{
  "name": "Manifold",
  "url": "https://manifold.mavenhandle.com",
  "generatedAt": "2026-08-21T20:14:03.371Z",
  "releases": [
    {
      "version": "Unreleased",
      "date": null,
      "sections": {
        "In flight": [
          "Slices C + D of STRATEGY Phase 7 (calendar overlay for draft",
          "UI walkthrough of the 2026-05-15 sprint still pending.",
          "**Input-sources \"populate handles\" workflow** — the dedicated Input",
          "**Publish-state on posts** — `Post.publishedTo` + `variants[net]`"
        ],
        "Recently completed — 2026-05-31 session": [
          "**Centralized OAuth apps** — new `SocialOAuthApp` table (one row per",
          "**In-panel OAuth flows** — LinkedIn, Pinterest, YouTube migrated to the",
          "**Publisher wiring** — `facebook.js`, `social/imgur.js`, `reddit.js`,",
          "**Waitlist feature flag** — `/panel/waitlist` \"Waitlist mode\" toggle backed"
        ],
        "Recently completed — 2026-05-30 session": [
          "**Dashboard redesign** — site hero (logo/name/URL), icon-driven",
          "**Setup wizard** — 4-step onboarding card on the dashboard (input",
          "**Current-campaign card** — running/approved (or latest draft)",
          "**Connection Test** (`POST /v1/panel/connections/:network/test`,",
          "**OAuth / Authorize** — Authorize buttons for LinkedIn + Pinterest",
          "**Input sources section** — dedicated panel on the site-settings page",
          "**Per-network credential help** — each settings section now has a",
          "**Sites: inactive + soft-delete** — shipped earlier (PR #9, merged) as",
          "**Panel sidebar footer pinned** — full-height sticky sidebar with"
        ],
        "Recently completed — 2026-05-26 session": [
          "**Phase 7 Slices A + B — Director as a real feature** (commit",
          "**Empty-body variant fix.** The runner now drafts each variant",
          "**URL sanitization with GCP Safe Browsing**",
          "**Build optimization** (commit `f872b94`). Dropped 20 unused deps"
        ],
        "Recently completed — 2026-05-15 sprint (commit `c60b598`)": [
          "**Smart presets per site.** Generator compose form hydrates from",
          "**Brand kit per site.** Per-site primary color, accent color, logo",
          "**Tone-and-intent dials.** Three 1-5 dials (formality, hook",
          "**Pre-publish lint pass.** New `helper/publishLint.js` with",
          "**RSS-driven generation.** New `helper/sources/rss.js` (RSS 2.0 +",
          "**Cmd-K command palette.** Global ⌘K in the panel layout. Static"
        ],
        "Recently completed — 2026-05-14 session (commit `c60b598`)": [
          "**LinkedIn publish — three-bug cascade fix.** Restored the missing",
          "**Per-site post title uniqueness.** `Post.title` is no longer",
          "**Per-network health pills on the generate page.** Each platform",
          "**Single-draft-per-site generator guard.** New `discardExistingDrafts`",
          "**Cross-site post-link recovery.** New",
          "**Source-link citation in generated drafts.** When the generator is",
          "**`TOKENS_DIR` absolute-path normalization.** `helper/token_paths.js`",
          "**JSON-aware error handler + 2 MB body limit.** `app-admin.js`"
        ],
        "Recently completed": [
          "**Generate-new-post page.** New `/panel/generator` route + view: one",
          "**Multi-pull-quote picker.** When the React-blog import returns",
          "**Legacy `helper/openai.js` removed.** Vestigial completions wrapper",
          "**429 `Retry-After` extended to every publisher.** LinkedIn, Pinterest,",
          "**React-blog source adapter.** `helper/sources/reactBlog.js scrape(url)`",
          "**Daily Neon backup tick.** `app-scheduler.js backupTick()` shells out",
          "**`scripts/rotate-credential-key.js` + `npm run db:rotate-cred-key`.**",
          "**Calendar top performer + suggested-time pre-fill.** `routes/calendar.js`",
          "**429 `Retry-After` queueing.** New `helper/rateLimitError.js` with",
          "**SiteSetting encryption at rest.** New `helper/cryptoSetting.js`",
          "**Pull-quote one-click seed.** \"Seed from pull quote\" button per",
          "**STRATEGY Phase 5 — Facebook Reels.** `helper/facebook.js publishReel(post)`",
          "**STRATEGY Phase 6 — Pinterest analytics.** `helper/pinterest.js fetchMetrics(pinId)`",
          "**Per-user timezones.** New `User.timezone` column (default `UTC`);",
          "**Quote-card photo blends.** `helper/quote_card.js renderQuoteCard()`",
          "**STRATEGY Phase 4.2 — AI variant drafts.** `helper/aiDrafts.js`",
          "**STRATEGY Phase 5 — Reddit publisher.** `helper/reddit.js publish(post)`",
          "**STRATEGY Phase 5 — X threads.** `helper/twitter.js publishThread(post)`",
          "**STRATEGY Phase 6 — Engagement metrics.** `helper/metrics.js`",
          "**`routes/index.js` env-loader refactor.** 197 → 61 lines. The 130-line",
          "**Hardcoded secrets moved to env.** `helper/openai.js`",
          "**Mongo → Neon (Postgres) migration — Phase 4 closed.** Mongoose"
        ],
        "Planned": [
          "Multi-pull-quote picker UI in the variant editor (data now flows via",
          "Long-term archive of `/data/backups` to off-Fly storage (R2/S3).",
          "Flip CSP from Report-Only to enforcing once violation reports settle.",
          "Encrypt `SiteSetting.*` credential blobs at rest (NEON-MIGRATION Phase 5)."
        ],
        "Added": [
          "**Public marketing routes** — `/blog` (placeholder), `/colophon`",
          "**Feeds + machine-readable surfaces** — `/changelog.atom` (Atom 1.0",
          "**Discovery files** — `/.well-known/security.txt` (RFC 9116, with",
          "**URL redirects** — `/admin`, `/admin/`, `/login`, `/signin`, `/dashboard`",
          "**Panel dashboard** — first-time empty state with three setup-step",
          "**Maintenance mode** — env-flag-controlled middleware (`MAINTENANCE=1`)",
          "**Rate limiting** — sliding-window IP-based limiter (zero npm dep)",
          "**CSP report-only header + `/csp-report`** sink — collects browser",
          "**Marketing footer chips** — live version chip (links to `/changelog`)",
          "**Bootstrap-compat shim** — `public/css/panel-compat.css` covers every",
          "**Inline-SVG icon mixin** — `views/_icons.pug` with 9 lucide-style",
          "**Brand assets** — `logo-on-dark.svg`, `logo-mark.svg`, OG image",
          "**A11y + UX polish** — skip-to-content link, `<noscript>` fallback,",
          "**AI scraper opt-out** — `robots.txt` blocks 13 LLM training bots",
          "**Operational scripts** — `scripts/backup-neon.sh` (pg_dump + retention",
          "**Custom error pages** — `views/marketing/404.pug`, `marketing/error.pug`",
          "**Docs** — `RELEASING.md` (cut-a-release workflow), `OPENGRAPH-AUDIT.md`",
          "**.editorconfig + .nvmrc** — project formatting baseline + Node 20 pin."
        ],
        "Changed": [
          "**Static asset Cache-Control** — removed broken `no-store` blanket",
          "**Log format** — `morgan('dev')` locally, `morgan('combined')` in",
          "**Sentry** — auto-imported as first line in all 5 batch entrypoints",
          "**Login page** — full brand rewrite (split card, indigo focus, amber",
          "**Panel sidebar logo** — now uses `logo-on-dark.svg` (proper palette",
          "**JSON-LD** — expanded from single `SoftwareApplication` to `@graph`",
          "**Marketing nav + footer** — added Blog + Changelog + Colophon links;",
          "**Sitemap** — now lists all 9 indexable marketing pages with",
          "**robots.txt** — explicit `Allow: /images/og-image.png`, disallow",
          "**`X-Robots-Tag` header** — defense-in-depth `noindex, nofollow, noarchive`",
          "**Trust proxy** — `app.set('trust proxy', 1)` so `req.ip` reflects the",
          "**404 + error handler** — picks `marketing/404` for public surface,"
        ],
        "Removed": [
          "**Bootstrap 4.5.2 CSS CDN** — replaced by `panel-compat.css`.",
          "**Bootstrap Icons CDN** — replaced by inline-SVG icon mixin.",
          "**Duplicate static-asset middleware** that was setting `Cache-Control: no-store`",
          "**`X-Powered-By: Express`** response header."
        ],
        "Security": [
          "HSTS in production (180 days, `includeSubDomains`).",
          "CSP Report-Only baseline (collects violations for later enforcement).",
          "COOP, CORP, Origin-Agent-Cluster, Permissions-Policy, X-DNS-Prefetch-Control.",
          "Rate limits on auth + publish endpoints.",
          "`security.txt` discovery file (RFC 9116).",
          "AI training-bot opt-out via robots.txt (toggleable)."
        ],
        "Performance": [
          "Static-asset caching now actually works (broken `no-store` policy fixed).",
          "`decoding=\"async\"` on every `<img>`; `fetchpriority=\"high\"` on the",
          "Two external CDN dependencies removed (~250 KB + DNS roundtrips).",
          "Width/height attrs on all images prevent layout shift."
        ],
        "Accessibility": [
          "Skip-to-content link as first focusable element on marketing layout.",
          "`prefers-reduced-motion: reduce` kills all transitions/animations.",
          "`:focus-visible` rings on every interactive element; no double-rings on inputs.",
          "ARIA-hidden icons paired with text labels.",
          "`<noscript>` fallback banner with reassuring copy."
        ]
      }
    },
    {
      "version": "0.1.0",
      "date": "2026-05-11",
      "sections": {
        "Added": [
          "Brand identity — logo (mark + wordmark), favicon, PWA icons, OG preview image",
          "Marketing site (SSR Pug) — `/`, `/features`, `/pricing`, `/about`,",
          "SEO infrastructure — sitemap.xml, robots.txt, humans.txt, JSON-LD",
          "Health probes — `/healthz` (liveness), `/readyz` (DB-dependent readiness)",
          "Security headers middleware — X-Frame-Options, X-Content-Type-Options,",
          "PWA manifest + apple-touch-icon — panel is installable to home screen",
          "Sentry wired into all batch script entrypoints (closes RUNBOOK §7 follow-up)",
          "GitHub Actions CI — pug compile, JS syntax, prisma validate, advisory npm audit",
          "Open-source paperwork — `LICENSE` (Apache 2.0), `CONTRIBUTING.md`,",
          "Mongo → Neon migration scaffolding — Prisma schema, initial migration,"
        ],
        "Changed": [
          "Product name \"Trends\" → \"Manifold\" everywhere it's a product reference",
          "Fly.io app slug `trends` → `manifold`",
          "Fly volume `trends_data` → `manifold_data`",
          "MongoDB database `trendsdb` → `manifolddb`",
          "MongoDB user `trendsadmin` → `manifoldadmin`",
          "Cloudflare R2 bucket reference `trends-media` → `manifold-media`",
          "Docker user/group `trends` → `manifold`",
          "Panel layout — adopts Manifold brand colors (indigo + amber), favicon, theme-color",
          "Error pages — branded 404 + 5xx with separate panel / marketing variants",
          "Fly healthcheck path — `/panel/login` → `/healthz`"
        ],
        "Removed": [
          "Default test credentials pre-filled on the login form"
        ],
        "Security": [
          "Removed `X-Powered-By: Express` from all responses",
          "Added HSTS for production responses",
          "Hardened default Permissions-Policy"
        ],
        "Migration notes": [
          "If you have an existing `trendsdb` MongoDB database, run",
          "If you had an existing Fly app called `trends`, follow the 9-step"
        ]
      }
    },
    {
      "version": "0.0.1",
      "date": "2024-2025",
      "sections": {}
    }
  ]
}