ARDOR changelog

useStoredState can turn its storage off with a null key

Sun, 08 Nov 2026 12:00:00 GMT

A null key makes useStoredState keep its value in memory, like useState, so a component can store state only when a user id or a flag is known.

BrowserStorage.subscribe tells a change of this tab from one of another tab

Sun, 08 Nov 2026 12:00:00 GMT

The listener of BrowserStorage.subscribe gets { isExternal }, false after a write through BrowserStorage in this tab and true when another tab changed the key.

reduxStore is optional

Sun, 08 Nov 2026 12:00:00 GMT

ArdorApplication no longer needs a Redux store; without one it mounts no Redux provider.

The app preset no longer has a vendor chunk that the first screen loads

Sun, 08 Nov 2026 12:00:00 GMT

The app preset keeps only the react group in codeSplitting, because its catch-all vendor group put the libraries of lazy routes into the first screen.

useIntersection watches several targets, a scroll container and several thresholds

Sun, 08 Nov 2026 12:00:00 GMT

useIntersection takes a list of targets and returns one entry for each, takes a root element, and takes a list of thresholds, so a scroll-spy needs no own observer.

Test fakes for the browser APIs the hooks use

Fri, 06 Nov 2026 12:00:00 GMT

FakeIntersectionObserver, FakeMatchMedia, FakeStorage and FakeClipboard join FakeResizeObserver, which now shows its observers; all in @venizia/ardor/testing.

Sign-out removes the stored data and the cached queries of the user

Fri, 06 Nov 2026 12:00:00 GMT

When the session ends, by any route, the auth provider removes the keys under @app/store/ and the application empties the query cache.

The REST data provider sends the record id as one path segment

Fri, 06 Nov 2026 12:00:00 GMT

getOne, update and delete percent-encode the id, so an id with a slash, a question mark or a hash reaches the server whole; doRequest refuses dot segments.

The generated app sends a report-only CSP and checks its container input

Fri, 06 Nov 2026 12:00:00 GMT

The app preset sends Content-Security-Policy-Report-Only, hides the nginx version, refuses more secret-looking VITE_ values and checks NGINX_LOCAL_RESOLVERS.

The codemod never writes through a symlink

Fri, 06 Nov 2026 12:00:00 GMT

ardor codemod namespace skips a tracked symlink, so --write cannot change a file outside the project that the link points to.

The codemod writes all files or none, and refuses outside git

Fri, 06 Nov 2026 12:00:00 GMT

ardor codemod namespace --write stages every file, names a file it cannot rewrite and writes nothing then, and needs --allow-dirty outside a git repository.

Client-side roles only show or hide interface

Fri, 06 Nov 2026 12:00:00 GMT

The roles ARDOR keeps in the browser, and the permission provider, are not an access check; the docs and the TSDoc now say the backend must check every permission.

An application id keeps two applications on one origin apart

Fri, 06 Nov 2026 12:00:00 GMT

IApplicationInfo.id scopes the session keys and the store prefix in browser storage; without it nothing changes, so a single application per origin needs no migration.

Sign-in can stay on the page, and the resolved auth provider can be typed as present

Fri, 06 Nov 2026 12:00:00 GMT

paths.afterLogin accepts false so login resolves with redirectTo false; ApplicationProviders.resolve takes isAuthRequired to type the auth provider as present.

Everything since ARDOR 0.4.7 in one place, with an upgrade checklist

Thu, 05 Nov 2026 12:00:00 GMT

A table of every change since 0.4.7 linked to its entry, the IGNIS peer versions, and the ordered checklist an application follows to move to ARDOR 0.4.8.

ISendResponse and IListFilter.offset are removed

Thu, 05 Nov 2026 12:00:00 GMT

ISendResponse was a second name for INetworkResponse, and IListFilter.offset an alias of skip; both are removed, and the codemod renames or lists them.

useUntypedTranslate translates a key that exists only at run time

Wed, 04 Nov 2026 12:00:00 GMT

useUntypedTranslate takes a plain string key, so a server error code or a data label needs no cast, while useTranslate keeps its compile-time key check.

useStoredState writeDelayMs writes the storage once after a burst of changes

Wed, 04 Nov 2026 12:00:00 GMT

useStoredState writeDelayMs updates the UI at once and writes localStorage once after the delay, for a value that changes many times a second.

useStoredState updaters compose, and the sign-out order is documented

Wed, 04 Nov 2026 12:00:00 GMT

setValue(updater) of useStoredState runs against the value at the call, so two updaters in one tick both apply; the reference covers sign-out.

StorageCodecs.text reads and writes a bare string

Wed, 04 Nov 2026 12:00:00 GMT

StorageCodecs.text() stores a string as it is, with an optional list of allowed values; useStoredState and BrowserStorage take it as a codec.

useResizeEffect runs one callback when any of several elements resizes

Wed, 04 Nov 2026 12:00:00 GMT

useResizeEffect observes several elements, and with children their direct children, and calls onResize once per animation frame or before paint.

useSizer is removed, use useElementSize

Wed, 04 Nov 2026 12:00:00 GMT

useSizer measured the element with a given id; useElementSize measures an element or a ref with more options, so useSizer is removed with no alias.

useIntersection tells whether an element is in view

Wed, 04 Nov 2026 12:00:00 GMT

useIntersection returns the latest IntersectionObserverEntry of an element, so lazy content or a load-more sentinel needs no own observer.

ardor-react and ardor-admin no longer depend on lodash

Wed, 04 Nov 2026 12:00:00 GMT

Six lodash calls are replaced by destructuring, an existing check and two small helpers, about 10 KB less in an app bundle.

A refreshTokenPath now refreshes the token without a subclass

Wed, 04 Nov 2026 12:00:00 GMT

With authRecovery.refreshTokenPath set, the default refreshToken posts to it and saves the new token, so a 401 recovers with no subclass.

useCopyToClipboard returns isCopied, with a resetMs option

Wed, 04 Nov 2026 12:00:00 GMT

useCopyToClipboard returns { copy, isCopied }, and resetMs sets isCopied back to false after a delay, so a "Copied" button needs no state or timer of its own.

BrowserClipboard writes and reads the clipboard outside React

Wed, 04 Nov 2026 12:00:00 GMT

BrowserClipboard.writeText and readText answer false or undefined on every refusal; useCopyToClipboard calls it and no longer throws on a server.

BrowserStorage.keys and removeWhere list and sweep keys by prefix

Wed, 04 Nov 2026 12:00:00 GMT

BrowserStorage.keys lists the keys of a storage area and removeWhere removes those with a prefix, without throwing.

useMediaQuery, useDocumentVisibility and useOnlineStatus read browser state

Wed, 04 Nov 2026 12:00:00 GMT

Three SSR-safe hooks over useSyncExternalStore for a media query, tab visibility and online status, with no hand-written subscribe.

useInjectableContainer is now useApplicationContainer

Wed, 04 Nov 2026 12:00:00 GMT

The hook that returns the application's container is renamed to say what it returns; there is no alias, and the upgrade is a find and replace.

RequestBodyEncoder types its body, and ResponseReader reads a file name

Tue, 03 Nov 2026 12:00:00 GMT

encode returns a FormData, a URLSearchParams or the body you passed, and readFilename returns the name in a Content-Disposition header.

Session hooks see every token change, and the unauthenticated rejection is configurable

Tue, 03 Nov 2026 12:00:00 GMT

DefaultAuthService.subscribe tells the provider about every saved or cleared session, so onSessionStarted fires for a refresh by the network service, and unauthenticatedRejection sets what checkAuth and a 401 reject with.

DefaultAuthProvider has session hooks

Tue, 03 Nov 2026 12:00:00 GMT

onSessionStarted and onSessionCleared tell a subclass when the session starts, changes its token or ends, so a socket or a per-user cache stays in step without overriding checkAuth.

useElementSize no longer throws where there is no ResizeObserver

Tue, 03 Nov 2026 12:00:00 GMT

useElementSize stays at 0 by 0 and observes nothing on a host without ResizeObserver, instead of throwing in its effect.

useElementSize follows any element, rounds and says when it measured, and FakeResizeObserver tests it

Tue, 03 Nov 2026 12:00:00 GMT

useElementSize returns a callback ref when you pass none, takes round, returns measured, and @venizia/ardor/testing has FakeResizeObserver for hosts whose ResizeObserver does nothing.

Typed browser storage and useElementSize

Tue, 03 Nov 2026 12:00:00 GMT

BrowserStorage reads and writes localStorage and sessionStorage without throwing, useStoredState keeps a value in step across hooks and tabs, and useElementSize measures a ref.

Everything since ARDOR 0.4.6 in one place, with an upgrade checklist

Mon, 02 Nov 2026 12:00:00 GMT

A table of every change since 0.4.6 linked to its entry, the peer versions, and the ordered checklist an application follows to move to ARDOR 0.4.7.

Sign-out clears only keys under @app/auth/, not @app/oauth2/

Mon, 02 Nov 2026 12:00:00 GMT

DefaultAuthService.cleanUp no longer removes keys under @app/oauth2/, and LocalStorageKeys.PREFIX_OAUTH2 is removed.

The i18n provider takes lazy sources, so a catalogue stays out of the boot bundle

Sun, 01 Nov 2026 12:00:00 GMT

An entry of i18nSources can be a loader such as () => import('./vi'), called the first time its locale is used; a loader that fails leaves the locale on English.

Utilities move to classes, hooks to Ardor, logger to IGNIS, and old names are removed

Sun, 01 Nov 2026 12:00:00 GMT

Utilities and helpers are now on classes, Ardor holds all hooks, the logger comes from IGNIS, and a tool updates your code.

Everything since ARDOR 0.4.4 in one place, with an upgrade checklist

Wed, 28 Oct 2026 12:00:00 GMT

A table of every change since 0.4.4 linked to its entry, and the checklist an application follows to move to ARDOR 0.4.5.

useDocumentTitle takes fallback, a base title screens override

Wed, 28 Oct 2026 12:00:00 GMT

useDocumentTitle gains an optional fallback flag; a fallback call shows its title only while no other call is mounted.

assertArdorApplicationBoots proves an application boots in a unit test

Tue, 27 Oct 2026 12:00:00 GMT

The new entry @venizia/ardor/testing exports assertArdorApplicationBoots, which proves an application boots in a unit test, with no browser and no network.

ArdorApplication takes a features prop, so a shell mounts a filtered list

Tue, 27 Oct 2026 12:00:00 GMT

ArdorApplication has a new optional features prop, the list of features to mount, so a shell can mount a filtered list.

Everything since ARDOR 0.4.3 in one place, with an upgrade checklist

Mon, 26 Oct 2026 12:00:00 GMT

A table of every change since 0.4.3 grouped by kind and linked to its entry, and the checklist an application follows to move to ARDOR 0.4.4.

Chunks keep import order, and buildInfoFile writes build-info.json

Mon, 26 Oct 2026 12:00:00 GMT

The preset turns on output.strictExecutionOrder so chunks keep import order, and @venizia/ardor/vite adds buildInfoFile for an About page.

The repository sub-path exports HttpReadShapes

Mon, 26 Oct 2026 12:00:00 GMT

The repository sub-path re-exports the HTTP module of IGNIS, so HttpReadShapes and THttpReadShape from IGNIS 0.4.3 are importable from ARDOR.

Everything since ARDOR 0.4.1 in one place, with an upgrade checklist

Sun, 25 Oct 2026 12:00:00 GMT

A table of every change since 0.4.1 linked to its entry, and the checklist an application follows to move to ARDOR 0.4.3.

getRuntimeConfig can require a value

Sun, 25 Oct 2026 12:00:00 GMT

Passing required to getRuntimeConfig makes it return a string and throw, naming the key, when no value is set; the error carries a code and the key.

The preset image compresses, answers /health and sends security headers

Sun, 25 Oct 2026 12:00:00 GMT

The preset image gzips text, answers /health, sends three security headers on every response, and writes the /api proxy only when API_UPSTREAM is set.

The network service is split into small parts, and its types are closed

Sun, 25 Oct 2026 12:00:00 GMT

DefaultNetworkRequestService stays the class you extend, its request types are closed, and the fetcher and socket client now come from IGNIS.

Correctness fixes in the kernel, the admin and the hooks

Sun, 25 Oct 2026 12:00:00 GMT

A series of fixes in the data providers, the network service, the auth service and the React hooks where the code did not do what its documentation said.

ARDOR 0.4.1 follows IGNIS 0.4.1

Sun, 25 Oct 2026 12:00:00 GMT

The four ARDOR packages move to 0.4.1 and peer on IGNIS 0.4.1; the node fetcher no longer logs the Authorization header or the sign-in password.

The fetcher no longer logs secrets, and four request bugs are fixed

Sat, 24 Oct 2026 12:00:00 GMT

NodeFetcher stops logging request headers and bodies, keeps your abort signal with a timeout, sends bodies as they are, and joins params to a url with a query.

ARDOR 0.4.0 follows IGNIS 0.4.0

Sat, 24 Oct 2026 12:00:00 GMT

The four ARDOR packages move to 0.4.0 and peer on IGNIS 0.4.0; the app preset gets required runtime variables and no formatter config.

Runtime config in the app preset, one image for every environment

Thu, 22 Oct 2026 12:00:00 GMT

The app preset writes config.js from VITE_ variables at container start, getRuntimeConfig reads it, and APP_REQUIRED_ENV stops a container early.

A feature library preset

Wed, 21 Oct 2026 12:00:00 GMT

vulcan add --preset ardor --lib adds an ARDOR feature package to a monorepo, with a sample feature and a test that mounts it.

ARDOR ships a VULCAN preset

Tue, 20 Oct 2026 12:00:00 GMT

Create a monorepo with an ARDOR admin, or add an admin to an existing monorepo, with the ARDOR preset for VULCAN 0.3.0 or newer.

ARDOR 0.3.0 Is Stable

Tue, 20 Oct 2026 12:00:00 GMT

The four ARDOR packages are published at 0.3.0 on the latest tag, on IGNIS 0.3.0. ARDOR and IGNIS now share a minor version.

Every app has the same scripts

Tue, 20 Oct 2026 12:00:00 GMT

The generated admin and the examples use one set of script names (server:dev, compile, typecheck, lint, test, clean). The names dev and build are gone.

toDataUrl no longer needs Promise.withResolvers

Mon, 19 Oct 2026 12:00:00 GMT

toDataUrl builds its promise with new Promise, so it runs on a Chrome older than 119.

Augment @venizia/ardor, not the declaring packages

Mon, 19 Oct 2026 12:00:00 GMT

Augment IUseInjectableKeysOverrides and IUseTranslateKeysOverrides on @venizia/ardor; a block on -react or -admin fails under a non-hoisting linker.

TPaths stops at a Date, a Set, a function and an any field

Sun, 18 Oct 2026 12:00:00 GMT

TPaths no longer names the members of a Date, RegExp, Set, Map, Promise, function or any field as paths, so createdAt.getTime is not a state path.

ARDOR 0.1.4 on stable IGNIS 0.2.2

Sun, 18 Oct 2026 12:00:00 GMT

The IGNIS peers of the four packages are the stable ^0.2.2 range instead of 0.2.2-N prerelease floors. ARDOR 0.1.4 is the first stable line on them.

login stores roles, and the sign-in extension points are protected hooks

Sun, 18 Oct 2026 12:00:00 GMT

DefaultAuthProvider.login saves the roles of the sign-in response where getRoles reads them. The four sign-in options of 0.1.4-4 become protected hooks.

One copy of each package that carries identity, owned by the application

Sun, 18 Oct 2026 12:00:00 GMT

ra-i18n-polyglot is a peer of ardor-admin and ardor, so an application needs no resolve.dedupe list.

Types, hooks and utilities follow IGNIS house style

Sun, 18 Oct 2026 12:00:00 GMT

Kernel utilities take one options object, React hooks take opts with an enabled flag, and features are defined through Features.

Options hold data, behaviour lives in protected hooks

Sun, 18 Oct 2026 12:00:00 GMT

Callbacks, flags and setters on the network service, providers and fetchers become protected hooks; an old-to-new table lists every renamed name.

A Vite application autoloads its classes with IgnisArtifactsVitePlugin

Sun, 18 Oct 2026 12:00:00 GMT

A Vite application registers its decorated classes with IgnisArtifactsVitePlugin and AutoArtifacts instead of listing them; the IGNIS peer floors move.

A package depends on its siblings at the exact version released with it

Sun, 18 Oct 2026 12:00:00 GMT

ardor, ardor-admin and ardor-react name the other ARDOR packages at the exact version released with them, so a fresh install cannot pull a newer sibling.

IGNIS's sign-in is the default, and an application can run with no sign-in

Sun, 18 Oct 2026 12:00:00 GMT

DefaultAuthProvider signs in the way IGNIS's auth controller expects, and ArdorApplication runs with no auth provider; the old path and body stay expressible.

start() names a module cycle in the artifact index

Sun, 18 Oct 2026 12:00:00 GMT

An artifact index that lists undefined or a non-class, as a module cycle leaves behind, makes start() throw an error that names the position and the cause.

PATCH in upper case, log levels, no pagination, no NaN count

Sat, 17 Oct 2026 12:00:00 GMT

Four fixes: upper-case fetcher methods, one console method per log level, getManyReference without pagination, no NaN count.

A generated artifact index for the application

Sat, 17 Oct 2026 12:00:00 GMT

artifacts() takes the index ignis-artifacts generate emits, so a bundler keeps every stereotyped class and start() fails on a class that was never discovered.

canAccess reaches an AuthProvider subclass without a fourth super argument

Wed, 14 Oct 2026 12:00:00 GMT

DefaultAuthProvider reads the bound permission provider from the container itself, so a subclass with its own constructor gets canAccess without forwarding it.

The data provider throws an ApplicationError and reads Content-Range

Sat, 10 Oct 2026 12:00:00 GMT

A failed request through the REST data providers rejects with an ApplicationError, and a malformed Content-Range falls back to the row count.

checkError redirects on a 401 or 403 from the data provider

Sat, 10 Oct 2026 12:00:00 GMT

DefaultAuthProvider.checkError falls back to statusCode, so an ApplicationError thrown by the data provider now reaches its 401 and 403 branches.

useDocumentTitle and useHtmlLang

Fri, 09 Oct 2026 12:00:00 GMT

Two admin hooks - one sets the browser tab title per screen and restores it on unmount, the other keeps the html lang attribute on the UI locale.

Const-value types keep their literals when copied

Fri, 09 Oct 2026 12:00:00 GMT

TConstValue, TStringConstValue, TNumberConstValue and TStatusFromClass keep their literals when copied into an object literal or a let.

List extras on the data provider and the repository

Wed, 07 Oct 2026 12:00:00 GMT

ARDOR adopts IGNIS list extras - getList asks with meta.extra and answers meta.extra, and reads a route's default extras unasked.

Feature modules and permissions

Wed, 07 Oct 2026 12:00:00 GMT

An application mounts feature packages - resources, routes, bindings, messages - from features(), and answers react-admin's canAccess from its own provider.

Class identity survives a minifier

Wed, 07 Oct 2026 12:00:00 GMT

A pinned datasource resolves in a minified build, and start() refuses two classes that derive one binding key. The IGNIS peer floors rise with it.

A repository sends what the data provider sends

Tue, 06 Oct 2026 12:00:00 GMT

getDataSourceAuth() fills IGNIS 0.2.1-4's per-send hooks - session headers, timezone, channel, no token on no-auth paths, the server's error code.

HttpRepository writes and shares the data provider auth; BaseCrudService goes

Fri, 02 Oct 2026 12:00:00 GMT

HttpRepository writes on IGNIS 0.2.1, shares the data provider's token and one 401 refresh, and replaces BaseCrudService. Providers bind as singletons.

Repositories by discovery, a relative baseUrl, and IGNIS 0.2.0 stable

Thu, 24 Sep 2026 12:00:00 GMT

Declare an HttpRepository with @repository({ type: RepositoryTypes.REMOTE }), point a datasource at '/api', and raise the IGNIS peers together.

Registration by hand, useRepository, and installs that load

Wed, 23 Sep 2026 12:00:00 GMT

Register artifacts by stereotype or by hand as in IGNIS, resolve repositories by class, BaseApiService removed, packages load under Node ESM.

IGNIS stereotypes and repositories, bulk writes in the body, safer headers

Sat, 19 Sep 2026 12:00:00 GMT

Classes register by stereotype, HTTP repositories come from IGNIS, bulk writes send their selector in the body, and requests work on plain-http origins.

The network layer is fetch only, and axios is gone

Wed, 16 Sep 2026 12:00:00 GMT

ARDOR drops its axios transport and moves the socket client behind a sub-path, so importing the framework pulls no HTTP client and no optional peer.

One logger per scope, singleton services, and a kernel that owns its headers

Fri, 11 Sep 2026 12:00:00 GMT

One logger per scope, singleton services, an application that binds itself, and per-call headers and form-encoded bodies honoured.

ARDOR Replaces @minimaltech/ra-core-infra

Fri, 11 Sep 2026 12:00:00 GMT

The frontend framework splits into four ARDOR packages behind an umbrella import, with four symbol renames and updated dependency requirements.