Changelog

change-items:subcontract number inline after the subcontractor name — clickable, wraps (#54)

auth:close missing permission gates found by the full-repo role-gate audit (#53)

change-items:right-align Link column + center Xfer/Fcst flag checkboxes (#52)

change-items:ROM holds the line amount — auto-fills from qty × rate, Subtotals column removed (#51)

oco:markup flows contract→OCP→OCO + Pending OCO advance rolls into a real order (#50)

change-orders:end-to-end change-order lifecycle — detail-page parity, budget drill-downs, contract rollups (#49)

change-items:double-row cost-lines grid (Budget/Costs stacked rows) (#48)

change-items:compact cost-lines grid + drop RFI-header New Change Item stub (#47)

team:project roles are read-only on the Team page — edit via Directory only (#46)

directory:persist the Add User dialog's Default role as the user's defaultProjectRole (#45)

budget:lock freezes only the Original Budget column — forecasting stays available (#44)

oco-sco:2-column detail pages for OCP, OCO, and SCO; CI grid number input polish (#43)

change-items:CI detail page rework — 2-col layout, edit-mode grid, Type-gated Open, forecast record view (#42)

budget:budget transfers permanently lock the budget (edits frozen, transfers stay open) (#41)

change-items:CI/OCP detail refinements — stepper, real budget tools, OCP PCO fields, attachments (#40)

change-items:pull-based provenance breakout + cost-line grid + OCO batch (#39)

change-items:show subcontractor name in Add Cost Line subcontract picker (#37)

owner-contracts:use UserCombobox for signers in Send Contract dialog (#36)

subcontracts:Send-for-Signature in stepper header + contract-PDF upload at Contract Final (#35)

owner-contracts:add contract-draft upload at Final Draft; drop 'scope sheet' wording (#34)

users:bulk import users from .xlsx (Project/Pencor Admin only) (#33)

projects:relax admin id validators from .cuid() to .min(1) (#32)

users:add an 'Add User (No email)' option to the create-user dialog (#30)

subcontracts:show the signed-copy PDF drag box at SENT for any editor (#28)

change-items:DRAFT-only row delete for change items, OCOs, SCOs (#27)

budget:Budget Transfer tool (Change Item Management target #4) (#26)

change-items:CI-locked forecast / Proceeding flow (target #3.5) (#25)

sco:build the Subcontract Change Orders module (target #3) (#24)

oco:build the Owner Change Orders module (target #2) (#23)

change-items:build the Change Items module (target #1) (#22)

nav:Timecards company module + company side tools for all Pencor staff (#18)

permissions:company-level access, derivative financials nav + RBAC consolidation (#17)

auth:repair invite & reset links via server-side token_hash verifyOtp

drawings:void sheets via hard-delete + append-only audit log (#12)

security:finish auth/permission hardening — gate all built-module privileged actions (#11)

email:resolve outbound link origin via getAppUrl() so links are always live (#10)

meta:lowercase browser title to "pencorOS"

ci:add DIRECT_URL env var for Prisma migrate deploy

ci:reword "Contact" in custom-login README to pass docs linter

login:update tagline to "the operating system for Pencor Construction"

login:wrap "//"-prefixed tagline as a string expression

login:redesign sign-in screen to cover + roadmap design

ci:unbreak ESLint flat config under Node 24 / ESLint 9.39

auth:hard-navigate after login/set-password + allow /auth callback unauthenticated (fixes Supabase login bounce)

build:exclude .next/cache + public/uploads from serverless tracing

owner-contracts:make getPencorCompanyId deterministic + pin test contractor to own company (kills shared-DB flake)

build:force-dynamic on (dashboard) layout so auth-gated pages aren't prerendered

build:rename useSupabaseStorage off the use* prefix (rules-of-hooks) + prefer-const in company test

rfis:add key to sendButton in EditableQuestion to silence React key warning

rfis:widen New RFI dialog to prevent horizontal scroll from long attachment names

permissions:gate directory pages/nav (view + carve-outs) + matrix editor

permissions:gate directory company actions + admin roster

permissions:gate directory user actions + role-assignment ladder

permissions:UI gates for drawings/specs detail actions

permissions:gate submittal create/edit/settings (+ rfi.settings)

permissions:gate drawing-set delete (drawings.void)

permissions:gate specifications upload/edit/delete

permissions:gate drawings upload/edit (drawings.upload / drawings.edit)

permissions:gate subcontract create/edit (subcontract.create / .manage)

permissions:gate project settings edit (project.settings)

permissions:gate project settings edit (project.settings)

permissions:gate project settings edit (project.settings)

permissions:gate owner-contract create/edit (ownerContract.create / .manage)

permissions:gate RFI create/edit (rfi.create / rfi.edit)

permissions:gate contract terminal transitions (owner/subcontract .manage)

permissions:gate budget settings (budget.settings)

permissions:gate budget lock/admin + edits (budget.admin/manage)

permissions:gate owner-contract execution/signature (ownerContract.sign)

permissions:gate SSOV submit/approve (subcontract.subview/manage)

permissions:gate subcontract SENT/EXECUTED (subcontract.sign)

perms:creator may delete own DRAFT (RFI + submittal)

permissions:gate RFI + Submittal void/distribute

auth:Pencor Dev capability + dev-mode toggle (replaces NODE_ENV gate)

auth:membership-based requireProjectAccess + creator membership

permissions:companyRole + hasPermission (Option A, isPencor gate + carve-outs)

permissions:rebuild role matrix (16 roles · 143 keys · 30 modules)

seed:correct name of internal user "Jared Phillips" to "Jared Penny" in seed data

directory:enhance user management with invite functionality and Pencor employee support

Field POC column, project admin assignments, budget popup links, UI polish

subcontracts:SCOPE_FINAL panel matches Owner Contract layout + expand edit permissions

subcontracts:scope-sheet drag-and-drop + Parties & Team relocation

subcontracts:Scope Final manager review — send back, advance, edit

subcontracts:full Edit dialog on title card while in SCOPE_DRAFT (creator-gated)

subcontracts:Edit cost-code allocation from the Financials card

subcontracts:drop redundant Executed row + humanize Status in Workflow Summary

budget:click-through Committed Costs cell — per-subcontract breakdown dialog

budget:committed costs now sourced from Subcontract.ContractLineItem + virtual rows

subcontracts:New dialog reworked — Contract Value + Cost Code Allocation + UnBudgeted picker

subcontracts:split SSOV from cost allocation — new SSOVLineItem table

subcontracts:server-rendered PDF export — matches RFI pattern

subcontracts:getProjectCostCodes — use isActive, not notDeleted()

subcontracts:split numbering.ts so client components can import TYPE_ABBR

schemas:codebase-wide sweep of z.string().cuid() → z.string().min(1)

subcontracts,companies:relax ID validators from .cuid() to .min(1)

subcontracts:P8b SSOV tab UI — line editor + submit/approve flow

subcontracts:P8a SSOV data layer — submit/approve/request-revisions

subcontracts:P7 detail page — colored title card, stepper, tabs, insurance buttons

subcontracts:P6 list page — table + cards + customizer + print + create dialog

companies:P5 — Contract / Insurance Admin pickers on Company Details

subcontracts:P4 actions — CRUD, transitions, insurance gate, settings

subcontracts:P3 types + Zod schemas + queries + two-barrel exports

subcontracts:P2 pure logic — bic, transitions, numbering, readiness

subcontracts:P1 schema migration

budget:downloadable CSV template in import dialog

budget:print/pdf + rest api + docs

budget:settings page

budget:lock/unlock + integration doc

budget:csv + template import dialogs

budget:forecast dialog shows $0 when item list is empty

budget:AUTO forecast create no longer crashes the dialog

budget:cost forecast dialog + inline cell

budget:pre-format Builder initialRows to plain DTO

budget:widen Builder Mode input columns

budget:builder mode spreadsheet entry

budget:read-only view + sticky grand total

budget:forecast items + evaluator

budget:module backend + column derivation

cost-codes:import + preview the division column

cost-codes:add downloadable CSV template + link in import dialog

cost-codes:drop seeded codes/templates + add CSV export button

cost-codes:company settings pages

cost-codes:module backend + CSV import

schema:budget module + company-scoped cost codes

specifications:use unknown instead of any for pdfjs worker module (CI lint)

deps:regenerate package-lock.json — resolve missing @testing-library/dom transitive deps

specifications:set pdfjs worker via globalThis instead of pathToFileURL (Next server bundling)

projects:make Project Details card read-only by default with Edit toggle

owner-contract:add primaryFile relation + FK constraint

schema:rename PrimeContract to OwnerContract + parties + signatures + CO markup

documents:natural-sort folder/file names (1,2,10 not 1,10,2)

documents:read-only Box folder browser with in-app downloads

box:accept full Box folder URL in folder-ID env vars

documents:import server actions directly from defining files

box:SECURITY — move internal helpers out of use-server file; cleanup on decrypt failure

documents:use Prisma's BoxConnection type directly (lint: no-empty-object-type)

projects:fire-and-forget Box provisioning + rename sync hooks

documents:global company library at /documents

documents:per-project Documents page orchestrator

documents:BoxFolderEmbed with lazy box-ui-elements load + token refresh

documents:ConnectBoxCard, ProvisionFolderCard, BoxOutOfSyncBanner

box:downscoped-token route with folder-membership authorization

box:OAuth start + callback routes with CSRF state cookie

documents:rewrite module around Box (queries, actions, provisioning, barrels)

box:token lifecycle + module barrel

box:typed Box REST wrappers — getMe, copyFolder, renameFolder

box:OAuth helpers — authorize URL, code exchange, refresh, downscope

box:AES-256-GCM token encryption with round-trip tests

box:config helper + error classes (hard-fail on missing env)

schema:documents box integration — BoxConnection + Project Box columns, drop Folder/FileObject/FileLink

projects:stack photo Replace/Remove buttons vertically

projects:wire NewProjectForm, allow project-photo file downloads, clean up

projects:seed 4 demo projects in YY.XXX format + Riverpark photo

projects:switch server-side consumers to index.server barrel

projects:detail page — photo slot, classification chips, permits card, edit panel

projects:list page — Show inactive toggle, filter dropdowns, neutral badges, photo thumbs

projects:ProjectEditForm — full settings panel including actuals + warranty

projects:NewProjectForm — single-screen sectioned dialog, Name+Number required

projects:temporarily drop NewProjectForm re-export (added back in Task 10)

projects:ProjectPhotoUpload + ActiveToggle components

projects:photo upload API route (single-slot PROJECT_PHOTO)

projects:actions — uniqueness check, setProjectActive, deleteProjectPhoto

projects:queries.ts supports new filters + photo include

projects:labels.ts — enum label + neutral badge style maps

projects:new Zod schema + types for redesigned model

schema:project lifecycle redesign — 13-status enum, scope/sector/delivery, descriptor columns, photo FK