Changelog

What shipped

• i18n via next-intl. Locale switcher in the topbar. Bundles for en / pt-BR / es covering nav, settings, admin sidebar, and common UI.
• Enterprise SSO through Better Auth's generic-oauth plugin. Configure any OIDC IdP via env vars (Okta / Auth0 / Azure AD / Google Workspace / Keycloak).
• Session inventory at /settings/sessions — list active sessions, revoke individually or all-others-at-once. Includes a "new-device-login" alert email when a fresh IP signs in.
• Maintenance mode — admin toggle that returns 503 + Retry-After on every mutation except admin/auth/webhooks. Banner component for the marketing site when configured.
• Demo seed — bun run seed:demo populates a fresh clone with 5 users, 2 orgs, todos, audit log, AI usage rows, and a converted affiliate referral.
• Notification preferences at Settings → Notifications. Security + transactional locked opted-in; marketing / digest / billing user-controllable.
• Activity feed at /activity — user-facing audit log scoped to your orgs.
• Public cookie policy at /cookies and public changelog at /changelog (this page).
• Webhook ping endpoint — customers can fire a test delivery before going to prod.
• apiVersion field on every outbound webhook envelope for forward-compat.
• API reference at /api-reference powered by Scalar, consuming the live OpenAPI spec.

New

• Public /pricing page with monthly/yearly toggle, free/basic/pro comparison, and a single shared plan config in @achoai/shared/plans.
• Landing page: How It Works, Testimonials, Tech Stack, Pricing preview, FAQ (native <details>), and Newsletter sections.
• Multi-tenant UI: org switcher in the topbar, /settings/team (members, invites, role changes), and /invite/[token] accept flow.
• GDPR: dedicated /cookies policy page, GET /user/export for portability, consent versioning with auto-reprompt on bumps.
• Onboarding wizard at /onboarding that walks new users through profile + workspace.
• Contact form at /contact backed by a rate-limited POST /api/contact.
• Email templates: invoice, security-alert, invitation (replacing inline HTML), digest.

Improved

• <CookieConsent /> now stores { version, choice, acceptedAt } instead of a bare string, so consent migrations are explicit.
• QueueDash admin route now uses a client loader so next build --webpack doesn't trip on dynamic({ ssr: false }) in a Server Component.

New

• audit_log table (RLS-scoped, FORCE ROW LEVEL SECURITY) with an Elysia plugin that auto-records 2xx mutations and exposes auditLog.record() for nuanced cases.
• ai_usage table and ai-rate-limit plugin enforcing a rolling 30-day token cap per organization (PLAN_LIMITS.aiTokens). Records usage from streamText's onFinish callback.
• Upload upgrade: tenant-scoped paths ({orgId}/{uuid}.{ext}), plan-bounded size via assertUploadSize, streaming straight to Bunny via uploadStream, one audit row per successful upload.
• Cron digest via BullMQ repeatable: scheduleDigest() registers a daily 9am UTC job with a stable jobId so restarts stay idempotent.
• Default job options: attempts: 3, exponential backoff from 1s. Redis client enforces maxRetriesPerRequest: null (BullMQ requirement).