forgecad 0.9.13 → 0.9.15

package/dist/docs-raw/internals/shape-from-slices.md

@@ -1,152 +0,0 @@
-# Shape.fromSlices — Design Document
-
-## Problem
-
-Users want to define 3D shapes by specifying 2D cross-section profiles on
-different planes (like slicing an object at various positions), then
-interpolating between them to create the solid. Think: "here's what the egg
-looks like from the side, here's what it looks like from the top — build me
-the 3D shape."
-
-Today's `loft()` only handles parallel XY cross-sections at different Z
-heights. There is no way to combine constraints from multiple viewing
-directions (e.g., XY circle + XZ egg-ellipse = egg).
-
-## API
-
-```ts
-Shape.fromSlices(slices: Slice[], options?: FromSlicesOptions): Shape
-```
-
-### Types
-
-```ts
-type SlicePlane = 'xy' | 'xz' | 'yz' | Vec3;
-
-interface Slice {
-  on: SlicePlane;    // plane normal (string shorthand or arbitrary unit vector)
-  at: number;        // signed offset along that normal from the origin
-  profile: Sketch;   // 2D cross-section on that plane
-}
-
-interface FromSlicesOptions {
-  edgeLength?: number;       // mesh resolution (Manifold only)
-  boundsPadding?: number;    // SDF bounding box padding (Manifold only)
-}
-```
-
-### Why `Shape.fromSlices()`?
-
-1. **No new global** — `Shape` already exists in the runtime. Adding a static
-   method adds zero namespace pollution.
-2. **Discoverable** — "I want a Shape, what can I build one from?" leads
-   naturally to `Shape.fromSlices`, `Shape.fromPatch`, etc.
-3. **Precedent** — `Points.distance()`, `sdf.sphere()`, `route.fillet()` all
-   use the namespace-dot-method pattern. This extends it to the core `Shape`
-   class.
-4. **Consistent with broader direction** — new specialized constructors go on
-   `Shape` as static methods instead of polluting the flat global namespace.
-
-## Algorithm
-
-### Core idea: group → interpolate → intersect
-
-1. **Group** slices by normal direction. Two slices with the same (or
-   antiparallel) normal belong to the same group.
-
-2. **Within each group** — build a solid by lofting (ThruSections / level-set)
-   between the profiles, placed on their respective parallel planes.
-   - Single-slice group: extrude the profile along the normal direction,
-     bounded generously (later trimmed by intersection).
-   - Multi-slice group: loft between profiles via ThruSections (OCCT) or
-     level-set (Manifold).
-
-3. **Across groups** — boolean-intersect all group solids. Each group's solid
-   represents a "viewing constraint": the final shape must fit within all of
-   them simultaneously.
-
-### Why intersection?
-
-Each group defines "what the object looks like from one direction." Extruding
-a side-view silhouette gives a prism that contains every possible shape
-matching that silhouette. Intersecting all such prisms carves out the shape
-that satisfies all views simultaneously. This is the *visual hull*
-reconstruction principle.
-
-### Examples
-
-**Egg (two silhouettes):**
-```
-Group 1 (normal=Y, 1 slice): XZ egg-ellipse → extrude along Y → egg prism
-Group 2 (normal=X, 1 slice): YZ egg-ellipse → extrude along X → egg prism
-Intersect → egg solid
-```
-
-**Vase (loft + envelope):**
-```
-Group 1 (normal=Z, 3 slices): circle@0, squircle@40, circle@80 → loft
-Group 2 (normal=Y, 1 slice): vase silhouette → extrude along Y
-Intersect → vase with cross-section transitions
-```
-
-**Pure loft (single group):**
-```
-Group 1 (normal=Z, 3 slices): profiles at different Z heights → loft
-No intersection needed (single group) → equivalent to loft()
-```
-
-## Compile plan
-
-A new `kind: 'fromSlices'` is added to `ShapeCompilePlan`:
-
-```ts
-{
-  kind: 'fromSlices';
-  groups: FromSlicesGroupPlan[];
-  edgeLength: number;
-  boundsPadding: number;
-}
-
-interface FromSlicesGroupPlan {
-  normal: [number, number, number];  // unit normal for this group
-  slices: {
-    offset: number;                   // signed distance along normal
-    profile: ProfileCompilePlan;
-  }[];
-}
-```
-
-### Lowering strategy
-
-**OCCT backend:**
-- Single-slice group → extrude profile, rotate to align with normal, translate
-- Multi-slice group → ThruSections with wires placed on their planes
-  (existing lowerLoftPlan pattern, generalized from Z-only to arbitrary normal)
-- Intersection → `BRepAlgoAPI_Common`
-- Result: exact B-rep, exportable to STEP
-
-**Manifold backend:**
-- Single-slice group → extrude cross-section, transform
-- Multi-slice group → loft via level-set (existing buildLoftLevelSetInput)
-- Intersection → Manifold boolean intersection
-- Result: mesh
-
-### Single-group optimization
-
-When all slices share the same normal (pure loft case), skip the intersection
-entirely and lower as a plain loft. This avoids unnecessary boolean overhead
-and produces identical output to `loft()`.
-
-## Broader API implications
-
-This is the first `Shape` static method. It establishes a pattern for future
-specialized constructors:
-
-| Method | Replaces global | Status |
-|--------|----------------|--------|
-| `Shape.fromSlices()` | (new) | This PR |
-| `Shape.fromPatch()` | `surfacePatch()` | Future |
-
-Existing globals (`loft`, `sweep`, `box`, etc.) remain unchanged — no
-migration, no breakage. New specialized construction goes through
-`Shape.method()`.

package/dist/docs-raw/internals/sketch-2d-pipeline.md

@@ -1,108 +0,0 @@
----
-skill-group: dev-compiler
-skill-order: 2
----
-
-# 2D Sketch Pipeline: Runtime Mesh ↔ ProfileCompilePlan ↔ Export Backend
-
-Captured from implementing sketch region selection, planar arrangement detection, and cross-sketch reference geometry (2026-03).
-
----
-
-## The Two-Track Export Model
-
-Every 3D shape in ForgeCAD has two representations:
-
-1. **Runtime mesh** — a watertight triangulated solid used for preview rendering and mesh-domain operations.
-2. **`ProfileCompilePlan`** — a serializable Forge intent description (discriminated union with `kind: 'rect' | 'circle' | 'polygon' | 'boolean' | ...`) that the current export backend reads to produce STEP geometry.
-
-When exporting STEP, the system walks the `ProfileCompilePlan` tree. If a node has no plan (plan is `null`), it falls back to a faceted mesh-to-STEP conversion — useful for interchange, but it loses parametric intent.
-
-**Key invariant**: any sketch API that only calls `polygon()` and boolean ops (`add`/`subtract`) automatically stays on the maintained STEP path. No special backend-specific code is needed.
-
----
-
-## What `Sketch` Is
-
-`Sketch` wraps a Manifold `CrossSection` (2D polygon set). It also carries:
-- An optional `ProfileCompilePlan` for the STEP path.
-- A `Placement3D` for face-mounted sketches (`.onFace()`).
-
-`ConstrainedSketchBuilder` → `.solve()` → `ConstraintSketch extends Sketch` holds the constraint definition alongside the solved `CrossSection`. The solved `CrossSection` is built from explicitly declared loops (`addLoop`); geometry outside loops is not included in the area — only in the constraint definition for arrangement detection.
-
----
-
-## New 2D Sketch Surface-Selection APIs (2026-03)
-
-### 1. `sketch.regions()` / `sketch.region(seed)`
-
-**File**: `src/forge/sketch/regions.ts`
-
-Decomposes a Manifold `CrossSection` into its distinct filled areas.
-
-- `CrossSection.toPolygons()` returns a flat list of contours. Positive signed area → outer boundary; negative → hole.
-- Holes are nested into their smallest containing outer boundary via `pointInPolygon`.
-- Each outer boundary + its holes is reassembled as a `polygon(outerPts, holePts)` sketch.
-- The `region(seed)` variant picks the one face whose outer boundary contains the seed and no hole does.
-
-**STEP export**: uses `polygon()` and potentially `boolean(difference)` for rings — both are handled by the current export backend without extra sketch-specific code.
-
-### 2. `constraintSketch.detectArrangement()` / `detectArrangementRegion(seed)`
-
-**File**: `src/forge/sketch/arrangement.ts`
-
-DCEL-based planar arrangement detection from the raw line segments in a `ConstraintDefinition`.
-
-Algorithm:
-1. Extract non-construction line segments from `def.lines`.
-2. Split segments at all pairwise intersections — both X-crossings (`segSegT`) and **T-junctions** (`pointOnSegT`). T-junction support is critical: when a divider endpoint touches a boundary edge interior, only `pointOnSegT` detects it.
-3. Snap nearby nodes and build a clean planar graph.
-4. Build DCEL half-edges. At each node sort outgoing half-edges by polar angle.
-5. `next(u→v)` = outgoing from v immediately preceding `twin(u→v)` in CCW order at v — i.e., `out[(pos−1+n) % n]`.
-6. Traverse all face cycles; keep CCW faces (positive signed area). CW = unbounded outer face, excluded.
-7. Return each face as a `polygon(pts)` sketch.
-
-No explicit loops needed from the caller. Works on any set of line constraints.
-
-**STEP export**: each face is a `polygon()` — handled by the maintained export path.
-
-### 3. `builderB.referenceFrom(sketchA, entityId)` / `referenceAllFrom(sketchA)`
-
-**File**: `src/forge/sketch/constraints.ts`
-
-Import solved geometry from another `ConstraintSketch` as fixed construction references.
-
-- Fixed points (`fixed: true`) and construction lines (`construction: true`) participate in constraint solving but contribute zero area to the resulting CrossSection profile.
-- `referenceFrom(source, id)` looks up the entity by id in the source's `ConstraintDefinition` and creates a fixed copy in the current builder.
-- Enables constraints like `parallel(bBot, refBase)` to lock relationships between separate sketches.
-
-**STEP export**: construction elements are ignored by `buildSketchFromDefinition` when assembling loops → no impact on export path.
-
----
-
-## Backend Agnosticism
-
-These APIs are fully backend-agnostic because they operate on:
-- **2D coordinates only** — no 3D kernel calls during region/arrangement detection.
-- **`polygon()`** — the lowest-level sketch primitive, available on every backend.
-- **Boolean ops** — available on every backend (Manifold, OCCT, …).
-
-No backend-specific code was added. Adding a new backend (e.g., CGAL, OpenCASCADE directly) automatically inherits all three APIs as long as it handles `polygon` and `boolean` plan kinds.
-
-The only Manifold-specific call is `CrossSection.toPolygons()` in `regions.ts`. If a future backend doesn't use `CrossSection`, `sketchRegions` would need an adapter — but the algorithm and public API shape would be unchanged.
-
----
-
-## Gotchas
-
-### Empty CrossSection for loop-less sketches
-
-`constrainedSketch().solve()` used to throw "at least one closed loop" when called without `addLoop()`. Users calling `.detectArrangement()` never add loops. Fix: return an empty `CrossSection` via `CrossSection.difference([unit, unit])` (not `new CrossSection([])` — Manifold's `polygons2vec` crashes on empty array).
-
-### T-junctions
-
-Interior-only intersection detection (`segSegT`) misses T-junctions entirely. A 3×2 grid yields only 4 cells instead of 6 if T-junctions aren't split. Always run `pointOnSegT` for every endpoint of every other segment against every segment.
-
-### DCEL `next` pointer direction
-
-The formula traces faces to the **LEFT** of each directed half-edge. CW winding = unbounded outer face. Keep only faces with positive signed area (CCW winding = bounded interior face).

package/dist/docs-raw/platform/admin.md

@@ -1,45 +0,0 @@
-# Admin Dashboard & Audit System
-
-The admin dashboard lives at `/admin` and is restricted to users with `role = 'admin'`. The frontend gate is in `src/pages/AdminPage.tsx`; the backend enforces the same role check on `/api/admin/*` routes.
-
-## Dashboard features
-
-- **System health** -- server status, uptime, version (fetched from `/api/health`).
-- **User statistics** -- total users, total projects, active today.
-- **User list** -- all users with name, email, role, and join date.
-- **Audit log** -- recent activity feed (via `/api/admin/audit`).
-
-## Audit log
-
-Every significant user action is recorded in the `audit_log` table. The schema (`server/db/schema.ts`):
-
-| Column | Type | Description |
-|--------|------|-------------|
-| `id` | uuid | Primary key |
-| `user_id` | uuid | FK to `users` |
-| `project_id` | uuid | FK to `projects` (nullable) |
-| `action` | text | Event type (see below) |
-| `details` | jsonb | Arbitrary metadata |
-| `ip_address` | inet | Client IP |
-| `created_at` | timestamptz | When it happened |
-
-### Tracked actions
-
-| Category | Actions |
-|----------|---------|
-| Auth | `user.register`, `user.login`, `user.password_reset`, `user.token_replay_detected` |
-| Projects | `project.create`, `project.update`, `project.delete` |
-| Files | `file.save`, `file.delete` |
-| Shares | `share.publish`, `share.unpublish` |
-
-Audit inserts are inline in each route handler (`server/routes/auth.ts`, `server/routes/projects.ts`, `server/routes/files.ts`, `server/routes/shares.ts`).
-
-## Granting admin access
-
-There is no self-service role escalation. Set the role directly in the database:
-
-```sql
-UPDATE users SET role = 'admin' WHERE email = 'user@example.com';
-```
-
-See [auth.md](auth.md) for the role system and [../runbook.md](../runbook.md) for production database access.

package/dist/docs-raw/platform/architecture.md

@@ -1,82 +0,0 @@
-# System Architecture
-
-ForgeCAD is a browser-based parametric CAD application. The production stack runs as Docker containers on Hetzner, managed by Kamal 2.
-
-## Stack Overview
-
-```
-Internet
-  |
-Cloudflare
-  |
-kamal-proxy (:80/:443)
-  |
-forgecad web container (Fastify / Node.js)
-  |--- serves SPA (Vite-built React frontend)
-  |--- API routes (/api/*)
-  |--- calls forgecad-backend over Docker network
-  |
-PostgreSQL accessory
-```
-
-**Frontend:** React SPA built with Vite. Three.js (via React Three Fiber) powers the 3D viewport. Monaco Editor provides the code editor. The SPA is served by the same Fastify process that handles API routes.
-
-**Server:** Fastify with Drizzle ORM for database access. Serves both the static SPA bundle and the `/api/*` JSON endpoints from a single process.
-
-**Database:** PostgreSQL for user accounts, project metadata, and application state.
-
-**File storage:** User project files are stored on disk (Docker volume `project-data`), not in the database.
-
-## Deployment Topology
-
-Production uses Kamal deploy configs, not Docker Compose:
-
-| File | Purpose |
-|------|---------|
-| `config/deploy.yml` | Kamal config for the ForgeCAD web app |
-| `config/deploy.backend.yml` | Kamal config for the ForgeCAD backend compute service |
-
-Docker Compose remains useful for local/self-hosted setups, but it is not the production control plane.
-
-## Authentication
-
-JWT-based auth with token rotation:
-
-- **Access tokens:** 15-minute expiry
-- **Refresh tokens:** 7-day expiry, rotated on use
-
-See [auth.md](auth.md) for details on OAuth providers, token flow, and session management.
-
-## URL Routes
-
-| Route | Access | Purpose |
-|-------|--------|---------|
-| `/` | Public | Landing page |
-| `/docs`, `/docs/:slug` | Public | API documentation |
-| `/blog`, `/blog/:slug` | Public | Announcements and tutorials |
-| `/app` | Auth-gated | The CAD editor |
-| `/app?gist=<id>` | Public preview | Shared model from GitHub Gist (read-only until login) |
-| `/app?url=<url>` | Public preview | Shared model from external URL |
-| `/app#code/<file>/<compressed>` | Public preview | Shared model with inline code |
-| `/app?embed=1` | Public | Embed-only viewport (no chrome, for iframes) |
-| `/m/:shareId` | Public | Published model preview (code + 3D viewport) |
-| `/m/:shareId?embed=1` | Public | Published model embed (viewport only) |
-| `/admin` | Admin role | User management, system health, audit log |
-| `/auth/callback/*` | Public | OAuth callback handlers |
-
-## Security
-
-- **Rate limiting:** 100 requests/min per IP; 10 auth attempts per 15 minutes
-- **CORS:** Origin whitelist (no wildcard)
-- **CSP:** Content Security Policy headers on all responses
-- **Path traversal:** Server-side validation on all file access paths
-
-## Related Documentation
-
-- [auth.md](auth.md) -- Authentication and authorization
-- [projects.md](projects.md) -- Project storage and management
-- [sharing.md](sharing.md) -- Model sharing and embeds
-- [admin.md](admin.md) -- Admin panel
-- [email.md](email.md) -- Transactional email
-- [../deployment.md](../deployment.md) -- Environment variables and deployment setup
-- [../runbook.md](../runbook.md) -- Operational procedures and troubleshooting

package/dist/docs-raw/platform/auth.md

@@ -1,139 +0,0 @@
-# Authentication
-
-ForgeCAD uses JWT-based authentication with refresh token rotation. Tokens are delivered via `httpOnly` cookies -- never exposed to client-side JavaScript.
-
----
-
-## Token Architecture
-
-- **Access token**: JWT signed with HMAC (HS256). Default lifetime: 15 minutes.
-- **Refresh token**: Opaque token stored in the database. Default lifetime: 7 days.
-- **Rotation**: Each refresh request issues a new refresh token and invalidates the old one. If a previously-used refresh token is replayed, all sessions for that user are revoked (replay detection).
-
-Both tokens are set as `httpOnly`, `Secure`, `SameSite=Strict` cookies.
-
----
-
-## User Roles
-
-| Role | Access |
-|-------|--------|
-| `user` | Standard account, can use `/app` and all editor features |
-| `admin` | Full access including `/admin` dashboard |
-
-Middleware:
-
-- `requireAuth` -- extracts the user from the JWT access token. Returns 401 if the token is missing or expired.
-- `requireAdmin` -- calls `requireAuth`, then checks `role === 'admin'`. Returns 403 otherwise.
-
----
-
-## Registration and Login
-
-1. **Register** (`POST /api/auth/register`) -- accepts email and password. Creates the account and sends a verification email. See [email delivery](email.md) for delivery configuration.
-2. **Verify email** (`GET /api/auth/verify-email`) -- confirms the address using the token from the email link.
-3. **Login** (`POST /api/auth/login`) -- validates credentials, sets access and refresh token cookies.
-
-Password reset:
-
-1. `POST /api/auth/forgot-password` -- sends a reset email with a single-use token (1-hour expiry).
-2. `POST /api/auth/reset-password` -- applies the new password using the reset token.
-
----
-
-## OAuth
-
-GitHub and Google are supported as optional OAuth providers. They are enabled by setting the corresponding environment variables (see below). When not configured, the provider is omitted from the login UI.
-
-- `GET /api/auth/providers` -- returns the list of configured OAuth providers and their authorization URLs.
-- `POST /api/auth/callback/:provider` -- handles the OAuth redirect, creates or links the account, and sets token cookies.
-
----
-
-## CLI Auth for OAuth Accounts
-
-The web app and CLI use different sign-in mechanics:
-
-- Browser sign-in uses cookies. Email/password login and OAuth login both end with `httpOnly` cookies that the browser sends back to ForgeCAD.
-- CLI sign-in uses bearer tokens. The CLI cannot reuse a browser-only OAuth cookie, and a Google OAuth redirect flow is awkward for a terminal.
-
-That difference is why a Google-only user needs an API token in the CLI: there is no terminal password to submit for a browser-only OAuth account.
-
-The normal CLI path is now one interactive command:
-
-```bash
-forgecad login
-```
-
-Choose **API token** when prompted, then paste a token created from the signed-in web app at **Settings > API Tokens**. The CLI validates the token with `GET /api/auth/session`, stores it in `~/.forgecad/auth.json` as `authType: "token"`, and sends it as `Authorization: Bearer ...` on project, publish, license, and token-management requests.
-
-For CI/CD and one-off automation, skip local storage and set:
-
-```bash
-FORGECAD_TOKEN=fc_pat_... forgecad project push
-```
-
-Passing the token directly as `forgecad login --token fc_pat_...` is accepted for non-interactive setup, but the interactive prompt is preferred so tokens do not land in shell history.
-
-For local development or self-hosted experiments, `forgecad login --server <url>` accepts a clean server origin only. Use HTTPS for remote servers; plain HTTP is accepted only for localhost. License activation remains tied to forgecad.io accounts.
-
----
-
-## API Endpoints
-
-| Method | Route | Purpose |
-|--------|-------|---------|
-| `POST` | `/api/auth/register` | Create account |
-| `POST` | `/api/auth/login` | Login (sets cookies) |
-| `POST` | `/api/auth/refresh` | Rotate refresh token, issue new access token |
-| `POST` | `/api/auth/logout` | Clear session cookies, invalidate refresh token |
-| `GET` | `/api/auth/session` | Return current user info (requires valid access token) |
-| `GET` | `/api/auth/providers` | List available OAuth providers |
-| `POST` | `/api/auth/callback/:provider` | OAuth callback |
-| `POST` | `/api/auth/forgot-password` | Request password reset email |
-| `POST` | `/api/auth/reset-password` | Apply password reset |
-| `GET` | `/api/auth/verify-email` | Confirm email address |
-| `POST` | `/api/auth/resend-verification` | Resend verification email |
-
----
-
-## Rate Limiting
-
-Auth endpoints are rate-limited to **10 requests per 15 minutes per IP**. This applies to login, registration, password reset, and token refresh. Exceeding the limit returns HTTP 429.
-
----
-
-## Environment Variables
-
-| Variable | Required | Default | Purpose |
-|----------|----------|---------|---------|
-| `FORGE_JWT_SECRET` | Yes | -- | HMAC signing key for JWT access tokens |
-| `FORGE_JWT_ACCESS_EXPIRES` | No | `15m` | Access token lifetime (e.g. `15m`, `1h`) |
-| `FORGE_JWT_REFRESH_EXPIRES` | No | `7d` | Refresh token lifetime |
-| `GITHUB_CLIENT_ID` | No | -- | GitHub OAuth application ID |
-| `GITHUB_CLIENT_SECRET` | No | -- | GitHub OAuth secret |
-| `GOOGLE_CLIENT_ID` | No | -- | Google OAuth client ID |
-| `GOOGLE_CLIENT_SECRET` | No | -- | Google OAuth secret |
-| `FORGE_ALLOWED_ORIGINS` | No | `localhost` | Comma-separated list of allowed CORS origins |
-
-See [deployment.md](../deployment.md) for the full environment variable reference.
-
----
-
-## Troubleshooting
-
-**500 on login** -- `FORGE_JWT_SECRET` is not set. The server cannot sign tokens without it.
-
-**401 on authenticated endpoints** -- the access token has expired. The client should call `POST /api/auth/refresh` to obtain a new one. If refresh also returns 401, the session has expired entirely and the user must log in again.
-
-**CORS errors** -- `FORGE_ALLOWED_ORIGINS` does not include the frontend's origin. Add the correct domain (e.g. `https://forgecad.io`).
-
----
-
-## Source Files
-
-| File | Purpose |
-|------|---------|
-| `server/routes/auth.ts` | All auth route handlers |
-| `server/middleware/auth.ts` | `requireAuth` and `requireAdmin` middleware |
-| `server/db/schema.ts` | User and refresh token table definitions |

package/dist/docs-raw/platform/email.md

@@ -1,67 +0,0 @@
-# Email Delivery
-
-ForgeCAD uses [Resend](https://resend.com) for transactional email. The free tier covers 3,000 emails/month and 100/day — more than enough for early production.
-
-Emails are sent for:
-- Email address verification (on register + resend)
-- Password reset links
-
-See [auth.md](auth.md) for the authentication flows that trigger these emails.
-
-## Environment Variables
-
-| Variable | Required | Default | Notes |
-|---|---|---|---|
-| `RESEND_API_KEY` | Yes (in prod) | — | From Resend dashboard |
-| `FORGE_EMAIL_FROM` | No | `ForgeCAD <noreply@forgecad.io>` | Must match a verified domain |
-| `FORGE_APP_URL` | No | `http://localhost:5173` | Base URL used in email links |
-
-Without `RESEND_API_KEY`, emails fall back to `console.log` — fine for local dev.
-
-See [../deployment.md](../deployment.md) for the full environment variable reference.
-
-## First-Time Setup
-
-### 1. Create a Resend account
-
-Sign up at [resend.com](https://resend.com). No credit card required for the free tier.
-
-### 2. Verify your sending domain
-
-In the Resend dashboard: **Domains** > **Add Domain** > enter `forgecad.io`.
-
-Resend will show you DNS records to add (typically a few TXT/MX entries). If your DNS is on **Cloudflare**, Resend can auto-configure the records — just connect your Cloudflare account in the Resend dashboard. It takes a few minutes to propagate.
-
-### 3. Create an API key
-
-In the Resend dashboard: **API Keys** > **Create API Key**.
-
-Use **Send access only** — no need for full access on the server.
-
-### 4. Set env vars
-
-In production secrets (`.kamal/secrets`) or your local `.env`:
-
-```
-RESEND_API_KEY=re_...
-FORGE_EMAIL_FROM=ForgeCAD <noreply@forgecad.io>
-FORGE_APP_URL=https://forgecad.io
-```
-
-## Local Development
-
-Leave `RESEND_API_KEY` unset. The `send()` function detects the missing key and logs the email content and token to the console instead of sending. Token links are printed so you can copy them directly into the browser.
-
-## Code Layout
-
-| File | Purpose |
-|---|---|
-| `server/email/send.ts` | Resend client + `sendVerificationEmail` / `sendPasswordResetEmail` helpers |
-| `server/env.ts` | `resendApiKey`, `emailFrom`, `appUrl` env vars |
-| `server/routes/auth.ts` | Calls into `send.ts` from register, forgot-password, resend-verification routes |
-
-## Adding a New Email Type
-
-1. Add a new `send*Email(to, ...)` export in `server/email/send.ts`
-2. Call it from the relevant route in `server/routes/auth.ts` (or wherever)
-3. No new infrastructure needed — same Resend client and `send()` helper

package/dist/docs-raw/platform/google-oauth-setup.md

@@ -1,88 +0,0 @@
-# Google OAuth Setup Guide
-
-Step-by-step guide to configure Google Sign-In for ForgeCAD.
-
-## Prerequisites
-
-- A Google account
-- Access to [Google Cloud Console](https://console.cloud.google.com)
-
-## 1. Create a Google Cloud Project
-
-1. Go to [console.cloud.google.com](https://console.cloud.google.com)
-2. Click the project dropdown at the top left (might say "Select a project")
-3. Click **New Project**
-4. Name it **ForgeCAD**, click **Create**
-5. Make sure it's selected in the project dropdown
-
-## 2. Configure the OAuth Consent Screen
-
-This is what users see when they click "Sign in with Google."
-
-1. In the left sidebar: **APIs & Services → OAuth consent screen**
-2. Click **Get started** (or **Configure consent screen**)
-3. Choose **External** (anyone with a Google account can sign in) → **Create**
-4. Fill in:
-   - **App name**: `ForgeCAD`
-   - **User support email**: your email
-   - **Developer contact email**: your email
-   - Logo is optional (can add later)
-5. Click **Save and Continue**
-6. **Scopes** screen → click **Add or Remove Scopes**
-   - Add these three:
-     - `openid`
-     - `email` (or `.../auth/userinfo.email`)
-     - `profile` (or `.../auth/userinfo.profile`)
-   - Click **Update** → **Save and Continue**
-7. **Test users** → skip for now (only matters while in "Testing" status) → **Save and Continue**
-8. Review and click **Back to Dashboard**
-
-## 3. Create OAuth Credentials
-
-Use the Google Auth Platform / Credentials page for ForgeCAD web sign-in.
-The `gcloud iam oauth-clients` command is for IAM/IAP OAuth application
-resources and is not the right client type for this app's Google Sign-In flow.
-
-1. In the left sidebar: **APIs & Services → Credentials**
-2. Click **+ Create Credentials → OAuth client ID**
-3. **Application type**: Web application
-4. **Name**: `ForgeCAD Web` (just a label for you)
-5. **Authorized JavaScript origins** — add your domain(s):
-   - `https://forgecad.io` (production)
-   - `http://localhost:5173` (local dev)
-6. **Authorized redirect URIs** — must match exactly:
-   - `https://forgecad.io/auth/callback/google`
-   - `http://localhost:5173/auth/callback/google` (local dev)
-7. Click **Create**
-8. Copy the **Client ID** and **Client Secret** from the dialog
-
-## 4. Add Credentials to `.env`
-
-On your server (or local `.env`):
-
-```bash
-GOOGLE_CLIENT_ID=123456789-xxxxxxx.apps.googleusercontent.com
-GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxxx
-```
-
-## 5. Publish the App
-
-While the consent screen is in **Testing** mode, only explicitly added test users can sign in.
-
-1. Go to **OAuth consent screen**
-2. Click **Publish App**
-3. For apps requesting only `email`, `profile`, and `openid` scopes, Google does not require a full verification review — just confirm the prompt.
-
-## 6. Restart and Test
-
-Restart the server so it picks up the new env vars, then click the Google button on the login page.
-
-## Troubleshooting
-
-| Problem | Cause | Fix |
-|---------|-------|-----|
-| `redirect_uri_mismatch` error | Redirect URI in Google Console doesn't exactly match the one your app sends | Check scheme (`http` vs `https`), domain, port, path, and trailing slashes |
-| "Access blocked: This app's request is invalid" | Consent screen not configured or missing scopes | Complete the OAuth consent screen setup (step 2) |
-| "This app isn't verified" warning | App is published but not verified by Google | Normal for `openid`/`email`/`profile` scopes — users can click "Advanced → Go to ForgeCAD" to proceed |
-| Google button doesn't appear on login page | `GOOGLE_CLIENT_ID` env var not set | Add it to `.env` and restart the server |
-| Sign-in works but no email returned | Missing `email` scope | Re-check scopes in consent screen (step 2.6) |