v0.6.0 (2026-09-12)

v0.6.0 focuses on release gates, Supabase free-tier keepalive/auto-restore, and operational evidence. The passkey session bridge was completed after the release and is tracked under Unreleased until the next patch release.

Highlights

• Health readiness contract: /api/health distinguishes required and optional dependencies and reports ready, degraded, and Supabase status.
• Keepalive: Vercel Cron and a daily GitHub Actions health check issue a lightweight Supabase query so an idle free-tier project is not paused.
• Auto-restore: A scheduled workflow checks the Supabase Management API and restores an INACTIVE project, then waits for database readiness.
• Release operations: v0.6.0 runbook, production smoke matrix, rollback runbook, and pnpm check:release-docs add reproducible evidence gates.
• Security/config: CI now checks migrations, RLS, Supabase boundaries, release docs, dependency vulnerabilities, and configured security headers.

Upgrade Notes

1. Apply migrations 022-025 before deploying the application.
2. Keep HEALTHCHECK_URL, SUPABASE_PROJECT_REF, and SUPABASE_ACCESS_TOKEN in GitHub repository variables/secrets for auto-restore.
3. Keep Supabase and application secrets in Vercel Secret/Sensitive variables; never place them in .env files committed to Git.

Unreleased: Passkey login

Passkey assertion verification now bridges to a real Supabase session through a server-only, single-use magiclink token. The browser receives only the Supabase SSR HttpOnly cookie; tokens, action links, email addresses, and user IDs are not returned. Users with a verified MFA factor continue through the aal2 challenge.

Enable it only after deploying this version:

NEXT_PUBLIC_FEATURE_PASSKEY=true
NEXT_PUBLIC_FEATURE_PASSKEY_LOGIN=true

Both values are build-time flags and should be stored as Vercel Secret/Sensitive environment variables. Passkey requires HTTPS (localhost is the development exception).