v0.10.0: Buildings infrastructure rollout + guided onboarding + CI/release hardening (#82)

* Standardize postcss on 8.4.49 to address CVE in versions < 8.4.49 (#59)

* Initial plan

* Fix postcss vulnerability by upgrading to 8.5.6

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Update postcss override to target 8.5.6 to eliminate dual versions

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Standardize on postcss 8.4.49 to fix CVE and eliminate version conflicts

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Fix early-game UX issues: form placeholders, time visibility, completion feedback (#73)

* Initial plan

* Fix prefilled form fields, add tick countdown, improve workforce UI explanations

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Add toast notifications for research and production completion

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Fix TypeScript errors in toast notifications

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Add release entry for UX improvements

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Remove prefilled allocation percentages from workforce page initial state

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Fix capacity delta input reset to empty string after submission

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Apply code review feedback: improve accessibility, fix countdown boundary, deduplicate toast recipes

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Update design guidelines documentation with new UX patterns

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* feat: Add infrastructure-based production foundation (Phase 1-2) (#75)

* Initial plan

* feat(sim): add building infrastructure domain layer with Prisma schema and tests

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* chore: add release entry for building infrastructure phase 1

* feat(sim): integrate building operating costs into tick pipeline

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix(sim): fix stale cash bug and reserved cash invariant in building operating costs

- Fetch fresh company data for each building to avoid stale cash values when processing multiple buildings
- Use availableCash() to respect reservedCashCents when checking affordability
- Update AGENTS.md to reflect new 11-stage tick pipeline
- Add tests for reserved cash respect and multi-building scenarios

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* refactor(sim): improve building service types and documentation clarity

- Remove `any` return types, let TypeScript infer from Prisma
- Clarify which invariants are enforced vs planned in module docs
- Add note in tick-engine that production validation doesn't check building status yet (Phase 2)
- Update building service docs to separate current vs future features

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix(shared): add new building ledger entry types to FinanceLedgerEntryType

- Add BUILDING_OPERATING_COST and BUILDING_ACQUISITION to shared API types
- Fixes TypeScript compilation errors in finance controller and service
- All 53 tests passing

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix(sim): remove explicit any type in building tests to pass linter

- Replace `{} as any` with `{} as Prisma.TransactionClient`
- Fixes ESLint error: @typescript-eslint/no-explicit-any
- All tests passing, TypeScript compilation successful

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Fix OAuth redirect_uri mismatch between better-auth and provider configuration (#77)

* Initial plan

* feat: Add nginx proxy rule for OAuth callbacks on web domain

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* docs: Update deployment docs and env example for OAuth callback configuration

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* docs: Add deployment guide for OAuth callback redirect URL fix

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: Address PR review feedback - update release area, nginx comments, and use RFC 5737 IP ranges

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Phase 3: Enforce storage capacity limits and production building requirements (#78)

* Initial plan

* feat: implement storage capacity system and building validation

- Add BASE_STORAGE_CAPACITY_PER_REGION and WAREHOUSE_CAPACITY_PER_SLOT constants
- Implement calculateRegionalStorageCapacity function
- Implement validateStorageCapacity function to check inventory limits
- Integrate storage validation in production completions
- Integrate storage validation in market settlement
- Integrate storage validation in shipment deliveries
- Add validateProductionBuildingAvailable function
- Integrate building validation in production job creation
- Update tick-engine JSDoc with Phase 3 validation notes
- Add comprehensive tests for storage capacity system
- Add tests for production building validation

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: remove unused imports in storage.test.ts

* fix: resolve storage validation race conditions and bot production

- Move storage validation BEFORE inventory mutations in production
- Move storage validation BEFORE inventory mutations in market settlement
- Only validate production buildings for player companies (bots exempt)
- Prevents batch processing race condition where multiple operations in same tick could exceed capacity

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: account for net inventory change in production storage validation

- Calculate net inventory change (outputs - inputs consumed)
- Only validate storage if net change is positive
- Update documentation to accurately reflect validation behavior
- Addresses bot reviewer feedback on production capacity logic

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: skip storage validation for self-trades in market settlement

- Self-trades (same company, region, and item) have net zero inventory change
- Skip storage capacity validation when buyer and seller are the same entity
- Prevents false positive rejections when company at capacity trades with itself
- Addresses bot reviewer feedback on self-trade edge case

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: add warehouse to market-candles test to ensure storage capacity

- Test was failing because buyer company lacked sufficient storage capacity
- Added warehouse to buyer company in test setup
- Warehouse increases capacity by 500 units (base 1000 + warehouse 500 = 1500 total)
- Ensures trade settlement doesn't hit storage limit validation

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: add production building and warehouse to seeded player company

- Player company now gets a FACTORY (5 capacity slots) for production jobs
- Player company now gets a WAREHOUSE (500 capacity) to handle 1088 units of starting inventory
- Total capacity: 1000 (base) + 500 (warehouse) = 1500 units
- Removes need for per-test warehouse setup in market-candles test
- Fixes all integration tests that rely on player company having buildings

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* refactor: reduce starting inventory and remove free warehouse

- Reduced player starting inventory from 1088 to 885 units (fits in base 1000 capacity)
- Removed free warehouse to avoid giving players buildings with upkeep costs
- Keep FACTORY for production capability (no operating cost in seed)
- Starting inventory breakdown:
  * ironOre: 240 → 200
  * coal: 140 → 120
  * copperOre: 180 → 150
  * water: 200 → 150
  * fertilizer: 150 → 120
  * bioSubstrate: 160 → 130
  * ironIngot: 12 → 10
  * copperIngot: 6 → 5

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* Phase 4 & 5: Buildings Management UI + Preflight Validation + Deterministic Overflow Policy + Stuck Shipment Indicator (#79)

* Initial plan

* feat(api): add buildings API with preflight validation

- Add BuildingsController with endpoints for listing, acquiring, and reactivating buildings
- Add preflight validation endpoints for production jobs and buy orders
- Add storage and capacity info endpoints
- Add building type definitions with costs (Phase 5 balance pass)
- Add building-related types to shared package
- Register buildings module in app.module.ts

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* feat(web): add buildings API client functions

- Add building-related parsers to api-parsers
- Add buildings API functions to api client
- Add support for listing, acquiring, and reactivating buildings
- Add preflight validation API calls
- Add storage and capacity info API calls

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* feat(web): add Buildings page and UI components

- Add Buildings page with region/category grouping
- Add building status display with badges
- Add Acquire Building dialog with cost preview
- Add reactivate building functionality
- Add Storage Meter component for capacity visualization
- Add missing UI components (Dialog, Label, Progress)
- Install required radix-ui packages

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* chore: add release entry for Phase 4 & 5 implementation

* fix: remove unused imports in buildings service

* feat(sim): implement deterministic overflow policy for shipments

CRITICAL FIX: Shipment delivery now returns to sender when destination storage is full, preventing tick blocking.

**Overflow Strategy: Return to Sender**

When shipment arrives but destination storage is full:
- Shipment marked as DELIVERED (not failed)
- Inventory returned to origin region (fromRegionId)
- No error thrown (prevents tick advancement failures)
- Deterministic behavior - always returns, never partial
- Player consequence: wasted logistics fee

**Changes:**
- packages/sim/src/services/shipments.ts:
  - deliverDueShipmentsForTick() now returns {deliveredCount, returnedCount}
  - Catches storage capacity errors and returns to sender
  - Updated JSDoc with comprehensive overflow policy documentation

**Prevents Soft-Lock:**
- Tick processing never fails due to player storage mismanagement
- Multi-operation storage contention handled deterministically
- Same-tick shipments processed in arrival order (ASC)

All 64 existing tests passing.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* docs: add comprehensive overflow policy and economic analysis

Complete documentation covering:
- Deterministic overflow policy (reject at source + return to sender)
- Multi-operation storage contention handling
- Soft-lock prevention strategy
- Economic balance analysis with break-even calculations
- Early game viability assessment
- Over-expansion risk scenarios
- Integration test coverage plan

Key Findings:
- Current building costs too high for absolute beginners
- Recommend adding $25k Workshop tier
- MegaFactory dangerous if purchased too early (bankruptcy risk)
- Production failure behavior needs design decision (lose inputs vs return)

All quality gates passing:
- ✅ 64/64 tests
- ✅ TypeScript compilation
- ✅ ESLint

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* feat: add WORKSHOP building tier and improve overflow policy

**Workshop Building Tier ($25k Entry-Level):**
- Acquisition: $25,000 (vs $80k for Farm)
- Weekly cost: $1,500 (vs $4k for Farm)
- Capacity: 1 slot
- Purpose: True early-game viability

**Overflow Policy Enhancements:**
- Origin storage validation SKIPPED for returns (prevents deadlock)
- Rationale: Items were already at origin - bounded violation acceptable
- Origin may temporarily exceed capacity but self-corrects
- Deterministic: Same inputs → same outputs
- Idempotent: updateMany prevents double-processing
- Atomic: Single transaction, no partial state
- No ledger entry on return (fee already paid at creation)

**Changes:**
- packages/db/prisma/schema.prisma: Add WORKSHOP to BuildingType enum
- packages/shared/src/api-types.ts: Add WORKSHOP to type union
- packages/sim/src/services/buildings.ts: Include WORKSHOP in production building types
- packages/sim/src/services/shipments.ts: Enhanced overflow documentation
- apps/api/src/buildings/buildings.service.ts: Add WORKSHOP definition and include in preflight

**Quality:**
- All 64 tests passing
- TypeScript compilation passing
- ESLint passing

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: maintain hard storage caps and use deterministic ordering

BREAKING CHANGES to overflow policy per reviewer feedback:

**1. Hard Storage Caps Maintained:**
- Origin capacity NOW VALIDATED on rollback (was bypassed)
- No bounded violation - all regions respect capacity limits
- If both origin and destination full, delivery FAILS
- This is acceptable - player made storage management error

**2. Delivery Rollback Semantics:**
- Clarified: This is a ROLLBACK, not a logistics return
- No new shipment created, no additional travel time
- Status: DELIVERED (completed, even if rolled back)
- Player penalty: wasted fee + time

**3. Deterministic Ordering:**
- Changed from createdAt (wall-clock) to tickCreated (deterministic)
- Guarantees same order on replay: ORDER BY tickArrives ASC, tickCreated ASC
- Location: packages/sim/src/services/shipments.ts:674

**Changes:**
- packages/sim/src/services/shipments.ts:
  - Add origin capacity validation on rollback (line 730-736)
  - Use tickCreated instead of createdAt for ordering
  - Comprehensive JSDoc updates explaining rollback vs return
  - Hard cap invariants maintained everywhere
- docs/overflow-policy-and-economics.md:
  - Updated to reflect rollback semantics
  - Clarified deterministic ordering with tickCreated
  - Documented edge case (both regions full)

**Rationale:**
- Hard caps are invariants - no bypass allowed
- Edge case failure acceptable (player must manage both regions)
- Simpler than overflow bucket (no quarantine system needed)
- Deterministic ordering critical for replay

All 64 tests passing.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: ensure tick never fails - retry shipments when both regions full

CRITICAL FIX: Tick advancement can never be blocked by storage overflow.

**Problem:** Previous implementation threw error if both origin and destination were full, blocking tick advancement.

**Solution:** Three-tier delivery fallback:
1. Destination has capacity → Normal delivery
2. Destination full, origin has capacity → Rollback to origin (DELIVERED status)
3. Both regions full → Keep IN_TRANSIT, retry next tick (tick continues)

**Changes:**
- packages/sim/src/services/shipments.ts:
  - Moved status update AFTER capacity validation (line 746-756)
  - Only update to DELIVERED if delivery succeeds
  - If both regions full: shipment stays IN_TRANSIT, no throw
  - Comprehensive JSDoc explaining three-tier fallback
  - Line 733: Catch origin validation error, set shouldDeliver=false

- docs/overflow-policy-and-economics.md:
  - Updated to document three-tier delivery outcomes
  - Clarified tick never fails guarantee
  - Documented retry mechanism for double-full scenario

**Guarantees:**
✅ Tick advancement NEVER fails due to storage
✅ Hard storage caps maintained (no bypass)
✅ Deterministic retry behavior
✅ Player gets clear feedback (shipment stays IN_TRANSIT until space available)

**Edge Case Handling:**
- Both regions full → shipment retries automatically next tick
- Player must clear space in EITHER region for delivery
- No soft-lock possible

All 64 tests passing.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* refactor: extract production building types constant and fix type safety

Address code review feedback:
1. Extract PRODUCTION_BUILDING_TYPES as shared constant (eliminates duplication)
2. Fix type safety: use `as BuildingType` instead of `as any` in acquire dialog

**Changes:**
- packages/sim/src/services/buildings.ts:
  - Add PRODUCTION_BUILDING_TYPES export (line 89-97)
  - Use constant in getProductionCapacityForCompany (line 513)
  - Use constant in assertHasActiveProductionBuilding (line 649)

- apps/api/src/buildings/buildings.service.ts:
  - Import PRODUCTION_BUILDING_TYPES (line 19)
  - Use constant in preflightProductionJob (line 337)

- apps/web/src/components/buildings/acquire-building-dialog.tsx:
  - Import BuildingType from api (line 25)
  - Fix type assertion: as BuildingType (line 90)

**Benefits:**
- Single source of truth for production building types
- Easier maintenance (add/remove building types in one place)
- Better type safety (no `as any` bypass)
- Consistent across API and sim layers

All 64 tests passing, typecheck and lint passing.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix: add database migration for WORKSHOP building type

CRITICAL FIX: Database enum missing WORKSHOP value causing 500 errors.

**Problem:** Added WORKSHOP to TypeScript code and Prisma schema, but database enum wasn't updated via migration.

**Error:**
```
invalid input value for enum "BuildingType": "WORKSHOP"
```

**Solution:** Create migration to add WORKSHOP to BuildingType enum in PostgreSQL.

**Migration:** packages/db/prisma/migrations/20260219133500_add_workshop_building_type/migration.sql
- Adds WORKSHOP value to BuildingType enum
- Required for integration tests to pass
- Safe to apply (enum extension, no data migration needed)

Integration tests will pass once migration is applied to test database.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* refactor: apply code review suggestions

Address copilot-pull-request-reviewer feedback:

1. Remove trailing blank lines in api-parsers.ts
2. Simplify listBuildings controller - pass query DTO directly
3. Wrap building definitions response for API consistency

**Changes:**
- apps/web/src/lib/api-parsers.ts: Remove trailing whitespace
- apps/api/src/buildings/buildings.controller.ts:
  - Pass query DTO directly to listBuildings (no redundant object)
  - Wrap definitions in { definitions: [...] } for consistency

**Note:** Bot comment about tickCreated field is incorrect - field exists in schema at line 290.

All changes are code quality improvements with no functional impact.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* feat: add stuck shipment UI indicator with storage management link

Implement real-time visual feedback for stuck shipments (IN_TRANSIT past ETA).

**Changes:**
- apps/web/src/components/logistics/logistics-page.tsx:
  - Added Badge and Link imports
  - Detect stuck shipments: tickArrives < currentTick
  - Display warning badge with tooltip on stuck shipments
  - Add "Manage Storage" button linking to /buildings page
  - Tooltip: "Waiting for storage capacity in destination or origin region"

**UX Improvements:**
- Clear visual indicator (amber warning badge) when shipment can't deliver
- Actionable "Manage Storage" button for direct navigation to Buildings page
- Tooltip explains retry behavior (waiting for capacity)
- Prevents player confusion about stuck shipments

**Implementation Details:**
- Uses existing Badge component with "warning" variant
- Conditionally renders badge only when isStuck = true
- Adds direct link to Buildings page for capacity management
- Maintains existing Cancel button functionality

No breaking changes. Pure UX enhancement.

Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BENZOOgataga <50145143+BENZOOgataga@users.noreply.github.com>

* fix(auth): support single-origin sso routing

* fix(web): preserve repeated proxy headers

* fix(ci): apply migrations before APP_ROLE all startup

* fix(web): hide seeded example accounts in admin list

* fix(api): allow admins on developer catalog read endpoints

* fix(web): accept redacted company cash in parsers

* fix(api): support admin research catalog on developer page

* fix(web): separate recipe input items across catalog views

* fix(web): centralize item quantity labels for recipe outputs

* fix(web): resolve unknown item labels in market lists

* fix(web): scope market listings to company tradable items

* fix(auth): support single-origin sso routing

* fix(web): preserve repeated proxy headers

* fix(ci): apply migrations before APP_ROLE all startup

* fix(web): hide seeded example accounts in admin list

* fix(api): allow admins on developer catalog read endpoints

* fix(web): accept redacted company cash in parsers

* fix(api): support admin research catalog on developer page

* fix(web): separate recipe input items across catalog views

* fix(web): centralize item quantity labels for recipe outputs

* fix(web): resolve unknown item labels in market lists

* fix(web): scope market listings to company tradable items

* docs(ops): use example domains and RFC5737 IPs in nginx docs

* docs(ops): drop API subdomain blocks from nginx sample

* feat(web): add ALPHA preview disclaimer to footer version badge

* feat(web): show alpha notice on version hover and overview

* fix(web): remove hover helper text from version badge

* fix(web): remove focus ring box from maintenance overlay

* feat(web): link alpha version badge to Discord updates

* fix(web): fetch Discord URL via runtime public-links endpoint

* fix(docs): add guideline to avoid commits to main branch

* feat(web): replace static onboarding tutorial with guided walkthrough

* fix(web): clarify overview metrics as world-level

* feat(web): begin guided tutorial with active company snapshot

* fix(sim): prevent zero-trade stalls from static bot books

* fix(api): harden diagnostics missing-items service injection

* fix(ci): resolve root typecheck failures

* fix(web): wrap search params hooks in suspense

* fix(ci): run release workflow only on main

* fix: stabilize prisma startup and restore phase 1-5 web UX

* fix(db): run Prisma generate without relying on dotenv-cli shell binary

* fix(web): parse buildings definitions payload correctly

* fix(web): support legacy buildings definitions payload shape

* chore(release): cut v0.10.
0

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

Author: BENZOOgataga

.env.example

@@ -43,6 +43,9 @@ JWT_SECRET=change_me_dev_only
 SESSION_SECRET=change_me_dev_only
 BETTER_AUTH_SECRET=replace_with_at_least_32_random_chars
 ADMIN_PASSWORD=
+# BETTER_AUTH_URL: Base URL for Better Auth endpoints and OAuth callbacks
+# In production, set this to the main web domain (e.g., https://corpsim.altitude-interactive.com)
+# NOT the API subdomain. The nginx proxy will forward /api/auth/* to the API server.
 BETTER_AUTH_URL=http://localhost:4310
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
@@ -97,8 +100,13 @@ COMPANY_SPECIALIZATION_CHANGE_COOLDOWN_HOURS=4
 ########################################
 # Frontend (Next.js public vars)
 ########################################
+NEXT_PUBLIC_APP_URL=http://localhost:4311
+# Optional explicit auth origin for Better Auth client requests.
+# Leave blank to use same-origin routing.
+NEXT_PUBLIC_AUTH_URL=
 NEXT_PUBLIC_API_URL=http://localhost:4310
 NEXT_PUBLIC_APP_NAME=CorpSim
+NEXT_PUBLIC_DISCORD_SERVER_URL=
 NEXT_PUBLIC_COMPANY_SPECIALIZATION_CHANGE_COOLDOWN_HOURS=4
 # SSO provider visibility flags (defaults to false if not set)
 # Set to 'true' to show SSO login buttons for each provider

.github/workflows/release.yml

@@ -4,6 +4,7 @@ on:
   workflow_run:
     workflows: ["Verify"]
     types: [completed]
+    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -17,7 +18,10 @@ concurrency:
 jobs:
   release:
     if: |
-      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_dispatch' &&
+        github.ref == 'refs/heads/main'
+      ) ||
       (
         github.event.workflow_run.conclusion == 'success' &&
         github.event.workflow_run.event == 'push' &&

…-fix-github-username-in-release-notes.md …-fix-github-username-in-release-notes.md.releases/unreleased/20260218092513-fix-github-username-in-release-notes.md renamed to .releases/released/v0.10.0/20260218092513-fix-github-username-in-release-notes.md .releases/unreleased/20260218092513-fix-github-username-in-release-notes.md renamed to .releases/released/v0.10.0/20260218092513-fix-github-username-in-release-notes.md

@@ -0,0 +1,12 @@
+---
+type: minor
+area: web
+summary: Fix early UX and data visibility issues (forms, time display, workforce clarity, completion feedback)
+---
+
+- Replace prefilled form values with descriptive placeholders in market orders, production jobs, and workforce
+- Add tick countdown timer showing "Next week in Xs" with tooltip explaining time progression
+- Reduce health polling from 3s to 15s to minimize UI refresh indicator blinking
+- Add comprehensive workforce explanations (capacity impact, allocation labels, help text)
+- Add toast notifications for research and production job completions with unlocked recipe details
+- Improve overall system transparency and onboarding clarity

.releases/released/v0.10.0/20260218131646-fix-ux-data-visibility-issues.md

@@ -0,0 +1,14 @@
+---
+type: minor
+area: sim
+summary: Add building infrastructure domain layer for capital-based production system
+---
+
+- Add Building model with BuildingType and BuildingStatus enums to Prisma schema
+- Add BUILDING_OPERATING_COST and BUILDING_ACQUISITION ledger entry types
+- Implement building acquisition, operating cost application, and reactivation services
+- Add production capacity tracking based on active buildings
+- Buildings have weekly operating costs (7 ticks interval)
+- Buildings deactivate when company cannot afford operating costs
+- Create comprehensive test suite (12 passing tests)
+- Prepare foundation for infrastructure-based production requirements

.releases/released/v0.10.0/20260218155700-add-building-infrastructure-phase-1.md

@@ -0,0 +1,10 @@
+---
+type: patch
+area: web
+summary: Fix OAuth callback redirect URLs for GitHub, Microsoft, and Discord by configuring nginx proxy and BETTER_AUTH_URL
+---
+
+- Updated nginx configuration to proxy `/api/auth/*` requests from web domain to API server
+- Added documentation for configuring `BETTER_AUTH_URL` to use the main web domain in production
+- Fixed OAuth callback URL issues that caused "redirect_uri is not associated with this application" errors
+- Ensures all OAuth providers (GitHub, Microsoft, Discord) redirect to the correct domain

.releases/released/v0.10.0/20260219091824-fix-github-oauth-redirect-url.md

@@ -0,0 +1,30 @@
+---
+type: minor
+area: web,api,sim
+summary: Add Buildings Management UI with preflight validation and acquisition flows (Phase 4 & 5)
+---
+
+**Phase 4 - Frontend Integration + Preflight + Operator Visibility:**
+- Add Buildings page with region/category grouping and status display
+- Add building acquisition dialog with cost preview
+- Add reusable Storage Meter component with warning thresholds (80%, 95%, 100%)
+- Add preflight validation endpoints (canCreateProductionJob, canPlaceBuyOrder)
+- Add storage and capacity info endpoints
+- Add building type definitions endpoint with balanced costs
+
+**Phase 5 - Acquisition Flows + Balance Pass:**
+- Implement transactional building acquisition with ledger entries
+- Define BuildingType dataset: Early Workshop, Factory, MegaFactory, Warehouse, HQ
+- Add building reactivation flow for INACTIVE buildings
+- Implement cost preview showing acquisition cost and weekly operating expenses
+
+**API Layer:**
+- Add BuildingsController with full CRUD operations
+- Add BuildingsService with ownership validation
+- Add buildings API client functions and parsers
+
+**UI Components:**
+- Add Dialog, Label, and Progress UI primitives
+- Install required @radix-ui packages
+
+- Add Buildings Management UI with preflight validation and acquisition flows (Phase 4 & 5)

.releases/released/v0.10.0/20260219112748-add-buildings-management-ui-with-preflight-valid.md

@@ -0,0 +1,10 @@
+---
+type: patch
+area: web, api
+summary: Support single-origin SSO by proxying auth routes and preferring web origin for auth base URL
+---
+
+- Added Next.js proxy routing for `/api/auth/*` to the API upstream so auth can run on the web origin.
+- Updated Better Auth base URL precedence to prefer explicit/web origins before internal API URLs.
+- Hardened web API upstream resolution to avoid accidental proxy loops when public URLs point to the web origin.
+- Updated deployment docs and env examples for single-domain SSO setup.

.releases/released/v0.10.0/20260222153300-single-origin-sso-auth-routing.md

@@ -0,0 +1,8 @@
+---
+type: patch
+area: ci
+summary: Run Prisma migrations before launching services in APP_ROLE=all mode
+---
+
+- Updated `scripts/start-container.sh` so `APP_ROLE=all` applies `prisma migrate deploy` before starting API, worker, and web.
+- Prevents runtime schema-readiness pauses when single-container deployments start without a dedicated migrate step.

.releases/released/v0.10.0/20260222154900-run-migrations-in-all-role-startup.md

@@ -0,0 +1,7 @@
+---
+type: patch
+area: web
+summary: Centralize item quantity rendering and apply quantifier labels to recipe outputs
+---
+
+- Centralize item quantity rendering and apply quantifier labels to recipe outputs