saasaloy 0.5.0 → 0.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saasaloy",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Composable SaaS accelerator kit.",
   "keywords": [
     "saas",
@@ -39,6 +39,7 @@
   },
   "scripts": {
     "build": "tsup",
+    "clean": "rimraf dist coverage",
     "prepack": "pnpm -w run readme:cli && pnpm run build",
     "dev": "tsup --watch",
     "start": "node ./dist/index.js",
@@ -54,6 +55,7 @@
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "release-it": "21.0.2",
+    "rimraf": "6.1.3",
     "tsup": "8.5.1",
     "vitest": "5.0.0"
   },

package/schemas/manifest.schema.json

@@ -98,7 +98,8 @@
                   "plugin-array",
                   "const-array",
                   "chained-route",
-                  "drizzle-column"
+                  "drizzle-column",
+                  "nav-entry"
                 ],
                 "description": "Which codemod applied this patch. Must list exactly the kinds registry-item.schema.json accepts — the applier records here whatever a descriptor authored, so a kind missing from this enum makes the next `loadManifest` refuse a manifest the tool itself wrote (#98). `schema.test.ts` asserts the two enums and the `Patch` union agree."
               }

package/schemas/registry-item.schema.json

@@ -159,9 +159,10 @@
               "plugin-array",
               "const-array",
               "chained-route",
-              "drizzle-column"
+              "drizzle-column",
+              "nav-entry"
             ],
-            "description": "Which codemod applies this patch. `const-array`, `plugin-array`, `chained-route`, `wrangler-binding` and `drizzle-column` have removal inverses."
+            "description": "Which codemod applies this patch. `const-array`, `plugin-array`, `chained-route`, `wrangler-binding`, `drizzle-column` and `nav-entry` have removal inverses."
           }
         },
         "allOf": [
@@ -191,6 +192,66 @@
               }
             }
           },
+          {
+            "if": {
+              "properties": { "kind": { "const": "nav-entry" } },
+              "required": ["kind"]
+            },
+            "then": {
+              "required": ["constName", "area", "group", "entry", "icon"],
+              "properties": {
+                "constName": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Name of the module-scope const holding the nav areas (NAV_AREAS)."
+                },
+                "area": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Which area to add to, named by its `to` value."
+                },
+                "group": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Which of that area's groups to add to, named by its `label`."
+                },
+                "entry": {
+                  "type": "object",
+                  "required": ["to", "label"],
+                  "properties": {
+                    "to": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Route the row links to. Identifies the row for add and remove."
+                    },
+                    "label": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Text the row shows."
+                    }
+                  },
+                  "description": "The nav row, minus its icon. Written as a JSON object literal."
+                },
+                "icon": {
+                  "type": "object",
+                  "required": ["name", "from"],
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Component rendered as the row's `icon`, e.g. UsersRoundIcon."
+                    },
+                    "from": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Module the icon is imported from, e.g. lucide-react."
+                    }
+                  },
+                  "description": "The icon component. Rendered as an identifier, not a string, and its named import is added on apply and dropped on remove."
+                }
+              }
+            }
+          },
           {
             "if": {
               "properties": { "kind": { "const": "package-json-script" } },

package/templates/base/apps/web/astro.config.mjs

@@ -36,6 +36,13 @@ export default defineConfig({
   // `imageService: "compile"` optimises images during the build and serves the results
   // as plain assets. The adapter's default would reach for Cloudflare's IMAGES binding
   // at runtime, which needs a Worker this site does not have.
+  //
+  // package.json pins @cloudflare/vite-plugin, which this file never imports. The
+  // adapter takes it through a caret range, and each release of the plugin raises the
+  // wrangler version it demands at startup, so an unpinned install pairs a new plugin
+  // with our pinned wrangler and `astro dev` exits before it is ready. The direct pin
+  // makes pnpm install the same plugin for the adapter. Move it and `wrangler` together:
+  // they release as a pair, and apps/api (once added) pins the same two versions.
   adapter: cloudflare({ imageService: "compile" }),
   integrations: [react()],
   // Fixed dev port. Every cross-origin consumer in this repo — the api Worker's CORS
@@ -50,6 +57,20 @@ export default defineConfig({
     // packages/ui/src/styles/globals.css, which Layout.astro imports via @repo/ui.
     plugins: [tailwindcss()],
     server: { strictPort: true },
+    // Dev only: pre-bundle every dependency the React components import before the
+    // first request. In dev the adapter renders inside workerd, and Vite's scan starts
+    // from the pages, so it never walks into @repo/ui (a linked workspace, not an npm
+    // package) or the islands a module drops in src/. Without these entries Vite finds
+    // lucide-react, @base-ui/react and the rest mid-request, re-bundles, and reloads the
+    // worker. The re-run components then import a fresh copy of react while
+    // react-dom/server holds the old one, and every hook throws "Invalid hook call".
+    // A glob, not an include list, so a component a module adds is covered with no edit
+    // here.
+    ssr: {
+      optimizeDeps: {
+        entries: ["src/**/*.tsx", "../../packages/ui/src/**/*.tsx"],
+      },
+    },
     resolve: {
       // `@web` mirrors saasaloy.json's alias of the same name (apps/web/src) — that
       // alias only drives the CLI's file-placement when a module's files[] target

package/templates/base/apps/web/package.json

@@ -4,27 +4,28 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "astro dev",
+    "dev": "astro dev --host",
     "build": "astro build",
     "clean": "rimraf dist .astro .wrangler",
     "preview": "astro preview",
     "deploy": "wrangler deploy"
   },
   "dependencies": {
-    "astro": "7.3.1",
-    "@astrojs/cloudflare": "14.3.0",
-    "@astrojs/react": "6.0.5",
-    "react": "19.2.8",
-    "react-dom": "19.2.8",
+    "astro": "7.3.5",
+    "@astrojs/cloudflare": "14.3.3",
+    "@astrojs/react": "7.0.0",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
     "@repo/ui": "workspace:*"
   },
   "devDependencies": {
+    "@cloudflare/vite-plugin": "1.62.3",
     "@tailwindcss/vite": "4.3.3",
-    "@types/node": "26.4.1",
-    "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.7",
+    "@types/node": "26.6.3",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
     "rimraf": "6.1.3",
     "tailwindcss": "4.3.3",
-    "wrangler": "4.129.0"
+    "wrangler": "4.145.0"
   }
 }

package/templates/base/apps/web/wrangler.jsonc

@@ -2,6 +2,13 @@
   "$schema": "node_modules/wrangler/config-schema.json",
   "name": "{{PROJECT_NAME}}-web",
   "compatibility_date": "2026-07-22",
+  // `astro dev` renders inside workerd, and @astrojs/react's server renderer keeps a
+  // dynamic `import("node:stream")` for the Node streaming path. That path never runs
+  // here (workerd resolves react-dom/server to the edge build), but without this flag
+  // @cloudflare/vite-plugin warns "Unexpected Node.js imports" on every dev start. The
+  // adapter only adds `nodejs_als` on its own. It costs nothing while the site is
+  // assets-only, and the first `prerender = false` page gets Node APIs with no edit.
+  "compatibility_flags": ["nodejs_compat"],
   // Static assets, and still no Worker code — but the layout moved. Registering
   // @astrojs/cloudflare in astro.config.mjs (for src/pages/500.astro) makes Astro build
   // to dist/client + dist/server instead of a flat dist/. While every page is

package/templates/base/package.json

@@ -23,22 +23,22 @@
     "typecheck": "turbo run typecheck"
   },
   "devDependencies": {
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "husky": "9.1.7",
-    "lint-staged": "17.5.0",
-    "oxlint": "1.81.0",
-    "oxlint-tsgolint": "7.0.2001",
-    "prettier": "3.9.6",
-    "prettier-plugin-astro": "0.14.1",
+    "lint-staged": "17.6.0",
+    "oxlint": "1.86.0",
+    "oxlint-tsgolint": "7.0.2003",
+    "prettier": "3.9.9",
+    "prettier-plugin-astro": "1.1.0",
     "prettier-plugin-tailwindcss": "0.8.1",
     "rimraf": "6.1.3",
     "stylelint": "17.15.0",
     "stylelint-config-idiomatic-order": "10.0.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-prettier": "5.0.3",
-    "turbo": "2.10.12",
+    "turbo": "2.11.6",
     "typescript": "7.0.2",
-    "ultracite": "7.11.0"
+    "ultracite": "7.12.2"
   }
 }

package/templates/base/packages/ui/package.json

@@ -20,9 +20,9 @@
     "@base-ui/react": "1.8.0",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
-    "lucide-react": "1.41.0",
+    "lucide-react": "1.49.0",
     "shadcn": "4.21.0",
-    "tailwind-merge": "3.6.0",
+    "tailwind-merge": "3.7.0",
     "tailwindcss": "4.3.3",
     "tw-animate-css": "1.4.0"
   },
@@ -31,8 +31,8 @@
   },
   "devDependencies": {
     "@repo/tsconfig": "workspace:*",
-    "@types/react": "19.2.18",
-    "react": "19.2.8",
+    "@types/react": "19.3.0",
+    "react": "19.3.0",
     "rimraf": "6.1.3",
     "typescript": "7.0.2"
   }

package/templates/base/packages/ui/src/lib/theme.ts

@@ -48,6 +48,18 @@ export const THEME_LABELS: Record<Theme, string> = {
 
 const OS_DARK_QUERY = "(prefers-color-scheme: dark)";
 
+/**
+ * Whether a raw string is one of the three themes.
+ *
+ * `data-theme` is author-writable and `localStorage` holds whatever was last put there, so
+ * every value this module reads back out of the page arrives as `string | null`. Narrowing
+ * it here rather than asserting `as Theme` at each site is what keeps an unrecognised value
+ * on the fallback path instead of into `THEME_LABELS[...]`, where it reads `undefined`.
+ */
+export function isTheme(value: string | null): value is Theme {
+  return value === "light" || value === "dark" || value === "system";
+}
+
 /** The stored choice, or `system` when unset, unreadable or not a valid theme. */
 export function getStoredTheme(): Theme {
   try {
@@ -105,16 +117,55 @@ export function setTheme(theme: Theme): void {
 export function relabelThemeToggles(theme?: Theme): void {
   const root = document.documentElement;
   const painted = theme ?? root.getAttribute(THEME_ATTRIBUTE);
-  const named =
-    painted !== null && THEME_ORDER.includes(painted as Theme)
-      ? (painted as Theme)
-      : getStoredTheme();
+  const named = isTheme(painted) ? painted : getStoredTheme();
 
   for (const trigger of root.querySelectorAll(`[${THEME_TOGGLE_ATTRIBUTE}]`)) {
     trigger.setAttribute("aria-label", THEME_LABELS[named]);
   }
 }
 
+// The toggle's click handler, installed by `installThemeToggle` below. It lives at module
+// scope because it reads nothing from that function, and one identity per page means a
+// second install adds no second listener.
+function onClick(event: MouseEvent): void {
+  const { target } = event;
+  if (!(target instanceof Element)) {
+    return;
+  }
+  if (!target.closest(`[${THEME_TOGGLE_ATTRIBUTE}]`)) {
+    return;
+  }
+
+  const painted = document.documentElement.getAttribute(THEME_ATTRIBUTE);
+  // An unrecognised `data-theme` gives index -1 and starts the cycle at the head of
+  // THEME_ORDER.
+  const index = isTheme(painted) ? THEME_ORDER.indexOf(painted) : -1;
+  const next = THEME_ORDER[(index + 1) % THEME_ORDER.length] ?? "light";
+
+  setTheme(next);
+
+  // After `setTheme`, and unconditionally: a `system` press CLEARS THEME_STORAGE_KEY, so
+  // this key is the only record that the visitor pressed anything at all.
+  try {
+    localStorage.setItem(THEME_CHOICE_KEY, "1");
+  } catch {
+    // Unwritable storage costs persistence, not the current page.
+  }
+}
+
+// The OS half of the same job, and the reason this is not click-only. THEME_INIT_SCRIPT
+// registers its own matchMedia listener; a host that calls `installThemeToggle` instead
+// does not have that script, so without this listener a visitor on `system` keeps the
+// palette resolved at load until the next reload.
+//
+// It repaints only while the state is `system`. A visitor who picked light or dark said
+// so deliberately, and the OS must not overrule that.
+function onOsChange(): void {
+  if (getStoredTheme() === "system") {
+    setTheme("system");
+  }
+}
+
 /**
  * Install the toggle's click behaviour on `document`, and answer with a function that
  * removes it again.
@@ -130,47 +181,8 @@ export function relabelThemeToggles(theme?: Theme): void {
  * the same value forever and every press would land on the same theme.
  */
 export function installThemeToggle(): () => void {
-  function onClick(event: MouseEvent): void {
-    const { target } = event;
-    if (!(target instanceof Element)) {
-      return;
-    }
-    if (!target.closest(`[${THEME_TOGGLE_ATTRIBUTE}]`)) {
-      return;
-    }
-
-    const painted = document.documentElement.getAttribute(THEME_ATTRIBUTE);
-    // An unrecognised `data-theme` gives index -1 and starts the cycle at the head of
-    // THEME_ORDER.
-    const index = painted === null ? -1 : THEME_ORDER.indexOf(painted as Theme);
-    const next = THEME_ORDER[(index + 1) % THEME_ORDER.length] ?? "light";
-
-    setTheme(next);
-
-    // After `setTheme`, and unconditionally: a `system` press CLEARS THEME_STORAGE_KEY, so
-    // this key is the only record that the visitor pressed anything at all.
-    try {
-      localStorage.setItem(THEME_CHOICE_KEY, "1");
-    } catch {
-      // Unwritable storage costs persistence, not the current page.
-    }
-  }
-
-  // The OS half of the same job, and the reason this is not click-only. THEME_INIT_SCRIPT
-  // registers its own matchMedia listener; a host that calls this function instead does
-  // not have that script, so without this listener a visitor on `system` keeps the palette
-  // resolved at load until the next reload.
-  //
-  // It repaints only while the state is `system`. A visitor who picked light or dark said
-  // so deliberately, and the OS must not overrule that.
   const media = window.matchMedia(OS_DARK_QUERY);
 
-  function onOsChange(): void {
-    if (getStoredTheme() === "system") {
-      setTheme("system");
-    }
-  }
-
   document.addEventListener("click", onClick);
   media.addEventListener("change", onOsChange);