Every shipped detail.

Added

• New landing site at imperial.gay — Instrument Serif, near-black palette, violet/cyan accents, aurora hero, numbered editorial sections
• Changelog page (/changelog) — editorial layout, 20+ entries ported, category filter
• Legal hub (/legal) + Privacy, Terms, Fair Use, Acceptable Use — same editorial design with sticky TOC and active-section highlighting
• Google OAuth — Sign in with Google + connect in Settings, +250MB bonus storage, optional Use Google Avatar toggle
• Session length picker (Settings → Security) — 7 / 30 / 90 days plus an experimental ⚠ Unrecommended dropdown for 180d / 1y / Indefinite
• Auto welcome DM when Discord is linked — doubles as a live deliverability test
• Email heads-up if Discord DMs fail (rate-limited to once per user / 24h) plus an inline 'I fixed this' retry link
• bun run test:emails [email protected] — sends every email template with sample data
• New webhook events: access.activated, access.grace_started, access.expired

Changed

• Sign-in, Sign-up, Forgot/Reset rebuilt with split layout + animated aurora panel and inline Turnstile (no more shadcn modal clashing with the design)
• Settings page — sticky side-nav replaces top tabs, § 0X section eyebrows, lighter card chrome, switch rows consolidated into single divide-y cards
• Linked Accounts unified — Discord + Google now share a single card and row template
• All 13 transactional emails rebuilt on a shared EmailShell (dark, serif + violet accents, mono eyebrows) — ~600 lines of per-template CSS deleted
• Removed Stripe legacy fields, env vars, and dead subscription emails

Fixed

• 10GB storage limit persisted after access expired — customLimits.storage now rebuilds correctly on grace→expired (free tier + still-active bonuses)
• Queued-tier activation inherited the previous tier's custom storage
• Circular bonus math on Discord/Google link + unlink
• Defense-in-depth: upload + stats routes coerce accessStatus = expired to free limits regardless of DB state
• Refresh token was hard-coded to 7 days while sessions were saved for 30 — root cause of 'logged out too often'. Refresh now matches your chosen session length
• OAuth callback toasts no longer swallowed by React strict-mode double-invocation
• Stray '1' after avatar, broken Tailwind on camera button, sidebar respects the Google avatar choice
• Connection cards gracefully handle missing fields (no more 'Invalid Date')
• login.google / google.linked / google.unlinked added to the SecurityEvent enum

Changed

• Dashboard upgraded from [email protected] → [email protected] (stable)
• Landing upgraded from [email protected] → [email protected] (stable)
• Moved off canary releases in production - both apps now run a stable Next.js channel that receives security backports on a predictable cadence

Fixed

• CVE-2026-23869 - App Router Server Function CPU exhaustion DoS (was vulnerable, now patched)
• CVE-2026-23864 - React Server Components DoS via crafted HTTP requests (already patched on canary, now on stable)
• CVE-2025-55184 - React2Shell DoS that could hang server processes (now patched)
• CVE-2025-55183 - React2Shell source code exposure of compiled Server Actions (now patched)

Added

• Sticky embed preview - The Discord embed preview now stays visible while you edit instead of living too far down the page
• Share summary - The Customize page now shows a clearer summary of the effective embed URL versus the underlying CDN file URL

Changed

• Customization UX - Embed and domain editing now feel more immediate because preview feedback is surfaced alongside the controls
• Subdomain feedback - Availability, invalid format, and unsupported-domain states are easier to understand
• Sharing explanations - Public, unlisted, and private behavior now read more clearly in the product

Fixed

• Hidden preview problem - The existing preview is no longer buried far enough down the page that it feels missing during normal editing

Added

• Open-source SDK repo - The official @imperial-host/sdk package is now prepared to live as its own public repository under the Imperial organization
• Folder pinning in SDK - SDK users can now pin folders, unpin them, and list pinned folders
• Metadata helpers - The SDK now includes convenience methods for moving uploads, adding/removing/replacing tags, and managing expiry rules
• Live integration coverage - The SDK now includes env-gated integration tests against the real Imperial API

Changed

• SDK package metadata - Repository links, license handling, publish config, and package metadata are now cleaner for public OSS distribution
• Typed SDK surface - Bulk metadata and folder-related return types now reflect the API more accurately
• SDK docs - README examples and descriptions now match the real client surface much more closely

Fixed

• Folder pin request shape - The SDK now sends the request body the live API expects for folder pinning

Added

• Retry failed OCR queue items - Failed indexing work can now be re-queued directly from the Media queue view
• Temporary private access links - Private uploads can now generate short-lived access links directly from the details panel
• Aggregate webhook logs - Dashboard delivery logs now support an all-webhooks view without client-side fanout

Changed

• OCR runtime reporting - Queue health now reports degraded vs unavailable vs healthy states more clearly
• Private media UX - Copying or opening a private upload now follows a temporary-access flow instead of just failing like a public link
• Session expiry handling - Dashboard redirects and re-auth behavior are more deliberate when refresh tokens can no longer recover a session

Fixed

• Sender config validation - Backend sender validation now matches the documented email sender format
• Storage breakdown - Thumbnail counts in Storage are now calculated correctly
• Bot configuration drift - Admin bot data access is cleaner and user-bot production env loading is more consistent

Added

• Saved searches - Save your current query, folder, sorting, and filters as reusable media views
• Pinned folders - Keep favorite folders at the top of the sidebar for faster navigation
• Duplicate cleanup - Storage now surfaces exact duplicate groups using safe file-hash matching
• Webhook replay - Failed webhook deliveries can now be replayed from the logs
• Optional API key expiry - API keys can now expire automatically and show that status clearly in the dashboard

Changed

• Bulk media actions - Selected uploads can now share folder moves, privacy changes, and auto-delete rules with less friction
• Storage cleanup - Storage now acts more like a cleanup center with forecast cards, duplicate groups, and re-compress suggestions
• Media navigation - Child folders, saved views, and pinned folders make moving around larger libraries much faster

Added

• Paste confirmation - Pasting an image outside a text field now asks before adding it to the upload queue
• Inline upload expiry - Auto-delete timing is now shown inline with queued files instead of taking over its own control row

Changed

• Upload review flow - Added files now stay in the queue for review instead of starting immediately
• Upload dialog actions - Start Upload is more clearly the primary action, while Add Files, Clear, and Close are easier to scan
• Queue feedback - The dialog now shows selected file count and total upload size before you begin

Fixed

• Editable paste handling - Clipboard upload detection no longer interferes when you're typing in inputs or editable areas
• Same-file re-add - Picking the same file again now works properly without reopening the dialog

Added

• Refresh token rotation - Refresh tokens are now tied to revocable sessions and rotated on use instead of remaining valid after session revocation
• Safer URL uploads - Upload-from-URL now blocks localhost, private/reserved networks, embedded credentials, and unsafe redirect chains
• Webhook egress validation - Webhook destinations are revalidated before delivery with stricter host checks for Discord and Slack

Changed

• Session model - Access and refresh tokens now share a consistent session lifecycle across password, Discord, and passkey logins
• Worker and app dependencies - Refreshed backend, dashboard, landing, SDK, docs, and worker lockfiles to pick up available security updates
• Worker tooling - Updated Wrangler-based packages and regenerated npm lockfiles where needed

Fixed

• Passkey session mismatch - Passkey logins now create the same revocable session shape as the rest of the auth system
• Webhook validation bypass - Provider-specific checks now validate actual hosts and paths instead of substring matches
• Internal error exposure - URL upload failures no longer echo raw internal error text back to clients

Added

• Account Deletion - Request account deletion directly from Settings, with a 7-day grace period to cancel
• Data Export - Request a full export of your account data, delivered to your email
• Confirmation Emails - Email notifications for deletion requests, cancellations, and completions
• Custom Upload Expiry - Set an auto-delete timer when uploading (1, 3, 7, 14, or 30 days)
• Upload from URL - Paste a direct link to an image or video and Imperial will fetch, compress, and store it
• File Renaming - Rename the display name of any upload directly from the details panel
• Right-Click Context Menu - Copy Link, Download, Rename, Favorite, Add Tags, or Move to Trash
• Page Loading States - Animated loading spinner on all dashboard pages during navigation
• Unified Details Panel - File details now live in a single dark panel with CDN and shareable links visible together
• CDN Image Transformations - Resize, crop, and convert images on the fly via URL params (?w=, ?h=, ?fit=, ?format=, ?q=)

Fixed

• Download filename - Files no longer download with a malformed name like image.png-42646149

Added

• Streaming Bulk Operations - Real-time progress feedback for bulk delete with NDJSON event streams
• Discord OAuth2 Login - Sign in to Imperial using your linked Discord account
• Enhanced Auth UX - Modernized login page with darker contrast and refined shadows
• API Key Rotation - Rotate keys directly from the API dashboard with session-based confirmation
• Bulk Delete Fallback - Automatic graceful degradation to non-streaming bulk delete when needed

Changed

• Toast System - Dashboard toast system migrated to Sileo for improved dark-mode readability
• Error Messaging - Clearer completion states for bulk operations (deleted vs already removed vs skipped)
• Auth Pages - Improved contrast and modern dark-mode styling with light accent glows

Fixed

• CORS Hardening - Explicit CORS headers on streaming endpoints for better cross-origin reliability
• Discord Login Errors - Clear messaging when Discord account not linked
• Bulk Delete States - Better handling of already-deleted items in completion summaries

Added

• File Deduplication - Same-file uploads now detect duplicates and store only one copy
• Bulk Export as ZIP - Select multiple files and export them as a single ZIP archive (up to 1000 files, 2GB max)
• Discord Integration - Link your Discord account to get +500MB bonus storage and unlock future bot features
• Duplicate Indicators - See which files are duplicates with visual badges in the grid and detail views
• Settings Page Redesign - Cleaner layout, organized sections, and persistent floating save banner
• Discord Avatar Override - Use your Discord avatar on Imperial with a simple toggle

Changed

• Storage system - Smart file detection automatically identifies duplicates with safe deletion
• ZIP export - Optimized for fast downloads with direct streaming
• Settings UI - Fixed positioning for save banner with slide-up animations

Added

• SDK v1.1.0 - Added folders, tags, privacy, trash/restore, and advanced list filters
• New folder scopes - API keys can now be limited to folder read/write access
• Editable scopes in dashboard - Change API key scopes anytime from the API tab

Changed

• Upload keys are upload-only - Upload keys are now hard-restricted to uploading only
• API docs refreshed - Updated API Reference with new endpoints and filters

Added

• Private uploads - Mark uploads as Private so only you can view them
• Visibility toggle - Switch between Public, Unlisted, and Private from the Media details panel
• Secure viewing links - Private uploads use short-lived access links so they can't be shared accidentally

Added

• Advanced Search & Filters - Search your whole library with filters for type, favorites, size, dates, and include/exclude tags
• Command Palette (Cmd/Ctrl+K) - Quick navigation and key actions from anywhere
• Folder Right-Click Menu - Rename, create subfolders, and delete directly from the sidebar

Changed

• Empty states - Clear next steps depending on Root, a folder, active filters, or Trash
• Media searching - Results are now server-powered for more consistent results

Added

• Trash - Deleting a file now moves it to Trash (restore anytime within 7 days)
• Restore - Bring files back from Trash in one click (single or bulk)
• Tags - Add tags to uploads and filter by tag
• Drag & Drop - Drag files onto folders to move them

Changed

• Media workflow - Faster folder switching and cleaner interactions

Added

• Folders - Organize uploads into folders (including subfolders)
• Bulk Move - Select multiple items and move them together
• Folder Icons - Give folders their own look with custom icons
• Upload Into Folder - Uploads go into the folder you're currently viewing

Changed

• New Media Library - Media tab is now centered around uploads for a cleaner workflow
• Better on Mobile - A smoother Media experience on smaller screens
• Refreshed details panel - Cleaner file details with quick links and actions

Added

• Redemption Key System - Users can now extend access using redemption keys with flexible time periods
• Time-Based Access Management - More flexible subscription system with day-based periods
• Migration Audit Trail - Complete transaction logging for all system changes and user migrations

Changed

• Database Cluster Migration - Successfully migrated 1,889 documents to new high-performance cluster
• Billing System Transition - From Stripe subscriptions to flexible key-based time system
• Backend Performance - Optimized database queries with new index structure

Changed

• Fully redesigned dashboard with modern layout and improved navigation
• Landing page refurbished with updated design and better UX
• Fixed pricing display issues on landing page
• Backend performance improvements and bug fixes

Changed

• Enhanced hero section animations
• Improved dashboard preview visual
• Removed stats separator for cleaner look
• Fixed light mode contrast issues

Added

• Storage Management Page - View usage breakdown, largest files, unused files, and storage trends
• Enhanced Media Lightbox - Added info panel with sliding animation, tooltips, and delete confirmation
• Advanced Search & Filters - Filter media by date range, type, and search with improved UI
• Billing Dashboard Redesign - Visual progress bars for storage and operations usage
• 9 new domains: hostinger.best, i-am.best, i-am.singles, mastercard.christmas, aldi.best, cloudflare.christmas, gdpr.mom, supreme.singles

Changed

• Standardized layout across all dashboard pages for consistency
• Better visual hierarchy and spacing throughout
• Fixed banner alignment and positioning

Added

• New domain: skillissue.lol (expires Mar 2026)
• Domain expiry dates now visible in dropdown
• Expiry tracking system for all custom domains

Domains

Added

• Custom domain selection (i.imperial.gay, ionlyhad192cents.lol)
• Optional subdomain prefixes (e.g., spoody.ionlyhad192cents.lol)
• Real-time subdomain availability checking
• Backend-validated domain configuration

Changed

• Upload API now returns custom domain embed URLs
• ShareX configs automatically use custom domains
• Dashboard Customize page redesigned