saasaloy 0.5.1 → 0.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saasaloy",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Composable SaaS accelerator kit.",
   "keywords": [
     "saas",
@@ -39,6 +39,7 @@
   },
   "scripts": {
     "build": "tsup",
+    "clean": "rimraf dist coverage",
     "prepack": "pnpm -w run readme:cli && pnpm run build",
     "dev": "tsup --watch",
     "start": "node ./dist/index.js",
@@ -54,6 +55,7 @@
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "release-it": "21.0.2",
+    "rimraf": "6.1.3",
     "tsup": "8.5.1",
     "vitest": "5.0.0"
   },

package/templates/base/apps/web/astro.config.mjs

@@ -36,6 +36,13 @@ export default defineConfig({
   // `imageService: "compile"` optimises images during the build and serves the results
   // as plain assets. The adapter's default would reach for Cloudflare's IMAGES binding
   // at runtime, which needs a Worker this site does not have.
+  //
+  // package.json pins @cloudflare/vite-plugin, which this file never imports. The
+  // adapter takes it through a caret range, and each release of the plugin raises the
+  // wrangler version it demands at startup, so an unpinned install pairs a new plugin
+  // with our pinned wrangler and `astro dev` exits before it is ready. The direct pin
+  // makes pnpm install the same plugin for the adapter. Move it and `wrangler` together:
+  // they release as a pair, and apps/api (once added) pins the same two versions.
   adapter: cloudflare({ imageService: "compile" }),
   integrations: [react()],
   // Fixed dev port. Every cross-origin consumer in this repo — the api Worker's CORS
@@ -50,6 +57,20 @@ export default defineConfig({
     // packages/ui/src/styles/globals.css, which Layout.astro imports via @repo/ui.
     plugins: [tailwindcss()],
     server: { strictPort: true },
+    // Dev only: pre-bundle every dependency the React components import before the
+    // first request. In dev the adapter renders inside workerd, and Vite's scan starts
+    // from the pages, so it never walks into @repo/ui (a linked workspace, not an npm
+    // package) or the islands a module drops in src/. Without these entries Vite finds
+    // lucide-react, @base-ui/react and the rest mid-request, re-bundles, and reloads the
+    // worker. The re-run components then import a fresh copy of react while
+    // react-dom/server holds the old one, and every hook throws "Invalid hook call".
+    // A glob, not an include list, so a component a module adds is covered with no edit
+    // here.
+    ssr: {
+      optimizeDeps: {
+        entries: ["src/**/*.tsx", "../../packages/ui/src/**/*.tsx"],
+      },
+    },
     resolve: {
       // `@web` mirrors saasaloy.json's alias of the same name (apps/web/src) — that
       // alias only drives the CLI's file-placement when a module's files[] target

package/templates/base/apps/web/package.json

@@ -4,27 +4,28 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "astro dev",
+    "dev": "astro dev --host",
     "build": "astro build",
     "clean": "rimraf dist .astro .wrangler",
     "preview": "astro preview",
     "deploy": "wrangler deploy"
   },
   "dependencies": {
-    "astro": "7.3.1",
-    "@astrojs/cloudflare": "14.3.0",
-    "@astrojs/react": "6.0.5",
-    "react": "19.2.8",
-    "react-dom": "19.2.8",
+    "astro": "7.3.5",
+    "@astrojs/cloudflare": "14.3.3",
+    "@astrojs/react": "7.0.0",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
     "@repo/ui": "workspace:*"
   },
   "devDependencies": {
+    "@cloudflare/vite-plugin": "1.62.3",
     "@tailwindcss/vite": "4.3.3",
-    "@types/node": "26.4.1",
-    "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.7",
+    "@types/node": "26.6.3",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
     "rimraf": "6.1.3",
     "tailwindcss": "4.3.3",
-    "wrangler": "4.129.0"
+    "wrangler": "4.145.0"
   }
 }

package/templates/base/apps/web/wrangler.jsonc

@@ -2,6 +2,13 @@
   "$schema": "node_modules/wrangler/config-schema.json",
   "name": "{{PROJECT_NAME}}-web",
   "compatibility_date": "2026-07-22",
+  // `astro dev` renders inside workerd, and @astrojs/react's server renderer keeps a
+  // dynamic `import("node:stream")` for the Node streaming path. That path never runs
+  // here (workerd resolves react-dom/server to the edge build), but without this flag
+  // @cloudflare/vite-plugin warns "Unexpected Node.js imports" on every dev start. The
+  // adapter only adds `nodejs_als` on its own. It costs nothing while the site is
+  // assets-only, and the first `prerender = false` page gets Node APIs with no edit.
+  "compatibility_flags": ["nodejs_compat"],
   // Static assets, and still no Worker code — but the layout moved. Registering
   // @astrojs/cloudflare in astro.config.mjs (for src/pages/500.astro) makes Astro build
   // to dist/client + dist/server instead of a flat dist/. While every page is

package/templates/base/package.json

@@ -23,22 +23,22 @@
     "typecheck": "turbo run typecheck"
   },
   "devDependencies": {
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "husky": "9.1.7",
-    "lint-staged": "17.5.0",
-    "oxlint": "1.81.0",
-    "oxlint-tsgolint": "7.0.2001",
-    "prettier": "3.9.6",
-    "prettier-plugin-astro": "0.14.1",
+    "lint-staged": "17.6.0",
+    "oxlint": "1.86.0",
+    "oxlint-tsgolint": "7.0.2003",
+    "prettier": "3.9.9",
+    "prettier-plugin-astro": "1.1.0",
     "prettier-plugin-tailwindcss": "0.8.1",
     "rimraf": "6.1.3",
     "stylelint": "17.15.0",
     "stylelint-config-idiomatic-order": "10.0.0",
     "stylelint-config-standard": "40.0.0",
     "stylelint-prettier": "5.0.3",
-    "turbo": "2.10.12",
+    "turbo": "2.11.6",
     "typescript": "7.0.2",
-    "ultracite": "7.11.0"
+    "ultracite": "7.12.2"
   }
 }

package/templates/base/packages/ui/package.json

@@ -20,9 +20,9 @@
     "@base-ui/react": "1.8.0",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
-    "lucide-react": "1.41.0",
+    "lucide-react": "1.49.0",
     "shadcn": "4.21.0",
-    "tailwind-merge": "3.6.0",
+    "tailwind-merge": "3.7.0",
     "tailwindcss": "4.3.3",
     "tw-animate-css": "1.4.0"
   },
@@ -31,8 +31,8 @@
   },
   "devDependencies": {
     "@repo/tsconfig": "workspace:*",
-    "@types/react": "19.2.18",
-    "react": "19.2.8",
+    "@types/react": "19.3.0",
+    "react": "19.3.0",
     "rimraf": "6.1.3",
     "typescript": "7.0.2"
   }

package/templates/base/packages/ui/src/lib/theme.ts

@@ -124,6 +124,48 @@ export function relabelThemeToggles(theme?: Theme): void {
   }
 }
 
+// The toggle's click handler, installed by `installThemeToggle` below. It lives at module
+// scope because it reads nothing from that function, and one identity per page means a
+// second install adds no second listener.
+function onClick(event: MouseEvent): void {
+  const { target } = event;
+  if (!(target instanceof Element)) {
+    return;
+  }
+  if (!target.closest(`[${THEME_TOGGLE_ATTRIBUTE}]`)) {
+    return;
+  }
+
+  const painted = document.documentElement.getAttribute(THEME_ATTRIBUTE);
+  // An unrecognised `data-theme` gives index -1 and starts the cycle at the head of
+  // THEME_ORDER.
+  const index = isTheme(painted) ? THEME_ORDER.indexOf(painted) : -1;
+  const next = THEME_ORDER[(index + 1) % THEME_ORDER.length] ?? "light";
+
+  setTheme(next);
+
+  // After `setTheme`, and unconditionally: a `system` press CLEARS THEME_STORAGE_KEY, so
+  // this key is the only record that the visitor pressed anything at all.
+  try {
+    localStorage.setItem(THEME_CHOICE_KEY, "1");
+  } catch {
+    // Unwritable storage costs persistence, not the current page.
+  }
+}
+
+// The OS half of the same job, and the reason this is not click-only. THEME_INIT_SCRIPT
+// registers its own matchMedia listener; a host that calls `installThemeToggle` instead
+// does not have that script, so without this listener a visitor on `system` keeps the
+// palette resolved at load until the next reload.
+//
+// It repaints only while the state is `system`. A visitor who picked light or dark said
+// so deliberately, and the OS must not overrule that.
+function onOsChange(): void {
+  if (getStoredTheme() === "system") {
+    setTheme("system");
+  }
+}
+
 /**
  * Install the toggle's click behaviour on `document`, and answer with a function that
  * removes it again.
@@ -139,47 +181,8 @@ export function relabelThemeToggles(theme?: Theme): void {
  * the same value forever and every press would land on the same theme.
  */
 export function installThemeToggle(): () => void {
-  function onClick(event: MouseEvent): void {
-    const { target } = event;
-    if (!(target instanceof Element)) {
-      return;
-    }
-    if (!target.closest(`[${THEME_TOGGLE_ATTRIBUTE}]`)) {
-      return;
-    }
-
-    const painted = document.documentElement.getAttribute(THEME_ATTRIBUTE);
-    // An unrecognised `data-theme` gives index -1 and starts the cycle at the head of
-    // THEME_ORDER.
-    const index = isTheme(painted) ? THEME_ORDER.indexOf(painted) : -1;
-    const next = THEME_ORDER[(index + 1) % THEME_ORDER.length] ?? "light";
-
-    setTheme(next);
-
-    // After `setTheme`, and unconditionally: a `system` press CLEARS THEME_STORAGE_KEY, so
-    // this key is the only record that the visitor pressed anything at all.
-    try {
-      localStorage.setItem(THEME_CHOICE_KEY, "1");
-    } catch {
-      // Unwritable storage costs persistence, not the current page.
-    }
-  }
-
-  // The OS half of the same job, and the reason this is not click-only. THEME_INIT_SCRIPT
-  // registers its own matchMedia listener; a host that calls this function instead does
-  // not have that script, so without this listener a visitor on `system` keeps the palette
-  // resolved at load until the next reload.
-  //
-  // It repaints only while the state is `system`. A visitor who picked light or dark said
-  // so deliberately, and the OS must not overrule that.
   const media = window.matchMedia(OS_DARK_QUERY);
 
-  function onOsChange(): void {
-    if (getStoredTheme() === "system") {
-      setTheme("system");
-    }
-  }
-
   document.addEventListener("click", onClick);
   media.addEventListener("change", onOsChange);