Skip to content

Changelog

19 July 2026

Unified token administration, admin breadcrumbs & session/stats fixes. Token management is now consolidated behind a single controller, the admin scaffolding pages gained a consistent breadcrumb trail, and several admin-UI defects (empty session lists, the JSON-dumping stats link, non-clickable token rows) are fixed across all three scaffold themes.

3 changes:

  • Unified token administration
  • Admin breadcrumbs
  • Fixes

17 July 2026

Account data export, admin fixes & scaffolding polish. Self-service GDPR data export with an app-extensible hook, consistent account navigation across all three themes, the admin Tokens/Token Actions fixes, the init admin-password prompt, project:switch-ui, and assorted DevPanel/email/cache fixes.

6 changes:

  • Self-service data export (GDPR) with an app-extensible hook
  • Consistent account navigation across all three themes
  • Admin Tokens & Token Actions pages fixed (all themes)
  • init prompts for the admin password (with a safe fallback)
  • New project:switch-ui command
  • Assorted fixes: DevPanel cache flush, email audit log, cache adapter

16 July 2026

Built-in login flow, account controller & passkey UI. The scaffoldable auth server takes shape: the overridable LoginFlow state machine, a built-in Account controller for login/verify/logout, branded built-in login views, passkey management + second-factor step-up, full auth-controller scaffolding, and the Upgrade Guide / DataTables BC note.

8 changes:

  • Account activity log, session tracking & active-device management
  • Account controller: built-in login / verify / logout
  • Built-in login views + branding seam
  • LoginFlow: the overridable password → step-up → session state machine
  • Passkey management page + reachable from the account UI
  • Passkey second-factor step-up + WebAuthn browser glue
  • Scaffolding exposes every auth controller
  • Upgrade Guide + DataTables aaData → data BC note

15 July 2026

Authorization core: capabilities, permissions & passkeys groundwork. The authorization stack lands: trusted-client silent consent, a client capabilities registry with manifest sync and push endpoint, the RBAC+ABAC permission grain and resolver with a live-fetch internal endpoint, instant permissions_changed webhook invalidation, feature-gated auto-migrations, and the passkey credential store + WebAuthn ceremonies.

10 changes:

  • Capabilities push endpoint
  • Client capabilities registry and manifest sync
  • Framework auto-migrations are now gated by enabled features
  • Internal permissions endpoint (live fetch)
  • Passkeys groundwork: credential store and WebAuthn library
  • Passkeys: WebAuthn registration & authentication ceremonies
  • Permission resolver (RBAC + ABAC, live-fetch read side)
  • Permissions grain: audience and ABAC conditions
  • Instant invalidation: permissions_changed webhook
  • Trusted clients: skip the OAuth2 consent screen (silent flow)

14 July 2026

Brand assets & theme-aware tooling. Official brand assets plus theme-aware log viewer, dashboard landing and new project: commands.

2 changes:

  • Official brand assets: docs logo, scaffolded favicons
  • Theme-aware log viewer, dashboard landing & project: commands