Platform Updates

Repositories: partners.furries.ph

What’s Changed

• Creating or editing a standalone campaign in Affiliates & Tracking now writes the campaign immediately and reloads the server-confirmed value.
• A failed write remains in the editor with a clear error instead of appearing saved only until the page reloads.

What To Do

• Event operators can use Create campaign or Save changes in the campaign dialog; the dashboard confirms the saved campaign before closing it.

Repositories: partners-api, partners.furries.ph, social.furries.ph

Status: Git release ready; migration publication and authenticated delivery certification remain pending

What’s Changed

• Audio and video uploads remain held for review. After staff release, a member can select up to 20 of their ready items and attach up to four total media items to a post.
• Rich media is delivered through the existing partners-api route only after it is attached to a visible post. The API never returns a direct Sanity asset URL, filename, or storage locator to the Social Pages app.
• Friends-only posts apply the existing canonical friendship check before rich media is streamed. Local-visible posts remain available to viewers of the public post.
• A database trigger is staged to reject any post-media attachment unless its asset is an image, audio, or video with a verified review state.

Impact

• Members can use reviewed audio and video without creating another Worker, a Pages Function, Queue, or direct browser connection to Supabase or Sanity.
• Moderators retain a review gate before rich media can be published, while the member-facing composer can safely show only its own ready-to-attach metadata.

Upgrade Notes

• Merge the paired API and database changes through Git, then publish the reviewed migration in the normal controlled migration window.
• Do not treat the database guard as live until migration publication and authenticated end-to-end delivery certification have both completed.

Validation

• The API rich-media validator passed 5 assertions, its route-contract test passed 17 assertions, and the Worker TypeScript check passed locally.
• The staged migration contract passed 20 assertions; the partner static app completed Astro diagnostics with 0 errors and 0 warnings.

Repositories: social.furries.ph, partners-api, partners.furries.ph

Status: Published

What’s Changed

• New Social members now enter only their email address, profile name, username, and password when creating an account.
• Cloudflare Turnstile remains server-verified abuse protection; it is not a member profile field and does not create an additional setup step.
• Staff invitation-management records remain available for staff workflows but no longer prevent an ordinary member from creating a Social account.
• The Social Pages SPA continues to use only the existing partners-api Worker for dynamic requests. The associated service-only database function was safely reissued at a non-colliding migration version before release.

Impact

• Members can join Social without needing a community invitation while Furries PH retains bot and abuse protection at the API boundary.
• Mobile users can reach account creation directly from the sign-in dialog.
• No Supabase or Sanity credentials, direct browser database access, Pages Functions, or additional Workers were added.

Upgrade Notes

• No action is required from existing members or staff.
• The project’s consolidated accessibility testing and remediation pass remains deliberately scheduled as the penultimate phase; Fediverse work remains the final phase.

Validation

• The local signup browser certificate passed 8 assertions, including the exact four-field payload and a single API request.
• Social type checking, 88 unit tests, and production build passed; the migration contract passed 7 assertions.
• The migration was dry-run before publish, then both the partners-api Worker and Social Cloudflare Pages production builds completed successfully.

Repositories: rego.furries.ph, partners-api

Status: Published

What’s Changed

• Campaign landing links now retain recognised UTM and affiliate parameters while a visitor moves through the registration site.
• Campaign attribution is handled separately from affiliate codes, so a campaign link no longer shows an invalid-affiliate message.
• Registration quotes now show the original subtotal, the campaign discount, and the resulting subtotal after discounts correctly. Payment surcharges remain included in the final total.

Impact

• Visitors using a campaign QR or shared link receive the configured campaign discount throughout their registration flow.
• Support and event operators can reconcile the displayed subtotal, discount, surcharge, and total without a misleading duplicate subtotal.

Validation

• The API TypeScript check passed before deployment.
• The registration site passed Astro diagnostics and a production static build.
• The Worker and Cloudflare Pages deployments completed successfully.

Repositories: partners-api, social.furries.ph

Status: Git release complete

What’s Changed

• A partner-verified Social Event Page now reuses the same signed-proof check as event discovery before it presents its verification state.
• When a current public event-discovery projection is available, the Page shows a named Official event link to the canonical Furries PH event route.
• If that public projection is unavailable or stale, the Page stays online and clearly says that the official link is temporarily unavailable. It does not guess a route or expose an event identifier, signing proof, Page staff data, or private operational data.

Impact

• Members can move from a verified community Event Page to the corresponding official event page with a clear trust boundary.
• Event organisers keep their Page available during a public-event projection refresh, without an unsafe or misleading fallback link.

Upgrade Notes

• No member action is required.
• Event Pages still need an explicitly selected canonical CMS event mapping and the configured Git-connected main-site rebuild hook before a new verification can be issued.

Validation

• The API signed-attestation certificate passed 19 local assertions and the Worker TypeScript check.
• The SPA passed 65 local tests, type-checking, a static build, and a local browser fixture with a named official-event link and no console errors.
• Git-connected Cloudflare Worker and Pages builds passed before release. No GitHub WCAG audit workflow was used.

Repository: partners-api

Status: Git release complete

What’s Changed

• The Event Page attestation, public discovery-preference, friendship, and standard moderation live certificates now intercept normal termination signals and finish their existing scoped cleanup before exiting.
• Cleanup removes only the disposable identities and records created by the interrupted certificate. It does not alter member content or operational event data.

Impact

• Operators can safely stop these Social certification checks without leaving fixture accounts, relationships, preferences, Event Pages, or moderation records behind.

Upgrade Notes

• No member action is required.
• The existing canonical CMS-event mapping and production-secret gates for Event Pages are unchanged.

Validation

• Each changed certificate passed Node syntax checks, a termination-cleanup source contract, and the API TypeScript gate locally.
• The Git-connected partners-api Worker build passed before merge.

Repositories: partners-api, social.furries.ph

Status: Git release complete

What’s Changed

• The two production moderation certification checks now intercept normal termination signals and run their existing cleanup before exiting.
• Cleanup soft-deletes temporary test posts and revokes temporary moderation roles and identities, keeping safety evidence intact without leaving public certification content visible.

Impact

• Operators can stop a certification run safely without creating avoidable public test-content residue.

Upgrade Notes

• No member action is required.
• The previously discovered public certification fixture still requires removal by an authenticated production operator; this release prevents a repeat.

Validation

• Both certification scripts pass Node syntax checks and the API TypeScript validation gate locally; the API Worker build passed before release.

Repositories: partners.furries.ph, partners-api, rego.furries.ph

Status: Deployment in progress; the database migration and all three application surfaces are released together

What’s Changed

• Event campaigns can carry one optional flat or percentage attendee discount, with separate switches for ordinary registration, gifted registration, and event shop use.
• Campaign links are standalone: they do not create or depend on an affiliate record.
• Registration, gifts, group registration, Dealers Den, and Event Shop select one eligible discount instead of stacking them. Campaign and affiliate attribution remain recorded independently.

Impact

• Event operators can run a direct promotional campaign without an affiliate reward arrangement.
• Attendees receive only the best eligible discount.

Repositories: social.furries.ph, partners-api, partners.furries.ph

Status: Public read launch complete; authenticated posting, account setup, and moderation certification remain separately gated

What’s Changed

• social.furries.ph now has a live, Git-connected Cloudflare Pages frontend backed only by the existing partners-api Worker.
• The reviewed Social database schema is published after a verified logical backup and scoped migration reconciliation.
• The public local timeline, topic timeline, and event discovery now return bounded success responses. The API uses explicit author relationships so the expanded shared-account graph cannot make post reads ambiguous.

Impact

• Visitors can load the public Social shell and browse its current empty-state timelines without a Pages Function, browser database connection, or a second Worker.
• The public API remains CORS-restricted to the Social site. A signed-in session is still required for account-specific actions.

Upgrade Notes

• No member action is required.
• Operators should keep account creation, posting, uploaded-content handling, and moderator workflows behind their existing authenticated launch checks.

Validation

• Cloudflare Git builds passed for Social Pages and partners-api.
• Production probes from social.furries.ph confirmed 200 responses for public timeline/topic/event endpoints and the expected 401 for an unauthenticated Social session.

Repositories: partners-api, social.furries.ph

Status: Git-connected Worker release completed; Social database migrations and authenticated launch checks remain required

What’s Changed

• The single Furries PH API Worker now serves the existing Social route module at /api/social, restoring the connection used by the Social Pages app.
• A focused route contract now checks that the Worker imports and mounts the Social module, preventing a future deployment from leaving those endpoints unreachable.
• Live cross-origin checks confirm Social requests now reach the API. The unauthenticated session endpoint returns its expected sign-in response, while public timeline and event discovery return a temporary-unavailable response from their handlers instead of a missing-route response.

Impact

• The Social frontend can reach its intended backend boundary without a Pages Function, browser database connection, or additional Worker.
• Social content and discovery are not yet available to members: the temporary-unavailable responses accurately preserve the existing database migration/RLS release gate.

Upgrade Notes

• No member action is needed. Platform operators must complete the verified Supabase backup, migration reconciliation/publication, and authenticated role checks before enabling Social account setup or posting.

Validation

• Social Page moderation route contract: 96 assertions passed.
• API TypeScript validation and Wrangler production dry run passed.
• Git-connected Worker build passed after merge to main; live API probes verified CORS and handler reachability.