sporades 0.3.0 → 0.5.0

package/CHANGES.md

@@ -1,36 +1,30 @@
 # Changes
 
-## Unreleased - 2026-07-07
+## Unreleased - 2026-07-28
 
-Changes since v0.2.0.
+Changes since v0.4.0.
 
 ### 🚀 Features
 
-- Add doctor hosted capsule checks (5eb39af).
-- Add doctor local runtime checks (36d1d66).
-- Add doctor capsule authoring checks (3561a09).
-- Add doctor project security checks (a474750).
-- Add doctor command envelope (3786aa2).
+- Add GitHub Pages documentation site (5cf865d).
 
 ### 🐛 Bug Fixes
 
-- Fix generated server upload helpers (8d310be).
+- Fix stale Docker container detection (adafcab).
+- Fix privileged runtime dependencies in generated bundles (bd72d9b).
+- Refine documentation (d99e8a4).
+- Remove superceded/ fixed security issue tracker doc (3befc2d).
 
 ### 📝 Documentation
 
-- MD formatting (223cd5c).
-- Harden database transaction coverage (a68beb2).
-- Update roadmap for current/next features (6a72e1d).
-- Plan transaction coverage audit (85a3bcc).
-- Document doctor workflow and roadmap status (ff2eb9c).
-- Plan sporades doctor diagnostics (f52f67a).
-- Update documentation files in the working tree: docs/api/functions/client.createHooks.html, docs/api/functions/client.isAuthenticated.html, docs/api/functions/client.onMessage.html, docs/api/functions/client.sendMessage.html, docs/api/functions/server.Boolean.html, docs/api/functions/server.capsule.html, docs/api/functions/server.Date.html, docs/api/functions/server.endpoint.html, docs/api/functions/server.Json.html, docs/api/functions/server.message.html, docs/api/functions/server.mutation.html, docs/api/functions/server.Number.html, docs/api/functions/server.query.html, docs/api/functions/server.Reference.html, docs/api/functions/server.requireAuth.html, docs/api/functions/server.String.html, docs/api/functions/server.table.html, docs/api/types/client.AppMessage.html, docs/api/types/client.AppMessageStream.html, docs/api/types/client.AuthApi.html, docs/api/types/client.AuthProviders.html, docs/api/types/client.AuthState.html, docs/api/types/client.EmailCredentials.html, docs/api/types/client.FileMetadata.html, docs/api/types/client.FileReference.html, docs/api/types/client.FilesApi.html, docs/api/types/client.HookPrimitives.html, docs/api/types/client.JsonObject.html, docs/api/types/client.JsonValue.html, docs/api/types/client.MutationState.html, docs/api/types/client.PreferencesApi.html, docs/api/types/client.PreferencesResult.html, docs/api/types/client.ProviderState.html, docs/api/types/client.PublicFileUrl.html, docs/api/types/client.PublicUrlOptions.html, docs/api/types/client.QueryState.html, docs/api/types/client.SporadesError.html, docs/api/types/client.SporadesHooks.html, docs/api/types/client.SporadesResult.html, docs/api/types/client.Subscription.html, docs/api/types/client.UploadCompleteEvent.html, docs/api/types/client.UploadOptions.html, docs/api/types/client.UploadProgressEvent.html, docs/api/types/client.UseAuthState.html, docs/api/types/server.AclDatabaseHelpers.html, docs/api/types/server.AclHelpers.html, docs/api/types/server.AclStorageFileMetadata.html, docs/api/types/server.AclStorageHelpers.html, docs/api/types/server.AnyFieldDefinition.html, docs/api/types/server.AuthContext.html, docs/api/types/server.AutoFields.html, docs/api/types/server.Capsule.html, docs/api/types/server.CapsuleContext.html, docs/api/types/server.CapsuleDefinition.html, docs/api/types/server.CapsuleHooks.html, docs/api/types/server.ContextKind.html, docs/api/types/server.ContextMiddleware.html, docs/api/types/server.DatabaseFromSchema.html, docs/api/types/server.EndpointContext.html, docs/api/types/server.EndpointDefinition.html, docs/api/types/server.EndpointHandler.html, docs/api/types/server.EndpointOptions.html, docs/api/types/server.EndpointRequest.html, docs/api/types/server.FieldBuilder.html, docs/api/types/server.FieldDefinition.html, docs/api/types/server.FieldKind.html, docs/api/types/server.FieldValue.html, docs/api/types/server.InsertValues.html, docs/api/types/server.JsonValue.html, docs/api/types/server.Logger.html, docs/api/types/server.MaybePromise.html, docs/api/types/server.MessageApi.html, docs/api/types/server.MessageDefinition.html, docs/api/types/server.MessageHandler.html, docs/api/types/server.MessageScope.html, docs/api/types/server.MiddlewareContext.html, docs/api/types/server.MutationDefinition.html, docs/api/types/server.MutationHandler.html, docs/api/types/server.MutationHook.html, docs/api/types/server.MutationHookEvent.html, docs/api/types/server.MutationResult.html, docs/api/types/server.OrderDirection.html, docs/api/types/server.QueryDefinition.html, docs/api/types/server.QueryHandler.html, docs/api/types/server.ReferenceFieldBuilder.html, docs/api/types/server.ReferenceFieldDefinition.html, docs/api/types/server.RequireAuthOptions.html, docs/api/types/server.RowFromFields.html, docs/api/types/server.SchemaDefinition.html, docs/api/types/server.TableAclContext.html, docs/api/types/server.TableAclOperation.html, docs/api/types/server.TableAclRule.html, docs/api/types/server.TableAclRuleInput.html, docs/api/types/server.TableAclRules.html, docs/api/types/server.TableApi.html, docs/api/types/server.TableDefinition.html, docs/api/types/server.UpdateValues.html, docs/api/variables/client.auth.html, docs/api/variables/client.files.html, docs/api/variables/client.preferences.html.
-
-### 🧪 Tests
-
-- Audit transaction boundary coverage (f6268ef).
+- Expose privileged file ownership safely (6120904).
+- Link llms manifest from docs home (5d67abe).
+- Separate getting-started tutorial from reference (e75b9ba).
+- Reorder user guide reference topics (8be6380).
+- Restructure published user guide (fc8910e).
+- Document local Postgres usage (e269780).
+- Link package docs to GitHub Pages (d94d998).
 
 ### 📦 Packaging
 
-- Align scaffold version tests with package version (d3dc529).
-- Clean up npm package tarballs (6303628).
+- Publish LLM-friendly documentation sources (53d3fdd).

package/Dockerfile.base

@@ -8,9 +8,9 @@ LABEL com.sporades.base-image.name="sporades-base"
 LABEL com.sporades.base-image.version="0.1.0-node22-alpine"
 LABEL com.sporades.base-image.node="22"
 
-RUN apk add --no-cache openssh-server \
+RUN apk add --no-cache openssh-server fail2ban \
   && addgroup -g 10001 -S sporades \
-  && adduser -u 10001 -S sporades -G sporades \
+  && adduser -u 10001 -S sporades -G sporades -s /bin/sh \
   && mkdir -p /app /app/data /run/sshd \
   && ssh-keygen -A \
   && printf '%s\n' \

package/README.md

@@ -13,7 +13,8 @@
 </p>
 
 Designed as Agents-first, Sporades is a CLI-first platform for building, running, inspecting, and hosting
-small full-stack web Capsules.
+small full-stack web Capsules supporting vanilla Typescript, React, Preact, Inferno, Lit, SolidJS, Vue, and Svelte 
+for front-end clients.
 
 It is intended for developers and coding Agents who want deterministic commands
 instead of dashboards: scaffold a Capsule, run it locally, test the bundled
@@ -54,17 +55,17 @@ sporades host push --restart
 
 ## Documentation
 
-- [User guide](docs/user-guide.md): build, run, inspect, deploy, auth,
+- [User guide](https://mgscox.github.io/sporades/user-guide): build, run, inspect, deploy, auth,
   preferences, files, endpoints, messages, and common workflows.
-- [Architecture](docs/architecture.md): platform model, runtime modes, Host
+- [Architecture](https://mgscox.github.io/sporades/architecture): platform model, runtime modes, Host
   server design, and ownership boundaries.
-- [Runtime layout](docs/runtime-layout.md): generated files, mounts, Host
+- [Runtime layout](https://mgscox.github.io/sporades/runtime-layout): generated files, mounts, Host
   directories, and persistent data locations.
-- [Host server installation](docs/server-installation.md): prepare a Linux Host
+- [Host server installation](https://mgscox.github.io/sporades/server-installation): prepare a Linux Host
   server for Hosted Capsules.
-- [Product requirements](docs/PRD.md): implemented scope, deferred scope, and
+- [Product requirements](https://mgscox.github.io/sporades/PRD): implemented scope, deferred scope, and
   core product principles.
-- [Roadmap](docs/ROADMAP.md): candidate features and promotion status.
+- [Roadmap](https://mgscox.github.io/sporades/ROADMAP): candidate features and promotion status.
 
 ## A Tiny Capsule - the entire server code for a real-time 'to-do' app
 
@@ -112,17 +113,32 @@ export default capsule({
 });
 ```
 
-Client scaffolds wire `sporades/client` into React or Preact hooks so the UI can
-subscribe to queries and run mutations without hand-rolled fetch plumbing.
+Client scaffolds wire `sporades/client` into React or Preact hooks, Vue
+composables, Svelte stores, SolidJS signals, Lit reactive controllers, native Inferno lifecycle adapters, or framework-neutral subscriptions
+so the UI can consume queries, mutations, and auth without hand-rolled fetch plumbing.
 
 ## What You Get
 
 Sporades currently includes:
 
-- React and Preact project scaffolds with `blank`, `todo`, `guestbook`, and
-  `photo-library` templates.
+- React, Preact, and Vue project scaffolds with `blank`, `todo`, `guestbook`,
+  `photo-library`, and `campfire` templates. Vue uses native Single-File
+  Components; Campfire is the complete consented User journey tracker exemplar.
+- Svelte/Vite project scaffolds across the complete template set, with native
+  components and lazily observed stores. Campfire preserves identity-safe
+  consent, caller-renewed Journey TTL state, and deterministic cleanup.
+- SolidJS/Vite scaffolds across the complete template set, with native JSX,
+  signals, identity-safe Campfire consent, and reactive-root cleanup.
+- Lit/Vite Web Component scaffolds across the complete template set, with
+  component styles and host-lifecycle reactive controllers. Campfire preserves
+  serialized identity-safe consent, explicit Journey TTLs, and cleanup.
+- Inferno scaffolds across the complete template set, using native class-component
+  lifecycle and classic Inferno JSX without React compatibility packages. esbuild
+  remains the default; Vite is available explicitly with full-page Dev refresh.
 - Local Dev sessions with rebuilds, WebSocket reconnects, SQLite persistence,
-  logs, database inspection, auth helpers, and file storage.
+  logs, database inspection, auth helpers, and file storage. Every admitted
+  esbuild/Vite pair uses the same acknowledged Sporades full-page refresh
+  protocol after a successful client rebuild; no pair promises HMR.
 - Local Docker Container sessions for production-like staging tests.
 - Hosted Capsules on SSH-reachable Host servers, routed through Caddy and run in
   hardened Docker containers.
@@ -153,7 +169,9 @@ npm install --global sporades
 sporades --help
 ```
 
-Sporades depends on `esbuild` for Capsule bundling. On newer npm versions, you
+Sporades depends on `esbuild` for the Server Bundle and default client builds;
+React and Preact clients can explicitly use the runtime-owned Vite adapter;
+Vue, Svelte, SolidJS, and Lit select Vite. On newer npm versions, you
 may see an `allow-scripts` warning during global install because `esbuild` uses
 a postinstall script to select the native binary for your platform.