Changelog

Financial Health Score, spending forecast with 95% CI, Explainable AI panel, and z-score display on anomaly cards.

• NewFinancial Health Score (0–100) — composite of savings rate (45%), HHI concentration (20%), trend (15%), anomaly count (10%), deficit/surplus (10%); rendered as SVG ring on insight cards
• NewSpending forecast — OLS extrapolation to next month with RMSE-based 95% confidence interval (requires ≥3 months of data)
• NewExplainable AI panel — collapsible section on each insight showing every expert rule that fired, its severity, and confidence score
• NewZ-score badges on anomaly cards — surfaces the statistical deviation value (e.g. 3.2σ) for each flagged transaction
• NewEngine confidence displayed as a badge next to the model identifier on each insight card
• ChangedInsightPayload now stores forecast, healthScore, confidence, and findings in the DB alongside summary, categories, and recommendations

Replaced OpenAI with a custom-built FinanceAI engine — BM25 retrieval, linear regression, expert rules, and intent-based chat. Zero external AI dependency.

• NewFinanceAI engine (src/lib/ai/) — multi-strategy AI built from scratch, no external API
• NewBM25 probabilistic retrieval — Elasticsearch-class algorithm over a 38-document financial knowledge base
• NewLinear regression trend detection — OLS slope over monthly expense data (increasing / decreasing / stable)
• NewHerfindahl-Hirschman Index — DOJ antitrust metric adapted for spending concentration
• NewExpert rule engine — 10 typed financial rules with confidence scores (deficit, savings rate, concentration, anomaly, trend)
• NewNLG composer — 3 summary templates selected by financial health profile; context-aware category and anomaly reasons
• NewIntent-based chat engine — keyword-scored intent detection with referential pronoun resolution
• Changedinsights/route.ts — swapped OpenAI fetch for generateInsights()
• Changedinsights/stream/route.ts — swapped OpenAI streaming for streamInsightSummary()
• Changedchat/route.ts — swapped OpenAI streaming chat for streamChatAnswer()
• ChangedRemoved OPENAI_API_KEY from env.ts and .env.example
• ChangedModel identifier in DB insight records changed from gpt-4o-mini to finance-ai-v1

Major UX overhaul — toast notifications, FAQ accordion, pricing toggle, drag-and-drop uploads, demo dataset, keyboard shortcuts, and full SEO setup.

• NewToast notification system with success/error/warning/info types, auto-dismiss, and stacking
• NewFAQ accordion on landing page and /pricing — CSS grid-template-rows animation, no max-height snapping
• NewAnnual / monthly billing toggle on landing and /pricing — Pro plan $9/mo or $7/mo (billed $84/yr) with Save 20% badge
• NewDrag-and-drop CSV upload zone on every dashboard dataset card with live visual feedback
• NewOne-click demo dataset loader in empty dashboard state — 47 transactions, built-in anomaly spike
• NewKeyboard shortcuts panel (press ?) — N focuses new dataset input, arrow keys paginate, Esc closes
• NewSample CSV download button in landing page hero
• Newrobots.txt and sitemap.xml via Next.js Metadata API
• NewDataset search — server-side name filtering with 300ms debounce
• NewDataset sort — Newest, Oldest, A→Z, Z→A via API query params
• NewCreated timestamps on each dashboard dataset card
• NewPassword strength meter on registration form (Weak / Good / Strong)
• NewQuick-stats pills on insight cards — top category, anomaly count, recommendation count
• NewJSON-LD structured data (schema.org/SoftwareApplication) in root layout
• NewPublic /changelog page
• FixedHSTS header — Strict-Transport-Security was claimed in the About page but missing from next.config.ts
• FixedTiltCard relative positioning — production-grade feature cards had absolute overlays escaping card boundaries
• Fixed/pricing 'Coming soon' badge replaced with 'Most popular' to match landing page CTAs

Daily insight quota API, paginated activity log, and quota progress bar on dataset detail.

• NewGET /api/auth/me/quota — returns insightsToday, quota, remaining for today's insight usage
• NewGET /api/activity with pagination (page + pageSize query params, Zod-validated)
• New/dashboard/activity page — per-action icons/colors, relative timestamps, load-more pagination
• NewQuota progress bar on dataset detail — color transitions at 20+ and 30/30 usage
• FixedReact Compiler purity violation — Date.now() moved to module-level constant in RelativeTime

Error boundaries, account settings with password change and account deletion.

• NewGlobal error boundary (error.tsx) — branded 500 page with Try again + error digest
• NewDashboard error boundary — inline compact error card
• New/dashboard/settings — change password and delete account with confirmation phrase
• NewPATCH /api/auth/me — change password (validates current password, writes audit log)
• NewDELETE /api/auth/me — delete account (cascades all data, clears cookie)
• Fixed2 ESLint errors — <a href='/#pricing'> replaced with Next.js <Link>

Playwright E2E suite, structured logging, SECURITY.md, Dependabot, and CI lint step.

• New8-test Playwright E2E suite — landing, auth, CSV upload, dataset detail navigation
• NewStructured JSON logger — JSON in production, human-readable in dev; replaces all console.*
• NewSECURITY.md — vulnerability reporting policy and security design overview
• NewDependabot config — weekly npm + monthly GitHub Actions updates
• NewArchitecture Mermaid diagram + Design Tradeoffs section in README
• NewCONTRIBUTING.md — local setup, test instructions, code style, PR process
• NewLint step added to CI pipeline

Stripe billing, pricing page, budget tracker, data chat, shareable insights, and weekly digest.

• NewStripe subscription integration — checkout, billing portal, and webhook handler
• New/pricing standalone page with Free and Pro plan comparison
• NewBudget tracker — set monthly limits per category, over-budget alerts
• NewChat with your data — SSE streaming AI conversation grounded in your transactions
• NewShareable insight links — public /share/[insightId] pages with CTA
• NewWeekly email digest via SendGrid (Vercel cron, Mondays 8am UTC)
• NewDataset comparison page — side-by-side metrics and bar chart diff
• NewStreaming AI insight generation (SSE) with step-by-step progress panel

Production hardening — 29 integration tests, admin panel, rate limiting, audit logging, PII redaction.

• New29 integration tests with zero mocks — auth, datasets, upload, metrics, insights, rename, delete
• NewAdmin panel — view all users and datasets; admin-scoped dataset deletion
• NewDB-backed rate limiting via RateLimitBucket table (no Redis)
• NewImmutable AuditLog — every sensitive action appended; quota enforced by counting rows
• NewPII redaction — strips email, phone, NRIC, long digit strings before AI processing
• NewMetricSnapshot caching — 1-hour TTL on dashboard analytics
• NewData hash cache — identical transaction sets skip recomputation entirely
• SecurityCSRF protection on all cookie-authenticated mutations
• SecurityCSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers

Initial production-ready release. Full auth pipeline, CSV ingestion, metrics, and AI insights.

• NewJWT auth — register, login, logout, forgot password, reset password
• NewDual auth transport — Bearer token + HttpOnly cookie simultaneously
• NewDataset CRUD — create, list, rename, delete with Prisma cascade
• NewCSV upload and parsing via PapaParse — row-level validation, atomic insertion
• NewServer-side metrics computation — income, expenses, savings rate, top categories, monthly breakdown
• NewAI insights — structured output, Zod-typed, with data-hash caching
• NewDashboard with Recharts — category pie, monthly bar, savings line chart
• NewRole-based access control — USER and ADMIN roles
• NewDeployment to Vercel + Neon PostgreSQL