create-thexjs-app@1.1.1

Patch Changes

• 369e737: Fix two issues in the generated projects produced by the scaffolder:

  • The .gitignore was silently missing from generated projects because npm
    strips files named .gitignore from published tarballs, even inside nested
    template directories. Templates now ship an _gitignore file that the
    scaffolder renames to .gitignore when copying the base template, so the
    file survives publication.
  • git init now forces the default branch to main (git init -b main)
    instead of inheriting the user's init.defaultBranch config, which could
    otherwise produce a master branch.

create-thexjs-app@1.1.0

Minor Changes

• 4ecb4e2: Redesign the scaffolder around a single universal base template with
  interactive feature selection (Next.js-style), powered by @clack/prompts.
  Users choose from Tailwind CSS, shadcn/ui, a SQLite-backed demo auth, and
  content collections instead of picking a full pre-built app template.

  • Generated projects now auto-initialize a git repo and ship a complete
    .gitignore.
  • New JSON / non-interactive CLI flags for scripting: --tailwind,
    --shadcn, --auth, --content, --no-install, --no-git, --dev.
  • Removes the five large app templates (basic, blog, default, landing, saas)
    in favor of the lean addon system.

@thexjs/core@1.2.2

Patch Changes

• c0ff88f: Make env-leak detection fail production builds loudly instead of silently
  degrading. A leaked server-only variable was previously caught by
  assertNoEnvLeakage, but the build continued and emitted a non-interactive
  fallback island while logging only a routine warning — a dead island in
  production that looked like a recovered build error. Now x build aborts
  with an EnvLeakageError (non-zero exit, visible to CI/CD), while the dev
  server keeps serving but logs a visually distinct SECURITY warning instead
  of a generic build error so it can't be mistaken for a hot-reload hiccup.

@thexjs/auth@3.0.2

Patch Changes

• Updated dependencies [c0ff88f]
  • @thexjs/core@1.2.2

@thexjs/adapter-vercel@1.0.3

Patch Changes

• Updated dependencies [c0ff88f]
  • @thexjs/core@1.2.2

@thexjs/core@1.2.1

Patch Changes

• baa688f: Fix a link-sanitization bypass in markdown rendering: control characters (tab, newline, carriage return) embedded in a link URL's scheme portion could evade scheme allowlisting while a browser strips them before parsing, turning a blocked link into a live javascript:-class link. URLs are now scrubbed of these characters before scheme detection and before being written into the emitted href.

  This shipped in 1.1.0 and is present through 1.2.0. Disclosure details are handled separately; this entry deliberately omits a working payload.

@thexjs/core@1.2.0

Minor Changes

• fbd5e29: Extract the platform-agnostic adapter pipeline (build-manifest resolution,
  per-file transpile, standalone render-function bundling, entry generation)
  into @thexjs/core/adapter as a documented Adapter SDK. @thexjs/adapter-vercel
  now composes the SDK (adding only its Node<->Web Request/Response bridge and
  Build Output API v3 .vercel/output tree), so third-party adapters (Node,
  Cloudflare, ...) reuse the same build core instead of reverse-engineering it.

  @thexjs/adapter-vercel now requires @thexjs/core@^1.2.0 (the release that
  introduces the @thexjs/core/adapter subpath) so consumers can never resolve
  the adapter against an older core that lacks the SDK export.

  Also hardened the generated Vercel entry: forwarded headers (x-forwarded-proto
  / x-forwarded-host) are validated instead of blindly trusted, streamed
  responses honor socket backpressure and cancel on client disconnect, the error
  path guards against already-sent headers, generated paths are project-relative,
  and non-JSON-serializable runtime options fail the build instead of silently
  dropping (keeping the deployed function aligned with x start).

• 58aa123: Add production-grade observability metrics: createInMemoryMetrics() (an in-process registry serving /metrics in Prometheus text format), createOtlpMetricsReporter() (forwards counters/histograms to an OpenTelemetry meter), and withRequestMetrics(). When passed as observability.metrics to createApp, every request records x_http_requests_total, x_http_request_duration_ms, and x_http_errors_total (plus x_rate_limit_rejections_total), and a /metrics endpoint is served ahead of routing when the reporter exposes one.

@thexjs/cli@1.1.0

Minor Changes

• 43fa19d: Add x doctor: a project diagnostics command that checks Bun version, config
  presence/parse, expected directories (pages/api/actions/layouts/content/public),
  route-tree compilation, installed @thexjs/* packages, and -- for production
  envs -- server-only env access across pages/actions and a missing AUTH_SECRET.
  Exits non-zero when problems are found.

Patch Changes

• Updated dependencies [fbd5e29]
• Updated dependencies [58aa123]
  • @thexjs/core@1.2.0
  • @thexjs/adapter-vercel@1.0.1

@thexjs/auth@3.0.1

Patch Changes

• Updated dependencies [baa688f]
  • @thexjs/core@1.2.1

@thexjs/auth@3.0.0

Minor Changes

• f22aaae: Add role-based access control. Sessions now carry roles/permissions (from the provider's user or a new resolveRoles hook on defineAuth, snapshotted at session creation). New pure helpers (hasRole, hasAnyRole, hasPermission, hasAllPermissions), fail-closed guards (requireRole, requirePermission, requireAuth), and middleware adapters (toMiddleware, plus auth.requireRole(...) / auth.requirePermission(...) / auth.requireAuth() / auth.guard(...)) that plug into the framework's route middleware. Signed out → 401, authenticated but unauthorized → 403, optional redirectTo for signed-out users.

Patch Changes

• Updated dependencies [fbd5e29]
• Updated dependencies [58aa123]
  • @thexjs/core@1.2.0