Changelog — April 10, 2026

✨ New Features

• Retouched version guard (API) — The hard guard that blocks transitioning a project to CLIENT_VALIDATION when any selected asset lacks a retouched version has been re-enabled. This prevents incomplete deliverables from reaching client review. #PR-368

• Mobile app UX overhaul — Comprehensive improvements to the etouch mobile app: sheet scrolling fixes, header action menus for session management, consumable add/remove flows, Plus buttons across all screens, and new ColoramaFormSheet. Replace iOS-only ActionSheetIOS with cross-platform BaseSheet components and add StepperSheet for multi-step wizards. #PR-368

• Image format negotiation (API/Web) — The API now reads the Accept header to automatically serve AVIF (~50% smaller) or WebP (~30% smaller) based on browser capabilities. Next.js image optimization configured with AVIF/WebP formats and a 7-day cache TTL. #PR-368

• Deep health check endpoint — /healthz now pings the database and Redis connection, returning a 503 degraded status when either is unavailable instead of always returning 200. #PR-368

🐛 Bug Fixes

• Watermark logic & concurrency — shouldApplyWatermark() now correctly returns true only for unauthenticated or client-only viewers; studio/retoucher/admin users receive unwatermarked images. getWatermarkedImage() now properly acquires the transform semaphore, and load shedding returns 503 with Retry-After instead of silently serving wrong content. #PR-376

• Upload queue null guards — Replaced non-null assertions with safe null guards for uploadQueueRef across three code paths to satisfy Biome linting and improve runtime safety. #PR-375

• Vercel preview auth — Added *.vercel.app wildcard to trustedOrigins so Better Auth accepts requests from preview deployments. #PR-374

• Password reset on preview — Fixed the auth proxy endpoint path from forget-password to request-password-reset (Better Auth v1.5.6). Also fixed relative redirectTo paths and origin rewriting so reset email links work correctly from preview domains. #PR-370, #PR-372, #PR-373

• Auth proxy rewrite conflict — Removed the /api/auth rewrite in next.config.mjs so the Route Handler proxy takes over correctly. v1.30.6

• TypeScript Control type assertions — Fixed Control type assertions in create-guideline, create-project, create-retoucher, create-studio, and session-to-project dialogs. v1.30.4

• Biome lint formatting — Applied biome check --write across all packages to fix line wrapping, import ordering, and trailing newlines that were causing CI failures. #PR-369

♻️ Refactoring & Technical Improvements

• Remove ignoreBuildErrors — Fixed all TypeScript errors in apps/web so tsc --noEmit passes cleanly, then removed typescript.ignoreBuildErrors from next.config.mjs. Includes SDK type fixes, Zod v4 migration, GraphQL codegen type alignment, and proper null handling. #PR-368

• Structured logging — Replaced console.* calls with pino logger in stripe-client.ts and annotation-pdf-generator.ts for better observability with structured fields. #PR-368

• Remove unsafe as any casts — Added optional id field to ProjectAccessInfo type and used readonly string[] tuples for Array.includes() instead of casting values to any. #PR-368

• Zod validation on webhook route — Replaced unsafe as cast with Zod schema validation on the workflow webhook payload. #PR-368

• Sharp corners UI enforcement — Removed all rounded corners from dashboard donut chart, sync buttons, FTP import dialog, and team dropdown per project design constraints. #PR-368

• Mobile consistency refactor — Created useThemeColors() and useStackScreenOptions() hooks, replaced hardcoded French time slot labels with i18n, harmonized placeholderTextColor, converted inline styles to Tailwind, and removed dead code. #PR-368

📦 Dependencies & Infrastructure

• Docker build optimization — Added --ignore-scripts to pnpm install in Docker to skip heavy postinstall scripts, then explicitly runs prisma generate afterward for faster, more reliable builds. #PR-368

• 10 releases published — v1.30.4 through v1.31.7 released via automated semantic-release pipeline.