Changelog

All notable changes to this project are documented here (new features, changes, bug fixes, security changes, database migrations, breaking changes).

[1.5.0] – 2026-08-04 · Partner commission payouts, premium offers

Added

• Grant premium as an offer: in the operator area a grant can now be

marked "customer must accept". Nothing is unlocked right away – the customer sees the offer at the top of their billing area and decides with one click, without any email confirmation. The licence and server premium are only created on acceptance; a decline is kept for the record. The grant list shows "Offered" and "Declined" as their own states.

• Access without a subscription in billing: one-off purchases,

vouchers, giveaway and partner licences as well as grants by the team now appear with tier, origin, server and validity. Previously the page said "No subscriptions yet" even though premium was active.

• Short referral link: cordavix.xyz/r/CODE instead of the technical

API address. Click counting and attribution are unchanged.

• Payout details in the partner area: partners choose between PayPal and

SEPA bank transfer and enter the matching details – PayPal address, or account holder, IBAN and optionally BIC. The IBAN is verified with the standard modulo-97 check, so a transposed digit is caught immediately.

• Request a payout: approved commission from €25 can be requested in a

single payout; the area shows separately what is still under review, what is available for payout and what is tied up in a payout in progress. An overview lists all previous payouts with their status.

• Payouts in the operator area: requests can be filtered and processed

(requested, in progress, paid out, rejected). Payment details appear only on an explicit click, each with a copy button for the transfer. Marking a payout as paid settles the bundled commissions; rejecting it releases them again.

Security

• PayPal address, account holder, IBAN and BIC are stored AES-256-GCM

encrypted. They are never shown to the partner in clear text again, only masked (DE•• •••• •••• 3000).

• Changing payout details requires a fresh sign-in, so a hijacked session

cannot quietly redirect the payout target.

• Every time the operator views payment details an audit entry is written –

the fact is logged, never the data itself.

Database

• Migration 20260804190000_affiliate_payouts: payout method and encrypted

payment details on Affiliate, new table AffiliatePayout, link AffiliateConversion.payoutId.

• Migration 20260804210000_grant_requires_acceptance: offer fields on

LicenseGrant. Existing grants are marked as accepted because they were always effective immediately.

[1.4.0] – 2026-08-04 · External music system, bilingual support, live status

Added

• External music system via Lavalink (spec change 2026-08-03):

Lavalink 4.2.2 with DAVE support as a dedicated service, youtube-source 1.18.2 and LavaSrc 4.8.3 as plugins. /play understands YouTube, YouTube Music and playlist links, Spotify tracks, albums and playlists as well as free-text search terms; Spotify supplies metadata only, through the official API, while Lavalink looks up the audio via the provider chain. One player and one queue per server, control only from the same voice channel, automatic joining and leaving, a playlist cap, duplicate detection with an honest summary of the skipped tracks. New commands /volume, /loop, /shuffle, /remove, /clear, /join, /leave and /music join; every command automatically targets the engine that is currently active, and the existing library and radio playback stays exactly as it was. Music control panel on channel join with nine buttons; only the newest message ever carries the controls. The music module is part of the premium plans (from Premium Basic up). Legal note on YouTube playback: docs/music-lavalink-setup.md.

• Music setup in the operator area: the Lavalink connection and the

Spotify API can be maintained in the admin area; password and client secret are encrypted with AES-256-GCM, can never be displayed again and are reserved for the platform owner. A sync service transfers the Spotify values into the Lavalink container automatically.

• Full bilingual support (German/English): website, dashboard, account

area, operator area and bot in both languages – including forms, dialogs, error messages, chart axes, number, date and currency formats, browser tab titles, the page language declaration and social media previews. Module names and descriptions are held bilingually in the central module list.

• Language detection and switching: an explicit choice (cookie) beats

the browser language (weighted by quality values, including de-AT and de-CH), which beats the country of origin (country header from an upstream service), with English as the default. The DE/EN switch is now also available in the dashboard, the account area and the operator area; the account language setting switches the interface over immediately.

• Status page with real live checks: the platform bot and the worker

report a heartbeat every 30 seconds and the music system is queried directly; new "background worker" and "music system" components. Without a cache connection the status is honestly reported as "degraded" instead of being guessed.

• Emoji style of the server templates now truly takes effect: "none"

removes emojis, "minimal" leaves the template names as they are, and "rich" adds fitting emojis for channels and categories (keyword list in both languages). Preview and application use the same logic.

• Temp voice: channel owners set the bitrate of their channel

themselves via a button; the upper limit follows the boost level of the server.

• Dashboard demo: a faithful replica of the real server area (same

navigation, overview cards and quick access) instead of a layout of its own; actions that are unavailable say so honestly.

• Discord community in the footer: invite link to the official server.

Changed

• Server settings split into two cards, with a live preview in the

Discord look (bot name, embed color, footer, time zone).

• Operator overview condensed from 24 to 12 tiles in three groups; new

server utilization display with the headroom remaining until the next expansion.

• Headers tidied up: avatar and name as a single element, the

subscription recognizable by the color of the name instead of an extra label; "website" link in the dashboard, account and operator areas.

• Plans: an English description per plan can be maintained in the

operator area.

Fixed

• Server templates: recognized channels are now moved into their

target category instead of being left without one (this occurred when switching languages with a clean reinstall); the change comparison shows the move beforehand.

• Music: removed the duplicate control menu after joining a channel.
• Operator area: module lists no longer show hidden modules.
• Legal pages: the heading and the list of planned sections stayed in

German in English mode even though the placeholder notice was already translated.

• Cookie page: table, column headers and explanatory note are now in

English; the language cookie was missing from the overview and is now listed.

• Cookie consent: the selection only read the language after the page

had loaded and showed German text until then - it now arrives correctly from the server, even without JavaScript.

• Home page: the plan overview and the question excerpt always showed

the German texts even though English versions are stored.

• Templates: titles and descriptions of the built-in templates are now

available in English; your own templates remain unchanged.

• Template gallery: only showed the first 20 entries, leaving three

templates unreachable - all 23 are now visible.

• Documentation: all 20 guides are available in English; where a

translation is missing, the German text is shown with a clear notice instead of an empty page.

Database

• MusicExternalConfig (Lavalink and Spotify credentials, secrets

encrypted), SubscriptionPlan.descriptionEn.

Security

• Music system credentials exclusively via environment variables or

encrypted in the database; the Lavalink service is reachable locally only.

[1.3.0] – 2026-08-02 · Phase 10: Cordavix domains, music system, server templates

Added

• Cordavix domain structure (spec. §235-§240): three separate

applications (cordavix.xyz / dashboard.cordavix.xyz / api.cordavix.xyz), versioned API /v1 with a documented transition path /api/v1, Nginx for four hostnames (WebSockets, uploads, Stripe webhooks, rate limits), cookies with domain, SameSite and Secure taken from the configuration, CORS for the website and dashboard only, DNS and TLS documentation with an acceptance checklist. Rebranding to "Cordavix" in all visible texts (the internal code namespace stays).

• Music system (spec. §241-§255): music-core and music-providers

packages with a provider interface and a server-side playback gate — Discord audio only from permitted sources (own uploads with a mandatory rights confirmation, web radio, direct streams with SSRF protection); Spotify and YouTube exclusively as metadata or official players, audio extraction technically ruled out and unlockable by no plan. Bot with one session per server (distributed lock), 24 slash commands plus shorthand commands, a self-updating control panel, vote skip, DJ roles (MUSIC_* matrix), error isolation per server, recovery after a restart (Pro); music API with library, radio, playlists and history; dashboard with 8 pages including a WebSocket live player; premium limits per tier.

• Server templates (spec. §256-§281): 23 bundled standard templates

(254 roles, 455 channels), a visual builder with a Discord-style preview and an expert mode, export and import in a strict versioned format, application in three modes (safe merge as the default; clean reinstall only for owners with re-auth plus name confirmation) through a 14-step pipeline with idempotency, role hierarchy protection, conflict decisions, mandatory backups (allowlist) and rollback with ID migration; a change comparison before every application, live progress over WebSockets; public gallery, ratings only after installation. Never user tokens or selfbots.

Database

• 30 new models: 14 for music (including encrypted OAuth connections) plus

16 for templates (versions, installations with steps, backups, conflicts, marketplace groundwork).

Security

• nodemailer 6→9 (8 advisories fixed, audit back at 0 vulnerabilities).

[1.2.0] – 2026-08-02 · Phase 9: operator dashboard, giveaways, coupons v2, public website

Added

• Operator dashboard `/admin` (spec. §108-§109, §137): 9 operator

roles with a capability matrix (every action checked server-side), metrics from real database data with a period selector and SVG charts, a customer overview with search, filters and customer numbers (C-100001), a customer detail page with all sections, internal notes and blocking/unblocking; organizations; team and role management with lockout protection. Bot tokens, passwords and other secrets are never displayed.

• Manual license granting (spec. §110): 10 grant types, all durations

including permanent and a custom end date, bot and server slots, automatic renewal (worker), optional customer notification, revocation; never Stripe billing, dedicated license sources (ADMIN_GRANT/GIVEAWAY/…), support only with limited goodwill (Basic and Pro, max. 30 days). Full audit trail.

• Platform giveaways (spec. §111-§112): creation with prizes, terms of

participation as a publishing requirement plus a review notice, entry through the website (free of charge, no purchase necessary, with requirement checks), a traceable draw with a stored seed and a selection reference per winner (never a silent re-roll), a multi-account filter, disqualification, substitute winners, an acceptance deadline and automatic license provisioning on acceptance.

• Coupons & discount codes v2 (spec. §113-§116): 4 discount types

(percentage, fixed amount, free period, free service), scopes (products, plans, intervals), usage limits in total and per customer, new versus existing customers, minimum order value, discount cap, country restriction, personal binding (user, email, Discord, organization, bot, server), promotion codes, creator codes with revenue share; 13 server-side checks, the final price calculated exclusively in the backend; redemption only after the payment webhook, configurable release on refund; statistics with CSV export.

• Public website (spec. §117-§134, §139-§140): around 30 pages with a

marketing layout, a high-quality home page (trust section only with real figures), 8 feature pages, prices and comparison exclusively from the database, a clearly labeled dashboard demo, documentation with 19 guides and search, a status page with real checks, a contact form with spam protection, a newsletter with double opt-in, genuine cookie consent (categories without preselection, server-side proof), SEO (sitemap, robots with admin exclusion, metadata per page).

• CMS & legal (spec. §123-§127, §135): pages with sections, version

history and scheduled publishing; navigation, FAQ, testimonials (real voices only), announcements; legal documents in 7 types with immutable published versions, consent capture at registration and clearly marked placeholders without invented company data.

• Contact & support (spec. §129): contact requests and support cases in

the database with an admin inbox, status management and internal notes.

Database

• 27 new models (CustomerProfile, CustomerNote, LicenseGrant,

PlatformGiveaway·Prize·Entry·Winner, PromotionCode, CouponRedemption, CreatorCode·Redemption, WebsitePage·Section·Version, NavigationItem, FaqEntry, Testimonial, PublicAnnouncement, LegalDocument·Version, UserLegalAcceptance, ContactRequest, SupportRequest, NewsletterSubscription, ConsentRecord, StatusIncident, StatusMaintenance, SystemMetric) plus User.adminRole; Coupon extended substantially.

[1.1.0] – 2026-08-01 · Phase 8: BYOB customer bots, account system, purchases

Added

• Bring Your Own Bot (spec. §65-§73): premium customers connect their

own Discord application. A setup wizard with step-by-step instructions and a real connection test (is the token valid? is it a bot application? does the application ID match? are the intents enabled? can commands be registered? is the token already connected elsewhere?). Three operating modes: platform bot, the customer's own bot (from Pro up) and a managed white-label instance.

• Bot instance manager: runs customer bots as logically isolated

discord.js instances (separate error boundaries – one crash stops no other bot), Redis pub/sub control plus a periodic state reconciliation, 11 status values (among them INVALID_TOKEN, MISSING_INTENTS, PAYMENT_REQUIRED), auto restart with backoff, latency monitoring, separate logs per bot and a server-side start approval based on plan, payment and grace period (spec. §98).

• Token security (spec. §68-§71): new @nexora/security package

(AES-256-GCM with its own IV, a separate auth tag and key versioning and rotation), write-only token storage in CustomerBotSecret, never in API responses, logs or exports, hash uniqueness (one token = one account), an email alert on token changes, replacement and removal only with re-auth.

• Account system (spec. §74-§77): registration and sign-in with email

and password (scrypt, policy including a common-password list, lockout), email confirmation, password reset (single-use 60-minute links), TOTP 2FA with backup codes, session and device management, sign-in history, security events, a re-auth sudo mode for sensitive actions, linking and unlinking Discord, profile plus billing address.

• Payments expanded (spec. §78-§89, §104): a PaymentProvider interface

(Stripe as the primary one, further providers pluggable), one-time purchases with products, order numbers and licenses (bot slots, lifetime …), idempotency through claim updates and idempotency keys, cancellation at the end of the period plus revocation, refunds (an admin triggers them, the webhook sets the status, licenses are withdrawn on a full refund), grace periods per plan (graceDays), admin product and purchase management.

• Teams (spec. §90): organizations with 9 roles, invitations by email

or Discord ID (valid for 7 days), a team size limit per plan and server-side role checks.

• Data export & account deletion (spec. §91-§94): export as JSON via an

allowlist (never tokens, passwords or keys, retrievable for 7 days), a deletion request with a confirmation phrase plus re-auth, a configurable revocation period (14 days by default), an account lock during that period, anonymization instead of full deletion for invoice data subject to retention, bots and tokens are removed.

• Emails (spec. §100): 26 templates in German and English (account,

security, bots, payments, deletion); SMTP optional – without a configuration an honest log warning instead of a dummy.

• Dashboard: auth pages (/register, /login with the 2FA second step,

/verify-email, /forgot-password, /reset-password), account area (/account/… with profile, security, sessions, connections plus organizations, billing with cancellation and revocation, purchases, data export, deletion), bot area (/dashboard/bots with wizard, detail tabs, security, logs, danger zone), admin products and purchases.

[1.0.0] – 2026-08-01 · Phase 7: production readiness

Added

• Missing spec commands: /reminder set|list|delete (personal

reminders by DM, worker delivery every 30 seconds, max. 25 open), /poll (native Discord polls, up to 4 answers, 1–168 h, multiple choice), /profile (level, coins, battle pass, join date) and /embed (send a saved template into a channel with autocomplete).

• Setup templates: /setup vorlage:Community|Gaming|Support activates

matching module presets (free modules only, an existing selection is kept).

• Plugin SDK: @nexora/plugin-sdk with a validated plugin manifest

(Zod), a version compatibility check and a plugin loader with error boundaries; example plugin welcome-reward (welcome coins).

• Owner dashboard: plan editor (prices, trial days, all 16 limits – the

single source of the plan values) and a server overview with search.

Security

• @fastify/helmet (security headers) and a 10/min rate limit on

/auth/login; security headers plus poweredByHeader: false in the dashboard.

• Dependency audit: 0 known vulnerabilities – postcss and sharp patched

through a pnpm override, @sentry/node raised to v10; pnpm audit --prod now runs in CI.

• Sentry error monitoring in the bot, API and worker (only with

SENTRY_DSN, tracing disabled).

Tests & Operations

• 37 additional tests (social feed parser with fixtures, automation

matcher, coupon calculation, plugin manifest, ISO weeks) – the feed parser was extracted into pure functions for this.

• Docker Compose: health checks for API and dashboard, the dashboard waits

for a healthy API.

[0.6.0] – 2026-08-01 · Phase 6: statistics, AI, social media, automations, white label, anti-nuke

Added

• Statistics: daily server statistics (messages, joins and leaves,

voice minutes, member count) – the bot counts resource-efficiently in Redis, the worker aggregates into the database every 5 minutes and enforces the plan-dependent retention (7/30/180 days/∞); dashboard page with metrics and SVG charts.

• AI (Premium Pro): /ai ask with an Anthropic connection, a

server-side monthly quota from the premium plan (500/5000/10000) and a usage display in the dashboard. Without ANTHROPIC_API_KEY the bot answers honestly that the feature is not configured.

• Social media (Premium Basic): notifications for YouTube (RSS), Twitch

(Helix, credentials optional), generic RSS feeds and GitHub releases; 5-minute polling in the worker, custom message templates with {title}/{url}/{name}, no spam from old posts during setup. TikTok, Instagram and X are deliberately not offered (no open interfaces).

• Automations (Premium Basic): if-then rules with 6 triggers (join,

leave, level reached, message contains, ticket closed, schedule/cron), conditions (roles, channels) and up to 5 actions (message, DM, add or remove a role); scheduled automations run in the worker with a claim against double execution; visual builder in the dashboard.

• Anti-nuke: the triggers modeled in phase 2 are now enforced – audit

log monitoring per actor (mass bans and kicks, channel and role manipulation, webhooks and bot adds) with configurable thresholds and measures (quarantine = role removal plus timeout, kick, ban), a moderation case plus a team notification; owners and exceptions remain untouched.

• White label (Premium White Label): custom instance branding (name,

avatar, color, footer, links, activity) and an encrypted bot token per customer; a customer instance starts with BRANDING_INSTANCE_KEY=<guildId> and loads branding plus token from the database. The token is never handed out again.

• API: 12 new endpoints; Dashboard: 4 new pages plus an extended

AutoMod page with anti-nuke configuration.

[0.5.0] – 2026-08-01 · Phase 5: Stripe, premium, coupons, affiliate, BP missions

Added

• Stripe integration: checkout (monthly or yearly subscription, prices

from the database as price_data – no Stripe price IDs needed), customer portal (cancellation, payment method), webhook with signature check (checkout.session.completed, subscription.updated/deleted, invoice.paid/payment_failed). Without configured Stripe keys all payment endpoints answer honestly with 503 BILLING_NOT_CONFIGURED.

• Premium activation server-side: subscriptions plus server-scoped

entitlements, automatic tier recalculation per server (the highest active tier wins), an expiry safety net in the worker, manual granting by platform admins (without Stripe) and audit logs for every change.

• Invoices: mirrored from Stripe webhooks (number, amount, status,

hosted URL plus PDF), viewable on the new billing page.

• Coupons: admin management (percentage OR fixed amount, max.

redemptions, validity window), server-side validation, price preview in checkout, automatic Stripe coupon creation and a redemption counter fed by the webhook.

• Affiliate system: join with one click (collision-safe code), referral

links with click counting and 30-day cookie attribution at OAuth signup, commission per paid invoice (configurable rate), self-referral detection (FRAUD) and payout management for admins.

• Battle pass expanded: missions (daily, weekly, seasonal; goals for

messages and voice minutes, XP reward, max. 20 per season, period reset), premium pass purchase with coins (/battlepass buy, retroactive premium rewards), /battlepass view with tier and mission progress, premium pass granting in the dashboard.

• Dashboard: server premium page (plan comparison, coupon validation,

checkout, entitlements), billing (subscriptions plus invoices), affiliate page, admin area (coupons, payouts) and battle pass mission editor.

• API: 20 new endpoints (billing, affiliate, admin, BP missions).

[0.4.0] – 2026-08-01 · Phase 4: levels, economy, battle pass, giveaways, temp voice

Added

• Level system: XP for messages (random amount, Redis anti-spam

cooldown) and voice time (AFK protection: max. 12 h per session), a level curve with tests, level roles (stacking or replacing), level-up messages, /level rank with a progress bar and /level leaderboard, a dashboard leaderboard and manual XP adjustment.

• Economy (Premium Pro): /economy balance|daily|weekly|work|pay|shop|buy|inventory

with a streak system, a configurable currency, a transfer tax, transaction-safe bookings (balance and history entry atomically), a server shop with role and item articles, stock and a per-user maximum, a coin leaderboard and admin corrections.

• Battle pass (Premium Pro): seasons with up to 200 tiers, free and

premium rewards (coins plus roles), XP through messages, automatic tier rewards, only one active season, season editor in the dashboard. (Missions and the premium unlock follow with phase 5.)

• Giveaways: /giveaway create|end|reroll and creation from the

dashboard, an entry button with a live counter, requirements (role, minimum level, account age), multiple winners, an automatic end via the worker (every 30 s) and a reroll that excludes previous winners.

• Temp voice: join-to-create hub, automatic channel creation with owner

permissions, a control panel (name, limit, lock, hide, claim) and automatic deletion of empty channels.

• API: 23 new endpoints; Dashboard: 5 new pages.

[0.3.0] – 2026-08-01 · Phase 3: tickets, applications, verification, embeds, custom commands

Added

• Tickets: panels with a "create ticket" button, automatic channel

creation with permission overwrites, sequential ticket numbers, claiming, closing and deleting by button, /ticket close|claim|add|remove|transcript, message logging, HTML transcripts with an unguessable public URL, auto close on inactivity (worker, deadline configurable per panel), a limit of open tickets per user and a premium limit on the number of panels.

• Applications (Premium Pro): form builder (max. 5 fields because of

the Discord modal limit), /apply with autocomplete and a modal, review posts with accept and reject buttons, decisions possible in the dashboard as well, automatic role assignment, DM notification and a cooldown after a rejection.

• Verification: three types (button, captcha code with a 5-minute TTL,

rules confirmation), a minimum account age, a verified role plus a quarantine role and publishing from the dashboard.

• Embed builder: templates with the full embed feature set (author,

fields, thumbnail, image, footer, timestamp), live preview in the dashboard, duplication, direct sending into a channel and a premium limit.

• Custom commands: custom guild slash commands (active immediately,

without a bot restart) with text, embed or random answers, variables, a Redis cooldown, role and channel restrictions and ephemeral replies; reserved names are protected, premium limit (5/25/∞), Discord sync on enabling, disabling and deleting.

• Dashboard: five new server area pages (tickets, applications,

verification, embeds, commands) with editors and live previews.

• API: 24 new endpoints including the public transcript route.

[0.2.0] – 2026-08-01 · Phase 2: moderation, logging, AutoMod, welcome, roles

Added

• Moderation: /mod warn|timeout|kick|ban|unban|history|cases with

cases (sequential case numbers, transactions, hierarchy check), warning points, a configurable escalation system (3/5/7/10 points → timeout/kick/ban, thresholds editable in the dashboard), mod log embeds, DM notification and tempbans with automatic lifting (worker job, every minute).

• Logging: separate logs for deleted and edited messages, member joins

and leaves, channels, roles and voice activity – categories can be switched off individually.

• AutoMod: 12 actively enforced message and join triggers (spam, flood,

mass mentions, emoji spam, caps, links with a domain allowlist, invites, phishing patterns, word filter, repeated messages, new accounts, join spike), each with configurable actions (delete, warn including escalation, timeout, kick, ban, notify mods, channel lockdown) and exceptions for roles, channels and users. Anti-nuke triggers are prepared in the data model (enforcement follows in phase 6).

• Welcome: welcome, farewell and DM messages with template variables

({user}, {server}, {membercount}, …), embed support, automatic roles and a minimum account age.

• Roles: reaction role panels in three styles (reactions, buttons,

select menu) with exclusive roles, a selection limit and publishing from the dashboard (premium limit checked server-side).

• Dashboard: server sidebar with tabs, module management with premium

and dependency checks, case management with filters and internal notes, AutoMod rule editor, welcome editor with live preview and reaction role manager.

• API: 14 new endpoints (moderation, AutoMod, welcome, reaction roles,

modules) – all with Zod validation, audit logs and cache invalidation.

[0.1.0] – 2026-07-31 · Phase 1: foundation

Added

• Monorepo: pnpm workspaces plus Turborepo, TypeScript strict, ESLint 9

(flat config), Prettier, EditorConfig and a complete VS Code configuration (tasks, debug profiles, recommendations).

• Database: Prisma schema with 48 models for every expansion stage

(users, guilds, premium/Stripe, moderation, tickets, applications, levels, economy, battle pass, giveaways, automations, audit, feature flags …), a seed for subscription plans plus default branding and backup/restore scripts.

• Discord bot: module system with manifests and error boundaries, a

command framework (premium, permission and cooldown checks centralized), i18n (German/English), 9 slash commands (/help, /status, /setup, /settings, /serverinfo, /userinfo, /avatar, /dashboard, /premium), guild synchronization, branding from the database, a sharding entry point and graceful shutdown.

• API: Fastify 5 with Discord OAuth2 (state check), encrypted OAuth

tokens (AES-256-GCM), sessions (SHA-256 hash plus signed HttpOnly cookies), guild endpoints with server-side permission checks, audit logging, Redis rate limiting and health and readiness checks.

• Worker: BullMQ jobs for scheduled messages (including cron repetition

and protection against double processing), automatic premium deactivation and session cleanup.

• Dashboard: Next.js 15 (App Router) with a dark design, landing page,

Discord login, server list with bot status and a server settings form with live validation; shared UI components in packages/ui.

• Operations: Docker Compose (PostgreSQL 17, Redis 7, prod profile with

Nginx), a Dockerfile per app, setup and dev scripts for Windows and Linux and a module generator (pnpm create:module).

• Documentation: README, architecture, installation, database,

permissions, premium matrix, security, API, modules, deployment and troubleshooting.

Database migrations

• init – initial schema (created on the first pnpm db:migrate:dev).