BETAPro is not billed during beta. Lock in the price and we will honor it at launch.Freeze this price

Changelog

Stay up to date with the latest changes in our product.

May 22, 2026

Timestamp-cleanup migrations 0018 + 0019

Database

  • Migration 0018 (`a9c7d37`) — converted all 37 mode: "timestamp" columns across 23 tables from sql\CURRENT_TIMESTAMP\`default to$defaultFn(() => new Date()). Reason: Drizzle's SQLite mode: "timestamp"parses the column as **unix seconds**, butCURRENT_TIMESTAMPwritesTEXT 'YYYY-MM-DD HH:MM:SS', which Drizzle parses to invalid Date. Symptom: Date.toISOString()throwsRangeError: Invalid time valuedeep inside hot paths (chatbot, scan list, mention rendering). Header doc onanalyticsSnapshot.computedAt` documents the trap in detail so new timestamp columns don't reintroduce it.
  • Migration 0019 (`aad6ff1`) — backfill bug-fix for 0018. The generated rebuild block multiplied existing values by 1000 (strftime('%s', col) * 1000) on the false assumption Drizzle stored milliseconds. With seconds-mode, the multiplier wrote ms-shaped values into seconds columns (e.g. 1748000000000 instead of 1748000000) — interpreted as year-58348 timestamps. Migration 0019 divides any row where col > 10000000000 (~year 2286) by 1000. Idempotent — re-running only hits values still in ms-form. 3175 rows fixed across 25 columns. `apps/saas/app/api/cron/reset-quotas/route.ts` also updated: resetAt: sql\(unixepoch() \* 1000)\`→resetAt: new Date()` so it stops generating ms-in-seconds writes.

May 22, 2026

Plan 025 (1k-user readiness — all 7 steps)

CI, observability, and tests

  • GitHub Actions workflow (ci.yml): pnpm install --frozen-lockfile → pnpm format:check → pnpm lint → workspace-wide type-check → pnpm build. Runs on push to main + every PR. lint:docs step catches stale links in .apsolut/03-plan/ files. Plan 025 step 1.
  • Sentry install + DSN-gated scaffold (b6d6947): @sentry/nextjs wired into apps/saas. instrumentation.ts + sentry.client.config.ts + sentry.edge.config.ts + sentry.server.config.ts follow the official wizard layout. All SDK calls go through a reportError boundary at @repo/api/orpc/handler.ts — Sentry never imports directly from procedure code, which keeps the @sentry/nextjs peer-dependency contained to the saas app and stops Turbopack from emitting "Cannot resolve" warnings on every API request (see 70cc4be). No-op when SENTRY_DSN is unset. @opentelemetry/api: "1.9.0" pinned in pnpm-workspace.yaml to stop Sentry bumps from forking the drizzle/better-auth peer tree across pnpm hashes. Plan 025 step 2.
  • Quota + tier subsystem pure-function tests (adcfb21): per-tier limits, monthly reset semantics, hourly free-tier cap, BYOK exemption, and edge cases (zero-quota orgs, mid-month upgrade). Plan 025 step 3.

Billing, tiers, and quotas

  • Per-tier quota schema + enforcement (58b2aed): new organization_quota table (organizationId, tier, scansThisMonth, topicsCount, keywordsCount, resetAt). Quota counters maintained transactionally alongside row inserts/deletes for topics and keywords; scan counter incremented per-scan on completion. TIER_LIMITS config at packages/api/modules/quotas/config.ts is the single source of truth. Free: 5 scans/250 keywords/1 topic. Pro: 500/25 topics/250 keywords. Team: unlimited. Hourly free-tier cap (10/hour) prevents one-shot exhaustion. Plan 025 step 4a + 4b.
  • Stripe webhook → org tier sync (7f181ea): /api/webhooks/stripe handles checkout.session.completed, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, invoice.payment_failed. Maps Stripe price_id → tier via STRIPE_PRICE_TO_TIER env. Updates organization_quota.tier + resets monthly counters on tier change. Signed-webhook verification via STRIPE_WEBHOOK_SECRET. Plan 025 step 4c.
  • Quota usage card on `/settings/billing` (b2e7ec2): shows current usage vs tier cap with a progress bar, "X scans left" message, monthly reset date, "Upgrade" CTA when ≥80% utilized. Plan 025 step 4d.
  • Stripe parked behind `NEXT_PUBLIC_BILLING_ENABLED` (2731299): pricing-page CTAs become "Join waitlist" mailto links when the flag is off, real /signup?intent=pro when on. Same flag gates the saas-side ChangePlan section. One env flip lights up both surfaces for launch.

Marketing

  • Public pricing page at /pricing (16767e7): Free / Pro ($49) / Team ($199) cards. Tier limits mirrored verbatim from packages/api/modules/quotas/config.ts — pages render correctly even if the saas app or DB is down (no runtime dependency). Highlights BYOK story: "Bring your own LLM key. We charge for insights, history, and seats — never per scan token." Plan 025 step 5.

Inngest cutover (off Vercel function-timeout path)

  • Scheduled-scans executor on Inngest (3fb9d7f): the per-minute cron at /api/cron/scheduled-scans now enqueues a scheduled-scan/due Inngest event for each due schedule instead of running the scans inline. The Inngest function picks up the event, resolves BYOK key inside step.run, and dispatches via runScanInBackground. Removes the 60s Vercel function-timeout ceiling; a 25-query bulk schedule no longer times out the cron. Plan 025 step 6.
  • `processPendingBatches` off Vercel timeout (ddb8d1e): batch-drain logic moved from inline cron execution into an inngest.createFunction triggered by batch/drain-requested. Per-batch step.run isolation means one failing batch row no longer poisons the whole drain. Concurrency capped at 1 per org via event.data.organizationId. Plan 025 step 7.

Hygiene

  • Sentry token guidance corrected (b815718, c1f88fa): .env.local.example updated for Sentry's current UI (Personal Tokens with Read/Read & Write/Admin permission pickers — not the legacy colon-syntax scopes).
  • DEPLOY.md added (5d2d7ea): first-time Vercel deploy checklist covering Turso provisioning, env-var matrix, Inngest Cloud wiring, cron config, smoke-test path.

May 22, 2026

Chatbot org-scoped + brand-tracking aware

AI assistant

  • Chatbot moved to `/<org-handle>/chatbot` (b44687b): previously account-scoped at /chatbot. Now an org-scoped product surface like /dashboard and /insights. The account-scoped route persists as a redirect that resolves the user's active org (session → lastActiveOrganizationId → first membership) and forwards to the org-scoped path. Vision doc at .apsolut/03-plan/DONE/028-idea-chat-with-your-data.md covers the deeper "tool-calling chatbot grounded in scan data" build that promotion to a sprint would unlock.
  • BYOK + free-tier gating on chat (c4c3235): chat now uses the same key-resolution + quota-enforcement code path as scans. Was previously hard-wired to the platform's shared OPENROUTER_API_KEY, which (a) bypassed BYOK orgs entirely, (b) drained the shared key without quota accounting, and (c) failed entirely if OPENROUTER_API_KEY was unset. Now calls resolveOpenRouterKey(organizationId) → createOpenRouterClient(apiKey) → openrouterModel("openai", client).
  • Stream-handler race fix (f8ddd13, ef7a0e1): suggestion buttons + form submit now gate on isOrgReady = orgLoaded && !!organizationId to avoid "No active organization" errors when the user clicks before ActiveOrganizationProvider resolves.

Bug fixes

  • `ActiveOrganizationProvider` URL-vs-DB-slug parse fix (f1ba797): the provider was passing the full Notion-style URL handle (acme-abc123…) as the DB slug for the org lookup, which never matched (organization.slug = "acme"). Result: navigating to /<org-handle>/dashboard from outside the org context returned null and the sidebar lost every tracking-nav item. Now uses parseOrgParam() to extract the trailing CUID and look up by ID (canonical) with slug-fallback for legacy URLs.
  • Better Auth session sync from URL-derived org (9f30f3f): the URL is the source of truth for active workspace, but non-org-scoped routes (like /chatbot post-redirect) read session.activeOrganizationId. The provider now best-effort writes the URL-resolved org back to the session so cross-route navigation doesn't drop into a different org's context.

May 21, 2026

Plan 024 Phases 0–3 (production hardening)

Security and hardening

  • BYOK API key removed from Inngest event payload: scan/requested and platform-scan/requested no longer ship the OPENROUTER_API_KEY through the durable event store. Worker now fetches the key fresh via resolveOpenRouterKey(organizationId) inside step.run. Stops the key from sitting in Inngest's UI, logs, or retry payloads.
  • Fake RAG retired: retrieveContext (which embedMany'd a query embedding and then did a no-op exists() subquery) renamed to getRecentMentions and now honestly returns chronologically-recent rows. System prompt updated to say "RECENT BRAND MENTIONS (chronological, not ranked)".
  • Bulk-scan failure recovery: missing .catch reattached to runScanInBackground in bulk-execute.ts so a single failing worker no longer leaves a scan_session row stuck in pending forever.
  • Typed environment validation: new @repo/env package built on @t3-oss/env-nextjs. All process.env.* reads now flow through a Zod-validated schema (emptyStringAsUndefined: true, most fields .optional() to avoid breaking provider-gated deployments). Wired into apps/saas/config.ts and apps/marketing/config.ts.
  • Server-side password schema enforcement: Better Auth's before hook now runs passwordSchema.safeParse() against /sign-up/email, /change-password, /reset-password, /set-password. A forged request that skips the React form is rejected with a BAD_REQUEST instead of writing a weak hash to disk.
  • Impersonation banner: when session.impersonatedBy is set, a sticky red banner with a one-click stop button is rendered on every authenticated page via <ImpersonationBanner /> mounted in the authenticated layout.
  • Content-Security-Policy with per-request nonce on both proxies (apps/saas/proxy.ts + apps/marketing/proxy.ts). crypto.getRandomValues → 16-byte base64 nonce per request, propagated to layouts via x-nonce header. Default Report-Only (set CSP_REPORT_ONLY=false to enforce) so violations are observable before they break the app.
  • AuditEvent table + `@repo/audit-log`: append-only audit_event schema (actor, org, type, target, JSON metadata, IP, UA, createdAt) with indexes on actor/org/type/createdAt. recordAudit() swallows write failures (compliance prefers a missing log line to a missed login). Better Auth after hook records sign-in/sign-up, password reset/change, admin impersonate/ban/role-change/delete, two-factor enable/disable, email change. Migration 0014_shiny_prima.sql.

Performance and DX

  • `reportWebVitals` wired: <WebVitals /> mounted in root layout uses next/web-vitals. Logs to console in dev; in production beacons to NEXT_PUBLIC_WEB_VITALS_URL (no-op if unset).
  • Bundle analyzer behind `ANALYZE=true`: @next/bundle-analyzer wrapping next.config.ts. Set ANALYZE=true pnpm --filter saas build to inspect chunk sizes.

Conformance and quality

  • Fumadocs version pinned correctly: apps/docs/fumadocs-mdx set to 15.0.7 (latest 15.x; v16 doesn't exist) so the withMDX typegen + postinstall regenerate the .source/server.ts correctly.
  • `proxy.ts` export style aligned: marketing's default export switched to a named export async function proxy to match the SaaS app + agents.md "avoid default exports" guidance.
  • `types` glob fixes in three more packages (@repo/logs, @repo/storage, @repo/utils) — malformed "./**/.ts" patterns replaced with "./index.ts".
  • `type` → `interface` for the prop type alias on the @repo/ui components that needed it (button, badge, chart).
  • Floating-promise sweep: five queryClient.invalidateQueries(...) call sites that were warning under typescript/no-floating-promises now properly prefixed with void.

May 21, 2026

Features and additions

  • AI alias suggester with Tavily grounding: The "Suggest with AI" button next to the aliases field on the brand add/edit forms now runs tracking.suggestAliases, which combines a Tavily web-search of the brand (Wikipedia, About page, news, Crunchbase) with a gpt-4o call on OpenRouter. The model is shown the search snippets as grounding context and instructed to ground every alias in that text — fixes the prior failure mode where niche B2B brands were getting generic Anglo defaults like "Cognigy Inc" instead of the actual legal entity "Cognigy GmbH". Bare + www. variants of the brand's primary domain are prepended server-side so they always appear. Popover groups suggestions by type, surfaces a confidence pill + one-sentence reason per row, pre-selects high-confidence picks, and includes a "Grounded in" panel listing the source URLs for verification. TAVILY_API_KEY is optional — without it the suggester falls back to LLM-only knowledge. Costs ~\$0.01/call (\$0.005 Tavily + \$0.005 gpt-4o) and is capped at 20/min per user per org.
  • "Your brand" inline form: Orgs created via the org dropdown (not the onboarding wizard) previously hit a dead-end on /brands — the "Your brand" section showed "finish onboarding to add one" with no path forward. The form is now rendered inline when the section is empty, with the same name + expandable details (website + AI-suggested aliases) used for adding competitors.
  • Default project on every new organization: Better Auth's organizationHooks.afterCreateOrganization now provisions a default project row, and the [organizationSlug] route layout lazily backfills one for orphan orgs created before this hook existed. /topics no longer dead-ends for org-dropdown signups. The "project" data-model abstraction stays invisible in the UI — one project per org, never surfaced in nav or settings. The multi-project selector in TopicsView remains for the eventual agency-style use case.
  • Notion-style URL handles: Workspace URLs are now /<slug>-<cuid2>/dashboard (e.g. /get-vocal-kf3p9b4z2g7q1d5x8w7v3yhq/dashboard) instead of the prior FCFS globally-unique slug pattern. The trailing CUID is canonical; the slug is decoration generated from the org name on every render. Two orgs named "Acme" coexist as /acme-<id1>/... and /acme-<id2>/... with zero collision possible — no FCFS squatting, no trademark exposure. URLs are bookmarkable and survive renames (changing the org name regenerates the slug part but the trailing ID never moves, so old links keep resolving). Legacy bare-slug URLs (/get-vocal/dashboard) still resolve via a slug-fallback and 301-upgrade to the canonical handle on first hit. Active workspace is now URL-driven; Better Auth's session-based activeOrganizationId is used only as the redirect default when landing on /.
  • Loading state everywhere: Every leaf route gets a loading.tsx skeleton that mirrors the page's real layout for zero reflow when content swaps in (dashboard, brands, queries, topics, scans, insights, all detail pages, all settings routes, plus org-scoped + account-scoped settings). The two LLM-driven routes (/insights and /topics/[id]/insights) get an additional banner-with-phases treatment: a spinner with a rotating phase string ("Reading scan history" → "Aggregating brand mentions" → "Comparing against tracked competitors" → "Detecting trend shifts" → "Drafting executive summary" → "Final pass"), a live m:ss elapsed counter, and a subtitle explaining the ~30s cold-start cost. Phases are honest descriptions of pipeline stages, not invented progress.
  • Error boundaries on every layer that can fail: error.tsx files at the org route, the insights route, the topic-insights route, and a last-resort catch in (main). All driven by a shared RouteError component with retry, dev-mode error dump, and a digest reference for support. LLM-driven routes have branded copy pointing at Settings → API keys.
  • Custom 404: not-found.tsx at the [organizationSlug] layer renders a friendly recovery panel inside the app shell — notFound() calls no longer fall through to Next's chromeless default.
  • Single-scrollbar shell: Replaced the framed-scroll pattern (which produced two scrollbars on tall pages — body's min-h-screen + main's overflow-y-auto) with natural body scroll + fixed sidebar. Matches every normal-feeling SaaS shell.

Security and hardening

  • Security headers + `poweredByHeader: false` on both apps/saas/next.config.ts and apps/marketing/next.config.ts: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, plus COOP/CORP on the SaaS app.
  • Better Auth `freshAge` restored from 0 to 60×15 (15 min). Without this, any old session could perform sensitive ops (deleteUser, changePassword, passkey.add, twoFactor.enable). Sensitive routes should catch SESSION_NOT_FRESH and prompt the user to re-auth.
  • Better Auth `rateLimit` config wired: 10/min baseline; tighter caps on /sign-in/email, /sign-up/email (5/min), /magic-link/send, /forget-password (3/min), /two-factor/send-otp (5/min). In-memory by default; swap to a Redis storage adapter when scaling multi-region.
  • App-layer rate limiting on three abuse surfaces: ai.stream (30/min/user), tracking.suggestAliases (20/min/(user, org)), organizations.generateSlug (600/min global). Token-bucket helper at @repo/api/lib/rate-limit.ts with 4 unit tests.
  • `/ai/stream` now requires `organizationId` + membership verification: previously any authenticated user could spam the endpoint against the platform's shared model key — direct route to draining the OpenAI/OpenRouter budget. AiChat updated to pass the active org.
  • Cron auth = `crypto.timingSafeEqual`: all 4 /api/cron/* endpoints (nightly-topic-insights-submit, process-completed-batches, scheduled-scans, weekly-digest-submit) switched from string-equality Bearer token compare to timing-safe via a shared helper at apps/saas/app/api/cron/_lib/auth.ts.
  • Defense-in-depth auth proxy at apps/saas/proxy.ts (Next.js 16 renamed middleware → proxy). Edge-safe cookie-presence check on non-public paths; redirects to /login with redirectTo preserved. Layout-level check stays the authoritative auth path; the proxy is the belt-and-suspenders layer that stops a future misplaced route group from bypassing auth.
  • Image-proxy path-traversal hardening: apps/saas/app/image-proxy/[...path]/route.ts validates filenames against ^[a-zA-Z0-9._-]+\.(png|jpe?g|webp|gif|avif)$ and an explicit bucket allowlist with a type-guard. Rejects ../, nul bytes, non-image extensions.
  • S3 signed upload accepts caller-supplied `contentType` validated against a per-bucket allowlist (ALLOWED_UPLOAD_CONTENT_TYPES). Was hard-coded to image/jpeg, letting clients upload HTML/SVG/PDF under a jpeg label — stored-XSS vector on public-read buckets.
  • OpenAPI Scalar docs gated at packages/api/orpc/handler.ts: only mounted in non-prod or when ENABLE_API_DOCS=true. The full API surface was previously discoverable at /api/docs on a public URL in prod.
  • Toast on org-invitation accept/decline errors: OrganizationInvitationModal was silently swallowing the error with a TODO comment — now surfaces via toastError with a localized fallback message.

Performance

  • `disableCookieCache: true` removed from default `getSession()`. Used to force a DB hit on every authenticated render (5–10× DB load multiplier on logged-in pages). Cookie cache is integrity-signed by Better Auth (5–10 min TTL) — safe for the default path. New getFreshSession() opt-in variant for the rare flows that need live DB state (admin role transitions, billing).
  • N+1 `db.insert(...)` calls batched in execute-scan.ts: brandMention fallback rows and source rows are now inserted via single batched values([...]) calls instead of one-row-per-iteration loops. Hot scans with many brands matched go from N round-trips to 1.
  • `fetch` to OpenRouter wrapped in `AbortController` + 8s timeout in true-up-cost.ts. Could previously hang indefinitely if their API stalled, blocking scan completion.
  • 29 redundant `revalidate = 0` declarations removed across saas + marketing routes. Implied by force-dynamic or cookies() / headers() reads.

Database

  • Migration tree reconciliation: 0011_foamy_pyro.sql + meta/0011_snapshot.json + _journal.json entry generated to record the topic_insight_snapshot → analytics_snapshot consolidation (the table was applied to dev earlier via the manual apply-migration-0011.mjs script per plan 022, but drizzle's codegen tree was never updated). The generated SQL was hand-edited to add IF NOT EXISTS / IF EXISTS guards so it's safe to apply against either fresh DBs or DBs that already have the table.
  • `backfill-drizzle-migrations.mjs` script: reads the journal, computes sha256 of each migration's SQL, and inserts one row per entry into __drizzle_migrations with the correct created_at. Solves the case where the DB has been populated via direct schema push or manual apply scripts before drizzle's tracking table existed and drizzle-kit migrate hangs trying to apply migrations from scratch against a populated schema.

Hygiene

  • `@repo/auth`, `@repo/ai`, `@repo/database`, `@repo/payments` `package.json` `types` fields corrected from the malformed ./**/.tsx (or ./**/.ts on payments) glob to ./index.ts. Inert in practice (consumers go through main) but worth fixing — the typo originated upstream in the Supastarter template and is propagated to every fork.
  • Removed unused `@scalar/hono-api-reference` dependency from @repo/api.
  • Renamed `apps/saas/modules/admin/component/` → `components/` to match the rest of the repo's directory convention.
  • Deleted dead `apps/saas/modules/organizations/components/OrganizationStart.tsx` (Supastarter template leftover with no imports — the org root redirects to /dashboard now).
  • Deleted dead `apps/saas/modules/lib/sidebar-context.tsx` (identical duplicate of the @shared/lib/ version, no imports).
  • `Pagination.tsx`: fixed PaginatioProps typo → PaginationProps, converted type → interface, arrow → function, removed redundant displayName.
  • `oauth-providers.tsx`: IconProps type → interface.
  • Marketing ContactForm + NewsletterSection `console.log` calls in the unimplemented submit-stubs gated behind NODE_ENV !== "production" so demo payloads don't leak in prod logs.
  • `metadataBase` wired in both root layouts from NEXT_PUBLIC_SAAS_URL / NEXT_PUBLIC_MARKETING_URL (fixes the OG/Twitter image resolution build warning).
  • SaaS `robots.ts` switched to `Disallow: /` — it's an authenticated product with no public content to index.
  • `LoginForm` password-toggle button got an aria-label (auth.login.showPassword / hidePassword i18n strings).
  • `as any` casts narrowed: LoginForm.tsx:92 via an in check on data.twoFactorRedirect; ActiveOrganizationProvider.tsx:69 typed against Session.
  • GitHub Actions workflow concurrency cancellation added to validate-prs.yml so rapid PR updates don't stack runs.

Deprecated routes removed

  • `/api/cron/weekly-digest` route deleted. Was superseded by the batch lane (weekly-digest-submit + process-completed-batches) shipped in plan 022; marker said "stays around for one release cycle" and that cycle ended.

May 13, 2026

Fixes and improvements

  • Dependency minimum release age: A 1-day minimum release age is now enforced at two levels to reduce supply chain attack exposure. Dependabot is configured with cooldown: default-days: 1 so upgrade PRs are not opened immediately for freshly published versions. pnpm-workspace.yaml sets settings.minimumReleaseAge: 1440 (minutes) so pnpm v11+ will also refuse to install any package version younger than one day, including transitive dependencies. Together these ensure a community-detection window before newly published — potentially compromised — versions reach the project.

May 9, 2026

Fixes and improvements

  • Two-factor authentication schema: Added the missing Better Auth verified flag to the TwoFactor Prisma model, generated Prisma Zod schema, and PostgreSQL, MySQL, and SQLite Drizzle schemas so two-factor enrollment state is represented consistently across database adapters.

May 6, 2026

Fixes and improvements

  • Account security settings: Passkeys can now be renamed from the passkey list, and the rename dialog opens automatically after creating a new passkey. The passkey list shows user-defined names without the device type prefix and falls back to “Unnamed passkey” for legacy passkeys without a saved name. The two-factor authentication block remains visible when a password has not been configured and now explains that a password is required before two-factor authentication can be enabled.

2026-04-24 v3.3.2

2026-04-24 v3.3.2

Fixes and improvements

  • Organization general settings: Organization name field now syncs when client data loads; success and error toasts use dedicated organizations.settings i18n keys. After renaming, the organization list query is refetched, the active organization is refreshed, and the name form resets to the saved value. The organization switcher no longer briefly shows “Personal account” when opening account settings with an active organization (active-org query keeps previous data across route key changes).

2026-04-20 v3.3.1

2026-04-20 v3.3.1

Fixes and improvements

  • Drizzle notifications and schema: Notification persistence (preferences, insert support, listing rows, unread counts, mark read) is implemented in @repo/database for both Prisma and Drizzle, so the Drizzle scaffold no longer mixes in Prisma-style db calls. The Drizzle schema barrel (drizzle/schema/index.ts) re-exports the PostgreSQL schema (aligned with the Drizzle client) and exposes NotificationType / NotificationTarget for type-safe consumers.
  • `user.lastActiveOrganizationId` in Drizzle: Added on PostgreSQL, MySQL, and SQLite user tables so Drizzle schemas match the Prisma user model and auth hooks that read this field.
  • Organization lookups (Drizzle): findFirst-based helpers now normalize missing rows to null, matching Prisma findUnique behavior for tests and callers.
  • `@repo/notifications`: Dropped the thin list, mark-read, and preferences modules; the package index re-exports the shared notification query helpers from @repo/database next to create/welcome/resolve-link.
  • Notifications procedures: List and unread-count handlers use the database row helpers from @repo/notifications / @repo/database and apply resolveNotificationLink when shaping list responses.
  • Notification center: Removed interval-based refetching of notifications from the notification center UI.

2026-03-30 v3.3.0

2026-03-30 v3.3.0

Added

  • Notification entity: New Notification model in Prisma and Drizzle (PostgreSQL, MySQL, SQLite) with user association and read/unread state.
  • `@repo/notifications`: Shared module for notification definitions (catalog), creating and listing notifications, marking as read, per-user preferences, and a welcome notification helper.
  • Notifications oRPC: Procedures to list notifications, get unread count, mark one or all as read, and read/update notification preferences.
  • Notification Center: Navbar UI to view notifications and mark them read.
  • Notification preferences: Account settings page and form for per-channel preferences; server-only notification logic is kept out of the client bundle for the preferences form.
  • Auth: Database hook after user creation creates a welcome in-app notification via @repo/notifications.
  • `Notification` email template and template wiring; saas and mail translation keys for notifications in English, German, Spanish, and French.
  • Popover and Switch components exported from @repo/ui for notification UI patterns.

Changed

  • Account and organization settings: Removed nested settings/layout.tsx for account and org routes; settings sub-pages (general, billing, security, members, etc.) are updated to match the flatter structure. New Notifications route under account settings.
  • NavBar: Reworked layout and behavior (including notification entry points); Tailwind theme (tooling/tailwind/theme.css) and related component tweaks for consistency.

2026-03-24 v3.2.0

2026-03-24 v3.2.0

Testing

  • Vitest setup: Added Vitest configuration (vitest.config.ts) to apps/saas, apps/marketing, and packages/api so unit tests can be run with pnpm test in each workspace package.
  • Unit tests: Added initial unit test suites covering base-url helpers in both apps, content utilities in the marketing app, and organization membership logic, slug generation, and oRPC procedure wiring in the API package.
  • CI integration: Added a unit test job to the GitHub Actions workflow so all unit tests run on every pull request; the Turbo test task no longer depends on build.

Page 5 of 9