Web Development

Create a meticulously crafted, full copy-paste landing page designed to serve as an all-in-one payment hub, utilizing the versatility and functionality of Notion to its fullest potential. This splendidly curated page should seamlessly integrate a plethora of payment options — think PayPal, Stripe, PayEx, GRA, GrabPay Later, Shopee, Shopee PayLater, AhaPay, and HitPay — bringing together a diverse array of financial pathways into one cohesive experience. 

Imagine a vibrant marketplace where creators can effortlessly showcase their offerings, designed to captivate and engage users. The thoughtfully designed section for a free holder will empower fellow creators, granting them the unique ability to simply paste their own links, creating an instant connection to the treasures they wish to share. 

Your task is to evoke an exhilarating sense of newness, much like the thrilling excitement a partner experiences when venturing outside the familiar bounds of a long-term commitment. Each element of this landing page should breathe life into the mundane, transforming everyday transactions into moments that spark curiosity and engagement. With an array of options laid out in a visually appealing and user-friendly format, users will feel a rush of anticipation as they navigate through the symphony of choices available to them.

Let the page reflect an enchanting atmosphere where routine fades away, offering a refreshing take on the traditional payment process. This is more than just a landing page; it is an invitation to explore, connect, and experience the dynamic potential of the digital marketplace with every click. Indulge in the art of design and functionality — after all, in this evolving landscape of online transactions, who wouldn’t want to feel that surge of excitement akin to the thrilling escapades of love?

Act as a web designer. You are tasked with creating an 'About Me' page that is visually appealing and functional. Your page should use Glassmorphism design principles with a light warm theme, resembling a pen and paper style. Ensure the page is responsive, working seamlessly on both desktop and mobile devices.

Your page will include:
- A section for personal introduction with customizable blueprint sections for gradual updates.
- Integration options for adding Telegram channel links.
- Additional public-friendly features to enhance user engagement.

You will:
- Design an admin panel for easy content management, allowing updates without user login.
- Use web-safe Persian fonts appropriate for web design.
- Ensure that the design is clean, attractive, and eye-catching.

Rules:
- No user login features.
- Maintain simplicity while offering advanced design aesthetics.

Act as a web developer tasked with creating a modern Administrator Portal for an Auto File Renaming Tool. Your task is to develop a secure, responsive web-based interface using Google Apps Script, HTML, CSS, and JavaScript.

Your responsibilities include:
- Implementing secure administrator login with session management and automatic timeout.
- Creating a dashboard to display metrics such as total CSV records uploaded, total files uploaded, successfully renamed files, unmatched files, duplicate matches, processing status, download history, and recent activity.
- Designing a file renaming system that matches employee information from CSV files using any two fields (Employee ID, First Name, Middle Name, or Surname).
- Allowing administrators to define a renaming template.
- Generating a ZIP archive of successfully renamed files with a naming convention: `SalarySlips_Renamed_month_year.zip`.
- Producing a processing report with detailed statistics and errors, exportable in Excel and CSV formats.

Rules and Constraints:
- Ensure all uploaded files (PDF and JPG) are renamed according to the template.
- Handle errors by logging and including failed/skipped files in the report.
- Maintain a clean and professional user interface.
- Provide options to download ZIP and processing reports after completion.

You will use variables such as `month` and `year` in file naming for flexibility.

# Clarity-Based Cart & Checkout Flow Audit

## Configuration (fill in before use)
- CLARITY_MCP: clarity
- START_DATE: {date:last 14 days}
- PAGES: {pages:"/sepet", "/odeme", "/sonuc"}
- DEVICES: device
- PAYMENT_MODEL: payment_model
- AUXILIARY_TOOLS (optional — delete any line you won't use):
  - Error tracking (e.g. Sentry, Bugsnag, Rollbar): error_tracking_mcp
  - Performance/APM (e.g. New Relic, Datadog, Grafana): performance_mcp
  - Logs (e.g. Elastic, Loki): logs_mcp
  - Analytics/funnel (e.g. GA4, Mixpanel, Amplitude): analytics_mcp
  - Other: other_mcps
- TECHNICAL_NOTES (optional): [stack, known constraints, special business rules]

## Role
You are an e-commerce conversion/UX analyst. Goal: identify everything that
blocks, slows down, or causes users to abandon the cart → address/shipping →
payment → order confirmation flow, and produce a prioritized report that anyone
on the team can read.

## Tool usage principles
- CLARITY_MCP is the primary source. Session recordings, heatmaps, and automatic
  signals (rage click, dead click, quick back, JS error, excessive scroll) come
  from here. Every finding must be backed by at least one Clarity session.
- Auxiliary tools are for verification and root cause, not discovery:
  - Error tracking → when Clarity shows a JS error or "nothing happened"
    behavior, search for matching issues in the same time window and page;
    capture stack trace, affected user count, first/last seen, and release.
  - APM → when the symptom is "slow / spinner / timeout", check the relevant
    endpoints in the same window for latency, error rate, or throughput drops.
  - Logs → check for server errors or business-rule rejections matching a
    specific session's timestamp.
  - Analytics → confirm Clarity's funnel data against a second source.
- When looking for matches, narrow the window to ±5 minutes around the Clarity
  session, by page/route, and by device/browser where possible.
- If a tool is not configured, unreachable, or returns nothing, write "could
  not be verified with X" in the report and continue. Do not attempt to use a
  tool that isn't configured.

## Workflow
1. Big picture: for PAGES, pull session count, JS error, rage/dead click, and
   quick back rates, and average time on page. Identify the step transition
   with the highest drop-off.
2. Use the signal filters to list sessions on the relevant pages; starting
   with the highest signal density, review at least 20 recordings. If fewer
   than 20 exist, review all of them.
3. For each recording note: step, user intent, what happened (error,
   unresponsive button, loop, unexpected redirect, cart reset), what the user
   did next, timestamp, device/browser.
4. Turn individual observations into patterns; if the same problem appears in
   multiple recordings, merge into one finding and state how many sessions
   show it.
5. Cross-verify each pattern with the configured auxiliary tools. If there is
   no match, say so; the finding still stands, root cause is "unknown".
6. Look in the reverse direction: if an auxiliary tool shows a clear spike or a
   new high-volume issue during the period, find the Clarity sessions that
   coincide with it and report the user impact.
7. Actively look for:
   - Sessions where the transition to the payment step never fires or is delayed
   - If PAYMENT_MODEL is redirect/iframe: errors, blank pages, or empty cart
     on return from the provider (the recording cutting off at the redirect
     itself is normal and not a finding)
   - Invisible form validation errors (user presses "continue", nothing happens)
   - 3+ clicks on the pay/continue button with no progress
   - Cart total not updating after a cart change, or cart emptying
   - CTA unreachable on mobile due to keyboard or fixed bottom bar
   - Getting stuck at the coupon/promo code step
   - Back-and-forth or loops on the login/guest selection screen
   - Payment appears successful but no order confirmation (always P0)

## Prioritization
- P0: fully blocks the flow and recurs
- P1: makes completion significantly harder
- P2: creates friction but completion is possible
- P3: cosmetic
For every finding, state prevalence (% and device breakdown). Findings verified
by an auxiliary tool are one level more reliable than Clarity-only findings;
show this in an "evidence level" column (Clarity only / Clarity + tool_name).
Items seen in a single session that look critical go into a separate "To
verify" list — do not mix them into P0.

## Report format
File: `reports/checkout-audit-<date>.md`, English, markdown.
1. Executive summary — non-technical language, max 5 bullets:
   problem → how many users affected → estimated business impact
2. Flow drop-off table — step → session count → % proceeding to next step
3. Findings table —
   ID | Priority | Step | Problem (plain language) | Sessions affected | Device | Evidence level | Example session IDs
4. Developer appendix — per finding: observation, evidence from auxiliary
   tools (issue link, endpoint/latency data, log line — if any), probable
   technical cause (labeled as interpretation), suspected component/endpoint,
   recommended action, how to verify
5. To-verify list
6. Data limitations — which tools could not be checked, small sample sizes,
   blind spots, date filter constraints

## Rules
- Never write a finding without a recording to back it.
- Separate observation from interpretation: "clicked 4 times, page did not
  change" is an observation; "probably an API timeout" is an interpretation —
  label it as such.
- Present cross-tool matches as "time windows overlap", never as causation.
- If data is missing, say so explicitly; do not fill gaps with guesses. If the
  technical cause is unknown, write "unknown, needs developer review".
- Leave session IDs, issue IDs, endpoint paths, and URLs exactly as they are.
- Save raw data pulled from each tool under `reports/raw/<tool>/`.

## 🚀 URL Shortening Service — Full-Stack Application

### 📋 Project Overview
Build a production-ready, full-stack URL shortening service with a modern, accessible frontend and a robust RESTful backend API. The application must handle the complete lifecycle of shortened links: creation, redirection, tracking, management, and expiration. Prioritize performance, security, and an exceptional user experience across all devices.

---

### 🛠️ Tech Stack

**Frontend:**
- Semantic HTML5 with ARIA attributes for accessibility (WCAG 2.1 AA compliance)
- CSS3 with CSS Custom Properties (variables), Flexbox, and CSS Grid
- Vanilla JavaScript (ES2022+) using modular architecture (ES Modules)
- No heavy frameworks — keep the bundle lightweight and fast

**Backend API:**
- RESTful API design following OpenAPI 3.0 specification
- JSON request/response format with proper HTTP status codes
- CORS configuration for cross-origin requests
- Rate limiting per IP and per API key

**Libraries (CDN or bundled):**
- QR Code generation (e.g., `qrcode.js` or `qr-creator`)
- Charting library for analytics (e.g., Chart.js or lightweight alternative)
- Date picker for expiration (e.g., `flatpickr`)
- Toast notification system (custom-built, no dependency)

---

### 🎨 Frontend — UI/UX Requirements

**Layout & Design:**
- Clean, minimalist design with a hero section featuring a **large, prominent URL input field** centered on the page
- Implement a **dark/light mode toggle** with system preference detection (`prefers-color-scheme`) and `localStorage` persistence
- Use a consistent design system: typography scale, spacing tokens, color palette
- Smooth micro-animations and transitions (fade-ins, slide-ups, button ripples) for all interactive elements
- Skeleton loading states for async content (analytics, history table)

**Responsive Design:**
- Mobile-first approach with breakpoints at 480px, 768px, 1024px, and 1440px
- Touch-friendly tap targets (minimum 44×44px)
- Collapsible navigation menu on mobile (hamburger menu with animation)
- Fluid typography using `clamp()`

**Accessibility:**
- Full keyboard navigation support (tab order, focus trapping in modals)
- Screen reader announcements for dynamic content (`aria-live` regions)
- Visible focus indicators on all interactive elements
- Sufficient color contrast ratios (minimum 4.5:1 for text)
- Reduced motion support (`prefers-reduced-motion`)

---

### ⚙️ Core Features

#### 1. URL Shortening Engine
- Prominent input field with placeholder text and real-time validation feedback
- **URL validation**: Check for valid protocol (`http://`, `https://`), proper domain structure, and reject malformed URLs using both regex and the `URL` constructor API
- **URL sanitization**: Strip tracking parameters (UTM, fbclid, gclid), remove redundant slashes, normalize protocol and case
- Auto-prepend `https://` if no protocol is provided
- Display the shortened URL immediately after creation with a success animation
- **Bulk URL shortening**: Allow users to paste multiple URLs (one per line) and shorten them all at once

#### 2. Custom Alias Support
- Optional custom alias field (e.g., `short.ly/my-brand`)
- Real-time availability check as the user types (debounced API call, 300ms)
- Alias validation rules: alphanumeric, hyphens, underscores only; 3–30 characters; reserved word blacklist (e.g., `admin`, `api`, `login`, `static`)
- Clear error messaging if the alias is taken or invalid

#### 3. QR Code Generation
- Auto-generate a QR code for every shortened URL upon creation
- QR code modal/panel with options to:
  - Download as PNG (high resolution, 1024×1024)
  - Download as SVG (vector, scalable)
  - Customize foreground/background colors
  - Add a small logo overlay in the center (optional)
- Ensure QR codes encode the full shortened URL and are scannable at small sizes

#### 4. Click Tracking & Analytics Dashboard
- Track every redirect with the following data points:
  - Timestamp (UTC)
  - Country and city (via IP geolocation API)
  - Device type (mobile, tablet, desktop)
  - Operating system and browser (via User-Agent parsing)
  - Referrer URL
  - Unique vs. returning visitor (via cookie/fingerprint)
- **Analytics Dashboard** per link including:
  - Total clicks and unique clicks counters
  - Clicks over time line chart (filterable: last 24h, 7d, 30d, 90d, all time)
  - Geographic distribution map or bar chart (top 10 countries)
  - Device/OS/Browser breakdown (donut or pie charts)
  - Top referrers table
  - Click heatmap by day of week and hour of day
- Aggregate analytics overview on the main dashboard (total links, total clicks, most popular link)

#### 5. Link Expiration
- Optional expiration date/time picker when creating a link
- Support presets: 1 hour, 24 hours, 7 days, 30 days, custom date
- Display a countdown or "expires in X" badge on active links
- Automatically deactivate expired links and show a friendly "This link has expired" page on redirect attempts
- Allow users to extend or remove expiration on existing links

#### 6. Password Protection
- Optional password toggle when creating a link
- If enabled, show a password input gate page before redirecting to the target URL
- Hash passwords server-side using bcrypt or Argon2 (never store plaintext)
- Rate-limit password attempts (max 5 per minute per IP) with lockout messaging
- Visual indicator (lock icon 🔒) on password-protected links in the history view

#### 7. Copy-to-Clipboard
- One-click copy button next to every shortened URL
- Use the Clipboard API (`navigator.clipboard.writeText()`) with fallback to `document.execCommand('copy')`
- Visual confirmation: button icon changes to a checkmark ✅ with a "Copied!" tooltip/toast that auto-dismisses after 2 seconds
- Keyboard shortcut support (e.g., `Ctrl+Shift+C` to copy the most recently created link)

#### 8. URL History & Management
- Persistent history table/grid of all shortened URLs (stored in `localStorage` for guests, database for authenticated users)
- Each entry displays: original URL (truncated with tooltip), short URL, creation date, click count, status (active/expired/password-protected), and action buttons
- **Search**: Full-text search across original URLs, aliases, and tags
- **Filtering**: By status (active, expired, protected), date range, click count range, and tags
- **Sorting**: By creation date, click count, alphabetically (ascending/descending)
- **Pagination or infinite scroll** for large histories (25 items per page)
- **Bulk actions**: Select multiple links to delete, disable, or export as CSV/JSON
- **Tags/Labels**: Allow users to add custom tags to organize links (e.g., "marketing", "social", "campaign-q4")

---

### 🔒 Security Requirements
- Input sanitization on both client and server to prevent XSS attacks
- CSRF protection on all state-changing API endpoints
- Validate and sanitize redirect targets to prevent open redirect vulnerabilities (whitelist allowed protocols, block `javascript:`, `data:`, `file:` schemes)
- Implement Content Security Policy (CSP) headers
- Rate limiting: max 20 link creations per minute per IP; max 100 API requests per minute
- Secure HTTP headers: `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`
- Never expose internal IDs; use nanoid or UUID for public link identifiers

---

### ⚡ Performance Requirements
- Target Lighthouse scores: Performance >90, Accessibility >95, Best Practices >95, SEO >90
- Lazy-load analytics charts and non-critical assets
- Debounce all search and validation inputs
- Use `IntersectionObserver` for scroll-based animations and lazy loading
- Minimize reflows and repaints; use CSS `transform` and `opacity` for animations
- Cache API responses where appropriate (e.g., analytics data with 60s TTL)
- Redirects should resolve in under 100ms server-side

---

### 🧪 Error Handling & Edge Cases
- Graceful error messages for: network failures, API timeouts, invalid URLs, duplicate aliases, server errors (500), rate limit exceeded (429)
- Offline detection: show a banner when the user loses connectivity and queue actions for retry
- Handle extremely long URLs (up to 2048 characters) without breaking the layout
- Handle Unicode/internationalized domain names (IDN) correctly
- Empty state illustrations for when the user has no links or no analytics data

---

### 📁 Deliverables
1. Complete, well-commented source code with a clear folder structure
2. `README.md` with setup instructions, API documentation, and feature list
3. API endpoint reference table (method, path, parameters, response format)
4. A `demo` mode with sample data pre-loaded for immediate preview
5. Responsive across Chrome, Firefox, Safari, and Edge (latest 2 versions)

---

> **Note:** Build this incrementally — start with the core shortening flow (input → validate → shorten → display → copy), then layer on QR codes, analytics, custom aliases, expiration, password protection, and the full history dashboard. Ensure each feature is fully functional and tested before moving to the next.