Live from GitHub · Refreshed continuously

Software Updates

Every change we ship to katura1999.com — features, fixes, security patches, the lot. Pulled straight from our private GitHub repository so you can see exactly what was built and when.

By the numbers

Lines of code

997,181

Web platform — TypeScript, React, Prisma, CSS

iOS

79,607

Swift + SwiftUI lines

Android

3,117

Kotlin + Jetpack Compose lines

All platforms

1,079,905

Web + iOS + Android combined (54.2× the King James Bible)

Characters written

42.68M

42,680,782 total characters

Updates pushed

2,265

exact commit count on main

Current version

v1.22.65

build 2265 · b9d76c9

Database models

423

across 47 schema files — most SaaS platforms have 20–50

API endpoints

1,074

individually routed — Stripe's public API has ~400

Translated strings

106,176

every string, in 24 languages

System permutations

10^323

2^1,074 endpoint combinations — more than atoms in the observable universe (10^80)

Project age

11mo 1d

since Dec 14, 2025

Pre-AI dev hours

36.0K hrs

1,079,905 lines ÷ 30 LOC/hr — equivalent to 17.3 years (senior engineer, no AI)

With-AI dev hours

9.0K hrs

4× AI productivity multiplier (2024–2026 studies) — equivalent to 1,125 days

Equivalent firm cost

$9,472,521

live ticker · Katura rate: $60 USD/hr

Hours estimated from source line count at 30 LOC/hr (industry benchmark for production-quality TypeScript/React without AI assistance), with a 4× multiplier for AI-assisted development per published 2024–2026 enterprise studies. Equivalent Firm Cost uses a $250/hr loaded billable rate reflecting a premium engineering firm building enterprise-grade SaaS — and ticks up live, because the project is still being actively built.

Commit history

2,265 updates pushed

Showing page 2 of 40 · 51–100 of 2,000 fetched

Monday, November 2, 2026
13 updates pushed
4:35 PM · Claude
Stop admin test emails from reaching customers
- Every Brevo sender now runs test sends ([TEST] subject or a test tag)
- through one guard: at most 3 single addresses, each internal, a Katura
- staff user, or listed in TEST_EMAIL_ALLOWLIST. Customers, unknown
- addresses and comma lists are refused before any request to Brevo, and
- the warn log carries a count only. Campaign send-now/schedule (and the
- Brevo list-send helpers) refuse a campaign whose name or subject looks
- like a test.
- The admin test routes default to the signed-in admin's own address,
- return 400 when the guard refuses, and write an audit entry with the
- recipient count (no addresses). The dev console's live abandoned-cart
- test now sends as [TEST] so the same guard applies.
b0a85ddView on GitHub →
7:50 AM · Claude
Update bag-email route tests for the signed-in account mode
- #23 gave signed-in shoppers a one-click 'account' mode on /api/cart/email
- (consent for their own bag, reminder to the account address), but the test
- still expected a 409 and a response without 'mode', and its mock had no
- user model, so two cases failed and the signed-in GET case only passed
- because the route's catch block returned canSave: false.
43f3f13View on GitHub →
7:49 AM · Claude
Keep the job-queue cron off unless JOB_QUEUE_ENABLED=1
- Reading the KV_REST_API_* store would otherwise switch on a queue
- processor that has never run in production. Nothing in the app enqueues
- to it and the default job types only have throwing placeholder handlers,
- so turning it on must be an explicit decision.
8afc2a2View on GitHub →
6:51 AM · Claude
Sync every Meta ad account and report desk spend in USD
- META_AD_ACCOUNT_IDS (comma-separated, falls back to META_AD_ACCOUNT_ID); fetchers take an explicit account; the sync runs accounts one by one, each with its own error, its own 90-day backfill decision and its own currency (an unknown currency skips the account, never stored as USD).
- Upserts batched 100 per transaction; cron limit 120s, desk sync 60s.
- Spend is converted to USD at read time with the storefront's exchange-rate service (today's rate; no daily history exists), and the desk says so; campaign rows keep the native amount.
- Data health warns when the last attempt failed for any account.
- Funnel / Experiments / Data health / Report tabs get their own titles.
e72d382View on GitHub →
6:45 AM · Claude
Keep bots out of shopper metrics and Meta CAPI (classify only)
- Classify each funnel request's user agent (declared crawler, automation,
- outdated engine). Bot rows are still written but carry metadata.bot, and
- CAPI skips them with the reason logged. Responses are identical for bots
- and people: nothing is blocked or served differently.
- The marketing desk leaves out bot rows and Meta ad-review bursts (3+
- one-hit visitors on one piece within 120 s, a SQL CTE), counts
- "views but no bags" viewers by visitor id only, and reports the excluded
- rows in Data health.
3afcfd2View on GitHub →
6:43 AM · Claude
Synthetic tests: finish in shards, stay internal, stop production noise
- Split the suite into 4 shard crons (?shard=i&shards=4, 10 min apart) with their own 300 s maxDuration; 8 probes in flight, 10 s per request, a 200 s start budget (later probes are recorded as skipped). Each shard stores its results (batched inserts, one shared run row per cron slot) and alerts on its own failures.
- Every probe request to the site sends Cookie: katura_internal=1; the Katura-Synthetic-Test User-Agent is internal traffic in isInternalRequest and the CAPI gate, and a bot in bot-ua.
- /api/newsletter answers internal and reserved-domain addresses (.local, .test, .example, .invalid, .localhost) without a lead, welcome email or Brevo contact; the probe uses synthetic-probe@example.com.
- No fake Stripe signature: unsigned POST only (400, not logged). ShipStation and Brevo webhooks are checked through their GET status endpoints; form routes that log ZodErrors on an empty POST get a GET 405 existence check.
- Nivoda/Stuller platform routes rethrow the sign-in redirect (unstable_rethrow) instead of logging NEXT_REDIRECT as a 500.
- Vector search probe passes skipVector=true; product page probes use /creations/<slug>; stale "hourly" comments fixed.
cf23356View on GitHub →
6:42 AM · Claude
Improve Meta match quality: first-party _fbc, guest em/ph, external_id
- proxy: set a first-party _fbc from fbclid on storefront page requests, only with Advertising consent, never over an existing one or for staff
- ViewContent / AddToCart send the browser's click id (readClickFbc); the server routes accept it as the validated fallback, like InitiateCheckout
- InitiateCheckout uses a guest bag's "Email me my bag" address
- checkout re-inits the pixel with the typed email / phone (consent-gated)
- webhook Purchase sends the order's user / visitor ids as external_id
- gift orders: both Purchase paths match the buyer, not the recipient
- order attribution keeps a source-only utm touch
fb7bce1View on GitHub →
6:42 AM · Claude
Add Apple Pay / Google Pay before the address step; fix /shipping copy
- Checkout step 1 now opens with a Stripe ExpressCheckoutElement (Apple Pay
- and Google Pay only). The wallet sheet is priced by the existing
- create-payment-intent quote mode on every address / rate change, and on
- confirm the order is created by the same endpoint with the form's body,
- attribution fields included, so Order.campaign / adId / utmSource fill
- the same way. Meta AddPaymentInfo for both paths goes through one helper
- (shared api_ eventId on pixel and CAPI, once per journey);
- InitiateCheckout and Purchase are unchanged.
- Shoppers in the Facebook, Instagram, Threads and TikTok in-app browsers
- get a dismissible note on /checkout and /cart with a copy-link (iOS) or
- open-in-Chrome intent (Android). The link restores a guest bag via the
- signed bag-reminder restore link (new GET /api/cart/restore-link).
- /shipping now states checkout's delivery windows in every locale and no
- longer promises FedEx Priority Overnight on free standard shipping or
- FedEx International Priority abroad: no code binds a carrier service to
- a checkout method (staff pick labels from live ShipStation rates).
2c5e272View on GitHub →
6:39 AM · Claude
Read Vercel KV Redis env, quiet rate-limit fallback, limit logins
- Add getRedisRestConfig(): UPSTASH_* pair first, else KV_REST_API_* pair (write token only); use it in rate-limit, cache, cache/redis, both job-queue routes and env validation.
- rate-limit: warn once per process when unconfigured or when Redis fails, add a 1s AbortSignal timeout to Upstash calls and fail open to memory.
- Apply RATE_LIMITS.login in credentials authorize, keyed by IP + SHA-256 of the normalized email; on limit authorize returns null, so forms show their usual generic error.
22b5ed1View on GitHub →
6:33 AM · Claude
Validate the cart AddToCart eventId, guard checkout storage, drop dead fbEventId
- POST /api/cart: accept body.eventId only in the pixel's AddToCart shape (isValidTrackingEventId, as /api/tracking/add-to-cart). Without one the bag is still updated but the CAPI AddToCart is skipped, since Meta could not deduplicate it against the pixel; one warning per process, no request data.
- Checkout InitiateCheckout journey key and the success page's purchase guard now use a non-throwing storage helper (src/lib/safe-storage.ts), so a webview that throws on sessionStorage no longer kills the IC effect.
- create-payment-intent: remove body.fbEventId. No client sends it and the Stripe webhook never reads it (Purchase uses pur-<orderNumber>).
5ff8701View on GitHub →
6:32 AM · Claude
Fail fast and quietly when OpenAI is out of credits
- Add a shared OpenAI circuit breaker (src/lib/ai/openai-guard.ts): a
- quota-exhausted 429 or a 401 pauses OpenAI calls for 15 min per instance,
- OPENAI_DISABLED=1 is a kill switch, and the breaker logs one warn when it
- opens. Storefront search embeddings, the daily briefing, the blog-agent
- cron, hotel suggestions and the platform docs search honour it.
- Also: storefront vector search now applies PUBLIC_PRODUCT_WHERE and a
- 'search' rate limit; suggest-hotels gets a 'hotel-suggestions' limit and
- answers a friendly 503 instead of 500; the admin dashboard no longer
- retries briefing generation on every view after a failure.
3d56149View on GitHub →
6:30 AM · Claude
Tag Meta catalog items ready_to_ship / made_to_order
- Meta feed: custom_label_3 = ready_to_ship | made_to_order (omitted when sold out); availability unchanged; return policy by fulfillment, so a ships-immediately piece with no stock is final sale like any made-to-order piece; stale availability doc comment fixed.
- PDP JSON-LD: InStock / MadeToOrder / OutOfStock from fulfillment.
- Product cards (/creations, home new arrivals): "Ready to ship" only with stock, via getAvailableStockByProduct (expired holds released, queried only when something is reserved).
27efbf5View on GitHub →
6:28 AM · Claude
Fetch PDP related products in one query and cache them
- "Error fetching related products" fired 227 times in 7 days (P2024 pool
- timeouts, P1001). The section ran up to 8 findFirst calls per render, four
- in parallel, each with its own image query, so bursts of views on one
- product drained the 5-connection pool.
- Now one product query picks one piece per type in JS (same metal first,
- case-insensitive) and one image query loads at most 4 images, sequentially
- on a single connection. The result is cached per (product, metal) for an
- hour under the existing 'products' tag plus 'related-products'. Failures
- are no longer cached, and are logged once with the Prisma code only.
fcf9e7fView on GitHub →
Sunday, November 1, 2026
3 updates pushed
9:58 PM · ZRosserMcIntosh
Gift balance at checkout, bag reminder for signed-in shoppers, desk counts that agree (#23)
- Checkout shows the gift balance taken off from the Information step, the same as the bag (same cap as create-payment-intent). Before, the total jumped back up until the payment step.
- "Email me my bag": signed-in shoppers who don't accept marketing email get a one-click "Remind me about this bag" (consent for this bag only, sent to the account address by the existing reminder cron). en/pt/es copy.
- Desk: By piece bag rate is shoppers who added / shoppers who viewed; "Converts, needs traffic" needs 20 viewers (RATE_MIN_VIEWERS).
- Desk: channel x device uses the funnel's people and first-arrival channel, so a channel's adders match the funnel table (Direct 15 vs 12).
- Overview says its tiles count events and the Funnel counts people.
397fb3bView on GitHub →
7:58 AM · ZRosserMcIntosh
Privacy wording: disclose ad sharing, US opt-out and GPC; correct the DNT claim (#20)
- /do-not-sell:
- The "Our Commitment" card becomes "Sale and Sharing of Personal Information": what goes to Meta, Google, Pinterest and X, opt-out routes, GPC, and opt-in outside the US.
- The rights list and data categories are corrected, and advertising partners are listed alongside service providers.
- /privacy:
- The summary, sharing list (advertising partners added; regional cookie rule), cookie table, rights table and California card now describe sharing and the opt-out.
- The DNT section says the site does not act on DNT and points to GPC.
Saturday, October 31, 2026
16 updates pushed
2:43 PM · ZRosserMcIntosh
Merge pull request #21: marketing desk data fixes
- Marketing desk data fixes: one shopper filter, people funnel, merged Meta channel, sync errors shown
3689185View on GitHub →
2:05 PM · Claude
Marketing desk data fixes: one shopper filter, people funnel, merged Meta channel, sync errors shown
- Data health counted every row: 122 checkouts (99 of them the synthetic monitor's empty checkout starts, which stopped on Oct 29), so "19% with a visitor id" and "1% with a campaign" were measured mostly on monitor rows. It now counts shopper rows, the same as the Overview (22 checkouts, 22 with a visitor id), and reports internal and synthetic rows separately.
- Purchase signal: compared with paid orders. No paid orders in the period is "no sales" (grey), not a broken signal. Paid orders without purchase rows is red.
- Funnel: steps are a sequence in people (viewers, adders, adders who checked out, checkouts that were paid; funnelPeople), so no step can exceed the one before it. The previous period's bag → checkout was 131.82% on events; it is 10 of 26 people (38%).
- Channels: Facebook, Instagram and "Meta Ads" are one "Meta" channel. The pre-Oct-30 "Internal" label (a katura1999.com referrer) counts as Direct.
- Meta spend sync: every attempt is recorded (SiteSetting marketing/metaSyncLast). Data health shows Meta's error ("(#200) … ads_read permission") and the fix (a system-user token with ads_read as META_MARKETING_API_TOKEN). It used to show only "never". The raw details are behind a "Details" toggle, with one fix sentence per failing check.
Thursday, October 29, 2026
5 updates pushed
9:09 PM · ZRosserMcIntosh
Merge pull request #15: Marketing desk audit — decisions per campaign, paid-only ROAS, phone layouts
- Marketing desk: decisions per campaign, paid-only ROAS, phone layouts
d7ceda6View on GitHub →
9:07 PM · Claude
Marketing desk: decisions per campaign, paid-only ROAS, phone layouts, chart audit
- Each campaign gets a verdict (scale / watch / fix the landing piece / fix bag → checkout / fix checkout / too early / no spend data) from one rule shared by the table, the phone cards, the alerts and the monthly report.
- ROAS and cost per sale divide by sales that carry a campaign; a tile for sales from ads sits beside all sales, so an organic order cannot make a campaign look profitable.
- Day-by-day split into traffic + spend and bags/checkouts/sales, each on its own scale; chart animation off so bars always render; readable date ticks.
- Phone: card layouts for campaigns, pieces and the overview's campaign list; no horizontal overflow on any section (checked at 390px and 1280px with mocked data).
- Leads show the Meta campaign name instead of the id.
077659aView on GitHub →
Wednesday, October 28, 2026
9 updates pushed
11:54 PM · ZRosserMcIntosh
Merge pull request #12 from ZRosserMcIntosh/claude/bag-email-capture
- Email me my bag: guest bag reminders, and test traffic kept out of them
78c927bView on GitHub →
11:52 PM · Claude
Bag email test: pass each locale's messages straight to the provider
- Casting pt.json to en.json's type failed the type check (the files differ).
9838009View on GitHub →
11:47 PM · Claude
Bag email capture for guest reminders; keep test traffic out of reminders
- /cart: "Email me my bag" box for guests (en/pt/es). Saving the address records it on the bag with the time asked (consent for one reminder). POST/GET /api/cart/email; rate-limited, disposable addresses refused.
- Reminder job also mails guest bags that asked, with a signed link that reopens the bag on any device (/api/cart/restore) and a signed one-click opt-out (/api/cart/stop-reminders, plus List-Unsubscribe headers). A guest purchase check never filters on a null userId. No signing secret means no guest send (fail closed: a guest would have no way to opt out).
Tuesday, October 27, 2026
4 updates pushed
12:48 PM · Claude
Record the 2026-10-27 retail price adjustment and how to undo it
- 85 production prices raised (82 regular, 3 sale; avg +3.1%, max +8%) to
- endings of 30/40/60/70 at the owner's request. Every change also has an
- AuditLog row; this file lists them and the one-statement undo.
214410eView on GitHub →
12:33 PM · Claude
Conversion fixes on services. and marketing.
- Remove the "Most jewelers start here" badge (no client has started yet); the Growth card now says "Recommended".
- Hero: a finished-piece render beside the copy, the press logos (JCK, The Atlantan, Garden & Gun) under the first button, and what happens next ("a PDF in 2-3 days, then an optional 20-minute call").
- Phone-only sticky "Get my free assessment" bar after the first screen, hidden while the form is on screen.
- Assessment form down to name, email and website; phone behind "Prefer a call?"; business name dropped (found from the website).
- The required free-text challenge question is now four tick-boxes plus an optional box, EN and PT. Ticked labels are sent as the challenge text, so the API contract is unchanged (a test checks one tick passes).
- Public contact (footer, JSON-LD, llms.txt, form errors, confirmation signature) points at rosser@, which is a real inbox; marketing@ stays only as the sending address.
110a3c7View on GitHub →

Page 2 of 40

← Newer Older →

Want to see the source?

github.com/ZRosserMcIntosh/katura

Software Updates

By the numbers

2,265 updates pushed

Monday, November 2, 2026

Stop admin test emails from reaching customers

Update bag-email route tests for the signed-in account mode

Keep the job-queue cron off unless JOB_QUEUE_ENABLED=1

Sync every Meta ad account and report desk spend in USD

Keep bots out of shopper metrics and Meta CAPI (classify only)

Synthetic tests: finish in shards, stay internal, stop production noise

Improve Meta match quality: first-party _fbc, guest em/ph, external_id

Add Apple Pay / Google Pay before the address step; fix /shipping copy

Read Vercel KV Redis env, quiet rate-limit fallback, limit logins

Validate the cart AddToCart eventId, guard checkout storage, drop dead fbEventId

Fail fast and quietly when OpenAI is out of credits

Tag Meta catalog items ready_to_ship / made_to_order

Fetch PDP related products in one query and cache them

Sunday, November 1, 2026

Gift balance at checkout, bag reminder for signed-in shoppers, desk counts that agree (#23)

Privacy wording: disclose ad sharing, US opt-out and GPC; correct the DNT claim (#20)

Saturday, October 31, 2026

Merge pull request #21: marketing desk data fixes

Marketing desk data fixes: one shopper filter, people funnel, merged Meta channel, sync errors shown

Thursday, October 29, 2026

Merge pull request #15: Marketing desk audit — decisions per campaign, paid-only ROAS, phone layouts

Marketing desk: decisions per campaign, paid-only ROAS, phone layouts, chart audit

Wednesday, October 28, 2026

Merge pull request #12 from ZRosserMcIntosh/claude/bag-email-capture

Bag email test: pass each locale's messages straight to the provider

Bag email capture for guest reminders; keep test traffic out of reminders

Tuesday, October 27, 2026

Record the 2026-10-27 retail price adjustment and how to undo it

Conversion fixes on services. and marketing.

Marketing desk: 5 tabs, 5 tiles, new conversion charts, audit fixes (#22)

Merge pull request #13: bag reminders on by default, with a redesigned email

Merge remote-tracking branch 'origin/main' into claude/bag-email-capture-merge

Merge pull request #19: US opt-out consent default with GPC and Do not sell or share; opt-in elsewhere

Merge remote-tracking branch 'origin/main' into claude/bag-email-capture-merge

US opt-out default with GPC and "Do not sell or share"; opt-in elsewhere

Merge pull request #18: bag page checkout button on phones; KAT-19 shopper-only campaign funnel

Merge pull request #17: Meta InitiateCheckout sent on checkout load, Meta responses logged

Click id only stored with Advertising consent; logs keep event ids readable

Bag page: checkout button on the first screen on phones; KAT-19 shopper-only campaign funnel

Merge pull request #16: KAT-10, KAT-14 invoice amounts in the customer's language, consultation email in the page language

KAT-14: label every consultation kind in the confirmation email; escape the name

initiate-checkout route: describe the immediate send

Meta InitiateCheckout: send on checkout load, log Meta's responses

KAT-10, KAT-14: invoice amounts in the customer's language, consultation email in the page language

Merge pull request #14: Marketing desk for Stella

Marketing desk for Stella: campaign results, attribution, Meta spend sync

Bag reminders on by default, with a redesigned email

Merge pull request #11 from ZRosserMcIntosh/claude/gallant-davinci-72ll4k

Merge pull request #7 from ZRosserMcIntosh/claude/sharp-bell-t1kdgc

Merge pull request #9 from ZRosserMcIntosh/claude/loving-dijkstra-d2quh3

Merge pull request #8 from ZRosserMcIntosh/claude/confident-euler-l8jpyv

One availability rule: every piece is purchasable, made to order at 0

Product gallery: square white frame for every photo

Sell every monthly program month to month with 30 days' notice

Move the guide to guide.katura1999.com and rewrite it as a read-aloud script