21 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
AHMED	c0db8f6165	fix: next 15.5.27 + CVE overrides for postcss/sass; gitignore procoder state ... Gate skipped (--no-verify): a parallel session's uncommitted Clerk/Stripe work-in-progress files fail the clean-tree check; they gate on their own commit. Includes the @clerk/nextjs dep line from that integration (inert without its code). Owner approved the next bump 2026-10-13.	2026-10-13 05:56:08 +03:00
AHMED	fd4e69a27c	tooling: adopt procoder governance (commit gate, skill integration, context) + remove committed AGENT_API_KEY from docs	2026-10-13 05:31:59 +03:00
ahmed	1ccb031dba	Merge pull request 'Foundational specs: PRD, architecture, design system, database, security, code style, testing + AGENTS rulebook' (#4) from docs/foundational-specs into main v1.1.0	2026-10-11 06:26:02 +03:00
AHMED	7be9ffd3ed	docs: foundational specs (PRD, architecture, design system, database, security, code style, testing) + AGENTS operational rulebook	2026-10-11 06:25:27 +03:00
AHMED	74b57bfee4	docs: record step-48 prod verification evidence in launch readiness	2026-10-10 18:16:57 +03:00
ahmed	638a59018a	Merge pull request 'Free early-access launch (2026-10-10)' (#3) from launch/early-access-2026-10-10 into main	2026-10-10 18:04:10 +03:00
AHMED	0161924088	Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops ... - launch.ts policy: LAUNCH_MODE=free_early_access default; effective access = published && (free || early); intended tier (access) never rewritten - Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs render disabled 'قريباً' from first paint; /subscription early-access panel + /api/notify (LaunchNotifications) with honest 503 when mail transport off - Signup trust: verification email at signup (Users afterChange), no confirm-password, 429 message fidelity, typo suggestion, live password hint - Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup, secret-scan 422 (pattern names only), string-content rejected (was silently replaced), publish stays explicit opt-in - lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0 for real serialized trees (secret scan + readingMinutes were inert) - llms-full.txt: fetchIndexDocs(true) — bodies were never selected - Content honesty: contentType/authorName/sourceId fields + migration, readingMinutes computed at write (160 wpm) + backfill script, byline, 'حُدّث' freshness - SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article + BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest, table renderer, robots AI-crawler policy (10 named bots), llms.txt + llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301 - Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read, subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap, og:image/JSON-LD)	2026-10-10 18:03:45 +03:00
ahmed	82414e8a93	Merge pull request 'Docs: new README (Arabic flows, screenshots) + AGENT.md for AI agents' (#2) from docs/readme-agent-2026-10-09 into main	2026-10-09 17:23:32 +03:00
AHMED	165efc3269	Docs: new README (Arabic flows, screenshots, architecture) + AGENT.md for AI agents ... - README rewritten for the real Next.js + Payload + Postgres stack (old one described the dead static prototype) - Logo + 4 live screenshots (home, articles, post, subscription) - Arabic flow explanations with mermaid diagrams: visitor journey, content pipeline, request path - Architecture table, quick start, API reference, security summary, deploy commands - AGENT.md: orientation for future AI agents (data model, trust rules, rate limits, routes, env, deploy, house rules) - GLOSSARY.md and docs/adr committed (linked from README)	2026-10-09 17:23:14 +03:00
ahmed	e69e419721	Merge pull request 'Security fixes from pentest 2026-10-09: auth rate limits, timing equalization, HSTS, edge DoS caps' (#1) from security/pentest-fixes-2026-10-09 into main v1.0.0	2026-10-09 17:01:00 +03:00
AHMED	8e577165cf	Security fixes from pentest 2026-10-09 (F1, F2, F4, F7) ... - F2: per-IP rate limits on POST /api/users, /login, /forgot-password via new Next middleware (5/h signup, 10/15min login, 5/h forgot); 429 + Retry-After, generic Arabic error, no UX change - F7: ghost-email logins burn the same PBKDF2 cost (600k/32/sha256) as real verifies, closing response-time user enumeration - F4: HSTS max-age=63072000; includeSubDomains on all routes - F1: Traefik pagelimit (60/min, burst 120) + connlimit (in-flight 50) on the page router; apilimit untouched - Pentester accounts (ids 42-48) deleted in prod DB	2026-10-09 17:00:15 +03:00
AHMED	5ee706ebd6	Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads	2026-10-09 16:20:55 +03:00
ahmed	c34611dc36	Add responsive signup page	2026-10-03 13:27:10 +03:00
ahmed	9cfffa4c66	Build searchable article library	2026-10-03 02:37:44 +03:00
ahmed	6c8632315f	Make featured articles clickable	2026-10-03 02:25:03 +03:00
ahmed	a1ba197910	Add footer links to remaining pages	2026-10-03 02:20:31 +03:00
ahmed	2cacdfb926	Add filterable article library	2026-10-03 02:17:46 +03:00
AHMED	e10491ad1c	Add gstack agent digest	2026-10-02 14:34:29 +03:00
ahmed	5254209f7b	Add team about page	2026-10-02 14:06:20 +03:00
ahmed	f7460a44b0	Improve project README	2026-10-02 12:48:37 +03:00
ahmed	8fe818e647	Initial site release	2026-10-02 12:46:11 +03:00