# Changelog

## [0.1.0] — 2026-08-03

Phase 1 (Foundation) + Phase 2 core (secure crawler & queue).

### Added
- Next.js 16 + TypeScript + Tailwind 4 application scaffold, zod-validated
  environment, pino structured logging with secret redaction.
- Full multi-tenant Prisma schema (50+ models) with initial migration and
  removable demo seed (fictional Lancashire dealership; no fabricated metrics).
- Authentication: register / login / logout / email verification / password
  reset — argon2id, hashed single-use tokens, account lockout, rate limiting,
  session revocation on reset, audit records; dev mailer logs email links.
- Organisations with six-role RBAC (tested permission matrix) and tenant
  guard returning 404 to non-members.
- Website management: SSRF-validated creation, update, archive; ownership
  verification via HTML file, meta tag or DNS TXT with live checking.
- SSRF-protected fetch layer: DNS pre-validation of every record, IPv4/IPv6
  private/link-local/CGNAT/metadata blocking, manual redirect re-validation,
  byte and time caps.
- Crawler: BFS engine in a BullMQ worker honouring robots.txt (RFC 9309
  matching) and crawl delay; page/link/issue snapshots; progress counters;
  cancellation; rule-based issue detection (titles, descriptions, headings,
  thin/duplicate content, broken internal links, redirect chains, alt text,
  noindex) with plain-English explanations and fixes.
- Dashboard UI: marketing homepage, auth pages, website list/add, website
  detail with verification panel, crawl controls, live progress and issue
  display. Private pages are noindex; app robots.txt excludes them.
- `/api/health` with database and Redis checks.
- Docker Compose (Postgres, Redis, web, worker), Dockerfile, production
  security headers, and the full documentation set.
- Test suite: 80 vitest tests (SSRF, robots, URL normalization, HTML parsing,
  passwords, tokens, RBAC, rate limiting). Typecheck and lint clean.

### Known limitations (tracked in TASKS.md)
- End-to-end crawl needs a running Redis (verified failure path without it;
  full run pending T10).
- 2FA UI, member invites, sitemap ingestion, SEO score, crawl comparison and
  onboarding wizard not yet implemented.