Release v0.0.139

• Build the client in isolated staging through integrity generation, prerendering and SSR extraction. Publish assets before HTML, then prune obsolete output. Compilation failures and cancellation preserve the previous client output instead of exposing missing or partially written chunks.

Release v0.0.138

• Erase historical two-factor settings and replay counters during account deletion, with bounded retryable cleanup, raw-byte release of old schemas, and generation fences that preserve session revocation across account recreation.
• Add server.authRoutes.deleteAccount; disabling factor setup still allows proof-backed removal of an existing factor.
• Build cold artifacts with the minimal collector and collect between resident calls on updated Node/native hosts, preserving daemon state without incremental barriers.
• Add exact RateLimit.TrailingWindow on Node and native hosts. Require ToilScript 0.1.67; deploy toil-backend 0.1.1 before using the new strategy or minimal cold runtime.
• Sort build-cache library listings and expose per-tier miss reasons with TOILJS_BUILD_CACHE_DEBUG=1.
• Correct auth/config and derive permission documentation; document native gas prices, measurement, routing, byte/write accounting, continuation polling and fresh Scylla keyspace readiness.

Validation: 808 framework tests pass with normal and strict database limits, alongside browser auth checks, both example builds/typechecks/lints, and a clean starter installation from a cached older CLI. See the release audit for all sixteen report items, additional regression fixes, and verification limits.

Release v0.0.137

• Compile request, stream, and daemon tiers in bounded parallel processes, dividing Binaryen's CPU budget among active jobs while preserving configured optimization levels and assertions.
• Reuse unchanged server tiers after checking actual dependency contents, failed import lookups, library listings, compiler implementation, options, and output hashes. Keep dependency manifests in .toil/compiler without duplicating compiled artifacts.
• Stage and validate tier outputs before publishing, isolate WAT, maps, bindings, and editor declarations, drain workers after failures or cancellation, and serialize complete builds of the same project across processes.
• Skip SSR/SSG module evaluation for routes with no matching exports and skip generic email rendering when every template is an auth override. Preserve re-exported and dynamic rendering opt-ins.
• Add TOILJS_BUILD_CACHE=0 for forced recompilation and TOILJS_BUILD_JOBS to limit concurrent compiler jobs. Custom transforms and extended compiler configs keep serial, uncached CLI behavior.
• On /root/nerva-ui, full recompilation improved from 28.6 seconds to 13.7 seconds and builds with unchanged server inputs took 2.6 seconds. All three Wasm artifacts were identical across full, cached, and forced-recompile runs. Validation includes 796 passing tests, framework build, typecheck, and lint.

Release v0.0.136

• Enable application server logging by default in development and keep production logs disabled unless server.logging: true is configured. Compile the policy into request, stream, and daemon Wasm artifacts, including edge deployments; rebuild after changing it.
• Support scalars, arrays, typed arrays, generated @data JSON, and errors through the ambient Log API, with log and debug convenience methods and matching editor declarations.
• Reset the log allowance for every stream event so resident connections continue logging after their first 32 messages. Preserve the per-call host limits.
• Extend the Node/SSR Logger with every log level, multiple values, object and error inspection, console formatting, and explicit production opt-in.
• Add configurable built-in auth route restrictions and cookie regression coverage from the previously unreleased changes on main.

v0.0.135

• Re-release the Google sign-in, authenticator security, and dependency updates from v0.0.134 with unchanged runtime behavior and ToilScript 0.1.66 compatibility.

Release v0.0.134

• Include Google sign-in, Google Authenticator, and hardened session management. Deploy the matching updated toil-backend first; session format 3 requires users to sign in again.
• Upgrade all available runtime and development dependencies to current stable versions, refresh root and example lockfiles, and align generated app defaults and optional Sass tooling.
• Publish version tags using npm trusted publishing through GitHub OIDC, with the current npm toolchain and no token-based registry configuration.

Release v0.0.132

• Declare the compiler-provided AuthUser type and __toildbResolve collection resolver in the shipped server globals so editors recognize them without application shims or generated lint output. Preserve custom @user fields through the generated principal declarations.

Release v0.0.131

• Preserve the browser Host header through the development Vite proxy so application origin-specific response policies, including localhost popup handoffs, receive the public origin instead of the internal loopback address. Retain multiple Set-Cookie headers, manual redirects, binary bodies, and HEAD handling.

Release v0.0.130

• Format browser security deployment instructions with colored headings and actions, aligned hosting guidance, and spaced rule blocks. Preserve complete copyable expressions and header values, generic project rules, and plain output when terminal colors are disabled.

Release v0.0.129

• Print generic Cloudflare deployment instructions after successful client builds, using the final generated header rules, configured hostname, complete policy values, and project-defined route exceptions.
• Support explicit script-src and script-src-elem overrides and an empty require-trusted-types-for array for script-injecting integrations such as Cloudflare analytics and challenges. Strict hash/nonce and Trusted Types defaults remain enabled unless explicitly overridden; document the reduced injection protection of compatibility settings.
• Correct RegExp compile-error guidance, the framed and domain-separated user-id derivation, and startup Job permissions throughout the docs and API comments.
• Ship the native auth vectors as a package JSON export and beside the generated protocol guide so its fixture link resolves.