Changelog

Notable changes to AkurAI/Framework. The format follows Keep a Changelog; the project uses semantic versioning.

Unreleased

Added

• akurai-json builder API — Value::object(), set, remove, get_mut,

get_str/get_bool/get_i64, and escape(&str) so apps stop hand-rolling JSON mutation.

• akurai-http::health::Health — the shared /api/health envelope

(app, framework, framework_version, version, status, extra fields) with .response(); akurai serve now uses it.

• Reply::Raw — a handler may take the socket before any byte is

written (Reply::raw(|stream| …)), so app-owned protocol engines and handlers mid-migration run on the framework Server (pool, body limit, access log) without rewriting every response path first. Middleware passes raw replies through untouched.

Changed

• Conformance framework_version is a floor — [framework].version in

AKURAI_APPS.toml is the minimum; an app may pin that release or a newer one (upgrades land in Framework first and consumers move serially).

• Catalog: akurai-router is now framework_based = true (0.9.0); its

/api/health carries the full contract envelope.

0.9.0 - 2026-09-03

Added

• RateLimit middleware — per-client token bucket in akurai-http

(RateLimit::new(capacity, refill_per_sec)), 429 with Retry-After, peer-IP key by default with .with_key(…), bounded memory with stalest eviction. See Middleware.

• akurai-s3 — pure-std S3 client core: AWS Signature V4 header

signing and presigned URLs (all four AWS documented vectors pass), typed builders for ListObjectsV2 (delimiter/paging), Head/Put/Get/Copy/Delete, batch DeleteObjects, multipart (create/part-presign/complete/abort/list), bucket versioning, ListObjectVersions, lifecycle rules, and CreateBucket; std-only XML reader for responses. The socket is injected through a Transport trait (TLS stays app-side), so tests run against canned responses. See S3 storage.

• akurai-rand — pure-std OS-entropy (/dev/urandom) random bytes,

token_hex, unpadded base64url token_url, and bias-free uniform_u32. No fallback: minting fails loudly if the entropy device is unreadable. Auth session ids, salts, and OTP codes now use it; the SplitMix64 "CSPRNG-lite" and its module caveat are gone. See Random.

• akurai-hash — pure-std SHA-256 (one-shot + streaming Sha256),

HMAC-SHA256, and hex_lower, proven by NIST and RFC 4231 known-answer vectors. akurai-blobs gains content_id_sha256 / BlobStore::put_sha256 for collision-resistant ids (FNV default unchanged). See Hashing.

• Application conformance contract — akurai conformance validates the pinned

Framework release, AkurAI Build pipeline ordering, immutable artifact path, absolute Cargo dependency paths, and duplicated generic infrastructure across every registered app checkout.

• Shared lifecycle telemetry contract — akurai-telemetry provides a

versioned, privacy-validated event envelope plus bounded non-blocking delivery, recent duplicate suppression, time-bounded shutdown, and payload-free metrics for organization/workspace adoption facts.

• Forkbird assistant artwork — preserved Bunfork's original mascot and now

uses it for the built-in chat assistant avatar and conversation empty state without replacing AkurAI/Framework's product mark.

• Built-in access log — the HTTP server now writes one access line per

request to stderr by default (journald-friendly): peer address, method and target, status, body bytes, and duration. Malformed request heads are logged too (<malformed> -> 400). Opt out with Server::access_log(false).

• Request::peer — handlers can read the client socket address, stamped by

the server on every live connection.

• Display for Method — methods print their canonical wire spelling.

Removed

• RequestLogger middleware — superseded by the server's built-in access

log, which sees parse failures and the peer address that middleware never could. Drop it from your MiddlewareStack; logging now happens by default.

0.8.4 - 2026-08-24

Changed

• Maintenance release aligned suite consumers on Framework 0.8.4.

0.8.3 - 2026-08-24

Changed

• Maintenance release refreshed the shared release artifact and worker paths.

0.8.2 - 2026-06-27

Added

• Literal template raw blocks — the template engine now supports

{% raw %}...{% endraw %} so docs and examples can show {{ }} / {% %} syntax without the parser trying to execute it.

• Bearer-auth embeddings — akurai-vector now has embed_with_bearer and

embed_many_with_bearer, and generated collection APIs read AKURAI_EMBED_API_KEY so protected OpenAI-compatible routers can power semantic search.

• Animated 3D hero background — the home-page hero now has a lightweight live

Three.js gradient (Stripe-style mesh gradient, GPU-only), replacing the static illustration. Self-hosted Three.js, no CDN; CSS-gradient fallback and respects reduced-motion.

0.8.1 - 2026-06-26

Changed

• Refreshed the default AkurAI dark theme to a deeper navy palette with a

blue→mint accent — matching the AkurAI Drive look.

Docs

• New Themes page under Design System documenting all 17 themes and how to

use, adopt, and extend them.

0.8.0 - 2026-06-26

Added

• Named themes — pick from 17 colour themes (Nord, Claude Code, Catppuccin,

Solarized, Gruvbox, Tokyo Night, Rosé Pine, Dracula, AkurAI) in light and dark, generated by the Rust theme engine and served at /themes.css. Switch with the header picker; your choice is remembered and the OS light/dark setting is the default. Any app on the framework gets the same themes for free.

Docs

• Added an AkurAI-RustAgent agent OS UI contract for channel-aware timelines,

confirmations, questions, edit previews, artifacts, and typed receipts.

0.7.0 - 2026-06-26

Added

• A built-in AI chat UI and tool-result component library — a streaming chat

(/chat) backed by a new /api/assistant endpoint that talks to any OpenAI-compatible model, plus 27 tool-result components (charts, tables, forms, approvals, media, social cards, maps, and more) that turn a model's tool output into interactive UI. Explore the live gallery at /ai-components. It's a 1:1 port of assistant-ui + tool-ui into the framework's no-build native-ESM frontend — no React. Also added a root /llms.txt so LLMs can read the framework's map.

0.6.0 - 2026-06-26

Added

• SQL aggregates — COUNT, SUM, AVG, MIN, MAX and GROUP BY are now supported in SELECT, so apps can compute dashboard stats directly in a query.
• Passwordless email sign-in — sign in with a one-time 6-digit code sent to

your email (/login/otp), in addition to username + password. Codes expire after 10 minutes and lock out after 5 wrong tries. The framework hands the code to a pluggable sender (logged by default), so you wire in your own email.

• User roles — accounts are now user or admin, so apps can gate

admin-only pages. The built-in demo user is an admin.

0.5.0 - 2026-06-26

Added

• Static generation (SSG/ISR) — mark a route as prerendered and it's rendered

once and served from cache, with optional timed revalidation. Try /welcome.

• Internationalisation — translate your pages: per-locale message files, a

{{ t "key" }} template helper, and automatic language negotiation from the browser's Accept-Language.

• Error & loading boundaries — a navigation progress bar and a small helper

that shows a loading state, then your content, or a retryable error. See /boundaries-demo.

0.4.0 - 2026-06-26

Added

• Relations — link collections together: a relation field points at another

collection, and ?expand= inlines the referenced record on read.

• File uploads — upload files straight to a collection record (multipart), with

a content-addressed blob store and a download URL per file field.

• Typed client SDK — a generated JavaScript client (createClient()) with

per-collection CRUD methods, built from your API at runtime. Demo at /client-demo.

Changed

• Refreshed landing page — a two-column hero with a custom illustration and

gradient feature icons, all hand-authored SVG (no images, no external requests).

0.3.0 - 2026-06-26

Added

• Admin UI — a built-in admin at /admin to browse, create, edit, search, and

delete records in any collection, generated from your schema. No build step.

• SQL UPDATE and DELETE — the embedded database now updates and deletes

rows (with WHERE), on top of create/insert/select.

• CSS engine, now automatic — akurai serve/dev scans your markup and serves

a utilities.css of just the classes you use, regenerated live as you edit.

• Faster static assets — files are minified and content-hashed with long-cache

immutable headers out of the box.

0.2.0 - 2026-06-26

Added

• Auto-generated REST API — declare your data in backend/collections.toml

and the framework serves CRUD endpoints for it automatically: list, create, read, update, and delete records under /api/collections/<name>/records, with validation and a self-describing /api/_meta — no handler code. Three new from-scratch crates power it (a TOML parser, a collections engine, and a vector library), all pure std, zero dependencies.

• Semantic search — add ?search= to a collection and it ranks records by

meaning, using any OpenAI-compatible embeddings endpoint; with no endpoint configured it falls back to plain substring search.

Docs

• A new breaking-changes & migration guide under Docs → Reference, and a policy

that every breaking change is documented there and in the changelog.

• The contributor guide (AGENTS.md) is now split into focused per-domain files.

0.1.0 - 2026-06-26

Added

• SQL executor — the embedded database now runs queries: CREATE TABLE,

INSERT, and SELECT (with WHERE, ORDER BY, and LIMIT) execute over the B+tree storage engine, and your tables and rows survive a restart.

• Auth & sessions — built-in cookie-based login: a /login form, a protected

/account page, and /logout, all backed by the storage engine. Try the demo user demo / akurai.

• Islands & hydration — server-rendered pages can now become interactive in

just the regions you mark, with no flicker and no virtual DOM. See the /islands demo.

• Live component previews — the component catalog under Docs now shows each

component rendered live next to its copyable markup, instead of just code.

• One-line install — the home page has a copyable curl … | sh install

command, and akurai update self-updates the CLI to the latest release.

• SQL engine (parser) — a from-scratch SQL lexer + parser (SELECT / INSERT /

CREATE TABLE, with WHERE/ORDER BY/LIMIT) — the first half of the embedded database's query layer. Execution comes next.

• Data loaders — a route can name a JSON data file that's loaded into the

page, so data-driven pages need no code. See the /team demo.

• SPA router — optional client-side navigation that fetches and swaps page

content with smooth View Transitions, while plain links still work without it. See the /spa demo.

• Reactivity — a tiny native-JavaScript signals runtime with declarative

directives (data-text, data-model, data-for, …) — client interactivity with no build step and no dependencies. See the /reactivity demo.

• Layouts — pages can be wrapped in a shared shell template via a layout

field in routes.json. See the /welcome demo.

• Asset pipeline — content-hash fingerprinting and conservative CSS/JS

minification for long-term-cacheable static assets.

• Security headers + middleware — every response now passes through a

middleware chain that adds security headers (nosniff, frame-deny, referrer policy) and a response-time header.

• Atomic CSS engine — a new pure-Rust crate that scans your markup and emits

only the utility CSS you actually use (Tailwind-style, from scratch, no build).

• SEO — generated sitemap.xml and robots.txt, plus per-page titles and

descriptions for better search and social previews.

• Durable storage — the embedded B+tree database now backs live requests.

The /guestbook persists to disk: entries survive a server restart and a redeploy. No separate database server — it's one file in the binary's data dir.

• Form actions — the server now reads POST bodies and parses HTML forms.

Try the /guestbook: a plain form the server validates, stores, and redirects back from — works with JavaScript disabled, and entries are HTML-escaped.

• Dynamic routes — a declarative backend/routes.json maps URL patterns

(/posts/:id, /files/*path) to templates, with captured params available in the page as params. See the live /hello/:name demo.

• Dev live-reload — akurai dev watches your project and reloads the

browser on every change over SSE; no plugin, no build step. Production (akurai serve) is untouched.

• Router core — a pure-Rust URL pattern matcher (/posts/:id,

/files/*path) with specificity ranking — the foundation for dynamic routes.

• Bigger component library — the /components page now covers ~30

components across Actions, Forms, Data display, Feedback, Navigation, and Overlays, grouped by category with a quick index. Tabs, modals, toasts, dropdowns and the rest are all pure HTML/CSS with native-first behaviour.

• Realtime — WebSocket & SSE — bidirectional WebSockets (RFC 6455) and

Server-Sent Events, both pure std with zero dependencies and standards- compliant, so a browser's native WebSocket/EventSource connect directly. Demo endpoints /api/ws and /api/events; see Docs → Realtime.

• Design system docs — a foundations page (design tokens) and an extensive

component catalog (~60 components, from buttons to the admin shell) specifying the UI primitives the framework ships. Under Docs → Design system.

• Roadmap & status page — Docs → Roadmap now lays out, honestly, what the

framework ships today versus what's in progress or still planned, measured against Next, Vue, and Svelte.

• akurai-markdown — a pure-std Markdown→HTML renderer (headings, lists,

code blocks, blockquotes, inline code/bold/italic/links). Powers these docs.

• Framework website, served by the framework itself: an authentic landing

page, sidebar documentation, an API reference, this changelog, and a categorized /components library.

• akurai-template — server-side template engine ({{ }}, {% if %},

{% for %}, {% include %}) rendering against a JSON context.

• akurai-storage — single-file pager and B+tree node encoding; the

foundation of the embedded database.

• akurai-json — JSON value, parser, and serializer with exact int/float.
• akurai-http — hand-written HTTP/1.1 server, response builder, thread pool.
• CLI — akurai new scaffolds a project; akurai serve runs it.
• Deployment — the AkurAI Build pipeline publishes the static musl binary

through the maintained akurai-ec2 release operation with automatic TLS; live at akurai-framework.olibuijr.com.

Notes

• The shipped binary has zero runtime dependencies — the entire stack is

written from scratch on std.

0.0.1

Initial foundation: workspace, HTTP core, JSON, the bootstrap CLI, and the single-binary, zero-dependency thesis proven end to end.