Release Notes — WUIC Framework v1.7.0

Date: 11 August 2026 Previously published version: 1.5.0 (21 July 2026) Backend: .NET 10 + IIS / Linux nginx Frontend: Angular 21

Packages replaced on 15 August 2026. The archives published initially shipped an appsettings.json with autoGeneratedQueryTimeout set to 1: with that value, every query taking longer than one second ends in a server error. A few header settings (logo, menu orientation, theme selector, notifications) had also been left behind by a test session. The archives have been rebuilt and their checksums updated.

If you downloaded before 15 August: download the package again, or open appsettings.json and set autoGeneratedQueryTimeout back to 30, removing the keys header-logo, header-logo-position, header-menu-orientation, header-show-theme-selector, header-menu-multicolumn-submenu and header-show-notifications unless you set them yourself. Neither setting touches your data: editing the file and restarting is enough to fix an existing installation.

Three weeks of work on two fronts. The first is appearance: the new Theme Builder is a page for composing custom themes — colors, typography, background, density, grid rendering — that apply to every user of the installation, and the application header has been redesigned and made configurable. The second is integration and observability: the new Webhook Hub receives and sends events with signing and retries, and the Performance Inspector measures fetch and render times per route. The chatbot learns to act on three more surfaces of the application and to query the database schema.

🎨 Theme Builder

A new page under Administration lets you compose custom themes without touching code. Every saved theme appears in the theme selector of all users of the installation, alongside the built-in ones.

What you can set:

Primary color, from which the full 11-shade scale is generated: the scale stays clickable, and picking a darker shade promotes it to primary color. A badge shows the WCAG contrast ratio reached (AAA / AA / AA-large / fail).
Light and dark surfaces, corner radius and density (comfortable or compact).
Typography: font family from a catalog of system fonts or a free-form stack, plus a base size that scales the whole interface.
Page background: solid color, gradient or image. The gradient can have an optional slow drift that swings its angle over time; the image is configured with fit, repeat, position and a dark overlay so text stays readable.
Grid: alternating rows and the selected row are no longer fixed colors but blends of the surface with an accent, driven by two intensity knobs, with the option of an accent different from the primary color.
Light/dark mode left free or forced by the theme.

The preview is live and applies the theme to the whole page while you compose it, without touching the user's own preferences: on leaving, reloading or closing the browser your own theme comes back.

Excel export follows the theme: a file exported while a custom theme is active comes out with that theme's colors — header, alternating rows, borders — instead of generic greys. Fallback styles have been added for every preset family, so a theme that has not been sampled yet still inherits the look of its family.

The built-in theme catalog gains new variants, and the active theme is applied on the very first frame after a reload, without the previous theme flashing.

🖥️ Redesigned, configurable header

The application header is now a framework component: installations inherit it instead of keeping a copy. The top-right block has been compacted — theme selector, light/dark, language, notifications and user area live in a card that expands on hover — and the user area shows name, role, license and sign-out.

A new Header & Menu section in the settings lets you choose the menu orientation (horizontal above or below, vertical left or right), upload a logo and position it, and turn the language selector, theme selector and notifications on or off. You can also disable the automatic multi-column layout of submenu entries: in that case long submenus become scrollable instead of being cut off.

🔗 Webhook Hub

A new system for integrating the application with external services, in both directions.

Outbound: events are queued and delivered asynchronously, with HMAC payload signing, retries at a fixed or exponential interval, a dead letter queue for permanently failed deliveries and the ability to replay a delivery. Every attempt is recorded in the logs.

Inbound: the POST /api/webhooks/inbound endpoint accepts external calls and routes them according to a metadata configuration — SQL execution, HTTP call or method invocation — with anti-replay protection.

Also included are notification policies with a configurable cooldown, an administrative API for managing endpoints, and a scheduler job that drains the queue. The whole configuration — endpoints, events, subscriptions, inbound rules — lives in metadata tables: adding an integration needs neither dedicated code nor a new deployment. The "Webhook Hub" page of the in-app documentation carries the full procedure in 5 languages.

📈 Performance Inspector

The framework can collect fetch and render metrics for every route, aggregate them and show them in an administrative dashboard: average, p95, maximum and count, with a 7-day retention and per-route collection.

The feature is off by default and is enabled with AppSettings:enablePerformanceInspector, in hot-reload. Alongside the metrics there is a data quality inspector, enabled per route from the props bag (extraProps.qualityInspector).

🤖 Chatbot: new actions and schema reading

The RAG chatbot gains ten new action types and the ability to query the structure of the project.

Three new contextual surfaces: pivot builder, settings editor and report designer. The chatbot proposes actions on the page you are on. In the settings editor changes are only prepared: saving stays an explicit user gesture. In the dump sent to the model, reserved values — connection strings, passwords, keys, license — are masked, and an exclusion list prevents writing them. In the report designer a new timestamped file is always generated, leaving the open report untouched.
Metadata operations: table creation, scaffolding of tables, views and columns, moving menu entries. The two irreversible operations — deleting a column and deleting a menu entry — require an explicit confirmation that is verified server-side as well, so it holds even when the request comes from a client with no user interface.
Introspection: the chatbot can list connections (names only, never connection strings), databases, tables, columns and the menu tree. Without these reads it could not know the real identifiers to work on.

A new documentation page lists the supported prompts, verified against the automated tests.

📊 Spreadsheet: column visibility aligned with the grid

The spreadsheet now honours the same visibility flags as the list grid: mc_hide_in_list, mc_hide_in_edit and mc_show_in_filters. A column hidden in the list no longer appears in the sheet, and a column hidden in edit is no longer editable in the cells.

🛡️ Security

Best-effort hardening on report scaffolding: the requested file name is now validated by rejecting absolute paths and disallowed characters, with a check that behaves the same way on Windows and on Linux — it previously relied on a normalization that filtered differently on the two systems. The returned error tells an invalid configuration apart from a generation failure, so integrators do not look for the problem in the wrong place.

🐛 Notable bug fixes

Scheduler, first load: the view showed data that was not filtered for the displayed range — typically no events in the current month, even with appointments present. The first load ran before the start and end fields configured for the archetype were available, and no later request corrected it. The fields are now resolved before the filter is composed and, if they arrive afterwards, the data is requested again exactly once.
3D scenes with a professional license: the designer and 3D viewer pages redirected to the access-denied screen, because the feature was not included in any license profile. It is now part of the professional profile.
Reports on Linux: report scaffolding failed because fonts were handled through a graphics library available only on Windows.
Performance Inspector, aggregation: two overlapping runs of the aggregation job — the dashboard triggers it on its own reload, and it can also be launched manually — ended with a duplicate key error. The raw data window was also not aligned to the daily bucket boundary, so the oldest bucket was rebuilt from a subset of the events.
Linux behind a reverse proxy: absolute URLs generated by the backend lost the port and used the wrong scheme when the installation is served on a non-standard port or over plain HTTP.
Oracle, saving 3D scenes: saving failed because of a reserved parameter name and of numeric value conversion. Both fixed, together with the handling of quoted lowercase column names.
Oracle, OData exposure: columns were forced to uppercase instead of using the physical name declared in the metadata, making entities with mixed-case names unreachable.
PostgreSQL and Oracle, lookups in charts and grouping: the descriptive field of a lookup was not resolved from the logical name to the physical one, and grouping showed empty or wrong values.
Chatbot, missing confirmations: in four places the confirmation prompt never appeared because of a malformed call; in two of them the deletion (chat history and sessions) happened without asking anything. Every confirmation now goes through the same path and, on error, the answer is "cancel".
Metadata import: routes whose database field is empty — that is, those using the application's default database — could not be imported, and the error suggested a permissions problem or the wrong database.
3D viewer: the scene occupied a horizontal band instead of the full height of the page.
UI, grid over a themed background: the area below the last row let the page background show through, making the grid look punctured. The grid surface now follows the theme, in light and dark.

🔧 Recommended operational updates for upgrades

Review appsettings.json after the upgrade: the new keys have conservative defaults and need no action, but this is a good moment to go through them.
Performance Inspector: set AppSettings:enablePerformanceInspector to true to enable it; it stays off if the key is absent.
Webhook Hub: nothing to do to make it reachable. Tables, administrative routes and menu entries — gathered in a "Webhook Hub" submenu under Administration — are created on the first menu load, both on a fresh installation and when upgrading from an earlier version. What remains is configuring the integration: outbound takes three rows (the endpoint with target URL, shared secret, timeout and retry policy; the event; the subscription linking them), inbound takes an endpoint with inbound direction and a routing rule. The signature travels in the X-Wuic-Signature header; the full procedure is in the "Webhook Hub" page of the in-app documentation.
Theme Builder: the themes table is created on the first save. If you use custom themes, check the Excel export of a grid to confirm the colors are the expected ones.
Chatbot: the new actions are available after restarting the RAG engine; irreversible operations require confirmation and cannot be applied without it.
Linux behind a reverse proxy: if the installation answers on a non-standard port or over plain HTTP, regenerate the nginx configuration or manually align the existing vhost to proxy_set_header Host $http_host; and proxy_set_header X-Forwarded-Proto $scheme;. Upgrades do not rewrite an existing vhost.