edgarroche.com · Avatar Studios · QC 29 Aug 2026
App Bible + QC engine to launch
This bible is live on both clean URLs:
Local:
C:\Users\Ernesto\OneDrive\Desktop\EdgarRoche-Website\bible.htmlPublic author site for Edgar Roché: books, series, blog, contact, checkout. Cloud Run service edgar-roche on project avatar-studios-ai. Live: https://www.edgarroche.com
0. History — why the bible looked “missing”
Fixed and staying fixed. Two old bugs (i18n FOUC hid pages without
i18n.js; nginx try_files served homepage for /bible). This page has i18n-ready + inline visibility. nginx maps /bible → bible.html (200 on production, re-checked 19 Aug 2026).
1. Identity
Static nginx site (HTML/CSS/vanilla JS + CineImagine design). Audience: readers and fans. Not a multi-tenant SaaS. Membership/podcast/speaking sections exist but stay hidden until real content exists.
2. Login
Live: email + password via Identity Platform (Identity Toolkit REST). No username field. Reset: /forgot-password. Pages: /login · /register · /account.
Authorized domains include edgarroche.com. OAuth/2FA never existed.
3. Error census (QC engine) — re-run 19 Aug 2026
| # | Item | Status | Owner |
|---|---|---|---|
| 1–15 | Honesty QC, nginx headers, honeypot, CSP/HSTS | Still good on live | — |
| 16 | Login email+password | Live Identity Platform | — |
| 17 | /health + /readyz 200. Public /healthz is 404 (Google Frontend intercepts that path — nginx never sees it). Docker HEALTHCHECK and Cloud Run startup probe hit /readyz. | Documented. Do not use /healthz on the custom domain. | — |
| 18 | Stripe test mode. Checkout is POST /api/checkout/session (not Payment Links). | Code ready; 409 until a title is armed + sk_live | Edgar live key |
| 19 | Resend not live (FormSubmit only) | Waitlist/contact use FormSubmit; Resend env detected on /api/status | Edgar |
| 20 | sk_test exposed in chat (not in Git) | Rotate, do not rewrite Git | Edgar |
| 22 | Podcast / membership / speaking not real | Stay hidden + aria-hidden | Later |
| 28 | sessionStorage (no httpOnly cookie) | Known until a BFF session cookie exists | Later |
| 29 | Bible FOUC / /bible SPA fallback | Fixed; /bible 200 | — |
| 31 | iPhone / iPad | Done — 1024 / dvh / touch / scroll | — |
| 32 | Leer in-app | Sample + chapter rail + tools. EPUB when files exist | Edgar files |
| 33 | Printful merch UI | Shop + tabs by book + search + wishlist + bundles. Catalog gated | Edgar token |
| 34 | Dashboard cliente | Tabs: Library / Orders / Wishlist / Addresses. Orders empty until Stripe | Pedidos reales |
| 35 | Dashboard admin | Tabs: Status / Essay. KPIs from /api/status; ventas $0 | Stripe live |
| 36 | book.html nav | Fixed | — |
| 37 | Nav inconsistente (login/legal/account/bible missing Read/Shop) | Fixed 19 Aug — 5 destinos + auth slot desktop/móvil | — |
| 38 | BFF HEAD /api/* returned 501 | Fixed — do_HEAD reuses GET without body | — |
| 39 | Neon Postgres + RLS for signed-in wishlist/progress/addresses | Live schema. App role edgarroche_app (no BYPASSRLS). Guests stay on localStorage. | — |
| 40 | Website fundamentals (splash, WebP, CTA, fonts) | Fase 2 shipped (see docs/audit) | — |
| 41 | Vibe-coding risk audit (authz, resilience, tests) | Fixed in repo 19 Aug — Fase 15. Not on live Cloud Run yet (public /api/status still returns funds) | Deploy |
| 42 | Repo vs live drift | Git has QC+hardening+light series. Live still old image. Visitors cannot see it until deploy.ps1 | Edgar deploy |
| 43 | Shop called admin-only Printful catalog (always 401) | Fixed — public shop = merch.js; live SKUs on Admin → Printful tab | — |
| 44 | Platform pages without footer (shop/read/account/admin/auth) | Fixed — mini legal footer on every HTML page | — |
| 45 | Light mode series titles invisible (ink on dark posters) | Fixed in CSS ?v=20260819d — cream type + paper nav/shadows | Deploy |
| 46 | Stripe test Payment Links leftover in books.js | Removed. Checkout is BFF session only | — |
| 47 | Orders / revenue dashboards empty | Honest empty. Needs Stripe live + persisted events (Fase 13) | API + DB |
| 48 | Reader is sample not EPUB | Working sample + HEAD for epub.js. Not a mock manuscript | Edgar files |
| 49 | Checkout 200 waited on FormSubmit; Stripe.js leftover; Netlify/Vercel files; service.yaml probed /healthz | Fase 17: sendBeacon then redirect; no Stripe.js; leftovers ignored/deleted; probes /readyz + /health | Deploy |
4. Print / POD APIs — exact links (books)
The storefront sells via Stripe Checkout sessions (POST /api/checkout/session). Gelato/Blurb/KDP buttons were stripped on purpose (fake storefront). Physical print requires a server (Secret Manager). Do not put print API keys in config.js.
Decidido: novelas 6×9 = Bookvault (direct) + KDP Amazon (ISBN locked) + IngramSpark más tarde para librerías. Printful/Printify = merch (tees, tote, mug, poster), no el paperback. API keys never in
config.js.Best fit for Edgar’s paperbacks / hardcovers
| Vendor | What it is | Docs (human) | API base / orders |
|---|---|---|---|
| Lulu Print API | Best public API for trade books (PDF in, ship out). OAuth2 / OpenID. |
Product page API docs Developer portal Create API keys Sandbox portal OpenAPI spec |
Live: https://api.lulu.com/Sandbox: https://api.sandbox.lulu.com/Print jobs: POST https://api.lulu.com/print-jobs/
|
| Gelato | Global POD; books + merch. Header X-API-KEY. MEGAPROMPT target. |
API docs (dashboard login) API portal / keys |
Orders: https://order.gelatoapis.com/v4/ordersCatalog/prices: https://product.gelatoapis.comShipping: https://shipment.gelatoapis.comEcommerce: https://ecommerce.gelatoapis.com
|
| Bookvault | UK/EU book POD, API-first, good for direct-to-reader paperbacks. |
API setup Connect your site |
Orders: POST https://api.bookvault.app/v3/OrderAuth: Authorization: basic bv_YOUR_API_KEY
|
| Blurb / RPI Print | Blurb has no standalone public API. Printing is RPI Print (self-service + custom/enterprise). |
Blurb Print API page RPI Print APIs Storefront (not API): https://www.blurb.com |
Onboarding + sandbox via RPI (not a public URL you can curl without a contract). Self-service = US shipping only; Custom API = global. |
Merch POD (not primary for 6×9 books — still real APIs)
| Vendor | Docs | API base |
|---|---|---|
| Printify | https://developers.printify.com/ | https://api.printify.com/v1/ — shops: GET /v1/shops.json — products: /v1/shops/{id}/products.json. Bearer token. No CORS (server only). Catalog is merch, not trade books. |
| Printful |
Overview API v1 docs API v2 beta |
v1: https://api.printful.comv2: https://api.printful.com/v2 (orders: /v2/orders)
|
| Prodigi |
Print API v4 reference |
Live: https://api.prodigi.com/v4.0 — POST /OrdersSandbox: https://api.sandbox.prodigi.com/v4.0Header: X-API-Key
|
| Mixam | https://mixam.com/documentation/api | Public OpenAPI v3 + Swagger UI on that page (short-run / offset-style books & print, not classic Amazon POD). |
Distribution portals — no public print-order API
| Vendor | Link | Reality |
|---|---|---|
| Amazon KDP | https://kdp.amazon.com | Upload PDFs in the portal. No public KDP Print API. Amazon SP-API is for Marketplace sellers, not KDP titles. |
| IngramSpark | https://www.ingramspark.com | Bookstore/library distribution. No public REST print API for indie authors. Lightning Source / Ingram Content is B2B contract. |
What to create (Edgar) — copy/paste
- Bookvault: already in Secret Manager
edgar-roche-bookvault-api-key— add Sabrosa title in the portal (PDFs). - Printful (merch, not novels): https://developers.printful.com/docs/ → private token → Secret Manager
edgar-roche-printful-api-key - Stripe live keys when ready to take money (still test today).
- Resend domain + API key for real mail (FormSubmit is temporary).
- EPUB / audio files per book for the in-app reader.
Until those secrets exist, checkout stays Stripe (ebook / “I’ll fulfill print later”). Do not restore Blurb/Gelato buttons that open generic homepages.
5. QC phases
Phase 1 — Frontpage + headers
Done live: https://www.edgarroche.com/
Phase 2 — Login
Done live: https://www.edgarroche.com/login
Phase 3 — Inner pages
/blog · /book.html?id=humangpt · /privacy
Phase 4 — Checkout
All five books are Coming Soon on the storefront. Stripe is still test-mode.
POST /api/checkout/session returns 409 until a Bookvault title exists. Do not take print money yet.Phase 5 — Mail
Resend domain + API key in Secret Manager. FormSubmit is temporary.
Phase 6 — Hidden products
Podcast / membership / speaking stay hidden.
Phase 7 — Sabrosa first (Bookvault)
API key is in Secret Manager
edgar-roche-bookvault-api-key. Cloud Run /api/status pings Bookvault. Catalog has 0 titles. USD prepay funds are 0.Edgar does in the Bookvault portal (I cannot: no PDFs in the repo, and creating a title bills £19.95):
- Add a card / prepay USD (Financial → PrePayment, RemainingFunds is 0).
- Add title Sabrosa — paperback, dummy ISBN, print partner US (not UK hub).
- Upload interior PDF + cover wrap. Order one proof to the LA/PR address on file.
- Tell me the dummy/real ISBN → env
BOOKVAULT_SABROSA_ISBNto arm checkout for Sabrosa only.
I already did via API: account ping (Master, myBookVAULT, eroche@edgarroche.com), empty library, countries list. I will not POST a Title (charges setup, needs files).
Phase 8 — Device QC + platform (done)
iPhone/iPad: hamburger at 1024px,
100dvh, safe-area, tap 44px. Routes: /read · /shop · /admin · /account. Reader is a working sample (not a fake manuscript). Shop has search, wishlist, bundles (Coming Soon). Account has library samples, continue, wishlist, addresses.Phase 9 — Sabrosa files (Edgar)
PDFs + prepay in Bookvault portal. Then set
BOOKVAULT_SABROSA_ISBN. The storefront reads /api/status and turns Sabrosa’s button on by itself.Phase 10 — Stripe live
Put
STRIPE_SECRET_KEY (sk_live) + STRIPE_WEBHOOK_SECRET in Secret Manager. Armed titles call POST /api/checkout/session and redirect to Stripe. Webhook is mounted at /api/webhooks/stripe.Phase 11 — Full in-app manuscript
Drop
assets/books/{id}-es.epub and {id}-en.epub (and optional MP3). The reader already HEAD-checks that path and loads epub.js. No more UI work.Phase 12 — Printful merch live
Secret Manager
PRINTFUL_API_KEY. Shop already calls GET /api/printful/catalog. Mockups follow from Printful.Phase 13 — Real dashboards
After live money: persist Stripe sessions → orders. Client orders list and admin revenue fill in. Until then they stay $0 on purpose.
Phase 8b — Covers + contact + blog
Jackets
object-fit:contain. Contact FormSubmit — click Activate Form. Blog essays are long-form ES/EN.Phase 14 — Full platform QC (19 Aug 2026)
Re-audited frontpage, inner pages, reader, shop, account, admin, auth, legal, BFF, nginx. Non-API gaps found and patched in repo: unified 5-destination nav + auth slot on mobile, account/admin/shop tabs, reader chapter rail,
HEAD on the Python API, Docker probe /health, legal copy no longer says Payment Links, bible light theme. Live slot still needs a deploy for visitors to see this. API gates unchanged (see §6).Phase 15 — Vibe-coding hardening (19 Aug 2026)
Audit fixes 1–15 shipped (
docs/audit/edgarroche-com/vibe-coding-risk-audit.md): /api/status is redacted for anonymous (catalog only — the BFF verifies Identity ID tokens server-side and only ADMIN_EMAILS see funds/plan/stripe mode); /api/printful/catalog is admin-only (401); checkout origin is allowlisted; Stripe sessions carry an Idempotency-Key; webhook answers 401 on bad signature / 503 without secret with a 300s timestamp window; Bookvault responses cache 45s; nginx rate-limits /api/ (checkout stricter) and /readyz proxies to the BFF; POST bodies cap at 32 KiB; entrypoint.sh supervises the Python API; deploy.ps1 prints the rollback runbook; checkout.js never fakes “order received” on a 5xx; admin.js sends the ID token and the server decides. 18 unit tests in tests/test_print_api.py (stdlib unittest) + qc-validate checks. Fulfillment stays out of the webhook until persisted event.id idempotency exists (fix 16, by design).Phase 16 — Full page QC + frontend close-out (19 Aug 2026 night)
Re-ran every HTML route, header/footer, tabs, buttons, and BFF contract. Census is §7 below. Shipped in this pass (repo): light-mode series type, legal footer on all platform/auth pages, shop no longer hits admin Printful, Admin Printful tab with Bearer token, dead Stripe Payment Links stripped from
books.js. Live still needs a Cloud Run deploy or visitors keep seeing the old image (unredacted /api/status, invisible series titles in light, no new footers).Phase 17 — Stack QC hygiene (20 Aug 2026)
Approved gaps from
docs/audit/edgarroche-com/stack-qc.md, no new platforms. Checkout 200 uses navigator.sendBeacon (keepalive fallback) so FormSubmit cannot stall the Stripe redirect. Stripe.js removed — hosted Checkout session URL only. CSP dropped js.stripe.com / api.stripe.com / buy.stripe.com. netlify.toml / vercel.json deleted and listed in .dockerignore. service.yaml startup /readyz, liveness /health. README describes the real stack (no Three.js runtime). Kafka / Redis / Postgres / K8s still out. Deploy still pending.6. Stack — UI wired; money/print still gated on secrets + files
Cloud Run edgar-roche · nginx + Python /api/ · Identity Platform · Neon Postgres (RLS) · FormSubmit · PWA shell. Signed-in wishlist / progress / addresses sync via /api/me. Guests stay on localStorage. Coming Soon is a live 409 from the BFF, not a fake storefront.
Honesty: “todo activo, nada Coming Soon” is not possible until Edgar pastes files and live keys. Inventing Buy buttons that charge nothing (or email a fake order) is the bug we already killed. The app is finished as a storefront gate. It is not finished as a store until Phase 9–13.
Edgar pega y listo (APIs / files):
- Deploy this branch:
.\deploy\deploy.ps1(repo ≠ live today). - FormSubmit → Activate Form in inbox (contact + waitlist).
- Bookvault: PDFs Sabrosa + prepay + env
BOOKVAULT_SABROSA_ISBN. - Stripe
sk_live+ webhook secret (test key already configured on live). - Printful token
PRINTFUL_API_KEY. - Optional: Resend
RESEND_API_KEY; EPUB/audio intoassets/books/.
Besides APIs — remaining to “finish” the app:
- Deploy (highest leverage; nothing new is visible without it — includes Fase 17 sendBeacon / no Stripe.js).
- Do not un-hide podcast / membership / speaking until there is real audio, a Stripe subscription product, and a talk calendar. Hidden ≠ dead code in the nav.
- Fase 13: persist Stripe
event.id(then orders tab and admin revenue). Until then empty is correct. - Optional later: httpOnly session cookie on the BFF (item 28). sessionStorage is the known static-site limit.
- Neon Postgres: signed-in wishlist, addresses, reading progress, waitlist. Role
edgarroche_apphas no BYPASSRLS. Guests remain on localStorage.
7. Page QC census — 19 Aug 2026 (re-run)
Source: repo HEAD + live HEAD/GET to www.edgarroche.com. Live /health = ok. Live /api/status still returns full ops JSON (hardening not deployed). Inner routes 200. Legend: Live = works for a visitor today · Repo = works in this checkout · Gated = wired, blocked on purpose (409 / Coming Soon / hidden) · Edgar = needs a secret or file, not more UI.
Shared chrome (every public page)
| Piece | State | Notes |
|---|---|---|
| Header desktop | Repo done | Books / Read / Blog / Shop / Contact + auth slot (Log in or Account / Admin). Theme + ES/EN. Homepage keeps extra About / Series / Dev in the hero nav — correct for a landing page. |
| Header mobile | Repo done | data-auth-slot-mob, hamburger ≤1024px, tap 44px, closeMob(). |
| Footer | Repo done (this pass) | Was missing on shop/read/account/admin/login/register/forgot/bible. Now legal mini-footer everywhere. Homepage keeps the full 4-column footer. |
| Theme | Repo done | Dark default. Light = paper/copper. Series posters keep cinema cream type (was ink-on-ink). |
| i18n ES/EN | Live | i18n.js + boot script on every page. Bible is EN ops doc (i18n-ready so it never FOUCs). |
index.html — frontpage
| Block / control | State | Notes |
|---|---|---|
| Hero, headshot, CTAs (Books / Blog / Series) | Live | Real links. No splash. WebP covers. |
| Stats 5 / 3 / 10+ | Live | Copy, not a live counter. |
| About + socials | Live | IMDb / IG / YT / FB / TikTok from config.js. |
| Books flip cards ×5 | Live + gated | Sample → read.html?id=. View → book.html. Coming Soon → checkout modal → BFF 409. Syncs coming_soon from /api/status.catalog. |
| Podcast | Hidden (intentional) | hidden + aria-hidden. Play buttons would toast “not published”. Do not show until audio exists. |
| Series ×3 + pitch modal | Live UI | openModal(anima/segfault/isabela). Light mode titles fixed in repo. Pitch copy is real; there is no streaming player (correct — series are in development). |
| What I do ×4 | Live | Static cards. |
| Speaking | Hidden | Until a real calendar. |
| Developer terminal + app tiles | Live | Tiles open Avatar Studios Cloud Run URLs from config.js. |
| Newsletter + contact | Live FormSubmit | Honeypot. Needs Edgar to click Activate Form once. Resend not configured. |
| Membership | Hidden | Would toast “coming soon”. No Stripe subscription product yet. |
| Checkout modal | Repo wired | POST /api/checkout/session. 409 all titles. 5xx does not fake “order received”. Studio notice is sendBeacon after a 200, then redirect. |
read.html — in-app reader
| Feature | State | Notes |
|---|---|---|
| Sample chapters + TOC rail | Repo done | Jacket/thesis/map/practice. Not a fake book — labeled sample. |
| Font / theme / progress | Repo done | localStorage per book. Continue-reading on Account. |
| TTS + sleep timer + quote PNG | Repo done | Browser voice until MP3 exists. |
| EPUB / audio files | Gated | HEAD assets/books/{id}-en.epub. Drop files → loads. Edgar. |
shop.html
| Feature | State | Notes |
|---|---|---|
| Tabs by book + search + wishlist | Repo done | Tabs All + 5 titles. Wishlist → localStorage. |
| Merch cards + bundles | Gated (honest) | Buy disabled Coming Soon. Bundles not dual fake prices. |
| Printful live catalog | Admin only | Was a dead 401 for visitors after authz. Shop now uses merch.js. Admin tab hits /api/printful/catalog with Bearer. Edgar: token. |
book.html?id=*
| Feature | State | Notes |
|---|---|---|
| Jacket, story, gallery, sample, waitlist, checkout | Live UI + gated pay | Waitlist → FormSubmit. Checkout → BFF. No Gelato/Blurb. |
blog.html / post.html
| Feature | State | Notes |
|---|---|---|
| Filters, 7 themes, long-form ES/EN | Live | Static JS corpus. Admin “essay” downloads JSON; does not auto-publish (correct, no CMS). |
login / register / forgot-password
| Feature | State | Notes |
|---|---|---|
| Email + password Identity Platform | Live | No username. Honeypot. Reset via Identity Toolkit. |
| Session | Live (browser) | ID token in sessionStorage. Not httpOnly (item 28). |
account.html
| Tab | State | Notes |
|---|---|---|
| Library | Live samples | All 5 titles + continue page. Purchased EPUB after Stripe fulfillment (Fase 13). |
| Orders | Honest empty | Copy says 409. Not a mock order list. |
| Wishlist | Live (Neon + device) | Signed-in: /api/me. Guest: localStorage. |
| Addresses | Live (device) | Saved for later Stripe Shipping. Not sent to a server yet. |
admin.html (allowlist emails only)
| Tab | State | Notes |
|---|---|---|
| Status | Repo wired | Bearer → redacted-vs-ops /api/status. Live still serves full JSON to anonymous (deploy). KPIs $0 honest. |
| Printful | Repo this pass | Bearer catalog. 409 until token. |
| Essay | Live tool | Download JSON only. |
Legal + bible
| Page | State | Notes |
|---|---|---|
| privacy / terms / cookies | Live | Checkout sessions (not Payment Links). Theme/lang localStorage disclosed. |
| bible.html · /bible | Live URL, repo content newer | 200 on production. This census is in the repo until deploy. |
BFF contract (frontend ↔ backend)
| Call | Who | State |
|---|---|---|
GET /api/status | books.js (public catalog) · admin.js (ops + token) | Repo: public = catalog only. Live: still full ops blob. |
POST /api/checkout/session | checkout.js | Wired. 409 all books. Origin allowlist + idempotency in repo. |
GET /api/printful/catalog | admin.js only | 401 without admin token. Shop no longer calls it. |
POST /api/webhooks/stripe | Stripe | Repo: 401/503. Live: old 200-ack handler until deploy. |
| Identity Toolkit | auth.js | Live. |
| FormSubmit | contact, newsletter, waitlist, fire-and-forget order notice on 200 checkout | Live endpoint; Activate Form is Edgar. Checkout no longer awaits FormSubmit. |
GET /api/me | commerce.js when signed in | Repo wired. 401 guest. 503 if Neon not on the service. |
POST /api/me/* | wishlist, addresses, progress, waitlist | Repo wired. Waitlist without Neon returns 200 persisted:false (FormSubmit still sends). |
GET /api/admin/waitlist | admin.js | Admin Bearer. Empty until Neon is on Cloud Run. |
8. QC masivo — 29 Aug 2026 (Mouvement + Neon + login)
Re-run local 127.0.0.1:8092 + live www.edgarroche.com. Legend: Hecho = UI+contrato listos en este repo · Live = visitante lo ve hoy (imagen Cloud Run vieja) · Gated = cableado, bloqueado a propósito · Edgar = secret/archivo/deploy, no más UI.
Login: sí está setup. Identity Platform email+password. Páginas login / register / forgot / account. Nav pinta Account + Admin. Esta pasada:
refreshToken + ERAuth.ensureToken() para que /api/me y Admin no mueran a la hora.Honestidad: “todo cobrando, nada Coming Soon” no es posible hasta deploy + Bookvault Sabrosa + Stripe live. Inventar un checkout que cobre $0 es el bug que ya matamos. El frontend está conectado al BFF. El dinero sigue gated.
Por página (29 Aug)
| Página | Header / footer | Features activos | Gated / no mock |
|---|---|---|---|
index.html | Hecho — About/Books/Podcast/Series/Dev/Blog/Shop + theme/lang/login | Hero, about, 5 libros, podcast visible, series 3:4, apps, newsletter, contacto, chatbot local, checkout modal | Buy → 409. Podcast play → toast. Speaking/membership no en nav (correcto) |
book.html | Hecho | Historia, galería, muestra, waitlist, wishlist, checkout | Pay gated. Waitlist → FormSubmit + /api/me/waitlist |
read.html | Hecho | Muestra + progreso. Signed-in → Neon | EPUB cuando existan archivos |
blog.html / post.html | Hecho | Filtros, 7 temas, ES/EN | Sin CMS (ensayo admin = JSON download) |
shop.html | Hecho | Tabs + search + wishlist | Merch Coming Soon. Printful solo Admin |
login / register / forgot | Hecho | Identity Toolkit live | Sesión sessionStorage + refresh |
account.html | Hecho | Tabs Library / Orders / Wishlist / Addresses | Orders vacío honesto. Sync Neon si hay token+DB |
admin.html | Hecho | Status / Printful / Waitlist / Essay | Ops solo admin. Ventas $0 honestas. Waitlist vacía sin Neon live |
Legal + bible.html | Hecho | Privacy/terms/cookies reales | Bible noindex |
9. Quince fases — de aquí al store live (no IA todavía)
Fase 18 corre en este repo. Las demás no se auto-despliegan. No commit/push/deploy desde el agente.
| # | Fase | Estado | Qué falta |
|---|---|---|---|
| 18 | Auth refresh + waitlist sin Neon + Admin waitlist + QC 29 Aug | Hecho en repo | Deploy para que live lo vea |
| 19 | Deploy Cloud Run (deploy.ps1) | Edgar | Visitantes siguen en imagen vieja |
| 20 | Neon en el servicio (DATABASE_URL ya en cloudbuild) | Schema en repo; secret creado | Confirmar migrate + ping Admin → Neon on |
| 21 | FormSubmit Activate Form | Endpoint live | Click en inbox de Edgar |
| 22 | Bookvault Sabrosa (PDF + ISBN env) | Gated | Archivos + BOOKVAULT_SABROSA_ISBN |
| 23 | Stripe sk_live + webhook | Test key en live | Edgar live key |
| 24 | Persistir event.id (orders + admin revenue) | No empezado | Tabla orders + webhook write |
| 25 | Printful merch armado | UI + admin catalog | PRINTFUL_API_KEY |
| 26 | EPUB / audio en assets/books/ | Reader HEAD listo | Archivos de Edgar |
| 27 | Resend (reemplaza FormSubmit) | Env detectado | Key + templates |
| 28 | Cookie httpOnly de sesión en el BFF | Item 28 conocido | Después de Neon estable |
| 29 | Podcast publicado | UI visible, play = toast | Audio + links Spotify/Apple |
| 30 | Membership Stripe | Oculto a propósito | Producto real, no un toast |
| 31 | Speaking calendar | Oculto | Fechas reales |
| 32 | Ingesta de datos + motor IA (megaprompt Fase 2) | Bloqueado — solo tras aprobar §10 | Gemini/Anthropic, no Asana salvo que Edgar lo pida |
10. Megaprompt Fase 1 — auditoría de fuentes (sin implementar)
App: edgarroche.com. Dato central: catálogo de libros + identidad de lector + pedidos print (no guiones CineImagine). Fase 2 no arranca aquí.
10.1 Fuentes que ya fluyen
| Fuente | Formato | Dónde vive | Estructura |
|---|---|---|---|
| Catálogo libros | JS BOOKS + GET /api/status | Repo + BFF + Bookvault /Titles | Alta: ids, coming_soon, print_ready |
| Identity (login) | JWT + refresh | Identity Platform · sessionStorage | email, localId |
| Wishlist / addresses / progress | JSON | localStorage guest · Neon si signed-in | RLS por app.user_id |
| Waitlist | email + book_id | FormSubmit + Neon waitlist_entries | Media |
| Contacto / newsletter | form JSON | FormSubmit (inbox Edgar) | Baja — no hay CRM propio |
| Checkout | Stripe session | Stripe; webhook ack sin persistir | Alta en Stripe, cero en nuestra DB |
| Blog | JSON estático | assets/js/blog-*.js | Alta, compile local |
| Chatbot frontpage | keywords | Solo browser | No se guarda |
| Series pitches | HTML en main.js | Estático | No hay CRM de pitches |
10.2 Vacíos (no conectar sin aprobación)
- Upload de manuscritos / PDFs print — hoy Edgar los sube a Bookvault fuera del sitio.
- Asana u otras tools de ops — no pedidas para este autor-site. No asumir.
- Exports ChatGPT/Claude de marca — no hay pipeline.
- Pedidos persistidos (
event.id) — Fase 24, no IA. - Chatbot no ingiere nada; no hay Gemini en esta app (a propósito).
10.3 Cómo alimentaría un motor de sugerencias (propuesta, no código)
Si Edgar aprueba Fase 2: centralizar en Neon (perfiles, waitlist, orders, contact logs) → dashboard Admin con sugerencias de qué título armar primero, a quién avisar, qué ensayo publicar. Modelo principal Gemini, Anthropic respaldo. Credenciales solo Secret Manager. No se implementa hasta aprobación explícita de este §10.
Además de APIs para “terminar” la app: deploy, Activate FormSubmit, PDFs Sabrosa, no desocultar podcast/membership/speaking sin contenido real, persistir Stripe events, opcional cookie httpOnly. Eso es producto, no un segundo panel de IA.