feat(server): add request logging middleware with request IDs

.cargo/audit.toml

@@ -0,0 +1,15 @@
+# cargo-audit configuration
+# Ignore transitive advisories from Soroban/Stellar ecosystem crates
+# that cannot be resolved without upstream fixes.
+# These are all INFO-level "unmaintained" notices, not exploitable vulnerabilities.
+
+[advisories]
+ignore = [
+    # derivative 2.2.0 — unmaintained, used transitively by soroban-sdk
+    "RUSTSEC-2024-0388",
+    # paste 1.0.x — unmaintained, used transitively by soroban-sdk
+    "RUSTSEC-2024-0436",
+    # rand 0.8/0.9 — unsoundness with custom logger, used transitively by soroban-sdk
+    # Not exploitable in contract context (no custom global logger)
+    "RUSTSEC-2026-0097",
+]

.env.example

@@ -1,100 +1,71 @@
-<<<<<<< feat/empty-and-error-states
-ADMIN_EMAILS=admin@example.com # comma-separated list of admin emails
-# The environment to use `development`, `testing`, `staging`, `production`
-STELLAR_SCAFFOLD_ENV=development
+# LearnVault environment template for local development. Copy this file to `.env`.
+
+# Optional: comma-separated admin email recipients for server notifications (flags, etc.)
+ADMIN_EMAILS=admin@example.com
 
-# Location of the config files for this project for the scaffold stellar CLI.
-# Learn more at https://developers.stellar.org/docs/tools/cli/stellar-cli#stellar-config-dir
-XDG_CONFIG_HOME=".config"
+# Scaffold / local tooling
+# Environment profile for Stellar scaffold scripts and CLI (`development`, `testing`, `staging`, `production`).
+STELLAR_SCAFFOLD_ENV=development
+# Stellar CLI config directory. See https://developers.stellar.org/docs/tools/cli/stellar-cli#stellar-config-dir
+XDG_CONFIG_HOME=.config
 
-# Prefix with "PUBLIC_" to make available in frontend files
-# Which Stellar network to use in the frontend: local, testnet, futurenet, or mainnet
-# More on Stellar networks: https://developers.stellar.org/docs/networks
+# --- Stellar network (frontend) ---
+# Prefix with PUBLIC_ so Vite exposes these to the browser.
+# More on networks: https://developers.stellar.org/docs/networks
 
-PUBLIC_STELLAR_NETWORK="LOCAL"
-# The Stellar network passphrase, this is local
+# Default: local scaffold (Horizon + Soroban on localhost)
+PUBLIC_STELLAR_NETWORK=LOCAL
 PUBLIC_STELLAR_NETWORK_PASSPHRASE="Standalone Network ; February 2017"
-# The Stellar network RPC URL. this is local
-PUBLIC_STELLAR_RPC_URL="http://localhost:8000/rpc"
-# The Stellar Horizon URL. this is local
-PUBLIC_STELLAR_HORIZON_URL="http://localhost:8000"
+PUBLIC_STELLAR_RPC_URL=http://localhost:8000/rpc
+PUBLIC_STELLAR_HORIZON_URL=http://localhost:8000
 
-# PUBLIC_STELLAR_NETWORK="TESTNET"
+# Uncomment for Testnet instead:
+# PUBLIC_STELLAR_NETWORK=TESTNET
 # PUBLIC_STELLAR_NETWORK_PASSPHRASE="Test SDF Network ; September 2015"
-# PUBLIC_STELLAR_RPC_URL="https://soroban-testnet.stellar.org"
-# PUBLIC_STELLAR_HORIZON_URL="https://horizon-testnet.stellar.org"
+# PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org
+# PUBLIC_STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
 
-# PUBLIC_STELLAR_NETWORK="MAINNET"
+# Uncomment for Mainnet:
+# PUBLIC_STELLAR_NETWORK=MAINNET
 # PUBLIC_STELLAR_NETWORK_PASSPHRASE="Public Global Stellar Network ; September 2015"
 # PUBLIC_STELLAR_RPC_URL=
 # PUBLIC_STELLAR_HORIZON_URL=
 
-# V1 Contract IDs (deployed to Testnet)
-# These will be populated after running ./scripts/deploy-testnet.sh
-
-# Core Platform Contracts
-VITE_LEARN_TOKEN_CONTRACT_ID=""
-VITE_GOVERNANCE_TOKEN_CONTRACT_ID=""
-
-# Scholarship System Contracts  
-VITE_COURSE_MILESTONE_CONTRACT_ID=""
-VITE_MILESTONE_ESCROW_CONTRACT_ID=""
-VITE_SCHOLARSHIP_TREASURY_CONTRACT_ID=""
-VITE_SCHOLAR_NFT_CONTRACT_ID=""
-
-# Token Contract
-PUBLIC_USDC_CONTRACT_ID="" # USDC token contract address (testnet or mainnet)
-
-# Optional: Friendbot-funded deployer address for testing
-# PUBLIC_DEPLOYER_ADDRESS=""
-
-# Backend API URL
+# --- LearnVault contract IDs (populate after deploy; Vite `VITE_*` vars) ---
+VITE_LEARN_TOKEN_CONTRACT_ID=
+VITE_GOVERNANCE_TOKEN_CONTRACT_ID=
+VITE_COURSE_MILESTONE_CONTRACT_ID=
+VITE_MILESTONE_ESCROW_CONTRACT_ID=
+VITE_SCHOLARSHIP_TREASURY_CONTRACT_ID=
+VITE_SCHOLAR_NFT_CONTRACT_ID=
+
+# USDC on Stellar — the app reads either name (see `src/util/usdc.ts`).
+PUBLIC_USDC_CONTRACT_ID=
+VITE_USDC_CONTRACT_ID=
+
+# Legacy `PUBLIC_*` aliases still read by older screens/hooks (optional).
+PUBLIC_LEARN_TOKEN_CONTRACT=
+PUBLIC_GOVERNANCE_TOKEN_CONTRACT=
+PUBLIC_SCHOLAR_NFT_CONTRACT=
+PUBLIC_COURSE_MILESTONE_CONTRACT=
+PUBLIC_SCHOLARSHIP_TREASURY_CONTRACT=
+PUBLIC_MILESTONE_ESCROW_CONTRACT=
+PUBLIC_SCHOLARSHIP_GOVERNANCE_CONTRACT=
+
+# --- Backend / API (frontend → server) ---
+# Backend runs on port 4000 by default (`npm run dev:server` / CONTRIBUTING.md).
 VITE_SERVER_URL=http://localhost:4000
+# Optional override when the API is on a different origin; leave empty to derive from `VITE_SERVER_URL`.
 VITE_API_URL=
+# Relative API prefix used by some upload and scholar flows.
+VITE_API_BASE_URL=/api
+
+# --- Email (optional for local) ---
 RESEND_API_KEY=
 EMAIL_FROM=notifications@learnvault.xyz
 FRONTEND_URL=http://localhost:3000
-=======
-# LearnVault environment template for local development. Copy this file to `.env`.
-
-# Scaffold / local tooling
-STELLAR_SCAFFOLD_ENV=development # Scaffold Stellar environment profile used by local scripts and CLI commands.
-XDG_CONFIG_HOME=.config # Location where the Stellar CLI stores config files and identities on your machine.
-
-# Stellar network
-PUBLIC_STELLAR_NETWORK=TESTNET # Frontend Stellar network used by wallet and contract helpers.
-PUBLIC_STELLAR_NETWORK_PASSPHRASE="Test SDF Network ; September 2015" # Stellar Testnet passphrase required by the frontend contract client.
-PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org # Public Soroban RPC endpoint for Stellar Testnet.
-PUBLIC_STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org # Public Horizon endpoint for Stellar Testnet.
-
-# LearnVault contract IDs
-VITE_LEARN_TOKEN_CONTRACT_ID= # LearnToken contract ID set after deployment.
-VITE_GOVERNANCE_TOKEN_CONTRACT_ID= # Governance token contract ID set after deployment.
-VITE_SCHOLAR_NFT_CONTRACT_ID= # Scholar NFT contract ID set after deployment.
-VITE_COURSE_MILESTONE_CONTRACT_ID= # Course milestone contract ID set after deployment.
-VITE_SCHOLARSHIP_TREASURY_CONTRACT_ID= # Scholarship treasury contract ID set after deployment.
-VITE_MILESTONE_ESCROW_CONTRACT_ID= # Milestone escrow contract ID set after deployment.
-
-# USDC on Stellar Testnet
-VITE_USDC_CONTRACT_ID= # USDC contract ID used by frontend funding flows.
-
-# Legacy frontend aliases still read by older screens/hooks
-PUBLIC_LEARN_TOKEN_CONTRACT= # Legacy alias for the LearnToken contract ID.
-PUBLIC_GOVERNANCE_TOKEN_CONTRACT= # Legacy alias for the governance token contract ID.
-PUBLIC_SCHOLAR_NFT_CONTRACT= # Legacy alias for the Scholar NFT contract ID.
-PUBLIC_COURSE_MILESTONE_CONTRACT= # Legacy alias for the course milestone contract ID.
-PUBLIC_SCHOLARSHIP_TREASURY_CONTRACT= # Legacy alias for the scholarship treasury contract ID.
-PUBLIC_MILESTONE_ESCROW_CONTRACT= # Legacy alias for the milestone escrow contract ID.
-PUBLIC_SCHOLARSHIP_GOVERNANCE_CONTRACT= # Legacy governance/event contract ID used by profile and activity feeds.
-PUBLIC_USDC_CONTRACT_ID= # Legacy alias for the USDC contract ID used by the current USDC utility.
-
-# Backend API
-VITE_API_URL=http://localhost:3001 # Base URL for frontend requests to the LearnVault backend when it runs locally.
-VITE_API_BASE_URL=/api # Relative API prefix used by upload and scholar milestone pages in the frontend.
-VITE_SERVER_URL=http://localhost:3001 # Backward-compatible alias still read by the current comment UI.
 
-# IPFS / Pinata
-PINATA_API_KEY= # Pinata API key used for authenticated file uploads to IPFS.
-PINATA_SECRET= # Pinata API secret used for authenticated file uploads to IPFS.
-VITE_IPFS_GATEWAY_URL=https://gateway.pinata.cloud/ipfs # Optional public IPFS gateway override for displaying uploaded files.
->>>>>>> main
+# --- IPFS / Pinata (optional for uploads) ---
+PINATA_API_KEY=
+PINATA_SECRET=
+VITE_IPFS_GATEWAY_URL=https://gateway.pinata.cloud/ipfs

.github/workflows/build.yml

@@ -3,7 +3,35 @@ name: Build Project and Run Tests
 on:
   push:
     branches: ["main"]
+    paths:
+      - "src/**"
+      - "public/**"
+      - "e2e/**"
+      - "packages/**"
+      - "contracts/**"
+      - "scripts/**"
+      - "index.html"
+      - "package.json"
+      - "package-lock.json"
+      - "playwright.config.ts"
+      - "vite.config.ts"
+      - "Cargo.toml"
+      - "Cargo.lock"
   pull_request:
+    paths:
+      - "src/**"
+      - "public/**"
+      - "e2e/**"
+      - "packages/**"
+      - "contracts/**"
+      - "scripts/**"
+      - "index.html"
+      - "package.json"
+      - "package-lock.json"
+      - "playwright.config.ts"
+      - "vite.config.ts"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
 env:
   CARGO_TERM_COLOR: always
@@ -46,7 +74,6 @@ jobs:
         with:
           node-version: 22
       - run: npm ci --legacy-peer-deps
-      - run: npm run lint
       - run: npx prettier . --check
       - name: Database Migration Safety Check
         run: |

.github/workflows/bundle-size.yml

@@ -0,0 +1,33 @@
+name: Bundle Size Analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  size-limit:
+    name: Check Bundle Size
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Run size-limit analysis
+        uses: andresz1/size-limit-action@v1.8.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          skip_step: install
+          build_step: build

.github/workflows/contracts.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     branches:
       - main
+    paths:
+      - "contracts/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
 jobs:
   contract-tests: