cronus-ui 0.6.1 → 0.6.2

package/README.md

@@ -49,7 +49,7 @@ Notes that match the commander surface:
   `packages/cli/scripts/build-registry.ts` — each item carries its source, its npm
   `dependencies`, and its `registryDependencies` (other components it imports),
   derived by parsing imports.
-- The default registry is pinned to the CLI package version (`v0.6.1` here), not
+- The default registry is pinned to the CLI package version (`v0.6.2` here), not
   mutable `main`, so a published CLI reads the registry snapshot it was released
   with. Use `-r, --registry ./registry` when testing local registry changes before
   a release tag exists.
@@ -80,7 +80,7 @@ Notes that match the commander surface:
     "lib": "lib",
     "blocks": "components/blocks"
   },
-  "registry": "https://raw.githubusercontent.com/pedrogbraz/cronus-ui/v0.6.1/registry"
+  "registry": "https://raw.githubusercontent.com/pedrogbraz/cronus-ui/v0.6.2/registry"
 }
 ```
 

package/dist/commands/add-page.js

@@ -26,7 +26,7 @@ import { baseSnapshotDir, reloadManifest } from "../compose/reload.js";
 import { chromeWrapperPath, layoutPath, pagePath, renderChromeWrapper, renderLayout, renderPage, renderShellWrapper, rewriteChromeBlock, } from "../compose/render.js";
 import { CLI_VERSION, hasConfig, readConfig, writeConfig, } from "../config.js";
 import { Registry, registrySourceVersion } from "../registry.js";
-import { closestName, collectDependencies, detectPackageManager, log, resolveSafeDest, runInstall, writeFileEnsured, writeItemFiles, } from "../utils.js";
+import { closestName, collectDependencies, detectPackageManager, log, recordDependencies, resolveSafeDest, rewriteImports, runInstall, writeFileEnsured, writeItemFiles, } from "../utils.js";
 import { readChromeSources, readComposeMeta } from "./compose.js";
 /** Title-case a route into a default page title: "/faq" → "Faq", "/help-center" → "Help Center". */
 function defaultTitle(route) {
@@ -275,7 +275,7 @@ export async function addPage(options) {
             const source = plan.chromeSources[slug];
             if (source === undefined || !existsSync(dest))
                 continue;
-            const content = rewriteChromeBlock(slug, source, plan);
+            const content = rewriteImports(rewriteChromeBlock(slug, source, plan), config);
             await writeFileEnsured(dest, content);
             if (!generatedFiles.includes(rel))
                 generatedFiles.push(rel);
@@ -298,17 +298,16 @@ export async function addPage(options) {
     };
     const composed = { ...config.composed, [appName]: nextRecord };
     await writeConfig(targetDir, { ...config, installed, composed });
-    // --- Install npm deps (best-effort) ---------------------------------------
-    if (resolvedItems.length > 0 && !(options.skipInstall ?? false)) {
-        const deps = collectDependencies(resolvedItems);
-        if (deps.length > 0) {
-            const pm = detectPackageManager(targetDir);
-            try {
-                await runInstall(pm, deps, targetDir);
-            }
-            catch {
-                // Non-fatal.
-            }
+    // --- Record + install npm deps (best-effort) ------------------------------
+    const deps = resolvedItems.length > 0 ? collectDependencies(resolvedItems) : [];
+    await recordDependencies(targetDir, deps);
+    if (deps.length > 0 && !(options.skipInstall ?? false)) {
+        const pm = detectPackageManager(targetDir);
+        try {
+            await runInstall(pm, deps, targetDir);
+        }
+        catch {
+            // Non-fatal.
         }
     }
     return { appName, route: options.route, generatedFiles, skippedFiles, installedBlocks };

package/dist/commands/add.js

@@ -1,6 +1,6 @@
 import { CLI_VERSION, hasConfig, readConfig, writeConfig, } from "../config.js";
 import { Registry, registrySourceVersion } from "../registry.js";
-import { closestName, collectDependencies, detectPackageManager, log, runInstall, writeItemFiles, } from "../utils.js";
+import { closestName, collectDependencies, detectPackageManager, log, recordDependencies, runInstall, writeItemFiles, } from "../utils.js";
 export async function add(names, options) {
     const { cwd } = options;
     if (!hasConfig(cwd)) {
@@ -94,6 +94,7 @@ export async function add(names, options) {
         await writeConfig(cwd, { ...config, installed });
     }
     const deps = collectDependencies(items);
+    await recordDependencies(cwd, deps);
     if (deps.length > 0 && !options.skipInstall) {
         const pm = detectPackageManager(cwd);
         log.step(`Installing ${deps.length} dependencies with ${pm}…`);

package/dist/commands/compose.js

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { writeDesignDocuments } from "@cronus-ui/ai-kit";
+import { applyGoldPath, GOLD_PATH_DEPENDENCIES, isGoldPathTemplate } from "../compose/gold-path.js";
 import { manifestFingerprint } from "../compose/manifest.js";
 import { buildComposePlan, ComposePlanError, } from "../compose/plan.js";
 import { renderPreview } from "../compose/preview.js";
@@ -10,7 +11,7 @@ import { renderPlan } from "../compose/render.js";
 import { defaultComposeTemplate, listTemplates, loadManifestFile, loadTemplate, } from "../compose/templates.js";
 import { CLI_VERSION, hasConfig, readConfig, writeConfig, } from "../config.js";
 import { Registry, registrySourceVersion } from "../registry.js";
-import { collectDependencies, detectPackageManager, log, resolveSafeDest, runInstall, writeFileEnsured, writeItemFiles, } from "../utils.js";
+import { collectDependencies, detectPackageManager, log, recordDependencies, resolveSafeDest, rewriteImports, runInstall, writeFileEnsured, writeItemFiles, } from "../utils.js";
 export { listTemplates, loadManifestFile, loadTemplate } from "../compose/templates.js";
 /** Read the chrome block sources named by the manifest's chrome map from the registry. */
 export async function readChromeSources(manifest, registry) {
@@ -129,7 +130,7 @@ export async function composeApp(options) {
             continue;
         }
         const dest = resolveSafeDest(targetDir, ".", rewrite.file);
-        await writeFileEnsured(dest, rewrite.content);
+        await writeFileEnsured(dest, rewriteImports(rewrite.content, config));
         generatedFiles.push(rewrite.file);
     }
     // --- Write the generated pages/layouts/wrappers (safe writes) -------------
@@ -147,6 +148,18 @@ export async function composeApp(options) {
         const snapDest = resolveSafeDest(targetDir, baseSnapshotDir(plan.templateName), file.path);
         await writeFileEnsured(snapDest, file.content);
     }
+    // Authenticated gold path (saas/admin only): sqlite + drizzle + better-auth.
+    if (isGoldPathTemplate(plan.templateName)) {
+        const gold = await applyGoldPath({
+            targetDir,
+            config,
+            generatedFiles,
+            overwrite,
+            templateName: plan.templateName,
+        });
+        generatedFiles.push(...gold.written);
+        skippedFiles.push(...gold.skipped);
+    }
     // --- Record composed{} + installed{} --------------------------------------
     // Keyed by TEMPLATE name (not project name): a project can compose several
     // templates, and re-composing the same one updates its record in place.
@@ -172,8 +185,14 @@ export async function composeApp(options) {
     const nextConfig = { ...config, installed, composed };
     await writeConfig(targetDir, nextConfig);
     writeDesignDocuments(targetDir, { theme: nextConfig.theme?.name });
-    // --- Install npm deps (best-effort, like add) -----------------------------
-    const deps = collectDependencies(items);
+    // --- Record + install npm deps --------------------------------------------
+    // Always pin registry specs into package.json (lucide-react, recharts, …)
+    // even when --no-install: a later `bun install` must match `pm add`.
+    const registryDeps = collectDependencies(items);
+    await recordDependencies(targetDir, registryDeps);
+    const deps = isGoldPathTemplate(plan.templateName)
+        ? [...new Set([...registryDeps, ...GOLD_PATH_DEPENDENCIES])].sort()
+        : registryDeps;
     if (deps.length > 0 && !(options.skipInstall ?? false)) {
         const pm = detectPackageManager(targetDir);
         try {

package/dist/compose/gold-path.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Authenticated gold path for saas/admin compose: SQLite + Drizzle + Better-Auth.
+ * Always sqlite — postgres/mysql live in create-cronus-stack.
+ */
+import type { CronusUIConfig } from "../config.js";
+export declare const GOLD_PATH_TEMPLATES: Set<string>;
+export declare function isGoldPathTemplate(name: string): boolean;
+/** Production npm specs installed with the gold path (devDeps are merged into package.json). */
+export declare const GOLD_PATH_DEPENDENCIES: readonly ["drizzle-orm@^0.45.2", "better-sqlite3@^12.0.0", "better-auth@^1.7.2"];
+export interface GoldPathLayout {
+    libDir: string;
+    dbDir: string;
+    appDir: string;
+    componentsDir: string;
+    middlewareRel: string;
+}
+export interface ApplyGoldPathOptions {
+    targetDir: string;
+    config: CronusUIConfig;
+    /** Paths compose actually wrote this run (used to gate the home-page patch). */
+    generatedFiles: string[];
+    overwrite: boolean;
+    /** Composed{} key; when set, the patched home snapshot is updated too. */
+    templateName?: string;
+}
+export interface ApplyGoldPathResult {
+    written: string[];
+    skipped: string[];
+}
+export declare function goldPathLayout(config: CronusUIConfig): GoldPathLayout;
+/**
+ * Wire the installed app-shell-chrome copy to live Better-Auth orgs + session.
+ * Idempotent: a chrome that already has WorkspaceMenu and SessionUser is left
+ * untouched. Returns undefined when the WorkspaceSwitcher / InviteDialog
+ * anchors are missing and nothing else can be patched.
+ */
+export declare function patchChromeSource(source: string, workspaceImport: string, inviteImport: string, sessionImport?: string): string | undefined;
+/** Insert ItemsPanel into a generated home page. Returns undefined when there is no main. */
+export declare function patchHomePageSource(source: string, itemsImport: string): string | undefined;
+/**
+ * Write sqlite + Drizzle + Better-Auth files into a composed saas/admin app.
+ * Overwrites lib/auth-adapter.ts always (replaces the demo adapter). Patches
+ * the shell home page only when compose wrote it this run.
+ */
+export declare function applyGoldPath(options: ApplyGoldPathOptions): Promise<ApplyGoldPathResult>;
+//# sourceMappingURL=gold-path.d.ts.map

package/dist/compose/gold-path.js

@@ -0,0 +1,923 @@
+/**
+ * Authenticated gold path for saas/admin compose: SQLite + Drizzle + Better-Auth.
+ * Always sqlite — postgres/mysql live in create-cronus-stack.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { resolveSafeDest, writeFileEnsured } from "../utils.js";
+import { baseSnapshotDir } from "./reload.js";
+export const GOLD_PATH_TEMPLATES = new Set(["saas", "admin"]);
+export function isGoldPathTemplate(name) {
+    return GOLD_PATH_TEMPLATES.has(name);
+}
+/** Production npm specs installed with the gold path (devDeps are merged into package.json). */
+export const GOLD_PATH_DEPENDENCIES = [
+    "drizzle-orm@^0.45.2",
+    "better-sqlite3@^12.0.0",
+    "better-auth@^1.7.2",
+];
+const GOLD_PATH_PROD_DEPS = {
+    "drizzle-orm": "^0.45.2",
+    "better-sqlite3": "^12.0.0",
+    "better-auth": "^1.7.2",
+};
+const GOLD_PATH_DEV_DEPS = {
+    "drizzle-kit": "^0.31.10",
+    "@types/better-sqlite3": "^9.6.0",
+};
+const GOLD_PATH_SCRIPTS = {
+    "db:push": "drizzle-kit push",
+    "db:generate": "drizzle-kit generate",
+    "db:studio": "drizzle-kit studio",
+};
+const ENV_VARS = {
+    DATABASE_URL: "file:./data/app.db",
+    BETTER_AUTH_SECRET: "change-me-to-a-32-character-secret",
+    BETTER_AUTH_URL: "http://localhost:3000",
+};
+const GITIGNORE_ENTRIES = ["*.db", "data/", "drizzle/"];
+const DATABASE_URL_FALLBACK = "file:./data/app.db";
+export function goldPathLayout(config) {
+    const libDir = posix(config.paths.lib);
+    const uiDir = posix(config.paths.ui);
+    const src = libDir === "src" || libDir.startsWith("src/");
+    const prefix = src ? "src/" : "";
+    const componentsDir = uiDir.endsWith("/ui")
+        ? uiDir.slice(0, -"/ui".length)
+        : `${prefix}components`;
+    return {
+        libDir,
+        dbDir: `${prefix}db`,
+        appDir: `${prefix}app`,
+        componentsDir,
+        middlewareRel: `${prefix}middleware.ts`,
+    };
+}
+function posix(p) {
+    return p.replaceAll("\\", "/");
+}
+function resolveAppDir(targetDir, layout, generatedFiles) {
+    const fromGenerated = generatedFiles.find((f) => /(^|\/)\(shell\)\/page\.tsx$/.test(posix(f)));
+    if (fromGenerated !== undefined) {
+        return posix(fromGenerated).replace(/\/\(shell\)\/page\.tsx$/, "");
+    }
+    if (existsSync(join(targetDir, "app", "(shell)", "page.tsx")))
+        return "app";
+    if (existsSync(join(targetDir, "src", "app", "(shell)", "page.tsx")))
+        return "src/app";
+    if (existsSync(join(targetDir, layout.appDir)))
+        return layout.appDir;
+    if (existsSync(join(targetDir, "app")))
+        return "app";
+    if (existsSync(join(targetDir, "src", "app")))
+        return "src/app";
+    return layout.appDir;
+}
+function homePageRel(appDir, generatedFiles) {
+    const match = generatedFiles.find((f) => posix(f) === `${appDir}/(shell)/page.tsx`);
+    if (match !== undefined)
+        return posix(match);
+    const any = generatedFiles.find((f) => /(^|\/)\(shell\)\/page\.tsx$/.test(posix(f)));
+    return any !== undefined ? posix(any) : undefined;
+}
+function drizzleConfigSource(dbDir) {
+    return `import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { defineConfig } from "drizzle-kit";
+
+const url = process.env.DATABASE_URL ?? "${DATABASE_URL_FALLBACK}";
+const fileFromUrl = url.startsWith("file:") ? url.slice("file:".length) : url;
+mkdirSync(dirname(fileFromUrl) || ".", { recursive: true });
+
+export default defineConfig({
+  dialect: "sqlite",
+  schema: "./${dbDir}/schema.ts",
+  out: "./drizzle",
+  dbCredentials: { url },
+});
+`;
+}
+function dbSchemaSource() {
+    return `import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const user = sqliteTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: integer("email_verified", { mode: "boolean" }).notNull(),
+  image: text("image"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const session = sqliteTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  token: text("token").notNull().unique(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  activeOrganizationId: text("active_organization_id"),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const account = sqliteTable("account", {
+  id: text("id").primaryKey(),
+  issuer: text("issuer").notNull(),
+  accountId: text("account_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  idToken: text("id_token"),
+  accessTokenExpiresAt: integer("access_token_expires_at", { mode: "timestamp" }),
+  refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
+  scope: text("scope"),
+  password: text("password"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const verification = sqliteTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }),
+  updatedAt: integer("updated_at", { mode: "timestamp" }),
+});
+
+export const organization = sqliteTable("organization", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  logo: text("logo"),
+  metadata: text("metadata"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+});
+
+export const member = sqliteTable("member", {
+  id: text("id").primaryKey(),
+  organizationId: text("organization_id")
+    .notNull()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  role: text("role").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+});
+
+export const invitation = sqliteTable("invitation", {
+  id: text("id").primaryKey(),
+  organizationId: text("organization_id")
+    .notNull()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  email: text("email").notNull(),
+  role: text("role"),
+  status: text("status").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  inviterId: text("inviter_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const items = sqliteTable("items", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  title: text("title").notNull(),
+  workspaceId: text("workspace_id").references(() => organization.id, { onDelete: "cascade" }),
+});
+`;
+}
+function dbClientSource() {
+    return `import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import * as schema from "./schema";
+
+const url = process.env.DATABASE_URL ?? "${DATABASE_URL_FALLBACK}";
+const fileFromUrl = url.startsWith("file:") ? url.slice("file:".length) : url;
+mkdirSync(dirname(fileFromUrl) || ".", { recursive: true });
+const sqlite = new Database(fileFromUrl);
+
+export const db = drizzle(sqlite, { schema });
+`;
+}
+function authServerSource() {
+    return `import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { nextCookies } from "better-auth/next-js";
+import { organization } from "better-auth/plugins";
+import { and, eq } from "drizzle-orm";
+import { db } from "@/db";
+import * as schema from "@/db/schema";
+import {
+  invitation as invitationTable,
+  member,
+  organization as organizationTable,
+  user as userTable,
+} from "@/db/schema";
+
+function newId(): string {
+  return crypto.randomUUID().replaceAll("-", "");
+}
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: "sqlite", schema }),
+  emailAndPassword: {
+    enabled: true,
+    sendResetPassword: async ({ url }) => {
+      console.info(url);
+    },
+  },
+  databaseHooks: {
+    session: {
+      create: {
+        before: async (session) => {
+          const [existing] = await db
+            .select({ organizationId: member.organizationId })
+            .from(member)
+            .where(eq(member.userId, session.userId))
+            .limit(1);
+          if (existing?.organizationId) {
+            return { data: { ...session, activeOrganizationId: existing.organizationId } };
+          }
+          const [owner] = await db
+            .select({ name: userTable.name, email: userTable.email })
+            .from(userTable)
+            .where(eq(userTable.id, session.userId))
+            .limit(1);
+          if (owner?.email) {
+            const [pending] = await db
+              .select({ id: invitationTable.id })
+              .from(invitationTable)
+              .where(
+                and(eq(invitationTable.email, owner.email), eq(invitationTable.status, "pending")),
+              )
+              .limit(1);
+            if (pending) return;
+          }
+          const orgId = newId();
+          const now = new Date();
+          await db.insert(organizationTable).values({
+            id: orgId,
+            name: owner?.name.trim() || "Workspace",
+            slug: \`ws-\${session.userId.slice(0, 16)}\`,
+            createdAt: now,
+          });
+          await db.insert(member).values({
+            id: newId(),
+            organizationId: orgId,
+            userId: session.userId,
+            role: "owner",
+            createdAt: now,
+          });
+          return { data: { ...session, activeOrganizationId: orgId } };
+        },
+      },
+    },
+  },
+  secret: process.env.BETTER_AUTH_SECRET,
+  baseURL: process.env.BETTER_AUTH_URL,
+  plugins: [
+    organization({
+      sendInvitationEmail: async (data) => {
+        const base = process.env.BETTER_AUTH_URL ?? "http://localhost:3000";
+        console.info(\`Invite \${data.email}: \${base}/accept-invitation?id=\${data.id}\`);
+      },
+    }),
+    nextCookies(),
+  ],
+});
+`;
+}
+function authClientSource() {
+    return `import { organizationClient } from "better-auth/client/plugins";
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient({
+  plugins: [organizationClient()],
+});
+`;
+}
+function authAdapterSource() {
+    return `import { authClient } from "./auth-client";
+
+const INVITE_KEY = "cronus-invitation";
+
+function readInvitation(): string | null {
+  if (typeof window === "undefined") return null;
+  const fromUrl = new URLSearchParams(window.location.search).get("invitation");
+  if (fromUrl) {
+    sessionStorage.setItem(INVITE_KEY, fromUrl);
+    return fromUrl;
+  }
+  return sessionStorage.getItem(INVITE_KEY);
+}
+
+function afterAuthPath(): string {
+  const invitation = readInvitation();
+  if (invitation) {
+    return \`/accept-invitation?id=\${encodeURIComponent(invitation)}\`;
+  }
+  return "/";
+}
+
+if (typeof window !== "undefined") {
+  readInvitation();
+}
+
+export async function signInEmail({ email, password }: { email: string; password: string }) {
+  const callbackURL = afterAuthPath();
+  const { error } = await authClient.signIn.email({ email, password, callbackURL });
+  if (error) throw new Error(error.message || "Sign in failed");
+  window.location.assign(callbackURL);
+}
+
+export async function signUpEmail({
+  email,
+  password,
+  name,
+}: {
+  email: string;
+  password: string;
+  name?: string;
+}) {
+  const callbackURL = afterAuthPath();
+  const { error } = await authClient.signUp.email({
+    email,
+    password,
+    name: name ?? email,
+    callbackURL,
+  });
+  if (error) throw new Error(error.message || "Sign up failed");
+  window.location.assign(callbackURL);
+}
+
+export async function requestPasswordReset({ email }: { email: string }) {
+  const { error } = await authClient.requestPasswordReset({ email, redirectTo: "/login" });
+  if (error) throw new Error(error.message || "Reset failed");
+}
+`;
+}
+function authRouteSource(authImport) {
+    return `import { toNextJsHandler } from "better-auth/next-js";
+import { auth } from ${JSON.stringify(authImport)};
+
+export const { GET, POST } = toNextJsHandler(auth);
+`;
+}
+function middlewareSource() {
+    return `import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+import { getSessionCookie } from "better-auth/cookies";
+
+const AUTH_PAGES = ["/login", "/signup", "/forgot-password"];
+
+function invitationOf(request: NextRequest): string | null {
+  const { pathname, searchParams } = request.nextUrl;
+  return (
+    searchParams.get("invitation") ??
+    (pathname === "/accept-invitation" ? searchParams.get("id") : null)
+  );
+}
+
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+  if (
+    pathname.startsWith("/api/auth") ||
+    pathname.startsWith("/_next") ||
+    pathname === "/favicon.ico"
+  ) {
+    return NextResponse.next();
+  }
+
+  const sessionCookie = getSessionCookie(request);
+  const isAuthPage = AUTH_PAGES.includes(pathname);
+  const invitation = invitationOf(request);
+
+  if (!sessionCookie && pathname === "/accept-invitation") {
+    const url = new URL("/signup", request.url);
+    if (invitation) url.searchParams.set("invitation", invitation);
+    return NextResponse.redirect(url);
+  }
+  if (!sessionCookie && !isAuthPage) {
+    const url = new URL("/login", request.url);
+    if (invitation) url.searchParams.set("invitation", invitation);
+    return NextResponse.redirect(url);
+  }
+  if (sessionCookie && isAuthPage) {
+    if (invitation) {
+      return NextResponse.redirect(
+        new URL(\`/accept-invitation?id=\${encodeURIComponent(invitation)}\`, request.url),
+      );
+    }
+    return NextResponse.redirect(new URL("/", request.url));
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: [
+    "/((?!_next/static|_next/image|favicon.ico|.*\\\\.(?:svg|png|jpg|jpeg|gif|webp|ico)$).*)",
+  ],
+};
+`;
+}
+function itemsPanelSource(authImport) {
+    return `import { eq } from "drizzle-orm";
+import { headers } from "next/headers";
+import { db } from "@/db";
+import { items, member, organization } from "@/db/schema";
+import { auth } from ${JSON.stringify(authImport)};
+
+export async function ItemsPanel() {
+  const session = await auth.api.getSession({ headers: await headers() });
+  let orgId = session?.session?.activeOrganizationId ?? null;
+  if (!orgId && session?.user?.id) {
+    const [row] = await db
+      .select({ organizationId: member.organizationId })
+      .from(member)
+      .where(eq(member.userId, session.user.id))
+      .limit(1);
+    orgId = row?.organizationId ?? null;
+  }
+  const org = orgId
+    ? (await db.select().from(organization).where(eq(organization.id, orgId)).limit(1))[0]
+    : undefined;
+  const rows = orgId
+    ? await db.select().from(items).where(eq(items.workspaceId, orgId))
+    : [];
+  const email = session?.user?.email ?? "signed out";
+  const workspace = org?.name ?? "no workspace";
+  const count = String(rows.length);
+  return (
+    <p className="px-6 pt-6 text-sm text-fg-tertiary">
+      {email} · {workspace} · {count} items
+    </p>
+  );
+}
+`;
+}
+function workspaceMenuSource(authClientImport) {
+    return `"use client";
+
+import { WorkspaceSwitcher } from "@cronus-ui/ui";
+import { useRouter } from "next/navigation";
+import { useEffect } from "react";
+import { authClient } from ${JSON.stringify(authClientImport)};
+
+export function WorkspaceMenu() {
+  const router = useRouter();
+  const { data: orgs } = authClient.useListOrganizations();
+  const { data: active } = authClient.useActiveOrganization();
+  const workspaces = (orgs ?? []).map((org) => ({ id: org.id, name: org.name }));
+  const firstId = workspaces[0]?.id;
+  useEffect(() => {
+    if (active || !firstId) return;
+    void authClient.organization.setActive({ organizationId: firstId }).then(() => {
+      router.refresh();
+    });
+  }, [active, firstId, router]);
+  return (
+    <WorkspaceSwitcher
+      workspaces={workspaces}
+      value={active?.id}
+      onValueChange={(id) => {
+        void authClient.organization.setActive({ organizationId: id }).then(() => {
+          router.refresh();
+        });
+      }}
+    />
+  );
+}
+`;
+}
+function inviteMemberSource(authClientImport) {
+    return `"use client";
+
+import { InviteDialog } from "@cronus-ui/ui";
+import type { ReactNode } from "react";
+import { authClient } from ${JSON.stringify(authClientImport)};
+
+export function InviteMember({ trigger }: { trigger: ReactNode }) {
+  return (
+    <InviteDialog
+      trigger={trigger}
+      onInvite={async ({ email, role }) => {
+        const assigned = role === "admin" || role === "owner" ? role : "member";
+        const { error } = await authClient.organization.inviteMember({
+          email,
+          role: assigned,
+        });
+        if (error) throw new Error(error.message || "Invite failed");
+      }}
+    />
+  );
+}
+`;
+}
+function sessionUserSource(authClientImport) {
+    return `"use client";
+
+import { Avatar, AvatarFallback, AvatarImage } from "@cronus-ui/ui";
+import { authClient } from ${JSON.stringify(authClientImport)};
+
+function initialsOf(name: string, email: string): string {
+  const parts = name.trim().split(/\\s+/).filter(Boolean);
+  if (parts.length >= 2) {
+    return \`\${parts[0]?.[0] ?? ""}\${parts[1]?.[0] ?? ""}\`.toUpperCase();
+  }
+  if (parts[0]?.[0]) return parts[0][0].toUpperCase();
+  return email.slice(0, 2).toUpperCase();
+}
+
+export function SessionUser({ compact = false }: { compact?: boolean }) {
+  const { data } = authClient.useSession();
+  const user = data?.user;
+  if (!user) return null;
+  const name = user.name || user.email || "Account";
+  const email = user.email || "";
+  const initials = initialsOf(name, email);
+  const avatar = (
+    <Avatar className="size-8">
+      {user.image ? <AvatarImage src={user.image} alt={name} /> : null}
+      <AvatarFallback>{initials}</AvatarFallback>
+    </Avatar>
+  );
+  if (compact) return avatar;
+  return (
+    <div className="flex items-center gap-2 rounded-lg px-2 py-1.5">
+      {avatar}
+      <div className="flex min-w-0 flex-col">
+        <span className="truncate text-sm font-medium text-fg">{name}</span>
+        <span className="truncate text-xs text-fg-tertiary">{email}</span>
+      </div>
+    </div>
+  );
+}
+`;
+}
+function acceptInvitationPageSource(authClientImport) {
+    return `"use client";
+
+import { Suspense, useEffect, useState } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { authClient } from ${JSON.stringify(authClientImport)};
+
+function AcceptInvitation() {
+  const router = useRouter();
+  const params = useSearchParams();
+  const id = params.get("id") ?? params.get("invitation");
+  const { data: session, isPending } = authClient.useSession();
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (isPending) return;
+    if (!id) {
+      setError("Invitation is missing.");
+      return;
+    }
+    if (!session) {
+      router.replace(\`/signup?invitation=\${encodeURIComponent(id)}\`);
+      return;
+    }
+    let cancelled = false;
+    void (async () => {
+      const { data, error: acceptError } = await authClient.organization.acceptInvitation({
+        invitationId: id,
+      });
+      if (cancelled) return;
+      if (acceptError) {
+        setError(acceptError.message || "Could not accept invitation.");
+        return;
+      }
+      const orgId = data?.invitation?.organizationId ?? data?.member?.organizationId;
+      if (orgId) {
+        await authClient.organization.setActive({ organizationId: orgId });
+      }
+      try {
+        sessionStorage.removeItem("cronus-invitation");
+      } catch {
+        // ignore
+      }
+      window.location.assign("/");
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [id, isPending, router, session]);
+
+  return (
+    <main className="flex min-h-svh flex-col items-center justify-center px-6">
+      {error ? (
+        <p role="alert" className="text-sm text-error-strong">
+          {error}
+        </p>
+      ) : (
+        <p className="text-sm text-fg-tertiary">Accepting invitation…</p>
+      )}
+    </main>
+  );
+}
+
+export default function AcceptInvitationPage() {
+  return (
+    <Suspense
+      fallback={
+        <main className="flex min-h-svh flex-col items-center justify-center px-6">
+          <p className="text-sm text-fg-tertiary">Accepting invitation…</p>
+        </main>
+      }
+    >
+      <AcceptInvitation />
+    </Suspense>
+  );
+}
+`;
+}
+function insertImport(source, line) {
+    if (source.includes(line))
+        return source;
+    const firstImport = source.match(/^import .+$/m);
+    if (firstImport?.index !== undefined) {
+        return `${source.slice(0, firstImport.index)}${line}\n${source.slice(firstImport.index)}`;
+    }
+    return `${line}\n${source}`;
+}
+/**
+ * Wire the installed app-shell-chrome copy to live Better-Auth orgs + session.
+ * Idempotent: a chrome that already has WorkspaceMenu and SessionUser is left
+ * untouched. Returns undefined when the WorkspaceSwitcher / InviteDialog
+ * anchors are missing and nothing else can be patched.
+ */
+export function patchChromeSource(source, workspaceImport, inviteImport, sessionImport) {
+    const hasMenu = source.includes("WorkspaceMenu");
+    const hasSession = source.includes("SessionUser");
+    if (hasMenu && hasSession)
+        return source;
+    const canPatchMenu = !hasMenu &&
+        /<WorkspaceSwitcher[\s\S]*?\/>/.test(source) &&
+        /<InviteDialog[\s\S]*?\/>/.test(source);
+    const canPatchSession = sessionImport !== undefined &&
+        !hasSession &&
+        source.includes("{USER.email}") &&
+        source.includes("<SidebarFooter>");
+    if (!canPatchMenu && !canPatchSession) {
+        return hasMenu ? source : undefined;
+    }
+    let out = source;
+    if (canPatchMenu) {
+        out = insertImport(out, `import { WorkspaceMenu } from ${JSON.stringify(workspaceImport)};`);
+        out = insertImport(out, `import { InviteMember } from ${JSON.stringify(inviteImport)};`);
+        out = out.replace(/<WorkspaceSwitcher[\s\S]*?\/>/, "<WorkspaceMenu />");
+        out = out.replace(/<InviteDialog([\s\S]*?)\/>/, "<InviteMember$1/>");
+        out = out.replace(/\nconst WORKSPACES = \[[\s\S]*?\];\n/, "\n");
+        out = out.replace(/\s*const \[workspaceId, setWorkspaceId\] = useState\("[^"]*"\);\n/, "\n");
+        out = out.replace(/,\s*useState/, "");
+        out = out.replace(/\s*InviteDialog,\n/, "\n");
+        out = out.replace(/\s*WorkspaceSwitcher,\n/, "\n");
+    }
+    if (canPatchSession && sessionImport !== undefined) {
+        out = insertImport(out, `import { SessionUser } from ${JSON.stringify(sessionImport)};`);
+        out = out.replace(/<SidebarFooter>\s*<div className="flex items-center gap-2 rounded-lg px-2 py-1\.5">[\s\S]*?<\/SidebarFooter>/, "<SidebarFooter>\n        <SessionUser />\n      </SidebarFooter>");
+        out = out.replace(/<Avatar className="size-8">\s*\{OWNER\?\.avatar \? <AvatarImage src=\{OWNER\.avatar\} alt=\{USER\.name\} \/> : null\}\s*<AvatarFallback>\{USER\.initials\}<\/AvatarFallback>\s*<\/Avatar>/, "<SessionUser compact />");
+        out = out.replace(/\nimport \{ TEAM, USER \} from "[^"]+";\n/, "\n");
+        out = out.replace(/\nconst OWNER = TEAM\.find\(\(m\) => m\.email === USER\.email\);\n/, "\n");
+        out = out.replace(/\s*Avatar,\n/, "\n");
+        out = out.replace(/\s*AvatarFallback,\n/, "\n");
+        out = out.replace(/\s*AvatarImage,\n/, "\n");
+    }
+    return out;
+}
+function nextConfigSource() {
+    return `/** @type {import('next').NextConfig} */
+const nextConfig = {
+  serverExternalPackages: ["better-sqlite3"],
+};
+
+export default nextConfig;
+`;
+}
+/** Insert ItemsPanel into a generated home page. Returns undefined when there is no main. */
+export function patchHomePageSource(source, itemsImport) {
+    if (!/<main\b/.test(source))
+        return undefined;
+    let out = source;
+    const importLine = `import { ItemsPanel } from ${JSON.stringify(itemsImport)};`;
+    if (!out.includes(importLine)) {
+        const match = out.match(/^import .+$/m);
+        if (match?.index !== undefined) {
+            out = `${out.slice(0, match.index)}${importLine}\n${out.slice(match.index)}`;
+        }
+        else {
+            out = `${importLine}\n${out}`;
+        }
+    }
+    out = out.replace(/export default(?! async) function/, "export default async function");
+    if (!/<ItemsPanel\s*\/>/.test(out)) {
+        out = out.replace(/(<main\b[^>]*>)/, "$1\n      <ItemsPanel />");
+    }
+    return out;
+}
+function mergePackageJson(raw) {
+    const pkg = JSON.parse(raw);
+    const dependencies = { ...(pkg.dependencies ?? {}) };
+    const devDependencies = { ...(pkg.devDependencies ?? {}) };
+    const scripts = { ...(pkg.scripts ?? {}) };
+    for (const [name, range] of Object.entries(GOLD_PATH_PROD_DEPS)) {
+        dependencies[name] ??= range;
+    }
+    for (const [name, range] of Object.entries(GOLD_PATH_DEV_DEPS)) {
+        devDependencies[name] ??= range;
+    }
+    for (const [name, cmd] of Object.entries(GOLD_PATH_SCRIPTS)) {
+        scripts[name] ??= cmd;
+    }
+    pkg.dependencies = dependencies;
+    pkg.devDependencies = devDependencies;
+    pkg.scripts = scripts;
+    return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+function mergeNextConfig(raw) {
+    if (raw.includes("better-sqlite3"))
+        return raw;
+    if (/serverExternalPackages:\s*\[/.test(raw)) {
+        return raw.replace(/serverExternalPackages:\s*\[/, 'serverExternalPackages: ["better-sqlite3", ');
+    }
+    const empty = raw.replace(/const nextConfig = \{\s*\}/, 'const nextConfig = {\n  serverExternalPackages: ["better-sqlite3"],\n}');
+    if (empty !== raw)
+        return empty;
+    if (raw.includes("const nextConfig = {")) {
+        return raw.replace(/const nextConfig = \{/, 'const nextConfig = {\n  serverExternalPackages: ["better-sqlite3"],');
+    }
+    return `${raw.trimEnd()}\n`;
+}
+function mergeEnvExample(raw) {
+    const lines = raw.split(/\r?\n/);
+    const keys = new Set(lines.map((line) => {
+        const eq = line.indexOf("=");
+        return eq === -1 ? line.trim() : line.slice(0, eq).trim();
+    }));
+    const extra = [];
+    for (const [key, value] of Object.entries(ENV_VARS)) {
+        if (!keys.has(key))
+            extra.push(`${key}=${value}`);
+    }
+    if (extra.length === 0)
+        return raw.endsWith("\n") ? raw : `${raw}\n`;
+    const base = raw.endsWith("\n") || raw.length === 0 ? raw : `${raw}\n`;
+    return `${base}${extra.join("\n")}\n`;
+}
+function mergeGitignore(raw) {
+    const lines = raw.split(/\r?\n/);
+    const have = new Set(lines.map((l) => l.trim()));
+    const extra = GITIGNORE_ENTRIES.filter((entry) => !have.has(entry));
+    if (extra.length === 0)
+        return raw.endsWith("\n") ? raw : `${raw}\n`;
+    const base = raw.endsWith("\n") || raw.length === 0 ? raw : `${raw}\n`;
+    return `${base}${extra.join("\n")}\n`;
+}
+async function writeRel(targetDir, rel, content, overwrite, always, written, skipped) {
+    const dest = resolveSafeDest(targetDir, ".", rel);
+    if (!always && existsSync(dest) && !overwrite) {
+        skipped.push(rel);
+        return;
+    }
+    await writeFileEnsured(dest, content);
+    written.push(rel);
+}
+/**
+ * Write sqlite + Drizzle + Better-Auth files into a composed saas/admin app.
+ * Overwrites lib/auth-adapter.ts always (replaces the demo adapter). Patches
+ * the shell home page only when compose wrote it this run.
+ */
+export async function applyGoldPath(options) {
+    const { targetDir, config, generatedFiles, overwrite } = options;
+    const layout = goldPathLayout(config);
+    const appDir = resolveAppDir(targetDir, layout, generatedFiles);
+    const middlewareRel = appDir === "src/app"
+        ? "src/middleware.ts"
+        : appDir === "app"
+            ? "middleware.ts"
+            : layout.middlewareRel;
+    const authImport = `${config.aliases.lib}/auth`;
+    const authClientImport = `${config.aliases.lib}/auth-client`;
+    const itemsImport = "@/components/items-panel";
+    const workspaceImport = "@/components/workspace-menu";
+    const inviteImport = "@/components/invite-member";
+    const sessionImport = "@/components/session-user";
+    const chromeRel = `${posix(config.paths.blocks)}/app-shell-chrome.tsx`;
+    const written = [];
+    const skipped = [];
+    const files = [
+        { rel: "drizzle.config.ts", content: drizzleConfigSource(layout.dbDir) },
+        { rel: `${layout.dbDir}/schema.ts`, content: dbSchemaSource() },
+        { rel: `${layout.dbDir}/index.ts`, content: dbClientSource() },
+        { rel: `${layout.libDir}/auth.ts`, content: authServerSource() },
+        { rel: `${layout.libDir}/auth-client.ts`, content: authClientSource() },
+        { rel: `${layout.libDir}/auth-adapter.ts`, content: authAdapterSource(), always: true },
+        {
+            rel: `${appDir}/api/auth/[...all]/route.ts`,
+            content: authRouteSource(authImport),
+        },
+        { rel: middlewareRel, content: middlewareSource() },
+        { rel: `${layout.componentsDir}/items-panel.tsx`, content: itemsPanelSource(authImport) },
+        {
+            rel: `${layout.componentsDir}/workspace-menu.tsx`,
+            content: workspaceMenuSource(authClientImport),
+            always: true,
+        },
+        {
+            rel: `${layout.componentsDir}/invite-member.tsx`,
+            content: inviteMemberSource(authClientImport),
+            always: true,
+        },
+        {
+            rel: `${layout.componentsDir}/session-user.tsx`,
+            content: sessionUserSource(authClientImport),
+            always: true,
+        },
+        {
+            rel: `${appDir}/(bare)/accept-invitation/page.tsx`,
+            content: acceptInvitationPageSource(authClientImport),
+            always: true,
+        },
+    ];
+    for (const file of files) {
+        await writeRel(targetDir, file.rel, file.content, overwrite, file.always === true, written, skipped);
+    }
+    const chromeDest = resolveSafeDest(targetDir, ".", chromeRel);
+    if (existsSync(chromeDest)) {
+        const current = await readFile(chromeDest, "utf8");
+        const patched = patchChromeSource(current, workspaceImport, inviteImport, sessionImport);
+        if (patched !== undefined && patched !== current) {
+            await writeFileEnsured(chromeDest, patched);
+            if (!written.includes(chromeRel))
+                written.push(chromeRel);
+            const templateName = options.templateName;
+            if (templateName !== undefined) {
+                const snapDest = resolveSafeDest(targetDir, baseSnapshotDir(templateName), chromeRel);
+                await writeFileEnsured(snapDest, patched);
+            }
+        }
+    }
+    const homeRel = homePageRel(appDir, generatedFiles);
+    if (homeRel !== undefined) {
+        const dest = resolveSafeDest(targetDir, ".", homeRel);
+        if (existsSync(dest)) {
+            const current = await readFile(dest, "utf8");
+            const patched = patchHomePageSource(current, itemsImport);
+            if (patched !== undefined && patched !== current) {
+                await writeFileEnsured(dest, patched);
+                const templateName = options.templateName;
+                if (templateName !== undefined) {
+                    const snapDest = resolveSafeDest(targetDir, baseSnapshotDir(templateName), homeRel);
+                    await writeFileEnsured(snapDest, patched);
+                }
+            }
+        }
+    }
+    await mergeTextFile(targetDir, "package.json", mergePackageJson);
+    await mergeOrCreate(targetDir, "next.config.mjs", nextConfigSource(), mergeNextConfig);
+    await mergeOrCreate(targetDir, ".env.example", `${Object.entries(ENV_VARS)
+        .map(([k, v]) => `${k}=${v}`)
+        .join("\n")}\n`, mergeEnvExample);
+    await mergeOrCreate(targetDir, ".gitignore", `${GITIGNORE_ENTRIES.join("\n")}\n`, mergeGitignore);
+    return { written, skipped };
+}
+async function mergeOrCreate(targetDir, rel, created, merge) {
+    const dest = resolveSafeDest(targetDir, ".", rel);
+    if (!existsSync(dest)) {
+        await writeFileEnsured(dest, created);
+        return;
+    }
+    const raw = await readFile(dest, "utf8");
+    const next = merge(raw);
+    if (next !== raw)
+        await writeFileEnsured(dest, next);
+}
+async function mergeTextFile(targetDir, rel, merge) {
+    const dest = resolveSafeDest(targetDir, ".", rel);
+    if (!existsSync(dest))
+        return;
+    const raw = await readFile(dest, "utf8");
+    let next;
+    try {
+        next = merge(raw);
+    }
+    catch {
+        return;
+    }
+    if (next !== raw)
+        await writeFileEnsured(dest, next);
+}
+//# sourceMappingURL=gold-path.js.map

package/dist/config.d.ts

@@ -1,6 +1,6 @@
 export declare const CONFIG_FILE = "cronus-ui.json";
-export declare const CLI_VERSION = "0.6.1";
-export declare const DEFAULT_REGISTRY = "https://raw.githubusercontent.com/pedrogbraz/cronus-ui/v0.6.1/registry";
+export declare const CLI_VERSION = "0.6.2";
+export declare const DEFAULT_REGISTRY = "https://raw.githubusercontent.com/pedrogbraz/cronus-ui/v0.6.2/registry";
 /** Manifest entry `add`/`upgrade` record per installed registry item. */
 export interface InstalledRecord {
     /** Registry release the files came from (git tag without the leading "v"). */

package/dist/config.js

@@ -2,7 +2,7 @@ import { existsSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 export const CONFIG_FILE = "cronus-ui.json";
-export const CLI_VERSION = "0.6.1";
+export const CLI_VERSION = "0.6.2";
 export const DEFAULT_REGISTRY = `https://raw.githubusercontent.com/pedrogbraz/cronus-ui/v${CLI_VERSION}/registry`;
 export const DEFAULT_CONFIG = {
     aliases: { ui: "@/components/ui", lib: "@/lib", blocks: "@/components/blocks" },

package/dist/utils.d.ts

@@ -60,6 +60,28 @@ export declare function assertValidDependency(dep: string): void;
  * package-manager spawn — so an injected/malformed spec throws before install.
  */
 export declare function collectDependencies(items: RegistryItem[]): string[];
+/**
+ * Split a registry npm spec (`lucide-react@^0.577.0`, `@cronus-ui/ui@0.6.1`)
+ * into name + range. A bare name (no `@range`) leaves `range` undefined so we
+ * never write an empty pin into package.json.
+ */
+export declare function splitDependencySpec(spec: string): {
+    name: string;
+    range: string | undefined;
+};
+/**
+ * Merge versioned registry specs into a package.json document. Existing pins
+ * win (`??=`) so a scaffold range is not clobbered by a later compose. Specs
+ * without a range are skipped. Returns the original string when nothing changes
+ * so we do not reformat an untouched file.
+ */
+export declare function mergeDependencySpecsIntoPackageJson(raw: string, specs: string[]): string;
+/**
+ * Persist registry npm pins into `<cwd>/package.json` even when install is
+ * skipped, so a later `bun install` / `npm install` picks up lucide-react,
+ * recharts, etc. No-ops when there is no package.json or nothing new to add.
+ */
+export declare function recordDependencies(cwd: string, specs: string[]): Promise<void>;
 /** Levenshtein edit distance between two strings (small inputs: registry names). */
 export declare function levenshtein(a: string, b: string): number;
 /**

package/dist/utils.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import pc from "picocolors";
 export const log = {
@@ -141,6 +141,74 @@ export function collectDependencies(items) {
     }
     return [...set].sort();
 }
+/**
+ * Split a registry npm spec (`lucide-react@^0.577.0`, `@cronus-ui/ui@0.6.1`)
+ * into name + range. A bare name (no `@range`) leaves `range` undefined so we
+ * never write an empty pin into package.json.
+ */
+export function splitDependencySpec(spec) {
+    if (spec.startsWith("@")) {
+        const at = spec.indexOf("@", 1);
+        if (at === -1)
+            return { name: spec, range: undefined };
+        const range = spec.slice(at + 1);
+        return { name: spec.slice(0, at), range: range.length > 0 ? range : undefined };
+    }
+    const at = spec.indexOf("@");
+    if (at <= 0)
+        return { name: spec, range: undefined };
+    const range = spec.slice(at + 1);
+    return { name: spec.slice(0, at), range: range.length > 0 ? range : undefined };
+}
+/**
+ * Merge versioned registry specs into a package.json document. Existing pins
+ * win (`??=`) so a scaffold range is not clobbered by a later compose. Specs
+ * without a range are skipped. Returns the original string when nothing changes
+ * so we do not reformat an untouched file.
+ */
+export function mergeDependencySpecsIntoPackageJson(raw, specs) {
+    if (specs.length === 0)
+        return raw;
+    const pkg = JSON.parse(raw);
+    const dependencies = { ...(pkg.dependencies ?? {}) };
+    let changed = false;
+    for (const spec of specs) {
+        const { name, range } = splitDependencySpec(spec);
+        if (range === undefined || name.length === 0)
+            continue;
+        if (dependencies[name] === undefined) {
+            dependencies[name] = range;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return raw;
+    pkg.dependencies = dependencies;
+    return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+/**
+ * Persist registry npm pins into `<cwd>/package.json` even when install is
+ * skipped, so a later `bun install` / `npm install` picks up lucide-react,
+ * recharts, etc. No-ops when there is no package.json or nothing new to add.
+ */
+export async function recordDependencies(cwd, specs) {
+    if (specs.length === 0)
+        return;
+    const pkgPath = join(cwd, "package.json");
+    if (!existsSync(pkgPath))
+        return;
+    const raw = await readFile(pkgPath, "utf8");
+    let next;
+    try {
+        next = mergeDependencySpecsIntoPackageJson(raw, specs);
+    }
+    catch {
+        return;
+    }
+    if (next === raw)
+        return;
+    await writeFile(pkgPath, next, "utf8");
+}
 /** Levenshtein edit distance between two strings (small inputs: registry names). */
 export function levenshtein(a, b) {
     // Single rolling row of the DP matrix (row 0 = distances against an empty `a`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cronus-ui",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "cronus-ui — add Cronus UI components to your project, shadcn-style (copy-paste registry).",
   "type": "module",
   "license": "MIT",
@@ -54,7 +54,7 @@
     "registry:check": "bun run scripts/check-registry.ts"
   },
   "dependencies": {
-    "@cronus-ui/ai-kit": "0.6.1",
+    "@cronus-ui/ai-kit": "0.6.2",
     "commander": "^15.0.0",
     "picocolors": "^1.1.1"
   },