chore: release server 0.8.46, cli 0.10.36

changelog/cli/0.10.36.md

@@ -0,0 +1,17 @@
+---
+package: "@webjsdev/cli"
+version: 0.10.36
+date: 2026-07-09T14:00:00.000Z
+commit_count: 4
+---
+## Features
+
+- **close coverage-gate deferred gaps with real scaffold demos** ([#870](https://github.com/webjsdev/webjs/pull/870)) [`e62d7e41`](https://github.com/webjsdev/webjs/commit/e62d7e41)
+- **add a tier-2 scaffold teaching-coverage gate for core exports** ([#861](https://github.com/webjsdev/webjs/pull/861)) [`35d180d2`](https://github.com/webjsdev/webjs/commit/35d180d2)
+- **add a boundaries gallery demo and harden the scaffold-sync skill** ([#854](https://github.com/webjsdev/webjs/pull/854)) [`5f7bd1f0`](https://github.com/webjsdev/webjs/commit/5f7bd1f0)
+
+## Fixes
+
+- **fresh saas scaffold passes typecheck and axe out of the box (#877, #878)** ([#879](https://github.com/webjsdev/webjs/pull/879)) [`72bb3611`](https://github.com/webjsdev/webjs/commit/72bb3611)
+  * Rewrite the `onBeforeCache` import to `#lib/utils/dom.ts` (it kept a registry-relative `../lib/dom.ts` and failed TS2307), and resolve `AUTH_SECRET` through a typed const with a production fail-fast guard (it was assigned as `string | undefined` to a required `string`).
+  * Give every generated page exactly one `<h1>`, raise the gallery label text to full `text-muted-foreground` contrast, and add accessible names to the file-upload and ref-focus inputs, so a fresh app returns zero axe violations.

changelog/server/0.8.46.md

@@ -0,0 +1,11 @@
+---
+package: "@webjsdev/server"
+version: 0.8.46
+date: 2026-07-09T14:00:00.000Z
+commit_count: 1
+---
+## Fixes
+
+- **route(module) auto-applies an action's declared middleware and validate (#876)** ([#879](https://github.com/webjsdev/webjs/pull/879)) [`72bb3611`](https://github.com/webjsdev/webjs/commit/72bb3611)
+  * The `route()` REST adapter only ran the `middleware` / `validate` passed via its `opts`, so an action's declared `export const middleware` protected the RPC boundary but not the REST one (a function reference cannot reach its sibling config exports).
+  * `route()` now also accepts the action's module namespace (`import * as postActions from '...'; export const POST = route(postActions)`) and auto-applies the declared `middleware` and `validate`, so a guard declared once beside the action protects both boundaries. The bare-function form is unchanged, and an explicit `opts` value still overrides the declared config.

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.35",
+  "version": "0.10.36",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.45",
+  "version": "0.8.46",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",