Changelog

1 copies

در حال توسعهCurrent version

New: Reference designs preserved with SHA-256 hashes (design/reference/) and offline decoder (scripts/decode-reference.py).

New: Screen inventories, traceability matrices and baseline screenshots for the reference designs.

New: Architecture overview, ADRs 0001–0012, assumptions register, progress tracking (progress/).

New: API skeleton (Slim 4, PHP-DI, hexagonal module layout), Docker Compose stack, migrations runner, health/readiness endpoints, one-command bootstrap.

New: Identity & devices: OTP/password login, recovery, roles/permissions with escalation guards, 3-device limit, refresh rotation, TV pairing.

New: Catalog (books, people, publishers, tags, reviews, Persian search), Content storage/uploads, Commerce (cart, orders, payments, entitlements, refunds), Wallet, discounts.

New: Authoring (projects, chapters, revisions, conflict copies), Editorial (suggestions, comments, assignments), Reader + Annotations sync, Royalties ledger, transactional outbox dispatcher and scheduler.

New: Go job engine (durable jobs, leases, SSRF-safe downloads), reader-core, design-tokens, typed API client.

New: Publishing: layout settings, real exports through the document engine (EPUB3, DOCX, HTML, Markdown verified end-to-end 2026-10-13; PDF print/digital fixing — see Fixed), cover designer with server-rendered front PNG and print wrap PDF at exact mm (spine from print profile), ISBN EAN-13 barcode.

New: Audio: shows/seasons/episodes, studio upload, review, FFmpeg (LGPL build) probe/transcode via the worker, ranged streaming, listening progress.

New: Articles, reader summaries, publication state machine with scheduling and review exceptions.

New: Reader: grounded book assistant with per-attempt usage records, dictionary, offline PWA, sync of progress/annotations with tombstones and conflicts.

New: Account privacy: personal-data export and account deletion for users and admins (financial records retained); role requests (author/translator/publisher) with permission-checked approval.

New: Shipping methods from settings, native payment return to the app (barg://payment/return).

New: Android app 0.1.0 (Capacitor): reference screens, secure tokens, native background audio, resumable checksummed downloads, offline reading, payment return; iOS purchase-surface policy (apps.ios_purchase_mode, default reader-app mode) — iOS shell and Swift plugin written, not built (no Xcode).

New: Android TV app 0.3.0 (Compose for TV, Media3): pairing, rails, search, reader, player, remote-only navigation.

New: Phase 14 contract for fixed-layout PDF reading (packages/contracts/jobs/pdf-derivatives.md, reader /pdf and /text-layer).

New: Worker 0.28.1-dev: pdf_derivatives jobs (Phase 14) — merged, validated text layer (text_layer, OCR pages listed) and a page-limited sample PDF (pdf_sample) per PDF source, each retryable on its own; advertised only when the tools runner reports the pdf_sample and text_layer features (document-tools 1.0.1 /healthz features).

New: API: fixed-layout PDF reading (Phase 14, server). Admin registers a book's catalog PDF as its reading edition (/admin/catalog/books/{id}/pdf, sample range, derivative status, targeted retry; catalog.manage). The server requests a pdf_derivatives job (sample PDF that physically contains only the sample pages + text layer) and imports the results (content:sync-pdf-derivatives, every 30 s); without the worker capability the request waits as awaiting_engine. Reader: manifest documents[].pdf, /documents/{docId}/pdf (original only for full access, sample otherwise; Range via nginx), /text-layer (only readable pages, original numbering), PDF positions validated against page count/sample range/page size; /content answers 409 fixed_layout_document for PDFs. Migration 0037_content_pdf_derivatives. Dev seed: three PDF books.

New: Web reader: fixed-layout PDF reading (Phase 14, client). pdf.js 6.4.299 (Apache-2.0, local bundled worker) behind reader-core PdfJsAdapter/PdfView: page/spread and scroll modes, zoom and fit-page/fit-width, lazy rendering for long PDFs, TOC from the PDF outline, search over the server text layer with Persian normalisation (honest «جست‌وجو برای این PDF در دسترس نیست.» without one), highlights/notes/bookmarks and progress stored as kind=pdf positions with original page numbers (sample PDFs mapped through the page offset), sample-end gate with the free page range, E-ink presentation, font-size controls disabled with an explanation; offline downloads store PDFs from /pdf + /text-layer. Bilingual modes («ترج�

New: Operations: scripts/ops/backup.sh / restore.sh with file-hash verification (rehearsed in an isolated project), docs/operations/recovery.md.

New: Contract gate scripts/check-contract-routes.mjs (implemented routes ⇔ OpenAPI) in scripts/ci.sh; generated docs/knowledge/database-model.md.

New: Google sign-in («ادا�

New: Search overlay shows the reference «�

New: Website profile: reference «کتابخانه» and «هایلایت‌ها و یادداشت‌ها» tabs (GET /me/annotations), PWA install banner, book cover wrap (front/spine/back) from the confirmed print profile only.

New: Articles: «�

New: Dev seeds articles:seed-dev (reference articles a1–a6) and commerce:seed-dev (BARG10, MEHR50, POSTFREE); both refused in production.

New: Audio studio «استودیو» at /app/studio (it was linked from the audio page but did not exist): my shows, new show (type, colour, tags), recording in the browser (MediaRecorder) or uploading a file, draft / «انتشار» / «فرستادن برای تأیید» per server policy, seasons, episode states with reject reason. GET /studio/shows now returns the studio policy; public GET /catalog/tags; WebM/Opus recordings accepted as audio_source (worker-transcoded).

New: Dev seed summaries:seed-dev (reference summaries s1–s3).

Fixes: Book panel «خواندن ن�

Fixes: Workspace links: «داشبورد» (/dashboard 404, /app/dashboard not found → /app/desk/dashboard, migration 0064 fixes the seeded menu), profile (/profile → /account), refund policy (/legal/refunds → /legal/refund).

Fixes: Icon ligature text (e.g. "edit_document") no longer leaks into screen-reader names: icon spans are aria-hidden across the site and workspace.

Fixes: Download-all ZIP: export files carry their real extensions (pdf_print.pdf, epub3.epub, …) — worker 0.28.3-dev.

Fixes: Imported books keep their figures (copied into Content; export works); ingestion picked up every 3 s instead of 15 s.

Fixes: Public site in English (reference UI dictionary, LTR) under /en/, language switcher in the footer driven by admin «زبان‌ها»; hreflang alternates on every page.

Security: Fixed audit findings SEC-01 (contributor profile hijack via same-name publication), SEC-02/05 (CSP and frame protection for apps and private files), SEC-04 (document tools see only job scratch), SEC-06 (staging no longer allows demo switches by default), SEC-07 (trusted proxies), SEC-08 (no admin action on more-privileged users), SEC-09, SEC-10 (password change signs out other devices; step-up OTP), SEC-11 (OTP/SMS caps), SEC-12 (404 for others' orders), SEC-13 (no row locks during gateway verify), SEC-14 (four-eyes payouts), SEC-15, SEC-16 (license inventory), SEC-03 (worker provider egress guard: no internal/metadata destinations, no redirects, no env proxies; worker 0.28.2-dev).

Security: TV 0.3.1: focus scrolling keeps the reference page padding and late-loading rows; toast above dialogs.

Security: Admin publication queue reader showed a placeholder and crashed on open; it now shows the exact submitted text.

Security: Worker 0.28.2-dev (SEC-03): AI provider calls, model discovery and connection tests now go through an SSRF egress guard. It blocks loopback, private, CGNAT, ULA, link-local and metadata addresses, checking at dial and connect time so DNS rebinding cannot bypass it. Redirects are not followed and environment proxies are ignored. PROVIDER_ALLOW_PRIVATE_HOSTS is an explicit operator allowlist (default empty) and PROVIDER_EGRESS_PROXY an optional explicit proxy. Blocked calls fail permanently with egress_blocked and never echo addresses or bodies.

Security: Five implemented API routes (data export/deletion, system health) were missing from the OpenAPI contract.

Security: /reader/books/{slug}/assets/{id} was documented but not registered, so book figures returned 404. The route now serves raster figures of a delivered document version (sample readers only get figures of sample chapters, ETag/304), published versions keep their figure assets referenced, and the dev seed stores the reference figure as a real Content image (the reference SVG fig-1 is never accepted) with a new document version for already seeded books.

Security: Document-tools 1.0.2: body fonts literata (Literata 3.103) and source_serif_4 (Source Serif 4 4.005R) are installed (OFL-1.1 static TTFs from the official releases, sha256-verified in the image, licenses shipped), so PDF exports with these layout fonts no longer fail with font_unavailable; Persian text in such books falls back to Vazirmatn because both fonts are Latin-only.

Security: Worker 0.28.1-dev / document-tools 1.0.1: Persian PDF exports (pdf_print, pdf_digital) failed profile confirmation. font: Publishing's snake_case body-font ids (noto_naskh_arabic, vazirmatn) were not resolved, so the PDF silently used Vazirmatn; they now resolve (plus amiri; literata/source_serif_4 are not installed and still fail truthfully). margins: a WeasyPrint 70.0 defect painted the first line of justified RTL paragraphs one space width into the margin when the line ended before an inline element (Latin run, bold); fixed by a version-gated renderer patch, the margin check is unchanged. Failed artifacts now keep the renderer's warnings and diagnostics (warnings, tool.render_profile.missing_features); retrying clears them. Cover wrap PDF now carries verified TrimBox/BleedBox (trim_box in applied).

Security: Mobile: preferences/player queue written right before a force-stop were lost; now also persisted to app-private files.