Changelog

Fixed

• Social sign-in failures now show a toast, invitation Accept uses the primary button, and list caches refresh after admin/org/settings mutations.

Fixed

• Invitation Accept uses the primary button, revoke/rename/password flows refresh the right caches, and admin access no longer depends on Permix setup timing.

Fixed

• Social sign-in failures now show a toast, invitation Accept uses the primary button, admin access no longer depends on Permix middleware timing, and list caches refresh after admin/org/settings mutations.

New

• Introduced typed `@repo/permissions` with Permix for admin, organization, and payment gates across oRPC and the SaaS UI.
• Admin user bans: Added admin controls to ban users with an internal reason, optional expiration, active ban details, and unban actions.
• Agent skills: Added curated agent skills for common workflows like features, auth, payments, database changes, tests, and more.

Fixed

• Improved login form keyboard flow and polished Base UI button, dropdown, select, and destructive confirmation behavior.

Fixed

• Improved the login form tab order so password visibility controls are reached before the forgot-password link.

Improved

• Migrated the UI components from Radix UI to Base UI, the new default base of shadcn/ui, to align with the TanStack Start version. Composition now uses the render prop instead of asChild, and Radix state attributes (data-[state=open]) are replaced by data-[open], data-[closed] and friends. See the changelog in your repository for the full upgrade notes.

Fixed

• Auth redirects and indexing: Login, signup, OTP, and onboarding redirects now stay on safe SaaS paths, and protected SaaS pages are marked noindex.

Fixed

• Login, signup, OTP, verify, and onboarding redirects now stay on safe SaaS paths, and protected SaaS pages are marked noindex.

Fixed

• Redirect handling now only allows normalized SaaS paths, and protected SaaS pages are marked noindex.

Fixed

• Restored strict SEO rendering, kept favicon metadata typed, and aligned SaaS H3 types.

New

• The consent banner is now mounted in the marketing and SaaS apps and remembers allow or decline choices from the consent cookie.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas next to their handlers.
• Organization roles: The organization role selector is more compact and now shows only role names.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas next to their handlers.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas while preserving the existing TanStack response shapes.
• Organization roles: The organization role selector is more compact and now shows only role names.

Improved

• Aligned the marketing and docs favicon assets with the updated SaaS rocket app icon.

Improved

• Refreshed the SaaS shell with Plus Jakarta Sans, updated theme tokens, cleaner navigation, organization/user menus, auth screens, settings rows, rounded organization logos, and a new app icon.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Refreshed the Nuxt SaaS shell with Plus Jakarta Sans, zinc and slate theme tokens, cleaner navigation, organization and user menus, auth screens, settings rows, and rounded organization logos.
• Favicons: SaaS, marketing, and docs now share the same rocket favicon.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Refreshed the SaaS shell with Plus Jakarta Sans, updated theme tokens, cleaner navigation, organization/user menus, auth screens, settings rows, and rounded organization logos.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.
• Favicons: SaaS, marketing, and docs now share the same rocket favicon wiring.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Resend is now the default mail provider, and the Plunk provider plus PLUNK_API_KEY example have been removed.

Removed

• Removed the Dependabot configuration. Dependency updates are now handled manually or through AI-agent automation while pnpm's one-day minimum release age remains in place.