Account recovery and onboarding links retain the requesting Bookcicle or Studio host during the transition.
Compatibility
- Existing Bookcicle password recovery and onboarding links stay on bookcicle.com while the Studio cutover is prepared.
- Requests from the dedicated Studio origin use studio.bookcicle.com; other brands keep their own account links.
- Unknown origins never become account-recovery destinations.
- repo
- bookcicle/ui
Product policies describe enabled services and shared security readiness.
Updated
- Curated Privacy, Terms, Cookies and Security views for each brand with product-specific data, sharing and deployment boundaries.
- Added SOC 2 Type II readiness status without claiming a completed examination.
- Bookcicle retains broader policies covering shared practices and all brands.
- Release-history filters activate when their page controls are ready, so early clicks are handled reliably.
- Completed shared controller and release compatibility checks for the policy rollout.
- Clarified encryption for service endpoint connections and the stronger protection for supported credential values.
- Verified the distinction between service endpoint encryption and zero-knowledge credential protection.
- repo
- bookcicle/ui
Product policies describe enabled services and shared security readiness.
Updated
- Curated Privacy, Terms, Cookies and Security views for each brand with product-specific data, sharing and deployment boundaries.
- Added SOC 2 Type II readiness status without claiming a completed examination.
- Bookcicle retains broader policies covering shared practices and all brands.
- Release-history filters activate when their page controls are ready, so early clicks are handled reliably.
- Completed shared controller and release compatibility checks for the policy rollout.
- Clarified encryption for service endpoint connections and the stronger protection for supported credential values.
- Verified the distinction between service endpoint encryption and zero-knowledge credential protection.
- repo
- bookcicle/ui
Product policies describe enabled services and shared security readiness.
Updated
- Curated Privacy, Terms, Cookies and Security views for each brand with product-specific data, sharing and deployment boundaries.
- Added SOC 2 Type II readiness status without claiming a completed examination.
- Bookcicle retains broader policies covering shared practices and all brands.
- Release-history filters activate when their page controls are ready, so early clicks are handled reliably.
- Completed shared controller and release compatibility checks for the policy rollout.
- Clarified encryption for service endpoint connections and the stronger protection for supported credential values.
- Verified the distinction between service endpoint encryption and zero-knowledge credential protection.
- repo
- bookcicle/ui
Product policies describe enabled services and shared security readiness.
Updated
- Curated Privacy, Terms, Cookies and Security views for each brand with product-specific data, sharing and deployment boundaries.
- Added SOC 2 Type II readiness status without claiming a completed examination.
- Bookcicle retains broader policies covering shared practices and all brands.
- Release-history filters activate when their page controls are ready, so early clicks are handled reliably.
- Completed shared controller and release compatibility checks for the policy rollout.
- Clarified encryption for service endpoint connections and the stronger protection for supported credential values.
- Verified the distinction between service endpoint encryption and zero-knowledge credential protection.
- repo
- bookcicle/ui
Add the separate Redline surfaces and document workspace integration. Deployment remains a separate release step.
Changes
- Remove developer dashboard and API keys from customer account navigation.
- Use document-focused subscription descriptions while preserving comparison-unit accounting and the existing checkout infrastructure.
Hardened Redline review mode entitlements, postMessage bridge origin validation, fail-closed HMAC webhook signatures, unified layout locking, and comparison-wide decision replaying across virtualized chunks.
Security
- Removed embed-class plan bypass in review mode authorization in favor of comparison owner manifest plan and account tier validation.
- Added strict postMessage source and origin validation to prevent unauthorized windows from mutating review state.
- Defaulted SDK embed origin to the official Redline service origin with strict message origin checking.
- Hardened HMAC-SHA256 signature computation and automated webhook dispatching to fail closed on missing secret or signing errors.
- Validated 64-character hex digest length before timingSafeEqual buffer comparison in the webhook verification receiver.
Improved
- Locked viewer layout in Unified mode while Review Mode is active to prevent split pane desynchronization.
- Preserved canonical artifact change IDs (e.g. mkt-*, h-chg-*) across chunk annotation and manifest generation.
- Added comparison-wide decision tracking and automatic decision replay when virtualized chunks are mounted into slots.
- Filtered out nested change groups during review session initialization to align with top-level action bars.
- Assembled clean resolvedHtml exports without presentation wrappers, unchanged region toggles, or unmounted placeholders.
- Accurately represented partial review completion with remaining unresolved change counts and matching webhook event types.
- repo
- bookcicle/ui
Prunes empty list items and block elements left by rejected insertions or accepted deletions, locks out Split mode during active review, and presents a floating Finish Review prompt when all changes are resolved one-by-one.
Fixed
- Prunes empty list items (li) and parent lists (ul, ol) when an inserted bullet is rejected or deleted bullet is accepted, eliminating dangling bullet markers in rendered documents.
- Prunes effectively empty block containers (p, blockquote, headings) when resolving block-level revisions without leaving unsightly blank lines.
- Strictly disables Split view buttons and blocks layout switching via postMessage during active review to maintain inline action bar alignment and DOM synchronization.
Improved
- Hides bulk Accept All and Reject All options once all changes have been resolved one-by-one, leaving Finish Review as the single actionable choice.
- Displays a floating Finish Review confirmation prompt in the bottom-right corner when all changes are reviewed, ensuring users never miss completing the review.
- Supported redline:resolveChange postMessage bridge event in addition to individual accept/reject change commands.
Validation
- Unit tests in reviewEngine.test.js and redlineAccept.test.js covering empty bullet and container pruning across single bullets, isolated paragraphs, and full list cleanup.
- Playwright E2E coverage in redline-review-callbacks.spec.mjs asserting bullet removal, split view locking, and floating finish completion interaction.
- repo
- bookcicle/ui
Introduced interactive track changes review mode with in-place DOM accept and reject actions, bidirectional postMessage event bridge, drop-in SDK, and HMAC-SHA256 signed webhooks tiered for Creator and Creator Pro plans.
Added
- Creator Plan: Interactive review mode in Redline viewer and embed iframes with top progress toolbar (changes remaining, bulk accept/reject, finish review) and inline Accept/Reject buttons for every tracked change.
- Creator Plan: Standard bidirectional postMessage event protocol (redline:changeResolved, redline:reviewComplete, redline:startReview, redline:acceptChange, redline:rejectChange, redline:acceptAll, redline:rejectAll, redline:requestState).
- Creator Plan: Drop-in Redline Embed SDK (/scripts/v1/redline.js) with clean initialization, lifecycle event handlers, and imperative review controls.
- Creator Pro Plan: Server-side automated document commit callbacks and signed HMAC-SHA256 webhooks (X-Redline-Signature, X-Redline-Event) upon review completion.
- Interactive configurator workbench live callback event console and updated documentation for SDK and Webhooks integration.
Improved
- Updated Redline pricing matrix detailing Creator and Creator Pro interactive review and webhook callback tiers.
- repo
- bookcicle/ui
Configured Showcase 1 on the hosted iframe demo page as a dedicated interactive review demo, added review mode presets and controls to the deeper playground workbench, and added explicit tier notes to the pricing cards.
Added
- Configured Showcase 1 on /iframe-demos as a dedicated interactive Track Changes Review demo with live toolbar toggle, review parameter initialization, and isolation from standard comparison showcases.
- Added global review controls (Start Review, Accept All, Reject All) to the sticky Master Playground bar for simultaneous multi-pane testing.
- Added a 1-click 'Try Review Mode Preset' button to the developer configurator workbench to quickly initialize review mode and inspect callbacks.
- Added explicit review tier notes inside each pricing card clarifying interactive review for Creator and signed HMAC webhooks for Creator Pro.
Improved
- Supported bidirectional redline:exitReview postMessage command to dynamically close review mode inside embedded iframes.
- Updated iframe embed copy snippets to reflect review demo configurations.
- repo
- bookcicle/ui
Career reports show supported issue findings when the asynchronous review is ready.
Improved
- Authenticated owner reports show grounded résumé issue findings and suggestions when available. Missing or invalid issue data leaves every existing report section usable.
- Free previews can show up to three prioritized document checks in a compact experiment card with a path to full analysis.
- repo
- bookcicle/ui
- commit
- f8f0da682c3029c892cddc5cb400271644ab9c8e
Deeper résumé issue reviews can recover from an incomplete AI response before showing findings.
Fixed
- Issue reviews retry an invalid response once before marking findings unavailable. Existing report sections remain usable when no valid review is available.
- The retry preserves source quotations, the selected model, and the review’s time and cost limits.
- Temporary conflicts between parallel report steps retry within a minute. An unavailable optional review leaves the other report content usable.
- repo
- bookcicle/bookcicle-openai
- commit
- d4308eac3cd1ab7d381b24e60ba1eee5b17e37c2
Excludes the unreleased FuncSpace labs tile from the production Bookcicle homepage while retaining it in development and test environments.
Changed
- Tagged the FuncSpace labs tile on the Bookcicle homepage with brand data attributes and pruned it during production build and surface hydration.
- Preserved FuncSpace labs discovery in development and test environments for active research and review.
Validation
- Unit tests in company_routes.test.mjs asserting production pruning and dev/test retention.
- Playwright E2E coverage in company-marketing.spec.mjs verifying brand tile integrity.
- repo
- bookcicle/ui
Funcspace DEV is registered as a publisher draft with passed package checks and a verified API domain.
Improved
- Bookcicle publisher verification, Funcspace DEV draft registration and domain verification are complete.
- The AWS deployment and nine anonymous live DEV checks passed. OAuth linking, real ChatGPT scenarios and public review remain separate gates.
- repo
- bookcicle/ui
Funcspace uses the established Bookcicle AWS runners for deployment, publication operations and live form checks.
Improved
- Funcspace deployment and smoke workflows use the existing AWS runner pool.
- Funcspace DEV publisher domain is verified; OAuth connection and real ChatGPT acceptance remain in progress.
- repo
- bookcicle/ui
Direct PDF/DOCX input uses a 750 KiB combined threshold; larger pairs use uploads. Hosted retention and viewer token lifetimes are clarified.
Improved
- PDF and DOCX pairs up to 750 KiB combined use direct input; larger pairs use the existing upload flow. Lambda retains 2 MiB acceptance headroom.
- Standard inline and direct API examples require no client-side hash header. Direct DOCX/PDF smoke lanes validate the documented threshold.
- Privacy and expired-viewer wording distinguish temporary uploads, configurable hosted retention, and separate viewer token expiry.
- repo
- bookcicle/ui
Direct PDF/DOCX input uses a 750 KiB combined threshold; larger pairs use uploads. Hosted retention and viewer token lifetimes are clarified.
Improved
- PDF and DOCX pairs up to 750 KiB combined use direct input; larger pairs use the existing upload flow. Lambda retains 2 MiB acceptance headroom.
- Standard inline and direct API examples require no client-side hash header. Direct DOCX/PDF smoke lanes validate the documented threshold.
- Privacy and expired-viewer wording distinguish temporary uploads, configurable hosted retention, and separate viewer token expiry.
- repo
- bookcicle/ui
Release history now lives on the parent Bookcicle website with the original cards and product filters.
Changed
- Restored the original release-note layout, product filters, version details, and brand chips on the parent Bookcicle website.
- Studio release-note links and legacy URLs open the parent release history.
- Renamed the Bookcicle and Desktop chips to Bookcicle Studio and Bookcicle Studio Desktop, and added brand logos and a Redline filter.
- External brand tiles open in a new browser tab, keeping the company portfolio available.
- Linked the shared Brand Assets page from the company footer, with grouped logos and existing brand color palettes.
- Restored the canvas-wave footer with company information, social links, and the original support and legal links.
- Clarified the core and brand-specific security policies, including OurSircle’s end-to-end encrypted, zero-knowledge credential architecture.
- repo
- bookcicle/ui
Live acceptance checks cover field-level repair, preserved draft content and stale-version recovery.
Improved
- The DEV/TEST smoke lane exercises malformed section feedback, corrected sourced updates, removals and version conflicts using disposable private previews.
- Formal Funcspace plugin packages include curated profile-building and company-discovery skills; client registration and acceptance remain separate gates.
- repo
- bookcicle/ui
Redline pre-rendered routes, CloudFront rewrites, and navigation states retain direct URL targets upon page refresh.
Fixed
- Ensured Redline page refreshes retain the target route and active view across pre-rendered routes and viewer shells.
- Aligned CloudFront routing policy to distinguish pre-rendered assets from fallback SPA routes.
Improved
- Streamlined Redline top menu for developer focus and consolidated API authentication and signature notes.
- repo
- bookcicle/ui
Bookcicle Studio
production