Expose API_SIGNATURE (E-Signature API) key scope
Add the E-Signature API scope to the org API-key manager so staff can grant Business orgs programmatic e-sign access. Usage beyond the included monthly allotmen...
Public programmatic e-sign API gateway (API_SIGNATURE scope)
Add /api/public/esign/** to PublicApiController: validates the org API key, requires the API_SIGNATURE scope, rate-limits, and forwards to ESigService's interna...
Internal programmatic envelope API (origin=API) for Business
- EsignInternalController (/api/esig/internal/*): X-Internal-Auth + X-Org-Id authed, called by APIService after it validates the API_SIGNATURE-scoped key; r...
API_SIGNATURE api-key scope + EsignGenericEnvelope.origin
Additive, no version bump: - ApiKeyScope.API_SIGNATURE — gates the programmatic e-signature API (Business) - EsignGenericEnvelope.origin (EsignUsageOrigin, null...
Send-for-signature action + envelope status in document editor
Add a 'Send for signature' button to the template editor header that opens a dialog to send the document to recipients and track signing status, calling the new...
Generic envelope create/send engine (sender side)
Add the OTK-authed /api/esig/envelopes API kamo-internal drives to send documents for signature, reusing the same shared-lib entities the public signing API rea...
Public signing API engine for sign.sign.pink
Implement the /api/esig/public/* signing API the kamo-signer app calls, turning the live signer from preview-stub into a working backend. - validate (recipient...
Back metered add-on prices with a Billing Meter
Stripe (>= 2025-03-31.basil) rejects the legacy usage_type+aggregate_usage metered model ('metered prices must be backed by meters'), so USAGE_BASED add-on pric...
Platform product toggle in Organizations tab
Surface the platform-product designation where it belongs — Platform → Organizations. Adds a gated Switch per org (disabled for the top-level org), a confirmati...
Manage Organization.isPlatformProduct from Platform → Orgs
PlatformAccountSummary exposes isPlatformProduct + hasSubscriptionMarket; new PUT **************** (platform-admin gated) sets the flag and invalidates the org'...
Explicit Organization.isPlatformProduct as entitlement-root signal
Replace the derived 'owns a SUBSCRIPTION market' heuristic with an explicit, admin-set ownership flag. A platform product (e.g. sign.pink) is a white-label prod...
Select the SUBSCRIPTION market for platform setup
KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....
Product root = owns SUBSCRIPTION market, not any market
A customer org (e.g. BluEleven) owns its OWN business markets (RETAIL/MORTGAGE) to run its company while remaining a customer of the KamoCRM platform — its memb...
Scope member entitlements to product root, not KamoCRM
EntitlementService now resolves each member's entitlement root via EntitlementRootResolver (nearest market-owning ancestor-or-self) instead of walking to the to...
Resolve entitlements by product-root org, not platform top-level
Introduce EntitlementRootResolver: the nearest market-owning ancestor-or-self of an org (its product root), falling back to the platform top-level. This decoupl...
Keep org list on background refetch; dedupe session calls
/network re-fired fetchNetworks on every background session refresh and hid the whole list on any fetch error, so a transient blip or a stale hasPlatformAdminAc...
Add envelope recipient, field value, recipient status entities
Check in the in-progress esign model: EsignEnvelopeRecipient (+repo), EsignFieldValue (+repo), EsignRecipientStatus, and an ESignSignerType update. Additive; no...
Add EsignUsageRecord for per-signature usage metering
New append-only usage entity (mirrors AiUsageRecord) emitted at signature completion. Only API-origin signatures count toward a plan's monthly included quota + ...
Revert email link click handlers, isolate cause
User reports email-preview link clicks still do nothing AND text selection is killed mid-drag. Right-click and hover both work, so the anchor element is intact ...
Preserve aspect ratio, never stretch non-square logos
Favicon PNG/ICO frames were produced with keepAspectRatio(false), stretching any non-square logo into a distorted square. Center-fit the logo on a transparent s...
Regenerate favicons on labeling save; sniff real logo type
provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...
Seed globals.css from template when org folder lacks it
provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...
Show full logo with its real extension, not hardcoded .svg
The branding tab built logoFullUrl as logo-full.svg on mount, ignoring the org's logoFullExt. Full logos uploaded as png/jpg/etc. live at logo-full.{ext} in Min...
Refresh TLSStore every loop so newly-issued certs get served
update_tls_store() only ran at startup and on shared-storage imports, so a cert freshly issued by cert-manager (HTTP-01) was Ready with a tls-* secret but never...
Give redirect-only route a backend so Traefik v3 enables it
Traefik v3 disables an IngressRoute router with services: [] when allowEmptyServices is off (as it is here), so the domain-agnostic HTTP->HTTPS redirect router ...
Redirect all HTTP hosts to HTTPS + gate auto-cert to real org domains
Custom org domains (e.g. login.sign.pink) returned Traefik's bare "404 page not found" over plain HTTP: the only port-80 redirect router was hardcoded to *.kamo...
Pre-seed sign.pink + www.sign.pink in STATIC_DOMAINS
sign.pink is a new apex domain (consumer e-signature brand / white-label Kamo tenant org). Pre-seed apex + www so a Let's Encrypt cert exists before first HTTPS...
Persist conversion_error instead of failing silently
Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...
Install turbo via npm in Docker pruner stage; pin pnpm; add .dockerignore
The pruner stage ran `pnpm add -g turbo` before any package.json existed, so corepack grabbed pnpm 11 and failed with "global bin directory /pnpm/bin not in PAT...
New monorepo + mobile-first e-signature signing app
Turborepo + pnpm workspaces monorepo housing reusable e-sign packages extracted from kamo-internal plus a new, ultra-polished kamo-signer app — the second-party...
Full-width enterprise rewrite with live preview
LoanProductForm was a single narrow column (maxWidth: 880) with hardcoded English everywhere. Now uses the same enterprise pattern as the offer page: Layout: -...
Two-column layout with live preview pane
The new-offer page was a tall narrow column on wide screens — wasted half the viewport. Now uses CSS Grid with the form on the left (5fr) and a live "Offer Prev...
Redesign new-offer page as two-column workspace + live preview
You asked for full real estate, modern, polished — last refactor put a single-column form inside a full-width shell, which is exactly the wide half-page-of-empt...
Polish new-offer page — empty state, LOC badge, custom terms
Three UX gaps the offer page had after the prior refactor: 1. Empty state. When a market has no Loan Products yet, the dropdown used to silently render empt...
Per-offer overrides for rate, APR, and origination fee
LoanOfferCreateRequest gains three optional fields — interestRateBpsOverride, aprBpsOverride, originationFeeAmountOverride. createDraft applies them when set an...
Default empty STRIPE_CONNECT_WEBHOOK_SECRET so KamoLOS boots
The configmap referenced **************** without a default, so Spring's placeholder resolver threw before reaching the Java-level **************** which alread...
Track shared-lib LoanRepository → PersonalLoanRepository rename
Updates every import and field type from LoanRepository to PersonalLoanRepository across 20 KamoLOS source files + 1 test (Lombok-injected field names stay as l...
Rename LoanRepository → PersonalLoanRepository
Spring Data JPA derives the repository bean name from the interface's simple class name, not from the @Repository("...") qualifier value, so the prior workaroun...
Add /commerce/personal-loans/new entry + polish market-scoped offer page
The QuickActionsBar "New Loan Offer" action pointed at /commerce/personal-loans/new but no such page existed, so Next.js routed to the dynamic [loanId] page wit...
Full-width enterprise polish across 10 pages
Adopts the modern enterprise pattern (gradient header + breadcrumbs + back arrow + full-height flex shell + card-grouped content on light gray canvas) used else...
Trigger rebuild to pick up renamed PersonalLoan entity
The SecurityService image at 761019b was built before shared-lib d14dc54 (which renamed the personal-loans Loan entity to JPA name "PersonalLoan" to resolve the...
Expose PERSONAL_LOANS in commerce-type & engagement pickers
Adds PERSONAL_LOANS to the COMMERCE_TYPES and EngagementType lists so the new KamoLOS personal-loans market can be created from the markets/new and markets/edit...
Avoid Loan / LoanRepository collision with mortgage app
KamoInitializerService failed to boot because two @Entity classes named 'Loan' and two repository classes named 'LoanRepository' both wanted to register the sam...
T6+T7 frontend polish + org reports + auto-pay UI
Frontend polish (T6): - New lib/format.ts: locale-aware Intl helpers — formatCurrency / formatDate / formatDateTime / formatPercentBps. Replaces hardcoded t...
Tier 6+7+9+10 — frontend polish, org reports, OpenAPI, JaCoCo
T6 (frontend polish): - New /lib/format.ts: locale-aware formatCurrency / formatDate / formatDateTime / formatPercentBps via Intl APIs (replaces hardcoded t...
Tier 4 — LoanPaymentPostingService unit tests
Six mocked-repository unit tests covering the heart of the payment posting: - **************** payment of $100 against loan with $25 fees / $50 interest / la...
Tier 5 compliance batch
- OfacSanctionsService: Jaro-Winkler fuzzy match @ ≥0.92 after exact-match pass. Hits surface similarity score. Configurable via los.ofac.fuzzy-threshold. - A...
LoanChargeOffReasonCode (IRS 1099-C box 6) + audit search
- New LoanChargeOffReasonCode enum (A_BANKRUPTCY..H_OTHER) per IRC §6050P - Loan.chargeOffReasonCode column - **************** multi-filter @Query for regulator...
Tier 3 security + Tier 8 bug cleanup batch
T3 — Security: - New RateLimitFilter (Bucket4j): 1000/min per IP for webhooks, 10/min per session for offer accept/decoder/rescind, 60/min general. Register...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.