# Upgrade notes — aipackaging v1.1.0 (2026-06-10)

## Changes in this zip

1. **Hardcoded DB credentials removed** — `src/lib/db.ts` had a fallback connection string with a live password baked in. Replaced with fail-fast: production refuses to boot without `DATABASE_URL` (same pattern as `AUTH_SECRET` in auth.ts). **Rotate the exposed password** (`aipackaging_app` role on localhost PG) — it shipped in plaintext inside every copy of this repo:
   ```sql
   ALTER USER aipackaging_app WITH PASSWORD '<new-strong-password>';
   ```
   Then update `DATABASE_URL` in `.env.local` and `ecosystem.config.js`, and `pm2 restart`.

2. **`db/schema.sql` created** — the PG schema previously existed only on the live server. Reconstructed (10 tables, 11 indexes) from the legacy SQLite database in PG dialect, idempotent. Verify against live:
   ```powershell
   pg_dump --schema-only -d aipackaging > db/schema.live.sql
   ```
   Diff and reconcile. This closes the disaster-recovery gap: VPS loss no longer means schema loss.

3. **Dead dependency removed** — `better-sqlite3` + `@types/better-sqlite3` survived the PG migration only in comments. Removed. Eliminates the native-gyp build step entirely; `npm install` is faster and no longer needs node headers.

4. **Repo cruft stripped** — `backups/`, `src.bak.*` (3 full src copies), `.work/`, all `*.bak*` files, `tsconfig.tsbuildinfo`, AppleDouble `._*` files, and the legacy SQLite `data/` directory. ~7 MB removed. Originals remain in your `aipackaging-full.zip` upload and on the server.

5. **`package-lock.json` regenerated**, version bumped to 1.1.0, production build verified (Next 14.2.35, all 40+ routes compile).

## Not done — needs a decision

1. **Next 14 → 16 migration.** `npm audit` flags 8 advisories against the entire 14.x line (DoS via image optimizer, request smuggling in rewrites, cache poisoning in middleware redirects, CSP-nonce XSS). No fix lands in 14.x; patches are in 15/16 only. The middleware-redirect and rewrites advisories are relevant to this app's architecture. Migration touches `serverComponentsExternalPackages` (moved out of `experimental`), async `cookies()`/`headers()` APIs, and React 19. Estimate: one focused Cursor session with the route handlers as the main surface. Owner: Hades (build), Jacer (verification gate).

2. **xlsx CVEs.** `xlsx@0.18.5` (used only for report export in `/reports`) carries two unfixed advisories on the npm registry. SheetJS ships patched builds on its own CDN:
   ```powershell
   npm install https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
   ```
   Risk is low today — the library only writes admin-generated exports, never parses untrusted uploads — but patch it on the next deploy.

3. **Currency.** `src/lib/pricing.ts` prices in INR (`formatINR`, ₹ baselines, free shipping above ₹5000). If aipackaging.company serves Nepal customers, this is a pricing-engine decision, not a find-and-replace: NPR baselines, VAT instead of GST fields (`customers.gst` column), shipping threshold. Confirm target market before touching it.

## Deploy

```powershell
# On VPS, from repo root after pulling this version:
npm ci
npm run build
pm2 restart ecosystem.config.js
```
