Serve canonical root-relative DAV URLs on a configured hostname while preserving the existing /dav mount. Reconcile Cloudflare rewrite rules and Worker custom domains during fork deployments, and expose the effective URL through site options.
Three related robustness fixes for the cloud pairing flow:
1. Trusted license public keys are env-configurable (ZPAN_LICENSE_PUBLIC_KEYS)
instead of hardcoding dev keys in source — a leaked dev key is rotated via
config and never baked into production builds. Registered in all platform
factories.
2. Certificate verification surfaces a specific rejection reason
(signature/issuer/instance/expired/host), and the pairing modal distinguishes
a cert-verification failure from a genuine timeout instead of showing both as
"expired". On failure the poll handler rolls back the orphaned cloud binding.
3. After verifying + storing the certificate, the instance confirms the binding
to the cloud (zpan-cloud-sdk 2.1.0's POST /licenses/:id/confirm) so the cloud
pairing page resolves to success only once the instance actually accepted it.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Support independent Pro and Business licensing, migrate Cloud store integration through the SDK, gate Business-only credit billing features, and validate the Cloud store E2E flow.
The deploy button uses values from .dev.vars.example as form defaults.
A placeholder like 'replace-with-a-long-random-string' could be
deployed as-is, which is a security risk.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Move BETTER_AUTH_URL and TRUSTED_ORIGINS from .dev.vars.example to
wrangler.toml [vars] so they render as text inputs, not password fields
- Keep only BETTER_AUTH_SECRET in .dev.vars.example (true secret)
- Add cloudflare.bindings descriptions in package.json for deploy form
- Remove unused concurrently dependency
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace Pages Functions with Workers entry (`workers/bootstrap.ts`)
- Add Deploy to Cloudflare button in README
- Integrate `@cloudflare/vite-plugin` for CF dev with HMR
- Integrate `@hono/vite-dev-server` for Node dev with HMR
- `npm run dev` now defaults to CF Workers mode
- Add `run_worker_first = ["/api/*"]` so static assets stay free
- Extract shared Node bootstrap (`server/bootstrap.ts`) for reuse
- Update all docs from Pages to Workers references
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove hardcoded BETTER_AUTH_SECRET that was leaking a development
credential into the repo and into production deployments.
- Replace database_id="local" placeholder with the real zpan-db D1
UUID (5bd64957-fa49-4da0-8b7b-6e0ad84037e7) so both manual
`wrangler pages deploy` and git-integrated deploys resolve to the
same remote database.
- Add non-secret [vars] (BETTER_AUTH_URL, TRUSTED_ORIGINS) and
pages_build_output_dir pointing at ./dist.
- Introduce .dev.vars.example documenting the env vars required for
local `wrangler pages dev` / Node `npm run dev`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
saltbo