O-BEST website prototype

A standalone, dependency-free website prototype for O-BEST Link Communication. It is intentionally separate from the Foundry/Solidity project in the workspace.

See BUILD-ROADMAP.md for the staged plan from catalogue review through a secure inquiry flow, launch, useful guides, possible repairs, and future ad-network readiness.

Preview

The linked Vercel project has protected Production and Preview deployments. Do not treat them as an approved public launch. The site includes a Guides hub with one owner-approved, publicly visible general charging-accessory checklist, an About & Visit page, and a plain-language Privacy page. Other guide subjects are labelled as future topics, not published advice. The catalogue includes an inline, dismissible suggestion to read the charger checklist. The owner confirmed 08105463451 for public phone and WhatsApp contact; the page displays it as a phone link but does not open a WhatsApp chat. The item-request form remains on-site and does not redirect to WhatsApp. Open index.html locally or use vercel dev for development. The request endpoint runs as a Vercel Function at /api/request; it requires server-side environment variables and returns an honest “not ready” response until configured. For quality checks, run npm run check and npm test (Node.js 20+). A plain static file preview cannot exercise API routes or send inquiries. See OBEST-ARCHITECTURE.md for the system map, ownership boundaries, and safe operations.

Before publishing

• The inquiry form no longer opens WhatsApp. api/request.js sends through Resend only after server configuration and provider acceptance; there is no separate application inquiry database. As confirmed on 2 October 2026, Resend's published retention is 30 days for email content, metadata, events, logs and metrics; the owner plans to delete inquiry messages from the personal Gmail inbox after 30 days (Gmail Trash may preserve deleted mail for up to a further 30 days unless emptied sooner). Vercel's Hobby runtime logs are retained for one hour, build logs are stored indefinitely but Build Logs and Source Protection is enabled, and this project's Vercel deployment-retention policy is set to 30 days. See privacy.html for the current plain-language disclosure.
• The four inquiry environment variable names are configured for protected Preview; values are hidden and must remain server-side. inquiries.obestlink.com is verified in Resend. The owner confirmed receipt of a clearly labeled protected-Preview test on 2 October 2026. Keep INQUIRY_ENABLED=false until remaining launch checks pass and the owner approves launch. INQUIRY_TO is the owner's private receiving address; do not commit it. Never expose the API key in browser code.
• The endpoint fails closed unless INQUIRY_ENABLED=true is set in Vercel. Keep it false during development and staging until delivery and privacy readiness are confirmed.
• Vercel Firewall rule Limit item inquiry submissions is published for POST /api/request, limited to 5 requests per IP per 60 seconds, including Production. Keep it in place; the honeypot and input validation alone are not rate limiting.
• The sending domain is verified, and the owner confirmed receipt of one clearly labeled protected-Preview test on 2 October 2026. The endpoint intentionally returns a service-not-ready response while INQUIRY_ENABLED=false and does not claim a request was sent.
• The local request page links to privacy.html; its provider and retention wording reflects the owner-confirmed settings as of 2 October 2026. Re-check it if provider plans/settings or Gmail practices change, and review applicable legal requirements before public launch.
• The previously confirmed WhatsApp number is not currently used by the form.
• 404.html provides the branded not-found page. vercel.json sets baseline security headers; they and the branded 404 were verified on an explicitly authorized, filtered protected Preview on 2 October 2026. HSTS is intentionally not set until the final HTTPS domain and redirect behavior are confirmed. That Preview check was not a Production deployment or launch approval.
• The installer files and Namecheap order document found under assets/products/ remain local but are excluded from Git and Vercel deployments by .gitignore and .vercelignore. Keep them out of the website; the order document may contain private account/order details.
• A private inquiry-recipient email has been provided by the owner. It is not displayed publicly; configure it only in server-side deployment settings. The confirmed shop address, opening hours and social links are displayed on the About & Visit page.
• products.js remains the checked-in 130-record migration/verification fixture. The public catalogue runtime now reads all published, valid Sanity products, including subsequent CMS additions; update and publish catalogue entries in Sanity rather than editing this fixture.
• Matching product photos are stored in assets/products/. Do not use mixed shelf photos as individual product photos.
• Fourteen non-Samsung power/volume flex listings now use separately stored supplier reference photos; each product detail links to the supplier listing. Three photos are from explicitly selectable exact variants on a combined PhoneXperts listing: Camon 20 Pro 4G CK7n, Pop 5 Pro BD4, and Pop 6 Go BE6i. An additional PhoneXperts photo is listed for iPhone 14 Pro Max; that listing notes welding is required. The owner approved use of the supplier reference photos. Their presence does not confirm O-BEST stock or physical compatibility; other flex listings retain the generic illustration until an exact model/variant photo is sourced. See POWER-FLEX-AUDIT.md for filenames, model suffixes, and sources.
• The additional supplied photos have been visually reviewed and sorted: 11 distinct product/accessory images are included in the homepage carousel under assets/homepage/; 10 compatibility charts, repair/lifestyle photos, and mixed shop displays are organized under assets/reference/. Three uploads are exact duplicates of the original homepage mouse, cable, and USB-drive photos, so they are not repeated. All original uploads remain in incoming/. The new carousel images are not catalogue listings; their model identities remain unasserted where packaging is unclear.
• Custom O-BEST object illustrations for the homepage strip and category cards are local SVGs in assets/illustrations/; they are decorative and paired with visible category labels. The owner approved the current visible illustrations on 2 October 2026.
• Home and Catalogue category navigation is inventory-driven: empty categories/item types are not presented as stocked catalogue groups, and invalid catalogue filter URLs fall back safely. The Home nav's current page is announced with aria-current for assistive technology.
• The homepage hero locally rotates through the selected owner-supplied accessory images in assets/homepage/, centered in one square, uncropped contain frame. Its transparent blue surround lets the hero's circular linework continue through the frame, with a slightly stronger light outline and small yellow base detail; there are no image labels. The frame is kept clear of the yellow hero band. Rotation is automatic at five-second intervals, with a 1.5-second crossfade and reduced-motion support. The previous illustrative Pexels image remains in the asset folder but is no longer used in the hero. Keep the final photo/background composition in Preview visual sign-off before launch.
• Product descriptions use direct retail wording. Confirm final product names, specifications and compatibility with the shop before launch; remove any detail that has not been confirmed.
• Set availability only when the shop confirms it; otherwise listings say “Ask us to check.”
• Phone-screen listings currently default to “Available” with a green pulse. app.js centralizes that item-type default; set an individual product's availability in Sanity when its status needs an override. The pulse stops for reduced-motion preferences.
• Available phone screens are sorted alphabetically by product name and can be filtered with inventory-derived brand chips. The selected brand is reflected in the URL for sharing/bookmarking; “All brands” resets the filter. Current screen brands are Apple, Infinix, Samsung, TECNO, and Xiaomi.
• The owner confirmed that items not available in-store can be sourced within 24 hours after a customer requests them. This timing is described as sourcing time, not as stock confirmation or a delivery promise.
• Delivery, rewards, prices, stock claims and unconfirmed technical claims are intentionally not included.

Editing catalogue items

Create and maintain catalogue products in Sanity Studio. The checked-in products.js is retained for migration checks and historical regression fixtures, not loaded by public pages. Current visible categories are power, audio, computing, wearables, home, and parts; empty categories are not promoted. Give each Sanity product a unique slug; product links and category filtering are generated from the published CMS response.

Sanity catalogue and Studio

• The hosted O-BEST Sanity Studio is at https://obest-catalogue.sanity.studio/. It can be opened from any device, but managing content requires signing in with an account that has been invited to the Sanity project. The project currently has two Administrator accounts; review membership in Sanity before inviting anyone else. Do not put a Sanity token in the website or commit one.
• For multiple new products, copy sanity/templates/product-import-template.csv and edit it in Excel or Google Sheets. Export/download it as CSV, then preview it with npm run products:csv:preview -- --file=path/to/products.csv. The preview validates required fields, category/type pairs, duplicate IDs in the file, and collisions with Production. It does not write anything. To create the reviewed products, run npm run products:csv:import -- --file=path/to/products.csv -- --confirm-production. The importer is append-only, sets blank availability to check, and does not import images; attach product photos in Sanity Studio afterward. Keep the provided column names unchanged. A blank urlId is generated from productName. Product-type/category options are fixed to the current schema; add a new type/category through the approved schema and website changes first.
• The owner's onset-list products (from onset lists 1.pdf) are imported with their photos by npm run products:onset:preview / npm run products:onset:import. The manifest at sanity/scripts/onset-products-manifest.json lists each product with its slug, category/type, and the photo file in assets/products/. Unlike the CSV importer, this one uploads the image and attaches it to the product. It is append-only, skips any slug or name already in Production, and sets availability to Ask us to check. Photos were cropped from the PDF page scans; the source list is the owner's own stock sheet.
• Bulk availability changes use npm run products:availability:preview / npm run products:availability:import (sanity/scripts/update-product-availability.ts). Samsung screen assemblies are excluded from the blanket update unless --samsung=available is passed; --samsung=check downgrades currently available Samsung screens back to Ask us to check. The owner confirmed in October 2026 that every product, including Samsung screens, should read Available.
• To run a local development copy, run npm install, then npm run studio; it opens at http://localhost:3333 while the command is running. Local Studio development is not required for normal availability edits.
• The schema supports catalogue categories, product types, descriptions, images, optional specifications/source links, and manually selected Ask us to check, Available, or Unavailable status. New products default to Ask us to check; Studio list previews show category, product type, and availability for easier review. Product URL IDs are capped at 128 characters to match the public route and have a Studio uniqueness check. It does not track quantity or sell products.
• Homepage, catalogue, and product-detail pages load published Sanity records through /api/catalogue and the shared catalog-data.js loader. Sanity is the only runtime source for shop products. An empty or unavailable Sanity response produces a clear empty/unavailable UI, never a silent fallback to products.js. The separate Lucent research feed is combined for catalogue browsing only when its API responds; the separately held Samsung Note 3 Mini research record is not included in that public feed. Availability and catalogue edits in Sanity do not require a website redeploy.
• npm run studio:build builds the editor locally. Build output is ignored and must not be included in the public website deployment.
• Keep Vercel's Output Directory unset/default so API routes remain enabled; do not point it at the Sanity Studio dist/ build for the catalogue site.
• Run npm run catalogue:import:dry-run to check the original 130 records and 121 referenced photo paths without writing to Sanity. The original npm run catalogue:import is a one-time migration only; do not rerun it to add products. For future additions, prepare a separate validated append-only import by category. Availability defaults to Ask us to check unless confirmed.
• This project's current Vercel preview deployment has not been added to Sanity CORS. The public site's reader uses a same-origin server API and requires no CORS entry or Sanity credential. Do not add a broad Vercel wildcard or permit credentials for website reads.
• The initial Sanity 6 install surfaced 15 audit findings; after moving to Sanity 5.31.2, npm audit reports 8 findings (4 moderate, 4 high) in the Studio/CLI dependency tree. Do not use npm audit fix --force blindly; re-evaluate with a compatible Sanity release when the upstream fixes are available.