Route paid signups to checkout after login
After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...
Carry paid ?plan from signup into checkout
When a member signup originates from a paid pricing CTA (?plan=pro|business), drop an apex-domain sp_checkout_plan cookie on completion. kamo-login consumes it ...
Wire internal-auth secret from ***
ESigService now validates X-Internal-Auth against the same shared secret APIService presents **************** from the *** k8s secret), hardening the programmat...
Rebuild for kamo-shared-library update (esign signer email templates)
Picks up the new canonical templates esign.signer_verification + esign.signer_invite so seedForOrg can seed them on first send.
Canonical e-sign signer templates (verification + invite)
Add two platform-wide canonical email templates seeded lazily per org: - esign.signer_verification (step-up OTP: {{code}}, {{name}}) - esign.signer_invite (sign...
Register esign repositories for the meter submission bean
EsignMeterSubmissionService needs EsignUsageRecordRepository, but @EnableJpaRepositories didn't scan com.kamo.z.shared.esign.repos, so the context failed to sta...
E-sign usage metering + consumer self-serve checkout
#4 metering: - EsignMeterSubmissionService (@Scheduled daily): aggregates API-origin EsignUsageRecords per org+period; first 40/period included, the rest subm...
Expose API_SIGNATURE (E-Signature API) key scope
Add the E-Signature API scope to the org API-key manager so staff can grant Business orgs programmatic e-sign access. Usage beyond the included monthly allotmen...
Public programmatic e-sign API gateway (API_SIGNATURE scope)
Add /api/public/esign/** to PublicApiController: validates the org API key, requires the API_SIGNATURE scope, rate-limits, and forwards to ESigService's interna...
Internal programmatic envelope API (origin=API) for Business
- EsignInternalController (/api/esig/internal/*): X-Internal-Auth + X-Org-Id authed, called by APIService after it validates the API_SIGNATURE-scoped key; r...
API_SIGNATURE api-key scope + EsignGenericEnvelope.origin
Additive, no version bump: - ApiKeyScope.API_SIGNATURE — gates the programmatic e-signature API (Business) - EsignGenericEnvelope.origin (EsignUsageOrigin, null...
Send-for-signature action + envelope status in document editor
Add a 'Send for signature' button to the template editor header that opens a dialog to send the document to recipients and track signing status, calling the new...
Generic envelope create/send engine (sender side)
Add the OTK-authed /api/esig/envelopes API kamo-internal drives to send documents for signature, reusing the same shared-lib entities the public signing API rea...
Public signing API engine for sign.sign.pink
Implement the /api/esig/public/* signing API the kamo-signer app calls, turning the live signer from preview-stub into a working backend. - validate (recipient...
Back metered add-on prices with a Billing Meter
Stripe (>= 2025-03-31.basil) rejects the legacy usage_type+aggregate_usage metered model ('metered prices must be backed by meters'), so USAGE_BASED add-on pric...
Platform product toggle in Organizations tab
Surface the platform-product designation where it belongs — Platform → Organizations. Adds a gated Switch per org (disabled for the top-level org), a confirmati...
Manage Organization.isPlatformProduct from Platform → Orgs
PlatformAccountSummary exposes isPlatformProduct + hasSubscriptionMarket; new PUT **************** (platform-admin gated) sets the flag and invalidates the org'...
Explicit Organization.isPlatformProduct as entitlement-root signal
Replace the derived 'owns a SUBSCRIPTION market' heuristic with an explicit, admin-set ownership flag. A platform product (e.g. sign.pink) is a white-label prod...
Select the SUBSCRIPTION market for platform setup
KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....
Product root = owns SUBSCRIPTION market, not any market
A customer org (e.g. BluEleven) owns its OWN business markets (RETAIL/MORTGAGE) to run its company while remaining a customer of the KamoCRM platform — its memb...
Scope member entitlements to product root, not KamoCRM
EntitlementService now resolves each member's entitlement root via EntitlementRootResolver (nearest market-owning ancestor-or-self) instead of walking to the to...
Resolve entitlements by product-root org, not platform top-level
Introduce EntitlementRootResolver: the nearest market-owning ancestor-or-self of an org (its product root), falling back to the platform top-level. This decoupl...
Keep org list on background refetch; dedupe session calls
/network re-fired fetchNetworks on every background session refresh and hid the whole list on any fetch error, so a transient blip or a stale hasPlatformAdminAc...
Add envelope recipient, field value, recipient status entities
Check in the in-progress esign model: EsignEnvelopeRecipient (+repo), EsignFieldValue (+repo), EsignRecipientStatus, and an ESignSignerType update. Additive; no...
Add EsignUsageRecord for per-signature usage metering
New append-only usage entity (mirrors AiUsageRecord) emitted at signature completion. Only API-origin signatures count toward a plan's monthly included quota + ...
Revert email link click handlers, isolate cause
User reports email-preview link clicks still do nothing AND text selection is killed mid-drag. Right-click and hover both work, so the anchor element is intact ...
Preserve aspect ratio, never stretch non-square logos
Favicon PNG/ICO frames were produced with keepAspectRatio(false), stretching any non-square logo into a distorted square. Center-fit the logo on a transparent s...
Regenerate favicons on labeling save; sniff real logo type
provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...
Seed globals.css from template when org folder lacks it
provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...
Show full logo with its real extension, not hardcoded .svg
The branding tab built logoFullUrl as logo-full.svg on mount, ignoring the org's logoFullExt. Full logos uploaded as png/jpg/etc. live at logo-full.{ext} in Min...
Refresh TLSStore every loop so newly-issued certs get served
update_tls_store() only ran at startup and on shared-storage imports, so a cert freshly issued by cert-manager (HTTP-01) was Ready with a tls-* secret but never...
Give redirect-only route a backend so Traefik v3 enables it
Traefik v3 disables an IngressRoute router with services: [] when allowEmptyServices is off (as it is here), so the domain-agnostic HTTP->HTTPS redirect router ...
Redirect all HTTP hosts to HTTPS + gate auto-cert to real org domains
Custom org domains (e.g. login.sign.pink) returned Traefik's bare "404 page not found" over plain HTTP: the only port-80 redirect router was hardcoded to *.kamo...
Pre-seed sign.pink + www.sign.pink in STATIC_DOMAINS
sign.pink is a new apex domain (consumer e-signature brand / white-label Kamo tenant org). Pre-seed apex + www so a Let's Encrypt cert exists before first HTTPS...
Persist conversion_error instead of failing silently
Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...
Full-width enterprise rewrite with live preview
LoanProductForm was a single narrow column (maxWidth: 880) with hardcoded English everywhere. Now uses the same enterprise pattern as the offer page: Layout: -...
Two-column layout with live preview pane
The new-offer page was a tall narrow column on wide screens — wasted half the viewport. Now uses CSS Grid with the form on the left (5fr) and a live "Offer Prev...
Redesign new-offer page as two-column workspace + live preview
You asked for full real estate, modern, polished — last refactor put a single-column form inside a full-width shell, which is exactly the wide half-page-of-empt...
Polish new-offer page — empty state, LOC badge, custom terms
Three UX gaps the offer page had after the prior refactor: 1. Empty state. When a market has no Loan Products yet, the dropdown used to silently render empt...
Rename LoanRepository → PersonalLoanRepository
Spring Data JPA derives the repository bean name from the interface's simple class name, not from the @Repository("...") qualifier value, so the prior workaroun...
Add /commerce/personal-loans/new entry + polish market-scoped offer page
The QuickActionsBar "New Loan Offer" action pointed at /commerce/personal-loans/new but no such page existed, so Next.js routed to the dynamic [loanId] page wit...
Full-width enterprise polish across 10 pages
Adopts the modern enterprise pattern (gradient header + breadcrumbs + back arrow + full-height flex shell + card-grouped content on light gray canvas) used else...
Trigger rebuild to pick up renamed PersonalLoan entity
The SecurityService image at 761019b was built before shared-lib d14dc54 (which renamed the personal-loans Loan entity to JPA name "PersonalLoan" to resolve the...
Expose PERSONAL_LOANS in commerce-type & engagement pickers
Adds PERSONAL_LOANS to the COMMERCE_TYPES and EngagementType lists so the new KamoLOS personal-loans market can be created from the markets/new and markets/edit...
Avoid Loan / LoanRepository collision with mortgage app
KamoInitializerService failed to boot because two @Entity classes named 'Loan' and two repository classes named 'LoanRepository' both wanted to register the sam...
T6+T7 frontend polish + org reports + auto-pay UI
Frontend polish (T6): - New lib/format.ts: locale-aware Intl helpers — formatCurrency / formatDate / formatDateTime / formatPercentBps. Replaces hardcoded t...
LoanChargeOffReasonCode (IRS 1099-C box 6) + audit search
- New LoanChargeOffReasonCode enum (A_BANKRUPTCY..H_OTHER) per IRC §6050P - Loan.chargeOffReasonCode column - **************** multi-filter @Query for regulator...
****************
Used by **************** to reactivate an existing PAUSED plan instead of creating a duplicate row that orphans the paused one.
/api/los proxy HMAC-signs identity headers
When LOS_PROXY_HMAC_SECRET env var is set, the proxy now computes **************** secret) and sends X-Proxy-Signature + X-Proxy-Timestamp alongside the X-Org-I...
Paged repo queries + countByStatus for hot paths
- LoanRepository: countByStatus / countByOrganizationAndStatus + Page<Loan> findByStatus(...) / **************** / **************** + **************** for...