Brand hexagon in amber on the dark graphite, linked as the icon +
apple-touch-icon, plus a theme-color meta.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Suggests existing library tags matching the token being typed (after the
last comma), with click or arrow-key/Enter selection; excludes tags
already entered.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Changing a license policy applies to all models with that license, and
opening Settings reconciles old imports to current rules (store.reconcileModelsToRules)
- Editing a model's license re-resolves its sellability from the rule
- Removed the per-model commercial-use override (set by license now)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- license_rules table (name -> commercial); licenses auto-register on
import with a best-effort seed, overridable in Settings (applies the
choice to every model with that license)
- resolveCommercial() replaces ad-hoc inferCommercial across import/refresh
- GET/PUT /api/licenses; "License types" section in Settings
- Fix CC short codes: BY / BY-SA / BY-ND now classed sellable (MakerWorld
stores e.g. "BY-SA"); NC variants stay non-commercial
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- users + password_resets tables; bcrypt hashing; JWT session in an
httpOnly cookie (auth_secret auto-generated in settings)
- /api gated behind auth (except /api/config and /api/auth/*)
- First-run creates the account (no open registration after that);
login, logout, forgot/reset-password flows
- SMTP settings (host/port/secure/user/pass/from) in Settings menu;
nodemailer sends reset links
- Auth screen (sign in / create account / forgot / reset) gates the SPA;
Sign out button; COOKIE_SECURE=true in compose for HTTPS
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
On a fresh install (no integration settings yet), prompt once for the
Thingiverse/MakerWorld/Printables tokens and FlareSolverr URL, with a
"skip for now" option. /api/config exposes setupComplete (true if any
setting is configured or setup was dismissed); POST /api/setup/complete
records dismissal. DB password stays a deploy-time env var by necessity.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
