Every step,
from the first commit.

The drizzle-generated 0004 migration re-creates every object already made by the hand-written 0001-0003 migrations (umap columns, guest packs, subscription enums/tables) without idempotency guards, so the chain died on the first CREATE TYPE when run in order against an empty database — failing the CI 'Apply database migrations' step before any test could run. - 0004: guard every statement (DO blocks for enums/constraints, IF NOT EXISTS for tables/columns/indexes) so it is a clean no-op once 0001-0003 have run. - 0013 + schema.ts: projects.created_by was NOT NULL but its FK used ON DELETE SET NULL — deleting a user violated the not-null constraint and broke the DB-backed auth suite's cascade cleanup. Switch to ON DELETE CASCADE to match the documented intent and the sibling patterns.created_by FK. Verified: full chain applies on a bare pgvector:pg16 database (22/22 migrations) and 'bun test' passes 176/0 with DATABASE_URL/REDIS_URL set. [private session redacted]

Implements the new product positioning: lead with hosting, organizing, and selling sounds (audio-native catalog + creator storefront), with the step sequencer demoted to a free funnel/preview feature. Landing & routing: - New marketing landing page at / (hero, value props, pricing) that adapts CTAs to auth state - Move the step sequencer from / to /studio (the /sequencer/* path is a backend asset proxy, so /studio avoids a route conflict) - Update Header nav, CommandPalette, and labels to point at /studio Fee model (fixes adverse selection): - Add PRO_FEE_PERCENT config (default 3%); Pro/Team sellers now pay a low 3% fee instead of 0%, keeping platform incentives aligned with high-volume sellers while still undercutting Gumroad (~13%) / Beatstars (12%). Free tier unchanged at 15%. - Drive dashboard fee percentages from config; expose free/pro fee percents for accurate upsell copy - Update SubscriptionDrawer and dashboard messaging from "keep 100% / 0%" to the new 3% framing Docs: - Rewrite README and CLAUDE.md product overview around the new positioning; note the docs/README that predate the Stripe migration [private session redacted]

Adds a ready-to-use CI workflow. It is placed under ci/ rather than .github/workflows/ because this environment's OAuth app lacks the 'workflow' scope required to push workflow files (and the GitHub contents API rejected the write). See ci/README.md for the one-step activation (git mv into .github/workflows/). The workflow's test job runs the backend suite against pgvector Postgres + Redis service containers, activating the DB-backed integration suites (auth.routes, purchases.integration) that skip without a database. lint + typecheck run as informational jobs due to pre-existing uploads.ts dead-code failures.

Adds purchases.integration.test.ts covering the real database-touching access logic against seeded rows (complements the pure-logic purchases.test.ts): - hasPurchasedPack: free-pack access, creator-owned access, stranger denial, unknown pack, missing identifier, completed-purchase access by email (case-insensitive), other-email denial, and that non-completed (pending) purchases are ignored. - linkGuestPurchasesToUser: claims a completed guest purchase by email and flips userId-based access from false to true; returns 0 for no-match and empty args. Seeds users/packs/purchases directly and cleans them up in afterAll. Guarded on infra.db only (no Redis needed), so it skips cleanly without Postgres and runs for real against a live DATABASE_URL. 12 tests. Full suite: 153 pass / 35 skip / 0 fail.

Replaces the two fake auth tests (auth.test.ts / auth.integration.test.ts), which built throwaway in-memory Elysia apps and tested reimplemented logic, with a suite that mounts the REAL authRoutes and exercises the full register -> login -> /me -> refresh -> logout flow against the actual database + Redis-backed rate limiter: - helpers/infra.ts: fast raw-TCP probe for Postgres/Redis (no ioredis/pg retry machinery), memoized; lets suites decide run-vs-skip. - helpers/auth-harness.ts: mounts production authRoutes with the subset of the global error mapping the flows rely on (AuthError->401/403, RateLimitError->429, validation->400); plus a request helper. - auth.routes.test.ts: 17 tests covering happy paths, duplicate email, validation, generic 'Invalid credentials' messaging, token/no-token/ garbage-token on /me, refresh rotation, and logout revocation. Guarded by describe.skipIf so it skips cleanly where Postgres/Redis are absent and runs for real where they exist. Cleans up created users via cascade. - setup.ts: env vars now use ||= so a real DATABASE_URL/REDIS_URL can be injected (CI secret / SessionStart hook / .env) to activate the suite. Adds a SessionStart hook (.claude/hooks/session-start.sh + settings.json) for Claude Code on the web: installs deps with bun install and, best-effort, brings up Postgres+Redis via docker compose, applies migrations, and exports DATABASE_URL/REDIS_URL so DB-backed suites run in future web sessions. The infra step never fails the session — without Docker the suites just skip. Full suite: 153 pass / 23 skip / 0 fail.

Adds unit tests for the pure, security- and money-sensitive logic exported from the payments services, exercised against the actual modules: - purchases.isValidRedirectUrl: open-redirect guard for checkout/portal redirects — covers trusted-host allow paths plus deny paths (external domains, look-alike subdomains, dev-only ports, javascript: scheme, malformed input). - purchases.MIN_PAYOUT_AMOUNT_CENTS: payout floor. - subscription.getStorageLimitForPlan + STORAGE_LIMITS/PRICING: tier invariants (free<pro<team, monthly==yearly storage, annual discount yearly<12x monthly, all prices positive) rather than brittle magic numbers. These confirm the service modules import cleanly under the test runner (lazy DB connection, no live Postgres/Redis required). Full suite green: 176 pass / 0 fail.

The existing suite largely reimplemented logic inside the test files (fake Elysia apps, in-memory auth, copied DSP algorithms) so it passed without exercising production code. This adds 7 test files that import and test the ACTUAL modules: - utils/sanitize (SQL LIKE escaping, XSS reflection, slug/UUID/pagination) - utils/slug (slug generation + async uniqueness loop) - utils/hash (content hashing, buffer/stream parity, known SHA-256 vector) - utils/format (byte formatting boundaries) - utils/audio-validation (magic-byte gate: accept/reject + real file reads) - auth/password (bcrypt salting + verification) - auth/jwt (HS256 sign/verify, tamper detection, expiry) Also wires up coverage: adds test:coverage / test:watch scripts and bunfig coverage settings. New modules now report ~100% line coverage. 66 new tests, full suite green (160 pass / 0 fail).

The ClamAV provider's isAvailable() was a TODO stub returning false. It now opens a short-lived TCP connection to clamd and issues the PING command, resolving to true only when the daemon replies PONG. Connection errors and timeouts resolve to false (daemon unavailable).

Replace the hardcoded `isMobile = false` placeholder with a reactive media query. Adds a reusable `useMediaQuery` hook that tracks a CSS media query via matchMedia, and uses it in StepGrid to detect viewports below Tailwind's `md` breakpoint (768px) for the single-column layout. [private session redacted]

Add missing documentation for observability stack (Jaeger, Prometheus, Grafana), service management commands, additional db commands, workers directory, and env file variants. Add .claude/launch.json for frontend and backend dev server configurations. Co-Authored-By: Claude Opus 4.6 <[email redacted]>

Documents the full codebase structure, tech stack, development workflows, code style conventions, architecture patterns, and key commands for AI assistants working on this repository. [private session redacted]

- Renamed all user-facing references across 35 files - Updated package.json names, page titles, meta tags, config - Preserved migration files and git history - No DB column/table renames (needs separate migration)

Simplify upload client to direct presigned uploads

Improve Stripe checkout handling (stop storing tokens, include session_id, handle async events)