PRODUCTS: readonly ("realtime" | "electron" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling")[];
+export declare const STANDARD_PRODUCTS: readonly ("realtime" | "electron" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog")[];
 declare const DEFINITIONS: {
     vinext: ItemDefinition;
     next: ItemDefinition;
@@ -67,7 +67,7 @@ declare const DEFINITIONS: {
 export type StackItemId = keyof typeof DEFINITIONS;
 export declare function getStackDefinition(name: string): ItemDefinition;
 export declare function getStackItem(name: string): StackRegistryItem;
-export declare const STACK_ITEMS: Record<"realtime" | "electron" | "eslint" | "typescript" | "wxt" | "expo" | "next" | "vinext" | "hono" | "neon" | "better-auth" | "queues" | "workflows" | "workspace" | "ui" | "d1" | "local-data" | "clerk" | "r2" | "kv" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog" | "styling", StackRegistryItem>;
+export declare const STACK_ITEMS: Record<"realtime" | "electron" | "eslint" | "typescript" | "wxt" | "expo" | "vinext" | "next" | "workflows" | "ui" | "workspace" | "styling" | "hono" | "neon" | "d1" | "local-data" | "clerk" | "better-auth" | "r2" | "kv" | "queues" | "cron" | "openai" | "ai-sdk" | "workers-ai" | "resend" | "stripe" | "revenuecat" | "sentry" | "basin" | "posthog", StackRegistryItem>;
 export declare const STACK_REGISTRY: {
     schemaVersion: number;
     name: string;

package/dist/stack-registry.js

@@ -1,3 +1,5 @@
+import { scaffoldStyling } from './scaffold/styling.js';
+import { resourceName } from './render.js';
 import { STACK_DEPENDENCIES } from './dependencies.js';
 import { dependencyOrder } from './dependency-order.js';
 import { GENERATOR_VERSION } from './version.js';
@@ -55,7 +57,7 @@ const PRODUCT_ITEMS = defineItems({
         type: 'application',
         description: 'Expo mobile application with native UI',
         targets: ['apps/mobile'],
-        registryDependencies: ['workspace', 'typescript', 'eslint'],
+        registryDependencies: ['workspace', 'typescript', 'eslint', 'styling'],
         setup: requirements('Mobile application', ['Expo/EAS CLI', 'Xcode or Android SDK'], ['Client-owned Apple/Google developer accounts for store delivery'], ['Platform signing credentials; EAS access when used'], ['Expo app; native adapters, signing, store configuration'], ['Native simulator/device flows and signed native build; web export alone is insufficient']),
         install: scaffoldExpo,
     },
@@ -71,7 +73,7 @@ const PRODUCT_ITEMS = defineItems({
         type: 'application',
         description: 'WXT browser side-panel extension',
         targets: ['apps/extension'],
-        registryDependencies: ['workspace', 'typescript', 'eslint'],
+        registryDependencies: ['workspace', 'typescript', 'eslint', 'styling'],
         setup: requirements('Chrome side-panel extension', ['Chrome', 'WXT'], ['Extension store publisher access for distribution'], ['Store publishing credentials when required'], ['Extension app; minimal browser permissions and store package'], ['Installed side panel, background/content messaging and permission behavior']),
         install: scaffoldWxt,
     },
@@ -106,7 +108,7 @@ const PRODUCT_ITEMS = defineItems({
             d1_databases: [
                 {
                     binding: 'DB',
-                    database_name: `${options.name}-db`,
+                    database_name: resourceName(options.name, 'db'),
                     database_id: 'REPLACE_WITH_D1_ID',
                     migrations_dir: '../../packages/db/migrations',
                 },
@@ -120,7 +122,12 @@ const PRODUCT_ITEMS = defineItems({
         targets: ['packages/local-data'],
         registryDependencies: ['workspace', 'typescript', 'eslint'],
         setup: requirements('Device-local SQLite and files', ['Selected platform database/filesystem tooling'], [], [], ['Integration boundary; implement platform adapters and explicit synchronization if needed'], ['Persistence, offline writes and recovery on the selected device']),
-        package: packageSource('local-data', '// Device-local SQLite and filesystem need platform-specific adapters.\nexport interface LocalDataStore { read(key: string): Promise<string | null>; write(key: string, value: string): Promise<void>; }\n', {}),
+        package: packageSource('local-data', `// Device-local SQLite and filesystem need platform-specific adapters.
+export interface LocalDataStore {
+  read(key: string): Promise<string | null>;
+  write(key: string, value: string): Promise<void>;
+}
+`, {}),
     },
     clerk: {
         type: 'integration',
@@ -130,7 +137,12 @@ const PRODUCT_ITEMS = defineItems({
         registryDependencies: ['workspace', 'typescript', 'eslint'],
         setup: requirements('Managed identity', ['Clerk integration or dashboard'], ['Client-owned Clerk project access'], ['Clerk publishable key; server secret key; webhook secret when used'], ['Identity project, allowed URLs, SDK setup and protected routes'], ['Sign-in/out, session expiry, resource authorization and selected native client flows']),
         install: scaffoldClerk,
-        environment: ['NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY', 'CLERK_SECRET_KEY'],
+        environment: ['NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY', 'CLERK_PUBLISHABLE_KEY', 'CLERK_SECRET_KEY'],
+        resolveEnvironment: ({ has }) => [
+            'CLERK_SECRET_KEY',
+            ...(has('vinext') || has('next') ? ['NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY'] : []),
+            ...(has('hono') ? ['CLERK_PUBLISHABLE_KEY'] : []),
+        ],
         runtime: 'server',
         resolveDependencies: ({ has }) => ['vinext', 'next', 'hono'].filter((id) => has(id)),
         resolveTargets: ({ has }) => [
@@ -162,7 +174,7 @@ const PRODUCT_ITEMS = defineItems({
         ]),
         install: scaffoldPrivateFiles,
         configure: ({ options }) => ({
-            r2_buckets: [{ binding: 'FILES', bucket_name: `${options.name}-private-files` }],
+            r2_buckets: [{ binding: 'FILES', bucket_name: resourceName(options.name, 'private-files') }],
         }),
         runtime: 'worker',
         resolveTargets: ({ runtimeApp }) => [`apps/${runtimeApp}/private-files.md`],
@@ -194,7 +206,7 @@ const PRODUCT_ITEMS = defineItems({
         setup: requirements('Deferred jobs', ['Wrangler'], ['Cloudflare Queues configuration access'], [], ['Queue, producer/consumer bindings and failure handling'], ['Retries, idempotency, concurrency and dead-letter recovery']),
         install: scaffoldQueues,
         configure: ({ options }) => ({
-            queues: { producers: [{ binding: 'JOBS', queue: `${options.name}-jobs` }] },
+            queues: { producers: [{ binding: 'JOBS', queue: resourceName(options.name, 'jobs') }] },
         }),
         runtime: 'optional-worker',
         resolveTargets: ({ runtimeApp, has }) => [
@@ -298,7 +310,9 @@ const PRODUCT_ITEMS = defineItems({
             'Basin dataset/stream, ANALYTICS binding, optional private R2 sink and authorized sink writes',
         ], ['Private ingestion, event delivery, query results and archive retrieval when selected']),
         package: packageSource('analytics', `export interface EventStream { send(events: Record<string, unknown>[]): Promise<void> }
-export async function recordEvents(stream: EventStream, events: Record<string, unknown>[]) { await stream.send(events); }
+export async function recordEvents(stream: EventStream, events: Record<string, unknown>[]) {
+  await stream.send(events);
+}
 `, {}),
         resolvePackage: ({ has }, recipe) => ({
             ...recipe,
@@ -325,8 +339,21 @@ export async function recordEvents(stream: EventStream, events: Record<string, u
         description: 'Shared platform-independent styling tokens',
         targets: ['packages/styling'],
         registryDependencies: ['workspace', 'typescript', 'eslint'],
-        setup: requirements('Shared styling definitions', [], [], [], ['Styling package; implement actual shared colors, typography, spacing and themes'], ['Consistency across selected interfaces; preserve platform-specific components']),
-        package: packageSource('styling', "export const styling = { colors: { foreground: '#171717', background: '#ffffff' }, spacing: { small: 4, medium: 8, large: 16 } } as const;\n", {}),
+        setup: requirements('Shared styling definitions', [], [], [], [
+            'Shared light/dark tokens and Tailwind v3 preset for Expo/WXT; adapt platform typography and components',
+        ], ['Consistency across selected interfaces; preserve platform-specific components']),
+        package: packageSource('styling', `import { light, dark, spacing } from './tokens.cjs';
+
+export const styling = {
+  colors: {
+    foreground: 'hsl(' + light['--foreground'] + ')',
+    background: 'hsl(' + light['--background'] + ')',
+  },
+  spacing,
+  themes: { light, dark },
+};
+`, {}),
+        install: scaffoldStyling,
     },
 });
 export const STANDARD_PRODUCTS = Object.freeze(Object.keys(PRODUCT_ITEMS));
@@ -366,7 +393,7 @@ function freeze(value) {
 }
 const DEFINITIONS = freeze({ ...FOUNDATION_ITEMS, ...PRODUCT_ITEMS });
 function describe(definition) {
-    const { install: _install, configure: _configure, resolveTargets: _targets, resolveDependencies: _dependencies, resolvePackage: _package, fallbackDependency: _fallback, ...metadata } = definition;
+    const { install: _install, configure: _configure, resolveTargets: _targets, resolveEnvironment: _environment, resolveDependencies: _dependencies, resolvePackage: _package, fallbackDependency: _fallback, ...metadata } = definition;
     return structuredClone(metadata);
 }
 export function getStackDefinition(name) {

package/dist/standard.js

@@ -8,25 +8,20 @@ import { registerVercelApplication } from './vercel.js';
 import { registerApplication } from './delivery.js';
 import { runStagedTransaction } from './transaction.js';
 import { createSetupPlan } from './capabilities.js';
-import { bootstrapWorkspace } from './scaffold/bootstrap.js';
+import { bootstrapWorkspace, assertBootstrapPlatform, assertWorkspaceRuntime, } from './scaffold/bootstrap.js';
 import { composeStack } from './scaffold/compose.js';
 import { parseStandardOptions } from './registry/options.js';
 import { STANDARD_USAGE } from './registry/usage.js';
 export { parseStandardOptions, STANDARD_USAGE };
 export { STANDARD_PRODUCTS } from './stack-registry.js';
-const defaultRunner = (command, args, cwd) => execFile(command, args, cwd);
-function assertBootstrapPlatform(run) {
-    if (process.platform === 'win32' && run === defaultRunner) {
-        throw new Error('Native Windows initialization is blocked because the upstream shadcn monorepo bootstrap writes component files outside the project. Run Anhedral inside WSL. Planning and doctor remain available on Windows.');
-    }
-}
-export async function scaffoldStandardProject(options, run = defaultRunner) {
+export async function scaffoldStandardProject(options, run = execFile) {
     const plan = createSetupPlan(options);
     if (options.dryRun) {
         console.log(options.json ? JSON.stringify(plan, null, 2) : JSON.stringify(plan));
         return;
     }
     assertBootstrapPlatform(run);
+    assertWorkspaceRuntime(run);
     const root = options.root;
     const previousQuiet = process.env.ANHEDRAL_QUIET;
     if (options.json)

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "0.9.0";
+export declare const GENERATOR_VERSION = "0.10.1";

package/dist/version.js

@@ -1 +1 @@
-export const GENERATOR_VERSION = '0.9.0';
+export const GENERATOR_VERSION = '0.10.1';

package/dist/vinext.js

@@ -1,3 +1,4 @@
+import { VINEXT_DEPENDENCIES } from './dependencies.js';
 import { existsSync, readFileSync, rmSync } from 'node:fs';
 import path from 'node:path';
 import { writeFile } from './util.js';
@@ -8,28 +9,14 @@ export function configureVinext(root, workerName, bindings) {
     const pkg = JSON.parse(readFileSync(path.join(root, 'apps/web/package.json'), 'utf8'));
     delete pkg.dependencies?.['@opennextjs/cloudflare'];
     pkg.type = 'module';
-    pkg.dependencies = {
-        ...pkg.dependencies,
-        vinext: '1.1.0',
-        next: '16.4.0',
-        react: '19.2.8',
-        'react-dom': '19.2.8',
-        'react-server-dom-webpack': '19.2.8',
-    };
-    pkg.devDependencies = {
-        ...pkg.devDependencies,
-        vite: '8.3.4',
-        '@cloudflare/vite-plugin': '1.63.1',
-        '@vitejs/plugin-rsc': '0.5.36',
-        '@vitejs/plugin-react': '6.1.2',
-        wrangler: '4.149.0',
-    };
+    pkg.dependencies = { ...pkg.dependencies, ...VINEXT_DEPENDENCIES.dependencies };
+    pkg.devDependencies = { ...pkg.devDependencies, ...VINEXT_DEPENDENCIES.devDependencies };
     pkg.scripts = {
         ...pkg.scripts,
         dev: 'vite dev --host 127.0.0.1 --port 3000',
         build: 'vite build',
         start: 'vinext start',
-        preview: 'wrangler dev --config dist/server/wrangler.json --persist-to .wrangler/state',
+        preview: 'wrangler dev --config dist/server/wrangler.json --port 3000 --persist-to .wrangler/state',
         deploy: 'vite build && wrangler deploy --config dist/server/wrangler.json',
         'build:worker': 'vite build',
         typecheck: 'wrangler types --env-interface CloudflareEnv cloudflare-env.d.ts && tsc --noEmit',
@@ -77,7 +64,11 @@ export default config;
     const uiFile = path.join(root, 'packages/ui/package.json');
     if (existsSync(uiFile)) {
         const ui = JSON.parse(readFileSync(uiFile, 'utf8'));
-        ui.dependencies = { ...ui.dependencies, react: '19.2.8', 'react-dom': '19.2.8' };
+        ui.dependencies = {
+            ...ui.dependencies,
+            react: VINEXT_DEPENDENCIES.dependencies.react,
+            'react-dom': VINEXT_DEPENDENCIES.dependencies['react-dom'],
+        };
         writeFile(uiFile, JSON.stringify(ui, null, 2) + '\n');
     }
 }

package/dist/workspace-graph.js

@@ -1,4 +1,5 @@
-import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { readBoundedFile, MAX_PROJECT_JSON_BYTES } from './bounded-file.js';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { dependencyOrder } from './dependency-order.js';
 const dependencyFields = [
@@ -12,7 +13,7 @@ function readManifest(file, directory) {
         throw new Error(`Workspace manifest missing: ${directory}.`);
     if (lstatSync(file).isSymbolicLink())
         throw new Error(`Workspace symlinks are unsupported: ${directory}/package.json.`);
-    const value = JSON.parse(readFileSync(file, 'utf8'));
+    const value = JSON.parse(readBoundedFile(file, MAX_PROJECT_JSON_BYTES).toString('utf8'));
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error(`Invalid workspace manifest: ${directory}.`);
     const manifest = value;

package/docs/delivery-workflow.md

@@ -6,7 +6,7 @@ Codex implements the product; the CLI supplies scaffolding, selected resource re
 
 1. Choose only needed components from the [stack standard](application-stack-standard.md). Record decisions, ownership, environment/cost assumptions and actual connections in the application's `docs/architecture.md`.
 2. Match installed plugin, registry `cliVersion` and executable versions. Check Node/pnpm, Git identity, toolchains and customer provider access. For unpublished development use `pnpm build` and `node dist/bin.js`; never silently substitute `@latest`.
-3. Inspect `new <unused-directory> <flags> --dry-run --json`, then generate with those choices. Review README, AGENTS, setup manifests and resolved lockfile. For initialized apps, preview `add <directory> <items...> --dry-run --json`; additions protect edited source and record registry provenance. Use `--registry <file|https-url>` for reviewed declarative registries. Older projects and runtime relocation require explicit migration. `doctor --providers --json` checks access without configuring infrastructure or certifying production.
+3. Inspect `new <unused-directory> <flags> --dry-run --json`, then generate with those choices. Review README, AGENTS, setup manifests and resolved lockfile. For initialized apps, preview `add <directory> <items...> --dry-run --json`; additions protect edited source and record registry provenance. Select only items from the bundled Anhedral catalog. If a web addition reports `filesChecked: false`, the preview covers selection and targets only; the actual transaction checks generated-file conflicts before committing. Older projects and runtime relocation require explicit migration. `doctor --providers --json` checks access without configuring infrastructure or certifying production.
 4. Implement screens, APIs, persistence, authorization and integration behavior. Replace placeholders with working flows. Configure real secrets, origins and reviewed migrations using provider tools; starters do not establish setup completion. Keep credentials out of source, logs and handoffs.
 
 ## Source and release authority

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anhedral",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Build and deliver applications with Cloudflare-first Vinext, selected services, optional Next.js on Vercel, and verified release evidence.",
   "type": "module",
   "exports": {

package/dist/registry/remote.d.ts

@@ -1,25 +0,0 @@
-export interface SourceItem {
-    name: string;
-    version: string;
-    registryDependencies: string[];
-    files: {
-        target: string;
-        content: string;
-    }[];
-}
-export interface SourceRegistry {
-    schemaVersion: 1;
-    name: string;
-    items: SourceItem[];
-}
-export interface RemoteRegistry {
-    source: string;
-    integrity: string;
-    registry: SourceRegistry;
-}
-/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
-export declare function validateSourceRegistry(value: unknown): SourceRegistry;
-export declare function loadSourceRegistry(source: string, fetcher?: typeof fetch): Promise<RemoteRegistry>;
-export declare function resolveSourceItems(registry: SourceRegistry, selected: readonly string[]): SourceItem[];
-/** Compile repository-relative source paths into a distributable JSON payload. */
-export declare function buildSourceRegistry(manifestFile: string): SourceRegistry;

package/dist/registry/remote.js

@@ -1,168 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readBoundedFile } from '../bounded-file.js';
-import path from 'node:path';
-import { dependencyOrder } from '../dependency-order.js';
-import { assertSafeTarget } from './receipt.js';
-const identifier = /^[a-z][a-z0-9-]{0,62}$/;
-const limit = 2 * 1024 * 1024;
-/** Declarative source only: no executable recipe callbacks, hooks or destination templates. */
-export function validateSourceRegistry(value) {
-    if (!value || typeof value !== 'object')
-        throw new Error('Invalid source registry.');
-    const registry = value;
-    if (registry.schemaVersion !== 1 ||
-        typeof registry.name !== 'string' ||
-        !identifier.test(registry.name) ||
-        !Array.isArray(registry.items) ||
-        !registry.items.length ||
-        registry.items.length > 100)
-        throw new Error('Unsupported source registry schema.');
-    const names = new Set();
-    const files = new Set();
-    for (const item of registry.items) {
-        if (!item ||
-            typeof item.name !== 'string' ||
-            !identifier.test(item.name) ||
-            names.has(item.name) ||
-            typeof item.version !== 'string' ||
-            !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(item.version) ||
-            !Array.isArray(item.registryDependencies) ||
-            !item.registryDependencies.every((id) => typeof id === 'string' && identifier.test(id)) ||
-            !Array.isArray(item.files) ||
-            !item.files.length)
-            throw new Error('Invalid or duplicate source registry item.');
-        names.add(item.name);
-        for (const file of item.files) {
-            if (!file || typeof file.target !== 'string' || typeof file.content !== 'string')
-                throw new Error('Invalid registry file.');
-            assertSafeTarget('/registry-validation', file.target);
-            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.target) ||
-                file.target
-                    .split('/')
-                    .some((part) => part.startsWith('.') ||
-                    ['node_modules', 'dist', 'release', 'anhedral.registry.json'].includes(part)) ||
-                files.has(file.target))
-                throw new Error(`Unsafe or duplicate source target: ${file.target}.`);
-            files.add(file.target);
-            if (path.basename(file.target) === 'package.json') {
-                const manifest = JSON.parse(file.content);
-                if (!manifest ||
-                    typeof manifest !== 'object' ||
-                    Array.isArray(manifest) ||
-                    manifest.private !== true ||
-                    typeof manifest.name !== 'string' ||
-                    !/^@workspace\/[a-z][a-z0-9-]*$/.test(manifest.name))
-                    throw new Error('Remote workspace manifests must be private @workspace packages.');
-                if (manifest.scripts &&
-                    Object.keys(manifest.scripts).some((key) => /^(?:preinstall|install|postinstall|preprepare|prepare|postprepare|prepublish|prepublishOnly|pnpm:devPreinstall)$/.test(key)))
-                    throw new Error('Remote installation hooks are unsupported.');
-                for (const field of [
-                    'dependencies',
-                    'devDependencies',
-                    'optionalDependencies',
-                    'peerDependencies',
-                ]) {
-                    if (manifest[field] &&
-                        (typeof manifest[field] !== 'object' ||
-                            Array.isArray(manifest[field]) ||
-                            Object.values(manifest[field]).some((version) => typeof version !== 'string' ||
-                                !/^(?:workspace:[*^~]|[~^]?\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?)$/.test(version))))
-                        throw new Error('Remote dependencies require versioned npm or workspace references.');
-                }
-            }
-        }
-    }
-    dependencyOrder(new Map(registry.items.map((item) => [item.name, item.registryDependencies])), 'Remote registry');
-    return structuredClone(registry);
-}
-export async function loadSourceRegistry(source, fetcher = fetch) {
-    let bytes;
-    if (/^https?:/.test(source)) {
-        const url = new URL(source);
-        if (url.protocol !== 'https:' ||
-            url.username ||
-            url.password ||
-            url.hash ||
-            url.search ||
-            !/^[a-z0-9.-]+$/i.test(url.hostname) ||
-            url.hostname === 'localhost' ||
-            !url.hostname.includes('.') ||
-            /^\d+(?:\.\d+){3}$/.test(url.hostname))
-            throw new Error('Remote registries require a public HTTPS URL without credentials or query parameters.');
-        const response = await fetcher(url, { redirect: 'error', signal: AbortSignal.timeout(15_000) });
-        if (!response.ok || !response.body)
-            throw new Error('Cannot retrieve source registry.');
-        const reader = response.body.getReader();
-        const chunks = [];
-        let size = 0;
-        try {
-            while (true) {
-                const result = await reader.read();
-                if (result.done)
-                    break;
-                size += result.value.byteLength;
-                if (size > limit)
-                    throw new Error('Source registry exceeds 2 MiB.');
-                chunks.push(result.value);
-            }
-        }
-        finally {
-            await reader.cancel();
-        }
-        bytes = Buffer.concat(chunks);
-        source = url.href;
-    }
-    else {
-        source = path.resolve(source);
-        bytes = readBoundedFile(source, limit);
-    }
-    if (bytes.length > limit)
-        throw new Error('Source registry exceeds 2 MiB.');
-    return {
-        source,
-        integrity: `sha256-${createHash('sha256').update(bytes).digest('base64')}`,
-        registry: validateSourceRegistry(JSON.parse(bytes.toString('utf8'))),
-    };
-}
-export function resolveSourceItems(registry, selected) {
-    const catalog = new Map(registry.items.map((item) => [item.name, item]));
-    const graph = new Map();
-    const collect = (name) => {
-        if (graph.has(name))
-            return;
-        const item = catalog.get(name);
-        if (!item)
-            throw new Error(`Unknown remote registry item: ${name}.`);
-        graph.set(name, item.registryDependencies);
-        item.registryDependencies.forEach(collect);
-    };
-    selected.forEach(collect);
-    return dependencyOrder(graph, 'Remote registry').map((name) => catalog.get(name));
-}
-/** Compile repository-relative source paths into a distributable JSON payload. */
-export function buildSourceRegistry(manifestFile) {
-    const root = path.dirname(path.resolve(manifestFile));
-    const registry = JSON.parse(readBoundedFile(manifestFile, limit).toString('utf8'));
-    if (!Array.isArray(registry.items))
-        throw new Error('Invalid source registry manifest.');
-    for (const item of registry.items) {
-        if (!Array.isArray(item.files))
-            throw new Error('Invalid registry file list.');
-        for (const file of item.files) {
-            if (file.path === undefined)
-                continue;
-            if (typeof file.path !== 'string' || file.content !== undefined)
-                throw new Error('Declare one source path or embedded content.');
-            assertSafeTarget(root, file.path);
-            if (!/^(?:apps|packages)\/[a-z][a-z0-9-]*\//.test(file.path) ||
-                file.path.split('/').some((part) => part.startsWith('.') || part === 'node_modules'))
-                throw new Error('Registry source paths must stay in application or package source.');
-            const source = path.join(root, file.path);
-            file.content = readBoundedFile(source, limit).toString('utf8');
-            delete file.path;
-        }
-    }
-    if (Buffer.byteLength(JSON.stringify(registry)) > limit)
-        throw new Error('Source registry exceeds 2 MiB.');
-    return validateSourceRegistry(registry);
-}