Changelog

All notable changes documented here. Format: Keep a Changelog. Versioning: SemVer.

---

[1.0.0] - 22nd May, 2026

Core Architecture & Developer Experience

• Agent-Native Architecture — Integrates Graphify AST-level codebase mapping to eliminate AI agent hallucination and reduce AI token usage by up to 71.5x.
• AI Developer Tooling — Includes dedicated .agents/ skills and workflows alongside AGENTS.md and CLAUDE.md for zero-hallucination AI-assisted development.
• Strict Tech Stack — Utilizes Next.js 16 App Router, TypeScript 6 (Strict), Drizzle ORM, and Zod validation. Guarantees testing parity with 900 unit tests and comprehensive E2E Playwright coverage.
• Interactive Setup Wizard — Provides a robust CLI with interactive prompts, automatic environment variable generation, and manual database bootstrapping instructions. Generates exclusively .env.local to avoid clutter, wraps special-character values in double quotes, and guarantees clean builds.
• Universal Background Jobs — Decouples transport logic into swappable Upstash QStash and Trigger.dev adapters with unified dependency health checks.
• Modular Background Jobs — Decoupled configuration validation (lib/jobs/config.ts) from dynamic Database/handler pathways to safeguard system health endpoints without side effects.
• Performance Optimization — Employs Promise.all for parallel database queries, cursor-based pagination, request-level React cache(), and dynamic imports to ensure high performance.
• Avatar Storage RLS Bypass — Uses service role client for avatar upload URL generation and deletion to bypass storage.objects RLS, with session identity validated first.
• Middleware Profile Fallback — Profile resolution queries the user-authenticated client first, falling back to service role only when the profile is not found and a valid SUPABASE_SECRET_KEY is present.
• Locale Scoping & Type Integrity — Hardened AI legal page publishing and configuration transitions to isolate workflows completely by locale and type, preventing accidental cross-locale state conflicts.

Design System & UI

• Glassmorphism 2.0 — Delivers premium crystal surfaces (bg-white/50 backdrop-blur-2xl), tri-font typography (Space Grotesk, DM Sans, Fragment Mono), and OKLCH color tokens.
• Touch-First Ergonomics — Enforces strict 44px minimum tap targets, fluid Bento Grid layouts, and iOS safe-area integration for mobile perfection.
• Dynamic Interactions — Features animated GlowCards, emoji loaders, spring-physics collapsible navigation, and smart sticky headers using motion/react.
• Super-Admin Dashboard — Supplies 17 modular management tools for users, billing, support tickets, waitlists, and AI-powered legal document generation, all featuring standardized UI and centralized CSV exports.
• Internationalization (i18n) — Maintains 100% key parity across EN, ES, and FR locales with localized marketing forms and transactional emails.
• Avatar Aspect Ratio — Global AvatarImage uses object-cover object-center for automatic 1:1 cropping and normalizes empty src to undefined to prevent browser warnings.
• Testimonials Network Optimization — Eliminated remote dependencies on external random avatar providers, adopting dynamic high-fidelity CSS-native glassmorphic gradients and initials, alongside an explicitly hardened Next.js allowedPatterns image configuration.
• Core Web Vitals Tuning — Dynamic progressive loading separates marketing page components into Server and Client lazy wrappers (BelowFoldSections.tsx) to drastically cut main-thread blocking time.

Security & Authentication

• Enterprise Authentication — Supports passkeys, magic links, OAuth (Google/GitHub), and TOTP MFA with step-up verification, secure email verification, PKCE-style server-side verification, and fail-closed middleware enforcement.
• Email Verification Redirect — Server-side OTP confirmation immediately redirects to /verified, eliminating duplicate page renders and client-side flash.
• OWASP Compliance — Enforces Row-Level Security (RLS) on all 32 tables, strict CSP nonce policies, SSRF URL sanitization, and cryptographic safety (zero Math.random() in server code).
• Edge Rate Limiting — Integrates Upstash Redis to provide route-level rate limiting, brute-force bans, and circuit breakers across 56+ public and authenticated API routes.
• Impersonation Safety — Enables super-admin user impersonation backed by HMAC-signed cookies, auto-expiry, and instantaneous UI layout synchronization.
• Defensive Deletion — Implements fail-closed account deletion to securely cancel all active payment provider subscriptions before wiping user profiles and storage.

Payments & Billing

• Universal Payment Adapter — Integrates Stripe, Polar, Lemon Squeezy, Dodo, and Creem via a single environment variable with retry-safe webhook idempotency.
• Complex Billing Models — Manages subscriptions, usage-based credits, one-time/lifetime purchases, and team seat entitlements natively.
• Checkout Security — Creates guest-safe checkout sessions, prevents external return targets via same-origin validation, and safely fulfills digital products via signed tokens.
• Billing Transparency — Features a high-fidelity billing dashboard to render tiered resource limits dynamically and manage lifetime access serialization.

AI & Intelligence

• Universal AI Adapter — Supports Gemini, OpenAI, Anthropic, and DeepSeek for high-quality chat, intent detection, and structured JSON outputs.
• Google GenAI 2.5.0 Upgrade — Integrated @google/genai v2.5.0 SDK, designating gemini-3.5-flash as primary chat model with robust custom schema mappings for legal page creation.
• RAG & Knowledge Base — Deploys a pgvector embedding pipeline (3072-dim) with cosine similarity and a super-admin managed document repository.
• Embeddings Dimension Protection — Standardized embedding processes on gemini-embedding-2 yielding a stable 3072-dimensional vector footprint with explicit runtime boundaries and zero pgvector dimension pollution.
• Universal AI Voice Adapter — Supports swappable text-to-speech (TTS) and speech-to-text (STT) services via ElevenLabs and Murf AI with request-time key resolution and integrated SSRF guards for immersive voice conversations in over 29 languages.
• Autonomous Support — Includes an AI chat widget with 100+ language support, lazy conversation creation, and seamless escalation to human support queues via Supabase Realtime.

Platform Features

• Organizations & Multi-Tenancy — Provides full organization RBAC with owner, admin, and member roles alongside tier-based project management limits and invite systems.
• Universal Email Adapter — Wraps SendGrid, Resend, Postmark, and Brevo into zero-code adapters featuring 13 localized transactional React Email templates.
• Universal Analytics Adapter — Supports 9 analytics providers (including Mixpanel, PostHog, Plausible) in a consent-gated, CSP-compliant architecture.
• Affiliate System — Drives growth via built-in referral tracking with IP hashing, cookie-based attribution, and atomic payout management.

️ OWASP Top 10 (2025) — Full Compliance

• ✅ A01 — Broken Access Control — Block SSRF via lib/security/ssrf.ts with 25+ unit tests
• ✅ A02 — Security Misconfiguration — Validate env at build-time; run 9 HTTP header tests
• ✅ A03 — Supply Chain — Run npm run security:audit in CI; maintain CycloneDX SBOM and Dependabot
• ✅ A04 — Cryptographic Failures — lib/security/crypto.ts replaces all Math.random() in server code
• ✅ A05 — SSRF — Audit LLM prompt injection; defense-in-depth via ssrf.ts
• ✅ A06 — Insecure Design — Maintain STRIDE threat model with 6 abuse case scenarios
• ✅ A07 — Auth Failures — Provide password strength meter and universal MFA across all vectors
• ✅ A08 — Data Integrity — Use SRI hashes on CDN scripts and verify all JSON.parse() calls
• ✅ A09 — Logging & Alerting — Maintain append-only auth_events with logAuthEvent() and brute-force detection
• ✅ A10 — Exceptional Conditions — Enforce fail-closed MFA, production fail-closed rate limiting, payment timeout handling, and graceful shutdown

---

️ Technical Stack

---

Role Terminology

⚠️ Platform super-admin uses hyphenated format (super-admin, not super_admin). All RLS, code, and docs use this consistently.

---

Copyright © 2026 Vibe44. Built with ❤️ by Scale with Alap.