anhedral 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -6,6 +6,28 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## Unreleased
 
+## 0.4.0 - 2026-07-22
+
+### Added
+
+- Add the `electron-updater` feature module, including packaged-app update checks, private R2 storage, a read-only bound Cloudflare Worker on a custom domain, ordered architecture-specific publishing commands, and a complete generated release runbook.
+- Make the `anhedral-init` coding-agent skill the recommended setup path, with project/domain intake, Computer Use and subagent orchestration, provider provisioning order, authentication and secret-generation stops, and verified Cloudflare/Vercel domain handoffs.
+- Add the canonical fixed-width master stack map to the published documentation and route the coding-agent skill through it for whole-platform planning and explanation.
+- Add a transactional project-upgrade path so compatible 0.3 projects can adopt 0.4 without regeneration.
+- Add a focused default development loop for the primary web and API surfaces, with `dev:all` available for intentionally launching every selected client.
+
+### Changed
+
+- Make generated onboarding follow the real environment, managed-Neon, verification, and framework source layout instead of promising an unconfigured one-command boot.
+- Treat developer extension points as user-owned source while retaining conflict protection for generated wiring and mergeable workspace configuration.
+- Publish the skill's provisioning references from their canonical `docs/references` location and validate every packed local documentation link.
+- Upgrade GitHub artifact transfer actions to their Node.js 24-native releases and keep manual npm publication routed through the trusted-publisher workflow identity.
+
+### Fixed
+
+- Canonicalize module ordering when an incremental feature contributes a previously absent dependency.
+- Attach release integrity metadata beside the npm tarball in GitHub Releases.
+
 ## 0.3.0 - 2026-07-21
 
 ### Added

package/CONTRIBUTING.md

@@ -67,4 +67,7 @@ Scheduled Toolchain Drift failures and release-workflow failures must alert the
 
 Do not run `npm publish` from a development checkout. Version changes are reviewed before release, and CI publishes the verified tarball. See [docs/RELEASING.md](docs/RELEASING.md).
 
-This repository and package are proprietary. Public availability of an npm artifact does not grant permission to install or run it. Contributor and customer rights, including rights in generated output, come only from a separate written agreement with Anhedral, Inc.
+This repository and package are licensed under the Apache License 2.0. Unless
+explicitly stated otherwise, contributions intentionally submitted for
+inclusion in Anhedral are provided under the same license, as described in
+Section 5 of [LICENSE](LICENSE).

package/LICENSE

@@ -1,26 +1,201 @@
-Copyright (c) 2026 Anhedral, Inc.
-
-All Rights Reserved.
-
-The contents of this project are proprietary and confidential.
-Unauthorized use, copying, modification, distribution, transfer, or
-reproduction of this project, in whole or in part and by any medium,
-is strictly prohibited except under a separate written agreement with
-Anhedral, Inc.
-
-Receipt or possession of the source code or any portion of it does not
-convey or imply a license or any right to use it beyond the purpose for
-which Anhedral, Inc. provided it.
-
-Public availability of package metadata, documentation, source code, or a
-downloadable package artifact does not constitute an offer, license, or
-authorization to install or execute the software. Installation, execution,
-and any rights to use, modify, own, deploy, or distribute output generated by
-the software require a separate written agreement with Anhedral, Inc. Nothing
-in this notice expands the rights granted by such an agreement.
-
-The software is provided "AS IS", without warranty of any kind, express
-or implied, including but not limited to the warranties of merchantability,
-fitness for a particular purpose, and noninfringement. In no event shall
-Anhedral, Inc. or its contributors be liable for any claim, damages, or
-other liability arising from, out of, or in connection with the software.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Anhedral, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -9,18 +9,49 @@ Anhedral generates a complete, production-oriented TypeScript stack whose source
 
 Anhedral is not a new programming language and generated applications do not run inside a proprietary application framework. It assembles well-documented tools, connects their difficult integration boundaries, and leaves developers with ordinary Next.js, Expo Router, Fastify, Drizzle, Electron, and WXT projects.
 
-> **Proprietary software:** Public visibility of package metadata, documentation, or an npm artifact does not grant permission to install, execute, copy, modify, or distribute Anhedral. Installation and use are limited to parties covered by a separate written agreement with Anhedral, Inc. Rights in projects generated by Anhedral are also governed by that agreement.
+Anhedral is open source under the [Apache License 2.0](LICENSE). You may use,
+modify, and distribute it subject to that license, including its notice and
+redistribution requirements. Generated applications remain ordinary project
+source that their developers can customize and license for their products.
 
-## Create an application
+## Recommended: use the coding-agent skill
+
+Install the Anhedral skill for Codex, Claude Code, or another compatible coding
+agent:
+
+```sh
+pnpm dlx skills add https://github.com/anhedral/anhedral-init --skill anhedral-init
+```
+
+Choose the agent and global or project scope when prompted. Then ask the agent:
+
+```text
+Use $anhedral-init to create and provision my application.
+```
+
+The skill begins by asking for the project name and whether you already own a
+custom domain. It selects the CLI command with you, detects Computer Use and
+subagent support, generates the project, and walks through the selected cloud
+providers. It pauses for sign-in, MFA, payments, secret generation, and final
+release submissions. Paste secrets directly into the instructed uncommitted
+`.env` file or protected provider field—never into chat.
+
+## Create an application directly
 
 Create the complete stack:
 
 ```sh
 pnpm dlx anhedral@latest new my-product
 cd my-product
-pnpm dev
 ```
 
+The generated `README.md` contains the exact next steps for the selected stack.
+For the complete stack, copy the package-local environment examples, configure
+the selected managed providers—including a Neon `DATABASE_URL`—and create the
+reviewed initial migration before running `pnpm dev`. Anhedral intentionally
+does not generate a local Postgres substitute or pretend that production
+provider credentials already exist.
+
 With no module flags, `new` includes every supported application surface and backend capability. Generate a focused stack by naming only what the product needs:
 
 ```sh
@@ -45,10 +76,11 @@ my-product/
 ├── apps/
 │   ├── web/                    # Next.js App Router + source-owned shadcn/ui
 │   ├── mobile/                 # Expo Router + React Native Reusables
-│   ├── api/                    # Fastify routes, services, auth, providers
+│   ├── api/                    # Fastify routes, backend modules, auth, providers
 │   ├── desktop/                # Electron + React
 │   ├── extension/              # WXT browser extension
-│   └── assets-private-proxy/   # Cloudflare Worker for private R2 delivery
+│   ├── assets-private-proxy/   # Cloudflare Worker for private asset delivery
+│   └── desktop-updater-worker/ # private R2 Electron update delivery
 ├── packages/
 │   ├── contracts/              # shared Zod network contracts
 │   ├── api-client/             # typed client used by every frontend
@@ -80,7 +112,7 @@ export default function ProjectsPage() {
 ```
 
 ```ts
-// packages/contracts/src/projects.ts
+// packages/contracts/src/app.ts
 import { z } from 'zod';
 
 export const ProjectSchema = z.object({ id: z.string(), name: z.string() });
@@ -88,13 +120,24 @@ export const ProjectListSchema = z.array(ProjectSchema);
 ```
 
 ```ts
-// apps/api/src/routes/projects.ts
+// packages/db/src/app-schema.ts
+import { pgTable, text } from 'drizzle-orm/pg-core';
+
+export const projects = pgTable('projects', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+});
+```
+
+```ts
+// apps/api/src/routes/app.ts
+import type { FastifyPluginAsync } from 'fastify';
 import { db } from '@shared/db';
 import { projects } from '@shared/db/schema';
 
-export async function listProjects() {
-  return db.select().from(projects);
-}
+export const appRoutes: FastifyPluginAsync = async (app) => {
+  app.get('/projects', async () => db.select().from(projects));
+};
 ```
 
 The convention is a conventional vertical flow, not an Anhedral DSL:
@@ -105,8 +148,8 @@ contracts -> database/service -> Fastify route -> typed API client -> frontend
 
 - Write web product code under `apps/web` using Next.js conventions.
 - Write mobile product code under `apps/mobile` using Expo Router conventions.
-- Write backend routes and services under `apps/api` using Fastify conventions.
-- Write tables and queries under `packages/db` using Drizzle conventions.
+- Register product routes in `apps/api/src/routes/app.ts` and add server-only feature modules under `apps/api/src` using Fastify conventions.
+- Write product tables in `packages/db/src/app-schema.ts` and queries under `packages/db` using Drizzle conventions.
 - Share only network contracts and client-safe packages with frontends.
 - Import the underlying framework directly whenever its API is the right tool.
 
@@ -123,6 +166,7 @@ contracts -> database/service -> Fastify route -> typed API client -> frontend
 | Storage | private Cloudflare R2 | Signed uploads and controlled asset delivery |
 | Billing/realtime | RevenueCat + Ably | Durable entitlements and client invalidation |
 | Desktop | Electron | Predictable cross-platform TypeScript desktop runtime |
+| Desktop updates | electron-updater + private R2 + Worker | Signed automatic updates through a product-owned custom domain |
 | Extension | WXT | Browser-extension entrypoints, builds, and packaging |
 | Workspace | pnpm + Turborepo | Strict dependencies and dependency-aware tasks |
 
@@ -135,6 +179,7 @@ anhedral new <directory> [modules...]    Generate a new readable workspace
 anhedral init [modules...]               Generate in the current empty directory
 anhedral add <module...>                 Add connected stack capabilities
 anhedral ui add <component...>           Add source-owned UI components
+anhedral upgrade                         Transactionally upgrade a supported project
 anhedral doctor                          Check ownership and generator drift
 ```
 
@@ -143,8 +188,10 @@ Useful examples:
 ```sh
 anhedral add storage --dry-run
 anhedral add desktop extension
+anhedral add electron-updater
 anhedral ui add button dialog
 anhedral ui add data-table --target web --dry-run
+anhedral upgrade --dry-run
 anhedral doctor --json
 ```
 
@@ -154,6 +201,7 @@ Application lifecycle commands remain visible in the generated root `package.jso
 
 ```sh
 pnpm dev
+pnpm dev:all
 pnpm dev:web
 pnpm dev:api
 pnpm typecheck
@@ -163,7 +211,11 @@ pnpm db:generate
 pnpm db:migrate
 ```
 
-Only commands relevant to selected modules are generated.
+`pnpm dev` starts the primary product loop: the first selected client plus the
+API when present, or the API by itself for backend-only projects. In the full
+stack that means web plus API. `pnpm dev:all` appears only when the project has
+additional surfaces and intentionally starts all of them. Only commands
+relevant to selected modules are generated.
 
 ## Extensibility and ownership
 
@@ -182,6 +234,8 @@ anhedral doctor
 anhedral add <module> --dry-run
 ```
 
+When `doctor` reports that a project was generated by a supported older release, run `anhedral upgrade --dry-run`, inspect the plan, and then run `anhedral upgrade`. Version 0.4 supports transactional upgrades from 0.3 projects while preserving user-owned extension seams. If a 0.3 project changed a file that was generator-managed, the upgrade stops instead of overwriting it. Preserve the change in source control, restore that managed file to its recorded 0.3 content, run the upgrade, and then move the product behavior into the new user-owned `app.ts`, `app-schema.ts`, page, component, or `app-window.ts` seam.
+
 ## Documentation contract
 
 Every generated project teaches both humans and coding agents how to work in it:
@@ -194,6 +248,9 @@ Every generated project teaches both humans and coding agents how to work in it:
 
 The generator's exact output contract is documented in [docs/output-tree-contract.md](docs/output-tree-contract.md). Contributor architecture remains available in the [source repository](https://github.com/anhedral/anhedral-init/tree/main/docs/architecture).
 
+The complete lifecycle, runtime, cloud, command, and coding-agent topology is in
+the [Anhedral master stack map](docs/master-stack-map.md).
+
 ## Module dependency rules
 
 Anhedral resolves integrations as a deterministic graph:
@@ -203,6 +260,7 @@ auth                 -> api + db
 billing              -> auth
 storage              -> auth
 native-subscriptions -> mobile + billing
+electron-updater     -> desktop
 ```
 
 Adding a capability brings the infrastructure it actually requires. Unselected providers do not leave dead source files or environment placeholders behind.

package/SECURITY.md

@@ -15,7 +15,7 @@ Include the affected version, reproduction steps, impact, and any suggested miti
 - Release artifacts are built and tested in a read-only job.
 - The exact tarball uploaded by CI is the artifact submitted to npm.
 - npm integrity is checked before and after publication.
-- npm credentials are exposed only to the publish step in the protected `npm` environment.
+- npm publication uses Trusted Publishing: GitHub exchanges an OIDC identity for a short-lived credential only in the publish step of the protected `npm` environment. No npm write token is stored in GitHub.
 - A Git tag and GitHub release are created only after npm confirms the expected artifact integrity.
 - GitHub Actions are pinned to reviewed commit SHAs, and the release Node.js/npm packer is pinned to an exact version.
 - CI queries OSV for every exact package version in `pnpm-lock.yaml` and every dependency version shipped by the generator; it fails closed if the service remains unavailable after bounded retries or reports a finding.
@@ -32,4 +32,6 @@ UI component installation is an explicit networked supply-chain operation. Anhed
 
 If a secret-shaped finding is real, do not merely remove it from the latest commit. Revoke or rotate the credential first, identify every log, artifact, cache, fork, and package version that may contain it, and coordinate history or artifact cleanup with the security responder. Treat false positives by changing the example to an unmistakable placeholder; do not add broad path exclusions.
 
-Anhedral is proprietary software. Security reports and public package availability do not grant permission to install, execute, or test the software outside the reporter's written agreement with Anhedral, Inc.
+Anhedral is licensed under the Apache License 2.0. Security research must still
+comply with applicable law and the systems owner's authorization; the software
+license does not authorize testing infrastructure or accounts you do not own.

package/SKILL.md

@@ -1,18 +1,22 @@
 ---
 name: anhedral-init
-description: Create, extend, explain, or diagnose complete Anhedral-generated TypeScript stacks. Use for new/init/add/ui/doctor; ordinary Next.js, Expo, Fastify, Drizzle/Neon, Clerk, R2, Electron, or WXT development inside a generated workspace; interpreting anhedral.json ownership; reproducing the scaffold manually; or verifying generated applications.
+description: Guide a user through creating, provisioning, extending, explaining, or diagnosing a complete Anhedral TypeScript stack. Use for skill-led new/init/add/ui/doctor workflows; Computer Use or subagent-assisted cloud setup; domains, DNS, Vercel, Cloudflare, Neon, Clerk, R2, billing, stores, and Electron updates; development inside a generated workspace; ownership interpretation; manual reproduction; or verification.
 ---
 
 # Anhedral Init
 
 Anhedral is a stack generator, not an application runtime or programming language. Generated projects use ordinary framework source and expose the complete integration code. Do not invent Anhedral-specific models, routes, queries, components, or client hooks when the selected framework already has a documented convention.
 
+For every new project or provisioning request, begin by asking for the project
+name and whether the user already owns a custom domain for it. Do not run init
+or create provider resources until those answers establish canonical names.
+
 Use Node.js 20.19+ or 22.12+ and pnpm. `new` creates a destination directory; `init` works in an empty current directory where `.git`, `.gitignore`, and `.DS_Store` are allowed.
 
 ## Choose the construction path
 
 - Use the manual path whenever the user asks to avoid the Anhedral CLI, the CLI is unavailable, or the task requires explaining/reproducing the scaffold itself.
-- Before creating or changing files manually, read [references/manual-scaffolding.md](references/manual-scaffolding.md) completely and follow its ordered procedure. Treat it as the canonical manual checklist, including its source-file matrix and feature gates.
+- Before creating or changing files manually, read [docs/references/manual-scaffolding.md](docs/references/manual-scaffolding.md) completely and follow its ordered procedure. Treat it as the canonical manual checklist, including its source-file matrix and feature gates.
 - Use the CLI path only when the user permits it. Do not silently substitute `anhedral init`, `anhedral add`, imported generator code, or a generated demo for the manual path.
 - For an exact-version scaffold inside the Anhedral source repository, render from the current `src/templates/*.ts`, `src/scaffold.ts`, and `src/dependencies.ts`; do not copy stale demo output. Outside that repository, implement the behavior and file contract in the manual reference and pin a mutually compatible toolchain.
 
@@ -22,7 +26,7 @@ The manual path must leave a complete working workspace, not merely a directory
 
 Choose app surfaces from `web`, `mobile`, `api`, `desktop`, and `extension`.
 
-Choose backend features from `db`, `auth`, `billing`, `storage`, and `native-subscriptions`.
+Choose features from `db`, `auth`, `billing`, `storage`, `native-subscriptions`, and `electron-updater`.
 
 Apply these dependency rules automatically:
 
@@ -31,10 +35,58 @@ auth                 -> api + db
 billing              -> auth
 storage              -> auth
 native-subscriptions -> mobile + billing
+electron-updater     -> desktop
 ```
 
 With no module flags, generate the full stack.
 
+## Master stack map
+
+Read [docs/master-stack-map.md](docs/master-stack-map.md) completely before
+explaining the whole platform, selecting modules for a complete product, or
+planning cross-provider provisioning. Treat it as the canonical map of the
+stack, command surface, runtime connections, agent workflow, and release path.
+
+```text
+project + domain intake
+          |
+          v
+1 select + plan -> 2 generate safely -> 3 one pnpm/Turborepo workspace
+                                              |
+                                              v
+4 connected product capabilities -> 5 provision cloud + DNS
+                                              |
+                                              v
+6 generated package.json commands -> 7 developer/agent/Computer Use
+                                              |
+                                              v
+                               8 verify, release, and operate
+```
+
+Use the full fixed-width ASCII map from the document when the user asks for the
+master stack map. Do not redraw it from memory or omit unselected modules when
+describing Anhedral's complete capability surface; mark modules as selected or
+unselected separately.
+
+## Run the guided init workflow
+
+Read [docs/references/provisioning.md](docs/references/provisioning.md) completely before
+starting a new project or provisioning any provider. Follow its intake,
+capability discovery, Computer Use, subagent, authentication, secret-handling,
+domain, provider-order, and verification gates.
+
+The lead agent must:
+
+1. Ask for project name and existing/custom-domain status first.
+2. Discover whether Computer Use/browser control and subagents are available.
+3. Resolve modules and show the user canonical project/resource names.
+4. Run the explicit CLI command, then read the generated `PRODUCTION.md`.
+5. Provision only selected providers, pausing for sign-in, MFA, secret
+   generation, purchases, and final submissions exactly as the reference says.
+6. Keep secrets out of chat and tool output; have the user paste them directly
+   into uncommitted environment files and protected provider fields.
+7. Verify code, cloud resources, DNS, TLS, and provider health before handoff.
+
 ## Initialize
 
 ```sh
@@ -74,23 +126,27 @@ Use the native source conventions:
 
 - Next.js code belongs in `apps/web/app`, `apps/web/components`, and `apps/web/lib`.
 - Expo Router code belongs in `apps/mobile/app` and `apps/mobile/components`.
-- Fastify routes and server-only services belong in `apps/api/src/routes` and `apps/api/src/services`.
-- Shared Zod network schemas belong in `packages/contracts/src`.
-- Client-safe HTTP methods belong in `packages/api-client/src`.
-- Drizzle schema and queries belong in `packages/db`; generate and review SQL migrations.
+- Product Fastify route registration belongs in `apps/api/src/routes/app.ts`. Server-only feature modules live alongside the managed integrations in `apps/api/src`.
+- Product Zod network schemas belong in `packages/contracts/src/app.ts`.
+- Product client-safe HTTP methods belong in `packages/api-client/src/app.ts`.
+- Product Drizzle tables belong in `packages/db/src/app-schema.ts`; generate and review SQL migrations.
 
 Implement an end-to-end feature as `contracts -> database/service -> route -> API client -> frontend`. Frontends may import contracts and client-safe packages, never API services, database connections, or server environments. This stack uses managed Neon and intentionally has no local Postgres service.
 
 ## Add modules safely
 
-Run `add` only from a project containing `anhedral.json` schema v5:
+Run `add` only from a project containing `anhedral.json` schema v5 at the current generator version. If `doctor` identifies a supported older generator, preview and apply its transactional upgrade first:
 
 ```sh
+pnpm dlx anhedral@latest upgrade --dry-run
+pnpm dlx anhedral@latest upgrade
 pnpm dlx anhedral@latest add desktop extension
 pnpm dlx anhedral@latest add storage --dry-run
 ```
 
-Use `--dry-run` before a consequential add. Use `--json` when another program needs the plan; JSON failures include a stable `code` and a human-readable `error`. Use `--verbose` for interactive child-command diagnostics. Do not bypass ownership conflicts: Anhedral intentionally refuses modified managed files, user-owned files, symlinks, and unowned collisions.
+Use `--dry-run` before a consequential add. Use `--json` when another program needs the plan; JSON failures include a stable `code` and a human-readable `error`. Use `--verbose` for interactive child-command diagnostics. Anhedral preserves recorded user-owned extension files and intentionally refuses modified managed files, symlinks, and unowned collisions; do not bypass those conflicts.
+
+For a 0.3 upgrade blocked by a modified managed file, preserve the change in source control, restore that file to its recorded 0.3 content, apply the upgrade, and port the product behavior into the corresponding 0.4 user-owned extension seam. Never approve the upgrade by rewriting manifest hashes.
 
 Require the manifest generator version to match the running CLI. Regenerate projects created by another version; do not add compatibility branches.
 
@@ -145,10 +201,16 @@ Common selected keys are:
 - Ably billing synchronization: server-only `ABLY_API_KEY`; clients obtain scoped tokens from the API
 - R2: `BASE_URL`, `R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`, `R2_PREFIX=storage`, `R2_PROXY_READ_URL_TTL_SECONDS=600`; keep `CLOUDFLARE_API_TOKEN` operations/CI-only
 - Internal billing/storage jobs: high-entropy server-only `CRON_SECRET`
+- Electron updates: `DESKTOP_UPDATE_BASE_URL` in `apps/desktop/electron-builder.env`; the private R2 binding needs no credential in the packaged application
 
 Never commit real `.env` files. Keep `ANHEDRAL_DEMO=false` in production.
 
-Run only scripts present for installed modules. Typical commands include `dev:web`, `dev:mobile`, `dev:api`, `dev:desktop`, `dev:extension`, corresponding `verify:*` scripts, and database scripts for `db` projects.
+Run only scripts present for installed modules. `pnpm dev` starts the primary
+product loop—web plus API when web is selected, otherwise the first selected
+surface. A multi-surface project also exposes `pnpm dev:all`; use it only when
+the user wants every selected development server. Typical focused commands
+include `dev:web`, `dev:mobile`, `dev:api`, `dev:desktop`, `dev:extension`,
+corresponding `verify:*` scripts, and database scripts for `db` projects.
 
 ## Understand deployment
 
@@ -158,6 +220,11 @@ For billing, keep Neon authoritative: RevenueCat reconciliation writes the subsc
 
 Use `apps/mobile` for EAS, `pnpm desktop:build` for a current-host Electron artifact, matching platform-specific desktop scripts in CI, and `pnpm extension:zip` for the WXT archive.
 
+For `electron-updater`, provision the generated private R2 bucket and
+`desktop-updater` Worker at `updates.<domain>`. Keep the Worker custom domain and
+`DESKTOP_UPDATE_BASE_URL` identical. Build signed artifacts on each native
+platform and publish artifacts before mutable channel metadata.
+
 For storage, generate `apps/assets-private-proxy` plus `cloudflare/r2-cors.template.json` and keep the R2 bucket private. The Worker must be named `assets-private-proxy`, bind the normalized `<project>-assets` bucket as `ASSETS`, disable `workers.dev`, and own `assets.<domain>` as a Worker Custom Domain. Presigned uploads continue on the R2 S3 API hostname. Root every key below `R2_PREFIX=storage`; expose only `storage/confirmed/` through the Worker and reject staging plus `generation-inputs`. Authenticated private reads must verify upload ownership and return a presigned GET URL bounded by `R2_PROXY_READ_URL_TTL_SECONDS`.
 
 When explaining domains, distinguish DNS delegation from registrar transfer. A GoDaddy registration can use Cloudflare authoritative nameservers immediately; transferring registration/billing to Cloudflare Registrar is optional and subject to eligibility locks. Keep Vercel app/API A or CNAME records DNS-only in Cloudflare, while Worker Custom Domains stay Cloudflare-managed and proxied.
@@ -174,4 +241,4 @@ pnpm build
 
 Use `pnpm --filter ./apps/api test` when the API exists. If verification fails, report the exact package and command rather than replacing generated ownership records manually.
 
-For exact representative trees, consult `docs/output-tree-contract.md` in the Anhedral repository. During manual construction, also compare the finished workspace with the file matrix in [references/manual-scaffolding.md](references/manual-scaffolding.md); every selected conditional file must exist and every unselected provider integration must be absent.
+For exact representative trees, consult `docs/output-tree-contract.md` in the Anhedral repository. During manual construction, also compare the finished workspace with the file matrix in [docs/references/manual-scaffolding.md](docs/references/manual-scaffolding.md); every selected conditional file must exist and every unselected provider integration must be absent.