Changelog

Every released change, generated from Conventional Commit history. Subscribe via RSS, or browse the immutable GitHub Releases for tags and source snapshots.

​

0.3.2 (2026-10-25)

​

🐛 Bug Fixes

• deps: patch compressed request parser denial of service (c1e211e)
• deps: remediate vulnerable Bun transitive dependencies (6c1c44b)
• deps: upgrade Bun and patched Node runtimes (bc9d252)
• deps: upgrade platform dependencies and patch transitive security flaws (8d99b63)

​

0.3.1 (2026-10-07)

​

🐛 Bug Fixes

• ci: maintain security resolutions and workspace updates (15484fc)
• ci: make workspace dependency updates maintainable (266a1ca)
• ci: make workspace dependency updates maintainable (266a1ca)
• ci: validate Payload GraphQL dependency compatibility (f0ccbd2)
• ci: validate Payload GraphQL dependency compatibility (f0ccbd2)
• ci: validate Payload GraphQL dependency compatibility (f5b7d8e)
• deps: remove vulnerable brace parser dependency chains (8a7819f)
• deps: repair dependency upgrades and CI compatibility (7b1f468)
• deps: repair dependency upgrades and CI compatibility (5ed8a6a)
• deps: repair development upgrade security and CI (a6db2ae)
• deps: repair production upgrade compatibility and security (deab42c)
• deps: repair Vitest compatibility and remove vulnerable chains (611621b)
• harden TypeScript migration tooling (ed6876c)
• test: migrate workspace mocks to MSW 3 (f59200c)

​

📚 Documentation

• add hosting migration and invoicing modernization plans (9b8e458)
• add hosting migration and invoicing modernization plans (f873cf2)
• record recurring dependency CI causes and repairs (412e019)
• record reproducible TypeScript 7 benchmarks (57179c8)
• record successful dependency repair builds (fc97696)

​

🛠 Refactors

• remove TypeScript 6 compatibility layer (40664fb)

​

🧪 Tests

• deps: isolate ancestor lookup fixtures (1a50f44)

​

⚙️ CI

• harden dependency and release automation (e1eda4f)
• harden dependency and release automation (bc9cf54)

​

0.3.0 (2026-09-27)

​

🚀 Features

• web: add a branch picker to the booking dialog (5962d64)

​

🐛 Bug Fixes

• admin: let the browser Sentry SDK reach its ingest host (99ee54e)
• observability: load Sentry from supported file locations (fea9aee)
• restore online booking, branch picker, onboarding gate, Sentry (9b5072a)
• web: answer availability requests that name no branch (e059112)
• web: ask for a missing profile when Book Now is tapped (f8630fd)
• web: cap CMS reads at 5 s so a sleeping CMS cannot stall renders (55b2e42)
• web: only staff can create confirmed walk-in bookings (ef04e7c)
• web: purge CMS fetch cache tags so owner content edits reach the site (5331703)
• web: route new customers through onboarding before they can book (a43d4c0)
• web: save the onboarding name and a consent receipt (f9b7852)

​

📚 Documentation

• document /api/branches and the availability branch rule (a5615c8)
• onboarding comes before the booking dialog (df40f70)
• web: correct the CMS read-timeout rationale (79475ee)

​

🧪 Tests

• pin the onboarded-only rule for walk-in bookings (3597559)

​

0.2.3 (2026-09-22)

​

🐛 Bug Fixes

• security: address five CodeQL alerts (#251) (e18f372)

​

0.2.2 (2026-09-22)

​

🐛 Bug Fixes

• cms: declare the Payload trusted origin in render.yaml (#241) (47355a8)

​

📚 Documentation

• commit the per-app repo instruction files (#246) (ca1f661)

​

0.2.1 (2026-09-10)

​

Bug Fixes

• auth: complete Better Auth 1.7.3 cleanup and stabilize CI (abb2b1f)
• auth: restore provider account identity for Better Auth 1.7.3 (985dac6)

​

0.2.0 (2026-09-09)

​

⚠ BREAKING CHANGES

• deps-dev: migrate to Biome v2.5.5 (#56)
• deps: bump @hono/node-server 1.14 -> 2.0.12 (batch of #55,#71)
• deps-dev: migrate to fast-check v4 (batch of #60,#62,#74,#78,#82,#84)

​

Features

• add catalogue drift-reconciliation job, migration runbook and docs (49a2ebc)
• add Kiro CLI steering files for implementation (d7c76fc)
• add Kiro CLI steering files for project implementation (2612516)
• add Kiro skills and setup guide for multi-agent development (821e6cb)
• add Kiro skills and setup guide for multi-agent development (76d191a)
• add Phase 4 (CRM, leads, memberships, gems) and Phase 5 (scheduling, notifications, offers) (cffc797)
• add Phase 6 background jobs and automation (be069e0)
• admin subdomain migration + update dev ports (web:3000, admin:3001, cms:3002, docs:3003) (7e1a85e)
• admin-web-separation: relocate staff self-service to admin /me/* (15bb2c2)
• admin: complete admin portal feature set, auth/session fixes, single-source services (b4e91e0)
• admin: migrate @tanstack/react-table v8 to v9 (#157) (df8d5cf)
• admin: migrate forms and filters to shadcn/Radix; fix dialog, hydration and filter sizing (d00ae5c)
• admin: redeem gems at checkout in the complete-booking flow (#6) (b6ad651)
• admin: redesign admin portal on a shadcn UI system (27ff841)
• admin: redesign admin portal with shared design-system primitives (119d44b)
• admin: wire audit-log writing into mutations + seed dev catalogue (7fce2aa)
• analytics: default PostHog to EU region (0c2367b)
• auth: add nullable account.issuer + Better Auth schema contract gate (1/2) (1a4f552)
• auth: add nullable account.issuer and Better Auth schema contract gate (da6fef9)
• auth: upgrade Better Auth to 1.7.2 + enforce account issuer identity (2/2) (aef0d2a)
• auth: upgrade Better Auth to 1.7.2 and enforce account issuer identity (c74844d)
• aws: attach theroyalglow.in and admin.theroyalglow.in to CloudFront (0c110bc)
• backend-api: complete thin-API layer with full test suite (88c7798)
• build remaining gaps — service detail pages, profile prefs, contact env, PWA install, customer realtime (8ac8f5e)
• close all outstanding spec tasks across the repo (643/647) (80f25d7)
• cms: add Dockerfile + standalone output for Koyeb free-tier deploy (b27ebb1)
• cms: add forward-only Payload migrations for the service catalogue schema (bceaa8d)
• cms: add on-demand revalidation, fix admin layout, install caveman steering (d52afbb)
• cms: add read-only Payload MCP server at /api/mcp (00ea942)
• cms: add schema-create guard to initial migration and Resend email adapter (f3f1515)
• cms: add schema-create guard to initial migration and Resend email adapter (fcc3eb2)
• cms: add schema-create guard to initial migration and Resend email adapter (4f6c4c3)
• cms: add schema-create guard to initial migration and Resend email adapter (d276ceb)
• cms: add Testimonial, Offer, and ServiceCard collections (1999c7c)
• cms: group sidebar, R2 cms/ prefix, fix SSL verify-full (179affc)
• cms: wire Payload collections into website with migrations and schema isolation (61ce539)
• complete Phase 0-3 implementation (7e2d074)
• contact form, server-side Sentry restore, CMS Render blueprint (88968b4)
• convert all pages/*.md to rich HTML using Claude HTML maximalist approach (a92fb44)
• Convert pages/*.md to rich HTML (Claude HTML maximalist) (793358a)
• db: schema-drift-remediation pipeline + migration discipline (8e738db)
• deploy: add Render free-tier services for web + admin (5456f7c)
• deploy: migrate web + admin to Cloudflare Workers via OpenNext (cdec206)
• design: finalize design tokens — Cabinet Grotesk, Clash Grotesk, Plus Jakarta Sans (2975e51)
• design: Finalize design tokens v2 — new font stack (e809186)
• docs: organisation-grade design system for the Mintlify docs site (df8d23d)
• docs: premium Fumadocs theme + path-based multi-version documentation (17f1939)
• gems-redemption: customer-only online gems redemption (per-spec) (6500dca)
• invoicing: Cloud Run PDF render service (0aecc5f)
• jobs+billing: register QStash schedules + send invoice/confirmation email on completion (c0f96fc)
• make Payload CMS the only write path for the service catalogue (55f7504)
• move service management to Payload CMS (collections + atomic sync) (81d1bcf)
• Phase 10 — observability stack + launch assets (1d7fb9e)
• Phase 7 — SEO, PWA, cookie consent, analytics & legal pages (b16199f)
• Phase 8 — CMS & Blog (Payload v3 + blog/gallery + SEO) (c780f2f)
• plan AWS deployment for web + admin on Lambda, retire Cloudflare Workers (06f1a23)
• platform: standardize releases, merge governance and MCP tooling (4698de7)
• platform: standardize releases, merge governance and MCP tooling (780d463)
• realtime booking publishing (#5) + admin notifications route (40fc07e)
• types,business: invoice-PDF render contract + HMAC signing + amount-in-words (2298ed0)
• web security perimeter (CSP/CORS, distributed rate limit, Meta CAPI) + admin walk-in booking (e275578)
• web,admin: wire invoice-pdf job + attach PDF to invoice email (bacb555)
• web,db: wire real Rayasandra Google Maps Place ID + fix contact map (f96c043)
• web: add brand favicon, app icons, and PWA manifest icons (4d526c5)
• web: add default OpenGraph social-share image (4deb30e)
• web: add Garnier brand between L’Oréal and TRESemmé (c54bf14)
• web: add TRESemme brand + seamless glitch-free marquee (e029a89)
• web: decouple the homepage hero image from the announcement strip (9c749a6)
• web: direct Google sign-in + One Tap, account dropdown, homepage polish (1c2b403)
• web: One Tap on mobile + remove /sign-in + brand typography marquee (d5b93fc)
• web: real monochrome SVG brand logos + per-brand optical sizing (5c76634)
• web: redesign cookie consent as compact pill bar (fa33a4b)
• web: testimonials carousel — horizontal scroll, auto-advance, functional dots (f4c3b0b)

​

Bug Fixes

• admin: harden check-allowed-paths against shell injection (32f68f6)
• admin: read customers array from search envelope in membership form (ce98bf1)
• admin: satisfy biome a11y and hook-deps lint in shadcn primitives (c5d3341)
• admin: unblock admin-design-gates CI on chart primitive (03e5c0e)
• auth: compile the schema contract test against both 1.6.x and 1.7.x (6216edf)
• auth: keep shared session cookie storable on local http (49ee426)
• auth: restore Better Auth 1.6.26 (8c06e37)
• auth: restore Better Auth 1.6.26 (deaf446)
• auth: support Better Auth 1.7.2 DB-free builds (7cbd5da)
• aws: omit unset optional env vars and give admin the delivery keys (9afd259)
• ci: coordinate dependency upgrades and validate fast-forward promotions (00c70f5)
• ci: declare environment on jobs that read environment-scoped secrets (57cddc7)
• ci: guard empty BetterStack webhooks in prod deploy workflows (38bb12f)
• ci: make path-allowlist gate formatting-aware (AST-based, not text-diff) (eb99491)
• ci: make path-allowlist gate formatting-aware instead of text-diff based (1330921)
• ci: make the pprd load/security gates match reality (cd919f5)
• ci: make the pprd load/security gates match reality (cabcbb1)
• ci: pass CLOUDFLARE_DEFAULT_ACCOUNT_ID to the deploy (eb8dfe1)
• ci: pass SKIP_ENV_VALIDATION/BETTER_AUTH_SECRET/NODE_OPTIONS through turbo strict env mode (#92) (7ddadf8)
• ci: pin Mergify action and enforce CMS unlock access (f86edc8)
• ci: point Lighthouse at the customer site instead of the admin portal (65c2767)
• ci: point Lighthouse at the customer site instead of the admin portal (d1bbfea)
• ci: poll for CI completion in deploy gate + bun install before rollback (075e45e)
• ci: preserve QStash schedule registration after retiring the deploy workflows (93b31f2)
• ci: quote wrangler rollback command so deploy workflows can start (b96c8ec)
• ci: recover dependency checks and enable fast-forward promotions (#226) (a3ba66b)
• ci: recover dependency checks and preserve commits across environments (a3ba66b)
• ci: repair the daily pprd replication and make live-fork suites opt-in (7084cc6)
• ci: scope prod deploy gate to CI workflow + install bun in rollback jobs (6526731)
• ci: stop the deploy workflow failing after a successful deploy (981e7dc)
• cms: use exactOptionalPropertyTypes-safe email config on pprd (06c45a6)
• cms: use exactOptionalPropertyTypes-safe email config on prod (86b93f2)
• cms: wire Resend email adapter and guard cms schema creation (625f269)
• converge all Neon branches to canonical and close the drift tooling gaps (f3e2c67)
• correct README.md inconsistencies — table count, roles, invoice numbering, job inventory, domain, and more (a9ac067)
• db: keep the lazy client lazy under Better Auth 1.7 adapter construction (bd077e1)
• db: lazy-init Neon client so next build no longer throws at import (3d7774e)
• db: retry Neon cold-start fetch failures (d95e3ee)
• db: use sql.query() in drift catalog reader for neon serverless v1 (sql(text) call form removed) (fd448fd)
• deploy: add missing NEXT_PUBLIC_APP_URL to both apps and make admin Sentry DSN optional (953887e)
• deploy: close Tier 0 blockers — required auth secret, pg_cron apply, QStash registration (44d7eca)
• deps: align @neondatabase/serverless across web/admin to dedupe drizzle-orm (af651e9)
• deps: clear all 22 audit findings so dependency-audit gate passes (78d2a23)
• deps: clear all audit findings so dependency-audit gate passes (8382df3)
• deps: migrate vitest workspace to test.projects + bump plugin-react to v5 for vitest 4/vite 8 (c93b395)
• deps: patch transitive security advisories from bun audit (78ff0ef)
• deps: pin better-auth to last good version; close the db/types typecheck gap (23e44fc)
• deps: raise security overrides so bun audit passes (ac4ca9a)
• deps: raise security overrides so bun audit passes (7d639c2)
• deps: resolve @hono/node-server advisory failing the audit gate (d85566f)
• deps: resync bun.lock with workspace manifests (#152) (c8fe568)
• docs: correct the page and endpoint-group counts on the docs landing page (7420521)
• docs: inline root tsconfig so docs builds standalone on Sevalla (2157451)
• docs: polish brand chrome and dark theme (5e97b8e)
• docs: restore accessibility = 1.0 on /docs/system-design (0269de4)
• docs: restore accessibility = 1.0 on /docs/system-design (320e4c2)
• dx: unbreak bun run dev, de-flake two admin suites, ignore SST generated files (38455e8)
• env: treat empty strings as unset in both apps (a1e3168)
• header: SSR auth state + mobile sign-in button + limit offers to 2 (cb4a916)
• lock dev ports for all apps (web:3000, cms:3001, docs:3002) (4dc47c8)
• monorepo: enforce web/admin separation — relocate background jobs to admin, remove duplication (1d6e820)
• ops: add missing anonymize-preprod script (CI break) + refresh stale pg_cron/phase-8 text (2f98658)
• release: reduce GraphQL history query size (1b82af1)
• release: reduce GraphQL history query size (979760b)
• release: reduce GraphQL history query size (#227) (1b82af1)
• release: retry transient GitHub read-query failures (69a0c2d)
• release: retry transient GitHub read-query failures (8325aee)
• release: retry transient GitHub read-query failures (#228) (69a0c2d)
• resolve 3 remaining doc inconsistencies (02dd9c2)
• resolve all bun run lint failures (aa2c928)
• security: override fflate to 0.8.3 to clear CI audit gate (2de5684)
• standardize gems expiry to 1 year (365 days) across all docs (aba7b3c)
• suppress root-element hydration warning from browser extensions (faa73a5)
• web,db: correct Rayasandra geo coordinates to the real listing (93276aa)
• web: accessible gold text token; defer only the performance threshold (6273d7c)
• web: correct PWA manifest icon purpose type (build break) (a44b406)
• web: enforce canonical typography + ship shadcn/Radix primitives (26aa832)
• web: hero headline — force two-line split on desktop (9c8ae39)
• web: hero headline guaranteed two lines (3d46ac9)
• web: make Meta Pixel/CAPI env vars optional for keyless go-live (720f8a2)
• web: nonce-free CSP on prerendered legal pages; move LHCI comment out of assertions (6117430)
• web: prevent Google Translate hydration mismatch (358ad1d)
• web: resolve the real Lighthouse failures the new gate exposed (eab233d)
• web: restore the homepage hero image and make it owner-managed (c53ebeb)
• web: services carousel — remove white fade, remove arrow circle, fix card alignment (1f53443)
• web: skip Google One Tap auto-prompt outside production (a344487)
• web: stop /staff/.. escaping the /me namespace in the staff redirect (846839b)
• web: testimonials card hover top-border clipping (48f8673)
• web: testimonials carousel — replace scrollIntoView with scrollLeft to prevent page hijack (3cac29c)
• web: use official Google Maps “Embed a map” iframe on contact page (75aa4b8)
• web: use reliable coordinate-based Google Maps embed on contact page (ab9e0d7)
• wrap each curl in a bash [ -n WEBHOOK ] guard so an unset webhook logs skipping and exits 0 instead of failing the job. Behaviour unchanged when the secret is set. (38bb12f)

​

Performance

• web: load brand fonts via link+preconnect instead of a CSS @import (dfaa946)
• web: load brand fonts via link+preconnect instead of a CSS @import (b6ec617)
• web: trim Worker bundle toward Cloudflare free-plan 3 MiB limit (7440091)

​

Documentation

• add comprehensive High-Level Design document (HLD) (a310bf4)
• add comprehensive Low-Level Design (LLD) document (1b3e389)
• add comprehensive Low-Level Design (LLD) document (ed5b7ca)
• add comprehensive pages.md route map (702e19e)
• add design.md — single-file design brief for Stitch/AI agents (641c793)
• add design.md — single-file design brief for Stitch/AI agents (7935a3a)
• add design/ folder with 11 elaborative flow documents (50eab1f)
• add design/ folder with 11 elaborative flow documents (9b87f54)
• add detailed implementation flows for pre-OAuth UTM storage and Redis availability cache (caa6999)
• add device-primary strategy (mobile for customers, tablet for a… (842ba78)
• add device-primary strategy (mobile for customers, tablet for admin) (e337d4a)
• add Emil Kowalski design skill & Taste Skill (anti-slop) to use-skills.md (8841591)
• add Emil Kowalski design skill & Taste Skill (anti-slop) to use… (2a2452a)
• add environment variables setup guide and status (d4d873b)
• add Favourite Services feature spec (HLD + LLD) (5b6875c)
• add Favourite Services feature spec (HLD + LLD) (a9c2f88)
• add HTML versions of all design flow documents (6f8b716)
• add HTML versions of all design flow documents (3a41e77)
• add Mintlify docs.json for docs site configuration (c3134b0)
• add pages.md — complete route map for all ~102 routes (403f18c)
• add Payload CMS to website integration handoff plan (f26ad95)
• add Royal Glow design tokens, variables, theme, and DESIGN.md (39ce56e)
• add Royal Glow design tokens, variables, theme, and DESIGN.md (10a5aac)
• add sitemap.md — complete site hierarchy and navigation archite… (271f690)
• add sitemap.md — complete site hierarchy and navigation architecture (ab21a57)
• add use-skills.md — comprehensive skills, tools & npx commands reference (22c91cf)
• add use-skills.md — essential skills & npx commands (844f5b0)
• add Writing PRDs, Grill-with-Docs, Next.js Developer, Deslop (aa19583)
• add Writing PRDs, Grill-with-Docs, Next.js Developer, Deslop (Hallmark), React Doctor skills (e90cc51)
• align all docs to codebase (099f572)
• align all docs to codebase (pprd->prod) (b621172)
• align all docs to codebase (test->pprd) (84cd48c)
• align docs to codebase (Cloud Run invoicing, Workers/OpenNext, admin root-path, Next 16.2.9, 6 packages) (7d18162)
• auth: record the Better Auth 1.7.2 rollout outcome and two defects found (bdf2bb5)
• aws: record the domain cutover and the CAA trap it set (033f984)
• aws: record the first successful Lambda deploy and what it exposed (bad9ac2)
• complete full-fledged Fumadocs documentation site (0975672)
• consolidate pages, features specs, and system-design into knowledge-base (c53ce0d)
• convert Fumadocs MDX components to Mintlify equivalents (245115f)
• establish knowledge-base/ — relocate reference docs + add INDEX (050838b)
• expand use-skills.md — add Refero, npx skills ecosystem, 90+ co… (050b8b0)
• expand use-skills.md — add Refero, npx skills ecosystem, 90+ commands, new sections (431664f)
• full project documentation in Fumadocs (no OpenAPI needed) (ddd527a)
• readme: add 3-CTA hero and Lead Developer section (9a03a4a)
• readme: add shields.io badge row under the H1 (34aff20)
• readme: open external links in a new tab (9942b7c)
• readme: revert target=“_blank” change (was a no-op) (b60d9f6)
• readme: update Neon badge to show PostgreSQL 18.6 (ca14ef6)
• redesign HTML files with visual CSS flowcharts and wireframes (b172881)
• redesign HTML files with visual CSS flowcharts and wireframes (4044a02)
• render: specify sslmode=verify-full and document Resend + revalidate env vars (d64b20d)
• render: specify sslmode=verify-full and document Resend + revalidate env vars (51c4531)
• render: specify sslmode=verify-full and document Resend + revalidate env vars (e5f96a6)
• render: specify sslmode=verify-full and document Resend + revalidate env vars (0b37f5b)
• repo: add compressed Royal Glow hero banner (318 KB) (8381811)
• repo: add standard trust files and README banner anchor (04c746b)
• repoint steering + README references to knowledge-base/ (c5ce3fe)
• retire remaining Fumadocs references from project documentation (5a01b79)
• rewrite 5 HTML files with SVG diagrams and tabbed layouts (batch 1/2) (57f0773)
• rewrite pages.md as maximally descriptive implementation reference (d2f24cf)
• rewrite remaining 5 HTML files with SVG diagrams and tabs (batch 2/2) (2e733f3)
• scrub all remaining pg_cron references repo-wide (architectural decision follow-through) (270ea68)
• split pages.md into pages/ folder for maintainability (aad9b04)
• update all docs to reflect admin subdomain migration + port changes (4a9c7a2)

​

Code Refactoring

• admin: rename admin Sentry DSN env var to NEXT_PUBLIC_ADMIN_SENTRY_DSN (3862850)
• align all environment variable names to canonical spec (65a9ced)
• blog: consistent grid, CMS read-time, 3x3 from page 2; remove unused cards (f326b3a)
• jobs: migrate all pg_cron jobs to QStash; drop pg_cron (architectural decision) (21c4d20)
• SPA membership now branch-locked — sessions at originating branch only (a407956)

​

Miscellaneous

• deps-dev: migrate to Biome v2.5.5 (#56) (1e3fac0)
• deps-dev: migrate to fast-check v4 (batch of #60,#62,#74,#78,#82,#84) (2bc2ef1)
• deps: bump @hono/node-server 1.14 -> 2.0.12 (batch of #55,#71) (092ac3e)