feat(new-deepnotes): marketing vite-ssg site, Drizzle prod migration doc, and plan progress

Add apps/marketing static landing with vite-ssg/single-page and VITE_WEB_APP_URL for the app link.

Document empty-to-current Drizzle migrations for staging/production. Extend DEPLOY_CLOUDFLARE for the marketing artifact.

Author: gustavotoyota

AGENTS.md

@@ -0,0 +1,2 @@
+- vue-shadcn and Tailwind for UI.
+- Feature-based folder structure.

new-deepnotes/PLAN_PROGRESS.md

@@ -2,7 +2,7 @@
 
 Checklist for [docs/RESTART_PLAN.md](../docs/RESTART_PLAN.md). **Procedure-level map:** [docs/TRPC_REST_MAP.md](./docs/TRPC_REST_MAP.md) (legacy tRPC + app-server WebSocket rows are marked **implemented** or **removed**).
 
-**Last reviewed:** 2026-04-28
+**Last reviewed:** 2026-04-29
 
 ---
 
@@ -14,7 +14,7 @@ Checklist for [docs/RESTART_PLAN.md](../docs/RESTART_PLAN.md). **Procedure-level
 | **1** — Legacy repo hygiene | **Optional** | Only if still editing the old monorepo. |
 | **2** — Repo bootstrap | **Done** | Turbo, CI, template DB tests, deploy notes. |
 | **3** — REST + Drizzle | **In progress** | All **HTTP** items in TRPC_REST_MAP through **slice 10** (`…/collab-updates`), **Stripe**, **2FA**, membership, crypto bootstrap routes. **Not started:** **live Yjs collab WebSocket** and **realtime** (legacy `realtime-server` / msgpackr — separate from collab). |
-| **4** — Client MVP | **In progress** | Auth, register (E2EE), pages list, Tiptap+Yjs+REST collab, groups + invites/join E2EE, notifications (list/read; **no** body decrypt), MSW contract smoke, ESLint import walls. **Done:** Playwright smoke for **demo** session (httpOnly tokens, `loggedIn` hint, reload → bootstrap/refresh). **Next:** password-login E2E (registered user fixture or flow); optional demo keyring assertions; marketing `vite-ssg` per plan. |
+| **4** — Client MVP | **In progress** | Auth, register (E2EE), pages list, Tiptap+Yjs+REST collab, groups + invites/join E2EE, notifications (list/read; **no** body decrypt), MSW contract smoke, ESLint import walls, **`apps/marketing`** (`vite-ssg`). **Done:** Playwright smoke for **demo** session (httpOnly tokens, `loggedIn` hint, reload → bootstrap/refresh). **Next:** password-login E2E (registered user fixture or flow); optional demo keyring assertions. |
 | **5** — Cutover | **Not started** | Canary, retire `/trpc` when safe. |
 
 ---
@@ -27,7 +27,7 @@ Cross-check [TRPC_REST_MAP.md](./docs/TRPC_REST_MAP.md): **sessions**, **users.a
 
 - **Anonymous public read** for `GET /api/groups/:groupId/pages` (legacy optional auth) — still auth-only; add if product needs it.
 - **Stripe:** optional `checkout.session.completed` / richer webhook tests.
-- **Marketing `vite-ssg`** site — not in this tree yet (RESTART_PLAN §5.1).
+- **Marketing `vite-ssg`** site — `apps/marketing` (static landing + `Open app` via `VITE_WEB_APP_URL`); deploy doc updated in `docs/DEPLOY_CLOUDFLARE.md`.
 - **Legacy `scheduler` / `manager` / standalone `collab-server` & `realtime-server` processes** — not ported; greenfield targets Workers + future WS/DO topology instead.
 
 ---
@@ -63,6 +63,7 @@ Cross-check [TRPC_REST_MAP.md](./docs/TRPC_REST_MAP.md): **sessions**, **users.a
 - [x] `/notifications` (ciphertext not decrypted in UI)  
 - [x] MSW: `GET /api/health`, `GET /api/users/me`; ESLint `no-restricted-imports` on `src/**/*.ts`  
 - [x] Playwright: demo session against real `wrangler dev` + Vite (see **E2E / Playwright** below)  
+- [x] Marketing landing (`vite-ssg`): `apps/marketing`  
 - [ ] Password-login (or registered-user) Playwright path; optional/crypto assertions beyond cookies  
 - [ ] Capacitor / Tauri after web MVP  
 
@@ -95,6 +96,7 @@ Cross-check [TRPC_REST_MAP.md](./docs/TRPC_REST_MAP.md): **sessions**, **users.a
 | `@deepnotes/api` | `openapi.test.ts`, `schemas/users.test.ts`, … | |
 | `@deepnotes/api-worker` | **`index.test.ts`** — **71** route × 503 matrix + **1** extra `email-verification/confirm` 503 | Totals **72** env-missing smoke cases |
 | `@deepnotes/web` | Vitest + happy-dom; composable/API tests | MSW contracts; extend login matrix |
+| `@deepnotes/marketing` | `vite-ssg build` → `dist/` | Static landing; `VITE_WEB_APP_URL` for app link |
 | **Playwright** | `pnpm test:e2e` (root) → `@deepnotes/web` **1** spec (demo cookies + reload) | Needs migrated DB + `.dev.vars`; CI installs Chromium only |
 
 Run session integration (from repo root):  
@@ -109,7 +111,7 @@ Run session integration (from repo root):
 
 - [x] OpenAPI + generated client types; no tRPC/superjson/RevenueCat/key-rotation in this tree; [CLIENT_FORKS](./docs/CLIENT_FORKS.md).  
 - [x] SQL-heavy flows: template Postgres tests (`@deepnotes/db`, `@deepnotes/session`).  
-- [ ] Drizzle “empty → current” production upgrade doc.  
+- [x] Drizzle “empty → current” production upgrade doc ([docs/DRIZZLE_MIGRATIONS.md](./docs/DRIZZLE_MIGRATIONS.md)).  
 - [ ] Collab **and** **realtime** each: ≥1 integration test with chosen deps.  
 - [ ] Stripe (and other high-risk paths): deeper automated coverage where secrets allow.  
 - [ ] Cloudflare staging: Hyperdrive + Postgres + Redis + chosen WS topology load-tested.  
@@ -122,7 +124,7 @@ Run session integration (from repo root):
 
 | Date | Change |
 |------|--------|
-| 2026-04-28 | Playwright demo E2E (`session.spec.ts`), `e2e/dev.vars.ci`, CI: migrate app DB, copy `.dev.vars`, Chromium + `pnpm test:e2e`; root `test:e2e`; tsconfig.node includes playwright + e2e. |
+| 2026-04-29 | `apps/marketing` (`vite-ssg` single-page), `docs/DRIZZLE_MIGRATIONS.md`, deploy doc row for marketing + `VITE_WEB_APP_URL`; plan progress. |
 | 2026-04-27 | Compacted PLAN_PROGRESS; verified legacy map vs `TRPC_REST_MAP` — HTTP + listed WS flows migrated; added **realtime** vs **collab WS** distinction, optional gaps (public page list, vite-ssg, scheduler). Corrected counts: **20** session integration `it()`, **72** worker 503 smokes (71-route matrix + confirm). |
 | 2026-04-27 | MSW contract tests + ESLint restricted imports on web `*.ts`. |
 | 2026-04-27 | Tiptap + Yjs editor; invite/join E2EE + crypto bootstrap API; members detail UI; notifications thin SPA; groups overview; collab REST + `passwordSalt`; Stripe. |

new-deepnotes/apps/marketing/components.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://shadcn-vue.com/schema.json",
+  "style": "reka-nova",
+  "font": "geist-sans",
+  "typescript": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/styles/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "rtl": false,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "composables": "@/composables"
+  },
+  "menuColor": "default",
+  "menuAccent": "subtle",
+  "registries": {}
+}

new-deepnotes/apps/marketing/eslint.config.js

@@ -0,0 +1,3 @@
+import base from "../../eslint.config.js";
+
+export default [...base];

new-deepnotes/apps/marketing/index.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>DeepNotes</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

new-deepnotes/apps/marketing/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@deepnotes/marketing",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "vite-ssg build",
+    "dev": "vite",
+    "lint": "eslint vite.config.ts \"src/**/*.ts\"",
+    "test": "node -e \"process.exit(0)\"",
+    "typecheck": "vue-tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "@tailwindcss/vite": "^4.2.4",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "reka-ui": "^2.9.6",
+    "shadcn-vue": "^2.6.2",
+    "tailwind-merge": "^3.5.0",
+    "tailwindcss": "^4.2.4",
+    "tw-animate-css": "^1.4.0",
+    "vue": "^3.5.13"
+  },
+  "devDependencies": {
+    "@unhead/vue": "^2.0.19",
+    "@vitejs/plugin-vue": "^5.2.3",
+    "typescript": "^5.8.3",
+    "vite": "^6.3.3",
+    "vite-ssg": "^28.2.2",
+    "vue-tsc": "^2.2.10"
+  }
+}

new-deepnotes/apps/marketing/src/App.vue

@@ -0,0 +1,67 @@
+<template>
+  <div class="min-h-screen bg-background text-foreground">
+    <div
+      class="mx-auto flex min-h-screen max-w-2xl flex-col px-6 py-10 md:px-8"
+    >
+      <header class="mb-10 flex items-center justify-between gap-4">
+        <span class="text-lg font-semibold tracking-tight">DeepNotes</span>
+        <Button as="a" :href="appHref">Open app</Button>
+      </header>
+
+      <Card class="border-border/60 shadow-none">
+        <CardHeader class="space-y-3 pb-2">
+          <CardTitle class="text-2xl tracking-tight sm:text-3xl">
+            Notes that stay yours
+          </CardTitle>
+          <CardDescription class="text-base leading-relaxed">
+            DeepNotes is built for end-to-end encrypted notes and collaboration. Your content is
+            encrypted before it leaves your device; the server stores ciphertext only.
+          </CardDescription>
+        </CardHeader>
+        <CardContent class="space-y-4 text-muted-foreground">
+          <p class="leading-relaxed">
+            This marketing site is static HTML from
+            <code class="bg-muted text-foreground rounded px-1.5 py-0.5 font-mono text-xs">vite-ssg</code>;
+            the signed-in experience is a separate SPA (see
+            <code class="bg-muted text-foreground rounded px-1.5 py-0.5 font-mono text-xs">apps/web</code>
+            in the repo).
+          </p>
+        </CardContent>
+        <CardFooter class="flex-col items-start gap-1 pt-4">
+          <p class="text-muted-foreground text-xs leading-relaxed">
+            Licensed under AGPL-3.0. Source code obligations apply when you modify and distribute the
+            software.
+          </p>
+        </CardFooter>
+      </Card>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useHead } from "@unhead/vue";
+
+import { Button } from "@/components/ui/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+
+const appHref = computed(() => import.meta.env.VITE_WEB_APP_URL?.trim() || "/");
+
+useHead({
+  title: "DeepNotes — encrypted notes",
+  meta: [
+    {
+      name: "description",
+      content:
+        "End-to-end encrypted notes and collaboration. Static marketing shell; app runs as a separate SPA.",
+    },
+  ],
+});
+</script>

new-deepnotes/apps/marketing/src/components/ui/button/Button.vue

@@ -0,0 +1,31 @@
+<script setup lang="ts">
+import type { PrimitiveProps } from 'reka-ui'
+import type { HTMLAttributes } from 'vue'
+import type { ButtonVariants } from '.'
+import { Primitive } from 'reka-ui'
+import { cn } from '@/lib/utils'
+import { buttonVariants } from '.'
+
+interface Props extends PrimitiveProps {
+  variant?: ButtonVariants['variant']
+  size?: ButtonVariants['size']
+  class?: HTMLAttributes['class']
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  as: 'button',
+})
+</script>
+
+<template>
+  <Primitive
+    data-slot="button"
+    :data-variant="variant"
+    :data-size="size"
+    :as="as"
+    :as-child="asChild"
+    :class="cn(buttonVariants({ variant, size }), props.class)"
+  >
+    <slot />
+  </Primitive>
+</template>

new-deepnotes/apps/marketing/src/components/ui/button/index.ts

@@ -0,0 +1,35 @@
+import type { VariantProps } from 'class-variance-authority'
+import { cva } from 'class-variance-authority'
+
+export { default as Button } from './Button.vue'
+
+export const buttonVariants = cva(
+  'focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 rounded-lg border border-transparent bg-clip-padding text-sm font-medium focus-visible:ring-3 aria-invalid:ring-3 active:not-aria-[haspopup]:translate-y-px [&_svg:not([class*=size-])]:size-4 group/button inline-flex shrink-0 items-center justify-center whitespace-nowrap transition-all outline-none select-none disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0',
+  {
+    variants: {
+      variant: {
+        default: 'bg-primary text-primary-foreground [a]:hover:bg-primary/80',
+        outline: 'border-border bg-background hover:bg-muted hover:text-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 aria-expanded:bg-muted aria-expanded:text-foreground',
+        secondary: 'bg-secondary text-secondary-foreground hover:bg-secondary/80 aria-expanded:bg-secondary aria-expanded:text-secondary-foreground',
+        ghost: 'hover:bg-muted hover:text-foreground dark:hover:bg-muted/50 aria-expanded:bg-muted aria-expanded:text-foreground',
+        destructive: 'bg-destructive/10 hover:bg-destructive/20 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/20 text-destructive focus-visible:border-destructive/40 dark:hover:bg-destructive/30',
+        link: 'text-primary underline-offset-4 hover:underline',
+      },
+      size: {
+        'default': 'h-8 gap-1.5 px-2.5 has-data-[icon=inline-end]:pr-2 has-data-[icon=inline-start]:pl-2',
+        'xs': 'h-6 gap-1 rounded-[min(var(--radius-md),10px)] px-2 text-xs in-data-[slot=button-group]:rounded-lg has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 [&_svg:not([class*=size-])]:size-3',
+        'sm': 'h-7 gap-1 rounded-[min(var(--radius-md),12px)] px-2.5 text-[0.8rem] in-data-[slot=button-group]:rounded-lg has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 [&_svg:not([class*=size-])]:size-3.5',
+        'lg': 'h-9 gap-1.5 px-2.5 has-data-[icon=inline-end]:pr-2 has-data-[icon=inline-start]:pl-2',
+        'icon': 'size-8',
+        'icon-xs': 'size-6 rounded-[min(var(--radius-md),10px)] in-data-[slot=button-group]:rounded-lg [&_svg:not([class*=size-])]:size-3',
+        'icon-sm': 'size-7 rounded-[min(var(--radius-md),12px)] in-data-[slot=button-group]:rounded-lg',
+        'icon-lg': 'size-9',
+      },
+    },
+    defaultVariants: {
+      variant: 'default',
+      size: 'default',
+    },
+  },
+)
+export type ButtonVariants = VariantProps<typeof buttonVariants>

new-deepnotes/apps/marketing/src/components/ui/card/Card.vue

@@ -0,0 +1,21 @@
+<script setup lang="ts">
+import type { HTMLAttributes } from 'vue'
+import { cn } from '@/lib/utils'
+
+const props = withDefaults(defineProps<{
+  class?: HTMLAttributes['class']
+  size?: 'default' | 'sm'
+}>(), {
+  size: 'default',
+})
+</script>
+
+<template>
+  <div
+    data-slot="card"
+    :data-size="size"
+    :class="cn('ring-foreground/10 bg-card text-card-foreground gap-4 overflow-hidden rounded-xl py-4 text-sm ring-1 has-data-[slot=card-footer]:pb-0 has-[>img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl group/card flex flex-col', props.class)"
+  >
+    <slot />
+  </div>
+</template>