Ci Website
CI-WEBSITEPublic
Website work from the Trady Perch engineering account.
TypeScriptCreated in
Repository statistics
- Stars
- 0
- Forks
- 0
- Watchers
- 0
- Open issues
- 0
- Open PRs
- 0
- Contributors
- 1
- Commits
- 39
- Created
- Last commit
Documentation
Rendered from CI-WEBSITE’s README on the main branch.
Commerce Insight — website
The digital platform for Commerce Insight, an exclusive institute for commerce education in Pratap Nagar, Jaipur. Built by TradyPerch.
Status: audited, deployment-ready, not launched. Phases 0-14 are done: the public site, the admin panel, SEO, security hardening, full QA, the import tooling and the deployment pre-flight. What remains is institute content and the accounts only the owner can create - see docs/DEPLOYMENT-HUMAN-CHECKLIST.md. Start at
docs/README.md.
Start here
| If you want to… | Read |
|---|---|
| Understand the whole project | docs/MASTER-PLAN.html — 25 sections, open it in a browser |
| Know what the client asked for | docs/brief/ — two verbatim source docs |
| Build UI | docs/design/DESIGN-TOKENS.md and tokens.css |
| Find the index | docs/README.md |
Planned stack
Next.js (App Router) · TypeScript · Tailwind CSS · PostgreSQL + Prisma · Vercel
Reviews come from the separate TP Reviews Engine as a published JSON payload, fetched server-side. Videos come from the YouTube Data API, ISR-cached. Neither is copied into this project's database — see Master Plan §13 and §14.
The rule that governs this repository
Nothing reaches the website that the institute has not confirmed in writing.
No invented student marks, toppers, testimonials, reviews, statistics, faculty credentials, or superlative claims. The site this replaces shipped fabricated toppers and testimonials as though they were real; correcting that is a stated goal of the rebuild. Where a fact is missing, the component renders nothing rather than something plausible.
See Master Plan §00 and §42 of the master directive.
Brand
Colours are sampled from the logo, not chosen:
Navy #002D66 | headings, brand bands, the mark itself |
Orange #EA853F | fills, rules, indicators — never text on white (2.65:1, fails AA) |
Orange #BC5915 | the AA-safe orange for text (4.59:1) |
White #FFFFFF | the dominant ground, ~82% of the mark |
Master file: assets/brand/commerce-insight-logo-master.jpg
Local setup
git clone https://github.com/Vanshmodi-dev/CI-WEBSITE.git
cd CI-WEBSITE
npm ci
cp .env.example .env.local # set DATABASE_URL and ENQUIRY_SECRET
npm run db:generate
npm run dev| Script | Does |
|---|---|
npm run dev | Development server |
npm run build | Production build |
npm run typecheck | tsc --noEmit |
npm run lint | ESLint |
npm test | Unit tests (Node's built-in runner) |
npm run verify | typecheck + lint + test + build |
npm run db:migrate | Apply migrations (needs DATABASE_URL) |
npm run create-admin | Create the admin account (needs a database) |
npm run db:test | Start a local PostgreSQL for verification |
npm run verify:constraints | Consent and integrity rules, exercised against real PostgreSQL |
npm run verify:e2e | The whole stack over HTTP, enquiry form to database |
npm run verify:scale | ~1,000 student benchmark |
npm run verify:public | Public-data isolation — what must NEVER reach a visitor |
npm run verify:revalidation | Proves publishing updates the public site |
npm run verify:integration | Admin form → database → public page, including consent withdrawal |
npm run verify:seo | Metadata, canonicals, sitemap, robots and JSON-LD |
npm run verify:import | Spreadsheet import and export, and that import can never publish |
npm run verify:security | Adversarial: auth, authorization, CSRF, XSS, IDOR, rate limits |
npm run verify:ux | Real-browser — responsive, drawer, keyboard, contrast, zoom |
npm run verify:teacher | Drives the admin as a teacher would, laptop and phone |
npm run verify:preflight | Is an environment safe to deploy? Non-zero exit when not |
npm run verify:production | Read-only smoke test against a deployed URL |
npm run retention:dry | Reports what the data-retention policy would remove |
npm run verify:budget | Performance budgets against a production build |
npm run verify:media | The whole photograph lifecycle, attacked |
npm run verify:admin | Every registry field, saved and read back as a visitor |
npm run verify:admin-ux | Every admin route, five widths, including the edit pages |
npm run verify:consent | "Please take my child's photograph down", end to end |
npm run seed:demo | Fill a local database with the ZZSHOW demonstration dataset |
npm run seed:demo:count | What demonstration data is currently there |
npm run seed:demo:clean | Remove it, and nothing else |
Assertion counts deliberately are not listed here. They changed in almost every phase, and a number in a table is the first thing to rot - Phase 14 found four of them stale in this very file. Each suite prints its own total when it runs, which is the number that is actually true.
| npm run perf:baseline | Measures wire bytes and TTFB for every public route | | npm run scale:seed / scale:clean | ~1,000 synthetic ZZTEST records, then removes them | | npm run lighthouse | Lighthouse CI, mobile preset (needs @lhci/cli) |
The site is pre-launch:
robots.tsdisallows all crawling and the root metadata setsnoindex. Both are governed bysrc/config/launch.ts, which requires a reviewed code change and a real https:// domain. The switch is flipped during deployment, not before.
Phases
| Phase | State | |
|---|---|---|
| 0 | Triage · repo · CI | ● done |
| 1 | Content collection | ○ blocked on client — Master Plan §22 |
| 2 | Design system | ● done — awaiting sign-off |
| 3 | Foundation build | ● done — see docs/PHASE-3-REPORT.md |
| 4 | Core pages + enquiry | ● done — see docs/PHASE-4-REPORT.md |
| 5 | Admin panel | ● done — see docs/PHASE-5-REPORT.md |
| 5.5 | Database & E2E verification | ● done — see docs/PHASE-5.5-DATABASE-VERIFICATION.md |
| 6 | Public website | ● done — see docs/PHASE-6-REPORT.md |
| 7 | Admin completion + launch readiness | ● done — see docs/PHASE-7-REPORT.md |
| 8 | Admin ↔ public integration | ● done — see docs/PHASE-8-REPORT.md |
| 9 | SEO + performance | ● done — see docs/PHASE-9-REPORT.md |
| 10 | Security hardening | ● done — see docs/PHASE-10-SECURITY-HARDENING.md |
| 11 | Full QA | ● done — see docs/PHASE-11-REPORT.md |
| 12 | Import / data tooling | ● done — see docs/PHASE-12-REPORT.md |
| 13 | Deployment preparation | ● done — see docs/PHASE-13-REPORT.md |
| 14 | Final adversarial audit | ● done — see docs/PHASE-14-FINAL-AUDIT.md |
| — | Launch | ○ blocked on institute content + manual setup — see PRODUCTION-SETUP.md |
| 6 | Eight-part audit | ○ |
| 7 | Launch + handover | ○ |
Private client project. Not licensed for reuse.
Commit history
All commits- Phase 21: a candidate the owner can actually sit down with
e708cb9Vanshmodi-dev - Phase 20: the two bands the blueprint asked for twice, and nobody could build
91b703cVanshmodi-dev - Phase 19: the fix that was dead code, and the refusal nobody could see
9f9faebVanshmodi-dev - Phase 18: the photo the gallery was showing, and the button that deleted it
e7c8c30Vanshmodi-dev - Phase 17: photographs that survive a deployment
dc9347cVanshmodi-dev - Phase 16: one admin, and a website the institute can actually write
d31510bVanshmodi-dev - Phase 16: an admin a teacher can actually use, proved field by field
903b327Vanshmodi-dev - Phase 16: directions that work, and a map that waits to be asked
006abe9Vanshmodi-dev - Phase 16: videos the institute chooses, and nobody else can point
9e8c369Vanshmodi-dev - Phase 16: a gallery that cannot publish a child by accident
2c4c058Vanshmodi-dev