local-first ios domain inspection toolkit. dns, tls, rdap, audit. http://git.krz.sh/krz/domain-dig.git/atom?h=v4.8.1 2026-07-20T20:12:24+00:00 2026-07-20T20:12:24+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T20:10:44+00:00 urn:sha1:b4147fe8f14d900c5c87f5fc4129f79884bb92b1 PR #11 merged after the v4.8.1 version bump, so the roadmap's v4.8.1 section omitted the product ID correction and the StoreKit configuration file. Both are in the 4.8.1 tree; document them alongside the other fixes. 2026-07-20T20:07:40+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T19:08:09+00:00 urn:sha1:b5d67f42b7f7e009eb60a80857a306414117969f Adds DomainDig.storekit mirroring the App Store Connect setup: one subscription group with Pro+ at level 1 and Pro at level 2, using the corrected product IDs. Wires it into the Run action so purchases resolve locally against StoreKit instead of the App Store, and disables the DOMAIN_DIG_FORCE_PRO_PLUS launch argument, which bypasses StoreKit entirely and would mask whether the purchase path works. Prices in the configuration are local-testing placeholders and do not need to match App Store Connect. 2026-07-20T20:07:40+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T19:03:36+00:00 urn:sha1:024f611fbbf4d2405a10d649a59968617321732a The four product ID constants did not match the auto-renewable subscriptions configured in App Store Connect, so Product.products(for:) returned an empty array and tier(for:) resolved every purchase to .free. Product IDs are permanent in App Store Connect, so the code is corrected to match the configured values rather than the reverse: domaindig.pro.monthly -> domaindig.pro.month domaindig.pro.yearly -> domaindig.pro.annually domaindig.dataplus.monthly -> domaindig.proplus.monthly domaindig.dataplus.yearly -> domaindig.proplus.annually 2026-07-20T20:07:16+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T20:05:19+00:00 urn:sha1:d69aa35d8843e45e1d13bae82259043787a661b0 Bump AppVersion/marketing version to 4.8.1 and build number to 41 across the app, widget, and share extension targets. Mark v4.8.1 (scheduled report tap target, completed Pro gate, markdown underline rendering, DNS record dedup, inspect tab keyboard behavior) shipped in RELEASE_ROADMAP.md, and note the three follow-ups filed during UAT. 2026-07-20T19:48:54+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T19:48:00+00:00 urn:sha1:1c3d19b233f135a059f5d111dd1a7514af25ed3f The plain-text-to-Markdown transform only recognized '-' underlines, but batchText writes '=' — under the document title and as a 48-character separator between reports. Both leaked through as literal bullets, so a generated report opened with: # Scheduled Watchlist Report - ========================== Title underlines are now consumed alongside the title, '=' underlines promote to H2 the same as '-', and standalone divider runs render as a Markdown horizontal rule. Separately, the DNS section concatenated apex and wildcard records without dedup. On a domain with wildcard DNS resolving to the same addresses as the apex, every value was listed twice. Now deduped while preserving order, so a wildcard value that genuinely differs is still shown. 2026-07-20T19:42:07+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T19:16:52+00:00 urn:sha1:91041af60b5a98ef01f5588478302c1ef04e043d Scheduled Reports: the entire Overview section was wrapped in a single VStack inside one List row, so SwiftUI collapsed every control into one tap target and the menu-style Cadence Picker captured taps intended for the Generate Now button. Unwraps the VStack so each control is its own row, matching the pattern used in IntegrationsView and elsewhere. Also extends the .automatedMonitoring gate to the two Pickers and the Generate Now button. Previously only the Toggle was disabled, leaving a button that appeared active on Free but silently no-opped against the guard in ScheduledReportService. Inspect tab: removes the keyboard toolbar's Dismiss Keyboard button and the onAppear that focused the single-domain field at launch. 2026-07-20T18:56:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T17:11:48+00:00 urn:sha1:ce71e6d93f5200972b9baff0fd17f55d93dbd2b9 2026-07-20T18:56:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T17:05:18+00:00 urn:sha1:6f8a441b622987ffe102cf7153e1bcdd1b730cfc Validating only at send time meant an http:// URL saved fine and then failed silently on delivery. Validate in upsert so the integration editor surfaces it, and give the failure its own error case rather than reusing the generic invalid-URL message. The send-time guard stays as defense in depth for URLs saved before this. 2026-07-20T18:56:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T16:56:37+00:00 urn:sha1:77a42a8b4f3dd89e631f8246bdea3e95f83bac6a Require HTTPS for outbound integration webhooks. Webhook URLs are themselves secrets (Slack in particular), so an http:// endpoint leaked both the URL and the alert payload in cleartext. Disable DomainDebugLog in release builds. Every message used privacy: .public, which opted out of OSLog redaction and wrote looked-up domains to the unified log in shipped builds. 2026-07-20T18:56:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-17T16:20:50+00:00 urn:sha1:6e9dea95d015c0f2d335d9b89b8ee843b4c2b05e Bump AppVersion/marketing version to 4.8.0 and build number to 40 across the app, widget, and share extension targets. Mark v4.8.0 (markdown/PDF export, scheduled reports, stronger share affordances, verified local API consistency) shipped in RELEASE_ROADMAP.md.