chore: production hardening, full feature build, and open-source prep

.dockerignore

@@ -0,0 +1,49 @@
+# =============================================================================
+# Docker Build Context — Excluded Files
+# =============================================================================
+
+# Dependencies (re-installed inside the container)
+node_modules/
+**/node_modules/
+
+# Git
+.git/
+.gitignore
+
+# Build output (rebuilt inside the container)
+dist/
+**/dist/
+*.tsbuildinfo
+
+# Environment files (secrets should not be baked into images)
+.env
+.env.*
+
+# IDE and editor files
+.vscode/
+.idea/
+
+# Docker files (not needed inside the build context)
+docker-compose.yml
+.dockerignore
+
+# Documentation and metadata
+README.md
+LICENSE
+*.md
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Test coverage
+coverage/
+
+# Logs
+*.log
+
+# SQLite database files
+*.db
+
+# Kiro specs
+.kiro/

.env.example

@@ -17,6 +17,11 @@ NODE_ENV=development
 # Log level for Pino logger: "trace", "debug", "info", "warn", "error", "fatal"
 LOG_LEVEL=info
 
+# Allowed CORS origin for the frontend (required in production).
+# Set to the exact URL of your frontend, e.g. https://app.example.com
+# In development this can be left unset (all origins are allowed).
+# CORS_ORIGIN=https://app.example.com
+
 # -----------------------------------------------------------------------------
 # OpenAI Integration
 # -----------------------------------------------------------------------------
@@ -27,12 +32,31 @@ AI_INTEGRATIONS_OPENAI_API_KEY=sk-your-key-here
 # OpenAI API base URL (defaults to https://api.openai.com/v1)
 AI_INTEGRATIONS_OPENAI_BASE_URL=https://api.openai.com/v1
 
-# OpenAI model to use for CAD analysis (must support vision/image input)
+# -----------------------------------------------------------------------------
+# Model Configuration
+# -----------------------------------------------------------------------------
+
+# Annotation detection — must support vision/image input
 OPENAI_MODEL=gpt-4o
 
+# DFM review — text-only, lighter model is fine
+DFM_MODEL=gpt-4o-mini
+
+# -----------------------------------------------------------------------------
+# Database
+# -----------------------------------------------------------------------------
+
+# PostgreSQL credentials — used by both docker-compose and the app.
+# Required in production. Omit DATABASE_URL to use SQLite fallback in development.
+POSTGRES_USER=cad_user
+POSTGRES_PASSWORD=change-me-in-production
+POSTGRES_DB=cad_annotator
+DATABASE_URL=postgresql://cad_user:change-me-in-production@localhost:5432/cad_annotator
+
 # -----------------------------------------------------------------------------
-# Database (optional — only needed if using DB features)
+# Local LLM (Ollama)
 # -----------------------------------------------------------------------------
 
-# PostgreSQL connection string
-# DATABASE_URL=postgresql://user:password@localhost:5432/cad_annotator
+# Uncomment to use Ollama instead of OpenAI:
+# AI_INTEGRATIONS_OPENAI_BASE_URL=http://localhost:11434/v1
+# AI_INTEGRATIONS_OPENAI_API_KEY=ollama

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug Report
+description: Report a bug to help us improve CAD Annotator
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps-to-reproduce
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: Expected Behavior
+      description: What you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual-behavior
+    attributes:
+      label: Actual Behavior
+      description: What actually happened.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - macOS
+        - Windows
+        - Linux
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: node-version
+    attributes:
+      label: Node.js Version
+      placeholder: "e.g., 24.0.0"
+    validations:
+      required: true
+
+  - type: input
+    id: browser
+    attributes:
+      label: Browser
+      placeholder: "e.g., Chrome 125, Firefox 128"
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots to help explain the problem.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,37 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem-statement
+    attributes:
+      label: Problem Statement
+      description: A clear description of the problem this feature would solve.
+      placeholder: "I'm always frustrated when..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed-solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution you'd like.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives-considered
+    attributes:
+      label: Alternatives Considered
+      description: Describe any alternative solutions or features you've considered.
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Add any other context, mockups, or screenshots about the feature request.
+    validations:
+      required: false

.github/pull_request_template.md

@@ -0,0 +1,24 @@
+## Description
+
+<!-- What changed and why? Link any related issues. -->
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation update
+- [ ] Refactor
+
+## Testing Performed
+
+<!-- Describe the tests you ran and how to reproduce them. -->
+
+## Checklist
+
+- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md)
+- [ ] My changes pass `pnpm run typecheck`
+- [ ] My changes pass `pnpm -r --if-present run test`
+- [ ] I have added tests for new functionality
+- [ ] I have not included unrelated changes
+- [ ] I have updated documentation if needed

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run typecheck
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm -r --if-present run test
+
+  docker-build:
+    name: Docker Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - run: docker build .
+
+  audit:
+    name: Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm audit --prod

.gitignore

@@ -16,6 +16,9 @@ node_modules/
 .env.local
 .env.*.local
 
+# Kiro (internal development specs and config)
+.kiro/
+
 # IDE and editor files
 .idea/
 .project
@@ -47,6 +50,11 @@ pnpm-debug.log*
 .DS_Store
 Thumbs.db
 
+# SQLite database (local dev fallback)
+cad-annotator.db
+cad-annotator.db-wal
+cad-annotator.db-shm
+
 # Lock files (pnpm only — enforced by preinstall hook)
 package-lock.json
 yarn.lock

.vscode/settings.json

@@ -0,0 +1 @@
+{}

CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-04-28
+
+### Added
+
+- AI-powered CAD drawing annotation using OpenAI vision models
+- GD&T compliance checking engine
+- DFM manufacturability review
+- Pipeline orchestration for multi-stage analysis
+- React frontend with interactive bounding box overlay
+- Docker Compose deployment with PostgreSQL
+- SQLite fallback for local development
+- OpenAPI specification with generated client hooks
+- Local LLM support via Ollama