Merge branch 'wt2'

docs/initial-app.md

@@ -2197,23 +2197,23 @@ All Phase 1 tasks can run in parallel.
 
 #### Workstream A: Database & Schema
 
-- [ ] **A1**: Create dbmate migration `001_initial_schema.sql` with all tables, enums, indexes
+- [x] **A1**: Create dbmate migration `001_initial_schema.sql` with all tables, enums, indexes
-- [ ] **A2**: Set up `@publisher-dashboard/db-schema` package with kysely-codegen
+- [x] **A2**: Set up `@publisher-dashboard/db-schema` package with kysely-codegen
-- [ ] **A3**: Set up `@publisher-dashboard/db` package with Kysely client
+- [x] **A3**: Set up `@publisher-dashboard/db` package with Kysely client
 
 #### Workstream B: API Contract
 
-- [ ] **B1**: Create `@publisher-dashboard/api-contract` package structure
+- [x] **B1**: Create `@publisher-dashboard/api-contract` package structure
-- [ ] **B2**: Define Zod schemas for all input/output types (auth, user, org, admin)
+- [x] **B2**: Define Zod schemas for all input/output types (auth, user, org, admin)
-- [ ] **B3**: Define oRPC contract with all procedure signatures
+- [x] **B3**: Define oRPC contract with all procedure signatures
 
 #### Workstream C: Project Infrastructure
 
-- [ ] **C1**: Initialize monorepo with workspace config (`package.json`, `bun.lockb`)
+- [x] **C1**: Initialize monorepo with workspace config (`package.json`, `bun.lockb`)
-- [ ] **C2**: Set up `apps/api-server` with Bun.serve entry point
+- [x] **C2**: Set up `apps/api-server` with Bun.serve entry point
-- [ ] **C3**: Set up `apps/publisher-dashboard` SvelteKit project with TanStack Query
+- [x] **C3**: Set up `apps/publisher-dashboard` SvelteKit project with TanStack Query
-- [ ] **C4**: Set up `apps/cli` with stricli framework
+- [x] **C4**: Set up `apps/cli` with stricli framework
-- [ ] **C5**: Create `devenv.nix` with scripts and environment variables
+- [x] **C5**: Create `devenv.nix` with scripts and environment variables
 
 ---
 
@@ -2223,25 +2223,25 @@ All Phase 1 tasks can run in parallel.
 
 _Depends on: A3, B3, C2_
 
-- [ ] **D1**: Implement auth middleware (session cookie + API key header)
+- [x] **D1**: Implement auth middleware (session cookie + API key header)
-- [ ] **D2**: Implement `auth.signup` (email + password or passkey)
+- [x] **D2**: Implement `auth.signup` (email + password or passkey)
-- [ ] **D3**: Implement `auth.createLoginRequest` with device/geo capture
+- [x] **D3**: Implement `auth.createLoginRequest` with device/geo capture
-- [ ] **D4**: Implement `auth.loginPassword` (trusted vs untrusted device flow)
+- [x] **D4**: Implement `auth.loginPassword` (trusted vs untrusted device flow)
-- [ ] **D5**: Implement `auth.loginPasswordConfirm` (email link handler)
+- [x] **D5**: Implement `auth.loginPasswordConfirm` (email link handler)
-- [ ] **D6**: Implement `auth.loginIfRequestIsCompleted` (polling + session creation)
+- [x] **D6**: Implement `auth.loginIfRequestIsCompleted` (polling + session creation)
-- [ ] **D7**: Implement `auth.logout`
+- [x] **D7**: Implement `auth.logout`
-- [ ] **D8**: Implement `auth.verifyEmail` and `auth.resendVerificationEmail`
+- [x] **D8**: Implement `auth.verifyEmail` and `auth.resendVerificationEmail`
-- [ ] **D9**: Implement `auth.forgotPassword` and `auth.resetPassword`
+- [x] **D9**: Implement `auth.forgotPassword` and `auth.resetPassword`
 
 #### Workstream E: WebAuthn Procedures (Backend)
 
 _Depends on: A3, B3, C2_
 _Can run parallel to D_
 
-- [ ] **E1**: Implement `auth.webauthn.createRegistrationOptions`
+- [x] **E1**: Implement `auth.webauthn.createRegistrationOptions`
-- [ ] **E2**: Implement `auth.webauthn.verifyRegistration`
+- [x] **E2**: Implement `auth.webauthn.verifyRegistration`
-- [ ] **E3**: Implement `auth.webauthn.createAuthenticationOptions`
+- [x] **E3**: Implement `auth.webauthn.createAuthenticationOptions`
-- [ ] **E4**: Implement `auth.webauthn.verifyAuthentication`
+- [x] **E4**: Implement `auth.webauthn.verifyAuthentication`
 
 #### Workstream F: User Procedures (Backend)
 
@@ -2250,7 +2250,7 @@ _Depends on: D1 (auth middleware)_
 - [ ] **F1**: Implement `me.get` and `me.setupProfile`
 - [ ] **F2**: Implement `me.updateProfile`
 - [ ] **F3**: Implement `me.setPassword`
-- [ ] **F4**: Implement `me.listPasskeys`, `me.createPasskey`, `me.renamePasskey`, `me.deletePasskey`
+- [x] **F4**: Implement `me.listPasskeys`, `me.createPasskey`, `me.renamePasskey`, `me.deletePasskey`
 - [ ] **F5**: Implement `me.listSessions`, `me.revokeSession`, `me.revokeAllSessions`
 - [ ] **F6**: Implement `me.getDeviceInfo`, `me.trustDevice`, `me.listTrustedDevices`, `me.untrustDevice`, `me.revokeAllTrustedDevices`
 - [ ] **F7**: Implement `me.delete` (account deletion)
@@ -2316,11 +2316,11 @@ _Depends on: D1 (auth middleware)_
 _Depends on: D1 (auth middleware), J1_
 _Can run parallel to J2-J6_
 
-- [ ] **K1**: Implement superuser middleware
+- [x] **K1**: Implement superuser middleware
-- [ ] **K2**: Implement `admin.orgs.*` procedures
+- [x] **K2**: Implement `admin.orgs.*` procedures
-- [ ] **K3**: Implement `admin.users.*` procedures
+- [x] **K3**: Implement `admin.users.*` procedures
-- [ ] **K4**: Implement `admin.orgs.addSite`, `admin.orgs.removeSite`
+- [x] **K4**: Implement `admin.orgs.addSite`, `admin.orgs.removeSite`
-- [ ] **K5**: Implement `admin.auth.completeLogin` (dev helper)
+- [x] **K5**: Implement `admin.auth.completeLogin` (dev helper)
 
 #### Workstream L: Org Pages (Frontend)
 
@@ -2349,47 +2349,47 @@ _Can run parallel to L_
 
 _Depends on: C4_
 
-- [ ] **N1**: Set up stricli CLI structure with command routing
+- [x] **N1**: Set up stricli CLI structure with command routing
-- [ ] **N2**: Implement config file handling (`~/.config/reviq/credentials.json`)
+- [x] **N2**: Implement config file handling (`~/.config/reviq/credentials.json`)
-- [ ] **N3**: Implement API client wrapper for CLI (reads token from config)
+- [x] **N3**: Implement API client wrapper for CLI (reads token from config)
 
 #### Workstream N-Bootstrap: CLI Bootstrap (Direct DB)
 
 _Depends on: A3, N1, N2_
 
-- [ ] **N4**: Implement `reviq bootstrap` - create superuser with password
+- [x] **N4**: Implement `reviq bootstrap` - create superuser with password
-- [ ] **N5**: Implement `reviq bootstrap` - create "reviq" org with user as owner
+- [x] **N5**: Implement `reviq bootstrap` - create "reviq" org with user as owner
-- [ ] **N6**: Implement `reviq bootstrap` - generate API token and save to config
+- [x] **N6**: Implement `reviq bootstrap` - generate API token and save to config
 
 #### Workstream N-Auth: CLI Auth Commands
 
 _Depends on: N1, N2, N3, D1-D9_
 
-- [ ] **N7**: Implement `reviq auth login` (open browser, poll for token, save to config)
+- [x] **N7**: Implement `reviq auth login` (open browser, poll for token, save to config)
-- [ ] **N8**: Implement `reviq auth logout` (revoke token, delete from config)
+- [x] **N8**: Implement `reviq auth logout` (revoke token, delete from config)
-- [ ] **N9**: Implement `reviq auth status` (show current user, API URL, config path)
+- [x] **N9**: Implement `reviq auth status` (show current user, API URL, config path)
 
 #### Workstream N-User: CLI User Commands
 
 _Depends on: N3, K3_
 
-- [ ] **N10**: Implement `reviq user create --email --name [--org --role]`
+- [x] **N10**: Implement `reviq user create --email --name [--org --role]`
-- [ ] **N11**: Implement `reviq user confirm-email --email` (dev helper)
+- [x] **N11**: Implement `reviq user confirm-email --email` (dev helper)
 
 #### Workstream N-Admin: CLI Admin Commands
 
 _Depends on: N3, K5_
 
-- [ ] **N12**: Implement `reviq admin complete-login --email` (dev helper)
+- [x] **N12**: Implement `reviq admin complete-login --email` (dev helper)
 
 #### Workstream N-Org: CLI Org Commands
 
 _Depends on: N3, K2, K4_
 
-- [ ] **N13**: Implement `reviq org create --owner --name`
+- [x] **N13**: Implement `reviq org create --owner --name`
-- [ ] **N14**: Implement `reviq org list`
+- [x] **N14**: Implement `reviq org list`
-- [ ] **N15**: Implement `reviq org add-site --org --domain`
+- [x] **N15**: Implement `reviq org add-site --org --domain`
-- [ ] **N16**: Implement `reviq org remove-site --org --domain`
+- [x] **N16**: Implement `reviq org remove-site --org --domain`
 
 #### Workstream N-Completions: CLI Shell Completions