The Verdaccio registry introduced earlier is unreachable from CI (listens on
127.0.0.1:4873 behind a firewall allowing only 80/443/SSH), which broke the
architecture-governance workflow - its npm ci step could no longer resolve
@marketplaces/auth.
Packages are now published to git release branches (release/auth,
release/payment in vitanovaPackages) whose root is the package itself, and
installed with git+<repo>#release/auth. No registry, token, tunnel, or CI
secret - anonymous git read is enough.
- package.json: git dependency; .npmrc removed (no scope mapping needed)
- vitanovaPackages release.yml rebuilt to force-push release branches
- ADR-0001 amended with the distribution change and why the registry lost
- BACKEND-HANDOFF: added the multi-tenancy section (hostname -> tenantKey ->
per-tenant bootstrap config), corrected the install and deploy notes, and
recorded that no CD pipeline exists
- PACKAGE-EXTRACTION / PACKAGES-USAGE rewritten for the git-branch flow
Verified: npm ci, arch:check:boundaries, ng build, 103/103 tests, all with
no credentials configured.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- ADR-0001: decision to extract auth/payment into shared @marketplaces/* packages
- Scaffold packages/auth, packages/payment; @marketplaces/auth now holds the real
telegram (customer+admin QR/session) and ed25519 (future admin challenge/response)
auth implementation, pushed to sources.vitanova.network/sdarbinyan/vitanovaPackages
- Rewire ~30 call sites to import from @marketplaces/auth; delete migrated originals
from core/auth, core/admin-auth, services/, models/
- Replace environment coupling with AUTH_API_URL/TELEGRAM_BOT_USERNAME injection
tokens and isDevMode(); wired as file:packages/auth pending registry publish
- Add TRACK-S §8: bootstrap per-marketplace admin login + marketplace-scoped
sub-admin invite/role endpoints
- Build, arch:check:boundaries, and full test suite (103/103) all green
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Removes all tracked repo documentation (root status docs, docs/,
docs/architecture/foundation/**, docs/archive/**, docs/context/BACKEND-AUDIT.md
+ adrs, src/assets/mock/README.md) and replaces it with:
- GAPS-AND-IMPROVEMENTS.md — role-based findings (user, PO, QA, backend,
accessibility, engineering) plus automated code-review passes over the
storefront and backoffice, each with file:line references. Findings only,
no fixes applied.
- BACKEND-API-REFERENCE.md — single consolidated backend contract: auth
(both mechanisms), bootstrap, pagination/sorting/filtering conventions,
error model, every live/mock-only endpoint with JSON examples, and the
admin-domain DI-token seam gaps.
Open items and unresolved decisions from the deleted docs (KNOWN-ISSUES,
PRODUCT_BACKLOG, SPRINT-PLAN-NEXT, Seller-Management audits, etc.) were
harvested into the two new files before deletion, not lost.
CLAUDE.md/AGENTS.md/GEMINI.md/.claude/ and docs/context/{INDEX,LOG,
MAINTENANCE,README}.md are untouched — confirmed gitignored, never part of
git history, outside this cleanup's scope.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Exhaustive inventory of every HTTP call, gateway (interface + mock +
real impl), facade, and model/DTO the frontend defines or expects,
grouped by domain. Primary input for the remaining Backend
Finalization Sprint docs.
Key findings:
- Only AdminCategoriesGateway and AdminDashboardMetricsGateway are
DI-token-bound; every other admin domain (orders, products, users,
transactions, monitoring, moderation) injects its *LocalGateway
class directly - a real backend swap needs a token added first, not
just a rebind.
- Only one real admin API impl exists (AdminCategoriesApiGateway);
everything else admin is in-memory/localStorage mock.
- Content-management/project-editor have no save/publish HTTP call at
all - builder writes are in-memory + localStorage draft only.
- No literal /admin|/builder|/backoffice CRUD paths exist in source;
concrete admin paths are proposals, not verified literals.
Milestone 6 (final) of the Configuration Engine sprint.
- docs/EDITOR.md: new "Configuration schema, form engine, and validation
architecture" section covering the field-schema registry, centralized
validators, live inline feedback, undo/redo, modified-field tracking, and
pre-publish preview added in M1-M5. Updated the facade signal list and
folder tour to include schema/.
- ADR-0002 (docs/context/adrs/): records the metadata-augmented-vs-fully-
schema-driven decision, why severity splits blocking/advisory, and the
accepted debt (partial [error] binding coverage, schema not yet driving
template labels).
- FACTS.jsonl (project-editor): decision fact pointing at the ADR.
Note: `barry-cache` is a phantom devDependency (no bin resolves, confirmed in
M1) - ADR/FACTS were authored by hand matching the existing schema/format
rather than via `npm run barry -- adr new` / `validate`.
Gate: tsc --noEmit, npm test (33/33), arch:check, build all green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Documents the MediaAsset model, future GET/POST/DELETE/PATCH /media contract,
and the MediaRepository interface (Mock IndexedDB-backed now, Http later via
DI swap) that Sprint 4 will implement against. Media assets never enter the
Bootstrap model, consistent with ADR-0001.
Records the multi-tenant marketplace platform architecture as ADR-0001
(bootstrap-driven, config-only frontend) with a source-backed fact pack,
and writes the approved Sprint 16 design for extending the existing
project editor with Languages/Navigation tabs, an HTML editor, and a
client-side draft/publish flow.
