AkurAI-Framework / site/content/changelog.md

Latest change d7fe19be2f456eff31bbb2b789e79c235c51dddb - akurai-toml: literal and multi-line strings, full escapes, inline tables by Ólafur Búi Ólafsson

# Changelog

Notable changes to AkurAI/Framework. The format follows
[Keep a Changelog](https://keepachangelog.com/); the project uses
[semantic versioning](https://semver.org/).

## Unreleased

### Added
- **`akurai-toml` strings and inline tables** — literal (`'...'`), multi-line basic (`"""..."""`) and literal (`'''...'''`) strings, `\uXXXX`/`\UXXXXXXXX`/`\r`/`\b`/`\f` escapes and single-line inline tables (`{ a = 1, b.c = 'x' }`), so content files can hold HTML fragments verbatim.
- **Microphone and audio in the Rust UI** — `platform::{record_start, record_stop, play_audio}` (browser `MediaRecorder` → base64 clip; `Audio` playback) with `testing::{recording, finish_recording, fail_recording, played_audio}`.
- **Global listeners from apps** — `akurai_ui::{listen, DOCUMENT, BODY, WINDOW}` are exported, so a page can hear the keyboard (a TV remote) whatever has focus.
- **`akurai_ui::http::event_source`** — Server-Sent Events in the Rust UI: named events, errors, closes with its scope; `testing::{open_streams, push_event, stream_error}` drive it in tests. See [Rust UI](/docs/rust-ui#live-data-httpevent_source).
- **WebSocket client** — `akurai_ws::connect_url` / `connect` dial another server (RFC 6455 §4.1 handshake, verified `Sec-WebSocket-Accept`) and return a `WsConn` in the client role: masked writes, unmasked reads. `WsConn::role()`, `frame::read_frame_with`, `frame::write_frame_masked`. See [Realtime](/docs/realtime#websocket-client).
- **File copies** — `AKURAI_FILE_COPY_DIR` + `AKURAI_FILE_COPY_COLLECTIONS` write every stored file of the listed collections to disk (multipart uploads and the image API alike). Replaces the image API's `AKURAI_IMAGE_SAVE_DIR`. See [Auto-API](/docs/auto-api#file-copies).
- **Live collection changes** — `GET /api/collections/events` streams every record create/update/delete as SSE (`?collection=a,b` filters), so pages mirror each other in real time. See [Realtime](/docs/realtime#live-collection-changes).
- **Image generation API** — `POST /api/images/generations` relays parameters to `AKURAI_IMAGE_URL` (OpenAI `data[]` or native `images[]`, `b64_json` or `url`), inlines `"blob:<id>"` params as data URLs, and stores the image in a collection `file` field with the declared params, upstream values and (when declared) `duration_ms`. See [Image generation API](/docs/images).
- **App version in health** — `/api/health` reports `<project>/VERSION` as `version` (framework version stays in `framework_version`).
- **`akurai_ws::base64::decode`** — standard padded base64 decoding next to `encode`.
- **Template comparisons** — `{% if a == "x" %}`, `{% if a != b %}` and `{% if x in list %}` (array membership or substring); operands are paths, `"strings"` or integers. Enables server-side form state restore (e.g. `<option{% if o == form.values.topic %} selected{% endif %}>`) without JS.
- **Form `test_mode`** — per-form flag: validates and redirects like a real submit but stores nothing, sends no mail and skips the rate limit, so live submit tests are repeatable.
- **Locale-aware forms** — with `locale_prefix`, declarative forms accept `POST /<code><path>`, localise error messages from the URL locale and prefix the `success` redirect.
- **Liquid-glass CSS kit** — `frontend/glass.css`: `--tint` token, `.glass`/`.glass-card`/`.glass-nav` surfaces, `.glass-aurora`, `.btn-glass`, `.glass-field` controls, focus ring, display serif stack, reduced-motion / no-backdrop / high-contrast fallbacks.
- **Contact-form recipe** — documented in [Forms](/docs/forms): bilingual contact form with consent, honeypot and mail notification.
- **Declarative forms** — `[[forms]]` / `[[forms.fields]]` in `akurai.toml`:
  field validation, durable store (`data/forms.db`), local-SMTP notification,
  `303` PRG with `422` error re-render (`form.errors`/`form.values`), honeypot,
  per-IP rate limit (`429` + `Retry-After`), localised `forms.error.*` messages.
  New glass classes `form-section`, `form-actions`, `form-error`, `hp`; `tel`,
  `url`, `number` and `search` inputs now share the base input style.
- **Configurable security headers** — `akurai_http::SecurityPolicy` middleware
  (strict default CSP `default-src 'self'`, `frame-ancestors 'none'`, HSTS,
  nosniff, referrer-policy, permissions-policy). `akurai serve` enables it when
  `akurai.toml` has a `[security]` section.
- **Path-prefix locales** — `routes.json` `"locale_prefix": true` serves the default locale at `/` and others at `/<code>`, sets `<html lang>` from the active locale, exposes `hreflang_links` (with `x-default`) for the head, and adds `xhtml:link` alternates to `sitemap.xml`.
- **Shared lifecycle telemetry contract** — `akurai-telemetry` provides a
  versioned, privacy-validated event envelope plus bounded non-blocking delivery,
  recent duplicate suppression, time-bounded shutdown, and payload-free metrics
  for organization/workspace adoption facts.
- **Forkbird assistant artwork** — preserved Bunfork's original mascot and now
  uses it for the built-in chat assistant avatar and conversation empty state
  without replacing AkurAI/Framework's product mark.
- **Built-in access log** — the HTTP server now writes one access line per
  request to stderr by default (journald-friendly): peer address, method and
  target, status, body bytes, and duration. Malformed request heads are logged
  too (`<malformed> -> 400`). Opt out with `Server::access_log(false)`.
- **`Request::peer`** — handlers can read the client socket address, stamped by
  the server on every live connection.
- **`Display for Method`** — methods print their canonical wire spelling.

### Removed
- **`RequestLogger` middleware** — superseded by the server's built-in access
  log, which sees parse failures and the peer address that middleware never
  could. Drop it from your `MiddlewareStack`; logging now happens by default.

## 0.8.2 - 2026-06-27

### Added
- **Literal template raw blocks** — the template engine now supports
  `{% raw %}...{% endraw %}` so docs and examples can show `{{ }}` / `{% %}`
  syntax without the parser trying to execute it.
- **Bearer-auth embeddings** — `akurai-vector` now has `embed_with_bearer` and
  `embed_many_with_bearer`, and generated collection APIs read
  `AKURAI_EMBED_API_KEY` so protected OpenAI-compatible routers can power
  semantic search.
- **Animated 3D hero background** — the home-page hero now has a lightweight live
  Three.js gradient (Stripe-style mesh gradient, GPU-only), replacing the static
  illustration. Self-hosted Three.js, no CDN; CSS-gradient fallback and respects
  reduced-motion.

## 0.8.1 - 2026-06-26

### Changed
- Refreshed the default **AkurAI** dark theme to a deeper navy palette with a
  blue→mint accent — matching the AkurAI Drive look.

### Docs
- New **Themes** page under Design System documenting all 17 themes and how to
  use, adopt, and extend them.

## 0.8.0 - 2026-06-26

### Added
- **Named themes** — pick from 17 colour themes (Nord, Claude Code, Catppuccin,
  Solarized, Gruvbox, Tokyo Night, Rosé Pine, Dracula, AkurAI) in light and dark,
  generated by the Rust theme engine and served at `/themes.css`. Switch with the
  header picker; your choice is remembered and the OS light/dark setting is the
  default. Any app on the framework gets the same themes for free.

### Docs
- Added an AkurAI-RustAgent agent OS UI contract for channel-aware timelines,
  confirmations, questions, edit previews, artifacts, and typed receipts.

## 0.7.0 - 2026-06-26

### Added
- **A built-in AI chat UI and tool-result component library** — a streaming chat
  (`/chat`) backed by a new `/api/assistant` endpoint that talks to any
  OpenAI-compatible model, plus **27 tool-result components** (charts, tables, forms,
  approvals, media, social cards, maps, and more) that turn a model's tool output
  into interactive UI. Explore the live gallery at `/ai-components`. It's a 1:1 port
  of assistant-ui + tool-ui into the framework's no-build native-ESM frontend — no
  React. Also added a root `/llms.txt` so LLMs can read the framework's map.

## 0.6.0 - 2026-06-26

### Added
- **SQL aggregates** — `COUNT`, `SUM`, `AVG`, `MIN`, `MAX` and `GROUP BY` are now supported in `SELECT`, so apps can compute dashboard stats directly in a query.
- **Passwordless email sign-in** — sign in with a one-time 6-digit code sent to
  your email (`/login/otp`), in addition to username + password. Codes expire
  after 10 minutes and lock out after 5 wrong tries. The framework hands the code
  to a pluggable sender (logged by default), so you wire in your own email.
- **User roles** — accounts are now `user` or `admin`, so apps can gate
  admin-only pages. The built-in demo user is an admin.

## 0.5.0 - 2026-06-26

### Added
- **Static generation (SSG/ISR)** — mark a route as prerendered and it's rendered
  once and served from cache, with optional timed revalidation. Try `/welcome`.
- **Internationalisation** — translate your pages: per-locale message files, a
  `{{ t "key" }}` template helper, and automatic language negotiation from the
  browser's `Accept-Language`.
- **Error & loading boundaries** — a navigation progress bar and a small helper
  that shows a loading state, then your content, or a retryable error. See
  `/boundaries-demo`.

## 0.4.0 - 2026-06-26

### Added
- **Relations** — link collections together: a `relation` field points at another
  collection, and `?expand=` inlines the referenced record on read.
- **File uploads** — upload files straight to a collection record (multipart), with
  a content-addressed blob store and a download URL per file field.
- **Typed client SDK** — a generated JavaScript client (`createClient()`) with
  per-collection CRUD methods, built from your API at runtime. Demo at `/client-demo`.

### Changed
- **Refreshed landing page** — a two-column hero with a custom illustration and
  gradient feature icons, all hand-authored SVG (no images, no external requests).

## 0.3.0 - 2026-06-26

### Added
- **Admin UI** — a built-in admin at `/admin` to browse, create, edit, search, and
  delete records in any collection, generated from your schema. No build step.
- **SQL `UPDATE` and `DELETE`** — the embedded database now updates and deletes
  rows (with `WHERE`), on top of create/insert/select.
- **CSS engine, now automatic** — `akurai serve`/`dev` scans your markup and serves
  a `utilities.css` of just the classes you use, regenerated live as you edit.
- **Faster static assets** — files are minified and content-hashed with long-cache
  immutable headers out of the box.

## 0.2.0 - 2026-06-26

### Added
- **Auto-generated REST API** — declare your data in `backend/collections.toml`
  and the framework serves CRUD endpoints for it automatically: list, create, read,
  update, and delete records under `/api/collections/<name>/records`, with
  validation and a self-describing `/api/_meta` — no handler code. Three new
  from-scratch crates power it (a TOML parser, a collections engine, and a vector
  library), all pure `std`, zero dependencies.
- **Semantic search** — add `?search=` to a collection and it ranks records by
  meaning, using any OpenAI-compatible embeddings endpoint; with no endpoint
  configured it falls back to plain substring search.

### Docs
- A new **breaking-changes & migration guide** under Docs → Reference, and a policy
  that every breaking change is documented there and in the changelog.
- The contributor guide (`AGENTS.md`) is now split into focused per-domain files.

## 0.1.0 - 2026-06-26

### Added
- **SQL executor** — the embedded database now *runs* queries: `CREATE TABLE`,
  `INSERT`, and `SELECT` (with `WHERE`, `ORDER BY`, and `LIMIT`) execute over the
  B+tree storage engine, and your tables and rows survive a restart.
- **Auth & sessions** — built-in cookie-based login: a `/login` form, a protected
  `/account` page, and `/logout`, all backed by the storage engine. Try the demo
  user `demo` / `akurai`.
- **Islands & hydration** — server-rendered pages can now become interactive in
  just the regions you mark, with no flicker and no virtual DOM. See the
  `/islands` demo.
- **Live component previews** — the component catalog under Docs now shows each
  component *rendered live* next to its copyable markup, instead of just code.
- **One-line install** — the home page has a copyable `curl … | sh` install
  command, and `akurai update` self-updates the CLI to the latest release.
- **SQL engine (parser)** — a from-scratch SQL lexer + parser (SELECT / INSERT /
  CREATE TABLE, with WHERE/ORDER BY/LIMIT) — the first half of the embedded
  database's query layer. Execution comes next.
- **Data loaders** — a route can name a JSON `data` file that's loaded into the
  page, so data-driven pages need no code. See the `/team` demo.
- **SPA router** — optional client-side navigation that fetches and swaps page
  content with smooth View Transitions, while plain links still work without it.
  See the `/spa` demo.
- **Reactivity** — a tiny native-JavaScript signals runtime with declarative
  directives (`data-text`, `data-model`, `data-for`, …) — client interactivity
  with no build step and no dependencies. See the `/reactivity` demo.
- **Layouts** — pages can be wrapped in a shared shell template via a `layout`
  field in `routes.json`. See the `/welcome` demo.
- **Asset pipeline** — content-hash fingerprinting and conservative CSS/JS
  minification for long-term-cacheable static assets.
- **Security headers + middleware** — every response now passes through a
  middleware chain that adds security headers (nosniff, frame-deny, referrer
  policy) and a response-time header.
- **Atomic CSS engine** — a new pure-Rust crate that scans your markup and emits
  only the utility CSS you actually use (Tailwind-style, from scratch, no build).
- **SEO** — generated `sitemap.xml` and `robots.txt`, plus per-page titles and
  descriptions for better search and social previews.
- **Durable storage** — the embedded B+tree database now backs live requests.
  The `/guestbook` persists to disk: entries survive a server restart and a
  redeploy. No separate database server — it's one file in the binary's data dir.
- **Form actions** — the server now reads POST bodies and parses HTML forms.
  Try the `/guestbook`: a plain form the server validates, stores, and redirects
  back from — works with JavaScript disabled, and entries are HTML-escaped.
- **Dynamic routes** — a declarative `backend/routes.json` maps URL patterns
  (`/posts/:id`, `/files/*path`) to templates, with captured params available in
  the page as `params`. See the live `/hello/:name` demo.
- **Dev live-reload** — `akurai dev` watches your project and reloads the
  browser on every change over SSE; no plugin, no build step. Production
  (`akurai serve`) is untouched.
- **Router core** — a pure-Rust URL pattern matcher (`/posts/:id`,
  `/files/*path`) with specificity ranking — the foundation for dynamic routes.
- **Bigger component library** — the `/components` page now covers ~30
  components across Actions, Forms, Data display, Feedback, Navigation, and
  Overlays, grouped by category with a quick index. Tabs, modals, toasts,
  dropdowns and the rest are all pure HTML/CSS with native-first behaviour.
- **Realtime — WebSocket & SSE** — bidirectional WebSockets (RFC 6455) and
  Server-Sent Events, both pure `std` with zero dependencies and standards-
  compliant, so a browser's native `WebSocket`/`EventSource` connect directly.
  Demo endpoints `/api/ws` and `/api/events`; see Docs → Realtime.
- **Design system docs** — a foundations page (design tokens) and an extensive
  component catalog (~60 components, from buttons to the admin shell) specifying
  the UI primitives the framework ships. Under Docs → Design system.
- **Roadmap & status page** — Docs → Roadmap now lays out, honestly, what the
  framework ships today versus what's in progress or still planned, measured
  against Next, Vue, and Svelte.
- **akurai-markdown** — a pure-`std` Markdown→HTML renderer (headings, lists,
  code blocks, blockquotes, inline code/bold/italic/links). Powers these docs.
- **Framework website**, served by the framework itself: an authentic landing
  page, sidebar documentation, an API reference, this changelog, and a
  categorized `/components` library.
- **akurai-template** — server-side template engine (`{{ }}`, `{% if %}`,
  `{% for %}`, `{% include %}`) rendering against a JSON context.
- **akurai-storage** — single-file pager and B+tree node encoding; the
  foundation of the embedded database.
- **akurai-json** — JSON value, parser, and serializer with exact int/float.
- **akurai-http** — hand-written HTTP/1.1 server, response builder, thread pool.
- **CLI** — `akurai new` scaffolds a project; `akurai serve` runs it.
- **Deployment** — the AkurAI Build pipeline publishes the static musl binary
  through the maintained `akurai-ec2 release` operation with automatic TLS;
  live at `akurai-framework.olibuijr.com`.

### Notes
- The shipped binary has **zero runtime dependencies** — the entire stack is
  written from scratch on `std`.

## 0.0.1

Initial foundation: workspace, HTTP core, JSON, the bootstrap CLI, and the
single-binary, zero-dependency thesis proven end to end.