Skip to content

dependabot: npm ecosystem must target the pnpm workspace root #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrahamFerga merged 2 commits into from
Jul 11, 2026
Merged

dependabot: npm ecosystem must target the pnpm workspace root #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ccd1f8a
dependabot: point npm at the pnpm workspace root
abrahamFerga Jul 10, 2026
ce1ed79
docs: CONFIGURATION.md catches up — Branding, Commerce, Onboarding
abrahamFerga Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,12 @@ updates:
patterns: ["*"]
update-types: ["minor", "patch"]

# Frontend (@cortex/ui) npm dependencies.
# Frontend pnpm WORKSPACE (@cortex/ui + @cortex/admin-ui). The directory must be the
# workspace ROOT — pnpm-lock.yaml lives there; pointing at a member package makes
# dependabot bump package.json without the lockfile, and every PR dies on
# ERR_PNPM_OUTDATED_LOCKFILE under --frozen-lockfile CI.
- package-ecosystem: "npm"
directory: "/frontend/cortex-ui"
directory: "/frontend"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
Expand Down
25 changes: 25 additions & 0 deletions docs/CONFIGURATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,31 @@ failed start or chat turn.
}
```

### Product identity (Branding)

The shell asks the host who it is at runtime — one prebuilt UI bundle serves every product:

```jsonc
// appsettings.json (not a secret)
"Branding": { "ProductName": "Networthy" } // -> GET /api/platform/branding -> top bar + tab title
```

### Billing (Commerce) — off by default

A deployment that doesn't sell subscriptions has no webhook surface at all. Selling turns on via
the `Commerce` section (secrets via user-secrets/Key Vault, never appsettings): `Enabled`,
`WebhookSecret` (SECRET), `StripeApiKey` (SECRET), `Prices:{product}:{plan}` -> Stripe Price ids,
`CheckoutSuccessUrl`/`CheckoutCancelUrl`, and `Dedicated:{Owner,Repo,Workflow,Token(SECRET)}` for
the dedicated-environment tier. The flow (checkout -> signed webhook -> durable inbox -> one-
transaction tenant provisioning) is platform machinery; a product only declares its
`ProductOffering` in the host. See a worked operator checklist in networthy's `docs/HOSTED.md`.

### First-run setup wizard (Onboarding)

Declared per module in the manifest (`ModuleManifest.Onboarding`): a probe endpoint ("do I have
data yet?"), a permission, and info/form/upload steps. No host configuration — the shell renders
the wizard and offers it via a dismissible banner while the probe returns an empty array.

## Where runtime configuration lives (admin console, per tenant)

Everything below is stored in the database, editable at `/admin` without a deploy, and RBAC-gated:
Expand Down