@alashi/cli 0.8.0 → 0.9.0

package/assets/v1/chat.js

@@ -1,4 +1,4 @@
-/* alashi chat component v1
+/* alashi chat + markdown components v1
  *
  * The system chat UI, served by the host. Apps drop in:
  *
@@ -9,6 +9,10 @@
  * and cost display. Renders into light DOM using system.css classes, so it
  * inherits the app's theme tokens.
  *
+ * The same script also registers <alashi-markdown>, the markdown renderer on
+ * its own for apps that display prose outside a conversation (see the bottom
+ * of this file). One renderer, one place formatting bugs get fixed.
+ *
  * Attributes:
  *   app            app name (default: derived from /app/<name>/ in the URL)
  *   placeholder    input placeholder text
@@ -31,7 +35,8 @@
  * Breaking changes ship as /assets/v2/chat.js. */
 
 (() => {
-  if (customElements.get('alashi-chat')) return;
+  // Loading the script twice is a no-op for every element it defines.
+  if (customElements.get('alashi-chat') || customElements.get('alashi-markdown')) return;
 
   const escapeHtml = (s) =>
     s
@@ -357,5 +362,40 @@
     }
   }
 
+  /* <alashi-markdown> — the same renderMarkdown() as chat bubbles, as a
+   * standalone display primitive. No fetching, no SSE, no conversations.
+   *
+   *   <alashi-markdown text="**hi**"></alashi-markdown>   // static markup
+   *   node.text = card.description;                       // re-renders
+   *
+   * The `text` property is the primary path: apps pass model-derived,
+   * multi-line strings that do not belong in an attribute. Renders into light
+   * DOM (like _setMsgText) so it inherits the app's theme tokens, and carries
+   * the `markdown` class so system.css can style its children. */
+  class AlashiMarkdown extends HTMLElement {
+    connectedCallback() {
+      this.classList.add('markdown');
+      // A property set before connect wins; the attribute is the static path.
+      if (this._text === undefined) this._text = this.getAttribute('text') ?? '';
+      this._render();
+    }
+
+    get text() {
+      return this._text ?? '';
+    }
+
+    set text(value) {
+      this._text = String(value ?? '');
+      this._render();
+    }
+
+    _render() {
+      // Escape-first pipeline: renderMarkdown escapes before rebuilding a
+      // known-safe subset of tags, so untrusted markdown stays inert.
+      this.innerHTML = renderMarkdown(String(this._text ?? ''));
+    }
+  }
+
   customElements.define('alashi-chat', AlashiChat);
+  customElements.define('alashi-markdown', AlashiMarkdown);
 })();

package/assets/v1/system.css

@@ -578,41 +578,39 @@ input[type="checkbox"] {
   /* assistant bubbles hold rendered markdown (chat.js), not preformatted text */
   white-space: normal;
 }
-.msg.assistant p,
-.msg.assistant ul,
-.msg.assistant ol,
-.msg.assistant pre,
-.msg.assistant h3,
-.msg.assistant h4,
-.msg.assistant h5,
-.msg.assistant h6 {
+/* Rendered-markdown prose. Shared by assistant chat bubbles and the
+ * <alashi-markdown> element (or any `.markdown` container) — chat.js renders
+ * both with the same renderMarkdown(), so the styling lives in one place too.
+ * Headings stay h3..h6 because that is what renderMarkdown emits. */
+alashi-markdown {
+  /* unknown element to CSS, same as <alashi-chat> in consumer apps */
+  display: block;
+}
+:is(.msg.assistant, alashi-markdown, .markdown) :is(p, ul, ol, pre, h3, h4, h5, h6) {
   margin: 0 0 0.6rem;
 }
-.msg.assistant > :last-child {
+:is(.msg.assistant, alashi-markdown, .markdown) > :last-child {
   margin-bottom: 0;
 }
-.msg.assistant ul,
-.msg.assistant ol {
+:is(.msg.assistant, alashi-markdown, .markdown) :is(ul, ol) {
   padding-left: 1.3rem;
 }
-.msg.assistant li {
+:is(.msg.assistant, alashi-markdown, .markdown) li {
   margin: 0.15rem 0;
 }
-.msg.assistant img {
+:is(.msg.assistant, alashi-markdown, .markdown) img {
   max-width: 100%;
   border-radius: var(--radius-sm);
   border: 1px solid var(--border);
 }
-.msg.assistant pre {
+:is(.msg.assistant, alashi-markdown, .markdown) pre {
   background: var(--panel);
   padding: 0.6rem 0.75rem;
 }
-.msg.assistant h3 {
+:is(.msg.assistant, alashi-markdown, .markdown) h3 {
   font-size: 1rem;
 }
-.msg.assistant h4,
-.msg.assistant h5,
-.msg.assistant h6 {
+:is(.msg.assistant, alashi-markdown, .markdown) :is(h4, h5, h6) {
   font-size: 0.92rem;
 }
 .msg.assistant.pending {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alashi/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "alashi host: install, manage, and run Claude Code-powered apps",
   "type": "module",
   "license": "MIT",
@@ -29,14 +29,14 @@
     "templates"
   ],
   "dependencies": {
-    "@alashi/apps-sdk": "^0.5.0",
+    "@alashi/apps-sdk": "^0.6.0",
     "@hono/node-server": "^2.1.1",
     "commander": "^14.0.0",
     "croner": "^10.0.1",
     "hono": "^4.13.2",
     "semver": "^7.8.5",
     "zod": "^4.4.3",
-    "@alashi/provider-claude": "^0.2.0"
+    "@alashi/provider-claude": "^0.2.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",

package/templates/basic-app/AGENTS.md

@@ -29,13 +29,22 @@ Beside the manifest: `routes` (fetch-style `(Request, ctx) => Response`) and
 `jobHandlers` (`{ [name]: (ctx) => Promise<void> }`).
 
 Known gap: `onInstall`/`onUpdate` exist in the SDK but the host never calls
-them — create DB schema lazily (`CREATE TABLE IF NOT EXISTS` on first open).
+them — so nothing runs at install time and the app owns its own schema. Schema
+lives in ordered `.sql` files in `migrations/` (`001-init.sql`,
+`002-add-....sql`), applied by `runMigrations(db, join(import.meta.dirname,
+'migrations'))` every time the DB is opened. It is forward-only and tracked in
+`PRAGMA user_version`: a schema change is **a new numbered file**, never an
+edit to one that has already been applied, and there are no down-migrations.
+Statements that cannot run inside a transaction — notably
+`PRAGMA journal_mode = WAL` — must not live in a migration file; set those on
+the connection before calling `runMigrations`.
 
 ## Runtime surface (`ctx`)
 
 - `ctx.dataDir` — the **only** writable directory. SQLite DB and files go
   here (`node:sqlite` `DatabaseSync`). Treat the repo itself as read-only at
-  runtime.
+  runtime — the DB lives in `ctx.dataDir`, but the `migrations/` files that
+  shape it are code and are read from the app repo (`import.meta.dirname`).
 - `ctx.config` — merged config (readonly).
 - `ctx.state` — small key/value store; `ctx.logger` — log here, not console.
 - `ctx.ai.createSession()` — an agent session, pre-scoped by the host
@@ -64,6 +73,10 @@ them — create DB schema lazily (`CREATE TABLE IF NOT EXISTS` on first open).
   with `openConversation`/`adoptSession`). Methods: `adoptSession(sessionId, title?)`,
   `openConversation(id)`, `newChat()`. Bubbling events: `alashi-chat:turn`
   (`{ok, costUsd, error, conversationId}`), `alashi-chat:conversation`.
+  The same script also registers `<alashi-markdown>` — the host's markdown
+  renderer as a standalone display primitive, for prose outside a conversation
+  (`node.text = card.description` re-renders on assignment; `text="**hi**"` is
+  honoured on connect for static markup). No fetching, no conversation logic.
   Never vendor or fork system UI; breaking changes ship as `/assets/v2/`.
 
 ## App routes
@@ -75,7 +88,8 @@ them — create DB schema lazily (`CREATE TABLE IF NOT EXISTS` on first open).
 
 - Never `innerHTML` external or model-derived data in the UI — build DOM via
   the `el()` helper / `textContent`. Markdown rendering belongs to
-  `<alashi-chat>`, which is escape-first.
+  `<alashi-chat>` / `<alashi-markdown>`, the sanctioned exception because the
+  host's renderer is escape-first. Never bundle a markdown library.
 - Validate at boundaries (webhooks, user input): JSON only, cap body sizes,
   4xx on garbage. Model output is a boundary too — parse defensively.
 - Secrets come from declared `config` keys (`secret: true`), referenced as

package/templates/basic-app/README.md

@@ -18,6 +18,7 @@ your changes are live.
 | File | What it is |
 |---|---|
 | `index.mjs` | The app: manifest, API routes, job handlers |
+| `migrations/` | Ordered `.sql` files — the DB schema, applied at DB open |
 | `ui/index.html` | The web UI, served at `/app/__APP_NAME__/` |
 | `AGENTS.md` | The platform contract, written for coding agents working in this repo |
 
@@ -27,7 +28,12 @@ your `routes` handler, so you can also server-render pages.
 ## What the app gets
 
 - **`ctx.dataDir`** — the only writable directory; put your SQLite DB and
-  files here (the template creates `app.db` on first request)
+  files here (the template opens `app.db` there on first request and applies
+  `migrations/` to it)
+- **`migrations/`** — the schema, as ordered `.sql` files applied by
+  `runMigrations` at DB open: forward-only, tracked in `PRAGMA user_version`.
+  To change the schema, add the next numbered file (`002-...sql`) — never edit
+  one that has already run
 - **`ctx.state`** — small key/value store (`state.json`)
 - **`ctx.config`** — `configDefaults` merged with the user's per-app config
 - **`ctx.ai`** — AI sessions through the host; the Chat page uses the host's

package/templates/basic-app/index.mjs

@@ -1,12 +1,12 @@
 import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-import { defineApp } from '@alashi/apps-sdk';
+import { defineApp, runMigrations } from '@alashi/apps-sdk';
 
 export default defineApp({
   name: '__APP_NAME__',
   version: '0.1.0',
   description: 'An alashi app',
-  sdkVersion: '^0.5.0',
+  sdkVersion: '^0.6.0',
   ui: 'ui',
   configDefaults: {
     greeting: 'What should we work on?',
@@ -27,11 +27,12 @@ export default defineApp({
   routes: (ctx) => {
     // The app's own SQLite database, living in its data dir.
     const db = new DatabaseSync(join(ctx.dataDir, 'app.db'));
-    db.exec(`CREATE TABLE IF NOT EXISTS notes (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      text TEXT NOT NULL,
-      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
-    )`);
+    // Schema comes from the ordered .sql files in this repo's migrations/
+    // (not ctx.dataDir), applied forward-only at DB open. A schema change
+    // ships as a new numbered file — never as an edit to an applied one.
+    // Pragmas that cannot run inside a transaction (journal_mode) go here,
+    // before the call, not into a migration file.
+    runMigrations(db, join(import.meta.dirname, 'migrations'), { logger: ctx.logger });
 
     return async (req) => {
       const url = new URL(req.url);

package/templates/basic-app/migrations/001-init.sql

@@ -0,0 +1,7 @@
+-- Applied once, then never touched again. Schema changes ship as a new
+-- numbered file (002-..., 003-...), never as an edit to this one.
+CREATE TABLE notes (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  text TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+);

package/templates/basic-app/package.json

@@ -4,6 +4,6 @@
   "type": "module",
   "main": "index.mjs",
   "dependencies": {
-    "@alashi/apps-sdk": "^0.5.0"
+    "@alashi/apps-sdk": "^0.6.0"
   }
 }