@better-openclaw/core 1.0.23 → 1.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-openclaw/core",
-  "version": "1.0.23",
+  "version": "1.0.24",
   "private": false,
   "description": "Core logic for better-openclaw: schemas, service registry, resolver, composer, validators and generators",
   "author": "bidew.io <bachir@bidew.io>",

package/src/__snapshots__/composer.snapshot.test.ts.snap

@@ -63,10 +63,39 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
       retries: 5
       start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       minio:
         condition: service_healthy
       redis:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   minio:
     image: minio/minio:RELEASE.2025-04-22T22-12-26Z
     environment:
@@ -146,9 +175,11 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
     depends_on:
       - openclaw-gateway
 volumes:
+  convex-data:
   ffmpeg-shared:
   minio-data:
   redis-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge
@@ -246,12 +277,41 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
       retries: 5
       start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       postgresql:
         condition: service_healthy
       redis:
         condition: service_healthy
       n8n:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   postgresql:
     image: postgres:17-alpine
     environment:
@@ -403,11 +463,13 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
     depends_on:
       - openclaw-gateway
 volumes:
+  convex-data:
   grafana-data:
   n8n-data:
   postgres-data:
   prometheus-data:
   redis-data:
+  tailscale-state:
   uptime-kuma-data:
 networks:
   openclaw-network:
@@ -580,6 +642,8 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
         condition: service_healthy
       caddy:
         condition: service_healthy
+      convex:
+        condition: service_healthy
       meilisearch:
         condition: service_healthy
       minio:
@@ -631,6 +695,33 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
     restart: unless-stopped
     networks:
       - openclaw-network
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   meilisearch:
     image: getmeili/meilisearch:v1.35.1
     environment:
@@ -861,6 +952,7 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
 volumes:
   caddy-config:
   caddy-data:
+  convex-data:
   ffmpeg-shared:
   gotify-data:
   grafana-data:
@@ -873,6 +965,7 @@ volumes:
   qdrant-data:
   redis-data:
   searxng-data:
+  tailscale-state:
   uptime-kuma-data:
 networks:
   openclaw-network:
@@ -935,8 +1028,37 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
       retries: 5
       start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       redis:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   redis:
     image: redis:8-alpine
     environment:
@@ -994,7 +1116,9 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
     depends_on:
       - openclaw-gateway
 volumes:
+  convex-data:
   redis-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge
@@ -1065,6 +1189,8 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
     depends_on:
       browserless:
         condition: service_healthy
+      convex:
+        condition: service_healthy
       qdrant:
         condition: service_healthy
       redis:
@@ -1089,6 +1215,33 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
     restart: unless-stopped
     networks:
       - openclaw-network
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   qdrant:
     image: qdrant/qdrant:v1.12.1
     environment:
@@ -1182,9 +1335,11 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
     depends_on:
       - openclaw-gateway
 volumes:
+  convex-data:
   qdrant-data:
   redis-data:
   searxng-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge

package/src/bare-metal-partition.test.ts

@@ -25,9 +25,10 @@ describe("bare-metal partition", () => {
 		});
 		const result = partitionBareMetal(resolved, "linux/amd64");
 		expect(result.nativeIds.has("redis")).toBe(true);
-		expect(result.nativeServices.length).toBe(1);
-		expect(result.nativeServices[0].definition.id).toBe("redis");
-		expect(result.dockerOnlyServices.length).toBe(0);
+		const redisNative = result.nativeServices.find((s) => s.definition.id === "redis");
+		expect(redisNative).toBeDefined();
+		// Mandatory services (convex, mission-control, tailscale) are Docker-only
+		expect(result.dockerOnlyServices.length).toBeGreaterThanOrEqual(0);
 	});
 
 	it("partitions n8n as Docker-only (no native recipe)", () => {

package/src/composer.test.ts

@@ -38,8 +38,10 @@ describe("compose", () => {
 		// Should have CLI companion service
 		expect(parsed.services).toHaveProperty("openclaw-cli");
 
-		// Gateway should have no depends_on (no companions)
-		expect(parsed.services["openclaw-gateway"]).not.toHaveProperty("depends_on");
+		// Gateway should have depends_on for mandatory services (convex, mission-control, tailscale)
+		// Even with no user-selected services, mandatory services are always present
+		expect(parsed.services).toHaveProperty("convex");
+		expect(parsed.services).toHaveProperty("mission-control");
 
 		// Gateway should have restart policy
 		expect(parsed.services["openclaw-gateway"].restart).toBe("unless-stopped");

package/src/composer.ts

@@ -50,6 +50,7 @@ const CATEGORY_PROFILE_MAP: Partial<Record<ServiceCategory, { file: string; prof
 	"social-media": { file: "docker-compose.social.yml", profile: "social" },
 	knowledge: { file: "docker-compose.knowledge.yml", profile: "knowledge" },
 	communication: { file: "docker-compose.communication.yml", profile: "communication" },
+	"saas-boilerplate": { file: "docker-compose.saas.yml", profile: "saas" },
 };
 
 const YAML_OPTIONS = { lineWidth: 120, nullStr: "" };
@@ -230,7 +231,25 @@ function buildCompanionService(
 	const svc: Record<string, unknown> = {};
 	const volumeNames: string[] = [];
 
-	svc.image = `${def.image}:${def.imageTag}`;
+	// Git-based services use build: context; image-based services use image:
+	if (def.gitSource && def.buildContext) {
+		const subdir = def.gitSource.subdirectory || ".";
+		const ctxPath = def.buildContext.context || ".";
+		const contextFull = subdir === "." ? `./repos/${def.id}/${ctxPath}` : `./repos/${def.id}/${subdir}/${ctxPath}`;
+		const buildBlock: Record<string, unknown> = { context: contextFull };
+		if (def.buildContext.dockerfile) {
+			buildBlock.dockerfile = def.buildContext.dockerfile;
+		}
+		if (def.buildContext.args && Object.keys(def.buildContext.args).length > 0) {
+			buildBlock.args = def.buildContext.args;
+		}
+		if (def.buildContext.target) {
+			buildBlock.target = def.buildContext.target;
+		}
+		svc.build = buildBlock;
+	} else {
+		svc.image = `${def.image}:${def.imageTag}`;
+	}
 
 	if (def.environment.length > 0) {
 		const env: Record<string, string> = {};

package/src/generate.test.ts

@@ -187,7 +187,8 @@ describe("generate (end-to-end)", () => {
 		for (const id of lasuiteMeetServices) {
 			expect(allServiceIds.has(id), `missing service ${id}`).toBe(true);
 		}
-		expect(result.metadata.serviceCount).toBe(lasuiteMeetServices.length);
+		// Service count includes user services + mandatory platform services (convex, mission-control, tailscale)
+		expect(result.metadata.serviceCount).toBeGreaterThanOrEqual(lasuiteMeetServices.length);
 	});
 
 	it("generates bare-metal installer for Windows (install.ps1)", () => {

package/src/generate.ts

@@ -7,6 +7,7 @@ import { composeMultiFile } from "./composer.js";
 import { StackConfigError, ValidationError } from "./errors.js";
 import { generateBareMetalInstall } from "./generators/bare-metal-install.js";
 import { generateCaddyfile } from "./generators/caddy.js";
+import { generateCloneScripts } from "./generators/clone-repos.js";
 import { generateCloudInit } from "./generators/cloud-init.js";
 import { generateEnvFiles } from "./generators/env.js";
 import { generateGsdScripts } from "./generators/get-shit-done.js";
@@ -149,6 +150,7 @@ export function generate(rawInput: GenerationInput): GenerationResult {
 		".env.*.local",
 		"*.log",
 		"docker-compose.override.yml",
+		"repos/",
 	].join("\n");
 
 	// Stack manifest (consumed by Mission Control)
@@ -181,11 +183,18 @@ export function generate(rawInput: GenerationInput): GenerationResult {
 	});
 
 	// Scripts
-	const scripts = generateScripts();
+	const hasGitServices = resolvedForCompose.services.some((s) => s.definition.gitSource);
+	const scripts = generateScripts({ hasGitServices });
 	for (const [path, content] of Object.entries(scripts)) {
 		files[path] = content;
 	}
 
+	// Clone scripts for git-based services (SaaS boilerplates)
+	const cloneScripts = generateCloneScripts(resolvedForCompose);
+	for (const [path, content] of Object.entries(cloneScripts)) {
+		files[path] = content;
+	}
+
 	// Health check scripts (dynamic, stack-specific)
 	const healthCheckFiles = generateHealthCheck(resolved, {
 		projectName: input.projectName,

package/src/generators/clone-repos.test.ts

@@ -0,0 +1,154 @@
+import { describe, expect, it } from "vitest";
+import { generateCloneScripts } from "./clone-repos.js";
+import type { ResolverOutput } from "../types.js";
+
+/** Minimal resolved output with no services */
+function emptyResolved(): ResolverOutput {
+	return {
+		services: [],
+		addedDependencies: [],
+		removedConflicts: [],
+		warnings: [],
+		errors: [],
+		isValid: true,
+		estimatedMemoryMB: 0,
+		aiProviders: [],
+		gsdRuntimes: [],
+	};
+}
+
+/** Create a resolved output with image-based services only */
+function imageOnlyResolved(): ResolverOutput {
+	return {
+		...emptyResolved(),
+		services: [
+			{
+				definition: {
+					id: "redis",
+					name: "Redis",
+					description: "In-memory cache",
+					category: "database",
+					icon: "🔴",
+					image: "redis",
+					imageTag: "7-alpine",
+					ports: [],
+					volumes: [],
+					environment: [],
+					dependsOn: [],
+					restartPolicy: "unless-stopped",
+					networks: ["openclaw-network"],
+					skills: [],
+					openclawEnvVars: [],
+					docsUrl: "https://redis.io",
+					tags: [],
+					maturity: "stable",
+					requires: [],
+					recommends: [],
+					conflictsWith: [],
+					gpuRequired: false,
+				},
+				addedBy: "user",
+			},
+		],
+	};
+}
+
+/** Create a resolved output with a git-based service */
+function gitServiceResolved(): ResolverOutput {
+	return {
+		...emptyResolved(),
+		services: [
+			{
+				definition: {
+					id: "open-saas",
+					name: "Open SaaS",
+					description: "SaaS boilerplate",
+					category: "saas-boilerplate",
+					icon: "🚀",
+					gitSource: {
+						repoUrl: "https://github.com/wasp-lang/open-saas.git",
+						branch: "main",
+						subdirectory: "template",
+						postCloneCommands: ["cp .env.example .env"],
+					},
+					buildContext: {
+						dockerfile: "Dockerfile",
+						context: ".",
+					},
+					ports: [{ host: 3100, container: 3000, description: "Web app", exposed: true }],
+					volumes: [],
+					environment: [],
+					dependsOn: [],
+					restartPolicy: "unless-stopped",
+					networks: ["openclaw-network"],
+					skills: [],
+					openclawEnvVars: [],
+					docsUrl: "https://opensaas.sh/docs",
+					tags: [],
+					maturity: "beta",
+					requires: [],
+					recommends: [],
+					conflictsWith: [],
+					gpuRequired: false,
+				},
+				addedBy: "user",
+			},
+		],
+	};
+}
+
+describe("generateCloneScripts", () => {
+	it("returns empty object when no git-based services exist", () => {
+		const result = generateCloneScripts(emptyResolved());
+		expect(result).toEqual({});
+	});
+
+	it("returns empty object when only image-based services exist", () => {
+		const result = generateCloneScripts(imageOnlyResolved());
+		expect(result).toEqual({});
+	});
+
+	it("generates bash and PowerShell scripts for git-based services", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		expect(Object.keys(result)).toHaveLength(2);
+		expect(result).toHaveProperty("scripts/clone-repos.sh");
+		expect(result).toHaveProperty("scripts/clone-repos.ps1");
+	});
+
+	it("bash script contains clone command with repo URL", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("https://github.com/wasp-lang/open-saas.git");
+		expect(bash).toContain('"open-saas"');
+		expect(bash).toContain('"main"');
+	});
+
+	it("bash script includes postCloneCommands", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("cp .env.example .env");
+	});
+
+	it("bash script includes git check and idempotency logic", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("command -v git");
+		expect(bash).toContain("clone_or_update");
+		expect(bash).toContain("pull --ff-only");
+		expect(bash).toContain("git clone --depth 1");
+	});
+
+	it("PowerShell script contains clone command with repo URL", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const ps = result["scripts/clone-repos.ps1"];
+		expect(ps).toContain("https://github.com/wasp-lang/open-saas.git");
+		expect(ps).toContain('"open-saas"');
+		expect(ps).toContain("Clone-OrUpdate");
+	});
+
+	it("bash script is executable (starts with shebang)", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toMatch(/^#!/);
+	});
+});

package/src/generators/clone-repos.ts

@@ -0,0 +1,159 @@
+import type { ResolverOutput } from "../types.js";
+
+/**
+ * Generates clone scripts for git-based services (SaaS boilerplates).
+ * Returns empty object if no git-based services exist in the resolved stack.
+ */
+export function generateCloneScripts(resolved: ResolverOutput): Record<string, string> {
+	const gitServices = resolved.services.filter(
+		(s) => s.definition.gitSource && s.definition.buildContext,
+	);
+
+	if (gitServices.length === 0) return {};
+
+	const files: Record<string, string> = {};
+
+	// ── scripts/clone-repos.sh ─────────────────────────────────────────────
+
+	const bashEntries = gitServices
+		.map((s) => {
+			const gs = s.definition.gitSource!;
+			const branchArg = gs.branch ? `"${gs.branch}"` : '""';
+			let block = `clone_or_update "${s.definition.id}" "${gs.repoUrl}" ${branchArg}`;
+			if (gs.postCloneCommands && gs.postCloneCommands.length > 0) {
+				const cmds = gs.postCloneCommands
+					.map((cmd) => `  (cd "$REPOS_DIR/${s.definition.id}${gs.subdirectory ? `/${gs.subdirectory}` : ""}" && ${cmd})`)
+					.join("\n");
+				block += `\n${cmds}`;
+			}
+			return block;
+		})
+		.join("\n\n");
+
+	files["scripts/clone-repos.sh"] = `#!/usr/bin/env bash
+set -euo pipefail
+
+# ─── Clone/Update Git-Based Service Repositories ────────────────────────────
+# Idempotent: clones if missing, pulls if already present.
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+REPOS_DIR="$PROJECT_DIR/repos"
+
+# ── Colour helpers ──────────────────────────────────────────────────────────
+if [ -t 1 ]; then
+  GREEN='\\033[0;32m'; YELLOW='\\033[1;33m'; CYAN='\\033[0;36m'; RED='\\033[0;31m'; NC='\\033[0m'
+else
+  GREEN=''; YELLOW=''; CYAN=''; RED=''; NC=''
+fi
+info()  { echo -e "\${CYAN}i  $*\${NC}"; }
+ok()    { echo -e "\${GREEN}✓  $*\${NC}"; }
+warn()  { echo -e "\${YELLOW}⚠  $*\${NC}"; }
+err()   { echo -e "\${RED}✗  $*\${NC}" >&2; }
+
+# ── Check git ───────────────────────────────────────────────────────────────
+if ! command -v git &> /dev/null; then
+  err "git is not installed. Please install git first."
+  exit 1
+fi
+
+mkdir -p "$REPOS_DIR"
+
+clone_or_update() {
+  local name="$1" url="$2" branch="\${3:-}"
+  local dir="$REPOS_DIR/$name"
+
+  if [ -d "$dir/.git" ]; then
+    info "Updating $name..."
+    git -C "$dir" pull --ff-only 2>/dev/null || warn "Could not fast-forward $name (you may have local changes)"
+  else
+    info "Cloning $name..."
+    if [ -n "$branch" ]; then
+      git clone --depth 1 --branch "$branch" "$url" "$dir"
+    else
+      git clone --depth 1 "$url" "$dir"
+    fi
+  fi
+}
+
+echo ""
+info "Cloning/updating SaaS boilerplate repositories..."
+echo ""
+
+${bashEntries}
+
+echo ""
+ok "All repositories ready."
+`;
+
+	// ── scripts/clone-repos.ps1 ────────────────────────────────────────────
+
+	const psEntries = gitServices
+		.map((s) => {
+			const gs = s.definition.gitSource!;
+			const branchArg = gs.branch ? ` -Branch "${gs.branch}"` : "";
+			let block = `Clone-OrUpdate -Name "${s.definition.id}" -Url "${gs.repoUrl}"${branchArg}`;
+			if (gs.postCloneCommands && gs.postCloneCommands.length > 0) {
+				const subdir = gs.subdirectory ? `/${gs.subdirectory}` : "";
+				const cmds = gs.postCloneCommands
+					.map((cmd) => `Push-Location "$ReposDir/${s.definition.id}${subdir}"; ${cmd}; Pop-Location`)
+					.join("\n");
+				block += `\n${cmds}`;
+			}
+			return block;
+		})
+		.join("\n\n");
+
+	files["scripts/clone-repos.ps1"] = `#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Clone/update git-based service repositories.
+  Idempotent: clones if missing, pulls if already present.
+#>
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$ProjectDir = Split-Path -Parent $ScriptDir
+$ReposDir = Join-Path $ProjectDir "repos"
+
+if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
+    Write-Error "git is not installed. Please install git first."
+    exit 1
+}
+
+if (-not (Test-Path $ReposDir)) { New-Item -ItemType Directory -Path $ReposDir -Force | Out-Null }
+
+function Clone-OrUpdate {
+    param(
+        [string]$Name,
+        [string]$Url,
+        [string]$Branch = ""
+    )
+    $dir = Join-Path $ReposDir $Name
+
+    if (Test-Path (Join-Path $dir ".git")) {
+        Write-Host "  Updating $Name..." -ForegroundColor Cyan
+        git -C $dir pull --ff-only 2>$null
+        if ($LASTEXITCODE -ne 0) { Write-Warning "Could not fast-forward $Name" }
+    } else {
+        Write-Host "  Cloning $Name..." -ForegroundColor Cyan
+        if ($Branch) {
+            git clone --depth 1 --branch $Branch $Url $dir
+        } else {
+            git clone --depth 1 $Url $dir
+        }
+    }
+}
+
+Write-Host ""
+Write-Host "Cloning/updating SaaS boilerplate repositories..." -ForegroundColor Cyan
+Write-Host ""
+
+${psEntries}
+
+Write-Host ""
+Write-Host "All repositories ready." -ForegroundColor Green
+`;
+
+	return files;
+}