Changelog

All notable changes to the storefront platform are documented here.

The format follows Keep a Changelog, and the project uses Semantic Versioning.

Release conventions

• Releases are tagged vMAJOR.MINOR.PATCH (e.g. v1.2.0) on main.
• Every release gets a GitHub Release with these notes and a downloadable source zip. Update entitlements follow the license terms — see docs/UPDATING.md for how to pull a release into your fork.
• MAJOR — breaking changes to site.config.ts, theme contracts, or data schemas that require a migration step (each ships with migration notes).
• MINOR — new features, new themes, new feature modules; backwards compatible.
• PATCH — bug fixes, dependency bumps, performance and accessibility improvements.

[Unreleased]

Changes merged to main but not yet tagged.

Fixed

• Preserve the build-selected Convex endpoint in deployed server functions. Service credentials remain runtime environment variables.
• Key the build cache by its Convex endpoint to keep Preview backends separate.
• Carry the reviewed Next.js 16.3.8 dependency update into the source release.
• Preserve the service-authenticated notifications.dispatch API and its dedupe behavior.
• Supply the build-selected backend URL to Better Auth's Convex Next.js helpers.

Deprecated

• site.providers.media is ignored (the media storage seam was removed in 1.2.0). It is still accepted, so existing configs keep validating; delete the line at your convenience.
• The @appy-days/analytics-core and @appy-days/analytics-next packages. trackConversion now lives in apps/storefront/lib/analytics/conversions.ts and reads site.currency; import it from there.

[1.2.0] — 2026-10-05

Added

• Full-catalog collections and search. Collection, search and sitemap reads page through the Storefront API, so collections with more than 100 products show every product and facet.
• Sale prices and variant media. Compare-at prices with "Save X%" on the PDP, a sale product-badge rule, variant images that switch the gallery, up to 20 images, and product video (media) in the gallery.
• Metafield PDP tabs and badges. pdp.tabs renders configured metafields or static text as PDP accordion tabs; a metafield badge rule. Requires the Storefront token's unauthenticated_read_metafields scope.
• Shopping-feed links. ?variant=<id> preselects that variant.
• Variant-level back-in-stock alerts (e.g. one ring size).
• Quick view (capability quickView), a second image on card hover, and pdp.soldOutVariants: "hide" to drop sold-out option values.
• Gift with purchase (capability giftWithPurchase): threshold progress and a gift picker in the cart drawer; enforce with a Shopify automatic discount.
• Product quiz (capability productQuiz) at /quiz.
• Market domains. i18n.domains serves several country domains from one deployment with per-host canonicals and hreflang.
• Loyalty VIP tiers and a Growave migration script.
• App-data imports. pnpm import:data for Loox reviews, Klaviyo/Mailchimp subscribers, back-in-stock requests and Growave wishlists.
• Paired products via pair:<handle> tags, with a read-only find-paired-products helper.
• Multi-store readiness. Home-page copy in site.home; site typed from the schema; prices, <html lang> and theme slots use site.locale; pricing.taxLabel ("incl. GST"); the au market enables payment badges and BNPL; Australia Post, StarTrack, Sendle and Aramex tracking links; a store setup checklist in the RUNBOOK.

Changed

• Builds key the Turbo cache on every app and package file (including site.config.ts), and Tailwind scans packages/features.
• Convex cart, review, COD and referral reads are bounded and indexed. Run catalog:backfillVariants and reviews:backfillReviewStats once after deploying.
• Session recording derives its allowed host from SITE_URL.

Removed

• The unused media storage seam (lib/media, /api/media/blob, the @vercel/blob and aws4fetch dependencies, convex/media.ts), unused carousel/grid/analytics wrappers, Gate/requireCapability, createSlotSystem, and stale shims.

Fixed

• Robots and sitemap metadata builds no longer require the Convex service secret; Convex requests validate it when used.
• Unconfigured Shopify catalog and content reads return empty results outside production, while production reads still fail closed.

[1.0.18] — 2026-09-14

Fixed

• Bundle totals use valid HTML structure, preventing hydration errors on product pages when the price component renders.
• Standalone commerce E2E now checks product-page hydration and markup errors.

[1.0.17] — 2026-09-14

Fixed

• Cart creation now happens in the server-side add/buy action, avoiding an empty-cart race during the standalone Stripe checkout handoff.

[1.0.16] — 2026-09-14

Fixed

• Standalone auth E2E targets the login form's submit button when the demo banner also exposes a sign-in action.

[1.0.15] — 2026-09-14

Fixed

• The standalone demo's checkout upsell route now isolates request-time data behind Suspense, so the production-shaped storefront build prerenders cleanly.
• The storefront release build gate now includes the standalone demo provider and capability configuration.

[1.0.14] — 2026-09-14

Fixed

• Vercel deployments invoke the pinned pnpm binary explicitly during install and the Convex-backed build, avoiding the host's incompatible global version.

[1.0.13] — 2026-09-14

Fixed

• Storefront CI installs the pinned pnpm package through npm instead of a release asset that is unavailable for pnpm 12.

[1.0.11] — 2026-09-14

Fixed

• Standalone demo mode now enables the full capability map, including the account routes required by the authenticated demo fixture.

[1.0.12] — 2026-09-14

Fixed

• Delivery CI now selects the storefront's pinned pnpm version, which supports the lockfile format generated by the source workspace.

[1.0.10] — 2026-09-14

Added

• Customer-delivered standalone Playwright projects for authenticated session, invalid-credential, cart-persistence, and Stripe test-checkout handoff proof.
• Internal platform E2E coverage for protected portal access, active license visibility, entitled downloads, and fresh-session download persistence.
• Nightly standalone preview validation with fail-closed URL, noindex, QA fixture, and Stripe checkout-host prerequisites.
• Shopify admin CI coverage for the module registry, package tests, and typechecking.

Changed

• Storefront source coverage now has a passing enforced floor of 97% statements, 89% branches, 98% functions, and 98% lines.
• Boundary tests cover form-body/timing rejection, honeypots, verification denial, duplicate subscriptions, provider failures, and cart hook failures.

[1.0.3] — 2026-07-10

Fixed

• Rebrand setup now consumes the public @appy-days/config API instead of importing across workspace source boundaries.
• Merchant return-policy URLs reject protocol-relative values, preventing a configured policy path from resolving to another host.
• Redirect configuration rejects indirect cycles in addition to duplicate rules and self-redirects.

[1.0.2] — 2026-07-10

Added

• Commercial readiness contract (docs/COMMERCIAL-READINESS.md) covering source checks, all-on/all-off builds, preview commerce, accessibility, performance, technical SEO, monitoring, rollback, established-site migration, and buyer handoff evidence.
• Buyer-configured internal redirect map (site.redirects) for cutovers. It rejects external destinations, duplicate sources, and redirect loops.
• Opt-in Organization-level merchant return-policy JSON-LD. The markup remains absent until a store enters terms matching a public policy page.
• release:verify and release:verify:build commands for deterministic source validation and capability-state builds.

Changed

• PR CI now invokes release:verify, keeping its source-validation contract in lockstep with the documented release procedure.
• Runbook, update guide, README, and theme status documentation now distinguish source health from real-store launch evidence and accurately describe partial theme archetype fallbacks.

Changed

• LICENSE-COMMERCIAL.md is now the v1.0 Commercial License Agreement (previously a non-binding placeholder scaffold): tier grants (Single / All Access / Lifetime), client-work rights, perpetual-per-version expiry semantics, 30-day refund, warranty/liability terms, NSW (Australia) governing law.
• Documentation truth pass. FEATURES.md: Subscribe & save reworded as a Shopify selling-plans pass-through (no billing engine / subscriber portal); bundle & build-your-own-box pricing flagged display-only (checkout enforcement needs a Shopify automatic discount); one-click upsell marked standalone-Stripe-only; the PH pack no longer implies wired SMS/Messenger (email-only today). docs/THEMES.md status tables updated to reality — the 12 token presets and the four non-editorial archetype packages ship (as partials), and the superstore / drops profiles now exist.
• /theme-gallery is now buyer-facing — the internal "visual QA · mock data" framing is replaced with "Explore all 12 themes" showcase copy. Per-theme anchors and the demo-mode gate are unchanged.

Added

• docs/RUNBOOK.md — operational runbook: deploy model, environment matrix, the mode-driven auth seam, moderation commands, demo seeding, PH COD-ops, and the CI gate.
• Skip-to-content link (WCAG 2.4.1 Bypass Blocks) — visually hidden until keyboard focus, jumps to the <main id="main-content"> landmark. Covered by an axe e2e test.
• Global prefers-reduced-motion: reduce rule in globals.css that shortens transitions/animations (incl. the Radix Sheet/Dialog overlays) to near-instant — the Sheet/Dialog "respects reduced-motion" comments are now backed by real CSS.
• Non-blocking preview-smoke CI (.github/workflows/preview-e2e.yml): after a Vercel deployment succeeds, runs the @preview-tagged Playwright tests (public landing shell + Convex health check) against the deployed URL. The expected store title is now env-driven (E2E_STORE_NAME, defaulting to the dev store), so the same specs pass locally and against the demo deployment.

Fixed

• pnpm rebrand (scripts/setup.ts) now accepts every shipped profile — the --profile allow-list was hardcoded to dtc-consumables and rejected the other five. It now derives from PROFILE_NAMES / MARKET_NAMES in @appy-days/config so it can't drift.
• Public demo footer showed PH-specific payment badges (GCash/Maya/GrabPay/COD) from the ph market — replaced with neutral international badges (Visa/Mastercard/Amex/PayPal) in the demo overlay (site.config.demo.ts).

[1.0.1] — 2026-07-04

Fixed

• convex/ ESLint upgraded from the narrow error-swallow-guard config to full recommendedTypeChecked + @convex-dev/eslint-plugin's recommended rules, and a real types:check (tsc --noEmit) gate was added — the repo previously relied on ESLint alone, which is not a substitute for a real compiler check. No functional/runtime changes; internal type-safety only.

[1.0.0] — 2026-07-03

This repository is now the canonical development home of the storefront platform. All platform development, releases, and issue tracking happen here; consuming forks pull tagged releases per docs/UPDATING.md.

Added

• CI gate suite on every pull request and main push: install, lint, formatting, import boundaries, manifest drift, Convex service guard, typecheck, unit tests, and the coverage gate.
• Standing leak guard in CI: fail-closed content + filename sweep keeping upstream-vendor internals out of the repository.
• Branch protection on main: the gate suite is required before merge.

[0.9.0] — 2026-07-02

Pre-release baseline. The platform architecture is complete:

Added

• Config-driven storefront: one site.config.ts drives branding, feature toggles, and theme selection; every feature ships off by default.
• Two runtime modes behind one adapter seam: headless-shopify (Shopify Storefront API + hosted checkout) and standalone (Convex catalog/cart + Stripe checkout).
• Theme engine with slot-based composition and a 12-theme catalog (packages/themes/*), previewable via the demo-gated /theme-gallery route.
• Feature modules: reviews, wishlist, loyalty, referrals, upsells, bundles, popups, product showcase — each independently toggleable.
• Package architecture: @appy-days/{config,domain,adapters,ui,core,themes} plus per-feature packages under features/*.