chore(release): v0.2.0

Author: github-actions[bot]

.dockerignore

@@ -4,8 +4,27 @@ node_modules
 coverage
 storybook-static
 .git
-.env
-.env.local
+.env*
+!.env.example
+.envrc
+*.pem
+*.key
+*.p12
+*.crt
+*.cert
+.claude/
+.codex/
+deploy/.ssh/
+deploy/.terraform/
+deploy/*.tfstate*
+deploy/*.tfvars
+reports/
+test-results/
+playwright-report/
+graphify-out/
+.DS_Store
+.idea/
+.vscode/
 *.log
 *.tsbuildinfo
 prisma/generated

.env.example

@@ -244,7 +244,7 @@ RANK_CHECK_SCHEDULER_MODE=legacy
 # OPS_NOTIFY_MODE=failures
 # Daily heartbeat cron and IANA timezone.
 # OPS_HEARTBEAT_CRON=0 8 * * *
-# OPS_HEARTBEAT_TZ=Europe/Warsaw
+# OPS_HEARTBEAT_TZ=Etc/UTC
 # Duplicate event suppression window in minutes.
 # OPS_THROTTLE_MINUTES=60
 # Base URL of your Temporal Web UI. When set, ops Slack messages link workflows to it.

.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# Funding links for the public mirror can be configured by its maintainers.
+# Funding links can be configured by repository maintainers.
 
 github:
 patreon:

.gitignore

@@ -27,8 +27,8 @@ storybook-static/
 *.crt
 *.cert
 
-# Public deployment manifests live in deploy/. Local state, credentials, and
-# provider caches belong under .agent-private/deploy/ and must never be staged.
+# Public deployment manifests live in deploy/. Local state and credentials stay
+# untracked.
 deploy/.ssh/
 deploy/.terraform/
 deploy/*.tfstate
@@ -38,13 +38,10 @@ deploy/*.tfvars
 # direnv local env (per-machine dev overrides, e.g. PORT)
 .envrc
 
-# Agent configs are machine-local; canonical hook wiring lives in .agent-private/hooks/README.md
+# Agent configs are machine-local.
 .claude/
 .codex/
 
-# Agent-local secrets (service-account keys etc.) - never commit
-.agent-private/.secrets/
-
 # Test / coverage
 coverage/
 *.tsbuildinfo
@@ -58,8 +55,7 @@ prisma/generated/
 .DS_Store
 *.log
 
-# Worktrees live under .worktrees/ and are ignored via .git/info/exclude
-# (not here), so the public mirror never sees that convention.
+# Nested worktrees are machine-local.
 .wt/
 
 # Test / e2e artifacts (root-only; lib/reports is source)
@@ -73,12 +69,9 @@ examples/go/go.work
 examples/go/go.work.sum
 examples/python/.venv/
 
-# Build-time baked server-only runtime env (never commit; regenerated by scripts/deploy/bake-runtime-env.mjs)
+# Build-time baked server-only runtime env
 lib/deployment/runtime-env.generated.ts
 
-# Graphify knowledge graph - generated, machine-local (regenerate: graphify update .)
+# Generated local knowledge graph
 graphify-out/
 .graphifyignore
-
-# Deploy-tests runner state (scratch run records; machine-local)
-.agent-private/scripts/deploy-tests/state/

.gitleaks.toml

@@ -5,10 +5,20 @@ useDefault = true
 
 [[allowlists]]
 description = "Location identifiers and masked display values are not credentials"
+condition = "AND"
 regexTarget = "match"
+paths = [
+  '''^app/.+\.test\.[jt]sx?$''',
+  '''^components/.+\.(test|stories)\.[jt]sx?$''',
+  '''^components/.+fixtures[^/]*\.[jt]sx?$''',
+  '''^docs/api/''',
+  '''^docs/openapi\.snapshot\.json$''',
+  '''^lib/.+\.test\.[jt]sx?$''',
+  '''^lib/mcp/canonical-contract\.json$''',
+  '''^scripts/smoke/''',
+]
 regexes = [
   '''(?i)(canonical_?key|location_?key|masked_?key)["']?\s*[:=]''',
   '''rawKey\s*=\s*"bsb_key_test_[a-z0-9_]+"''',
   '''rawPersonalToken\s*=\s*"bsb_pat_live_[a-z0-9_]+"''',
-  '''LinkedinLogo,\s+ListChecksIcon''',
 ]

CHANGELOG.md

@@ -2,4 +2,36 @@
 
 ## Unreleased
 
-- Initial release.
+## [0.2.0] - 2026-07-30
+
+- **Breaking:** Internal services (PostgreSQL, Valkey, Temporal Server) are no longer published on the
+host, and the Temporal UI now binds to `127.0.0.1`. For host access use the shipped
+`docker-compose.debug.yml`; for other bindings see the self-hosting guide.
+
+  Example: `docker compose -f docker-compose.yml -f docker-compose.debug.yml up --build`.
+
+- Fixed fresh installs, which created a database schema that diverged from the data model.
+- Fixed restart policies so the app, PostgreSQL, Valkey, and Temporal services restart unless stopped;
+previously only the optional worker did.
+- Fixed key rotation for provider credentials: `BISIBILITY_SECRETS_KEYS_RETIRED` now reaches the app
+on Compose installs, so retired keys can still decrypt existing secrets, and the rotation scripts
+run on the pinned Node runtime instead of resolving `tsx` from the network.
+- Narrowed the Docker build context so local environment files, keys, certificates, deployment state,
+and private material cannot enter checkout-built images.
+- Corrected the upgrade-path documentation: backup and restore examples now run inside the PostgreSQL
+container, and the rollback instructions warn that returning to 0.1.0 republishes the database and
+cache ports.
+- Corrected inaccurate claims about the contribution policy, CLI and Managed Cloud status, Search
+Console versus GA4 data, and roadmap vocabulary.
+
+### Known limitations
+
+`migrations: "ready"` covers blocking data migrations and public IDs, not Prisma
+schema. Use `npx prisma migrate status`. This is unchanged from 0.1.0; the fix
+is scheduled.
+
+## [0.1.0] - 2026-07-30
+
+- Added self-hosted keyword rank tracking with Docker, PostgreSQL, Redis or Valkey, optional Temporal scheduling, and BYO DataForSEO or SerpAPI accounts.
+- Added keyword and backlink research, position history, alerts, Search Console query metrics, GA4 landing-page metrics, and CSV export.
+- Added REST API v1 with OpenAPI, an authenticated MCP endpoint, signed outbound webhooks, scoped API keys, team roles, and audit logging.

CONTRIBUTING.md

@@ -7,11 +7,7 @@ This repository does not accept pull requests; see
 
 ## Ways to Contribute
 
-bisibility is developed by a small core team that ships with heavy AI-agent
-assistance, and the product itself is built agent-ready (MCP server, agent
-skills, machine-readable docs). In this setup, a precise problem statement or
-an implementation-ready spec regularly turns into shipped code faster than a
-patch would.
+bisibility is developed with substantial AI-agent assistance.
 
 In rough order of leverage:
 
@@ -155,7 +151,7 @@ npm run test
 
 It chains `npm run typecheck`, `npm run lint`, and `npm run test:unit`.
 
-Run `npm run verify:build` before larger pull requests, dependency changes,
+Run `npm run verify:build` before larger changes, dependency changes,
 build configuration changes, or changes that affect Storybook or production
 bundling. It checks the Node version, linting, typechecking, unit tests, the Next
 build, and the Storybook build.

Dockerfile

@@ -5,6 +5,7 @@ WORKDIR /workspace
 COPY package.json package-lock.json ./
 COPY scripts/deploy/bake-runtime-env.mjs ./scripts/deploy/bake-runtime-env.mjs
 COPY scripts/generate/generate-client-if-schema.mjs ./scripts/generate/generate-client-if-schema.mjs
+COPY scripts/generate/root-postinstall.mjs ./scripts/generate/root-postinstall.mjs
 # Pin npm to the version that generated package-lock.json so `npm ci` resolves the
 # identical dependency tree (the base image's bundled npm can differ and reject the lockfile).
 RUN npm install -g npm@10.9.3 && npm ci

Dockerfile.worker

@@ -14,6 +14,7 @@ COPY package.json package-lock.json ./
 COPY scripts/deploy/bake-runtime-env.mjs ./scripts/deploy/bake-runtime-env.mjs
 COPY scripts/deploy/download-rds-ca.mjs ./scripts/deploy/download-rds-ca.mjs
 COPY scripts/generate/generate-client-if-schema.mjs ./scripts/generate/generate-client-if-schema.mjs
+COPY scripts/generate/root-postinstall.mjs ./scripts/generate/root-postinstall.mjs
 RUN npm install -g npm@10.9.3 \
   && npm ci \
   && apt-get update \

README.md

@@ -104,25 +104,25 @@ a stable 1.0 contract.
 | REST API and OpenAPI | Available |
 | MCP endpoint | Available |
 | TypeScript, Python, and Go SDKs | Available |
-| CLI | Available |
+| CLI | Developer preview |
 | Self-hosting with Docker | Available |
-| Managed Cloud (open beta) | Available |
+| Managed Cloud | Open beta |
 | Domain overview | Planned |
 
 ### Included workflows
 
 - Keyword research with related queries, suggestions, ideas, search volume, 12-month
   trends, CPC, competition, difficulty, and intent data
 - Backlink research with referring domains and pages, 12-month new and lost link
-  history, domain authority, spam scores, and link attributes
+  history, authority and spam metrics, and link attributes
 - Rank tracking with position history, trend charts, and intended URL monitoring
 - Competitor benchmarking with Share of Voice
 - Manual, daily, weekly, monthly, and custom cron schedules
 - Rank alerts in-app and by email, plus weekly email digests for projects with
   recent rank-check activity
 - Keyword tags and saved views
-- Opt-in Search Console and GA4 connections, with queries, clicks, and impressions
-  per keyword
+- Opt-in Search Console connections, with queries, clicks, and impressions per keyword
+- Opt-in GA4 connections with landing-page sessions, engagement, and key events
 - Google index status on keyword details
 - REST API v1 with OpenAPI, an MCP endpoint, signed outbound webhooks, and CSV export
 - Owner, Admin, Editor, and Viewer team roles, with an audit log
@@ -244,7 +244,8 @@ remains available without an application subscription.
 
 ## Contributing
 
-Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and
+Public issues and feature specifications are welcome. This repository does not
+accept pull requests. See [CONTRIBUTING.md](CONTRIBUTING.md) and
 [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 
 ## Security