# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## Server session cache

2026-11-09

Ordinary server requests use Better Auth's signed session snapshot.

Server requests use the signed Session snapshot for up to 60 seconds, avoiding one session statement on a `todo.list` cache hit. The scenario B latency change was within local noise. Revocation on another device can take up to a minute for ordinary data. Membership removal remains immediate. Webhook endpoint changes and OAuth connection revocation read the current database session. The files gateway reads the membership directly. See [Session reads](/docs/features/auth#session-reads) and [PR #195](https://github.com/CarlosZiegler/template-cloudflare/pull/195).


## Bklit is the only chart library, Stageshow the only way to draw product UI

2026-11-07

The unused shadcn chart wrapper and Recharts are gone, a test refuses any other chart library on the web, and faux product UI on landing, marketing and docs pages is built with Stageshow.

Two design defaults are now rules, stated in `AGENTS.md`, `CODING_STANDARDS.md` and on [Design patterns](/docs/development/design). Every chart, sparkline and KPI or stat card on the web comes from [Bklit UI](https://bklit.com), through the `@bklit` registry and the `bklit-ui`, `bklit-ui-design` and `bklit-ui-migrate` skills. Faux product UI on landing, marketing and docs pages (stills, feature cards, cursor demos, bento grids) is built with [Stageshow](https://benji.org/stageshow) and ships only after its loop passes `film.mjs --gate`.

The shadcn `chart` wrapper in `packages/ui` and the `recharts` dependency of `apps/web` and `packages/ui` are removed. Nothing imported them, so the built client and Worker are byte-identical, and an install fetches 35 fewer packages. `scripts/web-chart-library.test.mjs` runs in `pnpm test` and fails when `apps/web/src` or `packages/ui/src` imports Recharts, Chart.js, Nivo, Victory, visx, ECharts, ApexCharts, Highcharts, Tremor or a similar library, or when their `package.json` lists one. It is a test rather than a lint rule because an oxlint entry would replace the client boundary; see [Enforcement](/docs/development/enforcement). The Stageshow rule is held in review, with a new item in the [Review checklist](/docs/development/review-checklist).

Bklit renders for React on the web only, so the Expo app is outside the rule. Its charts use `victory-native`, or Swift Charts through `@expo/ui` on an iOS-only screen. The dashboard KPI cards and the hand-built fragments of the landing feature board predate the rules and move to Bklit and Stageshow when they are reworked.


## Signed-in navigation no longer waits on the session read

2026-11-07

The /_auth guard revalidates the session in the background, GET /get-session runs outside the request transaction, and the browser's session read is served from Better Auth's 60-second signed cookie snapshot while every authorization still reads the database.

Three changes from issue [#189](https://github.com/CarlosZiegler/template-cloudflare/issues/189). They were measured on the built Worker in local workerd with a production-like latency profile: the browser 120 ms from the Worker, the database 20 ms away. A second profile put the database 110 ms away. Medians of 3 rounds.

- **The `/_auth` guard is stale-while-revalidate.** Once the cached session was older than 15 s, every signed-in navigation waited for `GET /api/auth/get-session` before the page's own loaders started. The guard now lets the navigation start on a cached signed-in session and re-reads it in the background; a signed-out answer sends the layout to `/login`. A navigation after 20 s idle went from about 220 ms to about 45 ms, and from about 820 ms to about 45 ms with the distant database. ([c38e801](https://github.com/CarlosZiegler/template-cloudflare/commit/c38e801be53e2edf8d46470e8b2a68fcf7dd8200))
- **`GET /get-session` runs outside the request transaction.** Every auth request ran in `db.transaction`, so a session read cost `BEGIN`, the read and `COMMIT`. It is now one statement; every other auth request keeps its transaction. ([f987550](https://github.com/CarlosZiegler/template-cloudflare/commit/f987550c2f37ad0b825ed3a4904e6ada4bb7df48))
- **The browser's session read comes from Better Auth's cookie snapshot.** `session.cookieCache` is on (`compact`, 60 s). The browser's presentation read no longer sends `disableCookieCache`, so a tab focus or a background revalidation costs no database statement. With the distant database, `get-session` dropped from about 290 ms to 8 ms. Authorization never uses the snapshot:
  - SSR, the oRPC context, the files gateway and admin still read the database;
  - the auth handler strips the snapshot from every other `/api/auth/*` request;
  - the web app re-reads from the database after its own session changes.

  Creating an Organization on the web now switches to it, as Better Auth and the native app already did. A session revoked on another device can keep the UI shell for up to 60 s, and its first data request is refused with 401. See [Session reads](/docs/features/auth#session-reads).


## Earlier updates

- 2026-11-07: [Skullet is the only way to draw a loading skeleton](/docs/changelog/2026-11-07-skullet-only-skeletons)
- 2026-11-06: [Agent skills from upstream, Expo's renamed skills, and three updates held back](/docs/changelog/2026-11-06-agent-skills-update)
- 2026-11-06: [Code is written in English](/docs/changelog/2026-11-06-code-in-english)
- 2026-11-06: [The consent banner paints from the HTML, repeat visits skip revalidation, and real Web Vitals](/docs/changelog/2026-11-06-web-quick-wins)
- 2026-11-05: [Dates in your time zone, without a hydration error](/docs/changelog/2026-11-05-dates-in-your-time-zone)
- 2026-11-05: [Public pages paint before any JavaScript arrives](/docs/changelog/2026-11-05-first-paint)
- 2026-11-04: [Better Auth 1.7.16 security fix and dependency round](/docs/changelog/2026-11-04-better-auth-security-dependency-round)
- 2026-11-04: [Animated assistant approval on the landing, and a design patterns page](/docs/changelog/2026-11-04-landing-assistant-demo)
- 2026-11-04: [Loading skeletons drawn from the real components](/docs/changelog/2026-11-04-skullet-skeletons)
- 2026-10-29: [Invitations are not a mail relay](/docs/changelog/2026-10-29-invitation-relay)
- 2026-10-29: [MCP Apps widget, approval status and plugin marketplaces](/docs/changelog/2026-10-29-mcp-apps-widget-approval-status)
- 2026-10-29: [One URL per language](/docs/changelog/2026-10-29-path-locales)
- 2026-10-29: [Account emails in React Email, in English, German and French](/docs/changelog/2026-10-29-react-email)
- 2026-10-29: [Share cards, Markdown negotiation and one site identity](/docs/changelog/2026-10-29-seo-agent-readiness)
- 2026-10-27: [TanStack AI 1.0, password forms and iPhone Duo](/docs/changelog/2026-10-27-deps-password-forms-iphone-duo)
- 2026-10-19: [Agent skills from upstream and the /pr template](/docs/changelog/2026-10-19-agent-skills-update)
- 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin)
- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)