feat(cli): add thread message stack

[miguel-heygen]

What

Adds the thread-message-stack registry block together with the CLI machinery it needs: a bounded caller-payload validator that materializes the block at install time, an OAuth-only install gate, a resumable install intent that survives the browser round-trip, and a privacy-safe funnel that spans catalog, auth, install, preview, and render.

Supersedes the closed mirror attempt in #3035.

Why

Every existing registry block ships fixed content, so hyperframes add only ever had to copy files. This block's content comes from the caller, which opens three holes the current add path cannot cover:

1. No way to prove which upstream catalog artifact and version an installed copy came from.
2. No way to refuse an install that is backed only by an API key, where a real account session is required.
3. No way to finish an install that was interrupted mid-flow while the user completed OAuth in a browser, without either losing the intent or replaying it twice.

The block is the vehicle. The install path is the actual change.

How

• Materialization is one function. packages/cli/src/registry/threadMessageStack.ts validates the entire payload before touching a file: at most 100 messages, text at most 8192 chars, sender at most 256, side restricted to incoming / outgoing, and stagger / hold finite numbers in 0 to 60. Only then does it rewrite the single data-hf-primitive-data island in the block HTML. Validate-then-mutate means a rejected payload can never leave a half-written file behind.
• Install authorization is its own boundary. threadMessageStackAuthorization.ts requires a persisted OAuth credential and verifies it against the current-user endpoint. Environment and file API keys deliberately do not satisfy it, and the outcome is a closed set (authorized / api-key-only / cancelled / failed) so callers cannot treat an ambiguous result as success.
• Install intent is durable and claimed once. commands/catalog-resume.ts persists a versioned record (item, artifact, version, funnel and install ids, status) through an atomic temp-file plus rename, with an explicit claim, so an install interrupted by the OAuth round-trip resumes exactly once instead of zero or twice.
• Telemetry has a single side-effect contract. telemetry/primitive-funnel*.ts owns the lifecycle events. Discovery works fully anonymously, and the funnel context is persisted under .hyperframes/ so preview and render stay stitched to the same funnel after the user authenticates.
• Provenance rides in the registry item. The registry-item schemas (docs/schema/registry-item.json, packages/core/schemas/registry-item.json) gain the upstream artifact and version fields, and the resolver validates the recorded source digest, so an installed copy is traceable to an immutable upstream projection.
• Preview generation covers the new block. scripts/generate-catalog-previews.ts and scripts/catalog-preview-temp.ts extended so the block is rendered by the same pipeline as every other catalog entry.

Test plan

• 134 focused tests covering validation, authorization, resume, funnel, and the registry item, including a real installer to Studio preview to producer compile chain that produces a deterministic 8-frame MP4.

• Full CLI suite at the reviewed head: 2,498 passed, 2 skipped.

• Catalog preview scripts: 2 passed.

• npx hyperframes lint and npx hyperframes check on the installed temp project: clean, zero runtime errors.

• CLI and core typechecks, schema sync, changed-file oxlint / oxfmt, fallow audit, CLI build.

• CI at this head: 61 successful checks, 1 expected Mintlify skip.

• Known and unchanged: aggregate registry lint still reports 38 pre-existing failures across older blocks. The new block passes with 0 warnings.

• Unit tests added/updated

• Manual testing performed (the end-to-end installer, preview, and render path is exercised in-suite rather than by hand)

• Documentation updated (if applicable) - registry-item schemas

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
hyperframes	🟢 Ready	View Preview	Aug 5, 2026, 4:46 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.