vibeboard

# vibeboard - expanded map

> vibeboard is an open-source (MIT) platform for running conferences and events end to end: publish a call for papers, collect and review submissions, decide, onboard speakers, build the schedule, and publish the public event site. This file is the long form of https://vibeboard.io/llms.txt - the same surfaces, with the field names, statuses, and response shapes an agent needs to actually operate the product.

Live app: https://vibeboard.io | Source: https://github.com/RRaphaell/vibeboard

## How the product is organised

Everything belongs to an **event**, addressed by a URL slug.

| URL shape | Who | What |
|---|---|---|
| `/` | anyone | landing page |
| `/login`, `/register`, `/invite` | anyone | authentication; `/login` also carries one-click demo role cards when a demo event exists |
| `/events` | signed in | every event you're a member of, plus "create event" |
| `/e/<event-slug>/...` | organizer / reviewer | the admin app |
| `/submit/<event-slug>` | anyone | the public call-for-papers wizard (primary form) |
| `/submit/<event-slug>/<form-id>` | anyone | a specific CFP form, when an event runs more than one |
| `/portal`, `/portal/profile`, `/portal/submissions/<id>` | speaker | the speaker portal |
| `/<event-slug>/...` | anyone | the public event site |
| `/api/v1/...` | API key | read-only REST API |

Roles are per event: **organizer** (everything), **reviewer** (only their own review queue), **speaker** (only their own submissions, profile, and tasks). A reviewer who opens an organizer-only page gets a branded 403, not a redirect loop.

## The lifecycle, in order

1. **Configure** - `/e/<slug>/settings`: event name, dates, timezone, location; tracks; rooms; session formats with default durations; team members and their roles.
2. **Build the CFP** - `/e/<slug>/forms`. A form has a name, a public title, welcome text, a custom success message, open and close dates (interpreted in event time), an optional per-speaker submission cap, and an open/closed status. Fields live in two sections, `submission` and `participant`, and come in nine types: `text`, `textarea`, `richtext`, `dropdown`, `checkbox`, `email`, `phone`, `url`, `file`. Each field has a label, help text, a required flag, options where relevant, and optional conditional logic ("show this only when field X equals Y"). Title, description, first name, last name, and email are locked core fields - their labels are editable, the fields themselves cannot be removed.
3. **Collect** - speakers fill `/submit/<slug>`. The wizard is Welcome -> Session Information -> Speaker Information -> Account -> Review. The form comes *before* the account step, so nothing is gated behind sign-up. Drafts save with just a title and resume on return. On submit the speaker gets a confirmation email that doubles as their portal invite, and the proposal appears in the admin app with status `pending`.
4. **Review** - `/e/<slug>/review`. Each round has its own scorecard built from criteria of kind `numeric`, `dropdown`, or `text`, each with a weight. Assign reviewers by hand, in bulk filtered by track with a per-reviewer cap, or auto-distribute. Reviewers see only their assignments, unreviewed first, and can declare a conflict of interest. Results are weighted aggregates, sortable, exportable as CSV. Rounds can be anonymized.
5. **Decide** - from `/e/<slug>/submissions`. The decision dialog states its consequences before you confirm ("Accepting spawns onboarding tasks and emails the speaker with a calendar invite"). "Notify speaker now" defaults on; switch it off to decide quietly and send the queued decision emails later in one batch. `maybe` never emails anyone. Accepting spawns onboarding tasks for the primary speaker and every co-speaker.
6. **Onboard** - `/e/<slug>/tasks` and `/e/<slug>/speakers`. Task states are `Incomplete` / `Complete`; tasks can require a file upload; overdue tasks surface on the dashboard with one-click nudges, and a daily cron sends an overdue digest (opt-out per event).
7. **Schedule** - `/e/<slug>/agenda`. Day x room grid. Drag accepted talks from the unscheduled tray, or click a talk then click a slot (both paths work; the click path is keyboard- and automation-friendly). Dropping a session sets its end time from the format's default duration. Conflicts - same room overlapping, same speaker in two overlapping sessions - recompute on every move and show both as a banner and as red cells. Nothing is emailed while you build: schedule changes queue behind an explicit "Notify speakers" button, which sends one calendar update per speaker with a bumped `SEQUENCE`.
8. **Publish** - publishing the agenda is an explicit action. Public pages and feeds read the same database, so there is no export or republish step. Session content has its own approval gate: only approved sessions appear publicly.
9. **Distribute** - `/e/<slug>/embeds` gives you the JSON feed, the iCal feed, and a one-line `<script>` embed for your own site, each filterable by track and format, with a configurable accent color.

## Statuses and vocabulary

- Submission status: `draft`, `pending`, `maybe`, `accepted`, `declined`, `withdrawn`. Speakers see `maybe` as a neutral in-review state, never the word.
- Session content status: `draft`, `approved`. Only `approved` content reaches public pages.
- Review criterion kinds: `numeric`, `dropdown`, `text`.
- CFP field types: `text`, `textarea`, `richtext`, `dropdown`, `checkbox`, `email`, `phone`, `url`, `file`.
- CFP field sections: `submission`, `participant`.
- Session codes shown in the UI and API are `SESS-<n>`, per-event sequential; the CFP list shows them as `SUB-<n>`.

## Emails

Templates are per event and editable at `/e/<slug>/emails`, with merge tags such as `{{speaker_name}}`, `{{talk_title}}`, `{{event_name}}`, `{{portal_link}}`. The set covers submission confirmation (which carries the portal link), accepted, declined, task reminders, draft reminders before the form closes, and schedule updates. Every send is logged and idempotent - the same decision cannot double-send. Acceptance emails carry a real `.ics` invite (`METHOD:REQUEST`); rescheduling sends a `SEQUENCE`-bumped update that calendar clients treat as an update rather than a duplicate. Bulk email goes out from `/e/<slug>/compose` with per-recipient preview.

## Public event site

`/<event-slug>` redirects to `/<event-slug>/sessions`, preserving `?track=`, `?format=`, and `?accent=` so shared embed links survive the hop.

- `/<slug>/sessions` - searchable list, filters by track, format, and room.
- `/<slug>/speakers` - alphabetical directory with bios.
- `/<slug>/agenda` - published day x room schedule.
- `/<slug>/itinerary` - attendees pick sessions and export a personal `.ics`.
- `/<slug>/gallery` - speaker photo grid.
- `/<slug>/feed.json` - machine-readable schedule. Query: `track`, `format` (id or case-insensitive name). Before the agenda is published it returns `{"published": false, "sessions": []}` with HTTP 200. Otherwise `{event, published, generatedAt, sessions[]}` where each session has `id`, `code`, `title`, `descriptionHtml`, `track`, `format`, `room`, `startsAt`, `endsAt`, `speakers[]`.
- `/<slug>/feed.ics` - the same schedule as an iCalendar file.
- `/<slug>/embed.js` - a `<script src>` that renders the schedule into the host page. Query: `track`, `format`, `accent` (hex, URL-encoded - the value is sanitized to a hex literal before it reaches any style).

## REST API v1

Read-only. Base: `https://vibeboard.io/api/v1`.

**Auth.** Create a key at `/e/<slug>/settings/api`. It is displayed once; only a SHA-256 hash is stored, and revoking takes effect immediately. Send it as `Authorization: Bearer <key>`. A key is bound to exactly one event and every query filters by that event, so a foreign id returns the same `404` as a nonexistent one - there is no existence oracle.

**Conventions.** JSON only. `GET` and `OPTIONS` only; anything else returns `405` with an `Allow` header. CORS is `*` (the token is the credential; no cookies are involved). Timestamps are ISO-8601 UTC strings. Successful bodies are `{"data": ...}`, list bodies add `{"pagination": {"limit","offset","total","hasMore"}}`. `limit` defaults to 50 and caps at 100. Errors are `{"error": {"code","message"}}` with codes `missing_token`, `invalid_token`, `key_revoked`, `not_found`, `invalid_parameter`, `rate_limited`, `method_not_allowed`. The limit is 120 requests per minute; exceeding it returns `429` with `Retry-After`.

| Endpoint | Returns |
|---|---|
| `GET /api/v1` | endpoint directory - the only route that needs no key |
| `GET /api/v1/event` | `id`, `slug`, `name`, `description`, `location`, `timezone`, `startsAt`, `endsAt`, `agendaPublished`, timestamps |
| `GET /api/v1/sessions` | submissions, ordered by session number. Query: `status` (one of the statuses above; drafts are excluded unless asked for explicitly), `track` and `format` (id or case-insensitive name; an unknown value yields an empty page, not an error), `limit`, `offset` |
| `GET /api/v1/sessions/{id}` | one submission with `code`, `title`, `descriptionHtml`, `status`, `contentStatus`, `track`, `format`, `room`, `startsAt`, `endsAt`, `speakers[]` |
| `GET /api/v1/speakers` | roster: `name`, `firstName`, `lastName`, `email`, `company`, `title`, `bio`, `status`, `links[]`, plus each speaker's `sessions[]`. Query: `limit`, `offset` |
| `GET /api/v1/speakers/{id}` | one speaker, same shape |
| `GET /api/v1/schedule` | `{published, timezone, days[]}` where each day has `date`, `label`, and `sessions[]`. Returns `published: false` with an empty `days` array until the agenda is published |

Example:

```
curl "https://vibeboard.io/api/v1/sessions?status=accepted&track=AI%20Engineering&limit=20" \
  -H "Authorization: Bearer <key>"
```

## Demo event

Sign in at https://vibeboard.io/login with the one-click role cards, or with `admin@demo`, `reviewer@demo`, or `speaker@demo` and the password `demo-demo-demo`. The seeded event is `ai-builders-summit-2026`: 49 submissions across three tracks, a review round with real scores, a partly built schedule containing one deliberate room conflict, and speakers who are behind on onboarding tasks. Anyone can also create a fresh event from `/events` - the CFP form, review round, and email templates are seeded automatically.

## Self-hosting

vibeboard runs on Cloudflare Workers with D1 (SQLite) and R2. Clone the repo, `pnpm install`, `pnpm db:migrate:local`, `pnpm seed`, `pnpm dev`. To deploy, create your own D1 database and R2 bucket, point `wrangler.jsonc` at them, set the `RESEND_API_KEY` secret for outbound email, and run `pnpm run deploy`. Full instructions are in the README: https://github.com/RRaphaell/vibeboard

## Stack

Cloudflare Workers (edge SSR, Smart Placement next to the database) | React Router v8 framework mode | D1 via Drizzle ORM | R2 for uploads | Resend for email plus a hand-rolled `.ics` builder | Tailwind CSS v4 | zod | TypeScript | Vitest running inside workerd against real D1 semantics | Playwright for end-to-end tests. MIT licensed.