voidforge-build 23.9.1

package/dist/wizard/lib/patterns/stablecoin-adapter.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Pattern: Stablecoin Treasury Adapter (Split Interface)
+ *
+ * Key principles:
+ * - Split interface: StablecoinSetup (interactive CLI/Danger Room) + StablecoinAdapter (daemon runtime)
+ * - Single-writer constraint: only Heartbeat daemon calls the runtime adapter
+ * - Funding lifecycle: USDC held at provider → off-ramp instruction → fiat settlement at linked bank
+ * - All amounts in branded integer cents (Cents type from financial-transaction.ts)
+ * - Hash-chained TransferRecord for tamper-evident audit trail
+ * - Idempotency keys on all write operations (off-ramp, cancel)
+ * - Provider abstraction: Circle first-class, Bridge secondary, manual fallback
+ * - The adapter does NOT move money between bank and ad platform — that is ad-billing-adapter.ts
+ *
+ * Agents: Dockson (treasury), Heartbeat daemon
+ *
+ * PRD Reference: §11.1A, §12.1, §12.4, §12.5
+ *
+ * Circle API reference (v1):
+ *   Auth: Bearer token via API key — header `Authorization: Bearer {apiKey}`
+ *   Base URL: https://api.circle.com/v1
+ *   GET  /wallets                       → list wallets
+ *   GET  /wallets/{id}/balances         → wallet balances (amount, currency, chain)
+ *   GET  /configuration                 → supported chains and assets
+ *   GET  /banks/wires                   → linked bank accounts
+ *   POST /payouts                       → initiate wire payout (off-ramp)
+ *   GET  /payouts/{id}                  → transfer status
+ *   GET  /payouts?destination={bankId}  → list completed payouts for reconciliation
+ *
+ *   Response shape (balance):
+ *     { data: { available: [{ amount: "1000.00", currency: "USD" }] } }
+ *   Response shape (payout):
+ *     { data: { id, status, amount: { amount, currency }, destination, createDate, updateDate } }
+ *   Payout statuses: pending → processing → complete | failed
+ *
+ * Bridge API reference:
+ *   Auth: API key header `Api-Key: {apiKey}`
+ *   Base URL: https://api.bridge.xyz/v0
+ *   POST /customers/{id}/liquidation_addresses → create liquidation address
+ *   GET  /customers/{id}/liquidation_addresses → list addresses
+ *   GET  /liquidation_addresses/{id}           → transfer status
+ *   Transfers settle via ACH to linked bank — status polling required
+ */
+type Cents = number & {
+    readonly __brand: 'Cents';
+};
+declare function toCents(dollars: number): Cents;
+declare function toDollars(cents: Cents): number;
+type StablecoinProvider = 'circle' | 'bridge';
+interface SupportedAsset {
+    asset: string;
+    network: string;
+    contractAddress: string;
+    minRedemption: Cents;
+}
+interface ProviderCredentials {
+    provider: StablecoinProvider;
+    apiKey: string;
+    environment: 'sandbox' | 'production';
+}
+interface StablecoinBalance {
+    provider: StablecoinProvider;
+    asset: string;
+    network: string;
+    balanceCents: Cents;
+    lastUpdated: string;
+}
+interface FiatBalance {
+    provider: 'mercury' | 'external';
+    accountId: string;
+    availableCents: Cents;
+    pendingCents: Cents;
+    currency: 'USD';
+    lastUpdated: string;
+}
+interface CombinedBalances {
+    stablecoin: StablecoinBalance[];
+    fiat: FiatBalance[];
+    totalStablecoinCents: Cents;
+    totalFiatAvailableCents: Cents;
+}
+interface OfframpQuote {
+    provider: StablecoinProvider;
+    sourceAsset: string;
+    sourceNetwork: string;
+    requestedCents: Cents;
+    estimatedFeeCents: Cents;
+    estimatedNetCents: Cents;
+    estimatedSettlementMinutes: number;
+    expiresAt: string;
+    quoteId?: string;
+}
+type TransferStatus = 'pending' | 'processing' | 'completed' | 'failed' | 'cancelled';
+interface TransferRecord {
+    id: string;
+    fundingPlanId: string;
+    providerTransferId: string;
+    bankTransactionId?: string;
+    provider: StablecoinProvider;
+    direction: 'crypto_to_fiat';
+    sourceAsset: string;
+    sourceNetwork: string;
+    amountCents: Cents;
+    feesCents: Cents;
+    netAmountCents: Cents;
+    destinationBankId: string;
+    status: TransferStatus;
+    statusReason?: string;
+    initiatedAt: string;
+    completedAt?: string;
+    idempotencyKey: string;
+    previousHash: string;
+    hash: string;
+}
+interface TransferStatusDetail {
+    transferId: string;
+    providerTransferId: string;
+    status: TransferStatus;
+    amountCents: Cents;
+    feesCents: Cents;
+    initiatedAt: string;
+    completedAt?: string;
+    estimatedCompletionAt?: string;
+    providerRawStatus: string;
+}
+interface DateRange {
+    start: string;
+    end: string;
+}
+interface StablecoinSetup {
+    /** Verify provider API key is valid and has required permissions */
+    authenticate(credentials: ProviderCredentials): Promise<{
+        valid: boolean;
+        accountId?: string;
+        permissions?: string[];
+        error?: string;
+    }>;
+    /** List stablecoins and networks the provider supports for off-ramp */
+    verifySupportedAssets(credentials: ProviderCredentials): Promise<SupportedAsset[]>;
+    /** Confirm the provider has a linked bank destination for wire/ACH payouts */
+    verifyLinkedBank(credentials: ProviderCredentials): Promise<{
+        linked: boolean;
+        bankId?: string;
+        bankName?: string;
+        accountLast4?: string;
+        error?: string;
+    }>;
+    /** Fetch current stablecoin balances for initial state snapshot */
+    getInitialBalances(credentials: ProviderCredentials): Promise<StablecoinBalance[]>;
+}
+interface StablecoinAdapter {
+    /** Current stablecoin + fiat balances across all connected accounts */
+    getBalances(): Promise<CombinedBalances>;
+    /** Estimate fees, settlement time, and net proceeds for an off-ramp */
+    quoteRedemption(amountCents: Cents): Promise<OfframpQuote>;
+    /**
+     * Create an off-ramp instruction with the provider.
+     * Requires an idempotencyKey on the FundingPlan to prevent duplicate transfers.
+     * Returns the created TransferRecord (with hash chain linking).
+     */
+    initiateOfframp(plan: FundingPlanRef, previousHash: string): Promise<TransferRecord>;
+    /** Poll provider for transfer status updates */
+    getTransferStatus(transferId: string): Promise<TransferStatusDetail>;
+    /** Cancel a pending transfer if the provider supports cancellation */
+    cancelTransfer(transferId: string): Promise<{
+        cancelled: boolean;
+        reason?: string;
+    }>;
+    /** List completed transfers in a date range for reconciliation */
+    listCompletedTransfers(dateRange: DateRange): Promise<TransferRecord[]>;
+}
+interface FundingPlanRef {
+    id: string;
+    sourceFundingId: string;
+    destinationBankId: string;
+    requiredCents: Cents;
+    idempotencyKey: string;
+}
+declare function computeTransferHash(record: Omit<TransferRecord, 'hash'>, previousHash: string): string;
+declare class CircleAdapter implements StablecoinSetup, StablecoinAdapter {
+    private config;
+    private readonly baseUrl;
+    private apiKey;
+    private bankId;
+    constructor(config: {
+        apiKey: string;
+        bankId: string;
+        environment: 'sandbox' | 'production';
+    });
+    authenticate(credentials: ProviderCredentials): Promise<{
+        valid: boolean;
+        accountId?: string;
+        permissions?: string[];
+        error?: string;
+    }>;
+    verifySupportedAssets(_credentials: ProviderCredentials): Promise<SupportedAsset[]>;
+    verifyLinkedBank(_credentials: ProviderCredentials): Promise<{
+        linked: boolean;
+        bankId?: string;
+        bankName?: string;
+        accountLast4?: string;
+        error?: string;
+    }>;
+    getInitialBalances(_credentials: ProviderCredentials): Promise<StablecoinBalance[]>;
+    getBalances(): Promise<CombinedBalances>;
+    quoteRedemption(amountCents: Cents): Promise<OfframpQuote>;
+    initiateOfframp(plan: FundingPlanRef, previousHash: string): Promise<TransferRecord>;
+    getTransferStatus(transferId: string): Promise<TransferStatusDetail>;
+    cancelTransfer(transferId: string): Promise<{
+        cancelled: boolean;
+        reason?: string;
+    }>;
+    listCompletedTransfers(dateRange: DateRange): Promise<TransferRecord[]>;
+    private fetchStablecoinBalances;
+    private apiCall;
+}
+declare function mapCircleStatus(circleStatus: string): TransferStatus;
+export type { StablecoinSetup, StablecoinAdapter, StablecoinProvider, SupportedAsset, ProviderCredentials, StablecoinBalance, FiatBalance, CombinedBalances, OfframpQuote, TransferStatus, TransferRecord, TransferStatusDetail, FundingPlanRef, DateRange, };
+export { toCents, toDollars, computeTransferHash, mapCircleStatus, CircleAdapter };

package/dist/wizard/lib/patterns/stablecoin-adapter.js

@@ -0,0 +1,264 @@
+/**
+ * Pattern: Stablecoin Treasury Adapter (Split Interface)
+ *
+ * Key principles:
+ * - Split interface: StablecoinSetup (interactive CLI/Danger Room) + StablecoinAdapter (daemon runtime)
+ * - Single-writer constraint: only Heartbeat daemon calls the runtime adapter
+ * - Funding lifecycle: USDC held at provider → off-ramp instruction → fiat settlement at linked bank
+ * - All amounts in branded integer cents (Cents type from financial-transaction.ts)
+ * - Hash-chained TransferRecord for tamper-evident audit trail
+ * - Idempotency keys on all write operations (off-ramp, cancel)
+ * - Provider abstraction: Circle first-class, Bridge secondary, manual fallback
+ * - The adapter does NOT move money between bank and ad platform — that is ad-billing-adapter.ts
+ *
+ * Agents: Dockson (treasury), Heartbeat daemon
+ *
+ * PRD Reference: §11.1A, §12.1, §12.4, §12.5
+ *
+ * Circle API reference (v1):
+ *   Auth: Bearer token via API key — header `Authorization: Bearer {apiKey}`
+ *   Base URL: https://api.circle.com/v1
+ *   GET  /wallets                       → list wallets
+ *   GET  /wallets/{id}/balances         → wallet balances (amount, currency, chain)
+ *   GET  /configuration                 → supported chains and assets
+ *   GET  /banks/wires                   → linked bank accounts
+ *   POST /payouts                       → initiate wire payout (off-ramp)
+ *   GET  /payouts/{id}                  → transfer status
+ *   GET  /payouts?destination={bankId}  → list completed payouts for reconciliation
+ *
+ *   Response shape (balance):
+ *     { data: { available: [{ amount: "1000.00", currency: "USD" }] } }
+ *   Response shape (payout):
+ *     { data: { id, status, amount: { amount, currency }, destination, createDate, updateDate } }
+ *   Payout statuses: pending → processing → complete | failed
+ *
+ * Bridge API reference:
+ *   Auth: API key header `Api-Key: {apiKey}`
+ *   Base URL: https://api.bridge.xyz/v0
+ *   POST /customers/{id}/liquidation_addresses → create liquidation address
+ *   GET  /customers/{id}/liquidation_addresses → list addresses
+ *   GET  /liquidation_addresses/{id}           → transfer status
+ *   Transfers settle via ACH to linked bank — status polling required
+ */
+import { createHash } from 'node:crypto';
+function toCents(dollars) {
+    return Math.round(dollars * 100);
+}
+function toDollars(cents) {
+    return cents / 100;
+}
+// ── Hash Chain Helper ───────────────────────────────
+function computeTransferHash(record, previousHash) {
+    const payload = JSON.stringify({
+        id: record.id,
+        fundingPlanId: record.fundingPlanId,
+        providerTransferId: record.providerTransferId,
+        amountCents: record.amountCents,
+        feesCents: record.feesCents,
+        status: record.status,
+        initiatedAt: record.initiatedAt,
+    }) + previousHash;
+    return createHash('sha256').update(payload).digest('hex');
+}
+// ── Reference Implementation Sketch: Circle ─────────
+// Production implementation would live in wizard/lib/financial/stablecoin/circle.ts
+class CircleAdapter {
+    config;
+    baseUrl = 'https://api.circle.com/v1';
+    apiKey = '';
+    bankId = '';
+    constructor(config) {
+        this.config = config;
+        this.apiKey = config.apiKey;
+        this.bankId = config.bankId;
+        if (config.environment === 'sandbox') {
+            // Circle sandbox base URL is the same but uses sandbox API keys
+        }
+    }
+    // ── Setup (interactive) ──────────
+    async authenticate(credentials) {
+        // GET /configuration — verifies API key works
+        // Circle returns { data: { payments: { masterWalletId } } }
+        const res = await this.apiCall('GET', '/configuration');
+        const data = res.data;
+        const payments = data?.payments;
+        return {
+            valid: true,
+            accountId: payments?.masterWalletId,
+        };
+    }
+    async verifySupportedAssets(_credentials) {
+        // Circle supports USDC on ETH, SOL, MATIC, AVAX, etc.
+        // GET /configuration → data.payments.supportedCurrencies
+        // Hardcoded for pattern — real implementation queries the API
+        return [
+            { asset: 'USDC', network: 'ETH', contractAddress: '0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48', minRedemption: toCents(100) },
+            { asset: 'USDC', network: 'SOL', contractAddress: 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v', minRedemption: toCents(100) },
+            { asset: 'USDC', network: 'MATIC', contractAddress: '0x3c499c542cef5e3811e1192ce70d8cc03d5c3359', minRedemption: toCents(100) },
+        ];
+    }
+    async verifyLinkedBank(_credentials) {
+        // GET /banks/wires — lists linked wire destinations
+        // Response: { data: [{ id, description, trackingRef, bankAddress, billingDetails, status }] }
+        const res = await this.apiCall('GET', '/banks/wires');
+        const banks = res.data;
+        if (!banks || banks.length === 0) {
+            return { linked: false, error: 'No linked bank accounts found in Circle' };
+        }
+        const primary = banks[0];
+        return {
+            linked: true,
+            bankId: primary.id,
+            bankName: primary.billingDetails?.name,
+            accountLast4: primary.trackingRef
+                ? primary.trackingRef.slice(-4)
+                : undefined,
+        };
+    }
+    async getInitialBalances(_credentials) {
+        return this.fetchStablecoinBalances();
+    }
+    // ── Runtime (daemon) ──────────
+    async getBalances() {
+        const stablecoin = await this.fetchStablecoinBalances();
+        const totalStablecoinCents = stablecoin.reduce((sum, b) => (sum + b.balanceCents), 0);
+        // Fiat balances come from the bank adapter, not the stablecoin provider.
+        // The caller (Treasury Planner) combines stablecoin + bank balances.
+        return {
+            stablecoin,
+            fiat: [],
+            totalStablecoinCents,
+            totalFiatAvailableCents: 0,
+        };
+    }
+    async quoteRedemption(amountCents) {
+        // Circle payout fees vary by destination and amount.
+        // For wire payouts: typically $25 flat fee.
+        // Settlement: 1-2 business days for domestic wire.
+        const feeCents = toCents(25);
+        return {
+            provider: 'circle',
+            sourceAsset: 'USDC',
+            sourceNetwork: 'ETH',
+            requestedCents: amountCents,
+            estimatedFeeCents: feeCents,
+            estimatedNetCents: (amountCents - feeCents),
+            estimatedSettlementMinutes: 24 * 60, // 1 business day estimate
+            expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString(),
+        };
+    }
+    async initiateOfframp(plan, previousHash) {
+        // POST /payouts
+        // Body: { idempotencyKey, source: { type: "wallet", id: "master" },
+        //         destination: { type: "wire", id: bankId },
+        //         amount: { amount: "1000.00", currency: "USD" },
+        //         metadata: { beneficiaryEmail: "..." } }
+        const res = await this.apiCall('POST', '/payouts', {
+            idempotencyKey: plan.idempotencyKey,
+            source: { type: 'wallet', id: 'master' },
+            destination: { type: 'wire', id: this.bankId },
+            amount: { amount: toDollars(plan.requiredCents).toFixed(2), currency: 'USD' },
+        });
+        const payout = res.data;
+        const now = new Date().toISOString();
+        const id = crypto.randomUUID();
+        const record = {
+            id,
+            fundingPlanId: plan.id,
+            providerTransferId: payout.id,
+            provider: 'circle',
+            direction: 'crypto_to_fiat',
+            sourceAsset: 'USDC',
+            sourceNetwork: 'ETH',
+            amountCents: plan.requiredCents,
+            feesCents: toCents(25),
+            netAmountCents: (plan.requiredCents - toCents(25)),
+            destinationBankId: plan.destinationBankId,
+            status: 'pending',
+            initiatedAt: now,
+            idempotencyKey: plan.idempotencyKey,
+            previousHash,
+        };
+        const hash = computeTransferHash(record, previousHash);
+        return { ...record, hash };
+    }
+    async getTransferStatus(transferId) {
+        // GET /payouts/{id}
+        // Response: { data: { id, status, amount, fees, createDate, updateDate } }
+        // Circle statuses: pending → processing → complete | failed
+        const res = await this.apiCall('GET', `/payouts/${transferId}`);
+        const payout = res.data;
+        const amount = payout.amount;
+        const fees = payout.fees;
+        return {
+            transferId,
+            providerTransferId: payout.id,
+            status: mapCircleStatus(payout.status),
+            amountCents: toCents(parseFloat(amount.amount)),
+            feesCents: fees ? toCents(parseFloat(fees.amount)) : 0,
+            initiatedAt: payout.createDate,
+            completedAt: payout.status === 'complete' ? payout.updateDate : undefined,
+            providerRawStatus: payout.status,
+        };
+    }
+    async cancelTransfer(transferId) {
+        // Circle does not support cancellation of payouts once processing begins.
+        // Only pending payouts may be cancellable via support — no direct API.
+        return {
+            cancelled: false,
+            reason: 'Circle does not support programmatic payout cancellation. Contact support for pending payouts.',
+        };
+    }
+    async listCompletedTransfers(dateRange) {
+        // GET /payouts?destination={bankId}&status=complete
+        //   &pageBefore=...&pageAfter=...
+        // Filter by createDate within dateRange on the client side.
+        // Returns array of TransferRecords for reconciliation.
+        // In production: paginate and filter by date.
+        throw new Error('HTTP implementation — use node:https, no SDK dependencies');
+    }
+    // ── Private helpers ──────────
+    async fetchStablecoinBalances() {
+        // GET /wallets/master/balances (or /wallets → pick master → /ballets/{id}/balances)
+        // Response: { data: { available: [{ amount: "1500.50", currency: "USD" }] } }
+        const res = await this.apiCall('GET', '/wallets');
+        const wallets = res.data;
+        const now = new Date().toISOString();
+        const balances = [];
+        for (const wallet of wallets) {
+            const available = wallet.balances ?? [];
+            for (const bal of available) {
+                if (bal.currency === 'USD') {
+                    balances.push({
+                        provider: 'circle',
+                        asset: 'USDC',
+                        network: 'ETH', // Circle aggregates across chains for USD balance
+                        balanceCents: toCents(parseFloat(bal.amount)),
+                        lastUpdated: now,
+                    });
+                }
+            }
+        }
+        return balances;
+    }
+    async apiCall(method, path, body) {
+        // Implementation: raw HTTPS (no SDK — zero dependency principle)
+        // Headers:
+        //   Authorization: Bearer {this.apiKey}
+        //   Content-Type: application/json
+        //   Accept: application/json
+        // Sanitize response strings per §9.19.16 before returning
+        throw new Error('HTTP implementation — use node:https, no SDK dependencies');
+    }
+}
+// ── Status Mapping ──────────────────────────────────
+function mapCircleStatus(circleStatus) {
+    switch (circleStatus) {
+        case 'pending': return 'pending';
+        case 'processing': return 'processing';
+        case 'complete': return 'completed';
+        case 'failed': return 'failed';
+        default: return 'pending';
+    }
+}
+export { toCents, toDollars, computeTransferHash, mapCircleStatus, CircleAdapter };

package/dist/wizard/lib/prd-validator.d.ts

@@ -0,0 +1,39 @@
+/**
+ * PRD Structural Validator — Troi's compliance checks.
+ *
+ * Validates that a PRD document has the expected sections and
+ * cross-references based on its frontmatter configuration.
+ * Produces warnings (not errors) — the user can proceed with gaps.
+ *
+ * PRD Reference: RFC-blueprint-path.md
+ */
+import type { PrdFrontmatter } from './frontmatter.js';
+export interface ValidationResult {
+    errors: string[];
+    warnings: string[];
+    sections: string[];
+    valid: boolean;
+}
+/**
+ * Extract all markdown heading sections from PRD content.
+ * Returns lowercase heading text for case-insensitive matching.
+ */
+export declare function extractSections(content: string): string[];
+/**
+ * Validate PRD structure against frontmatter configuration.
+ *
+ * Rules (warnings, not blockers):
+ * - PRD must have an OVERVIEW or SUMMARY section
+ * - PRD must have at least one feature section
+ * - If database is configured, should have DATA MODELS section
+ * - If deploy target is set, should have DEPLOYMENT section
+ * - If auth is enabled, should mention authentication
+ * - If workers are enabled, should define background workers
+ * - If payments are configured, should have a payments/billing section
+ */
+export declare function validatePrdStructure(content: string, frontmatter: PrdFrontmatter): ValidationResult;
+/**
+ * Run conflict scan between frontmatter fields.
+ * Checks for contradictions that cost hours if caught late.
+ */
+export declare function scanConflicts(frontmatter: PrdFrontmatter): string[];

package/dist/wizard/lib/prd-validator.js

@@ -0,0 +1,137 @@
+/**
+ * PRD Structural Validator — Troi's compliance checks.
+ *
+ * Validates that a PRD document has the expected sections and
+ * cross-references based on its frontmatter configuration.
+ * Produces warnings (not errors) — the user can proceed with gaps.
+ *
+ * PRD Reference: RFC-blueprint-path.md
+ */
+// ── Section Detection ───────────────────────────────
+/**
+ * Extract all markdown heading sections from PRD content.
+ * Returns lowercase heading text for case-insensitive matching.
+ */
+export function extractSections(content) {
+    const headingPattern = /^#{1,3}\s+(.+)$/gm;
+    const sections = [];
+    let match;
+    while ((match = headingPattern.exec(content)) !== null) {
+        sections.push(match[1].trim().toLowerCase());
+    }
+    return sections;
+}
+/**
+ * Check if any section heading contains a given keyword.
+ */
+function hasSection(sections, keyword) {
+    const lower = keyword.toLowerCase();
+    return sections.some(s => s.includes(lower));
+}
+// ── Structural Validation ───────────────────────────
+/**
+ * Validate PRD structure against frontmatter configuration.
+ *
+ * Rules (warnings, not blockers):
+ * - PRD must have an OVERVIEW or SUMMARY section
+ * - PRD must have at least one feature section
+ * - If database is configured, should have DATA MODELS section
+ * - If deploy target is set, should have DEPLOYMENT section
+ * - If auth is enabled, should mention authentication
+ * - If workers are enabled, should define background workers
+ * - If payments are configured, should have a payments/billing section
+ */
+export function validatePrdStructure(content, frontmatter) {
+    const sections = extractSections(content);
+    const errors = [];
+    const warnings = [];
+    const contentLower = content.toLowerCase();
+    // Required: Overview or Summary section
+    if (!hasSection(sections, 'overview') && !hasSection(sections, 'summary') && !hasSection(sections, 'introduction')) {
+        warnings.push('Missing OVERVIEW or SUMMARY section — add a high-level description of the product');
+    }
+    // Required: At least one feature section
+    if (!hasSection(sections, 'feature') && !hasSection(sections, 'core') && !hasSection(sections, 'functionality')) {
+        warnings.push('No feature sections found — add sections describing what the product does');
+    }
+    // Conditional: Database → Data Models
+    if (frontmatter.database && frontmatter.database !== 'no' && frontmatter.database !== 'none') {
+        if (!hasSection(sections, 'data model') && !hasSection(sections, 'schema') && !hasSection(sections, 'database')) {
+            warnings.push(`Database "${frontmatter.database}" configured but no DATA MODELS or SCHEMA section found`);
+        }
+    }
+    // Conditional: Deploy → Deployment section
+    if (frontmatter.deploy && frontmatter.deploy !== 'no' && frontmatter.deploy !== 'none') {
+        if (!hasSection(sections, 'deploy') && !hasSection(sections, 'infrastructure') && !hasSection(sections, 'hosting')) {
+            warnings.push(`Deploy target "${frontmatter.deploy}" configured but no DEPLOYMENT section found`);
+        }
+    }
+    // Conditional: Auth → Authentication mentioned
+    if (frontmatter.auth && frontmatter.auth !== 'no' && frontmatter.auth !== 'none' && frontmatter.auth !== 'false') {
+        if (!contentLower.includes('auth') && !contentLower.includes('login') && !contentLower.includes('sign in')) {
+            warnings.push('Auth is enabled but PRD does not mention authentication, login, or sign-in');
+        }
+    }
+    // Conditional: Workers → Background jobs defined
+    if (frontmatter.workers && frontmatter.workers !== 'no' && frontmatter.workers !== 'none' && frontmatter.workers !== 'false') {
+        if (!contentLower.includes('worker') && !contentLower.includes('background') && !contentLower.includes('queue') && !contentLower.includes('cron')) {
+            warnings.push('Workers enabled but PRD does not mention workers, background jobs, queues, or cron');
+        }
+    }
+    // Conditional: Payments → Billing section
+    if (frontmatter.payments && frontmatter.payments !== 'no' && frontmatter.payments !== 'none' && frontmatter.payments !== 'false') {
+        if (!contentLower.includes('payment') && !contentLower.includes('billing') && !contentLower.includes('subscription') && !contentLower.includes('pricing')) {
+            warnings.push(`Payments "${frontmatter.payments}" configured but PRD does not mention payments, billing, or pricing`);
+        }
+    }
+    // Conditional: Email → Email section or mentions
+    if (frontmatter.email && frontmatter.email !== 'no' && frontmatter.email !== 'none' && frontmatter.email !== 'false') {
+        if (!contentLower.includes('email') && !contentLower.includes('notification') && !contentLower.includes('mail')) {
+            warnings.push(`Email "${frontmatter.email}" configured but PRD does not mention email or notifications`);
+        }
+    }
+    return {
+        errors,
+        warnings,
+        sections,
+        valid: errors.length === 0,
+    };
+}
+/**
+ * Run conflict scan between frontmatter fields.
+ * Checks for contradictions that cost hours if caught late.
+ */
+export function scanConflicts(frontmatter) {
+    const conflicts = [];
+    // Auth + Database: auth usually needs a database
+    if (frontmatter.auth && frontmatter.auth !== 'no' && frontmatter.auth !== 'none') {
+        if (!frontmatter.database || frontmatter.database === 'none') {
+            conflicts.push('Auth is enabled but no database configured — auth needs persistent storage for users/sessions');
+        }
+    }
+    // Payments + Auth: payments need auth
+    if (frontmatter.payments && frontmatter.payments !== 'no' && frontmatter.payments !== 'none') {
+        if (!frontmatter.auth || frontmatter.auth === 'no' || frontmatter.auth === 'none') {
+            conflicts.push('Payments configured but auth is disabled — payments require authenticated users');
+        }
+    }
+    // Workers + Deploy: workers need persistent hosting
+    if (frontmatter.workers && frontmatter.workers !== 'no' && frontmatter.workers !== 'none' && frontmatter.workers !== 'false') {
+        if (frontmatter.deploy === 'static' || frontmatter.deploy === 'cloudflare') {
+            conflicts.push(`Workers enabled but deploy target "${frontmatter.deploy}" does not support background processes`);
+        }
+    }
+    // Cache + Deploy: Redis needs a host
+    if (frontmatter.cache && frontmatter.cache !== 'none' && frontmatter.cache !== 'no') {
+        if (frontmatter.deploy === 'static' || frontmatter.deploy === 'cloudflare') {
+            conflicts.push(`Cache "${frontmatter.cache}" configured but deploy target "${frontmatter.deploy}" does not support cache services`);
+        }
+    }
+    // Admin + Auth: admin panel needs auth
+    if (frontmatter.admin && frontmatter.admin !== 'no' && frontmatter.admin !== 'none' && frontmatter.admin !== 'false') {
+        if (!frontmatter.auth || frontmatter.auth === 'no' || frontmatter.auth === 'none') {
+            conflicts.push('Admin panel enabled but auth is disabled — admin requires authenticated access');
+        }
+    }
+    return conflicts;
+}

package/dist/wizard/lib/project-init.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Project creation — headless and browser init flows.
+ *
+ * Creates a new VoidForge project by copying methodology files,
+ * injecting project identity, writing the marker, and registering.
+ */
+import { type VoidForgeMarker } from './marker.js';
+export interface ProjectConfig {
+    name: string;
+    directory: string;
+    oneliner?: string;
+    domain?: string;
+    repoUrl?: string;
+    tier?: VoidForgeMarker['tier'];
+    extensions?: string[];
+    core?: boolean;
+    skipGit?: boolean;
+}
+export interface ProjectResult {
+    projectDir: string;
+    markerId: string;
+    filesCreated: number;
+}
+export declare function createProject(config: ProjectConfig): Promise<ProjectResult>;