- Remove `TemplatesList` and its Shiki pre-render pipeline; `adapter` and `previews` are no longer fetched or returned from `getModuleDetail`
- Replace `CommandPreview` + `Selections` wiring in `Install` with a direct `buildAddCommand` call that takes `category` + `id`; adds `PackageManagerSelect` and `CopyableField` inline
- Add `buildAddCommand` to `selection.ts` — emits `pnpm dlx` / `bunx` / `npx stanza-cli@latest add <category> <id>` with no peer flags
- Track copy events via `@vercel/analytics` (`module_add_command_copied`)
- `stanza init --dry-run` no longer creates the project directory, monorepo shell, or `stanza.json`; the dry-run manifest is built with `emptyManifest` and package.json existence checks are skipped throughout `applyModule`
- Direct-fs codemods (`append-to-file`, `add-package-dep`, `set-tsconfig-paths`) now claim their region before writing so a failed `add` rolls back to true pre-apply bytes and `RegionConflictError` fires before any disk change
- `stanza remove` reads the `consumesPackages` snapshot persisted on each installed record (falling back to a live registry fetch only for legacy records), so package-dir protection holds offline and after upstream renames
- `stanza remove` only applies the legacy bare-id owner fallback when no sibling install of the same module remains, preventing one app's removal from sweeping another app's files on pre-composite-owner manifests
- `stanza doctor` no longer reports false drift for package-home modules installed with an `--app` restriction; `expectedConsumerApps` now intersects targeted apps from the manifest records
- `wrap-root-layout` resolves the framework per dispatched app, fixing multi-app projects with differing frameworks
- The codemod render context now carries `packageManager` so `{{pm}}`/`{{run …}}` templates render bun/npm/pnpm correctly instead of always defaulting to pnpm
- Add `storage`, `observability`, and `analytics` categories (with module tables) to the registry docs
- Add planned entries for `supabase` (auth + db), `turso`, `postmark`, `storybook`, `netlify`, `render`, and `fly`
- Tighten category table descriptions and drop redundant examples from the "What it covers" column
- Update `@types/node`, `semver`, TanStack Router/Start, `posthog-node`, `shadcn`, `fumadocs-mdx`, and a handful of other minor dep bumps across the monorepo
- Upgrade pnpm to 11.5.2
- Replace deprecated `.inputValidator(…)` calls with `.validator(…)` on all server functions
- **`app.dir` and region key path traversal.** `appSpecSchema` now validates `dir` with `safeRelativePath` at parse time (rejecting `..`, absolute paths, and null bytes); the `regions` record key receives the same treatment. `applyModule` and `cmdRemove` re-check every resolved write/delete destination with the new `assertWithinRoot` helper, which walks the full symlink chain so a planted link can't redirect file operations outside the project root even if the lexical check passes.
- **Env var line injection in `.env.example`.** `envVarSchema` now validates `name` against `^[A-Za-z_][A-Za-z0-9_]*$` and rejects control characters in `example` and `description`; the `appendEnvVar` helper applies the same check as defense-in-depth so a crafted third-party module can't smuggle extra `KEY=value` lines into the generated file.
- **Cleartext registry/npm endpoint rejection.** Remote `http://` URLs for `STANZA_REGISTRY`, `registries[*].url`, and `STANZA_NPM_REGISTRY` are now refused (`STANZA_REGISTRY`/`STANZA_NPM_REGISTRY` hard-error; third-party `http://` entries warn and skip so the rest of the CLI keeps working). `file://`, bare filesystem paths, and loopback hosts stay allowed for local-dev and CI-fixture workflows. Set `STANZA_ALLOW_INSECURE_REGISTRY=1` to opt into a trusted internal `http://` mirror with a one-time stderr warning.
- Enhanced descriptions in `AGENTS.md`, `cli.mdx`, and `getting-started.mdx` to provide clearer guidance on module categories and commands.
- Added information about third-party module publishing in `registry.mdx`.
- Adjusted the order of pages in `meta.json` for better navigation.
- Improved warning and info callouts for better user experience.
- Set `disableThanks`, `prettier: false`, `privatePackages: { version: false, tag: false }`, and `updateInternalDependents: "always"` in `.changeset/config.json`; simplify the release workflow by dropping `NPM_TOKEN` and `NPM_CONFIG_PROVENANCE` from the CI env and switching to `vp run version`
- Add `stanza-cli` as a second bin entry in `publishConfig` alongside `stanza` so the package is callable by either name; reset the CLI package version to `0.0.0` so changesets drive versioning from a clean baseline
- Update docs throughout to reflect the `doctor` command surface (CLI reference, agents guide, telemetry list), the main-file registry URL convention (`registries` entries now point at the full `index.json` URL, not a directory), and the `STANZA_REGISTRY` env var description
- **Registry main file.** The CLI now addresses any registry (first-party, third-party, or `STANZA_REGISTRY` override) by the full URL/path to its JSON index file. The `modules/<category>-<id>.json` convention, the in-repo source-tree loader, the directory-based auto-detect, and the inline-template disk fallback are all removed — one loader, no heuristics. `STANZA_REGISTRY` must be the full path/URL to the main file (not a directory); `registries` entries now carry `url` pointing at the main file instead of an `indexUrl`+template. **Breaking** (pre-release, clean break): registry index bumped to `schemaVersion: 2`; every module entry carries a `path` field resolved relative to the main file.
- **Auto-rollback.** `stanza add` (and each module in `stanza init`) now wraps its file writes in a transaction; a mid-apply failure restores touched files and `stanza.json` to their pre-apply state. `reportApplyFailure` updated to say "The change was rolled back" and demotes the `stanza remove` / `git restore` steps to a backstop note.
- **`stanza doctor`.** New read-only command that checks `stanza.json` against the filesystem (tracked files, deps, scripts, env vars, internal packages) and reports drift, exiting non-zero when found.
- Update integration tests to build the first-party registry once into a temp dir and point `STANZA_REGISTRY` at its main file; update the third-party HTTP fixture server to serve `/index.json` as the main file alongside per-module paths.
- Update `AGENTS.md` E2E smoke instructions and `apps/cli/README.md` to reflect the new loader and `doctor` command.
- Add `api` to the category taxonomy (`cardinality: "one"`, `home: package` → `packages/api/`) for a future typed RPC layer; no first-party modules yet — wizard skips it and the web builder hides it while empty
- Replace the raw `throw err` in `cmdAdd` with `reportApplyFailure`: a `RegionConflictError` states plainly that nothing was written; a mid-apply failure points at `stanza remove …` to sweep tracked files and (when a clean baseline was enforced) `git restore . && git clean -fd` to reset the worktree
- Add npm READMEs to `apps/cli` and `packages/create-stanza` covering quick-start, commands, safety flags, registries, and telemetry
- Unwrap hard-wrapped lines in `category-taxonomy.md` changeset and update AGENTS.md to reference the `compile-registry` vp task instead of the old `prebuild` script
- Add `registry.index.tsx` — a root registry landing page at `/registry` listing all modules; emit `/registry` in `prerender.ts` so it is prerendered alongside category and module paths
- Sort deps, scripts, env vars, and templates alphabetically (env vars: required-first then alpha; templates: by scope rank then dest) for consistent display order
- Rename OG image routes to include the `.webp` extension in the URL (`og.index.ts` → `og[.]webp.ts`, `og.docs.$.ts` → `og.docs.{$}[.]webp.ts`, `og.registry.$category.$id.ts` → `og.registry.$category.{$id}[.]webp.ts`) and update the default `ogImage` fallback in `seo.ts` to `/og.webp`
- Swap version/icon layout in `DepsTable` so version is hidden on hover and the external-link icon appears in its place
- Switch top-level stat cards to `size="sm"` with `!`-overrides on gap/padding to match the per-category card density
- Remove `pb-1` overrides from `CardHeader` in favour of the card's own `gap-2.5!` so spacing is driven consistently by the card gap
- Drop `curveType="monotone"` and `animationType="left-to-right"` from `ActivityChart` as they are unused/unsupported props
- Rename the template file and update `src`/`dest` in the adapter's file list to match the new `proxy.ts` convention required by Next 16
- Update the example filename in `AGENTS.md` and `authoring.mdx` (`middleware.ts` → `proxy.ts`) so the scope guidance stays accurate
- Refactor `BarList` bar fill to animate `width` instead of `transform: scaleX` so the gradient and rounded cap don't distort; replace diagonal hatch overlay with a solid gradient + inset ring and tighten leading gap to `gap-1`
- Add `aria-hidden="true"`, `aria-label`, `aria-labelledby`, `aria-expanded`, `aria-controls`, and `role="region"` attributes throughout builder, detail, docs, and search components
- Fix `describeError` for `incompatible-peer` to show the module's human-readable label instead of the raw peer ID string
- Replace `IconLoader2` spinner ad-hoc pattern with a shared `Spinner` component; delete unused `popover.tsx`
- Add `IconExternalLink` indicator to deps table rows and make version column `tabular-nums`
- Fix scripts table to use `break-words whitespace-pre-wrap` on the command column so long commands wrap instead of overflowing
- Add `truncate overflow-hidden` to the file preview path header bar
- Capitalize "Environment Variables", "Required", "Optional" badge labels; add trailing period to empty-state copy
- Refactor `use-pointer-capability` and `use-time-ago` hooks for clarity; update chart legend, tooltip, and activity chart components
- Fix internal doc links to use absolute paths (`#anchor` → `/docs/page#anchor`) in `authoring.mdx` and `registry.mdx` so they resolve correctly from any page
- Clarify `consumesPackages` description wording in the module field reference table
- Switch category badge on module detail page from `outline` to `default` variant for better visual hierarchy
- Nudge `IconCheck` margin, `Label` leading, and adapter-switcher category span font size for tighter alignment
- Normalize `CardTitle` color from `text-foreground/85` → `text-foreground/80` and `text-muted-foreground` across stats cards for consistency; add `size="sm"` to per-category cards and tighten card spacing
- Add `text-sm` to the "Learn more…" docs link on the home page so it inherits the correct size
- Lighten `LastRefreshed` text from `/70` → `/85` opacity for legibility
- Merge `deps-table.tsx` and `env-table.tsx` into a single `tables.tsx` that also exports a new `ScriptsTable`; split was unnecessary and the unified file is easier to maintain
- Add `count` prop to `Section` so all detail sections (templates, deps, env vars, scripts) show an item-count badge in the heading
- Link each dependency row in `DepsTable` to `npmx.dev` so users can inspect package versions directly
- Introduce `registry.$category.index.tsx` — a new category landing page at `/registry/<cat>` that lists all modules in that category
- Update `prerender.ts` to emit both `/registry/<cat>` (category index) and `/registry/<cat>/<id>` (module detail) paths so all public registry URLs are prerendered
- Replace `npm create stanza@latest` → `npm init stanza` and `bun create stanza@latest` → `bun create stanza` in docs, SKILL.md, and `buildCommand` to match how these package managers actually resolve the initializer
- Update the agents.mdx rule to reference `npm init` instead of `npm create`
- Derive `init` vs `create` sub-command in `buildCommand` based on the selected package manager so generated install snippets are correct for npm
- Condense `AGENTS.md` by moving CLI-specific guidance into `skills/stanza-cli/SKILL.md` where it is co-located with the skill it describes
- Expand `SKILL.md` with the relocated context so agent runs against the CLI skill have the full picture without loading root-level agent instructions
- Minor cleanup to `stats.tsx` layout/typography
- Delete `scripts/prepare-registry.sh` and its `prebuild`/`predev` npm lifecycle hooks
- Define a `compile-registry` task in `vite.config.ts` using the `run.tasks` API with explicit `input`/`output` globs so Vite can cache and skip the build step when sources are unchanged
- Add `getOrderedPages()` to `source.ts` that walks `source.getPageTree()` recursively so pages are yielded in the order declared by `meta.json` (sidebar order) rather than arbitrary filesystem order; replace `source.getPages()` in `llms-full.txt` and `docs-index.functions.ts`
- Enhance `getLLMText` to prepend the page description as a blockquote when present, and `trimStart()` the processed body so the output is clean
- Fix `useTimeAgo` to return `"just now"` for sub-minute diffs instead of the awkward `Intl.RelativeTimeFormat` "0 seconds ago" / "in 0 seconds" output
- Tighten `LastRefreshed` markup so the tooltip wraps only the relative-time string, not the surrounding prose
- Switch heading `font-semibold` → `font-medium` across stats and home pages; update category card title color from `text-muted-foreground` to `text-foreground/85` for better contrast
- New `DocsActions` component renders a `ButtonGroup` with a "Copy Page" button (fetches the `.md` alternate and writes it to the clipboard) and a chevron dropdown linking to View as Markdown, ChatGPT, Claude, and Perplexity — each AI link pre-fills a prompt with the page URL
- Wire `DocsActions` into the docs route's page header alongside the title/description, computing `markdownPath` and `pageUrl` from `page.url` and the exported `SITE_URL`
- Added @number-flow/react as a dependency to improve number display.
- Replaced the custom formatCount function with NumberFlow for projectsScaffolded and modulesInstalled stats, ensuring better formatting and handling of loading states.
- Updated LastRefreshed component's styling for improved readability.
- Extract a new `ModuleMetadata` type (rename of `ModuleSummary`) containing only the display/resolution fields needed client-side; the full `Module` graph (templates, codemods, file lists, etc.) stays server-side
- Replace the dual `modules: Record<string, Module>` + `summaries: ModuleSummary[]` props on `Builder` and `ModuleCards` with a single `metadata: ModuleMetadata[]`; category bucketing and `${cat}:${id}` keyed lookup are derived once via `useMemo` inside `ModuleCards`
- Teach `resolveAdapter` (and its call sites in `module-cards.tsx`, `selection.ts`, `resolver.ts`) to accept `ModuleMetadata` directly so adapter-compatibility checks no longer require a full `Module` lookup
- Update `builder-state.functions.ts` and the index route to project only metadata before the server function returns, removing the `state.modules` record from the serialized payload
- Replace hand-rolled `JSON.parse`/`JSON.stringify` round-trips in `json.ts` with `jsonc-parser` `modify` + `applyEdits` so comments, trailing commas, indentation, and key ordering are preserved across all `setJsonPath`, `unsetJsonPath`, `mergeJson`, and `addPackageDependency` calls
- Add `setJsonPathSegments` / `unsetJsonPathSegments` for callers whose keys contain `.` (tsconfig `paths` aliases like `"@acme/ui.foo/*"` would be mis-split by the dot-path API); export both from `packages/codemods/src/index.ts`
- Refactor `set-tsconfig-paths` to use the new segment-aware helpers and drop its local `parseJsonc` + `applyEdits` usage — the builtin no longer performs raw `fs.readFileSync`/`writeFileSync` itself
- Add `jsonc-parser` to `apps/cli/package.json` (was already a transitive dep; now explicit)
- Add `"format preservation (JSONC)"` test suite covering comment/trailing-comma survival, key-ordering stability under `addPackageDependency`, dotted-key segment addressing, and no-op behavior when a parent key is absent
- Refuse to sweep `packages/<dir>/` in two new cases: (1) stray non-Stanza files exist under the dir (user-authored secrets, scratch scripts, etc.), and (2) a still-installed module lists the dir in `consumesPackages` — both append to `manualCleanup` with targeted hints instead of silently destroying user work; `findStrayFiles` and `collectConsumesPackagesProtectors` (parallel `Promise.all` over all installed records) implement the checks
- Snapshot `codemods` onto each `StanzaModuleRecord` at install time; `remove` drives `revertCodemods` from that snapshot so reversal is correct even when the upstream registry has renamed the adapter or reshuffled codemod ids since install — falls back to the live registry entry only when no snapshot is present
- Fix cardinality scope in `add` for package-home and repo-home categories: pass `undefined` (not `pickedAppId`) to `selectedAll` so the per-project uniqueness check covers all apps; previously a second install targeting a different app could slip past the check only to fail on the next read
- Use composite owner keys (`<id>@<app>`) in `regionsOwnedBy` for app-home installs so two apps installing the same module don't share a region owner and accidentally release each other's claims during remove; bare `<id>` fallback covers pre-snapshot manifests and non-app homes
- Refactor `applyCodemods` / `revertCodemods` to accept `codemods`, `adapterKey`, and `consumesPackages` directly rather than full `Module` + adapter objects; add a comprehensive `codemod-runner.test.ts` covering apply, revert, dry-run, idempotency, and error paths for all built-in codemod types
- Add `packages/registry/src/safe-path.ts` with `safePath` / `isSafePath` guards and tests; use in the codemod runner to reject path-traversal write targets before any disk touch
- Add `set-tsconfig-paths` builtin codemod with tests; harden `add-array-entry-in-call`, `add-jsx-child`, `wrap-root-layout`, and `replace-import` for idempotency and edge cases
- Validate unknown `--app` flags early in `remove` with a targeted error before any registry fetch; replace the `posthog-provider` React component and `posthog.server.ts` in the web app with a unified `analytics.ts` / `api.events.ts` pattern
- Add `isLikelyNamespaceTypo` and `isValidModuleId` to `@stanza/registry` and gate both `add` and `remove` on them before any registry fetch or disk write — bare `@ns` specs and path-traversal-style ids now fail fast with a targeted hint instead of an opaque 404
- Add `captureModule` to the telemetry client: mirrors `capture("cli_module", ...)` but redacts the module id when the namespace is not `@stanza` so proprietary ids never leave the user's machine; replace all `capture("cli_module", ...)` call sites in `add`, `remove`, and `init`
- Parallelize `loadRegistries` via `Promise.all` so custom-namespace index fetches happen concurrently; split `tryFetchIndex` into three discrete try/catch blocks that differentiate URL-build errors (surfaced as warnings), network failures (silent), 404s (legitimate no-index), and schema-invalid 200s (warned)
- Re-stamp `version` to `CURRENT_MANIFEST_VERSION` in `readManifest` so older manifests are transparently upgraded in memory and the next `writeManifest` persists the new version; export `CURRENT_MANIFEST_VERSION` and `SUPPORTED_MANIFEST_VERSIONS` from `@stanza/registry`
- Move codemod-catalog id validation before `ensureSlotPackage` in `applyModule` so an unknown codemod id can't bootstrap a slot package and leave it orphaned on a mid-flight throw; validation still runs on `--dry-run`
- Add a dedicated empty-state branch in `search` for namespaces that are configured but expose no browsable index, directing users to `stanza add <category> <ns>/<id>` instead of a generic "No modules found"
- Add `packages/registry/src/registry-config.ts` with a Zod schema for the `registries` field in `stanza.json` (string URL prefix or `{ url, indexUrl?, headers?, params? }` object), plus `parseModuleSpec` to split `@ns/id` specs and `expandEnv` to substitute `${VAR}` tokens in header values (dropping the header silently when the env var is unset)
- Replace `loadRegistry` with `loadRegistries(manifest)` in `registry-loader.ts`; the loader reads `registries` from `stanza.json`, builds a per-namespace fetch client with auth headers, and routes module loads to the correct HTTP endpoint — `@stanza` remains the implicit default namespace backed by the existing registry URL
- Update `add`, `remove`, `search`, and `list` commands to accept `[@<namespace>/]<id>` syntax; `namespace` is recorded alongside each module entry in `stanza.json` at install time so `remove` knows which registry to refetch from
- Enforce that codemods are catalog-only: third-party modules may reference first-party codemod IDs but cannot introduce new ones; catalog ID validation runs before any writes so unknown IDs are caught on `--dry-run` too
- Add a full third-party registry test suite in `commands.test.ts` using a stub `node:http` server: covers install + manifest recording, unknown-namespace rejection, remove round-trip (asserts correct namespace URL is hit), `${ENV_VAR}` header expansion, and codemod-catalog enforcement
- Export `DEFAULT_NAMESPACE` and `parseModuleSpec` from `@stanza/registry`; telemetry `cli_module` events now include a `namespace` field so first- vs. third-party installs can be distinguished in PostHog
- Add `apps/web/content/docs/authoring.mdx` covering the full module-authoring reference (schema fields, templates, adapters, codemods, third-party registry config)
- Add `consumesPackages` field to `Module` and thread it into `buildRenderContext` / `TemplateContext` so templates can reference sibling package names; update `manifest.ts`, `package-json.ts`, `template.ts`, and their tests
- Queue all file/package.json/env writes behind a `deferredWrites` array so `writeManifest` always persists before any disk mutation — a mid-flush crash leaves the manifest as ground truth with no orphan files it can't account for
- Move codemod-catalog ID validation before any writes so `--dry-run` catches unknown codemod IDs without touching the filesystem; codemods now run in a second phase after deferred writes flush, with a follow-up `writeManifest` after claim gathering
- Wrap `init`'s module-apply loop in try/catch; on failure, log which modules were already applied and leave the partial project on disk for inspection rather than silently exiting
- Register a new `ai` category in `CATEGORIES` (cardinality `one`, home `packages/ai/`) so both modules land under the same single-choice slot
- Add `ai-vercel-ai-sdk`: installs `ai` + `@ai-sdk/openai`, emits a `model.ts` configured for `gpt-4o-mini`, a shared package entry-point, and a streaming `/api/chat` route for Next.js (`StreamingTextResponse`) and TanStack Start (`EventStream`); peers on `framework`
- Add `ai-tanstack-ai`: installs `@tanstack/ai` + `@tanstack/ai-openai`, emits an `adapter.ts` wrapping `openaiText("gpt-4o-mini")`, a shared entry-point, and a streaming `/api/chat` route for both frameworks via `toServerSentEventsResponse`; peers on `framework`
- Both modules declare `OPENAI_API_KEY` in `env` and ship provider-swap instructions in `readme.md`
- Update `registry.mdx` AI table: mark both modules 🟢 Available with short capability notes
- Drop `IconHome` anchor from `ModuleCard` header; only the `IconInfoCircle` details link remains (opacity toned down to `text-foreground/40`)
- Reword error messages (`describeError`), empty-state strings, route-boundary messages, and stats page copy for clarity and consistency
- Replace `rel="noreferrer"` with `rel="noopener noreferrer"` across header, footer, detail page, and stats
- Add external-link icon to footer GitHub anchor; add `hover:text-foreground` to footer nav links
- Fix `PreviewBlock` top spacing (`mt-4` moved to `pt-4` on the wrapper so the border-top sits flush)
- Add "audit the code" link to stats telemetry opt-out blurb pointing at the telemetry source file
- Add `recharts` and `motion` deps; register `@evilcharts` registry in `components.json`
- Vendor evilcharts primitives (`AreaChart`, `Chart`, `Dot`, `EvilBrush`, `Legend`, `Tooltip`, `Background`) under `components/evilcharts/`
- Add `ActivityChart` wrapper in `components/stats/` that uses the evilcharts `AreaChart` for the daily-run sparkline on `/stats`; replaces the hand-rolled inline-SVG `SparkAreaChart` (deleted)
- Update `stats.tsx` to render `ActivityChart` instead of the removed component
- Tighten `.gitignore`: add `.vercel`, collapse `.env.local` / `.env.*.local` to `.env*` with a `!.env.example` carve-out
- Convert `<button>` to `<div role="button">` with an `onKeyDown` handler (Space/Enter) so nested `<a>` and `<Link>` elements can be interactive without violating the no-interactive-in-button HTML rule
- Add an `IconHome` anchor next to the module label that opens `m.homepage` in a new tab when present; `e.stopPropagation()` prevents the click from toggling the card
- Add an `IconInfoCircle` TanStack Router `<Link>` that navigates to `/registry/$category/$id` for the full module details page; same stopPropagation guard applied
- Replace `file-preview`'s `useEffect`-based tree→URL sync with an `onSelectionChange` callback so the URL hash is the sole source of truth for `activePath`; drop `useFileTreeSelector` and the last-file latch ref in favor of a direct `hash && filePaths.includes(hash)` guard
- Simplify `ProjectSetup` to a nullable `draft` (null until first keystroke) + `useDebouncedCallback` so no sync effect or `lastSyncedRef` is needed to avoid echo-back from the URL-backed prop
- Remove `@tanstack/react-router-ssr-query`, `@tanstack/router-plugin`, `handlebars`, and `web-vitals` from `apps/web` deps — none were imported
- Delete the re-exported `summaryFor` helper from `adapter-switcher` (callers use `findModule` from `@stanza/registry` directly)
- Fix `PreviewBlock` code padding (`[&_pre]:p-4` → `[&_pre]:p-0`, add `mt-4` top margin)
- Fix intra-doc anchor in `getting-started.mdx` to use a relative `#` fragment instead of an absolute `/docs/getting-started#` path
- Replace the simple 1-hour hard TTL with a soft/hard split: cache hits younger than 1h are returned immediately with no work; hits between 1h and 24h are returned stale while a background `refreshAndCache` call (via `waitUntil`) updates the cache for the next visitor; only a true cold miss (first request per region or age ≥ 24h) blocks on the PostHog round-trip
- Extract `refreshAndCache` helper so the "fetch → conditionally write" logic is shared between the background and cold-miss paths; failed fetches still never pollute the cache
- Move the "Last refreshed" timestamp from the bottom of the telemetry section to directly under the page header so it's visible without scrolling
- Inline `HeroStat` and `TelemetrySection` subcomponents into `StatsPage`; they were single-use and the indirection added no value
- Wrap `SparkAreaChart` SVG in a `div` and move the last-point dot from an inline `<circle>` to an absolutely-positioned HTML `<span>` so it stays a perfect circle regardless of `preserveAspectRatio="none"` scaling
- Add `leading?: ReactNode` slot to `BarListEntry` so any icon, logo, or swatch can be rendered before the row name; wrap name + leading in a flex container so truncation still works
- Wire `ModuleLogo` into the stats page `BarList` as the `leading` element for each module row; refactor `moduleLabel` to `findModule` so the full `ModuleSummary` is available for both the label and the logo
- Add `/stats` to the prerender list so the page is statically generated at build time
- Add `svgo` as a dev dep and run each logo through `optimize` with `multipass: true` + `preset-default` at build time
- Apply the `prefixIds` plugin scoped to the module slug (e.g. `email-resend-light`) so gradient / clip-path `id` collisions between logos are impossible when multiple modules are rendered on the same page
- Add `/stats` route: server function fetches PostHog event aggregates (total runs, daily sparkline, top modules by installs, top modules by removes, command breakdown) and renders them with a `SparkAreaChart` + `BarList` layout; data is cached server-side with a 5-minute TTL via TanStack Start server functions
- Add `BarList` UI component: proportional horizontal-bar leaderboard, optional trailing label + href per row, empty-state fallback; no charting deps
- Add `SparkAreaChart` UI component: inline SVG area + stroke chart with native `<title>` tooltip targets, `--color-chart-1/2` for automatic dark-mode theming; no charting deps
- Add `posthog-query.server.ts`: typed PostHog HogQL query helper that hits the `/query` REST endpoint; separate query builders for the daily run series, per-module install/remove counts, and per-command totals
- Add Stats link to header nav and footer; minor footer font-size tweak (`text-xs` → `text-[13px]`)
- Document telemetry in `cli.mdx`: what's sent, what's never sent, opt-out options, and `STANZA_TELEMETRY_URL` env var for self-hosted ingest
- Add `declaredEnvNames(manifest)` to `@stanza/registry`: extracts a sorted, deduped list of env var names from `manifest.regions[".env.example"]` — the same keys the CLI records as modules apply; exported from the package index
- Add `env: string[]` to `TemplateContext` and an `envNames` option to `buildRenderContext`: sorts + dedupes the input so rendered output is stable regardless of module-apply order; defaults to `[]` when omitted
- Register a `{{json}}` Handlebars helper that `JSON.stringify`s any value (primary use: `"globalEnv": {{json env}}` in `turbo.json`, but generic enough for any template embedding a JS value into a JSON literal)
- Thread `envNames` through `codemod-runner`'s `renderContextFor` (derived from `declaredEnvNames(manifest)` so late-running repo-home modules like `monorepo-turbo` see all prior env claims) and through `synthesizeTemplates` + `synthesizeReadme` (aggregated from every resolved entry's merged install fields, matching what the CLI derives post-apply so CLI and web preview render identically)
- Update `monorepo-turbo/templates/turbo.json` to emit `"globalEnv": {{json env}}` so Turborepo task hashes track every project-wide env var; update `readme.md` to document the auto-population behavior
- Add `declaredEnvNames` tests (empty manifest, multi-key `.env.example` regions, non-env file regions ignored), `buildRenderContext` tests (sort+dedupe, omitted default), `{{json}}` helper tests (env array, empty array, missing key), and a `synthesizeTemplates` integration test verifying the aggregated env list flows into a rendered `turbo.json`
- Add `monorepo-turbo`: `turbo ^2.9.0` dev dep + a Handlebars-templated `turbo.json` at the repo root; module scripts (`dev`/`build`/`test`/`lint`) overwrite the pm-native fan-out defaults seeded by `rootPackageJson`; an `append-to-file` codemod adds `.turbo/` to `.gitignore` idempotently so both fresh `init` and `stanza add` projects are covered; light/dark logos inlined from svgl
- Add `pmRecursive(pm, script)` to `@stanza/registry` (and export it): produces the pm-native workspace-wide invocation (`pnpm -r run <s>`, `bun run --filter '*' <s>`, `npm run <s> --workspaces --if-present`); `rootPackageJson` now seeds all four root scripts via `pmRecursive` instead of hard-coding the pnpm form, and gains a `lint` entry that was previously missing
- Change `applyFields` script merging from guard-if-undefined to unconditional overwrite so a `monorepo` module's declared scripts can replace the seeded defaults; the same fix is applied to the `app`-overlay script path
- Fix `monorepo` category cardinality from `"many"` to `"one"` (only one task orchestrator makes sense per repo) and update its description
- Remove `.turbo/` from the hardcoded `.gitignore` written by `bootstrapShell` in `init.ts` — the module codemod now owns that entry
- Add `package-json.test.ts` coverage for `rootPackageJson` default scripts per pm and for monorepo module script overrides
- Add `email-resend`: `resend` SDK + `react-email` template in `packages/email/`; ships a shared `resend.ts` client, a sample `WelcomeEmail` component, and framework-native `/api/webhook/resend` Svix-verifier route handlers for Next.js and TanStack Start; light/dark logos inlined from svgl
- `RESEND_API_KEY` is required; `RESEND_WEBHOOK_SECRET` is optional and gates the webhook route
- Update `registry.mdx` resend row from 🟨 Planned to 🟢 Available with a feature summary
- Add `synthesizeReadme(resolved, ctx)` to `@stanza/registry`: generates a Markdown README from the assembled module selection using each module's `readme` / `description` copy; exported alongside new `Resolved` / `ResolvedEntry` types that capture the module + adapter pair after resolution
- Add `apps/cli/src/lib/readme.ts` with `writeFreshReadme` (used by `init` into a guaranteed-empty dir), `regenerateReadmeIfUnmodified` (used by `add`/`remove` to skip user-edited files), and `readmeChecksum` / `userModifiedReadme` helpers that compare SHA-256 against a new `readmeChecksum` field on `StanzaManifest`; a missing stored checksum with a present file is treated as user-owned (conservative, covers legacy projects)
- Wire README generation into all three commands: `init` calls `writeFreshReadme` after all modules apply and records the checksum; `add` and `remove` call `regenerateReadmeIfUnmodified` post-mutation and warn when the file has been edited; both update `stanza.json` with the new checksum on write
- Add `app` install-fields overlay in `codemod-runner.ts`: a per-module `installFields.app` bucket routes `dependencies`, `devDependencies`, and `scripts` into each consuming app's `package.json` rather than the workspace root or `packages/ui`; use case is package-home modules whose app-scoped shims import npm packages that belong in the app (e.g. `next-themes` for `ui-shadcn-*`); claims are recorded under `app.dependencies.<name>` region keys so removal can reverse them
- Fix `remove.ts` region handling: strip the `app.` prefix before dispatching `dependencies.*` / `devDependencies.*` / `scripts.*` removals so `app`-overlay claims are reversed correctly
- Add `pmRun(pm, script)` helper to `@stanza/registry` and use it in the `init` outro so the suggested dev command respects the project's package manager (e.g. `npm run dev` vs `pnpm dev`)
- Update `ui-shadcn-base` and `ui-shadcn-radix` module definitions to use the new `app` install-fields overlay for app-scoped peer deps; expand `package-json.test.ts`, `synthesize.test.ts`, and `template.test.ts` with coverage for the new paths
- Add `resolveExactVersion(name, version)` to `npm-version.ts`: wraps `resolveRange` with an implied `^${version}` range and strips the modifier from the result so callers get a bare pinned version suitable for Corepack; falls back to the input version on any lookup failure
- Rename the private `PM_VERSION` constant to `PM_FLOOR_VERSION` (exported from `@stanza/registry`) and store bare versions (no `${pm}@` prefix) so they can be fed directly into the resolver; the `rootPackageJson` helper now accepts an optional `packageManagerVersion` override and interpolates it into the `packageManager` field, falling back to the floor when absent
- Make `bootstrapShell` async in `init.ts` and call `resolveExactVersion` before writing `package.json` so newly-generated projects are pinned to the latest compatible release rather than a hardcoded floor; the web preview's synth path continues to use the floor as-is to avoid per-render npm lookups
- Add `resolveExactVersion` tests covering the happy path, `STANZA_NO_NPM_LOOKUP` bypass, network rejection fallback, and unsatisfied range fallback
- Rename `styling` → `ui` across the entire codebase (CATEGORIES array, docs, AGENTS.md, CLI tests, resolver, template tests, codemod runner); `ui` is `home: package` so shadcn installs into `packages/ui/` as a workspace dep rather than wiring directly into the app shell
- Add `ui-shadcn-base` (Tailwind v4 / CSS-first, no Radix peer) and `ui-shadcn-radix` (Tailwind v4 + Radix primitives) with full per-framework template sets for Next.js and TanStack Start: `components.json`, `globals.css`, `postcss.config.mjs`, `theme-provider.tsx`, shared `Button` + `utils.ts`; light/dark logos inlined from svgl
- Rename `styling-tailwind` → `ui-tailwind` to match the new category id; update its module definition to `category: "ui"` and `home: package`
- Add four new codemod builtins with tests: `add-array-entry-in-call` (inserts an element into a named array argument of any `CallExpression`), `replace-import` (rewrites a specifier in an existing import declaration), `set-html-attributes` (sets attributes on an HTML/JSX element by tag name or selector), `set-tsconfig-paths` (merges `compilerOptions` entries into a `tsconfig.json` AST node); register all four in the builtins index and export from `@stanza/codemods`
- Add `wrap-root-layout` builtin tests
- Update registry.mdx, concepts.mdx, cli.mdx, getting-started.mdx, agents.mdx, index.mdx, AGENTS.md, README.md, TODO.md, and SKILL.md to reflect the category rename and new modules
- Add `@tanstack/react-pacer` and swap both hand-rolled `setTimeout`-based debounce patterns (project-name commit in `project-setup.tsx`, module search fetch in `site-search.tsx`) for `useDebouncedValue`; the search effect now runs directly against the debounced value with an abort controller rather than nesting the fetch inside the timer
- Extract `useGracePeriod` from `file-preview.tsx` into `src/hooks/use-grace-period.ts` so it can be reused independently
- Hoist `fileSelection`, `lastFileRef`, `activePath`, and `preview` above the reseed effect in `file-preview.tsx` so the effect can reference `defaultPath` and `lastFileRef` without stale-closure issues; expand ancestor directories when a hash-driven selection lands so the highlighted row is visible in the tree
- Add `payments-stripe`: `stripe` SDK + framework-native Checkout Session / webhook route handlers for Next.js and TanStack Start; Better Auth bridge variant ships `@better-auth/stripe` and wires the plugin into `auth.ts` when `auth: better-auth` is selected; light logo inlined from svgl
- Sync the web builder's open file to the URL hash so refreshes and shared links restore the same selection; latch the last file path so folder-expand clicks don't wipe the preview; back/forward navigation reflects hash changes back into the tree; default-file selections don't pollute the hash (keeps shareable URLs clean)
- Trim over-explained JSDoc comments in `add-package-dep.ts` and `add-plugin-to-call.ts` to the terse one-liner style; condense the `init.ts` `fullPending` comment to match
- Update `registry.mdx` stripe row from 🟨 Planned to 🟢 Available with a brief feature summary
- Replace per-framework template files (`eslint.config.next.mjs`, `eslint.config.tanstack.mjs`) with a single `eslint.config.mjs` that branches via Handlebars `{{#if peers.framework}}` conditionals; add `handlebars` as a direct dependency to `@stanza/registry`, `apps/cli`, and `apps/web`
- Extend the template render context with a `peers: Partial<Record<CategoryId, string>>` map so any template can inspect the active framework, auth provider, etc.; thread it through `buildRenderContext`, `synthesizeTemplates`, the CLI `codemod-runner`, and the web `getBuilderState` server function
- Extract and export `activePeerIds(manifest, appId?)` from `@stanza/registry` to derive the peer map from a manifest (app-scoped for `home: app` categories); add `selectedPeerIds(selections)` in `apps/web/src/lib/selection.ts` as the URL-params-derived equivalent
- Add integration tests verifying framework-conditional eslint-prettier output for `default`, `next`, and `tanstack-start` adapters; expand resolver tests for `activePeerIds` app-scoping and for modules that declare both a `default` adapter and a framework-specific override
- Add `payments-polar`: `@polar-sh/sdk` + framework-native checkout/webhook route handlers for Next.js and TanStack Start; Better Auth bridge variant ships `@polar-sh/better-auth` and wires the plugin into `auth.ts` when `auth: better-auth` is selected; light/dark logos inlined from svgl
- Consolidate the registry build: delete `scripts/registry-build.ts` and move the emit logic into `packages/registry/src/build.ts`, which now accepts an optional positional output-base arg (defaults to `dist/`) and writes `{base}/registry/{index,modules/*}.json` + `{base}/schema.json` directly; `prepare-registry.sh` is reduced to a single `jiti packages/registry/src/build.ts apps/web/public` invocation; CI/release workflows drop the Bun setup + `registry:build` steps since the build now runs inline at web-app prebuild time
- Replace `add-vite-plugin` codemod with the more general `add-plugin-to-call` (targets any `CallExpression` by callee + arg position, not just `vite.config` `plugins` arrays); add `add-package-dep` builtin for imperatively injecting deps into a `package.json` AST node; both are fully tested and registered in the builtins index
- Fix `init` adapter resolution order: precompute a `fullPending` map from all peer-category picks before the apply loop so `resolveAdapter` sees the complete peer set regardless of `categoryOrder` traversal sequence; export `PEER_CATEGORIES` from `@stanza/registry` to support this
- Extract `getAllModules()` into `registry-modules.server.ts` as a singleton promise that loads the full module catalog once per server process; `getBuilderState` now pays the I/O cost exactly once per deployment rather than on every request
- Wrap `renderPreviewImpl` with an LRU cache (max 500 entries, keyed by `filePath + source`) so repeated Shiki highlight calls for unchanged files are returned from memory
- Add `lru-cache` as a direct dependency
- Introduce `AppSpec` (`{ id, dir, kind }`) and `AppKind = "web" | "native"` types; `stanza.json` now declares `apps: AppSpec[]` alongside modules, and `stanza init` scaffolds a default web app via `defaultWebApp()`
- Add optional `apps?: string[]` to `StanzaModuleRecord` to encode which apps a record targets; `home: app` modules require it, `home: package` modules use it to scope workspace deps (omitting means all apps), `home: repo` modules forbid it
- Make cardinality enforcement app-scoped for `home: app` categories: `selectedOne(m, cat, appId?)` and `selectedAll(m, cat, appId?)` now filter by app, and `add`/`remove` thread a `targetApp` through the runner so per-app single-choice rejection works correctly
- Extend the template render context with an `app: { id, dir, kind }` binding (plus the legacy `project.appDir` alias) re-bound per target app; the codemod runner fans out template/codemod/dep application once per consuming app in a loop
- Update `synthesizePackageJsons`, `synthesizeTemplates`, `buildRenderContext`, and related web-preview helpers to accept an `apps` array and produce per-app output
- Update `package-json.ts` to strip workspace deps from all apps' `package.json` on remove and to inject them into every consuming app on install
- Expand `manifest.test.ts` and `template.test.ts` with multi-app fixture coverage; add `"use client"` directive to codemod test files to satisfy the RSC boundary
- Refresh `AGENTS.md`, `SKILL.md`, and all affected docs (`concepts.mdx`, `registry.mdx`, `cli.mdx`, `getting-started.mdx`, `agents.mdx`) to document the new apps schema and routing semantics
- Removed `RoutePendingBoundary` from `route-boundaries.tsx` and its usage in `router.tsx`.
- Simplified router configuration by eliminating default pending component and related properties.
- Add `NavigationProgress` component that subscribes to `onBeforeLoad` / `onResolved` router events; defers 120 ms so instant cached-route navigations don't flash a bar, trickles toward 90% with an easing function, snaps to 100% on resolve, then fades out with a 200 ms hold; includes a 12 s safety-net reset in case `onResolved` never fires
- Extract `route-boundaries.tsx` with reusable error and pending boundary wrappers and wire them into `router.tsx` and `__root.tsx` (replacing the inline implementations there)
- Add `section.tsx` exporting `Section` (heading + children wrapper) and `SectionList` (bordered divided `<ul>`); refactor `deps-table.tsx`, `env-table.tsx`, `templates-list.tsx`, and `try-it.tsx` to consume them, removing the duplicated heading markup from each; rename `try-it.tsx` → `install.tsx` and its export `TryIt` → `Install` to match the section heading copy
- Add `posthog.server.ts` to centralise the PostHog server-side client initialisation
- Downgrade section and card headings from `font-semibold` to `font-medium` throughout `module-cards.tsx` and `section.tsx` for a lighter visual weight; miscellaneous footer/header spacing tweaks
- Replace the single `index` root-loader prop with `{ registry, docs }` and split `SiteSearch` to accept both; empty state renders the docs page list and all modules from the root payload, while typed queries fan out to new `/api/search/docs` (Fumadocs Orama) and `/api/search/modules` (server-side Orama) API routes so the client bundle never carries a full search index
- Add `api.search.docs.ts` wired to the Fumadocs search server and `api.search.modules.ts` that builds an in-memory Orama index over the full registry on each request (including richer fields than the client-side summary); add `docs-index.functions.ts` to enumerate docs pages for the root loader's empty-state list
- Unify module and doc results into a `Hit` discriminated union and a `Group` abstraction; `SearchRow` replaces `SearchResult` and dispatches navigation to `/registry/$category/$id` or an arbitrary docs URL; arrow-key selection and `⌘K` hotkey are preserved
- Pre-seed the hotkey label with the macOS format (`{ platform: "mac" }`) on first render to eliminate the null→label layout shift, then upgrade to the platform-correct value in a `useEffect`; add `@orama/orama` as a direct dependency
- Revert the `useMatch` / `m.isFetching` approach in `Builder` to a `useRouterState` selector that only sets `isReloading` when the router is loading *and* the resolved pathname hasn't changed; preserves the "don't flash on navigate-away" invariant without relying on internal match shape
- Add a `useGracePeriod(active, delayMs, minMs)` hook in `FilePreview` that mirrors TanStack Router's `defaultPendingMs` / `defaultPendingMinMs` semantics: the overlay is suppressed for the first 300 ms (skips the flash on fast loads) and, once shown, stays visible for at least 250 ms (avoids a flicker on near-misses)
- Add `@vitejs/plugin-rsc` and flip `components.json` to `rsc: true`; annotate all client-side UI components, builder pieces, docs sidebar/TOC, search, theme toggle, and footer with `"use client"` so the RSC boundary is explicit
- Replace the global `useRouterState({ select: s => s.isLoading })` in `Builder` with a `useMatch`-scoped `isFetching` selector so navigating away doesn't flash the file-preview overlay before the page unmounts; thread the result as an `isReloading` prop into `FilePreview` (removing the `useRouterState` import there entirely)
- Extract `apps/web/src/server/docs-meta.functions.ts` as a dedicated server functions module for the docs route; refactor `docs.$.tsx` to consume it
- Trim verbose inline comments throughout `file-preview.tsx`, `builder/index.tsx`, and `project-setup.tsx` (no logic changes)
- Extend `buildHead` / `HeadOutput` with a `scripts` field for `application/ld+json` injection and a `markdownPath` field for `<link rel="alternate" type="text/markdown">`; add `getWebSiteJsonLd`, `getTechArticleJsonLd`, and `getSoftwareSourceCodeJsonLd` helpers; wire them into the home, docs, and module-detail routes
- Add an `og.docs.$` route that generates per-page OG images for docs pages using the page title/description; rename `og.$slot.$id` → `og.m.$slot.$id` to match the `/m/` route structure; regenerate the route tree
- Replace `@vercel/og` with `@takumi-rs/image-response` in `og-card.server.tsx`; remove `@vercel/analytics` and its `<Analytics />` usage from the root layout
- Replace the scattered `[navigate, name, pm, optimistic, ...]` dependency arrays in `setName`, `setPm`, and `toggle` with a `latest` ref that always holds the current values; callbacks are now stable across optimistic flips so downstream `memo`/`useMemo` in `SlotCards` and `ModuleCard` actually prevent re-renders
- Memoize `parsed`, `selections`, `pending`, `byCategory`, and `categories` in `Builder` and `SlotCards`; hoist the `resolveAdapter` manifest stub as a module-level constant (`RESOLVER_MANIFEST`) to stop it from allocating on every card render; thread `selections` directly into `ModuleSection` so `isSelected` no longer allocates a closure per card
- Swap the `onNameChangeRef` manual-ref pattern in `ProjectSetup` for `useEffectEvent`; extract a shared `defaultPathFor` helper in `FilePreview` to deduplicate the `package.json`-fallback logic
- Rename `mode-toggle.tsx` → `theme-toggle.tsx`; move LLM txt routes under the `docs.` prefix (`docs.llms[.]txt.ts`, `docs.llms-full[.]txt.ts`) and regenerate the route tree; add `vercel.json`
- Add `content/docs/agents.mdx` covering SKILL.md installation, agent guidance rules, common errors, and an end-to-end scaffolding script; link from the docs index and reorder `meta.json` to surface it before `concepts`
- Replace every bare `stanza <verb>` example in `getting-started.mdx` and `cli.mdx` with `npx stanza-cli <verb>` to match the published package name and avoid global-install assumptions
- Update `registry.mdx`, web builder components (`project-setup`, `slot-cards`), `header`, `footer`, `index` route, and `styles.css` with miscellaneous copy and UI refinements; bump `vite.config.ts` and add one new `package.json` dependency
- Track the last value pushed upstream with `lastSyncedRef` so incoming `name` prop changes that are echoes of our own debounced push are ignored instead of overwriting mid-flight user input
- Gate the debounce effect on `lastSyncedRef.current` rather than the stale `name` prop so the timer fires correctly after a history-nav reset
- Add an `<IconAlertCircle>` prefix to `FieldError` and inline the capitalize logic to avoid the CSS-only `capitalize` class clobbering multi-word messages
- Add `apps/web/public/icon.svg` and wire it up as the `<link rel="icon">` favicon in the root route
- Extract a reusable `<Logo>` component (`components/logo.tsx`) using the MingCute icon SVG with `currentColor` fill; swap the plain "stanza" text link in `Header` for the icon with an `sr-only` label and `aria-label`
- Replace the text wordmark in `OgCard` and `OgDefault` with an inline data-URI `<img>` of the SVG using an explicit `#fafafa` fill (Satori doesn't propagate `currentColor` to images); remove now-unused `WORDMARK` and `BIG_WORDMARK` style constants
- Add `packages/registry/src/project-name.ts` with a `validateProjectName` helper backed by `validate-npm-package-name`; rejects scoped names (the user supplies only the bare name, stanza synthesizes `@<name>/db` etc.) and returns a typed `ProjectNameValidation` discriminated union; export from `@stanza/registry`
- Replace the inline regex in `apps/cli/src/lib/wizard.ts` (both interactive and `--yes` paths) with `validateProjectName` so error messages are consistent
- Update `apps/web/src/components/builder/project-setup.tsx` to call `validateProjectName` via `useMemo`, gate the debounced `onNameChange` callback to only fire on valid input, and display inline `FieldError` feedback (suppressed while the field is empty so the placeholder fallback isn't alarming); add `maxLength`, `aria-invalid`, and `aria-describedby` for accessibility
- Promote `renderTemplate` and `buildRenderContext` from `@stanza/codemods` into `@stanza/registry` alongside `synthesizeManifest`/`synthesizeEnvExample`/`synthesizePackageJsons`; add a new `synthesizeTemplates` export that returns the fully-substituted file list for a resolved selection so the web preview and the CLI apply path share identical logic
- Change the template DSL to dotted paths: `{{project.name}}` (was `{{projectName}}`), `{{project.appDir}}` (was `{{appDir}}`), `{{package.name}}` (was `{{packageName}}`), and `{{packages.<dir>.name}}` (was `{{<dir>PackageName}}`, e.g. `{{packages.db.name}}`); add a `TemplateContext` type exported from `@stanza/registry`
- Migrate all first-party modules (`auth-better-auth`, `auth-clerk`) to the new dotted syntax; fixes the web builder preview regression where tokens like `{{dbPackageName}}` appeared unsubstituted
- Update AGENTS.md docs and CLI `codemod-runner.ts` to reflect the new context shape and import locations
- Add a `tanstack-start` adapter to `auth-clerk` with `@clerk/tanstack-react-start` dependency, env vars, and templates (`provider.tsx`, `index.ts`, `start.ts`)
- Reorganize existing Next.js templates into a `next/` subdirectory and update `module.ts` src paths accordingly
- Update peers from `["next"]` to `["next", "tanstack-start"]` and reflect the completed TanStack Start support in the registry docs
- Include Fumadocs `source.getPages()` entries in `/sitemap.xml` alongside the home and module detail URLs; drop `changefreq` from all entries and make `priority` optional
- Enable `prerender` in `tanstackStart()` with `crawlLinks: false` so static pages are pre-built without a full crawl
- Make the `lazyPlugins` callback `async` and forward the Fumadocs source config to `mdx()` so the MDX plugin picks up the correct collection/source settings
- Remove the `!apps/web` exclusion from the root `vite.config.ts` test projects list now that the upstream vite-plus bug (`runner.config` undefined during suite collection) is resolved
- Add `/llms.txt` route using Fumadocs' `llms().index()` helper (follows the https://llmstxt.org convention) and `/llms-full.txt` that concatenates the processed Markdown of every docs page into a single response
- Enable `includeProcessedMarkdown` on the docs collection and add `getLLMText` + `markdownPathToSlugs` helpers in `lib/source.ts`
- Add `src/start.ts` with a `llmMiddleware` that intercepts `/docs/**` requests: serves raw Markdown when the path ends in `.md` or when the `Accept` header prefers Markdown (via `fumadocs-core/negotiation`), short-circuiting TanStack Start's normal rendering
- Add skip-to-content link, `theme-color` meta tags for light/dark, `role="status"` + `aria-live` on the file-preview loading spinner, and `aria-hidden` on decorative icons throughout
- Scope `transition-*` on `Button` and `ModeToggle` to explicit properties instead of `transition-all`; add `overscroll-contain` to `DialogContent` and the `SiteSearch` results list; add `focus-within:ring` to the search input wrapper and `focus-visible:ring` to `CopyableField`
- Suppress `autoFocus` in `SiteSearch` on touch devices, add `translate="no"` to mono/code content, set `type="search"` / `autoComplete="off"` / `spellCheck={false}` on search and name inputs, and shorten doc page titles ("CLI reference" → "CLI", "Module registry" → "Registry")
- Add `concepts.mdx` covering categories, cardinality, home, vendoring, peers/adapters, manifest, regions, and the open registry model
- Flesh out `getting-started.mdx` with prerequisites, install/run steps, package-manager variants, inspect/remove commands, and a non-interactive `--yes` example
- Rewrite `cli-reference.mdx` with per-verb sections, global flags, environment variables, and dependency-versioning semantics
- Expand `README.md` with a "Why Stanza?" section, quick-start snippet, docs link, and updated module list; swap `pnpm create` example for `npm init`
- Add `concepts` to `meta.json` nav order
- Delete `components/copy-button.tsx` and replace it with `components/ui/copy-button.tsx`; the new version is a proper shadcn-style primitive that uses the enhanced `Tooltip` for its label and fires an `onCopy` callback after a successful write
- Add `components/ui/copyable-field.tsx` — a composable field that pairs a monospace text display with the new `CopyButton` in a single bordered row; `CommandPreview` now delegates to `CopyableField` instead of managing its own `<pre>` + icon button
- Add `hooks/use-pointer-capability.ts` — a `matchMedia(pointer: fine)` hook that distinguishes touch-only devices from mouse/stylus inputs; used to conditionally suppress hover-only affordances
- Expand `components/ui/tooltip.tsx` with a `nativeButton` prop on `TooltipTrigger` and better composability; use it in `slot-cards.tsx` to show disabled-card reasons as a tooltip instead of appending inline muted text below the card
- Expand `components/ui/scroll-area.tsx` with scrollbar-corner and horizontal scrollbar sub-components so the primitive is fully composable
- Add icons (sun / moon / laptop) to `ModeToggle` dropdown items; make the GitHub header button `size="icon"` and inline the anchor JSX; rename the detail-page "Try it" heading to "Install"
- Replace the `active && "bg-muted"` conditional class in `SiteSearch` results with a plain `hover:bg-muted` rule; remove `no-scrollbar` from the results list so native scrollbars reappear on pointer devices
- Replace `usePackageManager` (a localStorage-backed hook) with a `pm` field in `BuilderSearch` / `toSearchParams`; the package manager is now a first-class URL param that survives share links, back/forward, and optimistic navigation — `DEFAULT_PACKAGE_MANAGER` (`"npm"`) is used as the fallback
- Make `CommandPreview` fully controlled: drop the internal `usePackageManager` call and accept `pm` + `onPmChange` as props; wire a `setPm` callback in `Builder` that navigates like `setName`; keep local `useState` in `TryIt` (detail page) since it has no URL to write into
- Move `CommandPreview` out of `ProjectSetup` and into `FilePreview`'s header bar so the install command is always visible beside the file tree; `ProjectSetup` loses its `selections` prop and the command section, shrinking to the project-name field only
- Replace `FilePreview`'s `moduleCount: number` prop with `header: ReactNode` so the pane accepts arbitrary header content rather than computing its own file/module-count summary string
- Drop `yarn` from `PACKAGE_MANAGERS` and remove `YarnLogo` from `PackageManagerSelect`; the three remaining options (`npm`, `pnpm`, `bun`) cover all supported scaffolders
- Replace the `slot` / `add-on` discriminated-union split with one `Category` shape carrying two orthogonal fields: `cardinality` (`"one"` for single-choice, `"many"` for coexisting) and `home` (`"app"` / `"repo"` / `"package"`) — the old `packageDir` + `repoScoped` pair is dropped
- `Module` is no longer a discriminated union; it carries a single `category` field referencing a `Category` id; `KNOWN_SLOTS`, `KNOWN_ADDONS`, `ADDON_CATEGORIES`, and all related helpers are replaced by a single `CATEGORIES` array and derived `categoryHome` / `categoryLabel` / `PACKAGE_DIRS` lookups
- Manifest schema bumped to version `0.2` — `modules` is now one record keyed by category holding arrays; `cardinality: "one"` categories are enforced to ≤ 1 entry at install time; no migration (stanza is pre-1.0 and unpublished)
- Peer/constraint logic is now emergent from cardinality: the resolver treats only `cardinality: "one"` categories as peers, so `testing` (many) can never accidentally become a peer; install routing is a single `categoryHome` lookup shared by the CLI runner, codemod runner, and web preview
- Update all CLI commands (`add`, `remove`, `init`, `list`, `search`), the wizard, `codemod-runner`, `registry-loader`, all web builder/detail/search components, server functions, OG route, sitemap, analytics, and selection logic to use the new category API
- Update all first-party `module.ts` files, `registry-build.ts`, tests, and docs (`AGENTS.md`, `REGISTRY.md`, `SKILL.md`) to reflect the unified taxonomy
- Wrap `setSelection` and `toggleAddon` in `startTransition` + `useOptimistic` so card borders and checkmarks flip instantly on click; the preview pane continues to wait on committed loader data (server-rendered Shiki HTML) and shows its own spinner for that round-trip
- Fire-and-forget `getHighlighter()` during the initial `getBuilderState` call so the Shiki singleton is warm before the first slot toggle, eliminating cold-start latency on the first preview render
- Fix `initialExpandedPaths` replay in `FilePreview`: filter the expanded-dir set to only directories whose entire ancestor chain is also expanded, preventing a collapsed parent from being re-opened when its still-flagged descendant is replayed
- Hoist the loading overlay outside the empty/non-empty branch so it also covers the initial `filePaths === []` → content transition, where `filePaths` is still stale while the loader is in flight
- Promote `tooling` from an add-on category to a single-choice **slot** in `KNOWN_SLOTS`/`SLOTS` and remove it from `KNOWN_ADDONS`/`ADDON_CATEGORIES`; the three toolchains are mutually exclusive substitutes so single-choice semantics fit, and nothing peers on `tooling` so it bears no outbound dispatch constraints
- Add `registry/modules/tooling-eslint-prettier` — ESLint flat config + Prettier with per-framework adapters (`next` → `eslint.config.next.mjs`; `tanstack-start` → `eslint.config.tanstack.mjs`) and a shared `prettier.config.mjs`; scripts: `lint: "eslint ."`, `format: "prettier --write ."`
- Add `registry/modules/tooling-biome` — Biome 2.x with a single `default` adapter (framework-agnostic `biome.json`); scripts: `lint`, `format`, `check`
- Add `registry/modules/tooling-oxlint-oxfmt` — Oxlint + oxfmt with a single `default` adapter (`dot_oxlintrc.json`, `dot_oxfmtrc.json`); scripts: `lint`, `format`
- Drop `lint: "next lint"` from `framework-next` — `next lint` was removed in Next 16, so the tooling module now owns `scripts.lint` cleanly
- Add CLI tests covering `init --yes --tooling eslint-prettier`, framework-next shipping no lint script without a tooling pick, `add tooling biome` on an existing project, and slot-already-filled rejection
- Add `MANIFEST_SCHEMA_URL` constant and `manifestJsonSchema()` function to `packages/registry/src/manifest.ts`; the schema is derived from `StanzaManifestSchema` via `z.toJSONSchema` and decorated with `$id`, `title`, and `description`
- Add `$schema` field to the `StanzaManifest` type and `StanzaManifestSchema`; `emptyManifest` populates it automatically and `writeManifest` in the CLI spreads `$schema` first so pre-existing manifests gain the pointer on their next write
- Extend `scripts/registry-build.ts` to write `dist/schema.json` alongside the registry output; update `prepare-registry.sh` to copy `dist/schema.json` to `apps/web/public/schema.json` so it is served at the web root
- Gitignore `apps/web/public/schema.json` as a generated artifact
- Add `src/components/posthog-provider.tsx` — initializes the `posthog-js` browser SDK once (guarded by `VITE_PUBLIC_POSTHOG_KEY` and `posthog.__loaded`) with history-based pageview capture, pageleave tracking, and session replay + autocapture disabled; wraps the app shell in `__root.tsx` via `<PostHogProvider>`
- Add `src/lib/analytics.ts` with a `useAnalytics` hook that returns a stable `capture` callback bound to the PostHog singleton (no-ops when the key is absent or the SDK is uninitialized) and a `selectionProperties` helper that flattens slot/addon selections into a consistent event property shape across events
- Wire `capture` into `Builder` (`builder_module_selected`, `builder_module_deselected`, `builder_addon_toggled`) and `CommandPreview` (`builder_command_copied` with `package_manager`, `command`, `name_customized`, `module_count`, and per-slot properties); add an `onCopied` callback prop to `CopyButton` to fire the capture after a successful clipboard write
- Add `src/server/posthog.server.ts` — a lazy singleton that constructs a `posthog-node` `PostHog` client from `VITE_PUBLIC_POSTHOG_KEY`/`VITE_PUBLIC_POSTHOG_HOST` and returns `null` when unconfigured; refactor `/api/events` to use this client instead of a raw `fetch` to PostHog's `/batch/` endpoint, and flush via `waitUntil` from `@vercel/functions` so the serverless function stays alive past the response without blocking it
- Swap `mri` for `citty` and wrap every command handler with `defineCommand` so citty owns parsing, validation, and `--help` output; remove the hand-rolled `mri` parse block from `bin.ts` and simplify `run()` to accept no arguments
- Extract shared global flags (`--dry-run`, `--dangerously-allow-dirty`, `--no-telemetry`) into a new `commands/_args.ts` as `commonArgs` that is spread into each subcommand's `args` definition; introduce a `CliArgs` open-record type for handler signatures
- Migrate `add`/`remove`/`init`/`list`/`search` command signatures from `({ positional, argv: Argv }) => …` to a flat `(args: CliArgs) => …` shape; declare `slot`, `moduleId`, and `name` as `type: "positional"` in their respective `defineCommand` blocks
- Update the `commands.test.ts` helper from `argv(flags)` to `args(flags)` to match the flat citty-parsed shape (named positionals promoted to top-level keys alongside booleans)
- `@pierre/trees`' built-in middle-truncate renders both halves flush together with no visible ellipsis when the content cell is narrow; inject `unsafeCSS` to collapse the truncate group container to a standard `overflow: hidden` / `text-overflow: ellipsis` block and hide the overflow half and marker cell entirely
- Add `apps/cli/src/lib/telemetry.ts` — a dependency-free telemetry module that accumulates events in memory and flushes them as a single `fetch` POST at the end of each run; identity is an ephemeral per-process UUID (no on-disk state); suppressed by `--no-telemetry`, `STANZA_TELEMETRY=0`, `DO_NOT_TRACK=1`, or any recognized CI environment variable
- Wire `telemetry.configure` / `telemetry.capture` / `telemetry.flush` into `run.ts` so every command emits a `cli_command` event (with `status` and `duration_ms`) and individual `init`/`add`/`remove` calls emit `cli_module` events (with `action`, `group`, and `module`)
- Rename the `mri` boolean from `no-telemetry` to `telemetry` in `bin.ts` so mri's `--no-` prefix convention populates `argv.telemetry === false` as `isTelemetryDisabled` expects
- Add `apps/web/src/routes/api.events.ts` — a TanStack Start API route that receives the CLI's batched event payload and forwards each event to PostHog via the REST `capture` endpoint using `POSTHOG_API_KEY`; non-`POST` requests, missing keys, and upstream errors all return appropriate status codes without leaking details
- Document the `--no-telemetry` flag, `STANZA_TELEMETRY`, and `DO_NOT_TRACK` env vars in `skills/stanza-cli/SKILL.md`
- Restyle the mobile docs `<details>` disclosure with a bordered summary, animated `IconChevronRight` chevron, and a top-border separator below the open panel instead of a bottom-border above it
- Tighten `NavLink` padding (`py-1`) and add `rounded` so the active highlight matches the app's pill style; reduce separator top-padding from `pt-4` to `pt-3`
- Add `closeOnClick` to every `DropdownMenuRadioItem` in `ModeToggle` and `PackageManagerSelect` so the menu closes after a selection
- Strip the `moduleGroup/id` monospace trailing span from `SearchResult` rows to reduce visual noise
- Remove the per-item inline padding override on Shiki `.line` elements (`pl-0! pr-0!`) so code blocks no longer get double inset
- Reduce docs article top padding on mobile (`pt-2`) while keeping `md:pt-8` on wider viewports
- Remove `cmdk` and the generated `src/components/ui/command.tsx` shadcn primitive; replace `CommandDialog` / `CommandInput` / `CommandList` / `CommandItem` in `SiteSearch` with a plain `Dialog` + `<input>` + `<button>` elements so the component owns its own rendering without the cmdk abstraction layer
- Add `@tanstack/react-hotkeys` and replace the hand-rolled `keydown` listener with `useHotkey(HOTKEY, …)`; use `formatForDisplay` (deferred to mount to avoid SSR hydration mismatch) so the `<Kbd>` badge shows `⌘K` on macOS and `Ctrl+K` on Windows/Linux
- Implement client-side fuzzy filtering via a local `matches` helper (splits query on whitespace, checks every term against a joined haystack of group/id/label/description) and drive the list from derived `filtered` / `groups` / `flat` memos
- Add keyboard navigation — `ArrowDown`/`ArrowUp` cycle `activeIndex` through the flat item list, `Enter` selects; `onPointerMove` on each row syncs hover → `activeIndex`; the active row scrolls into view via a `data-index` attribute + `scrollIntoView`
- Reset `query` and `activeIndex` when the dialog opens; reset `activeIndex` whenever `query` changes
- Pin `fumadocs-ui` to `npm:@fumadocs/base-ui@^16.9.0`
- Add `src/components/docs/docs-sidebar.tsx` — a bespoke sidebar that reads the Fumadocs page tree and renders a `<NavList>` of links using TanStack Router's `<Link>`; shows a `<details>` disclosure on mobile and a sticky `<aside>` rail on `md`+, active item highlighted via the site's `--accent` token
- Add `src/components/docs/docs-toc.tsx` — a bespoke table of contents that wraps Fumadocs' `AnchorProvider`/`useActiveAnchor` in a plain `<ul>` with depth-based padding; hidden below `xl`
- Replace `<DocsLayout>` / `<DocsPage>` / `<DocsTitle>` / `<DocsDescription>` in `docs.$.tsx` with the custom components and plain `<article>` markup so the docs page is fully owned by the site shell rather than Fumadocs' layout primitives; `baseOptions()` and `layout.shared.tsx` are deleted
- Simplify the Fumadocs CSS token override in `styles.css` — the `#nd-sidebar` specificity hack is no longer needed now that Fumadocs renders no sidebar of its own
- Move `bin` from the top-level field into `publishConfig` in both `apps/cli/package.json` and `packages/create-stanza/package.json` so the binary entries only apply to the published artifact, not local workspace resolution
- Add a `tslib` → `tslib/tslib.es6.mjs` alias in `vite.config.ts` to avoid Rolldown's CJS interop issue with tslib's UMD bundle in Vite 8
- Set `[--trees-border-radius-override:0px]` on the file-tree in `FilePreview` so selected rows render as flush rectangles rather than rounded pills
- Add `react-resizable-panels` dependency and a `ResizablePanelGroup` / `ResizablePanel` / `ResizableHandle` shadcn-style UI primitive in `src/components/ui/resizable.tsx`
- Replace the static `grid-cols-[260px_1fr]` layout in `FilePreview` with a `ResizablePanelGroup` (horizontal on `sm`+, vertical on mobile) so the tree and preview panes are user-draggable; default split is 35 / 65
- Add a `useMediaQuery` hook (SSR-safe, defaults to the wide layout to avoid hydration mismatch) to switch the panel group orientation at the `sm` breakpoint
- Fix `PreviewPane` height propagation — both the empty state and the code pane now use `h-full`/`flex-1`/`min-h-0` so the scroll container fills the resizable panel instead of relying on `max-h` clamps
jake
