Combines fixes from PRs #34 and #35 into a clean single branch.
## Profile fetch fix (was PR #34)
- CuratedBox.js: Fetch user profile from /api/profile/:userId before
generating box. Use actual user preferences (colors, styles, budget)
instead of hardcoded placeholders.
## Affiliate env var fix (was PR #35)
- init-db.js, server.js: Read AMAZON_ASSOCIATE_ID from env var, fall
back to 'greybeardhold-20'. Convert all 26 seed product affiliate
links to template strings using the constant.
- .env.example: Add AMAZON_ASSOCIATE_ID configuration example.
## CORS lockdown
- server.js: Restrict CORS to specific origins (localhost:3000,
wardrobe.scoble.me) instead of wildcard '*'.
## Auth TODO
- CuratedBox.js: Add TODO comment to implement authentication and
permission checks for profile access.
## Style validation fix
- server.js: Add stylePreferences validation (handle string/array cases)
with JSON.parse fallback in the /api/box endpoint.
## Minor fix
- server.js: Fix leading space in Pact Women's Cotton Cardigan title.
Standalone HTML landing page with:
- Hero with product value prop (AI-curated boutique clothing)
- 3-step How It Works (profile → curation → feedback loop)
- 4 differentiators vs subscription boxes
- Free early access pricing card
- Waitlist form with localStorage persistence
- Mobile responsive, zero dependencies
- Styled with rose/sage/cream palette
Accessible at: https://os.scoble.me/forgejo/sscoble/wardrobe-ai/src/branch/main/site/index.html
- Hero with value prop and dual CTAs
- 3-step How It Works
- 4-differentiator grid (small biz first, budget control, ML learning, hard lines honored)
- 3-tier pricing (Essential 00, Signature 50, Custom)
- Designer spotlight section (placeholder for real vendors)
- Waitlist form with email + tier preference + localStorage persistence
- Warm, inviting aesthetic (no fashion jargon, plain English)
- Mobile responsive, zero dependencies
Addresses sscoble/wardrobe-ai#17
- Use process.env.AMAZON_ASSOCIATE_ID for all 26 products
- CORS locked to specific origins
- Auth TODO comments added
- Profile fetch with fallbacks
- Approved by @trust, @market, @engineering-2
Replaced hardcoded 'greybeardhold-20' affiliate tags with
template literal in both init-db.js and server.js.
All 26 products now respect the AMAZON_ASSOCIATE_ID environment variable,
with 'greybeardhold-20' as the default fallback.
- Fetch profile in fetchProfile() and use state in generateBox()
- Convert API underscore fields to camelCase for consistency
- Add TODO comment for auth gap in generateBox()
- Change CORS from '*' to specific allowed origins
- Generated ed25519 signing key
- Configured git to use SSH signing
- Added key to Forgejo user settings
- All future commits will be signed
Key fingerprint: SHA256:j8oNRynZpHi9J/88AVzxOq9cRYl1kxiVaWetHtLTZqE
- MEMORY.md seeded (the VHS tape)
- memory/ dir created (daily notes)
- SOUL.md, IDENTITY.md, USER.md, AGENTS.md in place
- Every future MEMORY.md rewrite will be git-committed
