v0.2.0 Initial release

Release v0.2.0

First tagged release of the operator SPA. Operators can sign in, rotate a seeded password, and manage catalog, stock, orders, users, and roles against ecommerce-store-api v0.7.0.

Business rules stay in the API. The UI hides navigation or shows a forbidden page when a permission is missing. Payments on order detail are read-only. There is no hosted demo.

Package 0.1.0 was never tagged. This cut is the first public milestone of the dashboard.

Scope

In this release	Not in this release
Login, forced password change, operator gate, silent refresh	Payment capture or refund UI
Dashboard, products, categories, inventory, orders, users, roles	Command palette and first-run checklists
List filters and sorts in the URL	Extra dashboard facts still missing from OpenAPI
MSW preview (npm run dev:mock)	Hosted staging
Theme, WebSocket toasts, live-API Playwright	Storefront (ecommerce-store-web)

Auth and session

• Access token in memory. Refresh cookie is HttpOnly (credentials: include).
• First login for seeded operators lands on change-password. Other shell routes wait until mustChangePassword is cleared.
• Sessions without access_admin cannot enter the SPA (login rejects them; OperatorRoute enforces the same gate).
• Domain HTTP 401 triggers one in-flight refresh and a single retry. After a successful refresh, session permissions and mustChangePassword are updated so nav chrome stays accurate.
• Limited operators land on the first permitted screen instead of looping on the dashboard or Forbidden "home".
• ADRs: ADR-0001 through ADR-0007.

Operator screens

• Dashboard: analytics reads from /v1/admin/analytics/* (Recharts). Grafana/Prometheus are not a data source.
• Products: list, create, edit, search, active/inactive filter, activate/deactivate.
• Categories: list and catalog association on product forms.
• Inventory: list, detail, stock adjust. HTTP 409 shows a conflict banner. The client does not invent a version field.
• Orders: list, detail, Process / Ship (and related transitions the API already exposes). Payments on the order are displayed, not mutated.
• Users: list, detail, activate/deactivate, address book (add, default, delete). Role change is shown only when the session has manage_roles.
• Roles: permission matrix editor.

List query params the API already accepts are wired in the UI and reflected in the URL.

Client contract

• Typed client from the API OpenAPI spec (openapi-fetch + generated schema.d.ts). Regenerate with npm run api:generate while the API is running.
• TanStack Query for lists, detail, and mutations. Centralized API error mapping for forms and toasts.
• RBAC chrome is UX only. Authorization is enforced on the API.

Local preview and quality

• npm run env:init then npm run dev on port 5174 against a live API (default http://localhost:3000).
• npm run dev:mock is an in-browser MSW replica. Demo 1-click login. Mock data resets on full reload. Playwright still needs a live API.
• Theme: light, dark, and system, persisted in localStorage.
• Socket.IO toasts for new orders and low stock, with query invalidation.
• PR CI: lint, typecheck, unit tests, build, npm audit. Playwright on master / main and workflow_dispatch.
• Live operator checklist: docs/RELEASE-GATE.md.

Stats

Metric	Value
Since	untagged 0.1.0 (initial commit)
Files changed	330
Insertions	+41,594
Commits	352 (327 excluding merges)
Playwright specs	12
ADRs	7 (ADR-0001 to ADR-0007)

Pull requests

PR	Title
#1	Scaffold, toolchain, and governance
#2	Responsive app shell and page structure
#3	Authentication and RBAC navigation chrome
#4	Forced password change routing and UI
#5	env:init for local Vite config
#6	Products list, create, and edit
#7	Operator gate and silent token refresh
#8	Inventory list, detail, and adjust
#9	Orders list, detail, and transitions
#10	Users list and detail
#11	Analytics dashboard and null-safe detail reads
#12	Quality, a11y, and journey tests
#13	Local Swagger URL in documentation
#14	List filters, column sort, URL parity
#15	Product, user, and role management screens
#16	Centralized error handling and strict API typing
#17	Product catalog status and user role assignment
#18	Customer address book on user detail
#19	MSW standalone preview
#20	Architecture cleanup, auth, mock routes, filters
#21	Theme, real-time feed, and auth hardening
#22	Release gate verification and auth hardening
#23	Dashboard cockpit layout and status styling
#24	Detail views and showcase assets
#25	Category management views and product catalog integration

README screenshot paths and the 0.2.0 version bump landed on release-v0-2-0 after #25.

Full changelog: initial commit through v0.2.0