Stagepass
GitHub

Changelog

Changelog

Every release of the CLI, the loader and the modules. Packages are versioned independently and follow semantic versioning.

@stagepass/cli2.2.1latest on npm@stagepass/loader2.3.0latest on npm@stagepass/modules2.2.0latest on npm

loader2.3.0

  • Stable release of the 2.3 loader, identical in behaviour to 2.3.0-beta.4 (only the embedded version string changes). Non-breaking minor release: the public sp API, attributes, events, session handling and URL swapping behave as in 2.2.0. @stagepass/cli (2.2.1) and @stagepass/modules (2.2.0) are unchanged; the published modules peer range >=2.0.0 accepts 2.3.0 without --legacy-peer-deps.
  • Visitors without a session load only loader.min.js, see nothing and get no extra listeners, no console wrapping and no crossorigin changes. Everything below appears only while a session (?stagepass=<project>.sp or ?stagepass=debug) is active.
  • Summary of 2.3.0-beta.0 to 2.3.0-beta.4:
  • Changed
  • New dev flag in three stages instead of the STAGEPASS ACTIVE / STAGEPASS DEBUG badge: a small pass-icon pill with a status dot at rest (amber for warnings, red for errors), expanded on hover or keyboard focus with LOCAL / DEBUG and the counters, and a session card on click. On touch devices the first tap expands and the second opens the card.
  • No glow, shadow, blur or filter in any state; dark ink text and icons on the gradient, 1px low-opacity border.
  • Clicking the flag no longer ends the session. Only "End session" in the card disconnects (same as ?stagepass=off); Esc or a click outside closes the card and returns focus to the pill.
  • The flag UI moved out of the loader into dist/flag.min.js and dist/flag-card.min.js, fetched only during a session (the card on first expand).
  • The Chrome Local Network Access check runs once per page, and its hint is shown in the card only when a local file fails at the network level.
  • "Script error." from another origin is shown as "Error in a cross-origin script (details only in DevTools console)" with source external.
  • Added
  • Session card: project, session domain, a collapsed list of swapped files (live → local, js/css, ok / 404 / failed; only loaded files count as swapped) and the latest 50 message groups. Fixed header and footer with an inner scroll area that stays inside the viewport; max-width: calc(100vw - 24px) and 44px touch targets on mobile.
  • Inspector with error context: each message keeps its source (local, live, external), file:line:col and a collapsible stack; repeats are grouped as ×N with the last time. "Always expanded" (stored per origin), "Copy all" and per-message "Copy" as Markdown (page URL without query, project, loader version, messages; no cookies or storage).
  • Locally swapped files load with crossorigin="anonymous" for full error details. Without a CORS header from the local server the file loads again without it and a warning says so.
  • Counters and messages from sp.warn / sp.error / sp.log, console.warn / console.error (the original console still runs; arguments are serialized safely with limits), uncaught errors, failed resource loads and unhandled rejections (with stack). Failed local files report "Local file not found (404)" or "Local server not reachable … Run stagepass doctor".
  • Card footer: Reload, "Debug mode" / "Back to local" (works in both directions, also from a new tab or a restored session; disabled with a reason when there is no session to return to) and End session.
  • Shadow DOM rendering with DOM APIs only (no innerHTML, no eval), keyboard and screen reader support, prefers-reduced-motion.
  • Size budget tests in CI for loader.min.js, flag.min.js and flag-card.min.js.
  • Sizes: loader.min.js 13.1 KB minified / 5.9 KB gzip (2.2.0: 12.1 KB / 5.0 KB), flag.min.js 2.7 KB gzip, flag-card.min.js 4.8 KB gzip.

loader2.3.0-beta.4

  • Prerelease of the loader only, on top of 2.3.0-beta.3. CLI and modules are unchanged. Visitors without a session see no change: no console wrapping, no crossorigin, no extra requests.
  • Added
  • Inspector details: every message keeps its source (local, live, external), file:line:col and the stack. Rows are one-liners; a click shows the details. Repeats are grouped as ×N with the last time.
  • Locally swapped files load with crossorigin="anonymous", so their errors keep message, location and stack. If the local server sends no CORS header, the file loads again without it and a warning explains that details are limited.
  • console.warn and console.error on the page are captured during a session (the original still runs; arguments are serialized safely with depth and size limits). Unhandled rejections show the message and stack.
  • Failed local files report "Local file not found (404)" or "Local server not reachable … Run stagepass doctor". The Local Network Access hint is added only to that network-level failure.
  • Collapsed list of swapped files (live → local, js/css, ok / 404 / failed, full URLs in the tooltip).
  • "Always expanded" toggle (stored per origin), "Copy all" and per-message "Copy" as Markdown (page URL without query, project, loader version, messages; no cookies or storage).
  • Changed
  • "Script error." from another origin is shown as "Error in a cross-origin script (details only in DevTools console)" with source external.
  • The swapped-files count only includes files that actually loaded.
  • The Debug toggle is labelled by its action ("Debug mode" / "Back to local"). After the reload the pill expands briefly to show the new mode. The session to return to is stored in localStorage, so it also works from a new tab or a restored session. Without one the button is visibly disabled and the card says why.
  • Card layout: fixed header and footer with an inner scroll area that never leaves the viewport; max-width: calc(100vw - 24px) and 44px touch targets on mobile.
  • After a click outside the card, focus returns to the pill (unless the click focused something on the page).
  • Sizes: loader.min.js 13.1 KB minified / 5.9 KB gzip (beta.3: 11.0 KB / 5.0 KB), flag.min.js 2.7 KB gzip, flag-card.min.js 4.8 KB gzip. Size budgets raised accordingly.

loader2.3.0-beta.3

  • Prerelease of the loader only, on top of 2.3.0-beta.2. CLI and modules are unchanged. The public sp API, attributes, events and URL swapping behave as before.
  • Changed
  • Dev flag v2, in three stages. At rest it is a small pass-icon pill with a status dot (amber for warnings, red for errors). On hover or keyboard focus it expands to the left and shows LOCAL / DEBUG and the counters. A click opens a session card. On touch devices the first tap expands and the second opens the card.
  • Clicking the flag no longer ends the session. Only "End session" in the card disconnects (same as ?stagepass=off). Esc or a click outside closes the card.
  • The flag text, counters and icons are dark ink on the gradient. There is still no glow, shadow, blur or filter in any state, and the pill has a 1px low-opacity border.
  • The Local Network Access hint is shown as a warning in the card instead of the tooltip.
  • Added
  • Session card (340px, opaque, follows a dark or light page): project, session domain, number of files swapped locally, and the latest 50 warnings and errors with time and file:line. Messages are always rendered as text and long messages are truncated. Clicking a message copies it to the clipboard ("Copied").
  • Card footer: Reload, a Debug on/off toggle (reloads with ?stagepass=debug and back to the previous session) and End session.
  • When the local dev server cannot be reached, the flag shows the error dot and the message "Local server not reachable … Run stagepass doctor".
  • The card ships as a separate file, dist/flag-card.min.js, fetched on first expand next to flag.min.js.
  • Accessibility: the pill is a button with aria-expanded, the card is a role="dialog" with an aria-label. Focus moves into the card on open and back to the pill on close, there is a visible focus ring, and with reduced motion all changes are instant.
  • Size budget test for flag-card.min.js. Sizes: loader.min.js 11.3 KB minified / 5.1 KB gzip (beta.2: 10.5 KB / 4.7 KB), flag.min.js 2.6 KB gzip, flag-card.min.js 3.4 KB gzip.

loader2.3.0-beta.2

  • Prerelease of the loader only, on top of 2.3.0-beta.1. CLI and modules are unchanged.
  • Changed
  • Dev flag: the glow is removed. The pill has no shadows, glow layers or filters in any state (rest, hover, focus, entry animation), which also removes the glow artefacts Chrome showed on hover. Hover now slightly lightens the red gradient; keyboard focus keeps the crisp 2px outline. Label, icons, counters and click behaviour are unchanged.

loader2.3.0-beta.1

  • Prerelease of the loader only, on top of 2.3.0-beta.0. CLI and modules are unchanged.
  • Fixed
  • Dev flag: the glow could show a straight edge in Chrome (a hard horizontal line next to the pill, most visible on dark pages). The glow is now a radial gradient on its own layer that fades out completely inside its box instead of a large blurred box-shadow, and the entry animation fades and scales in place instead of sliding in from above the viewport. The flag sits 12px from the top right corner (was 10px) so the glow fades out before the window edge at the top.

loader2.3.0-beta.0

  • Non-breaking minor prerelease of the loader only. @stagepass/cli (2.2.1) and @stagepass/modules (2.2.0) are unchanged; any 2.x CLI and modules work with it. The public sp API, attributes, events and URL swapping behave as in 2.2.0.
  • Changed
  • New dev flag: a red LOCAL pill (or DEBUG) replaces the old STAGEPASS ACTIVE / STAGEPASS DEBUG badge. The LNA hint moves from the badge text to the tooltip and the warning counter.
  • The flag UI moved to a separate file, dist/flag.min.js, fetched only while a session is active. Visitors without a session load less code: loader.min.js is 10.5 KB minified / 4.7 KB gzip (2.2.0: 12.1 KB / 5.0 KB).
  • The Chrome Local Network Access check runs once per page instead of twice.
  • Added
  • Warning and error counters on the flag: sp.warn / sp.error / sp.log('warn' | 'error'), uncaught errors, failed resource loads and unhandled rejections (listeners are only added during a session).
  • The flag renders in a Shadow DOM, uses DOM APIs only and respects prefers-reduced-motion.
  • Size budget test in CI for loader.min.js and flag.min.js.

cli2.2.1

  • Patch release of the CLI only. @stagepass/loader and @stagepass/modules stay at 2.2.0.
  • Fixed
  • stagepass new with "Run npm install now?" = y failed with npm error notarget No matching version found for @stagepass/loader@^2.2.0 while 2.2.0 was not yet published. Generated projects now depend on @stagepass/loader / @stagepass/modules ^2 (the same major as the CDN pin @2), never on a range derived from the CLI or a staged version.
  • stagepass upgrade only writes ranges that a published version satisfies. It reads npm view <pkg> dist-tags versions and writes ^<latest published 2.x>; offline it writes ^2. An explicit --version that is not published (for example a staged release awaiting approval) is refused before any file is written.
  • Types follow what is actually available: per-module entries (@stagepass/modules/cookies, …) are only written when a published or installed @stagepass/modules ships them (2.2.0 and later). Otherwise the umbrella @stagepass/modules is used, so tsc keeps passing on 2.0.0. After npm install, new reconciles the types with the installed package.
  • stagepass upgrade without a TTY maps the legacy "modules": true to ["all"] instead of [], so sp.inject / sp.cookies / sp.maintenance do not become type errors. A hint shows how to narrow the list (--site-modules cookies).
  • Generated JavaScript projects failed tsc -p jsconfig.json (checkJs + strict) on window.Webflow in src/main.js. The entry now uses a JSDoc cast; runtime code is unchanged.

cli2.2.0

  • Non-breaking minor release, together with @stagepass/loader and @stagepass/modules 2.2.0. Includes the 2.1.0 packaging fix (2.1.0 and the planned 2.1.1 were never published as latest). Existing commands, flags and defaults keep working.
  • Fixed
  • stagepass new failed with ENOENT … templates/project/.gitignore when installed from npm (for example after answering y to "Run npm install now?"): npm pack drops .gitignore files, so the template never shipped. Dotfile templates are now stored without the leading dot (templates/project/gitignore) and written as .gitignore.
  • A missing template now fails with a clear message ("reinstall the CLI") before anything is written.
  • Generated projects no longer pin @stagepass/loader / @stagepass/modules to the CLI's own version. They use ^<major>.<minor>.0 of the loader/modules version this CLI targets (^2.2.0).
  • stagepass upgrade without --version and the data-stagepass-version in printed snippets use the loader/modules version this CLI targets, not the CLI version.
  • Added
  • Declared modules: stagepass.json has "modules": [], ["cookies"] (any of inject, cookies, maintenance) or ["all"]. stagepass new asks for it (or takes --site-modules), stagepass upgrade infers and confirms it. The legacy boolean "modules": true|false is still read.
  • Live site detection: stagepass new --site <host> and stagepass upgrade (using --site or the project's linked origin) fetch the public page once (https only, no cookies or auth, about 5 s timeout, size cap, at most 3 redirects) and read <script src> tags of @stagepass/loader / @stagepass/modules on jsDelivr or one other public npm CDN (any version). Nothing from the page is executed. When the site is unreachable the CLI asks; without a TTY it keeps the existing list (or []) and prints a hint.
  • Agent guide: generated projects get AGENTS.md with a full sp API reference between <!-- stagepass:begin --> and <!-- stagepass:end -->, plus an editor rule file (globs src/**). Declared modules get full sections; undeclared ones get a "not available; enable by …" line and an explicit rule never to use them.
  • stagepass upgrade syncs existing projects: adds AGENTS.md if missing or refreshes only the managed block, adds the editor rule file if missing, updates types in tsconfig.json / jsconfig.json (rest of the JSON preserved; files with comments or without a types array are skipped with a hint), and prints every change. New flags --dry-run (writes nothing), --site, --site-modules, --skip-site, -y, --yes.
  • stagepass doctor checks the project in the current directory: stagepass.json modules list, the live site's loaded loader version, and a warning when the live site loads other modules than declared. --skip-site skips the network check.
  • tsconfig.json / jsconfig.json in new projects list per-module types (@stagepass/modules/cookies, …) for the declared modules only.
  • Changed
  • CI and the release workflow run a packed-tarball smoke test (scripts/test-cli-packed.mjs): packs cli, loader and modules, scaffolds ts and js projects with --install from the local tarballs, type checks sp, builds, and runs upgrade on an old-style project.
  • The release workflow stages every version (also stable) under the next dist-tag; promotion to latest is an explicit npm dist-tag add after approval. Partial releases stage only the packages whose version matches the tag.

loader2.2.0

  • Non-breaking minor release. No runtime behaviour change (only the embedded version string).
  • Added
  • Complete TypeScript declarations for sp / window.stagepass in global.d.ts with JSDoc and examples, including typed sp.on(...) overloads for the built-in events. Verified by type check fixtures.

modules2.2.0

  • Non-breaking minor release. Runtime files in dist/ are unchanged.
  • Added
  • Per-module type entries: @stagepass/modules/inject, @stagepass/modules/cookies, @stagepass/modules/maintenance (shipped as inject.d.ts, cookies.d.ts, maintenance.d.ts). Add only the modules your site loads to compilerOptions.types, so undeclared sp.<module> is a type error.
  • Full JSDoc with examples for sp.inject, sp.cookies and sp.maintenance.
  • Changed
  • @stagepass/modules (the package types entry, global.d.ts) still declares all modules, so existing types: ["@stagepass/modules"] setups keep working.

cli2.1.0

  • Non-breaking minor release. Existing commands, flags, defaults, and output contracts from 2.0.0 keep working.
  • Added
  • stagepass doctor [--json]: read-only local stack diagnostics (Homebrew, Caddy, PHP/php-fpm, dnsmasq, resolver, port 443, Caddyfile, projects, certs, LaunchAgent, Chrome LNA hint). Never uses sudo. Exit 1 when any check fails.
  • stagepass certs check / stagepass certs trust: read-only Caddy local CA checks; trust runs caddy trust after confirmation or --yes.
  • stagepass autostart on|off|status and stagepass daemon: user Login LaunchAgent (io.github.arobertherz.stagepass) running caddy run without sudo.
  • stagepass new [name]: lean Webflow project scaffold (TypeScript/SCSS defaults, optional modules, git, install). Flags for every option; --yes / --dry-run.
  • stagepass build / stagepass watch: thin wrappers around project npm run build / npm run watch (exit code forwarded; no shell).
  • stagepass upgrade: bump @stagepass/* in the current package.json and print Webflow snippets (does not run install).
  • macOS platform guard for system commands (setup, start, stop, reload, link, unlink). --version / --help still work everywhere. Escape hatch STAGEPASS_SKIP_PLATFORM_CHECK=1 for tests/CI only.
  • Manual macOS checklist packages/cli/TESTING-macos.md.
  • Changed
  • CI test matrix uses Node 22 and 24 (development tooling). Published engines.node remains >=18.0.0 (no consumer impact).
  • Docs
  • Documented doctor, certs, autostart/daemon, and project helpers (new / build / watch / upgrade).
  • Default CDN / install recommendation is major pin @2 (exact pin optional). jsDelivr is the documented CDN; another public npm CDN is noted as an alternative.
  • Issue/PR templates and jsDelivr @2 purge notes.

loader2.1.0

  • Non-breaking minor release. 2.0.0 behaviour is preserved (vars.env, eager vars.client, session/swap contracts unchanged).
  • Added
  • Flat helpers: stagepass.env() / is() / can() / client() / on() / use() (module registry with major-version check).
  • Optional data-stagepass-staging-hosts (comma-separated hostnames treated as staging in addition to *.webflow.io).
  • Optional data-stagepass-alias (custom global name; assigned only when free).
  • Debug-mode warning when multiple tagged assets share the same local filename.
  • Docs
  • Documented Runtime API helpers, staging hosts, and alias.
  • Prefer major CDN pin @2 (exact pin optional); jsDelivr purge notes for the @2 alias.

modules2.1.0

  • Non-breaking minor release. Existing inject / cookies APIs keep working; new behaviour is additive or opt-in. Modules still register without the loader (inject / cookies warn; maintenance skips).
  • Added
  • maintenance.min.js: opt-in client-side maintenance overlay (data-stagepass-maintenance="true"; sp.maintenance.enable / disable / isActive). Text via textContent only (not access protection; no noindex).
  • Cookies: consent categories with queue, jar / crumbs / throwAll, and sp.cookie alias.
  • Inject: integrity, crossorigin, nonce, and allowedHosts options.
  • Security
  • Cookie attribute values validated against cookie injection.
  • Reserved inject attributes cannot bypass the host allowlist.
  • Docs
  • Documented maintenance module, consent helpers, and inject security options.
  • Prefer major CDN pin @2 (exact pin optional); published files list includes maintenance.min.js.

cli2.0.0-beta.1

  • Security
  • Caddy site blocks no longer serve hidden path segments (.git, .env, …), node_modules, or common private key/cert/db/log extensions; blocked before php_fastcgi / file_server.
  • CORS no longer uses blanket Access-Control-Allow-Origin: * by default. Allowed origins are reflected with Vary: Origin (local .sp / localhost / 127.0.0.1, plus per-project --origin / projects.json). No Access-Control-Allow-Credentials.
  • Breaking: *.webflow.io / *.webflow.com are not in the default allowlist; add hosts via --origin (explicit *.webflow.io allowed with a warning).
  • Domain and project-root inputs are validated to prevent Caddyfile injection; dangerous roots (/, home, /Users, /System, …) are refused.
  • Added
  • Origin allowlist CORS with OPTIONS preflight (204), Access-Control-Allow-Private-Network, and configurable live domains (--origin, ~/.stagepass/projects.json).
  • --allow-all-origins / --no-allow-all-origins opt-in for the previous permissive CORS mode (with warnings).
  • --remove-origin <host> (repeatable) to drop stored CORS hostnames.
  • Automatic legacy Caddyfile migration on link / reload / start (timestamped backup, version marker # stagepass-block: v2; migrated blocks keep allowAllOrigins enabled for compatibility).
  • Shared pure helpers under src/lib/ (caddyfile, domain, origins, paths, projects, migrate) and expanded Vitest coverage; optional Docker/caddy adapt integration test (skipped when unavailable).
  • Tag-triggered npm stage publish release workflow (see RELEASING.md).
  • Changed
  • stagepass --version reads the version from packages/cli/package.json instead of a hard-coded value.
  • Generated site blocks include # stagepass-block: v2 / # stagepass-options: … markers.
  • Regenerating v2 blocks uses the tighter defaults and prints a tip to add --origin for Webflow/staging hosts.
  • Fixed
  • Invalid or injectable domain names are rejected before writing the Caddyfile; folder-derived domains are slugified when needed.
  • --no-allow-all-origins is a defined Commander option (three-state with --allow-all-origins; omitting both keeps stored settings).
  • Re-linking a v2 site when projects.json lacks the domain restores CORS options from the Caddyfile marker instead of silently resetting them.

loader2.0.0-beta.1

  • Breaking
  • No global console mute in production by default; opt in with data-stagepass-mute-console="true".
  • ?stagepass= sessions expire (default 12 h; data-stagepass-session-hours); stored as JSON with expiry.
  • data-stagepass-cachebust="true" no longer appends a timestamp on every production page view; use data-stagepass-version / data-stagepass-v → ?v=.
  • Injected scripts keep order (script.async = false).
  • Removed deprecated globals splog, spwarn, sperror.
  • Added
  • Chrome Local Network Access permission hint (loopback-network / local-network-access) before local swaps.
  • Build-time __STAGEPASS_VERSION__ from package.json.
  • Shipped global.d.ts (types field) for Window.stagepass / stagepass / sp.
  • Added package LICENSE (MIT).

modules2.0.0-beta.1

  • Breaking
  • Injected scripts keep insertion order (async = false unless async: true).
  • Production cacheBust: true no longer appends per-view timestamps; use version: '…' → ?v=.
  • Added
  • Declaration merging types (global.d.ts) for stagepass.inject / stagepass.cookies.
  • JSDoc on public cookie helpers and inject.
  • Earlier 1.1.1
  • Documentation only relative to published 1.1.0: package README.md, LICENSE, and version bump in package.json. Dist artifacts match npm 1.1.0.

cli2.0.0

  • Security
  • Caddy site blocks no longer serve hidden path segments (.git, .env, …), node_modules, or common private key/cert/db/log extensions; blocked before php_fastcgi / file_server.
  • CORS no longer uses blanket Access-Control-Allow-Origin: * by default. Allowed origins are reflected with Vary: Origin (local .sp / localhost / 127.0.0.1, plus per-project --origin / projects.json). No Access-Control-Allow-Credentials.
  • Breaking: *.webflow.io / *.webflow.com are not in the default allowlist; add hosts via --origin (explicit *.webflow.io allowed with a warning).
  • Domain and project-root inputs are validated to prevent Caddyfile injection; dangerous roots (/, home, /Users, /System, …) are refused.
  • Added
  • Origin allowlist CORS with OPTIONS preflight (204), Access-Control-Allow-Private-Network, and configurable live domains (--origin, ~/.stagepass/projects.json).
  • --allow-all-origins / --no-allow-all-origins opt-in for the previous permissive CORS mode (with warnings).
  • --remove-origin <host> (repeatable) to drop stored CORS hostnames.
  • Automatic legacy Caddyfile migration on link / reload / start (timestamped backup, version marker # stagepass-block: v2; migrated blocks keep allowAllOrigins enabled for compatibility).
  • Shared pure helpers under src/lib/ and expanded Vitest coverage; optional Docker/caddy adapt integration test (skipped when unavailable).
  • Tag-triggered npm stage publish release workflow (see RELEASING.md).
  • Changed
  • stagepass --version reads the version from packages/cli/package.json instead of a hard-coded value.
  • Generated site blocks include # stagepass-block: v2 / # stagepass-options: … markers.
  • Regenerating v2 blocks uses the tighter defaults and prints a tip to add --origin for Webflow/staging hosts.
  • Fixed
  • Invalid or injectable domain names are rejected before writing the Caddyfile; folder-derived domains are slugified when needed.
  • --no-allow-all-origins is a defined Commander option (three-state with --allow-all-origins; omitting both keeps stored settings).
  • Re-linking a v2 site when projects.json lacks the domain restores CORS options from the Caddyfile marker instead of silently resetting them.

loader2.0.0

  • Breaking
  • No global console mute in production by default; opt in with data-stagepass-mute-console="true".
  • ?stagepass= sessions expire (default 12 h; data-stagepass-session-hours); stored as JSON with expiry.
  • data-stagepass-cachebust="true" no longer appends a timestamp on every production page view; use data-stagepass-version / data-stagepass-v → ?v=.
  • Injected scripts keep order (script.async = false).
  • Removed deprecated globals splog, spwarn, sperror.
  • Added
  • Chrome Local Network Access permission hint (loopback-network / local-network-access) before local swaps.
  • Build-time __STAGEPASS_VERSION__ from package.json.
  • Shipped global.d.ts (types field) for Window.stagepass / stagepass / sp.
  • Package LICENSE (MIT).

modules2.0.0

  • Breaking
  • Injected scripts keep insertion order (async = false unless async: true).
  • Production cacheBust: true no longer appends per-view timestamps; use version: '…' → ?v=.
  • Added
  • Declaration merging types (global.d.ts) for stagepass.inject / stagepass.cookies.
  • JSDoc on public cookie helpers and inject.

loader1.2.0

  • Added sp.vars.client runtime info (theme, browser, os, device, viewport, locale, capabilities), with live updates for theme and viewport.
  • Added package README.md.

modules1.1.0

  • Added Cookies utility module (sp.cookies.bake / eat / throw / has / list), bundled into all.min.js.

loader1.1.4

  • Added preferred logging API: sp.log / sp.warn / sp.error (splog / spwarn / sperror deprecated).
  • Added sp.resolveLocalUrl(relativePath) for shared local URL building.
  • Added data-stagepass-cachebust for production cache busting.
  • Removed evaluation of loader script-tag query parameters ?modules / ?silent (modules must be included as separate script tags).

modules1.0.6

  • Injector uses loader resolveLocalUrl when available; added production cacheBust option.
  • Declared @stagepass/loader peer dependency; dist files committed for CDN use.

cli1.0.1

  • CORS support for linked .sp sites: OPTIONS preflight (204) plus Access-Control-Allow-Methods / Access-Control-Allow-Headers (committed in the 2026-03-10 release work; published as 1.0.1).

loader1.1.3

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history (same-day publishes after 1.1.1).

loader1.1.2

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history (same-day publishes after 1.1.1).

loader1.1.1

  • Module loading readiness / sequential module script loading fixes (while script-tag ?modules still existed in this line).

loader1.1.0

  • Exposed global stagepass (in addition to window.stagepass).

modules1.0.5

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history.

modules1.0.3

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history.

modules1.0.2

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history.

modules1.0.1

  • Published on npm. No separate feature commit for this patch bump remains in the current repository history.

modules1.0.0

  • Initial public release: Injector module (sp.inject / inject.min.js / all.min.js).

loader1.0.2

  • Fixed console suppression so active Stagepass sessions are not silenced incorrectly.
  • Added cache-bust query (_cb) for locally swapped assets.

loader1.0.1

  • Package main points at the minified build (dist/loader.min.js).

cli1.0.0

  • Initial public release: local .sp SSL domains via Caddy/Dnsmasq/PHP, setup / start / stop / link / unlink / reload, verbose (-v) logging.

loader1.0.0

  • Initial public release: data-stagepass asset swapping, session via localStorage / ?stagepass=, debug mode, production console suppression, visual active flag.

Generated from CHANGELOG.md in the repository. Upgrading from 1.x? Read Migrate from 1.x to 2.0.