- DOC 01ArchitectureSystem diagram, multi-tenant model, the three user layers, boundaries, and the locked decisions.
- DOC 02FrontendApp Router structure, components, the layered API client, hooks, types, and future tenant-aware areas.
- DOC 03BackendThe Express-style layered API tier: routes, middleware, controllers, services, models, realtime foundation.
- DOC 04DatabaseShared MongoDB model, the six implemented collections, tenantId isolation, indexes, and tracking ID strategy.
- DOC 05APIThe /api/v1 groups, the implemented auth endpoints, envelopes, and the error code registry.
- DOC 06AuthenticationSessions, cookies, Argon2id, enumeration defenses, role and tenant authorization, CSRF/CORS posture.
- DOC 07Tenant ManagementAtomic provisioning, slug rules, lifecycle matrix, list querying, password reset, and admin console.
- DOC 08Package ManagementTracking IDs, the five-status workflows, status/location history, atomic transactions, isolation, and console.
- DOC 09Platform AdminControl-plane permissions, tenant list, detail tabs, password reset, and server-authorized tenant dashboard access.
- DOC 10Website ConfigurationThe WebsiteConfig model, branding, sections, visibility and ordering, URL images, SEO, defaults, preview.
- DOC 11Tenant WebsitesHostname resolution, configuration-driven rendering, branding, sections, SEO, status behavior, local dev.
- DOC 12Public TrackingThe allowlisted tracking endpoint, safe errors, rate limiting, timelines, and integration boundaries.
- DOC 13MapsLeaflet + OSM ecosystem, geocoding abstraction, admin location picker, customer map, licensing duties.
- DOC 14RealtimeOne HTTP server hosting Socket.IO, room authorization, DB-first events, reconnection, lifecycle.
- DOC 15NotificationsV1 realtime-only notifications, connection feedback, and the documented future provider architecture.
- DOC 16Customer SharingTracking link generation, copy flows, WhatsApp share URL, clipboard resilience, and privacy bounds.
- DOC 17DeploymentVPS, PM2, Nginx, Cloudflare, environment values, build flow, Git releases, rollback, onboarding.
- DOC 18SecurityServer-side isolation, authN/Z, session security, validation, headers, safe public payloads, socket authorization.
- DOC 19EnvironmentEvery environment variable, public vs secret, local vs production principles.
- DOC 20Backup & RestoreAtlas backups, mongodump/mongorestore, retention, and the mandatory restore drill.
- DOC 21TroubleshootingWebSocket, host resolution, cookies, database, deploy, SSL — symptom to fix maps.
- DOC 22Production ChecklistPre-flight infrastructure list, the 22-step live smoke test, ops cadence.
- DOC 23TestingLayered suite (unit/integration/e2e), production-safety guard, coverage matrix, release gate.
- DOC 24DevelopmentPrerequisites, setup, quality gates, seeding, manual verification, troubleshooting, workflow.
- DOC 25Implementation RoadmapPhases 1–12 with scope, dependencies, and the standing rules for every phase.
Canonical sources: /docs/*.md in the repository · rendered here for reading.