v0.126.0

What's Changed

Bug Fixes 🐛

• Keep pnpm-lock.yaml in sync after josh-app init adds svelte-fast-check #282 by @joshuafolkken in #284
• Make josh-app start finish on a machine without a running Docker daemon #283 by @joshuafolkken in #287

Other Changes

• Adopt kit 1.1240.0 #276 by @joshuafolkken in #277
• Upgrade @joshuafolkken/kit to latest #279 by @joshuafolkken in #280
• Simplify the README to match kit's current layout #278 by @joshuafolkken in #281
• Upgrade @joshuafolkken/kit to latest #285 by @joshuafolkken in #286

Full Changelog: v0.120.0...v0.126.0

v0.120.0

What's Changed

Exciting New Features 🎉

• Add a Sound familiar? section to the README for SvelteKit + Cloudflare pains #264 by @joshuafolkken in #267
• Add README badges and adopt pnpm 12 #268 by @joshuafolkken in #269
• Migrate app-kit consumers from GitHub Packages to public npm #227 by @joshuafolkken in #273

Bug Fixes 🐛

• Use rune-aware svelte/prefer-const instead of core prefer-const for Svelte sources #271 by @joshuafolkken in #272
• Document the build approvals the app-kit install command needs under pnpm 12 #270 by @joshuafolkken in #274

Other Changes

• Adopt kit 1.1229.0 #265 by @joshuafolkken in #266

Full Changelog: v0.114.0...v0.120.0

v0.114.0

What's Changed

Exciting New Features 🎉

• Stop adding GitHub Packages auth lines for app-kit consumers on public npm #258 by @joshuafolkken in #259
• Add a one-command josh-app setup equivalent to kit's josh start #238 by @joshuafolkken in #262

Bug Fixes 🐛

• Stop passing the removed --type flag so josh-app init works on current kit #252 by @joshuafolkken in #257

Other Changes

• Upgrade @joshuafolkken/kit to latest #245 by @joshuafolkken in #246
• Bump SonarSource/sonarqube-scan-action from 8.2.2 to 8.3.0 by @dependabot[bot] in #244
• Brush up the README following the kit README and add the MIT license #243 by @joshuafolkken in #249
• Upgrade @joshuafolkken/kit to 1.1094.0 #250 by @joshuafolkken in #251
• Adopt kit 1.1128.0 and hold SvelteKit 3 / adapter-cloudflare 8 until #247 #260 by @joshuafolkken in #261

Full Changelog: v0.106.0...v0.114.0

v0.106.0

What's Changed

Exciting New Features 🎉

• Publish app-kit to the public npm registry alongside GitHub Packages #226 by @joshuafolkken in #240

Bug Fixes 🐛

• Install safe-chain with the checked installer in the DAST and load workflows #232 by @joshuafolkken in #233

Other Changes

• Align josh-app shared commands with kit CLI #223 by @joshuafolkken in #224
• Upgrade @joshuafolkken/kit to latest #230 by @joshuafolkken in #231
• Upgrade @joshuafolkken/kit to 1.1003.0 #236 by @joshuafolkken in #237
• Split the README into focused docs following the kit layout #234 by @joshuafolkken in #239

Full Changelog: v0.98.0...v0.106.0

v0.98.0

What's Changed

Breaking Changes 🛠

• Return Playwright to latest and rename the SvelteKit tsconfig preset to .json #113 by @joshuafolkken in #119

Exciting New Features 🎉

• Extract theme behind ./theme subpath and prove tree-shaking #13 by @joshuafolkken in #16
• Add app-kit/i18n locale slice #24 by @joshuafolkken in #25
• Rename to @joshuafolkken/app-kit + GH Packages publish #30 by @joshuafolkken in #31
• Add app-kit SvelteKit config presets (S1) #26 by @joshuafolkken in #32
• Add app-kit sync overlay with Cloudflare lifecycle + wrangler merge (S3) #28 by @joshuafolkken in #34
• Add josh-app init CLI overlaying the SvelteKit + Cloudflare layer #29 by @joshuafolkken in #37
• Add josh-app sync command (re-apply the Cloudflare overlay) #39 by @joshuafolkken in #42
• Add josh-app version / version:upgrade consuming kit/version #41 by @joshuafolkken in #51
• Make josh-app sync/init orchestrate josh sync/init + reconcile SvelteKit cspell/tsconfig lines #53 by @joshuafolkken in #54
• Add app-kit SvelteKit lefthook preset #66 by @joshuafolkken in #68
• Scaffold SvelteKit .vscode settings #67 by @joshuafolkken in #69
• Export SVELTEKIT_RESERVED_BOOLEAN_OPTIONS from SvelteKit ESLint preset #65 by @joshuafolkken in #71
• Show and upgrade upstream kit version in josh-app version commands (version chain) #75 by @joshuafolkken in #77
• josh-app: host SvelteKit type-check as check / check:ci (receiver for kit#628) #78 by @joshuafolkken in #79
• josh-app overlay: migrate eslint.config.js to the app-kit SvelteKit ESLint preset #44 by @joshuafolkken in #82
• Wire the effective-global upstream hooks into josh-app v/vu #83 by @joshuafolkken in #84
• Add ZAP baseline DAST scanning with a workflow distribution mechanism, local hook, and manual command #94 by @joshuafolkken in #98
• Add a Content-Security-Policy for SvelteKit via kit.csp #96 by @joshuafolkken in #105
• add k6 load testing as a manual command and ci workflow #95 by @joshuafolkken in #107
• Make security_headers composable for SSR consumers #106 by @joshuafolkken in #108
• Distribute the security-headers E2E so consumers stop re-deriving the CSP assertions #120 by @joshuafolkken in #128
• Distribute the GitHub Packages _authToken line from the app-kit npmrc overlay #160 by @joshuafolkken in #161
• add cross origin opener policy same origin to the baseline security headers #164 by @joshuafolkken in #165
• Resolve the DAST preview port through the kit PORT_SEED definition #177 by @joshuafolkken in #180
• resolve the dev server port through the kit port seed definition #181 by @joshuafolkken in #182
• Distribute the pnpm-free josh port wiring in dev/preview scripts and josh-app sync #183 by @joshuafolkken in #187
• Manage the dev script in MANAGED_SCRIPT_KEYS so PORT_SEED wiring reaches every consumer #188 by @joshuafolkken in #190
• Report the individual managed scripts josh-app sync rewrote, not just updated: package.json #189 by @joshuafolkken in #196
• Add a preview-backed screenshot command to josh-app #200 by @joshuafolkken in #201

Other Changes

• Suppress SonarQube PageWithoutTitleCheck rule for src/app.html #6 by @joshuafolkken in #12
• Compile node_modules Svelte components in auto-detect mode so svelte-core 1.1.x works under global runes:true #18 by @joshuafolkken in #19
• Rename spec.ts test files to test.ts #14 by @joshuafolkken in #20
• Update @joshuafolkken/kit to 0.271.0 and sync distributed config files #21 by @joshuafolkken in #22
• Single-source the Cloudflare managed-scripts lifecycle (S2) #27 by @joshuafolkken in #33
• Bootstrap pnpm toolchain pins (packageManager + exact devEngines) #35 by @joshuafolkken in #36
• Make josh-app init/sync non-destructive #45 by @joshuafolkken in #46
• Bump @joshuafolkken/kit to 0.274.0 + dev dependencies #47 by @joshuafolkken in #48
• Drop prepare:gen '|| true' so wrangler-types failures surface #56 by @joshuafolkken in #57
• eslint/sveltekit: scope consistent-boolean-name off for reserved route exports #58 by @joshuafolkken in #59
• Add .wrangler/** to cspell/sveltekit preset ignorePaths #60 by @joshuafolkken in #61
• Single-source cspell ignorePaths via preset import #62 by @joshuafolkken in #63
• Internalize the SvelteKit ESLint preset #52 by @joshuafolkken in #64
• Declare ESLint preset runtime deps as dependencies #74 by @joshuafolkken in #76
• cspell overlay: strip redundant kit base import #72 by @joshuafolkken in #80
• strip redundant kit-base extends in josh-app sync #73 by @joshuafolkken in #81
• Adopt kit 1.12 effective-upstream APIs: drop cloned resolver and redundant latest fetch #85 by @joshuafolkken in #86
• Write project README documenting CLI install and library usage #38 by @joshuafolkken in #87
• Restore --local in distributed preview script #88 by @joshuafolkken in #89
• Update kit to 1.16.0 and sync distributed config #90 by @joshuafolkken in #91
• Share one build and preview server between pre-push E2E and DAST #97 by @joshuafolkken in #99
• Fan out E2E and the ZAP scan inside verify #100 by @joshuafolkken in #101
• Run the full ZAP scan on a schedule, not on every PR #103 by @joshuafolkken in #104
• Exempt distributed k6 scenarios from the consumer type-check #109 by @joshuafolkken in #110
• Pin Playwright back to 1.61.1 to unblock E2E #111 by @joshuafolkken in #114
• Adopt kit 1.23.0 and sync distributed AI docs #115 by @joshuafolkken in #116
• Adopt kit 1.24.0 and sync distributed AI docs #117 by @joshuafolkken in #118
• fall back to path pnpm when npm execpath is unset #122 by @joshuafolkken in #124
• Correct the Tier-1 triage reason for ZAP rule 10109 #123 by @joshuafolkken in #125
• Reconcile the templates/_headers CSP comment with the zap-baseline.conf claim that kit.csp already emits it #121 by @joshuafolkken in #126
• Adopt the kit 1.29.0 sync: two-layer work-summary format in the distributed docs and hook #129 by @joshuafolkken in #130
• Make the security subpaths resolvable from plain Node so the distributed E2E loads under Playwright #132 by @joshuafolkken in #133
• Force a fresh global root so josh-app vu bumps the effective kit #134 by @joshuafolkken in #135
• Decide the security-headers skip by probing the running server instead of a hardcoded preview port #127 by @joshuafolkken in #138
• Fail instead of adopting a preview server josh-app did not start #136 by @joshuafolkken in #139
• Assert the demo heading text so an unrelated page cannot pass #137 by @joshuafolkken in #140
• E2E hydration test clicks before SvelteKit hydrates, so it fails in dev mode #143 by @joshuafolkken in #145
• Adopt @joshuafolkken/kit 1.45.0 and re-sync the config it distributes #142 by @joshuafolkken in #146
• Adopt @joshuafolkken/kit 1.49.0 and re-sync the config it distributes #147 by @joshuafolkken in https://github.com/joshu...