# Changelog

## [1.0.0] - 2026-09-27

First production release. Self-hosted messenger for family and friends,
built from scratch.

### Added
- **Auth**: registration/login, JWT access tokens (15 min) + rotated refresh
  tokens (30 days) in httpOnly cookies, argon2id password hashing,
  session revocation, rate-limited auth endpoints.
- **Chat**: direct messages and groups (roles owner/member), read receipts,
  typing indicators, presence, unread counters, keyset pagination.
- **Realtime**: in-process WebSocket hub delivering message.created, typing,
  presence, read, reaction and membership events.
- **Media**: file upload/download with image thumbnails, S3-like storage
  interface, local disk backend, path-traversal protection, 25 MiB limit.
- **Reactions**: emoji reactions on messages with live sync.
- **Search**: substring message search scoped to the user's conversations.
- **Web Push**: VAPID notifications to offline members (optional, needs keys).
- **PWA**: installable app, offline app-shell caching, Web Push service worker.
- **Frontend**: React + TypeScript + Tailwind, dark theme, responsive,
  optimistic UI.
- **Observability**: Prometheus `/metrics` (HTTP, WS, runtime), VictoriaMetrics
  + Grafana dashboard in `deploy/`.
- **Hardening**: security headers (CSP, X-Frame-Options, nosniff), request
  body limits, session cleanup, graceful shutdown.
- **Tooling**: `cmd/keygen` (VAPID keys), `cmd/seed` (demo data),
  GitHub Actions CI with PostgreSQL service.

### Notes
- Video attachments are supported as files; inline playback is planned.
- E2EE is on the roadmap via libsignal; TLS in transit is the current baseline.