FIRE DEPARTMENT

StationCommand Changelog

Current pre-launch version: 2.1.6

Version 2.1.6

Customizable Admin & Member menus

Administration is now a launcher page instead of one long crowded page.
Each major Administration section has its own URL/page.
Admin and member menu cards can be favorited to pin them first and dragged to reorder.
Menu layout preferences are stored server-side per user and follow the account across devices.

Version 2.1.6

Responder visibility & mobile public display

My Statistics now includes a complete year-to-date responder leaderboard from the department roster, including responders without Station Command accounts or linked Active911 devices. Responders marked No Stats remain excluded.
Read-only incident details now show every responder recorded on the call, not only whether the signed-in user was counted.
The public Time of Day screen is now scrollable on mobile, with horizontally scrollable donut panels/legend details instead of shrinking the content to an unreadable size.

Version 2.0.16

Agency identity in license validation

License validation now sends the configured Station Command agency/department name as agencyName.
License validation now sends the Station Command installation URL as url.
The URL is derived from the incoming request/proxy host and protocol; APP_BASE_URL can be used as a fallback for scheduled validation checks.
Administration diagnostics show the non-secret agency name and URL included in the validation request.

Version 2.0.15

License validation contract correction

Validation now sends the documented minimal request: licenseKey, product, and version.
Stopped sending the client-generated installation ID during normal hosted-license validation.
Removed unrelated station-count and public-usage fields from the validation request.
Structured license-server errors now display their actual code/message instead of [object Object].
Administration shows which non-secret fields were sent in the validation request.

Version 2.0.14

Entitlement enforcement audit

Audited every current licensable feature against the license server's entitlements object.
Added server-side gates for responder/incident displays, department statistics, advanced analytics, calendar events, display customization, and the public portal.
Member and Admin interfaces now hide matching unavailable sections instead of showing controls that the server will reject.
Administration now lists every entitlement returned by the license server with enabled/disabled state and any limit.
Plan names remain informational only; entitlement booleans and limits are authoritative.

Version 2.0.13

Direct entitlement pass-through

Removed Station Command plan/type translation from license enforcement.
The complete license-server JSON response is now stored unchanged and treated as the source of truth.
Features are enabled directly from entitlements.<feature>.enabled.
Station limits come directly from stations.licensed / stations.unlimited.
Public monthly traffic comes directly from entitlements.public_stats_monthly_views.limit.
Expiration/grace behavior comes directly from expiresAt, licenseState, and outageGraceUntil.

Version 2.0.12

End-to-end license state repair

Schema 3 responses now use a dedicated deterministic parser and never merge with stale cached legacy data.
MySQL now persists the complete Station Command license object, including the admin-entered key, cached entitlements, instance ID, and validation timestamps.
Added Administration diagnostics showing the license server's returned schema/plan/status/public-display value and whether a normalized entitlement is actually cached.
Added asset cache-busting to prevent stale Admin/Public JavaScript after rapid deployments.

Version 2.0.11

Schema 3 validation parser correction

Fixed the remaining null cached-license dereference that caused Cannot read properties of null (reading 'limits') after a successful HTTP 200 validation.
License validation now recognizes schema 3 data whether returned at the response top level or under payload.
Fresh validation responses no longer depend on an existing cached license.

Version 2.0.10

License persistence & schema null-safety

Fixed schema 3 validation when optional objects such as limits are null.
Admin-entered license keys now persist through the active database backend, including MySQL.
Cached license state and validation timestamps are persisted through the database backend after each validation.
Administration now indicates when the entered license key is saved persistently.

Version 2.0.9

Public Portal entitlement fix

Fixed schema 3 validation caching so Station Command retains the complete license response instead of caching only the nested entitlements object.
Public Portal now correctly recognizes features.public_display=true from the license server.
Enterprise plan, unlimited stations, public-traffic limits, organization, and validation state now remain intact after validation.

Version 2.0.8

License schema 3 support

Added native parsing for license-server schema 3 responses.
Enterprise and unlimited station licenses now display correctly from stations.licensed=-1 / stations.unlimited=true.
Maps snake_case license features such as public_display, advanced_analytics, department_stats, and responder_display into Station Command entitlements.
Uses nextValidationAt and outageGraceUntil from the licensing server.
Corrected Admin license diagnostics to display full attempted URLs and removed duplicate/undefined endpoint output.

Version 2.0.7

Absolute license URL diagnostics

License validation now uses absolute external URLs only; no relative validation path is passed to fetch().
The primary target is https://license.stationcommand.app/api/license/validate.
If that endpoint returns 404, Station Command tries the licensing service's advertised canonical endpoint https://license.stationcommand.app/api/v1/license/validate.
Administration now displays the complete absolute URL actually used for the most recent validation attempt.

Version 2.0.6

Direct license validation endpoint

Station Command now validates licenses directly against https://license.stationcommand.app/api/license/validate.
Removed fallback attempts against pluralized or alternate validation paths that could obscure the actual licensing request.
The licensing host remains hard-coded and cannot resolve back to the Station Command application itself.

Version 2.0.5

Hard-coded licensing service

Station Command now always sends production license validation requests to https://license.stationcommand.app.
Removed LICENSE_SERVER_URL and LICENSE_VALIDATE_PATH as deployment overrides so a Station Command installation cannot accidentally validate against itself.
The Administration license status now reports the fixed licensing service address.

Version 2.0.4

License endpoint compatibility

License validation no longer assumes only /api/v1/licenses/validate.
Added automatic fallback across known StationCommand license validation routes.
Added optional LICENSE_VALIDATE_PATH to explicitly configure the server route.
Added compatibility request fields for older license-server schemas.
Administration now shows the validation endpoint used and every attempted route when validation fails.

Version 2.0.3

License server connectivity fix

Corrected the default license server hostname to https://license.stationcommand.app.
Updated the application, environment example, and licensing documentation to use the correct hostname.
Corrected all current-version labels across the member menu, login page, public display, station display, and changelog.

Version 2.0.2

Licensed public portal fallback

When a license is not ACTIVE or GRACE, or does not include the Public Portal entitlement, the root page now shows a generic StationCommand member login instead of public statistics.
Public statistics, heat-map, analytics, and active-incident APIs now enforce the same Public Portal entitlement.
Authorized members and administrators can still sign in to repair or update licensing.

Version 2.0.1

License key management & public display repair

Added license-key entry, replacement, clearing, and immediate validation in Administration.
Saved license keys remain server-side and are returned to the browser only as a masked confirmation.
Changing a license key clears the old cached entitlement before validating the replacement.
Repaired public display department branding and logo loading through the reliable /department-logo endpoint.
Public display API failures now show a clear licensing/service message instead of silently rendering blank information.

Version 2.0.0

Microsoft sign-in & station licensing

Added Microsoft Entra ID sign-in alongside Google sign-in.
Added StationCommand license validation through the configurable license server at license.stationcommnd.app.
Licensing now limits physical station locations while allowing unlimited display devices at every licensed station.
Added license status and manual validation controls to Administration.
Updated 2.0 licensing so physical station locations are the licensed resource while displays at each station remain unlimited.
StationCommand now consumes generic feature entitlements and limits instead of hard-coding Basic/Intermediate/Pro behavior.
Added monthly public-portal traffic usage reporting and 80%/100% administrative warnings without automatically disabling the public portal.
License validation now preserves the last valid cached entitlement set during license-server outages.
Removed Home Station and per-user saved home routing from the web application; responder-origin routing is reserved for the responder app.
Removed individual annual/YTD call-total overrides. Participation totals are calculated from incident history.
Prepared feature entitlements for responder display, core statistics, individual portal, and public display licensing.
Added first-party public analytics with no retained public source IP, GPC/DNT reduction, page/slide usage, session duration, referrer and coarse network-supplied geography.
Added security logging for successful and failed Google/Microsoft logins, authorization denials, logout and protected write actions; security events can retain full source IP under the configured retention policy.
Added Analytics & Security administration and a public privacy notice at /privacy.
Disabled browser GPS/geolocation permission for StationCommand.

Version 1.7.0

Annual responder call-total overrides

Admins can now set an exact annual/YTD call total for an individual person from the Personnel Directory.
Overrides are stored by calendar year, so a 2026 correction does not affect 2027 or other years.
The overridden YTD value is used on Personnel Participation, Personal Stats, and the YTD responder leaderboard.
Month-to-date, Last Month, monthly charts, incident participation, and the underlying incident history remain calculated from actual incident records.
Leaving the annual override blank removes it and immediately returns that person to the automatically calculated YTD total.

Version 1.6.9

Google Photos OAuth/device recovery fix

Fixed Google Photos showing authorization failed after Google had already confirmed the device/account connection.
OAuth refresh tokens are now persisted immediately before Ambient device creation, so StationCommand never re-polls a consumed one-time device code.
Ambient device creation/recovery can now be retried independently without reconnecting the Google account.
Added recovery for devices created during an earlier partial setup and for ALREADY_EXISTS responses.
The Choose Albums button is now hidden until a real external Google settingsUri exists; it can no longer open the StationCommand Admin page through a placeholder # link.
Added a Finish Device Setup control when Google authorization succeeded but Ambient device creation still needs to complete.

Version 1.6.8

Google Photos Admin hotfix

Fixed ReferenceError: savePhotosConfig is not defined when using the Google Photos Collage controls.
Restored the shared Photos settings-save helper used by Save and Connect Google Photos.
Admin now reloads the saved non-secret Google Photos OAuth Client ID.
Leaving Client Secret blank preserves the existing secret instead of overwriting it.
Leaving Client ID blank during an unrelated update no longer erases the stored client ID.

Version 1.6.7

Display settings persistence & overview fit fix

Fixed Display Settings not saving after the Google Photos slide was added; the Photos checkbox was missing from the modal while the save code expected it.
Added the missing Google Photos collage rotation checkbox and hardened preference saving so a missing future control cannot abort the entire save.
User display settings now wait for MySQL persistence to complete before StationCommand reports success, and the browser reads the preferences back to verify the save.
Existing user preference records are normalized against current defaults so newly added display options do not reset older accounts.
Public display-screen administration now also waits for persistent storage confirmation.
Rebuilt the internal Statistics Overview layout so hero, metric cards, and Call Activity by Type share the actual viewport instead of fixed heights that overflow below the screen.
Call-category columns can scroll internally only when necessary, preventing the overall station display from being cut off.

Version 1.6.6

Google Photos setup-flow fix

Changed Google Photos Ambient authorization to Google's standard two-step flow instead of depending on the streamlined automatic redirect.
After Google account authorization, StationCommand creates and stores the Ambient device and exposes its exact Google-provided settingsUri as a Choose Albums button.
Added automatic polling of devices.get using Google's recommended pollingConfig.pollInterval until mediaSourcesSet becomes true.
Added a Change Albums action that reuses the existing device/settings URI rather than creating another Ambient device.
Added recovery logic that can reuse the newest matching Ambient device if a prior connection attempt created one.

Version 1.6.5

Clean announcements & Google Photos collage

Removed Google Groups subscription, unsubscribe, and discussion-link boilerplate from Gmail-sourced announcements.
Added internal-only Google Photos collage support using the Google Photos Ambient API.
Admins can connect Google Photos and select specific albums/photo collections for the StationCommand ambient device.
Added an adaptive Google Photos collage slide and per-user rotation toggle.
Google Photos metadata refreshes hourly and image bytes are proxied through authenticated StationCommand endpoints.

Version 1.6.4

Internal date & military time labels

Added the current Eastern date next to the internal station-display clock.
Kept the internal header clock in 24-hour military time.
Changed internal Calls by Time of Day labels themselves to military ranges such as 1500–1800 instead of 3–6 PM.
All eight internal time-of-day periods now use 0000–0300 through 2100–2400 consistently.

Version 1.6.3

Time-of-day kiosk fit fix

Fixed the internal Calls by Time of Day screen overflowing below the bottom of 1080p and shorter kiosk displays.
Changed the layout to reserve separate responsive space for donuts and the full legend.
Donut size now scales down automatically on shorter displays instead of pushing legend rows off-screen.
Tightened headings and legend spacing while preserving larger sizing on taller station displays.
Mobile/tablet layouts continue to flow vertically and scroll rather than clipping content.

Version 1.6.2

Military header clock & interactive analytics

Changed the internal station-display header clock to explicit 24-hour military time with no AM/PM indicator.
Expanded Calls by Time of Day to use substantially more of the available station/public display area while retaining responsive mobile scaling.
Expanded Calls by Day of Month to use nearly the full public slide area.
The current month is now emphasized by default on the day-of-month graph.
Hovering or focusing another month temporarily highlights that month's line while fading the others; clicking a month makes it the selected month until another is selected.
Time-of-day labels use military ranges consistently on internal and public displays.

Version 1.6.1

Adaptive displays & readability

Redesigned the rotating Department Announcements screen with responsive cards, wrapping text, larger typography, and safe scrolling so long announcements no longer run off-screen.
Redesigned the rotating Upcoming Department Events screen for clearer event names, 24-hour start/end times, and locations.
Improved the authenticated Upcoming Events and Announcements pages with larger responsive cards and mobile layouts.
Changed the internal Calls by Time of Day labels to explicit military ranges such as 0000–0300 and 2100–2400.
Expanded kiosk content to use the available display area while using responsive clamp-based sizing to remain readable on smaller screens.
Added responsive overflow handling across analytics, personnel, heat-map, incident, calendar, and announcement screens to reduce clipping on unusual aspect ratios and mobile devices.

Version 1.6.0

Public display controls, calendar improvements & hourly Google sync

Added raw call counts beside each time-of-day percentage on public and private donut displays.
Confirmed internal StationCommand time formatting uses 24-hour / military time.
Added administrator controls to enable or disable individual public display screens.
Added a public Calls by Day of Month graph with each month of the current year plotted on the same line chart.
Calendar events now show start date/time, end time, end date when different, and location when supplied.
Added Upcoming Events and Announcements links/pages to the authenticated menu.
Google/Gmail announcements now use only the original message and ignore replies/forwards.
Google Calendar and Gmail synchronization now runs once per hour.

Version 1.5.3

Department logo persistence hotfix

Restored the missing /department-logo handler that serves the configured uploaded department logo to pages and favicons.
Uploaded department logos are served directly from the MySQL-backed department configuration with the correct image content type.
Logo uploads now wait for the persistent database write to complete before Administration reports a successful save.
Added no-cache headers/cache busting so replacing a logo is reflected immediately instead of showing an older browser-cached image.
Configured local or external logo URLs remain supported, with the StationCommand logo as a safe fallback.

Version 1.5.2

Time-of-day donut charts

Replaced the time-of-day percentage rows with donut charts on both public and private displays.
Added separate YTD, Current Month, and Last Month donuts.
Each donut uses the eight 3-hour call periods as slices and retains exact percentages in a shared legend.

Version 1.5.1

Google Account integration wording & 3-hour analytics

Renamed Google Workspace Integration to Google Account Integration so the feature accurately reflects support for normal Gmail/Google accounts.
Google Workspace is not required for the Calendar or Gmail integrations.
Changed Calls by Time of Day from four 6-hour periods to eight 3-hour periods.
YTD, Current Month, and Last Month continue to display percentages rather than raw call totals.
Kept backward compatibility with the previous Google integration authorization URL.

Version 1.5.0

Time-of-day analytics & Google Workspace APIs

Standardized visible current-version references to 1.5.0.
Added public/private Calls by Time of Day displays using YTD, Current Month, and Last Month percentages.
Added Google Calendar API support with persistent OAuth authorization.
Added Google Group announcements through Gmail API messages delivered to a configured mailbox.
Added Google Workspace settings, manual refresh, status, and disconnect controls in Administration.
Retained iCal calendar URL support as a fallback.

Version 1.4.2

Dynamic changelog branding

Removed the remaining legacy department-specific branding from the changelog.
The changelog now uses the department name and logo configured in StationCommand Administration.
Updated changelog navigation and visual styling to match the rest of StationCommand.
Kept the StationCommand marketing-site link in the footer.

Version 1.4.1

Persistent Active911 administration

Moved Active911 routine API configuration into the administrator dashboard and persistent database state.
Added administrator editing for API enable/disable, refresh token, polling interval, webhook enable/disable, and webhook secret.
Environment variables remain supported as first-run/fallback configuration, so routine Active911 changes no longer require Railway environment edits.
Persisted webhook usage counters, last received/processed times, alert/agency IDs, errors, and the latest 100 webhook events in MySQL-backed storage.
Added the exact Active911 “Other” integration URL to the admin dashboard and a one-click webhook-secret generator.
Persisted short-lived Active911 access-token state and expiration information across deployments/restarts.

Version 1.4.1

Version visibility & changelog

Added this public changelog page at /changelog.
Made visible StationCommand version numbers link directly to the changelog.
Added the running version to the public statistics dashboard footer.
Standardized current-version references throughout the application to 1.4.1.

Version 1.1.13

Responder analytics

Added Year-to-Date, Current Month, and Last Month calls-per-day averages prominently to the public Call Trends screen.
Responder Participation now shows the complete roster rather than stopping at the first group of responders.
Added a slow continuous-loop scroll for long participation lists.
Added per-user responder-scroll delay settings: 5, 10, 15, 20, 30, 45, 60, and 90 seconds; 10 seconds is the default.

Version 1.1.12

Call averages

Changed day-of-week charts from raw totals to average calls per occurrence of each weekday.
Added average calls per day for Year to Date, Current Month, and Last Month.

Version 1.1.11

Active911 CSV compatibility

Updated CSV import for the current Active911 agency export format.
Added correct parsing for America/Detroit timestamps.
Added historical responder-response parsing for RESP, ARRIV, UNLV, WATCH, and related events.
Improved large CSV import performance and row-level error reporting.

Version 1.1.10

Hotfix

Fixed an internal active-incident display regression that prevented route maps and elapsed timers from rendering.

Version 1.1.9

Officer controls

Moved Clear Incident and +30 Minutes controls off station displays and onto the authenticated menu page.
Restricted controls to Captain, Deputy Chief, Chief, and administrators while incidents are active.

Version 1.1.8

Profiles & participation

Added user self-service display-name editing.
Added officer incident controls for active calls.
Added admin participation review per incident and manual responder-count overrides.

Version 1.1.7

Analytics

Added public and private Call Trends displays.
Added monthly call line graph and day-of-week call graph.
Added private responder participation totals for Year to Date, Current Month, and Last Month.
Combined multiple Active911 devices mapped to one user and counted a person once per incident.
Participation counts RESP and ARRIV only; AVAIL and UNLV do not count.

Version 1.1.6

Authentication UX

Added a clear authorization-denied message for Google accounts not approved for StationCommand.
Added a direct return link to the Public Statistics page.

Version 1.1.5

Active911 webhook

Added the production Active911 third-party webhook receiver.
Webhook events trigger an immediate authoritative Active911 API refresh while scheduled polling remains as backup.
Added webhook status and testing information to administration.

Version 1.1.4

Reserved / superseded

The webhook build was originally numbered 1.1.4 and was reissued as 1.1.5 to keep the project version history aligned.

Version 1.1.3

Public map loading

Fixed public maps being blocked by synchronous geocoding and road-snapping work.
Public maps now render immediately using safe generalized locations while preferred road-snapped points resolve and cache in the background.

Version 1.1.2

Public location privacy

Strengthened public residential-location privacy using generalized 100-block locations.
Preferred road-snapped public points instead of points over homes.
Kept intersection incidents identifiable as intersections without residential jitter.

Version 1.1.1

Server-side public privacy

Moved public-location sanitization entirely server-side.
Stopped exposing exact CAD/Active911 coordinates and exact addresses through public API responses.
Added generalized public identifiers and protected public heat-map coordinates.

Version 1.1.0

MySQL production architecture

Migrated persistent application data from store.json to MySQL.
Added automatic database schema initialization and migrations.
Added JSON-to-MySQL migration and database-test utilities.
Persisted Active911 access-token state in MySQL.
Prepared StationCommand for continuously hosted production operation.

Version 1.0.13

Heat-map details

Updated heat-map popups to match the public incident-map style.
Displayed category, privacy-safe location, and date/time rounded to the nearest hour for historical calls.

Version 1.0.12

Mobile & map popups

Fixed mobile hamburger-menu behavior.
Updated public map marker popups to show category, privacy-safe location, and rounded date/time instead of generic call counts.

Version 1.0.11

Personnel & token persistence

Persisted the current Active911 short-lived access key and expiration.
Linked Active911 devices to Google users and added personnel ranks.
Added apparatus-first responder sorting and rank abbreviations.
Added transparent markers for completed calls from the current day.
Improved responder-column overflow behavior.

Version 1.0.10

Public incident display

Renamed the public incident slide to Active Incidents.
Fixed numbered-road intersections such as 12 Mile Rd being mistaken for house numbers.

Version 1.0.9

Incident classification

Changed public active-call labels to standardized categories rather than raw Active911 descriptions.
Made vehicle-accident wording override medical wording so crashes classify as MVA.

Version 1.0.8

Public Active Incidents

Added the public Active Incidents map and list as another homepage slide.
Added active-incident and calls-today counters.
Normalized MED/MEDICAL calls to RESCUE/EMS.
Reworked Leaflet marker handling to address disappearing points.

Version 1.0.7

Public homepage

Made the root homepage a public statistics and heat-map rotation.
Moved Google login and the member menu to separate pages.
Added slide dots, direct slide selection, pause/resume controls, and smoother screen rotation.

Version 1.0.6

Display settings

Added configurable idle-screen rotation speed with a one-minute default.
Added auto-hidden station navigation that can be revealed from the corner or with Ctrl+Shift+M.

Version 1.0.5

Display Settings hotfix

Repaired the Display Settings button and preference modal behavior.

Version 1.0.4

Station UI

Standardized station navigation around a single Home link.
Unified rounded incident panels, map containers, update boxes, inputs, and buttons.
Corrected an initial build regression so Home Station and per-user Display Settings remained available.

Version 1.0.3

Home Station

Added /sthome with routing from each user's saved home address.
Added per-user idle-display selection settings.
Added the department patch to statistics branding.
Added green Active911 Live and red Active911 Offline status badges.

Version 1.0.2

Branding & history

Replaced the generic CTFD circle with the department patch.
Expanded Last Change Detected into a visible incident-change history.

Version 1.0.1

Polling & category colors

Stopped routine Active911 polls from resetting the incident display timer when nothing changed.
Separated Last Change Detected from Last Checked.
Applied standardized incident-category colors to live station displays.

Version 1.0.0

First official release

Reset project versioning for the first official StationCommand release.
Replaced PIN authentication with Google OAuth.
Added Admin and User access levels and the /user administration page.
Established the official production baseline for Active911 incidents, station displays, statistics, weather, calendar, announcements, heat maps, and administration.

Pre-1.0 Development

Prototype period

Established the original Active911 ingest, station routing, responder status, incident timers, multiple-call rotation, weather, calendar, announcements, address history, incident editing, device aliases, historical imports, statistics, and heat maps.
Developed the 1080p station-display layout and the operational rules that became StationCommand 1.0.0.