Scratchy.js Framework

Appearance

Changelog ​

All notable changes to this project will be documented in this file. Generated by git-cliff.

[26.3.22-1774223623833] - 2026-03-22 ​

🚀 Features ​

  • (create-scratchy-app) Use tsx runtime; ~ path aliases in template (5798e20)
  • (create-scratchy-app) Add AI instructions to template; remove .github/ from .prettierignore (1684203)
  • (security) Add security policy for reporting vulnerabilities (fbb3149)

🐛 Bug Fixes ​

  • (create-scratchy-app) Address all review comments (3c412dd)
  • (create-scratchy-app) Handle import stripping with package-name patterns (fe427f9)
  • (workflow) Enhance workflow conditions for build and deploy jobs (785187f)
  • Remove unused imports in utils.test.ts and fix VitePress tip syntax (cb1a097)
  • (license) Update copyright holder's email address in LICENSE file (1c602e8)
  • Resolve lint errors in pool.test.ts and timers.test.ts (1d2727d)
  • Resolve lint errors and add 44 tests across CLI commands and packages (d1f5280)
  • Resolve typecheck errors in CLI and drizzle test files, update AI docs with validation rules (6be42ed)
  • Update buildNextSteps to use relative paths and improve project name validation (24f20cb)
  • Enhance error handling for paths escaping src/ directory in makeTestCommand (09e4050)
  • Improve installDeps tests with execSync mocking for error handling (61a9bd0)
  • Enhance error handling in cacheClearCommand tests with consola warnings (0a083ec)
  • Change LOG_LEVEL to silent in production config for createServer tests (e7cb6c1)

📚 Documentation ​

  • (create-scratchy-app) Add documentation page and fix docs.yml formatting (c800a9c)
  • Add validation chain (format + lint + typecheck + build) to AI instruction files (bf382df)

🚜 Refactor ​

  • (create-scratchy-app) Address code review - make buildNextSteps pure, fix test assertions (ee8170a)

🧪 Testing ​

  • (create-scratchy-app) Add comprehensive tests for utils and feature stripping (59274b7)
  • (create-scratchy-app) Extract CLI logic to cli.ts and add comprehensive tests (e203bcf)
  • Add 53 more tests across packages to improve code coverage (fc7a691)
  • Address code review feedback on test quality (9b84f0b)

[26.3.22-1774210082544] - 2026-03-22 ​

🚀 Features ​

  • Add AGENTS.md and AI instruction files for all framework technologies (d571983)
  • Implement Phase 0 — project bootstrap with ESLint + Prettier (4f7ea43)
  • (drizzle) Implement Phase 2 — Data Layer Package (6080a0b)
  • (trpc) Implement Phase 3 - tRPC integration package (23be40a)
  • (renderer) Implement Phase 4 — Piscina worker pool, SSR/SSG, SharedArrayBuffer, Redis comm (72ede73)
  • (cli) Implement Phase 6 — @scratchy/cli package with scaffolding commands (9e17103)
  • Add @scratchy/utils package with server-side utilities ported from remix-utils (27861e4)
  • Add @total-typescript/ts-reset and apply globally across all packages (871e55a)
  • (auth) Implement @scratchy/auth package with better-auth and fastify-better-auth (88b28b9)
  • Implement Phase 7 — starter example application and integration tests (98ab492)
  • (auth) Add request.user decoration alongside request.session (7bda5f3)
  • Update Phase 7 to include auth in example app and add auth AI instructions (182e90d)
  • (cli) Implement Future Work items 1-3 — make:migration/seed/test, db:seed/fresh, routes:list, cache:clear (bf1284b)
  • Add comprehensive documentation instructions following the Diátaxis framework (d7dd41c)
  • OpenAPI/Swagger documentation plugin and SSG build-time pre-rendering pipeline (8ba471c)
  • Add CalVer publish workflow and publishConfig to all packages (6cb59ec)
  • Automate and standardize GitHub releases with git-cliff (7979aa2)
  • Add coverage workflows and PR reporting comments (5656f8b)
  • (docs) Set up VitePress documentation site (4d066df)
  • Add VitePress docs site, Cypress e2e tests, Cloudflare deployment workflows (96d1bee)
  • Add vitest setup file to configure environment variables (a84bef9)
  • Configure turborepo (b402260)
  • Add renovate configuration for dependency management (1e67b9a)
  • Configure Turborepo remote cache and update CI environment (75bf480)
  • Add schema reference to tsconfig.json (a0243fe)

🐛 Bug Fixes ​

  • Apply PR review changes — add shebang to husky hook, remove outDir/rootDir from tsconfigs (512a320)
  • (core) Use index-based route matching to prevent test files from loading as routes (fb4fd4a)
  • (drizzle) Read DATABASE_SCHEMA env var in createSchema, fix prettier and type errors (13a8c02)
  • (trpc) Address review feedback - cache-control, error logging, input validation (60c3fa9)
  • (renderer) Address review feedback — XSS escaping, TTL validation, buffer guards, task timeout (fb4d7b7)
  • Apply prettier formatting and mark Phase 5 tasks complete in IMPLEMENTATION_PLAN.md (1321573)
  • (cli) Address PR review — dedup imports, validate column names, fix async conventions, add pagination (879332e)
  • (workflow) Update cache cleanup script to use pull request branch reference and improve quoting (6d40409)
  • (utils) Constrain promiseHash generic to Hash extends PromiseHash; update redirectBack tests (7f2f311)
  • (utils) RFC 7239 Forwarded header parsing and CodeQL CWE-601 guard (1f16820)
  • Address remaining review comments — update mutation validation, types/fastify.d.ts, README .env note (14b7e04)
  • Remove Node 22 from CI, fix lockfile, update server.ts docstring (0abb6fd)
  • Update buildServer docstring to reflect actual auth registration conditions (adb6688)
  • Add sharp to onlyBuiltDependencies in pnpm-workspace.yaml (73f2879)
  • Add pnpm overrides for esbuild version (7d1e4cd)
  • (cli) Address review feedback on make:seed, db:seed, make:test commands (65a65b0)
  • Address PR review feedback on ssg-pipeline route safety, concurrency throttling, and test cleanup (94a1d6b)
  • Update CLI documentation to reflect the correct initializer package name (7079520)
  • Add concurrency guard and push version commit before npm publish (21c5b76)
  • Add mode handling for test environment in Vite config (0652384)
  • (publish) Use -X theirs on rebase to resolve version-bump conflicts (1c2be8e)
  • Control char injection in safeRedirect, align OWASP doc with actual Scratchy plugin config (e8e5ca1)
  • Correct docstring - server header exposes framework identity, not version (74ce7c1)
  • Ensure strip-internal-headers loads first, CORS reads fastify.config, add createContext error-path test (61bb69d)
  • Add pnpm setup to deploy jobs so wrangler-action can find pnpm (2f02f1a)
  • Use wrangler-action deployment-url output for PR preview comment (72cf9fa)
  • Add wrangler devDep and install step to fix pnpm workspace error in deploy jobs (a84fb97)
  • Simplify TOC cypress test - check VPDocAside on all pages without condition (502d696)
  • Correct command for git-cliff in publish workflow (34234b6)
  • Remove eslint directive for unexpected string thrown in context test (7667217)
  • Update tsconfig to exclude cypress configuration files (e9bbafb)
  • Update git-cliff action comments and path handling in publish workflow (afe83da)
  • Add onlyBuiltDependencies for cypress, esbuild, sharp, and workerd in package.json (677549a)
  • Enhance error handling and logging in publish workflow for CHANGELOG.md folding (6d0ff5c)
  • Disable husky during version release and changelog amendment commits (0e3354d)
  • Streamline CHANGELOG.md folding process in publish workflow (a5f5075)
  • Update npm publish command and improve OIDC token handling in publish workflow (77271da)
  • Enhance npm publish step with validation and detailed instructions for NPM_TOKEN (fb567f4)
  • Update npm publish step to use OIDC token and improve trusted publishing configuration (b325472)
  • Add conditional check for changelog entries in the body template (c5a2bcb)
  • (ci) Clear NODE_AUTH_TOKEN in publish step to enable OIDC trusted publishing (3da05b6)
  • Update compatibility date to 2026-03-21 in wrangler.toml (52af7b6)
  • Update test script to use turbo and add test run task in turbo.json (12b5fec)
  • Update test coverage scripts to use Turbo and refine environment variables (c589773)
  • (publish) Move npm publish before git push; clear CHANGELOG.md (5de58a6)
  • (publish) Rebase+retag before push; restore CHANGELOG header; add Cypress instructions (86367a6)
  • (publish) Add OIDC claims debugging for npm trusted publishing (a1190bc)
  • (publish) Enhance OIDC token exchange process for npm publishing (13a21b3)
  • (publish) Change OIDC token exchange request method to POST (d6b4003)
  • (publish) Streamline npm publishing process by removing legacy token handling (daf99b1)
  • (publish) Update npm publishing process to use NPM_TOKEN and remove OIDC claims debugging (edf9a2f)

📚 Documentation ​

  • Add comprehensive framework documentation in /docs directory (c046445)
  • (cli) Align query/mutation file naming to pluralized convention (0e7f007)
  • (worker-communication) Fix ring buffer wrap-around handling (3248574)
  • Add comprehensive middleware guide (019c1fe)
  • (error-handling) Add comprehensive error handling guide (5d0e321)
  • (sessions) Add comprehensive session and cookie management guide (b7da863)
  • (forms) Add comprehensive forms and server actions guide (ab13db1)
  • (data-loading) Add comprehensive data loading documentation (cd2111f)
  • (security) Add comprehensive security documentation (0e0b671)
  • Add streaming and progressive rendering guide (e9a2909)
  • (testing) Add comprehensive testing documentation (8ce815e)
  • Update existing docs with framework patterns and cross-references (cf1b350)
  • Add comprehensive implementation plan for Scratchy framework (53b462b)
  • Fix review comments — async middleware, timing-safe CSRF, catch blocks, Node.js APIs, flash keys, preHandler hook (b647edf)
  • Add async-only-with-await convention to TypeScript instructions and AGENTS.md (dee50ab)
  • Mark Phase 1 tasks as complete in implementation plan (fa9bf90)
  • (trpc) Improve type cast documentation in client.ts (777e86d)
  • Add Number.isNaN rule to TypeScript instruction file (9392e7a)
  • Enhance documentation with Diátaxis framework structure and related references (6128c99)
  • Add primary README and per-package READMEs (b9dffac)
  • Use async-callback vite config pattern; fix trpc cache-control header docs (dd83976)
  • Update README to include additional GitHub Actions repository secrets for Turbo and Cloudflare (9d73f8c)

🚜 Refactor ​

  • (renderer) Address code review feedback — improve docs, fix header types (c296173)
  • Remove unnecessary async keywords across renderer package (2e5f12f)
  • (auth) Remove unnecessary type assertion in requireAdmin hook (090e50a)
  • Rename package from Scratchy to ScratchyJS (7051a3d)
  • (ci) Split workflow into three separate jobs matching course-platform flow (4a05acf)

🎨 Styling ​

  • Format all documentation files with prettier (ed76fa1)

🧪 Testing ​

  • (trpc) Expand createContext coverage — valid states, hasRole edge cases, error-recovery path (e44d605)

⚙️ Miscellaneous Tasks ​

  • Port GitHub workflows from course-platform (dde5ded)
  • Add .npmignore file and mark example package as private (359cd4b)
  • Update publish workflow to manual trigger only (0cdcd0e)
  • Add environment specification for publish job (1a5e946)

◀️ Revert ​

  • Remove previous auth package attempt to restart cleanly (a56dfcf)

Security ​

  • Fix open-redirect percent-encoding bypass, JSON parse error handling, async style; add OWASP AI instructions (887f32b)