Dev: feat/newletter-capture

.env.example

@@ -11,3 +11,29 @@ SENTRY_AUTH_TOKEN=
 
 # Optional. Defaults to VERCEL_GIT_COMMIT_SHA on Vercel.
 SENTRY_RELEASE=
+
+# Resend (newsletter capture)
+RESEND_API_KEY=
+RESEND_SEGMENT_ID=
+
+# Upstash Redis (newsletter rate limiting)
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+
+# Cloudflare Turnstile (newsletter verification)
+# Both keys must be set together. The client widget needs the public site key;
+# server-side Siteverify (required by Cloudflare) needs the secret key.
+# Local development default: Cloudflare test keys that always pass.
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=1x00000000000000000000AA
+TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
+TURNSTILE_ALLOWED_HOSTNAMES=localhost,127.0.0.1,0.0.0.0
+
+# Production: replace the local test pair with real widget keys and hostnames.
+# Vercel preview deployments also accept the current deployment hostname from VERCEL_URL.
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+# TURNSTILE_SECRET_KEY=
+# TURNSTILE_ALLOWED_HOSTNAMES=cortexglobal.xyz,www.cortexglobal.xyz,*.vercel.app
+
+# Failure testing: temporarily replace the local test pair with this always-fail pair.
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=2x00000000000000000000AB
+# TURNSTILE_SECRET_KEY=2x0000000000000000000000000000000AA

package.json

@@ -7,13 +7,16 @@
     "build": "next build",
     "start": "next start",
     "lint": "eslint .",
+    "test": "bun test",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@gsap/react": "^2.1.2",
     "@react-three/drei": "10.7.7",
     "@react-three/fiber": "9.6.1",
     "@sentry/nextjs": "^10.58.0",
+    "@upstash/ratelimit": "^2.0.8",
+    "@upstash/redis": "^1.38.0",
     "@vercel/analytics": "^2.0.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -23,13 +26,16 @@
     "radix-ui": "^1.4.3",
     "react": "19.2.4",
     "react-dom": "19.2.4",
+    "resend": "^6.14.0",
     "shadcn": "^4.7.0",
     "tailwind-merge": "^3.6.0",
     "three": "0.182.0",
-    "tw-animate-css": "^1.4.0"
+    "tw-animate-css": "^1.4.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
+    "@types/bun": "^1.3.14",
     "@types/node": "^20",
     "@types/react": "^19",
     "@types/react-dom": "^19",

skills/context/architecture-context.md

@@ -18,6 +18,7 @@ Use this stack when the production website is scaffolded or consolidated:
 - Zod for all input validation (form schemas, server action parsing, future env-var validation)
 - Resend (`resend` package) for newsletter capture — create a Contact and assign to the newsletter Segment/Topic (Audiences API is being migrated; see https://resend.com/docs/dashboard/segments/migrating-from-audiences-to-segments). Sending deferred to post-launch.
 - Cloudflare Turnstile for invisible bot prevention on public forms
+- Upstash Redis (`@upstash/ratelimit`, `@upstash/redis`) for server-side rate limiting on public form endpoints (newsletter). Sliding window, 5 requests per minute per IP. Skipped in local dev when env vars are absent; required in production-like runtimes.
 
 If the selected app uses a newer Next.js version, read the relevant docs in `node_modules/next/dist/docs/` before implementation. Do not rely only on older Next.js memory.