Release notes

New

• syncAdd Supabase bottle sync spike
• syncGeneralize activity reads
• syncGeneralize activity writes
• syncHarden realtime invalidation
• syncPromote Supabase activity mutations
• syncReplace PowerSync activity reads

Fixed

• queryClose Pass 12 invalidation ripples + setup-file drift (audit pass 13)
• securityRe-establish activity write guards after PowerSync removal
• syncRefresh realtime auth token to prevent channel expiry

Faster

• queryHarden realtime invalidation + clear PowerSync residue (audit pass 12)

Faster

• lighthouseTighten browserslist to Next 16 baseline (-55 KB/route)
• powersync-tokenMove to Edge runtime to eliminate cold-start latency
• supabaseStub @supabase/realtime-js to drop ~50 KB/route

Fixed

• timelineDefault day-view photos to [] to stop N+1 fetch

Faster

• Defer Sentry SDK off first-load JS with queue-and-replay (~286 KB/route)
• Drop zod locale bundles from client (~136 KB/route)
• Lazy-load browser-image-compression off photo routes (~50 KB)

Fixed

• a11yReserve dashboard attention zone during hydration (CLS)
• a11yResolve Lighthouse accessibility and CLS audit failures

New

• drizzleMigrate pilot read paths to Drizzle (Phase 1)
• drizzleMigrate remaining read paths to Drizzle (Phase 2)

New

• Add /lighthouse audit + auto-fix slash command

Fixed

• hydrationPatch React #418 at UserSettingsProvider root cause

Fixed

• powersyncSplit UNION ALL bucket params into separate definitions

New

• activitiesAdd explicit-tables watched query hook
• activitiesAdd useActivitiesQuery generic helper
• activitiesMigrate useLatestActivities to PowerSync watch
• dashboardDrop SSR prefetch, render from local SQLite
• dbRestrictive RLS policies for direct PowerSync writes
• diagnosticStorkie takes users with stuck accounts to a diagnostic page
• notificationsThe app no longer includes an unused push notification feature
• offlinePost-login route warmup so all routes work offline
• offlineThe app now preloads modal segments and handles errors for failed loads
• powersyncAdd SQLite row mapper for activity + child profile
• powersyncAuto-recover stuck local SQLite + banner fallback
• powersyncImplement upload handler with SQLSTATE classification and soft-delete RPC routing
• powersyncWire connector.uploadData to new handler
• readsMigrate diaper, medicine, and detail hooks to PowerSync watches
• readsMigrate insights charts and settings export to PowerSync watches
• sharingPersist invitation custom_message end-to-end
• swMigrate from hand-rolled SW to Serwist
• timelineMigrate reads to PowerSync watches + restore caregiver attribution
• transportFlip activity write transport to PowerSync
• transportIntroduce ActivityTransport interface with server-action impl

Fixed

• accessStop showing viewers as Owner and prevent ghost writes
• attributionAccept Clerk user IDs in displayNameUserIdsSchema
• authIf you are offline, Storkie redirects you to sign-in
• authSign-in redirects are blocked when you are offline
• buildDrop dead options param + sweep notification leftovers
• buildPin engines.node to single major to silence Vercel warning
• buildSilence 155 Vercel preview warnings and local dev warnings
• chatDefer generateSessionTitleIfNeeded via after() so it survives response
• dashboardThe dashboard hides the first-use welcome if the child profile is resolved
• dashboardThe Activities page redirects to sign-in when needed
• dashboardThe dashboard shows loading profiles during data loading
• dashboardThe greeting on the dashboard is always reachable
• dashboardThe dashboard displays skeletons during the initial loading of data
• dashboardThe dashboard shows skeletons during data re-sync instead of empty cards
• dashboardThe dashboard safely shows the status of data loading
• dashboardThe dashboard no longer keeps grid cards loading when data arrives
• dashboardThe dashboard's loading skeletons are tinted with the activity card color
• dashboardThe dashboard's grid card skeletons are no longer stuck when data arrives
• dbAlign invitations user FKs with schema source (migration 099)
• emailThe sender display name in invitation emails is now set to 'Storkie'
• envGate VAPID strictness on VERCEL=1, not just NODE_ENV
• hydrationKill three React #418 sources on dashboard
• insights,swInsights shows correctly when the app is offline
• inviteThe app allows new invitees to complete the onboarding flow without issues
• inviteUse service-role client to read invitations by token
• layoutGuard CSS height vars against zero ResizeObserver entries
• migrationBackfill default_timeline_view 'summary'→'day'
• modalsViewers no longer see a prompt when trying to close without saving changes
• observabilityTag silent failure paths in child-profile fetch
• offlineCache Clerk's CDN bundle in SW (stale-while-revalidate)
• offlinePersist TanStack Query cache to localStorage
• offlinePreload nested photo modal chunks
• offlineUse direct import() to preload modal chunks
• persistUse stable buster instead of per-commit SHA
• powersyncClassify P0001 and PGRST* as non-retryable
• powersyncPowerSync no longer initializes until you sign in
• powersyncPowerSync does not start on the login page when you are signed out
• powersyncDrop cancelled flag so in-flight init completes
• powersyncThe app now prevents double initializations during PowerSync
• powersyncPowerSync now depends on the session cookie for initialization
• powersyncHoist provider above key={userId} subtree to stop double-init
• powersyncLatch init flag synchronously to close async race window
• powersyncMake recovery offline-aware + cache /@powersync/ in SW
• powersyncStop double-init by stabilizing provider's reconciliation slot
• powersyncSurface connect() failures via console
• powersyncTimeout waitForReady to surface stuck schema init
• powersyncUse correct RPC parameter names in upload handler
• powersyncUse static worker URLs for Turbopack compatibility
• pwaCache /_next/static/ chunks for offline dynamic imports
• readsRoute useActivitiesQuery through explicit-tables watch
• rlsCaregivers can see each other's names in the child profile
• securityClose anon EXECUTE on SECURITY DEFINER fns via REVOKE FROM PUBLIC
• securityClose Pass 6 audit gaps
• securityHarden PowerSync write path against IDOR and mass-assignment
• securityPass 4 defense-in-depth — chat ownership, rate limits, validation, hardening
• sentryCorrect project slug from 'javascript-nextjs' to 'storkie'
• sharingThe dropdown menu for sharing now indicates clickable options with a cursor pointer
• sharingMake accept_invitation_atomic actually executable (3 follow-up migrations)
• sharingMake acceptInvitation atomic via SECURITY DEFINER RPC
• sharingRefetch shared access on mount/focus for cross-device invitee acceptances
• sharingSanitize invitation custom_message against control + bidi spoofing
• splashAdd 5s safety-net dismiss for offline cold-start
• sw,proxyAllow Serwist SW to register on protected routes
• swCache /_next/static/ chunks for offline modal loads
• swCache same-path redirects so post-signin /dashboard works offline
• swDrop illegal RequestInit when constructing cache key
• swDynamic-import @serwist/next so it actually runs in build
• swFallback to cached /dashboard for unvisited routes offline
• swHoist isDevHost declaration above all cache branches
• swignoreSearch on /_next/static/ cache keys
• swignoreSearch on navigation cache lookup
• swMatch navigation HTML cache by pathname only, ignore query
• swPrecache splash + branding assets for offline cold-start
• swScrape chunk URLs from HTML and precache full graph
• swStrip ?dpl=... when matching precached static assets
• swSwitch to @serwist/cli for SW generation
• themeAdd --destructive-text token for AA-contrast destructive copy
• timelineHandle Map-or-Record from photos enrichment
• timestampsNormalize via datetime() in all SQLite range filters
• uiCursor-pointer on dropdown menu items system-wide
• user-settingsTag localStorage cache with userId, clear on mismatch

Faster

• powersyncPre-warm token + boot instrumentation

Fixed

• powersyncMake PowerSyncProvider SSR-safe to fix React #310

Fixed

• pwaThe install banner is hidden during the welcome onboarding tour

Fixed

• powersyncPrevent React hook count mismatch in PowerSyncProvider

Reverted

• Roll back Clerk from v7 to v6.39.2

Fixed

• envSkip server-only POWERSYNC_JWT_SECRET check in browser

New

• clerkUpgrade to @clerk/nextjs v7 (Core 3)
• powersyncAdd PowerSync packages, token route, and env config
• powersyncAdd production schema, connector, provider, and sync rules
• powersyncAdd Railway deployment config
• powersyncAdd Railway PowerSync URL to CSP connect-src
• powersyncWire PowerSyncProvider into app component tree

Fixed

• powersyncAdd sync_rules path to service config
• powersyncHarden env validation and pin service image
• powersyncPrefix env vars with PS_ for PowerSync config parser
• powersyncRevert to direct connection with verify-full SSL (IPv4 add-on enabled)
• powersyncUse session pooler for IPv4 and relax sslmode
• powersyncUse sslmode disable for pooler compatibility test
• securityUpdate @clerk/nextjs to 6.39.2

New

• uxThe camera and notification permission prompts have been improved

New

• brandingThe Storkie brand is now present across the app
• brandingStorkie is added to not-found pages and invitation emails
• chatThe chat includes a split-beak talking animation for the Storkie avatar
• chatScroll behavior and Storkie avatar consistency have been improved in chat
• chatThe chat features Storkie mascot, idle animations, and sizing for empty states
• growthA Growth & Milestones page stub has been added
• navThe bottom navigation has been restructured with a center button and seven items
• onboardingThe onboarding process includes a color and confetti celebration, enhancing the visual experience
• settingsYou can edit your display name in the settings
• splashThe splash screen shows Storkie flying across the screen during loading
• timelineThe timeline shows which caregiver recorded each activity entry
• welcomeThe welcome section includes a carousel that walks through the pre-auth feature

Fixed

• Align tests with source changes and upgrade Next.js to 16.2.3
• authThe app can now use Google accounts for sign-in
• chatThe chat animation plays for the Storkie avatar only during streaming
• dbDeploy create_child_profile_with_owner RPC as migration
• navThe navigation button moves below the border and has no ring overlay
• navThe navigation button's ring now covers the top border line
• nursingRound fractional durations to integers before DB insert
• perfThe app no longer shows flickers or loading delays
• settingsThe settings page has an easier way to edit display names
• settingsThe app reads your display name from the database
• settingsSettings show only the first name for display
• timelineThe timeline now has increased spacing between activity cards
• uxThe dashboard and timeline have an improved first-use experience

Fixed

• Time labels are now capitalized, and attention or overdue cards have a red badge
• Effect audit pass 3 — adjust-state-during-render and stable dep cleanup
• All activity fields are now available in the chat feature
• The grid card is easier to tap with a new shadow and chevron
• The latest activities for pumping now include mL columns for each side
• The Customize Cards button is now below the grid for easier access
• The attention sheet only shows when you first load the app, not after navigating
• The app now limits attention cards to 2 and renames the label, excluding activity type
• The chat input now automatically resizes for multi-line editing
• Resolve lint error and align stale test assertions
• The settings now has the Smart Insights toggle back, and chat copy has no em dashes
• Card management has a new style with drag-to-reorder and compact rows
• The activity strip shows a centered grid, readable labels, and timer indicators
• All activity columns are shown from the latest activities
• Unify chat markdown rendering through MemoizedMarkdown
• Upgrade drizzle-orm to 0.45.2 to patch SQL injection vulnerability
• Use vitest run in verify:ci to prevent watch mode blocking

Fixed

• Align test assertions with activity_type in update mutations
• Pass activity_type in update mutation for proper server-side handling