v0.1.2

• Digest notifications: two workers running at the same moment could split one owner's
  pending changes into two summary messages. Claims are now serialized per owner and channel,
  so each run sends a single digest.
• The stored ČÚZK API key fingerprint (used only to detect key rotation) is now derived with
  scrypt instead of plain SHA-256. After upgrading, the instance treats the key as rotated once:
  the cached ČÚZK account info and any temporary API pause are reset; the daily call budget is
  kept.
• The inline theme script in <head> is a static literal (no interpolated values).

Container image

ghcr.io/petrleocompel/hlidac-cuzk@sha256:02ec0ae9e06b1ecd394bca8c354e717dc93e05b7e20222e30780dd23836bbd2a
ghcr.io/petrleocompel/hlidac-cuzk:0.1.2
ghcr.io/petrleocompel/hlidac-cuzk:0.1
ghcr.io/petrleocompel/hlidac-cuzk:0
ghcr.io/petrleocompel/hlidac-cuzk:latest
ghcr.io/petrleocompel/hlidac-cuzk:sha-1601744

Pin the digest in deploy/.env (HLIDAC_CUZK_IMAGE=ghcr.io/petrleocompel/hlidac-cuzk@sha256:02ec0ae9e06b1ecd394bca8c354e717dc93e05b7e20222e30780dd23836bbd2a).
See the upgrade guide.

v0.1.1

• Raise transitive dependency floors flagged by Dependabot: seroval ≥ 1.6.8 (pulled in by
  Better Auth's optional Solid integration; the app does not call the affected
  deserialisation path, but the package shipped in the image), source-map-js ≥ 1.2.2 and
  esbuild ≥ 0.25 for development tooling.
• Website build uses Vite 6.4 instead of Vite 5 (development-server advisories only; the
  published static site was not affected).
• Documentation explains how to obtain the ČÚZK API key (registration, terms of use, expiry
  and rotation).

Container image

ghcr.io/petrleocompel/hlidac-cuzk@sha256:5aaae41154705e2cf7af33cea0428f323c7a4e3bd79d0bbdf44043c6e4f5e641
ghcr.io/petrleocompel/hlidac-cuzk:0.1.1
ghcr.io/petrleocompel/hlidac-cuzk:0.1
ghcr.io/petrleocompel/hlidac-cuzk:0
ghcr.io/petrleocompel/hlidac-cuzk:latest
ghcr.io/petrleocompel/hlidac-cuzk:sha-361fce6

Pin the digest in deploy/.env (HLIDAC_CUZK_IMAGE=ghcr.io/petrleocompel/hlidac-cuzk@sha256:5aaae41154705e2cf7af33cea0428f323c7a4e3bd79d0bbdf44043c6e4f5e641).
See the upgrade guide.

v0.1.0

First open-source release of Hlídač ČÚZK: a self-hosted watcher for parcels, buildings, units,
rights of superficies and proceedings in the Czech cadastre (ČÚZK) with change history and
notifications. Install with Docker Compose following the
self-hosting guide (CZ) or
self-hosting guide (EN).

• Project website with documentation: https://petrleocompel.github.io/hlidac-cuzk/

• Dependencies refreshed: Better Auth 1.7 (account unlinking now uses the account id),
  Sentry SDK 11 (still initialised only with SENTRY_DSN, sendDefaultPii: false),
  ESLint 10, jsdom 30, Vite 8.3 and current TanStack Start/Router.

• Published as open source under AGPL-3.0-only on GitHub; images are built by GitHub Actions
  and published multiarch to ghcr.io/petrleocompel/hlidac-cuzk with provenance and SBOM
  attestations.

• Opt-in bounded retention for events, historical snapshots, errors and API attempt detail;
  undelivered messages protect their source history, and daily quota totals are retained.
  Hourly maintenance reports counts; the manual CLI defaults to a dry run.

• Polling pages due watches in batches of 100 with stable cursors and shares fetched data
  across owners/pages for every supported register. Migration 0016 adds matching indexes.

• Private watch tags and notes, accent-insensitive portfolio search and KU/LV/status/tag filters.
  Atomic bulk pause, resume and interval updates validate ownership of every selected item;
  captured history and queued notifications survive pausing. Migration 0015 is required.

• Bounded map-area preview (1 × 1 km, up to 20 parcel geometries) with individual confirmations.

• Optional cadastral map on watch details and the overview, with orthophoto, stored definition
  points and exact parcel geometry from INSPIRE CP. Click or keyboard center selection offers
  a parcel for explicit verification and daily subscription. Map failure preserves text details.

• Runtime image and development move to Node.js 26 (LTS from 28 October 2026); Corepack is
  installed from npm because Node 25+ no longer bundles it.

• Watches can be added by address: RÚIAN suggests address places, the exact match yields the
  address place code and ČÚZK turns it into the building, which is offered together with its
  units and parcels. An ambiguous or unmatched address is confirmed by the user; coordinates
  and the geocoder's internal key are never used as identification.

• Buildings, units and rights of superficies can be watched as objects of their own, next to
  parcels. Each register has its own attributes, snapshot and diff, and only the data the
  given API returns is stored. Buildings and units are searched by RÚIAN část obce, number
  type and house/unit number; rights of superficies are added by the ISKN id a related object
  shows. A parcel, building or unit detail offers its linked objects as separate watches.

• Existing parcel watches are unchanged; uniqueness is now per user, register and ISKN id.

• New Přehled podle LV groups the objects a user already watches by katastrální území and
  LV number with the latest ten events per group. It queries no ČÚZK data, says plainly that
  it is not the complete contents of an LV, discovers no property on its own and does not
  call an LV change a confirmed change of owner.

• A polling cycle fetches each parcel once and shares the answer between all subscriptions of
  the same object; histories, labels, intervals and channel rules stay per user.

• Neighbor discovery previews up to 100 basic parcel definitions and atomically adds up to
  20 selected daily watches with quota estimates, ownership checks and duplicate protection.

• Per-watch notification filters, quiet hours with timezone, daily/weekly digests and
  urgent-event bypass. Durable digest batches retain failed events and recover after crashes.

• SMTP e-mail and self-hosted ntfy, independently controlled by administrators. Explicit
  opt-in enables shared instance Gotify; complete personal settings take precedence.

• Notification links open the exact owner-only event, including older history pages.

• A řízení is now followed as its own object: state changes, new completed operations and
  payment state are reported for the same řízení id, and its history survives the plomba
  disappearing from the parcel. After a plomba is removed the detail is still queried for
  CUZK_RIZENI_FOLLOW_DAYS (default 14, at most ten follows per watch), so the actual
  result is reported instead of implying an approved vklad. A missing detail keeps the last
  known values; a 404 or empty payload ends the follow-up as confirmed unavailable.

• Users can add a known řízení (type, number, year, office code) or a linked
  navazanaRizeni and stop the extra queries at any time.

• History now records the value before and after each change (Výměra: 976 → 980 m²) plus
  the snapshot behind it, compares BPEJ and protections in a normalized order, and treats a
  list the API did not return as unknown rather than removed. The watch detail pages and
  filters the history and exports CSV/JSON with acquisition times; it also states that no
  history exists from before the watch was created.

• Adding a watch no longer needs the KÚ code: search by name without diacritics or by code,
  write the parcel as one field (1133/77, st. 25) and confirm the verified ČÚZK answer
  before saving. Identification is taken from that answer, and the demo parcel is prefilled
  only with SEED_DEMO_WATCH=1.

• New CSV/JSON bulk import with a preview that spends no ČÚZK call, per-row errors with line
  numbers, duplicate detection and one verification call per imported row.

• One user can watch one object only once; the upgrade reduces existing duplicates to the row
  with the most recorded events before adding the unique index. All histories, pending
  deliveries and distinct tracked procedures are transferred before removing duplicates.

• AMD64 and ARM64 images must pass a real Compose installation smoke test before publishing.

• Web, worker and migrations run as UID 1000 with read-only storage; runtime dependencies
  are installed separately and pnpm is preloaded for startup without a registry connection.

• Loopback/LAN, Caddy TLS and standalone external PostgreSQL configurations are documented
  in Czech. Fonts are served locally; no DSN means no Sentry initialization.

• Image publishing now requires successful lint, typecheck, tests and production build.

• deploy/upgrade.sh stops writers, creates a protected local PostgreSQL dump, runs one
  bootstrap and waits for web readiness before starting the worker.

• The administration monitoring page reports image version, full commit and schema state.

• Production requests and workers no longer run implicit migrations. Start with pnpm bootstrap.

• Readiness refuses a database with newer migration metadata than the running image.

Upgrading pre-release installations (schema 0008)

Installations created from pre-release builds at schema 0008 are upgraded in place. The upgrade adds 0009_backup_status, 0010_watch_rizeni, 0011_event_history,
0012_watch_uniqueness (which consolidates duplicate watches while preserving their
histories and deliveries), 0013_notification_rules and 0014_object_watches (watched
register plus uniqueness per user, register and ISKN id). Existing accounts, watches, events and pending
notification deliveries are preserved. Back up the database and configuration/keys first;
use the pinned image and the upgrade procedure. The regression
test upgrades the previous schema and checks both preserved data and rejected startup after
a migration failure. There is no promise of compatibility with arbitrary older images.

Earlier selfhosting changes require a persistent NOTIFICATION_ENCRYPTION_KEY and explicit
pnpm notifications:encrypt for old plaintext credentials. Registration defaults to private.
Scheduled off-site backups remain optional until their target and recovery credentials are
configured. An unreachable SSO provider on a redeploy produces a bootstrap warning; verify
SSO independently after deployment.

Container image

ghcr.io/petrleocompel/hlidac-cuzk@sha256:0a538af66a7bc55a08cc00a20a5093d4b7a94b313bb1661a65fe4cbf2228009e
ghcr.io/petrleocompel/hlidac-cuzk:0.1.0
ghcr.io/petrleocompel/hlidac-cuzk:0.1
ghcr.io/petrleocompel/hlidac-cuzk:0
ghcr.io/petrleocompel/hlidac-cuzk:latest
ghcr.io/petrleocompel/hlidac-cuzk:sha-a5c3cc1

Pin the digest in deploy/.env (HLIDAC_CUZK_IMAGE=ghcr.io/petrleocompel/hlidac-cuzk@sha256:0a538af66a7bc55a08cc00a20a5093d4b7a94b313bb1661a65fe4cbf2228009e).
See the upgrade guide.