chore: release main

[github-actions]

🤖 I have created a release beep boop

core: 1.0.0

1.0.0 (2026-07-02)

Features

• accept WebSub-native publish to trigger fan-out (8a81963)
• add realtime log page and improved test infrastructure (0e5ac48)
• core: add @rsscloud/core interface contracts (3d46f8f)
• core: add async-202 accept seam for WebSub subscriptions (169b2d6)
• core: add file-backed Store adapter (2acf6b0)
• core: add REST front door dispatcher (d20905a)
• core: add SSRF egress guard for outbound fetches (0e57cf8)
• core: add xml-rpc rssCloud plugin and dispatcher (7364a71)
• core: expose the change-window size on Stats (2501d74)
• core: implement REST-capable rssCloud engine (51273d2)
• core: parse and validate WebSub hub.* subscribe requests (9435356)
• core: persist the domain model as a versioned v2 file format (f678d2b)
• core: verify WebSub subscriber intent with a challenge GET (8789847)
• distribute feed content to WebSub subscribers on fan-out (9615369)
• honor WebSub lease requests, clamped to configured bounds (7328aef)
• intent-verify WebSub unsubscribe before removal (70b7d65)
• sign WebSub deliveries with X-Hub-Signature (7f3349e)
• wire the WebSub subscribe front door (core dispatcher + express) (c15c0ea)

Bug Fixes

• core: absorb synchronous throws in the verification scheduler (aa46dcb)
• core: bound rssCloud REST notify redirects to prevent loops (c08b174)
• core: bound WebSub delivery redirects to prevent loops (703b2fd)
• core: fail WebSub delivery when the hub URL is unconfigured (ce1c4c7)
• core: match dispatcher wire messages to the rssCloud contract (bc87b3c)
• core: preserve caller abort signal in safeFetch timeout path (2ae15ef)
• core: reject non-URL hub.topic/hub.url with a synchronous 400 (e43a7a4)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @rsscloud/xml-rpc bumped to 1.0.0

express: 1.0.0

1.0.0 (2026-07-02)

Features

• accept WebSub-native publish to trigger fan-out (8a81963)
• add realtime log page and improved test infrastructure (0e5ac48)
• express: add Express middleware for the rssCloud front doors (fb58c5a)
• intent-verify WebSub unsubscribe before removal (70b7d65)
• wire the WebSub subscribe front door (core dispatcher + express) (c15c0ea)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @rsscloud/core bumped to 1.0.0

server: 4.0.0

4.0.0 (2026-07-02)

⚠ BREAKING CHANGES

• server: apps/server no longer exposes the mocha test suite or its devDependencies. Anything that ran 'pnpm --filter @rsscloud/server run test' (none externally) must switch to 'pnpm --filter @rsscloud/e2e run e2e-test' inside the docker container, or 'pnpm test' at the root.
• project restructured as pnpm monorepo

Features

• add realtime log page and improved test infrastructure (0e5ac48)
• convert to pnpm monorepo with server app (a4e3d41)
• distribute feed content to WebSub subscribers on fan-out (9615369)
• honor WebSub lease requests, clamped to configured bounds (7328aef)
• server: mount the WebSub hub front door (6f57343)
• server: screen outbound fetches with the SSRF egress guard (cc81ebe)
• sign WebSub deliveries with X-Hub-Signature (7f3349e)

Bug Fixes

• server: build @rsscloud/xml-rpc in the Docker image (2321097)
• server: normalize WEBSUB_PATH to a leading slash (090db46)
• server: repair broken /viewLog bootstrap script (9466543)
• server: restore /docs and /LICENSE.md routes after monorepo split (8b127de)
• server: scope the SSRF allowlist to topic fetch, keep callbacks strict (71241cb)
• server: stop the stats label hardcoding "7 days" (26e1d50)

Code Refactoring

• server: extract e2e test suite into apps/e2e (7013512)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @rsscloud/core bumped to 1.0.0
    • @rsscloud/express bumped to 1.0.0

xml-rpc: 1.0.0

1.0.0 (2026-07-02)

Features

• add realtime log page and improved test infrastructure (0e5ac48)
• xml-rpc: add the methodCall decoder (deff5a7)
• xml-rpc: add the typed methodCall/response builder (3478428)

---

This PR was generated with Release Please. See documentation.