Changelog

Clank follows semantic versioning. Entries describe user-visible framework, CLI, protocol, storage, security, and deployment changes.

#Unreleased

• Add eight local-search capabilities: any-term matching, field filters, ID scopes, exclusions, phrase matching, title/ID ordering, immutable document lookup and explicit clearing.
• Add six virtual-collection controls: index/key scrolling, key focus, constant-time key lookup, visible-range inspection and runtime overscan updates.
• Add six application-performance diagnostics: load-time limits, per-resource limits, baseline regression policies, duplicate-resource summaries, origin totals and resource-type totals. Support optional policies through the existing workbench budget file.
• Build replacement search indexes once and cache prefix vocabularies. Copy streamed body chunks into bounded slabs; fail size limits without waiting for producer cancellation. Bound untrusted HAR URLs, MIME metadata and diagnostic output.

• Add opt-in organization security policy review, versioned changes, persistent enrollment grace and independent last-administrator recovery. Fence current browser, CLI and MCP authority, including held requests, exact refresh retries and direct reviewed actions.
• Add reviewed customer status pages with expiring public health, dedicated incident copy, native account subscriber inboxes, version-fenced custom-domain ownership/routing and exact transactional publication receipts. Private operational payloads are never copied automatically.

• Add persistent project incidents with current-access-fenced ownership, recovery notes, resolution, release/error/trace/job/workflow/alert references, bounded readonly diagnostic adapters and exact retry receipts. The native console and shared browser client use the same contract; inactive release cleanup retains safe context.
• Add project service objectives with explicit native-ingress completion coverage, exact request/latency budget arithmetic, retained burn alerts, current-access-fenced policies and exact retry receipts. Restarts, missing measurements and overlapping collectors cannot establish compliance; native console edits preserve their original expected version.
• Fence retained SQLite write contexts to their original active transaction, including deferred async callbacks, so writes cannot bypass revision journals or borrow another owner's transaction.

• Add the documented PostgreSQL application subset with typed tables, native owner-scoped transactions, revisions, explicit reconnect, verified TLS and bounded SCRAM transport. Refuse SQLite-only services and report unknown commit outcomes without replay.
• Evaluate supervisor guardian lease timestamps after the native read so a valid concurrent renewal cannot spuriously fence its coordinator. Keep strict expiry, identity, configuration and clock-regression checks.

• Add opt-in same-host Linux supervisor leadership with native retained epochs, transaction fences, dedicated coordinator guardians and automatic standby recovery after verified tenant cleanup. Expose bounded CLI configuration and readonly local status; reject accidental ordinary-mode startup after enabling the topology.

• Add durable declared media transforms using native jobs, current human authority, exact source/destination generations, bounded progress and atomic publication receipts. Fence immediate image transforms against replaced uploads and verify actual bucket-read bytes.

• Add opt-in dedicated organization service accounts with scoped expiring credentials, current machine authority, signed human administration, encrypted exact rotation receipts and explicit machine audit/budget attribution.

• Revalidate the exact admitted credential and scope for held platform-token requests at current-authority boundaries.

• Reduce framework release size by removing only leading indentation in known JavaScript code regions. Preserve comments, licenses, literals and line endings; ambiguous modules stay exact. Public compiler, examples and mapped builds retain their format. Rebuilt distribution digests and reflective function formatting change.
• Keep compiler watch running through transient recursive scan errors on Node 22, and reconcile renamed/deleted source filenames when native notifications disappear. Reuse the serialized build queue and preserve failed build diagnostics.

• Add explicit workflow compensation with typed idempotent cleanup jobs or manual barriers. Reserve bounded recovery capacity with the run, freeze stable cleanup occurrences and arguments, execute in reverse dependency order after forward attempts settle, and retain original failure alongside recovery progress. Fence changed definitions and stale workers; protect unresolved evidence and active job references from retention and operator purge.

• Add typed durable decision/event waits to workflow graphs. Persist bounded requests, deadlines and exact retry receipts without holding worker leases. Require current reviewed-action execution for human decisions, fence resume tokens by current policy, and serialize resume, cancellation and timeout in SQLite transactions. Wrap long approval previews on phones and return native HTML form decisions to the inbox; preserve JSON and non-HTML client responses.
• Recognize the exact malformed-property-name coverage diagnostic for the existing single bounded artifact retry after every test passes; preserve failure and coverage-threshold refusal.

• Fence retired organization offboarding credentials against the current persisted provider snapshot, including requests waiting for their body. Preserve dedicated and linking-disabled revocation semantics and roll back credential publication with failed policy reconciliation.

• Add opt-in organization-scoped SCIM User/Group provisioning with separate expiring credentials, conditional resource versions, atomic PATCH and durable retry receipts. Require signed subject proof for binding/reactivation, preserve manual role ownership and unrelated workspace access, and provide fresh, versioned native membership adoption.

• Preserve dash-prefixed deployment identities and directories after the CLI -- option terminator, including literal --help and --json values. Keep prior options strict and prevent clock-boundary races in signed-provider rejection tests.

• Add opt-in verified organization identity linking with fresh local and provider authentication, durable subject ownership, versioned unlink receipts and organization-scoped offboarding. Preserve unrelated organization access and expose guarded native account-security controls.
• Recognize Node's malformed-property-value coverage artifact diagnostic for the existing single bounded retry only after every test passes; keep test failures and coverage thresholds strict.

• Drain admitted requests before stopping a failed canary candidate, with the existing two-second limit and verified process-cleanup fence. Preserve the prior release and accepted data on rollback.

• Reduce unmapped compiler output by removing complete erased declaration padding and compacting horizontal whitespace around erased types. Preserve token separators, runtime literal whitespace, CRLF/newline semantics and mapped debugging output without adding a minifier dependency.

• Add exact scheduled channel promotions with explicit UTC windows and IANA previews, durable fenced execution, current credential/readiness checks, versioned cancellation and verified recovery through API, CLI and dashboard. Preserve acceptance across restart and protect unresolved work against channel retirement and project deletion.

• Add versioned project dependency gates for uploads, canaries, rollback and environment/channel activation. Bind bounded health checks to exact managed service identities and current credentials, expose CLI/dashboard configuration and history, and support explicit human readiness approval with durable recovery fences and deletion protection. Preserve prior data and frozen provider environments during compensation and interrupted rollback recovery.
• Keep failed provider rollback from changing a historically accepted artifact into a failed upload, and commit rollback audit records with provider acceptance. Constrain environment form grid tracks so long select options and reviewed identities remain readable on phones.

• Recognize Node 26’s unterminated-string coverage artifact diagnostic for the existing single bounded retry, while preserving immediate failure for tests, threshold misses, inconsistent counts and other errors. A successful retry must measure JavaScript.

• Add persistent named release channels with immutable source pins, version-fenced updates, exact-byte environment promotion and historical rollback through CLI and dashboard. Commit rollback pointers only with verified activation; protect retained uploads from cleanup and project deletion, and support explicit authenticated retirement with versioned tombstones.

• Add persistent development/staging/production bindings, exact-artifact promotion, durable request receipts, migration policies, current authority fences and verified recovery through the dashboard and CLI. Support certified co-located code-only provider targets; unresolved cleanup, host proof or interrupted migration stays fenced.
• Restore the prior provider generation’s frozen runtime environment during failed-promotion compensation, so changed candidate secrets cannot prevent prior-code recovery.
• Retain original local upload bytes within storage limits, snapshot migrations after prior writers stop, contain rejected error observers, and recheck provider deployment/rollback authority before activation.
• Wait for managed runtime guardians to install their cleanup handlers before returning a runtime handle, so immediate rollback/shutdown does not strand an uninitialized fence.

• Add optional disposable fleet drills over actual coordinator, agent and Docker provider contracts, with lease loss, transport/storage faults, restarts, placement/fence timelines, current host-certification admission and ownership-verified cleanup.
• Clear inherited host capabilities before Linux SQLite sandbox startup, and preserve verified deployment file modes when extracting under a restrictive provider umask.

• Compact native type-erasure padding in unmapped erasable builds on Node 22/24 as well as Node 26. Keep Node 22/24 transformation for enums, parameter properties and runtime namespaces, and preserve mapped compiler output. Future build digests change; stored artifacts do not.

• Add optional, policy-bound Linux host certification with real disposable namespace, SQLite migration/worker, XFS quota and Docker resource/egress probes, authenticated expiring reports and CLI inspection. Denied, interrupted or unverified cleanup stays blocked.

• Add typed, caller-scoped count/sum/group projections over declared references, with explicit record policies, native JSON admission, bounded output and selective related/ACL live updates. Reject inherited table, query-field and index-field names while preserving declared literal keys.

• Add optional typed component specimens with SSR/hydration, owned reset/disposal, common UI contracts, native controls and deterministic assertion exports. Extend browser journeys with native focus/key input, focus/layout assertions and ARIA checked-state inspection. Wait for owned Chrome termination and handle transient profile-removal races during journey cleanup.

• Add opt-in authorized search facets, deterministic revision-pinned result paging and account-owned saved searches with fenced edits, exact latest retries and compact retired keys.
• Validate object-schema fields as own properties and preserve explicitly declared literal keys without changing the parsed object's prototype. Propagate unexpected refinement failures instead of returning partial container values or accepting another union branch.
• Require synchronous boolean refinement predicates and contain rejected thenables. Preserve isolated SQLite worker coverage profiles when PID namespaces emit colliding filenames.

• Add scoped retention inventory, reviewed purge batches, durable holds and periodic cleanup for imports, collaboration operations/receipts and acknowledged platform audit exports. Expired retry identities remain fenced, and holds suppress pruning across upgraded writers.
• Bound held audit outbox growth, avoid redelivery of acknowledged envelopes, and continue delivery of signed pending entries when a later event cannot be captured.

#0.24.0 - 2026-10-03

• Add forty framework and platform improvements covering tenant isolation, recovery, governance, generated applications, durable data workflows, and developer tools. The implementation and validation ledger is in reports/forty-improvements-2026-10-03/ in the source repository.
• Add bounded point-in-time recovery, automated restore drills, planned node evacuation, local code-only managed canaries, operational alerts, streaming usage accounting, usage forecasts, and tamper-evident audit exports. Fence background runtime recovery and old-writer cleanup.
• Add organization SSO/offboarding, fresh authentication for sensitive actions, project-level permissions, account-security screens, granular agent grants, durable action previews and approvals, and execution receipts with explicit undo options.
• Add workspace-aware blueprints, dynamic detail pages, explicit public pages, enforced relationship cardinality, and conflict-aware regeneration of edited applications.
• Add persistent collaborative editing, authorized full-text search, transactional bulk edits, shared saved views, resumable imports, offline conflict-resolution controls, localization, time-zone-aware recurrence, and notification delivery controls.
• Add Node 26 compiler support, state-preserving development updates, editor integration, signed application-release attestations, and runnable documentation examples. The framework, public API subpaths, and all four CLIs ship together in @clank.run/framework.
• Harden delegated OAuth scopes, current-session and tenant authorization, bucket/storage path handling, bounded SQLite execution, sanitized diagnostics, artifact handling, and runtime ownership. Linux workers use pinned filesystem capabilities and fair per-project admission; configured provider policies add disk quotas and outbound network restrictions.
• Improve responsive layouts across the core applications and starters.
• Reduce keyed-list DOM movement and bulk live-query invalidation work while preserving identity, cleanup, ownership, and fresh authority. Local alternating trials measured 17–27% lower desktop update time for large rotations/prepends and 66% lower time for the bulk live-reader fixture. Dashboard authorization and domain/release reads are batched; populated metric scans remain a bottleneck. See reports/performance-2026-10-03/ for raw measurements and limitations.
• Keep zero runtime dependencies and existing performance budgets; extend security, regression, package, browser, load, and crash/recovery verification. Correct a bulk-edit test's assumption about insertion order when creation timestamps tie.

Upgrade requirements:

• Supported Node versions are >=22.16 <27. Node 22, 24, and 26 are covered by local release checks.
• Before regenerating a blueprint, review its explicit public routes and public entity fields: generated public pages now expose those declared fields anonymously through read-only queries.
• Revoke constrained agent grants before rolling back to a version that does not enforce their workspace, action, resource, or operation-budget restrictions.
• Typed ingress metric producers must supply responseOutcome (complete, cancelled, or error); provider-phase consumers must handle evacuating. Normalized blueprints require auth.required: true while supporting explicitly declared public read-only routes.
• Before upgrading a Linux control plane, install bubblewrap and util-linux and verify that its actual user/container/security profile permits the required namespaces. Database helpers refuse work when isolation is unavailable; installing binaries alone is insufficient. Use dedicated per-application database directories. See SQLite worker isolation.
• The existing Railway host denies the required nested namespaces, so database-worker deployment operations there remain blocked. This release does not bypass that boundary or claim that the hosted documentation/Design Studio deployments have been updated. Non-Linux hosts require an external sandbox for equivalent tenant isolation; otherwise restrict them to trusted deployers.

#0.23.0 - 2026-09-20

• Deliver 100 practical framework, dashboard, documentation, Studio, Synth, starter, and CLI improvements; the numbered implementation and validation ledger is in reports/one-hundred-improvements-2026-09-20/ in the source repository.
• Correct reactive array and own-property tracking, form reset/submission races, native textarea and select SSR/hydration, navigation guard races, IME handling, focus traversal, and cleanup failures.
• Preserve dashboard workspace, activity, log-reading, and settings state; add operational filters, month navigation, full-ID copying, exact timestamps, bounded reads, and accessible mobile navigation.
• Add docs mobile contents and section tracking, search highlights and copy fallback; add Studio keyboard tabs, component favorites, theme filters, and sandbox CSS export.
• Add Synth pattern import, undo/redo, track editing, tap tempo, keyboard grid navigation, mix reset, validated saved state, and predictable audio lifecycle; improve starter filtering and todo recovery, and add booking calendar downloads.
• Bound compiler concurrency, serialize asset rebuilds, reject output collisions, preserve build diagnostics, validate workbench arguments, and harden deployment artifact/configuration handling.
• Add dashboard project sorting and workspace/status filters, activity search and action filtering, runtime log search and stream filtering, refresh pause, traffic tables, and monthly usage CSV export.
• Add documentation reading history, bookmarks, reading-position resume, progress, focus mode, text sizing, code wrapping, print layout, category search, and keyboard quick-search navigation.
• Add Studio token inspection, contrast calculation, theme export/comparison/sandbox tools, custom preview widths, shareable settings, catalog filters, keyboard guides, and specimen reset.
• Restrict dashboard touch zoom and use 16px mobile form controls to avoid focus-triggered zoom.

• Include the previously merged authentication, delegated-token, tenant-access, file-serving, deployment-packaging, rendered-URL, and job-isolation hardening. Legacy signed files download as attachments; unsafe private storage paths fail closed; job deduplication is owner-scoped; removed workspace members lose creator fallback access.
• Reduce repeated SQLite document-write, dashboard quota, and server-rendering work while preserving ownership, validation, history, and component cleanup.
• Make the resilience test worker avoid empty write transactions and tolerate bounded SQLite contention so release verification exercises fault recovery reliably under coverage.

#0.22.1 - 2026-09-07

• Aggregate dashboard metric summaries in one current-period query while preserving chart-summary semantics, and expose bounded platform authentication concurrency and queue settings without changing password-hash strength.
• Allow explicit, bounded runtime capacity settings for live connections and password-hash admission in deployment environments; application options take precedence and existing defaults remain unchanged.

• Preserve live-query dependency tracking after result-cache eviction, so connected clients keep receiving selective updates under cache pressure.

• Keep platform project listing and dashboard queries scoped to indexed ownership and workspace membership as tenant counts grow.

#0.22.0 - 2026-09-07

• Add private bookmarks and folders with safe URLs, favorites, search, conflict-checked editing, and atomic folder removal.
• Add personal activity timelines with trusted event recording, bounded retention, stable pagination, unread filters, and cursor-bounded clearing.
• Add shared feedback boards with explicit membership, unique votes, proposal editing, moderated status, and searchable controls.
• Add personal availability calendars with overlap-safe windows, conflict-checked edits, and bounded slot previews with booking buffers.
• Add saved dashboard layouts with owned defaults, widget visibility/order/width/collapse controls, responsive sizing, and preserved widget instances.
• Add personal labels with colors, bounded resource assignments, conflict-checked editing, and browser controls.
• Add owned ordered checklists with atomic completion, item editing, reordering, reset, and conflict-aware controls.
• Add personal reminders with local-time scheduling, due filters, snooze, completion, and version-fenced editing.
• Add recoverable device-local autosaved drafts with transactional revision checks, expiry, bounded JSON snapshots, and recovery controls.
• Add bounded local undo/redo history with named edits, explicit coalescing, atomic transactions, snapshot recovery, and controls.
• Add searchable command palettes with ranked accent-insensitive matching, keyboard navigation, focus restoration, and cancellable async execution.
• Add configurable keyboard shortcuts with conflict detection, optional local persistence, input-aware dispatch, scopes, and settings controls.
• Add resumable onboarding tours with highlighted targets, async preparation, retry, pause, skip, versioned progress, and cleanup.
• Add spreadsheet-safe CSV exports with explicit column selection, UTF-8 downloads, bounded construction, and cancellable streaming responses.
• Add an account-owned recycle bin with original-ID restoration, expiration sweeps, guarded permanent history deletion, and browser recovery controls.
• Add account-owned record history panels with paginated snapshots, structural comparisons, business-rule validation, and version-fenced restore controls.
• Add shared threaded comments with resource roles, safe edit/delete controls, reply limits, resolution, retry keys, and persistent permission revocation.
• Add account-owned saved views with validated filters, stable sorting, visible columns, optimistic revisions, default selection, and browser management controls.
• Add bounded local full-text search with accent folding, title-aware ranking, prefix completion, highlighted snippets, snapshot restore, and keyboard-accessible search controls.
• Add CSV import with strict bounded parsing, column mapping, typed validation, duplicate handling, preview controls, and idempotent host transaction keys.

#0.21.0 - 2026-09-06

• Add a persistent release error inbox with source-map frame locations, trace links, per-release counts, bounded retention, and recurrence tracking after resolution.
• Add opt-in SSE resume with bounded session/query-scoped JSON splices and full-snapshot fallback after cache misses, authorization changes, or invalid client bases.
• Add encrypted staged secret rotation to the platform and CLI, with bounded validation, conflict-checked activation/rollback, audit metadata, and running-consumer version inspection.
• Add disposable application resilience rehearsals for offline, lost-response, dependency, upload-interruption, and worker-restart faults with required recovery evidence and CLI gating.
• Add conservative API/MCP compatibility reports and a CI workbench gate for action removal, input/output schema changes, authentication, agent exposure, and required scopes.
• Add fixed-height virtualized lists and grids with keyed row retention, scroll anchoring, keyboard navigation, accessible positions, and explicit cleanup.
• Add a durable authenticated webhook outbox with signed deliveries, bounded attempt history, owner-scoped inspection, controlled replay, and per-attempt signing-key resolution.
• Add complete application-load budgets from cold-navigation HAR captures, with resource deltas, transitive asset accounting, and failing CI checks for incomplete evidence.
• Add opt-in SQLite query plans, bounded execution summaries, repeated-query and slow-query advice, and reviewable index candidates in local DevTools.

#0.20.0 - 2026-09-06

• Enforce deterministic reactive-work and browser-module size budgets in CI, with timing diagnostics.
• Compare consecutive deployment activations using matched traffic windows, request latency, error rates, and activation duration, with explicit low-traffic and collection states.
• Add loopback-only DevTools for reactive dependency activity, computation lifetime, and opt-in backend query/cache diagnostics.
• Carry request trace context through backend operations, durable jobs, retries, and workflow steps; inspect bounded, metadata-only request/job timelines.
• Build validated synthetic fixture databases and seed isolated preview environments through the CLI and platform, preserving parent application data and recovery safety.
• Rehearse encrypted-backup recovery and database migrations on disposable copies, including application health checks, timing, table changes, and cleanup.
• Persist bounded agent tool activity with granted scopes, outcomes, timing, observed revisions, filters, and a local explorer.
• Queue browser mutations durably with account-bound transactional replay receipts, pending/retry states, expiry checks, and explicit conflict reconciliation.
• Add persistent user-owned notifications, read state, category preferences, accessible browser controls, and optional durable email delivery with stable provider idempotency keys.
• Ship approval-queue, customer-portal, and booking application recipes with authenticated UI/MCP contracts, ownership and transition rules, fixtures, migrations, and deployment configuration.
• Run generated-application contracts in independent Node test contexts and build composed applications before their tests, closing a verification gap in the CLI harness.

#0.19.6 - 2026-09-06

• Coalesce shared reactive dependency invalidation before effects run, eliminating duplicate executions and partially updated computed values from a single signal write.
• Dispose server-rendered component scopes after asynchronous output settles, releasing subscriptions and cleanup callbacks on success and failure.
• Revalidate unchanged static GET/HEAD responses with weak ETags and bodyless 304 responses, avoiding repeated file streams and asset transfers.
• Release unused HEAD response bodies and response readers after backpressured or early client disconnects, while preserving responses to rejected request bodies.
• Load managed-ingress custom domains in one query per routing snapshot and skip provider fleet reads on local-only installations, preserving immediate routing and fencing updates.
• Correct deployment-token setup guidance for workflows that prune inactive releases before publishing.

#0.19.5 - 2026-08-18

• Fixed recurring MCP OAuth disconnects for clients with replicated credential storage. Adaptive refresh rotation now follows a bounded, encrypted predecessor chain so a lagging replica can converge on the one current successor without branching token authority or revoking a newer replica. Missing or overlong adaptive handoffs fail without collateral grant revocation; strict mode retains replay-driven family revocation for security-sensitive applications.

#0.19.4 - 2026-08-18

• Added adaptive OAuth refresh recovery for MCP clients that fail to persist a rotated successor. Clank now renews the access token through the encrypted, single-successor handoff while that successor remains unspent, preventing recurring hourly disconnects without branching refresh families or extending their expiry. Successor adoption restores immediate predecessor-replay revocation, and security-sensitive applications can opt into strict post-window rotation.

#0.19.3 - 2026-08-12

• Corrected delayed OAuth refresh retry responses to report the recovered access token's remaining lifetime rather than its original lifetime, preventing clients from caching it past server expiry.

#0.19.2 - 2026-08-12

• Made OAuth refresh rotation resilient to MCP clients with concurrent or delayed credential persistence. Retries of the immediately previous refresh token now recover the exact same successor pair for a bounded 15-minute window from an AES-GCM envelope whose key is not stored; older replays and replays after the successor advances still revoke the complete token family.

#0.19.1 - 2026-08-11

• Preserved MCP Apps _meta.ui.resourceUri metadata on model-visible tools even when stateless clients omit the per-request UI capability hint. Codex and other MCP hosts can now associate an already-published ui:// resource with its tool result instead of treating the resource as a separately read attachment; app-only tools remain hidden and uncallable until UI support is negotiated.

#0.19.0 - 2026-08-10

• Added first-class support for the stable MCP Apps 2026-01-26 extension. Backend queries and mutations can bind immutable ui:// HTML resources through defineMcpApp() and one agent.app declaration; negotiated clients receive exact text/html;profile=mcp-app resources, UI tool metadata, visibility, CSP, permission, domain, and border preferences. Application HTML and tool bindings participate in the deterministic MCP revision so UI resources cannot silently drift behind their server actions.
• Added the dependency-free @clank.run/framework/mcp-app browser runtime and document builder for host initialization, tool calls, resource reads, links, downloads, messages, model context, display modes, size changes, lifecycle events, and safe theme-token projection. The complete guide, low-level example, discovery metadata, type inference coverage, MCPJam Apps conformance, and packed-release conformance make the feature usable by humans and coding agents immediately.
• Hardened MCP App declarations with strict object fields, bounded complete HTML documents, secure CSP origin validation, explicit empty permission grants, trusted-parent message handling, request timeouts, and a clear separation between UI visibility and authorization scope enforcement.

#0.18.4 - 2026-08-10

• Normalized generated and custom MCP tool names to the strict cross-provider identifier contract: ASCII letters, numbers, and underscores with a 64-character ceiling. Dotted or hyphenated action paths such as dailyLog.getDay now publish as dailyLog_getDay; overlong or normalization- colliding names receive stable digest suffixes. Tool metadata retains the exact original Clank action path, invocation routes through the portable name, and the changed contract revision makes connected clients refresh stale catalogs automatically.

#0.18.3 - 2026-08-10

• Fixed hosted MCP sign-in behind proxies that normalize or remove browser Fetch Metadata. The OAuth login page now issues a five-minute, one-time proof bound to both the exact authorization return path and a private browser cookie. Cross-origin form login requires and atomically consumes that proof, so MCPJam, Augment, and other sandboxed hosted clients work without trusting fragile Sec-Fetch-* headers or weakening ordinary origin, JSON, redirect, expiry, and replay protections.

#0.18.2 - 2026-08-10

• Fixed hosted MCP authorization for sandbox-inherited browser popups. OAuth now performs one same-site session recheck to recover legacy Strict cookies, authenticated session checks reissue cookies under the current policy, and password login narrowly accepts a user-activated opaque same-origin top-level form navigation. Cross-site, iframe, scripted, JSON, and unbounded-return requests remain rejected.

#0.18.1 - 2026-08-10

• Fixed remote browser MCP authorization by making application sessions available to secure cross-site top-level OAuth navigations and adding narrowly scoped, credential-free CORS support for MCP preflight, dynamic client registration, and token requests. Protected MCP endpoints still require resource-bound bearer tokens, password submission remains same-origin only, and public MCP servers remain cross-origin restricted unless explicitly enabled.

#0.18.0 - 2026-08-09

• Upgraded every generated application MCP endpoint to the stateless 2026-07-28 protocol while retaining dual-era compatibility through 2025-11-25. Modern requests now implement required server/discover, per-request protocol/client metadata, result types and server identity, zero-TTL private discovery, and strict Mcp-Method, Mcp-Name, and schema-declared Mcp-Param-* header/body validation. They mint no process-local session state and remain valid across cold starts, replicas, and rolling deployments.
• Hardened application OAuth for the current MCP authorization profile with RFC 9207 issuer parameters on successful and error redirects, advertised issuer-response support, and explicit native/web dynamic-client classification. Existing PKCE, exact redirect, resource-bound token, rotating refresh-token, protected-resource metadata, and legacy registration behavior remain compatible.

#0.17.0 - 2026-08-03

• Added first-class managed application buckets through @clank.run/framework/buckets and blueprint buckets. The dependency-free runtime composes with local or S3-compatible object storage and provides transactional project/per-owner quotas, isolated metadata listing, immutable generation replacement, signed private/public delivery, CSRF-gated browser uploads, offset-checked resumable chunks, content and SHA-256 verification, raster signature/dimension policy, declared provider-pluggable image variants, and automatic owner-scoped MCP tools.
• Generated applications now receive zero-setup local bucket storage and production environment composition. The control plane injects a per-project root, stable derived signing key, logical namespace, public origin, and administrator-overridable bucket byte/object ceilings for local and provider placement. Bucket policies participate in backend manifests, MCP contract revisions, discovery, account/workspace limit administration, local project cleanup, and complete human/agent documentation.

#0.16.0 - 2026-08-02

• Added the opt-in, dependency-free Task<Success, Failure, Requirements> runtime. Typed expected failures remain distinct from defects and interruption; nominal services and memoized layers expose requirements; scopes guarantee reverse-order release; reusable schedules provide bounded retry; fibers, races, and concurrency-limited task groups use structured cancellation; Clank tracing plugs in directly; and an injectable deterministic clock covers sleep, retry, race, and timeout tests. Existing promise-based framework APIs remain unchanged.
• Added the focused @clank.run/framework/task package export, complete declarations, behavioral and failure-path coverage, compact API reference, and an agent-friendly guide explaining when to choose Task, promises, durable jobs, workflows, or durable objects.

#0.15.0 - 2026-08-01

• Added a unified dependency-free governance contract for users, agents, services, hosted entitlement layers, short-lived action/resource-bound HMAC approvals, and deterministic typed feature flags. The control plane now resolves default, billing, workspace, and operator limits through the same typed entitlement layering primitive, and its SSR design consumes the shared Clank theme tokens used by Design Studio.
• Added release and data lifecycle contracts for canonical provenance, promotion evidence, progressive canary guardrails, causal revision inspection and time travel, deterministic sanitized clones, checksummed portable project exports, and transparent capacity estimates. Deployment bundles now bind source revision, configuration, migration IDs, and every packaged material digest and verify those bindings at each decoding trust boundary.
• Added public App Studio/tooling APIs and clank workbench commands for policy/flag evaluation, revision replay, production parity, classified schema migration plans, capacity simulation, upgrades, provenance and promotions, exports and safe clones, action-contract tests, visual regression, and provider conformance. The provider acceptance kit verifies frozen credential-free requests, idempotency, abortable deadlines, and—with an explicit disposable project opt-in—advertised destructive capabilities.
• Added three user- and agent-oriented guides for governance, the revision/release lifecycle, and App Studio/workbench workflows, plus package exports at /governance, /lifecycle, and /tooling.

#0.14.0 - 2026-08-01

• Added first-party typed durable objects over each application's isolated SQLite database. Stable namespace/ID stubs serialize calls locally and across processes with renewable leases and stale revision fencing; validated state commits only after successful handlers. The runtime includes bounded mutation idempotency, tombstone/reinitialization semantics, sequential state migrations, one durable alarm per object with retry diagnostics, cross-process revision subscriptions, aggregate diagnostics, immutable manifests, and opt-in MCP tools with mandatory exact-object authorization. The public /durable-objects export remains dependency-free and follows Clank's statefully pinned durable-volume placement boundary.
• Hardened durable-object storage against retry and capacity abuse. Idempotency expiry is exact even after idle periods, reinitialization cannot replay a prior incarnation's result, cleanup is namespace-scoped and cannot turn a committed mutation into an error, tombstones remain under a fail-closed per-namespace identity ceiling, per-object retry records have a hard ceiling, and persisted alarm diagnostics are control-character-free and UTF-8 byte bounded.

• Added a dependency-free theming layer for the headless UI library. Ten immutable presets span light and dark color systems, square through pill geometry, compact through relaxed density, typography, depth, focus, danger, and motion tokens. Typed custom themes are validated before producing deterministic CSS variables; portal-safe DOM application includes reversible cleanup; and the /ui/theme export makes the same contract available to applications and agents. The new server-rendered Design Studio at design.clank.run exercises every one of the 37 real controllers, provides responsive and anatomy inspection, serves structured JSON and a public read-only MCP catalog, and deploys as an ordinary first-party Clank project. Its SSR coverage also corrected the Scroll Area's legacy Microsoft overflow style to use the renderer-safe DOM property spelling. Project and preview creation now also reserve the live rolling-release and startup ports, so a newly allocated site cannot collide with an application that remains active on a rollout port. Design Studio navigation now keys component content to the selected catalog entry, and keyed For rendering now fulfills its typed array-accessor contract during mount and hydration.

• Added a complete dependency-free headless UI library aligned to the 37-family Base UI 1.6 catalog. Clank-native controllers expose canonical part anatomy, controlled and uncontrolled state with cancelable reasons, keyboard/focus and RTL behavior, native form projection and validation, document-scoped overlays, same-document portals, collision-aware floating parts, transition-aware presence, drawer snap points and swipe physics, SSR-stable IDs and hydration, Tailwind-ready data/CSS hooks, and frozen redaction-aware clank-ui/1 agent manifests. The package root, /ui, group modules, and every /ui/<family> subpath expose the library without adding React, Base UI, Floating UI, CSS-in-JS, or any other runtime dependency.

• Added a dependency-free signed blueprint registry protocol and clank registry CLI. Scoped Ed25519 publisher keys bind normalized data-only blueprints to exact semantic versions; separate registry keys bind monotonic catalogs to exact HTTPS origins, release digests, publisher keys, and traversal-safe relative paths. Explicit trust policies support roles, namespace/origin scopes, key/release revocation, and minimum catalog sequences. Remote install refuses redirects, mutable tags, cross-origin paths, wrong media types, oversized/slow responses, forged verified wrappers, remote generators, and install hooks before using the ordinary deterministic plan.

• Added typed, privacy-first product analytics in each application's isolated SQLite database. Finite event contracts accept only aggregate-safe properties, publish an immutable agent-readable manifest, and support bounded time-series, dimension, measure, and ordered-funnel queries. Every write requires consent, honors do-not-track, HMAC-pseudonymizes identity and retry keys, enforces deterministic sampling, retention, scan limits, idempotency, and an atomic storage ceiling; raw events and small cohorts are never exposed. A typed memory-only browser queue discards pending data when consent is withdrawn.

• Added dependency-free realtime collaboration primitives for presence, cursors, selections, typing state, and ephemeral signals. The Fetch + SSE hub re-authorizes exact room access on every request, requires the application's CSRF check for writes, enforces same-origin and bounded capacity/rate/data/idle leases, exposes identity-free diagnostics, and publishes immutable snapshots with room revisions. A Clank auth adapter and reconnecting reactive browser client make setup small while keeping persistent backend mutations and MCP actions authoritative.

• Added dependency-free semantic browser journeys with data-only definitions, stable agent/native control IDs, real isolated Chrome execution, same-origin and timeout boundaries, mobile viewport support, hydration/live-update waits, page-exception failure, value-redacted reports, atomic failure screenshots, and agent-readable CLI output. Environment-backed secret references enable login flows without putting passwords in journey files or reports; generated blueprint apps now include a mobile smoke journey and agent maintenance guidance. The npm README now links to the canonical hosted guides instead of duplicating the complete Markdown documentation corpus in every installation; full source documentation remains versioned in the repository and docs site, restoring durable headroom under the fixed 5 MiB unpacked package ceiling.

• Added typed durable workflow graphs over ordinary jobs. Explicit acyclic dependencies support parallel roots and typed result handoff; mutation starts atomically persist runs and ready jobs; owner-scoped idempotency, retries, cancellation propagation, structural release revisions, bounded run/step/event history, restart reconciliation, worker integration, preview-data purge, and revisioned MCP/backend graph manifests keep orchestration safe without another process or package.

• Added bounded, immutable per-document revision history and conflict-safe compensating restore. Typed queries inherit owned-table isolation; deletes retain recoverable snapshots; restores validate the current schema, require an observed version or deletion state, and append a new version without rewinding live revisions. Blueprint admin studios now server-render responsive timelines and expose role-checked history/restore browser and MCP actions that refresh after every mutation. Browser verification also corrected generated validators so nullable fields keep their default-aware wrappers. Sanitized preview branches always purge historical snapshots. Compiled JavaScript duplicates under examples/ remain in the repository and docs workflow but are omitted from the npm tarball; the TypeScript examples stay published, preserving the fixed 5 MiB package ceiling.

• Added opt-in sanitized preview database branches for local and provider placement. Policies are frozen in the active production release, table/row bounded, deterministic and per-preview keyed; auth/OAuth/jobs and unlisted data are purged, staging files are vacuumed and overwritten, target migrations and health gates run normally, failures preserve the prior preview, raw production copies and secrets remain unavailable, and CLI/UI/audit surfaces expose only aggregate reports. The internal code-audit and public-beta readiness ledgers stay in the repository and docs site but are omitted from the npm tarball to preserve the existing 5 MiB package ceiling without removing user documentation.
• AI blueprints now generate an optional, server-rendered admin studio with inferred or explicit privileged roles, an entity allowlist, read-only mode, schema and visibility summaries, responsive live data controls, and generated SSR/UI-to-MCP parity tests. Route access, backend action roles, record ownership, validation, and optimistic concurrency remain authoritative; the studio introduces no database bypass.
• Added an application-local, server-rendered agent access inbox and a no-store clank-agent-grants/1 API. Users can inspect, reduce to read-only, or revoke their own MCP OAuth token families with immediate per-request enforcement, CSRF protection, cross-user isolation, bounded listings, configurable per-user admission limits, and discovery metadata. The internal project maintenance ledger is no longer included in the npm tarball, preserving the existing 5 MiB unpacked distribution ceiling without removing user or operator documentation.
• Added clank compose, a provider-neutral conversational build loop with data-only blueprint proposals, bounded external-agent stdin/stdout protocols, sanitized process context, private resumable reviews, exact SHA-256 plan approvals, stale-baseline rejection, transactional writes, rollback on unsafe paths, agent-readable JSON results, and an interactive launcher path.

#0.13.0 - 2026-07-30

• Fixed the operator memory dashboard to render control-plane process attribution from the diagnostics API's controlPlane field instead of confusing it with control-database storage.
• Hardened the release gate against Node's occasional truncated experimental coverage artifact: it retries that exact all-tests-passed reporter failure once while continuing to fail immediately for test failures, threshold misses, and every other nonzero exit.
• Added a server-rendered, live-refreshed operator status for the local application trust boundary, runner kind, and signup mode, including a critical warning for public signup on trusted local execution.
• Added generation-bound provider filesystem-capacity telemetry with a path-free versioned protocol, version 1 rolling-upgrade compatibility, strict aggregate validation, and responsive platform-administrator dashboard reporting with tenant/token redaction.
• Added explicit platform-administrator provider failover from a revoked source runner to a healthy compatible target. Recovery requires recent browser authentication, CSRF, exact typed confirmation, separate source-fencing and recovery-point-loss acknowledgements, and a verified encrypted backup; it unpublishes old ingress, allocates a higher generation, preserves placement requirements and process-slot demand, rechecks source revocation before target publication, and records queue and activation audit events. Heartbeat loss alone never triggers stateful movement.

#0.12.0 - 2026-07-30

• Added optional hosted plan catalogs with exact public prices, account entitlement snapshots, browser checkout and portal flows, a server-rendered responsive Billing view, read-only clank billing output, and audited operator plan grants. Billing remains disabled by default and catalog-only installations require no payment service.
• Added a zero-dependency Stripe adapter with fixed-origin bounded requests, durable idempotent checkout attempts, raw-body HMAC webhook verification, live/test separation, exact plan/Price mapping and pre-checkout amount/currency/interval verification, replay/conflict detection, out-of-order event handling, provider-bound customer and subscription identities, and optional operator-tested API-version pinning.
• Plan entitlements now layer between installation defaults and explicit account/workspace overrides. Trialing and active subscriptions apply immediately, past-due plans receive a bounded grace interval, invalid or inactive state fails closed to the free plan, and a downgrade never deletes existing resources.

#0.11.0 - 2026-07-30

• Added secretless GitHub pull-request previews. clank preview github configure binds an immutable repository ID, generates commit-SHA-pinned deploy and trusted-base cleanup workflows, and exchanges GitHub Actions OIDC for a one-time, 15-minute token scoped to exactly one pull-N preview.
• GitHub preview federation verifies the fixed issuer/JWKS, RS256 signature, audience, repository name and ID, workflow path/SHA, event, ref, time window, and replay-resistant JWT ID. It is refused without HTTPS and provider/container isolation; production and sibling projects remain inaccessible, cleanup revokes every temporary preview token, and no raw identity or credential is persisted or audited.
• Provider-hosted projects now expose the same bounded job status/list/cancel/retry API and CLI as local projects through a private clank-provider-jobs/1 control contract. The transport binds exact node/release/generation identity, validates all query/body/response bounds and schemas, rechecks placement after transfer, and never returns job payloads, results, error text, identities, leases, paths, or credentials.
• Runner placement now reserves durable process slots instead of counting projects: one web slot plus every configured worker and scheduler. Selection and portable reassignment are transactional, insufficient capacity waits safely, heartbeat/re-enrollment cannot shrink below assigned demand, and the operator fleet shows used and free slots. Stateful provider SQLite remains pinned and fails closed rather than moving implicitly.
• Added durable invitation email delivery for workspace and personal onboarding with an encrypted transactional outbox, cross-control-plane leases, bounded retries, stable idempotency, stale-lease recovery, revocation fencing, visible delivery state, and log-safe fragment links.
• Added zero-dependency Resend delivery plus a provider-neutral HTTPS gateway configuration; manual copy-once invitation tokens remain the explicit fallback.
• Added automatic invite-link prefill for both new and existing accounts, CLI delivery status, and complete operator/security documentation.
• Server-backed controls can now pass typed backend function references directly to agentAction. New bounded inspection and parity APIs compare SSR or DOM controls with the no-store backend manifest and MCP contract revision, rejecting stale, internal, undocumented, unstable, or missing required UI actions. Blueprint-generated apps and the authenticated starter enforce the UI↔MCP contract from npm test.
• AI blueprints now own bounded clank-fixture/1 synthetic states and generated Node contract tests. Fixtures validate users, roles, values, references, creation order, and private ownership; generated suites exercise the real backend, exact agent manifest, isolated visibility, and every SSR route without shipping test data in deployment artifacts. Built-in authenticated and minimal starters also include discoverable npm test contracts.
• Added an integrated clank dev supervisor that runs the deployment-configured build and entry, watches relevant project files, health-checks replacements on private loopback ports, atomically swaps the local proxy, reloads connected browsers, preserves the last good process after build or candidate failures, bounds crash restarts and reload clients, and emits agent-readable clank-dev-event/1 lifecycle records.
• Removed the browser package barrel's eager node:fs/promises import so generated module applications execute hydration instead of stalling while resolving a Node-only module.
• AI blueprints now generate every declared static route and entity instead of collapsing the contract to one primary table. Generated apps include SSR/hydration state per route, role-aware navigation and field forms, reference selectors, live subscriptions or request/response refresh, exact declared action names, sparse updates, and safe CRUD fallbacks shared by browser RPC and each app's OAuth-scoped MCP server.
• Blueprint relationships now resolve an explicit or unambiguous reference field and enforce bounded transactional restrict, nullify, and acyclic recursive cascade behavior. Invalid or other-owner reference inputs return a public bounded error; ambiguous relationship storage, cross-ownership deletion, non-nullable nullification, cascade cycles, empty role policies, reserved routes, and generated type-name collisions fail before generation.
• Generated service requirements now participate in startup and readiness. clank dev supplies explicit development-only placeholders, while production fails closed when a required driver has not been provisioned.
• Added bounded BackendActionError failures for intentional application guards. Their safe status/code/message survive browser RPC and MCP tool calls without reporting them as internal faults, while the surrounding mutation still rolls back atomically.
• Reworked the AI blueprint guide and generated project/agent READMEs to document exact action, relationship, route, service, authorization, and per-app MCP behavior plus unresolved boundaries.
• Select bindings now attach after their options, so programmatic resets preserve declared defaults and empty reference placeholders. Generated development servers also serve framework modules with revalidation instead of production's immutable cache policy.
• Generated route navigation now wraps on narrow viewports instead of clipping the active route. Shutdown closes live runtime streams alongside the HTTP server and service drivers so long-lived connections cannot stall process termination.
• Blueprint code generation now applies JavaScript-source escaping after JSON serialization, including HTML delimiters and Unicode line separators, so even hostile human-authored text cannot form executable source or closing-script sequences.

#0.10.0 - 2026-07-30

#Added

• clank templates --json now exposes the versioned clank-template-catalog/1 starter catalog, and clank create --json returns a clank-create-result/1 project/file/next-command manifest. Scaffold names are now length/control bounded and inserted into TypeScript, TSX, and Markdown with context-safe encoding instead of raw placeholder replacement.
• Provider-hosted runtimes now expose a generation-bound private diagnostics surface. The complete provider keeps a 128 KiB/1,000-entry in-memory output tail, samples all current web/worker/scheduler containers through one bounded Docker stats call, and reports memory, memory limits, CPU, PIDs, network I/O, and block I/O without container IDs or environment values. The control plane authenticates the exact node/release/generation, refuses redirects or unbounded/malformed responses, rechecks placement after transfer, redacts project secrets, and shows provider resources and logs in the existing project UI.
• Provider-hosted recovery points can now be restored through the ordinary platform and CLI API. The control plane verifies the target, creates an encrypted provider safety backup, freezes the target ID/digest/size and safety ID into a durable replacement generation, and re-verifies the recovery point while building the private runtime capsule. The provider then drains the prior writer, takes its own exact safety snapshot, replaces SQLite, reapplies current migrations, health-checks the candidate, and publishes only the new generation.
• Provider restore timeouts resume the same durable intent without creating another safety copy. Failed exact operations can allocate a new monotonically fenced attempt only after both target and safety recovery points verify again. Pending retention protects both recovery points, queue and completion are audited, and successful completion keeps the ordinary immediate data rollback available.
• The built-in control plane now creates, schedules, lists, and verifies encrypted backups for provider-hosted projects. It binds export to the exact active pinned node/release/generation and allowlisted origin, refuses redirects and encoded/unbounded/mismatched responses, rechecks placement after transfer, and imports directly into local or S3-compatible encrypted recovery without plaintext disk staging.
• Brand-new provider projects now initialize their isolated SQLite database instead of incorrectly requesting preservation of data that cannot exist. Later and retry generations preserve the committed provider database.
• Runtime capsules can carry a distinct provider-control credential, and the complete provider service now exposes a private, generation-bound consistent SQLite snapshot endpoint. The credential is retained only as an in-memory digest, never shares public-ingress authority, and is revoked on drain, stop, failure, deletion, close, or restart until exact reconciliation.
• Encrypted recovery repositories can now import a bounded consistent SQLite byte snapshot without a local live-database path or plaintext staging file. Authenticated bounded reads make the same recovery point available to a fenced remote restore capsule, including through chunked S3-compatible object storage.
• The built-in control plane can now opt immutable projects and inherited previews into stateful provider placement. It freezes encrypted generation inputs, emits sensitive capsules only to a current lease, publishes only exact allowlisted observations, resumes pending deploys, supports fenced code/data rollback, survives restart, and confirms provider deletion before removing metadata. Local placement remains the default and existing projects never move.
• The CLI and control-plane project dialog expose explicit local | provider creation. Persisted deploy-attempt keys now survive provider-pending responses so an exact retry cannot create a duplicate release.
• A packaged clank-provider process runs the complete Docker provider lifecycle bridge and generation-bound private runtime ingress with environment-only resource and trust-boundary configuration.
• Deployment desired state now distinguishes portable from stateful placement. Stateful projects reserve one node identity across releases, stopped state, expiry, and credential revocation; unsafe implicit failover, mode changes, and pinned-region changes are rejected.
• Desired placement can durably require a private node endpoint and exact capability labels. Delayed placement keeps those constraints, and assigned nodes cannot shed required capabilities through heartbeat or credential rotation.
• A complete zero-dependency @clank.run/framework/provider-service composition now binds independently verified runtime capsules, durable operation/generation/fence intent, provider data recovery and migrations, isolated Docker activation, stopped desired state, and generation-bound private ingress. Exact response-lost and restart retries recover without process adoption; failed post-commit activation removes the candidate and remains retryable.
• The complete provider service now owns fenced rollback and confirmed project deletion instead of requiring callers to reach beneath a live runtime boundary. Both operations revoke traffic, drain requests, stop every writer, persist restart-safe destructive intent, and resume safely when a process exits after the data commit point.
• Provider agents and the authenticated HTTP bridge now carry canonical rollback and delete operations to those lifecycle methods. Confirmations are derived after lease validation, request bodies are forbidden, coordinator credentials never cross the provider boundary, and existing operation tables migrate in place without losing history or fence high-water marks.
• Docker runtime launch can defer workers and the scheduler until activate() runs after provider data commits. Provider data validation has a cleanup hook that must quiesce an exposed candidate before uncommitted SQLite rollback and leaves recovery journaled when cleanup is uncertain.
• Docker cleanup now re-enumerates exact owner/project/release/generation labels before forgetting a runtime, including when docker create persisted a container but reported failure.
• A zero-dependency @clank.run/framework/provider-docker reference launcher now starts the exact verified web, worker, and scheduler topology inside resource-bounded Docker containers, checks private health over loopback, and exposes only non-secret candidate metadata. Immutable images, non-root execution, read-only releases/root filesystems, project-only data mounts, bounded logs, owner-scoped orphan cleanup, generation fencing, graceful stop, close-race fencing, and restart reconciliation are enforced.
• Provider-prepared runtime data now carries the exact normalized config decoded from the verified capsule, so launchers cannot accidentally substitute another entry, database path, or job topology.
• A provider-private @clank.run/framework/provider-runtime registry now publishes overlapping application generations, validates the complete managed-ingress binding before dispatch, retains only a route-token digest, proxies only to loopback origins, and revokes then drains exact generations. URL/body/time/capacity bounds, reserved-header stripping, generic unavailable failures, response streaming, pre-auth activation-race leases, close fencing, retry-safe deactivation, and timed-out-drain retention are covered end to end.
• Managed ingress can now bind an allowlisted remote provider origin to an exact clank-runtime/1 generation and provider-local path. It overwrites reserved project/protocol/generation/ingress-token headers, binds health checks identically, keeps the secret out of public failures and metrics, rejects encoded path traversal, and fences circuit state from both generation changes and late replaced-generation responses.
• A zero-dependency provider data lifecycle now consumes independently verified clank-runtime/1 capsules, stages immutable releases, initializes/preserves/replaces project-isolated SQLite, applies immutable migrations, exports consistent snapshots, retains one rollback generation, and requires exact confirmations for rollback and deletion. Durable apply/rollback journals recover crashes around the atomic metadata commit point, while generation/fence high-water marks reject stale work.
• A versioned clank-runtime/1 binary capsule now binds one desired project generation to its verified release, final process environment, SQLite initialization/preservation/replacement intent, optional integrity-checked snapshot, and managed-ingress identity. The codec has strict section/aggregate limits and is exported as @clank.run/framework/runtime-placement.
• Current operation leases can fetch an exact no-store runtime capsule through the coordinator, and provider agents plus the authenticated HTTP provider bridge independently verify and bind it before infrastructure code runs. clank-runner exposes separate runtime transfer deadline and byte-ceiling settings.
• The remote deployment coordinator now supports administrator-created one-time enrollment tokens bound to an exact node and region. The responsive control-plane fleet panel reports node health, capacity, placement, work, and pending enrollment metadata and provides audited drain, reactivate, enrollment-revoke, and credential-revoke controls.
• clank-runner --check [--json] validates local configuration without consuming a fresh enrollment and authenticates an existing saved node credential when present. The packaged platform has an explicit CLANK_RUNNER_COORDINATOR=1 switch while preserving the closed, zero-cost single-host default and legacy shared enrollment compatibility.
• Production clank-platform starts in an explicit isolated hosting profile by default and selects the constrained Docker runner unless the operator deliberately chooses the low-cost trusted profile. Programmatic platform runtimes expose their resolved hosting profile and runner kind for diagnostics.
• Durable deployment coordination now has an optional, versioned HTTP transport and bounded client for remote nodes. A separate enrollment secret provisions hashed node credentials; authenticated nodes can heartbeat, drain, claim, renew, complete, fail, and report generation-fenced observations without access to the control database.
• A provider-neutral remote deployment-agent loop now handles credential-only restart and deliberate re-enrollment, heartbeats, bounded claims/concurrency, automatic operation renewal, fenced observations and settlement, redacted failures, graceful drain, and abortable shutdown. Persistent node credentials use a serialized, atomic, owner-only validated file store; a running node stops safely when credential rotation revokes its session.
• Current operation leases can fetch their exact content-addressed release through a bounded binary coordinator call. The platform optionally retains owner-only original uploads when remote enrollment is enabled, accounts for that storage, and verifies identity, node scope, lease fence, length, media type, and SHA-256 across the complete transfer.
• A provider-neutral ObjectStore now includes atomic owner-only local envelopes and a zero-dependency S3-compatible adapter. The S3 subset signs exact single-chunk payloads with SigV4, supports virtual-hosted and path-style endpoints plus temporary credentials, bounds retries, deadlines, and error bodies, and rehashes every downloaded object.
• Remote deployment enrollment can retain original release uploads in a configured ObjectStore instead of the control-plane volume. Each release persists its repository namespace and exact content-addressed key; leased reads, release cleanup, project deletion, legacy local releases, quota accounting, and provider failures are verified end to end.
• Encrypted SQLite recovery points can use a local or S3-compatible object repository. Remote backups use an authenticated per-database catalog and bounded immutable chunks, promote legacy local copies, retain a usable local copy after upload failure, verify the complete remote copy, apply retention across both locations, survive restarts, and are erased with platform-managed project storage.
• Deployed projects now have a responsive Jobs console plus clank jobs status|list|cancel|retry. The bounded API reports queue health, overdue work, expired leases, dead letters, and cron schedule state; cancellation/retry use conditional live-database transitions and durable audit events.
• Remote infrastructure integrations now have a credential-free DeploymentProvider contract, canonical desired-state validation, independent artifact verification, fenced observation, and the openProviderDeploymentAgent lifecycle wrapper.
• A zero-dependency authenticated HTTP provider bridge carries the original bounded binary release through a redirect-safe, retry-safe protocol, and the packaged clank-runner command connects that bridge to a remote control plane with persistent node credentials and graceful drain.
• Projects now support isolated, expiring preview environments through the control-plane UI/API and clank preview deploy|list|remove. Reusing a preview name refreshes its TTL and publishes a normal atomic release without changing the production project link.
• Generated templates and blueprint apps now compile minified Tailwind CSS during the ordinary Clank build, serve a same-origin static stylesheet, and omit the development-only browser CDN. clank build --tailwind=<source> can use the local CLI module or an explicitly configured standalone executable.
• Workspaces now have a durable clank-usage/1 monthly ledger, responsive server-rendered Usage console, and clank usage [--org] [--month] [--json]. It reports admitted requests, request bodies, declared response bytes, traffic-limit rejections, retained deleted-project totals, and current resource inventory without inventing streamed-byte or pricing data.
• Managed ingress now enforces inherited workspace UTC-month request/known-transfer limits and a per-project UTC-minute request ceiling in one SQLite admission transaction. New installation, account, and workspace limits appear in the existing operator editor; retention is bounded and pruned at startup and during traffic.

#Fixed

• Deployment operation fences are now allocated from a durable per-project sequence instead of restarting at one for each operation. Successive releases, concurrent claims, expired-lease reclamation, and process restarts therefore preserve the provider's stale-writer ordering contract; project deletion removes the matching sequence.
• Object-backed project backups now map URL-safe project IDs that begin with - or _ to a stable portable repository identity, instead of intermittently rejecting valid generated projects.
• Docker application environment is now delivered through one inert, name-only encoded envelope that the in-container Node bootstrap deletes before importing application code. Application variables such as DOCKER_HOST, LD_PRELOAD, proxy settings, and TLS settings can no longer control the host-side Docker client or executable, and secret values remain absent from process arguments.
• The first-account bootstrap response now waits for winner retention before reconciling the configured platform-administrator allowlist, so a new operator receives administrator access immediately instead of only after the control plane restarts.
• Revoked or expired runner placement is reconsidered transactionally, expired operation leases become retryable on the current assigned node with a higher fence, and running desired state without capacity remains durable until an eligible node appears.
• Draining deployment nodes can no longer claim queued operations. Lost/expired leases and shutdown deadlines abandon work without stale settlement, while a missing completion response no longer converts a possibly committed success into an explicit failure and duplicate retry.

#Security

• Provider-service metadata stores only exact non-secret desired-state bindings in bounded, owner-only, no-follow, atomically replaced files. Capsules are rehashed and decoded before that intent advances; lower generations/fences, conflicting same-generation capsules, and same-fence operation substitution fail before infrastructure mutation. Reconciliation drains before stopping a writer, defers background effects until commit, and activates ingress last.
• The provider Docker launcher delivers the final application environment through bounded container stdin after Node starts. Secret values are absent from host Docker environment variables, command arguments, labels, and persisted container environment metadata; the in-container bootstrap validates names and values before importing the verified entry. The host Docker process receives only an operator-controlled connection/context/proxy/locale allowlist.
• Provider data metadata is exact-field decoded, size-bounded, project-bound, owner-only, and confined to typed data/generation/recovery paths. Unsafe permissions, symbolic-link storage, conflicting capsule/desired-state bindings, changed database paths, stale fences, and corrupted state relationships fail closed. Runtime environment values and ingress tokens remain memory-only, and committed cleanup can never roll database bytes back under newer metadata.
• Runtime capsules require the exact current node and operation lease, use canonical stored desired state, recheck the lease after capsule loading, verify whole-body and nested section digests, and bind project/release/generation at the provider hop. Application secrets, SQLite bytes, and ingress tokens remain only in bounded HTTPS bodies and never enter URLs, headers, public failures, or durable operation results. Built-in provider activation is explicit and fail-closed; generation-bound backup and deletion are integrated, while provider restore awaits a separately fenced replacement-generation path.
• Managed runner enrollment stores only a high-entropy digest, caps active grants, requires a recent same-origin browser administrator session plus CSRF, rejects bearer/admin impersonation, expires automatically, reserves transactionally, commits once, rolls back failed registration, and excludes enrollment and node credentials from API and audit records.
• Unknown CLANK_RUNNER and CLANK_HOSTING_PROFILE values now fail at startup instead of silently selecting process execution. The isolated profile rejects the process runner, and the packaged control plane rejects public signup when applications share the platform Unix trust boundary.
• Remote-runner requests are HTTPS-only outside loopback, JSON-only, size- and time-bounded, redirect-safe, no-store, and disabled unless a dedicated high-entropy enrollment token is configured. Node and operation credentials remain plaintext only to their holder and hashed at rest; expired nodes and stale operation fences fail closed.
• File-backed node credentials reject symbolic links, non-files, oversized or malformed data, unsafe owners/modes, inode/path swaps, unsupported versions, and invalid tokens; reads use a no-follow descriptor and writes replace a 0600 file atomically. Executor exceptions stay in private node diagnostics by default instead of durable control-plane state.
• A node credential alone cannot fetch a release: artifact access also requires its exact unexpired operation token and fence. The provider never receives that token, redirects remain disabled, and platform-managed secrets and databases are not included in retained release archives.
• Remote object storage refuses insecure non-loopback endpoints, embedded credentials, redirects, unsigned payloads, dotted virtual-host ambiguity, unsafe keys, oversized streams, and incomplete or inconsistent Clank integrity metadata. Provider response bodies never become public errors.
• Failed or ambiguous release-object writes are cleaned before their quota reservation is released. A repository namespace mismatch refuses reads and deletion rather than silently interpreting an old release through a newly configured bucket or prefix.
• Object backups authenticate catalog and manifest metadata, verify every chunk's exact key, media type, length, and SHA-256, then recheck AES-GCM, plaintext length/digest, and SQLite integrity before restore. The platform persists its backup namespace and logical root and refuses startup after repository configuration drifts or disappears.
• Hosted job inspection omits arguments, results, error text, owner/group identity, worker identity, and lease credentials. Mutations require the dedicated jobs permission, remain blocked during support impersonation, serialize with deployment/data operations, and never place application payloads in platform audit metadata.
• Provider adapters never receive control-plane node or operation credentials. Their HTTP bridge requires a distinct high-entropy token, HTTPS outside loopback, exact bounded headers and bodies, fresh artifact digest/config verification, no redirects, generic public failures, and private diagnostics.
• Preview environments never inherit production databases or secrets, cannot be nested, count toward existing account/workspace project limits, are hidden under their production parent, and expire through the same path-safe storage, token-revocation, and audit lifecycle as manual deletion.
• Tailwind builds execute an exact local binary and argument array without a shell, restrict the source to the compiler input tree, write output atomically, and fail deployment when the compiler is unavailable instead of silently shipping unprocessed production CSS.
• Traffic admission receives only project/route IDs, normalized method, request bytes, and receipt time; paths, hosts, headers, cookies, IP addresses, query strings, and body content never enter its ledger. Invalid policy decisions fail closed, project-scoped tokens cannot read workspace usage, and deleted-project rows contain only bounded operational aggregates until expiry.

#0.9.4 - 2026-07-28

#Added

• Typed durable jobs now support transactional mutation enqueue, owner-scoped handlers, queue and group routing, priorities, delays, idempotency keys, renewable visibility leases, heartbeats, cooperative timeout/cancellation, fenced settlement, bounded exponential retry, dead letters, event history, retention cleanup, and operator retry/purge controls.
• Time-zone-aware five-field cron schedules now provide deterministic occurrence keys, deadlines, bounded catch-up, suspension, and allow/forbid/replace concurrency through an independently leased scheduler.
• Deployment config can declare independent worker processes and a scheduler. The platform supervises and restarts the process group, quiesces background code across rolling releases, resumes the prior set after candidate failure, attributes per-role memory, and exposes tagged logs. clank jobs worker|scheduler runs the same process contract on any provider.
• The authenticated starter now includes an atomic background job, standalone process entry, deployment topology, local scripts, and human/agent guidance.
• Platform administrators can issue personal-only signup invitations as an explicit alternative to workspace invitations. Personal invitations create an isolated account and its own workspace without granting membership in an operator workspace; both types remain email-bound, single-use, expiring, hashed at rest, revocable, and auditable.
• Platform administrators can now set durable, audited account and workspace quota overrides from the Control plane. Workspace capacity inherits from its owning account and then installation defaults; projects, domains, release count/storage, and encrypted-backup retention all enforce the resolved value at their transactional or locked mutation boundary.
• The documentation now includes a practical per-app MCP guide covering automatic query and mutation tools, application-specific auth and data isolation, Codex connection, and contract freshness as UI actions change.
• Clank now ships a shared three-color brand mark with favicon, compact UI, and Apple touch variants. The deployment control plane and documentation site both publish and display the same generated identity.

#Fixed

• The legacy openJobQueue service now uses an isolated compatibility table and migrates its old table name, allowing it to coexist with the typed job runtime without a schema collision.
• Running cancellation now fences a handler that returns before its next heartbeat, and a cancelled job left by a crashed worker becomes cancelled rather than an unclaimable retry.
• Sidebar navigation now uses one consistently sized SVG icon system instead of font glyphs with mismatched baselines and visual bounds.
• The control-plane sidebar now keeps the Clank mark and name together in one compact lockup while preserving the descriptor alignment.
• The protected-main documentation workflow now removes one oldest inactive artifact only when the docs project reaches its release limit, preserving uninterrupted automatic deployments without deleting the active release or bypassing immediate rollback protection.

#0.9.3 - 2026-07-27

#Added

• MCP-visible backend contracts now receive deterministic revisions derived from server identity, tool names, schemas, descriptions, scopes, and annotations. Revisions are exposed through runtime manifests, discovery documents, Server Cards, response headers, list-result metadata, and deployment-sensitive serverInfo.version values.
• Bounded MCP Streamable HTTP sessions and authenticated SSE notification streams now support notifications/tools/list_changed. A new application process rejects a prior release's session so compliant clients automatically reinitialize and rediscover actions after rolling deploys.

#Changed

• tools/list, resources/list, and resources/read now publish ttlMs: 0 and private cache scope, while public discovery requires revalidation. Unknown tool errors include a structured refresh hint instead of leaving clients with an unexplained stale call.
• Generated agent guides now require every UI operation that reads or persists server state to use the same typed backend query or mutation exposed through MCP, with manifest/tool parity included in the definition of done.

#0.9.2 - 2026-07-27

#Fixed

• MCP OAuth consent pages now permit form navigation to the exact validated callback origin. This prevents Chromium from blocking the successful 303 loopback redirect after consuming the one-time consent proof, while retaining same-origin form restrictions everywhere else.

#0.9.1 - 2026-07-27

#Added

• docs.clank.run now exposes a public, read-only MCP server with bounded list, search, and canonical Markdown retrieval tools plus stable Clank and MCP Server Card discovery.

#Fixed

• MCP OAuth consent no longer depends on extension or embedded-browser Origin behavior. Consent pages now receive a one-time, expiring proof bound to the authenticated session and exact OAuth request; approval consumes it atomically alongside the existing session CSRF check.
• Signed-out MCP OAuth now offers a same-origin password form that advances directly to consent, while retaining strict Origin checks, credential throttling, secure cookies, generic failures, and same-origin-only return paths.
• MCP authorization remains a direct, standards-based exchange between the application and the MCP client. Connecting an agent never requires the Clank deployment CLI, the Clank control plane, a callback relay, Tailscale, or copying an authorization response.

#0.9.0 - 2026-07-26

#Added

• Automatic MCP Streamable HTTP tools for every Clank backend function, public server discovery, typed action resources, conservative side-effect annotations, and an OAuth authorization-code flow with PKCE, resource-bound access tokens, read/write scopes, rotating refresh tokens, and authenticated application-user isolation.
• Successful protected-main CI revisions now automatically build, validate, and deploy docs.clank.run through a dedicated GitHub environment and a least-privilege project token.
• Documentation code fences now use dependency-free, server-rendered syntax highlighting for TypeScript, TSX, JavaScript, shell, JSON, SQL, HTML, CSS, configuration, and Mermaid examples.
• Code-only application deployments now launch and health-check candidates on spare ports, atomically switch managed ingress, drain requests already assigned to the prior upstream, and stop the prior release only after the route change.
• Platform administrators can now attribute live container memory across the control plane, each hosted application process, V8 heap, file cache, kernel memory, swap, and per-process peaks from the responsive admin console.
• Platform administrators can now reconcile mounted-volume usage with the control database, isolated project databases, releases, migration snapshots, encrypted recovery backups, orphaned directories, and filesystem overhead without exposing paths or file contents.

#Fixed

• The deployment platform now reserves its own HTTP listener from the application port allocator and deterministically reassigns persisted project conflicts during startup.
• Deployment artifact collection now ignores the compiler's atomic temporary files, preventing a concurrent framework build from producing a transient file or ENOENT failure in an otherwise deterministic bundle.
• Deployment packaging now retries a complete, metadata-verified source snapshot when files or directory entries change during collection, preventing concurrent cleanup or replacement from producing partial artifacts.
• Railway startup recovers project runtimes concurrently without delaying the public listener, shutdown drains HTTP and platform resources together, and automatic crash recovery can no longer race a user deployment.
• Managed-ingress circuit breakers no longer carry an unhealthy prior upstream's open circuit into a newly activated release.

#0.8.0 - 2026-07-26

#Added

• A dependency-free interactive launcher when clank runs in a terminal, with guided create, readiness, login, deploy, and help workflows plus authenticated and minimal full-stack templates.
• A secure managed-platform default for clank login, so normal hosted use connects to https://clank.run without a --server flag while self-hosted platforms retain an explicit override.
• The framework now publishes from the @clank.run npm organization as @clank.run/framework, with explicit public-registry, provenance, repository, documentation, and package-export metadata.
• A fully authenticated deployment dashboard with site status, 1-hour through 30-day ingress charts, releases, logs, and guided custom-domain setup.
• Transactionally enforced per-organization site and per-project custom-domain limits, with operator-configurable metric retention.
• Minute-level fixed-histogram ingress metrics plus DNS routing inspection and a Caddy On-Demand TLS permission endpoint for deployed built-in and verified custom hosts.
• Packaged-release conformance covering scaffold, browser and CLI auth, live synchronization, isolation, deployment, migration, failed health activation, rollback, and data restoration.
• GitHub CI and OIDC trusted-publishing release workflows.
• Security reporting, contribution, conduct, ownership, and release-governance documentation.
• Deterministic AI blueprints with plan, explain, and generated authenticated application files.
• Email verification, password recovery, email-code MFA, WebAuthn passkeys, organizations, RBAC, invitations, and project-scoped CLI tokens.
• Typed file, email, job, webhook, observability, encrypted backup, orchestration, ingress, custom-domain, external PostgreSQL, and database-provisioning drivers.
• ASVS-oriented evidence, threat modeling, chaos tests, CodeQL, immutable GitHub Actions, package/credential auditing, and a public-beta gate.
• Enforced line, branch, and function coverage floors plus a documentation audit that verifies local links, guide indexing, declaration synchronization, and package export targets.
• Storage-backed /healthz and /readyz probes alongside the process-only /livez endpoint.
• Bounded automatic custom-domain routing reconciliation with durable cross-control-plane leases, lookup deadlines, operator configuration, and dashboard status.
• Automatic verified encrypted database backups with durable cross-control-plane leases, configurable cadence and retention, private failure reporting, and dashboard controls.
• Enforced per-project release count/byte quotas plus rollback-scoped dashboard and CLI cleanup for inactive runtime artifacts and pre-deploy snapshots.
• Owner/admin-only permanent site deletion in the dashboard, API, and CLI with exact confirmation, explicit data-loss acknowledgement, scoped-token denial, path-safe storage removal, token revocation, and retained audit evidence.
• A role-filtered, cursor-paginated workspace activity feed in the dashboard, API, and CLI that retains deleted-site history and upgrades existing audit rows with organization attribution.
• Workspace people administration in the dashboard and CLI, including browser acceptance, member role changes, immediate removal, safe pending-invitation listing, one-time token copy, replacement, and revocation.
• Quota-aware workspace creation in the People console with safe slug preview and immediate selection.
• Durable SQLite-backed deployment-platform authentication and CLI device-start rate limits shared across control-plane runtimes and restarts.
• Command-aware human and JSON CLI help, agent-readable readiness diagnostics, generated README.md/AGENTS.md guides, and local-checkout scaffolding that does not require an npm release.
• Offline deterministic deployment dry-runs, structured deployment results with timing, one-command first-project naming/workspace selection, and retry-safe persisted idempotency attempts.

#Changed

• Authentication now defaults to an eight-character password minimum across framework and platform forms; applications can still require a higher value, and scrypt hashing, bounded concurrency, rate limits, and optional server-only peppering remain in place.
• The documentation site now begins with the published npm package and generated-app workflow, with hosted login examples consistently using the managed clank.run service.

#Fixed

• Deployment-console header controls now center their labels and icons consistently, while account quota totals retain readable spacing at narrow widths.
• Workspace invitations can now create their email-bound account and accept membership in one browser flow even when public registration is disabled or the one-time bootstrap is complete.
• First-account bootstrap is now protected by an expiring SQLite claim across control-plane runtimes, preventing concurrent processes from creating multiple initial accounts.
• Platform signup policy now evaluates the same normalized auth operation as the low-level router, closing repeated-slash registration bypasses.
• Sign-out and expired-session transitions now reload the deployment console at the identity boundary, clearing prior-account dashboard DOM and recomputing bootstrap availability before another account signs in.
• Successful password login now clears the exact failed-attempt rate-limit key instead of leaving the account throttled.
• CLI profile and project-link state is now bounded, structurally validated, URL-canonicalized, privately and atomically replaced, and never reflected in parse errors.
• CLI control-plane responses are streaming-bounded, decoded as strict UTF-8/JSON, and protected by finite request and deployment timeouts.
• Platform signal handling now closes both the HTTP listener and control-plane state, reports shutdown failures, and enforces a 30-second termination deadline.
• Project navigation now resets scroll position and closes the mobile drawer; the detail tab row stays within narrow viewports without a page-level horizontal scrollbar or clipped breadcrumb, and the console explicitly serves no favicon asset.
• The deployment console no longer renders or requests a logo asset or letter-mark treatment.
• Backup API responses no longer expose private host database paths.
• Repeated deployments can no longer grow retained release storage without an installation-defined ceiling.
• Site quotas can now be reclaimed without operator-side SQLite or filesystem edits.
• Managed ingress now fixes the upstream origin before applying a request path and streaming-bounds bodies without Content-Length, closing scheme-relative SSRF and unbounded-buffer paths.
• Pending custom-domain assignments can no longer be moved between projects; platform-owned DNS namespaces are reserved.
• Reissuing an invitation now revokes every older active token for that workspace/email, existing members cannot be reinvited, and active invitations are capped at 100 per workspace.
• Refreshed dashboard sessions now render one consistent authentication state and return to sign-in when a session expires.
• Failed distributed-lease acquisition now releases the local project queue.
• Managed ingress strips Connection-nominated headers and retries safe requests after transient upstream 5xx responses.
• WebAuthn CBOR parsing now bounds collection size and nesting, and passkey counter advancement is atomic.
• Blueprint suffix parsing and local-file endpoint normalization are linear on adversarial input.
• Unexpected deployment-platform failures are logged privately and never reflected to HTTP clients.
• Every HTTP/runtime adapter now keeps unexpected exception text private, and adversarial prefix, identifier, URL, and numeric-literal parsing is linear.
• CLI device login prints its browser approval URL without launching an operating-system command.
• The minimum runtime is Node 22.16, the first Node 22 release with the built-in SQLite backup API used by migrations and recovery.
• The official package name is @clank.run/framework, avoiding collision with unrelated unscoped packages while leaving the binaries as clank and clank-platform.
• Command-specific --help no longer authenticates or executes the command, dry-run deploys no longer require login, asynchronous CLI failures now reliably exit non-zero without stack traces, and unknown long options fail with spelling guidance instead of being ignored.
• Generated authenticated apps and bundled SSR examples now map the browser's actual @clank.run/framework module specifier, allowing their server-rendered screens to hydrate and become interactive.
• Hydration now cleans partially attached listeners, directives, keyed rows, and component ownership before fallback; only structural mismatches remount, lifecycle/application errors remain visible, and case-sensitive SVG plus foreignObject namespaces preserve their server nodes.
• Local deployment artifacts are now written through a private atomic replacement, preventing a pre-existing output symlink from redirecting CLI writes.

#0.7.0 - 2026-07-16

#Added

• AI-first runtime schemas, actions, semantic UI, forms, headless UI primitives, SSR, hydration, routing, SQLite backend, authentication, migrations, and the Clank deployment platform.
• Deterministic deployment artifacts, encrypted platform secrets, device authorization, health-gated activation, logs, audit history, and rollback.

#Changed

• Renamed the complete framework, CLI, storage, protocol, documentation, and deployment UI from Proact to Clank while preserving legacy data through compatibility readers and in-place migration.