@shivaedev/create-app 0.34.0 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.36.0 - 2026-11-02
+
+### Added
+
+- Add `redactBrowserText` to mask quoted browser literals, including escaped quotes and multiline content, while preserving diagnostic shape and the existing server text policy.
+- Add opt-in `browserErrors` settings for an Error log per report, signed-in `user.id` attribution and session enforcement. The starter enables all three.
+
+### Fixed
+
+- Mask browser report messages and stacks before they reach diagnostic sinks and record reports at Error severity.
+- Apply starter updates to apps inside enclosing Git repositories while preserving sibling files and unrelated staged changes. Keep the generation record unchanged when a nonempty starter delta applies no changes.
+- Generated notes apps show an alert when adding or saving a note defects, keep the draft, and handle delete completion in the note's own action.
+- Generated Railway workers receive shared `RESEND_API_KEY`, `EMAIL_FROM` and `PUBLIC_URL` settings. Production workers require an explicit email sender at startup; deployment instructions describe queued auth email delivery and the worker's production settings.
+- Generated starter stories settle through screen pending signals and completed HTTP/live results instead of status markup or timed connection sampling. Remove the redundant third-party session lifecycle fixture and its teardown delays.
+
+## 0.35.0 - 2026-11-01
+
+### Added
+
+- Enforce `imports/admin-paths`: report admin-only source files outside an `admin/` path and admin files reached by member code, naming the destination folder. Follow production imports within each source tree while allowing registration composition and shared member dependencies.
+- Admit per-key budgets through `@shivaedev/rate-limit`, with an Effect-clock memory store, a PostgreSQL adapter, and typed `TooManyRequests` carrying a retry time.
+- Include rate limiting in Platform and demonstrate a per-user note creation budget in generated applications.
+- Send transactional email through a Resend-backed Mailer or development log, with typed message queues, job-id idempotency, backoff and provider-timed rate-limit retries.
+- Read delivered messages and one-time links through a fake Resend inbox in stories.
+- Include the email package in Platform for applications, including the starter's queued authentication emails.
+
+### Fixed
+
+- Report production imports of the `@effect/platform-node` barrel with module subpaths that avoid loading optional integrations such as redis.
+- Recognize native Effect `catchTags` record keys regardless of the handler body while retaining diagnostics for actual nested component and hook factories.
+- Keep a constant's matching filename valid when the constant becomes private.
+- Name each conflicting fix and format pass's file and line/column range when `quality fix` cannot settle.
+- Use Node platform module subpaths in package runtimes and commands instead of loading the barrel.
+
+### Breaking
+
+- Generated apps keep shared declarations outside the admin-only tree. Migrate custom `ReadStatistics` imports from `#admin/ReadStatistics.ts` to `#ReadStatistics.ts`, and custom `AdminNavigation` type imports from `#client/admin/Shell.tsx` to `#client/AdminNavigation.ts`.
+
 ## 0.34.0 - 2026-11-01
 
 ### Added

package/README.md

@@ -50,7 +50,7 @@ Run `pnpm run setup` after cloning the generated repository to install dependenc
 
 ### Take starter updates
 
-Run `pnpm dlx @shivaedev/create-app@latest update` in a generated app with a clean Git working tree to take later starter changes. The command reads `.create-app.json`, downloads the recorded generator’s starter and uses Git’s three-way merge to replay its changes against the current starter; app edits survive, deleted files stay deleted, and conflicts are listed and left for you to resolve. Once the starter changes apply, including a merge with conflicts, `.create-app.json` records the current generator version. The command runs `pnpm install` and the app’s `pnpm run typecheck`, lists every non-ignored file with conflict markers and any unresolved Git conflicts, and exits nonzero while those or either check’s failures remain. Resolve the reported problems and rerun install and typecheck before committing. If pnpm reports a trust downgrade, the command preserves the rejected package and version and gives `pnpm update --depth Infinity` to re-resolve transitive dependencies under the existing trust policy; an exact manifest or catalog pin must first be changed to a trusted version. An update adds the admin Users registration and route to an app that lacks them, and lists conflicts where the app customized those parts.
+Run `pnpm dlx @shivaedev/create-app@latest update` in a generated app with a clean app directory in Git to take later starter changes. Apps inside an enclosing repository receive the changes within their own directory; sibling files and unrelated staged changes stay untouched. Only the app directory must be clean. A nonempty starter delta that applies no changes fails without advancing `.create-app.json`. The command reads `.create-app.json`, downloads the recorded generator’s starter and uses Git’s three-way merge to replay its changes against the current starter; app edits survive, deleted files stay deleted, and conflicts are listed and left for you to resolve. Once the starter changes apply, including a merge with conflicts, `.create-app.json` records the current generator version. The command runs `pnpm install` and the app’s `pnpm run typecheck`, lists every non-ignored file with conflict markers and any unresolved Git conflicts, and exits nonzero while those or either check’s failures remain. Resolve the reported problems and rerun install and typecheck before committing. If pnpm reports a trust downgrade, the command preserves the rejected package and version and gives `pnpm update --depth Infinity` to re-resolve transitive dependencies under the existing trust policy; an exact manifest or catalog pin must first be changed to a trusted version. An update adds the admin Users registration and route to an app that lacks them, and lists conflicts where the app customized those parts.
 
 ### Reuse the generator