AUDIBLE3 VERIFIED SERVER UPDATE — 2026-08-07

UPLOAD TARGET
Extract the CONTENTS of this ZIP directly into the existing audible3.com Node
application root — the folder that already contains server.js, package.json,
.env, public/, database/, scripts/, server-data/, and tmp/.

PRESERVE — DO NOT DELETE OR REPLACE
1. .env
2. .htaccess (cPanel/hosting configuration)
3. .well-known/
4. server-data/ live JSON files and server-data/uploads/
5. Your live MySQL database

FILES THIS PACKAGE IS DESIGNED TO REPLACE
- server.js
- package.json
- database/mysql-store.js
- database/schema.sql
- scripts/check-mysql.js
- public/ application files listed in FILE-MANIFEST.txt

IMPORTANT FRONTEND ENTRYPOINT
public/index.html now loads public/app.js.
The ambiguous old filename royal-app-20260724.js is intentionally not used.

AFTER UPLOAD
1. Confirm .env still exists and still has your live MySQL/Stripe values.
2. Set NODE_ENV=production.
3. Confirm JWT_SECRET is a long random secret. The server refuses to start
   in production with the built-in placeholder.
4. In cPanel Setup Node.js App, verify Application Root is this audible3.com
   folder and Startup File is server.js.
5. Restart the Node application.
6. Visit /api/health and confirm ok:true and database:mysql.
7. Visit /?v=20260807-launch1 in a private browser window.
8. Visit /admin and verify admin authentication.

NODE MODULES
node_modules is intentionally not included. Your server already has it. The
package-lock.json from the uploaded archive was stale and did not include the
MySQL/dotenv dependencies, so it is intentionally not included in this update.
If you reinstall dependencies later, run npm install on the server to regenerate
a correct package-lock.json.

ADMIN BOOTSTRAP
Do not hard-code an admin password into public files. If needed, temporarily
set BOOTSTRAP_ADMIN_EMAIL and BOOTSTRAP_ADMIN_PASSWORD in .env, restart once,
verify login, then remove BOOTSTRAP_ADMIN_PASSWORD and restart again.

SECURITY INCLUDED
- Server-side admin role checks
- Password hashing
- JWT authentication
- Stripe webhook signature verification
- Protected full-audio media URLs
- Login/registration/message rate limiting
- Suspicious IP scoring and temporary blocking
- Honeypot bot detection
- Disposable email-domain checks
- URL/email/spam-format rejection in public messages
- Security headers and CSP
- No-cache headers for HTML/CSS/JS updates

VERSION CHECK
After restart, open /version.json. It must show build 2026-08-07-launch1.