Skip to content

Changelog

12 August 2026

14 changes:

  • Late writes into compressed chunks no longer have to be lost
  • print replaces the pdf document type, which had not worked for years
  • MariaDB stops pretending to be MySQL
  • The toolbar now sees what a page does after it renders, and can be opened on a live server
  • Nine queries per request, most of them avoidable
  • The SPA debug panel now says it exists
  • The docs now say when you would need them
  • The toolbar's hide button now hides the toolbar
  • spa:dev / spa:build, and a service container that actually exists
  • One toolbar, delivered two ways — and the SPA panel gains every tab
  • A name for every request, and the log lines it wrote
  • The server-rendered toolbar now uses the one renderer too
  • Settings read every key one at a time on PostgreSQL, and said nothing
  • SSE events published during a reconnect are no longer lost

11 August 2026

6 changes:

  • Five rolled-up views were frozen on every database without TimescaleDB
  • A model may give load() whatever parameters it needs
  • Five developer panels had been empty for years, and nothing said why
  • The rate limiter counted the proxy, and counted it badly
  • A human check that prices spam instead of pretending to detect it
  • getInstance() is a factory, and two call sites forgot

10 August 2026

16 changes:

  • pramnos init checks both Docker ports before proposing one
  • init scaffolds a working SPA — Svelte + daisyUI, Vite, Vitest and Docker
  • Files the container writes now belong to you, not to root
  • SPA follow-ups: the dev server, the site root, and the docs generator
  • The FK migration stops assuming the schema of tables it does not own
  • The scaffolded SPA now actually talks to the API
  • create:crud builds the SPA half too
  • A debug bar a SPA can actually use — and a guide for testing the front end
  • Generated CRUD gets real authorisation — and delete gets any at all
  • A SPA project gets an administration screen
  • cache:clear no longer wipes every installation sharing the backend
  • Signing in works, screens have URLs, and the SPA wears the project's colours
  • Permissions answers from whichever store the installation has
  • One permission system, available to every project with users
  • timescale:ensure — repairing hypertables on a database that got TimescaleDB late
  • The GDPR endpoints queried a table that does not exist

27 July 2026

8 changes:

  • Column comments are now applied when altering a table
  • Partial indexes and column ordering in the schema builder
  • Native enum types in the schema builder
  • Attribute-routed controller actions now dispatch
  • Auth controller tests no longer drop the shared users table
  • The test suite no longer leaves an app/ directory in the repo
  • Realtime: pluggable SSE + WebSocket backplane
  • Cross-cutting improvements: flat-key cache, log output modes, media alpha fix

21 July 2026

20 changes:

  • Activity log now writes on MySQL (schema-aware table probe)
  • SEO-friendly 404 for unknown controllers
  • Document::getInstance() no longer lets a stray ?format= hijack the response
  • View no longer triggers a PHP 8.5 "null array offset" deprecation
  • Scaffolded DataTables CRUD now works end-to-end
  • Controller scaffolding renders from a stub template
  • DebugBar "Views" panel now lists inserted partials
  • Full controllers always generate from one CRUD path (buggy heredoc removed)
  • Model scaffolding: one schema-first path, rendered from a stub
  • create:controller / create:model always generate full CRUD
  • Scaffolded CRUD now matches the admin look — server-side DataTable per theme
  • init seeds the admin user's name from the developer name
  • create:controller summary prints a ready-to-use test URL
  • API controller generator rendered from stubs (de-heredoc)
  • Generated model/controller tests are now schema-aware (real coverage)
  • Scaffolded auth tests fixed for the current login API + PHP 8.5
  • create:view --full unified onto the admin CRUD views
  • Scaffolding detects Select2 from project config, not the filesystem
  • Generated CRUD foreign keys load options via AJAX (Select2 remote)
  • Pramnos\User\User gains _getApiList() — FK special-case removed

19 July 2026

Unified token administration, admin breadcrumbs & session/stats fixes. Token management is now consolidated behind a single controller, the admin scaffolding pages gained a consistent breadcrumb trail, and several admin-UI defects (empty session lists, the JSON-dumping stats link, non-clickable token rows) are fixed across all three scaffold themes.

3 changes:

  • Unified token administration
  • Admin breadcrumbs
  • Fixes

17 July 2026

Account data export, admin fixes & scaffolding polish. Self-service GDPR data export with an app-extensible hook, consistent account navigation across all three themes, the admin Tokens/Token Actions fixes, the init admin-password prompt, project:switch-ui, and assorted DevPanel/email/cache fixes.

6 changes:

  • Self-service data export (GDPR) with an app-extensible hook
  • Consistent account navigation across all three themes
  • Admin Tokens & Token Actions pages fixed (all themes)
  • init prompts for the admin password (with a safe fallback)
  • New project:switch-ui command
  • Assorted fixes: DevPanel cache flush, email audit log, cache adapter

16 July 2026

Built-in login flow, account controller & passkey UI. The scaffoldable auth server takes shape: the overridable LoginFlow state machine, a built-in Account controller for login/verify/logout, branded built-in login views, passkey management + second-factor step-up, full auth-controller scaffolding, and the Upgrade Guide / DataTables BC note.

8 changes:

  • Account activity log, session tracking & active-device management
  • Account controller: built-in login / verify / logout
  • Built-in login views + branding seam
  • LoginFlow: the overridable password → step-up → session state machine
  • Passkey management page + reachable from the account UI
  • Passkey second-factor step-up + WebAuthn browser glue
  • Scaffolding exposes every auth controller
  • Upgrade Guide + DataTables aaData → data BC note