Changelog

Clank follows semantic versioning. Entries describe user-visible framework, CLI, protocol, storage, security, and deployment changes.

#Unreleased

No unreleased changes.

#0.22.1 - 2026-09-07

• Aggregate dashboard metric summaries in one current-period query while preserving chart-summary semantics, and expose bounded platform authentication concurrency and queue settings without changing password-hash strength.
• Allow explicit, bounded runtime capacity settings for live connections and password-hash admission in deployment environments; application options take precedence and existing defaults remain unchanged.

• Preserve live-query dependency tracking after result-cache eviction, so connected clients keep receiving selective updates under cache pressure.

• Keep platform project listing and dashboard queries scoped to indexed ownership and workspace membership as tenant counts grow.

#0.22.0 - 2026-09-07

• Add private bookmarks and folders with safe URLs, favorites, search, conflict-checked editing, and atomic folder removal.
• Add personal activity timelines with trusted event recording, bounded retention, stable pagination, unread filters, and cursor-bounded clearing.
• Add shared feedback boards with explicit membership, unique votes, proposal editing, moderated status, and searchable controls.
• Add personal availability calendars with overlap-safe windows, conflict-checked edits, and bounded slot previews with booking buffers.
• Add saved dashboard layouts with owned defaults, widget visibility/order/width/collapse controls, responsive sizing, and preserved widget instances.
• Add personal labels with colors, bounded resource assignments, conflict-checked editing, and browser controls.
• Add owned ordered checklists with atomic completion, item editing, reordering, reset, and conflict-aware controls.
• Add personal reminders with local-time scheduling, due filters, snooze, completion, and version-fenced editing.
• Add recoverable device-local autosaved drafts with transactional revision checks, expiry, bounded JSON snapshots, and recovery controls.
• Add bounded local undo/redo history with named edits, explicit coalescing, atomic transactions, snapshot recovery, and controls.
• Add searchable command palettes with ranked accent-insensitive matching, keyboard navigation, focus restoration, and cancellable async execution.
• Add configurable keyboard shortcuts with conflict detection, optional local persistence, input-aware dispatch, scopes, and settings controls.
• Add resumable onboarding tours with highlighted targets, async preparation, retry, pause, skip, versioned progress, and cleanup.
• Add spreadsheet-safe CSV exports with explicit column selection, UTF-8 downloads, bounded construction, and cancellable streaming responses.
• Add an account-owned recycle bin with original-ID restoration, expiration sweeps, guarded permanent history deletion, and browser recovery controls.
• Add account-owned record history panels with paginated snapshots, structural comparisons, business-rule validation, and version-fenced restore controls.
• Add shared threaded comments with resource roles, safe edit/delete controls, reply limits, resolution, retry keys, and persistent permission revocation.
• Add account-owned saved views with validated filters, stable sorting, visible columns, optimistic revisions, default selection, and browser management controls.
• Add bounded local full-text search with accent folding, title-aware ranking, prefix completion, highlighted snippets, snapshot restore, and keyboard-accessible search controls.
• Add CSV import with strict bounded parsing, column mapping, typed validation, duplicate handling, preview controls, and idempotent host transaction keys.

#0.21.0 - 2026-09-06

• Add a persistent release error inbox with source-map frame locations, trace links, per-release counts, bounded retention, and recurrence tracking after resolution.
• Add opt-in SSE resume with bounded session/query-scoped JSON splices and full-snapshot fallback after cache misses, authorization changes, or invalid client bases.
• Add encrypted staged secret rotation to the platform and CLI, with bounded validation, conflict-checked activation/rollback, audit metadata, and running-consumer version inspection.
• Add disposable application resilience rehearsals for offline, lost-response, dependency, upload-interruption, and worker-restart faults with required recovery evidence and CLI gating.
• Add conservative API/MCP compatibility reports and a CI workbench gate for action removal, input/output schema changes, authentication, agent exposure, and required scopes.
• Add fixed-height virtualized lists and grids with keyed row retention, scroll anchoring, keyboard navigation, accessible positions, and explicit cleanup.
• Add a durable authenticated webhook outbox with signed deliveries, bounded attempt history, owner-scoped inspection, controlled replay, and per-attempt signing-key resolution.
• Add complete application-load budgets from cold-navigation HAR captures, with resource deltas, transitive asset accounting, and failing CI checks for incomplete evidence.
• Add opt-in SQLite query plans, bounded execution summaries, repeated-query and slow-query advice, and reviewable index candidates in local DevTools.

#0.20.0 - 2026-09-06

• Enforce deterministic reactive-work and browser-module size budgets in CI, with timing diagnostics.
• Compare consecutive deployment activations using matched traffic windows, request latency, error rates, and activation duration, with explicit low-traffic and collection states.
• Add loopback-only DevTools for reactive dependency activity, computation lifetime, and opt-in backend query/cache diagnostics.
• Carry request trace context through backend operations, durable jobs, retries, and workflow steps; inspect bounded, metadata-only request/job timelines.
• Build validated synthetic fixture databases and seed isolated preview environments through the CLI and platform, preserving parent application data and recovery safety.
• Rehearse encrypted-backup recovery and database migrations on disposable copies, including application health checks, timing, table changes, and cleanup.
• Persist bounded agent tool activity with granted scopes, outcomes, timing, observed revisions, filters, and a local explorer.
• Queue browser mutations durably with account-bound transactional replay receipts, pending/retry states, expiry checks, and explicit conflict reconciliation.
• Add persistent user-owned notifications, read state, category preferences, accessible browser controls, and optional durable email delivery with stable provider idempotency keys.
• Ship approval-queue, customer-portal, and booking application recipes with authenticated UI/MCP contracts, ownership and transition rules, fixtures, migrations, and deployment configuration.
• Run generated-application contracts in independent Node test contexts and build composed applications before their tests, closing a verification gap in the CLI harness.

#0.19.6 - 2026-09-06

• Coalesce shared reactive dependency invalidation before effects run, eliminating duplicate executions and partially updated computed values from a single signal write.
• Dispose server-rendered component scopes after asynchronous output settles, releasing subscriptions and cleanup callbacks on success and failure.
• Revalidate unchanged static GET/HEAD responses with weak ETags and bodyless 304 responses, avoiding repeated file streams and asset transfers.
• Release unused HEAD response bodies and response readers after backpressured or early client disconnects, while preserving responses to rejected request bodies.
• Load managed-ingress custom domains in one query per routing snapshot and skip provider fleet reads on local-only installations, preserving immediate routing and fencing updates.
• Correct deployment-token setup guidance for workflows that prune inactive releases before publishing.

#0.19.5 - 2026-08-18

• Fixed recurring MCP OAuth disconnects for clients with replicated credential storage. Adaptive refresh rotation now follows a bounded, encrypted predecessor chain so a lagging replica can converge on the one current successor without branching token authority or revoking a newer replica. Missing or overlong adaptive handoffs fail without collateral grant revocation; strict mode retains replay-driven family revocation for security-sensitive applications.

#0.19.4 - 2026-08-18

• Added adaptive OAuth refresh recovery for MCP clients that fail to persist a rotated successor. Clank now renews the access token through the encrypted, single-successor handoff while that successor remains unspent, preventing recurring hourly disconnects without branching refresh families or extending their expiry. Successor adoption restores immediate predecessor-replay revocation, and security-sensitive applications can opt into strict post-window rotation.

#0.19.3 - 2026-08-12

• Corrected delayed OAuth refresh retry responses to report the recovered access token's remaining lifetime rather than its original lifetime, preventing clients from caching it past server expiry.

#0.19.2 - 2026-08-12

• Made OAuth refresh rotation resilient to MCP clients with concurrent or delayed credential persistence. Retries of the immediately previous refresh token now recover the exact same successor pair for a bounded 15-minute window from an AES-GCM envelope whose key is not stored; older replays and replays after the successor advances still revoke the complete token family.

#0.19.1 - 2026-08-11

• Preserved MCP Apps _meta.ui.resourceUri metadata on model-visible tools even when stateless clients omit the per-request UI capability hint. Codex and other MCP hosts can now associate an already-published ui:// resource with its tool result instead of treating the resource as a separately read attachment; app-only tools remain hidden and uncallable until UI support is negotiated.

#0.19.0 - 2026-08-10

• Added first-class support for the stable MCP Apps 2026-01-26 extension. Backend queries and mutations can bind immutable ui:// HTML resources through defineMcpApp() and one agent.app declaration; negotiated clients receive exact text/html;profile=mcp-app resources, UI tool metadata, visibility, CSP, permission, domain, and border preferences. Application HTML and tool bindings participate in the deterministic MCP revision so UI resources cannot silently drift behind their server actions.
• Added the dependency-free @clank.run/framework/mcp-app browser runtime and document builder for host initialization, tool calls, resource reads, links, downloads, messages, model context, display modes, size changes, lifecycle events, and safe theme-token projection. The complete guide, low-level example, discovery metadata, type inference coverage, MCPJam Apps conformance, and packed-release conformance make the feature usable by humans and coding agents immediately.
• Hardened MCP App declarations with strict object fields, bounded complete HTML documents, secure CSP origin validation, explicit empty permission grants, trusted-parent message handling, request timeouts, and a clear separation between UI visibility and authorization scope enforcement.

#0.18.4 - 2026-08-10

• Normalized generated and custom MCP tool names to the strict cross-provider identifier contract: ASCII letters, numbers, and underscores with a 64-character ceiling. Dotted or hyphenated action paths such as dailyLog.getDay now publish as dailyLog_getDay; overlong or normalization- colliding names receive stable digest suffixes. Tool metadata retains the exact original Clank action path, invocation routes through the portable name, and the changed contract revision makes connected clients refresh stale catalogs automatically.

#0.18.3 - 2026-08-10

• Fixed hosted MCP sign-in behind proxies that normalize or remove browser Fetch Metadata. The OAuth login page now issues a five-minute, one-time proof bound to both the exact authorization return path and a private browser cookie. Cross-origin form login requires and atomically consumes that proof, so MCPJam, Augment, and other sandboxed hosted clients work without trusting fragile Sec-Fetch-* headers or weakening ordinary origin, JSON, redirect, expiry, and replay protections.

#0.18.2 - 2026-08-10

• Fixed hosted MCP authorization for sandbox-inherited browser popups. OAuth now performs one same-site session recheck to recover legacy Strict cookies, authenticated session checks reissue cookies under the current policy, and password login narrowly accepts a user-activated opaque same-origin top-level form navigation. Cross-site, iframe, scripted, JSON, and unbounded-return requests remain rejected.

#0.18.1 - 2026-08-10

• Fixed remote browser MCP authorization by making application sessions available to secure cross-site top-level OAuth navigations and adding narrowly scoped, credential-free CORS support for MCP preflight, dynamic client registration, and token requests. Protected MCP endpoints still require resource-bound bearer tokens, password submission remains same-origin only, and public MCP servers remain cross-origin restricted unless explicitly enabled.

#0.18.0 - 2026-08-09

• Upgraded every generated application MCP endpoint to the stateless 2026-07-28 protocol while retaining dual-era compatibility through 2025-11-25. Modern requests now implement required server/discover, per-request protocol/client metadata, result types and server identity, zero-TTL private discovery, and strict Mcp-Method, Mcp-Name, and schema-declared Mcp-Param-* header/body validation. They mint no process-local session state and remain valid across cold starts, replicas, and rolling deployments.
• Hardened application OAuth for the current MCP authorization profile with RFC 9207 issuer parameters on successful and error redirects, advertised issuer-response support, and explicit native/web dynamic-client classification. Existing PKCE, exact redirect, resource-bound token, rotating refresh-token, protected-resource metadata, and legacy registration behavior remain compatible.

#0.17.0 - 2026-08-03

• Added first-class managed application buckets through @clank.run/framework/buckets and blueprint buckets. The dependency-free runtime composes with local or S3-compatible object storage and provides transactional project/per-owner quotas, isolated metadata listing, immutable generation replacement, signed private/public delivery, CSRF-gated browser uploads, offset-checked resumable chunks, content and SHA-256 verification, raster signature/dimension policy, declared provider-pluggable image variants, and automatic owner-scoped MCP tools.
• Generated applications now receive zero-setup local bucket storage and production environment composition. The control plane injects a per-project root, stable derived signing key, logical namespace, public origin, and administrator-overridable bucket byte/object ceilings for local and provider placement. Bucket policies participate in backend manifests, MCP contract revisions, discovery, account/workspace limit administration, local project cleanup, and complete human/agent documentation.

#0.16.0 - 2026-08-02

• Added the opt-in, dependency-free Task<Success, Failure, Requirements> runtime. Typed expected failures remain distinct from defects and interruption; nominal services and memoized layers expose requirements; scopes guarantee reverse-order release; reusable schedules provide bounded retry; fibers, races, and concurrency-limited task groups use structured cancellation; Clank tracing plugs in directly; and an injectable deterministic clock covers sleep, retry, race, and timeout tests. Existing promise-based framework APIs remain unchanged.
• Added the focused @clank.run/framework/task package export, complete declarations, behavioral and failure-path coverage, compact API reference, and an agent-friendly guide explaining when to choose Task, promises, durable jobs, workflows, or durable objects.

#0.15.0 - 2026-08-01

• Added a unified dependency-free governance contract for users, agents, services, hosted entitlement layers, short-lived action/resource-bound HMAC approvals, and deterministic typed feature flags. The control plane now resolves default, billing, workspace, and operator limits through the same typed entitlement layering primitive, and its SSR design consumes the shared Clank theme tokens used by Design Studio.
• Added release and data lifecycle contracts for canonical provenance, promotion evidence, progressive canary guardrails, causal revision inspection and time travel, deterministic sanitized clones, checksummed portable project exports, and transparent capacity estimates. Deployment bundles now bind source revision, configuration, migration IDs, and every packaged material digest and verify those bindings at each decoding trust boundary.
• Added public App Studio/tooling APIs and clank workbench commands for policy/flag evaluation, revision replay, production parity, classified schema migration plans, capacity simulation, upgrades, provenance and promotions, exports and safe clones, action-contract tests, visual regression, and provider conformance. The provider acceptance kit verifies frozen credential-free requests, idempotency, abortable deadlines, and—with an explicit disposable project opt-in—advertised destructive capabilities.
• Added three user- and agent-oriented guides for governance, the revision/release lifecycle, and App Studio/workbench workflows, plus package exports at /governance, /lifecycle, and /tooling.

#0.14.0 - 2026-08-01

• Added first-party typed durable objects over each application's isolated SQLite database. Stable namespace/ID stubs serialize calls locally and across processes with renewable leases and stale revision fencing; validated state commits only after successful handlers. The runtime includes bounded mutation idempotency, tombstone/reinitialization semantics, sequential state migrations, one durable alarm per object with retry diagnostics, cross-process revision subscriptions, aggregate diagnostics, immutable manifests, and opt-in MCP tools with mandatory exact-object authorization. The public /durable-objects export remains dependency-free and follows Clank's statefully pinned durable-volume placement boundary.
• Hardened durable-object storage against retry and capacity abuse. Idempotency expiry is exact even after idle periods, reinitialization cannot replay a prior incarnation's result, cleanup is namespace-scoped and cannot turn a committed mutation into an error, tombstones remain under a fail-closed per-namespace identity ceiling, per-object retry records have a hard ceiling, and persisted alarm diagnostics are control-character-free and UTF-8 byte bounded.

• Added a dependency-free theming layer for the headless UI library. Ten immutable presets span light and dark color systems, square through pill geometry, compact through relaxed density, typography, depth, focus, danger, and motion tokens. Typed custom themes are validated before producing deterministic CSS variables; portal-safe DOM application includes reversible cleanup; and the /ui/theme export makes the same contract available to applications and agents. The new server-rendered Design Studio at design.clank.run exercises every one of the 37 real controllers, provides responsive and anatomy inspection, serves structured JSON and a public read-only MCP catalog, and deploys as an ordinary first-party Clank project. Its SSR coverage also corrected the Scroll Area's legacy Microsoft overflow style to use the renderer-safe DOM property spelling. Project and preview creation now also reserve the live rolling-release and startup ports, so a newly allocated site cannot collide with an application that remains active on a rollout port. Design Studio navigation now keys component content to the selected catalog entry, and keyed For rendering now fulfills its typed array-accessor contract during mount and hydration.

• Added a complete dependency-free headless UI library aligned to the 37-family Base UI 1.6 catalog. Clank-native controllers expose canonical part anatomy, controlled and uncontrolled state with cancelable reasons, keyboard/focus and RTL behavior, native form projection and validation, document-scoped overlays, same-document portals, collision-aware floating parts, transition-aware presence, drawer snap points and swipe physics, SSR-stable IDs and hydration, Tailwind-ready data/CSS hooks, and frozen redaction-aware clank-ui/1 agent manifests. The package root, /ui, group modules, and every /ui/<family> subpath expose the library without adding React, Base UI, Floating UI, CSS-in-JS, or any other runtime dependency.

• Added a dependency-free signed blueprint registry protocol and clank registry CLI. Scoped Ed25519 publisher keys bind normalized data-only blueprints to exact semantic versions; separate registry keys bind monotonic catalogs to exact HTTPS origins, release digests, publisher keys, and traversal-safe relative paths. Explicit trust policies support roles, namespace/origin scopes, key/release revocation, and minimum catalog sequences. Remote install refuses redirects, mutable tags, cross-origin paths, wrong media types, oversized/slow responses, forged verified wrappers, remote generators, and install hooks before using the ordinary deterministic plan.

• Added typed, privacy-first product analytics in each application's isolated SQLite database. Finite event contracts accept only aggregate-safe properties, publish an immutable agent-readable manifest, and support bounded time-series, dimension, measure, and ordered-funnel queries. Every write requires consent, honors do-not-track, HMAC-pseudonymizes identity and retry keys, enforces deterministic sampling, retention, scan limits, idempotency, and an atomic storage ceiling; raw events and small cohorts are never exposed. A typed memory-only browser queue discards pending data when consent is withdrawn.

• Added dependency-free realtime collaboration primitives for presence, cursors, selections, typing state, and ephemeral signals. The Fetch + SSE hub re-authorizes exact room access on every request, requires the application's CSRF check for writes, enforces same-origin and bounded capacity/rate/data/idle leases, exposes identity-free diagnostics, and publishes immutable snapshots with room revisions. A Clank auth adapter and reconnecting reactive browser client make setup small while keeping persistent backend mutations and MCP actions authoritative.

• Added dependency-free semantic browser journeys with data-only definitions, stable agent/native control IDs, real isolated Chrome execution, same-origin and timeout boundaries, mobile viewport support, hydration/live-update waits, page-exception failure, value-redacted reports, atomic failure screenshots, and agent-readable CLI output. Environment-backed secret references enable login flows without putting passwords in journey files or reports; generated blueprint apps now include a mobile smoke journey and agent maintenance guidance. The npm README now links to the canonical hosted guides instead of duplicating the complete Markdown documentation corpus in every installation; full source documentation remains versioned in the repository and docs site, restoring durable headroom under the fixed 5 MiB unpacked package ceiling.

• Added typed durable workflow graphs over ordinary jobs. Explicit acyclic dependencies support parallel roots and typed result handoff; mutation starts atomically persist runs and ready jobs; owner-scoped idempotency, retries, cancellation propagation, structural release revisions, bounded run/step/event history, restart reconciliation, worker integration, preview-data purge, and revisioned MCP/backend graph manifests keep orchestration safe without another process or package.

• Added bounded, immutable per-document revision history and conflict-safe compensating restore. Typed queries inherit owned-table isolation; deletes retain recoverable snapshots; restores validate the current schema, require an observed version or deletion state, and append a new version without rewinding live revisions. Blueprint admin studios now server-render responsive timelines and expose role-checked history/restore browser and MCP actions that refresh after every mutation. Browser verification also corrected generated validators so nullable fields keep their default-aware wrappers. Sanitized preview branches always purge historical snapshots. Compiled JavaScript duplicates under examples/ remain in the repository and docs workflow but are omitted from the npm tarball; the TypeScript examples stay published, preserving the fixed 5 MiB package ceiling.

• Added opt-in sanitized preview database branches for local and provider placement. Policies are frozen in the active production release, table/row bounded, deterministic and per-preview keyed; auth/OAuth/jobs and unlisted data are purged, staging files are vacuumed and overwritten, target migrations and health gates run normally, failures preserve the prior preview, raw production copies and secrets remain unavailable, and CLI/UI/audit surfaces expose only aggregate reports. The internal code-audit and public-beta readiness ledgers stay in the repository and docs site but are omitted from the npm tarball to preserve the existing 5 MiB package ceiling without removing user documentation.
• AI blueprints now generate an optional, server-rendered admin studio with inferred or explicit privileged roles, an entity allowlist, read-only mode, schema and visibility summaries, responsive live data controls, and generated SSR/UI-to-MCP parity tests. Route access, backend action roles, record ownership, validation, and optimistic concurrency remain authoritative; the studio introduces no database bypass.
• Added an application-local, server-rendered agent access inbox and a no-store clank-agent-grants/1 API. Users can inspect, reduce to read-only, or revoke their own MCP OAuth token families with immediate per-request enforcement, CSRF protection, cross-user isolation, bounded listings, configurable per-user admission limits, and discovery metadata. The internal project maintenance ledger is no longer included in the npm tarball, preserving the existing 5 MiB unpacked distribution ceiling without removing user or operator documentation.
• Added clank compose, a provider-neutral conversational build loop with data-only blueprint proposals, bounded external-agent stdin/stdout protocols, sanitized process context, private resumable reviews, exact SHA-256 plan approvals, stale-baseline rejection, transactional writes, rollback on unsafe paths, agent-readable JSON results, and an interactive launcher path.

#0.13.0 - 2026-07-30

• Fixed the operator memory dashboard to render control-plane process attribution from the diagnostics API's controlPlane field instead of confusing it with control-database storage.
• Hardened the release gate against Node's occasional truncated experimental coverage artifact: it retries that exact all-tests-passed reporter failure once while continuing to fail immediately for test failures, threshold misses, and every other nonzero exit.
• Added a server-rendered, live-refreshed operator status for the local application trust boundary, runner kind, and signup mode, including a critical warning for public signup on trusted local execution.
• Added generation-bound provider filesystem-capacity telemetry with a path-free versioned protocol, version 1 rolling-upgrade compatibility, strict aggregate validation, and responsive platform-administrator dashboard reporting with tenant/token redaction.
• Added explicit platform-administrator provider failover from a revoked source runner to a healthy compatible target. Recovery requires recent browser authentication, CSRF, exact typed confirmation, separate source-fencing and recovery-point-loss acknowledgements, and a verified encrypted backup; it unpublishes old ingress, allocates a higher generation, preserves placement requirements and process-slot demand, rechecks source revocation before target publication, and records queue and activation audit events. Heartbeat loss alone never triggers stateful movement.

#0.12.0 - 2026-07-30

• Added optional hosted plan catalogs with exact public prices, account entitlement snapshots, browser checkout and portal flows, a server-rendered responsive Billing view, read-only clank billing output, and audited operator plan grants. Billing remains disabled by default and catalog-only installations require no payment service.
• Added a zero-dependency Stripe adapter with fixed-origin bounded requests, durable idempotent checkout attempts, raw-body HMAC webhook verification, live/test separation, exact plan/Price mapping and pre-checkout amount/currency/interval verification, replay/conflict detection, out-of-order event handling, provider-bound customer and subscription identities, and optional operator-tested API-version pinning.
• Plan entitlements now layer between installation defaults and explicit account/workspace overrides. Trialing and active subscriptions apply immediately, past-due plans receive a bounded grace interval, invalid or inactive state fails closed to the free plan, and a downgrade never deletes existing resources.

#0.11.0 - 2026-07-30

• Added secretless GitHub pull-request previews. clank preview github configure binds an immutable repository ID, generates commit-SHA-pinned deploy and trusted-base cleanup workflows, and exchanges GitHub Actions OIDC for a one-time, 15-minute token scoped to exactly one pull-N preview.
• GitHub preview federation verifies the fixed issuer/JWKS, RS256 signature, audience, repository name and ID, workflow path/SHA, event, ref, time window, and replay-resistant JWT ID. It is refused without HTTPS and provider/container isolation; production and sibling projects remain inaccessible, cleanup revokes every temporary preview token, and no raw identity or credential is persisted or audited.
• Provider-hosted projects now expose the same bounded job status/list/cancel/retry API and CLI as local projects through a private clank-provider-jobs/1 control contract. The transport binds exact node/release/generation identity, validates all query/body/response bounds and schemas, rechecks placement after transfer, and never returns job payloads, results, error text, identities, leases, paths, or credentials.
• Runner placement now reserves durable process slots instead of counting projects: one web slot plus every configured worker and scheduler. Selection and portable reassignment are transactional, insufficient capacity waits safely, heartbeat/re-enrollment cannot shrink below assigned demand, and the operator fleet shows used and free slots. Stateful provider SQLite remains pinned and fails closed rather than moving implicitly.
• Added durable invitation email delivery for workspace and personal onboarding with an encrypted transactional outbox, cross-control-plane leases, bounded retries, stable idempotency, stale-lease recovery, revocation fencing, visible delivery state, and log-safe fragment links.
• Added zero-dependency Resend delivery plus a provider-neutral HTTPS gateway configuration; manual copy-once invitation tokens remain the explicit fallback.
• Added automatic invite-link prefill for both new and existing accounts, CLI delivery status, and complete operator/security documentation.
• Server-backed controls can now pass typed backend function references directly to agentAction. New bounded inspection and parity APIs compare SSR or DOM controls with the no-store backend manifest and MCP contract revision, rejecting stale, internal, undocumented, unstable, or missing required UI actions. Blueprint-generated apps and the authenticated starter enforce the UI↔MCP contract from npm test.
• AI blueprints now own bounded clank-fixture/1 synthetic states and generated Node contract tests. Fixtures validate users, roles, values, references, creation order, and private ownership; generated suites exercise the real backend, exact agent manifest, isolated visibility, and every SSR route without shipping test data in deployment artifacts. Built-in authenticated and minimal starters also include discoverable npm test contracts.
• Added an integrated clank dev supervisor that runs the deployment-configured build and entry, watches relevant project files, health-checks replacements on private loopback ports, atomically swaps the local proxy, reloads connected browsers, preserves the last good process after build or candidate failures, bounds crash restarts and reload clients, and emits agent-readable clank-dev-event/1 lifecycle records.
• Removed the browser package barrel's eager node:fs/promises import so generated module applications execute hydration instead of stalling while resolving a Node-only module.
• AI blueprints now generate every declared static route and entity instead of collapsing the contract to one primary table. Generated apps include SSR/hydration state per route, role-aware navigation and field forms, reference selectors, live subscriptions or request/response refresh, exact declared action names, sparse updates, and safe CRUD fallbacks shared by browser RPC and each app's OAuth-scoped MCP server.
• Blueprint relationships now resolve an explicit or unambiguous reference field and enforce bounded transactional restrict, nullify, and acyclic recursive cascade behavior. Invalid or other-owner reference inputs return a public bounded error; ambiguous relationship storage, cross-ownership deletion, non-nullable nullification, cascade cycles, empty role policies, reserved routes, and generated type-name collisions fail before generation.
• Generated service requirements now participate in startup and readiness. clank dev supplies explicit development-only placeholders, while production fails closed when a required driver has not been provisioned.
• Added bounded BackendActionError failures for intentional application guards. Their safe status/code/message survive browser RPC and MCP tool calls without reporting them as internal faults, while the surrounding mutation still rolls back atomically.
• Reworked the AI blueprint guide and generated project/agent READMEs to document exact action, relationship, route, service, authorization, and per-app MCP behavior plus unresolved boundaries.
• Select bindings now attach after their options, so programmatic resets preserve declared defaults and empty reference placeholders. Generated development servers also serve framework modules with revalidation instead of production's immutable cache policy.
• Generated route navigation now wraps on narrow viewports instead of clipping the active route. Shutdown closes live runtime streams alongside the HTTP server and service drivers so long-lived connections cannot stall process termination.
• Blueprint code generation now applies JavaScript-source escaping after JSON serialization, including HTML delimiters and Unicode line separators, so even hostile human-authored text cannot form executable source or closing-script sequences.

#0.10.0 - 2026-07-30

#Added

• clank templates --json now exposes the versioned clank-template-catalog/1 starter catalog, and clank create --json returns a clank-create-result/1 project/file/next-command manifest. Scaffold names are now length/control bounded and inserted into TypeScript, TSX, and Markdown with context-safe encoding instead of raw placeholder replacement.
• Provider-hosted runtimes now expose a generation-bound private diagnostics surface. The complete provider keeps a 128 KiB/1,000-entry in-memory output tail, samples all current web/worker/scheduler containers through one bounded Docker stats call, and reports memory, memory limits, CPU, PIDs, network I/O, and block I/O without container IDs or environment values. The control plane authenticates the exact node/release/generation, refuses redirects or unbounded/malformed responses, rechecks placement after transfer, redacts project secrets, and shows provider resources and logs in the existing project UI.
• Provider-hosted recovery points can now be restored through the ordinary platform and CLI API. The control plane verifies the target, creates an encrypted provider safety backup, freezes the target ID/digest/size and safety ID into a durable replacement generation, and re-verifies the recovery point while building the private runtime capsule. The provider then drains the prior writer, takes its own exact safety snapshot, replaces SQLite, reapplies current migrations, health-checks the candidate, and publishes only the new generation.
• Provider restore timeouts resume the same durable intent without creating another safety copy. Failed exact operations can allocate a new monotonically fenced attempt only after both target and safety recovery points verify again. Pending retention protects both recovery points, queue and completion are audited, and successful completion keeps the ordinary immediate data rollback available.
• The built-in control plane now creates, schedules, lists, and verifies encrypted backups for provider-hosted projects. It binds export to the exact active pinned node/release/generation and allowlisted origin, refuses redirects and encoded/unbounded/mismatched responses, rechecks placement after transfer, and imports directly into local or S3-compatible encrypted recovery without plaintext disk staging.
• Brand-new provider projects now initialize their isolated SQLite database instead of incorrectly requesting preservation of data that cannot exist. Later and retry generations preserve the committed provider database.
• Runtime capsules can carry a distinct provider-control credential, and the complete provider service now exposes a private, generation-bound consistent SQLite snapshot endpoint. The credential is retained only as an in-memory digest, never shares public-ingress authority, and is revoked on drain, stop, failure, deletion, close, or restart until exact reconciliation.
• Encrypted recovery repositories can now import a bounded consistent SQLite byte snapshot without a local live-database path or plaintext staging file. Authenticated bounded reads make the same recovery point available to a fenced remote restore capsule, including through chunked S3-compatible object storage.
• The built-in control plane can now opt immutable projects and inherited previews into stateful provider placement. It freezes encrypted generation inputs, emits sensitive capsules only to a current lease, publishes only exact allowlisted observations, resumes pending deploys, supports fenced code/data rollback, survives restart, and confirms provider deletion before removing metadata. Local placement remains the default and existing projects never move.
• The CLI and control-plane project dialog expose explicit local | provider creation. Persisted deploy-attempt keys now survive provider-pending responses so an exact retry cannot create a duplicate release.
• A packaged clank-provider process runs the complete Docker provider lifecycle bridge and generation-bound private runtime ingress with environment-only resource and trust-boundary configuration.
• Deployment desired state now distinguishes portable from stateful placement. Stateful projects reserve one node identity across releases, stopped state, expiry, and credential revocation; unsafe implicit failover, mode changes, and pinned-region changes are rejected.
• Desired placement can durably require a private node endpoint and exact capability labels. Delayed placement keeps those constraints, and assigned nodes cannot shed required capabilities through heartbeat or credential rotation.
• A complete zero-dependency @clank.run/framework/provider-service composition now binds independently verified runtime capsules, durable operation/generation/fence intent, provider data recovery and migrations, isolated Docker activation, stopped desired state, and generation-bound private ingress. Exact response-lost and restart retries recover without process adoption; failed post-commit activation removes the candidate and remains retryable.
• The complete provider service now owns fenced rollback and confirmed project deletion instead of requiring callers to reach beneath a live runtime boundary. Both operations revoke traffic, drain requests, stop every writer, persist restart-safe destructive intent, and resume safely when a process exits after the data commit point.
• Provider agents and the authenticated HTTP bridge now carry canonical rollback and delete operations to those lifecycle methods. Confirmations are derived after lease validation, request bodies are forbidden, coordinator credentials never cross the provider boundary, and existing operation tables migrate in place without losing history or fence high-water marks.
• Docker runtime launch can defer workers and the scheduler until activate() runs after provider data commits. Provider data validation has a cleanup hook that must quiesce an exposed candidate before uncommitted SQLite rollback and leaves recovery journaled when cleanup is uncertain.
• Docker cleanup now re-enumerates exact owner/project/release/generation labels before forgetting a runtime, including when docker create persisted a container but reported failure.
• A zero-dependency @clank.run/framework/provider-docker reference launcher now starts the exact verified web, worker, and scheduler topology inside resource-bounded Docker containers, checks private health over loopback, and exposes only non-secret candidate metadata. Immutable images, non-root execution, read-only releases/root filesystems, project-only data mounts, bounded logs, owner-scoped orphan cleanup, generation fencing, graceful stop, close-race fencing, and restart reconciliation are enforced.
• Provider-prepared runtime data now carries the exact normalized config decoded from the verified capsule, so launchers cannot accidentally substitute another entry, database path, or job topology.
• A provider-private @clank.run/framework/provider-runtime registry now publishes overlapping application generations, validates the complete managed-ingress binding before dispatch, retains only a route-token digest, proxies only to loopback origins, and revokes then drains exact generations. URL/body/time/capacity bounds, reserved-header stripping, generic unavailable failures, response streaming, pre-auth activation-race leases, close fencing, retry-safe deactivation, and timed-out-drain retention are covered end to end.
• Managed ingress can now bind an allowlisted remote provider origin to an exact clank-runtime/1 generation and provider-local path. It overwrites reserved project/protocol/generation/ingress-token headers, binds health checks identically, keeps the secret out of public failures and metrics, rejects encoded path traversal, and fences circuit state from both generation changes and late replaced-generation responses.
• A zero-dependency provider data lifecycle now consumes independently verified clank-runtime/1 capsules, stages immutable releases, initializes/preserves/replaces project-isolated SQLite, applies immutable migrations, exports consistent snapshots, retains one rollback generation, and requires exact confirmations for rollback and deletion. Durable apply/rollback journals recover crashes around the atomic metadata commit point, while generation/fence high-water marks reject stale work.
• A versioned clank-runtime/1 binary capsule now binds one desired project generation to its verified release, final process environment, SQLite initialization/preservation/replacement intent, optional integrity-checked snapshot, and managed-ingress identity. The codec has strict section/aggregate limits and is exported as @clank.run/framework/runtime-placement.
• Current operation leases can fetch an exact no-store runtime capsule through the coordinator, and provider agents plus the authenticated HTTP provider bridge independently verify and bind it before infrastructure code runs. clank-runner exposes separate runtime transfer deadline and byte-ceiling settings.
• The remote deployment coordinator now supports administrator-created one-time enrollment tokens bound to an exact node and region. The responsive control-plane fleet panel reports node health, capacity, placement, work, and pending enrollment metadata and provides audited drain, reactivate, enrollment-revoke, and credential-revoke controls.
• clank-runner --check [--json] validates local configuration without consuming a fresh enrollment and authenticates an existing saved node credential when present. The packaged platform has an explicit CLANK_RUNNER_COORDINATOR=1 switch while preserving the closed, zero-cost single-host default and legacy shared enrollment compatibility.
• Production clank-platform starts in an explicit isolated hosting profile by default and selects the constrained Docker runner unless the operator deliberately chooses the low-cost trusted profile. Programmatic platform runtimes expose their resolved hosting profile and runner kind for diagnostics.
• Durable deployment coordination now has an optional, versioned HTTP transport and bounded client for remote nodes. A separate enrollment secret provisions hashed node credentials; authenticated nodes can heartbeat, drain, claim, renew, complete, fail, and report generation-fenced observations without access to the control database.
• A provider-neutral remote deployment-agent loop now handles credential-only restart and deliberate re-enrollment, heartbeats, bounded claims/concurrency, automatic operation renewal, fenced observations and settlement, redacted failures, graceful drain, and abortable shutdown. Persistent node credentials use a serialized, atomic, owner-only validated file store; a running node stops safely when credential rotation revokes its session.
• Current operation leases can fetch their exact content-addressed release through a bounded binary coordinator call. The platform optionally retains owner-only original uploads when remote enrollment is enabled, accounts for that storage, and verifies identity, node scope, lease fence, length, media type, and SHA-256 across the complete transfer.
• A provider-neutral ObjectStore now includes atomic owner-only local envelopes and a zero-dependency S3-compatible adapter. The S3 subset signs exact single-chunk payloads with SigV4, supports virtual-hosted and path-style endpoints plus temporary credentials, bounds retries, deadlines, and error bodies, and rehashes every downloaded object.
• Remote deployment enrollment can retain original release uploads in a configured ObjectStore instead of the control-plane volume. Each release persists its repository namespace and exact content-addressed key; leased reads, release cleanup, project deletion, legacy local releases, quota accounting, and provider failures are verified end to end.
• Encrypted SQLite recovery points can use a local or S3-compatible object repository. Remote backups use an authenticated per-database catalog and bounded immutable chunks, promote legacy local copies, retain a usable local copy after upload failure, verify the complete remote copy, apply retention across both locations, survive restarts, and are erased with platform-managed project storage.
• Deployed projects now have a responsive Jobs console plus clank jobs status|list|cancel|retry. The bounded API reports queue health, overdue work, expired leases, dead letters, and cron schedule state; cancellation/retry use conditional live-database transitions and durable audit events.
• Remote infrastructure integrations now have a credential-free DeploymentProvider contract, canonical desired-state validation, independent artifact verification, fenced observation, and the openProviderDeploymentAgent lifecycle wrapper.
• A zero-dependency authenticated HTTP provider bridge carries the original bounded binary release through a redirect-safe, retry-safe protocol, and the packaged clank-runner command connects that bridge to a remote control plane with persistent node credentials and graceful drain.
• Projects now support isolated, expiring preview environments through the control-plane UI/API and clank preview deploy|list|remove. Reusing a preview name refreshes its TTL and publishes a normal atomic release without changing the production project link.
• Generated templates and blueprint apps now compile minified Tailwind CSS during the ordinary Clank build, serve a same-origin static stylesheet, and omit the development-only browser CDN. clank build --tailwind=<source> can use the local CLI module or an explicitly configured standalone executable.
• Workspaces now have a durable clank-usage/1 monthly ledger, responsive server-rendered Usage console, and clank usage [--org] [--month] [--json]. It reports admitted requests, request bodies, declared response bytes, traffic-limit rejections, retained deleted-project totals, and current resource inventory without inventing streamed-byte or pricing data.
• Managed ingress now enforces inherited workspace UTC-month request/known-transfer limits and a per-project UTC-minute request ceiling in one SQLite admission transaction. New installation, account, and workspace limits appear in the existing operator editor; retention is bounded and pruned at startup and during traffic.

#Fixed

• Deployment operation fences are now allocated from a durable per-project sequence instead of restarting at one for each operation. Successive releases, concurrent claims, expired-lease reclamation, and process restarts therefore preserve the provider's stale-writer ordering contract; project deletion removes the matching sequence.
• Object-backed project backups now map URL-safe project IDs that begin with - or _ to a stable portable repository identity, instead of intermittently rejecting valid generated projects.
• Docker application environment is now delivered through one inert, name-only encoded envelope that the in-container Node bootstrap deletes before importing application code. Application variables such as DOCKER_HOST, LD_PRELOAD, proxy settings, and TLS settings can no longer control the host-side Docker client or executable, and secret values remain absent from process arguments.
• The first-account bootstrap response now waits for winner retention before reconciling the configured platform-administrator allowlist, so a new operator receives administrator access immediately instead of only after the control plane restarts.
• Revoked or expired runner placement is reconsidered transactionally, expired operation leases become retryable on the current assigned node with a higher fence, and running desired state without capacity remains durable until an eligible node appears.
• Draining deployment nodes can no longer claim queued operations. Lost/expired leases and shutdown deadlines abandon work without stale settlement, while a missing completion response no longer converts a possibly committed success into an explicit failure and duplicate retry.

#Security

• Provider-service metadata stores only exact non-secret desired-state bindings in bounded, owner-only, no-follow, atomically replaced files. Capsules are rehashed and decoded before that intent advances; lower generations/fences, conflicting same-generation capsules, and same-fence operation substitution fail before infrastructure mutation. Reconciliation drains before stopping a writer, defers background effects until commit, and activates ingress last.
• The provider Docker launcher delivers the final application environment through bounded container stdin after Node starts. Secret values are absent from host Docker environment variables, command arguments, labels, and persisted container environment metadata; the in-container bootstrap validates names and values before importing the verified entry. The host Docker process receives only an operator-controlled connection/context/proxy/locale allowlist.
• Provider data metadata is exact-field decoded, size-bounded, project-bound, owner-only, and confined to typed data/generation/recovery paths. Unsafe permissions, symbolic-link storage, conflicting capsule/desired-state bindings, changed database paths, stale fences, and corrupted state relationships fail closed. Runtime environment values and ingress tokens remain memory-only, and committed cleanup can never roll database bytes back under newer metadata.
• Runtime capsules require the exact current node and operation lease, use canonical stored desired state, recheck the lease after capsule loading, verify whole-body and nested section digests, and bind project/release/generation at the provider hop. Application secrets, SQLite bytes, and ingress tokens remain only in bounded HTTPS bodies and never enter URLs, headers, public failures, or durable operation results. Built-in provider activation is explicit and fail-closed; generation-bound backup and deletion are integrated, while provider restore awaits a separately fenced replacement-generation path.
• Managed runner enrollment stores only a high-entropy digest, caps active grants, requires a recent same-origin browser administrator session plus CSRF, rejects bearer/admin impersonation, expires automatically, reserves transactionally, commits once, rolls back failed registration, and excludes enrollment and node credentials from API and audit records.
• Unknown CLANK_RUNNER and CLANK_HOSTING_PROFILE values now fail at startup instead of silently selecting process execution. The isolated profile rejects the process runner, and the packaged control plane rejects public signup when applications share the platform Unix trust boundary.
• Remote-runner requests are HTTPS-only outside loopback, JSON-only, size- and time-bounded, redirect-safe, no-store, and disabled unless a dedicated high-entropy enrollment token is configured. Node and operation credentials remain plaintext only to their holder and hashed at rest; expired nodes and stale operation fences fail closed.
• File-backed node credentials reject symbolic links, non-files, oversized or malformed data, unsafe owners/modes, inode/path swaps, unsupported versions, and invalid tokens; reads use a no-follow descriptor and writes replace a 0600 file atomically. Executor exceptions stay in private node diagnostics by default instead of durable control-plane state.
• A node credential alone cannot fetch a release: artifact access also requires its exact unexpired operation token and fence. The provider never receives that token, redirects remain disabled, and platform-managed secrets and databases are not included in retained release archives.
• Remote object storage refuses insecure non-loopback endpoints, embedded credentials, redirects, unsigned payloads, dotted virtual-host ambiguity, unsafe keys, oversized streams, and incomplete or inconsistent Clank integrity metadata. Provider response bodies never become public errors.
• Failed or ambiguous release-object writes are cleaned before their quota reservation is released. A repository namespace mismatch refuses reads and deletion rather than silently interpreting an old release through a newly configured bucket or prefix.
• Object backups authenticate catalog and manifest metadata, verify every chunk's exact key, media type, length, and SHA-256, then recheck AES-GCM, plaintext length/digest, and SQLite integrity before restore. The platform persists its backup namespace and logical root and refuses startup after repository configuration drifts or disappears.
• Hosted job inspection omits arguments, results, error text, owner/group identity, worker identity, and lease credentials. Mutations require the dedicated jobs permission, remain blocked during support impersonation, serialize with deployment/data operations, and never place application payloads in platform audit metadata.
• Provider adapters never receive control-plane node or operation credentials. Their HTTP bridge requires a distinct high-entropy token, HTTPS outside loopback, exact bounded headers and bodies, fresh artifact digest/config verification, no redirects, generic public failures, and private diagnostics.
• Preview environments never inherit production databases or secrets, cannot be nested, count toward existing account/workspace project limits, are hidden under their production parent, and expire through the same path-safe storage, token-revocation, and audit lifecycle as manual deletion.
• Tailwind builds execute an exact local binary and argument array without a shell, restrict the source to the compiler input tree, write output atomically, and fail deployment when the compiler is unavailable instead of silently shipping unprocessed production CSS.
• Traffic admission receives only project/route IDs, normalized method, request bytes, and receipt time; paths, hosts, headers, cookies, IP addresses, query strings, and body content never enter its ledger. Invalid policy decisions fail closed, project-scoped tokens cannot read workspace usage, and deleted-project rows contain only bounded operational aggregates until expiry.

#0.9.4 - 2026-07-28

#Added

• Typed durable jobs now support transactional mutation enqueue, owner-scoped handlers, queue and group routing, priorities, delays, idempotency keys, renewable visibility leases, heartbeats, cooperative timeout/cancellation, fenced settlement, bounded exponential retry, dead letters, event history, retention cleanup, and operator retry/purge controls.
• Time-zone-aware five-field cron schedules now provide deterministic occurrence keys, deadlines, bounded catch-up, suspension, and allow/forbid/replace concurrency through an independently leased scheduler.
• Deployment config can declare independent worker processes and a scheduler. The platform supervises and restarts the process group, quiesces background code across rolling releases, resumes the prior set after candidate failure, attributes per-role memory, and exposes tagged logs. clank jobs worker|scheduler runs the same process contract on any provider.
• The authenticated starter now includes an atomic background job, standalone process entry, deployment topology, local scripts, and human/agent guidance.
• Platform administrators can issue personal-only signup invitations as an explicit alternative to workspace invitations. Personal invitations create an isolated account and its own workspace without granting membership in an operator workspace; both types remain email-bound, single-use, expiring, hashed at rest, revocable, and auditable.
• Platform administrators can now set durable, audited account and workspace quota overrides from the Control plane. Workspace capacity inherits from its owning account and then installation defaults; projects, domains, release count/storage, and encrypted-backup retention all enforce the resolved value at their transactional or locked mutation boundary.
• The documentation now includes a practical per-app MCP guide covering automatic query and mutation tools, application-specific auth and data isolation, Codex connection, and contract freshness as UI actions change.
• Clank now ships a shared three-color brand mark with favicon, compact UI, and Apple touch variants. The deployment control plane and documentation site both publish and display the same generated identity.

#Fixed

• The legacy openJobQueue service now uses an isolated compatibility table and migrates its old table name, allowing it to coexist with the typed job runtime without a schema collision.
• Running cancellation now fences a handler that returns before its next heartbeat, and a cancelled job left by a crashed worker becomes cancelled rather than an unclaimable retry.
• Sidebar navigation now uses one consistently sized SVG icon system instead of font glyphs with mismatched baselines and visual bounds.
• The control-plane sidebar now keeps the Clank mark and name together in one compact lockup while preserving the descriptor alignment.
• The protected-main documentation workflow now removes one oldest inactive artifact only when the docs project reaches its release limit, preserving uninterrupted automatic deployments without deleting the active release or bypassing immediate rollback protection.

#0.9.3 - 2026-07-27

#Added

• MCP-visible backend contracts now receive deterministic revisions derived from server identity, tool names, schemas, descriptions, scopes, and annotations. Revisions are exposed through runtime manifests, discovery documents, Server Cards, response headers, list-result metadata, and deployment-sensitive serverInfo.version values.
• Bounded MCP Streamable HTTP sessions and authenticated SSE notification streams now support notifications/tools/list_changed. A new application process rejects a prior release's session so compliant clients automatically reinitialize and rediscover actions after rolling deploys.

#Changed

• tools/list, resources/list, and resources/read now publish ttlMs: 0 and private cache scope, while public discovery requires revalidation. Unknown tool errors include a structured refresh hint instead of leaving clients with an unexplained stale call.
• Generated agent guides now require every UI operation that reads or persists server state to use the same typed backend query or mutation exposed through MCP, with manifest/tool parity included in the definition of done.

#0.9.2 - 2026-07-27

#Fixed

• MCP OAuth consent pages now permit form navigation to the exact validated callback origin. This prevents Chromium from blocking the successful 303 loopback redirect after consuming the one-time consent proof, while retaining same-origin form restrictions everywhere else.

#0.9.1 - 2026-07-27

#Added

• docs.clank.run now exposes a public, read-only MCP server with bounded list, search, and canonical Markdown retrieval tools plus stable Clank and MCP Server Card discovery.

#Fixed

• MCP OAuth consent no longer depends on extension or embedded-browser Origin behavior. Consent pages now receive a one-time, expiring proof bound to the authenticated session and exact OAuth request; approval consumes it atomically alongside the existing session CSRF check.
• Signed-out MCP OAuth now offers a same-origin password form that advances directly to consent, while retaining strict Origin checks, credential throttling, secure cookies, generic failures, and same-origin-only return paths.
• MCP authorization remains a direct, standards-based exchange between the application and the MCP client. Connecting an agent never requires the Clank deployment CLI, the Clank control plane, a callback relay, Tailscale, or copying an authorization response.

#0.9.0 - 2026-07-26

#Added

• Automatic MCP Streamable HTTP tools for every Clank backend function, public server discovery, typed action resources, conservative side-effect annotations, and an OAuth authorization-code flow with PKCE, resource-bound access tokens, read/write scopes, rotating refresh tokens, and authenticated application-user isolation.
• Successful protected-main CI revisions now automatically build, validate, and deploy docs.clank.run through a dedicated GitHub environment and a least-privilege project token.
• Documentation code fences now use dependency-free, server-rendered syntax highlighting for TypeScript, TSX, JavaScript, shell, JSON, SQL, HTML, CSS, configuration, and Mermaid examples.
• Code-only application deployments now launch and health-check candidates on spare ports, atomically switch managed ingress, drain requests already assigned to the prior upstream, and stop the prior release only after the route change.
• Platform administrators can now attribute live container memory across the control plane, each hosted application process, V8 heap, file cache, kernel memory, swap, and per-process peaks from the responsive admin console.
• Platform administrators can now reconcile mounted-volume usage with the control database, isolated project databases, releases, migration snapshots, encrypted recovery backups, orphaned directories, and filesystem overhead without exposing paths or file contents.

#Fixed

• The deployment platform now reserves its own HTTP listener from the application port allocator and deterministically reassigns persisted project conflicts during startup.
• Deployment artifact collection now ignores the compiler's atomic temporary files, preventing a concurrent framework build from producing a transient file or ENOENT failure in an otherwise deterministic bundle.
• Deployment packaging now retries a complete, metadata-verified source snapshot when files or directory entries change during collection, preventing concurrent cleanup or replacement from producing partial artifacts.
• Railway startup recovers project runtimes concurrently without delaying the public listener, shutdown drains HTTP and platform resources together, and automatic crash recovery can no longer race a user deployment.
• Managed-ingress circuit breakers no longer carry an unhealthy prior upstream's open circuit into a newly activated release.

#0.8.0 - 2026-07-26

#Added

• A dependency-free interactive launcher when clank runs in a terminal, with guided create, readiness, login, deploy, and help workflows plus authenticated and minimal full-stack templates.
• A secure managed-platform default for clank login, so normal hosted use connects to https://clank.run without a --server flag while self-hosted platforms retain an explicit override.
• The framework now publishes from the @clank.run npm organization as @clank.run/framework, with explicit public-registry, provenance, repository, documentation, and package-export metadata.
• A fully authenticated deployment dashboard with site status, 1-hour through 30-day ingress charts, releases, logs, and guided custom-domain setup.
• Transactionally enforced per-organization site and per-project custom-domain limits, with operator-configurable metric retention.
• Minute-level fixed-histogram ingress metrics plus DNS routing inspection and a Caddy On-Demand TLS permission endpoint for deployed built-in and verified custom hosts.
• Packaged-release conformance covering scaffold, browser and CLI auth, live synchronization, isolation, deployment, migration, failed health activation, rollback, and data restoration.
• GitHub CI and OIDC trusted-publishing release workflows.
• Security reporting, contribution, conduct, ownership, and release-governance documentation.
• Deterministic AI blueprints with plan, explain, and generated authenticated application files.
• Email verification, password recovery, email-code MFA, WebAuthn passkeys, organizations, RBAC, invitations, and project-scoped CLI tokens.
• Typed file, email, job, webhook, observability, encrypted backup, orchestration, ingress, custom-domain, external PostgreSQL, and database-provisioning drivers.
• ASVS-oriented evidence, threat modeling, chaos tests, CodeQL, immutable GitHub Actions, package/credential auditing, and a public-beta gate.
• Enforced line, branch, and function coverage floors plus a documentation audit that verifies local links, guide indexing, declaration synchronization, and package export targets.
• Storage-backed /healthz and /readyz probes alongside the process-only /livez endpoint.
• Bounded automatic custom-domain routing reconciliation with durable cross-control-plane leases, lookup deadlines, operator configuration, and dashboard status.
• Automatic verified encrypted database backups with durable cross-control-plane leases, configurable cadence and retention, private failure reporting, and dashboard controls.
• Enforced per-project release count/byte quotas plus rollback-scoped dashboard and CLI cleanup for inactive runtime artifacts and pre-deploy snapshots.
• Owner/admin-only permanent site deletion in the dashboard, API, and CLI with exact confirmation, explicit data-loss acknowledgement, scoped-token denial, path-safe storage removal, token revocation, and retained audit evidence.
• A role-filtered, cursor-paginated workspace activity feed in the dashboard, API, and CLI that retains deleted-site history and upgrades existing audit rows with organization attribution.
• Workspace people administration in the dashboard and CLI, including browser acceptance, member role changes, immediate removal, safe pending-invitation listing, one-time token copy, replacement, and revocation.
• Quota-aware workspace creation in the People console with safe slug preview and immediate selection.
• Durable SQLite-backed deployment-platform authentication and CLI device-start rate limits shared across control-plane runtimes and restarts.
• Command-aware human and JSON CLI help, agent-readable readiness diagnostics, generated README.md/AGENTS.md guides, and local-checkout scaffolding that does not require an npm release.
• Offline deterministic deployment dry-runs, structured deployment results with timing, one-command first-project naming/workspace selection, and retry-safe persisted idempotency attempts.

#Changed

• Authentication now defaults to an eight-character password minimum across framework and platform forms; applications can still require a higher value, and scrypt hashing, bounded concurrency, rate limits, and optional server-only peppering remain in place.
• The documentation site now begins with the published npm package and generated-app workflow, with hosted login examples consistently using the managed clank.run service.

#Fixed

• Deployment-console header controls now center their labels and icons consistently, while account quota totals retain readable spacing at narrow widths.
• Workspace invitations can now create their email-bound account and accept membership in one browser flow even when public registration is disabled or the one-time bootstrap is complete.
• First-account bootstrap is now protected by an expiring SQLite claim across control-plane runtimes, preventing concurrent processes from creating multiple initial accounts.
• Platform signup policy now evaluates the same normalized auth operation as the low-level router, closing repeated-slash registration bypasses.
• Sign-out and expired-session transitions now reload the deployment console at the identity boundary, clearing prior-account dashboard DOM and recomputing bootstrap availability before another account signs in.
• Successful password login now clears the exact failed-attempt rate-limit key instead of leaving the account throttled.
• CLI profile and project-link state is now bounded, structurally validated, URL-canonicalized, privately and atomically replaced, and never reflected in parse errors.
• CLI control-plane responses are streaming-bounded, decoded as strict UTF-8/JSON, and protected by finite request and deployment timeouts.
• Platform signal handling now closes both the HTTP listener and control-plane state, reports shutdown failures, and enforces a 30-second termination deadline.
• Project navigation now resets scroll position and closes the mobile drawer; the detail tab row stays within narrow viewports without a page-level horizontal scrollbar or clipped breadcrumb, and the console explicitly serves no favicon asset.
• The deployment console no longer renders or requests a logo asset or letter-mark treatment.
• Backup API responses no longer expose private host database paths.
• Repeated deployments can no longer grow retained release storage without an installation-defined ceiling.
• Site quotas can now be reclaimed without operator-side SQLite or filesystem edits.
• Managed ingress now fixes the upstream origin before applying a request path and streaming-bounds bodies without Content-Length, closing scheme-relative SSRF and unbounded-buffer paths.
• Pending custom-domain assignments can no longer be moved between projects; platform-owned DNS namespaces are reserved.
• Reissuing an invitation now revokes every older active token for that workspace/email, existing members cannot be reinvited, and active invitations are capped at 100 per workspace.
• Refreshed dashboard sessions now render one consistent authentication state and return to sign-in when a session expires.
• Failed distributed-lease acquisition now releases the local project queue.
• Managed ingress strips Connection-nominated headers and retries safe requests after transient upstream 5xx responses.
• WebAuthn CBOR parsing now bounds collection size and nesting, and passkey counter advancement is atomic.
• Blueprint suffix parsing and local-file endpoint normalization are linear on adversarial input.
• Unexpected deployment-platform failures are logged privately and never reflected to HTTP clients.
• Every HTTP/runtime adapter now keeps unexpected exception text private, and adversarial prefix, identifier, URL, and numeric-literal parsing is linear.
• CLI device login prints its browser approval URL without launching an operating-system command.
• The minimum runtime is Node 22.16, the first Node 22 release with the built-in SQLite backup API used by migrations and recovery.
• The official package name is @clank.run/framework, avoiding collision with unrelated unscoped packages while leaving the binaries as clank and clank-platform.
• Command-specific --help no longer authenticates or executes the command, dry-run deploys no longer require login, asynchronous CLI failures now reliably exit non-zero without stack traces, and unknown long options fail with spelling guidance instead of being ignored.
• Generated authenticated apps and bundled SSR examples now map the browser's actual @clank.run/framework module specifier, allowing their server-rendered screens to hydrate and become interactive.
• Hydration now cleans partially attached listeners, directives, keyed rows, and component ownership before fallback; only structural mismatches remount, lifecycle/application errors remain visible, and case-sensitive SVG plus foreignObject namespaces preserve their server nodes.
• Local deployment artifacts are now written through a private atomic replacement, preventing a pre-existing output symlink from redirecting CLI writes.

#0.7.0 - 2026-07-16

#Added

• AI-first runtime schemas, actions, semantic UI, forms, headless UI primitives, SSR, hydration, routing, SQLite backend, authentication, migrations, and the Clank deployment platform.
• Deterministic deployment artifacts, encrypted platform secrets, device authorization, health-gated activation, logs, audit history, and rollback.

#Changed

• Renamed the complete framework, CLI, storage, protocol, documentation, and deployment UI from Proact to Clank while preserving legacy data through compatibility readers and in-place migration.