* fix: accept empty DataForSEO task results
Treat successful tasks with null items as empty payloads so empty ranked keyword responses do not fail billing validation.
* refactor: simplify DataForSEO null result handling
Add .nullable() to the existing structured result schema instead of
loosening the type to unknown[] and re-parsing in parseTaskItems.
* refactor: simplify backlinks zod parsing with structured result schema
Same pattern as the dataforseoSchemas fix: give taskSchema.result a
structured type with .items instead of z.unknown(), removing the
intermediate resultItemsSchema and two-step parsing in parseItems.
* refactor: replace manual type guards with zod schemas
- progress-kv.ts: replace isCrawledUrlEntry type guard with a zod
schema and use jsonCodec(z.array(...)) instead of parsing unknown
then filtering
- helpers.ts: tighten normalizeIntent param from unknown to
string | null | undefined to match actual call sites
- dataforseoBacklinksSupport.ts: allow null result elements to match
API responses where result contains [null]
* refactor: filter null result elements at the source
Filter out null elements from task.result in postBacklinks so
downstream functions receive clean BacklinksTaskResult[] instead
of (BacklinksTaskResult | null)[].
* save
Treat successful DataForSEO keyword responses with null items as empty results so auto mode can fall back cleanly. Simplify the no-results state by removing dead-end actions and top-aligning the empty card.
* fix: use backlinks history for default trends
* simplify backlinks: remove filters, always use history endpoint
Remove the filter UI (status, subdomains, indirect links, exclude internal)
and hardcode defaults across the stack. Replace the conditional
timeseries_summary + timeseries_new_lost_summary fallback with a single
backlinks/history/live call for trend data. This reduces the overview from
5 parallel API calls to 3 and removes all conditional branching.
* improve charts
* fix: refresh backlinks cost docs
* feat: color-code rank badges in backlinks tables
Add colored score badges to rank/authority columns across all backlinks
tables (Backlinks, Referring Domains, Top Pages). Uses the same tier
system as keyword difficulty but reversed (higherIsBetter) so high
authority shows green and low authority shows red.
* style: fix prettier formatting in BacklinksPageTables
* style: fix prettier formatting in subscribe page
* feat: add filtering and sorting to domain overview
Add numeric range filters (traffic, volume, CPC, KD/score, rank) and
text include/exclude filters to the domain overview page. Make CPC and
Score columns sortable. Filters persist across searches and auto-apply
to new results.
* fix: match domain filter panel layout to keyword research pattern
Restructure DomainResultsCard to use border-separated sections instead
of card-body gap layout. Filters button now sits in a toolbar row with
keyword count and search, matching the keyword research page's design.
* fix: make filter text inputs full-width so labels stack above
* fix: prettier formatting
* fix: extract domain filtering logic to fix lint errors
Move filterAndSortKeywords into domainFiltering.ts to bring
controllerInternals under 350 lines. Use explicit key array
in useDomainFilters to avoid unsafe type assertion.
* feat: add optional helpText tooltip to SortableHeader
Reuses HeaderHelpLabel from keywords components to show hover
tooltips on CPC and Score column headers.
* save
* feat: add theme switcher with system/light/dark segmented control
Add a three-way theme toggle (system, light, dark) as a segmented
icon control in the account dropdown menu. Rename placeholder daisyUI
theme names from "todo" to "openseo".
* refactor: always resolve data-theme explicitly, remove duplicated dark CSS
Instead of removing data-theme in "system" mode and relying on
@media (prefers-color-scheme: dark) CSS, always resolve to an
explicit theme name via matchMedia. This eliminates the duplicated
dark-mode CSS overrides.
* Improve verify email page copy and design
Remove redundant green success alert, update title to "Verify your email",
rename button to "Resend email", and change footer link to "Back to sign in".
* Fix verification emails not sending in production
Remove the backgroundTasks/waitUntil handler so better-auth awaits
email sending inline. Previously, errors thrown inside waitUntil
promises were silently dropped by Cloudflare Workers, preventing
emails from sending with no visible error logs.
* fix: use full page reload after email verification
Client-side navigation via TanStack Router during the auth→app
transition can race with Vite HMR, causing "action is not a function"
server function errors.
* feat: add minimal /subscribe onboarding page
New post-auth subscribe page at /subscribe using the same centered
layout as auth pages. Shows plan details and a single Subscribe CTA.
Redirects PAYMENT_REQUIRED users here instead of /billing.
* redesign: rewrite billing page with usage chart and cleaner layout
Delete the sprawling multi-component billing page and replace it with a
single-file implementation. Two cards sit side by side at the top
(subscription summary + buy credits), with a 30-day usage bar chart
below powered by Autumn's useAggregateEvents hook and recharts.
Removed BillingRouteParts.tsx, HostedBillingContent.tsx, and trimmed
HostedBillingContentUtils to only parseTopUpAmount.
* polish: billing page improvements and OpenSEO nav link
- Two-column layout with subscription summary and buy credits side by side
- Usage bar chart using ResizeObserver instead of ResponsiveContainer
- Input validation with inline error message
- Full-page redirect state when navigating to Stripe
- Make OpenSEO logo in navbar link to /
* fix: guard app routes and include top-up usage
* fix: restore billing onboarding guards
Keep unpaid orgs on /subscribe and avoid misleading billing states when Autumn customer lookups fail.
* fix: split billing usage chart for ci checks
Remove card/shadow layout in favor of a clean centered design.
Add tree logo, simplify inputs (placeholder-only, no labels),
use soft buttons, narrow form width, and clean up footer links.
* fix: remove unused AUTUMN_SEO_DATA_USAGE_FEATURE_ID export
This constant became unused after the billing buckets separation
in #57 which replaced it with separate balance/topup feature IDs.
* fix: resolve oxlint errors from billing buckets PR
Add eslint-disable for max-lines in HostedBillingContent.tsx.
Type trackMock properly in dataforseoClient.test.ts to eliminate
unsafe type assertions without needing eslint-disable.
* feat: add Apply button to keyword research filters
Filters no longer live-update on every keystroke. Users can now set
multiple filter fields and click "Apply" to apply them all at once.
* fix: subscribe to form store so filter Apply button is reactive
useStore(filtersForm.store) ensures re-renders on field changes,
fixing the disabled Apply button when filter inputs have values.
* fix: use useStore for reactive live-filtering in keyword filters
Revert the Apply button approach in favor of the original live-filter
behavior. The actual issue was that filtersForm.state.values didn't
trigger re-renders on field changes. Using useStore(filtersForm.store)
properly subscribes to the form store so filters apply as the user types.
* refactor: move DataForSEO response cache from KV to R2 (#46)
* refactor: move lighthouse audits to dataforseo (#43)
* refactor: move lighthouse audits to dataforseo
* chore: remove obsolete audit settings modal
* refactor: rename psi flows to lighthouse
* save
* refactor: simplify audit lighthouse storage flow
* fix: separate lighthouse metrics from actionable audits
* refactor: remove redundant audit project inputs
* feat: redesign lighthouse issues screen with score gauges and table layout
Replace flat score cards with circular SVG gauges, condense metrics into
a compact grid, and switch issue list from cards to an expandable table
with fixed column widths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: harden lighthouse regression coverage
* fix: restore project-scoped audit inputs
* refactor: simplify lighthouse payload handling
* refactor: inline lighthouse server handlers
* refactor: share audit workflow types
* refactor: simplify lighthouse payload flows
* save
* refactor: drop project pagespeed api key
* fix: restore lighthouse issues loading with resilient project context
* fix: restore audit issues back navigation
* refactor: simplify project context and lighthouse error handling
* fix: tolerate DataForSEO lighthouse payload drift
* refactor: route audit lighthouse through dataforseo client
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move DataForSEO response cache from KV to R2
KV TTL-based expiry is imprecise for cache freshness. Switch to R2 with
soft TTL via custom metadata (expiresAt) and a 7-day lifecycle rule for
cleanup. Cache objects live under the `dataforseo-cache/` prefix,
separate from durable audit payloads in `site-audit/`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: use Workers crypto for R2 cache keys
Keep the cache helper aligned with the Cloudflare runtime and avoid pulling Worker bindings into Vitest. Also clarify that R2 lifecycle cleanup is optional but recommended to control storage growth.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move hosted billing to Autumn hooks (#48)
* refactor: move lighthouse audits to dataforseo (#43)
* refactor: move lighthouse audits to dataforseo
* chore: remove obsolete audit settings modal
* refactor: rename psi flows to lighthouse
* save
* refactor: simplify audit lighthouse storage flow
* fix: separate lighthouse metrics from actionable audits
* refactor: remove redundant audit project inputs
* feat: redesign lighthouse issues screen with score gauges and table layout
Replace flat score cards with circular SVG gauges, condense metrics into
a compact grid, and switch issue list from cards to an expandable table
with fixed column widths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: harden lighthouse regression coverage
* fix: restore project-scoped audit inputs
* refactor: simplify lighthouse payload handling
* refactor: inline lighthouse server handlers
* refactor: share audit workflow types
* refactor: simplify lighthouse payload flows
* save
* refactor: drop project pagespeed api key
* fix: restore lighthouse issues loading with resilient project context
* fix: restore audit issues back navigation
* refactor: simplify project context and lighthouse error handling
* fix: tolerate DataForSEO lighthouse payload drift
* refactor: route audit lighthouse through dataforseo client
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move hosted billing to Autumn hooks
* fix: satisfy ci checks for hosted billing
* refactor: simplify hosted Autumn billing integration
Limit Autumn wiring to the billing route and remove billing-specific indirection so the hosted billing flow is easier to reason about. Stop sending organization IDs as fake customer names to keep customer identity data honest.
* fix: satisfy ci line-limit check for hosted billing
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: split SEO credits into monthly included and top-up pools
Replaces the single usage_credits balance with two separate pools:
- usage_credits: monthly grant from base-plan, resets each cycle
- topup_credits: one-off purchases from credit-top-up, never expire
Usage now deducts from monthly credits first, then falls back to
top-ups. The billing UI shows both balances separately with a reset
date on the monthly card. Requires Autumn dashboard changes to create
the topup_credits credit system and update the credit-top-up plan.
* formt
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add share metadata and a real product social card so OpenSEO links render with a stronger preview. Sync the landing site and app shell favicons with the shared Every App icon set.
* refactor: move lighthouse audits to dataforseo (#43)
* refactor: move lighthouse audits to dataforseo
* chore: remove obsolete audit settings modal
* refactor: rename psi flows to lighthouse
* save
* refactor: simplify audit lighthouse storage flow
* fix: separate lighthouse metrics from actionable audits
* refactor: remove redundant audit project inputs
* feat: redesign lighthouse issues screen with score gauges and table layout
Replace flat score cards with circular SVG gauges, condense metrics into
a compact grid, and switch issue list from cards to an expandable table
with fixed column widths.
* test: harden lighthouse regression coverage
* fix: restore project-scoped audit inputs
* refactor: simplify lighthouse payload handling
* refactor: inline lighthouse server handlers
* refactor: share audit workflow types
* refactor: simplify lighthouse payload flows
* save
* refactor: drop project pagespeed api key
* fix: restore lighthouse issues loading with resilient project context
* fix: restore audit issues back navigation
* refactor: simplify project context and lighthouse error handling
* fix: tolerate DataForSEO lighthouse payload drift
* refactor: route audit lighthouse through dataforseo client
---------
* refactor: move DataForSEO response cache from KV to R2
KV TTL-based expiry is imprecise for cache freshness. Switch to R2 with
soft TTL via custom metadata (expiresAt) and a 7-day lifecycle rule for
cleanup. Cache objects live under the `dataforseo-cache/` prefix,
separate from durable audit payloads in `site-audit/`.
* refactor: use Workers crypto for R2 cache keys
Keep the cache helper aligned with the Cloudflare runtime and avoid pulling Worker bindings into Vitest. Also clarify that R2 lifecycle cleanup is optional but recommended to control storage growth.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add email verification and password reset for hosted auth
Add email-based sign-up verification and password reset flows using
Better Auth and Loops transactional emails. New routes for
/verify-email, /reset-password, and /forgot-password. Sign-up now
redirects to verify-email page instead of showing inline state.
* refactor: use TanStack Form standard schema validation for auth forms
Pass Zod schemas directly to `validators.onSubmit` instead of manually
calling safeParse and reducing over issues. TanStack Form v1.25+ with
Zod v4 handles field-level error extraction automatically.
* refactor: use form.isSubmitSuccessful instead of manual state
Replace `submittedEmail` state in forgot-password and `isComplete`
state in reset-password with TanStack Form's built-in
`isSubmitSuccessful` flag, removing the need for useState in both.
* fix: formatting and lint fixes for ci:check
Fix prettier formatting, replace unsafe type assertions with
Reflect.get for Cloudflare env access.
* fix auth copy and verification redirect
* refactor: derive auth route page copy from state
* refactor: rename delegated auth user table
* feat: scaffold hosted better auth setup
* feat: add hosted auth flows
* refactor: scope project access to organizations
* fix: harden hosted auth entry points
* fix: stabilize org backfills and auth state
* refactor: simplify hosted organization setup
* fix: restore hosted auth signup flow
* fix: preserve hosted workspace access
* fix: preserve hosted auth redirects
* Improve hosted auth UX: auto-redirect to sign-up, hide header on auth pages, add form placeholders, and trust portless dev origins
- Auto-redirect unauthenticated users to /sign-up in hosted mode
- Hide top nav on /sign-in and /sign-up for a cleaner auth experience
- Add input placeholders across sign-in and sign-up forms
- Make name field optional on sign-up (falls back to email username)
- Update copy: remove 'hosted' from user-facing text, rename link to 'Create account'
- Trust *.open-seo.localhost:1355 in dev mode to fix Better Auth origin rejection with portless worktrees
* Simplify hosted auth flow and remove standalone PSI
Use TanStack Form for sign-in and sign-up, make hosted unauthenticated handling redirect-focused, and inline auth route errors. Remove the leftover standalone PSI route, services, and table so PSI only exists within site audits.
* Align project auth with Better Auth organizations
* Make server function auth middleware global
* Reduce auth server function boilerplate
* delete migrations
* fix regenerated migration data backfills
* Simplify hosted auth flow and project audit scoping
* Use active project context for audit actions
* Allow hosted session project updates
* Let agent dev server inherit auth mode
* Match hosted header to gateway account menu
* Scope project session updates to active project
* Inline authenticated server function setup
* Polish header project and account controls
* restore auth generate script
* Use explicit project access in server functions
Make project-scoped server functions take projectId input and enforce ownership through shared middleware instead of session-backed current project state. Document the tradeoffs in an ADR so future changes can follow the same boundary.
* fix ci dependency detection for auth tooling
* Harden project auth in server middleware
Authorize projectId automatically in authenticated server middleware and add a requireProject guard for project-scoped handlers. This makes the auth boundary harder to bypass and removes ad hoc non-null assertions from server functions.
* Inline project id input schemas
Remove tiny shared projectId schema helpers where they were adding indirection without reducing real complexity. Keep project-scoped validation explicit at each server function boundary.
* Skip hosted backlinks access checks
* Simplify auth mode helpers
* Avoid rerunning auth server middleware
* Simplify server function scoping ADR
* Fix backlinks project scoping in hosted auth
* Refine auth route foundations
* Simplify ensure user auth resolution
Split auth-mode context resolvers into focused modules so the middleware reads as request orchestration instead of implementation details. Reuse a shared ensured-user context type across server middleware.
* Simplify hosted organization bootstrap
Use Better Auth to own hosted organization creation and membership so hosted auth only needs to resolve a default active organization. Keep delegated-mode compatibility records isolated in a separate helper.
* Clarify hosted auth and backlinks behavior
Document the hosted AUTH_MODE deploy contract and explain why hosted deployments skip manual backlinks verification. This makes the platform-managed behavior explicit in the code paths that differ from self-serve mode.
* Document hosted org creation callback
Explain why auth.ts injects createOrganization into the hosted org helper. This makes the dependency direction explicit and avoids future import cycles while keeping the helper reusable.
* Fix CI check failures
* Fix nav link prop forwarding
* save
* refactor: simplify keyword source selection flow
* fix: improve stacked keyword page layout
* fix: keep SERP tied to searched keyword
Stop silently falling back SERP lookups to related keywords and show a keyword-specific empty message so missing coverage is explicit to users.
* refactor: extract keyword controller and switch SERP to live
Move keyword research orchestration out of the route, call DataForSEO organic live SERP, and harden response normalization with runtime validation for safer typed handling.
* refactor: split keyword research page state into focused hooks
* fix: aggregate auto keyword fallback and reuse cached results
* scope keyword metrics to projectId
* refactor: modularize SEO routes and harden parsing for CI checks
* refactor: adopt zod json codecs at parse boundaries
* refactor: adopt papaparse, tldts, and zod error enums
* refactor: reorganize client and server feature layout
Group keyword UI/controller files and server repositories/services by feature while keeping serverFunctions as the stable API surface. This improves navigation and maintainability without changing runtime behavior.
* refactor: move PSI business logic into service layer
Keep serverFunctions/psi as thin transport handlers by delegating orchestration, export shaping, and source resolution to PsiAuditService. This aligns PSI with the existing service-first backend pattern without changing endpoint behavior.
* refactor: enforce 350/120 size limits across modules
* move self host
* fix: show dynamic range for search trends
Replace the static 'Past 12 months' subtitle with a computed range from the actual plotted trend points so the UI reflects data lag correctly.
* fix: bind audit workflow writes to workflow instance
* chore: make ci checks pass
* add DataForSEO key setup guard and onboarding help
Detect missing DataForSEO credentials at app load so users get a clear setup path before running SEO workflows.
* fix api key setup warning visibility and help docs
Make the setup warning fail-safe when status checks error, switch the top notice to DaisyUI alert styling, and add Cloudflare dashboard secret instructions to the help page.
* fix README formatting for CI
* fix seo api key status fallback behavior
* harden DataForSEO setup status checks and modal UX
Gate API key status behind authenticated middleware and improve the setup modal’s keyboard/accessibility behavior, with a clearer fallback notice when status checks fail.
* refine setup UX and local env docs
Hide the API key setup modal on the setup guide route to avoid a self-blocking flow, and clarify README local configuration for DATAFORSEO_API_KEY format.
* Enforce safe TypeScript assertions and validate runtime payloads
* Fix CI knip config and floating promise lint
* Validate DataForSEO payloads with Zod schemas
Replace weak object guards with endpoint-level schema parsing so invalid API shapes fail fast instead of being silently filtered. Align downstream keyword mapping with the stricter validated payload contracts.
* remove Every App SDK and add auth modes for Cloudflare Access and local_noauth
* align local dev auth defaults and normalize Access team domain
* Apply suggestions from code review
* restore local drizzle D1 URL helper
* save
* fix auth error mapping and document self-hosting setup
* Tweak readme
* improve auth config error UI and remove manifest link
* fix team domain config validation and docs anchor
