Release Test

Merge pull request #857 from Blue-Dots-Economy/feature

promote: feature → develop (2026-10-11 cycle)

v1.0.0-mobile-testv2: fix(web): clamp dashboard cell popovers by their measured width (#793)

Addresses the PR #817 review. The FunnelCell / ProgressTiny popovers were
clamped to the viewport with a hardcoded width (176 / 136) that did not
match what they render: ProgressTiny is at least 142px, and FunnelCell's
labels come from network config (dashboardBuckets), so its width is
deployment-dependent. Near the right edge the 8px gutter collapsed to
2px/0px, and a label with no break points pushed the popover past the
viewport and widened the page.

- Both popovers get max-w-[calc(100vw-1rem)] + wrap-anywhere, so their
  width is always bounded by the viewport.
- The popover renders at the page's left edge first, then a layout effect
  measures its real width and clamps it beside its cell with the gutter,
  before paint. The width constant is gone.
- Close-on-scroll now only fires when the cell actually moved. The
  viewport widening in the overflow case fired a scroll event that closed
  the popover ~30ms after opening, so it could never be read.
- Tests cover the right-edge clamp, a popover that already fits, the
  left-edge gutter, and scroll with/without cell movement; reverting any
  of those fixes fails a test.

mobile view test

feat(web): make the logged-in portal usable on mobile (#793)

Keeps the current design and changes only how it lays out on narrow
screens. From 1024px up the portal renders exactly as before.

- Below lg the sidebar is hidden; a slim bar (menu button + logo) opens
  the same sidebar as a slide-in drawer. It closes on Escape, backdrop
  tap, following a link or widening to desktop, locks page scroll and
  keeps focus inside while open.
- Page padding shrinks on phones; Topbar title and actions stack and wrap.
- Dashboard: stat cards two per row; the toolbar wraps below sm only;
  the select + identity columns are frozen from md up only; bulk-action
  bar and pagination wrap; the cell breakdown popovers also open on tap
  and keyboard focus, clamp to the viewport and close on scroll.
- Registration link cards stack their actions and let a long URL wrap
  inside the pill on phones; success toasts span the width on phones.
- Profile pages: smaller padding, header/footer rows wrap.
- Support dialog height uses dvh so it fits under mobile browser chrome.
- Form fields use 16px text on phones so iOS Safari does not zoom on
  focus; row checkboxes are fully visible on touch screens.
- New nav.open_menu / close_menu / menu_label strings (en, hi, kn).

ALIMCO (TCS) deployment — 202609-s1-rc3-alimco

Pins the exact commit deployed to the ALIMCO/TCS environment (blralimcoapp01).

Base: 202609-s1-rc3
8 additional commits beyond rc3.

Not a general release — client-deployment marker only.

202609-s1-rc2

Release candidate cut from main @ 2452445d.

Changes since 202609-s1-rc1: 29 commits. Full diff: 202609-s1-rc1...202609-s1-rc2

Promotion PR: #772

Release Notes

Bulk upload (#564)

• Coordinators now download a generated XLSX workbook per participant type instead of a bare sample CSV: four tabs — Instructions, Allowed values, Sample data, and an empty grid with a dropdown on every closed-set column. GET /v1/bulk-uploads/template?participant_type=…&format=xlsx; ?format=csv remains the default. (#754)
• The upload path is unchanged and still accepts .csv only — the workbook is what an operator fills in and then exports as CSV.
• The previously committed bulk-samples/*.csv are gone: they had rotted into templates the parser itself rejects.

Security

• next raised to 15.5.24+ and sharp to 0.35.4, clearing two CRITICAL Next.js RCEs (CVE-2026-75604, GHSA-2xp9-vwfh-vxw4) and a HIGH libheif advisory (GHSA-rgj7-g3m4-5g8c).
• Placeholder dev credentials removed, profile export bounded, flat-mode registration limited. (#751)
• Approval-token verify endpoints rate-limited. (#730)
• Hardcoded secrets removed from local-setup/.env.example.
• Admin approval actions are written to the audit log; the Keycloak-auth blocker is documented. (#610)
• vitest 4.1.11 as the CVE-2026-84373 floor. (#766)

Auth / portal

• Cross-app sign-in escape closed in both the app and the Keycloak deny page; dashboard filter menu fixed. (#758)
• Campaign-manager description no longer exceeds the Keycloak realm column. (#762)
• The portal reads its UI settings at runtime rather than baking them into the image. ENABLED_LANGUAGES replaces NEXT_PUBLIC_ENABLED_LANGUAGES, so changing the language set is an env edit plus a restart — no image rebuild. The prefixed name is still read as a fallback so deployments can migrate without a flag day. (#752)
• An already-registered user sees the already-registered outcome instead of the pending screen.

Config

• alimco brand added under purple_dot. (#763)

Housekeeping

• Org-hierarchy submit tests no longer share a rate bucket.
• Weekly Dependabot batch, 2026-09-11. (#767)

The bulk-upload template work appears in history as an in-branch revert followed by a re-land via #754. The net state is the #754 implementation.

In Plain Terms

The visible change is for people who upload participant lists: instead of a bare CSV they get a proper spreadsheet with drop-downs, worked examples and a guide, so there's far less guessing about what belongs in each column. They still save it as CSV to upload. Separately, the portal stopped baking settings like "which languages are available" into the app at build time — an operator can now change them by editing config and restarting, rather than requesting a new build. The rest is security hardening, including two critical Next.js patches.

Deploy ordering

No cross-repo ordering constraint for this repo in this release.

202609-s1-rc1

Release candidate cut from main @ c7ef1f9b.

Changes since 202608-s2-rc1: 18 commits. Full diff: 202608-s2-rc1...202609-s1-rc1

Promotion PR: #746

Release Notes

Features

• Invite-only coordinator registration (#619 #699 #700 #701 / #718) — owner (organisation) registration moves to the unlisted /register/owner deep link; /register becomes the coordinator-only flow. Adds email-bound coordinator invite tokens (14d) minted by the org owner from a 90d grant link, bulk paste of up to 10 recipients, and per-IP plus per-org rate limits on the mint endpoint. Migration 0021_registration_invites.
• Stranded-org recovery + externalised email copy (#743) — re-send an org's invite link when the original was lost, and move email copy out of TypeScript into config/**/emails/messages.properties.
• Append-only campaign PII-action audit log (#617 / #729) — migration 0022_campaign_pii_audit.

Fixes

• Account-only registration no longer drops the birth year (#613 / #747) — performSubmit stamped year_of_birth from state that the account-only surface never writes, overwriting a real selection with an empty string. The API read that as no age, treated unknown age as adult, and Signals rejected the push with AGE_REQUIRED on every guardian-gated domain — i.e. every domain that shows the field. The resolved year is now threaded through both submit paths and held across the consent gate. Client-only, so it affects the web image. Surfaced via voice links but not voice-specific.
• Legal-page layout parity (#719).
• fast-uri vulnerable-transitive floor (#740).

Chores

• Dependency batches #727, #731, #732, #735, #737, #738, #741; Dependabot and scheduled scans moved to a monthly cadence (#742).

Configuration (all defaulted; override only to change behaviour)

INVITE_TOKEN_TTL_SECONDS (14d), GRANT_TOKEN_TTL_SECONDS (90d), INVITE_MINT_RATE_WINDOW_SECONDS (3600), INVITE_MINT_RATE_MAX_PER_WINDOW (100), INVITE_MINT_MAX_RECIPIENTS (10), REGISTRATION_COOLING_MINUTES (720), ORG_INVITE_RESEND_RATE_WINDOW_SECONDS (3600), ORG_INVITE_RESEND_RATE_MAX_PER_WINDOW (3).

Deploy notes

• Requires global.orgHierarchyEnabled: true, or /register/owner returns 404. Already set on up-gzb-blue-dots-prod-cluster and Ka-dhwd-blue-dots-prod-cluster.
• config/**/emails/messages.properties ships inside the image (COPY /app/config); the chart's ConfigMap mounts are single-file subPath overlays, so they do not shadow it. No chart or ConfigMap change needed.
• api, web and worker images must move together.
• Migrations 0021, 0022. KA-Dharwad additionally needs 0019 and 0020.

Payload notes

• The birth-year fix landed three times: a direct push to develop (75b98c6a), a revert of it (b2d0c8c5), then the reviewed PR #747 (3661c154). Net effect is the fix present once, via #747 — verified against main: the test file added and the view modified.
• A standardised target OpenAPI spec was committed (0d109c49) and reverted (deff3e54) within the branch — net no change.
• 3dc2d2c7 is the main → feature sync-down that restored main ⊆ develop ⊆ feature before this cycle; 38a3492b is the feature → develop promotion (#745).
• Post-release: #747 and the birth-year fix went in via develop, so feature does not have them. Sync main → feature.

202608-s2-rc1

Sprint release candidate promoting develop → main (53 commits; smoke-tested on develop).

Promotion PR: #722

In Plain Terms

Ships the campaign-manager tooling (participant PII export, voice campaigns, email campaigns, non-PII dump), the registration/consent improvements, a large security cleanup, the brand-logo alignment, and routine dependency/CI upkeep — moving all of it from the tested develop line to main.

Release Notes

• Campaign-manager suite (shared async-job engine): durable job engine + PII export (#579); voice channel via Raya (#577); email channel (#578); whole-network non-PII dump download API (#692).
• Registration / consent / onboarding: per-deployment onboarding-mode gating via AGGREGATOR_ONBOARDING_ENABLED (#663); scroll-gated consent (#636); pre-form "Already Registered — Sign In" chooser (#652); post-submit redirect to the Signals UI (#635); on-demand registration QR, dropping the S3 round-trip (#650).
• Local stack: signals-search in the unified stack behind a search profile.
• Brand: base blue-dot logos aligned with up-gzb/ka-dhwd + shown on the Keycloak login hero (purple-dot deferred — blue-dot only).
• Fixes: 23 SonarQube vulnerabilities resolved, Security rating D → A (#659); worker /healthz liveness endpoint (#675); read-only identity probe (#648).
• CI / platform: hash-pin all Actions (#693) + security-scan ref pinned to main SHA (#645); all images on Docker Hardened Images (#623); codeql-action v4 (#633); trivy-action bump (#634); coordinated @rjsf/* v6 (#683) and React 19 (#682) upgrades; grouped dependabot bumps.
• Docs: campaign subsystem + new packages + worker roles documented in CLAUDE.md.

v1.0.0-release

Blue Dots Economy — Release Notes

Release Window: 11–12 Jun 2026
Components: Signal Stack (Network Backend) + Aggregator Portal

This release brings flexible participant onboarding, location-based discovery, a new public tourism app, and a substantially upgraded aggregator dashboard.

---

🧭 Flexible Participant Onboarding

Onboarding no longer requires complete information up front.

• Field staff, bulk imports, and partner data can now register a participant with just minimal details (phone/email + name). The full profile can be completed later via a follow-up link or assisted data capture.

• Profiles now follow a clear lifecycle:

  In Progress → Ready
  

  Only Ready profiles are discoverable and eligible for connections, ensuring incomplete records never appear publicly or create dead-end interactions.

• Profiles can be paused and resumed without losing information.

• When a participant already exists under another aggregator, the system signals this clearly without exposing personal details or revealing who onboarded them.

---

📍 Location-Aware Discovery & Maps

• Address autocomplete during profile creation using Google Places, with a free fallback option.
• Providers can now serve multiple locations and appear on the map in every city they serve, not just their primary location.
• "Near Me" discovery uses the visitor's current location to surface the closest options first.
• Privacy by design:
  • Exact/private residential addresses are never displayed.
  • Only approximate city-level locations are shown.
  • Public business contact information remains visible.

---

Orange Dots — Udupi Tourism (Launch Ready)

A new public, login-free tourism application.

Features

• Visitors can discover nearby local practitioners, including:

  • Stays
  • Guides
  • Artisans
  • Experiences

• Interactive map and nearest-first listing view.

• Direct actions:

  • Call
  • Visit Website
  • Get Directions

• Practitioner listings include:

  • Categories
  • Services
  • Languages
  • Pricing

---

📊 Aggregator Dashboard — Major Upgrade

Dashboard Redesign

• New summary bar.
• Onboarding funnel visualization.
• Grouped Profile and User metrics.

Connection Insights

• Connections are now split into:
  • Requests Sent
  • Requests Received
• Per-user connection averages are displayed.

Bulk Actions

• Select participants across multiple pages.
• Export selected participants to CSV.
• Foundation laid for additional bulk actions in future releases.

Onboarding Analytics

Dashboard now surfaces:

• Registered participants
• Verified participants
• Participants grouped by entry mode

Fixes

• Fixed an issue where participant names occasionally displayed internal IDs instead of actual names.

---

🌐 Multi-Language Support

The portal and applications are now available in:

• English
• Kannada
• Hindi

An in-app language switcher allows users to change languages at any time.

---

🤝 Connections & Matching

• Bulk Connect, Accept, and Reject actions with an explicit consent step.
• Provider-to-provider connections are now supported.
• Participants are restricted to a single role per network:
  • Seeker or
  • Provider

This ensures consistency in matching and network interactions.

---

🔧 Platform Improvements

• Cross-platform local development support, including native Windows environments.
• Deployment workflow improvements.
• CI/CD reliability and maintenance enhancements.

What's Changed

• feat(F-01.1): pnpm workspaces + turbo pipeline by @AbhiGaddi in #193
• feat(F-01.2): TS strict + shared tsconfig base by @AbhiGaddi in #197
• feat(F-01.3): ESLint/Prettier + husky hooks by @AbhiGaddi in #202
• feat(F-01.4): CI workflow (lint / typecheck / test / build) by @AbhiGaddi in #207
• feat(F-01.5): conventional commits + changesets by @AbhiGaddi in #211
• feat(F-01.6): Dockerfiles per deployable by @AbhiGaddi in #216
• fix(ci): remove explicit pnpm version from action-setup to avoid pack… by @AbhiGaddi in #218
• [EPIC] P-01 Monorepo & Build System #1 by @AbhiGaddi in #217
• feat(P-02): Shared Primitives & Interface Conventions by @AbhiGaddi in #242
• feat(P-03): config-loader package (ConfigService) by @AbhiGaddi in #278
• Feat/aggregator portal nextjs by @AbhiGaddi in #325
• feat(auth): OIDC Auth Code + PKCE BFF with Keycloak + Redis sessions by @AbhiGaddi in #326
• feat(aggregator): registration + admin approval + profile flow by @AbhiGaddi in #328
• Feat/aggregator vm public ip deploy by @AbhiGaddi in #329
• Nginx and conf updates by @vinodbhorge in #331
• feat(errors): standard error envelope, HttpError catalogue, structured pino logs by @AbhiGaddi in #330
• feat: onboarding pipeline (bulk + link) end-to-end by @AbhiGaddi in #334
• Feat/participants writer by @AbhiGaddi in #336
• fix(web): use PUBLIC_PORTAL_URL for post-logout redirect URI by @AbhiGaddi in #337
• Feat/aggregator type enforcement and draft edit by @AbhiGaddi in #338
• feat(web): scope My Blue Dots tabs by aggregator type by @AbhiGaddi in #339
• Feat/signalstack writer by @AbhiGaddi in #340
• Implement nginx ingress with TLS and update Keycloak integration by @vinodbhorge in #335
• Feat/onboarding restructure and bluedots tabs by @AbhiGaddi in #341
• fix(web): wait for profile before mounting blue-dots tab by @AbhiGaddi in #342
• feat(web): toast on csv upload + redirect to onboarding after link cr… by @AbhiGaddi in #343
• Feat/signalstack aggregator upsert by @AbhiGaddi in #344
• feat: generic aggregator — same image runs any signalstack network by @AbhiGaddi in #345
• feat(config): per-network config folders + single env switch by @AbhiGaddi in #346
• Promote feature → develop by @AniketSaki in #357
• fix(web): drop Pre-Shortlisted column; wire Applied header; add New status card by @AniketSaki in #358
• fix(public-form): brand-aware header + clean cold mount by @AbhiGaddi in #359
• feat(web): shadcn-driven Select + MultiSelect for RJSF widgets by @AbhiGaddi in #360
• fix(forms): native input types for URL + email RJSF widgets by @AbhiGaddi in #361
• revert: pull shadcn select + url/email widgets out of develop (#360, #361) by @AbhiGaddi in #363
• feature → develop: dashboard config-driven, RJSF widget overhaul, onboarding Actions column, CI scope by @AniketSaki in #367
• feat(orange_dot): add Udupi tourism network + network-agnostic plumbing by @AbhiGaddi in #374
• feat(orange_dot): OneTAC rebrand + sienna palette + unified themes by @AbhiGaddi in #376
• ci(keycloak): add scoped image-build workflow by @AbhiGaddi in #377
• feat(theme): remove Blue Dots literal from aggregator-realm.json by @AbhiGaddi in #378
• Update Keycloak workflow and add themes workflow by @vinodbhorge in #415
• Promote feature → develop: dashboard redesign, onboarding lifecycle, i18n, bulk actions by @AbhiGaddi in #418

Full Changelog: https://github.com/Blue-Dots-Economy/aggregator-dpg/commits/v1.0.0