v0.4.0

0.4.0 (2026-07-30)

⚠ BREAKING CHANGES

• repo: authentication can no longer be disabled. Before upgrading, take and verify a PostgreSQL backup. Remove AUTH_ENABLED from every environment file — the API refuses to boot while it is present. Set AUTH_SECRET to at least 32 characters, for example openssl rand -hex 32, in the root .env for Compose and in apps/api/.env for local development. On first start, open the web app and create the owner account; registration closes automatically once it exists. Existing sessions are invalidated and every MCP client needs a personal API token.
• web: gate every route behind a session
• api: require authentication on every request
• shared: replace the auth enabled flag with setup state

Features

• alerts: daily flush with grouped payload (b8d156f)
• alerts: delivery log with retention (a596afd)
• alerts: digest webhook formatting (ed5f2d6)
• alerts: email alert crud and config endpoints (afb2de8)
• alerts: grouped alert delivery (18af508)
• alerts: grouped email template (e2949a4)
• alerts: negative review alerts (eefc253)
• alerts: outbox dispatch mode (8661072)
• alerts: queued email delivery (a268090)
• alerts: queued webhook delivery with hmac signatures (44efb37)
• alerts: rank drop alerts from daily checks (d65cc13)
• alerts: smtp mailer and email formatting (ab396c5)
• alerts: webhook registry with crud endpoints (8c26774)
• analytics: app summary endpoint (cba7a1e)
• analytics: blended group visibility (9eec61e)
• analytics: portfolio summary endpoint (a8684ea)
• analytics: rank distribution history endpoint (616fe57)
• analytics: ratings history endpoint (f42fccb)
• analytics: visibility history for charts (a60bb84)
• analytics: visibility score computation (0c5664b)
• api: add swagger openapi docs at /docs (d4af179)
• api: app link endpoints (439ee30)
• api: auth module with register and login (adea72b)
• api: basic auth for bull board (2c00b84)
• api: entitlement guard and trial (a40e00d)
• api: format scoped email notifications (7ec7186)
• api: format scoped webhook notifications (6080216)
• api: global auth guard (a888916)
• api: global validation and consistent error envelope (c2efd1f)
• api: google play metadata audit (01271ba)
• api: grossing chart scheduling (b6fd935)
• api: openai client provider (20b5c92)
• api: openapi documentation at /docs (27caca1)
• api: password change with session reset (3863021)
• api: personal api tokens (1c96f69)
• api: pipeline signals in health endpoint (bf0faaa)
• api: play ratings histogram endpoint (e4a7246)
• api: require authentication on every request (56426d1)
• apps: add list detail and delete endpoints (d2387a8)
• apps: add manual refresh with snapshot diffing (7bcc55b)
• apps: import app from store url with initial snapshot (21830f9)
• apps: import honors store url country with override (501a03d)
• apps: market availability endpoint (e5b670d)
• audit history persistence (1e7b80c)
• audit: ai-driven audit from openai (ae16d5f)
• audit: app audit endpoint with manual inputs (24e4b17)
• audit: audit history endpoint (51e9d0c)
• audit: daily audit score snapshot (c731e14)
• audit: rubric engine with aso-skills factor weights (0966091)
• auth: gate the queue dashboard and openapi surface on an owner session (b92b2de)
• auth: login, register, api tokens and entitlements (c1a4723)
• auth: owner only admin surfaces (f4c8937)
• blended cross-store visibility for linked apps (a83c1c5)
• changes: change timeline endpoint (335e4ba)
• changes: persist metadata change events on refresh (14c5df6)
• changes: whats new change events (11d19f7)
• changes: workspace recent changes endpoint (f6ad0f6)
• competitors: add and manage competitor apps (2a5bb3a)
• competitors: capture competitor positions in daily rank checks (20c26a6)
• competitors: competitor discovery from serp entries (e0869f0)
• competitors: keyword comparison with gap analysis (24ab67a)
• competitors: keyword gap and positioning analysis (daa0c5b)
• db: add durable alert flush claims (4e89fd8)
• db: alert event outbox (36f491f)
• db: app group model (9fd97b1)
• db: audit score model (f89ac3f)
• db: category genre key migration (8c3d2b2)
• db: category rank model (4a2d049)
• db: change events and webhooks (c806b19)
• db: email alerts and alert deliveries (47933f8)
• db: keyword relevance override and audit inputs (c571235)
• db: persist scoring provenance (1e6e17d)
• db: review model (2ad91fb)
• db: serp entry model for daily top search results (923a953)
• db: suggest probe model (fdbe170)
• db: user and api token models (8cdc47c)
• docker: one command full stack compose (fa37bd3)
• docker: production images for api and web via turbo prune (72f04df)
• jobs: add daily pipeline scheduler with idempotent fan out (3d7a66d)
• jobs: add rate limited app store worker (0035ee7)
• jobs: configurable data retention job (8f43948)
• jobs: configure bullmq queues and redis connection (7bc53a7)
• jobs: daily request budget estimate endpoint (e747a53)
• jobs: daily review sync with import backfill (486e9f4)
• jobs: digest group section (1bb666d)
• jobs: gplay queue and worker (1e9227f)
• jobs: manual pipeline trigger per app (f7090cc)
• jobs: mount bull board dashboard behind config flag (956d296)
• jobs: per store daily budget (f186cf9)
• jobs: store routed job enqueueing (fabbdea)
• jobs: weekly digest schedule and payload builder (73d97f8)
• keywords: add metadata keyword extraction utility (fdf597f)
• keywords: auto track summary keywords for google play (2c35660)
• keywords: auto track title and subtitle keywords on import (48e25ff)
• keywords: competitor based keyword suggestions (1bc2caf)
• keywords: country-scoped keyword endpoints (65f86dd)
• keywords: developer suggestion strategy (7e28d51)
• keywords: expose previous day position on tracked keywords (3ad819e)
• keywords: expose scoring provenance (ab8ffe8)
• keywords: expose the captured rank depth (adc3121)
• keywords: manage tracked keywords via crud endpoints (49f7d6f)
• keywords: relevance updates and strategic keyword buckets (9e30b48)
• keywords: review mining suggestion strategy (d6d6b97)
• keywords: seasonal keyword calendar suggestions (7e7f93e)
• keywords: serp volatility on tracked keywords (c340b25)
• keywords: suggest spider endpoints and probe jobs (799a75e)
• keywords: suggestion strategies via metadata autocomplete and similar apps (524d245)
• keywords: support manual ios keyword field input (e54f0a5)
• keywords: track keywords per country under one app (6889f19)
• keywords: volatility sort key (52e84ce)
• mcp: drop the disabled auth preflight branch (da46aea)
• mcp: ranking audit and insight tools (ce04d06)
• mcp: read-only MCP server for agents (8d62bc1)
• mcp: server scaffold, api client and auth preflight (a3a0a2c)
• mcp: tool factory with app and keyword tools (359782d)
• metadata: metadata audit with keyword coverage matrix (b6781ac)
• metadata: openai draft assistant (dd2c843)
• monitor and portfolio quick wins (86c360a)
• openai-driven ai aso audit and metadata assistant (2cd89e7)
• play insights — availability probe, developer strategy, ratings histogram (744eed3)
• providers: app store reviews listing (0cdebc2)
• providers: availability and developer lookups (6ee9263)
• providers: google play lib wrapper (8669b19)
• providers: google play provider implementation (652b228)
• providers: release notes raw fact (d7a1670)
• providers: store aware raw facts (15b7d41)
• providers: top charts listing for the app store (72532ba)
• providers: typed raw snapshot facts extraction (8de2a9f)
• rankings: capture daily keyword positions from a single search (b2917c0)
• rankings: capture keyword positions to depth 200 (58972d5)
• rankings: category rank history endpoint (7776942)
• rankings: daily category rank capture (aae9233)
• rankings: persist top serp entries during keyword checks (e701aeb)
• rankings: ranking history endpoint for charts (ce21865)
• rankings: serp entrant alert event (77d3aa9)
• rankings: serp movers endpoint (90e9968)
• rankings: serp snapshot endpoint (cfa4f27)
• scoring: expose opportunity in keyword listing (4edd6d5)
• scoring: google play formulas (0d85d0f)
• scoring: google play stats collection (5a067e2)
• scoring: keyword stats collection with two request budget (b6b20f7)
• scoring: port aso-skills opportunity formula with relevance (117f6eb)
• scoring: pure traffic and difficulty formulas with tunable weights (6f7ed4c)
• scoring: record metric provenance (f05a9f8)
• scoring: scheduled and on demand keyword scoring (f6c80c5)
• shared: add rank depth constant and position formatter (c0fe7e1)
• shared: alert batch contracts (656b82b)
• shared: app group contracts (dffe175)
• shared: app list country and daily budget contracts (6a930be)
• shared: aso limits, metadata lint rules and audit contracts (89c098f)
• shared: audit history contracts (f45655d)
• shared: category genre key contracts (d12ac7b)
• shared: category rank contracts and collection union (5df385d)
• shared: change timeline and webhook contracts (373501d)
• shared: daily position delta and rank distribution history contracts (bd929f3)
• shared: define scoring provenance contracts (39f38e0)
• shared: email alert and delivery log contracts (eb2c5fc)
• shared: enable google play imports (d6cd442)
• shared: group visibility contracts (90767de)
• shared: keyword country on tracked item and country summary (5318978)
• shared: metadata assistant contracts (28adf3a)
• shared: metadata coverage field contracts (83e894b)
• shared: per store budget contract (3b4c8eb)
• shared: portfolio and weekly digest contracts (4f58dc5)
• shared: replace the auth enabled flag with setup state (3ade0c1)
• shared: review contracts, reviews strategy and negative review event (404dddf)
• shared: serp snapshot and competitor discovery contracts (54c6f82)
• shared: serp volatility and movers contracts (a54b826)
• shared: volatility sort entrant event and portfolio contracts (7c2412a)
• shared: whats new field, spider and pipeline health contracts (25e429b)
• web: add favicon, icon and apple-icon set (60a1573)
• web: add guided app setup checklist (a263772)
• web: add keywords dialog (4bf6dc4)
• web: add web app manifest and pwa icons (0bb7475)
• web: ai audit panel (e7185d4)
• web: alert delivery settings card (a0529a3)
• web: api token settings (a791335)
• web: app detail layout with section navigation (e399a49)
• web: app detail with summary strip and keyword table (0f5cbc4)
• web: app icon set, manifest and theme (4eb8ae8)
• web: app import dialog with validation and toasts (73d07da)
• web: app shell with navigation and health indicator (bf2daa4)
• web: apps dashboard with server prefetch (65e40e7)
• web: apps list with store url import form (35f4982)
• web: audit history chart and digest delta (6a45a71)
• web: audit score card on app detail (c87b65c)
• web: availability probe developer strategy and histogram (611b682)
• web: base layout and navigation shell (101d38d)
• web: blended group visibility row (90bb60e)
• web: bulk actions for selected keywords (e8f6ef9)
• web: category genre keys (118f67d)
• web: category rank chart on overview (2d102ed)
• web: change timeline view (9308d70)
• web: command palette (5b3f8cf)
• web: competitor analysis and keyword buckets views (f939c94)
• web: competitor discovery panel (ba37092)
• web: competitor management (c7b2bc0)
• web: core ui primitives via shadcn (8606132)
• web: country aware import and badges (7b5a5f3)
• web: country-scoped keyword queries and url state (5a1c7ec)
• web: csv export for keywords and rankings (c635a09)
• web: daily position delta in keywords table (9a16b03)
• web: dark mode with theme toggle (5080864)
• web: dashboard empty and error states (0531405)
• web: degraded state in health badge (7c848af)
• web: delete app with confirmation (b7711c3)
• web: email alerts and delivery log in settings (ae9cbdb)
• web: full api coverage with query options factories (3359105)
• web: gate every route behind a session (7885c14)
• web: google play import polish (23dc912)
• web: grouped portfolio rows (af9a4e2)
• web: ios keyword field editor (d998de1)
• web: keyword comparison matrix with gap filter (8970bfa)
• web: keyword movers and coverage cards (cd7f71d)
• web: keyword picker for ranking series (df0ab3a)
• web: keyword row actions (cd07be9)
• web: keyword suggestions with one click tracking (2f7b160)
• web: keywords table on tanstack react-table with row selection (7ed49ea)
• web: keywords table with url sort state (db9db0a)
• web: linked app navigation (6dd6290)
• web: login register and paywall pages (f595934)
• web: mcp server connect card in settings (e29e5bc)
• web: metadata assistant panel (b531a40)
• web: metadata workbench with live counters (76282ab)
• web: overview stat cards with deltas (485ceb0)
• web: per store budget breakdown (37bbe4b)
• web: per-country keyword filter and add flow (4471046)
• web: portfolio dashboard home (06a0751)
• web: proxy cookie forwarding (3702519)
• web: query and url state providers (ae2cbc0)
• web: rank distribution chart (8b47825)
• web: rank distribution history chart (795bb6a)
• web: ranking date range presets (677b2fb)
• web: ranking history chart with reversed position axis (286640c)
• web: recent changes feed on dashboard (63ff636)
• web: refresh and run daily actions with snapshot diff (8331e5e)
• web: render positions against the captured depth (32425c4)
• web: request budget card in settings (d21a504)
• web: reviews suggestion tab and alert event surfaces (66ac462)
• web: reviews tab with ratings chart and filters (82df361)
• web: route level loading and error coverage (13ede5a)
• web: runtime api proxy route (3c35626)
• web: serp movers card on rankings (08e1496)
• web: serp preview sheet on keyword rows (85af82f)
• web: serve the admin surfaces on the app origin (83f6ad8)
• web: set theme color and apple web app metadata (aeef487)
• web: shadcn ui foundation with neutral theme (c7fa3a0)
• web: show brand mark in site header (ee6c0f5)
• web: show pipeline-complete alert delivery (273d034)
• web: show scoring provenance (5f02a1e)
• web: start onboarding after first import (15e8ab0)
• web: store aware metadata workbench (d70c846)
• web: storefront grouped portfolio rows (c786f96)
• web: suggest spider dialog (6a6d423)
• web: typed api client with error handling (69db16e)
• web: visibility history area chart (f492995)
• web: volatility column in keywords table (da14b9b)
• web: webhook settings page (fafab92)

Bug Fixes

• alerts: address split delivery review findings (b84cd1f)
• alerts: format webhook payloads for discord and slack (4313dce)
• alerts: keep batch events flat and flush before marking sent (f95de97)
• alerts: render batch webhook detail for discord and slack (40c687e)
• alerts: render batch webhook detail for discord and slack (037b022)
• alerts: render batched webhook body for discord and slack (1c2d226)
• alerts: scope outbox dedupe by workspace and keep rows consistent (38b3441)
• analytics: align group visibility capture dates (94be6e5)
• analytics: align group visibility capture dates (aebb2a9)
• analytics: drop movers without both compared captures (a7c060c)
• analytics: drop the stale zero delta from a single audit snapshot (22561c1)
• analytics: treat a non-positive mover position as unranked (7116af9)
• api: bound the openai client timeout and retries (2178c57)
• api: enable cors for the web frontend (41fb87c)
• api: rate-limit token creation, map unique violations to 409, add trust-proxy option (05752ef)
• api: reject non-stop openai completions and cover the adapter (c452f91)
• api: serialize bigint values in json responses (9eb2357)
• api: treat blank openai env values as unset (1066a02)
• audit: ground ai factors in evidence and coalesce runs (639a411)
• audit: normalize history bounds to the utc day (054b556)
• audit: score only observable ai factors and reject empty output (a6f1d05)
• auth (3795604)
• docker: web api url (0340787)
• harden availability and histogram edge cases (f87dd33)
• jobs: colon-free custom job ids for bullmq 5 (898356f)
• jobs: isolate e2e queue onto a separate redis db (e1322ea)
• mcp: name the depth field the keyword payload returns (b16f0b1)
• mcp: reject unentitled accounts and encode path segments (6d48311)
• metadata: market-scope drafts and enforce the field contract (7d624c3)
• providers: scrape ios subtitle from product page (400e8e7)
• rankings: capture keyword rankings regardless of app home country (28efc72)
• rankings: use the same-day snapshot as the entrant baseline (5b84e6a)
• repo: address review findings on the quality refactor (e95a632)
• repo: address stabilization review findings (af7a669)
• repo: patch release readiness dependencies (6290c36)
• repo: resolve split alert delivery review findings (77a9e72)
• repo: widen the dependency overrides to security ranges (f6b031c)
• scoring: fail scoring when the play prefix sweep breaks (5de8f1a)
• scoring: skip scoring gracefully when the keyword is gone (b687631)
• scoring: tolerate suggest failures when collecting keyword stats (d0e0ad9)
• shared: share the metadata assistant request contract (ed646ee)
• shared: treat every non-positive rank as unranked (5d1633d)
• tests: e2e failing on ci (c1d2d2b)
• web: bound proxy upstream, forward client ip, gate protected content, reset auth dialogs (6db20ee)
• web: clear command palette search when it reopens (7b3a130)
• web: forward tooltip trigger props through the sort header (16a3dcb)
• web: keep settings reachable on small screens (2bfe7e2)
• web: make guided setup opt-in and recoverable (8a1a33f)
• web: navigate consistently on every session transition (69c9f42)
• web: render a single api health badge (5236e69)
• web: report metadata draft copy failures (7f379e7)
• web: scope score provenance to measured metrics (25e72d6)
• web: serve groups from the e2e portfolio mock (714450a)
• web: show >100 for unranked series in ranking tooltip (5786b7e)
• web: surface lint messages and share metadata display maps (cd92725)
• web: sync command palette open ref synchronously (ac0d87a)
• web: wrap recent changes list in TooltipProvider (5a6b4fc)
• web: wrap recent changes list in TooltipProvider (f5444e5)

Refactoring

• alerts: split durable alert delivery (74f7450)
• analytics: extract shared read helpers (a8ab20f)
• analytics: move portfolio roll-up into its own provider (f301004)
• analytics: move weekly digest builder into its own provider (11591f9)
• api: make alert flushes resumable (3a7725c)
• api: separate alert batch classification (8e72a73)
• api: split and order alert batch delivery (9582488)
• apps: extract linked-app group logic into its own provider (67b6e0f)
• audit: extract shared check scoring primitives (ab2e641)
• auth: track the admin grant in a weakset (6c56c6b)
• competitors: move competitor crud out of the apps service (cf8425e)
• jobs: flush alerts after daily pipeline completion (5bfb97f)
• keywords: confirm keywords service is core crud and compare (8d40dec)
• keywords: extract shared keyword helpers (e9608d0)
• keywords: extract spider into its own provider (79663e8)
• keywords: extract suggestion strategies into their own provider (fdd2f9c)
• metadata: extract draft prompt building and parsing (5cc9997)
• rankings: extract serp reads into their own provider (80acabe)
• rankings: isolate rank alert dispatch (ecae096)
• repo: execute the code-quality plan (q0-q6) (c34d4f9)
• repo: remove dead code and stray imports (778011b)
• shared: add job enqueue contracts (dc19dad)
• shared: consolidate api contract types (08f614b)
• shared: define mutation request contracts in shared (938564a)
• shared: require the captured depth on rank payloads (57049cd)
• web: drop phase 9 ui primitives (978353f)
• web: extract api client core (d2f5b57)
• web: extract keyword csv export (43423e4)
• web: extract keyword table cells (a17135f)
• web: extract keyword table columns (48adc78)
• web: frame import country as home storefront (b0fc2b8)
• web: move endpoint functions into domain api modules (ac88f97)
• web: remove legacy components and dead code (f64a281)
• web: responsive and accessibility pass (45b6bb7)
• web: share alert channel card primitives (27c6b6b)

Documentation

• add code organization standards (1930d2c)
• add phase 11 aso audit plan and new commit scopes (f1f2692)
• authentication setup (3353e73)
• clarify registration toggle and document proxy env vars (737fc55)
• complete alert env reference (751ce85)
• correct ai empty-key behavior and rubric reference (dde51d9)
• describe the split web transport (e28f2b1)
• docker: add backup restore and upgrade runbook (776f247)
• docker: rotate the database password with its env file (b12156c)
• frontend guide and updated readme (35ab12a)
• google play support (332346e)
• grouped alert delivery (13e7cc5)
• mark phase 10 complete (a631873)
• mark phase 11 complete (0b5fbf1)
• mark phase 24 complete (6b7871a)
• mark phase 25 complete (870378b)
• mark phase 26 complete (32a024f)
• mark phase 3 complete (c9cca98)
• mark phase 30 complete (d3eddfe)
• mark phase 31 complete (17ca3bf)
• mark phase 32 complete (0c1f118)
• mark phase 35 complete (f72816d)
• mark phase 36 complete (39c9a3a)
• mark phase 38 complete (9ca8f42)
• mark phase 4 complete (d472742)
• mark phase 5 complete (b91685d)
• mark phase 6 complete (95cedf5)
• mark phase 7 complete (b328928)
• mark phase 8 complete (4a93d14)
• mark phase 9 complete (50e72e4)
• mark quality phase q0 complete (bffd68a)
• mark quality phase q1 complete (8986680)
• mark quality phase q2 complete (7bc10cf)
• mark quality phase q3 complete (0ec5400)
• mark quality phase q4 complete (8b8608d)
• mark quality phase q5 complete (092637b)
• mark quality phase q6 complete (d736ffa)
• mcp server usage (df33778)
• multi country tracking notes (01430ea)
• multi-country keyword tracking model (d3c46e9)
• openai ai features setup (8a711c0)
• project readme with quick start and configuration reference (1ead791)
• repo: add contribution, security and issue templates (6db5cf0)
• repo: define the road to 1.0 (eae811d)
• repo: describe owner-only access to the admin surfaces (cf0b7c0)
• repo: document durable split alert delivery (836ac43)
• repo: document mandatory authentication (ae8a592)
• repo: document the current product (3ea1e01)
• repo: normalize shipped phase history (5c3cd1f)
• repo: record how release notes reach the changelog (41aecc5)
• repo: scope the admin gate wording to API_DOCS modes (3a13f94)
• retention settings and runtime api url (f57c5e4)
• vendor aso-skills reference rubrics (48ee96e)

Build and Deployment

• docker: harden production compose defaults (9040c60)
• docker: remove build time api url from the web image (64ecf49)
• docker: run application images as non-root (9780515)
• repo: allow identifiers in commit subjects (17d7d8e)
• repo: enforce conventional commits with commitlint (a85167b)
• repo: format every file type prettier owns on commit (dbfeff5)
• repo: generate prisma client as a turbo prerequisite task (0ee9db4)