# Changelog 0.4 ## v0.4.3 — 2026-07-31 ### 🐛 Fixed - Site search client matches fumadocs 16.14's ZBSearch move: use `staticClient` (no custom `@orama/orama` init). Fresh installs were failing `next build` typecheck under `useTypeScriptCli`. ## v0.4.2 — 2026-07-31 ### 🐛 Fixed - `bun run bump` updates package/jsr `"version"` fields in place so oxfmt compact arrays in `jsr.json` are not rewritten into multi-line form (which failed `fmt:check` after the v0.4.1 cut). ## v0.4.1 — 2026-07-31 ### 🐛 Fixed - Competitor-mention gate no longer matches its own comment: the Rust-core peer name in the allowlisted split comment is split the same way as the search needle. - Site `next build` with TypeScript 7: enable `experimental.useTypeScriptCli` so Next runs the project-local `tsc` instead of the removed JS compiler API, and point it at `tsconfig.build.json` so Bun `*.test.ts` files stay out of the production typecheck. ## v0.4.0 — 2026-07-31 ### ✨ Added - `Redacted` — a plain value wrapper for secrets at the value level. `fx.vault` now returns `Redacted`: printing, logging, or JSON serialization yields a fixed placeholder, never the real value; `.reveal()` is the one explicit unwrap, called once at the credential boundary (drivers unchanged — they take plain strings at boot). `fx.log` (all levels) deep-masks any `Redacted` found anywhere in the logged data, nested included, on top of the existing boot-registered substring scrub. Orthogonal to effect tracking — the Manifest still records secret _names_. - `fx.using(acquire, release, use)` — scoped resource cleanup that completes the structured-concurrency surface. `release` runs exactly once when `use` settles or when the ambient abort signal fires (a sibling `fx.race` winner or failing `fx.all` branch), reusing the Prompt-57 ALS signal rather than a second cancellation channel. Process-local only — not journaled, and not for handles held across durable park/resume. - `oke-deps` agent skill — scoped dependency updates (one package, one `package.json`, or all) with Bun + `ncu`, pin/alias guards, and install verification. Documented under Skills; linked from `AGENTS.md`. - `meilisearch` as an opt-in fourth `store.index` driver — full-text, typo-tolerant, faceted search as a genuinely different capability from the vector ANN drivers (`memory` / `pgvector` / `libsql`). `IndexStore` is now a discriminated union on `driverId`, so TypeScript rejects a vector query against a text index (and vice versa) at compile time, never at runtime. Local mode spawns a `meilisearch` binary from `PATH` with a generated master key under `.oke/meilisearch/`; docker/prod uses a `getmeili/meilisearch` image recipe. Not the default — `memory` stays the default and meilisearch is wired explicitly per env. ### ♻️ Changed - Collapse diagram (homepage / Why OKE): each element cluster now has a labelled ring arc, and the live chips name the active source plus its destinations (A → B, C, D) instead of a single anonymous node. Chips sit on the node's outward ray, well clear of the group-name band; the connector is a technical leader — pin at the node, creeping data dash, and on diagonals a bent end that plugs square into the chip edge — and collision layout pushes or drops overlapping destinations. Group names ride the arc on a textPath so they curve with their cluster; names below the horizontal midline run the other way along the arc so they stay upright. - Get-started docs replace the Comparison page with **Why OKE** — an evergreen case around traditional backend pain points (cache invalidation, secrets sprawl, hand-rolled headers, bolted-on observability, ad-hoc capabilities) and what Manifest / `fx` / Vault / Console / official plugins already close. Ambition stated plainly; pre-1.0 maturity kept honest. - Get-started pages (Introduction, Why OKE, Installation, Basic Usage) rewritten to the oke-docs standard: one-rule Callouts, Quick start Steps, Learn more / Next Cards, real Troubleshooting Accordions, and source-verified claims (corrected stale `--sql postgres` / `pgTable` wording and template examples). Prose-density gate now covers `get-started/`. - Introduction and Why OKE restructured: Introduction teaches Flow → `fx` → Manifest → eight elements → ten exports with a real Quick start; Why OKE replaces the mega-table with seam-by-seam sections (cache, glue, secrets, observability, permissions, local≠prod) plus ambition/maturity. - Get-started visuals: every get-started page carries a diagram that earns its place — Introduction (`FlowShape`, `ManifestPipeline`, `Features`, `Vocabulary`), Why OKE (`DriftBoard`, `CollapseBoard`), Installation (`Surfaces`, `DevModes`), Basic Usage (`Surfaces`, `FlowShape`, `ClientLoop`). Custom `FlowShape` / `DevModes` / `ClientLoop` / `DriftBoard` / `CollapseBoard` plus landing reuse registered in the docs MDX map. - Why OKE refactored around felt pain: six seams written as incidents (the cache that lies, the secret that fails in prod, the glue you rewrite, the dashboard that doesn't know you, the permission check in the wrong place, local≠prod), each closed by what OKE derives. New `DriftBoard` visual shows one change propagating two ways — hand-maintained copies scatter versions and stay scattered, Manifest derivations flip in sync — replacing the two duplicate pins/features tables with one summary table. - Docs visuals are now micro-simulations of their own physics, not static diagrams with a fade-in: a request token traverses the Gate pipeline (every third run denied with a cycling typed failure), a probe descends the Vault resolution chain (hit cycles layers; every sixth run misses all → `VaultBootError`), Flow triggers fire in turn into one Flow, Signal cards run once/broadcast/live delivery demos, Clock ticks a metronome vs a cron dial, a send travels Channel's consent→locale→fallback→receipts, and `fx.ask` is checked against each AI guardrail with verdicts. All driven by a shared deterministic beat clock (`useTick` + `BeatPing` in `components/docs/reveal.tsx`), hydration-safe, reduced-motion-aware (static snapshots), and toned in each element's canonical ink. - `CollapseBoard` — a compact docs-side telling of the integration curve (Why OKE), replacing the 955px landing stepper in the article. The same 40 concerns on one ring twice: zoo mesh (136 seams) beside the hub collapse (48 edges), with the change feed costing one live change in both shapes (up to 15 seams re-checked vs always 2 edges). The full CollapseDiagram stays on the landing page. - Bumped root dependencies: `oxc-parser` / `@oxc-project/types` to `0.142`, `vite` to `8.2`, Playwright to `1.62.1`, plus patch updates for DuckDB, CodeMirror, React types, and `@vitejs/plugin-react`. - Bumped site dependencies: fumadocs to `16.14` / MDX `15.2.1`, Next to `16.2.12`, `cnfast` to `0.1`, TypeScript to `7`, plus patch/minor updates for lucide, framer-motion, postcss, and React types. ### 🔥 Removed - Named peer comparison matrix and head-to-head positioning copy from get-started docs, landing attribution comments, and related satellite mentions. A `git grep` gate keeps those names out of the tree. - `infisical` vault driver (`vault-infisical` / `infisicalVaultDriver`) — drop the unused SaaS-shaped secrets backend. Vault drivers that remain: `env` · `openbao` · `managed` · `memory`. ### 🐛 Fixed - Site header active-tab underline no longer floats above the border when switching surfaces. Replaced the Framer `layoutId` morph (which fought the brand-cell width spring) with a single measured bar that only animates `x` / `width`. - Console production builds resolve shared display labels across element panels. - Animated docs favicons no longer remove Next-managed metadata nodes during navigation. - `bump-version --dry-run` rehearses cleanly right after a release: an empty `## Unreleased` now prints a note instead of failing (real bumps still refuse to cut an empty release), so the publish gate stays green in the post-release window.