HalfQR
Generate QR

What changed in HalfQR, release by release.

HalfQR is halway to open-source - closed collaboration due to the monorepo nature, please contact me via my portfolio site for collaboration. Every API and web builder release is grouped by breaking.major.minor, with patch builds folded into each line.

Subscribe via RSSContact: Paul Namalomba
Latest line
v0.4.1
Version lines
15
Builds shipped
24

  1. HalfQR 0.4.1

    Diff BaselineSystem Architecture Maps & Visual Specifications (system-architecture-maps.md)Documentation Cross-Reference & Link Integrity RectificationCode Files Touched

    0.4.1.1

    Diff Baseline

    • Previous documented version and release tag: 0.4.1.0 (commit 586ad85).
    • Release scope commands: git diff 0.4.1.0 -- . ':(exclude).commits/**' and git status --short.
    • Effective runtime scope: 4 modified tracked documentation and architectural specification files (README.md, docs/README.md, system-architecture.md, system-imbroglio.md) and 2 newly created files (LICENSE, system-architecture-maps.md), encompassing +662 insertions and -12 deletions (+76 tracked line insertions, -12 tracked line deletions, and 586 lines across untracked assets).
    • Version progression: 0.4.1.0 -> 0.4.1.1 under HalfQR fast sequence versioning.

    System Architecture Maps & Visual Specifications (system-architecture-maps.md)

    • Authored comprehensive architectural maps document in system-architecture-maps.md containing four verified, standards-compliant Mermaid diagrams modeled after Pretty-mermaid-skills architectural patterns, complete with exhaustive state dictionaries, boundary directories, flow validation matrices, and schema domain definitions:
    • Mapped the reactive state engine implemented in webapp/src/components/qr-builder.tsx from initial form mount through background polling and artifact export.
    • Modeled state nodes: Idle (pre-populated builder defaults: Link type, #000000/#FFFFFF, ECC H, 1024px, Square finder, Linear gradient), Validating (client-side syntax checks on target URLs, phone digits, and file byte ceilings), InvalidConfig (form validation failure disabling generation triggers), LocalPreview (instant client-side SVG placeholder generated synchronously via qrcode-generator in webapp preview stage), DraftSyncing (debounced 450 ms server synchronization requesting POST /api/v1/qr/render/draft via Next.js route proxy /api/halfqr/*), DraftReady (authoritative server-rendered SVG markup and SHA-256 payload/configuration hashes returned), DraftFailed (graceful fallback retaining local SVG preview with warning indicator on draft network failure), Submitting (authoritative render submission dispatching POST /api/v1/qr/render), SubmissionRejected (400 validation error or 429 rate limit quota exhaustion), PollingJob composite state, ArtifactsReady (generation completion enabling high-res downloads), Downloading, and JobFailed (terminal failure exposing failureReason diagnostics).
    • Modeled PollingJob composite sub-states: Queued (enqueued in RabbitMQ message broker), Running (worker actively processing matrix encoding, SVG composition, and SkiaSharp rasterization), PollRetrying (transient network backoff applying 3,000 ms backoff retry before continuing active poll loop), Failed, and Completed.
    • Documented explicit state transition triggers, debounce durations (450 ms), status polling intervals (1,500 ms), and error backoffs (3,000 ms).
    • Formulated a detailed State Dictionary & Transition Rules matrix specifying ingress triggers, execution behaviors, and exit criteria across all 12 operational builder states.
    • Formalized multi-tier containerized topology across physical network boundaries, ingress routing, microservice containers, message brokers, and polyglot persistence stores:
    • Clients and Entrypoints: Webapp Browser (Next.js 15 / React 19 SPA), Admin Console (Next.js App Router internal console), HalfQR CLI (HalfQR.Cli .NET 10 console runner), and External API Consumers.
    • Ingress and Edge Routing: Edge Proxy / Public Tunnels (www.halfqr.com:5173, api.halfqr.com:8083, and admin.halfqr.com) and Next.js Route Handlers (/api/halfqr/*, /api/auth/*, /api/account/*).
    • ASP.NET Core Microservices: HalfQR.PublicApi (REST facade, rate limiting, OpenAPI generation, RabbitMQ dispatch), HalfQR.QrEngine (QRCoder SvgQRCode matrix generation, custom SVG finder overlays, SVG sanitization, and SkiaSharp rasterization), HalfQR.Identity (JWT access tokens, refresh token rotation, Google OAuth 2.0 PKCE, and API keys), HalfQR.Redirector (high-throughput dynamic URL resolution at /r/{slug} and scan event tracking), HalfQR.Billing (PayChangu mobile money integration, plan catalog, checkout sessions, and webhook processing), and HalfQR.Worker (background queue consumer, multi-size PNG generation, and R2 asset storage).
    • Message Broker: RabbitMQ message broker running topic exchange halfqr.events routing into queues qr.render.requested and qr.batch.requested.
    • Persistence and Caching: PostgreSQL multi-schema database (schemas: auth, qr, analytics, billing), Redis distributed cache (rate limit buckets, short-lived preview cache, session storage), and Cloudflare R2 / FileSystem object storage (canonical SVGs and multi-size raster PNGs).
    • Provided an exhaustive Service & Boundary Directory table defining service responsibilities, layer boundaries, and associated persistence backends.
    • Mapped the end-to-end data lifecycle across 10 participants (User/Browser, Webapp Client, Next.js API Proxy, HalfQR.PublicApi, Redis Cache, HalfQR.QrEngine, RabbitMQ, HalfQR.Worker, PostgreSQL DB, and Cloudflare R2 Storage) through four chronological phases:
    • Phase 1: Real-time Draft & Local Preview: Instant client-side validation, qrcode-generator local SVG synthesis, and debounced (450 ms) background draft synchronization fetching authoritative server SVG markup and configuration hashes.
    • Phase 2: Authoritative Render Job Submission: Ingress gatekeeping enforcing sliding-window IP/credential rate-limiting in Redis (returning 429 Too Many Requests upon quota exhaustion); strict URL protocol whitelisting (http/https) and SSRF defense (blocking 127.0.0.1, private RFC-1918 subnets, and cloud metadata 169.254.169.254); SVG logo sanitization stripping <script>, <foreignObject>, inline onload/onerror handlers, and XML entity (XXE) declarations; payload limit clamping (max 512 KB logo, 2,048-char URLs, 16 payload entries); SHA-256 cryptographic hashing (config_hash, payload_hash); initial job state persistence (status: 'Queued') in PostgreSQL; event publication (qr.render.requested) to RabbitMQ; and immediate HTTP 202 Accepted response returning jobId and statusUrl.
    • Phase 3: Background Worker Execution: Asynchronous job pickup by HalfQR.Worker from RabbitMQ; job status transition to 'Running'; matrix generation via QRCoder defaulting to ECC 'H'; custom SVG finder marker overlay composition for border and center shapes (Square, Rounded, Circle) over the three 7x7 corner windows; center logo clearing and SVG embedding; SkiaSharp PNG multi-resolution rasterization (1024, 2048, 4096 px); artifact upload to Cloudflare R2 / FileSystem; job status transition to 'Completed' in PostgreSQL with artifact descriptors; and publishing qr.render.completed domain event.
    • Phase 4: Status Polling & Artifact Delivery: Webapp polling loop querying GET /api/v1/qr/jobs/{jobId} every 1,500 ms until terminal state; presentation of completion stage; user download trigger; and streaming binary artifact stream (GET /api/v1/qr/jobs/{jobId}/artifacts/png) directly to browser.
    • Documented a Security & Validation Checklist specifying component execution boundaries and security rationales.
    • Designed a comprehensive relational entity model for PostgreSQL partitioned across four core domain schemas:
    • auth schema: USERS (id PK, email UK, password_hash, role, status, created_at, updated_at), OAUTH_IDENTITIES (id PK, user_id FK, provider, provider_user_id UK, email, created_at), REFRESH_TOKENS (id PK, user_id FK, token_hash UK, expires_at, revoked, created_at), API_KEYS (id PK, user_id FK, key_prefix, key_hash UK, label, expires_at, revoked, created_at).
    • qr schema: RENDER_REQUESTS (id PK, user_id FK nullable, content_type, render_mode, target_url, config_hash, payload_hash, ecc_level, status, failure_reason, created_at, completed_at), QR_ASSETS (id PK, render_request_id FK, format, storage_provider, storage_path, file_size_bytes, width_px, height_px, created_at), DYNAMIC_ROUTES (id PK, user_id FK, slug UK, encrypted_destination_url, is_active, created_at, updated_at), QR_TAGS (id PK, render_request_id FK, tag_name).
    • analytics schema: SCAN_EVENTS (id PK, dynamic_route_id FK, scanned_at, ip_hash, user_agent, referer, coarse_country, coarse_city, device_type), GENERATION_EVENTS (id PK, user_id FK nullable, content_type, render_mode, ecc_level, config_hash, created_at), DAILY_ROLLUPS (id PK, dynamic_route_id FK, rollup_date, scan_count, unique_ip_count, generation_count).
    • billing schema: PLANS (id PK, code UK, name, price_cents, currency, max_dynamic_qr, max_batch_size, analytics_retention_days, high_res_allowed), CUSTOMERS (id PK, user_id FK UK, payment_provider, provider_customer_id UK, billing_email, created_at), SUBSCRIPTIONS (id PK, customer_id FK, plan_id FK, status, current_period_start, current_period_end, cancel_at_period_end), INVOICES (id PK, subscription_id FK, invoice_number UK, amount_cents, currency, status, invoice_url, created_at), PAYMENT_EVENTS (id PK, customer_id FK, provider_event_id UK, event_type, payload_json, processed_at).
    • Defined strict entity cardinalities (one-to-many, one-to-one, zero-or-more), typed SQL attributes, and primary/foreign/unique constraints.
    • Formulated a Schema Domain Breakdown describing data isolation, retention policies, and privacy guarantees.

    Documentation Cross-Reference & Link Integrity Rectification

    • Root README.md:
    • Corrected invalid casing in operator link [QUICK_REFERENCE.md](QUICK_REFERENCE.md) to [quick-reference.md](quick-reference.md).
    • Updated Monorepo Layout ASCII directory tree to reflect lowercase normalized files: quick-reference.md, system-architecture.md, and new system-architecture-maps.md, while removing obsolete inspiration/ directory reference.
    • Corrected invalid [SYSTEM_ARCHITECTURE.md](SYSTEM_ARCHITECTURE.md) link in Quick Navigation to [system-architecture.md](system-architecture.md).
    • Expanded Quick Navigation directory table with direct links to system-architecture-maps.md, quick-reference.md, system-imbroglio.md, and docs/README.md.
    • Updated version badge to 0.4.1.1.
    • docs/README.md:
    • Replaced the bare placeholder text with a comprehensive documentation portal index.
    • Added structured navigation tables with verified relative paths across:
    • Core Architecture & Specifications (README.md, system-architecture.md, system-architecture-maps.md, system-imbroglio.md, quick-reference.md).
    • Security & Backend Audits (api-security-audit-2026-10-09.md, api-and-backend-security.md).
    • Product Features & Route Coverage (feature-roadmap-2026-10-09.md, frontend-route-coverage-2026-10-09.md).
    • UI/UX Improvements & Code Simplification (styling-and-ux-fixes.md, code-simplification-and-review-2026-10-09.md, components-site-header.md).
    • Visual Testing & UI Renders (webapp desktop/mobile and console desktop/mobile render catalogs).
    • Updated metadata headers to App Version 0.4.1.1.
    • system-architecture.md & system-imbroglio.md:
    • Corrected file tree in system-architecture.md line 276 from uppercase SYSTEM_ARCHITECTURE.md to system-architecture.md, quick-reference.md, and system-architecture-maps.md.
    • Bumped App Version to 0.4.1.1 and updated maintenance dates to 2026-10-11.
    • LICENSE:
    • Created standard MIT License file (Copyright (c) 2026 Paul Namalomba) in the repository root, ensuring the license badge in README.md resolves to an active, valid file.

    Code Files Touched

    • Architectural Specifications & Visual Maps:
    • system-architecture-maps.md: Newly authored visual architecture specification document containing 4 comprehensive Mermaid diagrams, state dictionaries, service matrices, sequence validation checklists, and ERD domain breakdowns.
    • system-architecture.md: Updated version metadata to 0.4.1.1 and corrected layout tree references.
    • system-imbroglio.md: Updated version metadata to 0.4.1.1 and verified against current service architecture.
    • Documentation Hub & Root Navigation:
    • README.md: Corrected broken quick-reference and architecture links, updated monorepo ASCII tree, expanded Quick Navigation table, and bumped version badge to 0.4.1.1.
    • docs/README.md: Completely rebuilt documentation catalog indexing all security, feature, UX, code simplification, and render artifacts.
    • LICENSE: Created root MIT license file resolving badge target.

    Compatibility and Deployment Notes

    • Zero Runtime Impact: Changes in this release are strictly confined to architectural documentation, visual reference specifications, link integrity normalization, and legal licensing.
    • Link Integrity Guarantee: All relative links across all root and subdirectory markdown files were crawled and validated using an automated Python AST script; 0 broken references exist.
    • Documentation Compatibility: The webapp dynamic changelog loader (webapp/src/lib/changelog.ts) and RSS feed (/changelog/rss.xml) parse .commits/*.txt files seamlessly without modifications.

    Validation Performed

    • Markdown Link Verification: Executed automated Python link validation script traversing all markdown files across the repository; confirmed 100% of relative links across README.md, docs/README.md, system-architecture.md, system-architecture-maps.md, quick-reference.md, and system-imbroglio.md resolve to existing files and directories.
    • Mermaid Syntax Smoke Tests: Rendered all 4 Mermaid diagram blocks (stateDiagram-v2, flowchart LR, sequenceDiagram, erDiagram) from system-architecture-maps.md through node /Users/kabwe/.gemini/config/skills/pretty-mermaid/scripts/render.mjs; all 4 diagrams compiled and rendered with exit code 0 and zero syntax errors.
    • Working Tree Integrity: Ran git status --short and git diff --stat to verify that modifications are clean, isolated, and strictly aligned with release goals.

    0.4.1.0

    Diff Baseline

    • Previous documented version and release tag: 0.4.0.0 (commit aa749dd).
    • Release scope commands: git diff 0.4.0.0 -- . ':(exclude).commits/**' and git status --short.
    • Effective runtime scope: 42 modified and deleted tracked source files, 51 untracked new feature files (+3,552 tracked line insertions, -1,334 tracked line deletions, and over 12,400 lines across newly created services, contracts, and frontend modules).
    • Version progression: 0.4.0.0 -> 0.4.1.0 under HalfQR fast sequence versioning.

    API Authentication, Authorization & Rate Limiting

    • Added ApiCallerMiddleware in microservices/HalfQR.PublicApi/Security/ApiCallerMiddleware.cs supporting Authorization: Bearer <token> (for hqr_sk_ API keys and hqr_pat_ access tokens) and X-Api-Key headers.
    • Integrated CredentialVerifier to validate incoming credentials against HalfQR.Identity via HTTP POST /internal/v1/credentials/verify with internal secret authentication.
    • Implemented RequireApiScope endpoint route filter in PublicApi enforcing granular scopes ApiScopes.QrRender (qr:render) on render and draft endpoints and ApiScopes.QrRead (qr:read) on job status and artifact downloads.
    • Added partitioned rate limiting via builder.Services.AddRateLimiter(...) in PublicApi with dedicated policies: 'render' (anonymous quota vs. subscriber plan limit), 'draft' (anonymous draft quota), and 'read' (read operations).
    • Implemented secure caller IP partitioning in ApiCallerMiddleware: extracts client addresses from X-Forwarded-For only when validated against a shared HALFQR_PROXY_SECRET header, preventing address spoofing.
    • Bound render jobs to creator credentials via RenderJobState.OwnerCredentialId; enforced private job isolation in RenderJobService.GetStatusAsync and GetArtifactAsync, returning HTTP 404 to unauthorized callers to prevent job GUID enumeration.
    • Sanitized queue failure responses in RenderJobService: replaced exposed internal exception messages with generic user messages ('The render queue is unavailable. Please retry shortly.') while logging detailed exceptions on the server.
    • Added strict security headers on all PublicApi responses (X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, HSTS on HTTPS) and applied sandbox Content-Security-Policy ('default-src 'none'; img-src data:; style-src 'unsafe-inline'; sandbox') to SVG artifact downloads.

    QrEngine Sanitization, Hardening & Validation

    • Hardened SVG logo XML parsing in microservices/HalfQR.QrEngine/Rendering/QrLogoProcessor.cs: replaced plain XDocument.Parse with ParseSvgDocument using XmlReaderSettings with DtdProcessing.Prohibit and null XmlResolver to eliminate XML External Entity (XXE) vectors.
    • Enforced strict SVG complexity caps: limited total SVG element count to 4,000 and <use> elements to 64; implemented ValidateUseReferences to detect and reject nested <use> reference chains that could trigger quadratic amplification in SkiaSharp rasterization.
    • Expanded CSS URL sanitization: updated ContainsUnsafeCssUrl validation across all element attribute values, blocking url() injections through SVG presentation attributes (fill, stroke, mask, clip-path, filter).
    • Prevented raster logo decompression bombs in QrLogoProcessor.EnsureDecodableRasterSize: inspects dimensions via SKCodec.Create prior to decoding full pixel buffers, capping decoded size at 4096 x 4096 pixels (16 megapixels) and 512 KB payload size.
    • Hardened QrRenderRequestValidator.cs: added ValidateEnums using Enum.IsDefined across ContentType, Mode, ErrorCorrectionLevel, Finder.BorderShape, Finder.CenterShape, Data.Pattern, Data.GradientMode, and Logo.SourceType to reject raw integer bypasses.
    • Added ValidatePayloadShape in QrRenderRequestValidator: capped TargetUrl to 2,048 characters, payload dictionary entries to 16, key lengths to 64 characters, and value lengths to 2,048 characters.
    • Added validation rejection for QrRenderMode.Managed, returning an explicit HTTP 400 validation error informing clients that dynamic managed QR codes are not yet available.
    • Refactored SVG composer modules (QrSvgComposer.cs and QrFinderSvgComposer.cs): centralized QuietZoneModules (4) and FinderSizeModules (7) constants, introduced IsInFinderSpan helper, and extracted shared SvgNumberFormat.Format(double) to eliminate duplicate invariant floating-point formatting.

    HalfQR.Identity Service (Auth, Sessions & Credentials)

    • Implemented microservice in microservices/HalfQR.Identity targeting .NET 10 with pluggable FileSystemIdentityStore and PostgresIdentityStore storage backends.
    • Created PostgreSQL schema 'identity' with automatic startup initialization for users, sessions, api_credentials, and email_verifications tables with JSONB document records and indexed lookup columns.
    • Built passwordless magic-link authentication via EmailVerificationService and ResendEmailSender using Resend's REST API, with fallback LoggingEmailSender for local development.
    • Implemented EmailDomainPolicy: validates email format and blocks registrations from disposable email domains and known spam sources using bundled resources (disposable-email-domains.txt, spam-domains.txt, trusted-email-providers.txt); provided .helpers/update-email-blocklists.sh for automated blocklist updates.
    • Implemented Google OAuth 2.0 PKCE authentication flow in GoogleOAuthClient: handles code exchange, user profile extraction (email, display name, avatar), and account upsert in UserDirectory.
    • Implemented session engine via SessionService: issues cryptographically secure 40-character base62 tokens prefixed with 'hqr_sess_' (~238 bits of entropy), hashes tokens with SHA-256 for database lookup, and tracks user-agent, IP, and activity timestamps.
    • Built full API credential lifecycle in CredentialService: creates scoped API keys (hqr_sk_) with lifetimes of 30, 90, 180, 365 days, or never, and personal access tokens (hqr_pat_) with lifetimes of 1, 7, 30, or 90 days.
    • Added credential rotation, single-time plaintext secret reveal, credential revocation, and plan limit checks integrated with HalfQR.Billing.
    • Provided internal verification route POST /internal/v1/credentials/verify protected with X-HalfQR-Internal-Key and constant-time string comparison (SecretTokens.FixedTimeEquals).

    HalfQR.Billing Service (PayChangu Mobile Money & Plans)

    • Implemented billing microservice in microservices/HalfQR.Billing targeting .NET 10 with FileSystemBillingStore and PostgresBillingStore backends managing subscriptions and payments tables.
    • Built native Malawi Mobile Money payment integration in PayChanguClient supporting Airtel Money and TNM Mpamba checkout flows with 9-digit telephone normalization and network prefix validation (Airtel '9', TNM '8').
    • Implemented webhook receiver POST /api/v1/billing/webhooks/paychangu with mandatory HMAC-SHA256 'Signature' header verification in Production environments, automatically re-verifying payments directly with PayChangu before subscription activation.
    • Added background service PaymentTimeoutWorker running every 30 seconds to query PayChangu for unconfirmed mobile charges and expire pending records older than 15 minutes.
    • Configured subscription tiers: 'Developer' plan (MWK 15,000 / month, 3 API keys, 5 access tokens, 300 RPM) and 'Business' plan (MWK 45,000 / month, 25 API keys, 25 access tokens, 1,200 RPM), with free tier entitlement fallback.
    • Added internal service endpoints GET /internal/v1/users/{userId}/entitlement and GET /internal/v1/users/{userId}/overview secured by InternalHeaders.InternalKey.

    Developer Console & Webapp Interface Architecture

    • Built developer console frontend under webapp/src/app/dashboard with dedicated layout shell, responsive sidebar navigation, user session context, and optimistic authentication protection via webapp/src/proxy.ts matching /dashboard/:path*.
    • Created CredentialsManager, CredentialsPage, KeyMask, and CopyButton components under webapp/src/components/dashboard for issuing, viewing, copying, rotating, and revoking API keys and Personal Access Tokens.
    • Implemented BillingPanel component with real-time entitlement display, plan cards, mobile money checkout dialog with telephone formatting, payment transaction tables with status badges, and manual refresh controls.
    • Implemented SessionsPanel in webapp/src/app/dashboard/security/page.tsx displaying active sessions, current browser indicator, user-agent and IP details, and remote session termination.
    • Built dedicated authentication flows under webapp/src/app/sign-in and webapp/src/app/sign-up supporting passwordless email verification, Google OAuth 2.0 PKCE, and local development bypass.
    • Hardened webapp reverse proxy in webapp/src/app/api/halfqr/[...path]/route.ts: restricted forwarding strictly to /api/v1/qr/* routes, enforced a 1 MB body size cap, allowlisted request headers (accept, content-type) and response headers, and forwarded client IP with HALFQR_PROXY_SECRET.
    • Built interactive changelog platform under webapp/src/app/changelog backed by loadReleaseLines() in webapp/src/lib/changelog.ts, dynamically parsing .commits/*.txt files into structured release lines, patch details, and an RSS 2.0 feed at /changelog/rss.xml.

    Design System, Typography & Frontend Simplification

    • Replaced Google Inter typography with Plus_Jakarta_Sans (--font-sans) via Next.js font optimization across the entire application for improved readability and typographic rhythm.
    • Introduced standardized webapp sizing design tokens in webapp/src/app/globals.css (--web-font-body: 0.75rem, --web-font-heading: 1rem, --web-control-height: 2.25rem, --web-control-radius: 12px, --web-surface-radius: 14px) and console tokens in webapp/src/app/console.css.
    • Removed disruptive hover transformations (transform: scale(1.06)) across interactive buttons in favor of subtle border-color, background, and filter transitions.
    • Standardized public marketing pages (Product, Why HalfQR, QR Codes, API Documentation) with reusable PageHero and InfoCardGrid components, removing unused MUI icon dependencies and commented layout code.
    • Expanded API documentation in webapp/src/app/api-documentation/page.tsx with comprehensive guidance on /render/draft, /content-types, Bearer authentication headers, scopes (qr:render, qr:read), and validation limits.
    • Applied code simplifications in webapp/src/components/qr-builder.tsx: removed redundant aliases, simplified target URL mapping, flattened payload resolution, unified SVG preview data URLs, and normalized phone digits.

    Infrastructure, Docker Compose & Environment Hardening

    • Overhauled docker-compose.yml and .env.example: eliminated committed dev passwords (halfqr_dev_password), replacing them with mandatory environment variable checks (${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env} and ${RABBITMQ_DEFAULT_PASS:?Set RABBITMQ_DEFAULT_PASS in .env}).
    • Bound database and broker ports (PostgreSQL 5436, Redis 6386, RabbitMQ 5673 and 15673) strictly to localhost (127.0.0.1) to avoid unintended host network exposure.
    • Enforced Redis authentication with --requirepass ${REDIS_PASSWORD} and updated Redis container healthchecks.
    • Added Docker container definitions and compose services for halfqr-identity (microservices/HalfQR.Identity/Dockerfile) and halfqr-billing (microservices/HalfQR.Billing/Dockerfile), connecting them securely to Postgres and PublicApi.
    • Configured restart: unless-stopped policies across all application microservices and background dependencies.
    • Updated root .gitignore to match nested build directories (/bin/, /obj/, **/.data/, *.tsbuildinfo, and UI screenshots).

    Code Files Touched

    • Root & Infrastructure:
    • .env.example: Added required secret declarations, OAuth credentials, Resend options, and PayChangu configuration.
    • .gitignore: Added recursive bin/obj, .data/, and tsbuildinfo ignore patterns.
    • docker-compose.yml: Added identity and billing services, localhost port bindings, Redis authentication, and secret validation.
    • .helpers/update-email-blocklists.sh: Shell script for updating disposable and spam email domain blocklists.
    • docs/security/api-security-audit-2026-10-09.md: Security audit documentation.
    • docs/code-improvements/code-simplification-and-review-2026-10-09.md: Code review and simplification findings.
    • docs/features/feature-roadmap-2026-10-09.md: Architecture and feature roadmap.
    • docs/features/frontend-route-coverage-2026-10-09.md: API contract coverage matrix.
    • Backend Services - HalfQR.PublicApi:
    • microservices/HalfQR.PublicApi/Program.cs: Configured API caller middleware, rate limiters, security headers, and scope authorization.
    • microservices/HalfQR.PublicApi/Services/RenderJobService.cs: Added job owner credential binding and sanitized error messages.
    • microservices/HalfQR.PublicApi/Security/ApiAccessOptions.cs: Configuration options for API keys and rate limits.
    • microservices/HalfQR.PublicApi/Security/ApiCaller.cs: Caller context model representing anonymous or authenticated callers.
    • microservices/HalfQR.PublicApi/Security/ApiCallerMiddleware.cs: Authentication and client IP extraction middleware.
    • microservices/HalfQR.PublicApi/Security/CredentialVerifier.cs: HTTP client verifier calling Identity.
    • microservices/HalfQR.PublicApi/appsettings.json & appsettings.Development.json: Updated access options.
    • Backend Services - HalfQR.Identity:
    • microservices/HalfQR.Identity/Dockerfile: Multi-stage container build definition.
    • microservices/HalfQR.Identity/Program.cs: Identity service setup, routes for auth, sessions, credentials, and verification.
    • microservices/HalfQR.Identity/IdentityOptions.cs: Identity configuration models and provider constants.
    • microservices/HalfQR.Identity/Models/UserAccount.cs: User entity model.
    • microservices/HalfQR.Identity/Models/SessionRecord.cs: Session entity model.
    • microservices/HalfQR.Identity/Models/ApiCredential.cs: API key and access token entity model.
    • microservices/HalfQR.Identity/Models/EmailVerification.cs: Email verification token entity model.
    • microservices/HalfQR.Identity/Security/CredentialService.cs: Credential generation, validation, and lifecycle.
    • microservices/HalfQR.Identity/Security/SessionService.cs: Session generation, revocation, and hashing.
    • microservices/HalfQR.Identity/Security/UserDirectory.cs: User account provisioning and lookup.
    • microservices/HalfQR.Identity/Security/EmailDomainPolicy.cs: Disposable and spam email domain filter.
    • microservices/HalfQR.Identity/Security/EmailVerificationService.cs: Magic link verification workflow.
    • microservices/HalfQR.Identity/Security/SecretTokens.cs: Cryptographic token generator and constant-time comparison.
    • microservices/HalfQR.Identity/Security/BillingClient.cs: Internal HTTP client relay to Billing.
    • microservices/HalfQR.Identity/Google/GoogleOAuthClient.cs: Google OAuth 2.0 PKCE client.
    • microservices/HalfQR.Identity/Email/IEmailSender.cs: Email sender interface.
    • microservices/HalfQR.Identity/Email/ResendEmailSender.cs: Resend API implementation.
    • microservices/HalfQR.Identity/Email/VerificationEmailTemplate.cs: HTML/text verification email template.
    • microservices/HalfQR.Identity/Storage/IIdentityStore.cs: Identity storage interface.
    • microservices/HalfQR.Identity/Storage/PostgresIdentityStore.cs: PostgreSQL storage implementation.
    • microservices/HalfQR.Identity/Storage/FileSystemIdentityStore.cs: File system storage implementation.
    • microservices/HalfQR.Identity/Resources/*: Domain blocklists and trusted provider lists.
    • Backend Services - HalfQR.Billing:
    • microservices/HalfQR.Billing/Dockerfile: Multi-stage container build definition.
    • microservices/HalfQR.Billing/Program.cs: Billing service setup, PayChangu webhook, and internal user routes.
    • microservices/HalfQR.Billing/BillingOptions.cs: Billing options and plan definitions.
    • microservices/HalfQR.Billing/BillingContracts.cs: DTOs for checkout, overview, plans, and payments.
    • microservices/HalfQR.Billing/Models/Subscription.cs: Subscription state model.
    • microservices/HalfQR.Billing/Models/BillingPayment.cs: Payment transaction model.
    • microservices/HalfQR.Billing/PayChangu/PayChanguClient.cs: PayChangu API client with mobile validation and HMAC verification.
    • microservices/HalfQR.Billing/Payments/BillingService.cs: Plan entitlements, checkout flow, and webhook processing.
    • microservices/HalfQR.Billing/Payments/PaymentTimeoutWorker.cs: Background sweep for timed-out payments.
    • microservices/HalfQR.Billing/Storage/IBillingStore.cs: Billing storage interface.
    • microservices/HalfQR.Billing/Storage/PostgresBillingStore.cs: PostgreSQL billing storage implementation.
    • microservices/HalfQR.Billing/Storage/FileSystemBillingStore.cs: File system billing storage implementation.
    • Backend Shared Contracts & QrEngine:
    • microservices/HalfQR.Contracts/Models/RenderJobState.cs: Added OwnerCredentialId property.
    • microservices/HalfQR.Contracts/Security/*: ApiCredentialKind, ApiScopes, CredentialVerificationRequest/Response, InternalHeaders.
    • microservices/HalfQR.Contracts/Billing/EntitlementResponse.cs: Entitlement DTO contract.
    • microservices/HalfQR.QrEngine/Rendering/QrLogoProcessor.cs: XML parsing hardening, complexity caps, and decompression bomb protection.
    • microservices/HalfQR.QrEngine/Rendering/QrRenderRequestValidator.cs: Enum validation, payload limits, and managed mode rejection.
    • microservices/HalfQR.QrEngine/Rendering/QrSvgComposer.cs: Module geometry refactoring and IsInFinderSpan helper.
    • microservices/HalfQR.QrEngine/Rendering/QrFinderSvgComposer.cs: Shared geometry constants.
    • microservices/HalfQR.QrEngine/Rendering/SvgNumberFormat.cs: Shared floating-point string formatting helper.
    • microservices/HalfQR.Cli/Program.cs: Cleaned up option parsing and shared logo option instantiation.
    • Frontend Webapp:
    • webapp/src/proxy.ts: Middleware protecting dashboard routes.
    • webapp/src/app/globals.css: Sizing tokens and typography overhaul.
    • webapp/src/app/console.css: Complete console and dashboard stylesheet.
    • webapp/src/app/layout.tsx: Migrated to Plus_Jakarta_Sans font.
    • webapp/src/components/site-header.tsx: Added Changelog and Sign-in navigation links; concealed header on console routes.
    • webapp/src/components/qr-builder.tsx: Code simplifications, dead code removal, and phone normalization.
    • webapp/src/app/api/halfqr/[...path]/route.ts: Hardened proxy with header allowlists and body length enforcement.
    • webapp/src/app/api/auth/*: Endpoints for email magic links, Google OAuth, dev sign-in, and sign-out.
    • webapp/src/app/api/account/[...path]/route.ts: Proxy for credentials, sessions, and billing requests to Identity.
    • webapp/src/app/sign-in/page.tsx & webapp/src/app/sign-up/page.tsx: Authentication pages.
    • webapp/src/app/dashboard/*: Dashboard overview, api-keys, access-tokens, billing, and security pages.
    • webapp/src/components/dashboard/*: Reusable credentials manager, billing panel, sessions panel, dialogs, and key masks.
    • webapp/src/components/auth/*: Auth hero, auth panel, and Google logo mark.
    • webapp/src/components/site/*: PageHero and InfoCardGrid reusable marketing layout components.
    • webapp/src/app/changelog/*: Dynamic changelog pages and RSS feed.
    • webapp/src/lib/*: Client API helpers, changelog loader, formatting utilities, and server config.

    Compatibility and Deployment Notes

    • Database Migrations: PostgresIdentityStore and PostgresBillingStore automatically create their respective PostgreSQL schemas ('identity' and 'billing') along with tables and indexes on first startup; no manual migration scripts required.
    • Mandatory Environment Variables: Deployment requires setting POSTGRES_PASSWORD, RABBITMQ_DEFAULT_PASS, REDIS_PASSWORD, HALFQR_INTERNAL_API_KEY, and HALFQR_PROXY_SECRET in .env.
    • Identity Base URL & CORS: Webapp requires HALFQR_IDENTITY_BASE_URL (defaults to http://identity:8080 in Docker) to communicate with HalfQR.Identity; PublicApi requires ApiAccess__IdentityBaseUrl.
    • PayChangu Webhooks: Public webhook routing for PayChangu requires pointing reverse proxies or tunnels to the Billing service at /api/v1/billing/webhooks/paychangu with PAYCHANGU_WEBHOOK_SECRET configured.
    • Backward Compatibility: Anonymous render and draft requests remain functional when HALFQR_REQUIRE_API_KEY is set to false (default); existing static QR codes and rendering parameters remain fully compatible.

    Validation Performed

    • .NET Solution Compilation: Executed dotnet build HalfQR.sln across all 8 microservices and library projects; build passed with 0 warnings and 0 errors.
    • Frontend Next.js Build: Executed npm --prefix webapp run build; Next.js 16.4.0 (Turbopack) successfully compiled all static routes (/changelog, /product, /qr-codes, /why-halfqr, /api-documentation) and dynamic API/dashboard routes with 0 errors.
    • CLI Render & Decode Verification: Executed dotnet run --project microservices/HalfQR.Cli -- verify-render --url https://example.com/test --preset link; verified draft SVG generation, final PNG rasterization, and ZXing payload decoding successfully passed.
    • Email Blocklist Verification: Verified disposable-email-domains.txt, spam-domains.txt, and trusted-email-providers.txt load into memory during Identity startup and reject invalid or disposable test addresses as expected.

  2. HalfQR 0.4.0

    QR rendering reliabilitySVG logo uploadsTypography

    QR rendering reliability

    • Diagnosed /api/halfqr/api/v1/qr/render HTTP 500 responses as RabbitMQ broker failures after the Docker daemon restarted.
    • Added unless-stopped restart policies to RabbitMQ, PostgreSQL, and Redis.
    • Restored RabbitMQ and confirmed the public render API accepts jobs again.

    SVG logo uploads

    • Accept SVG files by MIME type or .svg filename so generic browser/file-server MIME values do not block valid logos.
    • Parse SVG markup in the browser and return a clear validation message for malformed files.
    • Support common safe SVG metadata, stylesheet, symbol, text, local fragment, and embedded raster content.
    • Preserve sanitizer rejection of event handlers, scripts, executable values, external references, and unsafe CSS URLs.

    Typography

    • Replaced the site's primary typography with Google Inter through Next.js font optimization.
    • Reduced QR builder font sizes by 15% across headings, labels, hints, statuses, preview copy, and download controls.

    Validation

    • Frontend: npm run build
    • Backend and deployment: docker compose build and docker compose up -d
    • API: live render queue, completion, and SVG/PNG artifact smoke tests
    • Logo: live SVG draft and queued-render smoke tests

  3. HalfQR 0.3.0

    AddedChanged

    0.3.0.1

    Added

    • Many many UX changes and fixes including content-level augmentations to core functional components

    Validation

    • npm run dev

    0.3.0.0

    Added

    • Continued Fast versioning
    • Added a shared webapp icon barrel and SiteTitleIcon wrapper so the public header can render the refreshed HalfQR logo set without depending on the legacy havqr_* image references.

    Changed

    • Changed the public deployment surface from the temporary computemore.com bench hosts to the production www.halfqr.com and api.halfqr.com domains across the README, Docker Compose defaults, API documentation, and Public API CORS allowlist.
    • Changed the public webapp shell to use the refreshed HalfQR branding layer, including the new logo assets, updated typography, revised header treatment, landing-page hero copy, and refreshed marketing copy on the Why HalfQR and API documentation pages.
    • Changed top-level documentation and asset naming to better match the public-release surface, including normalizing guide filenames and replacing the older havqr_* logos with halfqr_* equivalents.
    • Changed the webapp delivery stack for the public release by updating the Next.js and TypeScript toolchain versions and renaming backend service containers to the halfqr-backend-* convention.

    Validation

    • git diff --stat
    • git diff -- README.md docker-compose.yml microservices/HalfQR.PublicApi/Program.cs webapp/src/app/layout.tsx webapp/src/app/page.tsx webapp/src/app/why-halfqr/page.tsx webapp/src/app/api-documentation/page.tsx webapp/src/components/site-header.tsx
    • npm run build from webapp
    • dotnet build HalfQR.sln currently fails locally with NETSDK1045 because the installed SDK is 9.0.313 while the solution targets .NET 10.0

  4. HalfQR 0.2.9

    AddedChanged

    Added

    • Continued Fast versioning

    Changed

    • Completely ovarhauled file names, envs and all other related issues to be hooked to HalfQR not HaveQR, as well as updating all the docs and guides to reflect this change. This is in preparation for the upcoming public release, where we want to have a more unique and memorable name that is still closely related to QR codes.
    • Preparing for domain deployment and public release by updating all references to the project name and ensuring consistency across all documentation and codebase. This includes changing the website title, updating the README, and modifying any internal references to the project name in the code and documentation.

    Validation

    • dotnet build HalfQR.sln
    • npm run build from webapp
    • Verified the reported R2 PDF URL decodes successfully through the new CLI for Pdf and Link renders without a logo
    • Verified the same URL decodes successfully through the new CLI with the curated menu and scan-me preset logos applied

  5. HalfQR 0.2.8

    AddedChanged

    Added

    • Continued Fast versioning

    Changed

    • Changed the builder preview flow to prefer the server draft once it is available, keeping the on-screen QR closer to the authoritative backend render.

    Validation

    • dotnet build HalfQR.sln
    • npm run build from webapp
    • Verified the reported R2 PDF URL decodes successfully through the new CLI for Pdf and Link renders without a logo
    • Verified the same URL decodes successfully through the new CLI with the curated menu and scan-me preset logos applied

  6. HalfQR 0.2.7

    AddedFixedChanged

    Added

    • Added a verify-render command to HalfQR.Cli so draft SVG and final PNG artifacts can be rendered, decoded, and written to disk from the same backend pipeline used by the product.
    • Added curated transparent SVG preset watermark assets for Scan Me, Link, Menu, and WhatsApp so preset logos no longer depend on brittle raster background removal.
    • Added a shared QrArtifactRasterizer helper in HalfQR.QrEngine so SVG-to-PNG conversion is reusable across render validation and production rendering flows.

    Fixed

    • Fixed the local preview matrix geometry to include the same quiet-zone padding used by the backend renderer, so preview placement no longer drifts away from the server-generated QR layout.
    • Fixed the preset watermark path that could produce opaque or blackout center logos by switching the builder to transparent SVG presets.
    • Fixed draft render failures surfacing as opaque server errors by returning a validation-style message when payload encoding cannot be completed.

    Changed

    • Changed the builder preview flow to prefer the server draft once it is available, keeping the on-screen QR closer to the authoritative backend render.
    • Changed the preview summary to show whether the builder is currently targeting a local API or the hosted API, removing ambiguity during render debugging.

    Validation

    • dotnet build HalfQR.sln
    • npm run build from webapp
    • Verified the reported R2 PDF URL decodes successfully through the new CLI for Pdf and Link renders without a logo
    • Verified the same URL decodes successfully through the new CLI with the curated menu and scan-me preset logos applied

  7. HalfQR 0.2.6

    FixedChanged

    Fixed

    • Fixed the centered logo render path so the QR now reserves a true safe middle window before the logo is embedded, instead of painting the watermark on top of live QR data modules.
    • Fixed the gradient rendering logic in both the local preview and backend SVG composer by switching the gradient to QR-wide user-space coordinates, so the data body now shows a visible directional gradient instead of looking flat.
    • Fixed the default dark colour so finder markers and dark data modules now start from pure black until the user changes the colour settings.

    Changed

    • Aligned the local preview geometry and backend SVG geometry so centered logo sizing, backdrop padding, and data-module exclusion use the same layout rules.
    • Updated the builder guidance text to reflect the new safe-window logo behavior rather than implying the logo simply sits on top of the code.

    Validation

    • npm run build from webapp
    • dotnet build HalfQR.sln
    • Verified the local preview SVG now emits a QR-wide gradient definition with gradientUnits="userSpaceOnUse"
    • Verified the local backend render path now produces SVG and PNG artifacts with a visible gradient and a cleared centered logo window

  8. HalfQR 0.2.5

    Changed

    Changed

    • Fixed the non-loading assets
    • Moving forward the versioning quickly

  9. HalfQR 0.2.4

    ChangedFixed

    Changed

    • Continued the CSS-first frontend cleanup by keeping layout, spacing, breakpoint, and visual rules in globals.css while leaving JSX focused on state, routing, and interaction behavior.
    • Refined the header and hero presentation with updated spacing, brand sizing, theme tokens, and explicit hero text colours so the top-of-page content reads cleanly against the darker shell background.
    • Updated the header component to use next/image for the brand mark and to close the mobile menu automatically on route changes and when the viewport returns to desktop widths.

    Fixed

    • Fixed the mobile navigation dropdown so it stays anchored to the right side of the header actions and no longer drifts or overflows left on narrow screens.
    • Fixed small-screen overflow in the QR type selector by switching the cards to a tighter wrapping grid, reducing card density, and hiding secondary copy where space is limited.
    • Fixed small-screen overflow in the Popular Watermark Presets selector by applying the same wrapped-grid treatment, smaller thumbnails, and safer text wrapping inside the card.
    • Added overflow guards such as min-width: 0, overflow-wrap: anywhere, and clipped horizontal bleed protection so nested grids and long labels stop forcing parent containers wider than intended.

    Validation

    • npm run build from webapp
    • Verified the QR type selector at a 390px mobile viewport renders across wrapped rows with zero horizontal overflow
    • Verified the watermark preset selector at a 390px mobile viewport renders across wrapped rows with zero horizontal overflow

  10. HalfQR 0.2.3

    AddedFixedWhyProblem Solved

    0.2.3.5

    Added

    • So now what we are doing is completely bootstrapping sisplays in css and functionality in jsx, no cross-confusion, only tweaking displays in jsx if necessary but avoiding that as much as possible
    • Added active state styling to the mobile menu links, so when a user clicks a link in the mobile menu, it gets highlighted to indicate it's the current page. This improves navigation clarity on mobile devices.
    • Updated the mobile menu link styles to ensure they are visually distinct and provide clear feedback on interaction, enhancing the overall user experience on mobile devices.
    • Updated all css by adding block-style html comments so that we can easily identify which styles correspond to which components or features, making future maintenance and updates easier for developers.

    0.2.3.4

    Added

    • Started documenting code improvements.

    0.2.3.3

    Fixed

    • Normalized uploaded and preset raster logos in the webapp before they enter builder state, automatically scaling PNG and JPEG assets down when their image area exceeds the supported threshold while preserving aspect ratio.
    • Added optimized-logo metadata and updated the Logo-tab guidance so the builder explains when a raster asset was scaled locally instead of failing later in the render pipeline.
    • Kept raster background removal opt-in while making the upload path safer, so large raster logos can be previewed and rendered without silently changing other logo settings.

    Why

    • The existing upload guard only checked file size in bytes. That allowed highly compressed but very large-dimension raster logos to pass validation even though the render path still had to decode and embed the full pixel area.
    • Those requests could fail during draft preview or final rendering on stricter or older runtimes, producing an avoidable server-side error for an asset the builder should have normalized before submission.
    • Fixing the issue in the webapp protects both manual uploads and preset raster logos without requiring users to preprocess artwork themselves.

    Problem Solved

    • Prevented large-dimension PNG and JPEG logos from breaking draft preview sync when they were under the byte limit but still too large in raw image area.
    • Removed the class of failures where the builder looked healthy locally but the server draft request errored as soon as the raster logo was included.
    • Preserved the existing behavior for SVG logos and already-safe raster files, so only oversized raster inputs are transformed.

    Validation

    • npm run build from webapp
    • Verified the previously failing high-resolution raster logo path now scales the image locally and completes draft preview successfully
    • Verified optimized raster logos keep their aspect ratio and continue through the normal final render request flow

    0.2.3.2

    Changed

    • Switched raster logo background removal in the webapp to an explicit user-controlled checkbox instead of auto-enabling it for uploaded or preset raster logos.
    • Defaulted the builder background-removal toggle to false, so raster logos stay intact unless the user deliberately opts into transparent-background cleanup.
    • Updated the Logo-tab helper copy to explain that raster background removal is an opt-in transparency pass rather than a default upload behavior.

    Validation

    • npm run build
    • Verified the builder keeps raster logo background removal unchecked after manual upload and preset selection until the checkbox is explicitly enabled

    0.2.3.1

    Added

    • Generated favicon and app icons for the web app, surfaced in the builder UI and as part of the public assets.

    0.2.3.0

    Added

    • Added a synchronous SVG-only draft preview route at POST /api/v1/qr/render/draft, returning resolved target metadata plus SVG markup without queueing a worker job or generating PNG output.
    • Added browser-side local SVG preview generation in the webapp so the builder can render styled QR previews immediately while the server draft sync catches up.
    • Added Logo-tab preset selection backed by webapp/public/assets/qr-watermarks, with preset logos loading as centered overlays and defaulting to 12% logo size.

    Changed

    • Reworked the builder preview lifecycle into three stages: instant local preview, debounced server draft preview, and final worker artifact preview after an explicit render job completes.
    • Updated the builder to debounce and cache draft-preview requests, ignore stale preview responses, and prevent outdated completed jobs from overwriting the current request state.
    • Replaced the old approximate preview behavior with a more realistic SVG preview path that reflects the active data styling configuration, including live gradient settings and centered logo placement.
    • Expanded the builder status UI and styles to distinguish Local preview, Draft synced, and final render states, and to surface the new preset-logo controls.

    Validation

    • dotnet build HalfQR.sln
    • npm run build from webapp
    • Verified POST /api/v1/qr/render/draft returns 200 for a styled link render request against the local PublicApi
    • Verified the builder transitions from local SVG preview to server draft preview
    • Verified selecting a logo preset loads the image and resets logo size to 12%

  11. HalfQR 0.2.2

    AddedChanged

    0.2.2.2

    Added

    • Implemented the styled QR slice end to end. The backend now accepts data styling and richer logo inputs, renders square or dotted data modules with linear gradients limited to the main QR body, and supports centered SVG, PNG, and JPEG logos with backdrop handling and raster background removal.
    • The webapp now uses the HalfQR favicon, ships a real landing page plus rebuilt builder UI, exposes the new styling controls, and swaps to worker artifacts instead of a fake preview once a job completes.
    • Added a same-origin proxy in the webapp so local use no longer fails on browser CORS when talking to the hosted API.
    • Completely implemeneted the webapp and it's components and pages, written in TypeScript with React and Next.js, and styled with Material UI and Emotion, copying over some boilerplate and patterns from afriflex.
    • The webapp as externally tunneled to halfqr.computemore.com is now the primary demo and test interface for the project, replacing the previous Postman collection and direct API calls.
    • Completely overhauled the api as well

    0.2.2.1

    Added

    • Added first-party Docker build assets for webapp, HalfQR.PublicApi, and HalfQR.Worker, plus a root .dockerignore for the monorepo bench.
    • Added Compose-managed webapp, public-api, and worker services with host ports 5173 and 8083 and a shared render-job volume for the file-backed async pipeline.

    Changed

    • Switched the webapp from same-origin rewrite calls to direct public API calls using NEXT_PUBLIC_HALFQR_API_BASE_URL, while normalizing relative job and artifact URLs against the public API origin.
    • Added configurable CORS and JSON string-enum serialization in HalfQR.PublicApi, and aligned persisted render-job JSON with the string-based request and response contract used by the webapp.
    • Wired canonical R2 artifact settings through Docker Compose so the API and worker can switch from filesystem artifacts to Cloudflare R2 through environment configuration.
    • Disabled AWS streaming payload signing and default checksum validation on R2 uploads so Cloudflare R2 accepts the .NET S3 PutObject flow.
    • Updated operator docs and release-facing metadata for the current Dockerized devops/testing bench at halfqr.computemore.com and halfqr-api-demo.computemore.com.

    Validation

    • npm run build from webapp
    • docker compose config
    • docker compose build webapp public-api worker
    • docker compose up -d
    • Verified http://127.0.0.1:8083/healthz and http://127.0.0.1:5173
    • Verified a live render job queue, completion, and PNG artifact download through the Docker bench
    • Verified the Cloudflare R2 upload-format fix; the currently provided bucket credentials still return Access Denied on write, so the local .env keeps RENDER_ARTIFACT_PROVIDER=FileSystem until bucket permissions are corrected
    • dotnet build HalfQR.sln is still blocked on this machine because the installed SDK is 9.0.312 while the solution targets .NET 10.0

    0.2.2.0

    Added

    • Added a same-origin Next.js rewrite so the webapp can call the render API through /api/v1/qr/* without browser-side CORS workarounds.
    • Added webapp job polling and artifact download actions for generated SVG and PNG outputs.
    • Added a finder-pattern SVG compositor in HalfQR.QrEngine so square, rounded, and circle now affect the three finder markers without changing normal data modules.
    • Added provider-backed render storage seams with PostgreSQL job-state and Cloudflare R2 artifact implementations behind IRenderJobStore.
    • Added runtime configuration and operator notes for split dev-machine and power-machine workflows in QUICK_REFERENCE.md.

    Changed

    • Wired the builder form to submit real render jobs, validate request inputs, surface queue/render/failure state, and resolve WhatsApp fallback URLs in the preview.
    • Expanded the builder status UI to reflect worker progress and available artifacts.
    • Split the previous file-backed store into dedicated state and artifact providers while keeping filesystem storage as the default fallback.
    • Updated the public API runtime version and aligned release-facing docs with the current implementation.

    Validation

    • npm run build --prefix webapp
    • dotnet build HalfQR.sln
    • End-to-end queue smoke test is still blocked on this dev machine because RabbitMQ and PostgreSQL are not reachable locally; use the documented tunnel and power-machine commands to run it against live infra.

  12. HalfQR 0.2.1

    AddedChanged

    Added

    • Added a same-origin Next.js rewrite so the webapp can call the render API through /api/v1/qr/* without browser-side CORS workarounds.
    • Added webapp job polling and artifact download actions for generated SVG and PNG outputs.
    • Added a finder-pattern SVG compositor in HalfQR.QrEngine so square, rounded, and circle now affect the three finder markers without changing normal data modules.
    • Added provider-backed render storage seams with PostgreSQL job-state and Cloudflare R2 artifact implementations behind IRenderJobStore.
    • Added runtime configuration and operator notes for split dev-machine and power-machine workflows in QUICK_REFERENCE.md.

    Changed

    • Wired the builder form to submit real render jobs, validate request inputs, surface queue/render/failure state, and resolve WhatsApp fallback URLs in the preview.
    • Expanded the builder status UI to reflect worker progress and available artifacts.
    • Split the previous file-backed store into dedicated state and artifact providers while keeping filesystem storage as the default fallback.
    • Updated the public API runtime version and aligned release-facing docs with the current implementation.

    Validation

    • npm run build --prefix webapp
    • dotnet build HalfQR.sln
    • End-to-end queue smoke test is still blocked on this dev machine because RabbitMQ and PostgreSQL are not reachable locally; use the documented tunnel and power-machine commands to run it against live infra.

  13. HalfQR 0.2.0

    AddedChanged

    Added

    • Added QRCoder-backed SVG rendering and Docker-safe PNG rasterization in HalfQR.QrEngine.
    • Added RabbitMQ-backed job dispatch in HalfQR.PublicApi and worker-side queue consumption in HalfQR.Worker.
    • Added file-backed render job state and artifact storage for generated SVG and PNG outputs.
    • Added QUICK_REFERENCE.md with build, run, infrastructure, and request examples.

    Changed

    • Refined the v1 content model so most QR categories now resolve from TargetUrl, with WhatsApp kept as the first special native builder flow.
    • Updated README.md and SYSTEM_ARCHITECTURE.md to match the current implementation and quick-start commands.

    Validation

    • dotnet build HalfQR.sln

  14. HalfQR 0.1.1

    Changes

    • Created the solution and backend project structure in HalfQR.sln and HalfQR.slnx, with service projects under microservices.
    • Added the first shared QR contracts in HalfQR.Contracts, including content types, finder shapes, render modes, output options, and async render job request and response models.
    • Added real payload encoding logic in QrPayloadEncoder.cs and hashing in Sha256HashService.cs. This now canonicalizes link, text, email, call, SMS, WhatsApp, Wi-Fi, vCard, event, app, social, PDF, image, and video payloads.
    • Replaced the template API with an initial async in-memory render flow in Program.cs and InMemoryRenderJobService.cs. The API now exposes health, content-type discovery, render job submission, and job status endpoints.
    • Added infrastructure scaffolding in docker-compose.yml and .env.example for PostgreSQL, Redis, and RabbitMQ.
    • Added tracked bootstrap placeholders for README.md.
    • The full solution builds successfully through both HalfQR.sln and HalfQR.slnx.
    • Target is .NET 10

  15. HalfQR 0.1.0

    Changes

    • README.md: Added project bootstrap details and other introductory details.
    • SYSTEM_ARCHITECTURE.md: Added system architecture details.