Changelog

• No more crash on tap. Tapping your story could throw you out to a red error screen instead of playing it. Photo stories now play normally, and if a story truly cannot be shown you get a friendly message with a back button instead of a crash.

• Only real activity from others. You could get a notification saying someone liked your post when it was actually your own like — these broken entries no longer appear, and liking or saving your own posts and stories no longer creates a notification at all. Your notification count is now accurate too.

• No more red error screen. Opening the feed for the first time could crash the whole page before any post appeared. Posts now load normally, with correct like and save states, and the post dates show the real day instead of an old one.

• Every tap counts. Liking, passing, or super-liking someone used to fail behind the scenes. Actions now go through properly everywhere — the swipe deck, blind dates, hot takes, pop balloon, and the "who likes you" list.

• Like, save, comment, buy, edit, delete. Several buttons on posts looked fine but quietly did nothing. They now all go through — including paid posts, which are now charged at the real price.

• Security hardening behind the scenes. Actions like chats, reels, stories, live rooms, and meetings now always run as you — the app no longer sends your identity with each tap, and read receipts, streaks, and live streams can only be touched by the people in them.

• No duplicates, no disappearances. Other people's story circles could show up twice after reopening the feed, or vanish entirely because of one bad profile. The list now refreshes cleanly every time.

• Always there on first open. Your story circle could still come up empty the first time you opened the feed. It now loads your stories directly every time the feed opens.

• See your story right away. Posting a story worked, but it never appeared in your story circle — not even after reopening the app. New stories now show immediately, and your existing stories load with your profile.

• Share your moments. Posting a reel with original sound or a feed with photos was failing every time. Both now go through — original sounds are saved automatically — and a failed upload shows a friendly message instead of crashing.

• Finish your verification. Tapping the front or back ID boxes used to crash instead of opening the camera. Both now open the camera properly, and the back-side preview shows the correct photo.

• No more endless spinner. Opening your blocked list before blocking anyone used to load forever. It now opens normally with a friendly empty message, and blocked people appear here if you block them.

• See your mutual likes. Opening Matches used to fail behind the scenes and show an error. Your matches now load properly.

• No more endless spinner. Opening your meetings before planning any date used to load forever. The page now opens normally with a friendly empty message, and your dates appear as soon as you have them.

• Add your payout details right away. Opening My Card before saving any details used to spin forever. The page now loads normally and shows the card form so you can fill in your payout details immediately.

• No more red error screen. Opening the leaderboard when only one or two players are ranked used to crash the page. The top-players section now adapts — one winner shows alone, two players show side by side, and the full top three appear once enough players are ranked.

• See when it happened at a glance. Story timestamps could fail to load or show a raw number. They now show friendly times like "5 minutes ago".

• Share the moment. Adding a photo or video to your story was failing every time. Stories now save properly — and deleting one actually removes it.

• Checklists share their lessons. The packaging guides for both marketplaces now include each other's applicable safeguards, while keeping their different licensing rules separate.

• Point, click, done. Navigation links, footer columns, and social icons in the theme editor are now simple rows you can add, edit, and remove — no more raw code blocks.

• Nothing left undocumented. The manual now walks through each value buyers must replace — login keys, ad IDs, deep-link domains, the support address, call setup, and share links — with two new troubleshooting answers.

• Buyer-ready copy. The release package was swept for leftover keys, private branding, and machine-specific files — everything now uses placeholders the buyer fills with their own accounts.

• No more clutter. When customizing a landing page design, the editor now shows only the texts and images that design actually uses, instead of every setting from all designs at once.

• No more third-party detours. After signing in with Apple in a browser, users now land on a page you choose (a setting, or your own site address by default) instead of an address that doesn't belong to you.

• One complete manual. The main setup guide absorbed the pieces that only existed in one marketplace copy — seeded demo data, web metadata, and the full Android/iOS release signing walkthroughs — plus the latest wording updates.

• Safer voice and video calls. Calls now use short-lived, single-room passes created fresh on the server for each conversation, instead of one shared key — and a setup mix-up that could leave calls unconfigured was fixed along the way.

• Phone sign-in is now verified. The server double-checks the phone login directly with the login provider before handing over an account.
• Other people's private details stay private. Profiles you view now show dating info plus an approximate distance — never email addresses, phone numbers, exact locations, or balances.
• App setup data no longer leaks secrets. Technical passwords and keys were removed from the public setup download; only the IDs the app needs are shared.
• Payment notifications are authenticated. Every payment provider's alerts are now signature- checked, and only yours and others' own dates, posts, and products can be changed or removed — plus fixed shop pages that could crash on seller info.

• Payments are double-checked. Coins and premium are now granted only for a confirmed payment — every purchase is recorded once, so it can never pay out twice, and transfers between users are protected against errors. Free welcome coins are now claimed through a dedicated, one-time bonus.

• Photos, videos, and files are verified. Every upload (chats, stories, reels, reports, dates, and more) is now checked to be a genuine media or document file before it is saved, and the upload folders are locked so nothing stored there can ever run as a program.

• Sign-in starts blank. The admin login page no longer comes with an email and password already typed in, and no sample login details are left behind in the page for visitors to find.

• Only admins and moderators can sign in. Regular app accounts can no longer open the admin pages — and each moderator role only sees the sections its permissions allow. Dangerous shortcuts (like running server commands) are limited to fully authorized roles.

• No more public sign-up page. The admin sign-in area no longer offers a way for anyone on the internet to create an account — new accounts can only be created from inside the panel by someone who is already signed in.

• No more cloudy, washed-out panels. The totals card, filter pills, and list rows now use a single clean glass layer, so colors stay crisp instead of milky and doubled-up.

• Same cloudy-glass fix as Withdrawals. The summary card, type filters, and earning rows now use one clean glass layer instead of two stacked tints.

• One icon, one layer. The video thumbnail preview was stacking its placeholder and add-button twice under a grey wash; now it renders once, sharp. Other flagged screens (interactions, matches, blocked users, plans, followers, notifications) were audited and have no such double layer.

• No more blank white cards. The notification cards now use the app's frosted-glass style with readable titles and Push / SMS / Email switches in both light and dark mode.

• One clean character count. The caption box was showing two overlapping counters; now there is a single count and the photo preview is free of its grey haze.

• Video calls now open video. A setup check found regular video calls were loading the voice-only screen — corrected, along with the Decline button (which never hung up) and the missing notification permissions calls need on newer Android phones.

• Tapping call or video actually calls. The voice and video buttons in chat were not connected to anything, so tapping them did nothing. Both now start the right kind of call immediately.

• Easier to publish with confidence. The setup guides now show the right check for each file type before you upload to Google Play, with the step-by-step signing and branding instructions unchanged.

• Fresh profiles, instantly. Saving filter changes now reloads your swipe deck right where you are instead of restarting the whole app.

• Your microphone stays on in the background. Calls and livestreams now keep audio going if you switch apps, with a notification that takes you back. The first time, the app explains this and lets you opt out.

• No more endless "Processing…". Paid coin purchases now credit your balance and finish correctly, and any store problem tells you what is wrong instead of going silent.

• No waiting for the network. Settings now opens immediately from your saved profile and quietly updates itself if anything changed on the server.

• Back button visible again. The packages screen matches the app theme, with readable cards instead of solid white blocks.

• Less for reviewers to question. Removed an unused background-messaging declaration and unused background-location permission left over from old code — the app never used either.

• Stops waiting after a few seconds. If the list can't load, the page now gives up gracefully and tells you there's no one blocked instead of spinning forever.

• Blank and forever-loading screens fixed. The map now opens even with no one nearby, the leaderboard and event lists show friendly messages instead of spinning forever, Lama AI waits briefly then offers a retry instead of a blank page, and upload progress always clears. The video trimmer now allows up to 30 seconds, and payments offer just Google / Apple Pay plus card.
• Premium-only means premium-only. The visibility toggle in filters and edit profile stays off for free accounts.

• No more blank screen from the profile menu. Settings now always has something to show, and every row — toggles, dropdowns, sliders, and dividers — matches the app's dark theme instead of solid blocks.

• You can now reach the submit button. The verification submission form scrolls when its content runs long, and the profile-type options are readable before you select one.

• Blocked users, subscriptions, plans, uploads, followers, edit profile, notifications, and events. All now use the same themed background and readable text — including difficult spots like the plan comparison cards, the profile theme picker, and notification menus. Fixed along the way: the Unblock confirmation that never appeared, and a crash in the Events tab switcher.

• No more white screens. Send Dymonds, Interactions, and Matches now use the same dark themed background and styling as the rest of the app — including their loading, empty, and error states, so you never hit a bright unstyled page mid-flow.

• Verified safe, no changes needed. The installer's database update step was compared against the live admin runner and confirmed correct — including the setting it needs for unattended installs.

• No more personal keys in the package. Error tracking is now off by default and only turns on when you add your own key — the app runs normally without one.
• Clearer app setup. The app now ships under the Lamat name everywhere, with step-by-step guides for changing the app name, connecting your own login/notification accounts, and installing the database from the included file even if the download server is unreachable.
• Honest cost guidance. The guides now explain that login, notification, chat, video, and payment services may charge depending on how much your app is used, so you can plan your budget before launch.

• Future updates can't silently re-break the package. Both submission guides gained a review-gates checklist with copy-paste checks for sensitive files, error-tracking keys, the bundled database, app names, SDK versions, the app readme, and cost notes — plus corrected setup paths and template references.

• Setup guide plus clear license links. The readme now opens with quick start, configuration, and troubleshooting help, and points to the right license terms for CodeCanyon and Codester buyers.

• Copy-paste commands for every build. The buyer guides now show exactly how to enable error tracking when running and when building for Android, iPhone, and web — including the reminder to repeat the settings on every release build.

• Rename in VS Code, step by step. The renaming guide now shows how to swap the app name with VS Code search-and-replace, with a screenshot walking through each click.

• Database setup is self-healing. After loading the included database file, the installer now automatically applies any pending updates, so your install is always complete — and you'll see the result right in the setup screen.

• No more white screen or oversized gap at the top. The Withdraw page now uses the same dark themed background and modern input style as the New Product page, with normal spacing on phones and tablets.

• Install in 4 quick steps, fully offline. The Codester backend package no longer asks for a purchase code or contacts a license server — the database installs from a file included in the package, and the buyer guides were updated to match.

• One less thing standing between you and updates. We removed an unused background-sync component the store was flagging, so future releases move through review smoothly. Notifications for calls and messages are untouched.

• Dead rooms clean themselves up. Empty or long-abandoned voice rooms now close on their own, lists refresh faster, and room badges show the real room type — all re-verified live.

• Ticketed rooms and per-minute pay work. Live testing with real accounts proved paid entry (diamonds), host earnings per minute, and tier-ordered lists — with every test trace removed afterward.

• Find rooms close to you. New rooms remember where they were created, so the Nearby tab lists the closest ones first (rooms without a location appear last).

• Tabs, interests and trophy now do their jobs. The top tabs filter rooms, the people row shows live hosts you can join, the trophy opens a top-rooms chart, and upcoming times display correctly.

• Open, followers-only and invite-only rooms. Hosts choose who can join at creation; joining, leaving and closing now update counts correctly, and only hosts can close their room — verified live end to end.
• Spotlight cards on home. The busiest room, Gold hosts' rooms and upcoming rooms get their own showcase cards with live counts.

• Featured rooms, Gold hosts and announcements. The plan now includes a spotlight card for the busiest room, a gold look for Gold hosts' rooms, an announcements banner, and live speaking indicators — all for a future build.

• Room history, topics and paid entry planned. A design review lined up the next voice-room upgrades — recently visited rooms, topic tags, region browsing and ticketed entry — for a future build.

• Cleaner tabs and livelier room cards. Categories are now sleek text tabs, and each room shows live occupancy bars with member counts — the busiest room gets a highlighted frame so members spot where the action is.

• Open, followers-only and invite-only rooms ahead. A review found rooms never really closed and anyone could join anything — the new plan maps private rooms, proper leaving and closing, and host earnings, all manageable from the admin panel.
• Planning only. No app changes yet — this is the blueprint the upgrade will follow.

• Your taps now actually count. A live end-to-end check (upload, watch, like, save, comment with a real test account) found views crashing and likes/saves silently failing — both fixed and re-verified green, with all test traces removed.

• Video browsing now checks itself. 18 automated checks using the project's real sample videos verify feeds load, pages turn, the right video plays, and failures recover with a retry — catching regressions before they reach you.

• The full video upgrade is now in the build. Profiles load once instead of per video, buttons animate without stutter, upcoming previews preload silently, and dead code was removed — longer watch sessions, less data and battery use.

• No more waiting when switching tabs. For You, Following and Trending now stay loaded as you move between them, and scrolling fetches the next videos just before you reach them.

• Smoother reels already in this build. Short videos now show a preview image while loading, start only when visible, and stop the moment you scroll past — with a retry button if one fails to load.
• More speed work queued. The feed rewrite (faster tab switches, no repeated downloads) follows in the next steps.

• Faster, stutter-free scrolling ahead. A technical plan now maps out how short videos will load instantly, play one at a time, and stop draining battery while browsing.
• Planning only. No app changes yet — this is the blueprint the upgrade will follow.

• Setup no longer stops halfway. A database step that already existed was blocking the remaining updates; it now skips safely when there is nothing to do. Nothing you entered was touched.

• Members compare plans before paying. A new plans page shows Plus, Gold and Platinum side by side with their benefits and prices — tapping a plan opens its payment screen.
• Everything adjustable from the admin panel. Tier names, benefits, prices, and store settings are all managed in one place, with a setup checklist for connecting the app stores.

• Plus, Gold and Platinum will be fully adjustable. A build plan now describes how every subscription detail — prices, benefits, and store settings — can be managed from the admin panel, plus a new in-app page where members compare tiers before choosing one.
• Planning only. No app changes yet — this is the blueprint the upgrade will follow.

• Clearer setup requirement for buyers. The Envato description now asks for Flutter 3.47 stable (tested with 3.47.2) with Dart 3.13, instead of the confusing "3.44 or higher" wording the reviewer flagged.
• Nothing else changed — same app, same features, just accurate version info.

• Another header icon removed. The Top Picks button now sits in the ⋮ menu alongside Who Likes You, Map View, Events and AI.
• Same premium rules. Free members still see the upgrade prompt; Gold members open Top Picks as before.

• One less icon on the top bar. The star button that opened Who Likes You now lives in the ⋮ menu (with Map View, Events and AI), so the header stays less crowded.
• Same premium rules. Free members still see the upgrade prompt; Gold members open Who Likes You as before.

• Email changes now need a confirmation click. Enter a new address and tick save — we email you a secure link that expires in an hour. Only after you open it does your profile update.
• Phone changes verify with a text message. Saving a new number asks for a one-time code from SMS (same verification as sign-in), then stores the number as verified.
• Old behaviour removed. The email field no longer tried to save directly (which always failed) — everything goes through the confirmation steps above.

• Reviewer feedback addressed. The long repetitive bullet lists — especially the feature and admin dashboard sections — were condensed into short paragraphs anyone can scan.
• Nothing important was removed. All selling points remain: swiping, chat and calls, stories and reels, live streaming, the 6 dating games, monetization, and the admin panel. They are now grouped by benefit instead of listed setting by setting.
• Dashboard section simplified. The 50-plus admin settings are now one readable list of categories, with duplicate entries removed.

• Requirements now name the Flutter version. The setup section lists Flutter 3.44 or higher (tested with 3.47.2) with Dart 3.12 or higher.

• AI is mentioned where it matters, not everywhere. A light touch — intro, chat, Hot Takes, and safety — notes where Gemini and Sight Engine help (translation, replies, matching, moderation) without sounding like buzzword stuffing.

• Admin panel scripts are now reviewable. Chart.js, Popper, Bootstrap and Smooth Scrollbar are included as their original unminified files (v2.9.4, v2.9.2, v5.0.0, v8.4.0) and pages load those — no minified files remain.

• Private keys no longer ship. The release keystore, Firebase credentials, Google Maps key, and Play service-account key were replaced with placeholders and setup instructions. Buyers add their own keys — your accounts stay private and the app still builds.

• Fresh uploads can now reach the installer. A leftover file marked the package as already installed, which would have locked buyers out of the setup wizard. Your own license file, local log, and test cache were removed too — all recreate themselves on the buyer's server.

• Three unreferenced .min files plus one stale bundle are gone. A full reference sweep proved no page loads them, so the admin panel is unaffected — it keeps using the readable sources and the four vendor files it actually needs.

• Reviewer feedback addressed. The .idea folder, all build output folders, nine stale .dart_tool pub caches, and two IDE module files were removed from the submission. A rescan confirms none remain — no source files were touched.

• Reviewer feedback addressed. Build caches (Gradle, Kotlin, CMake outputs) and 22 verified-empty placeholder folders were removed from the submission's flutter_app — including empty Zego example-app skeletons and an unused voicechat search folder.
• Laravel storage folders were kept on purpose. They look empty but the framework needs them at runtime for compiled views, cache, and sessions. Removing them would break fresh installs.

• Each key now has a short comment. App, logging, database, realtime and Pusher, cache, queue, session, Redis, email, and demo mode are grouped with plain-language notes on what to set and where to get the values.
• No values were changed — comments only, so existing setups are unaffected.

• The splash animation type was hard-coded. The app always treated the splash as a GIF animation, even when the admin panel was meant to allow a static image. The setting existed in code but was never read from the server.
• It is now a live configuration option. A new Splash Animation Type field appears in the App Images Icons settings. Set it to gif for an animated GIF, or image for a static picture. The app reads the value on every launch and switches behaviour accordingly.
• Defaults remain unchanged. If the field is left empty the app continues to show the built-in GIF animation, so existing installs are not affected until you choose to change it.

• The splash screen could come up blank. If the artwork in the admin panel was left empty, or the app could not reach it, the opening screen showed no background and no animation at all — and a failed animation could take the screen down with it.
• It now falls back to the artwork built into the app. Those images ship with the app, so the opening screen always shows something. A custom image still appears as soon as it loads, and is quietly skipped if it cannot.
• Light and dark mode are handled separately. A custom light background no longer affects the dark one.

• Choosing a photo did nothing on iPhone. On your edit-profile page, tapping an image and picking "Photo library" or "Camera" gave no response at all — no picker, no permission prompt, no error message. The same silence affected sending a picture in chat, verification selfies and ID photos, and posting to feeds.
• The cause was a device check meant for Android. Before opening the picker, the app asked every phone for Android system details. On iPhone that request fails, which stopped everything before the picker could appear. Those details are now requested on Android only.
• Found while validating the iOS 26 and 27 update. Nothing changes for you on Android — this simply restores the same behaviour on iPhone.

• Some new accounts never finished signing up. After creating a profile, the app could sit on the loading screen forever instead of taking you into the app.
• Saving your profile is now guarded. If the phone's local storage is slow or briefly stuck, the app stops waiting after a few seconds and shows a proper message instead of spinning forever — and it reopens storage itself if it was closed.

• Nothing looks different — this is behind the scenes. There is now an automated test that signs up one user and verifies their account, name, and photo are saved exactly as registered, so this kind of stall gets caught before it reaches you.

• Nothing changes in the app. Local editor and helper folders are now left out of version control to keep the project clean.
• Filter options load more reliably. The "here to" choices and the interests strip on the filter screen — and the "looking for" choices during sign-up — now update on their own when ready instead of depending on one-time loads.
• Premium-only filters stay exclusive. The "Show Premium User Only" and "Global Match" switches now appear only for premium members, not for free accounts.
• Finishing the first-time setup restarts cleanly everywhere. After completing the initial filters, the app now does a full restart on web as well as on mobile, so everyone lands in the app the same way.
• Shared posts open right on the post. Tapping a link to a specific post now opens that very post on its own page instead of the general feed.
• Links open the right page, properly. Taps from outside the app (profiles, chats, matches, posts) now travel through the app's own page system instead of one-off pop-ups, so back buttons and navigation behave normally.
• Open a post to see every detail. The single-post page now shows the full picture: photo gallery, author, caption and tags, likes and stats, music, products, sponsor info and post details — with liking and commenting right there.
• Tapping a match opens that person. Links about a new match now jump straight to the matched profile instead of a generic list.
• Event links open event swiping. Tapping a link to an event now jumps straight into swiping that event's members, just as if you had tapped the event itself.
• Verification links open verification. Tapping a verification link now jumps straight to the verification page instead of a generic screen.
• Promotions have a home now. Tapping a promotion link opens its page (or the full promotions list when the link names none), with details and a link button. New promotions appear once added on the server.
• The feed loads again. Posts were coming back empty because of a check on the server that asked for something the app never sends. That check is removed, so the feed fills up normally.
• Videos from people you follow load again. That section crashed on the server because of a leftover line that did nothing useful. It is removed, so the list opens normally (empty if you follow nobody yet).
• Followers and following lists load again. These were blocked by a server check asking for something the app never sends, and the app was also looking for the names under the wrong key. Both are fixed, so the lists fill up normally.
• The leaderboard loads again. That section failed because its address was missing on the server. It now exists and returns the top members (empty until members earn rank).
• Demo mode is never empty. When there is nothing to show, the demo now fills in from all members: the swipe deck, followers and following, chats (openable as new conversations), the videos feed and the following-videos tab. Live streams and posts already showed everything.
• Technical clean-up behind the scenes. App screens now share one central place for saved settings instead of passing them from screen to screen, page addresses no longer carry settings baggage, and a leftover duplicate settings channel is gone. Nothing looks different in the app.

• No more background location checks. Echoes used to look for nearby people even when the app was closed, which app stores reject. Now it only checks your location while the Echoes screen is open or when you tap refresh or check in yourself.
• A clear permission screen comes first. Before the phone asks for location, the app now explains in plain words what is used, when, and that nothing runs in the background — so there are no surprises.
• Turning Echoes off truly stops everything. Disabling the feature immediately stops all location use, and leftovers from older app versions are safely ignored.

• The app would not package for release. The build stopped right away saying the project's build tool was too old for the current Flutter version.
• Updated the build tool behind the scenes. Nothing looks different in the app — this just lets the release version build and install normally again.

• Nothing changes in the app you use. A fresh copy of the app's Android foundation was set up with the latest recommended tools, ready for the future.
• All store and login settings carried over. Things like notifications, maps, payments, and the app's store identity were carefully moved across so nothing is lost when the switch happens.

• Nothing changes in the app you use. The new template wanted a different way of fetching iPhone building blocks, but the video-call pieces the app relies on don't support it yet — so the current proven method stays, with all its settings carried over.
• Same app identity on iPhone. The new shell now uses the same app ID as the live app, so updates keep working as usual.
• iPhone permissions and services moved over. Login with Facebook and Google, notifications, camera and location explanations, and advertising settings were all carried into the new shell, now showing the Lamat name.
• Web version look carried over. The browser version keeps its icon, loading screen, sharing preview, and login buttons exactly as before.
• Fixed a hiccup building the new shell. The first test build of the new foundation stopped on a technicality in its settings file — corrected, and the build is being retried.

• A "For You" row now lives at the top of the Shop. It learns from what a buyer has already purchased and puts similar and featured products right at the front.
• Buyers without order history still get picks. New shoppers see the newest and featured items instead of an empty recommendation shelf.

• Creators can now earn from the Shop. A new Affiliates section lets creators browse commission plans, join them and request product samples from sellers.
• Personal referral links pay out automatically. Every order placed through a creator's link credits the creator's wallet the moment payment completes — whether the buyer pays with credits or a card.
• An earnings dashboard tracks it all. Creators see clicks, orders and commission earned at a glance, and can copy any of their links to share.

• Sellers get their own control room. The new Seller Center shows revenue, paid orders and product count, plus direct access to seller order fulfilment.
• Storefronts can be personalised. Sellers set a store name and description, and verification status is clearly displayed.
• Admin gains seller oversight. A new Shop Sellers admin page lets staff verify or suspend sellers, and the dashboard now shows shop revenue, orders today, new sellers and low-stock products.

• Buyers can request a return. Delivered orders now offer a Request Return action with a reason.
• Sellers can refund directly. Approving and refunding a return reverses the credits back to the buyer's wallet automatically and updates the order timeline.
• Disputes have an escape hatch. Either party can open a dispute on an order and resolve it with a written outcome.

• Products can be put on subscription. Sellers flag items as subscribable and buyers pick weekly, biweekly or monthly delivery.
• Renewals happen hands-free. A scheduled task charges the buyer's wallet and creates the renewal order automatically; if the balance is short it simply tries again next cycle.
• Easy management from My Orders. A new Subscriptions sheet lists active subscriptions and lets buyers cancel in one tap.

• Three premium tiers replace the old one-size-fits-all premium. Members now join Lamat Plus, Gold or Platinum, each unlocking a bigger set of perks, and the app shows a tier badge on member profiles.
• Plus removes the limits. Members swipe with unlimited likes and rewinds, can browse invisibly with Incognito mode, and change their location to match anywhere with Passport.
• Upgrading, downgrading or cancelling just works. The membership level updates instantly, and perks expire gracefully when a subscription ends.

• The subscription screen got a full makeover. The old custom paywall is replaced with a modern, native purchase experience that follows each store's guidelines.
• Plans refresh themselves. Pricing, plans and special offers come straight from the App Store and Play Store, so testers and users always see the live catalog.
• Desktop and web users are covered too. The familiar card-based plan sheet remains available where the new purchase experience isn't supported.

• Gold members see who likes them. A new grid reveals everyone who has already swiped right, so a like back is an instant match.
• Hand-picked Top Picks arrive daily. A curated batch of the most compatible profiles shows up every day.
• Weekly perks land automatically. Free Super Likes and a monthly Boost are granted on schedule — no need to claim anything.

• Platinum likes jump the queue. Likes from Platinum members are shown ahead of everyone else's.
• Say something before you match. Platinum members can attach a short note to a Super Like, so the other person reads it before deciding.
• More visibility everywhere. Platinum hosts appear first in Live Streams, get priority placement in the Shop with lower selling fees, and earn a bonus on affiliate commissions. A new Likes Sent history shows the profiles liked over the past week.

• Platinum members get a direct line to us. A new Support area in the profile menu opens a real conversation — start a ticket, reply to it and follow the whole thread in one place.
• Every message is kept together. Past tickets stay in the inbox with their status, so nothing gets lost between replies.
• Our team answers from the admin panel. Support staff see new tickets as they arrive, reply directly and close a conversation once it is resolved.

• Platinum profiles can dress up. A new theme picker offers six animated gradients — Aurora, Sunset, Midnight, Royal, Rose and Neon — that become the backdrop of the profile header.
• Visitors see the theme too. The chosen gradient shows up when someone else opens the profile, so a first impression feels personal.

• Platinum hosts can welcome more people. Rooms hosted by a Platinum member hold twenty extra listeners before they are full.
• The front seats are kept for Platinum guests. Reserved seats are marked with a crown so everyone can see them, and members without Platinum are invited to upgrade instead.

• The app's automated health check is green again. Thirty-one code warnings across the discovery pages, voice rooms and profile screens were tidied up, so future updates build on a clean foundation.
• Nothing looks different — and that is the point. This was behind-the-scenes housekeeping: buttons, badges and layouts all behave exactly as before, just with the code now passing its quality checks.

• Fixed CanvasKit PathBuilder error on web. The app was crashing with "PathBuilder is not a constructor" error because manual CanvasKit files were placed in the web folder instead of letting Flutter generate them automatically during builds.
• Removed manual CanvasKit files. The web/canvaskit/ directory with manually placed files was removed to allow Flutter to generate the correct CanvasKit assets during web builds.
• Updated web bootstrap script. Added async attribute to the flutter_bootstrap.js script tag in web/index.html to match current Flutter web best practices.

• Added sw package for optimized web performance. The sw (Service Worker) package v0.1.5 was added to dev_dependencies to provide an optimized Service Worker and Bootstrap pipeline for Flutter web builds.
• Global activation completed. The package was activated globally using dart pub global activate sw, enabling the generation of service worker files with resource manifest and caching logic.
• Build process enhanced. The new setup allows generating sw.js and bootstrap.js files during web builds, providing intelligent caching, CanvasKit CDN loading, and a professional loading experience.

• General bug fixes and UI enhancements across the application to improve user experience and stability.

• Four public pages are now live on the backend: Privacy Policy (/privacy), Your Privacy Choices (/privacy-choices), Cookie Policy (/cookies) and Help & Support with a FAQ section (/support). They are open to everyone — no login needed — and are styled to match the site branding.
• The app's old privacy links now land here too. The in-app browser links that used ?page=pp, ?page=cookies and ?page=faq now redirect to the new public pages instead of opening the landing page.
• Content is editable from the admin panel. A new "Public Pages" section in the sidebar lets you pick any of the four pages and edit its title and body with the same editor used for blog posts, then save straight to the database. The changes appear on the public pages immediately.
• The pages live in their own database table. A new public_pages table stores each page's slug, title and HTML content, and comes pre-filled with sensible default Privacy, Privacy Choices, Cookies and Support text — ready to be customised.

• The app and server finally agree on genders. Everyone's gender options come from one single list in the database (the genders table), and the "Show me" choice now stores the id from that same list (or "all"). Previously the server used its own old internal list while the app used the database list, and the matching screens looked for values that were never stored — so gender filtering in swipes, echoes, blind dates, hot takes and live mingle silently showed everyone to everyone. All five now resolve the choice through the same helper, so filtering works properly.
• The "Show me" settings screens were fixed too. The app previously read and saved the choice by list position, which misidentified straight people as "All" (e.g. picking "Straight Woman" was shown as "All"), and the settings dialog read the option with a broken accessor that could crash. Both the filter screen and account settings now match by the real gender id.
• Registration now separates the two questions. The sign-up flow now asks "Show me" (which gender you are interested in) and "I'm looking for" (your purpose — love, friendship, etc.) as two separate choices, and both are saved. The old flow mixed these two meanings into one mislabeled picker.

• What you pick is what gets stored. Every way a profile can set gender — sign-up, editing settings, and the server's generic update — now saves the exact gender id from the database list the user selected. Before, the database had a leftover "male" default, and accounts created through Apple, Google, Facebook or phone login silently got the word "male" stored instead of a real gender, so those users could be missed or mismatched by gender filters.
• Old accounts are repaired. A database update converts any existing "male"/"female" text values to the matching gender from the list, and the column's default is changed so no future account can fall back to "male" again.

• "Here for" and "I'm looking for" are now one thing. They stored the same answer (make friends, find a date, etc.) in two separate places — one was written once at sign-up and never used again, the other is what you edit in settings. The duplicate is removed: sign-up now saves straight into the one real field, the profile no longer sends or reads the old one, and a database update merges any existing values before removing the extra column.
• Double dates were still using the old gender list. The double-date matcher checked hard-coded "men"/"women" values that are never stored anymore, so it silently ignored everyone's preference. It now uses the same gender-list helper as every other feature.
• All the leftover old-style code was cleaned up. The blocked-users screen shows the gender correctly instead of a 0, live mingle and hot takes store the choice in the same id format as everywhere else, a useless line was removed from swiping, and the admin panel (sign-up, user management, profile editing) now offers the same gender list from the database instead of a fixed Male/Female/Other dropdown.
• A settings bug in the app was fixed along the way. The advanced filter screen's dropdowns could overwrite several profile fields at once because the code didn't stop after the right one — each choice now updates only its own field.

• No more app restarts after logging in or registering. After signing in (with password, Apple, Google, Facebook or phone) or creating a new account, the main screen sometimes showed an empty profile until the app was restarted. The profile was saved on the server but the app's memory and what the home screen reads were out of sync. Signing in now updates both at once, and the main screen also re-reads the saved profile if it ever starts without it — so your name, photo and account details are there immediately.

• Only your session is cleared when you sign out or get logged out. Before, signing out (or the app automatically logging you out after an expired session) also erased preferences like your display language, dark mode choice, favourite music and the features you were introduced to. Now only your login details are removed — restarting the session no longer resets your personal setup.
• Session-expiry handling was hardened. The routine that detects an expired login and sends you back to the sign-in screen could get stuck after the first timeout and never react again; it now always resets itself. A small background location-ping task was also cleaned up so it always finishes properly.

• Your access token used to be copied into the database in readable form. Every time you signed in or registered — including through Apple, Google and Facebook — the server wrote your session token in plain text next to your account. Tokens are already protected on the device and in the server's token table, so this duplicate copy was an unnecessary risk if the database ever leaked. New logins no longer write it, and a database update removes the leftover column.
• Web builds lock the token down too. The app's secure-storage switch on the web now explicitly uses strong encrypted storage instead of the fallback option, and a dead in-memory token variable was removed so no code can read a stale empty token.

• Apple asked for a privacy explanation for using the device's location in the background, so a new build had to be prepared. The app already explained why it needs location while open and in general. Apple also wanted the wording that covers the "always" option, so this explanation was added to the iOS settings. The explanation text matches the existing ones — "This app needs access to location to save your default location." — and the updated build is ready to be uploaded to the App Store as version 5.5.3 (build 17).

• Any action that changes a chat no longer travels as a plain GET request. Marking a message as read, reacting to, deleting, starring, pinning, editing or forwarding a message, and creating or restoring chat streaks now use the POST method, which is the proper way to change data on the server. Simply viewing chats, messages, streaks or call history still use GET, and nothing else about the requests was touched.

• Updating your profile, photos, stories, credits or settings no longer happens over a GET request. Updating profile fields, settings and notifications, following or unfollowing, liking, adding or removing interests, boosting, visiting, purchasing or deleting stories, deleting conversations or photos, spending credits and saving favourite sounds now all use the POST method. Anything that only reads data — your profile, followers, rankings, matches, visitors or payout history — still uses GET.

• On iPhone, signing in with Apple no longer asks the server to re-check the Apple token. Apple's login screen already confirms who the user is on the device, so the app now simply tells the server which Apple identity signed in, and the server signs into that account. Fewer steps and no extra network checks, so Apple sign-in on iOS is faster and less likely to break. The Apple button only signs into an existing account — it never creates a new one automatically — and Android / web keep the full secure verification since those flows need it.

• Every remaining action that changes data — in feeds, reels, voice chat rooms, stories, events, live streams, wallets, meetings, subscriptions, notifications, blocking, rankings and location updates — was moved from GET to the POST method in both the app and the server. Anything that only reads information (listing feeds, sounds, rooms, balances, transactions, matches or comments) stays as a quick GET request. The server routes were updated to accept the new method, so the app and backend always agree.

• Starting or joining a live stream no longer travels as a plain GET request. Starting a stream and recording who joined it now use the POST method, and the server was updated to match. Loading the list of live streams still uses GET.

• Photos chosen for a date request now travel with the request itself in one upload. Previously the app uploaded each photo separately and then a second request created the date. Now the photos are uploaded as part of the same single request when you send the date invite, and the server keeps them attached to the date — they appear in both users' "my meetings" screens as before.

• Creating a feed post with multiple photos is now a single upload. The app used to create the post first, then send each photo one by one. Now the post details and all its photos are sent together at once, so posting is faster and the post never exists without its photos. The same tidy-up was applied to reels, and the old file-upload helper endpoints were retired.

• Release builds no longer stop at the Google Maps setup. The automated build for the Play Store was failing before compiling because the tool that reads the Maps API key was listed in the build settings without its version number. The version is now declared, so the build loads the tool correctly and can proceed all the way through.
• Removed duplicate, unused build files. The project carried two copies of its build settings, and only one set was actually used. The unused copies were removed so the release build always reads from a single, consistent set of settings.

• Release builds no longer crash inside the map plugin. After the first fix, the build got further but still stopped while compiling the Google Maps part of the app, because the version of the Kotlin coding tools the project was using was older than what the map plugin needs. The project now uses the same up-to-date tool versions that the current version of the app framework recommends, so the map code compiles cleanly.

• Crash reporting, Firebase setup and Play Store publishing tools were updated. These three helper tools were several years behind the current versions the build system recommends. Newer versions are officially designed for the build system now in use, fix known problems with newer Android builds, and everything the app needs was already in place, so the update is safe.
• Every other build setting was double-checked. The remaining build tools and libraries were reviewed one by one against the current build system and all of them are compatible, so no other changes were needed.

• The crash-reporting SDK was brought up to date. The version in use was from a couple of years ago and no longer compiled with the newer build tools, which stopped the Play Store build again. It has been updated to the current version, and the way the app uses it stays exactly the same, so crash reports keep working as before.

• Fixed a mismatch that stopped the messaging library from building. One of the chat libraries was being compiled partly with an old version of Java's language settings and partly with a newer one, and the build tools refuse to mix them. The build now uses one consistent language level across every part of the app, which the stricter newer build tools require.

• Mended an old chat library that no longer worked with the current app framework. The library that keeps real-time chat and game features connected had been abandoned and referenced an old app-framework feature that no longer exists, which stopped the Play Store build once more. A fixed copy of the library is now kept inside the project with that outdated reference removed — the way the app talks to it is unchanged, so live chat behaves exactly as before.

• No more silent sign-outs after a day. The login token that keeps users signed in used to expire after 24 hours, which meant people who opened the app on a later day would suddenly find their feed failing even though they still looked logged in. Sessions are now valid for 90 days from login, so staying signed in just works.
• Fresh logins still work exactly as before. Every time someone signs in — password, phone, Google, Facebook or Apple — they receive a new 90-day session, so this change only makes things more convenient, never less secure.

• Every Apple sign-in now gets a one-time secret code. When someone signs in with Apple, the app creates a unique code and asks Apple to stamp it onto the login receipt. Our server checks the stamp before letting anyone in, and refuses to accept a receipt that has been used before — so a stolen or copied login can't be reused to get into an account.
• Apple's session details are now kept safely on file. The server stores the Apple refresh token it receives at login, so the account stays linked to Apple even on Android and the web where Apple behaves differently.

• iPhone, Android and web are each handled the way Apple expects. The login flow now speaks Apple's language per platform, which keeps sign-in working consistently and avoids the session being rejected on one device while working on another.
• Verified email addresses are now read accurately. Apple's "email verified" flag is interpreted exactly as Apple sends it, so unverified details are never mistaken for verified ones.

• No more frozen screens when a login runs out. If a session ever does end (for example a blocked account or an older login that ran past its date), the app now notices the rejection, clears the local session in the background and sends you back to the sign-in screen — instead of quietly showing error after error while the app appears broken.
• Everything is tidied up automatically. The stale login is removed from the device and all in-memory profile details are reset, so the next sign-in starts clean with no leftovers from the previous account.

• A full marketplace now lives in the app. Teels has a new fourth tab (For You / Following / Trending / Shop). The Shop tab shows a browsable product grid with category filters and a search screen with sorting and endless scrolling, so users can discover goods without leaving the video feed.
• Products now have real catalog data. Sellers can list physical or digital items with stock, SKU, currency, shipping fee, media gallery, featured flag and SEO fields. Digital items are marked clearly and need no shipping.
• The Shop tab can be turned on from the admin panel. A new "LAMAT SHOP" plugin controls whether the tab is visible and lets the owner toggle wallet or gateway payment, set the default currency, shipping fee and free shipping threshold, and set the platform fee.

• Product page: swipeable image gallery, stock and quantity controls, seller info and an Add to Cart / Buy Now action that both drop the item straight into the cart.
• Cart: change quantities, remove items and see the running subtotal before checking out.
• Checkout: pick a saved shipping address (or add a new one), apply a coupon, and pay either with the in-app wallet balance or through the standard payment gateways in a secure in-app browser. Digital orders skip the address step entirely.

• Orders behind the scenes: orders are created automatically grouped per seller, payment is confirmed through the wallet or the payment webhooks, and the seller is credited automatically minus the platform fee. Digital goods are delivered instantly after payment.
• My Orders / Seller Orders: buyers can cancel, track and confirm delivery; sellers can mark orders shipped (with a tracking number) or delivered. Every status change is kept in a history.
• Shipping addresses: save and manage multiple addresses, mark one as the default, and reuse them at checkout.

• The order page now displays the saved shipping address for physical orders, pulled from the address book automatically.

• Server maintenance is back. A setup issue on the server prevented administrative tasks from running, which also blocked database updates for the Shop. That is fixed, and all Shop database changes are now applied.
• Coupons are only used once an order is actually paid. Previously a coupon could be spent the moment an order was started, even if the buyer never paid. Now the coupon is redeemed only when payment goes through, whether by wallet or payment gateway.
• Wallet payments always charge the right amount. The wallet can only hold whole credit units, so orders are rounded up fairly so the seller is never paid less, and everything (balance, record, order status) is saved as one clean step.
• One order = one seller. Each order now only covers products from a single seller. If a cart mixes sellers, the app asks you to place a separate order, so every seller is paid correctly.
• Order steps are kept strict and clear. Sellers can only move an order forward in the right order (paid, fulfilled, shipped) and can no longer skip ahead; digital purchases are delivered instantly and can't be mistaken for physical shipments. Tracking details are stored when an order is shipped.
• Payments are private. Users can only check the status of their own payments, and a payment link can't be reused after an order is paid.
• Smaller fixes: cart quantities are kept between 1 and 99 with stock checked, price sorting in the shop is now accurate, gateway payments record the reference properly and are protected against being processed twice, and the order lists now show the product name and image for each order at a glance.

• Manage everything about the Shop from the admin panel. Five new items appear in the sidebar under Pro Plans: Shop Orders, Shop Coupons, Shop Products, Shop Categories and Shop Reviews — all available to the admin without touching the database directly.
• Shop Orders: every order is listed with the buyer, seller, type, total and status, with filters and an easy dropdown to move an order forward or resolve it (paid, shipped, delivered, cancelled, refunded). Each admin change is recorded in the order history.
• Shop Coupons: create, edit, enable or delete discount codes with percent or fixed discounts, minimum spends, usage limits and validity dates. Live usage counts are shown next to each coupon.
• Shop Products: search and filter the product catalog, feature items, hide or re-list them, or remove them.
• Shop Categories: add, rename and reorder the shop categories, with icons and auto-generated slugs.
• Shop Reviews: browse all product reviews with star ratings, hide or show them, and remove any that are inappropriate.

• Apple sign-in on iOS is now truly enabled. The permission that lets the app talk to Apple's sign-in page was never actually attached to the app when it was built, so the login would not work on an iPhone. The permission file is now wired into the build correctly.
• The app's identity matches on the server. The server now knows the iPhone app's real bundle identifier, so when someone signs in with their Apple ID the app is accepted as the genuine Lamat app and the login goes through. This also keeps the iPhone's universal-link setup consistent.
• Getting Apple sign-in fully live still needs the "Sign in with Apple" capability turned on for the app in the Apple Developer portal and a matching provisioning profile.

• New Apple callback page: the server now answers the "Return URL" (/apple/callback) that Apple redirects to after login. On Android it safely hands Apple's response back to the app so login completes automatically; everywhere else it sends users back to the web app.
• Code exchange: the login API now accepts either an Apple identity token (iPhone) or an authorization code (Android/Web) and verifies it with Apple before creating a session.
• App side: the login screen passes Apple the right identifiers for Android and Web, the Android app registers the Apple callback screen, and login no longer fails on repeat sign-ins.
• Setup still required: fill in the Apple Team ID, Service ID and Sign in with Apple key in the server settings, and register the return URLs (https://lamatt.abbble.co.za/apple/callback and https://lamat.abbble.co.za/) on the Service ID.

• The email used to link an Apple login to an account used to come from the app itself. Someone with any Apple account could have attached a victim's email to their own login and take over the victim's account. The email is now taken only from Apple's verified token.

• The LoginButton and LangaugeSwitcher widgets were moved out of the login page into their own files under lib/widgets so they can be reused more easily.

• New Apple plugin: a database migration adds the Apple plugin and its settings (enabled, Service ID, Key ID, Team ID, private key, Return URL) so everything can be configured from the admin panel instead of the server settings file.
• Config API: the app's configuration now includes the Apple login details. The private key is never sent to the app.
• App: the login screen reads these settings and only shows the Sign in with Apple button when the plugin is switched on and a Service ID is filled in.

• composer.json: added kreait/laravel-firebase ^7.2 (FCM HTTP v1 via service account); enabled ext-sodium in C:\xampp\php\php.ini (required by lcobucci/jwt).
• config/firebase.php: new — published package config; credentials resolved from FIREBASE_CREDENTIALS pointing at storage/app/firebase/service-account.json.
• FcmService.php: send() now prefers the FCM HTTP v1 API (CloudMessage) when a service account is present, and falls back to the legacy server-key API on failure or when no service account exists; added hasServiceAccount(); public method signatures unchanged.
• PushNotifications.php: sendRealMessage() no longer requires fcm_server_key when a Firebase service account is configured; updated error message.

• root .htaccess: requests that map to a real file/dir under .env*, .git, storage/app/firebase, app/, config/, database/, vendor/, tests/, bootstrap/ now return 403 (docroot is the project root, so these were previously served raw — the Firebase service account and .env were publicly downloadable).
• storage/app/firebase/.htaccess: new — Require all denied scoped to the service account directory.
• FcmService.php: data values are cast to strings before sending (FCM payloads require strings — CallController passes ints, which previously forced a v1 TypeError and silent legacy fallback); hasServiceAccount() accepts absolute credential paths.

• The broad storage/ deny was breaking uploaded images served through the public/storage junction to storage/app/public.
• root .htaccess: deny list narrowed to storage/app/firebase only (plus the original non-storage entries).
• storage/.htaccess: removed; storage/app/firebase/.htaccess: new with Require all denied.

• Error visibility: new red #manual-error alert — the actual server error message is now rendered (previously dropped), and the output log auto-reveals with a red border on failure.
• JSON fix: the ?action=check/install/status handlers ran after the HTML was echoed, so responses started with <!DOCTYPE and failed r.json() ("Unexpected token '<'"). All three handlers now run at the top of the script, before any output or the vendor-exists redirect.
• No env checks: ?action=check removed — the flow starts directly at "Install dependencies" (2 steps: install → complete).
• Cross-OS hardening: runCommand() accepts unset by-ref args (fixed TypeError); Windows uses cmd /s /c for quote-safe launching with output captured; Linux/macOS uses nohup so composer survives request end; Windows status detects php.exe via tasklist; --no-ansi keeps logs clean everywhere.

• SpotifyService.php: new backend service for Spotify Web API — Client Credentials auth with cached token, searchTracks() and getTrack().
• SpotifyController.php: new endpoints — GET /spotify/search, POST /spotify/set-anthem, DELETE /spotify/remove-anthem.
• Migration: added Spotify Anthem plugin with spotify_client_id, spotify_client_secret, and spotify_enabled settings.
• config_model.dart: added SpotifyAnthemPlugin model and registered in Plugins class.
• spotify_anthem_model.dart: new Flutter model for parsing anthem JSON (id, name, artist, imageUrl, previewUrl).
• spotify_anthem_widget.dart: reusable LiquidGlass card showing track art, name, and artist.
• spotify_search_page.dart: search page with LiquidGlass-styled search bar and track list; tap to select anthem.
• user_image_card.dart: anthem overlay on swipe cards when user has set a track.
• edit_profile_page.dart / account_settings.dart: anthem selector that opens the Spotify search page.

• ably_service.dart: changed MESSAGE action from 16 to 17 — action 16 is AUTH, not MESSAGE. All chat messages published via Ably REST arrived with action 17 and were silently dropped by the switch statement.

• ably_service.dart: added format=json&v=1.2 to WebSocket URL. Ably defaults to binary msgpack encoding — without this param, all frames arrived as binary and failed JSON parsing.
• ably_service.dart: added clientId field to CONNECT message for proper token authentication.

• AblyService.php: extracted keyName from full apiKey for token request URL (was using full key with secret in URL path, causing 404).
• AblyService.php: reduced token TTL from 24h to 1h.
• routes/api.php: added throttle:10,1 to ably/token endpoint to prevent abuse.

• chat_provider.dart: conversation messages cached per user-pair in Hive under key chat_msg_{userId}_{peerId}.
• chat_provider.dart: cached messages shown instantly on page load; background refresh fetches only delta.
• constants.dart: added cachedMessagesPrefix to HiveConstants.

• ChatService.php: added since param — filters by time > since OR edited_at > since; includes recently deleted messages for client-side cache cleanup.
• ChatController.php: accepts since query param and passes to service.
• ChatController.php: deleteForEveryone now sets edited_at = now() so deletes are detected by incremental sync.
• chat_provider.dart: tracks latest message timestamp; subsequent polls/Ably events pass since to fetch only changes.

• chat_provider.dart: reads AblyRealtime.enabled from config model in connectAbly(); only connects when plugin is enabled.
• ably_service.dart: added setEnabled() setter — early return in connect() when disabled; no connection attempt.

• auth_providers.dart: send full_name (givenName + familyName) from Apple credential to the backend
• AppleConnectController.php: accept full_name param and use it for user creation instead of deriving from email prefix
• AppleConnectController.php: SECURITY — JWT signature is now verified via openssl_verify() using Apple's JWK public keys (previously only base64-decoded the payload with no cryptographic verification)
• AppleConnectController.php: added claim validation: exp (not expired), iss (must be https://appleid.apple.com), aud (must match bundle ID)
• AppleConnectController.php: added rsaJwkToPem, base64urlDecode, derLength helpers for JWT verification

• ably_service.dart: new — WebSocket-based Ably realtime client with auto-reconnect
• chat_provider.dart: poll reduced from 2s to 30s; Ably events trigger instant refresh
• ChatController.php: publishes message to Ably after sendMessage
• AblyService.php: new — REST publish + token generation via Guzzle
• AblyAuthController.php: new — token & status endpoints
• plugins: added "Ably Realtime" plugin + settings (ably_api_key, ably_channel_prefix, ably_enabled)

• Info.plist: merged orphaned fbapi/fb-messenger-share-api into LSApplicationQueriesSchemes array
• Info.plist: removed second CFBundleURLTypes dict with orphaned CFBundleTypeRole
• Info.plist: removed duplicate NSCameraUsageDescription and NSMicrophoneUsageDescription entries
• Info.plist: changed CFBundleName from "myapp" to "Lamat"
• Runner.entitlements: changed aps-environment from "development" to "production"
• project.pbxproj: set TARGETED_DEVICE_FAMILY = "1,2" in Release (iPad support)
• project.pbxproj: removed hardcoded MARKETING_VERSION = 1 (uses FLUTTER_BUILD_NAME)
• project.pbxproj: aligned IPHONEOS_DEPLOYMENT_TARGET to 13.0 at project level
• Podfile: uncommented platform :ios, '13.0'

• Podfile: updated invertase/firestore-ios-sdk-frameworks tag from 10.29.0 to 12.16.0 (matches Firebase iOS SDK v12.16.0)

• proguard-rules.pro: added keep rules for RevenueCat, OneSignal, Sentry, Facebook, Pusher, Google Billing, ML Kit, and Stripe to prevent release crashes

• build.gradle: removed invalid classpath, deprecated dexOptions, old support multidex, redundant play-services deps, jcenter, and buildToolsVersion
• build.gradle: narrowed broad pickFirst '**/*.so' to specific libc++_shared.so per arch
• build.gradle: bumped minSdk to 26
• root build.gradle: removed jcenter() and buildToolsVersion

• config_model.dart: added splashBgDark field to AppImagesIcons
• constants.dart: added setter for splashBgDark in initialize()
• migration: added splash_bg_dark to plugins_settings for "App Images Icons"

• 8 controllers: replaced all 'storage/' . $path with asset('storage/' . $path) so photo URLs stored in DB are absolute URLs
• InterestController.php: removed user_id from addInterest validator (Flutter never sends it; endpoint already uses auth()->id())

• lib/providers/user_profile_provider.dart: Sanctum token now saved via TokenService.saveToken() after registration — add_interest and getUser calls were unauthenticated
• RegisterController.php: wrapped user creation + photo uploads in DB::transaction() for atomicity
• RegisterController.php: added mime-type + size validation on uploaded images (jpeg,png,jpg,gif,webp, max 10MB, max 8 images)
• RegisterController.php: validation errors now return HTTP 422; duplicate email/username return HTTP 409; server errors return HTTP 500 (previously all returned HTTP 200)

• replaced all .toSafeString()/.toSafeInt()/.toSafeDouble()/.toSafeBool() extension calls on dynamic receivers with safeStr()/safeInt()/safeDouble()/safeBool() top-level helpers

• lib/utils/num_parsing_extensions.dart: added safeStr/safeInt/safeDouble/safeBool top-level helpers that cast to Object? before calling extension methods (fixes NoSuchMethodError on dynamic receivers)
• lib/models/config_model.dart: fixed boolFromJson(dynamic value) to use safeStr(value) instead of value.toSafeString(); fixed x.toSafeString() in .map() callback to use safeStr(x)
• lib/main.dart: wrapped SentryFlutter.init() in try-catch with fallback runApp(buildApp()) when Sentry fails; extracted buildApp() widget function

• pubspec.yaml: replaced commented SFDisplay font section with Outfit family (9 weights from assets/fonts/)
• lib/utils/native_theme.dart: changed both light/dark theme fontFamily from 'Lexend' to 'Outfit' (bundled); removed unused google_fonts import
• web/canvaskit/: added pre-downloaded canvaskit.js/wasm for offline web rendering
• web/index.html: set flutter-renderer to canvaskit; added window.flutterConfig.canvasKitBaseUrl pointing to local /canvaskit/

• lib/utils/native_theme.dart: replaced GoogleFonts.outfit().fontFamily with 'Lexend' to eliminate CDN font fetch on dark theme; removed google_fonts import
• web/index.html: added <meta name="flutter-renderer" content="html"> to use HTML renderer (avoids canvaskit.js CDN download)
• .vscode/launch.json: added --web-renderer=html to all launch configs
• lib/routes.dart: changed BottomNavBarRoute path from '/' to '/tabs' to prevent URL collision with initial browser URL

• SoundController.php: removed required id from getFavSounds validator (uses auth()->id())
• SoundController.php: removed required uid from addFavSound validator (uses auth()->id())
• FeedService.php: added singer and song_title to getFeeds() response (were selected but not returned)
• ReelService.php: now stores audio_link and audio_cover during createReel()
• Music.php (Livewire admin): sound files, covers, and category images now stored as absolute URLs via url('storage/' . $path)

• test/registration_flow_test.dart: 8 tests covering Registration API, checkUserNameEmail, and image assets — all pass with flutter test
• lib/providers/api_service.dart: added @visibleForTesting static setDioForTesting(Dio) setter for injectable mock Dio
• lib/providers/chat_provider.dart: hid FormData from universal_html/html.dart to fix import name conflict with dio FormData
• build_runner: --force-jit flag required on Dart 3.10.7; use dart run build_runner build --force-jit

• web/index.html: enabled preload hint for main.dart.js; added preconnect / dns-prefetch for Google Fonts, Google Maps, Apple CDN
• pubspec.yaml: removed 13 unused dependencies (cloud_firestore, flutterwave_standard, stacked, injectable, scoped_model, socket_io_client, sms_autofill, zego_plugin_adapter, flutter_background_service, flutter_cached_pdfview, flutter_glass_morphism, flutter_story_view, flutter_wall_layout)
• pubspec.yaml: removed unused Roboto font family (40+ variants, ~3-4MB) — app uses Outfit exclusively
• pubspec.yaml: moved mockito from dependencies to dev_dependencies (test-only)

• RegisterController.php: password regex now allows any non-whitespace special char (was restricted to @$!%*?& only)
• first_time_update_profile_page.dart: added regex validator matching backend; updated hint text with full requirements
• password_page.dart: added same regex validator
• UserProfileController.php: show() now uses auth()->id() instead of requiring id request param — fixes "Baking Your Profile" hang when getUser() omitted the id to hang indefinitely

• bordered_avatar.dart: new widget — avatar with PpBorder frame, status badges, and speaking indicator
• gift_button.dart: new widget — floating gift button with diamond balance display, opens GiftSheet
• chat_overlay.dart: new widget — welcome message / chat overlay at bottom of room
• user_profile_image.dart: added optional borderImageUrl and isSpeaking params for border decoration
• room_page.dart: integrated avatar borders (from config ppBorders), host crown badge, floating gift diamond button, chat overlay, and "Send Gift" option in member list context menu; changed from pushReplacement to direct Stack overlay for custom UI on top of Zego

• home_screen.dart: integrated tabs (Related/HOT/Explore) with active underline styling, trophy icon + clock in app bar
• home_screen.dart: ported _InterestsSection with gradient-ring avatars, tag labels, and mini avatars
• room_card.dart: upgraded to 3 card types (Featured 20+ users / Gold 10+ users / Simple <10 users) with gradient container, framed avatars, tag pills, signal bars, mini avatars, rocket icon
• room_card.dart: added _SpaceshipRocket, _RocketPainter, _FeaturedFramePainter, _TagPill, _SignalBars, _MiniAvatars shared widgets
• room_card.dart: added BroadcastRoomCard widget
• list_live_stream.dart: inserted BroadcastRoomCard at index 3 in ListLiveStreamSearch list view

• pk/config.dart: PK foregroundBuilder now shows per-host gift icon (bottom-left), user info name/level/avatar (bottom-right), and sound wave (top-right) driven by host.soundLevel stream
• pk/config.dart: foreground handles all grid layouts — 1×2 (2 users), 2×2 (4 users), 3×3 (9 users)
• pk/config.dart: added _showGiftSheet gifting integration + _SoundWaveWidget real-time audio visualization

• Migration: added default_home_page to plugins_settings (General Settings) — value can be swipecards, livestreams, livemingle, voiceparty, popballoon, hottakes, blinddate, or reels
• lib/models/config_model.dart: added defaultHomePage field to Settings class with fromJson/toJson
• lib/views/tabs/bottom_nav_bar_page.dart: first _BottomNavBarItem now reads configs.plugins?.settings?.defaultHomePage and renders the matching page widget dynamically

• Migration: added order column (int, default 0) to plugins_settings
• Database: all 59 General Settings ordered by importance with proper block group names (brand, currency, appearance, registration, urls, profile, location, datetime, messages, notifications, live, misc)
• PluginSettings.php: loadSettings() now orders by order column instead of id
• plugin-settings.blade.php: block names displayed in uppercase

• Replaced all as String / as String? → safeStr() (~65 replacements across auth_user, match_model, streak_model, question_model, user_photo, auth_providers, product_provider, contests_provider, blind_date_provider, notification_service, session_manager, live_mingle_search_screen, item_coin_plan, user_profile_provider, voicechat_rooms_provider, ranking_provider, boost_screen, live_stream_model, other_profile_page, subscriptions)
• Replaced all .toInt() → safeInt() (8 replacements across bank_card_model, stream_goal_model, user_account_settings_model, top_search_model, live_card_model, list_live_card_model)
• Replaced all int.parse() on map values → safeInt() (116 replacements across profile_controller, user_profile_provider, other_users_provider, voicechat_rooms_provider, teels_provider, ranking_provider)
• Replaced all double.parse() on map values → safeDouble() (19 replacements across profile_controller, user_profile_provider, other_users_provider, coin_plans)
• ~208 total replacements — no more unsafe casts from map/dynamic values

• lib/widgets/ImageEditor/: @RoutePage() wrapper around image_editor_plus
• lib/widgets/MapLocationPicker/: @RoutePage() wrapper around map_location_picker
• lib/routes.dart: added routes at /image/editor and /location-picker
• media_picker_helper.dart, bottom_nav_bar_page.dart, filter_options_screen.dart, account_settings.dart: replaced Navigator.push + MaterialPageRoute with auto_route push; backButton Navigator.pop() changed to context.router.maybePop()

• lib/widgets/diamond_event_overlay.dart — deleted file (no longer needed)
• lib/myapp.dart — added _listenToDiamondEvents() that subscribes to pusherServiceProvider.onDiamondEarned and calls DiamondAnimation.show() directly
• lib/myapp.dart — proper disposal of StreamSubscription in dispose()
• lib/myapp.dart — removed DiamondEventOverlay wrapper from Stack in build method
• lib/myapp.dart — removed unused diamond_event_provider import

• echo_ping_task.dart — replaced Sentry.setUser() (undefined static method) with Sentry.configureScope → scope.setUser()
• main.dart — fixed BeforeSendCallback signature; changed named param {hint} to positional hint (sentry 8.14.2 API)
• myapp.dart — removed outer SentryNavigatorObserver wrapper (NavigatorObserver ≠ Widget); observer already used in navigatorObservers list

All RevenueCat business logic extracted from Job into a testable service class. JSON error responses with UUID correlation IDs added for traceable debugging.

• Created ProPlan & UserSubscription Eloquent models; updated webhook Job to use them (replaces raw DB::table)
• Dispatch HandleRevenueCatWebhook to webhooks queue via ->onQueue('webhooks')
• RevenueCatWebhookRequest FormRequest — replaces ad-hoc payload validation with typed rules
• TransactionsLogger trait — shared between PaymentWebhookController and HandleRevenueCatWebhook Job (DRY)
• Health endpoint (GET /webhook/health) + try/catch error tracking
• Input sanitization for origTransId, productId, transactionId (trim + truncate to column limits)
• Handled PRODUCT_CHANGE, TRANSFER, SUBSCRIPTION_EXTENDED event types
• Async queue for RevenueCat webhook — new Job dispatched from controller (returns 202)
• Default match arm logs warning for unhandled event types
• Renamed $expirationMs → $expirationAtMs (matches RC field name)
• Renamed ConfigService::getRevenueCart → getRevenueCat (typo)
• Null-safety guard in initPlatformStateForPurchases (removed userID! crash risk)
• Removed client-side boost_balance sync from subscription_builder.dart; webhook is sole grants source
• DB transactions in activateRevenueCatSubscription & renewRevenueCatSubscription
• V2 webhook signature replay protection (5-minute timestamp window)
• isPremiumUserProvider uses ref.watch (reactive) instead of ref.read (snapshot)
• User existence check in handleRevenueCat (prevents orphan records)
• Activation idempotency guard (duplicate webhook detection)
• Fixed premium_expiry_date type bug (int → MySQL datetime string)

• routes/web.php — Added POST /webhook/revenuecat route
• PaymentWebhookController — Added handleRevenueCat() with HMAC-SHA256 signature verification (V1/V2); resolves pro_plans by product_id; handles INITIAL_PURCHASE/RENEWAL/CANCELLATION/UNCANCELLATION/EXPIRATION events; inserts/updates users_subscriptions + users tables

• is_subscribed_provider.dart — Derived isPremiumUserProvider from premiumCustomerInfoProvider to eliminate duplicate Purchases.getCustomerInfo() calls; added web guard
• init_purchase_conf.dart — Typed ref as WidgetRef; added try-catch around RevenueCat init; listener now syncs both activation AND deactivation with early return when state matches
• offerings_provider.dart — Added kIsWeb guard to return empty list without calling Purchases.getOfferings()
• subscription_builder.dart — Changed from ref.read → ref.watch for reactive rebuilds; replaced FutureBuilder with try/await; removed app restart and splash navigation after purchase