Release v0.2.8

Added

• Dinh Fire Lamp theme applied across the app UI and docs — Bạc Ngà (ivory) light default with an optional Rừng Đêm (forest-night) dark palette, tokenized per the shared design spec (Georgia serif headings, 18px radii, 60-30-10).

Fixed

• Light-mode --faint text color corrected to the spec value (#97897a; a dark-mode value had been used, dimming secondary text too far in light mode).

Docs

• Screenshot gallery refreshed — every capture re-taken against the themed live demo (owner dashboard, invite flow, seat updates, RBAC denial, audit trail; 298 tests).

Full change history: CHANGELOG.md

Release v0.2.7

Docs

• Suite tables completed to match the shipped 13 test files: AGENTS.md, docs/testing.md, and README status now list every suite (added billing-edge-cases, rbac-boundary, service-integration, edge-cases) with measured per-file counts (298 tests total).

Full change history: CHANGELOG.md

Release v0.2.4

Added

• Docker support: Dockerfile (multi-stage Node 24 Alpine build) and docker-compose.yml with persistent SQLite volume for container deployments.
• Deployment docs: docs/deployment.md — comprehensive deployment guide covering Docker, VPS, Cloudflare Pages, Vercel, Fly.io, and Postgres swap path.
• Usage-based billing guide: docs/ai-billing.md — adapter pattern for AI token usage tracking, metered billing, and usage-based pricing.
• .dockerignore: Build context exclusions for cleaner Docker builds.

Full change history: CHANGELOG.md

Release v0.2.3

Added

• Password strength validation: checkPasswordStrength() now enforces uppercase, lowercase, and digit requirements (not just minimum length). Returns { ok, reasons } for UI feedback.
• Session management: listSessions(), destroyAllSessions(exceptToken?), cleanupExpiredSessions() for security features like "log out everywhere" and session listing.
• Configurable session TTL: SESSION_TTL_DAYS environment variable (default 30) for compliance scenarios requiring shorter sessions.
• Audit log export: exportAuditCsv() and exportAuditJson() for compliance buyers who need to export their audit trail. CSV includes proper escaping; JSON includes ISO timestamps and parsed metadata.
• Billing guard: assertSeatAvailable() now blocks past_due and canceled subscriptions from adding new seats.

Fixed

• createUser error handling: catch block now only catches unique constraint violations (SQLITE_CONSTRAINT, SQLITE_CONSTRAINT_UNIQUE, Postgres 23505) instead of silently swallowing all DB errors as email_taken.

Tests

• 240 tests (was 204): +36 new tests covering password strength, session management, billing guard, error mapping with actual Error subclasses, audit export, and audit pagination edge cases.

Full change history: CHANGELOG.md

Release v0.2.2

Added

• Source documentation (TSDoc): every exported symbol on the public API surface now carries a doc comment — parameter/return/throws contracts, the RBAC hierarchy (mayActOn/mayGrant), the typed error codes, schema tables, and the swappable BillingAdapter/RateLimiter seams. Comments only — no behavior, signature, or formatting change; all 204 tests still pass.
• Generated public API reference: docs/api/ — a TypeDoc-generated reference for the full src/lib/server surface (auth, rbac, db, services, billing, http, ratelimit). Ships with the kit; regenerated from source so it cannot drift.
• Docs gate (CI + release pipeline): npm run docs:api:check in CI and a gen-api-docs check in the release pipeline now fail if any exported symbol goes undocumented or if docs/api falls out of sync with the source.

Full change history: CHANGELOG.md

Release v0.2.1

Added

• Audit suite: tests/audit.test.ts — append-only writer (no update/delete path), metadata round-trip, null handling, newest-first pagination, history surviving member removal
• Billing suite: tests/billing.test.ts — per-org seat counting, assertSeatAvailable (at-limit + no-subscription), mock adapter contract + MOCK_PLAN_SEATS env override
• Auth edge cases: expired sessions rejected at read time; display-name fallback to email prefix
• Org/invite edges: unique URL-safe slug generation, member-only org reads, multi-owner transfer guard, invite default TTL + recipient-email normalization, raw token never audited, member-revoke forbidden
• Documentation: docs/testing.md — testing philosophy, suite layout, patterns, gotchas

Changed

• Test suite grown from 52 to 77 tests across 9 suites
• README/AGENTS/CLAUDE test counts and suite tables updated

Full change history: CHANGELOG.md