---
package: "@webjsdev/cli"
version: 0.10.7
date: 2026-06-03T13:20:48.123Z
commit_count: 3
---
## Features

- **add a webjs typecheck command (tsc --noEmit wrapper)** ([#307](https://github.com/webjsdev/webjs/pull/307)) [`0eb4e9f4`](https://github.com/webjsdev/webjs/commit/0eb4e9f4)
  webjs ships erasable TypeScript as a first-class authoring mode (strict + noEmit + erasableSyntaxOnly + @webjsdev/ts-plugin) but had no command to run the type checker. The runtime only catches strip-time failures (non-erasable syntax) with a 500; genuine type errors were surfaced by nothing, since webjs check is correctness-only and explicitly does not type-check.
  
  Add `webjs typecheck`: it resolves the project's OWN typescript/bin/tsc (via createRequire from the app cwd, so it reads the app's tsconfig) and spawns it with --noEmit, passing extra args through, exiting non-zero on a type error so it works as a CI gate. When TypeScript is not installed it prints a clear message and exits non-zero. The framework runs the standard compiler, it does not embed one. The scaffold now ships a typecheck npm script and typescript as a devDependency, with CONVENTIONS.md documenting it as the separate is-my-TypeScript-valid gate to add to CI once the app type-checks cleanly. Not auto-added to the scaffold CI to avoid a day-one failure before the app is verified to type-check.
- **document the handle() test harness, ship test helpers, fix the saas auth test** ([#308](https://github.com/webjsdev/webjs/pull/308)) [`9df85d23`](https://github.com/webjsdev/webjs/commit/9df85d23)
  createRequestHandler().handle(request) drives the full pipeline (middleware, routing, SSR, actions, auth/CSRF) and the framework's own suite uses it, but it was documented only as an embedding API, with no testRequest() recipe, no helper to build an authenticated/CSRF request, and no helper to round-trip an action through the /__webjs/action/<hash>/<fn> serializer+dispatch path. Actions were tested by direct import, bypassing CSRF and prod error sanitization. The saas template's test asserted only TypeScript shapes and sat on test/unit/, contradicting the documented test/<feature>/ convention.
  
  Add packages/server/src/testing.js (a ./testing export): testRequest fires a native Request through handle(); getCsrf mints a valid token+cookie off the first SSR response (reusing the real csrf.js constants); loginAndGetCookies drives the real credentials login and captures the genuine signed session cookie; actionEndpoint computes the real /__webjs/action/<hash>/<fn> path; and invokeActionForTest round-trips an action through that endpoint with the real serializer + CSRF, so a regression test proves it catches what a direct import misses (a Map surviving only because the wire serializer ran, a 403 on a CSRF-missing request, and prod error sanitization hiding a stack + secret field the direct throw leaks). The saas scaffold now ships a real auth-flow test at test/auth/auth.test.ts: the unauthenticated-protected-route-redirect always runs, and the signup/login/authenticated-render path runs when the DB is set up (skips cleanly otherwise).
- **add a webjs doctor project-health command** ([#311](https://github.com/webjsdev/webjs/pull/311)) [`44ff8600`](https://github.com/webjsdev/webjs/commit/44ff8600)
  * feat: add a webjs doctor project-health command
  
  There was no single command to verify a webjs project is set up correctly. webjs has unusually many fragile preconditions (the Node 24+ strip-types floor, the erasableSyntaxOnly TS flag, importmap pin freshness, git-hook activation, env drift, @webjsdev version coherence), each an independent failure mode a contributor onboarding to an existing repo hits only at runtime.
