v1.1.0

The first feature release on top of the 1.0.0 backend baseline — a complete track → bill → get-paid platform. All changes are backward-compatible (SemVer minor): the API-key path is unchanged; new behavior is additive or gated on the new signed-in-user (JWT) actor.

Highlights

• Billing platform — invoicing (time→invoice rollup, numbering, PDF, tax/discount/write-off), payments + invoice allocation + AR aging, expenses, retainers, recurring invoices.
• Auth & RBAC — self-service signup/login (JWT), password reset, teammate invitations, and RBAC enforcement across the user-management surface and the approval action, including separation-of-duties.
• Approval workflow — submit → review → approve, with multi-level approval-chain enforcement.
• Security hardening — idempotency pre-handler claim (no concurrent double-execution), streamed GDPR export (no OOM), per-link share-link revocation, SSRF/DoS/cross-tenant fixes, and all money columns exact-decimal NUMERIC(14,2).

See CHANGELOG.md for the full 1.1.0 entry.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

v1.0.18

Added

• CI: supply-chain + static-analysis security scanning. New
  security.yml runs CodeQL (JavaScript SAST) and Trivy
  (filesystem scan for vulnerable deps + IaC/config misconfig), surfacing
  findings in the repo Security tab with a weekly resweep. Report-only —
  the npm audit step in tests.yml stays the hard gate on production
  deps. Rounds out the security posture expected of a sellable product.

v1.0.17

Fixed

• Money is now exact (NUMERIC, not float). The amount columns —
  InvoiceJob.injbAmount, CustomerPayment.cpayAmount,
  BillingType.btHourlyRate — migrate from double precision to
  NUMERIC(14,2) so cents arithmetic can't accumulate binary-float
  drift (a must for a billing product). The Sequelize models pair them
  with a getter that returns a JS Number, so the API/JSON
  representation is unchanged (numbers, not the strings node-postgres
  yields for NUMERIC). Validated end-to-end by the existing real-Postgres
  integration tests.

v1.0.16

Changed

• CI: gate the web build. test.yml gains a parallel web job that
  runs npm ci && npm run build in web/, so a broken SPA build is
  caught on every push/PR instead of only when the Docker webbuild
  stage fails at release time.

v1.0.15

Added

• web: A/R dashboard. The home screen now shows accounts-receivable
  at a glance — total outstanding, the aging buckets (current / 1–30 /
  31–60 / 61–90 / 90+), and a "who owes you" table — wired to
  /v1/report/aging. The quick-action cards (Track time / Clients /
  Invoices) are now real links. Builds clean.

v1.0.14

Added

• Single-container deploy: the API serves the web app. server.js
  serves the built SPA (web/dist) — static assets plus an index.html
  fallback for client-side routes — whenever it's present, so one
  container serves both the /v1 API and the UI (API routes still win;
  /healthz, /metrics, /docs, /openapi.json are untouched). The
  Dockerfile gains a dedicated webbuild stage (Vite build) and copies
  web/dist into the runtime image; .dockerignore excludes
  web/node_modules/web/dist from the context. API-only deploys (no
  built UI) are unaffected — the static serving is skipped.

v1.0.13

Added

• web: Invoicing. Closes the core "track time → bill → get paid" loop
  in the UI: one-click auto-bill a job into an invoice (from the
  client page), an invoice detail view with total / paid / balance /
  status, line items and payments, a record-payment form (full or
  partial), download PDF (authenticated blob fetch), and carry
  balance forward. New Invoices nav + an invoice list per client.
  Builds clean.

v1.0.12

Added

• web: Time tracking. Log time against a client (and optionally a job)
  with a manual date + start/end form, and see a recent-entries table with
  durations. Wired to POST /v1/timeentry and
  /v1/timeentry/bycompany. Client→job selects cascade; billable toggle.
  Builds clean.

v1.0.11

Added

• web: Clients & Jobs management. New screens in the web app to list
  and add clients (customers) and, per client, list and add their jobs —
  wired to /v1/customer/bycompany, POST /v1/customer,
  /v1/job/bycustomer, and POST /v1/job with the session key. Adds a
  top nav (Dashboard · Clients), tables, and a tolerant list-response
  helper. Builds clean.

v1.0.10

Added

• web/ — end-user web app scaffold (React + Vite SPA). First slice
  of the UI: signup / login / logout, a /v1/auth/me-backed auth context,
  a session-key API client (stores the key in localStorage, sends it as
  authKey), a protected app shell, and a dashboard framing the feature
  areas to come. Dev server proxies /v1 to the API. Standalone
  sub-project — the root API test suite, lint, and Docker image are
  unaffected (its build/deploy wiring lands in a later iteration). Builds
  clean (cd web && npm run build).