[dev] [claudfuen] codex/ahrefs-docs-seo-fixes

[github-actions]

This is an automated pull request to merge codex/ahrefs-docs-seo-fixes into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Generates SEO-optimized public API docs with a new OpenAPI metadata and quality layer, and updates site content to improve search visibility and accuracy. Internal endpoints are removed from the published spec, a new API overview is added, and questionnaire/trust content is streamlined.

• New Features

  • Public OpenAPI metadata: human summaries/descriptions, tag details, SEO titles/descriptions, and optional code samples; applied during API bootstrap.
  • Public docs quality: excludes sensitive paths, prunes internal fields/unused schemas, and sets canonical title/description/server.
  • Docs: new API Reference overview, improved page titles/descriptions, and redirects for legacy URLs.

• Refactors

  • Replace generated spec with sanitized packages/docs/openapi.json; delete apps/api/packages/docs/openapi.json.
  • Update OpenAPI generation/tests; manual run via bunx jest.
  • Remove Trust Center questionnaire page and fold guidance into security-questionnaire and trust-access.

^{Written for commit c1df9a8. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	May 10, 2026 11:47pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		May 10, 2026 11:47pm
portal	Skipped		May 10, 2026 11:47pm

[cubic-dev-ai]

2 issues found across 24 files

Confidence score: 3/5

• There is a concrete regression risk in apps/api/src/main.ts: applyPublicOpenApiMetadata appears to overwrite document.servers with https://api.trycomp.ai, which can make local/staging Swagger UI point to the wrong backend and confuse or break environment-specific testing.
• apps/api/src/openapi/schema-pruning.ts has a documentation-quality risk: removing the whole enum when it includes secrets_info_disclosure strips valid public values from the schema, which can mislead API consumers even if runtime behavior is unchanged.
• Given a medium-severity, high-confidence environment-targeting issue plus another medium schema issue, this is mergeable with caution but carries some real user/developer impact if left as-is.
• Pay close attention to apps/api/src/main.ts and apps/api/src/openapi/schema-pruning.ts - server URL metadata and enum pruning behavior may unintentionally degrade public Swagger usability.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/main.ts">

<violation number="1" location="apps/api/src/main.ts:177">
P2: `applyPublicOpenApiMetadata` overwrites `document.servers` with a hardcoded production URL (`https://api.trycomp.ai`). Since the same `document` object is passed to `SwaggerModule.setup`, the local/staging Swagger UI will point to production instead of the environment-appropriate server. Consider applying the metadata to a deep copy for the written `openapi.json` file, or applying it only in the file-write branch.</violation>
</file>

<file name="apps/api/src/openapi/schema-pruning.ts">

<violation number="1" location="apps/api/src/openapi/schema-pruning.ts:111">
P2: Deleting the entire `enum` array when it contains one internal value (`secrets_info_disclosure`) removes all valid value documentation from the public schema. If the intent is to hide only that value, filter it out instead; if the intent is to suppress the entire check-type enum everywhere, consider adding a comment explaining the rationale.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P2: applyPublicOpenApiMetadata overwrites document.servers with a hardcoded production URL (https://api.trycomp.ai). Since the same document object is passed to SwaggerModule.setup, the local/staging Swagger UI will point to production instead of the environment-appropriate server. Consider applying the metadata to a deep copy for the written openapi.json file, or applying it only in the file-write branch.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/main.ts, line 177:

<comment>`applyPublicOpenApiMetadata` overwrites `document.servers` with a hardcoded production URL (`https://api.trycomp.ai`). Since the same `document` object is passed to `SwaggerModule.setup`, the local/staging Swagger UI will point to production instead of the environment-appropriate server. Consider applying the metadata to a deep copy for the written `openapi.json` file, or applying it only in the file-write branch.</comment>

<file context>
@@ -169,6 +174,8 @@ async function bootstrap(): Promise<void> {
     .build();
   const document: OpenAPIObject = SwaggerModule.createDocument(app, config);
 
+  applyPublicOpenApiMetadata(document);
+
   // Setup Swagger UI at /api/docs
</file context>

[cubic-dev-ai]

P2: Deleting the entire enum array when it contains one internal value (secrets_info_disclosure) removes all valid value documentation from the public schema. If the intent is to hide only that value, filter it out instead; if the intent is to suppress the entire check-type enum everywhere, consider adding a comment explaining the rationale.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/openapi/schema-pruning.ts, line 111:

<comment>Deleting the entire `enum` array when it contains one internal value (`secrets_info_disclosure`) removes all valid value documentation from the public schema. If the intent is to hide only that value, filter it out instead; if the intent is to suppress the entire check-type enum everywhere, consider adding a comment explaining the rationale.</comment>

<file context>
@@ -0,0 +1,126 @@
+    Array.isArray(record.enum) &&
+    record.enum.includes('secrets_info_disclosure')
+  ) {
+    delete record.enum;
+  }
+
</file context>