{"protocol":"clank-doc/1","frameworkVersion":"0.8.0","slug":"changelog","title":"Changelog","description":"Clank follows semantic versioning. Entries describe user visible framework, CLI, protocol, storage, security, and deployment changes.","group":{"id":"project","title":"Project"},"url":"https://docs.clank.run/docs/changelog","source":"CHANGELOG.md","headings":["Unreleased","Added","Fixed","0.8.0 2026 07 26","Added","Changed","Fixed","0.7.0 2026 07 16","Added","Changed"],"tableOfContents":[{"id":"unreleased","title":"Unreleased","level":2},{"id":"added","title":"Added","level":3},{"id":"fixed","title":"Fixed","level":3},{"id":"080-2026-07-26","title":"0.8.0 - 2026-07-26","level":2},{"id":"added-2","title":"Added","level":3},{"id":"changed","title":"Changed","level":3},{"id":"fixed-2","title":"Fixed","level":3},{"id":"070-2026-07-16","title":"0.7.0 - 2026-07-16","level":2},{"id":"added-3","title":"Added","level":3},{"id":"changed-2","title":"Changed","level":3}],"markdown":"# Changelog\n\nClank follows semantic versioning. Entries describe user-visible framework, CLI, protocol, storage, security, and deployment changes.\n\n## Unreleased\n\n### Added\n\n- Successful protected-main CI revisions now automatically build, validate, and deploy `docs.clank.run` through a dedicated GitHub environment and a least-privilege project token.\n\n### Fixed\n\n- Deployment artifact collection now ignores the compiler's atomic temporary files, preventing a concurrent framework build from producing a transient file or `ENOENT` failure in an otherwise deterministic bundle.\n\n## 0.8.0 - 2026-07-26\n\n### Added\n\n- A dependency-free interactive launcher when `clank` runs in a terminal, with guided create, readiness, login, deploy, and help workflows plus authenticated and minimal full-stack templates.\n- A secure managed-platform default for `clank login`, so normal hosted use connects to `https://clank.run` without a `--server` flag while self-hosted platforms retain an explicit override.\n- The framework now publishes from the `@clank.run` npm organization as `@clank.run/framework`, with explicit public-registry, provenance, repository, documentation, and package-export metadata.\n- A fully authenticated deployment dashboard with site status, 1-hour through 30-day ingress charts, releases, logs, and guided custom-domain setup.\n- Transactionally enforced per-organization site and per-project custom-domain limits, with operator-configurable metric retention.\n- Minute-level fixed-histogram ingress metrics plus DNS routing inspection and a Caddy On-Demand TLS permission endpoint for deployed built-in and verified custom hosts.\n- Packaged-release conformance covering scaffold, browser and CLI auth, live synchronization, isolation, deployment, migration, failed health activation, rollback, and data restoration.\n- GitHub CI and OIDC trusted-publishing release workflows.\n- Security reporting, contribution, conduct, ownership, and release-governance documentation.\n- Deterministic AI blueprints with plan, explain, and generated authenticated application files.\n- Email verification, password recovery, email-code MFA, WebAuthn passkeys, organizations, RBAC, invitations, and project-scoped CLI tokens.\n- Typed file, email, job, webhook, observability, encrypted backup, orchestration, ingress, custom-domain, external PostgreSQL, and database-provisioning drivers.\n- ASVS-oriented evidence, threat modeling, chaos tests, CodeQL, immutable GitHub Actions, package/credential auditing, and a public-beta gate.\n- Enforced line, branch, and function coverage floors plus a documentation audit that verifies local links, guide indexing, declaration synchronization, and package export targets.\n- Storage-backed `/healthz` and `/readyz` probes alongside the process-only `/livez` endpoint.\n- Bounded automatic custom-domain routing reconciliation with durable cross-control-plane leases, lookup deadlines, operator configuration, and dashboard status.\n- Automatic verified encrypted database backups with durable cross-control-plane leases, configurable cadence and retention, private failure reporting, and dashboard controls.\n- Enforced per-project release count/byte quotas plus rollback-scoped dashboard and CLI cleanup for inactive runtime artifacts and pre-deploy snapshots.\n- Owner/admin-only permanent site deletion in the dashboard, API, and CLI with exact confirmation, explicit data-loss acknowledgement, scoped-token denial, path-safe storage removal, token revocation, and retained audit evidence.\n- A role-filtered, cursor-paginated workspace activity feed in the dashboard, API, and CLI that retains deleted-site history and upgrades existing audit rows with organization attribution.\n- Workspace people administration in the dashboard and CLI, including browser acceptance, member role changes, immediate removal, safe pending-invitation listing, one-time token copy, replacement, and revocation.\n- Quota-aware workspace creation in the People console with safe slug preview and immediate selection.\n- Durable SQLite-backed deployment-platform authentication and CLI device-start rate limits shared across control-plane runtimes and restarts.\n- Command-aware human and JSON CLI help, agent-readable readiness diagnostics, generated `README.md`/`AGENTS.md` guides, and local-checkout scaffolding that does not require an npm release.\n- Offline deterministic deployment dry-runs, structured deployment results with timing, one-command first-project naming/workspace selection, and retry-safe persisted idempotency attempts.\n\n### Changed\n\n- Authentication now defaults to an eight-character password minimum across framework and platform forms; applications can still require a higher value, and scrypt hashing, bounded concurrency, rate limits, and optional server-only peppering remain in place.\n- The documentation site now begins with the published npm package and generated-app workflow, with hosted login examples consistently using the managed `clank.run` service.\n\n### Fixed\n\n- Deployment-console header controls now center their labels and icons consistently, while account quota totals retain readable spacing at narrow widths.\n- Workspace invitations can now create their email-bound account and accept membership in one browser flow even when public registration is disabled or the one-time bootstrap is complete.\n- First-account bootstrap is now protected by an expiring SQLite claim across control-plane runtimes, preventing concurrent processes from creating multiple initial accounts.\n- Platform signup policy now evaluates the same normalized auth operation as the low-level router, closing repeated-slash registration bypasses.\n- Sign-out and expired-session transitions now reload the deployment console at the identity boundary, clearing prior-account dashboard DOM and recomputing bootstrap availability before another account signs in.\n- Successful password login now clears the exact failed-attempt rate-limit key instead of leaving the account throttled.\n- CLI profile and project-link state is now bounded, structurally validated, URL-canonicalized, privately and atomically replaced, and never reflected in parse errors.\n- CLI control-plane responses are streaming-bounded, decoded as strict UTF-8/JSON, and protected by finite request and deployment timeouts.\n- Platform signal handling now closes both the HTTP listener and control-plane state, reports shutdown failures, and enforces a 30-second termination deadline.\n- Project navigation now resets scroll position and closes the mobile drawer; the detail tab row stays within narrow viewports without a page-level horizontal scrollbar or clipped breadcrumb, and the console explicitly serves no favicon asset.\n- The deployment console no longer renders or requests a logo asset or letter-mark treatment.\n- Backup API responses no longer expose private host database paths.\n- Repeated deployments can no longer grow retained release storage without an installation-defined ceiling.\n- Site quotas can now be reclaimed without operator-side SQLite or filesystem edits.\n- Managed ingress now fixes the upstream origin before applying a request path and streaming-bounds bodies without `Content-Length`, closing scheme-relative SSRF and unbounded-buffer paths.\n- Pending custom-domain assignments can no longer be moved between projects; platform-owned DNS namespaces are reserved.\n- Reissuing an invitation now revokes every older active token for that workspace/email, existing members cannot be reinvited, and active invitations are capped at 100 per workspace.\n- Refreshed dashboard sessions now render one consistent authentication state and return to sign-in when a session expires.\n- Failed distributed-lease acquisition now releases the local project queue.\n- Managed ingress strips `Connection`-nominated headers and retries safe requests after transient upstream 5xx responses.\n- WebAuthn CBOR parsing now bounds collection size and nesting, and passkey counter advancement is atomic.\n- Blueprint suffix parsing and local-file endpoint normalization are linear on adversarial input.\n- Unexpected deployment-platform failures are logged privately and never reflected to HTTP clients.\n- Every HTTP/runtime adapter now keeps unexpected exception text private, and adversarial prefix, identifier, URL, and numeric-literal parsing is linear.\n- CLI device login prints its browser approval URL without launching an operating-system command.\n- The minimum runtime is Node 22.16, the first Node 22 release with the built-in SQLite backup API used by migrations and recovery.\n- The official package name is `@clank.run/framework`, avoiding collision with unrelated unscoped packages while leaving the binaries as `clank` and `clank-platform`.\n- Command-specific `--help` no longer authenticates or executes the command, dry-run deploys no longer require login, asynchronous CLI failures now reliably exit non-zero without stack traces, and unknown long options fail with spelling guidance instead of being ignored.\n- Generated authenticated apps and bundled SSR examples now map the browser's actual `@clank.run/framework` module specifier, allowing their server-rendered screens to hydrate and become interactive.\n- Hydration now cleans partially attached listeners, directives, keyed rows, and component ownership before fallback; only structural mismatches remount, lifecycle/application errors remain visible, and case-sensitive SVG plus `foreignObject` namespaces preserve their server nodes.\n- Local deployment artifacts are now written through a private atomic replacement, preventing a pre-existing output symlink from redirecting CLI writes.\n\n## 0.7.0 - 2026-07-16\n\n### Added\n\n- AI-first runtime schemas, actions, semantic UI, forms, headless UI primitives, SSR, hydration, routing, SQLite backend, authentication, migrations, and the Clank deployment platform.\n- Deterministic deployment artifacts, encrypted platform secrets, device authorization, health-gated activation, logs, audit history, and rollback.\n\n### Changed\n\n- Renamed the complete framework, CLI, storage, protocol, documentation, and deployment UI from Proact to Clank while preserving legacy data through compatibility readers and in-place migration.\n"}