Repository navigation
Releases: inite-ai/inite-billing-service
Releases · inite-ai/inite-billing-service
Release list
inite-billing-service: v1.3.0
1.3.0 (2026-08-29)
Features
Bug Fixes
- admin: give the UI the states and semantics it was missing (#125) (91905fb)
- admin: UX pass — stop the admin lying, let the operator find records, make destructive actions name their target (#126) (e713898)
- api: validate every request body, and stop defaulting to INITE infrastructure (#123) (983031e)
- billing: P1 — affiliate ledger integrity and the last cross-tenant reads (#131) (2c69750)
- billing: P1 — lost webhooks, unrouted subscription events, unpinned issuer, cross-service reads (#130) (ed3f852)
- billing: P2 — secrets, unenforced scopes, half-atomic writes, decimal money (#133) (573729e)
- billing: three P0 defects in the money path (#129) (9e79c7c)
- build: keep the compiled entrypoint at dist/main.js (#119) (5aea854)
- ci: publish release image for component-prefixed tags (#116) (4842eca)
- deploy: pin the self-hosted jobs to the sfo runner (#128) (3f53241)
- ops: stop the deploy from guessing what production is running (#132) (dc7a2c4)
- test: restore the e2e suite, gate CI on it, and close the gaps it was hiding (#122) (f1b15f1)
inite-billing-service: v1.2.0
1.2.0 (2026-08-08)
Features
- connectors: canonical rail identity + capability contract + auto-discovery registry (#72) (b7847f8)
- frontend: MDX blog at /blog (#61) (c787b58)
- frontend: MDX docs site at /docs (auth's pattern, Ledger theme) (#58) (a67f14f)
- frontend: SEO / OpenGraph / AEO / AI-visibility for the landing (#57) (566e444)
- frontend: SOTA landing redesign + native RU/EN copy (#56) (ef1130b)
Bug Fixes
- admin: validate promo-code & referral-level bodies with DTOs (P1) (#102) (8d16f9c)
- affiliates: reconcile payouts to prevent double-pay and lost balances (#70) (408a2d9)
- AI-first landing rewrite + correct stale docs (#53) (88ab085)
- apple-iap: verify App Store notification JWS (CRITICAL — was presence-check only) (#92) (e0bcac7)
- auth: pin JWT issuer and audience, opt-in (P2) (#105) (475ba51)
- billing: wire refunds & cancellations to the provider (was DB-only) (#73) (5654e16)
- checkout: back idempotency with Redis (survives restart / multi-instance) (#77) (1650c17)
- checkout: enforce one live payment intent per order at the DB level (#91) (f8ad686)
- checkout: reuse a live payment intent instead of double-charging (#75) (6cde841)
- credits: grant/reset/refund inside the payment transaction (#71) (6a19b4c)
- credits: row-lock the flat consume path (double-spend guard) (#93) (951affb)
- credits: scope service-to-service consume/adjust to the caller's own service (IDOR) (#94) (f91fa67)
- crypto: resolve the invoice and validate the transfer before settling (HIGH) (#96) (856a623)
- docker: copy next.config.mjs (renamed from .js for MDX ESM config) (#60) (3e4eb9b)
- entitlements: scope service-to-service reads to the caller's service (IDOR) (#90) (0c51cd1)
- frontend: point landing docs links to /docs, add /blog links (#63) (ce59847)
- google-play: verify one-time products instead of failing open to paid (HIGH) (#95) (6775c08)
- orchestrator: make webhook-driven renewals idempotent (P1) (#101) (22c3b58)
- outbox: add producer so billing.* events are actually delivered (#66) (d328c87)
- outbox: sign deliveries (HMAC) + harden SSRF guard (P1) (#100) (7739a15)
- outreach: derive test-email CTA from FRONTEND_URL (was hardcoded) (#111) (94c0c68)
- schedulers: distributed lock around cron sweeps (P2) (#108) (9a4f2c3)
- subscriptions: compute period end in UTC with month-end clamp (#103) (a0c9566)
- subscriptions: resolve Apple/Google subscription linkage (renewals/cancels) (#69) (e13aae4)
- webhooks: fail closed when a provider's verification secret is unconfigured (#68) (963a01d)
- webhooks: reconcile paid amount in normalized units (P1 — was a no-op) (#99) (ff1aa47)
- webhooks: verify signatures over raw request bytes, not re-serialized JSON (#67) (b912f73)