v0.2.1 — View and delete document versions, and zoom the PDF viewer

Document versions

• Choose any version in "Versiones" to view it in place of the current one.
  The choice lives in the address (?version=N), the viewer says which
  version is shown and offers "Ver la actual", and the download and the
  signature validity panel follow the shown version. Viewing leaves no trace.
• Delete the latest version (never the only one) after confirming; the
  previous version becomes current again with its page count. Signed
  versions can be deleted too: the dialog warns that the signed file goes
  while the signature record and its trace stay.
• Deletion is a soft delete: the version row is kept so every trace and
  signature record that names it survives, and its encrypted object is
  removed from storage. Version numbers are never reused (after deleting
  v3, the next one is v4). New document_versions.deleted_at column
  (migration included).
• Each deletion records a "Versión eliminada" trace. Deleted versions show
  as "vN (eliminada)" in the signature history, the signature log, the
  certificate's signatures and Trazas, and their signatures no longer count
  as the document's (status, counts and the page-edit lock).
• New deleteLatestVersion procedure. It answers CONFLICT when the version
  is no longer current, and signing and page edits are serialized against
  a deletion so none builds on a version another one just removed.

PDF viewer

• Zoom from a bottom bar or with Ctrl+wheel (and trackpad pinch), keeping
  the point under the cursor in place.

Docs

• OpenSpec: the change was proposed, synced into the document management,
  signing, signature log, page editing and activity trace specs, and
  archived.

v0.2.0

v0.2.0 — Two-step verification, closed sign-up and signing by touch

Authentication and limits

• Optional TOTP two-step verification: each user turns it on from their
  profile and is asked for the code at sign-in, typed into per-digit slots
  that submit once complete. New two_factor table and
  user.two_factor_enabled (migration included).
• DISABLE_SIGN_UP closes self-service sign-up by email and SSO; admins
  keep creating accounts, the sign-up link is hidden and /signup shows a
  closed notice.
• Heavy document operations are limited to 2 concurrent and 30 per minute
  per user, so one account cannot exhaust memory with PDFs.
• Request bodies are capped at 25 MiB in Bun.serve, covering routes
  outside the oRPC limits such as /api/auth.

Touch and mobile

• Phones sign by tapping the stamp into place, keep swipe scrolling on the
  pages and dock the sign button under the PDF.
• The library, page editor and upload dialogs work by touch: visible
  checkboxes, 44px actions and tap wording.
• Content and fixed bars stay clear of the notch on landscape phones.
• Home: a wider signing desk, a drop sheet fitted to phones, and the
  certificates and library side by side under it on narrow layouts.

Typography and UI copy

• The remaining hand-built type classes (admin, comments, documents, the
  mobile menu, metadata, filters and checkbox captions) now use Text
  roles and tones.
• The sign-in and sign-up cards are titled with a display h1.
• Numbers stay bound to their units and middle dots to the fact before
  them, so narrow columns wrap between facts.
• Names are quoted with «» and trail off with a single … in UI copy.
• Footer and cron placeholder text reach AA contrast; the authenticator
  code field is centered.

Docs

• README, site and stack docs cover DISABLE_SIGN_UP, two-step
  verification and its recovery, and the new request and operation limits.
• DESIGN describes tap-to-place signing, the docked signing bar, the touch
  layouts, bound numerals and Spanish quote and ellipsis marks.
• OpenSpec: harden-auth-and-request-limits done and its change files
  removed.

v0.1.5

v0.1.5 — Trazas: an audit trail of every action on documents and certificates

Traces

• New append-only trace_events table (migration included): importing,
  renaming, remembering or forgetting the password of and deleting a
  certificate, and uploading, merging, editing pages, downloading,
  renaming, moving and deleting a document each write a trace with the
  client IP, in the same transaction as the action.
• New trace API (trace.list, trace.certificates): the trail merges
  those traces with the existing signature records, newest first, paged
  by cursor and filterable by type, certificate, text and dates.
• New POST document.exportVersion for explicit downloads, which are
  traced; the GET document.download used to render documents stays an
  untraced read.

Frontend

• The "Firmas" page at /signatures is replaced by "Trazas" at /traces
  (/signatures no longer exists).
• The trail shows as a timeline grouped by recency, with relative times,
  a type badge and a one-line description per entry; signatures open the
  full signature detail, other entries their own detail sheet.
• The trace detail sheets are wider so hashes and fingerprints fit on one
  line, and the filters spread over up to four columns on wide screens
  (resource filters now support a fourth column).

Certificates

• User-managed organizations and teams for sharing certificates with
  defined permissions.

Docs

• README, PRODUCT, DESIGN and the project site describe the traces page.
• OpenSpec: add-activity-traces proposed, archived and synced (new
  activity-traces spec); harden-auth-and-request-limits proposed.
• IDEAS: link-based PDF upload requests and download links, and QR
  verification pages.

v0.1.4

v0.1.4 — AGPL license, self-bootstrapping MinIO and filter search

License

• Garabato is now licensed under AGPL-3.0-only (LICENSE, and a license
  field in every package.json), with a separate commercial license
  available from the author.
• README explains the AGPL and the commercial dual license; the site
  footer links the license in both languages.

Features

• Resource filters: select filters are searchable, and clearing is left
  to the filter chips so the inline panel no longer shows a second
  "Limpiar".
• Certificates: search by name, holder, NIF/NIE or issuer.
• Documents: the folder icon picker sits beside the name in the folder
  dialog; the tags and new-folder header actions are outlined icon
  buttons, leaving upload as the one labelled action.

Docker

• The minio container creates its own bucket, replacing the one-shot
  minio-init that lingered exited, and the MinIO console is no longer
  published.

Docs

• README, site and stack skill describe the self-bootstrapping MinIO,
  administering it with mc and upgrading with --remove-orphans.
• OpenSpec: merge-minio-bucket-init proposed, specs synced and archived.
• Ideas document for simple signatures and signing documents via link.

v0.1.3

v0.1.3 — page editing and merging

Features

• Page editing: reorder, rotate and remove pages of an unsigned document,
  saved as its next version; the page count follows the new version.
• Merging: join 2 to 20 unsigned documents, in a chosen order, into a new
  document from "Unir en un PDF" in the library's selection bar.
• Signed documents are protected: editing and merging refuse documents
  with signatures, recorded in garabato or embedded in the PDF.
• Version origin: each version records what produced it (upload, merge,
  signature or page edit) and the version list labels it.
• Site: every tour screen has a dark capture shown in the dark theme.

Database

• New kind column on document_versions, with existing rows backfilled
  (version 1 as upload, the rest as signature); migration snapshots
  reformatted.

Docs

• README screenshots recaptured in both themes, following the reader's
  GitHub theme.
• PRODUCT, README and DESIGN describe page editing and merging.
• OpenSpec: add-page-editing archived and its specs synced.

v0.1.2

v0.1.2 — signature validation

Features

• Signature validation: every signature embedded in a PDF is checked,
  whether it was made in garabato or with another tool before uploading.
  Checks cover integrity of the signed bytes, the CMS signature, coverage
  (whole file, followed only by signatures, or followed by other changes),
  the certificate's validity at signing time (the timestamp's time when
  present) and a chain to a trusted root (Mozilla store plus the bundled
  FNMT and DNIe roots). Each signature gets a verdict: valid, valid with an
  unrecognized issuer, invalid or not checkable. Revocation is not checked.
• API: new document.verifySignatures procedure.
• Frontend: a "Validez de las firmas" section on the document page lists
  each signature with its verdict and every check behind it.
• Site: the tour and lightbox show dark captures in the dark theme.

Fixes

• A PDF uploaded already signed no longer reads "Sin firmar" on its page:
  the header says "Firmado fuera de Garabato" and the empty history points
  at the embedded signatures.

Refactors

• Long signer names wrap in the validation card instead of overflowing.
• The signing tests check signatures with the production validator
  instead of a regex parser.

Docs

• README and PRODUCT describe signature validation.
• OpenSpec: add-signature-validation archived and its spec synced.

v0.1.1

v0.1.1

Signature timestamps (PAdES B-T)

• feat(env): optional TSA_URL to choose the RFC 3161 time-stamping authority
• feat(api): signatures carry a TSA timestamp when TSA_URL is set, and fail
  instead of silently falling back to B-B when the TSA gives none
• feat(db): signature records keep the timestamp time and authority (new
  migration, applied by the backend on startup)
• feat(frontend): the document history and the signature log detail show
  each signature's timestamp

Library

• feat(frontend): the navbar search finds library folders and opens them in
  the documents page
• refactor(frontend): the folder helpers have a light public entry, so pages
  outside documents use them without loading pdfjs

Project website

• feat(site): new apps/site, a static Astro site with a landing, a screenshot
  tour and English and Spanish docs
• chore(ci): a workflow builds it and publishes it to GitHub Pages

Docs and config

• docs: README, PRODUCT and stack references cover B-T signatures and the
  site workspace
• docs(openspec): add-signature-timestamp archived with its specs synced;
  add-signature-validation and add-page-editing proposed
• chore(config): show the .claude folder in the VS Code explorer

v0.1.0

v0.1.0 — first release of garabato

Garabato is a PDF signing app built on the stack template (Astro + Hono +
oRPC + Better Auth + Drizzle/PostgreSQL on Bun, behind a Caddy gateway).

Features

• Certificates: import PKCS#12 certificates, stored with per-row envelope
  encryption under a vault master key; rename, delete and remember passwords;
  shown as credentials with a validity line.
• Documents: upload, version, rename and sign PDFs with PAdES B-B incremental
  signatures and an Adobe-style visible stamp; PDF viewer with signature
  placement, page navigation and per-certificate signature history.
• Library: folders with icons, colored tags and pins, filters, multi-selection,
  bulk move/tag/delete and drag-and-drop; thumbnail and list views; document
  search from the navbar.
• Signature log (/signatures): every signature by certificate, document and
  date, with its full evidence.
• Home as a signing desk: drop a PDF and it opens ready to sign.
• Object storage: S3-compatible store for documents, with an optional bundled
  MinIO or an external S3.
• Branding and design: the garabato name and one-stroke signature logo,
  Schibsted Grotesk + JetBrains Mono, softer 6px corners, Text roles for
  every title, hint and empty line.

Foundation

• Better Auth with admin, organization, API-key and optional OIDC plugins.
• Versioned oRPC API by feature, in-process cron scheduler, pino logger with
  Loki activity log, validated env.
• Docker dev and production stacks behind a Caddy gateway, HTTPS/HTTP2 dev
  gateway, baseline security headers, images published to ghcr.io.

Fixes

• Sign through the named SignPdf class so the bundled backend can sign.
• Keep object-store errors as the cause in request logs.
• Use the public origin as Better Auth's base URL; register the PWA service
  worker only in production; restore sidebar page scroll offsets.

Refactors and tests

• Shared UI building blocks (Spinner, IconButton, SoftCardListItem,
  ScrollPanel) and three-column filter panels.
• Unit suites for packages/api, packages/cron and apps/frontend with a fake
  Drizzle database; PKCS#12, vault, PAdES and document handlers covered.

Docs

• README with screenshots, agent rules and the stack skill, design and product
  docs, and OpenSpec specs for every shipped change.