# Changelog

## 2026-09-04 - 8.2.4

### Fixes

- re-arm platform templates during service upgrades (service-template-env)
  - Prefer platform-owned App Store template declarations over stored public environment literals while preserving operator overrides for non-templated values.
  - Keep service-intrinsic templates frozen to preserve install-time validation semantics.
  - Add an offline migration repair command to re-arm previously frozen templated environment values for stopped cutover services.
  - Behaviour change: an app template whose public declaration references an absent optional launcher-environment secret now fails its upgrade during validation instead of deploying a stale literal.

## 2026-09-04 - 8.2.3

### Fixes

- skip rehearsal-only inspect during production keyring preparation (cloudly-secrets-v2-cutover)
  - Removes the redundant inspect command from the production prepare path to avoid AUTHORIZATION_INVALID after a production binding is written.
  - Updates cutover test expectations to validate blocked replay behavior through keyring-check only.

## 2026-09-04 - 8.2.2

### Fixes

- settle production cutovers with recorded provisioned Mongo credentials (cloudly-secrets-v2-cutover)
  - Builds the production settlement Mongo environment from the platform provision for the service's recorded database resource.
  - Rejects production settlement when the provisioned database identity differs from the recorded resource.
  - Updates cutover tests to cover recorded database binding and mismatched provision refusal.

## 2026-09-04 - 8.2.1

### Fixes

- report MongoDB descriptor inconsistencies safely (settlement-mongo)
  - Replace the generic settlement MongoDB consistency error with field-level mismatch names while withholding secret values.
  - Report multiple MongoDB URL/environment disagreements together and include the relevant environment key names.
  - Add tests covering safe error messages for database, credential, password, and scheme mismatches.
- handle malformed MongoDB credential encoding in settlement validation (settlement-secrets)
  - Safely compares percent-encoded MongoDB username and password fields without throwing URIError on malformed sequences.
  - Adds regression coverage to preserve descriptive validation errors for malformed credentials.

## 2026-09-04 - 8.2.0

### Features

- add offline cutover backup repair migration command (cli)
  - Adds migration repair-cutover-backup <service-name> to restore cleared Cloudly cutover backup identities when startup validation prevents the daemon from running
  - Initializes offline maintenance for the repair and shuts it down after completion
  - Documents the new migration command in CLI help

## 2026-09-04 - 8.1.1

### Fixes

- preserve and repair superseded backup identities (cloudly-secrets-v2-cutover)
  - Keep pinned schema-5 supersession backups when retiring rehearsals so operations remain backup-verified.
  - Add a repair-superseded-backup command that restores a cleared backup from the supersession audit for damaged held operations.
  - Add regression coverage for repairing wrongly cleared superseded backups.

## 2026-09-03 - 8.1.0

### Fixes

- settle production during keyring preparation (cloudly-secrets-v2-cutover)
  - Run schema-5 production settlement at the start of prepare-keyring before Cloudly reads production data.
  - Make production settlement stage-aware so keyring preparation and execution use their own operation fences.
  - Keep execution settlement as an idempotent backstop for operations that reach execution unsettled.
  - Add regression coverage for keyring-prepare fence preservation and settlement idempotency.
- allow rehearsal retirement to supersede stale keyring prepare intent (cloudly-secrets-v2-cutover)
  - Clear stale prepare-keyring intents before starting rehearsal retirement when the failed prepare persisted no production state.
  - Add regression coverage for retiring a rehearsal wedged by a failed prepare-keyring intent.

### Features

- add rehearsal retirement for fresh cutover baselines (cloudly-secrets-v2-cutover)
  - Add a retire-rehearsal CLI action that returns rehearsed cutover operations to held for re-baselining
  - Record retired rehearsal identities and retirement evidence while clearing stale backup, scratch, run id, and rehearsal receipt state
  - Refuse retirement after downstream production, keyring, or settlement steps and re-prove scratch absence before discarding allocation references
  - Document the re-baselining workflow and add coverage for retirement, refusal, and fresh backup re-entry
- add ledger-backed startup migration rewind (migrations)
  - Run startup migrations through a strict data-version migration ledger.
  - Add `migration rewind <data-version>` to revert startup migration steps above a target so they rerun on next boot.
  - Refuse forward rewind targets and document the supported rewind workflow.

## 2026-09-03 - 8.0.2

### Fixes

- validate full diagnostics envelope for blocked cutover outputs (cloudly-secrets-v2-cutover)
  - Apply the diagnostics schema to every CUTOVER_BLOCKED command instead of only inspect.
  - Reject legacy short blocker envelopes in safe Cloudly output validation.

## 2026-09-03 - 8.0.1

### Fixes

- encode Cloudly settlement requests as canonical stdio frames (cloudly-settlement)
  - Writes settlement requests using Cloudly's canonical stdio frame encoder before running the maintenance container.
  - Updates the settlement responder test helper to reject non-canonical request frames while keeping responses as plain JSON.

## 2026-09-03 - 8.0.0

### Breaking Changes

- migrate log streaming to TypedRequest 8 virtual streams (opsserver)
  - Upgrades TypedRequest, TypedRequest interfaces, TypedServer, TypedSocket, Dees, and catalog dependencies to new major versions.
  - Creates outbound ops log and event streams through typedsocket with admin identity-bound virtual stream authorization.
  - Serializes virtual stream writes, applies Docker log stream backpressure, and aborts or cleans up on stream failures.
  - Updates log stream response interfaces to requester-local TVirtualStream<'receive'> streams.
  - Refreshes the smartregistry and taskbuffer floors so the installed tree resolves the same single TypedRequest runtime the compiled binary embeds.

## 2026-09-03 - 7.14.1

### Fixes

- publish release artifacts for the legacy deployment settlement release (release)
  - Cut a follow-up patch release so the tagged tree ships its platform binaries, package tarball, checksums, and third-party notices.

## 2026-09-03 - 7.14.0

### Features

- add legacy deployment settlement for schema 5 cutovers (cloudly-secrets-v2)
  - Run scratch and production settlement flows with a pinned Cloudly 25.1.0 settlement image and private-file stdio transport.
  - Persist authenticated settlement artifacts as encrypted service secrets while checkpointing only digests, byte counts, attempt ids, and dispositions.
  - Verify settlement artifacts in-process through @serve.zone/interfaces runtime contracts and support lost apply response resolution.
  - Upgrade the pinned Corestore runtime and dependency to 6.3.0 for database grants and platform migration replay.

### Fixes

- update package manager and development dependencies (deps)
  - Bump pnpm from 11.22.0 to 11.25.0
  - Update @git.zone/tsbundle from ^2.11.4 to ^2.13.0
  - Update @types/node from ^26.2.0 to ^26.4.1

## 2026-08-17 - 7.13.0

### Features

- retire schema-4 rehearsal scratch before target advance (cloudly-secrets-v2)
  - Add durable retire-rehearsal-for-target-advance intent validation for prepared, retiring, and retired schema-4 rehearsal states
  - Clean allocation-fenced scratch databases idempotently before schema-5 supersession and verify absence during persistence and resume
  - Allow schema-5 target advance from clean or retired schema-4 predecessors while rejecting unrelated state changes
  - Add backup manager and cutover coverage for rehearsal retirement workflows

## 2026-08-17 - 7.12.0

### Features

- add exact schema-5 Cloudly target supersession (cloudly-secrets-v2)
  - Pins App Store 1.1.6 from `@serve.zone/appstore` 2.5.0 and the released Cloudly 24.1.0 OCI identities.
  - Advances only clean schema-4 operations while preserving their complete predecessor, backup, WorkloadInit authority, optional keyring digest, runtime hold, and immutable audit evidence.
  - Rejects private secret, staging, maintenance-container, and runtime residue before the revision-fenced schema-5 persistence boundary.
- upgrade the pinned Corestore runtime to 5.2.1 (corestore)
  - Selects the released Corestore 5.2.1 image for fresh deployments, diagnostics, and replay while retaining exact historical cleanup and migration identities.
  - Adds allocation-fenced schema-5 backup rehearsal coverage and upgrades the nested SmartDB runtime to 4.2.1.

### Fixes

- stop deleting older releases in release workflow (release)
  - Removed the cleanup step that deleted releases beyond the latest four after publishing.
- bump pnpm package manager to 11.22.0 (package-manager)
  - Updates packageManager from pnpm@11.21.0 to pnpm@11.22.0.

## 2026-08-15 - 7.11.0

### Features

- support Cloudly diagnostics schema 8 settlement projections (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 24.0.0 image digest.
  - Requires diagnosticsVersion 8 and includes deploymentSettlementProjection in safe diagnostic summaries.
  - Validates deployment-settlement envelope counts, invalid service-envelope aggregates, classifier results, bounds, and evaluated-facet consistency.
  - Adds the released diagnostic/Corestore image tuple for cleanup replay and updates documentation and tests.

## 2026-08-14 - 7.10.0

### Features

- support Cloudly diagnostics schema 7 predicate evidence (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 23.0.0 image digest.
  - Requires diagnosticsVersion 7 and validates fixed Corestore projected-identity predicate counts, bounds, and aggregate consistency.
  - Requires deployment-settlement classification mismatch sites to match the released allowlist and mismatch facet evidence.
  - Adds the released diagnostic/Corestore image tuple for cleanup replay and updates documentation and tests.

## 2026-08-14 - 7.9.0

### Features

- support Cloudly diagnostics schema 6 facets (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 22.0.0 image digest.
  - Requires diagnosticsVersion 6 and validates the expanded approved diagnostic facet set.
  - Replaces schema 5 coarse facets with schema 6 ownerless-bundle, Corestore, and deployment-settlement evidence facets.
  - Adds the released Cloudly 22.0.0 diagnostic image tuple for cleanup replay and updates tests and documentation.

## 2026-08-14 - 7.8.0

### Features

- support Cloudly diagnostics schema 5 facets (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 21.0.0 image digest.
  - Requires diagnosticsVersion 5 and validates approved diagnostic facet names, counts, ordering, uniqueness, and bounds.
  - Includes diagnosticFacets in safe diagnostic summaries and blocked inspection output.
  - Adds the released Cloudly 21.0.0 diagnostic image tuple for cleanup replay and documents schema 5 behavior.

## 2026-08-14 - 7.7.0

### Features

- support Cloudly diagnostics schema 4 (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 20.0.0 image digest.
  - Requires diagnosticsVersion 4 for safe inspect output and approves the new ownerless bundle and Corestore binding evidence blocker reasons.
  - Allows cleanup replay for exact diagnostic/Corestore image tuples emitted by released versions while rejecting unknown or mixed tuples.

## 2026-08-14 - 7.6.0

### Features

- support Cloudly diagnostics schema 3 (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 19.3.0 image digest.
  - Requires diagnosticsVersion 3 for safe inspect output and rejects schema 2 output.
  - Adds approved schema 3 blocker pairs for explicit null Corestore legacy references and platform binding environment candidates.

## 2026-08-14 - 7.5.3

### Fixes

- upgrade pinned Corestore runtime to 5.1.2 (corestore)
  - Bumps @serve.zone/corestore and the pinned Corestore image digest to the 5.1.2 release.
  - Updates default deployments and diagnostic read-grant runtime checks to require the exact 5.1.2 image.
  - Adjusts Corestore platform replay so 5.0.0 is accepted only as a completed replay source and rejected for unfinished cutovers.

## 2026-08-13 - 7.5.2

### Fixes

- allow schema-4 Cloudly scratch rehearsal replay (cloudly-secrets-v2)
  - Apply the existing allocation and ownership fences to schema-4 rehearsal provision, restore, and cleanup.

## 2026-08-13 - 7.5.1

### Fixes

- validate production-shaped backups after schema-4 supersession (cloudly-secrets-v2)
  - Keep the authenticated schema-3 predecessor backup and full-restore evidence valid after the fenced schema-4 transition.
  - Preserve strict legacy backup-shape validation before supersession.

## 2026-08-13 - 7.5.0

### Features

- add schema-4 Cloudly target supersession and WorkloadInit authority fencing (cloudly-secrets-v2)
  - Pins App Store 1.1.5 from `@serve.zone/appstore` 2.4.0 and the released Cloudly 19.2.0 OCI index and platform identities.
  - Supersedes eligible schema-3 state through a dedicated CAS while preserving the complete predecessor audit and leaving predecessor scratch resources inert.
  - Accepts verified WorkloadInit active or revoked artifacts through bounded root-local multiline stdin and stores them in a reserved encrypted root-only secret file.
  - Applies strictly higher-generation authority changes to promoted runtimes through crash-safe intent, secret CAS, runtime recreation, startup hold, and immutable checkpoint history.

## 2026-08-10 - 7.4.0

### Features

- support Cloudly diagnostics schema 2 (cloudly-secrets-v2)
  - Pins diagnostic inspection to the Cloudly 19.0.0 image digest.
  - Requires diagnosticsVersion 2 for safe inspect output and rejects schema 1 output.
  - Adds approved schema 2 blocker reasons for bundle ownership, Corestore legacy references, managed deployment operations, and platform credential migration blockers.

## 2026-08-09 - 7.3.2

### Fixes

- update @apiclient.xyz/docker to 7.6.1 (deps)
  - Bumps @apiclient.xyz/docker from 7.6.0 to 7.6.1.

## 2026-08-09 - 7.3.1

### Fixes

- harden Corestore 5.0.0 replay and failed candidate cleanup (corestore-platform)
  - Pin the Corestore platform image to the released 5.0.0 digest used for database read grants.
  - Clean up failed platform service candidates and preserve aggregate reconciliation errors when cleanup or persistence fails.
  - Restrict completed Corestore migration replay to known 4.5.0 sources while retrying interrupted 5.0.0 startup safely.
  - Document the explicit offline Corestore 5.0.0 replay and recovery requirements.

## 2026-08-09 - 7.3.0

### Features

- add rehearsal diagnostic inspection command (cloudly-secrets-v2)
  - Adds cloudly-secrets-v2 diagnose to run a non-mutating rehearsal diagnosis under the cutover lock and print validated JSON output.
  - Uses a fixed 12-minute Corestore 5.0.0 read-only grant, delivers its MongoDB URI only over stdin to an auto-removing diagnostic container, and durably journals revocation plus cleanup for crash recovery.
  - Pins diagnostic inspection to the released Cloudly 18.1.0 image digest while keeping cutover target commands on the existing target image.
  - Validates diagnostics schema 1 blocker reasons and aggregate counts, rejecting malformed diagnostic output without echoing untrusted values.
  - Serializes diagnosis and journal reconciliation globally, cancels Docker attach and wait transports, proves the complete adopted execution identity, bounds Corestore error bodies, and reconciles every valid journal without capacity lockout.
- secure diagnostic inspection with Corestore read grants (cloudly-secrets-v2)
  - Run Cloudly diagnostics with fixed 12-minute Corestore 5.0.0 read-only grants passed only over stdin to auto-removing diagnostic containers.
  - Persist diagnostic grant and container journals for crash-safe revocation and cleanup reconciliation.
  - Add validated Corestore grant issue/revoke client support with bounded private control API responses.
  - Update diagnostic inspection to the Cloudly 18.1.0 image digest and bump related Corestore and Docker dependencies.

## 2026-08-08 - 7.2.1

### Fixes

- validate schema-3 scratch ownership against Corestore identity (cloudly-secrets-v2-cutover)
  - Require schema-3 scratch resource names to match the current Corestore database identity for the scratch service.
  - Keep legacy scratch resource name validation compatible with existing pre-schema-3 state.
  - Update cutover and backup-manager tests to derive scratch resource names from the Corestore identity helper.

## 2026-08-08 - 7.2.0

### Features

- add schema 3 rehearsal gate for cutovers (cloudly-secrets-v2)
  - Adds the cloudly-secrets-v2 rehearse command and a rehearsed phase before production keyring preparation.
  - Pins the Cloudly cutover target to App Store 1.1.4 with @serve.zone/appstore 2.3.0 and schema 3 target-advance history.
  - Splits backup archive verification from allocation-fenced Corestore scratch rehearsal restore, digest, receipt, and cleanup evidence.
  - Pins Corestore 4.5.0 and hardens maintenance container cancellation and lost-create cleanup ownership checks.

## 2026-08-07 - 7.1.22

### Fixes

- advance legacy cutovers to the Cloudly 1.1.3 target (cloudly-secrets-v2)
  - Adds the cloudly-secrets-v2 advance-target gate for eligible legacy backup-verified operations.
  - Updates the pinned Cloudly target to App Store 1.1.3 with @serve.zone/appstore 2.2.0 and the new image, manifest, and config identities.
  - Persists schema v2 target-advance audit evidence while verifying the preserved keyring, held runtime, backup proof, and absent staging or maintenance containers.
  - Documents the target advance recovery flow and expands regression coverage for CLI dispatch and cutover validation.

## 2026-08-06 - 7.1.21

### Fixes

- classify blocked inspect output without error codes as cutover blocked (cloudly-secrets-v2-cutover)
  - Infer CUTOVER_BLOCKED for inspect failures that return blocker evidence without an explicit code.
  - Report validated blocker codes without exposing blocker references.
  - Add regression coverage for MANAGED_FLOW_IN_PROGRESS blocker output.

## 2026-08-06 - 7.1.20

### Fixes

- resolve Cloudly maintenance environment aliases (cloudly-secrets-v2)
  - Render maintenance env var aliases from the verified target App Store config before launching cutover commands.
  - Reuse shared Docker environment templating to resolve service and secret placeholders without mutating inputs.
  - Remove reserved keyring and authorization secret file values from maintenance container environments.

## 2026-08-06 - 7.1.19

### Fixes

- bump pinned Corestore image digest (corestore)
  - Update the default Corestore image to sha256:25b94ac2db90bef7dd8e9ec393812268d355a9020a769f134b42c34eada9d752.
  - Recognize the prior Corestore digest as a migratable image during platform migrations.
  - Extend tests to assert the pinned image and pending keyring preparation upgrade behavior.

## 2026-08-06 - 7.1.18

### Fixes

- harden release asset upload and publishing flow (release-workflow)
  - Create releases as drafts until all expected assets are uploaded and verified.
  - Add upload retries, timeout controls, and authoritative asset reconciliation for indeterminate upload responses.
  - Publish the release only after final asset verification succeeds.

## 2026-08-06 - 7.1.17

### Fixes

- set bash shell for release workflow steps (release)
  - Explicitly run release artifact validation, release deletion, release creation, and cleanup steps with bash.
  - Prevents release workflow failures when bash-specific script options are not available in the default shell.

## 2026-08-06 - 7.1.16

### Fixes

- harden keyring preparation replay validation (cloudly-secrets-v2-cutover)
  - Reuse an existing encrypted keyring for pending prepare-keyring replays instead of regenerating or replacing it.
  - Fail fresh keyring preparation when the reserved key already exists or is empty, and verify staged keyring contents stay bound to the persisted value.
  - Surface only validated CUTOVER_BLOCKED blocker codes and truncated counts in Cloudly maintenance failures.
- harden Gitea release artifact publishing (release)
  - Validate expected package, binary, and checksum artifacts before creating a release
  - Use strict HTTP status handling for release lookup, creation, upload, and cleanup steps
  - Verify uploaded release assets match expected names and sizes

## 2026-08-05 - 7.1.15

### Fixes

- read maintenance logs via byte-safe container logs API (docker)
  - Use the Docker container logs API for maintenance log retrieval and sanitize returned output
  - Bump @apiclient.xyz/docker to 7.5.1

## 2026-08-05 - 7.1.14

### Fixes

- preserve identity-framed backup restore uploads (corestore)
  - Stream database backup restore uploads with node HTTP to maintain exact Content-Length framing and avoid transfer/content encoding.
  - Clean up aborted or rejected restore uploads promptly and cap restore response size before parsing.
  - Update binary build and release Deno version checks to 2.9.4.

## 2026-08-05 - 7.1.13

### Fixes

- retry release binary artifact publication after a transient upload failure (release)

## 2026-08-05 - 7.1.12

### Fixes

- preserve SmartDB during graceful systemd shutdown (systemd)
  - Signal only the Onebox process initially so ordered shutdown can close its child processes.

## 2026-08-05 - 7.1.11

### Fixes

- verify cutover backups with canonical Corestore database digests (backup)
  - Replaces size-limited portable database exports with the service-bound Corestore content digest endpoint.
  - Compares the content SHA-256 and all scan counters before accepting a restored scratch database.
  - Pins the released Corestore 4.3.0 multi-architecture image and upgrades completed or interrupted migration states from accepted prior images.

## 2026-08-05 - 7.1.10

### Fixes

- register providers before platform services initialization (platform-services)
  - Move platform service provider registration into manager construction so callers can access providers before init runs
  - Add regression coverage for startup scratch reconciliation using pre-registered providers

## 2026-08-05 - 7.1.9

### Fixes

- harden cutover backup verification staging (backup)
  - Selectively materializes only required regular files from logical backup bundles during verification.
  - Derives cutover backup-create and backup-verify staging paths from the operation identity under backup staging.
  - Removes verification staging after validation and aggregates cleanup failures with scratch cleanup errors.

## 2026-08-05 - 7.1.8

### Fixes

- harden cutover staging and S3 export cleanup (backup)
  - Add a dedicated private backup-staging path and remove crash-left cutover staging during BackupManager initialization.
  - Validate cutover operation identifiers and revisions before staging cleanup to prevent path traversal.
  - Reject unsafe staging directories or symlinks and verify staging cleanup completion.
  - Write S3 object exports from Node readable streams with 0600 permissions and remove partial files on export failures.

## 2026-08-05 - 7.1.7

### Fixes

- reconcile held cutover credentials without starting workloads (corestore-platform)
  - Use held cutover credential reconciliation for stopped services with held backup intents during Corestore platform migration
  - Add regression coverage to ensure persisted resource reconciliation keeps held workloads stopped and preserves cutover state

## 2026-08-05 - 7.1.6

### Fixes

- update Corestore image and harden cutover replay (corestore)
  - Bumps the released Corestore platform image digest.
  - Accepts both prior Corestore image digests when reconciling migration replay state.
  - Reconciles the Corestore image before replaying a targets-provisioned cutover state.

## 2026-08-05 - 7.1.5

### Fixes

- retain proven legacy MongoDB name holders during Corestore cutover (corestore-platform)
  - Persist exact displaced-container ownership before renaming a stopped legacy twin that occupies the canonical MongoDB name.
  - Require matching command, network, data volume, key-file bind, and mount topology while allowing distinct anonymous config volumes.
  - Reject running, unrelated, or malformed owners before mutating the captured MongoDB source and preserve both recovery containers across replays.

## 2026-08-05 - 7.1.4

### Fixes

- restore legacy MongoDB identity during Corestore cutover (corestore-platform)
  - Lease the canonical onebox-mongodb name only to the captured legacy container during database conversion and reject conflicting owners before mutation.
  - Restore retained recovery container names before advancing migration phases or replaying interrupted cutovers.
  - Verify the legacy MongoDB replica set reports the canonical writable primary identity before inspecting databases.
  - Add exact Docker container name lookup to avoid partial-name matches.

## 2026-08-05 - 7.1.3

### Fixes

- repair stale Corestore credentials before host backups (corestore-migration)
  - Re-provision and CAS-verify canonical Corestore resource credentials during migration replay, including already-complete migrations.
  - Reconcile mapped service environment and encrypted secret bundles through the exact held backup fence without starting held workloads.
  - Fail host backups closed when Corestore S3 credentials are stale, malformed, or missing the required loopback publication.

## 2026-08-05 - 7.1.2

### Fixes

- preserve immutable Cloudly source images during cutover preparation (cloudly-secrets-v2)
  - Resolve the cutover source without pulling mutable metadata and add an optional --source-image recovery path that pins verified stopped zero-task runtimes through Docker version fencing.
  - Serialize Cloudly cutover operations with service lifecycle mutations to prevent concurrent runtime changes.
  - Preserve immutable owned runtime images for configuration-only service replacements and pull when only the registry changes.

## 2026-08-04 - 7.1.1

### Fixes

- bump @serve.zone/appstore to 2.1.0 (deps)
  - Updates the App Store dependency to the released 2.1.0 target.
  - Documents the Cloudly 1.1.2 App Store target for Cloudly 17.0.0 digest resolution and Onebox 7.1.0 compatibility.

## 2026-08-04 - 7.1.0

### Features

- add a durable Cloudly Secrets v2 App Store cutover coordinator (platform)
  - Persist immutable source/target identities, phase and action fences, pending intents, backup and runtime evidence, operator approval, authorization, and maintenance receipts on the owned service.
  - Hold every non-promoted operation at zero before startup reconciliation, restore the selected database through an operation-owned Corestore scratch resource, compare canonical source/restored data, and require explicit gates through restart-without-authorization before promotion.
  - Adopt deterministic completed maintenance attempts after lost responses, persist terminal ownership before output parsing, require explicit zero-blocker completion evidence, and remove them only after proving cleanup.
- add bounded read-only Corestore migration status inspection (migration)
  - Consume SmartDB's offline management sidecar without initializing or mutating storage and emit only redacted hashes, counts, phases, and timestamps.
### Fixes

- serialize conditional service-secret updates and fail closed on stale cutover writes (security)
  - Use selector-bound atomic writes for service and encrypted secret state while sharing one per-service mutation lock with cutover creation, transitions, and deletion.
  - Remove operation-owned plaintext keyring and authorization staging on success, failure, startup, and shutdown paths; reconcile persisted scratch ownership before proceeding.
- fence Cloudly cutover Docker lifecycle and recovery paths (security)
  - Resolve persisted service/platform ownership for generic runtime starts, restarts, scaling, and removal, including an exact legacy MongoDB migration fence.
  - Force-remove failed maintenance candidates, restore zero replicas after verification failures, and require restart verification again after startup recovery.
- make the Onebox release target explicitly Git-only (release)
  - Keep binary publication owned by the existing tag-triggered Gitea workflow without adding npm or Docker release targets.

## 2026-08-04 - 7.0.2

### Fixes

- restore the captured MongoDB replica-set key during Corestore cutover replay (migration)
  - Reconstruct the encrypted legacy key only for the exact captured MongoDB owner and a positively verified key-file command and read-only bind topology.
  - Atomically replace only Docker's empty runtime-directory artifact with a mode-`0400` file owned by the legacy container user.
  - Reject missing ownership metadata, malformed topology, symbolic links, non-empty directories, and other unsafe runtime paths before starting the source container.

## 2026-08-03 - 7.0.1

### Fixes

- reconcile Corestore image during platform cutover replay (platform)
  - Pin Corestore 4.2.1 so its versioned SmartDB migration tightens the exact legacy `smartdb-users.json` mode before startup.
  - On replay after platform ownership is renamed, stop any previous-image Corestore container before updating the persisted owner to the pinned image.
  - Reject replay if the persisted Corestore image was changed to an unexpected digest.
  - Keep permission repair inside SmartDB's versioned migration path instead of mutating persisted data from Onebox.

## 2026-08-03 - 7.0.0

### Breaking Changes

- replace the standalone MongoDB and SmartStorage platform-service surface with Corestore (platform)
  - Remove the legacy `mongodb` and `smartstorage` provider variants and the superseded MongoDB replica-set migration command.
  - Require the explicit checkpoint-gated Corestore cutover for existing installations while preserving MongoDB wire-protocol workload variables.
- replace legacy MongoDB and SmartStorage services with Corestore (platform)
  - Remove standalone MongoDB and SmartStorage platform providers in favor of a unified Corestore provider for database and object-storage resources.
  - Replace the MongoDB replica-set migration command with a checkpoint-gated Corestore platform cutover.
  - Upgrade App Store and storage contracts to v2, including sealed secret ingress, generated/file-delivered secrets, and Corestore backup APIs.
  - Authenticate hosted apps with signed machine identities and revision-fenced lifecycle actions.

### Features

- consolidate database and object storage under Corestore (platform)
  - Replace the standalone MongoDB and SmartStorage platform providers with one pinned Corestore owner while preserving the MongoDB wire protocol and standard workload variables.
  - Add an explicit, checkpoint-gated, replay-safe migration under `ts_migration/` that converts non-empty legacy databases, atomically replaces resource credentials, and retains recovery containers.
  - Consume Corestore's exact v2 storage capability, binding, credential, release, and database-backup contracts.
- add end-to-end App Store secret contracts (security)
  - Seal declared browser and CLI secret inputs to a persistent X25519 recipient with install-specific authenticated context.
  - Generate declared values inside Onebox and deliver file-only secrets through Docker secrets without duplicating them into the public environment.
- authenticate hosted apps with signed machine identities (hosted-app)
  - Issue encrypted-at-rest, audience-scoped RS256 JWTs and rotate legacy or near-expiry control tokens through normal runtime reconciliation.
  - Replace free-form bootstrap payloads with typed message/setup-route actions and revision-fenced atomic lifecycle transitions.

### Fixes

- keep external registry passwords out of process arguments (security)
  - Require registry passwords through a bounded single-line stdin value and remove the process-argument password form.
  - Keep credentials encrypted in Onebox and attach them only to the exact Docker pull request instead of persisting them through `docker login`.
- keep secret settings out of process arguments (security)
  - Require every recognized secret setting through the bounded stdin form and reject positional secret values.
  - Require App Store secret overrides as a bounded JSON object through `--secrets-stdin`, reject declared secret keys supplied through `--env`, and seal values before installation.
- consume the owner package for mutable application image pulls (docker)
  - Upgrade `@apiclient.xyz/docker` to 7.2 and remove Onebox's raw Docker Engine pull request and response parsing.
  - Keep exact digest pulls separate while delegating mutable-tag validation, request-scoped credentials, progress failures, direct inspection, and stale-cache rejection to the Docker package.
- consume owner-level fail-closed Swarm stop proof (docker)
  - Upgrade `@apiclient.xyz/docker` to 7.3 and remove Onebox's raw service update and task-state proof logic.
  - Delegate exact-ID replicated-service shutdown and bounded terminal-task proof to the Docker package while retaining standalone-container proof locally.

## 2026-08-03 - 6.11.4

### Fixes

- consume progress-aware full backup verification (backup)
  - Update @serve.zone/containerarchive to 0.3.2 so full verification keeps the five-minute inactivity boundary without imposing a five-minute total runtime limit.

## 2026-08-03 - 6.11.3

### Fixes

- anchor offline backup repositories to the canonical Onebox state root (backup)
  - Resolve archive and legacy backup paths independently of the caller's working directory.
  - Resolve persisted relative dataDir overrides from the Onebox state root.
  - Refuse to initialize an empty archive while database records reference archive snapshots.

## 2026-08-03 - 6.11.2

### Fixes

- rotate MongoDB consumer credentials during the replica-set migration (security)
  - Generate and encrypt each replacement password in the approved migration checkpoint before stopping consumers or mutating MongoDB.
  - Reconcile database users through SmartData against the exact target database, then persist resource and service secrets in a crash-safe order.
  - Reject divergent credential state on resume and prove retained data with the rotated credentials before consumer activation.
- rotate MongoDB consumer credentials during replica-set migration (mongodb-migration)
  - Generate encrypted replacement credentials in the approved migration checkpoint before mutating consumers or resources
  - Reconcile database users, resource credentials, and service environments in a crash-safe order
  - Reject divergent credential state on resume and verify retained data with rotated credentials before activation

## 2026-08-03 - 6.11.1

### Fixes

- finalize backups from pipe-compatible bundle producers (backup)
  - Update @serve.zone/containerarchive to 0.3.1 so streamx bundle sources can complete without requiring Node's optional unpipe() method.
  - Type bundle producer streams as tar-stream packs to match archive ingestion behavior.
  - Preserve the published snapshot result and database record creation after successful archive ingestion.

## 2026-08-02 - 6.11.0

### Features

- stream bounded logical backup bundles through ContainerArchive (backup)
  - Store one deterministic tar item per platform-resource type and one for opted-in service volumes instead of opening one archive item per exported file.
  - Preserve arbitrary S3 object keys through a versioned manifest while storing bodies only under SHA-256 identifiers.
  - Restore large logical items with limits derived from their authenticated snapshot metadata and retain an explicit reader for earlier file-item snapshots.

### Fixes

- make destructive backup gates prove logical bundle contents (backup)
  - Verify the exact nonempty MongoDB archive member before the offline replica-set migration mutates production data.
  - Delegate snapshot removal to ContainerArchive and remove orphaned snapshots when backup-record persistence fails.
  - Reject unsafe tar members, escaping symlinks, unexpected snapshot formats, duplicate entries, and mismatched S3 manifests.
- bump @git.zone/tsrun to ^2.0.6 (dev-deps)
  - Updated devDependency @git.zone/tsrun from ^2.0.5 to ^2.0.6.

## 2026-08-02 - 6.10.1

### Fixes

- stabilize Docker image identity resolution for backups (backup)
  - Resolve backup image references from confirmed running Docker containers instead of exited historical Swarm tasks.
  - Fail closed when runtime containers, service image references, or active replica image IDs change during identity collection.
  - Fallback to the verified immutable image ID when mutable tags or unavailable digests cannot be tied to the active image, while rejecting conflicting immutable digests.

## 2026-08-02 - 6.10.0

### Features

- verify immutable Docker image identities during backup restore (backups)
  - Export image-inclusive backups by the resolved runtime image ID and record immutable runtime image metadata.
  - Verify restored Docker image IDs before changing service state and avoid replacing archived images with registry pulls.
  - Add local image identity checks for service deploy and update flows used by restores.
  - Preserve restored images when cleaning up failed clone restores.

## 2026-08-02 - 6.9.2

### Fixes

- align the Node and Deno binary builds on one exact Typed RPC runtime family
  - Pin TypedRequest 3.8.0, TypedRequest interfaces 4.0.0, TypedServer 8.12.0, and TypedSocket 5.1.2.
  - Verify the Onebox-to-TypedServer router boundary, add `onebox selftest typed-rpc`, and reject release binaries containing a mixed Typed RPC runtime graph.
- improve changelog extraction and retain four releases (release)
  - Match changelog headings by tag or version-number suffix when generating release notes.
  - Keep the latest four releases for rollback safety before deleting older releases.

## 2026-08-02 - 6.9.1

### Fixes

- expose root-local backup creation and inventory through the Onebox CLI
  - Route backup operations through the sole coordinator and serialize concurrent creation for each service.
  - Keep the offline MongoDB migration's full archive and exact snapshot verification as the pre-mutation gate.

## 2026-08-02 - 6.9.0

### Features

- convert owned MongoDB from standalone 4.4 to an authenticated 8.0 replica set
  - Add an explicit offline migration that runs full chunk-content archive verification and checks the required snapshot items for every MongoDB consumer before stopping workloads.
  - Advance MongoDB and feature compatibility sequentially through 5.0, 6.0, 7.0, and 8.0 with graceful shutdowns between each durable step.
  - Pin the exact live `/data/db` bind or named volume, reconcile encrypted consumer credentials to replica-set URIs, preserve prior workload running state, and prove transactions plus retained collection counts before marking the topology ready.
  - Keep all direct MongoDB administration commands in `ts_migration/`; normal provisioning, health, user, and database operations use public SmartData APIs.
  - Quiesce every consumer before capturing the retained-data checkpoint, persist activation intent before restarting workloads, and clean exact owned Docker candidates after lost create responses.
### Fixes

- complete the passkey-only data cutover in a versioned migration
  - Remove every remaining legacy password hash during startup migration instead of carrying legacy-field cleanup in normal authentication writes.

## 2026-07-28 - 6.8.7

### Fixes

- update SmartPuppeteer to 2.0.7 in the resolved dependency graph
  - Allows Chromium-only release environments to skip unavailable browser executable candidates safely.

## 2026-07-28 - 6.8.6

### Fixes

- bump @serve.zone/appstore to 1.4.2 (deps)
  - Consumes App Store 1.4.2 for the immutable Cloudly 1.1.1 upgrade target.
  - Recognizes the Cloudly 14.5.3 image digest without changing existing storage or Platform OIDC contracts.

## 2026-07-27 - 6.8.5

### Fixes

- use dees-simple-login for the normal Onebox passkey sign-in
  - Delegates passkey sign-in busy and error presentation to the shared login component.
  - Keeps bootstrap and invitation passkey ceremonies in the existing guarded Onebox flows.
  - Adds browser coverage for normal, bootstrap, and invitation states.

## 2026-07-26 - 6.8.4

### Fixes

- configure CoreTraffic publish ports before service creation (reverseproxy)
  - Propagates final HTTP and HTTPS ports to CoreTraffic before the Docker service publish spec is built.
  - Prevents production HTTPS from retaining the default 8443 publish port instead of 443.
  - Adds test coverage for reverse proxy port propagation before service creation.

## 2026-07-26 - 6.8.3

### Fixes

- update @design.estate/dees-catalog to ^3.98.0 (deps)
  - Bumps @design.estate/dees-catalog from 3.97.1 to ^3.98.0.
  - Allows compatible 3.x updates through the new caret range.

## 2026-07-25 - 6.8.2

### Fixes

- Self-heal historical null service runtime optionals.
  - Re-run the idempotent raw-document repair under a new startup migration completion key.
  - Unset only fields whose stored BSON type is null, preserving valid arguments, secret mappings, and cleanup state.
  - Normalize hydrated container arguments and secret-file mappings before validating unrelated service updates.
  - Reuse targeted database unsets so existing null records converge to omitted fields without weakening strict input validation.
- self-heal legacy null service runtime optionals (services)
  - Add a v2 startup repair for legacy null service runtime optional fields.
  - Unset only fields stored as BSON null so valid container arguments, secret files, and cleanup state are preserved.
  - Normalize hydrated service runtime optionals before unrelated service update validation.
  - Ensure updates remove legacy null fields while still allowing explicit runtime optional values.

## 2026-07-25 - 6.8.1

### Fixes

- restore and explain hosted-app platform OIDC eligibility (access)
  - Backfill missing lifecycle identities for App Store-managed services through an idempotent, crash-resumable startup migration.
  - Reconcile the generated hosted-app identity into existing containers after startup so migrated services become usable without reinstalling.
  - Return stable per-service qualification codes and reasons instead of silently omitting ineligible apps from Access.
- reject stale, backwards, and racing App Store upgrades (appstore)
  - Require fresh index, metadata, config, template, and expected-version validation before migration and again before apply.
  - Serialize UI and CLI upgrades per service while preserving operator-owned domain access intent.
  - Bound migration execution time and captured output so failed upgrades cannot retain a service lock indefinitely.

## 2026-07-24 - 6.8.0

### Features

- support stdin-safe config updates and preserve domain routing intent (cli,services)
  - Add config set <key> --stdin handling that carries bounded single-line values over the daemon control channel outside argv.
  - Preserve App Store and service domain metadata, secondary routes, source profiles, and proxy flags across upgrades and legacy primary-domain updates.
  - Include explicit DNS proxy intent in external gateway reconciliation and route-change signatures.
  - Bump @serve.zone/interfaces to 19.3.1.

## 2026-07-24 - 6.7.0

### Features

- add named App Store storage bindings (storage)
  - Add a Onebox storage manager for capability advertisement, class selection, binding fulfillment, release, and upgrade compatibility checks.
  - Persist storage ownership, normalized storage specs, bindings, pending bindings, and reclaim policies on services.
  - Normalize App Store storage requests, legacy volumes, and legacy S3 requirements into managed storage bindings with class mapping support.
  - Integrate managed storage lifecycle with service deployment, removal, backup/restore validation, and SmartStorage Corestore v2 APIs.

## 2026-07-24 - 6.6.0

### Features

- guide storage configuration by backend type (settings)
  - Show only the fields and guidance relevant to the selected local, NFS, SMB, backup, or custom target kind.
  - Explain the class-to-target model and workload purposes directly above the storage tables.
  - Validate required network-storage fields and discard fields that do not belong to the selected backend.
  - Link class, target, Synology NFS, and Kerberos guidance to the serve.zone documentation.

## 2026-07-24 - 6.5.1

### Fixes

- keep the daemon as the sole Onebox coordinator (cli)
  - Execute operational CLI commands through a root-only Unix control socket owned by the running daemon.
  - Enforce a single-writer coordinator lock before database, Docker, CoreTraffic, or route initialization.
  - Resolve production state independently of the caller's working directory and preserve isolated ephemeral development paths.

## 2026-07-24 - 6.5.0

### Features

- declare explicit dcrouter ingress policy for Onebox-managed routes
  - Expose public app domains and public port mappings through RemoteIngress with the PUBLIC source profile.
  - Keep private app routes available directly on the hub and over SmartVPN with the STANDARD source profile.
  - Restrict the Onebox admin UI to direct hub and SmartVPN ingress with the LOCAL NETWORK source profile.

## 2026-07-24 - 6.4.7

### Fixes

- give storage tables the full settings width (settings)
  - Stack storage classes and targets vertically below the platform storage selector.
  - Remove redundant panel shells around `dees-table` so columns and actions have room.

## 2026-07-24 - 6.4.6

### Fixes

- align dashboards with the current shared design system (dashboard)
  - Consume Catalog v2.19.2 dashboard cards built on `dees-tile` and native Dees controls.
  - Render unavailable dashboard states as accessible tiles with catalog buttons and theme tokens.
  - Pass explicit memory utilization and remove the inactive View Logs shortcut.

## 2026-07-24 - 6.4.5

### Fixes

- reduce live container metrics overhead (metrics)
  - Read CPU, memory, and network counters directly from cgroup v2 and procfs with Docker stats as a portable fallback.
  - Coalesce one-second samples and resolve container and Swarm aliases from one shared inventory.
  - Avoid overlapping background collection and unnecessary full-shell renders during live updates.

## 2026-07-24 - 6.4.4

### Fixes

- preserve direct navigation during router initialization (ui)
  - Resolve the requested URL before subscribing default UI state back into browser history.

## 2026-07-24 - 6.4.3

### Fixes

- keep passkey access management separate from platform settings (ui)
  - Remove the stale account and password controls from Settings.
  - Register Access as a top-level route so it opens on the first click and supports direct navigation.
  - Update the shared serve.zone catalog component dependency.

## 2026-07-24 - 6.4.2

### Fixes

- recover failed services without unnecessary gateway rollback (services)
  - Recreate and start missing runtimes when updating a failed service.
  - Skip strict external gateway synchronization when route ownership is unchanged.
  - Normalize nullable legacy runtime options while recreating a rollback runtime.

## 2026-07-24 - 6.4.1

### Fixes

- initialize hosted-app OIDC for headless App Store upgrades (appstore)
  - Share and coalesce OIDC manager initialization between OpsServer and root CLI upgrade paths.

## 2026-07-24 - 6.4.0

### Features

- add a root CLI path for managed App Store upgrades (appstore)
  - Add `onebox appstore upgrade <service-name> [--version <version>]`.
  - Update the bundled App Store metadata to v1.3.0 so Cloudly template v1.1.0 is available.

## 2026-07-24 - 6.3.0

### Features

- add app access management and hosted app OIDC sign-in (access)
  - Adds user invitations, stable user subjects, app role assignments, and an Access view for managing permissions.
  - Adds a hosted-app OIDC provider with discovery, JWKS, PKCE authorization code flow, role-scoped claims, and encrypted client secret handling.
  - Adds live container resource usage sampling for dashboard CPU, memory, and network throughput.

## 2026-07-23 - 6.2.0

### Features

- stabilize authenticated state and proxy observations (runtime)
  - Serialize protected requests by intent and mutation domain, coalesce duplicate reads, fence stale session generations, and merge concurrent action and socket state without losing updates.
  - Verify persisted sessions before mounting the dashboard, enforce JWT expiry, retain last-good resource data, and distinguish authentication failures from temporary backend failures.
  - Observe CoreTraffic through bounded authoritative Docker checks and render starting, failed, unavailable, and stale states instead of reporting uncertain runtime state as inactive.

## 2026-07-23 - 6.1.3

### Fixes

- pin release binaries to the verified Deno compiler (release)
  - Require Deno v2.7.11 for every binary build because Deno v2.9.3 omits required npm runtime packages from self-extracting artifacts.
  - Pin the App Store, interfaces, catalog, and container archive runtime graph so pnpm and Deno consume the same published versions.
  - Verify the tagged binary starts and embeds the lockfile-installed runtime package versions before publishing.

## 2026-07-23 - 6.1.2

### Fixes

- build release binaries from an isolated Deno package cache (release)
  - Prevent stale runner cache state from omitting runtime packages and verify the x64 binary starts with the tagged version before publishing assets.

## 2026-07-23 - 6.1.1

### Fixes

- use the published binary-safe App Store runtime dependency (dependencies)
  - Update App Store to v1.1.1 so clean self-extracting builds embed the single shared interfaces v17.3.0 graph and start successfully.

## 2026-07-23 - 6.1.0

### Features

- adopt the shared workload app runtime format (appstore)
  - Consume the current App Store environment declarations, including public, secret, and generated values, without persisting plaintext credentials in service metadata.
  - Forward container arguments and deliver file-only secrets through Docker Swarm while rejecting unsupported or unsafe runtime combinations.
  - Encrypt service secret bundles, migrate legacy plaintext runtime values, and preserve ciphertext in portable backups.
  - Make install, update, image cleanup, platform-resource provisioning, and rollback ownership durable across partial failures and restarts.

## 2026-07-23 - 6.0.1

### Fixes

- replace stale active MinIO labels with SmartStorage naming (platform-services)
  - Map platform service details to the SmartStorage endpoint and update UI, README, and source descriptions while retaining legacy migration and backup compatibility.

## 2026-07-23 - 6.0.0

### Breaking Changes

- replace password-based administrator login with passkey-only authentication (auth)
  - Require first-run WebAuthn enrollment with a short-lived bootstrap code shown only in local startup logs.
  - Bind administrator sessions to active passkey credentials and reject legacy password-era sessions.
  - Add a confirmed local passkey reset command and remove legacy password hashes after enrollment.

## 2026-07-07 - 5.1.0

### Features

- support canonical service target ports and public port mappings (service-routing)
  - Add targetPorts, domains, and publicPortMappings to service types, persistence, backups, and App Store install/upgrade flows
  - Configure reverse proxy, CoreTraffic, and external gateway routes from canonical service routing data, including TCP/UDP public listeners
  - Add a startup migration to normalize legacy services to canonical target port and domain route fields
  - Improve service update and cleanup flows to keep gateway and public port route lifecycle in sync

## 2026-06-21 - 5.0.0

### Breaking Changes

- rename SmartProxy platform integration to CoreTraffic and add read-only MCP endpoint (platform)
  - Replaces SmartProxy platform service type, provider, manager, container name, backend status, and admin token key with CoreTraffic equivalents.
  - Adds a startup migration for persisted SmartProxy platform services, secret tokens, dcrouter target host settings, service requirements, and backup records.
  - Adds an admin-authenticated /mcp endpoint with read-only service, domain, and platform-service summary tools that omit secrets.
  - Updates UI text, documentation, and tests for CoreTraffic naming and MCP support.

## 2026-06-18 - 4.2.3

### Fixes

- use Gitea API raw URL for installer downloads (installer)
  - Fetch install.sh through the Gitea raw API endpoint across updater, release workflow, installer help, and documentation.
  - Quote installer URLs in shell commands so the query string is preserved.
  - Clarify bootstrap admin password setup in the README.

## 2026-06-18 - 4.2.2

### Fixes

- authenticate SmartProxy admin API with persistent token (smartproxy)
  - Switch SmartProxy service image to coretraffic
  - Generate and store the SmartProxy admin token as an encrypted secret setting
  - Pass the admin token to the service and authorize route reload requests
  - Clean up SmartProxy service and Docker client state after failed startup

## 2026-06-14 - 4.2.1

### Fixes

- bump @api.global/typedserver to ^8.5.3 (deps)
  - Update @api.global/typedserver from ^8.4.6 to ^8.5.3.

## 2026-06-11 - 4.2.0

### Features

- complete the MinIO to smartstorage unification (platform-services)
  - Rewrite migrated service env vars by credential value so template-specific names (e.g. S3_ACCESSKEY) are updated too.
  - Decommission the MinIO platform service automatically once no resources reference it (container stopped, record removed, data directory kept).
  - Remove the MinIO provider; S3 provisioning is smartstorage-only. Restoring pre-migration backup archives remains supported.

## 2026-06-11 - 4.1.0

### Features

- add smartstorage S3 provisioning and MinIO migration (platform-services)
  - Add a smartstorage platform service provider for corestore-backed S3 buckets with scoped credentials.
  - Provision new S3 requirements through smartstorage while keeping legacy MinIO resources supported.
  - Add an admin migration request to copy MinIO bucket objects, update resource records, and swap service environment variables.
  - Extend backup import/export and network port handling to recognize smartstorage buckets.

## 2026-06-10 - 4.0.1

### Fixes

- prune dangling images after service image updates (services)
  - Run Docker image pruning after updates that pull a replacement image to prevent disk usage from accumulating.
  - Log image prune failures without failing an otherwise completed service update.
  - Add service cleanup coverage to verify image pruning is triggered during image updates.

## 2026-06-09 - 4.0.0

### Breaking Changes

- adopt canonical gateway client contracts and drop legacy dcrouter compatibility (gateway)
  - External gateway sync now uses only the canonical gateway-client API (syncGatewayClientRoute, getGatewayClientDomains); the legacy syncWorkAppRoute/getWorkHosterDomains fallbacks were removed.
  - Removes the legacy dcrouterWorkHosterId setting key and settings field; dcrouterGatewayClientId is the only supported key.
  - External gateway requests are now typed against @serve.zone/interfaces gateway contracts (dependency bumped to ^7.4.0).

## 2026-06-08 - 3.3.0

### Features

- support force-pulling unchanged service images (services)
  - Add a forcePull option to service update payloads to refresh unchanged image tags.
  - Pull requested images before replacing running containers so pull failures leave the existing runtime intact.

## 2026-06-07 - 3.2.0

### Features

- add app store source metadata and package source support (appstore)
  - Default the app store resolver to the packaged source unless remote options are provided
  - Expose sourceInfo in app store template responses and client state
  - Display app store package, version, and remote URL details in the web UI
  - Bump @serve.zone/appstore to ^0.3.0

## 2026-06-04 - 3.1.0

### Features

- add real-time service and platform telemetry streaming (telemetry)
  - Introduce telemetry subscription requests and an OpsServer telemetry handler for live log and metric pushes.
  - Subscribe dashboard detail views to service and platform telemetry with cleanup on navigation and disconnect.
  - Demux Docker stdout/stderr log frames and preserve source metadata for historical and streamed logs.
  - Refresh or stop telemetry workers when service and platform runtimes change.

## 2026-05-29 - 3.0.0

### Breaking Changes

- migrate Onebox from Deno to Node.js runtime (runtime)
  - Replace Deno APIs, imports, commands, and filesystem access with Node-compatible runtime helpers.
  - Switch package, build, binary, install, and test workflows to pnpm/Node tooling.
  - Serve the Ops UI from dist_serve and update systemd/upgrade behavior for the Node runtime.
  - Remove legacy SQLite repository and migration code in favor of SmartDB-only storage.

### Fixes

- keep the installer script executable (installer)

### Maintenance

- document binary and source installer usage (docs, installer)
  - Replace stale package-install guidance with the one-line Linux binary installer flow.
  - Keep installer version examples generic so docs do not drift after releases.

## 2026-05-29 - 2.3.11

### Fixes

- abort service deletion before runtime removal when external gateway cleanup fails (services)
  - Move external gateway route deletion ahead of runtime and reverse proxy cleanup for domain-backed services
  - Add regression coverage to ensure gateway policy failures leave the service and runtime intact

## 2026-05-29 - 2.3.10

### Fixes

- rehydrate SmartProxy runtime config during daemon sync (reverseproxy)
  - Reapplies the current SmartProxy routes and certificates after service status synchronization to recover from Docker task replacement.
  - Adds a reverse proxy runtime reapply method that reloads SmartProxy config without clearing desired in-memory state.
  - Covers runtime config reapplication with a reverse proxy test.

## 2026-05-28 - 2.3.9

- replace Redis platform service with Valkey
  - Renames the platform provider, service type, App Store requirement handling, injected env vars, UI labels, and backup/restore paths to Valkey.
  - Adds startup migration for existing platform metadata, credentials, backup metadata, and local platform data directories.

## 2026-05-28 - 2.3.8

### Fixes

- make service deletion strict and leak-free (services)
  - Clean Docker runtime, service-owned volumes/images, registry tags, backups, DNS/certs, platform resources, log streams, and workspace sessions before deleting the service row.
  - Keep the service row when required cleanup fails so deletion can be retried.
  - Preserve OCI blobs shared by other repositories during registry image cleanup.
- make service deletion strict and leak-free (services)
  - Clean Docker runtime resources, owned volumes/images, registry tags, backups, DNS records, certificates, platform resources, log streams, and workspace sessions before deleting the service row.
  - Keep service records intact when required cleanup fails so deletion can be retried.
  - Preserve OCI blobs shared by other tags or repositories during registry image cleanup.

## 2026-05-28 - 2.3.7

- fix SmartData document API serialization for service rows

### Fixes

- serialize SmartData documents to API data (database)
  - Build API data from declared saveable properties and SmartData serializers instead of returning the raw savable object
  - Add regression coverage for service document serialization

## 2026-05-28 - 2.3.6

- move startup data migrations into `ts_migration`

### Fixes

- move startup data migrations into ts_migration (migrations)
  - Extract legacy SQLite import logic from database initialization into a dedicated migration module
  - Run startup migrations during database initialization and record completion in metadata
  - Add test coverage for legacy SQLite import completion metadata

## 2026-05-28 - 2.3.5

- bump `@serve.zone/appstore` to `^0.2.2` so Ghost and Gitea App Store details support mixed-case env keys

## 2026-05-28 - 2.3.4

### Fixes

- skip legacy metrics and logs during startup migration to keep first SmartDB boot bounded
- skip legacy telemetry imports during startup migration (database)
  - Avoid importing legacy metrics and logs into SmartDB to keep first boot bounded
  - Continue migrating non-telemetry legacy tables and add regression coverage

## 2026-05-28 - 2.3.3

### Fixes

- compile Linux binaries as self-extracting artifacts so SmartDB sidecar assets are available at runtime
- initialize SmartData documents before saving default storage records to avoid duplicate-key startup failures
- bump `@push.rocks/smartdb` to `^2.10.2` for missing database collection listing support
- initialize SmartData documents before saving default storage records (database)
  - Create SmartData documents after framework initialization to avoid duplicate-key startup failures.
  - Add a database initialization regression test for default storage targets and classes.
  - Build Linux binaries as self-extracting artifacts so SmartDB sidecar assets are available at runtime.
  - Bump SmartDB to ^2.10.2 for database collection listing support.

## 2026-05-28 - 2.3.2

### Fixes

- set `HOME` and `DENO_DIR` for detached Onebox upgrade systemd units
- make `install.sh` provide writable Deno cache defaults in minimal service environments
- set writable Deno cache defaults for installer and detached upgrades (installer)
  - Exports HOME and DENO_DIR for detached systemd upgrade units.
  - Creates the Deno cache directory during installation for minimal service environments.

## 2026-05-27 - 2.3.1

### Fixes

- show safe App Store backend errors instead of falling back to app-not-found UI
- guard App Store config responses against null typed RPC payloads
- bump `@api.global/typedrequest` to `^3.3.2` for sanitized server-side typed errors
- surface safe App Store backend errors (appstore)
  - Return sanitized App Store typed request errors for config loading and installs
  - Show config load failures with retry controls instead of falling back to the app-not-found UI
  - Guard against empty App Store config responses and display deploy failures as toast errors
  - Bump @api.global/typedrequest to ^3.3.2

## 2026-05-27 - 2.3.0

- refactor Onebox persistence and storage configuration (storage,persistence)
  - Move Onebox persisted entities onto managed SmartData documents with explicit API serialization.
  - Add storage targets and storage classes for local, NFS, SMB, backup, and custom Docker volume backends.
  - Resolve service, App Store, and platform database volumes through configurable storage classes.
  - Add Settings UI management for storage targets, classes, and platform database storage selection.

### Features

- add configurable storage classes with SmartData persistence (storage,persistence)
  - Move persisted Onebox entities to SmartData documents with legacy SQLite import and explicit API serialization.
  - Add storage targets and storage classes for local, NFS, SMB, backup, and custom Docker volume backends.
  - Resolve service, App Store, and platform volumes through configurable storage classes.
  - Expose storage management in settings and deployment flows.

## 2026-05-26 - 2.2.0

- add hosted app lifecycle protocol support (hostedapp)
  - Injects generic hosted-app runtime identity environment variables into managed services.
  - Adds token-scoped Hosted App TypedRequest handlers for lifecycle reporting, bootstrap setup, and managed self-upgrades.
  - Injects a Docker host alias so hosted apps can reach the Onebox runtime URL from managed containers.
  - Shows hosted-app bootstrap and upgrade state in the service detail view with a mark-done cleanup action.

### Features

- add hosted app lifecycle protocol support (hostedapp)
  - Inject hosted app runtime identity environment variables into managed services and persist lifecycle records.
  - Add token-scoped TypedRequest handlers for lifecycle reporting, bootstrap actions, and managed app upgrades.
  - Show hosted app bootstrap and upgrade state in the service detail view with a mark-done cleanup action.
  - Configure Docker host gateway aliases so managed containers can reach the Onebox runtime URL.
  - Bump @serve.zone/interfaces to ^6.1.0.

## 2026-05-25 - 2.1.3

### Fixes

- deduplicate dees-catalog in the admin UI bundle (web)
  - Collapse transitive `@design.estate/dees-catalog` resolution to a single version to avoid duplicate custom element registration.
- deduplicate dees-catalog in the admin UI bundle (web)
  - Collapse transitive @design.estate/dees-catalog resolution to a single version to avoid duplicate custom element registration.
  - Update the bundled web artifact with the deduplicated dependency resolution.

## 2026-05-25 - 2.1.2

### Fixes

- keep self-upgrades alive after stopping the service (upgrade)
  - Launch dashboard-triggered upgrades as transient systemd units outside the service cgroup.
  - Download and validate installer binaries before stopping the running service.
  - Restart the previous service if installation fails after it was stopped.

## 2026-05-25 - 2.1.1

### Fixes

- disable dees-catalog build scripts in workspace config (pnpm-workspace)
  - Adds @design.estate/dees-catalog to pnpm allowBuilds with a false value to explicitly prevent its build scripts from running.

## 2026-05-25 - 2.1.0

### Features

- add App Store upgrade progress tracking and interactive workspace processes (appstore,workspace)
  - Track App Store upgrade operations with async start/list requests and streamed progress updates.
  - Show running and failed upgrade status in App Store and service detail views while preventing duplicate upgrade actions.
  - Route App Store upgrades through the shared service update flow to restore service routes before gateway sync.
  - Add backend workspace shell discovery plus interactive process start/input/kill/output/exit APIs backed by Docker exec streams.
  - Bump Docker and workspace UI dependencies for interactive stdin streaming and shell selection support.

## 2026-05-25 - 2.0.0

### Breaking Changes

- switch Onebox App Store resolution to the shared appstore client
  - Uses `@serve.zone/appstore` and `@serve.zone/interfaces` for App Store metadata, parsing, and Docker digest resolution
  - Renames App Store typed request methods to `getAppStoreTemplates`, `getAppStoreConfig`, `installAppStoreApp`, and `getUpgradeableAppStoreServices`
  - Removes local duplicated App Store DTO and resolver code while preserving Onebox install and upgrade behavior

## 2026-05-25 - 1.31.0

### Features

- resolve repo manifests and docker digest-tracked images (appstore)
  - Add catalog source, resolved source, channel, runtime, upgrade strategy, and version metadata types for appstore manifests.
  - Resolve catalog entries from repo manifests and pin digest-tracked Docker images using registry digests.
  - Propagate resolved image digests into app version configs and service creation options.
  - Add runtime coverage for repo manifest resolution and digest-tracked latest images.

## 2026-05-24 - 1.30.2

### Fixes

- reduce remaining reverse proxy wording to required legacy SmartProxy cleanup and migration identifiers
- clean up legacy reverse proxy naming for SmartProxy (smartproxy)
  - Update legacy reverse proxy service naming and logs used during SmartProxy startup cleanup.
  - Clarify migration and documentation wording for the legacy reverse proxy to SmartProxy transition.
  - Bump @serve.zone/catalog to ^2.12.6 and add pnpm workspace build dependency settings.

## 2026-05-24 - 1.30.1

### Fixes

- align Onebox settings gateway cards with the dees-tile footer action pattern
- align settings gateway cards with dees-tile footer actions (settings-ui)
  - Replaces custom gateway card wrappers with dees-tile header and footer slots.
  - Uses tile-styled action buttons for Admin UI and dcrouter settings saves.

## 2026-05-24 - 1.30.0

### Features

- add configurable Onebox Admin UI domain
  - expose Admin UI domain in settings
  - sync the Admin UI route as a first-class dcrouter gateway route
  - keep Admin UI routing separate from app service routes
- add configurable Admin UI domain routing (admin-ui)
  - Expose and validate the Admin UI domain in settings
  - Sync the Admin UI as a dedicated dcrouter gateway route and SmartProxy route
  - Preserve configured and legacy Admin UI routes during stale-route reconciliation

### Fixes

- preserve Onebox Admin UI routes during external gateway stale-route reconciliation

## 2026-05-24 - 1.29.0

### Features

- add Onebox runtime update prompts and admin-triggered self-upgrades
  - expose Onebox update status through system status
  - reuse the CLI upgrade logic for web-triggered detached upgrades
  - show an update banner and guided DeesUpdater flow in the dashboard

## 2026-05-24 - 1.28.0

### Features

- add enterprise-ready App Store runtime support for declared volumes and raw published ports
  - validate app template schemas before install, fail invalid port/volume declarations early, and preserve declarations across upgrades and backups
  - preflight Docker/host published port conflicts and back up declared service volume data
  - show App Store volume mounts and raw host port exposure before deploy

### Fixes

- fix Onebox dashboard system metrics rendering and traffic polling
- update `@serve.zone/catalog` to `^2.12.5`
- preserve an existing managed dcrouter config file instead of rewriting it on container creation
- remove stale external gateway routes during route reconciliation

## 2026-05-21 - 1.27.0

### Features

- group Onebox sidebar navigation into Apps, Network, and Registry sections (web)
  - add parent/subview routes for grouped app, network, and registry pages

## 2026-05-21 - 1.26.3

### Fixes

- use `dees-table` for gateway domains and DNS records views (web)
  - replace custom row grids with catalog tables, filtering, refresh, and row actions
- use dees-table for gateway domains and DNS records views (web)
  - replace custom row layouts with dees-table in gateway domains and DNS records views
  - add table filtering, refresh actions, and row/context actions for dcrouter management

## 2026-05-20 - 1.26.2

### Fixes

- reload SmartProxy routes after managed startup (proxy)
  - reloads SmartProxy routes immediately after the admin API is ready during startup, avoiding an empty route table when Docker task state lags behind service readiness

## 2026-05-09 - 1.26.1 - fix(external-gateway)
derive gateway client identity from the dcrouter token and make the settings UI read-only

- Resolves external gateway ownership and domain sync to use the gateway client context returned by dcrouter instead of a locally entered client ID.
- Falls back to stored gateway client settings only when token context is unavailable.
- Removes editable Gateway Client ID fields from settings and shows them as diagnostic read-only values for managed and external modes.
- Updates external gateway tests to validate token-derived gateway client IDs and admin-token behavior.

## 2026-05-09 - 1.26.0 - feat(dcrouter)
add managed local dcrouter mode with status controls and gateway integration

- Adds a ManagedDcRouterManager to provision and control a local dcrouter container with default gateway settings.
- Updates gateway sync logic to support managed, external, and disabled dcrouter modes, including managed local route targets.
- Exposes managed dcrouter status, start, stop, and restart operations through OpsServer typed requests.
- Extends settings APIs and the settings UI to configure managed dcrouter ports, image, data directory, and mode selection.
- Adjusts Onebox startup to prepare managed dcrouter settings, shift proxy ports when managed mode is active, and initialize the local gateway before route sync.

## 2026-05-09 - 1.25.0 - feat(external-gateway)
add gateway client domain and DNS record support for dcrouter integration

- switch dcrouter route syncing to gateway-client APIs with fallback to legacy workHoster endpoints
- add admin endpoints and frontend views for browsing gateway domains and DNS records
- introduce dcrouterGatewayClientId settings support while preserving compatibility with the legacy workHoster ID

## 2026-05-08 - 1.24.7 - fix(web-ui)

align Delegate Routing settings with the Dees catalog control and theme conventions

- replace raw Delegate Routing inputs and save button with `dees-input-text` and `dees-button`
- style the Delegate Routing card with explicit `cssManager.bdTheme(...)` colors

## 2026-05-08 - 1.24.6 - fix(auth)

avoid bcrypt worker crashes in compiled binaries during login and password creation

- replace bcrypt password hashing with a Web Crypto PBKDF2 hash format
- remove legacy password-hash fallbacks; existing deployments need their admin user hash updated

## 2026-05-08 - 1.24.5 - fix(opsserver)

start the OpsServer with typedserver custom routes registered through the UtilityWebsiteServer hook

- fixes daemon startup with the current typedserver lifecycle
- cap SmartProxy readiness waiting at 10 seconds during daemon startup

## 2026-05-08 - 1.24.4 - fix(installer)

avoid documenting a hardcoded initial admin password for fresh installs

- update installer output to point operators to the service logs or `ONEBOX_ADMIN_PASSWORD` for initial credentials

## 2026-05-08 - 1.24.3 - fix(runtime)

upgrade runtime dependencies and harden registry/shutdown behavior

- update Deno, API, Docker, Cloudflare, SmartACME, SmartRegistry, SmartStorage, TaskBuffer, catalog, and build-tool dependencies
- expose the embedded OCI registry through OpsServer `/v2` routes with the configured token realm
- avoid creating a hardcoded default admin password and close Docker/log receiver resources during shutdown

## 2026-03-24 - 1.24.2 - fix(deps)
bump runtime and build tool dependencies

- update @design.estate/dees-catalog to ^3.49.0
- update development tooling packages @git.zone/tsbundle, @git.zone/tsdeno, and @git.zone/tswatch

## 2026-03-24 - 1.24.1 - fix(repo)
migrate smart build config to .smartconfig.json and tidy repository metadata

- Rename npmextra.json to .smartconfig.json and extend it with CLI project metadata for the repository.
- Mark the package as private and add an empty pnpm overrides block in package.json.
- Expand .gitignore to cover common build artifacts, caches, install directories, and local tooling folders.
- Reformat changelog and README files for cleaner spacing and Markdown table alignment without changing documented behavior.

## 2026-03-24 - 1.24.0 - feat(backup)

add containerarchive-backed backup storage, restore, download, and pruning support

- add database support for archive snapshot IDs and stored size tracking for backups
- initialize and close the backup archive during onebox lifecycle startup and shutdown
- allow backup download and restore flows to work with archive snapshots as well as legacy file-based backups
- schedule daily archive pruning based on the most generous configured retention policy
- replace smarts3 with smartstorage for registry-backed S3-compatible storage

## 2026-03-21 - 1.23.0 - feat(appstore)

add remote app store templates with service upgrades and Redis/MariaDB platform support

- introduces an App Store manager, API handlers, shared request types, and web UI flow for browsing remote templates and deploying services from template metadata
- tracks app template id and version on services, adds upgrade discovery and migration-based service upgrades, and includes a database migration for template version columns
- adds Redis and MariaDB platform service providers with provisioning plus backup and restore support, and exposes their requirements through service creation and app template config

## 2026-03-18 - 1.22.2 - fix(web-ui)

stabilize app store service creation flow and add Ghost sqlite defaults

- Defers App Store navigation to the services view to avoid destroying the current view during the deploy event handler.
- Processes pending app templates after services view updates so the create flow opens reliably.
- Adds default Ghost environment variables for sqlite3 and the database file path in the App Store template.
- Removes obsolete Gitea CI and npm publish workflow definitions.

## 2026-03-18 - 1.22.1 - fix(repo)

no changes to commit

## 2026-03-18 - 1.22.0 - feat(web-appstore)

add an App Store view for quick service deployment from curated templates

- adds a new App Store tab to the web UI with curated Docker app templates
- passes selected app templates through UI state into the services view for quick deployment
- supports quick deploy creation with prefilled image, port, environment variables, and optional platform service flags
- updates @serve.zone/catalog to ^2.8.0 to support the new app store view

## 2026-03-18 - 1.21.0 - feat(opsserver)

add container workspace API and backend execution environment for services

- introduces typed workspace handlers for reading, writing, listing, creating, removing, and executing commands inside service containers
- adds frontend backend-execution environment integration so the service view can open a workspace against a selected service
- extends Docker exec lookup to resolve Swarm service container IDs when a direct container ID is unavailable

## 2026-03-17 - 1.20.0 - feat(ops-dashboard)

stream user service logs to the ops dashboard and resolve service containers for Docker log streaming

- add typed socket support for pushing live user service log entries to the web app
- extend platform log streaming to include running user services with separate dashboard handlers
- fall back from direct container lookup to service-to-container resolution when streaming Docker logs
- update log parsing to preserve timestamps and infer log levels for service log entries
- bump @serve.zone/catalog to ^2.7.0

## 2026-03-17 - 1.19.12 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.11 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.10 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.9 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.8 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.7 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.6 - fix(repository)

no changes to commit

## 2026-03-17 - 1.19.5 - fix(repo)

no changes to commit

## 2026-03-17 - 1.19.4 - fix(repository)

no changes to commit

## 2026-03-16 - 1.19.3 - fix(repo)

no changes to commit

## 2026-03-16 - 1.19.2 - fix(docs)

remove outdated UI screenshot assets from project documentation

- Deletes multiple PNG screenshots that documented previous dashboard, service form, and hello-world states.
- Reduces repository clutter by removing obsolete image assets no longer needed in docs.

## 2026-03-16 - 1.19.1 - fix(dashboard)

add updated dashboard screenshots for refresh and resource usage states

- Adds new dashboard screenshots covering post-refresh, resource usage, and populated data views.
- Updates visual assets to document current dashboard behavior and UI states.

## 2026-03-16 - 1.19.1 - fix(dashboard)

add aggregated resource usage stats to the dashboard

- Aggregate CPU, memory, and network stats across all running user and platform service containers in getSystemStatus
- Extend ISystemStatus.docker interface with cpuUsage, memoryUsage, memoryTotal, networkIn, networkOut fields
- Fix getContainerStats to properly handle Swarm service IDs by catching exceptions and falling back to label-based container lookup
- Wire dashboard resource usage card to display real aggregated data from the backend

## 2026-03-16 - 1.19.0 - feat(opsserver,web)

add real-time platform service log streaming to the dashboard

- stream running platform service container logs from the ops server to connected dashboard clients via TypedSocket
- parse Docker log timestamps and levels for both pushed and fetched platform service log entries
- enhance the platform service detail view with mapped statuses and predefined host, port, version, and config metadata
- add the typedsocket dependency and update the catalog package for dashboard support

## 2026-03-16 - 1.18.5 - fix(platform-services)

fix platform service detail view navigation and log display

- Add back button to platform service detail view for returning to services list
- Fix DOM lifecycle when switching between platform services (destroy and recreate dees-chart-log)
- Fix timestamp format for log entries to use ISO 8601 for dees-chart-log compatibility
- Clear previous stats/logs state before fetching new platform service data

## 2026-03-16 - 1.18.4 - fix(repo)

no changes to commit

## 2026-03-16 - 1.18.3 - fix(deps)

bump @serve.zone/catalog to ^2.6.1

- Updates the @serve.zone/catalog runtime dependency from ^2.6.0 to ^2.6.1.

## 2026-03-16 - 1.18.2 - fix(repo)

no changes to commit

## 2026-03-16 - 1.18.1 - fix(repo)

no changes to commit

## 2026-03-16 - 1.18.0 - feat(platform-services)

add platform service log retrieval and display in the services UI

- add typed request support in the ops server to fetch Docker logs for platform service containers
- store fetched platform service logs in web app state and load them when opening platform service details
- render platform service logs in the services detail view and add sidebar icons for main navigation tabs

## 2026-03-16 - 1.17.4 - fix(docs)

add hello world running screenshot for documentation

- Adds a new PNG asset showing the application in a running hello world state.
- Supports project documentation or README usage without changing runtime behavior.

## 2026-03-16 - 1.17.3 - fix(mongodb)

downgrade the MongoDB service image to 4.4 and use the legacy mongo shell for container operations

- changes the default MongoDB container image from mongo:7 to mongo:4.4
- replaces mongosh with mongo for health checks, provisioning, and deprovisioning inside the container

## 2026-03-16 - 1.17.2 - fix(platform-services)

provision ClickHouse, MinIO, and MongoDB resources via docker exec instead of host port access

- switch ClickHouse provisioning and teardown to in-container client commands to avoid host port mapping issues
- replace MinIO host-side S3 API calls with in-container mc commands for bucket creation and removal
- run MongoDB provisioning and deprovisioning through mongosh inside the container and improve docker exec failure reporting

## 2026-03-16 - 1.17.1 - fix(repo)

no changes to commit

## 2026-03-16 - 1.17.0 - feat(web/services)

add deploy service action to the services view

- Adds a prominent "Deploy Service" button to the services page header.
- Routes users into the create service view directly from the services listing.
- Includes a new service creation form screenshot asset for the updated interface.

## 2026-03-16 - 1.16.0 - feat(services)

add platform service navigation and stats in the services UI

- add platform service stats state and fetch action
- show platform services in the services list and open a platform detail view
- enable dashboard clicks to jump directly to the selected platform service
- refresh platform service stats after start and restart actions
- bump @serve.zone/catalog to ^2.6.0 for the new platform service UI components

## 2026-03-16 - 1.15.3 - fix(install)

refresh systemd service configuration before restarting previously running installations

- Re-enable the systemd service during updates so unit file changes are applied before restart
- Add a log message indicating the service configuration is being refreshed

## 2026-03-16 - 1.15.2 - fix(systemd)

set HOME and DENO_DIR for the systemd service environment

- Adds HOME=/root to the generated onebox systemd unit
- Adds DENO_DIR=/root/.cache/deno so Deno cache paths are available when running as a service

## 2026-03-16 - 1.15.1 - fix(systemd)

move Docker installation and swarm initialization to systemd enable flow

- Ensures Docker is installed before writing and enabling the systemd unit that depends on docker.service.
- Removes Docker auto-installation from Onebox initialization so setup happens in the service management path.

## 2026-03-16 - 1.15.0 - feat(systemd)

replace smartdaemon-based service management with native systemd commands

- adds a dedicated OneboxSystemd manager for enabling, disabling, starting, stopping, checking status, and following logs
- introduces a new `onebox systemd` CLI command set and updates install and help output to use it
- removes the smartdaemon dependency and related service management code

## 2026-03-16 - 1.14.10 - fix(services)

stop auto-update monitoring during shutdown

- Track the auto-update polling interval in the services manager
- Clear the auto-update interval when Onebox shuts down to prevent background checks after shutdown

## 2026-03-16 - 1.14.9 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.8 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.7 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.6 - fix(project)

no changes to commit

## 2026-03-16 - 1.14.5 - fix(onebox)

move Docker auto-install and swarm initialization into Onebox startup flow

- removes Docker setup from daemon service installation
- ensures Docker is installed before Docker initialization during Onebox startup
- preserves automatic Docker Swarm initialization on fresh servers

## 2026-03-16 - 1.14.4 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.3 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.2 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.1 - fix(repo)

no changes to commit

## 2026-03-16 - 1.14.0 - feat(daemon)

auto-install Docker and initialize Swarm during daemon service setup

- Adds a Docker availability check before installing the Onebox daemon service
- Installs Docker automatically when it is missing using the standard installation script
- Attempts to initialize Docker Swarm after installation and handles already-initialized environments gracefully

## 2026-03-16 - 1.13.17 - fix(ci)

remove forced container image pulling from Gitea workflow jobs

- Drops the `--pull always` container option from CI, npm publish, and release workflows.
- Keeps workflow container images unchanged while avoiding forced pulls on every job run.

## 2026-03-16 - 1.13.16 - fix(ci)

refresh workflow container images on every run and bump @apiclient.xyz/docker to ^5.1.1

- add --pull always to CI, release, and npm publish workflow containers to avoid stale images
- update @apiclient.xyz/docker from ^5.1.0 to ^5.1.1 in deno.json

## 2026-03-15 - 1.13.15 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.14 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.13 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.12 - fix(ci)

run pnpm install with --ignore-scripts in CI and release workflows

- Update CI workflow dependency installation steps to skip lifecycle scripts during builds.
- Apply the same install change to the release workflow for consistent automation behavior.

## 2026-03-15 - 1.13.11 - fix(project)

no changes to commit

## 2026-03-15 - 1.13.10 - fix(deps)

bump @git.zone/tsdeno to ^1.2.0

- Updates the tsdeno development dependency from ^1.1.1 to ^1.2.0.

## 2026-03-15 - 1.13.9 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.8 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.7 - fix(repo)

no changes to commit

## 2026-03-15 - 1.13.6 - fix(ci)

correct workflow container image registry path

- Update Gitea CI, release, and npm publish workflows to use the corrected ht-docker-node image path
- Align all workflow container references from hosttoday to host.today to prevent pipeline image resolution issues

## 2026-03-15 - 1.13.5 - fix(workflows)

switch Gitea workflow containers from ht-docker-dbase to ht-docker-node

- Updates the CI, release, and npm publish workflows to use the Node-focused container image consistently.
- Aligns workflow runtime images with the project's Node and Deno build and publish steps.

## 2026-03-15 - 1.13.4 - fix(ci)

run workflows in the shared build container and enable corepack for pnpm installs

- adds the ht-docker-dbase container image to CI, release, and npm publish workflows
- enables corepack before pnpm install in build and release jobs to ensure package manager availability

## 2026-03-15 - 1.13.3 - fix(build)

replace custom Deno compile scripts with tsdeno-based binary builds in CI and release workflows

- adds @git.zone/tsdeno as a dev dependency and configures compile targets in npmextra.json
- updates CI and release workflows to install Node.js dependencies before running tsdeno compile
- removes the legacy scripts/compile-all.sh script and points the compile task to tsdeno compile

## 2026-03-15 - 1.13.2 - fix(scripts)

install production dependencies before compiling binaries and exclude local node_modules from builds

- Adds a dependency installation step using the application entrypoint before cross-platform compilation
- Updates all deno compile targets to use --node-modules-dir=none to avoid bundling local node_modules

## 2026-03-15 - 1.13.1 - fix(deno)

remove nodeModulesDir from Deno configuration

- Drops the explicit nodeModulesDir setting from deno.json.
- Keeps the package version unchanged at 1.13.0 while simplifying runtime configuration.

## 2026-03-15 - 1.13.0 - feat(install)

improve installer with version selection, service restart handling, and upgrade documentation

- Adds installer command-line options for help, specific version selection, and custom install directory.
- Fetches the latest release from the Gitea API when no version is provided and installs the matching platform binary.
- Preserves Onebox data directories, stops and restarts the systemd service during updates, and refreshes installation instructions in the README including upgrade usage.

## 2026-03-15 - 1.12.1 - fix(package.json)

update package metadata

- Single metadata-only file changed (+1, -1)
- No source code or runtime behavior modified; safe patch release

## 2026-03-15 - 1.12.0 - feat(cli,release)

add self-upgrade command and automate CI, release, and npm publishing workflows

- adds a new `onebox upgrade` CLI command that checks the latest release and reinstalls the current binary via the installer script
- introduces Gitea CI workflows for type checks, build verification, multi-platform binary compilation, release creation, and npm publishing
- adds a reusable release template describing installation options, supported platforms, and checksum availability

## 2026-03-03 - 1.11.0 - feat(services)

map backend service data to UI components, add stats & logs parsing, fetch service stats, and fix logs request param

- Fix: rename service logs request property from 'lines' to 'tail' when calling typedRequest
- Add data transformation helpers: formatBytes, parseImageString, mapStatus, toServiceDetail, toServiceStats, parseLogs
- Transform service list and detail props to match @serve.zone/catalog component interfaces (map status, image, repo/tag, timestamps, registry)
- Dispatch fetchServiceStatsAction on service click and surface transformed stats with default values to avoid nulls
- Parse and normalize logs into timestamp/message pairs for the detail view

## 2026-03-02 - 1.10.3 - fix(bin)

make bin/onebox-wrapper.js executable

- Metadata-only change: file mode updated for bin/onebox-wrapper.js to include the executable bit
- No source or behavior changes to the code

## 2026-03-02 - 1.10.2 - fix(build)

update build/watch configuration, switch to esbuild bundler and tswatch, and bump catalog and tooling dependencies

- Switch watch script to 'tswatch' (replaced previous concurrently command invoking deno + tswatch).
- npmextra.json: set bundler to 'esbuild', enable production mode, include html/index.html in the bundle, and extend watchPatterns to include ./html/\*_/_.
- Backend watcher: expanded watch globs and changed command to include --unstable-ffi and runtime flags (--ephemeral --monitor); restart and debounce kept.
- Bump runtime deps: @design.estate/dees-catalog -> ^3.43.3, @serve.zone/catalog -> ^2.5.0.
- Bump devDependencies: @git.zone/tsbundle -> ^2.9.0, @git.zone/tswatch -> ^3.2.0.

## 2026-02-24 - 1.10.1 - fix(package.json)

update package metadata

- Single metadata-only file changed (+1 -1)
- No source code or runtime behavior modified; safe patch release
- Current package version is 1.10.0; recommend patch bump to 1.10.1

## 2026-02-24 - 1.10.0 - feat(opsserver)

introduce OpsServer (TypedRequest API) and new lightweight web UI; replace legacy Angular UI and add typed interfaces

- Add OpsServer (ts/opsserver) with TypedRequest handlers for admin, services, platform, dns, domains, registry, network, backups, schedules, settings and logs.
- Integrate typedrequest/typedserver and smartjwt/smartguard plugins (ts/plugins.ts) and add comprehensive ts_interfaces for requests and data shapes.
- Replace legacy HTTP server usage with OpsServer throughout daemon, Onebox class and CLI (ts/classes/daemon.ts, ts/classes/onebox.ts, ts/cli.ts).
- Implement log streaming via VirtualStream and support for downloading/restoring backups and registry token management within handlers.
- Introduce new web UI built with dees-element web components under ts_web (ob-app-shell and views) and bundle/watch tooling (npmextra.json, tsbundle/tswatch integration).
- Update package.json: add build/watch scripts, tsbundle/tswatch dev deps and new runtime dependencies for typedrequest and catalog components.
- Remove large Angular-based ui application and related services/components in ui/ (major cleanup of Angular code and assets).
- Note: This adds many new endpoints and internal API changes (TypedRequest-based); consumers of the old UI/HTTP endpoints should migrate to the new OpsServer TypedRequest API and web components.

## 2025-12-03 - 1.9.2 - fix(ui)

Add VS Code configs for the UI workspace and normalize dark theme CSS variables

- Add VS Code workspace files under ui/.vscode:
- - extensions.json: recommend the Angular language support extension
- - launch.json: Chrome launch configurations for 'ng serve' and 'ng test' (preLaunchTask hooks)
- - tasks.json: npm 'start' and 'test' tasks with a background TypeScript problem matcher to improve dev workflow
- Update ui/src/styles.css dark theme variables to use neutral black/gray HSL values for background, foreground, cards, popovers, accents, borders, inputs and ring to improve contrast and consistency

## 2025-11-27 - 1.9.1 - fix(ui)

Correct import success toast and add VS Code launch/tasks recommendations for the UI

- Fix backup import success toast in backups-tab.component to reference response.data.service.name (previously response.data.serviceName), preventing incorrect service name display.
- Add VS Code workspace settings for the UI: extensions recommendation, launch configurations for 'ng serve' and 'ng test', and npm tasks for start/test to simplify local development and debugging.

## 2025-11-27 - 1.9.0 - feat(backups)

Add backup import API and improve backup download/import flow in UI

- Backend: add /api/backups/import endpoint to accept multipart file uploads or JSON with a URL and import backups (saves temp file, validates .tar.enc, calls backupManager.restoreBackup in import mode).
- Backend: server-side import handler downloads remote backup URLs, stores temporary file, invokes restore/import logic and cleans up temp files.
- Frontend: add downloadBackup, importBackupFromFile and importBackupFromUrl methods to ApiService; trigger browser download using Blob and object URL with Authorization header.
- Frontend: replace raw download link in service detail UI with a Download button that calls downloadBackup and shows success/error toasts.
- Dev: add VS Code launch, tasks and recommended extensions for the ui workspace to simplify local development.

## 2025-11-27 - 1.8.0 - feat(backup)

Add backup scheduling system with GFS retention, API and UI integration

- Introduce backup scheduling subsystem (BackupScheduler) and integrate it into Onebox lifecycle (init & shutdown)
- Extend BackupManager.createBackup to accept schedule metadata (scheduleId) so scheduled runs are tracked
- Add GFS-style retention policy support (IRetentionPolicy + RETENTION_PRESETS) and expose per-tier retention in types
- Database migrations and repository changes: create backups and backup_schedules tables, add schedule_id, per-tier retention columns, and scope (all/pattern/service) support (migrations up to version 12)
- HTTP API: add backup schedule endpoints (GET/POST/PUT/DELETE /api/backup-schedules), trigger endpoint (/api/backup-schedules/:id/trigger), and service-scoped schedule endpoints
- UI: add API client methods for backup schedules and register a Backups tab in Services UI to surface schedules/backups
- Add task scheduling dependency (@push.rocks/taskbuffer) and export it via plugins.ts; update deno.json accordingly
- Type and repository updates across codebase to support schedule-aware backups, schedule CRUD, and retention enforcement

## 2025-11-27 - 1.7.0 - feat(backup)

Add backup system: BackupManager, DB schema, API endpoints and UI support

Introduce a complete service backup/restore subsystem with encrypted archives, database records and REST endpoints. Implements BackupManager with export/import for service config, platform resources (MongoDB, MinIO, ClickHouse), and Docker images; adds BackupRepository and migrations for backups table and include_image_in_backup; integrates backup flows into the HTTP API and the UI client; exposes backup password management and restore modes (restore/import/clone). Wire BackupManager into Onebox initialization.

- Add BackupManager implementing create/restore/export/import/encrypt/decrypt workflows (service config, platform resource dumps, Docker image export/import) and support for restore modes: restore, import, clone.
- Add BackupRepository and database migrations: create backups table and add include_image_in_backup column to services; database API methods for create/get/list/delete backups.
- Add HTTP API endpoints for backup management: list/create/get/download/delete backups, restore backups (/api/backups/restore) and backup password endpoints (/api/settings/backup-password).
- Update UI ApiService and types: add IBackup, IRestoreOptions, IRestoreResult, IBackupPasswordStatus and corresponding ApiService methods (getBackups, createBackup, getBackup, deleteBackup, getBackupDownloadUrl, restoreBackup, setBackupPassword, checkBackupPassword).
- Expose includeImageInBackup flag on service model and persist it in ServiceRepository (defaults to true for existing rows); service update flow supports toggling this option.
- Integrate BackupManager into Onebox core (initialized in Onebox constructor) and wire HTTP handlers to use the new manager; add DB repository export/import glue so backups are stored and referenced by ID.

## 2025-11-27 - 1.6.0 - feat(ui.dashboard)

Add Resource Usage card to dashboard and make dashboard cards full-height; add VSCode launch/tasks/config

- Introduce ResourceUsageCardComponent and include it as a full-width row in the dashboard layout.
- Make several dashboard card components (Certificates, Traffic, Platform Services) full-height by adding host classes and applying h-full to ui-card elements for consistent card sizing.
- Reflow dashboard rows (insert Resource Usage as a dedicated row and update row numbering) to improve visual layout.
- Add VSCode workspace configuration: recommended Angular extension, launch configurations for ng serve/ng test, and npm tasks to run/start the UI in development.

## 2025-11-27 - 1.5.0 - feat(network)

Add traffic stats endpoint and dashboard UI; enhance platform services and certificate health reporting

- Add /api/network/traffic-stats GET endpoint to the HTTP API with an optional minutes query parameter (validated, 1-60).
- Implement traffic statistics aggregation in CaddyLogReceiver using rolling per-minute buckets (requestCount, errorCount, avgResponseTime, totalBytes, statusCounts, requestsPerMinute, errorRate).
- Expose getTrafficStats(minutes?) in the Angular ApiService and add ITrafficStats type to the client API types.
- Add dashboard UI components: TrafficCard, PlatformServicesCard, CertificatesCard and integrate them into the main Dashboard (including links to Platform Services).
- Enhance system status data: platformServices entries now include displayName and resourceCount; add certificateHealth summary (valid, expiringSoon, expired, expiringDomains) returned by Onebox status.
- Platform services manager and Onebox code updated to surface provider information and resource counts for the UI.
- Add VSCode workspace launch/tasks recommendations for the UI development environment.

## 2025-11-26 - 1.4.0 - feat(platform-services)

Add ClickHouse platform service support and improve related healthchecks and tooling

- Add ClickHouse as a first-class platform service: register provider, provision/cleanup support and env var injection
- Expose ClickHouse endpoints in the HTTP API routing (list/get/start/stop/stats) and map default port (8123)
- Enable services to request ClickHouse as a platform requirement (enableClickHouse / platformRequirements) during deploy/provision flows
- Fix ClickHouse container health check to use absolute wget path (/usr/bin/wget) for more reliable in-container checks
- Add VS Code workspace launch/tasks/extensions configs for the UI (ui/.vscode/\*) to improve local dev experience

## 2025-11-26 - 1.3.0 - feat(platform-services)

Add ClickHouse platform service support (provider, types, provisioning, UI and port mappings)

- Introduce ClickHouse as a first-class platform service: added ClickHouseProvider and registered it in PlatformServicesManager
- Support provisioning ClickHouse resources for user services and storing encrypted credentials in platform_resources
- Add ClickHouse to core types (TPlatformServiceType, IPlatformRequirements, IServiceDeployOptions) and service DB handling so services can request ClickHouse
- Inject ClickHouse-related environment variables into deployed services (CLICKHOUSE\_\* mappings) when provisioning resources
- Expose ClickHouse default port (8123) in platform port mappings / network targets
- UI: add checkbox and description for enabling ClickHouse during service creation; form now submits enableClickHouse
- Add VS Code recommendations and launch/tasks for the UI development workflow

## 2025-11-26 - 1.2.1 - fix(platform-services/minio)

Improve MinIO provider: reuse existing data and credentials, use host-bound port for provisioning, and safer provisioning/deprovisioning

- MinIO provider now detects existing data directory and will reuse stored admin credentials when available instead of regenerating them.
- If data exists but no credentials are stored, MinIO deployment will wipe the data directory to avoid credential mismatch and fail early with a clear error if wiping fails.
- Provisioning and deprovisioning now connect to MinIO via the container's host-mapped port (127.0.0.1:<hostPort>) instead of relying on overlay network addresses; an error is thrown when the host port mapping cannot be determined.
- Bucket provisioning creates policies and returns environment variables using container network hostnames for in-network access; a warning notes that per-service MinIO accounts are TODO and root credentials are used for now.
- Added logging improvements around MinIO deploy/provision/deprovision steps for easier debugging.
- Added VSCode workspace files (extensions, launch, tasks) for the ui project to improve developer experience.

## 2025-11-26 - 1.2.0 - feat(ui)

Sync UI tab state with URL and update routes/links

- Add VSCode workspace recommendations, launch and tasks configs for the UI (ui/.vscode/\*)
- Update Angular routes to support tab URL segments and default redirects for services, network and registries
- Change service detail route to use explicit 'detail/:name' path and update links accordingly
- Make ServicesList, Registries and Network components read tab from route params and navigate on tab changes; add ngOnDestroy to unsubscribe
- Update Domain detail template link to point to the new services detail route

## 2025-11-26 - 1.1.0 - feat(platform-services)

Add platform service log streaming, improve health checks and provisioning robustness

- Add WebSocket log streaming support for platform services (backend + UI) to stream MinIO/MongoDB/Caddy logs in real time
- Improve platform service lifecycle: detect unhealthy 'running' containers, mark for redeploy and wait/retry health checks with detailed logging
- MinIO health check now uses container IP (via Docker) instead of hostname to reliably probe the service
- MongoDB and MinIO providers updated to use host-mapped ports for host-side provisioning and connect via 127.0.0.1:<hostPort>
- Docker manager: pullImage now actively pulls images and createContainer binds service ports to localhost so host-based provisioning works
- UI: platform service detail page can start/stop/clear platform log streams; log stream service state cleared on disconnect to avoid stale logs
- Caddy / reverse-proxy improvements to manage certificates and routes via the Caddy manager (Caddy runs as Docker service)
- Add VSCode workspace helpers (extensions, launch, tasks) to improve developer experience

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

- Initial project structure
- Core architecture classes
- Docker container management
- Nginx reverse proxy integration
- Cloudflare DNS management
- Let's Encrypt SSL automation
- SQLite database layer
- Angular web UI
- Multi-user authentication
- Systemd daemon integration
- CLI commands for all operations
- Metrics collection and historical data
- Log aggregation
- Registry authentication support

## [1.0.0] - TBD

### Added

- First stable release
