Release Notes

20 Jul 2026: ver. 4.0.10 Beta

Oracle & Database

• Oracle is now a fully supported backend: new DDL + Data scripts for the HelloKitto and TasKitto examples (Oracle XE 21c), plus TasKitto_Oracle_ShiftDates.sql to re-center the demo dashboard dates
• Oracle SQL dialect fixes: corrected the top-N pagination off-by-one (Oracle ROWNUM is 1-based — single-row fetches previously returned 0 rows, full pages were short by one) and reintroduced the portable %DB.CONCAT% macro (|| on Oracle/PostgreSQL/Firebird, + on SQL Server); new %DB.FROM_DUAL% and %DB.CURRENT_DATE% macros make hand-written YAML SQL portable across all five dialects
• FireDAC Oracle wired up in the examples: the Ora driver is registered in UseKitto.pas and a ready-to-use FireDAC_Oracle connection block ships (commented) in Config.yaml
• New optional ODAC backend (EF.DB.ODAC, ClassId ODAC): an alternative Oracle path built on Devart ODAC, modelled on the FireDAC adapter (connection, commands, queries, transactions, metadata introspection via the Oracle data dictionary). It reuses the existing Oracle dialect and is not in the core package (commercial dependency) — enable it per-app by referencing the unit; the examples ship it defined-but-disabled so they still compile without ODAC installed
• Fix ftUnknown parameter binding under MS ODBC Driver 17/18: with DirectExecute the driver no longer infers untyped parameter types (as SQL Server Native Client 11 did), which rejected optional/unassigned columns — now bound safely
• New KittoX_Oracle.md documenting the full Oracle setup; a note in every UseKitto.pas clarifies that the client/server FireDAC/DBExpress drivers require Delphi Enterprise/Architect (Professional ships only local/embedded drivers)

Routing (attribute-based refactor complete)

• The whole kx/* request surface is now attribute-routed: after the auth family in 4.0.9, this release migrates the entire view domain (view, data, form, save, delete) and all ancillary endpoints (lookup, tool, blob, upload, notify, master-detail detail/{i}/data|save|delete, wizard-finish) into typed handlers running under a single shared request-filter chain (error → JWT auth → navigation guard → authorization)
• Legacy TKWebApplication.DoHandleRequest now serves only the Home page (/); zero IsKX*Request matchers remain (down from ~24) — the monolithic dispatcher is gone
• New TKXResourceRegistry.RegisterOverride API: an application can subclass a framework handler and override a single endpoint or hook (e.g. a custom save) without forking the whole route — register the subclass and it replaces the default for its base path

Security

• Navigation guard: direct browser navigation to an internal kx/* fragment endpoint (e.g. pasting .../kx/view/SomeChart in the address bar) is now rejected and redirected to login / home. Only in-app HTMX requests are served the partial; typing a fragment URL no longer leaks a bare HTML partial (when logged in) nor returns a bald 404 (when not)

Master-Detail & Forms

• {MasterRecord.*} macros now resolve in detail-form lookup filters: the detail store is linked to the session master record, so dependent lookups populate correctly instead of coming up empty
• Dedicated lookup grids apply the calling field's LookupFilter (including {MasterRecord.*}), with search/paging state preserved
• Detail-record rules fire on save: HandleDetailSave now applies each field's AfterFieldChange rules (calculated fields — avoids NOT NULL violations) and ApplyBeforeRules (rules that roll detail values up into the master, e.g. totals)
• Reference caption & AutoAddFields resolve on newly-added in-memory records: the derived-values cascade (previously skipped because populate runs with notifications off) now runs via RefreshDerivedReferenceValues, so a reference column is filled immediately instead of staying blank until reloaded from the DB

UI

• Mobile dashboard fix: cards in a maximized-dialog dashboard (Controller: Dashboard / FlexPanel) no longer overflow the screen width and the panel now scrolls vertically, so cards below the fold are reachable

Documentation

• Framework public-API XMLDoc coverage raised from ~32% to ~74%, spanning the routing namespace, the in-memory store, the metadata system, the web engine/server, the HTML^x controllers, EF.DB, the config/rules/SQL core, the tool controllers and the third-party integration shims — surfaced in KIDE^x through [YamlNode] descriptions

6 July 2026: ver. 4.0.9 Beta

Mandatory-field validation now covers reference (lookup) and DateTime editors

• A required field left empty now blocks Save with a validation message, also for large reference fields (searchable lookups) and DateTime editors. Previously only the standard text / select / date / time / number / small-reference editors were validated client-side, so a mandatory lookup or datetime could be saved empty.
• Large references: the hidden value input now carries the required flag; because a hidden input cannot receive focus or show a validity bubble, the message is surfaced on the visible lookup display.
• Compound DateTime: only the date part is mandatory — an empty time defaults to 00:00 server-side.
• Root cause: the reference-lookup and datetime editors built their markup outside the shared BuildInputAttrs helper (which emits required), so the attribute was never rendered. See Form — required fields.

Master/Detail (Style: Bottom) — detail grid renders for a new master

• Opening a master form in Add mode with a DetailTables/Controller/Style: Bottom detail no longer leaves the detail panel empty (previously it showed a stray "200 OK"): the detail grid and its Add / Delete / Refresh toolbar are now always rendered (empty when there are no rows yet).

Add form no longer aborts on a String field with a Null default

• Opening an Add form no longer fails with "Could not convert variant of type (Null) into type (OleStr)" when a String field's default value evaluates to Null. TKViewField.GetDefaultValue now converts through EFVarToStr (Null / Empty → '').

Request field values are decoded exactly once

• Removed a redundant second URL-decode of POST / GET field values in TKWebRequest.GetFormField / GetQueryField: the RTL already decodes them once when filling ContentFields / QueryFields. The double decode could silently corrupt values containing %, + or reserved characters (e.g. a password, a saved field value, a search term).

Responsive form scaling on mobile — now a framework default (all apps)

• Data-entry form fields no longer overflow horizontally on a phone. On narrow screens (max-width: 480px) the <fieldset> and the flex chain shrink to the viewport, fields stack (label above input, matching the mobile LabelAlign=top) and every editor — text, memo, HTML memo (SunEditor), select, date / time, number and reference lookups — fills the field width instead of its fixed CharWidth. Checkboxes / radios keep their square size.
• This is now a framework rule in Home/Resources/css/kittox.css, so it applies to every KittoX app automatically (previously it was an app-level tweak). Desktop layouts are untouched (the rules only apply below the mobile breakpoint). See How to — mobile.

Bug fixes

• Double URL-decode of request values — form/query values were URL-decoded twice (a second decode over already-decoded text), silently corrupting any value containing %, + or (on some RTL versions) ?: passwords (login failing), saved form fields (e.g. 50%, C++), search/filter terms and record keys. Values are now decoded exactly once

Routing

• The authentication family (kx/login, kx/logout, kx/resetpassword, kx/changepassword) migrated to the attribute-based router — first core group to "bring its own routing" (the login page is still served by Home() at /, unchanged)
• Attribute-routed requests now run inside the full per-request context (authenticator, macro engine, and — for Auth: JWT — a session hydrated from the verified token)

Tooling

• Examples/build_Examples.cmd now accepts command-line arguments to build a single example / deploy mode / config, e.g. build_Examples.cmd TasKitto Desktop Debug (the interactive menu is kept when run with no arguments)

08 Jun 2026: ver. 4.0.8 Beta

Theming

• User-selectable theme: set Theme/UserSelection: True and drop a Controller: ThemeSwitcher anywhere in the GUI — the end user picks Light / Auto / Dark live, persisted per-app in localStorage, FOUC-safe boot, no page reload
• Theme is now a structured config block discoverable by KIDE^x: Theme/Mode (Auto/Light/Dark), shared font/icon settings, and per-mode Light:/Dark: palettes (each with its own Primary-Color) — replaces the old flat Theme: <mode> value (existing configs still load)

Login

• Full-width footer and side-panel layout refinements; optional per-section theme switcher

KIDE^x

• Boolean [YamlNode] defaults now carry the inverse of the runtime default, so the "Add node" menu writes the meaningful value instead of a no-op

MCP-KittoX

• Many new tools added — full CRUD on Models / Views / Layouts, database introspection (connections, tables, columns), config read/update, locale (.po) reading, metadata validation, and grid/list view scaffolding (40+ tools total, up from 16)

18 May 2026: ver. 4.0.7 Beta

• Controller/AutoOpen and Controller/PagingTools based on model's IsLarge flag
• A Reference field whose target Model has IsLarge: True renders as a searchable lookup popup

JWT / ACL hardening

• Auth: JWT no longer emits the legacy <AppName> session-id cookie nor kx_db — the JWT sid and db claims carry the same info
• Server-side ACL enforcement on every HandleKX* route (view/data/save/delete/form/lookup/blob/upload/tool/detail*/wizard)
• New auth gate in DoHandleRequest returns 404 on protected routes for unauthenticated requests (public views excluded)
• Toolbar Add/Edit/Delete/Dup stay disabled for ACL-denied users
• Per-thread JWT context cache uses TObjectDictionary<TThreadID, ...>

IDE / wizard

• New RAD Studio IDE plugin gallery: KittoXIDE.bpl registers 4 entries under File > New > Other > KittoX Projects (Standalone .exe / Desktop .exe / ISAPI .dll / Apache .dll)
• Three paths to scaffold a new app: KIDE^x standalone, the new IDE gallery, and MCP-KittoX project_create_app
• New project default: Auth: TextFile with a ready-to-use Home/FileAuthenticator.txt (admin/admin demo accounts) so the generated app authenticates out of the box, no users table required. JWT envelope kept as default. AccessControl default switched to Null to avoid deny-all post-login on a brand-new project. DB.FD.yaml template now sets ODBCAdvanced: TrustServerCertificate=yes so SQL Server ODBC Driver 17/18 connects on first try
• Model Wizard Beautify names option now also handles DB names with spaces (Northwind-style: Quarterly Orders → QuarterlyOrders, Sales by Category → SalesByCategory); the original name is preserved in PhysicalName for the SQL layer
• Model Wizard — new editable DisplayLabel and Hint fields on every Add/Update Field action: auto-populated from the database's native column comment when present (MSSQL MS_Description, PostgreSQL pg_description, Firebird RDB$DESCRIPTION, MySQL COLUMN_COMMENT, Oracle USER_COL_COMMENTS), fully editable before Apply
• Action "New TreeView..." on the Views folder is now idempotent: pointing it at an existing MainMenu.yaml merges the Models that aren't yet referenced under the Folder: Menu block, preserving every hand-edited entry, instead of raising a duplicate-object error

MCP-KittoX

• New tool models_create_from_db — the headless equivalent of the Model Wizard. AI agents can reverse-engineer Models from a database connection conversationally: defaults to dry_run: true (preview only); pass dry_run: false to commit. Output is byte-identical to what the visual wizard writes. DisplayLabel auto-populated from the database's native column comments; optional field_descriptions array lets the agent inject labels from a non-DB source (CSV, glossary, prior YAML) with per-property override precedence
• New tools models_list / models_read / views_list / views_read / resources_list / resources_read — enumerate and read project metadata and static resources headlessly
• New tool menu_generate_main_menu — create or refresh MainMenu.yaml with one entry per Model under a top-level Folder: Menu; idempotent (existing entries preserved, only missing Models appended)
• Database column comments are now auto-fetched for all 5 supported engines (MSSQL, PostgreSQL, Firebird, MySQL, Oracle) and flow into both the KIDE^x wizard and the MCP tool
• 16 tools now implemented (was 9)
• Better error reporting from MCP tools: errors are now propagated verbatim to the JSON-RPC client (class name + message) instead of being replaced by a generic fallback

Setup / tooling

• Setup installer ships MCPKittoX.exe alongside KIDEX.exe sharing OnGuard license
• Tools/SetVersion.ps1 now also bumps the 12 dprojs of the 3 official examples (HelloKitto, TasKitto, KEmployee — 4 deployment variants each), and inserts <VerInfo_Release> and other VerInfo tags when the .dproj has them stripped (Delphi removes VerInfo tags whose value is 0)

01 May 2026: ver. 4.0.6 Beta

• New Auth: JWT wrapper authenticator (signed kx_token cookie, sliding expiration, programmatic key registration)
• New AccessControl: JWT reading grants from kx_acl claim snapshotted at login, with optional DB fallback
• Updated examples to JWT Auth (TasKitto / HelloKitto / KEmployee)
• Updated TasKitto example with three-tier ACL (admin / user / viewer)
• Multi-database support on TasKitto and HelloKitto: SQL Server / PostgreSQL / Firebird
• Cross-dialect macros: %DB.TRUE% / %DB.FALSE%, %DB.DATEDIFF, %DB.DATETIME_FROM
• Login form with optional "Environment" combo for multi-database apps (Auth/DatabaseChoices)
• Native boolean types on the three sample DBs (BIT / BOOLEAN); Firebird setup is now SQL-script-only
• Firebird Activity Dashboard views translated from the SQL Server originals
• TasKitto SQL Server DDL split (tables / views in separate scripts because of T-SQL batch rules)
• New Tools/SetVersion.ps1: one-shot version bump across constant, dproj, README and Inno Setup
• New Projects/BuildAllPackagesD{10_4,11,12,13}.ps1 wrappers: rebuild Core + Enterprise per Delphi version
• YAML metadata files included in every .dproj (visible in Project Manager, KIDE^x highlighting)
• EF.Logger.TextFile active out-of-the-box for the standalone Indy hosts

23 Apr 2026: ver. 4.0.5 Beta

• Architectural refactor: DB connection ownership unified in TKConfig
• New API TKConfig.DatabaseFor(Name) and TKConfig.CreateStandaloneDBConnection(Name)
• CreateDBConnection moved from public to protected
• ClearDatabase / DestroyInstance now clear both FDatabase and FDatabases
• New InDBConnection / InDBTransaction helpers

22 Apr 2026: ver. 4.0.4 Beta

• Manual column resize in grids
• Tooltip on truncated grid cells (only when actually truncated)
• Fix: in-memory lookup popup closing on resize
• Tooltip on TreePanel menu nodes
• Multi-column sort in grids
• Multi-page form validation
• Edit-mode accent border for combobox and other non-text-editable fields
• SunEditor readonly rendering
• Checkbox styled like other form inputs
• DetailTables Style (Tabs/Bottom/Popup)
• Added CSS .disabled class

23 Apr 2026: ver. 4.0.3 Beta

• Editing-mode field borders
• Form toolbar anchoring
• DateTime field fixes
• Fixed KittoEmailSenderSrvc
• Grid keyboard navigation
• SunEditor theming and resize
• Dialog focus
• DetailTables Style (Tabs/Bottom/Popup)
• ExportExcel / ExportFlexCel
• Fixed Date/time filters SQL conversion
• Date/time filter trigger
• Error dialog consistency
• Controller: Window restored backward-compatibility

19 Apr 2026: ver. 4.0.2 Beta

• Simplified Apache/IIS deployment: static resources served internally, no RewriteRule needed
• New deployment mode: Windows Service + reverse proxy (nginx/Apache/IIS) with install/uninstall scripts
• Fixed ViewMode to EditMode save bug in master-detail forms
• Implemented Apply*Rules event chain (EditRecord, NewRecord, Duplicate, AfterShowEditWindow)
• Master-detail: "Confirm" button (save-cache) and "Save All" only visible in ViewMode
• HTTP error feedback (htmx:responseError) with Retry/Reset dialog
• Updated Italian localization (.po/.mo) with all KittoX strings
• Extensive documentation updates (deploy, proxy, localization, form state machine, routing)
• Added DDL and DML script for Example databases

09 Apr 2026: ver. 4.0.1 Beta

• Fixed Field Rules client-side (ForceUpperCase, ForceCamelCaps, MinValue/MaxValue)
• Fixed PackageGroup
• Fixed modal lookup for Reference fields
• Fixed Example for Apache modules

07 Apr 2026: ver. 4.0.0 Beta (first public release)

First public release of Kitto^x, the fourth generation of the Kitto framework: complete rewrite of the client from ExtJS to HTMX + AlpineJS + TemplatePro, with a new modular server architecture.

• HTMX + AlpineJS client: server-generated HTML, partial page updates, no heavy JS framework
• Attribute-Based Routing via RTTI (MARS/WiRL-style), DI request context, dynamic JS/CSS injection
• Open Core licensing: Core (Apache 2.0), Enterprise (AGPL-3.0 / Commercial), KIDE^x (Commercial)
• Server-Side Store: record state tracking, transactional master-detail save, blob lazy-load
• Controllers: List, GroupingList, Form, Wizard, BorderPanel, TabPanel, FlexPanel, TreePanel, TilePanel, HtmlPanel, StatusBar, ToolBar
• Enterprise controllers: ChartPanel, CalendarPanel, GoogleMap, Dashboard
• Card View (List with custom HTML template) and Desktop Embedded Mode (WebView2)
• Database agnostic (FireDAC / DBExpress / ADO)
• Master-detail transactional save with in-memory detail CRUD
• Form state machine (ViewMode / EditMode) with save-cache + Save All workflow
• Custom Grid and Form layouts (multipage, collapsible regions)
• Mobile support: auto-detection, fullscreen dialogs, TilePanel, per-size Home views
• Filter Panel: FreeSearch, List, DynaList, ButtonList, Date/Time/Numeric/Boolean search
• Toast notifications, draggable dialogs, double-click to open, session-lost detection, timeout handling
• Authentication: DB, DBCrypt, TextFile, DBServer, OSDB, Null; BCrypt + Google OTP (2FA)
• Access control: DB, Null
• Tools: CSV / Excel export, file download/upload, FlexCel, ReportBuilder, Debenu PDF (Enterprise)
• Deployment: Standalone, Desktop Embedded, Console, IIS (ISAPI), Apache (module)
• KIDE^x visual IDE: RTTI property discovery, SVG icons, DB reverse engineering, project wizard, validators
• Examples: HelloKitto, TasKitto, KEmployee
• Supported on Delphi 10.4 → latest (Win64)