chore: sync main onto upstream tag v1.6.0

.env.example

@@ -44,6 +44,14 @@ S3_BUCKET=reqcore
 S3_REGION=us-east-1
 S3_FORCE_PATH_STYLE=true
 
+# ─── GDPR retention cleanup ─────────────────────────────────────────────────
+# Master switch for automated, irreversible candidate erasure. Fail-closed:
+# leave unset/false to guarantee NO automatic deletion. Set to true only after
+# you have reviewed your retention policy and want the sweep to run.
+GDPR_CLEANUP_ENABLED=false
+# Optional: authenticates external schedulers calling /api/admin/retention-cleanup.
+CRON_SECRET=
+
 # ─── SEO ─────────────────────────────────────────────────────────────────────
 # Used by @nuxtjs/seo for sitemaps, canonical URLs, and OG tags
 NUXT_PUBLIC_SITE_URL=http://localhost:3000
@@ -78,6 +86,19 @@ NUXT_PUBLIC_SITE_URL=http://localhost:3000
 # evaluates feature flags locally (no per-request HTTP round trip).
 # POSTHOG_FEATURE_FLAGS_KEY=phx_...
 
+# ─── Optional: Platform AI gateway (OpenRouter) ─────────────────────────────
+# When set, organizations that haven't added their own AI key fall back to this
+# platform key, routed through OpenRouter for unified billing + analytics.
+# Platform-paid runs are subject to the budget gate (server/utils/ai/budget.ts);
+# bring-your-own-key (BYOK) orgs are never affected. Leave unset to stay BYOK-only.
+# Get a key at https://openrouter.ai/keys
+# OPENROUTER_API_KEY=sk-or-...
+# Default model for platform-paid runs (OpenRouter-prefixed). Default: openai/gpt-5.4-mini
+# OPENROUTER_MODEL=openai/gpt-5.4-mini
+# Global platform-wide daily AI spend cap in USD — the runaway-loop kill-switch.
+# Trips loudly long before a bug can empty your account. Default: 25
+# AI_DAILY_SPEND_CAP_USD=25
+
 # ─── Optional: Feature Flag Overrides (no PostHog required) ─────────────────
 # Force any flag on or off without running PostHog. The full list of available
 # flags lives in shared/feature-flags.ts. Variable name pattern:
@@ -124,8 +145,21 @@ NUXT_PUBLIC_SITE_URL=http://localhost:3000
 # SMTP_SECURE=false   # true = implicit TLS (port 465), false = STARTTLS (port 587)
 
 # Option B: Resend (free tier: 3,000 emails/month — resend.com)
+# A send-only key is sufficient for ordinary transactional email.
 # RESEND_API_KEY=re_xxxxxxxxxxxx
 # RESEND_FROM_EMAIL="Reqcore <noreply@yourcompany.com>"
+# Candidate messages use the recruiter's name as the display name while this
+# setting supplies the mailbox and Reply-To routes each private conversation.
+# RESEND_CANDIDATE_FROM_EMAIL="Reqcore Messages <messages@yourcompany.com>"
+# Candidate messaging requires a dedicated receiving subdomain and a signed
+# webhook subscribed to email.received, sent, delivered, delayed, bounced,
+# failed, and complained events at /api/webhooks/resend. Add the Resend-provided
+# MX record to the subdomain; do not use the domain of an existing mailbox.
+# The Receiving API key must have Full access (a send-only key cannot retrieve
+# inbound message bodies).
+# RESEND_RECEIVING_API_KEY=re_xxxxxxxxxxxx
+# RESEND_REPLY_DOMAIN=reply.yourcompany.com
+# RESEND_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx
 
 # ─── Optional: Social Sign-In (Google, GitHub, Microsoft) ────────────────────
 # Enable social login buttons on the sign-in and sign-up pages.
@@ -147,3 +181,28 @@ NUXT_PUBLIC_SITE_URL=http://localhost:3000
 # AUTH_MICROSOFT_CLIENT_ID=your-microsoft-client-id
 # AUTH_MICROSOFT_CLIENT_SECRET=your-microsoft-client-secret
 # AUTH_MICROSOFT_TENANT_ID=common
+
+# ─── Optional: Stripe Billing (paid plans) ───────────────────────────────────
+# Enables self-serve subscription checkout for the Solo, Team, and Scale plans.
+# Leave STRIPE_SECRET_KEY unset to disable billing entirely (self-hosters are
+# unaffected). When STRIPE_SECRET_KEY is set, ALL variables below are required.
+#
+# Setup:
+#   1. Create three Products in Stripe with recurring Prices:
+#      "Solo" ($79/mo + $790/yr), "Team" ($239/mo + $2,390/yr),
+#      and "Scale" ($599/mo + $5,990/yr).
+#   2. Enable the Customer Portal: Stripe Dashboard → Settings → Billing → Customer portal.
+#   3. Add a webhook endpoint → https://yourdomain.com/api/auth/stripe/webhook
+#      Events: checkout.session.completed, customer.subscription.created/updated/deleted.
+#      Copy the signing secret into STRIPE_WEBHOOK_SECRET.
+#   4. Local dev: run `stripe listen --forward-to localhost:3000/api/auth/stripe/webhook`
+#      and use the whsec_… it prints.
+#
+# STRIPE_SECRET_KEY=sk_test_xxx
+# STRIPE_WEBHOOK_SECRET=whsec_xxx
+# STRIPE_PRICE_SOLO_MONTHLY=price_xxx
+# STRIPE_PRICE_SOLO_ANNUAL=price_xxx
+# STRIPE_PRICE_TEAM_MONTHLY=price_xxx
+# STRIPE_PRICE_TEAM_ANNUAL=price_xxx
+# STRIPE_PRICE_SCALE_MONTHLY=price_xxx
+# STRIPE_PRICE_SCALE_ANNUAL=price_xxx

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.3.0"
+  ".": "1.6.0"
 }

.vscode/settings.json

@@ -1,3 +1,3 @@
 {
     "snyk.advanced.autoSelectOrganization": false
-}
+}

.zed/settings.json

@@ -0,0 +1,37 @@
+{
+  "file_scan_exclusions": [
+    "**/.git",
+    "**/.svn",
+    "**/.hg",
+    "**/.jj",
+    "**/CVS",
+    "**/.DS_Store",
+    "**/Thumbs.db",
+    "**/.classpath",
+    "**/.settings",
+    "**/node_modules",
+    "**/.nuxt",
+    "**/.output",
+    "**/dist",
+    "**/build",
+    "**/coverage",
+    "**/playwright-report",
+    "**/test-results"
+  ],
+  "lsp": {
+    "vtsls": {
+      "settings": {
+        "typescript": {
+          "tsserver": {
+            "maxTsServerMemory": 2048
+          }
+        },
+        "javascript": {
+          "tsserver": {
+            "maxTsServerMemory": 2048
+          }
+        }
+      }
+    }
+  }
+}

ARCHITECTURE.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Reqcore is a **Nuxt 4** full-stack application following a monolithic architecture with clear separation between client (`app/`) and server (`server/`) code. The system supports both **managed deployment** on Railway and **self-hosted deployment** via Docker Compose.
+Reqcore is a **Nuxt 4** full-stack application following a monolithic architecture with clear separation between client (`app/`) and server (`server/`) code. Reqcore is open-source and self-hostable; Docker Compose is the reference deployment path for running the app with Postgres and S3-compatible object storage.
 
 ## Technology Stack
 
@@ -20,7 +20,7 @@ Reqcore is a **Nuxt 4** full-stack application following a monolithic architectu
 | SEO | `@nuxtjs/seo` (Sitemap, Robots, Schema.org, SEO Utils, Site Config) | Search engine optimization, structured data |
 | Content | `@nuxt/content` v3 | Markdown blog engine with typed collections |
 | Infrastructure | Docker Compose (local dev) | Local Postgres, MinIO, Adminer |
-| Hosting | Railway | Managed platform (auto-build, auto-deploy) |
+| Hosting | Docker Compose / Railway-compatible platforms | Self-hosted or managed deployment |
 | CDN | Cloudflare (Free) | DNS, DDoS protection, edge caching |
 
 ## Directory Structure
@@ -80,6 +80,7 @@ reqcore/
 │   ├── middleware/                # Global server middleware
 │   ├── plugins/
 │   │   ├── migrations.ts         # Auto-apply migrations on startup
+│   │   ├── posthog.ts            # PostHog server-side capture + filtered error hook
 │   │   └── s3-bucket.ts          # Ensure S3 bucket exists + enforce private policy
 │   └── utils/                    # Auto-imported server utilities
 │       ├── auth.ts               # Better Auth instance
@@ -88,14 +89,16 @@ reqcore/
 │       ├── requireAuth.ts        # Auth guard (throws 401/403)
 │       ├── s3.ts                 # S3/MinIO client, upload, delete, bucket policy
 │       ├── slugify.ts            # URL slug generation for public job pages
-│       ├── rateLimit.ts          # IP-based sliding window rate limiter
+│       ├── rateLimit.ts          # IP-based sliding window rate limiter (in-memory, single-instance)
+│       ├── pgDumpEnv.ts          # Allowlist of env vars passed to pg_dump (no secret leak)
 │       └── schemas/              # Shared Zod validation schemas
 │           ├── document.ts       # MIME types, file limits, sanitizeFilename()
 │           ├── job.ts            # Job create/update schemas
 │           ├── candidate.ts      # Candidate schemas
 │           └── application.ts    # Application schemas
 ├── content/                      # Markdown content (@nuxt/content v3)
 │   └── blog/                     # Blog articles (*.md with YAML frontmatter)
+├── ee/                           # Enterprise Edition — separate license (see ee/LICENSE), a Nuxt layer merged in via `extends`
 ├── public/                       # Static assets
 ├── docker-compose.yml            # Postgres + MinIO + Adminer
 ├── drizzle.config.ts             # Drizzle Kit configuration
@@ -163,7 +166,7 @@ Nitro auto-imports everything from `server/utils/`. The core utilities are alway
 | `auth` | Better Auth instance |
 | `env` | Zod-validated environment variables |
 | `generateJobSlug` | URL slug generation for public job pages |
-| `createRateLimiter` | IP-based sliding window rate limiter |
+| `createRateLimiter` | IP-based sliding window rate limiter (in-memory; for multi-instance setups, terminate at the reverse proxy / CDN) |
 | `uploadToS3`, `deleteFromS3` | S3/MinIO file operations |
 
 ### 3. Environment Validation
@@ -262,40 +265,44 @@ Blog articles are Markdown files in `content/blog/` powered by `@nuxt/content` v
 | Environment secrets | Validated at startup, never exposed to client |
 ## Deployment Architecture
 
-Reqcore runs on **Railway** with **Cloudflare** as CDN/DNS:
+Reqcore can run as a Docker Compose stack or on a managed container platform. The app expects PostgreSQL and S3-compatible object storage.
 
 | Component | Role |
 |-----------|------|
-| Cloudflare (Free) | DNS, DDoS protection, SSL edge termination, AI bot blocking |
-| Railway Service | Nuxt SSR app (auto-built from GitHub via Nixpacks) |
-| Railway PostgreSQL | Managed Postgres database with automatic backups |
-| Railway Storage Bucket | S3-compatible object storage for documents |
+| Reverse proxy / CDN | DNS, TLS termination, DDoS protection |
+| Nuxt SSR app | Web UI and Nitro API server |
+| PostgreSQL | Application database |
+| S3-compatible storage | Uploaded resumes and documents |
 
 ### Deploy Workflow
 
 ```bash
-# Push to main branch — Railway auto-builds and deploys
-git push origin main
+./setup.sh
+docker compose -f docker-compose.production.yml up -d
+```
+
+Managed platforms such as Railway can also build from source:
 
-# Build: npm run build (detected from package.json)
-# Start: node .output/server/index.mjs
+```bash
+npm run build
+node .output/server/index.mjs
 ```
 
-### Environment Variables on Railway
+### Environment Variables
 
-Variables are configured in the Railway dashboard or via `railway variables`. Service-to-service references use Railway's template syntax:
+Configure these variables through `.env`, Docker Compose, or your hosting provider's environment-variable UI:
 
 | Variable | Source |
 |----------|--------|
-| `DATABASE_URL` | `${{Postgres.DATABASE_URL}}` |
-| `S3_ENDPOINT` | `${{Bucket.ENDPOINT}}` |
-| `S3_ACCESS_KEY` | `${{Bucket.ACCESS_KEY_ID}}` |
-| `S3_SECRET_KEY` | `${{Bucket.SECRET_ACCESS_KEY}}` |
-| `S3_BUCKET` | `${{Bucket.BUCKET}}` |
-| `S3_REGION` | `${{Bucket.REGION}}` |
-| `S3_FORCE_PATH_STYLE` | `false` |
-| `BETTER_AUTH_SECRET` | Manual (sealed) |
-| `BETTER_AUTH_URL` | Production: `https://reqcore.com` · PR/preview: `https://${{RAILWAY_PUBLIC_DOMAIN}}` |
+| `DATABASE_URL` | PostgreSQL connection string |
+| `S3_ENDPOINT` | S3-compatible API endpoint |
+| `S3_ACCESS_KEY` | S3 access key |
+| `S3_SECRET_KEY` | S3 secret key |
+| `S3_BUCKET` | Bucket name |
+| `S3_REGION` | Bucket region |
+| `S3_FORCE_PATH_STYLE` | `true` for MinIO, `false` for virtual-hosted providers |
+| `BETTER_AUTH_SECRET` | Random secret, at least 32 characters |
+| `BETTER_AUTH_URL` | Public URL of your deployment |
 
 For zero manual PR setup, define `BETTER_AUTH_URL` as `https://${{RAILWAY_PUBLIC_DOMAIN}}` in your Railway preview/PR environment (or shared variables scoped to previews).
 ## Local Development Services