Changelog

Added the Better Auth admin plugin with D1-backed roles on the user model, plus migration 0008 (role, banReason, banExpires, the session impersonatedBy field, the admin_audit_log table, and a created-at index for the roster query).

Built the decision core with a ban-first fail-closed order: an active ban rejects before every grant branch, including the bootstrap path, so a hand-written ban cannot be walked over by an allowlisted email.

Shipped the six admin screens: overview statistics with the newest audit rows, a read-only contact inbox with per-channel delivery badges and an expandable body, newsletter subscriptions with the audited operator unsubscribe, read-only payments snapshots across orders/subscriptions/customers, AI credit periods and recent requests, and user management with role and ban dialogs.

Added ADMIN_EMAILS as an optional public environment variable with the full sync chain, email-verified promotion, and normalized address matching. Demotions always re-promote at the next session check; removing the email from the list is the only way to retire an operator.

Architecture guards scan the admin area in CI: every server function entry passes the shared request guard, read-only repositories carry no write paths, route heads declare themselves unindexable, and the enumeration maps answer the raw value for unknown enum values instead of routing a fallback key's translation.

Moved the TanStack Start cookie bridge to the end of the Better Auth plugin array per upstream guidance, so plugin hooks that run after it cannot write cookies the framework cookie store misses.

Migrated the deployment chain from Wrangler to the official Cloudflare CLI. cf migrate converted the Worker configuration, keeping the Worker name, every binding, the D1 database ID, and the R2 bucket; the build now runs through the Cloudflare Vite plugin's new Wrangler-independent line, and cf deploy --prebuilt publishes the Build Output pnpm build already produced instead of building a second time.

Replaced the JSONC environment surgery with a JSON sidecar: pnpm cloudflare:sync-env renders cloudflare.vars.json from .env, cloudflare.config.ts imports it and maps each entry to a text binding, and the build and preflight scripts read the same file. Secrets are no longer uploaded by the sync step -- they attach to each Worker version at deploy time, which is how the CLI models them.

Moved the D1 migration commands to cf d1 migrations apply, which takes the database ID and applies to the remote database by default; local migrations add --local --persist-to .cloudflare/state, sharing the dev simulator's database; unattended runs answer the migration confirmation with its default yes.

Split the dashboard into one route per view. /dashboard/apps/mail, /dashboard/settings/billing, and the rest are addressable paths now, and each route builds only the view it renders, so opening one dashboard surface no longer ships the others with it. Legacy /dashboard/?view=... links redirect permanently with the locale intact, and settings-user stays as an alias for the account view.

Added Google One Tap as an opt-in. Setting VITE_GOOGLE_CLIENT_ID offers the browser prompt to signed-out visitors on public pages, waits for the session to settle before it asks, and returns the visitor to the localized dashboard afterwards. It stays out of the auth flow, which keeps its own "Sign in with Google" button.

Shipped a new factory theme: Orange, square corners, Space Grotesk over Fira Code, and the Compact reading rhythm. A stored configuration keeps whatever the reader already had, so the new defaults reach a first visit and a reset rather than every returning reader.

Grew both curated lists: the font pairings from ten to thirteen (a native pair that asks for no web font, a literary serif, and a grotesque drawn from monospace bones with a ligature mono), and the typography presets from six to eight, adding Essay for a narrow long-read column and Easy read for the largest size at a moderate rhythm. Guard tests reject a preset or pairing that repeats another one's values.

Added a second homepage. The home route renders a variant picked in the theme customizer's Custom region: the original Showcase page, with its interactive hero and its tour of what ships in the box, or a Marketing page migrated from the @7ovr/saas-landing registry block. Both use the semantic tokens, so every theme, font, radius, and typography choice reaches them, and the reset action and the dice leave the choice alone because it is a layout decision rather than a skin.

Rewrote that marketing page for this template. Its copy describes the accounts, billing, trust, data, locale, and theming features that actually ship, its pricing table uses the catalogue's real plans, and every number on it is countable in the repository. Its hotlinked photos and avatars became token-built mocks and initials, its fake demo video and support form became links to the real guides and contact pages, and the brand wall now shares one set of marks with the showcase page. The default homepage is the marketing page, and it is prerendered, so a first visit carries the real content.

Made the default homepage cheap to serve. Its variant is imported statically so the prerendered HTML holds the real page, while the showcase variant loads on demand in its own chunk: the home route's script went from 83 KB to 34 KB, and a reader who never switches never downloads the other one.

Removed the navigation pending bar, the pricing "All Plans Include" block, and four closing blocks from the homepage, so a navigation no longer flashes a loading strip and the pricing page no longer repeats a shared feature list that every plan card already covers.

Fixed raw translation keys on almost every page. Splitting the locale bundle per route only covered the route a reader lands on: the router's hydration hook runs once, so a client-side navigation never loaded the next route's copy, and the instance built for the first route could not see it arriving. A first attempt fixed the shared chrome's namespaces in the route table; the general fix loads each route's namespaces as the router moves and rebuilds the instance from that state, pushes a namespace registered later into the instance already in use, and reads translated arrays without trusting them -- a missing bundle now renders less rather than the key names.

Fixed the same class of fallback in the places that build output rather than render it: each route's head() is projected before the page renders, so the copy it reads now lives in a namespace loaded on every route, and the Open Graph generator -- which runs outside the app and whose cards no test read -- takes its keys from that namespace too.

Rebuilt the corner scale as a ratio of the customizer value and pulled the remaining fixed radii into it. Checkboxes, charts, tooltips, input groups, long-form marks, search highlights, scrollbars, page-header badges, blog tags, and the pricing monthly/yearly switch now all follow the control, and a guard test keeps a hard-coded radius from creeping back in.

Merged the body and heading font slots into one. A reader picks a body family and a code family, and the curated pairings describe that pair instead of inventing a heading family for every body.

Open Graph images now take their logo from the resolved theme mode, so the light and dark marks stay with the theme they belong to.

Stopped the reading position from drifting on reload. The restore now waits for the page height to settle instead of aiming at a layout that is still growing.

Made the long font list scrollable. The default alignment translated the list rather than giving it a scrollable area, so a family near the end could not be reached at all.

Realigned the pricing FAQ. Both columns read from one shared grid, so a taller answer no longer pushes the next question out of line.

Put the Open Graph brand line and headline on the semibold face, since full bold read too heavy at display sizes.

Removed the page-load reveal. Content no longer starts hidden and fades in, so a fast navigation does not show an empty frame first.

Vendored shadcn Typeset as the only typesetting engine and removed the Tailwind Typography plugin, its token bridge, and the hand-written prose overrides. Heading sizes, list indents, and block spacing now derive from three rhythm values.

Added a font system with a slot each for body text, headings, and code, plus curated pairings. Families are self-hosted and loaded on demand, and the heading slot accepts serif faces for an editorial tone.

Added typography presets to the theme manager, with controls for size, line height, block spacing, and reading width, and individual values for each measurement.

Tuned the reading defaults per surface: Chinese pages and dark surfaces loosen the line height slightly, and any value chosen in the customizer overrides both.

Wired the reading width through the blog and guides shells. A wider column narrows the side rails instead of pushing them past the viewport, and every shell keeps its previous geometry at the default measure.

Kept wide tables inside long-form content scrollable instead of widening the page on mobile, and gave interactive widgets an explicit way to opt out of the engine.

Restored the site heading scale across long-form content. Page titles and section headings follow the shared roles again, so an article or legal page reads at the same size as every other page instead of one step below it. Headings inside the text keep their em ladder, so the typography size control still scales those, while the page header stays fixed.

Restored the font tokens across the whole app. Utilities compile to the theme variables again, so the selected family reaches the site chrome, the dashboard, and article content alike.

Kept typography values and font slots out of the theme preset, imported theme, and randomization paths, so switching themes no longer discards a reader's choices.

Added an interactive Hero Showcase with 3D story cards, pricing promo, animated backdrop, and logo carousel, fully localized in EN and ZH.

Integrated Chatwoot live chat with a dark-mode toggle and localized launcher and chat UI.

Added JSON-LD structured data for Blog posts, homepage, pricing, and public pages, with refined FAQ and article rendering.

Added the Service page, blog cover images, and updated navigation for the expanded public site.

Introduced the TanShip Commercial License page and replaced Open Graph fonts with OFL-licensed Fredoka and Smiley Sans.

Converted feature showcase images to WebP and added Vite chunk size warnings for leaner deployments.

Added authenticated Workers AI tools with monthly credit management and Cloudflare binding-based execution.

Added deployment scripts, environment preflight checks, and Cloudflare configuration for production Workers.

Expanded Guides with Chinese content, localized full-text search, snippets, highlights, icons, and responsive navigation.

Added global theme presets, radius controls, and Dashboard layout settings.

Added Open Graph image generation, R2-backed profile avatars, and unified account identity across public and Dashboard surfaces.

Introduced shared typography roles and reusable MDX code blocks with syntax highlighting, copy actions, and bounded scrolling.

Integrated Better Auth with Cloudflare D1, including email verification, password reset, and localized authentication redirects.

Added Creem, Stripe, and PayPal adapters with verified webhook processing and provider-specific checkout flows.

Added subscription recovery, cancellation, renewal status, and lifetime purchase handling.

Expanded the authenticated Billing page with membership summaries and paginated payment history.

Added double-opt-in Newsletter subscriptions and a persisted Contact form with localized email delivery.

Added the initial TanStack Router structure for public, authentication, and dashboard experiences.

Created responsive Dashboard navigation and workspace views for core application workflows.

Added Guides navigation, search, table of contents, and responsive documentation layouts.

Introduced Blog listing, pagination, article rendering, and shared MDX content registries.

Added shared long-form typography through the ArticleContent component.