anhedral 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -6,6 +6,41 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## Unreleased
 
+## 0.4.1 - 2026-07-22
+
+### Added
+
+- Add the public launch artwork, reusable stack-map renderer, and expanded brand asset library to the repository and published package.
+
+### Changed
+
+- Present Anhedral as a cross-platform, modular product stack that lets teams build once, ship everywhere, and scale without repeating framework setup.
+- Automatically create patch versions for ordinary changes merged to `main`, while preserving explicitly declared minor and major releases.
+- Keep project upgrades compatible across automatic patch releases and retain the supported 0.3-to-0.4 ownership migration.
+- Publish from the exact generated release commit and attach npm provenance now that the source repository is public.
+
+## 0.4.0 - 2026-07-22
+
+### Added
+
+- Add the `electron-updater` feature module, including packaged-app update checks, private R2 storage, a read-only bound Cloudflare Worker on a custom domain, ordered architecture-specific publishing commands, and a complete generated release runbook.
+- Make the `anhedral-init` coding-agent skill the recommended setup path, with project/domain intake, Computer Use and subagent orchestration, provider provisioning order, authentication and secret-generation stops, and verified Cloudflare/Vercel domain handoffs.
+- Add the canonical fixed-width master stack map to the published documentation and route the coding-agent skill through it for whole-platform planning and explanation.
+- Add a transactional project-upgrade path so compatible 0.3 projects can adopt 0.4 without regeneration.
+- Add a focused default development loop for the primary web and API surfaces, with `dev:all` available for intentionally launching every selected client.
+
+### Changed
+
+- Make generated onboarding follow the real environment, managed-Neon, verification, and framework source layout instead of promising an unconfigured one-command boot.
+- Treat developer extension points as user-owned source while retaining conflict protection for generated wiring and mergeable workspace configuration.
+- Publish the skill's provisioning references from their canonical `docs/references` location and validate every packed local documentation link.
+- Upgrade GitHub artifact transfer actions to their Node.js 24-native releases and keep manual npm publication routed through the trusted-publisher workflow identity.
+
+### Fixed
+
+- Canonicalize module ordering when an incremental feature contributes a previously absent dependency.
+- Attach release integrity metadata beside the npm tarball in GitHub Releases.
+
 ## 0.3.0 - 2026-07-21
 
 ### Added

package/CONTRIBUTING.md

@@ -67,4 +67,7 @@ Scheduled Toolchain Drift failures and release-workflow failures must alert the
 
 Do not run `npm publish` from a development checkout. Version changes are reviewed before release, and CI publishes the verified tarball. See [docs/RELEASING.md](docs/RELEASING.md).
 
-This repository and package are proprietary. Public availability of an npm artifact does not grant permission to install or run it. Contributor and customer rights, including rights in generated output, come only from a separate written agreement with Anhedral, Inc.
+This repository and package are licensed under the Apache License 2.0. Unless
+explicitly stated otherwise, contributions intentionally submitted for
+inclusion in Anhedral are provided under the same license, as described in
+Section 5 of [LICENSE](LICENSE).

package/LICENSE

@@ -1,26 +1,201 @@
-Copyright (c) 2026 Anhedral, Inc.
-
-All Rights Reserved.
-
-The contents of this project are proprietary and confidential.
-Unauthorized use, copying, modification, distribution, transfer, or
-reproduction of this project, in whole or in part and by any medium,
-is strictly prohibited except under a separate written agreement with
-Anhedral, Inc.
-
-Receipt or possession of the source code or any portion of it does not
-convey or imply a license or any right to use it beyond the purpose for
-which Anhedral, Inc. provided it.
-
-Public availability of package metadata, documentation, source code, or a
-downloadable package artifact does not constitute an offer, license, or
-authorization to install or execute the software. Installation, execution,
-and any rights to use, modify, own, deploy, or distribute output generated by
-the software require a separate written agreement with Anhedral, Inc. Nothing
-in this notice expands the rights granted by such an agreement.
-
-The software is provided "AS IS", without warranty of any kind, express
-or implied, including but not limited to the warranties of merchantability,
-fitness for a particular purpose, and noninfringement. In no event shall
-Anhedral, Inc. or its contributors be liable for any claim, damages, or
-other liability arising from, out of, or in connection with the software.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Anhedral, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -5,22 +5,59 @@
 
 Anhedral generates a complete, production-oriented TypeScript stack whose source code stays understandable and customizable.
 
-> **Three-second version:** Start with the full TypeScript stack. Keep every escape hatch.
+> **Build once. Ship everywhere. Scale is built in.** Pick the platforms,
+> frameworks, and features your product needs; Anhedral assembles them into a
+> production-ready TypeScript workspace for web, iOS, Android, desktop, APIs,
+> and browser extensions. Start free, skip months of repetitive setup and
+> integration work, and focus on what makes your app unique.
+
+![Anhedral Init Stack architecture diagram](assets/anhedral-cli-init.svg)
 
 Anhedral is not a new programming language and generated applications do not run inside a proprietary application framework. It assembles well-documented tools, connects their difficult integration boundaries, and leaves developers with ordinary Next.js, Expo Router, Fastify, Drizzle, Electron, and WXT projects.
 
-> **Proprietary software:** Public visibility of package metadata, documentation, or an npm artifact does not grant permission to install, execute, copy, modify, or distribute Anhedral. Installation and use are limited to parties covered by a separate written agreement with Anhedral, Inc. Rights in projects generated by Anhedral are also governed by that agreement.
+Anhedral is open source under the [Apache License 2.0](LICENSE). You may use,
+modify, and distribute it subject to that license, including its notice and
+redistribution requirements. Generated applications remain ordinary project
+source that their developers can customize and license for their products.
+
+## Recommended: use the coding-agent skill
+
+Install the Anhedral skill for Codex, Claude Code, or another compatible coding
+agent:
+
+```sh
+pnpm dlx skills add https://github.com/anhedral/anhedral-init --skill anhedral-init
+```
+
+Choose the agent and global or project scope when prompted. Then ask the agent:
+
+```text
+Use $anhedral-init to create and provision my application.
+```
+
+The skill begins by asking for the project name and whether you already own a
+custom domain. It selects the CLI command with you, detects Computer Use and
+subagent support, generates the project, and walks through the selected cloud
+providers. It pauses for sign-in, MFA, payments, secret generation, and final
+release submissions. Paste secrets directly into the instructed uncommitted
+`.env` file or protected provider field—never into chat.
 
-## Create an application
+## Create an application directly
 
 Create the complete stack:
 
 ```sh
 pnpm dlx anhedral@latest new my-product
 cd my-product
-pnpm dev
 ```
 
+The generated `README.md` contains the exact next steps for the selected stack.
+For the complete stack, copy the package-local environment examples, configure
+the selected managed providers—including a Neon `DATABASE_URL`—and create the
+reviewed initial migration before running `pnpm dev`. Anhedral intentionally
+does not generate a local Postgres substitute or pretend that production
+provider credentials already exist.
+
 With no module flags, `new` includes every supported application surface and backend capability. Generate a focused stack by naming only what the product needs:
 
 ```sh
@@ -45,10 +82,11 @@ my-product/
 ├── apps/
 │   ├── web/                    # Next.js App Router + source-owned shadcn/ui
 │   ├── mobile/                 # Expo Router + React Native Reusables
-│   ├── api/                    # Fastify routes, services, auth, providers
+│   ├── api/                    # Fastify routes, backend modules, auth, providers
 │   ├── desktop/                # Electron + React
 │   ├── extension/              # WXT browser extension
-│   └── assets-private-proxy/   # Cloudflare Worker for private R2 delivery
+│   ├── assets-private-proxy/   # Cloudflare Worker for private asset delivery
+│   └── desktop-updater-worker/ # private R2 Electron update delivery
 ├── packages/
 │   ├── contracts/              # shared Zod network contracts
 │   ├── api-client/             # typed client used by every frontend
@@ -80,7 +118,7 @@ export default function ProjectsPage() {
 ```
 
 ```ts
-// packages/contracts/src/projects.ts
+// packages/contracts/src/app.ts
 import { z } from 'zod';
 
 export const ProjectSchema = z.object({ id: z.string(), name: z.string() });
@@ -88,13 +126,24 @@ export const ProjectListSchema = z.array(ProjectSchema);
 ```
 
 ```ts
-// apps/api/src/routes/projects.ts
+// packages/db/src/app-schema.ts
+import { pgTable, text } from 'drizzle-orm/pg-core';
+
+export const projects = pgTable('projects', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+});
+```
+
+```ts
+// apps/api/src/routes/app.ts
+import type { FastifyPluginAsync } from 'fastify';
 import { db } from '@shared/db';
 import { projects } from '@shared/db/schema';
 
-export async function listProjects() {
-  return db.select().from(projects);
-}
+export const appRoutes: FastifyPluginAsync = async (app) => {
+  app.get('/projects', async () => db.select().from(projects));
+};
 ```
 
 The convention is a conventional vertical flow, not an Anhedral DSL:
@@ -105,8 +154,8 @@ contracts -> database/service -> Fastify route -> typed API client -> frontend
 
 - Write web product code under `apps/web` using Next.js conventions.
 - Write mobile product code under `apps/mobile` using Expo Router conventions.
-- Write backend routes and services under `apps/api` using Fastify conventions.
-- Write tables and queries under `packages/db` using Drizzle conventions.
+- Register product routes in `apps/api/src/routes/app.ts` and add server-only feature modules under `apps/api/src` using Fastify conventions.
+- Write product tables in `packages/db/src/app-schema.ts` and queries under `packages/db` using Drizzle conventions.
 - Share only network contracts and client-safe packages with frontends.
 - Import the underlying framework directly whenever its API is the right tool.
 
@@ -121,8 +170,9 @@ contracts -> database/service -> Fastify route -> typed API client -> frontend
 | Authentication | Clerk | Connected frontend and backend identity/session flows |
 | UI | shadcn/ui + React Native Reusables | Accessible source code the application owns |
 | Storage | private Cloudflare R2 | Signed uploads and controlled asset delivery |
-| Billing/realtime | RevenueCat + Ably | Durable entitlements and client invalidation |
+| Billing/realtime | RevenueCat + Stripe + Ably | Unified billing entitlements and realtime invalidation |
 | Desktop | Electron | Predictable cross-platform TypeScript desktop runtime |
+| Desktop updates | electron-updater + private R2 + Worker | Signed automatic updates through a product-owned custom domain |
 | Extension | WXT | Browser-extension entrypoints, builds, and packaging |
 | Workspace | pnpm + Turborepo | Strict dependencies and dependency-aware tasks |
 
@@ -135,6 +185,7 @@ anhedral new <directory> [modules...]    Generate a new readable workspace
 anhedral init [modules...]               Generate in the current empty directory
 anhedral add <module...>                 Add connected stack capabilities
 anhedral ui add <component...>           Add source-owned UI components
+anhedral upgrade                         Transactionally upgrade a supported project
 anhedral doctor                          Check ownership and generator drift
 ```
 
@@ -143,8 +194,10 @@ Useful examples:
 ```sh
 anhedral add storage --dry-run
 anhedral add desktop extension
+anhedral add electron-updater
 anhedral ui add button dialog
 anhedral ui add data-table --target web --dry-run
+anhedral upgrade --dry-run
 anhedral doctor --json
 ```
 
@@ -154,6 +207,7 @@ Application lifecycle commands remain visible in the generated root `package.jso
 
 ```sh
 pnpm dev
+pnpm dev:all
 pnpm dev:web
 pnpm dev:api
 pnpm typecheck
@@ -163,7 +217,11 @@ pnpm db:generate
 pnpm db:migrate
 ```
 
-Only commands relevant to selected modules are generated.
+`pnpm dev` starts the primary product loop: the first selected client plus the
+API when present, or the API by itself for backend-only projects. In the full
+stack that means web plus API. `pnpm dev:all` appears only when the project has
+additional surfaces and intentionally starts all of them. Only commands
+relevant to selected modules are generated.
 
 ## Extensibility and ownership
 
@@ -182,6 +240,8 @@ anhedral doctor
 anhedral add <module> --dry-run
 ```
 
+When `doctor` reports that a project was generated by a supported older release, run `anhedral upgrade --dry-run`, inspect the plan, and then run `anhedral upgrade`. Version 0.4 supports transactional upgrades from 0.3 projects while preserving user-owned extension seams. If a 0.3 project changed a file that was generator-managed, the upgrade stops instead of overwriting it. Preserve the change in source control, restore that managed file to its recorded 0.3 content, run the upgrade, and then move the product behavior into the new user-owned `app.ts`, `app-schema.ts`, page, component, or `app-window.ts` seam.
+
 ## Documentation contract
 
 Every generated project teaches both humans and coding agents how to work in it:
@@ -194,6 +254,9 @@ Every generated project teaches both humans and coding agents how to work in it:
 
 The generator's exact output contract is documented in [docs/output-tree-contract.md](docs/output-tree-contract.md). Contributor architecture remains available in the [source repository](https://github.com/anhedral/anhedral-init/tree/main/docs/architecture).
 
+The complete lifecycle, runtime, cloud, command, and coding-agent topology is in
+the [Anhedral master stack map](docs/master-stack-map.md).
+
 ## Module dependency rules
 
 Anhedral resolves integrations as a deterministic graph:
@@ -203,6 +266,7 @@ auth                 -> api + db
 billing              -> auth
 storage              -> auth
 native-subscriptions -> mobile + billing
+electron-updater     -> desktop
 ```
 
 Adding a capability brings the infrastructure it actually requires. Unselected providers do not leave dead source files or environment placeholders behind.

package/SECURITY.md

@@ -15,7 +15,7 @@ Include the affected version, reproduction steps, impact, and any suggested miti
 - Release artifacts are built and tested in a read-only job.
 - The exact tarball uploaded by CI is the artifact submitted to npm.
 - npm integrity is checked before and after publication.
-- npm credentials are exposed only to the publish step in the protected `npm` environment.
+- npm publication uses Trusted Publishing: GitHub exchanges an OIDC identity for a short-lived credential only in the publish step of the protected `npm` environment. No npm write token is stored in GitHub.
 - A Git tag and GitHub release are created only after npm confirms the expected artifact integrity.
 - GitHub Actions are pinned to reviewed commit SHAs, and the release Node.js/npm packer is pinned to an exact version.
 - CI queries OSV for every exact package version in `pnpm-lock.yaml` and every dependency version shipped by the generator; it fails closed if the service remains unavailable after bounded retries or reports a finding.
@@ -32,4 +32,6 @@ UI component installation is an explicit networked supply-chain operation. Anhed
 
 If a secret-shaped finding is real, do not merely remove it from the latest commit. Revoke or rotate the credential first, identify every log, artifact, cache, fork, and package version that may contain it, and coordinate history or artifact cleanup with the security responder. Treat false positives by changing the example to an unmistakable placeholder; do not add broad path exclusions.
 
-Anhedral is proprietary software. Security reports and public package availability do not grant permission to install, execute, or test the software outside the reporter's written agreement with Anhedral, Inc.
+Anhedral is licensed under the Apache License 2.0. Security research must still
+comply with applicable law and the systems owner's authorization; the software
+license does not authorize testing infrastructure or accounts you do not own.