redweb 0.13.5 → 0.15.0

package/CHANGELOG.md

@@ -1,6 +1,23 @@
-# Changelog
-
-## Unreleased
+# Changelog
+
+## Unreleased
+
+## 0.15.0
+
+- Include an Express-subtree `qs@6.16.0` override in generated application manifests and document the temporary root-policy requirement for existing consumers. This mitigation does not propagate from Redweb's dependency manifest or silently upgrade Express.
+- Bind server TSX controls directly to typed socket handlers with `rw-submit={Join}` and `rw-click={Move.with(payload)}`. Socket-bound pages use their registered route and the existing renderer/client runtime on one connection.
+- Expose a checked, connection-owned `socket.page(PageClass)` accessor for private server state. Preserve admission, exact page/route ownership, post-validation authorization, reconnect and cancellation fences; reserve internal rendering commands.
+- Add explicit handler `false` return semantics for recoverable rejections without a success acknowledgement. Existing handlers returning `undefined` still succeed. Use a correlated `sendProtocolError` before returning `false` to complete requesting clients.
+- Keep typed contract metadata browser-safe; custom page commands use published redweb-client 0.3.0 with terminal-response filtering, installed automatically by Redweb.
+
+## 0.14.0
+
+- Bound already-closing WebSocket peers with the native `ws` closing-handshake deadline: `websocketOptions.closeTimeout` defaults to 5000ms instead of 30000ms and remains configurable. Real TCP tests cover a peer withholding FIN; heartbeat, session expiry, and shutdown deadlines remain separate.
+- Introduce deferred `defineApp({ pages, sockets, services, port })` composition and `await app.run()` with one owned HTTP/WebSocket listener, ordered application service initialization, cancellation, bounded shutdown, and partial-startup rollback.
+- Run the five canonical headed-browser example scenarios through `defineApp`; cover its lifecycle with real HTTP/WSS, process, and unit tests. Recognize the unified page/socket registrations in `redweb doctor` without executing application code.
+- Simplify all six generated starters around `app.run()` and remove their copied startup helper. Move dashboard auth/database ownership into an application service; retain real generated-app process tests and centralize lifecycle coverage on the framework implementation.
+- Guard late native listener completion after cancellation or timeout on Node 18, and avoid racing duplicate deadlines during owned HTTP peer cleanup.
+- Preserve native constructor errors across JavaScript contexts while awaiting partial-startup cleanup, including the original already-listening error.
 
 ## 0.13.5