Release Notes

08 May 2026: ver. 4.0.7 Beta

• Controller/AutoOpen and Controller/PagingTools based on model's IsLarge flag
• A Reference field whose target Model has IsLarge: True renders as a searchable lookup popup

Form Date / Time / DateTime — no more spurious rule errors during typing

• kxForm.notifyFieldChange(view, field, this) accepts an optional triggerEl argument: when the input fires change while the user is still typing a date segment (years with fewer than 4 digits, partial HH:MM), the whole notify cycle is aborted client-side and never reaches the server
• Other date / time / datetime-local inputs on the same form that hold a partial value are also omitted from the POST body, so the server preserves the record's existing value for those fields instead of binding an out-of-range TDateTime
• Matches the Kitto1 behaviour where AfterFieldChange rules ran only when the user left the field with a complete value
• The same logic was previously fixed only on grid filters (DateSearch / TimeSearch / DateTimeSearch, hx-trigger="change[...]") — the form-side fix is now centralized in kxForm._isCompleteDateTimeInput and applies to every editor that calls notifyFieldChange. See Form — partial date / time values during typing

Date / Time / DateTime AsString — formatted instead of raw Double

• TKField.AsString on a Date, Time or DateTime field now returns a formatted value (01/07/2026) instead of the raw TDateTime Double (46204)
• Affected any code path that displayed Field.AsString to the end user: rule error messages, log output, debug strings, template panels
• Root cause: TEFDateDataType.ValueToString (and its Time / DateTime siblings) in Source/EF/EF.Tree.pas had the try / DateToStr / except block commented out for years, leaving only the EFVarToStr fallback — for a Variant varDouble (produced when a TDate is assigned to a Variant — TDate = type Double in Delphi) that fallback stringifies the raw float
• Fix: the try / except block is restored with VarToDateTime(AValue) normalization, so any internal representation (varDate, varDouble, varInteger, varString) is formatted via DateToStr / TimeToStr / DateTimeToStr using the current FormatSettings (UserFormats/Date, UserFormats/Time from Config.yaml). EFVarToStr remains as a safety net for non-convertible Variants

Date / Time / DateTime — spurious raises along the variant pipeline

• TEFDataType.ValueToDate and TEFDataType.ValueToTime in Source/EF/EF.Tree.pas used an uninitialized local TFormatSettings record: only ShortDateFormat / DateSeparator (or their time counterparts) were set, the other fields (TwoDigitYearCenturyWindow, TimeSeparator, …) contained stack garbage. The same defect was fixed in ValueToDateTime in r163 but the two siblings had been missed. Now both initialize the record via TFormatSettings.Create('en-US') before the targeted overrides. ValueToDate also now calls StrToDate (it's a date-only parser, not datetime) on the string variant
• TEFDateDataType.ValueToString / TEFTimeDataType.ValueToString / TEFDateTimeDataType.ValueToString are formatters, not parsers, but they were calling VarToDateTime(AValue) even when the Variant already held a string: on a non-en-US locale (e.g. it-IT, where ShortDateFormat is dd/mm/yyyy) an ISO string like '2026-05-12', or any non-date string, raised EVariantTypeCastError / EConvertError. The exception was caught by the surrounding try/except but Delphi's debugger pauses on every raise. Added an else if VarIsStr(AValue) then Result := VarToStr(AValue) short-circuit before the try: string variants are already a textual representation and are passed through unchanged. The try ... VarToDateTime / DateToStr ... except branch stays for numeric variants (varDouble produced by DateToValue, or varDate), preserving the r225 intent of formatting 46204 as 2026-05-12
• Net effect: no more raises along the Date / Time / DateTime variant pipeline when the value is already a string, regardless of server locale

JWT / ACL hardening

• Auth: JWT no longer emits the legacy <AppName> session-id cookie nor kx_db — the JWT sid and db claims carry the same info
• Server-side ACL enforcement on every HandleKX* route (view/data/save/delete/form/lookup/blob/upload/tool/detail*/wizard)
• New auth gate in DoHandleRequest returns 404 on protected routes for unauthenticated requests (public views excluded)
• Toolbar Add/Edit/Delete/Dup stay disabled for ACL-denied users
• Per-thread JWT context cache uses TObjectDictionary<TThreadID, ...>

IDE / wizard

• New RAD Studio IDE plugin gallery: KittoXIDE.bpl registers 4 entries under File > New > Other > KittoX Projects (Standalone .exe / Desktop .exe / ISAPI .dll / Apache .dll)
• Three paths to scaffold a new app: KIDEX standalone, the new IDE gallery, and MCP-KittoX project_create_app
• New project default: Auth: TextFile with a ready-to-use Home/FileAuthenticator.txt (admin/admin demo accounts) so the generated app authenticates out of the box, no users table required. JWT envelope kept as default. AccessControl default switched to Null to avoid deny-all post-login on a brand-new project. DB.FD.yaml template now sets ODBCAdvanced: TrustServerCertificate=yes so SQL Server ODBC Driver 17/18 connects on first try
• Model Wizard Beautify names option now also handles DB names with spaces (Northwind-style: Quarterly Orders → QuarterlyOrders, Sales by Category → SalesByCategory); the original name is preserved in PhysicalName for the SQL layer

MCP-KittoX

• New tool models_create_from_db — the headless equivalent of the Model Wizard. AI agents (Claude Desktop, Claude Code, Codex, …) can reverse-engineer Models from a database connection conversationally: defaults to dry_run: true (preview only); pass dry_run: false to commit. Output is byte-identical to what the visual wizard writes
• 9 tools now implemented (was 8)
• Better error reporting from MCP tools: errors are now propagated verbatim to the JSON-RPC client (class name + message) instead of being replaced by a generic fallback

Setup / tooling

• Setup installer ships MCPKittoX.exe alongside KIDEX.exe sharing OnGuard license
• Tools/SetVersion.ps1 now also bumps the 12 dprojs of the 3 official examples (HelloKitto, TasKitto, KEmployee — 4 deployment variants each), and inserts <VerInfo_Release> and other VerInfo tags when the .dproj has them stripped (Delphi removes VerInfo tags whose value is 0)

01 May 2026: ver. 4.0.6 Beta

• New Auth: JWT wrapper authenticator (signed kx_token cookie, sliding expiration, programmatic key registration)
• New AccessControl: JWT reading grants from kx_acl claim snapshotted at login, with optional DB fallback
• Updated examples to JWT Auth (TasKitto / HelloKitto / KEmployee)
• Updated TasKitto example with three-tier ACL (admin / user / viewer)
• Multi-database support on TasKitto and HelloKitto: SQL Server / PostgreSQL / Firebird
• Cross-dialect macros: %DB.TRUE% / %DB.FALSE%, %DB.DATEDIFF, %DB.DATETIME_FROM
• Login form with optional "Environment" combo for multi-database apps (Auth/DatabaseChoices)
• Native boolean types on the three sample DBs (BIT / BOOLEAN); Firebird setup is now SQL-script-only
• Firebird Activity Dashboard views translated from the SQL Server originals
• TasKitto SQL Server DDL split (tables / views in separate scripts because of T-SQL batch rules)
• New Tools/SetVersion.ps1: one-shot version bump across constant, dproj, README and Inno Setup
• New Projects/BuildAllPackagesD{10_4,11,12,13}.ps1 wrappers: rebuild Core + Enterprise per Delphi version
• YAML metadata files included in every .dproj (visible in Project Manager, KIDEX highlighting)
• EF.Logger.TextFile active out-of-the-box for the standalone Indy hosts

23 Apr 2026: ver. 4.0.5 Beta

Architectural refactor: DB connection ownership unified in TKConfig

• New public API TKConfig.DatabaseFor(Name)
• CreateDBConnection moved from public to protected
• New public API TKConfig.CreateStandaloneDBConnection(Name)
• ClearDatabase and DestroyInstance now clear both** FDatabase and FDatabases
• InDBConnection / InDBTransaction helpers

22 Apr 2026: ver. 4.0.4 Beta

• Manual column resize in grids
• Tooltip on truncated grid cells (only when actually truncated)
• Fix: in-memory lookup popup closing on resize
• Tooltip on TreePanel menu nodes
• Multi-column sort in grids
• Multi-page form validation
• Edit-mode accent border for combobox and other non-text-editable fields
• SunEditor readonly rendering
• Checkbox styled like other form inputs
• DetailTables Style (Tabs/Bottom/Popup)
• Added CSS .disabled class

23 Apr 2026: ver. 4.0.3 Beta

• Editing-mode field borders
• Form toolbar anchoring
• DateTime field fixes
• Fixed KittoEmailSenderSrvc
• Grid keyboard navigation
• SunEditor theming and resize
• Dialog focus
• DetailTables Style (Tabs/Bottom/Popup)
• ExportExcel / ExportFlexCel
• Fixed Date/time filters SQL conversion
• Date/time filter trigger
• Error dialog consistency
• Controller: Window restored backward-compatibility

19 Apr 2026: ver. 4.0.2 Beta

• Simplified Apache/IIS deployment: static resources served internally, no RewriteRule needed
• New deployment mode: Windows Service + reverse proxy (nginx/Apache/IIS) with install/uninstall scripts
• Fixed ViewMode to EditMode save bug in master-detail forms
• Implemented Apply*Rules event chain (EditRecord, NewRecord, Duplicate, AfterShowEditWindow)
• Master-detail: "Confirm" button (save-cache) and "Save All" only visible in ViewMode
• HTTP error feedback (htmx:responseError) with Retry/Reset dialog
• Updated Italian localization (.po/.mo) with all KittoX strings
• Extensive documentation updates (deploy, proxy, localization, form state machine, routing)
• Added DDL and DML script for Example databases

09 Apr 2026: ver. 4.0.1 Beta

• Fixed Field Rules client-side (ForceUpperCase, ForceCamelCaps, MinValue/MaxValue)
• Fixed PackageGroup
• Fixed modal lookup for Reference fields
• Fixed Example for Apache modules

07 Apr 2026: ver. 4.0.0 Beta (first public release)

First public release of Kitto^x, the fourth generation of the Kitto framework. Complete rewrite of the client-side from ExtJS to HTMX + AlpineJS + TemplatePro, with a new modular server architecture.

Architecture

• HTMX + AlpineJS client: server-generated HTML fragments with partial page updates via AJAX. No heavy JavaScript framework.
• Attribute-Based Routing (RTTI): URL routing via Delphi custom attributes, inspired by MARS/WiRL. Resource classes register in initialization sections; the framework discovers them via RTTI. Dependency injection for request context ([TKXContext]). Dynamic JS/CSS injection via TKXScriptRegistry.
• Open Core licensing: Core (Apache 2.0), Enterprise modules (AGPL-3.0 / Commercial), KIDEX (Commercial only). Separate packages: KittoXCore.dpk and KittoXEnterprise.dpk.
• Server-Side Store: persistent in-session data stores with record state tracking (rsNew, rsClean, rsDirty, rsDeleted), transactional master-detail saving (INSERT/UPDATE/DELETE in a single DB transaction), blob lazy-loading, and store lifecycle management (save/cancel/close/timeout).

Controllers

• List (grid with CRUD toolbar, server-side paging, sorting, column layouts, row colors, grouping)
• GroupingList (collapsible group headers)
• Form (data-aware editing with field pages, detail tabs, ViewMode/EditMode state machine)
• Wizard (multi-step data-aware with Back/Next/Finish, per-step validation)
• BorderPanel, TabPanel, FlexPanel, TreePanel, TilePanel, HtmlPanel, StatusBar, ToolBar
• Enterprise: ChartPanel (Chart.js), CalendarPanel (EventCalendar), GoogleMap (Google Maps JS API), Dashboard (auto-refresh)
• Card View: List controller with TemplateFileName for custom HTML card layouts with full CRUD
• Desktop Embedded Mode: KittoX app inside a WebView2 (TEdgeBrowser) VCL window

Data & Database

• Database agnostic: pluggable via FireDAC (preferred), DBExpress, ADO
• Master-detail transactional save: master + all detail stores persisted in one transaction
• Detail CRUD in memory: add/edit/delete detail records without DB round-trips until final Save All
• Record state after Load: records loaded from DB correctly marked as rsClean
• Server-Side Store cache: blob lazy-load from session store, store released on save/cancel/close/timeout

Forms & Editing

• Form State Machine: ViewMode (Edit / Save All / Close) and EditMode (Save / Cancel) with CSS-based button toggling
• Save-cache endpoint: saves master to memory without DB persistence, enables Save All workflow
• Detail tables: lazy-loaded tabs, auto-built views, FK pre-fill on Add, transactional cascading save
• Unified Editor Factory (Kitto.Html.Editors): centralized HTML input generation shared between Form and FilterPanel
• Help button: configurable via Defaults/Help/HRef in Config.yaml, appears in forms (first button) and list toolbar (after Refresh)

Mobile Support

• Automatic mobile detection: user agent + screen size cookie
• Fullscreen dialogs on mobile: IsModal + Maximized forced for all fragment views/forms via AdjustControllerForContext
• Panel properties: IsModal (dialog overlay), Maximized (fullscreen viewport), AllowClose (X button and Close button)
• Width/Height getters: return 0 when Maximized is True (original values preserved for restore)
• kxApp.openView: single JS function for view opening from menus (TreePanel and TilePanel use identical logic)
• body.kx-mobile CSS class: forces dialog and login fullscreen on mobile devices
• TilePanel: tile-based menu controller for mobile home pages, with touch support (role="button", touch-action: manipulation)
• Home view selection: HomeTinyView (phone), HomeSmallView (tablet), HomeView (desktop)

UI & UX

• Toast notifications: shown after save ("Data saved") and delete ("Data deleted"), auto-dismiss 3 seconds
• Error handling: DB errors (EEFDBError) non-fatal with clean messages (driver prefixes stripped). Session-level errors trigger reload.
• Draggable dialogs: all message boxes and error dialogs draggable by title bar via kxMakeDraggable
• Refresh button: in CRUD toolbar (visible by default, hidden with PreventRefreshing or on read-only controllers)
• Column sorting: click to sort ascending, click again for descending, sort arrows via CSS pseudo-elements
• Double-click to open: automatic edit/view form from grid rows
• Session lost detection: fatal error dialog with reload on server restart
• Timeout handling: configurable AjaxTimeout for both HTMX and fetch channels, Retry/Reset dialog

Filters

• Filter Panel with: FreeSearch, List, DynaList, ButtonList, DynaButtonList
• DateSearch, TimeSearch, DateTimeSearch, NumericSearch, BooleanSearch
• Layout with ColumnBreak and LabelWidth

Custom Layouts

• Custom Layout for Grid and Form
• Grid Layout with Column position, alignment
• Form Layout "multipage", with collapsible regions

Authentication & Access Control

• Pluggable authenticators: DB, DBCrypt, TextFile, DBServer, OSDB, Null
• Pluggable access controllers: DB, Null
• BCrypt password hashing, Google OTP (TOTP) two-factor authentication, QR code generation
• Session abstraction: IKXSessionProvider with TKXCookieSessionProvider (JWT-ready for future)

Tools

• CSV export (ExportCSVTool), Excel export via ADO (ExportExcelTool), SQL tool, file download/upload
• FlexCel integration (commercial, Enterprise edition)
• ReportBuilder integration (commercial, Enterprise edition)
• DebenuQuickPDF for PDF merging

Deployment

• Standalone (VCL desktop or Windows service with embedded Indy HTTP server)
• Desktop Embedded (WebView2 inside VCL window)
• Console (headless server)
• IIS (ISAPI DLL via WebBroker)
• Apache (module via WebBroker)

KIDEX (Visual IDE — Enterprise)

• RTTI-based property discovery (replaced 215 MetadataTemplate YAML files)
• 6 custom YAML attributes: YamlNode, YamlRequiredNode, YamlContainer, YamlSubNode, YamlChildType, YamlEnumValue
• SVG icon support (Material Design Icons)
• Database reverse engineering (model creation from DB schema)
• Project wizard, validators, tree editors

Examples

• HelloKitto: simple party/invitation manager (Parties, Girls, Dolls, Invitations)
• TasKitto: activity tracking with dashboard, charts, calendar, projects, customers
• KEmployee: employee/customer management with master-detail, card views

Supported Delphi Versions

Available from Delphi 10.4 to Latest (Win32 or Win64 platforms).

Related links: www.embarcadero.com - https://learndelphi.org