Merge branch 'main' into staging

Author: karishnu

.github/workflows/ai-pr-review.yml

@@ -38,6 +38,7 @@ jobs:
           CLOUDFLARE_GATEWAY_ID: ${{ secrets.CLOUDFLARE_AI_GATEWAY_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_AI_GATEWAY_TOKEN }}
         with:
+          oidc_base_url: https://ask-bonk.cloudflare-exponent.workers.dev/auth
           model: 'cloudflare-ai-gateway/workers-ai/@cf/zai-org/glm-5.2'
           forks: 'false'
           permissions: write

docs/llm.md

@@ -116,7 +116,7 @@ Use `bun run dev:browser` for local browser-console inspection and `bun run depl
 ### **Running Locally**
 
 **Prerequisites:**
-- Node.js 18+
+- Node.js 22+
 - Cloudflare account (for D1, Durable Objects)
 - API keys: OpenAI, Anthropic, Google AI Studio
 
@@ -4258,7 +4258,7 @@ Audit log for all authentication attempts.
 
 ### **verificationOtps Table**
 
-Email verification codes (currently not actively used as users are auto-verified).
+Email verification codes. The email-OTP verification flow has been removed (users are auto-verified on registration), so nothing reads or writes this table; the table is retained only to avoid a destructive migration.
 
 **Fields:** email, otp (hashed), used, expiresAt (15 min)
 

docs/setup.md

@@ -11,7 +11,7 @@ Current generated-app previews use SpaceDO, a Worker Loader binding, and Dynamic
 Before getting started, make sure you have:
 
 ### Required
-- **Node.js** (v18 or later)
+- **Node.js** (v22 or later)
 - **Cloudflare account** with API access  
 - **Cloudflare API Token** with appropriate permissions
 

package.json

@@ -3,6 +3,9 @@
 	"private": true,
 	"version": "1.5.0",
 	"type": "module",
+	"engines": {
+		"node": ">=22"
+	},
 	"workspaces": [
 		"space"
 	],

scripts/setup.ts

@@ -2119,7 +2119,12 @@ async function main() {
 	await setup.setup();
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Run if this is the main module (supports both direct execution and tsx)
+const isMainModule = import.meta.url.endsWith('setup.ts') ||
+	import.meta.url === `file://${process.argv[1]}` ||
+	process.argv[1]?.endsWith('setup.ts');
+
+if (isMainModule) {
 	main().catch((error) => {
 		console.error('Setup failed:', error);
 		process.exit(1);

src/components/auth/login-modal.tsx

@@ -507,6 +507,7 @@ export function LoginModal({
 						<a
 							href="https://www.cloudflare.com/website-terms/"
 							target="_blank"
+							rel="noopener noreferrer"
 							className="underline hover:text-kumo-default"
 						>
 							Terms of Service
@@ -515,6 +516,7 @@ export function LoginModal({
 						<a
 							href="https://www.cloudflare.com/privacypolicy/"
 							target="_blank"
+							rel="noopener noreferrer"
 							className="underline hover:text-kumo-default"
 						>
 							Privacy Policy

src/components/cloudflare-account-selector.tsx

@@ -316,8 +316,8 @@ export function CloudflareAccountSelector() {
 								<DropdownMenu.Content align="end">
 									{gatewayDashUrl && (
 										<DropdownMenu.Item
-											icon={ArrowSquareOutIcon}
-											onClick={() => window.open(gatewayDashUrl, '_blank')}
+                      icon={ArrowSquareOutIcon}
+											onClick={() => window.open(gatewayDashUrl, '_blank', 'noopener,noreferrer')}
 										>
 											View gateway
 										</DropdownMenu.Item>

src/features/presentation/components/PresentationHeaderActions.tsx

@@ -48,7 +48,7 @@ export function PresentationHeaderActions({
 			: `${currentSrc}?print-pdf`;
 
 		// Open print view in new window for PDF export
-		window.open(printUrl, '_blank');
+		window.open(printUrl, '_blank', 'noopener,noreferrer');
 	};
 
 	return (

src/lib/api-client.ts

@@ -1249,34 +1249,6 @@ class ApiClient {
 		});
 	}
 
-	/**
-	 * Verify email with OTP
-	 */
-	async verifyEmail(data: {
-		email: string;
-		otp: string;
-	}): Promise<ApiResponse<LoginResponseData>> {
-		return this.request<LoginResponseData>('/api/auth/verify-email', {
-			method: 'POST',
-			body: data,
-		});
-	}
-
-	/**
-	 * Resend verification OTP
-	 */
-	async resendVerificationOtp(
-		email: string,
-	): Promise<ApiResponse<{ message: string }>> {
-		return this.request<{ message: string }>(
-			'/api/auth/resend-verification',
-			{
-				method: 'POST',
-				body: { email },
-			},
-		);
-	}
-
 	/**
 	 * Get CSRF token
 	 */

src/routes/app/index.tsx

@@ -792,7 +792,7 @@ export default function AppView() {
 											aria-label="Open in new tab"
 											title="Open in new tab"
 											onClick={() =>
-												window.open(appUrl, '_blank')
+												window.open(appUrl, '_blank', 'noopener,noreferrer')
 											}
 											icon={
 												<ExternalLink className="size-3.5" />