Changelog

Highlights

Scaffold-integrity and packaging release: generated auth actually authenticates, MongoDB works against a real API, and the packages are ESM-only.

Fixed

• Auth scaffolds hash passwords with scrypt and verify them at login — generated register handlers previously discarded the password and login accepted any password for a known email.
• TypeScript auth and database scaffolds pass strict typecheck; auth-only scaffolds boot; session auth is only offered where routes exist (express); auth requires a SQL database.
• MongoDB repaired end to end: the adapter gained collection() (it had no write operations), the manager exposes it, the generated config/init use the real connection shape, and models normalize _id to a string id.
• MySQL scaffold model reads the adapter’s real result shape (result.rows) — every method silently returned undefined before.
• Boot E2E gained auth permutations that assert a wrong password is rejected with 401.

Changed

• ESM-only packaging: CJS bundles removed; require() keeps working on Node 22.12+ via native require(esm). Export maps resolve types + default everywhere — import-only maps had locked CJS consumers out entirely.
• engines.node floor raised to >=22.12.0.

Highlights

Dependency-truth release: what the published packages declare now matches what they need at runtime, and the audit is clean.

Fixed

• core VERSION reports the real version — it had been hardcoded at 1.0.0-beta.8 since that release. Now substituted from the manifest at build time, with a CI gate so it cannot drift again.
• coherent-language-server no longer crashes on a clean install: the LSP uses the TypeScript compiler API at runtime, and typescript is now a real dependency of @coherent.js/tooling.
• CLI: ws bumped off an exact-pinned vulnerable version (memory-exhaustion DoS, fixed in 8.21.0), and the optional bundler peers (rollup, vite, webpack) are ranges instead of exact pins — no more unmet-peer warnings on newer versions.
• database JSDoc examples import from @coherent.js/database (was the nonexistent @coherent/database).

Changed

• Dependencies updated to latest: commander 15 and ora 9 (cli), fastify-plugin 6 (integrations), vscode-languageserver/client 10 (tooling + VS Code extension).
• pnpm audit reports zero vulnerabilities — overrides added for the remaining low/moderate transitive advisories.

Highlights

Renderer correctness and type-truth follow-up to rc.3, plus the release guardrails that would have caught both bug classes earlier.

Fixed

• Void elements (meta, img, input, br, link, …) render without closing tags — the renderer previously emitted invalid HTML like <meta></meta> on every page.
• 69 phantom type declarations removed across eight packages: .d.ts files declared values that do not exist at runtime, so broken consumer code typechecked and then crashed.
• tooling testing subpaths ship per-slice declaration files matching their runtime exports; ObjectRouter’s type gained its real methods (get/post/…, toExpressRouter, createServer).
• Express TypeScript scaffolds typecheck: typed error-middleware parameters.

Added

• Types-parity gate: CI fails when a declaration promises a value the runtime does not export.
• Scaffold boot E2E: generated projects are installed, typechecked, tested, booted, and probed over HTTP — nightly and on PRs.

Highlights

Quality release driven by end-to-end verification: consuming the published packages from a real project, scaffolding projects and running their scripts, executing every documented code sample, and link-auditing the built website.

Fixed

• Published exports maps: the development condition pointing at unshipped src/ broke every Vite/Vitest consumer of core, client, devtools, state, and tooling — removed. Client subpaths (./events, ./router, ./hmr) and main now resolve to built dist output. Phantom subpath exports in api, database, and devtools now have real build outputs.
• @coherent.js/devtools was unimportable when installed (deep @coherent.js/core/src imports) — now imports the public entry.
• CLI scaffolds work out of the box: runnable test setup, strict-TypeScript-clean templates for all four runtimes, working /api routing glue for fastify and koa, and no more fabricated APIs (createI18n, createMetaTags, renderField, setupDevtools).
• Docs and examples aligned with the real APIs: renderToString → render, phantom type declarations removed, 30+ dead cross-links fixed, examples are runnable again (node examples/<file>.js).
• Website: broken links, stale version badge (now version-driven), SEO/a11y basics (lang, canonical, Open Graph, sitemap, robots.txt, 404 page).

Added

• CI gates: publint on every publishable package, api-surface check hard-fails on missing export targets, scaffold-matrix parses every generated file.
• New docs: testing guide, i18n and seo package pages.

Highlights

Hotfix release. Manual verification of `coherent create` revealed that several scaffold permutations could not boot; rc.2 fixes the boot-blocking bugs in CLI scaffolds and the Fastify/Koa/SQLite integrations. No public API was removed or renamed.

Fixed

• Fastify integration: coherentFastify is now wrapped with fastify-plugin so hooks and decorators apply to the parent context; auto-render moved from onSend to preSerialization with an identity serializer so rendered HTML is sent verbatim.
• Koa integration: setupCoherent forwards the template option through to the middleware instead of silently dropping it.
• Database: sqlite3 peer dependency relaxed from an exact 5.0.0 pin to >=5.0.0.
• CLI sqlite scaffolds: switched from better-sqlite3 to sqlite3, rewrote UserModel on the database manager API, and fixed init racing that intermittently caused SQLITE_BUSY.
• CLI fullstack scaffolds: auth routes are now actually mounted under /api/auth, and authMiddleware no longer 401s every request including GET /.
• CLI fastify scaffold: static-file root now points at the project public/ directory; koa and fastify scaffolds wrap pages in a real HTML shell.
• CLI version resolution: scaffolds correctly pin @coherent.js/* deps to ^1.0.0-rc.2 (previously a stale 1.0.0-beta.5 fallback could slip in).

Changed

• BREAKING: minimum Node.js version is now 22 (engines.node >=22.0.0 across all published packages). CI tests Node 22.x, 24.x, and 26.x.

Highlights

Comprehensive v1.0 hardening across five waves. See MIGRATION-1.0.md in the repo for the full breaking-changes guide with copy-paste fixes.

Workspace consolidation (Waves 2a/2b/2c)

• Workspace consolidated from 21+ packages to 12 published packages (plus the standalone VS Code extension).
• Framework integrations (express, fastify, koa, nextjs, adapters/*) → subpath exports of @coherent.js/integrations.
• Build tools (vite, webpack, rollup, loader) → subpath exports of @coherent.js/cli/build-tools.
• Performance utilities (cache, code-splitting, lazy-loading) → subpath exports of @coherent.js/devtools/performance.
• LSP + testing + language-service merged into @coherent.js/tooling.
• Dropped: @coherent.js/runtime, @coherent.js/web-components, @coherent.js/profiler (138 lines of placeholder).

Removed APIs (Wave 1)

• Client: legacyHydrate, hydrateAll, hydrateBySelector, enableClientEvents, makeHydratable, autoHydrate, registerEventHandler — use hydrate() instead.
• Client: direct imports of @coherent.js/client/src/hmr.js throw a migration error. Use { hmrClient } from @coherent.js/client.
• Forms: createForm, formValidators, enhancedForm removed. Use createFormBuilder + hydrateForm.

New in 1.0

• Built-in HMR dev server (`coherent dev --coherent`): HTTP + WebSocket + chokidar, no vite/webpack required for static-served projects.
• API surface lockdown: every public export is snapshotted to packages/<name>/api-surface.txt; CI gates accidental drift.
• Per-package bundle-size gates: each dist/index.js raw + gzipped size baselined to packages/<name>/bundle-size.json; CI fails on >±5% drift.
• Playwright E2E suite: six audit-item browser flows automated in CI (Chromium).
• VS Code extension publish-readiness check + dedicated CI job + PUBLISHING.md runbook.

README claims cleaned up

• Dropped: "42.7% improvement over OOP" (required maintaining an OOP-equivalent fixture).
• Dropped: "95%+ cache hit rate" (workload-dependent, dishonest as a framework property).
• Dropped: aggregate "80.7KB gzipped bundle" claim (replaced with per-package CI gates).
• Dropped: "79.5% tree-shake reduction" (no gate existed to defend the number).
• Retained: "247 renders/sec" (defensible from benchmarks/benchmark.js).

Next

Release candidate — 1-2 week soak before promoting to 1.0.0 stable. Install with `pnpm add @coherent.js/core@rc` to try it.

Added

• Major website UI/UX overhaul with search, animations, and examples improvements
• Dynamic docs route and sidebar navigation for the dev server
• Island() hydration, performance monitoring, and perf API in the website
• Website restructured as a proper Coherent.js project using framework features

Improved

• Consistent full-width layout, page structure, and background styling
• Hero section: improved orb animation, cleaner CTA buttons, code highlighting
• Unified website build script with component composition

Fixed

• CJS build: hardcoded VERSION to avoid import.meta.url warning
• WebSocket.OPEN reference guarded for Node.js environments
• CI/CD: release-drafter, shellcheck warnings, and GitHub Actions cleanup
• Pinned @vitest/coverage-v8 to match vitest version

Dependencies

• Bumped esbuild, next, codecov, upload-artifact, deploy-pages, pnpm/action-setup, release-drafter, and more

Added

• Islands Architecture with Island() wrapper and client-side discovery for selective hydration
• Selective Hydration via selectiveHydrate() and hydratable SSR flag
• Functional Programming support with hoc, compose, and fp namespaces
• VS Code extension with language client and LSP server
• Hot Module Replacement (HMR) with state preservation and error overlay
• Key-based reconciliation for efficient updates
• HTML nesting validation for valid DOM structures

Improved

• Streaming Renderer with full component and feature parity
• Cache performance: MurmurHash3-based object hashing for 50x faster cache keys
• Defensive rendering with improved circular reference detection

Added

• Docker scaffolding support in the CLI for easy containerization

Improved

• Production readiness checklist for deployment
• LRU cache for compiled routes in @coherent.js/api
• Optimized security header configurations
• Smart route matching performance in the API router

Fixed

• Return type issue in API validation functions

Fixed

• CI/CD build and test workflows for fresh artifacts
• Several moderate and high-severity security vulnerabilities
• Timing tolerance issues in profiler tests

Fixed

• Critical API router bugs: double slash generation and character class escaping
• Comprehensive documentation refactor and reorganization
• Added missing README files for forms, koa, nextjs, performance, and seo packages

Changed

• Major package reorganization for better separation of concerns
• New @coherent.js/state package for reactive state management
• Client-side router moved to @coherent.js/client

Added

• Reactive state with observables, computed properties, and persistence
• Enhanced client routing with prefetching, transitions, and code splitting
• New lifecycle hooks and object factory exports from @coherent.js/core

First beta release of Coherent.js with a complete version reset and clean npm registry.

Highlights

• Pure object components with optimized SSR and streaming support
• Client-side hydration with progressive enhancement
• Extensible plugin system with 7 built-in plugins and 10+ lifecycle hooks
• Framework integrations for Express, Fastify, Koa, and Next.js
• Full-featured packages for i18n, forms, SEO, database, and API
• All 20 packages synchronized and released