Revival: rebuilt data model, auth, delivery & analytics

.env.example

@@ -1,2 +1,3 @@
 APP_SECRET=CHANGE_ME_TO_A_LONG_RANDOM_STRING
-DATABASE_URL="postgresql://user:password@localhost:5432/dmcommerce?schema=public"
+DATABASE_URL="file:./dev.db"
+CHECKPOINT_DISABLE=1

.gitattributes

@@ -0,0 +1 @@
+public/files/*.pdf binary

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  APP_SECRET: ci-session-secret-that-is-at-least-thirty-two-characters
+  DATABASE_URL: file:./dev.db
+  CHECKPOINT_DISABLE: "1"
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run prisma:generate
+      - run: npm run prisma:migrate:deploy
+      - run: npm run db:seed
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run validate:fixtures
+      - run: npm test
+      - run: npm run build
+
+  browser:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run prisma:generate
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e
+      - name: Upload Playwright report on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          if-no-files-found: ignore
+          retention-days: 7

.gitignore

@@ -18,13 +18,15 @@ production
 /.next
 /out
 /build
+/var/
 
 misc
 
 .DS_Store
 .env*
 !.env.example
 *.log
+*.tsbuildinfo
 .prisma
 .sanitized-backup/
 scan-report.json
@@ -37,6 +39,8 @@ dev.db
 /dev.db-journal
 /prisma/dev.db
 /prisma/dev.db-journal
+/prisma/e2e.db
+/prisma/e2e.db-journal
 
 # Security - keys and certificates
 *.pem

.sensitiverc.json

@@ -3,13 +3,19 @@
     "node_modules/**",
     ".next/**",
     ".git/**",
+    "tmp/**",
+    "var/**",
     "public/screenshots/**",
     "prisma/dev.db",
-    "DM Commerce UI/**",
-    "old_ui_backup/**",
     "scan-report.json"
   ],
-  "allowEmails": ["demo@local.test"],
+  "allowEmails": ["demo@local.test", "i@izs.me"],
+  "allowMatches": [
+    "SECRET: \"playwright-secret-that-is-at-least-thirty-two-characters\"",
+    "SECRET = \"test-secret-that-is-long-enough-for-signing\"",
+    "SECRET = \"CHANGE_ME_TO_A_LONG_RANDOM_STRING\"",
+    "secret = \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\""
+  ],
   "treatAsBinary": [
     "**/*.pdf",
     "**/*.png",

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing
+
+Thank you for improving DM Commerce OS. The project welcomes focused bug fixes, tests, documentation corrections, and product changes that preserve its local-first, inspectable DM-commerce loop.
+
+## Ground rules
+
+- Keep the default demo usable without API keys, Docker, or hosted services.
+- Make simulated boundaries explicit; do not imply mock payments or local delivery are production integrations.
+- Put business rules in `src/lib` and keep route handlers thin.
+- Validate untrusted input at the server boundary.
+- Preserve append-only commerce events when adding funnel behavior.
+- Avoid unrelated formatting or generated files in a change.
+
+## Local workflow
+
+```bash
+npm run setup
+npm run dev
+```
+
+Before opening a pull request:
+
+```bash
+npm run lint
+npm run typecheck
+npm run validate:fixtures
+npm test
+npm run build
+```
+
+For browser behavior, also run:
+
+```bash
+npm run test:install
+npm run test:e2e
+```
+
+## Pull requests
+
+A useful pull request includes:
+
+- the user-visible problem and intended outcome;
+- the smallest coherent implementation;
+- unit or browser regression coverage;
+- migration and seed changes when the data model changes;
+- updated README/docs for altered commands or claims; and
+- screenshots only when visual behavior materially changes.
+
+Do not commit `.env`, `prisma/dev.db`, `prisma/e2e.db`, `var/`, `.next`, `node_modules`, Playwright output, scan reports, or personal data.
+
+## Security issues
+
+Do not open a public issue containing vulnerability details. Follow [SECURITY.md](SECURITY.md).