Upcoming changes and release readiness

Published and candidate source

The consolidated QA report merged in CLI PR12 at 39c1443. Its recorded source baseline is fcde52a; historical results are not reruns against newer main commits. See the current release and QA status for source identities, published package evidence, and remaining gaps.

CLI PR6 merged into main at 060bc5d; its 30 checks passed. Its template-pinning work is now included in the published 2.6.2 and 2.6.3 artifacts. The follow-up candidate d5a0bb1 needs a new PR and CI on its own head.

Candidate local verification passed 118 CLI tests and npm pack dry-run. Supabase-generated output passed lint, typecheck, and build in React + Vite, Next.js, Vue + Vite, Nuxt, and SvelteKit. These results cover source output; they do not certify a released npm artifact or a live auth backend.

Batch slices, preserving segments, and architectural checks

The candidate adds native batch generation with complete preflight and rollback of earlier slices, affected routes/store files, and the ownership manifest if a later operation fails. Batch --force is refused.

node /path/to/cli/bin/index.mjs -g entity product customer --dry-run
node /path/to/cli/bin/index.mjs -g entity product customer
node /path/to/cli/bin/index.mjs -g feature cart --segments ui,api --root src/lib
node /path/to/cli/bin/index.mjs -g shared --segments ui,lib --root src

--segments creates missing directories and empty TypeScript public APIs, preserving existing files. It generates no components, routes, backend, or state registration. --root is supported only with this structure-only mode; it does not rewrite framework aliases or routing. Segments are one comma-separated argument. Symlinks and path collisions are rejected.

# Install in the application using its package manager:
npm install -D steiger @feature-sliced/steiger-plugin
node /path/to/cli/bin/index.mjs check --architecture

This opt-in runs the project's installed Steiger against its framework source root and propagates failure. It downloads nothing automatically; rules and exceptions remain project-owned. Normal check/doctor inspect config, layers, and toolchain, without analyzing import architecture. Native entity batch output passed lint/types/build across all five frameworks.

Supabase Auth adapter candidate

The opt-in adapter replaces example auth requests with Supabase SDK operations in all five supported frameworks. It writes inside the auth slice and does not install an SDK, provision a project, or edit env files. Run these commands from the candidate CLI checkout inside a compatible project; the current published npm 2.6.3 package does not support the new flag.

# Replace /path/to/cli with the reviewed candidate checkout
node /path/to/cli/bin/index.mjs -g feature auth --auth-provider supabase --dry-run
node /path/to/cli/bin/index.mjs -g feature auth --auth-provider supabase
npm install @supabase/supabase-js

The actual SDK 2.117.2 declaration was typechecked; that SDK requires Node.js 22 or later. The CLI runtime requirement remains separate. Initialize the adapter at the framework browser boundary before form submission:

import { createClient } from '@supabase/supabase-js';
import { configureSupabaseAuth } from '@/features/auth';

// Values from the application's public browser configuration.
const client = createClient(publicUrl, publishableKey);
configureSupabaseAuth(client);

Use a public publishable or anon key. Never ship secret or service-role keys to the browser. Server configuration of the browser singleton is rejected; SSR cookies, callbacks, and authorization need a separate request-scoped server integration.

• Login returns a normalized user/session; provider errors and missing sessions reject.
• Registration can return null when email confirmation is required; show confirmation instructions.
• Password recovery uses an email recovery OTP. Configure the recovery email template to expose {{ .Token }}.
• Reset requires matching password confirmation and verified recovery identity; recovery proof is consumed once.
• Logout calls provider signOut. Clearing UI state alone does not revoke a session.
• The SDK owns persistence and refresh. Subscribe to onAuthStateChange to synchronize application state.

When server state is disabled, wire submit handlers to exported API methods. Handle failures without logging passwords, OTPs, or tokens. Before live acceptance, verify signup/confirmation/login, recovery mail and expired codes, password reset, refresh/logout, and RLS on an isolated staging project. Those backend checks remain pending.

Full adapter contract

Light hooks and optional automation

The candidate policy uses staged and unstaged whitespace checks on pre-commit, conventional commit validation on commit-msg, and quality checks in CI. Local lint and pre-push lint/build are opt-in:

FSD_PRE_COMMIT_LINT=1 git commit -m "feat: add catalog"
FSD_PRE_PUSH_CHECKS=1 git push
# Explicit bypass when needed:
HUSKY=0 git commit -m "docs: update guide"

React Auto-PR and labeler workflows move to optional-workflows. Auto-PR is manually dispatched; configure repository labels and workflow permissions before enabling either workflow. No automatic publishing is enabled.

The CLI candidate adds light-hooks-v1, managed state 2 to 3. Only unchanged owned hooks update; customized hooks remain conflicts. Review upgrade --dry-run before applying. The current published npm 2.6.3 package does not contain this migration.

Existing-project migration through the Skill

Migration v1 is an agent-guided workflow: inventory the existing app, establish a passing baseline, map responsibilities to FSD, then move code in small batches. Keep routes, API contracts, product behavior, SSR boundaries, and locale handling intact. Update public APIs and their consumers together; validate each batch and restore affected files on failure.

A representative React/Vite legacy catalog pilot passed lint, types, builds, and Chromium checks across baseline, batch 1, final state, and rollback. Browser checks covered catalog routes, controlled API success and error responses, cart interactions, and wildcard handling. An injected type failure restored exact batch bytes while preserving package and lock files.

This is one synthetic React pilot, not certification of arbitrary production apps or other frameworks. Skill v2.0.0 is tagged and installable, with 15 tests passing in all nine OS/Node CI jobs; the Skill branch merged into main at b825360, with all nine OS/Node jobs passing again on that merge. No arbitrary-app CLI migrate command is shipped. See the tagged Skill and migration fixture.

Roadmap and release gates

The canonical FigJam roadmapseparates published, merged source, candidates, and blocked work. Add and plugin systems remain in the Parking Lot; broader arbitrary migration is research without a promised CLI release.

Nuxt production security findings still block a production-readiness claim. Angular supports read-only inspection in CLI 2.6.3; scaffolding, generation, reconfiguration, and managed upgrades remain unsupported. Old React PR2 and PR3 are obsolete and await owner closure; they are not release requirements.

1. Review and merge the required template and CLI changes; run CI against their exact heads.
2. Complete Supabase staging acceptance before claiming live auth support.
3. Select a version, update changelog and package metadata, and verify the packed artifact.
4. Publish manually and verify npm version, integrity, and gitHead. A Git tag creates a GitHub Release but does not publish npm.
5. Run post-release smoke against the exact published version, then update the release archive and announcements.

English GitHub/DEV.to drafts and Egyptian Arabic LinkedIn copy are prepared. Recording and publication remain owner actions; no content was published as part of this candidate work.