Changelog
Changelog
Cambios relevantes en CastorStack.
CastorStack 1.20.0
- Admin → Settings now edits the MCP allowed origins, stored in a new `runtime_settings` table, so changing them no longer needs a redeploy; `MCP_ALLOWED_ORIGINS` and the built-in defaults remain the fallback.
- The web-app sign-in forgets the remembered email as soon as "remember me" is unchecked, instead of only on submit.
- Git worktrees link the main checkout's `node_modules` instead of crashing the pre-commit and pre-push hooks.
- The repo pins Node 20 (`engines` and `.nvmrc`) to match CI and stop a resolver failure on newer local Node versions.
CastorStack 1.19.1
- The Meta Pixel now loads: `connect.facebook.net` was missing from `script-src` in both frontends' `vercel.json`, so the browser's Content Security Policy blocked `fbevents.js` on every deployment and no client-side event ever reached Meta.
- Page traffic is now measured as `PageView` on each route instead of a single `ViewContent` on mount: the layout mounts once, so client-side navigation went uncounted and a whole visit reported one event.
- The Meta Pixel now waits for the same cookie-banner acceptance Google Analytics already required, instead of loading as soon as an admin had the provider active.
CastorStack 1.19.0
- Admin → AI provider connections: global admins store an encrypted OpenAI or OpenRouter API key, pick catalog models per connection, and promote one connection as the default for text and one for image generation; backend code calls a single `IAiGateway` instead of talking to any provider directly.
- Admin → Integrations → WhatsApp: a global support number and per-screen visibility now drive a dismissible `wa.me` widget shown to customers whose plan grants the `priority_support` feature.
- Admin → Integrations → Meta Pixel: an opt-in Meta Pixel + Conversions API connection fires `ViewContent`/`InitiateCheckout`/`CompleteRegistration` client-side and a server-side `Purchase` event via the Conversions API, deduplicated against the existing webhook processing guard.
- Signup now captures `fbclid`/`fbc`/`fbp` alongside the existing UTM/referrer attribution fields, fixing a bug where a later ad click's `fbclid` updated in memory but never persisted back to storage.
CastorStack 1.18.0
- Added remote MCP servers so ChatGPT and Claude can connect over authenticated HTTP using a client key created in Admin > Integrations > MCP, scoped and revocable without touching infra.
- `mcp-actions` gained typed list/get/create/update/remove blog tools; create and update take `SaveBlogPostRequest` fields, and `status` published writes to the database, triggers revalidation, and appears on the public API (draft does not).
- The remote MCP transport authenticates every request with the caller's own client key end to end; there is no separate server-only key to deploy or rotate.
- Saving a blog post through the admin API now treats `status` as case-insensitive (`published` and `Published` both publish).
CastorStack 1.17.0
- Added remote MCP servers (`mcp.castorstack.com`, `mcp-actions.castorstack.com`) so ChatGPT and Claude can connect over authenticated HTTP using a client key created in Admin > Integrations > MCP, scoped and revocable without touching infra.
- `mcp-actions` gained typed list/get/create/update/remove blog tools; create and update take `SaveBlogPostRequest` fields, and `status` published writes to the database, triggers revalidation, and appears on the public API (draft does not).
- Saving a blog post through the admin API now treats `status` as case-insensitive (`published` and `Published` both publish).
- The admin dashboard gate probes `GET /api/v1/admin/roles` (status-only) instead of listing payment providers, starts the profile fetch in parallel, and aborts the probe after 15s so a hung request shows retry instead of `ui.loading.stuck`.
CastorStack 1.16.2
- Fixed a bug where a Supabase storage folder's path was missing its trailing separator, breaking navigation into any folder more than one level deep in the admin Storage Explorer.
CastorStack 1.16.1
- The app switcher's "Web App" link now carries first-touch UTM attribution into the web app, so a signup started from the switcher (instead of a marketing page's signup button) is no longer misattributed as direct traffic.
CastorStack 1.16.0
- Signups capture their first-touch UTM parameters, referrer and landing page, shown per-user in the admin panel and aggregated on a new Analytics page (signups by day and source).
- Product coupon discounts are created automatically on Stripe or Paddle from the admin panel instead of requiring a pasted provider discount id.
- The dashboard home page gained a product extension slot, alongside the four existing account-page slots.
- Unknown routes on the admin panel and web app now return an actual HTTP 404 status with a branded, localized page instead of a 200.
CastorStack 1.15.0
- The four core account pages (Settings, Product access, Features, Support) render a product-owned extension slot, so a product adds its own section without editing a core page.
- The template's demo home page, marketing sections and example billing page moved out of the product seam, leaving it free for the product's own files.
- Installing dependencies now registers the git merge driver that keeps product-owned and generated files from conflicting on every upstream update.
- A product can be marked as accepting discount coupons directly on the admin product form.
CastorStack 1.14.1
- Fixed uploads failing on an install whose storage is configured by environment variables and has no saved connection yet.
CastorStack 1.14.0
- New Storage browser in the admin panel: navigate the bucket by folder, with image preview through short-lived signed URLs.
- Every stored file now carries an owner and a purpose, so the panel shows who a file belongs to and what it is for.
- The listing separates files that are registered, orphan, or missing, so a file deleted outside the panel stops being invisible.
- Upload, replace, rename and delete files from the panel. Deleting a file that is still in use is refused and lists what depends on it.
CastorStack 1.13.0
- Hero section on the marketing home now plays a short intro video.
- Preview section shows real product screenshots instead of placeholders.
- Download page has clearer, more premium post-download instructions.
- AppSwitcher links out to pricing so users can upgrade from any app.
CastorStack 1.12.2
- The license note component and its test no longer ship: 1.12.1 removed the note from the pages but left the files behind, and the test asserted against message keys that release had deleted.
CastorStack 1.12.1
- The license note below the pricing card is gone from the home page and from /pricing; the license page stays reachable from the footer.
CastorStack 1.12.0
- Plan features are edited per locale in the admin and served localized in the public catalog and pricing card.
- The marketing purchase section is rebuilt around license, price, inclusions, and guarantee.
- Home page anchors land on the right position, with reveal animations on scroll.
- A failed download now shows a readable message instead of a raw error.
CastorStack 1.11.0
- Account page consolidates profile, password, and billing controls, with password re-authentication before sensitive changes.
- Feature visibility and destinations are configurable per plan, with an upcoming-bills view on the dashboard.
- Product webhook events, buyer ZIP release packaging, and shared app links across the frontends.
- Marketing site gains a credibility/proof section, an about page, and refreshed home and pricing copy.
CastorStack 1.10.0
- Admin can edit runtime product links, auth email templates, and user or subscription records.
- Marketing pricing localizes through Paddle PricePreview.
- Env manifest drives `.env.example`, with `env:doctor` and `env:push`.
- Tag push builds the buyer ZIP and syncs the public changelog.
CastorStack 1.9.2
- Blog index stays statically generated when the API is unreachable.
- E2E pipeline retries transient MSBuild build failures.
CastorStack 1.9.1
- Parallel refresh no longer reuses a rotated refresh token.
- Pricing and features JSON documented as bootstrap seed only.
- CI retries transient MSBuild failures.
CastorStack 1.9.0
- Admin-granted profile feature overrides.
- Extensible payment-provider seam for product modules.
- Profile resolution middleware caching and closed PSP code registry.
CastorStack 1.8.0
- Google OAuth login with admin FAQ for non-config behaviors.
- PSPs without an optional public key no longer appear pending.
- Dev preview domains stay mapped on every main deploy.
CastorStack 1.7.2
- Polar added as a merchant-of-record payment provider.
- PWA manifest generated from branding config.
- SECURITY.md published; unknown web-app routes show 404.
CastorStack 1.7.1
- Bootstrap tests copy shared config schema into fixtures.
- Webhooks return 200 for events not targeting this installation.
CastorStack 1.7.0
- One-time (lifetime) plan billing support.
- Transactional auth emails sent via the API and GoTrue Send Email Hook.
- Google OAuth login and CastorStack README/agent docs rebrand.
CastorStack 1.6.2
- Marketing locale tests derive routing expectations from config.
CastorStack 1.6.1
- No functional changes; corrects a mistagged 1.6.0 core cut.
CastorStack 1.6.0
- Auth email template preview per locale in the admin panel.
- Template seed data uses neutral identity; locales follow product config.
- Core release re-mirrors `.env.example` after freezing product config.
CastorStack 1.5.2
- Deploy checks validate the domain the deployment actually serves.
CastorStack 1.5.1
- Admin assets page tests use fixtures instead of template branding.
CastorStack 1.5.0
- Admin Project Assets library for versioned brand files.
- API HTTP edge hardening: rate limiting, Swagger, and health checks.
- Additional admin MCP tools for previously uncovered writes.
CastorStack 1.4.0
- Supabase storage write path with shared endpoint resolution.
- Core release merge no longer blocked by the comment guard.
CastorStack 1.3.0
- Theme, typography, and navigation customizable via config files.
- Admin MCP covers write operations across the admin surface.
- Shared loading screen and ref-aware CI deploy targets.
CastorStack 1.2.0
- Self-hosted Supabase path with GoTrue and S3-compatible storage.
- Admin MCP setup page with API key generation.
- Security headers standardized across the three frontends.
CastorStack 1.0.0
- Profile-scoped authentication, authorization, subscriptions, entitlements, API keys, and audit logs.
- Explicit reusable-core and product-owned boundaries across the API and all three frontends.
- Independent `AppDbContext` and `ProductDbContext` migration histories.
- The removable Upcoming Bills instructional product example with profile-owned persistence, RLS, API endpoints, localized UI, and tests.
Internationalized frontends
- Locale routing and translation files across marketing site, web app and admin panel.
Multi-provider billing
- Stripe and Paddle integrated end to end: country-to-provider routing, signed webhooks and entitlements, configured from the admin panel.
Initial foundation
- Monorepo with three frontends, .NET API, auth, tests and CI/CD structure.