Skip to content

feat(site): open signup replaces the waitlist - #185

Merged
sre-helmcode merged 8 commits into
mainfrom
feat/open-signup
Oct 15, 2026
Merged

feat(site): open signup replaces the waitlist#185
sre-helmcode merged 8 commits into
mainfrom
feat/open-signup

Conversation

@sre-helmcode

@sre-helmcode sre-helmcode commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Summary

The landing stops feeding a waitlist and sends people to create an account.

  • The hero form becomes the signup form: name, email, job role + Other, and optional X/LinkedIn. It posts to the new same-origin Worker route /api/signup, which validates, rate-limits per IP, has a honeypot, and proxies to cloud-api POST /api/auth/signup, forwarding cf-connecting-ip and cf-ipcountry. ?plan is carried through.
  • A no-JS form post gets a minimal ES/EN page linking to the platform signup; the body is never read.
  • Every CTA goes to account creation: pricing → cloud.nan.builders/signup?plan=…, a workspaces CTA, and a nav "Create account". /community loses its pay-first form.
  • All waitlist copy is removed in ES and EN, including FAQ, legal pages (privacy now covers the profile data and the 7-day purge of unconfirmed accounts), 404 and footer. Tests guard against waitlist wording and web-search content coming back.
  • The old waitlist route, its libs and the Resend confirmation email are deleted; cloud-api sends the English magic link.
  • ARCHITECTURE.md and README.md rewritten.

Tests

npm run build and astro check OK; vitest 83 files / 2447 tests green. Visual check: desktop/mobile, ES/EN.

Blocking reviews (QA, UX, Security): approved.

Deploy notes

  • Deploy after cloud-api has OPEN_SIGNUP=true; the signup endpoint is only mounted with the flag on.
  • CLOUD_API_URL is still required.
  • RESEND_API_KEY, RESEND_FROM_EMAIL and CLOUD_API_WAITLIST_KEY are no longer used and can be removed from the Worker secrets.

🤖 Generated with Claude Code

barckcode and others added 8 commits October 15, 2026 10:26
@barckcode @claude
feat(signup): /api/signup Worker route proxying to cloud-api open signup
8685c41 
Shared validation in lib/signup.ts mirrors POST /api/auth/signup
(OPEN-SIGNUP.md 2.3): full name, email, job role enum with 'other' free
text, optional X/LinkedIn profile URLs normalized to the accepted shapes,
plan from the enum. The route validates, drops honeypot hits with the
same 202, rate limits per IP (5 per 10 min, valid submissions only) and
proxies to the public endpoint with Origin https://nan.builders and the
client IP. Every upstream success is the same 202; 400 field errors are
sanitized; 429 passes through; anything else is an opaque 502.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
feat(home): hero signup form replaces the waitlist
9d7913b 
The hero form now creates an account: full name, email, job role (with
'Other' free text revealed on demand), optional X and LinkedIn profiles,
honeypot, required markers, per-field errors and a 'check your inbox'
success state. Still a vanilla script, no island; ?plan= (and the legacy
?premium=1) is carried into the payload. Copy rewritten in EN and ES.

Removes the waitlist route, its client/server libs, the Resend
confirmation email and their tests. cloud-api now sends the English
magic link, so RESEND_* and CLOUD_API_WAITLIST_KEY are unused here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
feat(site): every CTA goes to account creation, no waitlist left
16de81e 
Pricing tiers link to cloud.nan.builders/signup?plan=premium|inference|
community and the workspaces block gets a plan=workspace CTA. The nav
shows 'Create account' next to Login. Models, footer and 404 point at
the hero signup form. /community drops its payment-first form for a CTA
to signup?plan=community (form, route, lib and tests deleted). Privacy
covers the account profile data and the 7-day purge of unconfirmed
accounts; terms no longer mention a waitlist. A guard test keeps any
waitlist copy out, except the events reserve pool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
test(docs): guard that web search stays off the site
971c155 
Web search (/v1/search and the MCP server that only exposed it) was
removed in #100 and /docs/mcp already 301s to agent-setup. Pin it: no
page, doc, dictionary, OpenAPI path or public file may mention it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
docs: describe open signup instead of the waitlist island
666ebf8 
ARCHITECTURE.md and README.md now document /api/signup (contract,
validation, honeypot, rate limit, response mapping), the vanilla hero
form, the plan-aware signup links, the free lifecycle state, path-based
EN/ES, the current structure, and the env vars the site no longer reads
(RESEND_*, CLOUD_API_WAITLIST_KEY).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
fix(nav): keep Login + Create account on one line in the narrow deskt…
f9f5389 
…op band

With the new Create account button the Spanish nav overflowed 66px at
861px, 28px at 900px and 28px right after the old 1100px band. The
compact band now runs to 1240px with tighter spacing and smaller auth
buttons; measured no horizontal scroll at 861-1300px in EN and ES.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
fix(signup): no-JS safe form, exact JSON media type, forward visitor …
cb32a64 
…country

- The hero form has method="post" action="/api/signup", so if the
  script fails the browser never GETs the data into a URL. That form
  post gets a plain-text 415 pointing at the platform signup; the body
  is never read or echoed (a redirect to cloud.nan.builders would be
  blocked by the page's form-action 'self').
- /api/signup parses the Content-Type media type and requires exactly
  application/json instead of a substring match.
- cf-ipcountry is forwarded to cloud-api next to the client IP (only a
  well-formed two-character code), for the billing region at verify.
- The blocked email domain/TLD lists are exported and pinned by a test
  so they stay in sync with cloud-api.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@barckcode @claude
fix(signup): accept mail.com, localized HTML page for no-JS form posts
239930b 
- mail.com is a real email provider: removed from the blocked-domain
  list (cloud-api drops it too). The pinned list test is updated.
- A no-JS form post to /api/signup now gets a small static HTML page
  instead of plain English text: dark like the site, no JS, its own
  CSP (default-src 'none'), in Spanish when posted from /es or, with no
  same-origin Referer, when Accept-Language prefers it. It explains the
  form needs JavaScript and links to cloud.nan.builders/signup. The
  request body is still never read or echoed; the status stays 415.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sre-helmcode
sre-helmcode merged commit 3c2aca1 into main Oct 15, 2026
2 checks passed
@sre-helmcode sre-helmcode mentioned this pull request Oct 16, 2026
Closed
@sre-helmcode
sre-helmcode deleted the feat/open-signup branch October 16, 2026 11:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@barckcode barckcode

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sre-helmcode @barckcode