# Live VPS source reconciliation

## Source of truth

This reconciliation imports the already deployed application source from `/root/anwarpi` into `web/`. The owner explicitly confirmed that the VPS copy, including its package manifest and lockfile, is authoritative. It does not deploy or restart the website.

Included features:

- Admin-only user creation and protected administrative user fields.
- Free early-access reading with registration, checkout and notification signup disabled.
- The exact trial banner, current policy pages and support contact.
- Arabic branding «أنور پآي» and site-wide «محتوى» labels.
- SEO titles/descriptions, utility-page noindex and absolute Article image URLs.
- Most-read homepage cards based on the published collection's cumulative views.
- Click-to-load privacy-enhanced YouTube embeds and same-origin inline raster images.
- Bundled Readex Pro font with its OFL license.
- The deployed daily backup script and cron definition under `ops/`.

## Deliberate exclusions

Do not import `.env` files, secrets, database dumps, backups, uploads/media, private files, build output, dependency directories or TypeScript build caches into Git. Published article records remain in the production CMS database; they are not application-source files.

Generated `payload-types.ts` remains generated/ignored. The repository's existing removal of a hardcoded publishing key from `web/docs/agent-publish-api.md` is retained rather than copying that key back from an older live document.

## Dependencies and security

The deployed `web/package.json` and `web/package-lock.json` are imported as requested. This replaces repository-only dependency/tooling edits and CVE overrides that were not on the live VPS. This release is a source reconciliation, **not a security upgrade**, and does not claim to resolve dependency advisories. Keep the existing recorded Next.js risk acceptance visible and evaluate upgrades separately.

## Verification

Before publication, the reconciled application passed:

- `npm ci --ignore-scripts --no-audit --no-fund`.
- `npm run test:launch`: 10 tests passed, 0 failed.
- `npm run generate:types`.
- `npx tsc --noEmit`.
- `npm run build`: Next.js production build completed successfully.

Added-line credential/injection screening found no literal credentials. Linting is skipped by the deployed build configuration; these results do not claim a separate lint pass or a remote CI run. The independent pre-publication review is recorded in the reconciliation's private evidence, not treated as a substitute for the commands above.

## Operational files

`ops/daily_backup.py` is the deployed `/root/anwarpy-daily-backup.py`; `ops/anwarpy-backup.cron` is the deployed cron definition. Their paths and container names reflect the current installation. Merely merging these files does not install cron or run a backup.

Backup archives include runtime configuration and potentially sensitive data. Keep their destination root-only and never publish archive contents. This workflow did not read or change production data, invoke a backup, apply migrations, or deploy a replacement image.