Signify Creator v1.1.0

Signify Creator v1.1.0

This release expands Signify Creator's self-hosted SaaS foundation with
commercial licensing, signed updates, transactional account email, stronger
readiness checks, and repeatable Microsoft 365 and Stripe acceptance tooling.

Licensing and editions

• Community Edition defaults to one workspace and ten managed users.
• Signed Enterprise entitlements unlock additional tenants and user capacity.
• License activation, refresh, revocation, reinstatement, expiration, offline
  grace, installation binding, and safe Community downgrade are enforced by the
  server.
• Tenant and user limits apply to every creation path, including concurrent
  requests.

Managed releases

• Private GitHub release detection runs periodically from encrypted credentials.
• One-click updates verify package size, SHA-256, Ed25519 signatures, release
  inventory, and migration compatibility.
• Updates create a safety backup, require the new process to pass readiness, and
  roll back automatically on failure.

Account delivery and readiness

• Resend transactional email supports registration verification, password
  recovery, and invitations.
• Provider credentials are verified before encrypted storage.
• Durable delivery jobs retry transient failures, prevent duplicate sends, and
  scrub sensitive message content after completion.
• Production registration fails closed when account email delivery is not ready.

Microsoft 365 and Stripe

• Microsoft 365 acceptance verifies application roles, organization identity,
  directory access, sender-mailbox access, and sandbox mail delivery.
• Stripe acceptance verifies test mode, mapped recurring prices, webhook signing,
  all required events, and a disposable hosted Checkout session.
• Sanitized acceptance reports exclude credentials, access tokens, and customer
  records.
• Stripe remains restricted to the Application Owner control plane.

Signature operations

• Managed Outlook signatures are removed when a member or subscription becomes
  inactive and resume after entitlement restoration.
• The Banner Card preset adds an integrated technology banner, compact identity
  row, initials fallback, and an Outlook-visible shadow layer.
• Thirty-day trial enforcement disables editor reads and writes after expiration
  and presents the subscription recovery flow.

Security and verification

• Full formatting, lint, syntax, security, secret, unit, integration, smoke,
  artifact, startup, CodeQL, OSV, and dependency-audit gates passed.
• Production dependency audit: zero known vulnerabilities.
• Release artifact inventory: 146 checksummed files, 28 SQLite migrations, and
  10 PostgreSQL migrations.
• The README includes current installation, configuration, licensing, update,
  and provider-acceptance guidance with an Application Owner screenshot.

External acceptance limitation

Live Microsoft 365 mail and Stripe Checkout acceptance was not executed because
sandbox provider credentials were not supplied. The acceptance runner and
controlled provider regression suite pass, and the live command fails closed
until both sandbox providers are configured.

Distribution limitation

The full release and GitHub-generated source archives are published. The signed,
one-click installer artifact is intentionally withheld because the production
License Authority public URL and verification key are not configured in GitHub.
The only currently available authority address is a local test endpoint, which
must not be embedded in a customer release. Release signing is configured and
will remain fail-closed until the production authority identity is supplied.

Signify Creator v1.0.0

Signify Creator v1.0.0 is the first stable production release of the self-hosted multi-tenant email-signature SaaS.

Highlights

• Standalone Setup ? Configure ? Sign in installer with atomic Application Owner provisioning and pre-install application lock
• Application Owner ? Tenant ? End User access model with tenant lifecycle and direct user provisioning
• Clickable Microsoft 365, Stripe, and GitHub integration catalog with focused configuration dialogs
• Encrypted private GitHub release credentials and authenticated update detection
• Owner MFA, session controls, application audit, durable jobs, fleet visibility, backups, staged restore, and update operations
• Campaign banner repository selection, overlays, typography, animation effects, and stable preview dimensions
• Hardened Node.js deployment, runtime leases, health checks, structured logs, SBOM, and closed artifact allowlist

Security and reliability

• Provider credentials encrypted at rest with rotation support
• Server-side RBAC, tenant isolation, CSRF protection, rate limiting, signed webhooks, and URL credential stripping
• 23 SQLite migrations and 5 PostgreSQL migrations
• Production artifact contains 125 verified files and no populated provider secrets

Validation

• Full npm run check release gate
• Formatting, ESLint, syntax/type checks, security policy, and secret scans
• Unit, frontend, database, runtime lease, PostgreSQL static/import, credential rotation, deployment, container, jobs, media, observability, operations, recovery, setup, installer, and smoke tests
• CycloneDX SBOM generation and validation
• Production artifact and clean startup verification
• Fresh browser installation, setup progression, and route-lock verification

See CHANGELOG.md, README.md, and DEPLOYMENT.md for complete details.

Signify Creator v0.4.0

Production optimization release

Signify Creator v0.4.0 completes the sequential production hardening and efficiency program while preserving the existing Signature Studio-styled UI, approved login page, campaign overlays, banner effects, multi-tenant M365 registration, and Application Owner-only Stripe billing.

Architecture and performance

• Shared CSRF-aware frontend request client and common style primitives.
• Extracted authentication, authorization, validation, HTTP, media, and job services.
• Indexed email, workspace, approval, tenant pagination, and Application Owner query paths.
• Concurrent GET coalescing, bounded request timeouts, and stale preview cancellation.
• Health p95 measured at 16.364 ms versus 16.495 ms baseline.

Reliability and operations

• Durable SQLite jobs with atomic claims, deduplication, retry backoff, terminal failures, and stale-lock recovery.
• Tenant media quotas, atomic writes, immutable caching, and seven-day orphan safety window.
• Separate liveness, readiness, legacy health, and aggregate metrics endpoints.
• Structured startup errors and idempotent HTTP/job/database shutdown.
• Production operations runbook for deploy, monitor, jobs, backup, restore, rollback, and capacity.

Security and supply chain

• Explicit release asset allowlist and artifact privacy gate.
• Tenant storage path validation and server-side access policy modules.
• CycloneDX 1.5 production SBOM included.
• npm production audit: 0 known vulnerabilities.

Verification

• Unit, frontend, database, job, media, setup, smoke, SBOM, formatting, lint, build, and artifact suites passed locally and on Linux CI.
• Clean production-only install: 36 packages, 0 vulnerabilities.
• Archive inspection: 84 entries, no runtime uploads, generated tenant media, databases, local environment files, backups, logs, or dependencies.

Integrity

SHA-256: d7bd00ca40f5b767d51d8d38495575db322637cd4eebbb1bbab902d35e463732

Signify Creator v0.3.1

Security correction

This release replaces the v0.3.0 install artifact after identifying that the previous local packaging process recursively copied ignored runtime media from the working public directory. The affected custom v0.3.0 and release-candidate assets were removed; source archives and immutable tags were preserved.

Changes

• Package only an explicit allowlist of product-owned static banners and icons.
• Create clean data, backup, upload, and generated-banner runtime directories during builds.
• Add a mandatory release-artifact gate to the standard check pipeline.
• Reject tenant uploads, generated campaign media, databases, backups, logs, archives, dependency trees, local environment files, and populated provider secrets.
• Preserve the setup wizard, three-level RBAC, tenant isolation, M365 consent, owner-level Stripe controls, campaign overlays, signature rendering, and all existing product functionality.

Verification

• Formatting and ESLint passed.
• Setup and full smoke suites passed.
• Production build and artifact policy test passed.
• Clean production-only dependency install passed.
• npm audit reported 0 vulnerabilities.
• Archive inspection passed for all 71 entries.

Integrity

SHA-256: 759da6b3d3eafc280f49e38b52830630d70d4574de828bb4e8cacb041b8ec27e

Use Signify-Creator-v0.3.1.zip for Node.js deployment and verify it with the attached checksum file.

Signify Creator v0.3.0

What's Changed

• Add multi-tenant application control plane by @ithealthtech in #5
• Add guided provider onboarding by @ithealthtech in #6
• Update CI actions for Node 24 by @ithealthtech in #7
• Add out-of-box Node.js installer by @ithealthtech in #8
• Prepare Signify Creator 0.3.0-rc.2 by @ithealthtech in #9
• Detect hosting paths during setup by @ithealthtech in #10
• Prepare Signify Creator 0.3.0-rc.3 by @ithealthtech in #11
• Revalidate callbacks and responsive release by @ithealthtech in #12
• Release Signify Creator 0.3.0 by @ithealthtech in #13

Full Changelog: v0.2.0...v0.3.0

Signify Creator 0.3.0-rc.4

What's Changed

• Revalidate callbacks and responsive release by @ithealthtech in #12

Full Changelog: v0.3.0-rc.3...v0.3.0-rc.4

Signify Creator 0.3.0-rc.3

What's Changed

• Detect hosting paths during setup by @ithealthtech in #10
• Prepare Signify Creator 0.3.0-rc.3 by @ithealthtech in #11

Full Changelog: v0.3.0-rc.2...v0.3.0-rc.3

Signify Creator 0.3.0-rc.2

What's Changed

• Update CI actions for Node 24 by @ithealthtech in #7
• Add out-of-box Node.js installer by @ithealthtech in #8
• Prepare Signify Creator 0.3.0-rc.2 by @ithealthtech in #9

Full Changelog: v0.3.0-rc.1...v0.3.0-rc.2

Signify Creator 0.3.0-rc.1

What's Changed

• Add multi-tenant application control plane by @ithealthtech in #5
• Add guided provider onboarding by @ithealthtech in #6

Full Changelog: v0.2.0...v0.3.0-rc.1

Signify Creator v0.2.0

Changelog

0.2.0 - 2026-07-17

First stable Signify Creator release.

Added

• Multi-tenant signature studio, reusable templates, campaign banners, approvals, bulk rollout, analytics, audit history, QR codes, and vCards.
• Microsoft 365 login, directory synchronization, profile-photo import, and Graph email delivery when configured.
• Stripe Checkout, customer portal, subscription state, seat limits, and signed idempotent webhooks when configured.
• Production build artifact, health check, structured logging, backup command, Hostinger deployment guidance, and automated CI validation.

Security and reliability

• Server-side role and tenant enforcement, CSRF protection, browser-bound OAuth state, session revocation, rate limiting, and strict request validation.
• Atomic user, approval, directory-sync, and webhook workflows.
• Signature data normalization and HTML attribute escaping.
• Clean and existing-database migration, integrity, backup, production-startup, and responsive browser verification.