Tagged releases
Shipped
Everything in a tagged release, newest first — v0.1.0 through v0.10.2.
66 items The sample library shows the mature-content controls working Twelve public-domain classical works are labelled in the seed catalogue — the kind of fine art a museum genuinely flags — so a fresh install can actually demonstrate the opt-in, the operator switch, and the way unopted viewers simply never see the work. The cover editor uses the room it has Choosing a cover fills the dialog instead of peering through one clipped row, and the crop area grows once a picture is chosen. Two days of testing, answered A patch release built entirely from real use: thirty fixes and refinements found by actually working in the app, from search behaviour to card chrome to the collection editor. Search waits for you to finish typing Suggestions appear as you type, but results change only when you press Enter — and a suggestion never offers a term that finds nothing. Advanced search speaks plainly and copes with catalogues that have thousands of values per field. Browsing keeps up and looks sharp Endless scrolling loads far enough ahead that fast scrolling never hits a blank, grid tiles request the right-sized picture instead of stretching a thumbnail, and the sort control gained a type filter that sees inside multi-asset posts. Visitors can browse public work Marking a post public actually works now, and instances that allow it can be browsed without an account — with every privacy rule verified on that path. Signed-in members finally see public work in their own feed too. Collections hold posts, not loose files Uploads stay in your own space until you turn them into a post; collections and browsing show posts only. Covers you actually choose A collection can carry one cover for its card and a different one for the featured strip, each cropped by dragging a box — with zoom, so an off-centre subject can be framed — and the picture can come from the collection, from your files, or straight from an upload. Every menu works from the keyboard Menus that could not be reached by keyboard at all — including sign-out — are focusable and tabbable, with a test that walks the page to keep it that way. The browse wall was rebuilt on explicit placement The masonry view now computes every tile's position deliberately instead of trusting the browser's guesses, which ends the growing gaps, keeps your place when new work loads in, and stays stable while you scroll. Every view mode got its own identity Grid is a visual wall with details on hover, thumbnails are a working surface with visible controls, list is for metadata work with resizable columns, and the feed is for reading — each tuned separately instead of being one layout at four sizes. Mature content is an opt-in choice on every account Artists mark a work at upload, each viewer decides whether they want to see it, and the instance operator decides whether it is allowed at all. Everything derived from a hidden work — previews, counts, collection covers — respects the same choice. Teams became a way to read the feed A rail of teams sits above browsing and filters the feed in place. You can follow tags the same way, and curate which teams and tags you want at hand. Operators can feature work and run a promo strip Hand-picked collections ride a wide slider at the top of browse, and a full-width promotional band can be placed in the feed, aimed at a chosen audience — invisible when empty. Selecting many things at once works like a desktop Drag a box around tiles, shift-click for ranges, and act on the selection — in every view mode, including inside collections. Search stopped leaking what it hides A work you are not cleared to see no longer answers text queries, suggestions, similarity search, or counts through its hidden title — the entire family of side channels was closed, ahead of what the mainstream search engines document as a known limitation. Dependency hygiene A patch release. Two high-severity advisories in a YAML parser were closed in both lockfiles — the fix was already inside the declared version range, so this was a stale resolution rather than a missing upgrade, and refreshing the lockfiles was enough. The version the software reports about itself was brought back in line with the release it actually is. Permissions became one rule per plane Being allowed to edit something no longer implies being allowed to see it. A team lead can correct a title without being cleared for the artwork behind it. Editing and deleting a file also gained the ownership check they were missing entirely, which in turn delivered team-scoped content management. Deleting is reversible, and visible Every account has a trash page showing what it deleted and how long is left to recover it. Deleting anything now offers Undo. If someone else removed your work, you can ask for it back, and only the person who deleted it (or an administrator) can decide. The feed, the browse layouts, and the surfaces that were half-built Feed view is a real post card — who made it, the image at its own shape, like/comment/share. Operators choose which browse layouts their install offers. The control bar returns when you reach for it instead of only on scroll-up. Files have an edit page, studios have a home page you can follow, and each metadata field has its own settings page. Save someone else's post to your collection Collections could already hold other people's files; posts were the missing half. What lands in your collection is a reference to their post, not a copy — and it changes nothing about who can see it. The image pipeline stopped running out of memory A three-plane memory sampler named the cause rather than guessing at it, and the fixes were measured against the same yardstick: the identical workload went from being killed at its ceiling to finishing with room to spare, at no cost in throughput. Operator configuration The admin config spine. Controlled vocabularies are editable; a field can be a hierarchy with a nested-term tree editor; keywords grow by typing and straight from file metadata (open vocabulary); rich-text fields render as formatted text; any wording the interface ships with, and every transactional email, can be rewritten without forking; and field administration became a capability an operator can delegate. Internal release numbers no longer surface in the UI, and re-seeding an instance serves fresh data without a restart. Visibility correctness Five separate leaks closed under one root cause: read paths that wrote out the "who may see this" rule themselves instead of asking the one component that owns it. Private posts were readable by any signed-in user; one collection route had no permission check at all; a tag filter exposed unpublished work to anonymous visitors on public installs. The rule is now obtained from a single expression, and a test pins that a list can never return something the single-item view refuses. Half-size server image Blender is no longer packaged. It was a third of the image plus the ten X libraries it loaded at startup, and nothing invoked it any more — every 3D format in the reference catalogue already rendered through the three.js worker. 3.64 GB to 1.82 GB, with no configuration change on upgrade. Browse that behaves Cards render at their true proportions, the masonry wall stops reshuffling tiles you are already looking at when more results load, every asset type fades up from a blur instead of flashing blank, and thin audio tiles keep their controls inside the tile. Form controls also gained a visible edge — their border measured below the accessibility floor in both themes. A believable catalogue The bundled demo library nearly doubled, and every studio in it now has real work to show — two had none at all, while one held nearly half of everything. Provenance is recorded per record so any item can be traced back to its source and re-fetched. Public profile pages Every user has a profile page — by username or stable ref — showing their display name, avatar, and the work a viewer is allowed to see. It reuses the existing visibility rules: anonymous visitors see only public work, and only when public mode is on; an owner can opt out of anonymous exposure. Cleared the last dead author and similar-asset links. Shared view controls everywhere The browse view switcher (grid, masonry, thumbnail, list) and sort now appear on profile and post-by-asset pages too, not just the main browse — one consistent control bar wherever assets are shown. Faster 3D previews, multi-file models fixed Open-format 3D (glTF/GLB, FBX, OBJ) now renders through a headless three.js worker instead of Blender — much faster, and arm64 deployments get 3D previews for the first time. Multi-file glTF (a model plus its external data and textures) now renders correctly where it used to fail silently. Blender stays as an automatic fallback. Read-only viewers see the whole catalogue A content-plane read capability lets a read-only role — like the public demo viewer — see every sensitivity tier instead of blank "Preview unavailable" tiles. It grants asset-content reads only: no admin surfaces, no writes. Scheduled actions A generic engine for changes that run at a future time — change sensitivity, soft-delete, change state, notify — cancellable before they fire, each executed atomically with its audit entry so it either fully happens and is logged or fully does not. Audit-log retention + export Per-category retention with legal-hold exemptions and a nightly enforcement pass; a GDPR erasure request anonymises a user across the log while keeping the events; and the whole log exports as streamed CSV or NDJSON over a date range, with IP addresses withheld from callers who can't see them live. Shareable asset pages Assets now have a real /assets/[id] page that opens, reloads and shares correctly; collection tiles previously dead-ended on a Not-found route. A build-time link-integrity check guards against dead internal links. 3D previews on published builds Turntable thumbnails for 3D models had silently stopped generating on released images — the published build shipped without the renderer. Restored for amd64, with a build-and-render smoke so it can't regress unnoticed. Visibility hardening Soft-deleted collections no longer appear to signed-in non-owners, and the IIIF image path enforces the same visibility rule as the browse grid, plus audit and admin-gating cleanups. Public visibility tier + single predicate A public tier for collections and posts, with all three anonymous cases living in one visibility predicate that every read path splices in. Asset browse through the predicate Browse was static generated SQL and the one read path visibility could not reach; converted to hand-built SQL and gated. Anonymous reads Anonymous callers can read public-tier bytes and the list/get operations for assets and collections. This also closed a pre-existing hole where any signed-in account could read any asset or collection by id. Collection-contents gate The last endpoint a public collection page needs. Also closed a hole where any authenticated caller could enumerate the contents of any collection. Public browsing toggle Anonymous access is an operator choice rather than a property of the software, and it is off by default. A fresh install serves nothing anonymously until an operator enables it, and enforcement lives at the API — with it off, anonymous requests are refused rather than merely unlinked. First-boot, login and SSO all keep working with it off. Logged-out frontend Browsing without an account: listing and opening assets and collections, public collection pages that render their contents, and public images — all through the one visibility predicate, writes still authenticated. Public featured rail Curated content featured for a logged-out audience on the front page. Featuring is a placement, not a flag — the same item can be featured publicly and internally with its own order in each, and it never widens access. Jobs admin The whole async pipeline — queue, workers, live counts, failures, per-type concurrency, schedules — readable behind system.jobs.read; requeue and cancel behind system.admin. Storage admin Deduplicated usage (originals vs derivatives, by content type and backend) and a per-family variant inventory, behind system.storage.read. Storage integrity sweeps Orphan scan and checksum verification as batched, resumable job kinds. Findings are advisory — no destructive cleanup yet. Real version in About An anonymous /build-info endpoint replaces the hard-coded placeholder; the displayed licence is AGPL-3.0-only. Help visible to read-only operators Documentation, shortcuts, about, release notes and support are public admin tiles on desktop and mobile alike. Admin UI for read-cap holders The admin menu and route guard gate per tile on the capability each surface actually enforces, so a read-only role can browse what its caps permit. Media derivatives on seed and upload col / hires / screen thumbnails plus video hover-scrub sprite sheets, so the browse grid renders real thumbnails. Read-only admin access A role can hold *.read admin capabilities without the system.admin superuser cap; six previously superuser-only surfaces render read-only. Responsive + accessible UI Fluid from a 390px phone to a 3840px ultrawide with no breakpoint cliffs, a single-column feed view, and WCAG 2.2 AA target sizing on coarse pointers. Featured curation seeded The admin Featured rail and the public collections featured tab both show content on a fresh seed. Admin tiles unlocked (Tier 1–2) Audit-log viewer, per-user sessions and capability grants, resource requests, trash with soft-delete restore, system log, and an API explorer served from the Go binary. Demo mode Env-gated AA_DEMO_MODE — credential hint, fill button, and a read-only banner. Off by default, zero footprint on real installs. Public read-only demo demo.artist-alley.org runs the release image behind a write-blocking edge, seeded, and redeploys on each release. Burnt/Steel brand palette The finalised chevron mark, AA-verified burnt accent and steel secondary, and the configured site name honoured throughout. Job + saved-search fixes Per-type concurrency caps applied in the worker pool; the saved-search notify coordinator no longer spins. Media processing restored The in-process worker pool never claimed jobs on a fresh install, so no thumbnails, previews, transcripts or embeddings generated. Single-binary deploy One Go server with the SvelteKit SPA embedded via go:embed. Postgres plus a storage volume, filesystem or any S3-compatible bucket. Identity, auth + capabilities Sessions, scoped API tokens, roles and capabilities, password policy, and an SSO provider-config surface. Upload → posts → collections Drag-anywhere upload with a background queue, per-row tags and per-asset metadata, and full-text search across all of it. Admin-extensible metadata Operators define typed custom fields per asset-type and per collection, with per-field capability gates and audit history. Universal asset viewer + format coverage One shell hosting image, video, audio, PDF, font and 3D bodies over a shared anchor model — HDR/EXR, HLS video, waveforms, font specimens, glTF/GLB/OBJ/FBX. Federation — ArchivePub v1.0 The reference implementation of the walled-garden federation protocol: signed envelopes, share-list access control, delivery worker, encrypted tiers. Admin + account shells, theme + i18n A capability-gated admin menu with real config surfaces, an account shell, M3-shaped light/dark palettes, and the per-user language foundation.
- v0.10.2 The sample library shows the mature-content controls working
- v0.10.2 The cover editor uses the room it has
- v0.10.1 Two days of testing, answered
- v0.10.1 Search waits for you to finish typing
- v0.10.1 Browsing keeps up and looks sharp
- v0.10.1 Visitors can browse public work
- v0.10.1 Collections hold posts, not loose files
- v0.10.1 Covers you actually choose
- v0.10.1 Every menu works from the keyboard
- v0.10.0 The browse wall was rebuilt on explicit placement
- v0.10.0 Every view mode got its own identity
- v0.10.0 Mature content is an opt-in choice on every account
- v0.10.0 Teams became a way to read the feed
- v0.10.0 Operators can feature work and run a promo strip
- v0.10.0 Selecting many things at once works like a desktop
- v0.10.0 Search stopped leaking what it hides
- v0.9.1 Dependency hygiene
- v0.9.0 Permissions became one rule per plane
- v0.9.0 Deleting is reversible, and visible
- v0.9.0 The feed, the browse layouts, and the surfaces that were half-built
- v0.9.0 Save someone else's post to your collection
- v0.9.0 The image pipeline stopped running out of memory
- v0.8.0 Operator configuration
- v0.7.0 Visibility correctness
- v0.7.0 Half-size server image
- v0.7.0 Browse that behaves
- v0.7.0 A believable catalogue
- v0.6.0 Public profile pages
- v0.6.0 Shared view controls everywhere
- v0.6.0 Faster 3D previews, multi-file models fixed
- v0.5.2 Read-only viewers see the whole catalogue
- v0.5.1 Scheduled actions
- v0.5.1 Audit-log retention + export
- v0.5.1 Shareable asset pages
- v0.5.1 3D previews on published builds
- v0.5.1 Visibility hardening
- v0.5.0 Public visibility tier + single predicate
- v0.5.0 Asset browse through the predicate
- v0.5.0 Anonymous reads
- v0.5.0 Collection-contents gate
- v0.5.0 Public browsing toggle
- v0.5.0 Logged-out frontend
- v0.5.0 Public featured rail
- v0.4.0 Jobs admin
- v0.4.0 Storage admin
- v0.4.0 Storage integrity sweeps
- v0.4.0 Real version in About
- v0.4.0 Help visible to read-only operators
- v0.3.1 Admin UI for read-cap holders
- v0.3.0 Media derivatives on seed and upload
- v0.3.0 Read-only admin access
- v0.3.0 Responsive + accessible UI
- v0.3.0 Featured curation seeded
- v0.2.0 Admin tiles unlocked (Tier 1–2)
- v0.2.0 Demo mode
- v0.2.0 Public read-only demo
- v0.1.2 Burnt/Steel brand palette
- v0.1.2 Job + saved-search fixes
- v0.1.1 Media processing restored
- v0.1.0 Single-binary deploy
- v0.1.0 Identity, auth + capabilities
- v0.1.0 Upload → posts → collections
- v0.1.0 Admin-extensible metadata
- v0.1.0 Universal asset viewer + format coverage
- v0.1.0 Federation — ArchivePub v1.0
- v0.1.0 Admin + account shells, theme + i18n