Release 3.1.0 (#1185)

* Phase 0 — NestJS + Zod foundation harness (F1–F8) (#1050)

Co-hosted NestJS app behind the existing Express server via a strangler-fig dispatcher, sharing the same better-sqlite3 connection and JWT httpOnly cookie. Additive and dormant: default routing stays on Express, Nest only serves its own /api/_nest diagnostics until a module opts in.

F1 @trek/shared Zod contract package; F2 Nest bootstrap co-hosted (fall-through, single Dockerfile/port); F3 shared better-sqlite3 provider; F4 JWT cookie auth guard (+ @CurrentUser, admin guard); F5 Zod validation pipe + error-envelope parity; F6 Nest test + coverage gates; F7 per-prefix strangler toggle (env, default Express); F8 CI build/typecheck/test/coverage.

Remaining F4/F6/F8 checklist items (trip-access + permission levels + MFA policy, e2e harness/seed + 80% gate, Nest↔Express parity test, Playwright PR-comment workflow) are tracked on the first consuming module cards (L1/A1/C1).

* feat(weather): migrate /api/weather to the NestJS pilot module (L1) (#1053)

First strangler migration (L1): /api/weather is served by a NestJS module.

- @trek/shared/weather Zod contract; Nest controller byte-identical to the legacy Express route (paths, query params, status codes, { error } bodies, lang default, ApiError/500 passthrough). Service reuses getWeather/getDetailedWeather (+ shared cache; MCP tools unchanged).
- Strangler routes /api/weather to Nest by default; the legacy Express route + its migration-time parity test were decommissioned in this PR.
- Frontend (FE2): weatherApi typed against the @trek/shared WeatherResult contract.
- Harness: reusable Nest-vs-Express parity harness, e2e harness (temp SQLite + seed/cookie helpers, real JwtAuthGuard), src/nest coverage gate raised to >=80%, src/nest test guide.
- Verified end-to-end on a prod mirror (dev1): 401/400/200 via Nest with real Open-Meteo data, Express route gone.

* fix(packing): multiply item weight by quantity in bag/total weight calcs (#898)

Quantity now counts toward bag and total weights. Generalised to an itemWeight() helper used by every weight sum (bag totals + max, unassigned, grand total; sidebar + bag modal) with unit tests.

* feat(i18n): add Korean (ko) translation (#977)

Korean translation by @ppuassi, topped up to full en.ts key parity. Language registration follows separately.

* feat(i18n): add Japanese (ja) translation (#829)

Japanese translation by @soma3978, at full en.ts key parity, registered in supportedLanguages + TranslationContext.

* Add Turkish (tr) translation + language registry (#1029)

Turkish translation by @SkyLostTR, at full en.ts key parity, registered in supportedLanguages + TranslationContext.

* i18n: register Korean + add Ukrainian translation (#1055)

Korean translation by @ppuassi (#977) — now registered. Ukrainian by @JeffyOLOLO (#902) — lifted onto a clean branch. Both at full en.ts key parity (2258 keys).

* chore: fix monorepo build pipeline and migrate shared to built package (#1056)

* chore: fix monorepo build pipeline and migrate shared to built package

- Root package.json: add workspace scripts (dev, build, test, test:cov, test:e2e)
  that delegate to actual scripts in shared/server/client workspaces
- shared: add tsup build step (CJS + ESM dual output, .d.ts); consumers now import
  from the built dist instead of raw TS source via path aliases
- server: replace tsc-alias with tsconfig-paths (tsc-alias mangled node_modules
  paths); fix MCP SDK path aliases to point to root node_modules (../node_modules)
- server/scripts/dev.mjs: delay node --watch until tsc -w signals first-pass done,
  eliminating the spurious restart on every dev startup
- client/vite.config.js + vitest.config.ts: remove @trek/shared path alias (no longer
  needed now that shared is a proper package)
- Consolidate package-lock.json at the workspace root; drop per-workspace lock files

* chore: fix test script to reflect root package.json

* chore: add missing lint and prettier script in root package.json

* fix(ci): build shared before tests; fix vitest MCP SDK alias paths

vitest.config.ts aliases pointed at ./node_modules/ (server-local) but
packages are hoisted to the root node_modules/ in the npm workspace —
changed to ../node_modules/.

CI jobs now install and build shared before running server/client tests
so that @trek/shared's dist/ exists when vitest resolves the package.

* fix(docker): update Dockerfile and CI for monorepo workspace structure

Dockerfile:
- Add shared-builder stage that produces @trek/shared dist before
  client and server stages need it
- Each build stage carries root package.json + package-lock.json so npm
  can resolve @trek/shared as a workspace dependency
- Production stage installs via workspace context (npm ci --workspace=server
  --omit=dev) so node_modules/@trek/shared symlinks to shared/dist correctly
- Copy server/tsconfig.json into the image so tsconfig-paths/register can
  find the MCP SDK path aliases at runtime
- CMD cds into /app/server before starting node so tsconfig-paths baseUrl
  resolves and ../node_modules points to /app/node_modules
- Remove mkdir for /app/server (now a real dir); keep symlinks for uploads/data

docker.yml version-bump:
- Replace manual per-workspace cd+npm-version calls with single:
  npm version --workspaces --include-workspace-root --no-git-tag-version
  (mirrors the version:* scripts in root package.json)
- git add now references root package-lock.json; adds shared/package.json

.dockerignore: add shared/dist
package.json: fix version:prerelease preid (alpha → pre)

* fix(tests): use in-memory SQLite per worker in test mode

vitest pool:forks spawns parallel worker processes that all called
initDb() on the same data/travel.db, causing SQLite "database is locked"
and "duplicate column name" races.

When NODE_ENV=test each fork now gets an isolated :memory: DB so migrations
run independently with no file contention.

* chore(ci): add ACT guards to skip DockerHub steps in local act runs

act sets ACT=true automatically. Guards added:
- docker login: if: ${{ !env.ACT }}
- build outputs: type=docker (local load) when ACT, push-by-digest when CI
- digest export/upload: if: ${{ !env.ACT }}
- merge job: if: ${{ !env.ACT }}
- release-helm job (docker.yml): if: ${{ !env.ACT }}
- version-bump git push (docker.yml): wrapped in [ -z "$ACT" ] shell guard

Run locally with:
  ./bin/act -j build -W .github/workflows/docker.yml \
    -P ubuntu-latest=catthehacker/ubuntu:act-latest

* fix(ci): move ACT guards to step level; add guards to security.yml

env context is invalid in job-level if conditions — moved all ACT
guards down to individual steps. Also guards docker login + scout
in security.yml so act can run the build-only part of that workflow.

* fix(ci): skip git fetch and tag logic in act (no remote access in local containers)

* Revert "fix(ci): skip git fetch and tag logic in act (no remote access in local containers)"

This reverts commit 67cf290cda.

* Revert "fix(ci): move ACT guards to step level; add guards to security.yml"

This reverts commit f92b95e054.

* Revert "chore(ci): add ACT guards to skip DockerHub steps in local act runs"

This reverts commit 797183de08.

* fix(docker): add musl optional deps so alpine builds find native rollup/sharp binaries

npm prunes libc-constrained optional deps to the host libc (glibc) when
generating the lockfile, leaving no musl entry for Alpine containers.
Declaring the x64/arm64 musl variants as explicit root optionalDependencies
forces them into the lockfile so npm ci on Alpine can install them.

Covers shared-builder (tsup/rollup) and client-builder (vite/rollup + sharp
icon generation) for both linux/amd64 and linux/arm64 CI targets.

* fix(docker): copy client dist into server/public so the server resolves static files correctly

The server runs from /app/server and serves static files relative to that
directory, so the client build output must land at /app/server/public, not /app/public.

* feat(planner): real road routes (OSRM) with travel-time connectors (#1060)

* feat(planner): real road routes (OSRM) with travel-time connectors

Replace the straight-line "as the crow flies" route with real OSRM road
geometry (FOSSGIS routed-car/-foot) and an Apple-Maps style render
(blue casing under a lighter core) on both the Leaflet and Mapbox GL
maps. Routes are off by default and toggled per session, with a
driving/walking mode switch in the day footer.

Each day shows per-segment travel time/distance connectors between
places, computed from the OSRM legs and split at transport bookings.

Also redesigns the day header for visual consistency: vertical
number+weather capsule, name with a divider before the date, subtle
hotel/rental pills that stay on one line, and a hover-revealed 2x2
action square (edit / add transport / add note / collapse). Drops the
Google Maps button.

* test(planner): update route hook tests for calculateRouteWithLegs

* remove route_calculation setting, always use OSRM routing (#1064)

The per-user route_calculation toggle was a second, hidden on/off layer
on top of the day footer's show-route button, and made it easy to end up
with straight-line routes for no obvious reason. Drop the setting
entirely: routing is always on, the footer toggle stays the single
switch. Old stored values are simply ignored (settings are key-value, no
migration needed).

* chore: move i18n to shared package (#1066)

* chore: move i18n to shared package

* chore: move server translations to shared package and apply linter and prettier on entire shared package

* feat(dashboard): upcoming reservations endpoint + travel-stats country/distance

Adds GET /api/reservations/upcoming for the dashboard widget, switches travel-stats to the same country source as Atlas (manual + place-derived, ISO codes), and a distance service for flown km.

* i18n(dashboard): dashboard keys across locales

* feat(dashboard): boarding-pass hero, atlas row, live widgets + modal portal fix

Reworked dashboard layout: boarding-pass hero with hover + days-left countdown, atlas stats row with real flags, searchable currency widget, editable timezone widget, new-trip FAB. Modals now portal to document.body to avoid inheriting dashboard-scoped button/font styles.

* i18n(dashboard): sync all locales to one key set + German copy-dialog strings

Brings every locale's dashboard namespace to the same 149-key set (missing keys backfilled from English) and translates the previously English-only copy-trip dialog into German.

* refactor(dashboard): replace hardcoded strings with i18n keys

Hero, atlas row, trip cards, filters, currency and timezone widgets now resolve all visible copy through t() instead of hardcoded English/German.

* feat(i18n): add Greek translation (#1061)

* i18n: complete Turkish (tr) translation (#1075)

Fill in the remaining ~2100 UI strings in shared/src/i18n/tr so Turkish
matches the English catalog. Brand names, URLs, and technical placeholders
are left untranslated by design.

* chore: prettier + lint

* chore: enforce prettier & lint on shared package

* feat: Updated border of map markers to reflect category color. (#1062)

* feat(dashboard): mobile layout, glass UI, context bottom nav + OIDC PKCE (#1079)

* feat(dashboard): mobile layout, glass tiles, plain-text countdown, place photos

- Rework the mobile dashboard: cover hero, separate boarding-pass card,
  trimmed atlas (trips + days only), stacked widgets
- New floating bottom tab bar with a centred context-aware + button
  (new trip / place / journey / entry depending on the page)
- Move profile + notifications into a small top strip on the dashboard
- Desktop: glassmorphic tiles (light + dark), neutral dark palette,
  plain-text countdown module, real place photos in the boarding pass

* i18n(dashboard): translate new dashboard keys across all locales

Fill the dashboard-rework keys (hero, atlas, fx, tz, upcoming, copy
dialog, aria labels, countdown) that were left as English placeholders,
plus the new startsIn/aria keys, for all 19 languages.

* feat(oidc): send PKCE (S256) in the OIDC login flow

The OIDC client now generates a code_verifier per login, sends the
S256 code_challenge on the authorize request and the code_verifier on
the token exchange. Works whether the provider has PKCE optional or
required (fixes login against providers that require PKCE, e.g. Pocket ID).

* Migrate TREK 3 to NestJS + React 19 (shared Zod contracts) (#1087)

* Migrate TREK 3 to NestJS + React 19 with a shared Zod contract layer

Brownfield strangler migration of the backend onto NestJS modules
(auth, trips, days, places, assignments, packing, todo, budget,
reservations, collab, files, photos, journey, share, settings, backup,
oidc, oauth, admin, atlas, vacay, weather, airports, maps, categories,
tags, notifications, system-notices) served through a per-prefix
dispatcher, keeping the existing SQLite/better-sqlite3 DB and JWT
httpOnly cookie auth, with behavioural parity for every route.

Client: React 19 upgrade, "page = wiring container + data hook"
pattern across all pages, per-domain Zustand stores bound to
@trek/shared contracts, and decomposition of the large components
(DayPlanSidebar, PackingListPanel, CollabNotes, FileManager,
MemoriesPanel, PlacesSidebar, CollabChat, SystemNoticeModal,
BudgetPanel, PlaceFormModal, ...) into focused render units backed by
in-file hooks.

Apply the shared global request pipeline (helmet/CSP, CORS, HSTS,
forced HTTPS, the global MFA policy and request logging) to the NestJS
instance as well, so a migrated route is protected identically to the
legacy fallback rather than bypassing it.

* Finish the NestJS migration — drop the legacy Express app

NestJS now serves the whole surface: every /api domain plus the platform
routes (uploads, /mcp, the OAuth/MCP SDK + /.well-known metadata and the
production SPA fallback). Removed server/src/app.ts, all of
server/src/routes/* and the strangler dispatcher; index.ts and the
integration suite share a single buildApp() bootstrap so prod and tests
can't drift.

- Platform/transport routes extracted to nest/platform/platform.routes.ts
  and mounted before app.init() — Nest's router answers an unmatched
  request with a 404, so a route registered after init is never reached.
  The SPA fallback is a NotFoundException filter and the catch-all uses a
  RegExp (Express 5's path-to-regexp rejects a bare '*').
- New modules: memories (/api/integrations/memories — the Journey
  gallery's Immich/Synology proxy), addons (GET /api/addons) and the
  cross-trip GET /api/reservations/upcoming.
- TrekExceptionFilter reproduces the old multer / err.statusCode handling
  so upload rejections keep their 400/413 { error } body and non-ASCII
  filenames survive (defParamCharset).
- addTripToJourney and the MCP get_journey_share_link tool gained the
  trip-access check they were missing.
- Re-pointed the 34 integration tests + the websocket test onto the Nest
  app; removed the now-meaningless Express-vs-Nest parity tests and a few
  orphaned client components.

* Restore the reset-password rate limit and fix copyTrip reservation links

Two correctness/security gaps the NestJS migration introduced:

- POST /api/auth/reset-password lost its per-IP rate limiter. Restore it
  (5 attempts / 15 min on a dedicated bucket, same as the old resetLimiter)
  so reset tokens can't be brute-forced unthrottled. Covered by AUTH-019.
- copyTripById did not copy reservations.end_day_id (a day reference — now
  remapped through dayMap like day_id) or needs_review, so a duplicated trip
  lost multi-day transport end-day links and reset the review flag.

* Clean up dead code, dedupe helpers, fix the reset-password contract

- Remove server exports orphaned by the Express removal: the immich
  album-link helpers, seven route-only service exports, getFileByIdFull;
  de-export internal-only helpers (utcSuffix).
- De-duplicate verifyTripAccess (9 identical copies -> services/tripAccess.ts)
  and avatarUrl (3 -> services/avatarUrl.ts); name the bcrypt cost
  (BCRYPT_COST) and the email regex (EMAIL_REGEX). Public API unchanged.
- resetPasswordRequestSchema declared `password`, but the client sends and
  the service reads `new_password` — rename it so the contract matches and
  the client types resolve.
- Make ATLAS-013 deterministic: stub the admin-1 GeoJSON download instead of
  fetching ~4600 features from GitHub during the test (it hung the suite).

* Make the client typecheck runnable (vitest/vite ambient types)

The client had no `typecheck` script and tsc couldn't even start (the
baseUrl deprecation errored out, same as server/shared already silence).
Add `ignoreDeprecations: "6.0"` to match the other workspaces, a `typecheck`
npm script, and a src/vite-env.d.ts referencing vite/client + vitest/globals
so tsc knows the test globals (describe/it/expect/vi). This turns ~3600
phantom "Cannot find name" errors into a real, measurable count (~590 actual
type errors remain, to be worked down). Type-only; no runtime change.

* Derive client domain types from the shared schema contracts

Add entity/response Zod schemas to @trek/shared (place, trip, assignment, day, budget, packing, reservation), each matched against the producing server service, and re-export them from client types.ts instead of the hand-written duplicates that had drifted (name/title, amount/total_price, owner_id/user_id, cover_url/cover_image, ...). Updates the call sites and test fixtures the corrected types surfaced; type-only, no runtime behaviour change.

* chore(db): log swallowed errors in addon-disable migration + guard against destructive migrations

The migration that disables the legacy "memories" addon swallowed any
error in an empty catch, as did ~30 other catch blocks in the migration
runner (column adds, the journey rebuild, index probes). Replace each
silent catch with the existing console.warn('[migrations] ...') log so
failures are visible. Control flow is unchanged: every step stays
non-fatal, nothing new is thrown.

Add a static guardrail test that scans the migration source and fails
when a new destructive statement (DROP TABLE / DROP COLUMN / TRUNCATE /
DELETE FROM / ALTER ... DROP) appears outside a reviewed allowlist, and
when an empty/silent catch block is reintroduced. The existing
destructive statements are all legitimate table rebuilds or
bounded cleanups and are recorded in the allowlist with a reason.

* Re-check SSRF on every redirect hop when resolving short links

Replace the one-shot checkSsrf + fetch(redirect:'follow') in the maps and place short-link resolvers with safeFetchFollow, which follows redirects manually and re-runs checkSsrf against the DNS-pinned IP of each hop (max 5). A redirect to an internal/loopback address is now blocked even when the initial URL is public, while legitimate cross-host redirects (goo.gl -> maps.google.com) still resolve.

* Reject WebSocket tokens minted before a password change

Stamp the user's password_version onto the ephemeral ws token and verify it on connect, closing the socket (4001) when it no longer matches, so a token issued before a password reset can't be replayed. Tokens minted without a version are treated as version 0, matching the JWT pv-claim semantics.

* fix(i18n): guard locale key parity and finish the OAuth consent page strings

Every non-en locale now exposes the exact same flat key set as en. Keys that
had drifted out of sync are backfilled with the English source value (tagged
en-fallback) so t() resolves a real string instead of relying on the silent
runtime fallback; no existing translation was touched and no key was removed.

Add a parity test that imports each aggregated locale bundle and asserts its
key set matches en, with a diagnostic listing of any missing/extra keys. This
complements the file-level check in shared/scripts by guarding the merged
export the app actually serves.

Finish internationalising OAuthAuthorizePage: the ~15 remaining hardcoded
English chrome strings now go through oauth.authorize.* keys (English source
in en, en-fallback placeholders elsewhere). Markup and behaviour are unchanged.

* Add semantic theme color tokens to Tailwind

Map the CSS theme variables from src/index.css (:root light / .dark dark) to named Tailwind utilities — bg-surface, text-content, border-edge, bg-accent and their variants. This gives components a Tailwind-native target for the theme colors so we can replace inline `style={{ ... 'var(--...)' }}` with utility classes without changing the rendered values.

* Surface silent store failures to the user and validate API responses in dev

Reservation toggle, todo/packing toggle and budget reorder were swallowing API errors after rolling back, so the user saw the change silently snap back with no explanation. Route those failures through the existing toast channel (new store/notify.ts bridges to window.__addToast, the same channel SystemNoticeBanner uses); the reservation toggle re-throws so ReservationsPanel's own translated toast finally fires. Also wire the existing parseInDev/checkInDev response validation into the maps and notification-test endpoints to catch contract drift in dev.

* Migrate static theme inline styles to Tailwind utilities and extract page sub-components

Replace the static, color-only inline `style={{ ... 'var(--bg-primary)' ... }}` props with the new semantic Tailwind utilities (bg-surface, text-content, border-edge, ...) wherever the result is byte-identical; dynamic/conditional theme styles and hardcoded status colors are left inline. Extract the Atlas country-search autocomplete, the Admin update banner, and two Journey dialogs into their own presentational components to shrink the oversized page files, keeping behaviour and markup identical.

* Remove the unrouted photos page and its dead photo components

PhotosPage was never wired into the router and its usePhotos hook read a tripStore photos slice that was never implemented; the Photos gallery, lightbox and upload components were only reachable through it. Per-trip photos now live in the Journey gallery (Immich/Synology). Removed the dead page, hook and components — the live Journey PhotoLightbox is a separate component and stays.

* Resolve the remaining client type errors and the trip.title navbar bug

Drive the client typecheck to zero without any/ts-ignore: convert the tripId route param to a number once at the page boundary so it matches the numeric props and store actions it feeds, fix trip.name -> trip.title (the wire field is title, so the old read rendered blank in the files/offline views), and tighten the scattered handler-arity, DOM-cast and untyped-payload sites. No runtime behaviour change.

* Convert the remaining dynamic and hardcoded inline styles to Tailwind utilities

Second styling pass over the components and pages: move conditional theme colors into className ternaries (bg-accent / bg-surface-hover etc.), turn reused CSSProperties constants into className constants, and express static hardcoded hex/rgba colors as Tailwind arbitrary values so the exact rendered colour is preserved. Truly dynamic styling (computed geometry, gradients, multi-part shadows, data-driven colours, the undefined --sidebar/--nav layout vars) stays inline as it cannot be expressed as a static class. Updated three component tests that asserted the old inline active-state styles to assert the equivalent utility class instead.

Verified: client typecheck 0, full client suite green, and a live light/dark render check in the dev server confirms the semantic theme tokens resolve correctly (the earlier 'transparent popups' were a stale dev server that pre-dated the tailwind.config token addition, not a code issue).

* Add eslint flat-config for client and server and gate typecheck, lint and pages in CI

client and server had lint scripts but no eslint config (only shared was linted in CI). Add flat configs mirroring shared's stack (js + typescript-eslint recommended + eslint-config-prettier) plus the client's react-hooks/react-refresh plugins. Pre-existing patterns in this never-linted code (explicit any, require() in the CommonJS server, empty catches, exhaustive-deps) are set to 'warn' rather than 'error' so the gate passes at 0 errors without a repo-wide reformat — these can be ratcheted to errors over time. Wire blocking typecheck + lint + lint:pages steps into the client and server CI jobs (now that both typechecks are clean) and promote the server typecheck from informational to blocking.

* Decompose the remaining God Components into hooks, helpers and sub-components

FE6: split the oversized page and panel components into thin layout shells plus colocated use<Component> hooks, .constants.ts, .helpers.ts (with tests) and presentational sub-components, following the established 'logic in a hook, render in slices' pattern. Behaviour, markup, classes and effect order are unchanged. Largest reductions: PackingListPanel 1598->42, FileManager 1055->36, AdminPage 1525->167, BudgetPanel 1266->146, JourneyDetailPage 2822->547, PlacesSidebar 945->66, CollabChat 861->106, CollabNotes 1417->532. DayPlanSidebar's drag-and-drop render body was left intact (ref-identity sensitive) and only its toolbar/modals/constants were extracted.

* Fix duplicate React keys in the file-assign place list

When a place is assigned to the same day more than once it appeared twice in a day's list, so the place-button key={p.id} collided and React warned about duplicate keys. Key by place id + render index so siblings stay unique. Pre-existing in the old FileManager; behaviour unchanged.

* Format the shared package and drop an unused import to satisfy the lint gate

The i18n and schema changes added code that wasn't prettier-formatted, and place.schema.ts imported categorySchema without using it. Run prettier over shared and remove the import so 'npm run lint' + 'format:check' pass.

* Install all workspaces in the server CI job so SWC's native binary is present

The server vitest config transforms via unplugin-swc, which needs @swc/core's platform-specific native binary. A workspace-scoped 'npm ci --workspace server' skips that optional dependency, so vitest failed to load the config on the Linux runner. Use a full 'npm ci'.

* Re-resolve dependencies with npm install in the server CI job for SWC

Full 'npm ci' still skipped @swc/core's Linux native binary because the committed lockfile was generated on Windows and lacks the Linux optional-dep install metadata. 'npm install' re-resolves and fetches the platform-matching binary, which the server's unplugin-swc transform needs to load vitest.config.ts.

* Install @swc/core's Linux binary explicitly in the server CI job

Neither npm ci nor npm install fetched @swc/core-linux-x64-gnu on the Linux runner because the lockfile was generated on Windows and lacks the Linux optional-dep metadata. Add a step that installs the matching @swc/core-linux-x64-gnu version (no-save, no-lockfile) so unplugin-swc can load the server's vitest config.

* Use legacy-peer-deps when installing the SWC Linux binary in CI

The explicit @swc/core-linux-x64-gnu install re-resolved the tree and hit the pre-existing lucide-react/react-19 peer conflict that the lockfile was generated around. Add --legacy-peer-deps so the step matches the project's resolution and installs the binary.

* Keep the lockfile when installing the SWC binary so other deps stay pinned

Dropping --no-package-lock made npm re-resolve the whole tree and upgrade eslint, whose newer recommended config flagged no-useless-assignment as an error in the server lint step. Keep the lockfile so only @swc/core-linux-x64-gnu is added and every other dependency (incl. eslint) stays at its locked version.

* Fix a batch of reported bugs: Atlas regions, planner overlays, imports, Safari modals (#1094)

* Start the Journey date picker week on Monday (#1078)

The Journey entry date picker started the week on Sunday (firstDow = getDay(), headers Su-first) while every other picker (CustomDateTimePicker, VacayCalendar) starts on Monday. Align it: Monday-first leading offset ((getDay()+6)%7) and Mo-first weekday headers.

* Fix Taiwan resolving to CN-TW in the Atlas country search (#1049)

natural-earth gives Taiwan ISO_A2='CN-TW' (a subdivision-style value) with ADM0_A3='TWN'. The dynamic A2_TO_A3 augmentation added 'CN-TW'->'TWN', which then overwrote the legitimate TWN->TW entry in the reverse map, so Taiwan's country option resolved to 'CN-TW' — unresolvable by Intl.DisplayNames (no name, broken flag, not searchable). Only augment A2_TO_A3 with real 2-letter codes.

* Drop empty leftover dateless days when a trip gets a shorter dated range (#1083)

generateDays kept all unused dateless placeholder days after switching to an explicit (shorter) date range, so day_count (COUNT(*) FROM days) stayed inflated. Delete the empty leftovers (no assignments/notes/accommodations) like the dateless path already does, while preserving any that still hold content. Adds TRIP-SVC-017.

* Render GPX and route overlays once the Mapbox style has loaded (#1036)

The GPX and route geojson effects ran before the map 'load' event had
attached their sources, so on the first paint they hit the early return
and never re-ran. Add mapReady to their dependencies so they fire again
the moment the sources exist.

* Convert HEIC trip and journey covers to JPEG before upload (#1085)

HEIC/HEIF covers coming straight off an iPhone could not be rendered in
the preview or stored as a usable image. Route both cover pickers through
normalizeImageFile, the same conversion the journal entry editor already
uses, so the file becomes a JPEG before it leaves the browser.

* Name GPX routes and tracks after their source file so multiple imports stick (#1054)

Unnamed routes and tracks all fell back to the same generic 'GPX Route' /
'GPX Track' label, so the name-based import dedup dropped every one after
the first - importing several files (or one file with several tracks) only
kept a single place. Derive the default name from the source filename with
an index suffix when a file holds more than one geometry, thread the
filename down through the controller, and let the import modal take more
than one file at a time. Adds PLACE-SVC-037/038.

* Namespace the modal backdrop class so content blockers stop hiding it (#1027)

Generic class names like .modal-backdrop sit on the cosmetic filter lists
that content blockers (1Blocker, EasyList Annoyances) ship, and get hidden
with display:none. The shared Modal - used by New Trip and Add Place -
carried that class, so Safari users running such a blocker saw the modal
silently fail to open with no error and no network request. Rename it to
.trek-modal-backdrop.

* Highlight GB regions by resolving England/Scotland/Wales/NI to finer admin-1 codes (#1067)

A zoom-8 reverse geocode of a UK place only resolves to the constituent
country (GB-ENG/SCT/WLS/NIR), but Natural Earth's admin-1 polygons for GB
are counties and boroughs (GB-LND, GB-MAN, GB-CON, ...). Those four codes
match no polygon, so places in England never highlighted in the Atlas
while CH/IT/NL/etc. worked. When a GB lookup lands on a constituent
country, re-resolve it at a finer zoom where Nominatim exposes the
county/borough code the polygons actually carry. Other countries keep the
exact zoom-8 behaviour. Adds ATLAS-UNIT-021.

* Surface the real place-search error instead of a generic toast (#1092)

When a place search or detail lookup fails, the backend already forwards the
upstream reason - including descriptive Google Places API messages such as
'Places API (New) has not been used in project ... or it is disabled'. The
planner discarded it and always showed 'Place search failed', so a key that
is mis-enabled, unbilled, or pointed at the legacy API instead of Places API
(New) looked like an unexplained silent failure. Show the server-provided
message when present, and stop the Atlas bucket-list search from swallowing
its error without a trace.

* Await the async cover normalization in the TripFormModal paste test (#1085)

handleCoverSelect now normalizes the pasted file before previewing it, so
URL.createObjectURL is called a microtask later. The assertion moves into
waitFor; a non-HEIC file still passes through unchanged.

* fix(pwa): removed orientation from the manifest (#1058)

* fix(journey): raise PhotoLightbox z-index above MobileEntryView (#1101)

* feat(transport): add bus, taxi, bicycle, ferry and other transport types (#1105)

Closes #718. Adds five new transport reservation types alongside the
existing flight/train/car/cruise: bus, taxi, bicycle, ferry and a generic
'transport_other' catch-all. The new types are treated as first-class
transports everywhere — the transport modal, day plan, route calculation,
map overlays, file grouping and the PDF export — and are translated across
all 20 locales.

A dedicated 'transport_other' value is used for the catch-all so existing
'other' bookings are not reclassified as transport.

* feat(reservations): native booking-confirmation import via KDE KItinerary (#1102)

* feat(reservations): native booking-confirmation import via KDE KItinerary

Adds a two-step preview → confirm flow for importing booking emails,
PDFs, PKPass and HTML confirmations. The server invokes the KDE
kitinerary-extractor binary, maps JSON-LD schema.org output to TREK
reservation shapes, and persists via the existing createReservation
pipeline (accommodations, budget, places, WebSocket broadcasts).

- NestJS BookingImportModule: preview + confirm endpoints under
  /api/trips/:tripId/reservations/import/booking{,/confirm}
- KitineraryExtractorService: spawns the binary, filters stderr noise,
  handles QDateTime (@value) timezone-aware datetimes
- kitinerary-mapper: FlightReservation, TrainReservation, BusReservation,
  BoatReservation, LodgingReservation, FoodEstablishmentReservation,
  RentalCarReservation, EventReservation → typed preview items
- BookingImportService: auto-creates place rows; geocodes venues without
  coordinates via Nominatim (name+address → address → name fallback);
  resolves day IDs for accommodation linking
- BookingImportModal: drag-and-drop multi-file upload, preview cards
  with type icons, per-item exclude toggle, confirm step
- Shared Zod contracts: BookingImportPreviewItem, PreviewResponse,
  ConfirmRequest, ConfirmResponse — consumed by controller, service,
  API client and modal
- Dockerfile: node:24-trixie-slim runtime; amd64 downloads KDE static
  binary + locales; arm64 installs libkitinerary-bin + symlinks to
  fixed path; ENV KITINERARY_EXTRACTOR_PATH set for both arches
- /api/health/features exposes { bookingImport: boolean } so the UI
  hides the Import button when the binary is absent
- i18n keys (English), wiki docs, API.md, README one-liner

* i18n: add booking import translations for all 19 non-English locales

Adds 17 reservations.import.* keys and undo.importBooking to ar, br, cs,
de, es, fr, gr, hu, id, it, ja, ko, nl, pl, ru, tr, uk, zh, zh-TW.

* chore: enforce i18n parity

* docs(wiki): add KItinerary local setup instructions to dev environment guide

* feat(costs): rework Budget into Costs — Splitwise-style, multi-currency, mobile (#1106)

* fix(journey): authorize reads of the journey share link

GET /api/journeys/:id/share-link now requires journey access (canAccessJourney),
matching the create/delete share-link routes and the get_journey_share_link MCP
tool. Returns no link when the caller lacks access to the journey.

* feat(costs): rework Budget into Costs — Splitwise-style, multi-currency, mobile

Renames the Budget addon to "Costs" (UI only) and reworks it into a Tricount/
Splitwise-style cost tracker: multiple payers per expense, equal split across
chosen members, settle-up with persisted history + undo, 12 fixed categories,
per-expense currency with live FX conversion to a user-set display currency
(Settings -> Display), and locale-correct money formatting. Adds a desktop and a
dedicated mobile layout. A migration backfills existing budget items (single
payer, split members, currency). Closes #551 (per-expense currency).

Also switches the app font to self-hosted Poppins (Geist for secondary subtext),
replacing the Google Fonts CDN dependency.

* fix(costs): neutral dashboard dark palette + liquid glass, full page width, entry-count badge

- Dark mode used a warm oklch palette that read brownish; switch to the
  neutral zinc tokens used by the dashboard (#121215 bg, #f4f4f5 ink) and add a
  subtle backdrop-blur glass on cards.
- Costs now uses the full available page width on desktop instead of a 1280px cap.
- Render the expense count next to the Expenses title as a badge.
- Adapt budget/journey unit tests to the new payer-based settlement model and the
  Costs rename (category default 'other', Costs tab/CostsPanel).

* fix(costs): drop the entry-count badge, always show row edit/delete actions

Removes the count badge next to the Expenses title and makes the per-row
edit/delete actions permanently visible (no longer hover-only) on desktop too.

* feat(costs): currency-native money formatting, custom select/date, rename addon to Costs

- Format every amount in its own currency convention (symbol position, grouping
  and decimal separators) regardless of app language, via a currency->locale map
  (EUR -> '12,00 €', USD -> '$12.00', JPY -> '¥12', ...). Previously Intl used the
  app locale, so EUR showed the symbol in front under an English UI.
- Use TREK's CustomSelect (searchable, with symbols) and CustomDatePicker in the
  add/edit expense modal instead of the native <select>/<input type=date>.
- Rename the 'Budget Planner' add-on to 'Costs' in the admin list (display only;
  id/tables/permissions/MCP stay 'budget') via seed + a migration for existing DBs.

* feat(auth): configurable session duration via SESSION_DURATION

Adds a SESSION_DURATION env var (ms-style strings: 1h, 7d, 30d, ...) controlling
how long a session stays valid before re-login. It drives both the trek_session
JWT exp claim and the cookie maxAge from one source, so they never drift. Invalid
values warn at startup and fall back to the default (24h — unchanged). The MFA
challenge token and MCP OAuth tokens keep their own TTL.

Implements the request from discussion #946. Documented in the env-var wiki page,
.env.example and docker-compose.yml.

* feat: Passkey (WebAuthn) login (#1111)

* feat(auth): passkey (WebAuthn) login — server endpoints, schema + admin toggle

Add @simplewebauthn/server registration and primary (discoverable) login ceremonies under /api/auth/passkey, a webauthn_credentials + single-use webauthn_challenges schema (migration), the instance-wide passkey_login toggle (default off) enforced before auth by a guard, and require_mfa satisfaction via a verified passkey. RP ID/origin come only from server config (webauthn_rp_id/origins -> APP_URL), never request headers.

* feat(auth): passkey enrolment, login button + admin settings UI

PasskeysSection in account settings (add/rename/remove with a current-password step-up), a 'Sign in with a passkey' button on the login page, the admin enable + RP-ID/origins controls, and a per-user admin reset action.

* i18n(auth): passkey strings across all locales

Add login/settings/admin passkey keys to en and all 19 translated locales.

* chore: update kitinerary version

* Backend/frontend hardening & consistency cleanups (#1113)

* refactor(auth): session token validation and password-change consistency

* refactor(journey): entry field allow-list and public share-link consistency

* refactor(mcp): align tool authorization with the REST permission checks

* chore: input validation and sanitisation touch-ups (uploads, pdf, maps, backup, csp)

* feat: optimize routes around accommodation, confirm note deletions (#1123)

Optimize day routes around the accommodation

When a day has an accommodation set, the route optimizer now treats it as
the day's home base: it optimizes a loop that leaves the hotel and returns
to it, so the stop nearest the hotel comes first. On a transfer day -
checking out of one hotel and into another - the route runs from the first
hotel to the second instead.

The optimizer also gained a 2-opt pass on top of the nearest-neighbor
ordering, which removes the crossings the greedy pass used to leave behind.
A new display setting ("optimize route from accommodation", on by default)
lets you turn the anchoring off.

Confirm before deleting notes

Deleting a plan note or a collab note now asks for confirmation first. On
phones and tablets the edit and delete icons sit close together and were
easy to mis-tap, which deleted notes with no way back.

* fix: miscellaneous bug fixes (#1139)

* fix(share): serve place thumbnails in shared trip links (#1100)

Google-sourced place photos are stored as image_url pointing at the
JWT-guarded /api/maps/place-photo/:placeId/bytes endpoint, so they 401
for an unauthenticated shared-trip viewer and render as broken images.

Rewrite place image_url values in the shared payload to a public,
token-scoped proxy (/api/shared/:token/place-photo/:placeId/bytes) and
add an unguarded SharedController route that validates the token and that
the place belongs to its trip before streaming the cached bytes. Mirrors
the existing JourneyPublicController precedent. No client changes needed.

* fix(atlas): replace Natural Earth with geoBoundaries for up-to-date regions (#1119)

Atlas sourced country and sub-national boundaries from Natural Earth's GitHub
`master` at runtime. That data is stale (e.g. it still shows Norway's pre-2020
counties such as Oppland/Hordaland) and depicts some contested territory in
unwanted ways (nvkelso/natural-earth-vector#391), so Natural Earth is dropped
entirely.

- Country borders (admin0) now come from the geoBoundaries CGAZ composite;
  sub-national regions (admin1) from per-country gbOpen, which carries ISO 3166-2
  codes. A new script (server/scripts/build-atlas-geo.mjs) normalizes and quantizes
  them into committed gzipped bundles under server/assets/atlas, read server-side at
  runtime (no network at boot, no GitHub CSP allowlist entry).
- New GET /addons/atlas/countries/geo serves the country layer; the client fetches
  it from the API instead of GitHub.
- A migration reconciles manually-marked visited_regions against the new bundle
  (valid code -> keep; region name still matches -> re-code; curated merge crosswalk
  for renamed reforms; else leave intact), with UNIQUE-safe dedup. bucket_list and
  visited_countries hold only invariant alpha-2 country codes, so they are untouched.
- Attribution added (NOTICE.md + README) per geoBoundaries CC BY 4.0.

Closes #1119

* fix(packing): make templates admin-only to create, usable by members

Creating a packing-list template was gated only by trip access, so any
trip member could create one from the Lists feature, while applying a
template silently failed for non-admins because the apply dropdown was
populated from the AdminGuard-protected /api/admin/packing-templates
endpoint.

- save-as-template now returns 403 for non-admins; the Save-as-Template
  button is hidden unless the user is an admin (both the TripPlanner
  toolbar and the inline packing header).
- add member-accessible GET /api/trips/:tripId/packing/templates so the
  apply dropdown lists templates for any trip member; client fetches
  from it instead of the admin endpoint.

Closes #1120
Closes #1121

* fix(packing): show bag tracking to non-admin members

The global Bag Tracking toggle was only readable via the admin-gated
GET /api/admin/bag-tracking, so non-admin trip members got 403 and the
weight fields, bag circles, and BAGS sidebar never rendered (#1124).

Surface the flag through the already-authenticated GET /api/addons
(loaded into the client addon store on app start for every user); the
packing hook reads it from the store instead of the admin endpoint. The
admin write path stays admin-gated and unchanged.

* Fix a batch of reported bugs (#1145)

* fix(maps): fall back to OSM/Wikipedia for place photos and normalize non-standard language codes (#1137)

* fix(auth): refuse password reset for OIDC/SSO-linked accounts (#1129)

* fix(docker): ship server/assets (airports + atlas geo) in the runtime image (#1133, #1119)

* fix(unraid): point the template at a PNG icon Unraid can render (#1073)

* fix(offline): serve cached file blobs when offline or on network failure (#1046, #1069)

* fix(map): centre the selected pin in the visible map area above the bottom panel (#1125)

* fix(pdf): render persisted place-photo proxy URLs as images (#1130)

* fix(planner): show the selected place category in the edit form (#1134)

* fix(dashboard): collapse list-view trip cards to a compact row on mobile (#1132)

* Support multi-leg (layover) flights (#1146)

* feat(transport): support multi-leg (layover) flights in the booking form

A flight booking can now hold an ordered chain of airports (e.g. FRA -> BER ->
HND) instead of a single departure/arrival pair. The route is entered as a list
of waypoints with a '+ add stop' button; each stop carries its own arrival and
departure time plus the airline/flight number of the segment leaving it, while
the whole booking keeps one price.

Stored without a schema change: the existing reservation_endpoints rows carry the
ordered waypoints (from/stop/to by sequence) and a metadata.legs array holds the
per-leg detail. Top-level metadata (departure_airport/arrival_airport/airline/
flight_number) mirrors the first and last leg, so a single-leg flight persists
exactly as before and legacy readers keep working.

* feat(planner): show each flight leg as its own day-plan entry, ordered by time

A multi-leg flight now expands into one entry per leg (BER -> FRA, then FRA ->
HND), each on its own day with its own times, instead of a single span. Each leg
is an addressable slot (reservation id + leg index) so places and notes can be
dropped into the layover gap between legs; the per-leg position is persisted in
metadata.legs[i].day_positions and survives a reload.

Day-plan items are now ordered chronologically: anything with a time (a place's
time, a flight leg, a timed note) sorts by that time, and untimed items inherit
the time of the item before them so they stay where they were placed.

* feat(planner): show the full multi-stop route in the bookings panel

The route row now lists every waypoint (FRA -> BER -> HND) by sequence instead of
just the first and last airport.

* feat(map): draw multi-leg flights as connected legs with a marker per airport

Both the Leaflet and Mapbox overlays now render a flight over all its waypoints:
one great-circle arc per leg and a marker at every airport, with the label
showing the full route and the summed distance. A single-leg flight is unchanged.

Also drops the floating stats badge that was drawn on transport arcs.

* fix(map): centre a clicked place above the bottom inspector panel

Selecting a place panned/flew it to the dead centre of the screen, where it sat
behind the detail card. Both overlays now bias the target into the visible area
above the bottom panel (Leaflet offsets the pan by the inspector inset; Mapbox
passes the padding to flyTo).

* feat: show the full multi-stop flight route in PDF and calendar export

The PDF day list and the ICS export now render the whole route (FRA → BER → HND)
for a multi-leg flight instead of just the first and last airport, falling back to
the flat metadata for single-leg flights. The ICS keeps a single event per booking.

* feat(import): group connecting flight legs into one multi-leg booking

When a booking confirmation contains several flight legs sharing a PNR that
connect at the same airport with a short layover (under 24h), they are now
imported as a single multi-leg booking (from/stop/to endpoints + metadata.legs)
instead of one booking per leg. A round trip (same PNR, multi-day gap) stays two
separate bookings, and a single flight is unchanged.

* i18n: translate the new flight-route strings into all languages

* i18n: translate the Costs page into every language

The Budget → Costs rework left the new costs.* strings untranslated in every
non-English locale (they fell back to English). Translate them across all
supported languages.

* Revert "fix(map): centre a clicked place above the bottom inspector panel"

This reverts commit 0936103f04.

* Explore places on the map, planner route fixes, and instance-wide Mapbox (#1147)

* feat(maps): add an OSM POI search endpoint (category within a viewport)

New /api/maps/pois queries OpenStreetMap via Overpass for places of a category
(restaurants, cafes, hotels, sights, …) inside a bounding box. OSM-only by design
— it never calls Google, even when a Google key is configured.

* feat(map): explore nearby places on the trip map (OSM category pill)

A floating, icon-only pill over the planner map lets you toggle a POI category and
see those OpenStreetMap places in the current view; clicking a marker opens the
add-place form pre-filled (name, address, website, phone). Single-select with a
'search this area' action after the map moves. Renders on both the Leaflet and
Mapbox maps, and can be turned off in settings (discussion #841).

* fix(planner): anchor timed places when optimising and route transports by location

- The day optimiser no longer reshuffles places that have a set time — they stay
  anchored to their time, like locked places.
- The route now uses a transport's departure/arrival location as a waypoint when it
  has one (e.g. a flight's airport), instead of breaking the route at every booking;
  transports without a location are ignored for routing but still show their leg's
  distance/duration under the booking.

* feat(admin): instance-wide Mapbox defaults in default user settings

Admins can set a shared Mapbox token (plus style, 3D and quality) as instance
defaults, so the whole instance can use Mapbox without each user pasting their own
key. Users without their own value inherit it via the existing admin-defaults
merge; the shared token is stored encrypted (discussion #920).

* Reorder whole days and insert a day (#589) (#1148)

* feat(days): reorder whole days and insert a day at a position

Adds reorderDays + insertDay to the day service and a PUT /days/reorder route
(plus an optional position on create). Day rows stay stable so a day's
assignments, notes, bookings and accommodations ride along by id; on a dated
trip the calendar dates stay pinned to their slots while the content moves
across them, and each booking's date is re-stamped onto its day's new date
(time-of-day preserved) so day_id stays consistent. Renumbering uses the
two-phase write to avoid the UNIQUE(trip_id, day_number) collision, and a move
that would invert an accommodation's check-in/out span is rejected.

* feat(planner): reorder days from a toolbar popup, and add days

A new toolbar button opens a popup listing the days; drag a row by its grip or
use the up/down arrows to reorder, and add a day from there. Reorders apply
optimistically with rollback and sync over WebSocket; the day headers are left
untouched, so the existing place drop-targets are unaffected.

* i18n: add day-reorder strings across all languages

* Map/planner/dashboard polish and small community features (#1155)

* feat(planner): reorder days in a modal instead of a dropdown

The day-reorder control opened a small anchored dropdown; move it into the shared Modal (portal, dimmed backdrop, Esc/backdrop close) so it matches the Add activity dialog. Drag handles, up/down arrows and the day badges are unchanged.

* feat(map): explore reliability, Mapbox popups + compass, region-biased search

POI explore: clamp oversized viewports, query the Overpass mirrors in parallel (first valid response wins) with a per-request timeout and a short-lived cache, and surface a retry when every mirror fails - so it returns results at any zoom instead of timing out.

Mapbox renderer: add the place/POI hover popups (name, category, address, photo) the Leaflet map already had, plus a compass pill next to the explore pill that resets the view to north.

/api/maps/search: accept an optional locationBias to fix foreign-region bias and expose Google's place types in the result.

* feat(dashboard): list-view and mobile polish

Use the Archived status label for the filter and show Open dates for trips without dates; drop the unused settings button next to the view toggle. Desktop list view renders the date as a stat-style block separated from the counts.

Mobile list rows are stacked (slim cover banner + centred date), trip actions stay visible (touch has no hover), and the hero card's hover lift is disabled on touch; small spacing fix under the sidebar.

* feat: small community-requested options

Raise the plan-note subtitle limit to 250 characters and add more note icons. Expose is_archived and cover_image on the update_trip MCP tool. Add place coordinates to the PDF export. Allow creating a category from an existing to-do, and add a show/hide toggle on the admin password fields.

* test(shared): bump day-note subtitle limit assertion to 250

* test: align specs with the new search param order and archive label

Keep lang as the 3rd positional arg of the maps search controller so the existing unit test stays valid, and forward locationBias as the 4th. Add the now-used Popup to the MapViewGL mapbox mock, switch the dashboard archive-filter query to the Archived label, and expect the 4-arg search call.

* fix(packing): add more bag colors so sub-bags stop repeating (#1156)

The auto-assigned bag palette only had 8 colors, so the 9th bag reused the first one. Double it to 16 (keeping the existing 8 and their order) and keep the server and client lists in sync - both cycle BAG_COLORS[count % length].

* fix(packing): respect per-item quantity in bulk import (#1157)

* AirTrail integration: import flights & two-way sync (#214) (#1158)

* feat(admin): register AirTrail as an integration addon

Off by default; toggle lives in Admin -> Addons with a Plane icon. The
per-user connection (URL + API key) follows in integration settings.

* feat(integrations): add per-user AirTrail connection

Settings -> Integrations gains an AirTrail section: instance URL + Bearer
API key (encrypted at rest via apiKeyCrypto), a self-signed-TLS opt-in and
a test-connection check. Served by a small Nest controller under
/api/integrations/airtrail, gated on the airtrail addon and SSRF-guarded.
The key is per-user, so it only ever returns that user's own flights.

* feat(transport): import flights from AirTrail

Adds an AirTrail Import button next to Manual Transport that lists the
user's AirTrail flights and highlights the ones inside the trip dates.
Selected flights become reservations linked to their AirTrail origin
(external_* columns), deduped against flights already in the trip, then
broadcast to every member. The mapping resolves airports, airport-local
times and flight metadata; the linkage is what the two-way sync rides on.

* feat(transport): badge AirTrail-linked flights as synced

Linked reservations show an 'AirTrail synced' badge, or 'no longer
synced' once the flight is gone from AirTrail.

* feat(transport): keep TREK and AirTrail flights in sync both ways

A scheduled poll reconciles each connected owner's flights: field edits
(detected by snapshot hash, since AirTrail has no updated_at) flow into
the linked reservation and broadcast live; a flight deleted in AirTrail
keeps the TREK row but stops syncing. Editing a linked flight in TREK
pushes back to AirTrail under the importer's credentials, preserving the
existing seat manifest; if the owner disconnected the link detaches so the
poll can't revert the local edit. Deleting in TREK never touches AirTrail.

* i18n(airtrail): add AirTrail strings across all locales

* test(airtrail): cover flight mapping, timezones and snapshot hashing

* fix(airtrail): reduce airline/aircraft objects to codes

The flight list/get response returns airline and aircraft as joined
objects ({icao, iata, name, ...}), not bare codes. Mapping them straight
through produced '[object Object]' titles and stored objects in metadata,
which crashed reservation rendering. Extract the ICAO/IATA code instead,
and title flights by their flight number.

* fix(airtrail): clear error on non-JSON responses, tolerate /api in URL

A misconfigured instance URL made AirTrail serve its SPA/login HTML, and
the raw JSON.parse failure surfaced as 'Unexpected token <'. Surface an
actionable message instead, and strip a pasted trailing /api so the base
URL still resolves.

* feat(transport): sync AirTrail edits on trip open, not just on the poll

Add a per-user on-demand sync (POST /integrations/airtrail/sync) triggered
when a connected user opens a trip, so AirTrail-side edits appear right away
instead of waiting up to a full poll cycle. Lower the background poll from 15
to 5 minutes as a safety net.

* fix(transport): refresh imported AirTrail flights without a reload

loadTrip doesn't fetch reservations, so a freshly imported flight only
appeared after a full page reload — use loadReservations instead. Also show
flight dates in the user's locale format (e.g. 13.06.2026) rather than the
raw ISO string.

* style(settings): align AirTrail connection with the photo-provider layout

Match the Immich section: stacked URL/key fields, a ToggleSwitch for
self-signed TLS, and a Save / Test-connection row with a status badge.

* feat(transport): add a seat field when editing flights

The transport editor only offered a seat field for trains; flights had
none even though imports store metadata.seat. Show and persist a seat for
flights too.

* style(transport): match the AirTrail button height to Manual Transport

* feat(transport): put the flight seat next to flight number and sync it to AirTrail

Move the seat from a standalone row to the per-leg flight details (beside
the flight number), stored per leg in metadata.legs[].seat with the first
leg mirrored to metadata.seat. On push, set the seat number on the user's
own AirTrail seat (the one with a userId), leaving co-passengers untouched;
import/poll read that same seat back.

* refactor(planner): move the AirTrail trip-open sync into useTripPlanner

Page containers must not own state/effects (lint:pages). Same logic,
relocated from the page into its data hook.

* test(db): pin the region-reconciliation test to its schema version

The test re-ran 'the last migration' assuming the reconciliation is last;
it no longer is once later migrations are appended. Pin to version 135 and
re-run from there (the appended migrations are idempotent).

* Various fixes: 2FA autofocus, viewer-timezone times, duplicate place guard (#1159)

* fix(auth): autofocus the 2FA code input when the MFA step appears (#767)

* fix(notifications): show notification and admin times in the viewer timezone (#1149)

SQLite CURRENT_TIMESTAMP is UTC but the string has no Z, so the client parsed
it as local time. Normalize in-app notification created_at to ISO-UTC, and stop
forcing the admin user table to render in the server timezone.

* fix(places): warn before adding a duplicate place (#1152)

Manually adding a place did not check the existing pool, so the same POI could
land in Unplanned twice. Flag a likely duplicate by Google Place ID, name or
near-identical coordinates and require a confirming second click to add anyway.

* fix(planner): make route tools reachable in mobile day plan sheet (#1142)

* wiki: update dev env

* wiki: small precision in dev env

* fix(planner): make route tools reachable in mobile day plan sheet

On mobile, selecting a day closes the plan sheet immediately, so the
route tools footer (Route toggle / Optimize / routing profile) - gated
on the selected day - was never reachable. Desktop was unaffected.

- Add showRouteToolsWhenExpanded prop to DayPlanSidebar: when set,
  route tools render on any expanded day with 2+ assigned places
- Make handleOptimize accept an explicit dayId (defaulting to
  selectedDayId, preserving desktop behavior)
- Keep the distance/duration pill gated on the selected day, since
  routeInfo belongs to the selected day's calculated route
- Enable the prop on the mobile plan sheet in TripPlannerPage

* fix(planner): correct route-tools prop doc and dev-environment wiki

- Reword the showRouteToolsWhenExpanded JSDoc to list the controls the
  footer actually renders (Route toggle / Optimize / travel profile);
  there is no "Open in Google Maps" action in that block.
- Wiki: drop the non-existent server test:parity script, document the
  real shared i18n:parity checks, and fix the i18n note (the translation
  layer already lives in @trek/shared, it is not "upcoming").

---------

Co-authored-by: jubnl <jgunther021@gmail.com>
Co-authored-by: Maurice <mauriceboe@icloud.com>

* feat(places): enrich list-imported places via the Places API (#886) (#1161)

* feat(places): enrich list-imported places via the Places API (#886)

Google/Naver list imports only carry a name and coordinates, so the places open
as bare pins — the Maps tab jumps to coordinates, with no photo, address or
open/closed. Add an opt-in "Enrich places via Google" toggle to the list-import
dialog, shown only when a Google Maps key is configured.

When enabled, after the (fast, unchanged) import the server runs a background
pass that re-resolves each place by name — biased to and validated against the
imported coordinates so a common-name search cannot overwrite the wrong place —
and fills the empty address/website/phone/photo columns plus the resolved
google_place_id, pushing each row over the live sync. Opening hours and the
proper Maps link then work on demand from the stored id.

Enrichment only fills empty fields, runs detached so a long list never blocks
the import, and no-ops when no key is configured.

* fix(places): use the ToggleSwitch component for the enrich toggle

Match the rest of the app — the import-enrichment opt-in used a raw checkbox;
swap it for the shared ToggleSwitch (text left, switch right) like the settings
toggles.

* fix(maps): bound place-photo cache growth (Wikimedia + Google) (#1174)

The place-photo cache (uploads/photos/google) grew unbounded: a Wikimedia
geosearch path cached full-res originals despite requesting a 400px thumb,
the writer applied no size guard, nothing reclaimed orphaned files, and
backups archived the whole re-derivable cache verbatim.

- Prefer the scaled `thumburl` over the full-res `info.url` in the Commons
  geosearch fallback.
- Downscale any cached image to <=800px JPEG via the existing jimp dep,
  with a safe fallback to the original bytes on decode failure.
- Add sweepOrphans() (orphaned meta rows + stray files) wired into the
  scheduler (startup + nightly), and removeIfUnreferenced() called on
  place delete for prompt reclamation.
- Exclude the re-derivable photo/trek caches from backups; restores
  self-heal as the cache dirs are recreated at startup.

* fix(sync): remap temp ids, prevent id collisions, surface failed mutations (#1175)

Closes three offline BLOCKERs from the PWA audit:

- B1: offline edits/deletes of an offline-created entity were lost. The
  negative temp id was baked into the PUT/DELETE url and never rewritten
  after the CREATE returned a real id, so dependents 404'd and were dropped.
  Dependents now carry a {id} placeholder + tempEntityId; flush builds a
  tempId->realId map and durably rewrites still-queued dependents on CREATE
  success (survives flush boundaries / reloads).
- B2: tempId = -(Date.now()) collided within a millisecond, overwriting an
  optimistic row. Replaced with a monotonic nextTempId() minter.
- B3: any 4xx marked the mutation failed with no rollback and no signal, and
  the badge ignored failed rows. Terminal failures now roll back the phantom
  optimistic CREATE; 401/408/425/429 are treated as retryable; failedCount()
  is surfaced in OfflineBanner (red pill) and OfflineTab.

* fix(maps): make offline tiles cover real trips (cap coherence + zoom-clamp) (#1177)

Closes BLOCKER B5 — the offline map was blank for most real trips:

- The Workbox 'map-tiles' cache held only 1000 entries while the prefetcher
  budgeted ~3413, so prefetched tiles were evicted on arrival. Both caps are
  now a coherent 12288 (~180 MB), kept in sync with cross-referencing comments.
- prefetchTilesForTrip skipped a trip entirely when its all-zooms estimate
  exceeded the cap, so region/road-trip bboxes got no tiles. Removed the
  all-or-nothing guard; prefetchTiles already fills zooms low→high and stops at
  the budget, so large trips now cache the zooms that fit instead of nothing.

* fix(security): stop cross-user offline data leak on shared devices (#1176)

Closes BLOCKER B4 — three reinforcing paths could serve one account's
cached data to the next user on a shared device:

- The Workbox 'api-data' cache keyed trip/user-scoped GETs by URL only
  (cookie-blind). Changed to NetworkOnly; offline reads come from the
  per-user IndexedDB cache via the repo layer instead.
- IndexedDB had no per-user scoping. The Dexie connection is now scoped
  per user (trek-offline-u<id>) behind a Proxy so the ~19 importers keep a
  stable binding; login opens the user DB, logout deletes it and returns
  to the anonymous DB.
- logout() was fire-and-forget and racy: background flush/syncAll could
  re-seed the DB after the wipe. It is now async and ordered — close an
  auth gate, unregister sync triggers, disconnect, clear caches, delete
  the user DB — and flush()/syncAll() bail when the gate is closed.

* fix(db): scope, evict, and cap the offline blob cache (H3) (#1178)

Blob cache previously leaked forever: clearTripData omitted it, entries had
no trip discriminator, and there was no size/count bound, so file blobs
survived trip eviction and could starve the map-tile cache for quota.

- BlobCacheEntry gains tripId + bytes; Dexie v3 adds a tripId index with a
  backfill upgrade (legacy rows -> tripId -1, bytes from blob.size)
- clearTripData purges the trip's blobs in-transaction
- enforceBlobBudget() evicts oldest-by-cachedAt past 200 entries / 100 MB
- tripSyncManager threads tripId/bytes into puts and enforces the budget

* fix(repo): fall back to Dexie when a network read fails (H2) (#1179)

Repos gated reads on raw navigator.onLine and the online branch had no
try/catch, so a captive portal or connected-but-no-internet (navigator.onLine
lying "true") threw a network error instead of serving the good cached copy —
blanking the trip even though Dexie held it.

- new onlineThenCache(onlineFn, cacheFn) helper: reads the cache when offline,
  and on a network-level failure (Axios error with no HTTP response). A genuine
  HTTP error (4xx/5xx — the server responded) is rethrown so callers still set
  error state / navigate, not masked by a stale cache.
- gates only on navigator.onLine, NOT the connectivity probe: the probe is a
  coarse global flag and one failed health check would otherwise divert every
  read to the (possibly empty) cache even when the request would succeed.
- every repo list/get read path routed through it (reads only — writes still
  go through the mutation queue so failures surface)
- tests: captive-portal fallback, HTTP-error rethrow, non-Axios rethrow

* fix(store): reset and uniformly hydrate trip-scoped slices in loadTrip (H4, H5) (#1180)

loadTrip only replaced the first slice group, so budget/reservations/files
from a previous trip stayed visible after switching trips (data exposure on a
shared screen). Those three also loaded via separate tab-gated effects, so they
never hydrated offline for an unopened tab.

- resetTrip() clears every trip-scoped slice (keeps global tags/categories) and
  runs at the top of loadTrip, so a switch can't leak the prior trip's data
- loadTrip now hydrates budget/reservations/files through their repos alongside
  the rest (non-fatal catches), making offline hydration uniform
- useTripPlanner drops the redundant loadFiles + reservations/budget effects;
  tab-gated lazy reloads stay as on-demand refresh
- tests: cross-trip no-leak, uniform hydration, resetTrip

* fix(sync): re-hydrate active trip store on reconnect/online (H1) (#1181)

setRefetchCallback was dead code, so on reconnect the queue flushed and Dexie
re-seeded but the open trip's Zustand store was never refreshed — a
collaborator's edits made while we were offline didn't appear until navigating
away and back.

- new tripStore.hydrateActiveTrip(): silent refresh of the active trip's
  collaborative state (days/places/packing/todo/budget/reservations/files),
  no resetTrip and no isLoading toggle so there's no splash on reconnect
- syncTriggers wires setRefetchCallback to it (WS layer awaits the flush hook
  first) and re-hydrates open trips after the online-event syncAll; cleared on
  unregister
- websocket exposes getActiveTrips() for the online-event path
- tests: refetch wiring + ordering, silent hydrate without reset/splash

* fix(server): lengthen idempotency key TTL to survive multi-day offline (H6) (#1182)

The nightly cleanup deleted idempotency keys older than 24h. The TREK client
replays queued mutations with their X-Idempotency-Key on reconnect, so a device
offline longer than a day had its keys GC'd before it returned — the replayed
POST was then treated as new and created a duplicate.

- raise the TTL to 30 days (DEFAULT_IDEMPOTENCY_TTL_SECONDS), overridable via
  IDEMPOTENCY_TTL_SECONDS
- extract purgeExpiredIdempotencyKeys(now, ttl, db) (mirrors cleanupOldBackups)
  with an injectable db, and have the cron job call it
- tests: 30-day default eviction, 25-day key retained (was dropped at 24h),
  env override

H7 (exactly-once across the lost-response window) is deferred: a correct fix
must store the response in the same DB transaction as the entity write. Doing
it in the generic interceptor (reserve-before-handler) cannot store the real
response body for the crash case, which would break the client's temp->real id
remapping on replay (mutationQueue.flush relies on the entity in the body). It
needs a per-service change and is tracked separately.

* fix(realtime): correct assignment:created echo dedup (H11) (#1183)

When X-Idempotency/X-Socket-Id let an own-echo through, the assignment:created
dedup had two bugs: it keyed on place id, so (1) a legitimate second assignment
of a place already on the day was silently dropped, and (2) the temp-version
reconciliation matched place?.id === placeId, letting undefined === undefined
collapse place-less rows onto each other.

- dedup now keys on assignment id (exact-id duplicate -> no-op)
- temp (negative-id) optimistic rows are reconciled only when a real placeId
  matches, replacing just that row; a sibling temp of another place is untouched
- everything else appends, including a genuine 2nd assignment of the same place
- tests: 2nd-of-same-place kept, correct temp picked among siblings, place-less
  rows don't collapse

Note: the broader own-echo suppression relies on X-Socket-Id being sent; this
fixes the client-side fallback when an echo slips through.

* fix(pwa): persist offline storage + Mapbox offline policy (H8, H9) (#1184)

H8: prefetched tiles and file blobs could be evicted under storage pressure
(worsened by opaque tile responses inflating the quota ~7MB each), blanking the
offline map right when a traveler needs it. Request persistent storage at app
init so the browser exempts our caches from eviction. We deliberately keep tile
requests no-cors (a cors switch would break self-hosted/custom tile providers
without CORS headers), so persistence is the safe mitigation rather than
de-opaquing responses.

H9: Mapbox GL users had no offline map at all — no runtimeCaching matched the
Mapbox hosts. Add a StaleWhileRevalidate rule for api.mapbox.com /
*.tiles.mapbox.com so visited areas are available offline (best-effort; full
pre-download still requires the Leaflet renderer, now documented).

- new sync/persistentStorage.ts requestPersistentStorage(), called from main.tsx
- vite.config: mapbox-tiles SW cache rule
- MapViewAuto / tilePrefetcher comments document the offline-maps policy
- tests for the persist helper (granted / already-persisted / absent / rejects)

* ci(security): only fail Docker Scout on fixable CVEs

Add only-fixed so the scan no longer fails on vulnerabilities with no
upstream fix available (e.g. base-image OS packages), and only flags
actionable, fixable findings.

* build(docker): rebuild gosu with a current Go toolchain

Debian's apt gosu ships an old Go stdlib that the image CVE scan flags
(1 critical + several high, all in golang/stdlib). Build gosu from source
with a current Go toolchain and copy the static binary in instead; the
runtime behaviour is unchanged — gosu still drops root to node at startup.

* build(deps): bump tsx's esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)

The production image's last image-scan finding was esbuild 0.28.0, pulled
in transitively by tsx. Pin tsx's esbuild to 0.28.1 (within tsx's ~0.28.0
range) to clear GHSA-gv7w-rqvm-qjhr. Lockfile-only; no runtime change.

* feat(auth): add "Remember me" checkbox to extend session lifetime (#1189)

Adds a "Remember me" checkbox to the login form (single responsive page,
covers mobile + desktop). Unchecked (default) issues the existing
SESSION_DURATION JWT with a browser-session cookie (no maxAge); checked
issues a longer-lived JWT plus a persistent cookie sized by the new
SESSION_DURATION_REMEMBER env var (default 30d). The choice is threaded
through the MFA verify leg so it survives the step-up.

Register/demo logins keep their current persistent behaviour.

* chore(ssrf): include lookup error code in error message

* fix(backup): restore from Docker, fail-fast on shadowed /app, bundle encryption key (#1193) (#1197)

* fix(backup): restore uploads through symlinked dir and bundle encryption key (#1193)

Restoring a backup inside Docker threw ERR_FS_CP_DIR_TO_NON_DIR because
/app/server/uploads is a symlink to the mounted /app/uploads volume and
cpSync (dereference:false) refuses to overwrite the symlink node with a
directory. The DB was swapped before this failing copy, so users saw
restored data but missing upload files (trip covers). Resolve the symlink
with realpathSync before copying so the merge targets the real directory;
no-op on a plain dir, so non-Docker behavior is unchanged.

Also bundle the at-rest encryption key (data/.encryption_key) into the
backup so a restore onto a different install can decrypt stored secrets
(API keys, MFA, SMTP/OIDC). Skipped when ENCRYPTION_KEY is provided via
env (the file is not the source of truth then). On restore the key is
swapped back if the archive carries one; a restart is required for the
in-memory key to take effect.

* fix(docker): fail fast when a volume shadows /app (#1193)

Mounting an old volume at /app hides the image's node_modules and dist,
so startup crashed with a cryptic "Cannot find module
'tsconfig-paths/register'". Add a CMD preflight that detects the missing
app files and exits with actionable guidance. Document in the README that
only /app/data and /app/uploads should be mounted, never /app.

* fix: ssrf test

* fix(places): fall back to search when autocomplete details lookup fails (#1192) (#1198)

Clicking an auto-suggest dropdown item did a second /maps/details lookup
that could fail (details kill-switch off, an overloaded OSM Overpass mirror
behind a proxy, or any upstream error), dead-ending on "Place search failed"
while the search button stayed reliable.

handleSelectSuggestion now treats a missing or coordinate-less details result
(or a thrown error) as a miss and falls back to the text-search path the search
button uses, applying the first result. The error toast only fires if the
fallback also returns nothing. Adds tests for the previously untested
suggestion-click path.

* fix(planner): scroll long place description/notes on mobile (#1195) (#1199)

The place details card (PlaceInspector) clipped long description/notes
with no way to scroll. The content area is a flex column whose children
(description/notes) had the default flex-shrink: 1, so once the card hit
its maxHeight cap they compressed to fit and their overflow:hidden clipped
the text instead of overflowing into a scroll region.

- Make the content area a bounded scroll region (flex: 1 1 auto,
  minHeight: 0, overflowY: auto, momentum + overscroll containment).
- Pin description/notes with flexShrink: 0 so they keep natural height and
  the card overflows into the scroll instead of clipping.
- Pin header/footer with flexShrink: 0 so they stay fixed while scrolling.
- Add wordBreak/overflowWrap to the description div to fix horizontal clip.

* Day plan: hotel travel times at start/end + login toggle polish (#1206)

* fix(login): use the shared toggle for the stay-signed-in option

* feat(planner): show hotel travel times at the start and end of a day

* fix(login): give the stay-signed-in toggle an accessible name and fix its test

* fix(trips): keep the day-count field empty when cleared and validate it (#1204) (#1207)

* docs(readme): refresh dashboard, costs and trip screenshots (#1208)

* docs(readme): refresh dashboard, costs and trip screenshots

* docs(readme): correct outdated info (React 19, NestJS, 20 languages, Costs rename, passkeys, AirTrail, notifications)

* chore: update all dependencies (#1209)

* chore: update all dependencies

* chore: remove lint errors

* fix(client): restore typecheck after dependency bump

vitest 4 types vi.fn() as Mock<Procedure | Constructable>, which no
longer assigns to the strictly-typed onUpdate prop; type the mock
explicitly. TS6 + the new transitive @types/node 25 stopped auto-
including node builtin module types, so import('node:buffer') failed;
add @types/node as a direct client devDependency and a scoped node
type reference in the one test that needs it.

* test: fix constructor mocks for vitest 4 Reflect.construct semantics

vitest 4 resolves new-invoked mocks via Reflect.construct, which rejects
arrow-function implementations (including mockReturnValue sugar) as
non-constructable. Convert mapbox-gl and better-sqlite3 mocks that the
code instantiates with new to regular function implementations.

* fix(planner): only route to multi-day transport endpoints on their pickup/drop-off days (#1210) (#1212)

* chore: move to Frankfurter API for exchange rate (#1214)

* Restore nest coverage to >=80% after the #1209 dep bump (istanbul provider + branch tests) (#1213)

* fix(server): set oxc:false in vitest so the SWC transform survives the Vite 8 bump

* fix(server): switch coverage to the istanbul provider (v8 under-reports branches on Vite 8 + Vitest 4)

* test(nest): cover controller/service branches to clear the 80% coverage gate

* fix(planner): correct transfer-day hotel legs and connect them to transports (#1215)

When you change hotels on a day, the morning bookend leg showed the hotel
you check into instead of the one you slept in whenever the morning stay
didn't end exactly on that day — both bookends collapsed onto the arriving
hotel. The morning hotel is now picked by "checked in earlier and still in
range" rather than "checks out today", which also fixes the route
optimizer's start anchor for the same case.

The bookend legs now connect to the first/last located waypoint of the day
— a place or a transport endpoint (a car return, a taxi or train arrival) —
so the hotel-to-transport drives are included too.

* feat(transports): add kitinerary import-from-file button to Transports tab

* docs(config): document SESSION_DURATION_REMEMBER across deployment artifacts

Add SESSION_DURATION_REMEMBER to docker-compose, .env.example, README env
table, Helm chart (values + configmap passthrough), the Unraid template, and
the Unraid install guide. Where the base SESSION_DURATION was also absent
(README, charts, Unraid) add the pair so the Remember-me variable has context.

---------

Co-authored-by: gzor <risenbrowser@web.de>
Co-authored-by: ppuassi <34529179+ppuassi@users.noreply.github.com>
Co-authored-by: sss3978 <106522699+soma3978@users.noreply.github.com>
Co-authored-by: SkyLostTR <onurluerin@gmail.com>
Co-authored-by: Julien G. <66769052+jubnl@users.noreply.github.com>
Co-authored-by: Dimitris Kafetzis <39215021+Dkafetzis@users.noreply.github.com>
Co-authored-by: Ahmet Yılmaz <70577707+sharkpaw@users.noreply.github.com>
Co-authored-by: jubnl <jgunther021@gmail.com>
Co-authored-by: jufy111 <40817638+jufy111@users.noreply.github.com>
Co-authored-by: Larinel <bodink7@gmail.com>
Co-authored-by: rossanorbr <48014819+rossanorbr@users.noreply.github.com>

server/.env.example

@@ -8,6 +8,8 @@ NODE_ENV=development # development = development mode; production = production m
 # Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 TZ=UTC # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
 # DEFAULT_LANGUAGE=en # Default language on the login page for users with no saved preference (default: en)
+# SESSION_DURATION=30d # How long users stay logged in — sets the trek_session JWT exp + cookie maxAge. Accepts 1h, 12h, 7d, 30d, 90d. Default: 24h
+# SESSION_DURATION_REMEMBER=30d # Session length when "Remember me" is ticked at login — longer-lived JWT + persistent cookie that survives browser restarts. Same format as SESSION_DURATION. Default: 30d
 # Supported values: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
 # Note: browser/OS language is detected automatically first; this is the fallback when no match is found.
 LOG_LEVEL=info # info = concise user actions; debug = verbose admin-level details

server/.gitignore

@@ -0,0 +1 @@
+.atlas-geo-cache/

server/.prettierrc

@@ -0,0 +1,18 @@
+{
+  "printWidth": 120,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "plugins": [
+    "prettier-plugin-organize-imports",
+    "@trivago/prettier-plugin-sort-imports"
+  ],
+  "importOrder": [
+    "^[a-zA-Z]",
+    "^@/.*"
+  ],
+  "importOrderSeparation": true,
+  "importOrderParserPlugins": [
+    "typescript",
+    "decorators-legacy"
+  ]
+}

server/eslint.config.mjs

@@ -0,0 +1,47 @@
+import js from '@eslint/js';
+
+import gitignore from 'eslint-config-flat-gitignore';
+import eslintConfigPrettier from 'eslint-config-prettier';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  gitignore({ strict: false }),
+  {
+    ignores: [
+      'node_modules',
+      'dist',
+      'coverage',
+      'public',
+      'data',
+      'uploads',
+      'assets',
+      'scripts/**',
+      'reset-admin.js',
+      '**/*.config.js',
+      '**/*.config.ts',
+      '**/*.config.mjs',
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  eslintConfigPrettier,
+  {
+    files: ['src/**/*.ts', 'tests/**/*.ts'],
+    rules: {
+      // --- Severities tuned to keep CI green on a codebase that was never linted ---
+      // (each rule below has pre-existing violations; surfaced as warnings, not blockers)
+      '@typescript-eslint/no-explicit-any': 'warn',
+      '@typescript-eslint/no-unused-vars': [
+        'warn',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_', caughtErrorsIgnorePattern: '^_' },
+      ],
+      // The server is CommonJS (tsconfig module: commonjs); require() is intentional throughout.
+      '@typescript-eslint/no-require-imports': 'warn',
+      '@typescript-eslint/no-unsafe-function-type': 'warn',
+      // js.recommended rules with pre-existing hits in the never-linted codebase.
+      'no-empty': 'warn',
+      'no-useless-escape': 'warn',
+      'prefer-const': 'warn',
+    },
+  },
+);

server/package.json

@@ -1,19 +1,32 @@
 {
-  "name": "trek-server",
+  "name": "@trek/server",
   "version": "3.0.22",
   "main": "src/index.ts",
   "scripts": {
-    "start": "node --import tsx src/index.ts",
-    "dev": "tsx watch src/index.ts",
+    "start": "node --require tsconfig-paths/register dist/index.js",
+    "dev": "node scripts/dev.mjs",
+    "build": "node scripts/build.mjs",
+    "start:prod": "node --require tsconfig-paths/register dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\" \"test/**/*.ts\"",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "lint:check": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:unit": "vitest run tests/unit",
     "test:integration": "vitest run tests/integration",
     "test:ws": "vitest run tests/websocket",
+    "test:e2e": "vitest run tests/e2e",
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
+    "@nestjs/common": "^11.1.24",
+    "@nestjs/core": "^11.1.24",
+    "@nestjs/platform-express": "^11.1.24",
+    "@simplewebauthn/server": "^13.1.2",
+    "@trek/shared": "*",
     "archiver": "^6.0.1",
     "bcryptjs": "^2.4.3",
     "better-sqlite3": "^12.8.0",
@@ -30,22 +43,33 @@
     "nodemailer": "^8.0.5",
     "otplib": "^12.0.1",
     "qrcode": "^1.5.4",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2",
     "semver": "^7.7.4",
+    "tsconfig-paths": "^4.2.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.2",
     "undici": "^7.0.0",
     "unzipper": "^0.12.3",
     "uuid": "^14.0.0",
-    "ws": "^8.19.0",
+    "ws": "^8.21.0",
     "zod": "^4.3.6"
   },
   "overrides": {
     "hono": "^4.12.16",
     "@hono/node-server": "^1.19.13",
     "picomatch": "^4.0.4",
-    "ip-address": "^10.1.1"
+    "ip-address": "^10.1.1",
+    "multer": "^2.1.1",
+    "ws": "^8.21.0",
+    "qs": "^6.15.2",
+    "file-type": "^21.3.4"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@nestjs/testing": "^11.1.24",
+    "@swc/core": "^1.15.40",
+    "@trivago/prettier-plugin-sort-imports": "^6.0.2",
     "@types/archiver": "^7.0.0",
     "@types/bcryptjs": "^2.4.6",
     "@types/better-sqlite3": "^7.6.13",
@@ -63,10 +87,19 @@
     "@types/unzipper": "^0.10.11",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.18.1",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-istanbul": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.9",
+    "eslint": "^9.18.0",
+    "eslint-config-flat-gitignore": "^2.3.0",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.2",
     "nodemon": "^3.1.0",
+    "prettier": "^3.8.3",
+    "prettier-plugin-organize-imports": "^4.3.0",
     "supertest": "^7.2.2",
+    "typescript-eslint": "^8.58.2",
     "tz-lookup": "^6.1.25",
-    "vitest": "^3.2.4"
+    "unplugin-swc": "^1.5.9",
+    "vitest": "^4.1.9"
   }
 }

server/scripts/build-atlas-geo.mjs

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+// Build server/assets/atlas/{admin0,admin1}.geojson.gz from geoBoundaries (gbOpen).
+//
+// Why: Atlas previously fetched country + sub-national boundaries from Natural Earth's
+// GitHub `master` at runtime. Natural Earth is stale (e.g. it still shows Norway's
+// pre-2020 counties) and depicts some contested territory in ways the project does not
+// want (see nvkelso/natural-earth-vector#391). geoBoundaries (CC BY 4.0) is current,
+// redistributable, and carries ISO 3166-2 codes on its per-country ADM1 files.
+//
+// This downloads the *simplified* per-country gbOpen ADM0 (countries) and ADM1
+// (regions) layers from a pinned geoBoundaries revision, normalizes each feature to
+// the property names the Atlas client/server already read, and writes two gzipped
+// FeatureCollections that the server serves at runtime (no network at boot).
+//
+// geoBoundaries: CC BY 4.0 — https://www.geoboundaries.org/  (attribution required).
+
+import fs from 'node:fs'
+import path from 'node:path'
+import zlib from 'node:zlib'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const OUT_DIR = path.join(__dirname, '..', 'assets', 'atlas')
+
+// Pinned geoBoundaries revision (override with GB_REF=<sha|branch|tag>). The LFS media
+// endpoint resolves a commit SHA, branch, or tag in the <ref> path segment.
+const GB_REF = process.env.GB_REF || '5c25134028196d43ce97b5071934fd0cfc92f09f'
+const MEDIA = (a3, level) =>
+  `https://media.githubusercontent.com/media/wmgeolab/geoBoundaries/${GB_REF}` +
+  `/releaseData/gbOpen/${a3}/${level}/geoBoundaries-${a3}-${level}_simplified.geojson`
+
+// Country borders come from CGAZ (the Comprehensive Global Administrative Zones composite)
+// rather than per-country gbOpen ADM0: CGAZ is gap-filled, so it includes territories
+// that gbOpen omits or folds away — notably Svalbard (inside Norway's geometry) and
+// Greenland. The country layer only needs A3/A2/name, so CGAZ's lack of `shapeISO` is
+// irrelevant. (gbOpen ADM0 maxes Norway at 71°N and has no Svalbard at all.)
+const CGAZ_ADM0 =
+  `https://media.githubusercontent.com/media/wmgeolab/geoBoundaries/${GB_REF}` +
+  `/releaseData/CGAZ/geoBoundariesCGAZ_ADM0.geojson`
+
+const CONCURRENCY = 8
+const RETRIES = 3
+
+// Complete ISO-3166-1 alpha-3 → alpha-2 map (source: lukes/ISO-3166-Countries-with-
+// Regional-Codes). Drives ADM1 enumeration (one gbOpen request per code; missing ones
+// 404 and are skipped) and stamps `iso_a2`/`ISO_A2` (geoBoundaries keys by alpha-3
+// `shapeGroup`). A complete map — not the client's curated ~180 — is what restores the
+// dropped territories (Greenland, Falklands, French Guiana, …).
+const A3_TO_A2 = {"ABW":"AW", "AFG":"AF", "AGO":"AO", "AIA":"AI", "ALA":"AX", "ALB":"AL", "AND":"AD", "ARE":"AE", "ARG":"AR", "ARM":"AM", "ASM":"AS", "ATA":"AQ", "ATF":"TF", "ATG":"AG", "AUS":"AU", "AUT":"AT", "AZE":"AZ", "BDI":"BI", "BEL":"BE", "BEN":"BJ", "BES":"BQ", "BFA":"BF", "BGD":"BD", "BGR":"BG", "BHR":"BH", "BHS":"BS", "BIH":"BA", "BLM":"BL", "BLR":"BY", "BLZ":"BZ", "BMU":"BM", "BOL":"BO", "BRA":"BR", "BRB":"BB", "BRN":"BN", "BTN":"BT", "BVT":"BV", "BWA":"BW", "CAF":"CF", "CAN":"CA", "CCK":"CC", "CHE":"CH", "CHL":"CL", "CHN":"CN", "CIV":"CI", "CMR":"CM", "COD":"CD", "COG":"CG", "COK":"CK", "COL":"CO", "COM":"KM", "CPV":"CV", "CRI":"CR", "CUB":"CU", "CUW":"CW", "CXR":"CX", "CYM":"KY", "CYP":"CY", "CZE":"CZ", "DEU":"DE", "DJI":"DJ", "DMA":"DM", "DNK":"DK", "DOM":"DO", "DZA":"DZ", "ECU":"EC", "EGY":"EG", "ERI":"ER", "ESH":"EH", "ESP":"ES", "EST":"EE", "ETH":"ET", "FIN":"FI", "FJI":"FJ", "FLK":"FK", "FRA":"FR", "FRO":"FO", "FSM":"FM", "GAB":"GA", "GBR":"GB", "GEO":"GE", "GGY":"GG", "GHA":"GH", "GIB":"GI", "GIN":"GN", "GLP":"GP", "GMB":"GM", "GNB":"GW", "GNQ":"GQ", "GRC":"GR", "GRD":"GD", "GRL":"GL", "GTM":"GT", "GUF":"GF", "GUM":"GU", "GUY":"GY", "HKG":"HK", "HMD":"HM", "HND":"HN", "HRV":"HR", "HTI":"HT", "HUN":"HU", "IDN":"ID", "IMN":"IM", "IND":"IN", "IOT":"IO", "IRL":"IE", "IRN":"IR", "IRQ":"IQ", "ISL":"IS", "ISR":"IL", "ITA":"IT", "JAM":"JM", "JEY":"JE", "JOR":"JO", "JPN":"JP", "KAZ":"KZ", "KEN":"KE", "KGZ":"KG", "KHM":"KH", "KIR":"KI", "KNA":"KN", "KOR":"KR", "KWT":"KW", "LAO":"LA", "LBN":"LB", "LBR":"LR", "LBY":"LY", "LCA":"LC", "LIE":"LI", "LKA":"LK", "LSO":"LS", "LTU":"LT", "LUX":"LU", "LVA":"LV", "MAC":"MO", "MAF":"MF", "MAR":"MA", "MCO":"MC", "MDA":"MD", "MDG":"MG", "MDV":"MV", "MEX":"MX", "MHL":"MH", "MKD":"MK", "MLI":"ML", "MLT":"MT", "MMR":"MM", "MNE":"ME", "MNG":"MN", "MNP":"MP", "MOZ":"MZ", "MRT":"MR", "MSR":"MS", "MTQ":"MQ", "MUS":"MU", "MWI":"MW", "MYS":"MY", "MYT":"YT", "NAM":"NA", "NCL":"NC", "NER":"NE", "NFK":"NF", "NGA":"NG", "NIC":"NI", "NIU":"NU", "NLD":"NL", "NOR":"NO", "NPL":"NP", "NRU":"NR", "NZL":"NZ", "OMN":"OM", "PAK":"PK", "PAN":"PA", "PCN":"PN", "PER":"PE", "PHL":"PH", "PLW":"PW", "PNG":"PG", "POL":"PL", "PRI":"PR", "PRK":"KP", "PRT":"PT", "PRY":"PY", "PSE":"PS", "PYF":"PF", "QAT":"QA", "REU":"RE", "ROU":"RO", "RUS":"RU", "RWA":"RW", "SAU":"SA", "SDN":"SD", "SEN":"SN", "SGP":"SG", "SGS":"GS", "SHN":"SH", "SJM":"SJ", "SLB":"SB", "SLE":"SL", "SLV":"SV", "SMR":"SM", "SOM":"SO", "SPM":"PM", "SRB":"RS", "SSD":"SS", "STP":"ST", "SUR":"SR", "SVK":"SK", "SVN":"SI", "SWE":"SE", "SWZ":"SZ", "SXM":"SX", "SYC":"SC", "SYR":"SY", "TCA":"TC", "TCD":"TD", "TGO":"TG", "THA":"TH", "TJK":"TJ", "TKL":"TK", "TKM":"TM", "TLS":"TL", "TON":"TO", "TTO":"TT", "TUN":"TN", "TUR":"TR", "TUV":"TV", "TWN":"TW", "TZA":"TZ", "UGA":"UG", "UKR":"UA", "UMI":"UM", "URY":"UY", "USA":"US", "UZB":"UZ", "VAT":"VA", "VCT":"VC", "VEN":"VE", "VGB":"VG", "VIR":"VI", "VNM":"VN", "VUT":"VU", "WLF":"WF", "WSM":"WS", "YEM":"YE", "ZAF":"ZA", "ZMB":"ZM", "ZWE":"ZW"}
+
+const COUNTRIES = Object.keys(A3_TO_A2) // every ISO alpha-3 code (ADM1 fetch list)
+
+// Cache raw downloads so re-runs (e.g. to tune simplification) don't re-fetch ~360 files.
+const CACHE_DIR = path.join(__dirname, '..', '.atlas-geo-cache', GB_REF)
+
+async function fetchGeo(url) {
+  const cacheFile = path.join(CACHE_DIR, url.split('/').slice(-1)[0])
+  if (fs.existsSync(cacheFile)) {
+    const cached = fs.readFileSync(cacheFile, 'utf8')
+    return cached === '' ? null : JSON.parse(cached)
+  }
+  for (let attempt = 1; attempt <= RETRIES; attempt++) {
+    try {
+      const res = await fetch(url, { headers: { 'User-Agent': 'TREK atlas builder' } })
+      if (res.status === 404) { fs.writeFileSync(cacheFile, ''); return null } // no file — skip
+      if (!res.ok) throw new Error(`HTTP ${res.status}`)
+      const text = await res.text()
+      if (text.startsWith('version https://git-lfs')) throw new Error('got LFS pointer, not content')
+      const parsed = JSON.parse(text)
+      fs.writeFileSync(cacheFile, text)
+      return parsed
+    } catch (err) {
+      if (attempt === RETRIES) {
+        console.warn(`  ! ${url.split('/').slice(-1)[0]}: ${err.message}`)
+        return null
+      }
+      await new Promise(r => setTimeout(r, 500 * attempt))
+    }
+  }
+  return null
+}
+
+// Run async tasks with a fixed concurrency cap.
+async function pool(items, worker) {
+  const results = []
+  let i = 0
+  const runners = Array.from({ length: CONCURRENCY }, async () => {
+    while (i < items.length) {
+      const idx = i++
+      results[idx] = await worker(items[idx], idx)
+    }
+  })
+  await Promise.all(runners)
+  return results
+}
+
+// Geometry size control. geoBoundaries' "_simplified" files still carry ~12-decimal
+// coordinates, which dominate the JSON size. Quantizing to a fixed grid (rounding
+// preserves topology — identical input coords map to identical output) and dropping
+// the now-redundant consecutive duplicate points shrinks the bundles ~5-8x with no
+// visible effect at the atlas' zoom range (3-10). ADM0 fills are viewed zoomed out, so
+// they tolerate a coarser grid than ADM1 region borders.
+const ADM0_DECIMALS = 2 // ~1.1 km
+const ADM1_DECIMALS = 3 // ~110 m
+
+function quantizeRing(ring, decimals) {
+  const m = 10 ** decimals
+  const out = []
+  let prevX, prevY
+  for (const pt of ring) {
+    const x = Math.round(pt[0] * m) / m
+    const y = Math.round(pt[1] * m) / m
+    if (x === prevX && y === prevY) continue
+    out.push([x, y])
+    prevX = x; prevY = y
+  }
+  return out
+}
+
+// Quantize a (Multi)Polygon, dropping rings that collapse below a valid ring (<4 pts).
+function quantizeGeometry(geom, decimals) {
+  if (!geom) return null
+  if (geom.type === 'Polygon') {
+    const rings = geom.coordinates.map(r => quantizeRing(r, decimals)).filter(r => r.length >= 4)
+    return rings.length ? { type: 'Polygon', coordinates: rings } : null
+  }
+  if (geom.type === 'MultiPolygon') {
+    const polys = geom.coordinates
+      .map(poly => poly.map(r => quantizeRing(r, decimals)).filter(r => r.length >= 4))
+      .filter(poly => poly.length)
+    return polys.length ? { type: 'MultiPolygon', coordinates: polys } : null
+  }
+  return geom
+}
+
+// Normalize one CGAZ ADM0 feature (keyed by alpha-3 `shapeGroup`) to the property names
+// the client country layer reads (ISO_A2/ADM0_A3/NAME/ADMIN). Returns null for the CRS
+// pseudo-entry or anything without a group/geometry.
+function normalizeAdm0Feature(f) {
+  const a3 = f.properties?.shapeGroup
+  if (!a3) return null
+  const name = f.properties?.shapeName || a3
+  const geometry = quantizeGeometry(f.geometry, ADM0_DECIMALS)
+  if (!geometry) return null
+  return {
+    type: 'Feature',
+    properties: { ISO_A2: A3_TO_A2[a3] || null, ADM0_A3: a3, NAME: name, ADMIN: name },
+    geometry,
+  }
+}
+
+function normalizeAdm1(geo, a3, countryName) {
+  if (!geo?.features) return []
+  return geo.features.map(f => {
+    const name = f.properties?.shapeName || ''
+    const geometry = quantizeGeometry(f.geometry, ADM1_DECIMALS)
+    if (!geometry) return null
+    const a2 = A3_TO_A2[a3] || null
+    // shapeISO is a real ISO 3166-2 code for ~90% of features; geoBoundaries leaves the
+    // rest blank or uses an `XX_YYY` placeholder. Keep real/placeholder codes as-is
+    // (stable per polygon → manual mark/unmark works, real ones match Nominatim). For
+    // blank codes, synthesize a stable id mirroring the server's geocode fallback so
+    // every region is still markable.
+    let code = f.properties?.shapeISO || ''
+    if (!code && a2) code = `${a2}-${name.replace(/[^A-Za-z0-9]/g, '').substring(0, 3).toUpperCase()}`
+    return {
+      type: 'Feature',
+      // Property names the Atlas region layer + server getRegionGeo already read.
+      properties: {
+        iso_a2: a2,
+        iso_3166_2: code,
+        name,
+        name_en: name,
+        admin: countryName,
+      },
+      geometry,
+    }
+  }).filter(Boolean)
+}
+
+async function main() {
+  console.log(`[atlas-geo] geoBoundaries ref ${GB_REF}; ${COUNTRIES.length} countries`)
+  fs.mkdirSync(OUT_DIR, { recursive: true })
+  fs.mkdirSync(CACHE_DIR, { recursive: true })
+
+  // ADM0 (countries) — one comprehensive CGAZ file (large; cached). Also yields the
+  // English country name (shapeGroup → shapeName) used for the ADM1 `admin` field.
+  console.log('[atlas-geo] downloading CGAZ ADM0 (countries)…')
+  const cgaz = await fetchGeo(CGAZ_ADM0)
+  const adm0Features = []
+  const a3ToName = {}
+  for (const f of cgaz?.features || []) {
+    const nf = normalizeAdm0Feature(f)
+    if (nf) { a3ToName[nf.properties.ADM0_A3] = nf.properties.NAME; adm0Features.push(nf) }
+  }
+
+  // ADM1 (sub-national regions) — per-country gbOpen (carries ISO 3166-2 `shapeISO`).
+  console.log('[atlas-geo] downloading ADM1 (regions)…')
+  const adm1Raw = await pool(COUNTRIES, a3 => fetchGeo(MEDIA(a3, 'ADM1')))
+  const adm1Features = []
+  let withCodes = 0
+  COUNTRIES.forEach((a3, idx) => {
+    const feats = normalizeAdm1(adm1Raw[idx], a3, a3ToName[a3] || a3)
+    for (const f of feats) if (f.properties.iso_3166_2) withCodes++
+    adm1Features.push(...feats)
+  })
+
+  const write = (name, features) => {
+    const fc = { type: 'FeatureCollection', features }
+    const gz = zlib.gzipSync(Buffer.from(JSON.stringify(fc)), { level: 9 })
+    const file = path.join(OUT_DIR, `${name}.geojson.gz`)
+    fs.writeFileSync(file, gz)
+    console.log(`[atlas-geo] wrote ${path.relative(path.join(__dirname, '..'), file)} — ${features.length} features, ${(gz.length / 1e6).toFixed(1)} MB gz`)
+  }
+
+  write('admin0', adm0Features)
+  write('admin1', adm1Features)
+
+  const missing1 = COUNTRIES.filter((a3, i) => !normalizeAdm1(adm1Raw[i], a3, '').length)
+  console.log(`[atlas-geo] ADM0 country features: ${adm0Features.length}`)
+  console.log(`[atlas-geo] ADM1 countries without regions (skipped/404): ${missing1.length}`)
+  console.log(`[atlas-geo] ADM1 features with ISO 3166-2 code: ${withCodes}/${adm1Features.length}`)
+}
+
+main().catch(err => { console.error(err); process.exit(1) })

server/scripts/build.mjs

@@ -0,0 +1,9 @@
+import { execSync } from 'node:child_process';
+
+try {
+  execSync('tsc -p tsconfig.build.json', { stdio: 'inherit' });
+} catch {
+  console.warn('[build] tsc reported type errors — emitting anyway (gated by `npm run typecheck`).');
+}
+
+console.log('[build] dist ready.');

server/scripts/dev.mjs

@@ -0,0 +1,32 @@
+import { execSync, spawn } from 'node:child_process';
+
+console.log('[dev] initial build...');
+execSync('node scripts/build.mjs', { stdio: 'inherit' });
+
+const children = [];
+const stop = () => { children.forEach((c) => { try { c.kill(); } catch {} }); process.exit(0); };
+process.on('SIGINT', stop);
+process.on('SIGTERM', stop);
+
+// Start tsc -w and wait for its first "Watching for file changes." before launching
+// node --watch, so the initial tsc compilation doesn't trigger a spurious restart.
+const tsc = spawn('npx', ['tsc', '-w', '-p', 'tsconfig.build.json', '--preserveWatchOutput'], {
+  stdio: ['ignore', 'pipe', 'inherit'],
+  shell: true,
+});
+children.push(tsc);
+
+let nodeProc = null;
+let ready = false;
+
+tsc.stdout.on('data', (chunk) => {
+  process.stdout.write(chunk);
+  if (!ready && chunk.toString().includes('Watching for file changes')) {
+    ready = true;
+    nodeProc = spawn('node', ['--require', 'tsconfig-paths/register', '--watch', 'dist/index.js'], {
+      stdio: 'inherit',
+      shell: true,
+    });
+    children.push(nodeProc);
+  }
+});

server/src/addons.ts

@@ -7,6 +7,7 @@ export const ADDON_IDS = {
   ATLAS: 'atlas',
   COLLAB: 'collab',
   JOURNEY: 'journey',
+  AIRTRAIL: 'airtrail',
 } as const;
 
 export type AddonId = typeof ADDON_IDS[keyof typeof ADDON_IDS];

server/src/app.ts

@@ -1,522 +0,0 @@
-import express, { Request, Response, NextFunction } from 'express';
-import cors from 'cors';
-import helmet from 'helmet';
-import cookieParser from 'cookie-parser';
-import path from 'node:path';
-import fs from 'node:fs';
-
-import multer from 'multer';
-import { logDebug, logWarn, logError } from './services/auditLog';
-import { enforceGlobalMfaPolicy } from './middleware/mfaPolicy';
-import { authenticate, verifyJwtAndLoadUser } from './middleware/auth';
-import { db } from './db/database';
-
-import authRoutes from './routes/auth';
-import tripsRoutes from './routes/trips';
-import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './routes/days';
-import placesRoutes from './routes/places';
-import assignmentsRoutes from './routes/assignments';
-import packingRoutes from './routes/packing';
-import todoRoutes from './routes/todo';
-import tagsRoutes from './routes/tags';
-import categoriesRoutes from './routes/categories';
-import adminRoutes from './routes/admin';
-import mapsRoutes from './routes/maps';
-import airportsRoutes from './routes/airports';
-import filesRoutes from './routes/files';
-import reservationsRoutes from './routes/reservations';
-import dayNotesRoutes from './routes/dayNotes';
-import weatherRoutes from './routes/weather';
-import settingsRoutes from './routes/settings';
-import budgetRoutes from './routes/budget';
-import collabRoutes from './routes/collab';
-import backupRoutes from './routes/backup';
-import oidcRoutes from './routes/oidc';
-import { oauthPublicRouter, oauthApiRouter } from './routes/oauth';
-import vacayRoutes from './routes/vacay';
-import atlasRoutes from './routes/atlas';
-import memoriesRoutes from './routes/memories/unified';
-import photoRoutes from './routes/photos';
-import notificationRoutes from './routes/notifications';
-import shareRoutes from './routes/share';
-import journeyRoutes from './routes/journey';
-import journeyPublicRoutes from './routes/journeyPublic';
-import publicConfigRoutes from './routes/publicConfig';
-import systemNoticesRoutes from './routes/systemNotices';
-import { mcpHandler } from './mcp';
-import { trekOAuthProvider, trekClientsStore } from './mcp/oauthProvider';
-import { Addon } from './types';
-import { getPhotoProviderConfig } from './services/memories/helpersService';
-import { getCollabFeatures } from './services/adminService';
-import { isAddonEnabled } from './services/adminService';
-import { ADDON_IDS } from './addons';
-import { ALL_SCOPES } from './mcp/scopes';
-import { mcpAuthMetadataRouter } from '@modelcontextprotocol/sdk/server/auth/router';
-import { authorizationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize';
-import { clientRegistrationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/register';
-import type { OAuthMetadata } from '@modelcontextprotocol/sdk/shared/auth';
-import { getMcpSafeUrl } from './services/notifications';
-
-export function createApp(): express.Application {
-  const app = express();
-
-  // Trust first proxy (nginx/Docker) for correct req.ip
-  if (process.env.NODE_ENV?.toLowerCase() === 'production' || process.env.TRUST_PROXY) {
-    app.set('trust proxy', Number.parseInt(process.env.TRUST_PROXY) || 1);
-  }
-
-  const allowedOrigins = process.env.ALLOWED_ORIGINS
-      ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
-      : null;
-
-  let corsOrigin: cors.CorsOptions['origin'];
-  if (allowedOrigins) {
-    corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
-      if (!origin || allowedOrigins.includes(origin)) callback(null, true);
-      else callback(new Error('Not allowed by CORS'));
-    };
-  } else if (process.env.NODE_ENV?.toLowerCase() === 'production') {
-    corsOrigin = false;
-  } else {
-    corsOrigin = true;
-  }
-
-  const shouldForceHttps = process.env.FORCE_HTTPS?.toLowerCase() === 'true';
-  // HSTS is worth enabling any time we're serving production traffic,
-  // not only when FORCE_HTTPS is set. Self-hosters behind Traefik /
-  // Caddy / Cloudflare Tunnel typically leave FORCE_HTTPS unset (the
-  // proxy handles the redirect for them), and the previous "HSTS off by
-  // default" meant those instances never advertised HSTS at all.
-  //
-  // `includeSubDomains` stays OFF by default on purpose: an instance
-  // running on an apex domain would otherwise force HTTPS on every
-  // sibling subdomain the same operator may still be running over plain
-  // HTTP. Operators who want the stricter policy opt in with
-  // `HSTS_INCLUDE_SUBDOMAINS=true`.
-  const hstsActive = shouldForceHttps || process.env.NODE_ENV === 'production';
-  const hstsIncludeSubdomains = process.env.HSTS_INCLUDE_SUBDOMAINS === 'true';
-
-  // RFC 8414 / RFC 9728 / RFC 7591: discovery docs and DCR are world-readable/writable.
-  // /mcp needs open CORS so external MCP clients (ChatGPT, Claude.ai, Inspector) can call it
-  // with Bearer tokens from any origin. /oauth/register and /oauth/authorize need it for
-  // browser-based DCR/authorization preflights — the global cors({ origin: false }) would
-  // answer OPTIONS without Access-Control-Allow-Origin before the SDK's own cors() runs.
-  // All /.well-known/* paths get open CORS so clients probing openid-configuration or the
-  // RFC 8414 path-suffixed AS metadata form don't get CORS-blocked (they get 404 JSON instead).
-  app.use(
-      (req: Request, _res: Response, next: NextFunction) => {
-        if (
-            req.path.startsWith('/.well-known/') ||
-            req.path === '/oauth/register' ||
-            req.path === '/oauth/authorize' ||
-            req.path === '/oauth/userinfo' ||
-            req.path === '/mcp'
-        ) {
-          cors({ origin: '*', credentials: false })(req, _res, next);
-        } else {
-          next();
-        }
-      },
-  );
-  app.use(cors({ origin: corsOrigin, credentials: true }));
-  app.use(helmet({
-    contentSecurityPolicy: {
-      directives: {
-        defaultSrc: ["'self'"],
-        scriptSrc: ["'self'", "'wasm-unsafe-eval'", "'unsafe-eval'"],
-        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
-        imgSrc: ["'self'", "data:", "blob:", "https:"],
-        connectSrc: [
-          "'self'", "ws:", "wss:",
-          "https://nominatim.openstreetmap.org", "https://overpass-api.de",
-          "https://places.googleapis.com", "https://api.openweathermap.org",
-          "https://en.wikipedia.org", "https://commons.wikimedia.org",
-          "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
-          "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
-          "https://geocoding-api.open-meteo.com", "https://api.exchangerate-api.com",
-          "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/master/geojson/ne_50m_admin_0_countries.geojson",
-          "https://router.project-osrm.org/route/v1/",
-          "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com"
-        ],
-        workerSrc: ["'self'", "blob:"],
-        childSrc: ["'self'", "blob:"],
-        fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
-        objectSrc: ["'none'"],
-        frameSrc: ["'none'"],
-        frameAncestors: ["'self'"],
-        upgradeInsecureRequests: shouldForceHttps ? [] : null
-      }
-    },
-    crossOriginEmbedderPolicy: false,
-    hsts: hstsActive ? { maxAge: 31536000, includeSubDomains: hstsIncludeSubdomains } : false,
-    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-  }));
-
-  if (shouldForceHttps) {
-    app.use((req: Request, res: Response, next: NextFunction) => {
-      if (req.path === '/api/health') return next();
-      if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
-      res.redirect(301, 'https://' + req.headers.host + req.url);
-    });
-  }
-
-  app.use(express.json({ limit: '100kb' }));
-  app.use(express.urlencoded({ extended: true }));
-  app.use(cookieParser());
-  app.use(enforceGlobalMfaPolicy);
-
-  // Request logging with sensitive field redaction
-  {
-    const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
-    const redact = (value: unknown): unknown => {
-      if (!value || typeof value !== 'object') return value;
-      if (Array.isArray(value)) return (value as unknown[]).map(redact);
-      const out: Record<string, unknown> = {};
-      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-        out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v);
-      }
-      return out;
-    };
-
-    app.use((req: Request, res: Response, next: NextFunction) => {
-      if (req.path === '/api/health') return next();
-      const startedAt = Date.now();
-      res.on('finish', () => {
-        const ms = Date.now() - startedAt;
-        if (res.statusCode >= 500) {
-          logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-        } else if (res.statusCode === 401 || res.statusCode === 403) {
-          logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-        } else if (res.statusCode >= 400) {
-          logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-        }
-        const q = Object.keys(req.query).length ? ` query=${JSON.stringify(redact(req.query))}` : '';
-        const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(redact(req.body))}` : '';
-        logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
-      });
-      next();
-    });
-  }
-
-  // Static: avatars, covers, and journey photos.
-  //
-  // Security model (audit SEC-M9): these paths are unauthenticated by
-  // design. All filenames are server-chosen UUID v4 (see `uuid()` in
-  // the multer storage config for avatars / covers / journey uploads),
-  // which gives each asset >122 bits of namespace entropy — not
-  // guessable via enumeration. An attacker would need to have already
-  // seen the URL (email, shared journey, etc.) to request the file.
-  //
-  // Moving these behind auth would also break:
-  //   - Unauthenticated trip-card rendering on public share links
-  //   - Journey public-share pages (/public/journey/:token)
-  //   - Email-embedded avatars
-  //
-  // The `/uploads/photos/...` route below is DIFFERENT: photo URLs are
-  // not embedded in unauthenticated UI contexts, so that endpoint IS
-  // gated (session JWT with pv, or a share token scoped to the photo's
-  // trip).
-  app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
-  app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
-  app.use('/uploads/journey', express.static(path.join(__dirname, '../uploads/journey')));
-
-  // Photos require either a valid logged-in session (via JWT with the
-  // password_version gate) OR a share token that covers the SPECIFIC
-  // photo's trip. Previously any share token for any trip could request
-  // any photo filename by UUID — fine in practice because UUIDs are
-  // unguessable, but the auth model was wrong.
-  app.get('/uploads/photos/:filename', (req: Request, res: Response) => {
-    const safeName = path.basename(req.params.filename);
-    const filePath = path.join(__dirname, '../uploads/photos', safeName);
-    const resolved = path.resolve(filePath);
-    if (!resolved.startsWith(path.resolve(__dirname, '../uploads/photos'))) {
-      return res.status(403).send('Forbidden');
-    }
-    // existsSync here is cheap and avoids a sendFile error frame; kept
-    // sync because the handler is already short-lived.
-    if (!fs.existsSync(resolved)) return res.status(404).send('Not found');
-
-    const authHeader = req.headers.authorization;
-    const rawToken = (req.query.token as string) || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
-    if (!rawToken) return res.status(401).send('Authentication required');
-
-    // JWT session path (with pv check).
-    const user = verifyJwtAndLoadUser(rawToken);
-    if (user) return res.sendFile(resolved);
-
-    // Share-token path: require the token to cover the exact trip the
-    // photo belongs to. Expired tokens fall through to 401.
-    const photo = db.prepare('SELECT trip_id FROM photos WHERE filename = ?').get(safeName) as { trip_id: number } | undefined;
-    if (!photo) return res.status(401).send('Authentication required');
-
-    const share = db.prepare(
-        "SELECT trip_id FROM share_tokens WHERE token = ? AND (expires_at IS NULL OR expires_at > datetime('now'))"
-    ).get(rawToken) as { trip_id: number } | undefined;
-    if (!share || share.trip_id !== photo.trip_id) {
-      return res.status(401).send('Authentication required');
-    }
-    res.sendFile(resolved);
-  });
-
-  // Block direct access to /uploads/files
-  app.use('/uploads/files', (_req: Request, res: Response) => {
-    res.status(401).send('Authentication required');
-  });
-
-  // API Routes
-  app.use('/api/auth', authRoutes);
-  app.use('/api/auth/oidc', oidcRoutes);
-  app.use('/api/trips', tripsRoutes);
-  app.use('/api/trips/:tripId/days', daysRoutes);
-  app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
-  app.use('/api/trips/:tripId/places', placesRoutes);
-  app.use('/api/trips/:tripId/packing', packingRoutes);
-  app.use('/api/trips/:tripId/todo', todoRoutes);
-  app.use('/api/trips/:tripId/files', filesRoutes);
-  app.use('/api/trips/:tripId/budget', budgetRoutes);
-  app.use('/api/trips/:tripId/collab', collabRoutes);
-  app.use('/api/trips/:tripId/reservations', reservationsRoutes);
-  app.use('/api/trips/:tripId/days/:dayId/notes', dayNotesRoutes);
-  app.get('/api/health', (_req: Request, res: Response) => {
-    res.setHeader('Cache-Control', 'no-store, must-revalidate')
-    res.json({ status: 'ok' })
-  });
-  app.use('/api/config', publicConfigRoutes);
-  app.use('/api', assignmentsRoutes);
-  app.use('/api/tags', tagsRoutes);
-  app.use('/api/categories', categoriesRoutes);
-  app.use('/api/admin', adminRoutes);
-
-  // Addons list endpoint
-  app.get('/api/addons', authenticate, (_req: Request, res: Response) => {
-    const addons = db.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
-    const providers = db.prepare(`
-      SELECT id, name, icon, enabled, sort_order
-      FROM photo_providers
-      WHERE enabled = 1
-      ORDER BY sort_order, id
-    `).all() as Array<{ id: string; name: string; icon: string; enabled: number; sort_order: number }>;
-    const fields = db.prepare(`
-      SELECT provider_id, field_key, label, input_type, placeholder, hint, required, secret, settings_key, payload_key, sort_order
-      FROM photo_provider_fields
-      ORDER BY sort_order, id
-    `).all() as Array<{
-      provider_id: string;
-      field_key: string;
-      label: string;
-      input_type: string;
-      placeholder?: string | null;
-      hint?: string | null;
-      required: number;
-      secret: number;
-      settings_key?: string | null;
-      payload_key?: string | null;
-      sort_order: number;
-    }>;
-
-    const fieldsByProvider = new Map<string, typeof fields>();
-    for (const field of fields) {
-      const arr = fieldsByProvider.get(field.provider_id) || [];
-      arr.push(field);
-      fieldsByProvider.set(field.provider_id, arr);
-    }
-
-    res.json({
-      collabFeatures: getCollabFeatures(),
-      addons: [
-        ...addons.map(a => ({ ...a, enabled: !!a.enabled })),
-        ...providers.map(p => ({
-          id: p.id,
-          name: p.name,
-          type: 'photo_provider',
-          icon: p.icon,
-          enabled: !!p.enabled,
-          config: getPhotoProviderConfig(p.id),
-          fields: (fieldsByProvider.get(p.id) || []).map(f => ({
-            key: f.field_key,
-            label: f.label,
-            input_type: f.input_type,
-            placeholder: f.placeholder || '',
-            hint: f.hint || null,
-            required: !!f.required,
-            secret: !!f.secret,
-            settings_key: f.settings_key || null,
-            payload_key: f.payload_key || null,
-            sort_order: f.sort_order,
-          })),
-        })),
-      ],
-    });
-  });
-
-  // Addon routes
-  app.use('/api/addons/vacay', vacayRoutes);
-  app.use('/api/addons/atlas', atlasRoutes);
-  app.use('/api/journeys', (req, res, next) => {
-    if (!isAddonEnabled(ADDON_IDS.JOURNEY)) return res.status(404).json({ error: 'Journey addon is not enabled' });
-    next();
-  }, journeyRoutes);
-  app.use('/api/public/journey', journeyPublicRoutes);
-  app.use('/api/integrations/memories', memoriesRoutes);
-  app.use('/api/photos', photoRoutes);
-  app.use('/api/maps', mapsRoutes);
-  app.use('/api/airports', airportsRoutes);
-  app.use('/api/weather', weatherRoutes);
-  app.use('/api/settings', settingsRoutes);
-  app.use('/api/system-notices', systemNoticesRoutes);
-  app.use('/api/backup', backupRoutes);
-  app.use('/api/notifications', notificationRoutes);
-  app.use('/api', shareRoutes);
-
-  // OAuth 2.1 — public endpoints
-  // Gate: 404 when MCP addon is disabled (M2 — prevents feature fingerprinting)
-  const mcpAddonGate = (_req: Request, res: Response, next: NextFunction) => {
-    if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
-    next();
-  };
-
-  // OAuth 2.1 — SPA-facing authenticated endpoints (/api/oauth/*)
-  // Mounted first: per-route 403 checks inside oauthApiRouter are the gate, not mcpAddonGate
-  app.use('/api/oauth', oauthApiRouter);
-
-  // SDK metadata router — built lazily on first request so getAppUrl() (which queries the DB)
-  // is not called at createApp() time, before test tables have been created.
-  // mcpAuthMetadataRouter serves:
-  //   /.well-known/oauth-authorization-server   — RFC 8414 AS metadata
-  //   /.well-known/oauth-protected-resource/mcp — RFC 9728 path-based PRM (fixes issue #959 bug 1)
-  let _oauthMetadata: OAuthMetadata | null = null;
-  let _sdkMetaRouter: express.Router | null = null;
-
-  function getOAuthMetadata(): OAuthMetadata {
-    if (_oauthMetadata) return _oauthMetadata;
-    const base = getMcpSafeUrl().replace(/\/+$/, '');
-    _oauthMetadata = {
-      issuer:                                base,
-      authorization_endpoint:                `${base}/oauth/authorize`,
-      token_endpoint:                        `${base}/oauth/token`,
-      revocation_endpoint:                   `${base}/oauth/revoke`,
-      registration_endpoint:                 `${base}/oauth/register`,
-      response_types_supported:              ['code'],
-      grant_types_supported:                 ['authorization_code', 'refresh_token', 'client_credentials'],
-      code_challenge_methods_supported:      ['S256'],
-      token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
-      scopes_supported:                      ALL_SCOPES,
-    };
-    return _oauthMetadata;
-  }
-
-  function getMetaRouter(): express.Router {
-    if (_sdkMetaRouter) return _sdkMetaRouter;
-    const metadata = getOAuthMetadata();
-    _sdkMetaRouter = mcpAuthMetadataRouter({
-      oauthMetadata: metadata,
-      resourceServerUrl: new URL(`${metadata.issuer}/mcp`),
-      scopesSupported: ALL_SCOPES as string[],
-      resourceName: 'TREK MCP',
-    });
-    return _sdkMetaRouter;
-  }
-
-  // Only invoke the SDK metadata router for /.well-known/* paths.
-  // Calling getMetaRouter() on every request triggers lazy init (new URL(...)) which
-  // throws "Invalid URL" when APP_URL lacks a protocol — breaking all page loads.
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.path.startsWith('/.well-known/') && !isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
-    getMetaRouter()(req, res, next);
-  });
-
-  // ChatGPT (and other OIDC-first clients) bootstrap OAuth discovery via
-  // /.well-known/openid-configuration. Serve the AS metadata plus the OIDC
-  // userinfo_endpoint so ChatGPT can fetch the authenticated user's email
-  // for authorization domain claiming.
-  app.get('/.well-known/openid-configuration', (_req: Request, res: Response) => {
-    const meta = getOAuthMetadata();
-    res.json({
-      ...meta,
-      userinfo_endpoint: `${meta.issuer}/oauth/userinfo`,
-    });
-  });
-
-  // RFC 9728 flat well-known URL — served alongside the path-based form the SDK already provides.
-  // Clients like ChatGPT probe /.well-known/oauth-protected-resource (no path suffix) on every
-  // fresh discovery. Without this, they get 404, fall back to the issuer URL as the resource
-  // parameter, and the authorize handler rejects them with invalid_target — showing the user
-  // the TREK home page instead of the consent form.
-  app.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {
-    if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
-    const meta = getOAuthMetadata();
-    res.json({
-      resource:                 `${meta.issuer}/mcp`,
-      authorization_servers:    [meta.issuer],
-      bearer_methods_supported: ['header'],
-      scopes_supported:         ALL_SCOPES,
-      resource_name:            'TREK MCP',
-    });
-  });
-
-  // SDK authorize handler: validates OAuth params, calls provider.authorize() which redirects
-  // to the SPA consent page at /oauth/consent
-  app.use('/oauth/authorize', mcpAddonGate, authorizationHandler({ provider: trekOAuthProvider }));
-
-  // SDK DCR handler: accepts registrations without scope (fixes issue #959 bug 2)
-  app.use('/oauth/register', mcpAddonGate, clientRegistrationHandler({ clientsStore: trekClientsStore }));
-
-  // Token and revoke keep TREK's own handlers (timing-safe hash comparison not supported by SDK clientAuth)
-  // oauthPublicRouter has per-route isAddonEnabled checks; no blanket gate needed here
-  app.use('/', oauthPublicRouter);
-
-  // MCP endpoint
-  app.post('/mcp', mcpHandler);
-  app.get('/mcp', mcpHandler);
-  app.delete('/mcp', mcpHandler);
-
-  // Return 404 JSON for any /.well-known/* path the SDK metadata router doesn't handle.
-  // Without this, the SPA catch-all serves HTML — clients probing
-  // /.well-known/openid-configuration or the RFC 8414 path-suffixed AS metadata URL
-  // receive a 200 HTML response they can't parse as JSON, causing "does not implement OAuth".
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.path.startsWith('/.well-known/')) return res.status(404).json({ error: 'not_found' });
-    next();
-  });
-
-  // Helmet's COOP: same-origin isolates the consent popup from its cross-origin opener (ChatGPT etc.), making window.opener null and breaking the OAuth flow.
-  app.use('/oauth/consent', (_req: Request, res: Response, next: NextFunction) => {
-    res.setHeader('Cross-Origin-Opener-Policy', 'unsafe-none');
-    next();
-  });
-
-  // Production static file serving
-  if (process.env.NODE_ENV === 'production') {
-    const publicPath = path.join(__dirname, '../public');
-    app.use(express.static(publicPath, {
-      setHeaders: (res, filePath) => {
-        if (filePath.endsWith('index.html')) {
-          res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-        }
-      },
-    }));
-    app.get('*', (_req: Request, res: Response) => {
-      res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-      res.sendFile(path.join(publicPath, 'index.html'));
-    });
-  }
-
-  // Global error handler
-  app.use((err: Error & { status?: number; statusCode?: number }, _req: Request, res: Response, _next: NextFunction) => {
-    if (process.env.NODE_ENV === 'production') {
-      console.error('Unhandled error:', err.message);
-    } else {
-      console.error('Unhandled error:', err);
-    }
-    if (err instanceof multer.MulterError) {
-      const status = err.code === 'LIMIT_FILE_SIZE' ? 413 : 400;
-      return res.status(status).json({ error: err.message });
-    }
-    const status = err.statusCode || err.status || 500;
-    // Expose the message for client errors (4xx); keep 'Internal server error' for 5xx.
-    const message = status < 500 ? err.message : 'Internal server error';
-    res.status(status).json({ error: message });
-  });
-
-  return app;
-}

server/src/bootstrap.ts

@@ -0,0 +1,45 @@
+import { NestFactory } from '@nestjs/core';
+import { ExpressAdapter } from '@nestjs/platform-express';
+import type { INestApplication } from '@nestjs/common';
+import { AppModule } from './nest/app.module';
+import { applyGlobalMiddleware } from './middleware/globalMiddleware';
+import { applyPlatformUploads, applyPlatformTransport, applyPlatformStatic } from './nest/platform/platform.routes';
+
+/**
+ * Builds the unified TREK NestJS application that serves the ENTIRE surface — the
+ * former Express app is gone. One builder is shared by the production bootstrap
+ * (index.ts) and the integration-test harness so the two can never drift.
+ *
+ * Composition order is load-bearing. Everything except the SPA index.html fallback
+ * is registered on the underlying Express instance BEFORE `app.init()`, because
+ * Nest's router terminates an unmatched request by throwing NotFoundException — it
+ * does NOT fall through to a route registered after init, so a post-init Express
+ * route is unreachable. The platform routes are all specific paths (/uploads/*,
+ * /api/health, /mcp, /.well-known/*, /oauth/{authorize,register,consent}) so they
+ * match their own requests and `next()` everything else through to the Nest
+ * controllers registered during init.
+ *
+ *   1. applyGlobalMiddleware — helmet/CSP, CORS, HSTS, forced-HTTPS, the global MFA
+ *      policy, request logging + cookie-parser. `bodyParser: false` so Nest does its
+ *      own parsing and the raw /mcp body reaches the MCP handler unparsed.
+ *   2. applyPlatformUploads — the static + guarded /uploads/* routes.
+ *   3. applyPlatformTransport — /api/health, the OAuth/MCP SDK + /.well-known
+ *      metadata, the /mcp routes, the /oauth/consent COOP header.
+ *   4. applyPlatformStatic — the production built-client static assets (so a real
+ *      asset request returns the file before the Nest router 404s it).
+ *   5. app.init() — registers every migrated /api domain (the Nest controllers).
+ *
+ * The SPA index.html fallback (unmatched GET → index.html in production) is the
+ * SpaFallbackFilter (APP_FILTER in AppModule); the global error envelope is the
+ * TrekExceptionFilter (also APP_FILTER).
+ */
+export async function buildApp(): Promise<INestApplication> {
+  const app = await NestFactory.create(AppModule, new ExpressAdapter());
+  const instance = app.getHttpAdapter().getInstance();
+  applyGlobalMiddleware(instance, { bodyParser: false });
+  applyPlatformUploads(instance);
+  applyPlatformTransport(instance);
+  applyPlatformStatic(instance);
+  await app.init();
+  return app;
+}

server/src/config.ts

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { SUPPORTED_LANGUAGE_CODES as SUPPORTED_LANG_CODES } from '@trek/shared';
 
 const dataDir = path.resolve(__dirname, '../data');
 
@@ -101,12 +102,55 @@ export const ENCRYPTION_KEY = _encryptionKey;
 
 // DEFAULT_LANGUAGE sets the language shown on the login page before the user
 // selects one. Only applies when the user has no saved language preference.
-// Supported values: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
-// Must stay in sync with client/src/i18n/supportedLanguages.ts (canonical source).
-// Kept duplicated here because server and client are separate npm packages.
-const SUPPORTED_LANG_CODES = ['de', 'en', 'es', 'fr', 'hu', 'nl', 'br', 'cs', 'pl', 'ru', 'zh', 'zh-TW', 'it', 'ar'];
 const rawDefaultLang = process.env.DEFAULT_LANGUAGE?.toLowerCase() || 'en';
 if (!SUPPORTED_LANG_CODES.includes(rawDefaultLang)) {
   console.warn(`DEFAULT_LANGUAGE="${rawDefaultLang}" is not supported. Falling back to "en". Supported: ${SUPPORTED_LANG_CODES.join(', ')}`);
 }
 export const DEFAULT_LANGUAGE = SUPPORTED_LANG_CODES.includes(rawDefaultLang) ? rawDefaultLang : 'en';
+
+// SESSION_DURATION controls how long a TREK session (the `trek_session` JWT
+// cookie) stays valid before re-login is required. Accepts ms-style strings:
+// '1h', '12h', '7d', '30d', '90d', etc. It applies to BOTH the JWT `exp` claim
+// and the cookie `maxAge`, so the two never drift apart. Invalid values warn at
+// startup and fall back to the default. Does not affect the short-lived MFA
+// challenge token or MCP OAuth tokens — those keep their own TTL.
+const DEFAULT_SESSION_DURATION = '24h';
+const DURATION_UNITS_MS: Record<string, number> = {
+  ms: 1, s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000, y: 31_557_600_000,
+};
+function parseDurationMs(value: string): number | null {
+  const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w|y)?$/i.exec(value.trim());
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return n * DURATION_UNITS_MS[(m[2] || 'ms').toLowerCase()];
+}
+const rawSessionDuration = process.env.SESSION_DURATION?.trim() || DEFAULT_SESSION_DURATION;
+const parsedSessionMs = parseDurationMs(rawSessionDuration);
+if (parsedSessionMs == null) {
+  console.warn(`SESSION_DURATION="${rawSessionDuration}" is not a valid duration (use e.g. 1h, 7d, 30d). Falling back to "${DEFAULT_SESSION_DURATION}".`);
+}
+/** Human-readable session length actually in effect (for logs/diagnostics). */
+export const SESSION_DURATION = parsedSessionMs == null ? DEFAULT_SESSION_DURATION : rawSessionDuration;
+/** Session length in milliseconds — used for the cookie `maxAge`. */
+export const SESSION_DURATION_MS = parsedSessionMs ?? parseDurationMs(DEFAULT_SESSION_DURATION)!;
+/** Session length in seconds — passed to `jwt.sign({ expiresIn })` (number = seconds). */
+export const SESSION_DURATION_SECONDS = Math.floor(SESSION_DURATION_MS / 1000);
+
+// SESSION_DURATION_REMEMBER is the session length used when the user ticks
+// "Remember me" on the login form: a longer-lived JWT `exp` claim plus a
+// persistent `trek_session` cookie `maxAge`. An unticked login keeps
+// SESSION_DURATION and a browser-session cookie (no `maxAge`). Same ms-style
+// format and fallback behavior as SESSION_DURATION.
+const DEFAULT_SESSION_DURATION_REMEMBER = '30d';
+const rawRememberDuration = process.env.SESSION_DURATION_REMEMBER?.trim() || DEFAULT_SESSION_DURATION_REMEMBER;
+const parsedRememberMs = parseDurationMs(rawRememberDuration);
+if (parsedRememberMs == null) {
+  console.warn(`SESSION_DURATION_REMEMBER="${rawRememberDuration}" is not a valid duration (use e.g. 7d, 30d, 90d). Falling back to "${DEFAULT_SESSION_DURATION_REMEMBER}".`);
+}
+/** Human-readable "remember me" session length actually in effect (for logs/diagnostics). */
+export const SESSION_DURATION_REMEMBER = parsedRememberMs == null ? DEFAULT_SESSION_DURATION_REMEMBER : rawRememberDuration;
+/** "Remember me" session length in milliseconds — used for the persistent cookie `maxAge`. */
+export const SESSION_DURATION_REMEMBER_MS = parsedRememberMs ?? parseDurationMs(DEFAULT_SESSION_DURATION_REMEMBER)!;
+/** "Remember me" session length in seconds — passed to `jwt.sign({ expiresIn })`. */
+export const SESSION_DURATION_REMEMBER_SECONDS = Math.floor(SESSION_DURATION_REMEMBER_MS / 1000);

server/src/db/database.ts

@@ -6,12 +6,27 @@ import { runMigrations } from './migrations';
 import { runSeeds } from './seeds';
 import { Place, Tag } from '../types';
 
-const dataDir = path.join(__dirname, '../../data');
-if (!fs.existsSync(dataDir)) {
-  fs.mkdirSync(dataDir, { recursive: true });
-}
+// In test mode each vitest worker gets an isolated in-memory DB so that
+// parallel forks can't race on the same file or share migration state.
+const isTest = process.env.NODE_ENV === 'test';
 
-const dbPath = path.join(dataDir, 'travel.db');
+let dbPath: string;
+if (isTest) {
+  dbPath = ':memory:';
+} else if (process.env.TREK_DB_FILE) {
+  // Explicit DB file (used by the Playwright E2E harness to run against an
+  // isolated, throwaway database instead of the real data/travel.db). Purely
+  // additive — when unset the default path below is used exactly as before.
+  dbPath = process.env.TREK_DB_FILE;
+  const dir = path.dirname(dbPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+} else {
+  const dataDir = path.join(__dirname, '../../data');
+  if (!fs.existsSync(dataDir)) {
+    fs.mkdirSync(dataDir, { recursive: true });
+  }
+  dbPath = path.join(dataDir, 'travel.db');
+}
 
 let _db: Database.Database | null = null;
 

server/src/db/schema.ts

@@ -42,6 +42,32 @@ function createTables(db: Database.Database): void {
     CREATE INDEX IF NOT EXISTS idx_prt_user ON password_reset_tokens(user_id);
     CREATE INDEX IF NOT EXISTS idx_prt_hash ON password_reset_tokens(token_hash);
 
+    CREATE TABLE IF NOT EXISTS webauthn_credentials (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      credential_id TEXT NOT NULL UNIQUE,
+      public_key BLOB NOT NULL,
+      counter INTEGER NOT NULL DEFAULT 0,
+      transports TEXT,
+      device_type TEXT,
+      backed_up INTEGER NOT NULL DEFAULT 0,
+      name TEXT,
+      aaguid TEXT,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      last_used_at DATETIME
+    );
+    CREATE INDEX IF NOT EXISTS idx_webauthn_credentials_user ON webauthn_credentials(user_id);
+
+    CREATE TABLE IF NOT EXISTS webauthn_challenges (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      challenge TEXT NOT NULL UNIQUE,
+      user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+      type TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    CREATE INDEX IF NOT EXISTS idx_webauthn_challenges_expires ON webauthn_challenges(expires_at);
+
     CREATE TABLE IF NOT EXISTS settings (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,

server/src/db/seeds.ts

@@ -1,6 +1,9 @@
 import Database from 'better-sqlite3';
 import crypto from 'crypto';
 
+// bcrypt cost factor for the seeded admin password — kept in sync with authService.
+const BCRYPT_COST = 12;
+
 // Seeds run at startup before the DB admin panel can be used, so only env vars
 // are checked here. The granular password_login/password_registration DB toggles
 // are only relevant after the first user exists; at that point seeds have already
@@ -40,7 +43,7 @@ function seedAdminAccount(db: Database.Database): void {
       email = 'admin@trek.local';
     }
 
-    const hash = bcrypt.hashSync(password, 12);
+    const hash = bcrypt.hashSync(password, BCRYPT_COST);
     const username = 'admin';
 
     db.prepare('INSERT INTO users (username, email, password_hash, role, must_change_password) VALUES (?, ?, ?, ?, 1)').run(username, email, hash, 'admin');
@@ -87,7 +90,7 @@ function seedAddons(db: Database.Database): void {
   try {
     const defaultAddons = [
       { id: 'packing', name: 'Lists', description: 'Packing lists and to-do tasks for your trips', type: 'trip', icon: 'ListChecks', enabled: 1, sort_order: 0 },
-      { id: 'budget', name: 'Budget Planner', description: 'Track expenses and plan your travel budget', type: 'trip', icon: 'Wallet', enabled: 1, sort_order: 1 },
+      { id: 'budget', name: 'Costs', description: 'Track and split trip expenses', type: 'trip', icon: 'Wallet', enabled: 1, sort_order: 1 },
       { id: 'documents', name: 'Documents', description: 'Store and manage travel documents', type: 'trip', icon: 'FileText', enabled: 1, sort_order: 2 },
       { id: 'vacay', name: 'Vacay', description: 'Personal vacation day planner with calendar view', type: 'global', icon: 'CalendarDays', enabled: 1, sort_order: 10 },
       { id: 'atlas', name: 'Atlas', description: 'World map of your visited countries with travel stats', type: 'global', icon: 'Globe', enabled: 1, sort_order: 11 },
@@ -95,6 +98,7 @@ function seedAddons(db: Database.Database): void {
       { id: 'naver_list_import', name: 'Naver List Import', description: 'Import places from shared Naver Maps lists', type: 'trip', icon: 'Link2', enabled: 1, sort_order: 13 },
       { id: 'collab', name: 'Collab', description: 'Notes, polls, and live chat for trip collaboration', type: 'trip', icon: 'Users', enabled: 1, sort_order: 6 },
       { id: 'journey', name: 'Journey', description: 'Trip tracking & travel journal — check-ins, photos, daily stories', type: 'global', icon: 'Compass', enabled: 0, sort_order: 35 },
+      { id: 'airtrail', name: 'AirTrail', description: 'Sync flights from your self-hosted AirTrail instance', type: 'integration', icon: 'Plane', enabled: 0, sort_order: 14 },
     ];
     const insertAddon = db.prepare('INSERT OR IGNORE INTO addons (id, name, description, type, icon, enabled, sort_order) VALUES (?, ?, ?, ?, ?, ?, ?)');
     for (const a of defaultAddons) insertAddon.run(a.id, a.name, a.description, a.type, a.icon, a.enabled, a.sort_order);

server/src/index.ts

@@ -1,7 +1,10 @@
+import 'reflect-metadata';
 import 'dotenv/config';
 import path from 'node:path';
 import fs from 'node:fs';
-import { createApp } from './app';
+import http from 'node:http';
+import type { INestApplication } from '@nestjs/common';
+import { buildApp } from './bootstrap';
 
 // Create upload and data directories on startup
 const uploadsDir = path.join(__dirname, '../uploads');
@@ -16,8 +19,6 @@ const tmpDir = path.join(__dirname, '../data/tmp');
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 });
 
-const app = createApp();
-
 import * as scheduler from './scheduler';
 import { getAppUrl, getMcpSafeUrl } from './services/notifications';
 
@@ -49,6 +50,7 @@ const onListen = () => {
     '──────────────────────────────────────',
   ];
   banner.forEach(l => console.log(l));
+  sLogInfo('NestJS serving all routes (Express decommissioned)');
   if (process.env.APP_URL) {
     let parsedAppUrl: URL | null = null;
     try { parsedAppUrl = new URL(process.env.APP_URL); } catch { /* invalid */ }
@@ -77,6 +79,8 @@ const onListen = () => {
   scheduler.startDemoReset();
   scheduler.startIdempotencyCleanup();
   scheduler.startTrekPhotoCacheCleanup();
+  scheduler.startPlacePhotoCacheCleanup();
+  scheduler.startAirTrailSync();
   const { startTokenCleanup } = require('./services/ephemeralTokens');
   startTokenCleanup();
   import('./websocket').then(({ setupWebSocket }) => {
@@ -84,9 +88,25 @@ const onListen = () => {
   });
 };
 
-const server = HOST
-  ? app.listen(PORT, HOST, onListen)
-  : app.listen(PORT, onListen);
+let server: http.Server;
+let nestApp: INestApplication;
+
+// Strangler toggle: prefixes served by Nest (env-overridable, instant rollback).
+async function bootstrap(): Promise<void> {
+  // The whole surface runs on the single NestJS app now (Express decommissioned):
+  // global pipeline + /uploads + every /api domain + the platform/transport routes
+  // (/mcp, /.well-known, OAuth SDK, SPA catch-all). buildApp() owns the composition
+  // order; it is shared with the integration-test harness so they can't drift.
+  nestApp = await buildApp();
+  server = http.createServer(nestApp.getHttpAdapter().getInstance());
+  if (HOST) server.listen(PORT, HOST, onListen);
+  else server.listen(PORT, onListen);
+}
+
+bootstrap().catch((err) => {
+  console.error('Fatal: failed to bootstrap server', err);
+  process.exit(1);
+});
 
 // Graceful shutdown
 function shutdown(signal: string): void {
@@ -95,6 +115,7 @@ function shutdown(signal: string): void {
   sLogInfo(`${signal} received — shutting down gracefully...`);
   scheduler.stop();
   closeMcpSessions();
+  void nestApp?.close();
   server.close(() => {
     sLogInfo('HTTP server closed');
     const { closeDb } = require('./db/database');
@@ -110,5 +131,3 @@ function shutdown(signal: string): void {
 
 process.on('SIGTERM', () => shutdown('SIGTERM'));
 process.on('SIGINT', () => shutdown('SIGINT'));
-
-export default app;

server/src/mcp/tools/_shared.ts

@@ -1,4 +1,6 @@
 import { broadcast } from '../../websocket';
+import { db } from '../../db/database';
+import { checkPermission } from '../../services/permissions';
 
 export function safeBroadcast(tripId: number, event: string, payload: Record<string, unknown>): void {
   try {
@@ -46,6 +48,24 @@ export function noAccess() {
   return { content: [{ type: 'text' as const, text: 'Trip not found or access denied.' }], isError: true };
 }
 
+export function permissionDenied() {
+  return { content: [{ type: 'text' as const, text: 'You do not have permission to perform this action on this trip.' }], isError: true };
+}
+
+/**
+ * RBAC gate for MCP tools, mirroring the checkPermission() calls the REST/Nest
+ * routes run. Call this after canAccessTrip() with the same action key the
+ * matching REST route uses. Returns true when the user may perform `action`
+ * on `tripId`.
+ */
+export function hasTripPermission(action: string, tripId: number | string, userId: number): boolean {
+  const trip = db.prepare('SELECT user_id FROM trips WHERE id = ?').get(tripId) as { user_id?: number } | undefined;
+  if (!trip) return false;
+  const userRow = db.prepare('SELECT role FROM users WHERE id = ?').get(userId) as { role?: string } | undefined;
+  const tripOwnerId = typeof trip.user_id === 'number' ? trip.user_id : null;
+  return checkPermission(action, userRow?.role ?? 'user', tripOwnerId, userId, tripOwnerId !== userId);
+}
+
 export function ok(data: unknown) {
   return { content: [{ type: 'text' as const, text: JSON.stringify(data, null, 2) }] };
 }

server/src/mcp/tools/assignments.ts

@@ -13,7 +13,7 @@ import { getDay } from '../../services/dayService';
 import {
   safeBroadcast, TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canWrite } from '../scopes';
 
@@ -38,6 +38,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, dayId, placeId, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!dayExists(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       if (!placeExists(placeId, tripId)) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
       const assignment = createAssignment(dayId, placeId, notes || null);
@@ -60,6 +61,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, dayId, assignmentId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!assignmentExistsInDay(assignmentId, dayId, tripId))
         return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
       deleteAssignment(assignmentId);
@@ -83,6 +85,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, assignmentId, place_time, end_time }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const existing = getAssignmentForTrip(assignmentId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
       const assignment = updateTime(
@@ -111,6 +114,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, assignmentId, newDayId, oldDayId, orderIndex }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!getAssignmentForTrip(assignmentId, tripId)) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
       if (!getDay(newDayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       const result = moveAssignment(assignmentId, newDayId, orderIndex ?? 0, oldDayId);
@@ -151,6 +155,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, assignmentId, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!getAssignmentForTrip(assignmentId, tripId)) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
       const participants = setAssignmentParticipants(assignmentId, userIds);
       safeBroadcast(tripId, 'assignment:participants', { assignmentId, participants });
@@ -174,6 +179,7 @@ export function registerAssignmentTools(server: McpServer, userId: number, scope
     async ({ tripId, dayId, assignmentIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!getDay(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       reorderAssignments(dayId, assignmentIds);
       safeBroadcast(tripId, 'assignment:reordered', { dayId, assignmentIds });

server/src/mcp/tools/budget.ts

@@ -10,7 +10,7 @@ import {
 import {
   safeBroadcast, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canWrite } from '../scopes';
 import { isAddonEnabled } from '../../services/adminService';
@@ -38,6 +38,7 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, name, category, total_price, note }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
       const item = createBudgetItem(tripId, { category, name, total_price, note });
       safeBroadcast(tripId, 'budget:created', { item });
       return ok({ item });
@@ -57,6 +58,7 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
       const deleted = deleteBudgetItem(itemId, tripId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
       safeBroadcast(tripId, 'budget:deleted', { itemId });
@@ -85,6 +87,7 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, itemId, name, category, total_price, persons, days, note }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
       const item = updateBudgetItem(itemId, tripId, { name, category, total_price, persons, days, note });
       if (!item) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
       safeBroadcast(tripId, 'budget:updated', { item });
@@ -111,6 +114,7 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, name, category, total_price, note, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
       const hasMembers = userIds && userIds.length > 0;
       try {
         const run = db.transaction(() => {
@@ -144,6 +148,7 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, itemId, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
       const item = updateBudgetMembers(itemId, tripId, userIds);
       safeBroadcast(tripId, 'budget:members-updated', { item });
       return ok({ item });
@@ -165,7 +170,8 @@ export function registerBudgetTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, itemId, memberId, paid }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const member = toggleMemberPaid(itemId, memberId, paid);
+      if (!hasTripPermission('budget_edit', tripId, userId)) return permissionDenied();
+      const member = toggleMemberPaid(itemId, tripId, memberId, paid);
       safeBroadcast(tripId, 'budget:member-paid-updated', { itemId, member });
       return ok({ member });
     }

server/src/mcp/tools/collab.ts

@@ -12,7 +12,7 @@ import { ADDON_IDS } from '../../addons';
 import {
   safeBroadcast, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT, TOOL_ANNOTATIONS_READONLY,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canWrite } from '../scopes';
 
@@ -43,6 +43,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, title, content, category, color, pinned }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
       const note = createCollabNote(tripId, userId, { title, content, category, color, pinned });
       safeBroadcast(tripId, 'collab:note:created', { note });
       return ok({ note });
@@ -67,6 +68,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, noteId, title, content, category, color, pinned }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
       const note = updateCollabNote(tripId, noteId, { title, content, category, color, pinned });
       if (!note) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       safeBroadcast(tripId, 'collab:note:updated', { note });
@@ -87,6 +89,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
     async ({ tripId, noteId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
       const deleted = deleteCollabNote(tripId, noteId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       safeBroadcast(tripId, 'collab:note:deleted', { noteId });
@@ -128,6 +131,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, question, options, multiple, deadline }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const poll = createPoll(tripId, userId, { question, options, multiple, deadline });
         safeBroadcast(tripId, 'collab:poll:created', { poll });
         return ok({ poll });
@@ -147,6 +151,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       },
       async ({ tripId, pollId, optionIndex }) => {
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const result = votePoll(tripId, pollId, userId, optionIndex);
         if (result.error) return { content: [{ type: 'text' as const, text: result.error }], isError: true };
         safeBroadcast(tripId, 'collab:poll:voted', { poll: result.poll });
@@ -167,6 +172,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, pollId }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const poll = closePoll(tripId, pollId);
         if (!poll) return { content: [{ type: 'text' as const, text: 'Poll not found.' }], isError: true };
         safeBroadcast(tripId, 'collab:poll:closed', { poll });
@@ -187,6 +193,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, pollId }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const deleted = deletePoll(tripId, pollId);
         if (!deleted) return { content: [{ type: 'text' as const, text: 'Poll not found.' }], isError: true };
         safeBroadcast(tripId, 'collab:poll:deleted', { pollId });
@@ -225,6 +232,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, text, replyTo }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const result = createMessage(tripId, userId, text, replyTo ?? null);
         if (result.error) return { content: [{ type: 'text' as const, text: result.error }], isError: true };
         safeBroadcast(tripId, 'collab:message:created', { message: result.message });
@@ -245,6 +253,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, messageId }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const result = deleteMessage(tripId, messageId, userId);
         if (result.error) return { content: [{ type: 'text' as const, text: result.error }], isError: true };
         safeBroadcast(tripId, 'collab:message:deleted', { messageId, username: result.username });
@@ -266,6 +275,7 @@ export function registerCollabTools(server: McpServer, userId: number, scopes: s
       async ({ tripId, messageId, emoji }) => {
         if (isDemoUser(userId)) return demoDenied();
         if (!canAccessTrip(tripId, userId)) return noAccess();
+        if (!hasTripPermission('collab_edit', tripId, userId)) return permissionDenied();
         const result = addOrRemoveReaction(messageId, tripId, userId, emoji);
         if (!result.found) return { content: [{ type: 'text' as const, text: 'Message not found.' }], isError: true };
         safeBroadcast(tripId, 'collab:message:reacted', { messageId, reactions: result.reactions });

server/src/mcp/tools/days.ts

@@ -15,7 +15,7 @@ import {
 import {
   safeBroadcast, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canWrite } from '../scopes';
 
@@ -38,6 +38,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, dayId, title }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const current = getDay(dayId, tripId);
       if (!current) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       const updated = updateDay(dayId, current, title !== undefined ? { title } : {});
@@ -60,6 +61,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, date, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const day = createDay(tripId, date, notes);
       safeBroadcast(tripId, 'day:created', { day });
       return ok({ day });
@@ -79,6 +81,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, dayId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!getDay(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       deleteDay(dayId);
       safeBroadcast(tripId, 'day:deleted', { id: dayId });
@@ -105,6 +108,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const errors = validateAccommodationRefs(tripId, place_id, start_day_id, end_day_id);
       if (errors.length > 0) return { content: [{ type: 'text' as const, text: errors.map(e => e.message).join(', ') }], isError: true };
       const accommodation = createAccommodation(tripId, { place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes });
@@ -144,6 +148,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, name, description, lat, lng, address, category_id, google_place_id, osm_id, place_notes, website, phone, start_day_id, end_day_id, check_in, check_out, confirmation, accommodation_notes, price, currency }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const dayErrors = validateAccommodationRefs(tripId, undefined, start_day_id, end_day_id);
       if (dayErrors.length > 0) return { content: [{ type: 'text' as const, text: dayErrors.map(e => e.message).join(', ') }], isError: true };
       try {
@@ -182,6 +187,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, accommodationId, place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const existing = getAccommodation(accommodationId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Accommodation not found.' }], isError: true };
       const accommodation = updateAccommodation(accommodationId, existing, { place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes });
@@ -203,6 +209,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, accommodationId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!getAccommodation(accommodationId, tripId)) return { content: [{ type: 'text' as const, text: 'Accommodation not found.' }], isError: true };
       const { linkedReservationId } = deleteAccommodation(accommodationId);
       safeBroadcast(tripId, 'accommodation:deleted', { id: accommodationId, linkedReservationId });
@@ -228,6 +235,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, dayId, text, time, icon }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       if (!dayNoteExists(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       const note = createDayNote(dayId, tripId, text, time, icon);
       safeBroadcast(tripId, 'dayNote:created', { dayId, note });
@@ -252,6 +260,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, dayId, noteId, text, time, icon }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const existing = getDayNote(noteId, dayId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       const note = updateDayNote(noteId, existing, { text, time: time !== undefined ? time : undefined, icon });
@@ -274,6 +283,7 @@ export function registerDayTools(server: McpServer, userId: number, scopes: stri
     async ({ tripId, dayId, noteId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('day_edit', tripId, userId)) return permissionDenied();
       const note = getDayNote(noteId, dayId, tripId);
       if (!note) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       deleteDayNote(noteId);

server/src/mcp/tools/journey.ts

@@ -380,6 +380,7 @@ export function registerJourneyTools(server: McpServer, userId: number, scopes:
       annotations: TOOL_ANNOTATIONS_READONLY,
     },
     async ({ journeyId }) => {
+      if (!canAccessJourney(journeyId, userId)) return notFound('Journey not found or access denied.');
       const shareLink = getJourneyShareLink(journeyId);
       return ok({ shareLink });
     }

server/src/mcp/tools/packing.ts

@@ -14,7 +14,7 @@ import {
 import {
   safeBroadcast, TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canWrite } from '../scopes';
 import { isAddonEnabled } from '../../services/adminService';
@@ -42,6 +42,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, name, category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const item = createPackingItem(tripId, { name, category: category || 'General' });
       safeBroadcast(tripId, 'packing:created', { item });
       return ok({ item });
@@ -62,6 +63,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, itemId, checked }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const item = updatePackingItem(tripId, itemId, { checked: checked ? 1 : 0 }, ['checked']);
       if (!item) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
       safeBroadcast(tripId, 'packing:updated', { item });
@@ -82,6 +84,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const deleted = deletePackingItem(tripId, itemId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
       safeBroadcast(tripId, 'packing:deleted', { itemId });
@@ -106,6 +109,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, itemId, name, category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const bodyKeys = ['name', 'category'].filter(k => k === 'name' ? name !== undefined : category !== undefined);
       const item = updatePackingItem(tripId, itemId, { name, category }, bodyKeys);
       if (!item) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
@@ -129,6 +133,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, orderedIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       reorderPackingItems(tripId, orderedIds);
       safeBroadcast(tripId, 'packing:reordered', { orderedIds });
       return ok({ success: true });
@@ -165,6 +170,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, name, color }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const bag = createBag(tripId, { name, color });
       safeBroadcast(tripId, 'packing:bag-created', { bag });
       return ok({ bag });
@@ -186,6 +192,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, bagId, name, color }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const fields: Record<string, unknown> = {};
       const bodyKeys: string[] = [];
       if (name !== undefined) { fields.name = name; bodyKeys.push('name'); }
@@ -209,6 +216,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, bagId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       deleteBag(tripId, bagId);
       safeBroadcast(tripId, 'packing:bag-deleted', { id: bagId });
       return ok({ success: true });
@@ -229,6 +237,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, bagId, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       setBagMembers(tripId, bagId, userIds);
       safeBroadcast(tripId, 'packing:bag-members-updated', { bagId, userIds });
       return ok({ success: true });
@@ -265,6 +274,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, categoryName, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       updatePackingCategoryAssignees(tripId, categoryName, userIds);
       safeBroadcast(tripId, 'packing:assignees', { categoryName, userIds });
       return ok({ success: true });
@@ -284,6 +294,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, templateId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const applied = applyTemplate(tripId, templateId);
       if (applied === null) return { content: [{ type: 'text' as const, text: 'Template not found.' }], isError: true };
       safeBroadcast(tripId, 'packing:template-applied', { templateId });
@@ -304,6 +315,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, templateName }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       saveAsTemplate(tripId, userId, templateName);
       return ok({ success: true });
     }
@@ -326,6 +338,7 @@ export function registerPackingTools(server: McpServer, userId: number, scopes:
     async ({ tripId, items }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       bulkImport(tripId, items);
       safeBroadcast(tripId, 'packing:updated', {});
       return ok({ success: true, count: items.length });

server/src/mcp/tools/places.ts

@@ -10,7 +10,7 @@ import { searchPlaces } from '../../services/mapsService';
 import {
   safeBroadcast, TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
   TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canWrite } from '../scopes';
 
@@ -45,6 +45,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, name, description, lat, lng, address, category_id, google_place_id, osm_id, notes, website, phone, price, currency }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
       const place = createPlace(String(tripId), { name, description, lat, lng, address, category_id, google_place_id, osm_id, notes, website, phone, price, currency });
       safeBroadcast(tripId, 'place:created', { place });
       return ok({ place });
@@ -78,6 +79,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, dayId, name, description, lat, lng, address, category_id, google_place_id, osm_id, place_notes, website, phone, assignment_notes, price, currency }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
       if (!dayExists(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
       try {
         const run = db.transaction(() => {
@@ -125,6 +127,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, placeId, name, description, lat, lng, address, category_id, price, currency, place_time, end_time, duration_minutes, notes, website, phone, transport_mode, osm_id, google_place_id }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
       const place = updatePlace(String(tripId), String(placeId), { name, description, lat, lng, address, category_id, price, currency, place_time, end_time, duration_minutes, notes, website, phone, transport_mode, osm_id, google_place_id });
       if (!place) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
       safeBroadcast(tripId, 'place:updated', { place });
@@ -145,6 +148,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, placeId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
       const deleted = deletePlace(String(tripId), String(placeId));
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
       safeBroadcast(tripId, 'place:deleted', { placeId });
@@ -222,6 +226,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, url, source }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
 
       const result = source === 'google-list'
         ? await importGoogleList(String(tripId), url)
@@ -251,6 +256,7 @@ export function registerPlaceTools(server: McpServer, userId: number, scopes: st
     async ({ tripId, placeIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('place_edit', tripId, userId)) return permissionDenied();
 
       const deleted = deletePlacesMany(String(tripId), placeIds);
       for (const id of deleted) {

server/src/mcp/tools/prompts.ts

@@ -46,17 +46,16 @@ export function registerMcpPrompts(server: McpServer, _userId: number, isStaticT
       if (!summary) {
         return { messages: [{ role: 'user', content: { type: 'text', text: 'Trip not found.' } }] };
       }
-      const { trip, days, members, budget, packing, reservations, collabNotes } = summary;
-      const packingStats = packing ? { total: packing.length, packed: packing.filter((p: any) => p.checked).length } : { total: 0, packed: 0 };
-      const budgetTotal = budget?.reduce((sum: number, b: any) => sum + (b.total_price || 0), 0) || 0;
+      const { trip, days, members, budget, packing, reservations, collab_notes } = summary;
+      const memberList = [members?.owner, ...(members?.collaborators || [])].filter(Boolean);
       const text = `Trip: ${trip?.title || 'Untitled'}${trip?.description ? `\n${trip.description}` : ''}
 Dates: ${trip?.start_date || '?'} to ${trip?.end_date || '?'}
-Members: ${members?.length || 0} (${members?.map((m: any) => m.name || m.email).join(', ') || 'none'})
+Members: ${memberList.length} (${memberList.map((m: any) => m.name || m.email).join(', ') || 'none'})
 Days: ${days?.length || 0}
-Packing: ${packingStats.packed}/${packingStats.total} items packed
-Budget: ${budgetTotal} ${trip?.currency || 'EUR'} total
+Packing: ${packing?.checked || 0}/${packing?.total || 0} items packed
+Budget: ${budget?.total || 0} ${trip?.currency || 'EUR'} total
 Reservations: ${reservations?.length || 0}
-Collab Notes: ${collabNotes?.length || 0}
+Collab Notes: ${collab_notes?.length || 0}
 ${days?.map((d: any, i: number) => `Day ${i + 1} (${d.date}): ${d.assignments?.length || 0} places${d.title ? ` - ${d.title}` : ''}`).join('\n') || 'No days yet'}`;
       return {
         description: `Summary of trip "${trip?.title || tripId}"`,
@@ -118,7 +117,7 @@ ${days?.map((d: any, i: number) => `Day ${i + 1} (${d.date}): ${d.assignments?.l
       }
       const { trip, budget } = summary;
       const currency = trip?.currency || 'EUR';
-      const byCategory = (budget || []).reduce((acc: Record<string, number>, item: any) => {
+      const byCategory = (budget?.items || []).reduce((acc: Record<string, number>, item: any) => {
         const cat = item.category || 'Uncategorized';
         acc[cat] = (acc[cat] || 0) + (item.total_price || 0);
         return acc;
@@ -128,7 +127,8 @@ ${days?.map((d: any, i: number) => `Day ${i + 1} (${d.date}): ${d.assignments?.l
         .sort(([, a], [, b]) => b - a)
         .map(([cat, amount]) => `- ${cat}: ${amount} ${currency}`)
         .join('\n');
-      const perPerson = (summary.members?.length || 1) > 0 ? (total / (summary.members?.length || 1)).toFixed(2) : total.toFixed(2);
+      const memberCount = Math.max(1, [summary.members?.owner, ...(summary.members?.collaborators || [])].filter(Boolean).length);
+      const perPerson = (total / memberCount).toFixed(2);
       return {
         description: `Budget overview for "${trip?.title || tripId}"`,
         messages: [{ role: 'user', content: { type: 'text', text: `# Budget: ${trip?.title || 'Trip'}\n\n**Total: ${total} ${currency}** (${perPerson} ${currency} per person)\n\n${lines || 'No expenses recorded.'}` } }],

server/src/mcp/tools/reservations.ts

@@ -12,7 +12,7 @@ import { placeExists, getAssignmentForTrip } from '../../services/assignmentServ
 import {
   safeBroadcast, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
   TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canWrite } from '../scopes';
 
@@ -47,6 +47,7 @@ export function registerReservationTools(server: McpServer, userId: number, scop
     async ({ tripId, title, type, reservation_time, location, confirmation_number, notes, day_id, place_id, start_day_id, end_day_id, check_in, check_out, assignment_id, price, budget_category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
 
       // Validate that all referenced IDs belong to this trip
       if (day_id && !getDay(day_id, tripId))
@@ -113,6 +114,7 @@ export function registerReservationTools(server: McpServer, userId: number, scop
     async ({ tripId, reservationId, title, type, reservation_time, location, confirmation_number, notes, status, place_id, assignment_id }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
       const existing = getReservation(reservationId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
 
@@ -144,6 +146,7 @@ export function registerReservationTools(server: McpServer, userId: number, scop
     async ({ tripId, reservationId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
       const { deleted, accommodationDeleted } = deleteReservation(reservationId, tripId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
       if (accommodationDeleted) {
@@ -171,6 +174,7 @@ export function registerReservationTools(server: McpServer, userId: number, scop
     async ({ tripId, positions, dayId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
       updateReservationPositions(tripId, positions, dayId);
       safeBroadcast(tripId, 'reservation:positions', { positions, dayId });
       return ok({ success: true });
@@ -195,6 +199,7 @@ export function registerReservationTools(server: McpServer, userId: number, scop
     async ({ tripId, reservationId, place_id, start_day_id, end_day_id, check_in, check_out }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
       const current = getReservation(reservationId, tripId);
       if (!current) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
       if (current.type !== 'hotel') return { content: [{ type: 'text' as const, text: 'Reservation is not of type hotel.' }], isError: true };

server/src/mcp/tools/todos.ts

@@ -10,7 +10,7 @@ import {
 import {
   safeBroadcast, TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
   TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canWrite } from '../scopes';
 import { isAddonEnabled } from '../../services/adminService';
@@ -58,6 +58,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, name, category, due_date, description, assigned_user_id, priority }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const item = createTodoItem(tripId, { name, category, due_date, description, assigned_user_id, priority });
       safeBroadcast(tripId, 'todo:created', { item });
       return ok({ item });
@@ -83,6 +84,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, itemId, name, category, due_date, description, assigned_user_id, priority }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       // Build bodyKeys to signal which nullable fields were explicitly provided
       const bodyKeys: string[] = [];
       if (due_date !== undefined) bodyKeys.push('due_date');
@@ -110,6 +112,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, itemId, checked }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const item = updateTodoItem(tripId, itemId, { checked: checked ? 1 : 0 }, []);
       if (!item) return { content: [{ type: 'text' as const, text: 'To-do item not found.' }], isError: true };
       safeBroadcast(tripId, 'todo:updated', { item });
@@ -130,6 +133,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const deleted = deleteTodoItem(tripId, itemId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'To-do item not found.' }], isError: true };
       safeBroadcast(tripId, 'todo:deleted', { itemId });
@@ -150,6 +154,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, orderedIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       reorderTodoItems(tripId, orderedIds);
       return ok({ success: true });
     }
@@ -185,6 +190,7 @@ export function registerTodoTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, categoryName, userIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('packing_edit', tripId, userId)) return permissionDenied();
       const assignees = updateTodoCategoryAssignees(tripId, categoryName, userIds);
       safeBroadcast(tripId, 'todo:assignees', { category: categoryName, assignees });
       return ok({ assignees });

server/src/mcp/tools/transports.ts

@@ -9,7 +9,7 @@ import { linkBudgetItemToReservation } from '../../services/budgetService';
 import { getDay } from '../../services/dayService';
 import {
   safeBroadcast, TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  TOOL_ANNOTATIONS_WRITE, demoDenied, noAccess, ok,
+  TOOL_ANNOTATIONS_WRITE, demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canWrite } from '../scopes';
 
@@ -56,6 +56,7 @@ export function registerTransportTools(server: McpServer, userId: number, scopes
     async ({ tripId, type, title, status, start_day_id, end_day_id, reservation_time, reservation_end_time, confirmation_number, notes, metadata, endpoints, needs_review, price, budget_category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
 
       if (start_day_id && !getDay(start_day_id, tripId))
         return { content: [{ type: 'text' as const, text: 'start_day_id does not belong to this trip.' }], isError: true };
@@ -120,6 +121,7 @@ export function registerTransportTools(server: McpServer, userId: number, scopes
     async ({ tripId, reservationId, type, title, status, start_day_id, end_day_id, reservation_time, reservation_end_time, confirmation_number, notes, metadata, endpoints, needs_review }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
 
       const existing = getReservation(reservationId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Transport not found.' }], isError: true };
@@ -165,6 +167,7 @@ export function registerTransportTools(server: McpServer, userId: number, scopes
     async ({ tripId, reservationId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('reservation_edit', tripId, userId)) return permissionDenied();
       const { deleted } = deleteReservation(reservationId, tripId);
       if (!deleted) return { content: [{ type: 'text' as const, text: 'Transport not found.' }], isError: true };
       safeBroadcast(tripId, 'reservation:deleted', { reservationId });

server/src/mcp/tools/trips.ts

@@ -22,7 +22,7 @@ import {
   safeBroadcast, MAX_MCP_TRIP_DAYS,
   TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
   TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
-  demoDenied, noAccess, ok,
+  demoDenied, noAccess, ok, hasTripPermission, permissionDenied,
 } from './_shared';
 import { canRead, canReadTrips, canWrite, canDeleteTrips, canShareTrips } from '../scopes';
 
@@ -78,12 +78,15 @@ export function registerTripTools(server: McpServer, userId: number, scopes: str
         start_date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
         end_date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
         currency: z.string().length(3).optional(),
+        is_archived: z.boolean().optional().describe('Archive (true) or unarchive (false) the trip'),
+        cover_image: z.string().optional().describe('Cover image path, e.g. /uploads/covers/abc.jpg'),
       },
       annotations: TOOL_ANNOTATIONS_WRITE,
     },
-    async ({ tripId, title, description, start_date, end_date, currency }) => {
+    async ({ tripId, title, description, start_date, end_date, currency, is_archived, cover_image }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('trip_edit', tripId, userId)) return permissionDenied();
       if (start_date) {
         const d = new Date(start_date + 'T00:00:00Z');
         if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== start_date)
@@ -94,7 +97,7 @@ export function registerTripTools(server: McpServer, userId: number, scopes: str
         if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
           return { content: [{ type: 'text' as const, text: 'end_date is not a valid calendar date.' }], isError: true };
       }
-      const { updatedTrip } = updateTrip(tripId, userId, { title, description, start_date, end_date, currency }, 'user');
+      const { updatedTrip } = updateTrip(tripId, userId, { title, description, start_date, end_date, currency, is_archived, cover_image }, 'user');
       safeBroadcast(tripId, 'trip:updated', { trip: updatedTrip });
       return ok({ trip: updatedTrip });
     }
@@ -321,6 +324,8 @@ export function registerTripTools(server: McpServer, userId: number, scopes: str
       annotations: TOOL_ANNOTATIONS_READONLY,
     },
     async ({ tripId }) => {
+      // Read parity with the REST route GET /api/trips/:tripId/share-link, which
+      // only requires trip membership (share_manage gates create/delete, not read).
       if (!canAccessTrip(tripId, userId)) return noAccess();
       const link = getShareLink(String(tripId));
       return ok({ link });
@@ -344,6 +349,7 @@ export function registerTripTools(server: McpServer, userId: number, scopes: str
     async ({ tripId, share_map, share_bookings, share_packing, share_budget, share_collab }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('share_manage', tripId, userId)) return permissionDenied();
       const { token, created } = createOrUpdateShareLink(String(tripId), userId, {
         share_map: share_map ?? true,
         share_bookings: share_bookings ?? true,
@@ -367,6 +373,7 @@ export function registerTripTools(server: McpServer, userId: number, scopes: str
     async ({ tripId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!hasTripPermission('share_manage', tripId, userId)) return permissionDenied();
       deleteShareLink(String(tripId));
       return ok({ success: true });
     }

server/src/middleware/auth.ts

@@ -27,7 +27,11 @@ export function extractToken(req: Request): string | null {
  */
 export function verifyJwtAndLoadUser(token: string): User | null {
   try {
-    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number; pv?: number };
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number; pv?: number; purpose?: string };
+    // Purpose-scoped tokens (e.g. the short-lived mfa_login token) share this
+    // secret but are not full session tokens — only their dedicated endpoint
+    // may accept them, so reject any token carrying a purpose claim here.
+    if (decoded.purpose) return null;
     const row = db.prepare(
       'SELECT id, username, email, role, password_version FROM users WHERE id = ?'
     ).get(decoded.id) as (User & { password_version?: number }) | undefined;

server/src/middleware/globalMiddleware.ts

@@ -0,0 +1,165 @@
+import express, { Request, Response, NextFunction } from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import cookieParser from 'cookie-parser';
+import { logDebug, logWarn, logError } from '../services/auditLog';
+import { enforceGlobalMfaPolicy } from './mfaPolicy';
+
+/**
+ * The global request pipeline shared by the legacy Express app and the NestJS
+ * instance. Both mount the *exact same* config so a request hitting a migrated
+ * Nest route is protected identically to one hitting the legacy fallback
+ * (helmet/CSP, CORS, HSTS, forced-HTTPS, the global MFA policy and request
+ * logging). Keeping it in one place is what makes the strangler dispatch
+ * behaviourally transparent — and is the prerequisite for retiring Express,
+ * since the Nest instance must carry the whole shell on its own.
+ *
+ * `bodyParser` is opt-out: the Nest instance does its own body parsing, so it
+ * passes `false` to avoid parsing the request twice.
+ */
+export function applyGlobalMiddleware(
+  app: express.Application,
+  opts: { bodyParser?: boolean } = {},
+): void {
+  const { bodyParser = true } = opts;
+
+  // Trust first proxy (nginx/Docker) for correct req.ip
+  if (process.env.NODE_ENV?.toLowerCase() === 'production' || process.env.TRUST_PROXY) {
+    app.set('trust proxy', Number.parseInt(process.env.TRUST_PROXY) || 1);
+  }
+
+  const allowedOrigins = process.env.ALLOWED_ORIGINS
+    ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
+    : null;
+
+  let corsOrigin: cors.CorsOptions['origin'];
+  if (allowedOrigins) {
+    corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
+      if (!origin || allowedOrigins.includes(origin)) callback(null, true);
+      else callback(new Error('Not allowed by CORS'));
+    };
+  } else if (process.env.NODE_ENV?.toLowerCase() === 'production') {
+    corsOrigin = false;
+  } else {
+    corsOrigin = true;
+  }
+
+  const shouldForceHttps = process.env.FORCE_HTTPS?.toLowerCase() === 'true';
+  // HSTS is worth enabling any time we're serving production traffic,
+  // not only when FORCE_HTTPS is set. Self-hosters behind Traefik /
+  // Caddy / Cloudflare Tunnel typically leave FORCE_HTTPS unset (the
+  // proxy handles the redirect for them), and the previous "HSTS off by
+  // default" meant those instances never advertised HSTS at all.
+  //
+  // `includeSubDomains` stays OFF by default on purpose: an instance
+  // running on an apex domain would otherwise force HTTPS on every
+  // sibling subdomain the same operator may still be running over plain
+  // HTTP. Operators who want the stricter policy opt in with
+  // `HSTS_INCLUDE_SUBDOMAINS=true`.
+  const hstsActive = shouldForceHttps || process.env.NODE_ENV === 'production';
+  const hstsIncludeSubdomains = process.env.HSTS_INCLUDE_SUBDOMAINS === 'true';
+
+  // RFC 8414 / RFC 9728 / RFC 7591: discovery docs and DCR are world-readable/writable.
+  // /mcp needs open CORS so external MCP clients (ChatGPT, Claude.ai, Inspector) can call it
+  // with Bearer tokens from any origin. /oauth/register and /oauth/authorize need it for
+  // browser-based DCR/authorization preflights — the global cors({ origin: false }) would
+  // answer OPTIONS without Access-Control-Allow-Origin before the SDK's own cors() runs.
+  // All /.well-known/* paths get open CORS so clients probing openid-configuration or the
+  // RFC 8414 path-suffixed AS metadata form don't get CORS-blocked (they get 404 JSON instead).
+  app.use(
+    (req: Request, _res: Response, next: NextFunction) => {
+      if (
+        req.path.startsWith('/.well-known/') ||
+        req.path === '/oauth/register' ||
+        req.path === '/oauth/authorize' ||
+        req.path === '/oauth/userinfo' ||
+        req.path === '/mcp'
+      ) {
+        cors({ origin: '*', credentials: false })(req, _res, next);
+      } else {
+        next();
+      }
+    },
+  );
+  app.use(cors({ origin: corsOrigin, credentials: true }));
+  app.use(helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'", "'wasm-unsafe-eval'", "'unsafe-eval'"],
+        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
+        imgSrc: ["'self'", "data:", "blob:", "https:"],
+        connectSrc: [
+          "'self'", "ws:", "wss:",
+          "https://nominatim.openstreetmap.org", "https://overpass-api.de",
+          "https://places.googleapis.com", "https://api.openweathermap.org",
+          "https://en.wikipedia.org", "https://commons.wikimedia.org",
+          "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
+          "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
+          "https://geocoding-api.open-meteo.com", "https://api.frankfurter.dev",
+          "https://router.project-osrm.org/route/v1/", "https://routing.openstreetmap.de/",
+          "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com"
+        ],
+        workerSrc: ["'self'", "blob:"],
+        childSrc: ["'self'", "blob:"],
+        fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
+        objectSrc: ["'none'"],
+        frameSrc: ["'none'"],
+        frameAncestors: ["'self'"],
+        // Restrict <form> submission targets (form-action has no default-src
+        // fallback, so it must be set explicitly).
+        formAction: ["'self'"],
+        upgradeInsecureRequests: shouldForceHttps ? [] : null
+      }
+    },
+    crossOriginEmbedderPolicy: false,
+    hsts: hstsActive ? { maxAge: 31536000, includeSubDomains: hstsIncludeSubdomains } : false,
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+  }));
+
+  if (shouldForceHttps) {
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path === '/api/health') return next();
+      if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
+      res.redirect(301, 'https://' + req.headers.host + req.url);
+    });
+  }
+
+  if (bodyParser) {
+    app.use(express.json({ limit: '100kb' }));
+    app.use(express.urlencoded({ extended: true }));
+  }
+  app.use(cookieParser());
+  app.use(enforceGlobalMfaPolicy);
+
+  // Request logging with sensitive field redaction
+  const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
+  const redact = (value: unknown): unknown => {
+    if (!value || typeof value !== 'object') return value;
+    if (Array.isArray(value)) return (value as unknown[]).map(redact);
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v);
+    }
+    return out;
+  };
+
+  app.use((req: Request, res: Response, next: NextFunction) => {
+    if (req.path === '/api/health') return next();
+    const startedAt = Date.now();
+    res.on('finish', () => {
+      const ms = Date.now() - startedAt;
+      if (res.statusCode >= 500) {
+        logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+      } else if (res.statusCode === 401 || res.statusCode === 403) {
+        logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+      } else if (res.statusCode >= 400) {
+        logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+      }
+      const q = Object.keys(req.query).length ? ` query=${JSON.stringify(redact(req.query))}` : '';
+      const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(redact(req.body))}` : '';
+      logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
+    });
+    next();
+  });
+}

server/src/middleware/mfaPolicy.ts

@@ -12,6 +12,9 @@ export function isPublicApiPath(method: string, pathNoQuery: string): boolean {
   if (method === 'POST' && pathNoQuery === '/api/auth/demo-login') return true;
   if (method === 'GET' && pathNoQuery.startsWith('/api/auth/invite/')) return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/verify-login') return true;
+  // Unauthenticated passkey (primary) login ceremony.
+  if (method === 'POST' && pathNoQuery === '/api/auth/passkey/login/options') return true;
+  if (method === 'POST' && pathNoQuery === '/api/auth/passkey/login/verify') return true;
   if (pathNoQuery.startsWith('/api/auth/oidc/')) return true;
   return false;
 }
@@ -21,6 +24,11 @@ export function isMfaSetupExemptPath(method: string, pathNoQuery: string): boole
   if (method === 'GET' && pathNoQuery === '/api/auth/me') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/setup') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/enable') return true;
+  // Allow enrolling a passkey as the second factor (a user-verified passkey
+  // satisfies require_mfa), so a fresh user under the policy isn't stuck.
+  if (method === 'POST' && pathNoQuery === '/api/auth/passkey/register/options') return true;
+  if (method === 'POST' && pathNoQuery === '/api/auth/passkey/register/verify') return true;
+  if (method === 'GET' && pathNoQuery === '/api/auth/passkey/credentials') return true;
   if ((method === 'GET' || method === 'PUT') && pathNoQuery === '/api/auth/app-settings') return true;
   return false;
 }
@@ -81,8 +89,12 @@ export function enforceGlobalMfaPolicy(req: Request, res: Response, next: NextFu
     return;
   }
 
+  // A user-verified passkey is phishing-resistant and inherently two-factor, so
+  // owning at least one satisfies the require_mfa policy exactly like TOTP does.
+  // (All stored passkeys were registered with userVerification required.)
   const mfaOk = row.mfa_enabled === 1 || row.mfa_enabled === true;
-  if (mfaOk) {
+  const passkeyOk = !!db.prepare('SELECT 1 FROM webauthn_credentials WHERE user_id = ? LIMIT 1').get(userId);
+  if (mfaOk || passkeyOk) {
     next();
     return;
   }

server/src/nest/README.md

@@ -0,0 +1,84 @@
+# NestJS migration layer — module & test guide
+
+This folder holds the co-hosted NestJS app that incrementally strangles the legacy
+Express API (see the "Brownfield Rewrite" board). Until a prefix is migrated, the
+top-level dispatcher in `src/index.ts` routes it to the legacy app; migrated
+prefixes go to Nest. **Weather (`weather/`) is the reference implementation** — copy
+its shape when migrating a new domain.
+
+## Module layout (per domain)
+
+```
+shared/src/<domain>/<domain>.schema.ts(.spec.ts)   # Zod contract — single source of truth
+server/src/nest/<domain>/<domain>.service.ts        # business logic (ported 1:1 from the Express service)
+server/src/nest/<domain>/<domain>.controller.ts     # same routes/verbs/params/status codes as Express
+server/src/nest/<domain>/<domain>.module.ts         # registered in app.module.ts
+```
+
+Add the prefix to `DEFAULT_NEST_PREFIXES` in `strangler.ts` to route it to Nest
+(operators can override at runtime via the `NEST_PREFIXES` env var — instant
+rollback, no redeploy). Trip-scoped mounts use a pattern prefix with a `:param`
+segment (e.g. `/api/trips/:tripId/packing`); the matcher routes only that nested
+mount to Nest and leaves the sibling trip routes (days, places, ...) on Express.
+
+## Migrated so far
+
+- **Phase 1 (leaf):** weather, airports, config (public), system-notices, maps,
+  categories, tags, notifications, atlas.
+- **Phase 2 (trip sub-domains):** vacay (addon), packing, todo.
+
+## Cross-cutting Foundation pieces
+
+- `common/idempotency.interceptor.ts` — global `APP_INTERCEPTOR` replaying the
+  client's `X-Idempotency-Key` on mutations, mirroring the legacy
+  `applyIdempotency` middleware so retried writes don't double-apply.
+- `strangler.ts` — supports both static prefixes and `:param` pattern prefixes.
+
+## Parity gotchas worth remembering
+
+- A POST that answers with `res.json` in Express stays **200**; add `@HttpCode(200)`
+  (Nest defaults POST to 201). Creates that Express sends as 201 need nothing.
+- Static sub-routes that collide with a `:id` param (e.g. `/in-app/all` vs
+  `/in-app/:id`, `/reorder` vs `/:id`) must be declared **before** the param route.
+- Reproduce bespoke admin/error wording exactly — e.g. notifications' `test-smtp`
+  returns `{ error: 'Admin only' }`, not the AdminGuard's `Admin access required`.
+- Trip-scoped routes verify trip access (404) and the relevant permission (403)
+  per handler and forward `X-Socket-Id` to the WebSocket broadcast.
+
+## Parity is law
+
+A migrated route must be **byte-identical** for the client: same URL, method,
+query/body, HTTP status, `Set-Cookie`, and JSON body — including bespoke error
+strings. Where the legacy route returns a hand-written error (e.g. weather's
+`{ error: 'Latitude and longitude are required' }`), reproduce that exact body in
+the controller rather than relying on the generic `ZodValidationPipe` envelope.
+
+## How to write the tests
+
+Every module ships three kinds of tests; the coverage gate (`vitest.config.ts`,
+scoped to `src/nest/**`) requires ≥80%.
+
+1. **Service / controller unit spec** — `tests/unit/nest/<domain>.controller.test.ts`.
+   Instantiate the controller with a mocked service; assert status codes, the exact
+   `{ error }` bodies, and that inputs are forwarded correctly (defaults, coercion).
+   See `weather.controller.test.ts`.
+
+2. **Parity test** — `tests/parity/<domain>.parity.test.ts`. Mock the shared service
+   identically for both apps, then fire the same request at the Express route and the
+   Nest controller with the `expectParity()` harness (`tests/parity/parity.ts`) and
+   assert identical status + body. This is the gate before flipping the toggle.
+   See `weather.parity.test.ts`.
+
+3. **e2e** — `tests/e2e/<domain>.e2e.test.ts`. Boot the Nest module against a temp
+   in-memory SQLite db via the shared harness (`tests/e2e/harness.ts`:
+   `createTempDb`/`seedUser`/`sessionCookie`), exercising the **real** `JwtAuthGuard`
+   end-to-end (401 without cookie, 200 with a signed session). Mock external I/O
+   (HTTP/etc.). See `weather.e2e.test.ts`.
+
+## Definition of Done (per module)
+
+Contract in `@trek/shared` → service ported 1:1 → controller with identical routes →
+validation/error parity → unit + parity + e2e tests over the gate → prefix toggled to
+Nest → parity verified on the demo DB → **then** decommission the old Express
+route/service (separate step, after the toggle is confirmed in prod) → frontend points
+at the typed contract (Frontend Track).

server/src/nest/addons/addons.controller.ts

@@ -0,0 +1,22 @@
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { AddonsService } from './addons.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+
+/**
+ * GET /api/addons — the enabled trip add-ons + photo providers feed.
+ * Byte-identical to the legacy inline handler in server/src/app.ts
+ * (authenticate-gated, returns { collabFeatures, addons: [...] }).
+ *
+ * Distinct from the addon sub-mounts /api/addons/atlas and /api/addons/vacay
+ * (their own Nest modules); the strangler routes only the EXACT /api/addons here.
+ */
+@Controller('api/addons')
+@UseGuards(JwtAuthGuard)
+export class AddonsController {
+  constructor(private readonly addons: AddonsService) {}
+
+  @Get()
+  list() {
+    return this.addons.list();
+  }
+}

server/src/nest/addons/addons.module.ts

@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+import { AddonsController } from './addons.controller';
+import { AddonsService } from './addons.service';
+
+/**
+ * GET /api/addons — enabled add-ons + photo providers (was an inline handler in
+ * server/src/app.ts). The addon sub-features (atlas, vacay) keep their own
+ * modules; this only serves the EXACT /api/addons listing.
+ */
+@Module({
+  controllers: [AddonsController],
+  providers: [AddonsService],
+})
+export class AddonsModule {}

server/src/nest/addons/addons.service.ts

@@ -0,0 +1,82 @@
+import { Injectable } from '@nestjs/common';
+import { db } from '../../db/database';
+import type { Addon } from '../../types';
+import { getBagTracking, getCollabFeatures } from '../../services/adminService';
+import { getPhotoProviderConfig } from '../../services/memories/helpersService';
+
+/**
+ * Thin wrapper around the enabled-addons + photo-provider read that the legacy
+ * inline `GET /api/addons` handler performed (server/src/app.ts). The SQL,
+ * ordering, boolean coercions and the merged photo-provider entries are
+ * reproduced 1:1 so the body is byte-identical for the client.
+ */
+@Injectable()
+export class AddonsService {
+  list() {
+    const addons = db
+      .prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order')
+      .all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
+    const providers = db
+      .prepare(
+        `SELECT id, name, icon, enabled, sort_order
+         FROM photo_providers
+         WHERE enabled = 1
+         ORDER BY sort_order, id`,
+      )
+      .all() as Array<{ id: string; name: string; icon: string; enabled: number; sort_order: number }>;
+    const fields = db
+      .prepare(
+        `SELECT provider_id, field_key, label, input_type, placeholder, hint, required, secret, settings_key, payload_key, sort_order
+         FROM photo_provider_fields
+         ORDER BY sort_order, id`,
+      )
+      .all() as Array<{
+      provider_id: string;
+      field_key: string;
+      label: string;
+      input_type: string;
+      placeholder?: string | null;
+      hint?: string | null;
+      required: number;
+      secret: number;
+      settings_key?: string | null;
+      payload_key?: string | null;
+      sort_order: number;
+    }>;
+
+    const fieldsByProvider = new Map<string, typeof fields>();
+    for (const field of fields) {
+      const arr = fieldsByProvider.get(field.provider_id) || [];
+      arr.push(field);
+      fieldsByProvider.set(field.provider_id, arr);
+    }
+
+    return {
+      collabFeatures: getCollabFeatures(),
+      bagTracking: getBagTracking().enabled,
+      addons: [
+        ...addons.map((a) => ({ ...a, enabled: !!a.enabled })),
+        ...providers.map((p) => ({
+          id: p.id,
+          name: p.name,
+          type: 'photo_provider',
+          icon: p.icon,
+          enabled: !!p.enabled,
+          config: getPhotoProviderConfig(p.id),
+          fields: (fieldsByProvider.get(p.id) || []).map((f) => ({
+            key: f.field_key,
+            label: f.label,
+            input_type: f.input_type,
+            placeholder: f.placeholder || '',
+            hint: f.hint || null,
+            required: !!f.required,
+            secret: !!f.secret,
+            settings_key: f.settings_key || null,
+            payload_key: f.payload_key || null,
+            sort_order: f.sort_order,
+          })),
+        })),
+      ],
+    };
+  }
+}

server/src/nest/admin/admin.controller.ts

@@ -0,0 +1,346 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpException, NotFoundException, Param, Post, Put, Query, Req, UseGuards } from '@nestjs/common';
+import type { Request } from 'express';
+import { AdminService } from './admin.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { AdminGuard } from '../auth/admin.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { writeAudit, getClientIp, logInfo } from '../../services/auditLog';
+import { send as sendNotification } from '../../services/notificationService';
+import type { User } from '../../types';
+
+/** Throw the legacy {error,status} envelope when a service call reports failure. */
+function ok<T>(result: T): Exclude<T, { error: string }> {
+  if (result && typeof result === 'object' && 'error' in (result as Record<string, unknown>)) {
+    const r = result as unknown as { error: string; status?: number };
+    throw new HttpException({ error: r.error }, r.status ?? 400);
+  }
+  return result as Exclude<T, { error: string }>;
+}
+
+/**
+ * /api/admin — admin-only control surface (users, stats, permissions, audit log,
+ * OIDC settings, invites, feature toggles, packing templates, addons, MCP/OAuth
+ * sessions, JWT rotation, default user settings).
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/admin.ts):
+ * admin-gated, the {error,status} envelopes, the audit-log writes, the MCP
+ * session invalidation on addon/collab changes, create-201 vs the rest 200, and
+ * the dev-only test-notification endpoint (404 outside development).
+ */
+@Controller('api/admin')
+@UseGuards(JwtAuthGuard, AdminGuard)
+export class AdminController {
+  constructor(private readonly admin: AdminService) {}
+
+  // ── Users ──
+  @Get('users')
+  listUsers() { return { users: this.admin.listUsers() }; }
+
+  @Post('users')
+  @HttpCode(201)
+  createUser(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    const result = ok(this.admin.createUser(body));
+    writeAudit({ userId: user.id, action: 'admin.user_create', resource: String(result.insertedId), ip: getClientIp(req), details: result.auditDetails });
+    return { user: result.user };
+  }
+
+  @Put('users/:id')
+  updateUser(@CurrentUser() user: User, @Param('id') id: string, @Body() body: unknown, @Req() req: Request) {
+    const result = ok(this.admin.updateUser(id, body));
+    writeAudit({ userId: user.id, action: 'admin.user_update', resource: String(id), ip: getClientIp(req), details: { targetUser: result.previousEmail, fields: result.changed } });
+    logInfo(`Admin ${user.email} edited user ${result.previousEmail} (fields: ${result.changed.join(', ')})`);
+    return { user: result.user };
+  }
+
+  @Delete('users/:id')
+  deleteUser(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    const result = ok(this.admin.deleteUser(id, user.id));
+    writeAudit({ userId: user.id, action: 'admin.user_delete', resource: String(id), ip: getClientIp(req), details: { targetUser: result.email } });
+    logInfo(`Admin ${user.email} deleted user ${result.email}`);
+    return { success: true };
+  }
+
+  @Delete('users/:id/passkeys')
+  resetUserPasskeys(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    const result = ok(this.admin.resetUserPasskeys(id));
+    writeAudit({ userId: user.id, action: 'admin.user_passkeys_reset', resource: String(id), ip: getClientIp(req), details: { targetUser: result.email, deleted: result.deleted } });
+    return { success: true, deleted: result.deleted };
+  }
+
+  // ── Stats / permissions / audit ──
+  @Get('stats')
+  stats() { return this.admin.getStats(); }
+
+  @Get('permissions')
+  permissions() { return this.admin.getPermissions(); }
+
+  @Put('permissions')
+  savePermissions(@CurrentUser() user: User, @Body() body: { permissions?: unknown }, @Req() req: Request) {
+    if (!body.permissions || typeof body.permissions !== 'object') {
+      throw new HttpException({ error: 'permissions object required' }, 400);
+    }
+    const result = this.admin.savePermissions(body.permissions as unknown as Parameters<AdminService['savePermissions']>[0]);
+    writeAudit({ userId: user.id, action: 'admin.permissions_update', resource: 'permissions', ip: getClientIp(req), details: body.permissions as Record<string, unknown> });
+    return { success: true, permissions: result.permissions, ...(result.skipped.length ? { skipped: result.skipped } : {}) };
+  }
+
+  @Get('audit-log')
+  auditLog(@Query() query: { limit?: string; offset?: string }) { return this.admin.getAuditLog(query); }
+
+  // ── OIDC ──
+  @Get('oidc')
+  getOidc() { return this.admin.getOidcSettings(); }
+
+  @Put('oidc')
+  updateOidc(@CurrentUser() user: User, @Body() body: { issuer?: string } & Record<string, unknown>, @Req() req: Request) {
+    const result = this.admin.updateOidcSettings(body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status || 400);
+    }
+    writeAudit({ userId: user.id, action: 'admin.oidc_update', ip: getClientIp(req), details: { issuer_set: !!body.issuer } });
+    return { success: true };
+  }
+
+  @Post('save-demo-baseline')
+  @HttpCode(200)
+  saveDemoBaseline(@CurrentUser() user: User, @Req() req: Request) {
+    const result = this.admin.saveDemoBaseline();
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'admin.demo_baseline_save', ip: getClientIp(req) });
+    return { success: true, message: result.message };
+  }
+
+  // ── GitHub / version ──
+  @Get('github-releases')
+  async githubReleases(@Query('per_page') perPage = '10', @Query('page') page = '1') {
+    return this.admin.getGithubReleases(String(perPage), String(page));
+  }
+
+  @Get('version-check')
+  async versionCheck() { return this.admin.checkVersion(); }
+
+  // ── Admin notification preferences ──
+  @Get('notification-preferences')
+  getNotificationPrefs(@CurrentUser() user: User) { return this.admin.getPreferencesMatrix(user.id, user.role); }
+
+  @Put('notification-preferences')
+  setNotificationPrefs(@CurrentUser() user: User, @Body() body: unknown) {
+    this.admin.setAdminPreferences(user.id, body);
+    return this.admin.getPreferencesMatrix(user.id, user.role);
+  }
+
+  // ── Invites ──
+  @Get('invites')
+  listInvites() { return { invites: this.admin.listInvites() }; }
+
+  @Post('invites')
+  @HttpCode(201)
+  createInvite(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    const result = this.admin.createInvite(user.id, body);
+    writeAudit({ userId: user.id, action: 'admin.invite_create', resource: String(result.inviteId), ip: getClientIp(req), details: { max_uses: result.uses, expires_in_days: result.expiresInDays } });
+    return { invite: result.invite };
+  }
+
+  @Delete('invites/:id')
+  deleteInvite(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    ok(this.admin.deleteInvite(id));
+    writeAudit({ userId: user.id, action: 'admin.invite_delete', resource: String(id), ip: getClientIp(req) });
+    return { success: true };
+  }
+
+  // ── Feature toggles ──
+  @Get('bag-tracking')
+  getBagTracking() { return this.admin.getBagTracking(); }
+
+  @Put('bag-tracking')
+  updateBagTracking(@CurrentUser() user: User, @Body() body: { enabled?: unknown }, @Req() req: Request) {
+    const result = this.admin.updateBagTracking(body.enabled);
+    writeAudit({ userId: user.id, action: 'admin.bag_tracking', ip: getClientIp(req), details: { enabled: result.enabled } });
+    return result;
+  }
+
+  @Get('places-photos')
+  getPlacesPhotos() { return this.admin.getPlacesPhotos(); }
+
+  @Put('places-photos')
+  updatePlacesPhotos(@CurrentUser() user: User, @Body() body: { enabled?: unknown }, @Req() req: Request) {
+    if (typeof body.enabled !== 'boolean') throw new HttpException({ error: 'enabled must be a boolean' }, 400);
+    const result = this.admin.updatePlacesPhotos(body.enabled);
+    writeAudit({ userId: user.id, action: 'admin.places_photos', ip: getClientIp(req), details: { enabled: result.enabled } });
+    return result;
+  }
+
+  @Get('places-autocomplete')
+  getPlacesAutocomplete() { return this.admin.getPlacesAutocomplete(); }
+
+  @Put('places-autocomplete')
+  updatePlacesAutocomplete(@CurrentUser() user: User, @Body() body: { enabled?: unknown }, @Req() req: Request) {
+    if (typeof body.enabled !== 'boolean') throw new HttpException({ error: 'enabled must be a boolean' }, 400);
+    const result = this.admin.updatePlacesAutocomplete(body.enabled);
+    writeAudit({ userId: user.id, action: 'admin.places_autocomplete', ip: getClientIp(req), details: { enabled: result.enabled } });
+    return result;
+  }
+
+  @Get('places-details')
+  getPlacesDetails() { return this.admin.getPlacesDetails(); }
+
+  @Put('places-details')
+  updatePlacesDetails(@CurrentUser() user: User, @Body() body: { enabled?: unknown }, @Req() req: Request) {
+    if (typeof body.enabled !== 'boolean') throw new HttpException({ error: 'enabled must be a boolean' }, 400);
+    const result = this.admin.updatePlacesDetails(body.enabled);
+    writeAudit({ userId: user.id, action: 'admin.places_details', ip: getClientIp(req), details: { enabled: result.enabled } });
+    return result;
+  }
+
+  @Get('collab-features')
+  getCollabFeatures() { return this.admin.getCollabFeatures(); }
+
+  @Put('collab-features')
+  updateCollabFeatures(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    const result = this.admin.updateCollabFeatures(body);
+    this.admin.invalidateMcpSessions();
+    writeAudit({ userId: user.id, action: 'admin.collab_features', ip: getClientIp(req), details: result });
+    return result;
+  }
+
+  // ── Packing templates ──
+  @Get('packing-templates')
+  listPackingTemplates() { return { templates: this.admin.listPackingTemplates() }; }
+
+  @Get('packing-templates/:id')
+  getPackingTemplate(@Param('id') id: string) { return ok(this.admin.getPackingTemplate(id)); }
+
+  @Post('packing-templates')
+  @HttpCode(201)
+  createPackingTemplate(@CurrentUser() user: User, @Body() body: { name?: unknown }) {
+    return ok(this.admin.createPackingTemplate(body.name, user.id));
+  }
+
+  @Put('packing-templates/:id')
+  updatePackingTemplate(@Param('id') id: string, @Body() body: unknown) { return ok(this.admin.updatePackingTemplate(id, body)); }
+
+  @Delete('packing-templates/:id')
+  deletePackingTemplate(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    const result = ok(this.admin.deletePackingTemplate(id));
+    writeAudit({ userId: user.id, action: 'admin.packing_template_delete', resource: String(id), ip: getClientIp(req), details: { name: result.name } });
+    return { success: true };
+  }
+
+  @Post('packing-templates/:id/categories')
+  @HttpCode(201)
+  createTemplateCategory(@Param('id') id: string, @Body() body: { name?: unknown }) {
+    return ok(this.admin.createTemplateCategory(id, body.name));
+  }
+
+  @Put('packing-templates/:templateId/categories/:catId')
+  updateTemplateCategory(@Param('templateId') templateId: string, @Param('catId') catId: string, @Body() body: unknown) {
+    return ok(this.admin.updateTemplateCategory(templateId, catId, body));
+  }
+
+  @Delete('packing-templates/:templateId/categories/:catId')
+  deleteTemplateCategory(@Param('templateId') templateId: string, @Param('catId') catId: string) {
+    ok(this.admin.deleteTemplateCategory(templateId, catId));
+    return { success: true };
+  }
+
+  @Post('packing-templates/:templateId/categories/:catId/items')
+  @HttpCode(201)
+  createTemplateItem(@Param('templateId') templateId: string, @Param('catId') catId: string, @Body() body: { name?: unknown }) {
+    return ok(this.admin.createTemplateItem(templateId, catId, body.name));
+  }
+
+  @Put('packing-templates/:templateId/items/:itemId')
+  updateTemplateItem(@Param('itemId') itemId: string, @Body() body: unknown) { return ok(this.admin.updateTemplateItem(itemId, body)); }
+
+  @Delete('packing-templates/:templateId/items/:itemId')
+  deleteTemplateItem(@Param('itemId') itemId: string) {
+    ok(this.admin.deleteTemplateItem(itemId));
+    return { success: true };
+  }
+
+  // ── Addons ──
+  @Get('addons')
+  listAddons() { return { addons: this.admin.listAddons() }; }
+
+  @Put('addons/:id')
+  updateAddon(@CurrentUser() user: User, @Param('id') id: string, @Body() body: unknown, @Req() req: Request) {
+    const result = ok(this.admin.updateAddon(id, body));
+    writeAudit({ userId: user.id, action: 'admin.addon_update', resource: String(id), ip: getClientIp(req), details: result.auditDetails });
+    this.admin.invalidateMcpSessions();
+    return { addon: result.addon };
+  }
+
+  // ── MCP tokens / OAuth sessions ──
+  @Get('mcp-tokens')
+  listMcpTokens() { return { tokens: this.admin.listMcpTokens() }; }
+
+  @Delete('mcp-tokens/:id')
+  deleteMcpToken(@Param('id') id: string) {
+    ok(this.admin.deleteMcpToken(id));
+    return { success: true };
+  }
+
+  @Get('oauth-sessions')
+  listOAuthSessions() { return { sessions: this.admin.listOAuthSessions() }; }
+
+  @Delete('oauth-sessions/:id')
+  revokeOAuthSession(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    ok(this.admin.revokeOAuthSession(id));
+    writeAudit({ userId: user.id, action: 'admin.oauth_session.revoke', resource: String(id), ip: getClientIp(req) });
+    return { success: true };
+  }
+
+  // ── JWT rotation ──
+  @Post('rotate-jwt-secret')
+  @HttpCode(200)
+  rotateJwtSecret(@CurrentUser() user: User, @Req() req: Request) {
+    const result = this.admin.rotateJwtSecret();
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'admin.rotate_jwt_secret', ip: getClientIp(req) });
+    return { success: true };
+  }
+
+  // ── Default user settings ──
+  @Get('default-user-settings')
+  getDefaultUserSettings() { return this.admin.getAdminUserDefaults(); }
+
+  @Put('default-user-settings')
+  setDefaultUserSettings(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+      throw new HttpException({ error: 'Object body required' }, 400);
+    }
+    try {
+      this.admin.setAdminUserDefaults(body as unknown as Record<string, unknown>);
+      writeAudit({ userId: user.id, action: 'admin.default_user_settings_update', ip: getClientIp(req), details: body as Record<string, unknown> });
+      return this.admin.getAdminUserDefaults();
+    } catch (err) {
+      throw new HttpException({ error: err instanceof Error ? err.message : String(err) }, 400);
+    }
+  }
+
+  // ── Dev-only: test notification (404 outside development, mirroring the conditional mount) ──
+  @Post('dev/test-notification')
+  @HttpCode(200)
+  async devTestNotification(@CurrentUser() user: User, @Body() body: { event?: string; scope?: string; targetId?: number; params?: Record<string, unknown>; inApp?: boolean }) {
+    if (process.env.NODE_ENV?.toLowerCase() !== 'development') {
+      throw new NotFoundException();
+    }
+    try {
+      await sendNotification({
+        event: body.event ?? 'trip_reminder',
+        actorId: user.id,
+        scope: body.scope ?? 'user',
+        targetId: body.targetId ?? user.id,
+        params: { actor: user.email, ...(body.params ?? {}) },
+        inApp: body.inApp,
+      } as unknown as Parameters<typeof sendNotification>[0]);
+      return { success: true };
+    } catch (err) {
+      throw new HttpException({ error: err instanceof Error ? err.message : String(err) }, 400);
+    }
+  }
+}

server/src/nest/admin/admin.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { AdminController } from './admin.controller';
+import { AdminService } from './admin.service';
+
+@Module({
+  controllers: [AdminController],
+  providers: [AdminService],
+})
+export class AdminModule {}

server/src/nest/admin/admin.service.ts

@@ -0,0 +1,81 @@
+import { Injectable } from '@nestjs/common';
+import * as svc from '../../services/adminService';
+import { getAdminUserDefaults, setAdminUserDefaults } from '../../services/settingsService';
+import { invalidateMcpSessions } from '../../mcp';
+import { getPreferencesMatrix, setAdminPreferences } from '../../services/notificationPreferencesService';
+import { adminResetPasskeys } from '../../services/passkeyService';
+
+/**
+ * Thin Nest wrapper around the existing admin service (+ the settings,
+ * MCP-session and notification-preference helpers the legacy route used). All
+ * business logic, audit-relevant return shapes and the addon/MCP invalidation
+ * reuse the legacy code unchanged.
+ */
+@Injectable()
+export class AdminService {
+  // Users
+  listUsers() { return svc.listUsers(); }
+  createUser(body: unknown) { return svc.createUser(body as Parameters<typeof svc.createUser>[0]); }
+  updateUser(id: string, body: unknown) { return svc.updateUser(id, body as Parameters<typeof svc.updateUser>[1]); }
+  deleteUser(id: string, actingUserId: number) { return svc.deleteUser(id, actingUserId); }
+  resetUserPasskeys(id: string) { return adminResetPasskeys(Number(id)); }
+
+  getStats() { return svc.getStats(); }
+  getPermissions() { return svc.getPermissions(); }
+  savePermissions(permissions: Parameters<typeof svc.savePermissions>[0]) { return svc.savePermissions(permissions); }
+  getAuditLog(query: { limit?: string; offset?: string }) { return svc.getAuditLog(query); }
+
+  getOidcSettings() { return svc.getOidcSettings(); }
+  updateOidcSettings(body: unknown) { return svc.updateOidcSettings(body as Parameters<typeof svc.updateOidcSettings>[0]); }
+  saveDemoBaseline() { return svc.saveDemoBaseline(); }
+
+  getGithubReleases(perPage: string, page: string) { return svc.getGithubReleases(perPage, page); }
+  checkVersion() { return svc.checkVersion(); }
+
+  // Invites
+  listInvites() { return svc.listInvites(); }
+  createInvite(userId: number, body: unknown) { return svc.createInvite(userId, body as Parameters<typeof svc.createInvite>[1]); }
+  deleteInvite(id: string) { return svc.deleteInvite(id); }
+
+  // Feature toggles
+  getBagTracking() { return svc.getBagTracking(); }
+  updateBagTracking(enabled: unknown) { return svc.updateBagTracking(enabled as boolean); }
+  getPlacesPhotos() { return svc.getPlacesPhotos(); }
+  updatePlacesPhotos(enabled: boolean) { return svc.updatePlacesPhotos(enabled); }
+  getPlacesAutocomplete() { return svc.getPlacesAutocomplete(); }
+  updatePlacesAutocomplete(enabled: boolean) { return svc.updatePlacesAutocomplete(enabled); }
+  getPlacesDetails() { return svc.getPlacesDetails(); }
+  updatePlacesDetails(enabled: boolean) { return svc.updatePlacesDetails(enabled); }
+  getCollabFeatures() { return svc.getCollabFeatures(); }
+  updateCollabFeatures(body: unknown) { return svc.updateCollabFeatures(body as Parameters<typeof svc.updateCollabFeatures>[0]); }
+
+  // Packing templates
+  listPackingTemplates() { return svc.listPackingTemplates(); }
+  getPackingTemplate(id: string) { return svc.getPackingTemplate(id); }
+  createPackingTemplate(name: unknown, userId: number) { return svc.createPackingTemplate(name as string, userId); }
+  updatePackingTemplate(id: string, body: unknown) { return svc.updatePackingTemplate(id, body as Parameters<typeof svc.updatePackingTemplate>[1]); }
+  deletePackingTemplate(id: string) { return svc.deletePackingTemplate(id); }
+  createTemplateCategory(templateId: string, name: unknown) { return svc.createTemplateCategory(templateId, name as string); }
+  updateTemplateCategory(templateId: string, catId: string, body: unknown) { return svc.updateTemplateCategory(templateId, catId, body as Parameters<typeof svc.updateTemplateCategory>[2]); }
+  deleteTemplateCategory(templateId: string, catId: string) { return svc.deleteTemplateCategory(templateId, catId); }
+  createTemplateItem(templateId: string, catId: string, name: unknown) { return svc.createTemplateItem(templateId, catId, name as string); }
+  updateTemplateItem(itemId: string, body: unknown) { return svc.updateTemplateItem(itemId, body as Parameters<typeof svc.updateTemplateItem>[1]); }
+  deleteTemplateItem(itemId: string) { return svc.deleteTemplateItem(itemId); }
+
+  // Addons + tokens + sessions
+  listAddons() { return svc.listAddons(); }
+  updateAddon(id: string, body: unknown) { return svc.updateAddon(id, body as Parameters<typeof svc.updateAddon>[1]); }
+  listMcpTokens() { return svc.listMcpTokens(); }
+  deleteMcpToken(id: string) { return svc.deleteMcpToken(id); }
+  listOAuthSessions() { return svc.listOAuthSessions(); }
+  revokeOAuthSession(id: string) { return svc.revokeOAuthSession(id); }
+  rotateJwtSecret() { return svc.rotateJwtSecret(); }
+
+  invalidateMcpSessions() { invalidateMcpSessions(); }
+
+  // Settings + notification preference helpers (non-admin-service modules)
+  getAdminUserDefaults() { return getAdminUserDefaults(); }
+  setAdminUserDefaults(body: Record<string, unknown>) { return setAdminUserDefaults(body); }
+  getPreferencesMatrix(userId: number, role: string) { return getPreferencesMatrix(userId, role, 'admin'); }
+  setAdminPreferences(userId: number, body: unknown) { return setAdminPreferences(userId, body as Parameters<typeof setAdminPreferences>[1]); }
+}

server/src/nest/airports/airports.controller.ts

@@ -0,0 +1,38 @@
+import { Controller, Get, HttpException, Param, Query, UseGuards } from '@nestjs/common';
+import type { Airport } from '@trek/shared';
+import { AirportsService } from './airports.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+
+/**
+ * /api/airports — typeahead search + single lookup by IATA code.
+ *
+ * Behaviour is byte-identical to the legacy Express route (server/src/routes/
+ * airports.ts): both endpoints require auth, an absent/non-string query answers
+ * with `[]` (not a 400), and an unknown IATA code 404s with the exact
+ * `{ error: 'Airport not found' }` body.
+ *
+ * The `search` route is declared before `:iata` so the static segment wins over
+ * the param, matching the legacy router's registration order.
+ */
+@Controller('api/airports')
+@UseGuards(JwtAuthGuard)
+export class AirportsController {
+  constructor(private readonly airports: AirportsService) {}
+
+  @Get('search')
+  search(@Query('q') q?: string | string[]): Airport[] {
+    // Express coerces a missing/array query to '' and returns [] for it.
+    const term = typeof q === 'string' ? q : '';
+    if (!term) return [];
+    return this.airports.search(term);
+  }
+
+  @Get(':iata')
+  findByIata(@Param('iata') iata: string): Airport {
+    const airport = this.airports.findByIata(iata);
+    if (!airport) {
+      throw new HttpException({ error: 'Airport not found' }, 404);
+    }
+    return airport;
+  }
+}

server/src/nest/airports/airports.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { AirportsController } from './airports.controller';
+import { AirportsService } from './airports.service';
+
+/** Airports domain (L2 leaf module). Registered in AppModule. */
+@Module({
+  controllers: [AirportsController],
+  providers: [AirportsService],
+})
+export class AirportsModule {}

server/src/nest/airports/airports.service.ts

@@ -0,0 +1,19 @@
+import { Injectable } from '@nestjs/common';
+import type { Airport } from '@trek/shared';
+import { searchAirports, findByIata } from '../../services/airportService';
+
+/**
+ * Thin Nest wrapper around the existing airport service. It delegates to the
+ * same `searchAirports` / `findByIata` functions the legacy route uses, so the
+ * in-memory dataset and lookup behaviour stay identical and unduplicated.
+ */
+@Injectable()
+export class AirportsService {
+  search(query: string): Airport[] {
+    return searchAirports(query) as Airport[];
+  }
+
+  findByIata(code: string): Airport | null {
+    return findByIata(code) as Airport | null;
+  }
+}

server/src/nest/app.module.ts

@@ -0,0 +1,65 @@
+import { Module } from '@nestjs/common';
+import { APP_FILTER, APP_INTERCEPTOR } from '@nestjs/core';
+import { DatabaseModule } from './database/database.module';
+import { HealthController } from './health/health.controller';
+import { HealthService } from './health/health.service';
+import { WeatherModule } from './weather/weather.module';
+import { AirportsModule } from './airports/airports.module';
+import { ConfigModule } from './config/config.module';
+import { SystemNoticesModule } from './system-notices/system-notices.module';
+import { MapsModule } from './maps/maps.module';
+import { CategoriesModule } from './categories/categories.module';
+import { TagsModule } from './tags/tags.module';
+import { NotificationsModule } from './notifications/notifications.module';
+import { AtlasModule } from './atlas/atlas.module';
+import { VacayModule } from './vacay/vacay.module';
+import { PackingModule } from './packing/packing.module';
+import { BudgetModule } from './budget/budget.module';
+import { ReservationsModule } from './reservations/reservations.module';
+import { DaysModule } from './days/days.module';
+import { AssignmentsModule } from './assignments/assignments.module';
+import { PlacesModule } from './places/places.module';
+import { TripsModule } from './trips/trips.module';
+import { TodoModule } from './todo/todo.module';
+import { CollabModule } from './collab/collab.module';
+import { FilesModule } from './files/files.module';
+import { PhotosModule } from './photos/photos.module';
+import { MemoriesModule } from './memories/memories.module';
+import { AirtrailModule } from './integrations/airtrail.module';
+import { JourneyModule } from './journey/journey.module';
+import { ShareModule } from './share/share.module';
+import { SettingsModule } from './settings/settings.module';
+import { BackupModule } from './backup/backup.module';
+import { BookingImportModule } from './booking-import/booking-import.module';
+import { AuthModule } from './auth/auth.module';
+import { OidcModule } from './oidc/oidc.module';
+import { OauthModule } from './oauth/oauth.module';
+import { AdminModule } from './admin/admin.module';
+import { AddonsModule } from './addons/addons.module';
+import { TrekExceptionFilter } from './common/trek-exception.filter';
+import { SpaFallbackFilter } from './platform/spa-fallback.filter';
+import { IdempotencyInterceptor } from './common/idempotency.interceptor';
+
+/**
+ * Root NestJS module for the incremental migration. Domain modules
+ * (weather, notifications, integrations, ...) get registered here as they are
+ * migrated.
+ */
+@Module({
+  imports: [DatabaseModule, WeatherModule, AirportsModule, ConfigModule, SystemNoticesModule, MapsModule, CategoriesModule, TagsModule, NotificationsModule, AtlasModule, VacayModule, PackingModule, TodoModule, BudgetModule, ReservationsModule, DaysModule, AssignmentsModule, PlacesModule, TripsModule, CollabModule, FilesModule, PhotosModule, MemoriesModule, AirtrailModule, JourneyModule, ShareModule, SettingsModule, BackupModule, AuthModule, OidcModule, OauthModule, AdminModule, AddonsModule, BookingImportModule],
+  controllers: [HealthController],
+  providers: [
+    HealthService,
+    // Global error-envelope normaliser (DI-registered so it also catches
+    // framework-level exceptions like the not-found handler).
+    { provide: APP_FILTER, useClass: TrekExceptionFilter },
+    // SPA fallback: serves index.html for unmatched GETs in production (the Nest
+    // equivalent of the legacy Express app.get('*') catch-all). @Catch(NotFoundException)
+    // is more specific than TrekExceptionFilter, so Nest routes 404s here.
+    { provide: APP_FILTER, useClass: SpaFallbackFilter },
+    // Replays the X-Idempotency-Key the client sends on every write, matching
+    // the legacy applyIdempotency middleware so retried mutations don't double-apply.
+    { provide: APP_INTERCEPTOR, useClass: IdempotencyInterceptor },
+  ],
+})
+export class AppModule {}

server/src/nest/assignments/assignments.controller.ts

@@ -0,0 +1,189 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  UseGuards,
+} from '@nestjs/common';
+import type { User } from '../../types';
+import { AssignmentsService } from './assignments.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+type Trip = NonNullable<ReturnType<AssignmentsService['verifyTripAccess']>>;
+
+/** Shared trip-access guard (mirrors requireTripAccess → 404 "Trip not found"). */
+function requireTrip(svc: AssignmentsService, tripId: string, user: User): Trip {
+  const trip = svc.verifyTripAccess(tripId, user.id);
+  if (!trip) {
+    throw new HttpException({ error: 'Trip not found' }, 404);
+  }
+  return trip;
+}
+
+function requireEdit(svc: AssignmentsService, trip: Trip, user: User): void {
+  if (!svc.canEdit(trip, user)) {
+    throw new HttpException({ error: 'No permission' }, 403);
+  }
+}
+
+/**
+ * /api/trips/:tripId/days/:dayId/assignments — the day's ordered itinerary items.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/assignments.ts):
+ * trip access (404), 'day_edit' on mutations (403, GET is access-only), create
+ * 201 / rest 200, the bespoke "Day not found" / "Place not found" / "Assignment
+ * not found" bodies, the journey place-created hook, and WebSocket broadcasts.
+ */
+@Controller('api/trips/:tripId/days/:dayId/assignments')
+@UseGuards(JwtAuthGuard)
+export class DayAssignmentsController {
+  constructor(private readonly assignments: AssignmentsService) {}
+
+  @Get()
+  list(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('dayId') dayId: string) {
+    requireTrip(this.assignments, tripId, user);
+    if (!this.assignments.dayExists(dayId, tripId)) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    return { assignments: this.assignments.listDayAssignments(dayId) };
+  }
+
+  @Post()
+  create(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Body() body: { place_id?: unknown; notes?: string | null },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    if (!this.assignments.dayExists(dayId, tripId)) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    if (!this.assignments.placeExists(body.place_id, tripId)) {
+      throw new HttpException({ error: 'Place not found' }, 404);
+    }
+    const assignment = this.assignments.createAssignment(dayId, body.place_id, body.notes);
+    this.assignments.broadcast(tripId, 'assignment:created', { assignment }, socketId);
+    this.assignments.notifyPlaceCreated(tripId, body.place_id);
+    return { assignment };
+  }
+
+  @Put('reorder')
+  reorder(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Body('orderedIds') orderedIds: number[],
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    if (!this.assignments.dayExists(dayId, tripId)) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    this.assignments.reorderAssignments(dayId, orderedIds);
+    this.assignments.broadcast(tripId, 'assignment:reordered', { dayId: Number(dayId), orderedIds }, socketId);
+    return { success: true };
+  }
+
+  @Delete(':id')
+  remove(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Param('id') id: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    if (!this.assignments.assignmentExistsInDay(id, dayId, tripId)) {
+      throw new HttpException({ error: 'Assignment not found' }, 404);
+    }
+    this.assignments.deleteAssignment(id);
+    this.assignments.broadcast(tripId, 'assignment:deleted', { assignmentId: Number(id), dayId: Number(dayId) }, socketId);
+    return { success: true };
+  }
+}
+
+/**
+ * /api/trips/:tripId/assignments/:id/* — per-assignment ops (move, time,
+ * participants), independent of the day path. Same parity rules as above.
+ */
+@Controller('api/trips/:tripId/assignments')
+@UseGuards(JwtAuthGuard)
+export class AssignmentOpsController {
+  constructor(private readonly assignments: AssignmentsService) {}
+
+  @Put(':id/move')
+  move(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body() body: { new_day_id?: unknown; order_index?: number },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    const existing = this.assignments.getAssignmentForTrip(id, tripId);
+    if (!existing) {
+      throw new HttpException({ error: 'Assignment not found' }, 404);
+    }
+    if (!this.assignments.dayExists(String(body.new_day_id), tripId)) {
+      throw new HttpException({ error: 'Target day not found' }, 404);
+    }
+    const oldDayId = (existing as { day_id: number }).day_id;
+    const { assignment } = this.assignments.moveAssignment(id, body.new_day_id, body.order_index, oldDayId);
+    this.assignments.broadcast(tripId, 'assignment:moved', { assignment, oldDayId: Number(oldDayId), newDayId: Number(body.new_day_id) }, socketId);
+    return { assignment };
+  }
+
+  @Get(':id/participants')
+  participants(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string) {
+    requireTrip(this.assignments, tripId, user);
+    return { participants: this.assignments.getParticipants(id) };
+  }
+
+  @Put(':id/time')
+  time(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body() body: { place_time?: string | null; end_time?: string | null },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    if (!this.assignments.getAssignmentForTrip(id, tripId)) {
+      throw new HttpException({ error: 'Assignment not found' }, 404);
+    }
+    const assignment = this.assignments.updateTime(id, body.place_time, body.end_time);
+    this.assignments.broadcast(tripId, 'assignment:updated', { assignment }, socketId);
+    return { assignment };
+  }
+
+  @Put(':id/participants')
+  setParticipants(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body('user_ids') userIds: unknown,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = requireTrip(this.assignments, tripId, user);
+    requireEdit(this.assignments, trip, user);
+    if (!Array.isArray(userIds)) {
+      throw new HttpException({ error: 'user_ids must be an array' }, 400);
+    }
+    const participants = this.assignments.setParticipants(id, userIds);
+    this.assignments.broadcast(tripId, 'assignment:participants', { assignmentId: Number(id), participants }, socketId);
+    return { participants };
+  }
+}

server/src/nest/assignments/assignments.module.ts

@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+import { DayAssignmentsController, AssignmentOpsController } from './assignments.controller';
+import { AssignmentsService } from './assignments.service';
+
+/**
+ * Assignments domain (S7 — Phase 2 trip sub-domain). The day-assignments mount
+ * sits under the /api/trips/:tripId/days prefix (S6); the per-assignment ops use
+ * the /api/trips/:tripId/assignments prefix.
+ */
+@Module({
+  controllers: [DayAssignmentsController, AssignmentOpsController],
+  providers: [AssignmentsService],
+})
+export class AssignmentsModule {}

server/src/nest/assignments/assignments.service.ts

@@ -0,0 +1,83 @@
+import { Injectable } from '@nestjs/common';
+import { broadcast } from '../../websocket';
+import { canAccessTrip } from '../../db/database';
+import { checkPermission } from '../../services/permissions';
+import type { User } from '../../types';
+import * as svc from '../../services/assignmentService';
+import { onPlaceCreated } from '../../services/journeyService';
+
+type Trip = { user_id: number };
+
+/**
+ * Thin Nest wrapper around the existing assignment service. Trip access mirrors
+ * the requireTripAccess middleware (canAccessTrip); mutations use 'day_edit'.
+ * The SQL, the move/reorder logic and the journey "place created" hook reuse the
+ * legacy code unchanged.
+ */
+@Injectable()
+export class AssignmentsService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return canAccessTrip(Number(tripId), userId) as Trip | null | undefined;
+  }
+
+  canEdit(trip: Trip, user: User): boolean {
+    return checkPermission('day_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  dayExists(dayId: string, tripId: string) {
+    return svc.dayExists(dayId, tripId);
+  }
+
+  placeExists(placeId: unknown, tripId: string) {
+    return svc.placeExists(placeId as never, tripId);
+  }
+
+  listDayAssignments(dayId: string) {
+    return svc.listDayAssignments(dayId);
+  }
+
+  createAssignment(dayId: string, placeId: unknown, notes?: string | null) {
+    return svc.createAssignment(dayId, placeId as never, notes as never);
+  }
+
+  /** Mirrors the legacy POST hook; non-fatal, like the route's try/catch. */
+  notifyPlaceCreated(tripId: string, placeId: unknown): void {
+    try { onPlaceCreated(Number(tripId), Number(placeId)); } catch { /* non-fatal */ }
+  }
+
+  assignmentExistsInDay(id: string, dayId: string, tripId: string) {
+    return svc.assignmentExistsInDay(id, dayId, tripId);
+  }
+
+  deleteAssignment(id: string): void {
+    svc.deleteAssignment(id);
+  }
+
+  reorderAssignments(dayId: string, orderedIds: number[]): void {
+    svc.reorderAssignments(dayId, orderedIds as never);
+  }
+
+  getAssignmentForTrip(id: string, tripId: string) {
+    return svc.getAssignmentForTrip(id, tripId);
+  }
+
+  moveAssignment(id: string, newDayId: unknown, orderIndex: number | undefined, oldDayId: unknown) {
+    return svc.moveAssignment(id, newDayId as never, orderIndex as never, oldDayId as never);
+  }
+
+  getParticipants(id: string) {
+    return svc.getParticipants(id);
+  }
+
+  updateTime(id: string, placeTime: unknown, endTime: unknown) {
+    return svc.updateTime(id, placeTime as never, endTime as never);
+  }
+
+  setParticipants(id: string, userIds: number[]) {
+    return svc.setParticipants(id, userIds);
+  }
+}

server/src/nest/atlas/atlas.controller.ts

@@ -0,0 +1,148 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Header,
+  HttpCode,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  Query,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import type { Response } from 'express';
+import type { RegionGeo } from '@trek/shared';
+import type { User } from '../../types';
+import { AtlasService } from './atlas.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+/**
+ * /api/addons/atlas — visited countries/regions, region GeoJSON, bucket list.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/atlas.ts): all
+ * endpoints require auth; country/region codes are upper-cased; /regions is
+ * always no-store while /regions/geo is cached for a day only on a non-empty
+ * result; the mark POSTs answer 200 (not Nest's default 201); and the bespoke
+ * 400/404 bodies are reproduced exactly. No addon gate — the legacy route has
+ * none, so adding one would break clients when the addon is off.
+ */
+@Controller('api/addons/atlas')
+@UseGuards(JwtAuthGuard)
+export class AtlasController {
+  constructor(private readonly atlas: AtlasService) {}
+
+  @Get('stats')
+  stats(@CurrentUser() user: User) {
+    return this.atlas.stats(user.id);
+  }
+
+  @Get('regions')
+  @Header('Cache-Control', 'no-cache, no-store')
+  regions(@CurrentUser() user: User) {
+    return this.atlas.visitedRegions(user.id);
+  }
+
+  @Get('regions/geo')
+  async regionGeo(
+    @Query('countries') countries: string | undefined,
+    @Res({ passthrough: true }) res: Response,
+  ): Promise<RegionGeo> {
+    const list = (countries || '').split(',').filter(Boolean);
+    if (list.length === 0) {
+      return { type: 'FeatureCollection', features: [] };
+    }
+    const geo = await this.atlas.regionGeo(list);
+    // Cache only a non-empty result, matching the legacy route (the empty
+    // short-circuit above sends no Cache-Control header).
+    res.setHeader('Cache-Control', 'public, max-age=86400');
+    return geo;
+  }
+
+  @Get('countries/geo')
+  @Header('Cache-Control', 'public, max-age=86400')
+  countryGeo(): RegionGeo {
+    return this.atlas.countryGeo();
+  }
+
+  @Get('country/:code')
+  countryPlaces(@CurrentUser() user: User, @Param('code') code: string) {
+    return this.atlas.countryPlaces(user.id, code.toUpperCase());
+  }
+
+  @Post('country/:code/mark')
+  @HttpCode(200)
+  markCountry(@CurrentUser() user: User, @Param('code') code: string): { success: boolean } {
+    this.atlas.markCountry(user.id, code.toUpperCase());
+    return { success: true };
+  }
+
+  @Delete('country/:code/mark')
+  unmarkCountry(@CurrentUser() user: User, @Param('code') code: string): { success: boolean } {
+    this.atlas.unmarkCountry(user.id, code.toUpperCase());
+    return { success: true };
+  }
+
+  @Post('region/:code/mark')
+  @HttpCode(200)
+  markRegion(
+    @CurrentUser() user: User,
+    @Param('code') code: string,
+    @Body('name') name?: string,
+    @Body('country_code') countryCode?: string,
+  ): { success: boolean } {
+    if (!name || !countryCode) {
+      throw new HttpException({ error: 'name and country_code are required' }, 400);
+    }
+    this.atlas.markRegion(user.id, code.toUpperCase(), name, countryCode.toUpperCase());
+    return { success: true };
+  }
+
+  @Delete('region/:code/mark')
+  unmarkRegion(@CurrentUser() user: User, @Param('code') code: string): { success: boolean } {
+    this.atlas.unmarkRegion(user.id, code.toUpperCase());
+    return { success: true };
+  }
+
+  @Get('bucket-list')
+  bucketList(@CurrentUser() user: User) {
+    return { items: this.atlas.bucketList(user.id) };
+  }
+
+  @Post('bucket-list')
+  createBucketItem(
+    @CurrentUser() user: User,
+    @Body() body: { name?: string; lat?: number | null; lng?: number | null; country_code?: string | null; notes?: string | null; target_date?: string | null },
+  ): { item: unknown } {
+    if (!body.name?.trim()) {
+      throw new HttpException({ error: 'Name is required' }, 400);
+    }
+    const { name, lat, lng, country_code, notes, target_date } = body;
+    return { item: this.atlas.createBucketItem(user.id, { name, lat, lng, country_code, notes, target_date }) };
+  }
+
+  @Put('bucket-list/:id')
+  updateBucketItem(
+    @CurrentUser() user: User,
+    @Param('id') id: string,
+    @Body() body: { name?: string; notes?: string; lat?: number | null; lng?: number | null; country_code?: string | null; target_date?: string | null },
+  ): { item: unknown } {
+    const { name, notes, lat, lng, country_code, target_date } = body;
+    const item = this.atlas.updateBucketItem(user.id, id, { name, notes, lat, lng, country_code, target_date });
+    if (!item) {
+      throw new HttpException({ error: 'Item not found' }, 404);
+    }
+    return { item };
+  }
+
+  @Delete('bucket-list/:id')
+  deleteBucketItem(@CurrentUser() user: User, @Param('id') id: string): { success: boolean } {
+    if (!this.atlas.deleteBucketItem(user.id, id)) {
+      throw new HttpException({ error: 'Item not found' }, 404);
+    }
+    return { success: true };
+  }
+}

server/src/nest/atlas/atlas.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { AtlasController } from './atlas.controller';
+import { AtlasService } from './atlas.service';
+
+/** Atlas addon domain (L7 leaf module). Registered in AppModule. */
+@Module({
+  controllers: [AtlasController],
+  providers: [AtlasService],
+})
+export class AtlasModule {}

server/src/nest/atlas/atlas.service.ts

@@ -0,0 +1,80 @@
+import { Injectable } from '@nestjs/common';
+import {
+  getStats,
+  getCountryPlaces,
+  markCountryVisited,
+  unmarkCountryVisited,
+  markRegionVisited,
+  unmarkRegionVisited,
+  getVisitedRegions,
+  getRegionGeo,
+  getCountryGeo,
+  listBucketList,
+  createBucketItem,
+  updateBucketItem,
+  deleteBucketItem,
+} from '../../services/atlasService';
+
+type CreateBucketData = Parameters<typeof createBucketItem>[1];
+type UpdateBucketData = Parameters<typeof updateBucketItem>[2];
+
+/**
+ * Thin Nest wrapper around the existing atlas service. The Admin-1 GeoJSON
+ * cache, the stats aggregation and the visited-region logic all stay in
+ * atlasService, so behaviour is unchanged. Returns native service shapes; the
+ * client-facing contracts live in @trek/shared.
+ */
+@Injectable()
+export class AtlasService {
+  stats(userId: number) {
+    return getStats(userId);
+  }
+
+  visitedRegions(userId: number) {
+    return getVisitedRegions(userId);
+  }
+
+  regionGeo(countries: string[]) {
+    return getRegionGeo(countries);
+  }
+
+  countryGeo() {
+    return getCountryGeo();
+  }
+
+  countryPlaces(userId: number, code: string) {
+    return getCountryPlaces(userId, code);
+  }
+
+  markCountry(userId: number, code: string): void {
+    markCountryVisited(userId, code);
+  }
+
+  unmarkCountry(userId: number, code: string): void {
+    unmarkCountryVisited(userId, code);
+  }
+
+  markRegion(userId: number, code: string, name: string, countryCode: string): void {
+    markRegionVisited(userId, code, name, countryCode);
+  }
+
+  unmarkRegion(userId: number, code: string): void {
+    unmarkRegionVisited(userId, code);
+  }
+
+  bucketList(userId: number) {
+    return listBucketList(userId);
+  }
+
+  createBucketItem(userId: number, data: CreateBucketData) {
+    return createBucketItem(userId, data);
+  }
+
+  updateBucketItem(userId: number, itemId: string, data: UpdateBucketData) {
+    return updateBucketItem(userId, itemId, data);
+  }
+
+  deleteBucketItem(userId: number, itemId: string): boolean {
+    return deleteBucketItem(userId, itemId);
+  }
+}

server/src/nest/auth/admin.guard.ts

@@ -0,0 +1,18 @@
+import { CanActivate, ExecutionContext, HttpException, Injectable } from '@nestjs/common';
+import type { Request } from 'express';
+
+/**
+ * Mirrors the legacy `adminOnly` middleware: requires an authenticated admin.
+ * Use together with JwtAuthGuard (which populates req.user):
+ * `@UseGuards(JwtAuthGuard, AdminGuard)`.
+ */
+@Injectable()
+export class AdminGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest<Request>();
+    if (!req.user || req.user.role !== 'admin') {
+      throw new HttpException({ error: 'Admin access required' }, 403);
+    }
+    return true;
+  }
+}

server/src/nest/auth/auth-public.controller.ts

@@ -0,0 +1,159 @@
+import { Body, Controller, Get, HttpCode, HttpException, Param, Post, Req, Res, UseGuards } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { AuthService } from './auth.service';
+import { RateLimitService } from './rate-limit.service';
+import { OptionalJwtGuard } from './optional-jwt.guard';
+import { writeAudit, getClientIp } from '../../services/auditLog';
+import type { User } from '../../types';
+
+const WINDOW = 15 * 60 * 1000;
+const LOGIN_MIN_LATENCY_MS = 350;
+const FORGOT_MIN_LATENCY_MS = 350;
+const GENERIC_FORGOT_RESPONSE = { ok: true };
+
+const delay = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Public auth endpoints (no session required) — byte-identical to the legacy
+ * Express route (server/src/routes/auth.ts): the same per-IP rate-limit buckets
+ * + limits, the constant-time login/forgot latency padding, the enumeration-safe
+ * forgot response, the audit writes and the JWT httpOnly cookie set/clear via
+ * the shared cookie service (no new token shape).
+ */
+@Controller('api/auth')
+export class AuthPublicController {
+  constructor(private readonly auth: AuthService, private readonly rl: RateLimitService) {}
+
+  private limit(bucket: string, req: Request, max: number): void {
+    if (!this.rl.check(bucket, req.ip || 'unknown', max, WINDOW, Date.now())) {
+      throw new HttpException({ error: 'Too many attempts. Please try again later.' }, 429);
+    }
+  }
+
+  @Get('app-config')
+  @UseGuards(OptionalJwtGuard)
+  appConfig(@Req() req: Request) {
+    return this.auth.getAppConfig((req.user as User | undefined) ?? undefined);
+  }
+
+  @Post('demo-login')
+  @HttpCode(200)
+  demoLogin(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    const result = this.auth.demoLogin();
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    this.auth.setAuthCookie(res, result.token!, req);
+    return { token: result.token, user: result.user };
+  }
+
+  @Get('invite/:token')
+  invite(@Param('token') token: string, @Req() req: Request) {
+    this.limit('login', req, 10);
+    const result = this.auth.validateInviteToken(token);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { valid: result.valid, max_uses: result.max_uses, used_count: result.used_count, expires_at: result.expires_at };
+  }
+
+  @Post('register')
+  @HttpCode(201)
+  register(@Body() body: unknown, @Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.limit('login', req, 10);
+    const result = this.auth.registerUser(body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: result.auditUserId!, action: 'user.register', ip: getClientIp(req), details: result.auditDetails });
+    this.auth.setAuthCookie(res, result.token!, req);
+    return { token: result.token, user: result.user };
+  }
+
+  @Post('login')
+  @HttpCode(200)
+  async login(@Body() body: unknown, @Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.limit('login', req, 10);
+    const started = Date.now();
+    const result = this.auth.loginUser(body);
+    if (result.auditAction) {
+      writeAudit({ userId: result.auditUserId ?? null, action: result.auditAction, ip: getClientIp(req), details: result.auditDetails });
+    }
+    const elapsed = Date.now() - started;
+    if (elapsed < LOGIN_MIN_LATENCY_MS) await delay(LOGIN_MIN_LATENCY_MS - elapsed);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    if (result.mfa_required) {
+      return { mfa_required: true, mfa_token: result.mfa_token };
+    }
+    this.auth.setAuthCookie(res, result.token!, req, result.remember);
+    return { token: result.token, user: result.user };
+  }
+
+  @Post('forgot-password')
+  @HttpCode(200)
+  async forgotPassword(@Body() body: { email?: unknown }, @Req() req: Request) {
+    this.limit('forgot', req, 3);
+    const started = Date.now();
+    const rawEmail = typeof body?.email === 'string' ? body.email : '';
+    const ip = getClientIp(req);
+
+    const outcome = this.auth.requestPasswordReset(rawEmail, ip);
+    if (outcome.reason === 'issued' && outcome.tokenForDelivery && outcome.userEmail) {
+      const origin = this.auth.getAppUrl();
+      const url = `${origin.replace(/\/$/, '')}/reset-password?token=${encodeURIComponent(outcome.tokenForDelivery)}`;
+      writeAudit({ userId: outcome.userId, action: 'user.password_reset_request', ip, details: { delivered: 'pending' } });
+      try {
+        const delivery = await this.auth.sendPasswordResetEmail(outcome.userEmail, url, outcome.userId);
+        writeAudit({ userId: outcome.userId, action: 'user.password_reset_request', ip, details: { delivered: delivery.delivered } });
+      } catch {
+        writeAudit({ userId: outcome.userId, action: 'user.password_reset_request', ip, details: { delivered: 'failed' } });
+      }
+    } else {
+      writeAudit({ userId: outcome.userId, action: 'user.password_reset_request', ip, details: { reason: outcome.reason } });
+    }
+    const elapsed = Date.now() - started;
+    if (elapsed < FORGOT_MIN_LATENCY_MS) await delay(FORGOT_MIN_LATENCY_MS - elapsed);
+    return GENERIC_FORGOT_RESPONSE;
+  }
+
+  @Post('reset-password')
+  @HttpCode(200)
+  resetPassword(@Body() body: unknown, @Req() req: Request) {
+    // Per-IP brute-force guard, parity with the legacy resetLimiter (5 / 15 min on
+    // a dedicated bucket) — without it reset tokens could be guessed unthrottled.
+    this.limit('reset', req, 5);
+    const ip = getClientIp(req);
+    const result = this.auth.resetPassword(body);
+    if (result.error) {
+      writeAudit({ userId: null, action: 'user.password_reset_fail', ip, details: { reason: result.error } });
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    if (result.mfa_required) {
+      return { mfa_required: true };
+    }
+    writeAudit({ userId: result.userId ?? null, action: 'user.password_reset_success', ip });
+    return { success: true };
+  }
+
+  @Post('mfa/verify-login')
+  @HttpCode(200)
+  verifyMfaLogin(@Body() body: unknown, @Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.limit('mfa', req, 5);
+    const result = this.auth.verifyMfaLogin(body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: result.auditUserId!, action: 'user.login', ip: getClientIp(req), details: { mfa: true } });
+    this.auth.setAuthCookie(res, result.token!, req, result.remember);
+    return { token: result.token, user: result.user };
+  }
+
+  @Post('logout')
+  @HttpCode(200)
+  logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.auth.clearAuthCookie(res, req);
+    return { success: true };
+  }
+}

server/src/nest/auth/auth.controller.ts

@@ -0,0 +1,271 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  Req,
+  Res,
+  UploadedFile,
+  UseGuards,
+  UseInterceptors,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { diskStorage } from 'multer';
+import type { Request, Response } from 'express';
+import path from 'path';
+import fs from 'fs';
+import { v4 as uuid } from 'uuid';
+import { AuthService } from './auth.service';
+import { RateLimitService } from './rate-limit.service';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { CurrentUser } from './current-user.decorator';
+import { writeAudit, getClientIp } from '../../services/auditLog';
+import { isDemoEmail } from '../../services/demo';
+import type { User } from '../../types';
+
+const WINDOW = 15 * 60 * 1000;
+const avatarDir = path.join(__dirname, '../../../uploads/avatars');
+const ALLOWED_AVATAR_EXTS = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+const AVATAR_UPLOAD = {
+  storage: diskStorage({
+    destination: (_req, _file, cb) => { if (!fs.existsSync(avatarDir)) fs.mkdirSync(avatarDir, { recursive: true }); cb(null, avatarDir); },
+    filename: (_req, file, cb) => cb(null, uuid() + path.extname(file.originalname)),
+  }),
+  limits: { fileSize: 5 * 1024 * 1024 },
+  fileFilter: (_req: unknown, file: Express.Multer.File, cb: (err: Error | null, accept: boolean) => void) => {
+    const ext = path.extname(file.originalname).toLowerCase();
+    if (!file.mimetype.startsWith('image/') || !ALLOWED_AVATAR_EXTS.includes(ext)) {
+      const err: Error & { statusCode?: number } = new Error('Only image files (jpg, png, gif, webp) are allowed');
+      err.statusCode = 400;
+      return cb(err, false);
+    }
+    cb(null, true);
+  },
+};
+
+/**
+ * Authenticated account endpoints — byte-identical to the legacy Express route
+ * (server/src/routes/auth.ts): the same /me/* account ops, avatar upload (with
+ * the demo-mode block), settings, key validation, MFA setup/enable/disable, MCP
+ * tokens and the short-lived ws/resource tokens. The per-IP rate limits reuse
+ * the shared buckets (the inline rateLimiter(5) shares the 'login' bucket, as in
+ * the legacy code). create-token answers 201; everything else 200.
+ */
+@Controller('api/auth')
+@UseGuards(JwtAuthGuard)
+export class AuthController {
+  constructor(private readonly auth: AuthService, private readonly rl: RateLimitService) {}
+
+  private limit(bucket: string, req: Request, max: number): void {
+    if (!this.rl.check(bucket, req.ip || 'unknown', max, WINDOW, Date.now())) {
+      throw new HttpException({ error: 'Too many attempts. Please try again later.' }, 429);
+    }
+  }
+
+  @Get('me')
+  me(@CurrentUser() user: User) {
+    const loaded = this.auth.getCurrentUser(user.id);
+    if (!loaded) {
+      throw new HttpException({ error: 'User not found' }, 404);
+    }
+    return { user: loaded };
+  }
+
+  @Put('me/password')
+  changePassword(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.limit('login', req, 5);
+    const result = this.auth.changePassword(user.id, user.email, body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    // Refresh this device's cookie with the new password_version so the user
+    // stays logged in here while all other sessions are invalidated.
+    if (result.token) this.auth.setAuthCookie(res, result.token, req);
+    writeAudit({ userId: user.id, action: 'user.password_change', ip: getClientIp(req) });
+    return { success: true };
+  }
+
+  @Delete('me')
+  deleteAccount(@CurrentUser() user: User, @Req() req: Request) {
+    const result = this.auth.deleteAccount(user.id, user.email, user.role);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'user.account_delete', ip: getClientIp(req) });
+    return { success: true };
+  }
+
+  @Put('me/maps-key')
+  mapsKey(@CurrentUser() user: User, @Body() body: { maps_api_key?: unknown }) {
+    return this.auth.updateMapsKey(user.id, body.maps_api_key);
+  }
+
+  @Put('me/api-keys')
+  apiKeys(@CurrentUser() user: User, @Body() body: unknown) {
+    return this.auth.updateApiKeys(user.id, body);
+  }
+
+  @Put('me/settings')
+  updateSettings(@CurrentUser() user: User, @Body() body: unknown) {
+    const result = this.auth.updateSettings(user.id, body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { success: result.success, user: result.user };
+  }
+
+  @Get('me/settings')
+  getSettings(@CurrentUser() user: User) {
+    const result = this.auth.getSettings(user.id);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { settings: result.settings };
+  }
+
+  @Post('avatar')
+  @HttpCode(200)
+  @UseInterceptors(FileInterceptor('avatar', AVATAR_UPLOAD))
+  async avatar(@CurrentUser() user: User, @UploadedFile() file: Express.Multer.File | undefined) {
+    if (process.env.DEMO_MODE?.toLowerCase() === 'true' && isDemoEmail(user.email)) {
+      throw new HttpException({ error: 'Uploads are disabled in demo mode. Self-host TREK for full functionality.' }, 403);
+    }
+    if (!file) {
+      throw new HttpException({ error: 'No image uploaded' }, 400);
+    }
+    return this.auth.saveAvatar(user.id, file.filename);
+  }
+
+  @Delete('avatar')
+  async deleteAvatar(@CurrentUser() user: User) {
+    return this.auth.deleteAvatar(user.id);
+  }
+
+  @Get('users')
+  users(@CurrentUser() user: User) {
+    return { users: this.auth.listUsers(user.id) };
+  }
+
+  @Get('validate-keys')
+  async validateKeys(@CurrentUser() user: User) {
+    const result = await this.auth.validateKeys(user.id);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { maps: result.maps, weather: result.weather, maps_details: result.maps_details };
+  }
+
+  @Get('app-settings')
+  getAppSettings(@CurrentUser() user: User) {
+    const result = this.auth.getAppSettings(user.id);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return result.data;
+  }
+
+  @Put('app-settings')
+  updateAppSettings(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    const result = this.auth.updateAppSettings(user.id, body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'settings.app_update', ip: getClientIp(req), details: result.auditSummary, debugDetails: result.auditDebugDetails });
+    return { success: true };
+  }
+
+  @Get('travel-stats')
+  travelStats(@CurrentUser() user: User) {
+    return this.auth.getTravelStats(user.id);
+  }
+
+  @Post('mfa/setup')
+  @HttpCode(200)
+  async mfaSetup(@CurrentUser() user: User) {
+    const result = this.auth.setupMfa(user.id, user.email);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    try {
+      const qr_svg = await result.qrPromise!;
+      return { secret: result.secret, otpauth_url: result.otpauth_url, qr_svg };
+    } catch (err) {
+      console.error('[MFA] QR code generation error:', err);
+      throw new HttpException({ error: 'Could not generate QR code' }, 500);
+    }
+  }
+
+  @Post('mfa/enable')
+  @HttpCode(200)
+  mfaEnable(@CurrentUser() user: User, @Body() body: { code?: unknown }, @Req() req: Request) {
+    this.limit('mfa', req, 5);
+    const result = this.auth.enableMfa(user.id, body.code);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'user.mfa_enable', ip: getClientIp(req) });
+    return { success: true, mfa_enabled: result.mfa_enabled, backup_codes: result.backup_codes };
+  }
+
+  @Post('mfa/disable')
+  @HttpCode(200)
+  mfaDisable(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    this.limit('login', req, 5);
+    const result = this.auth.disableMfa(user.id, user.email, body);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    writeAudit({ userId: user.id, action: 'user.mfa_disable', ip: getClientIp(req) });
+    return { success: true, mfa_enabled: result.mfa_enabled };
+  }
+
+  @Get('mcp-tokens')
+  listMcpTokens(@CurrentUser() user: User) {
+    return { tokens: this.auth.listMcpTokens(user.id) };
+  }
+
+  @Post('mcp-tokens')
+  @HttpCode(201)
+  createMcpToken(@CurrentUser() user: User, @Body() body: { name?: unknown }, @Req() req: Request) {
+    this.limit('login', req, 5);
+    const result = this.auth.createMcpToken(user.id, body.name);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { token: result.token };
+  }
+
+  @Delete('mcp-tokens/:id')
+  deleteMcpToken(@CurrentUser() user: User, @Param('id') id: string) {
+    const result = this.auth.deleteMcpToken(user.id, id);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { success: true };
+  }
+
+  @Post('ws-token')
+  @HttpCode(200)
+  wsToken(@CurrentUser() user: User) {
+    const result = this.auth.createWsToken(user.id);
+    if (result.error) {
+      throw new HttpException({ error: result.error }, result.status!);
+    }
+    return { token: result.token };
+  }
+
+  @Post('resource-token')
+  @HttpCode(200)
+  resourceToken(@CurrentUser() user: User, @Body() body: { purpose?: unknown }) {
+    const token = this.auth.createResourceToken(user.id, body.purpose);
+    if (!token) {
+      throw new HttpException({ error: 'Service unavailable' }, 503);
+    }
+    return token;
+  }
+}

server/src/nest/auth/auth.module.ts

@@ -0,0 +1,18 @@
+import { Module } from '@nestjs/common';
+import { AuthPublicController } from './auth-public.controller';
+import { AuthController } from './auth.controller';
+import { PasskeyController } from './passkey.controller';
+import { AuthService } from './auth.service';
+import { RateLimitService } from './rate-limit.service';
+
+/**
+ * Auth module — public flows (login/register/reset/mfa-verify/logout) and the
+ * authenticated account/MFA/token endpoints. The OIDC sub-mount (/api/auth/oidc)
+ * is a separate, not-yet-migrated route, so the strangler lists the auth
+ * sub-paths explicitly rather than claiming all of /api/auth.
+ */
+@Module({
+  controllers: [AuthPublicController, AuthController, PasskeyController],
+  providers: [AuthService, RateLimitService],
+})
+export class AuthModule {}

server/src/nest/auth/auth.service.ts

@@ -0,0 +1,61 @@
+import { Injectable } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import * as auth from '../../services/authService';
+import { setAuthCookie, clearAuthCookie } from '../../services/cookie';
+import { sendPasswordResetEmail, getAppUrl } from '../../services/notifications';
+import type { User } from '../../types';
+
+/**
+ * Thin Nest wrapper around the existing auth service. Token generation, the
+ * password/MFA/backup-code crypto, the JWT cookie set/clear and the reset-email
+ * delivery all reuse the legacy code unchanged. Access control + audit stay in
+ * the controller (mirroring the legacy route handlers).
+ */
+@Injectable()
+export class AuthService {
+  // Cookie
+  setAuthCookie(res: Response, token: string, req: Request, remember?: boolean) { setAuthCookie(res, token, req, remember); }
+  clearAuthCookie(res: Response, req: Request) { clearAuthCookie(res, req); }
+
+  // Reset-email delivery (canonical app URL, never request headers)
+  getAppUrl() { return getAppUrl(); }
+  sendPasswordResetEmail(email: string, url: string, userId: number | null) { return sendPasswordResetEmail(email, url, userId); }
+
+  // Public config + auth flows
+  getAppConfig(user: User | undefined) { return auth.getAppConfig(user); }
+  demoLogin() { return auth.demoLogin(); }
+  validateInviteToken(token: string) { return auth.validateInviteToken(token); }
+  registerUser(body: unknown) { return auth.registerUser(body as Parameters<typeof auth.registerUser>[0]); }
+  loginUser(body: unknown) { return auth.loginUser(body as Parameters<typeof auth.loginUser>[0]); }
+  requestPasswordReset(email: string, ip: string) { return auth.requestPasswordReset(email, ip); }
+  resetPassword(body: unknown) { return auth.resetPassword(body as Parameters<typeof auth.resetPassword>[0]); }
+  verifyMfaLogin(body: unknown) { return auth.verifyMfaLogin(body as Parameters<typeof auth.verifyMfaLogin>[0]); }
+
+  // Account
+  getCurrentUser(userId: number) { return auth.getCurrentUser(userId); }
+  changePassword(userId: number, email: string, body: unknown) { return auth.changePassword(userId, email, body as Parameters<typeof auth.changePassword>[2]); }
+  deleteAccount(userId: number, email: string, role: string) { return auth.deleteAccount(userId, email, role); }
+  updateMapsKey(userId: number, key: unknown) { return auth.updateMapsKey(userId, key as string); }
+  updateApiKeys(userId: number, body: unknown) { return auth.updateApiKeys(userId, body as Parameters<typeof auth.updateApiKeys>[1]); }
+  updateSettings(userId: number, body: unknown) { return auth.updateSettings(userId, body as Parameters<typeof auth.updateSettings>[1]); }
+  getSettings(userId: number) { return auth.getSettings(userId); }
+  saveAvatar(userId: number, filename: string) { return auth.saveAvatar(userId, filename); }
+  deleteAvatar(userId: number) { return auth.deleteAvatar(userId); }
+  listUsers(userId: number) { return auth.listUsers(userId); }
+  validateKeys(userId: number) { return auth.validateKeys(userId); }
+  getAppSettings(userId: number) { return auth.getAppSettings(userId); }
+  updateAppSettings(userId: number, body: unknown) { return auth.updateAppSettings(userId, body as Parameters<typeof auth.updateAppSettings>[1]); }
+  getTravelStats(userId: number) { return auth.getTravelStats(userId); }
+
+  // MFA
+  setupMfa(userId: number, email: string) { return auth.setupMfa(userId, email); }
+  enableMfa(userId: number, code: unknown) { return auth.enableMfa(userId, code as string); }
+  disableMfa(userId: number, email: string, body: unknown) { return auth.disableMfa(userId, email, body as Parameters<typeof auth.disableMfa>[2]); }
+
+  // MCP tokens + short-lived tokens
+  listMcpTokens(userId: number) { return auth.listMcpTokens(userId); }
+  createMcpToken(userId: number, name: unknown) { return auth.createMcpToken(userId, name as string); }
+  deleteMcpToken(userId: number, id: string) { return auth.deleteMcpToken(userId, id); }
+  createWsToken(userId: number) { return auth.createWsToken(userId); }
+  createResourceToken(userId: number, purpose: unknown) { return auth.createResourceToken(userId, purpose as string); }
+}

server/src/nest/auth/cookie-auth.guard.ts

@@ -0,0 +1,26 @@
+import { CanActivate, ExecutionContext, HttpException, Injectable } from '@nestjs/common';
+import type { Request } from 'express';
+import { verifyJwtAndLoadUser } from '../../middleware/auth';
+
+/**
+ * Mirrors the legacy `requireCookieAuth` middleware: accepts ONLY the httpOnly
+ * trek_session cookie (never a Bearer token), so CSRF-sensitive state-changing
+ * OAuth endpoints (consent submit, client/session mutations) can't be driven by
+ * a leaked Bearer. Error bodies + codes match the legacy 401 shapes exactly.
+ */
+@Injectable()
+export class CookieAuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest<Request & { cookies?: Record<string, string> }>();
+    const cookieToken = req.cookies?.trek_session;
+    if (!cookieToken) {
+      throw new HttpException({ error: 'Cookie session required for this endpoint', code: 'COOKIE_AUTH_REQUIRED' }, 401);
+    }
+    const user = verifyJwtAndLoadUser(cookieToken);
+    if (!user) {
+      throw new HttpException({ error: 'Invalid or expired session', code: 'AUTH_REQUIRED' }, 401);
+    }
+    req.user = user;
+    return true;
+  }
+}

server/src/nest/auth/current-user.decorator.ts

@@ -0,0 +1,12 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+import type { User } from '../../types';
+
+/**
+ * Resolves the authenticated user attached by JwtAuthGuard.
+ * Use on guarded handlers: `getThing(@CurrentUser() user: User) { ... }`.
+ */
+export const CurrentUser = createParamDecorator(
+  (_data: unknown, context: ExecutionContext): User | undefined => {
+    return context.switchToHttp().getRequest().user;
+  },
+);

server/src/nest/auth/jwt-auth.guard.ts

@@ -0,0 +1,28 @@
+import { CanActivate, ExecutionContext, HttpException, Injectable } from '@nestjs/common';
+import type { Request } from 'express';
+import { extractToken, verifyJwtAndLoadUser } from '../../middleware/auth';
+
+/**
+ * Validates TREK's existing JWT session — the same httpOnly `trek_session`
+ * cookie (or `Authorization: Bearer`) the legacy app uses. Reuses the canonical
+ * `verifyJwtAndLoadUser` so the secret, the password_version invalidation gate
+ * and the loaded user are IDENTICAL to the Express middleware. No new tokens.
+ *
+ * Error bodies match the legacy 401 shape exactly so the client is unaffected.
+ */
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest<Request>();
+    const token = extractToken(req);
+    if (!token) {
+      throw new HttpException({ error: 'Access token required', code: 'AUTH_REQUIRED' }, 401);
+    }
+    const user = verifyJwtAndLoadUser(token);
+    if (!user) {
+      throw new HttpException({ error: 'Invalid or expired token', code: 'AUTH_REQUIRED' }, 401);
+    }
+    req.user = user;
+    return true;
+  }
+}

server/src/nest/auth/optional-jwt.guard.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import type { Request } from 'express';
+import { extractToken, verifyJwtAndLoadUser } from '../../middleware/auth';
+
+/**
+ * Mirrors the legacy `optionalAuth` middleware: populates req.user with the
+ * loaded user when a valid token is present, otherwise leaves it null — and
+ * always allows the request through (never 401). Used for endpoints whose
+ * response varies by auth state but don't require it (e.g. /app-config).
+ */
+@Injectable()
+export class OptionalJwtGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest<Request>();
+    const token = extractToken(req);
+    (req as { user: unknown }).user = (token ? verifyJwtAndLoadUser(token) : null) || null;
+    return true;
+  }
+}

server/src/nest/auth/passkey-enabled.guard.ts

@@ -0,0 +1,22 @@
+import { CanActivate, HttpException, Injectable } from '@nestjs/common';
+import { resolveAuthToggles } from '../../services/authService';
+
+/**
+ * Server-side enforcement of the instance-wide `passkey_login` toggle. Placed
+ * BEFORE the auth guard on every passkey ceremony route so a disabled feature
+ * returns 404 (not "auth required") and cannot be driven by direct API calls —
+ * hiding the button in the UI is not enough. Mirrors JourneyAddonGuard.
+ *
+ * The credential-management routes (list/rename/delete) are deliberately NOT
+ * gated by this guard so users can still clean up their passkeys after an admin
+ * turns the feature off.
+ */
+@Injectable()
+export class PasskeyEnabledGuard implements CanActivate {
+  canActivate(): boolean {
+    if (!resolveAuthToggles().passkey_login) {
+      throw new HttpException({ error: 'Passkey login is not enabled' }, 404);
+    }
+    return true;
+  }
+}

server/src/nest/auth/passkey.controller.ts

@@ -0,0 +1,114 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpException, Param, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { RateLimitService } from './rate-limit.service';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { PasskeyEnabledGuard } from './passkey-enabled.guard';
+import { CurrentUser } from './current-user.decorator';
+import { setAuthCookie } from '../../services/cookie';
+import { writeAudit, getClientIp } from '../../services/auditLog';
+import * as passkey from '../../services/passkeyService';
+import type { User } from '../../types';
+
+const WINDOW = 15 * 60 * 1000;
+const LOGIN_MIN_LATENCY_MS = 350;
+const delay = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * /api/auth/passkey — WebAuthn (passkey) registration, primary login and
+ * credential management.
+ *
+ * - register/*  : authenticated, gated by the admin toggle + password re-auth.
+ * - login/*     : UNauthenticated discoverable-credential login, gated by the
+ *                 admin toggle; mints the SAME session cookie as password login.
+ * - credentials : owner-scoped management — intentionally NOT toggle-gated so a
+ *                 user can always view/remove their passkeys.
+ *
+ * PasskeyEnabledGuard is listed first so a disabled feature 404s before auth.
+ */
+@Controller('api/auth/passkey')
+export class PasskeyController {
+  constructor(private readonly rl: RateLimitService) {}
+
+  private limit(bucket: string, req: Request, max: number): void {
+    if (!this.rl.check(bucket, req.ip || 'unknown', max, WINDOW, Date.now())) {
+      throw new HttpException({ error: 'Too many attempts. Please try again later.' }, 429);
+    }
+  }
+
+  // ── Registration (authenticated) ──
+  @Post('register/options')
+  @HttpCode(200)
+  @UseGuards(PasskeyEnabledGuard, JwtAuthGuard)
+  async registerOptions(@CurrentUser() user: User, @Body() body: { password?: string }, @Req() req: Request) {
+    this.limit('mfa', req, 5);
+    const result = await passkey.passkeyRegisterOptions(user.id, body?.password);
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    return result.options;
+  }
+
+  @Post('register/verify')
+  @HttpCode(200)
+  @UseGuards(PasskeyEnabledGuard, JwtAuthGuard)
+  async registerVerify(@CurrentUser() user: User, @Body() body: unknown, @Req() req: Request) {
+    const result = await passkey.passkeyRegisterVerify(user.id, body as Parameters<typeof passkey.passkeyRegisterVerify>[1]);
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    writeAudit({ userId: user.id, action: 'user.passkey_register', ip: getClientIp(req) });
+    return { success: true, credential: result.credential };
+  }
+
+  // ── Authentication (public — primary login) ──
+  @Post('login/options')
+  @HttpCode(200)
+  @UseGuards(PasskeyEnabledGuard)
+  async loginOptions(@Req() req: Request) {
+    this.limit('login', req, 10);
+    const result = await passkey.passkeyLoginOptions();
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    return result.options;
+  }
+
+  @Post('login/verify')
+  @HttpCode(200)
+  @UseGuards(PasskeyEnabledGuard)
+  async loginVerify(@Body() body: unknown, @Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    this.limit('login', req, 10);
+    const started = Date.now();
+    const result = await passkey.passkeyLoginVerify(body as Parameters<typeof passkey.passkeyLoginVerify>[0]);
+    if (result.auditAction) {
+      writeAudit({ userId: result.auditUserId ?? null, action: result.auditAction, ip: getClientIp(req) });
+    }
+    // Pad to the same floor as password login so timing can't distinguish a
+    // known credential from an unknown one.
+    const elapsed = Date.now() - started;
+    if (elapsed < LOGIN_MIN_LATENCY_MS) await delay(LOGIN_MIN_LATENCY_MS - elapsed);
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    writeAudit({ userId: result.auditUserId!, action: 'user.login', ip: getClientIp(req), details: { method: 'passkey' } });
+    setAuthCookie(res, result.token!, req);
+    return { token: result.token, user: result.user };
+  }
+
+  // ── Management (authenticated, owner-scoped — NOT toggle-gated) ──
+  @Get('credentials')
+  @UseGuards(JwtAuthGuard)
+  list(@CurrentUser() user: User) {
+    return { credentials: passkey.listPasskeys(user.id) };
+  }
+
+  @Patch('credentials/:id')
+  @UseGuards(JwtAuthGuard)
+  rename(@CurrentUser() user: User, @Param('id') id: string, @Body() body: { name?: unknown }) {
+    const result = passkey.renamePasskey(user.id, id, body?.name);
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    return { success: true };
+  }
+
+  @Delete('credentials/:id')
+  @UseGuards(JwtAuthGuard)
+  remove(@CurrentUser() user: User, @Param('id') id: string, @Body() body: { password?: string }, @Req() req: Request) {
+    this.limit('login', req, 5);
+    const result = passkey.deletePasskey(user.id, id, body?.password);
+    if (result.error) throw new HttpException({ error: result.error }, result.status!);
+    writeAudit({ userId: user.id, action: 'user.passkey_delete', resource: String(id), ip: getClientIp(req) });
+    return { success: true };
+  }
+}

server/src/nest/auth/rate-limit.service.ts

@@ -0,0 +1,45 @@
+import { Injectable } from '@nestjs/common';
+
+interface Attempt { count: number; first: number }
+
+/**
+ * In-memory per-IP rate limiter, ported 1:1 from the legacy auth route's
+ * `rateLimiter`. Each named bucket keeps its own attempt map; `check` returns
+ * false once a key exceeds `max` within `windowMs` (the caller answers 429).
+ *
+ * The legacy route also ran a setInterval to garbage-collect expired records;
+ * that was pure memory housekeeping (the window check below already treats an
+ * expired record as fresh), so it is intentionally omitted — the limit
+ * behaviour is identical and there's no dangling timer to leak in tests.
+ */
+@Injectable()
+export class RateLimitService {
+  private readonly buckets = new Map<string, Map<string, Attempt>>();
+
+  private store(bucket: string): Map<string, Attempt> {
+    let s = this.buckets.get(bucket);
+    if (!s) { s = new Map(); this.buckets.set(bucket, s); }
+    return s;
+  }
+
+  /** Returns true when the request is allowed, false when it should be rejected (429). */
+  check(bucket: string, key: string, max: number, windowMs: number, now: number): boolean {
+    const store = this.store(bucket);
+    const record = store.get(key);
+    if (record && record.count >= max && now - record.first < windowMs) {
+      return false;
+    }
+    if (!record || now - record.first >= windowMs) {
+      store.set(key, { count: 1, first: now });
+    } else {
+      record.count++;
+    }
+    return true;
+  }
+
+  /** Test helper: clear a bucket (mirrors the legacy exported maps used for resets). */
+  reset(bucket?: string): void {
+    if (bucket) this.buckets.get(bucket)?.clear();
+    else this.buckets.clear();
+  }
+}

server/src/nest/backup/backup.controller.ts

@@ -0,0 +1,167 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  Req,
+  Res,
+  UploadedFile,
+  UseGuards,
+  UseInterceptors,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import type { Request, Response } from 'express';
+import fs from 'fs';
+import type { User } from '../../types';
+import { BackupService } from './backup.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { AdminGuard } from '../auth/admin.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { writeAudit, getClientIp } from '../../services/auditLog';
+import { getUploadTmpDir, MAX_BACKUP_UPLOAD_SIZE } from '../../services/backupService';
+
+const UPLOAD = {
+  dest: getUploadTmpDir(),
+  fileFilter: (_req: unknown, file: Express.Multer.File, cb: (err: Error | null, accept: boolean) => void) => {
+    if (file.originalname.endsWith('.zip')) return cb(null, true);
+    cb(new Error('Only ZIP files allowed'), false);
+  },
+  limits: { fileSize: MAX_BACKUP_UPLOAD_SIZE },
+};
+
+/**
+ * /api/backup — admin-only database backup management (list, create, download,
+ * restore from a stored or uploaded zip, auto-backup settings, delete).
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/backup.ts):
+ * admin-gated, the create rate-limit (429), the filename validation (400/404),
+ * the audit-log writes, res.download for downloads and the tmp-file cleanup for
+ * uploads. All JSON responses answer 200.
+ */
+@Controller('api/backup')
+@UseGuards(JwtAuthGuard, AdminGuard)
+export class BackupController {
+  constructor(private readonly backup: BackupService) {}
+
+  @Get('list')
+  list() {
+    try {
+      return { backups: this.backup.listBackups() };
+    } catch {
+      throw new HttpException({ error: 'Error loading backups' }, 500);
+    }
+  }
+
+  @Post('create')
+  @HttpCode(200) // Express answers create with res.json (200), not the POST-default 201.
+  async create(@CurrentUser() user: User, @Req() req: Request) {
+    if (!this.backup.checkRateLimit(req.ip || 'unknown', 3, this.backup.rateWindow)) {
+      throw new HttpException({ error: 'Too many backup requests. Please try again later.' }, 429);
+    }
+    try {
+      const backup = await this.backup.createBackup();
+      writeAudit({ userId: user.id, action: 'backup.create', resource: backup.filename, ip: getClientIp(req), details: { size: backup.size } });
+      return { success: true, backup };
+    } catch {
+      throw new HttpException({ error: 'Error creating backup' }, 500);
+    }
+  }
+
+  @Get('download/:filename')
+  download(@Param('filename') filename: string, @Res() res: Response): void {
+    if (!this.backup.isValidBackupFilename(filename)) {
+      throw new HttpException({ error: 'Invalid filename' }, 400);
+    }
+    if (!this.backup.backupFileExists(filename)) {
+      throw new HttpException({ error: 'Backup not found' }, 404);
+    }
+    res.download(this.backup.backupFilePath(filename), filename);
+  }
+
+  @Post('restore/:filename')
+  @HttpCode(200) // Express answers restore with res.json (200).
+  async restore(@CurrentUser() user: User, @Param('filename') filename: string, @Req() req: Request) {
+    if (!this.backup.isValidBackupFilename(filename)) {
+      throw new HttpException({ error: 'Invalid filename' }, 400);
+    }
+    if (!this.backup.backupFileExists(filename)) {
+      throw new HttpException({ error: 'Backup not found' }, 404);
+    }
+    try {
+      const result = await this.backup.restoreFromZip(this.backup.backupFilePath(filename));
+      if (!result.success) {
+        throw new HttpException({ error: result.error }, result.status || 400);
+      }
+      writeAudit({ userId: user.id, action: 'backup.restore', resource: filename, ip: getClientIp(req) });
+      return { success: true };
+    } catch (err) {
+      if (err instanceof HttpException) throw err;
+      throw new HttpException({ error: 'Error restoring backup' }, 500);
+    }
+  }
+
+  @Post('upload-restore')
+  @HttpCode(200) // Express answers upload-restore with res.json (200).
+  @UseInterceptors(FileInterceptor('backup', UPLOAD))
+  async uploadRestore(@CurrentUser() user: User, @UploadedFile() file: Express.Multer.File | undefined, @Req() req: Request) {
+    if (!file) {
+      throw new HttpException({ error: 'No file uploaded' }, 400);
+    }
+    const zipPath = file.path;
+    const origName = file.originalname || 'upload.zip';
+    try {
+      const result = await this.backup.restoreFromZip(zipPath);
+      if (!result.success) {
+        throw new HttpException({ error: result.error }, result.status || 400);
+      }
+      writeAudit({ userId: user.id, action: 'backup.upload_restore', resource: origName, ip: getClientIp(req) });
+      return { success: true };
+    } catch (err) {
+      if (err instanceof HttpException) throw err;
+      throw new HttpException({ error: 'Error restoring backup' }, 500);
+    } finally {
+      if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+    }
+  }
+
+  @Get('auto-settings')
+  autoSettings() {
+    try {
+      return this.backup.getAutoSettings();
+    } catch (err) {
+      console.error('[backup] GET auto-settings:', err);
+      throw new HttpException({ error: 'Could not load backup settings' }, 500);
+    }
+  }
+
+  @Put('auto-settings')
+  updateAutoSettings(@CurrentUser() user: User, @Body() body: Record<string, unknown>, @Req() req: Request) {
+    try {
+      const settings = this.backup.updateAutoSettings(body || {});
+      writeAudit({ userId: user.id, action: 'backup.auto_settings', ip: getClientIp(req), details: { enabled: settings.enabled, interval: settings.interval, keep_days: settings.keep_days } });
+      return { settings };
+    } catch (err) {
+      console.error('[backup] PUT auto-settings:', err);
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new HttpException({ error: 'Could not save auto-backup settings', detail: process.env.NODE_ENV?.toLowerCase() !== 'production' ? msg : undefined }, 500);
+    }
+  }
+
+  @Delete(':filename')
+  remove(@CurrentUser() user: User, @Param('filename') filename: string, @Req() req: Request) {
+    if (!this.backup.isValidBackupFilename(filename)) {
+      throw new HttpException({ error: 'Invalid filename' }, 400);
+    }
+    if (!this.backup.backupFileExists(filename)) {
+      throw new HttpException({ error: 'Backup not found' }, 404);
+    }
+    this.backup.deleteBackup(filename);
+    writeAudit({ userId: user.id, action: 'backup.delete', resource: filename, ip: getClientIp(req) });
+    return { success: true };
+  }
+}

server/src/nest/backup/backup.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { BackupController } from './backup.controller';
+import { BackupService } from './backup.service';
+
+@Module({
+  controllers: [BackupController],
+  providers: [BackupService],
+})
+export class BackupModule {}

server/src/nest/backup/backup.service.ts

@@ -0,0 +1,24 @@
+import { Injectable } from '@nestjs/common';
+import * as svc from '../../services/backupService';
+
+/**
+ * Thin Nest wrapper around the existing backup service. The zip packing/restore,
+ * the auto-backup scheduler settings, the filename validation, the rate-limit
+ * bookkeeping and the tmp-dir all reuse the legacy code unchanged.
+ */
+@Injectable()
+export class BackupService {
+  listBackups() { return svc.listBackups(); }
+  createBackup() { return svc.createBackup(); }
+  restoreFromZip(zipPath: string) { return svc.restoreFromZip(zipPath); }
+  getAutoSettings() { return svc.getAutoSettings(); }
+  updateAutoSettings(body: Record<string, unknown>) { return svc.updateAutoSettings(body); }
+  deleteBackup(filename: string) { return svc.deleteBackup(filename); }
+
+  isValidBackupFilename(filename: string) { return svc.isValidBackupFilename(filename); }
+  backupFilePath(filename: string) { return svc.backupFilePath(filename); }
+  backupFileExists(filename: string) { return svc.backupFileExists(filename); }
+  checkRateLimit(key: string, maxAttempts: number, windowMs: number) { return svc.checkRateLimit(key, maxAttempts, windowMs); }
+
+  get rateWindow() { return svc.BACKUP_RATE_WINDOW; }
+}

server/src/nest/booking-import/booking-import.controller.ts

@@ -0,0 +1,102 @@
+import {
+  Controller,
+  Post,
+  Body,
+  Param,
+  Headers,
+  HttpException,
+  UseGuards,
+  UseInterceptors,
+  UploadedFiles,
+} from '@nestjs/common';
+import { FilesInterceptor } from '@nestjs/platform-express';
+import { memoryStorage } from 'multer';
+import type { User } from '../../types';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { BookingImportService } from './booking-import.service';
+import type { BookingImportPreviewItem, BookingImportPreviewResponse, BookingImportConfirmResponse } from '@trek/shared';
+
+const ACCEPTED_EXTS = new Set(['.eml', '.pdf', '.pkpass', '.html', '.htm', '.txt']);
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_FILES = 5;
+
+const UPLOAD = {
+  storage: memoryStorage(),
+  limits: { fileSize: MAX_FILE_BYTES, files: MAX_FILES },
+};
+
+@Controller('api/trips/:tripId/reservations/import')
+@UseGuards(JwtAuthGuard)
+export class BookingImportController {
+  constructor(private readonly bookingImport: BookingImportService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.bookingImport.verifyTripAccess(tripId, user.id);
+    if (!trip) throw new HttpException({ error: 'Trip not found' }, 404);
+    return trip;
+  }
+
+  private requireEdit(trip: ReturnType<BookingImportService['verifyTripAccess']>, user: User): void {
+    if (!this.bookingImport.canEdit(trip!, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+  }
+
+  /**
+   * POST /api/trips/:tripId/reservations/import/booking
+   * Accepts up to 5 booking confirmation files (EML, PDF, PKPass, HTML, TXT).
+   * Returns a preview list without persisting anything.
+   */
+  @Post('booking')
+  @UseInterceptors(FilesInterceptor('files', MAX_FILES, UPLOAD))
+  async preview(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @UploadedFiles() files: Express.Multer.File[] | undefined,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+
+    if (!this.bookingImport.isAvailable()) {
+      throw new HttpException({ error: 'KItinerary extractor is not available on this server' }, 503);
+    }
+
+    if (!files || files.length === 0) {
+      throw new HttpException({ error: 'No files uploaded' }, 400);
+    }
+
+    // Validate extensions
+    for (const f of files) {
+      const ext = f.originalname.toLowerCase().slice(f.originalname.lastIndexOf('.'));
+      if (!ACCEPTED_EXTS.has(ext)) {
+        throw new HttpException({ error: `Unsupported file type: ${f.originalname}. Accepted: EML, PDF, PKPass, HTML, TXT` }, 400);
+      }
+    }
+
+    const result: BookingImportPreviewResponse = await this.bookingImport.preview(files);
+    return result;
+  }
+
+  /**
+   * POST /api/trips/:tripId/reservations/import/booking/confirm
+   * Persists the user-confirmed subset of parsed items.
+   */
+  @Post('booking/confirm')
+  async confirm(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { items?: BookingImportPreviewItem[] },
+    @Headers('x-socket-id') socketId?: string,
+  ): Promise<BookingImportConfirmResponse> {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+
+    const items = body?.items;
+    if (!Array.isArray(items) || items.length === 0) {
+      throw new HttpException({ error: 'items must be a non-empty array' }, 400);
+    }
+
+    return this.bookingImport.confirm(tripId, items, socketId);
+  }
+}

server/src/nest/booking-import/booking-import.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { BookingImportController } from './booking-import.controller';
+import { BookingImportService } from './booking-import.service';
+import { KitineraryExtractorService } from './kitinerary-extractor.service';
+import { FeaturesController } from './features.controller';
+
+@Module({
+  controllers: [BookingImportController, FeaturesController],
+  providers: [BookingImportService, KitineraryExtractorService],
+})
+export class BookingImportModule {}

server/src/nest/booking-import/booking-import.service.ts

@@ -0,0 +1,165 @@
+import { Injectable, HttpException } from '@nestjs/common';
+import { broadcast } from '../../websocket';
+import { checkPermission } from '../../services/permissions';
+import { verifyTripAccess } from '../../services/tripAccess';
+import { createReservation } from '../../services/reservationService';
+import { createPlace } from '../../services/placeService';
+import { searchNominatim } from '../../services/mapsService';
+import { db } from '../../db/database';
+import type { User } from '../../types';
+import { KitineraryExtractorService } from './kitinerary-extractor.service';
+import { mapReservations } from './kitinerary-mapper';
+import type { BookingImportPreviewItem, BookingImportPreviewResponse, BookingImportConfirmResponse, Reservation } from '@trek/shared';
+import type { ParsedBookingItem } from './kitinerary.types';
+
+function resolveDayId(tripId: string, iso: string | null | undefined): number | null {
+  if (!iso) return null;
+  const date = iso.slice(0, 10);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return null;
+  const row = db.prepare('SELECT id FROM days WHERE trip_id = ? AND date = ? LIMIT 1').get(tripId, date) as { id: number } | undefined;
+  return row?.id ?? null;
+}
+
+@Injectable()
+export class BookingImportService {
+  constructor(private readonly extractor: KitineraryExtractorService) {}
+
+  isAvailable(): boolean {
+    return this.extractor.isAvailable();
+  }
+
+  verifyTripAccess(tripId: string, userId: number) {
+    return verifyTripAccess(tripId, userId);
+  }
+
+  canEdit(trip: NonNullable<ReturnType<typeof verifyTripAccess>>, user: User): boolean {
+    return checkPermission('reservation_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  /**
+   * Parse uploaded files through kitinerary-extractor and return a preview list.
+   * Does NOT persist anything.
+   */
+  async preview(files: Express.Multer.File[]): Promise<BookingImportPreviewResponse> {
+    if (!this.extractor.isAvailable()) {
+      throw new HttpException({ error: 'KItinerary extractor is not available on this server' }, 503);
+    }
+
+    const allItems: ParsedBookingItem[] = [];
+    const allWarnings: string[] = [];
+
+    for (const file of files) {
+      let kiItems;
+      try {
+        kiItems = await this.extractor.extract(file.buffer, file.originalname);
+      } catch (err) {
+        allWarnings.push(`${file.originalname}: extraction failed — ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+
+      if (kiItems.length === 0) {
+        allWarnings.push(`${file.originalname}: no reservations found`);
+        continue;
+      }
+
+      const { items, warnings } = mapReservations(kiItems, file.originalname);
+      allItems.push(...items);
+      allWarnings.push(...warnings);
+    }
+
+    return { items: allItems, warnings: allWarnings };
+  }
+
+  /**
+   * Persist a confirmed list of parsed items.
+   * Creates place rows for hotel/restaurant/event venues, then calls createReservation.
+   * Broadcasts reservation:created (and accommodation:created if applicable) per item.
+   */
+  async confirm(
+    tripId: string,
+    items: BookingImportPreviewItem[],
+    socketId: string | undefined,
+  ): Promise<BookingImportConfirmResponse> {
+    const created: Reservation[] = [];
+
+    for (const item of items) {
+      try {
+        const { _venue, _accommodation, source: _src, ...reservationData } = item;
+
+        // Auto-create a place row for venue-based reservations
+        let placeId: number | undefined;
+        if (_venue?.name) {
+          // Geocode before creating so the broadcast carries the coordinates
+          let lat = _venue.lat;
+          let lng = _venue.lng;
+          if (lat == null && (_venue.address || _venue.name)) {
+            try {
+              const queries = [
+                _venue.address ? `${_venue.name} ${_venue.address}` : null,
+                _venue.address ?? null,
+                _venue.name,
+              ].filter((q): q is string => !!q);
+
+              for (const q of queries) {
+                const results = await searchNominatim(q);
+                const hit = results[0];
+                if (hit?.lat != null && hit?.lng != null) {
+                  lat = hit.lat;
+                  lng = hit.lng;
+                  break;
+                }
+              }
+            } catch {
+              // geocoding failure is non-fatal
+            }
+          }
+
+          const place = createPlace(tripId, {
+            name: _venue.name,
+            lat,
+            lng,
+            address: _venue.address,
+            website: _venue.website,
+            phone: _venue.phone,
+          });
+          placeId = (place as any).id;
+          broadcast(tripId, 'place:created', { place }, socketId);
+        }
+
+        // Build create_accommodation for hotel reservations.
+        // start_day_id / end_day_id are resolved from check-in/out ISO dates so
+        // the accommodation row is actually inserted (createReservation gates on them).
+        let createAccommodation: { place_id?: number; start_day_id?: number; end_day_id?: number; check_in?: string; check_out?: string; confirmation?: string } | undefined;
+        if (item.type === 'hotel' && _accommodation) {
+          const startDayId = resolveDayId(tripId, _accommodation.check_in);
+          const endDayId   = resolveDayId(tripId, _accommodation.check_out);
+          createAccommodation = {
+            place_id: placeId,
+            start_day_id: startDayId ?? undefined,
+            end_day_id:   endDayId   ?? undefined,
+            check_in:     _accommodation.check_in,
+            check_out:    _accommodation.check_out,
+            confirmation: _accommodation.confirmation,
+          };
+        }
+
+        const { reservation, accommodationCreated } = createReservation(tripId, {
+          ...reservationData,
+          place_id: placeId,
+          create_accommodation: createAccommodation,
+        } as any);
+
+        broadcast(tripId, 'reservation:created', { reservation }, socketId);
+        if (accommodationCreated) {
+          broadcast(tripId, 'accommodation:created', {}, socketId);
+        }
+
+        created.push(reservation);
+      } catch (err) {
+        console.error(`[booking-import] Failed to create reservation "${item.title}":`, err instanceof Error ? err.message : err);
+      }
+    }
+
+    return { created };
+  }
+}

server/src/nest/booking-import/features.controller.ts

@@ -0,0 +1,15 @@
+import { Controller, Get } from '@nestjs/common';
+import { KitineraryExtractorService } from './kitinerary-extractor.service';
+
+/** Exposes server feature flags consumed by the frontend to show/hide optional UI. */
+@Controller('api/health')
+export class FeaturesController {
+  constructor(private readonly extractor: KitineraryExtractorService) {}
+
+  @Get('features')
+  features() {
+    return {
+      bookingImport: this.extractor.isAvailable(),
+    };
+  }
+}

server/src/nest/booking-import/kitinerary-extractor.service.ts

@@ -0,0 +1,104 @@
+import { Injectable, OnModuleInit } from '@nestjs/common';
+import { execFile } from 'node:child_process';
+import { existsSync, readdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, extname } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { execSync } from 'node:child_process';
+import { promisify } from 'node:util';
+import type { KiReservation } from './kitinerary.types';
+
+const execFileAsync = promisify(execFile);
+const TIMEOUT_MS = 30_000;
+const MAX_BUFFER = 5 * 1024 * 1024;
+
+@Injectable()
+export class KitineraryExtractorService implements OnModuleInit {
+  private binaryPath: string | null = null;
+
+  onModuleInit() {
+    this.binaryPath = this.findBinary();
+    if (this.binaryPath) {
+      console.log(`[KItinerary] extractor found at: ${this.binaryPath}`);
+    } else {
+      console.info('[KItinerary] extractor not found — booking import feature disabled');
+    }
+  }
+
+  isAvailable(): boolean {
+    return this.binaryPath !== null;
+  }
+
+  async extract(buffer: Buffer, fileName: string): Promise<KiReservation[]> {
+    if (!this.binaryPath) {
+      throw new Error('kitinerary-extractor is not available on this system');
+    }
+
+    const ext = extname(fileName).toLowerCase();
+    const tmpFile = join(tmpdir(), `trek-ki-${randomUUID()}${ext}`);
+
+    try {
+      writeFileSync(tmpFile, buffer);
+
+      const { stdout, stderr } = await execFileAsync(this.binaryPath, [tmpFile], {
+        timeout: TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+      });
+
+      if (stderr?.trim()) {
+        // Filter expected noise: currency-symbol ambiguity warnings and vendor
+        // extractor script errors are normal (every matching script is tried;
+        // most won't match the current document).
+        const unexpected = stderr
+          .split('\n')
+          .filter(l => l.trim())
+          .filter(l => !l.includes('Ambig') && !l.includes('JS ERROR') && !l.includes('Invalid result type from script'));
+        if (unexpected.length) {
+          console.warn(`[KItinerary] stderr for "${fileName}":`, unexpected.join('\n'));
+        }
+      }
+
+      const text = stdout.trim();
+      if (!text) return [];
+
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        console.warn(`[KItinerary] non-JSON output for "${fileName}"`);
+        return [];
+      }
+
+      if (Array.isArray(parsed)) return parsed as KiReservation[];
+      if (typeof parsed === 'object' && parsed !== null) return [parsed as KiReservation];
+      return [];
+    } finally {
+      try { unlinkSync(tmpFile); } catch {}
+    }
+  }
+
+  private findBinary(): string | null {
+    const envPath = process.env.KITINERARY_EXTRACTOR_PATH;
+    if (envPath) {
+      if (existsSync(envPath)) return envPath;
+      console.warn(`[KItinerary] KITINERARY_EXTRACTOR_PATH="${envPath}" not found`);
+      return null;
+    }
+
+    // Debian/Ubuntu: /usr/lib/<triplet>/libexec/kf6/kitinerary-extractor
+    try {
+      for (const dir of readdirSync('/usr/lib')) {
+        const candidate = join('/usr/lib', dir, 'libexec', 'kf6', 'kitinerary-extractor');
+        if (existsSync(candidate)) return candidate;
+      }
+    } catch { /* not a Debian system */ }
+
+    // Fallback: binary in PATH
+    try {
+      execSync('kitinerary-extractor --version', { stdio: 'pipe', timeout: 3000 });
+      return 'kitinerary-extractor';
+    } catch { /* not in PATH */ }
+
+    return null;
+  }
+}

server/src/nest/booking-import/kitinerary-mapper.ts

@@ -0,0 +1,355 @@
+import { findByIata } from '../../services/airportService';
+import type {
+  KiReservation, KiFlight, KiTrainTrip, KiBusTrip, KiBoatTrip,
+  KiLodgingBusiness, KiFoodEstablishment, KiRentalCar, KiEvent,
+  KiGeo, KiAddress, KiDateTimeish, ParsedBookingItem, ParsedEndpoint, ParsedVenue,
+} from './kitinerary.types';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Extract a plain ISO string from either a string or a KDE QDateTime object. */
+function toIsoString(dt: KiDateTimeish): string | null {
+  if (!dt) return null;
+  if (typeof dt === 'string') return dt || null;
+  if (typeof dt === 'object' && dt['@type'] === 'QDateTime') return dt['@value'] || null;
+  return null;
+}
+
+function splitIso(dt: KiDateTimeish): { date: string | null; time: string | null } {
+  const iso = toIsoString(dt);
+  if (!iso) return { date: null, time: null };
+  return { date: iso.slice(0, 10) || null, time: iso.length > 10 ? iso.slice(11, 16) || null : null };
+}
+
+function formatAddress(address: string | KiAddress | undefined): string | null {
+  if (!address) return null;
+  if (typeof address === 'string') return address || null;
+  const joined = [address.streetAddress, address.addressLocality, address.postalCode, address.addressCountry].filter(Boolean).join(', ');
+  return joined || null;
+}
+
+function coords(geo: KiGeo | undefined): { lat: number; lng: number } | null {
+  if (!geo || geo.latitude == null || geo.longitude == null) return null;
+  return { lat: Number(geo.latitude), lng: Number(geo.longitude) };
+}
+
+// ---------------------------------------------------------------------------
+// Type mappers
+// ---------------------------------------------------------------------------
+
+function mapFlight(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const f = r.reservationFor as KiFlight | undefined;
+  if (!f) return null;
+
+  const depIata = f.departureAirport?.iataCode?.toUpperCase() ?? null;
+  const arrIata = f.arrivalAirport?.iataCode?.toUpperCase() ?? null;
+  const depAp = depIata ? findByIata(depIata) : null;
+  const arrAp = arrIata ? findByIata(arrIata) : null;
+
+  const depLabel = depAp ? (depAp.city ? `${depAp.city} (${depAp.iata})` : depAp.name) : (f.departureAirport?.name ?? depIata ?? 'Unknown');
+  const arrLabel = arrAp ? (arrAp.city ? `${arrAp.city} (${arrAp.iata})` : arrAp.name) : (f.arrivalAirport?.name ?? arrIata ?? 'Unknown');
+
+  const airline = f.airline?.name ?? f.airline?.iataCode ?? '';
+  const flightNum = f.flightNumber ?? '';
+  const title = [airline, flightNum].filter(Boolean).join(' ') || `Flight ${depLabel} → ${arrLabel}`;
+
+  const { date: depDate, time: depTime } = splitIso(f.departureTime);
+  const { date: arrDate, time: arrTime } = splitIso(f.arrivalTime);
+
+  const endpoints: ParsedEndpoint[] = [];
+  if (depAp) {
+    endpoints.push({ role: 'from', sequence: 0, name: depLabel, code: depAp.iata, lat: depAp.lat, lng: depAp.lng, timezone: depAp.tz, local_time: depTime, local_date: depDate });
+  } else {
+    const c = coords(f.departureAirport?.geo);
+    if (c) endpoints.push({ role: 'from', sequence: 0, name: depLabel, code: depIata, lat: c.lat, lng: c.lng, timezone: null, local_time: depTime, local_date: depDate });
+  }
+  if (arrAp) {
+    endpoints.push({ role: 'to', sequence: 1, name: arrLabel, code: arrAp.iata, lat: arrAp.lat, lng: arrAp.lng, timezone: arrAp.tz, local_time: arrTime, local_date: arrDate });
+  } else {
+    const c = coords(f.arrivalAirport?.geo);
+    if (c) endpoints.push({ role: 'to', sequence: 1, name: arrLabel, code: arrIata, lat: c.lat, lng: c.lng, timezone: null, local_time: arrTime, local_date: arrDate });
+  }
+
+  return {
+    type: 'flight',
+    title,
+    reservation_time: toIsoString(f.departureTime),
+    reservation_end_time: toIsoString(f.arrivalTime),
+    confirmation_number: r.reservationNumber ?? null,
+    metadata: {
+      ...(airline ? { airline } : {}),
+      ...(flightNum ? { flight_number: flightNum } : {}),
+      ...(depIata ? { departure_airport: depIata } : {}),
+      ...(arrIata ? { arrival_airport: arrIata } : {}),
+    },
+    endpoints,
+    needs_review: endpoints.length < 2,
+    source,
+  };
+}
+
+/** True when flight `b` is a short layover connection that continues flight `a`. */
+function sameConnection(a: KiReservation, b: KiReservation): boolean {
+  const fa = a.reservationFor as KiFlight | undefined;
+  const fb = b.reservationFor as KiFlight | undefined;
+  if (!fa || !fb) return false;
+  const arrIata = fa.arrivalAirport?.iataCode?.toUpperCase();
+  const depIata = fb.departureAirport?.iataCode?.toUpperCase();
+  if (!arrIata || !depIata || arrIata !== depIata) return false; // must connect at the same airport
+  const arrIso = toIsoString(fa.arrivalTime);
+  const depIso = toIsoString(fb.departureTime);
+  if (arrIso && depIso) {
+    const gapMs = new Date(depIso).getTime() - new Date(arrIso).getTime();
+    // A real layover is forward in time and short — anything longer (e.g. a
+    // round-trip return days later) stays a separate booking.
+    if (gapMs < 0 || gapMs > 24 * 3600 * 1000) return false;
+  }
+  return true;
+}
+
+/** Collapse several connecting flight legs (same PNR) into one multi-leg booking. */
+function mapFlightGroup(legs: KiReservation[], source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const flights = legs.map(l => l.reservationFor as KiFlight | undefined);
+  if (flights.some(f => !f)) return mapFlight(legs[0], source); // malformed → fall back to single
+  const fs = flights as KiFlight[];
+
+  const iataOf = (ap: KiFlight['departureAirport']) => ap?.iataCode?.toUpperCase() ?? null;
+  const makeEndpoint = (
+    ap: KiFlight['departureAirport'], role: 'from' | 'stop' | 'to', time: string | null, date: string | null,
+  ): ParsedEndpoint | null => {
+    const iata = iataOf(ap);
+    const found = iata ? findByIata(iata) : null;
+    const label = found ? (found.city ? `${found.city} (${found.iata})` : found.name) : (ap?.name ?? iata ?? 'Unknown');
+    if (found) return { role, sequence: 0, name: label, code: found.iata, lat: found.lat, lng: found.lng, timezone: found.tz, local_time: time, local_date: date };
+    const c = coords(ap?.geo);
+    if (c) return { role, sequence: 0, name: label, code: iata, lat: c.lat, lng: c.lng, timezone: null, local_time: time, local_date: date };
+    return null;
+  };
+
+  const endpoints: ParsedEndpoint[] = [];
+  const metaLegs: Record<string, unknown>[] = [];
+  const first = fs[0];
+  const firstDep = splitIso(first.departureTime);
+  const originEp = makeEndpoint(first.departureAirport, 'from', firstDep.time, firstDep.date);
+  if (originEp) endpoints.push(originEp);
+
+  fs.forEach((f, i) => {
+    const isLast = i === fs.length - 1;
+    const arr = splitIso(f.arrivalTime);
+    const arrEp = makeEndpoint(f.arrivalAirport, isLast ? 'to' : 'stop', arr.time, arr.date);
+    if (arrEp) endpoints.push(arrEp);
+    const airline = f.airline?.name ?? f.airline?.iataCode ?? '';
+    metaLegs.push({
+      from: iataOf(f.departureAirport),
+      to: iataOf(f.arrivalAirport),
+      ...(airline ? { airline } : {}),
+      ...(f.flightNumber ? { flight_number: f.flightNumber } : {}),
+      dep_time: splitIso(f.departureTime).time,
+      arr_time: arr.time,
+    });
+  });
+  endpoints.forEach((e, i) => { e.sequence = i; });
+
+  const last = fs[fs.length - 1];
+  const airline = first.airline?.name ?? first.airline?.iataCode ?? '';
+  const route = [iataOf(first.departureAirport), ...fs.map(f => iataOf(f.arrivalAirport))].filter(Boolean).join(' → ');
+  return {
+    type: 'flight',
+    title: airline ? `${airline} ${route}` : `Flight ${route}`,
+    reservation_time: toIsoString(first.departureTime),
+    reservation_end_time: toIsoString(last.arrivalTime),
+    confirmation_number: legs[0].reservationNumber ?? null,
+    metadata: {
+      ...(airline ? { airline } : {}),
+      ...(first.flightNumber ? { flight_number: first.flightNumber } : {}),
+      ...(iataOf(first.departureAirport) ? { departure_airport: iataOf(first.departureAirport) } : {}),
+      ...(iataOf(last.arrivalAirport) ? { arrival_airport: iataOf(last.arrivalAirport) } : {}),
+      legs: metaLegs,
+    },
+    endpoints,
+    needs_review: endpoints.length < fs.length + 1,
+    source,
+  };
+}
+
+function mapTrain(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const t = r.reservationFor as KiTrainTrip | undefined;
+  if (!t) return null;
+
+  const depName = t.departureStation?.name ?? 'Unknown';
+  const arrName = t.arrivalStation?.name ?? 'Unknown';
+  const trainId = t.trainNumber ?? t.trainName ?? '';
+  const title = trainId ? `${trainId} (${depName} → ${arrName})` : `Train ${depName} → ${arrName}`;
+
+  const { date: depDate, time: depTime } = splitIso(t.departureTime);
+  const { date: arrDate, time: arrTime } = splitIso(t.arrivalTime);
+
+  const endpoints: ParsedEndpoint[] = [];
+  const dc = coords(t.departureStation?.geo);
+  const ac = coords(t.arrivalStation?.geo);
+  if (dc) endpoints.push({ role: 'from', sequence: 0, name: depName, code: null, lat: dc.lat, lng: dc.lng, timezone: null, local_time: depTime, local_date: depDate });
+  if (ac) endpoints.push({ role: 'to', sequence: 1, name: arrName, code: null, lat: ac.lat, lng: ac.lng, timezone: null, local_time: arrTime, local_date: arrDate });
+
+  return {
+    type: 'train',
+    title,
+    reservation_time: toIsoString(t.departureTime),
+    reservation_end_time: toIsoString(t.arrivalTime),
+    confirmation_number: r.reservationNumber ?? null,
+    metadata: trainId ? { train_number: trainId } : undefined,
+    endpoints,
+    needs_review: endpoints.length < 2,
+    source,
+  };
+}
+
+function mapBus(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const b = r.reservationFor as KiBusTrip | undefined;
+  if (!b) return null;
+
+  const depName = b.departureBusStop?.name ?? 'Unknown';
+  const arrName = b.arrivalBusStop?.name ?? 'Unknown';
+  const busId = b.busNumber ?? b.busName ?? '';
+  const title = busId ? `${busId} (${depName} → ${arrName})` : `Bus ${depName} → ${arrName}`;
+
+  const { date: depDate, time: depTime } = splitIso(b.departureTime);
+  const { date: arrDate, time: arrTime } = splitIso(b.arrivalTime);
+
+  const endpoints: ParsedEndpoint[] = [];
+  const dc = coords(b.departureBusStop?.geo);
+  const ac = coords(b.arrivalBusStop?.geo);
+  if (dc) endpoints.push({ role: 'from', sequence: 0, name: depName, code: null, lat: dc.lat, lng: dc.lng, timezone: null, local_time: depTime, local_date: depDate });
+  if (ac) endpoints.push({ role: 'to', sequence: 1, name: arrName, code: null, lat: ac.lat, lng: ac.lng, timezone: null, local_time: arrTime, local_date: arrDate });
+
+  return { type: 'train', title, reservation_time: toIsoString(b.departureTime), reservation_end_time: toIsoString(b.arrivalTime), confirmation_number: r.reservationNumber ?? null, endpoints, needs_review: endpoints.length < 2, source };
+}
+
+function mapBoat(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const b = r.reservationFor as KiBoatTrip | undefined;
+  if (!b) return null;
+
+  const depName = b.departureBoatTerminal?.name ?? 'Unknown';
+  const arrName = b.arrivalBoatTerminal?.name ?? 'Unknown';
+  const title = (b as any).name ?? `Cruise ${depName} → ${arrName}`;
+
+  const { date: depDate, time: depTime } = splitIso(b.departureTime);
+  const { date: arrDate, time: arrTime } = splitIso(b.arrivalTime);
+
+  const endpoints: ParsedEndpoint[] = [];
+  const dc = coords(b.departureBoatTerminal?.geo);
+  const ac = coords(b.arrivalBoatTerminal?.geo);
+  if (dc) endpoints.push({ role: 'from', sequence: 0, name: depName, code: null, lat: dc.lat, lng: dc.lng, timezone: null, local_time: depTime, local_date: depDate });
+  if (ac) endpoints.push({ role: 'to', sequence: 1, name: arrName, code: null, lat: ac.lat, lng: ac.lng, timezone: null, local_time: arrTime, local_date: arrDate });
+
+  return { type: 'cruise', title, reservation_time: toIsoString(b.departureTime), reservation_end_time: toIsoString(b.arrivalTime), confirmation_number: r.reservationNumber ?? null, endpoints, source };
+}
+
+function mapLodging(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const l = r.reservationFor as KiLodgingBusiness | undefined;
+  if (!l?.name) return null;
+
+  const c = coords(l.geo);
+  const venue: ParsedVenue = { name: l.name, ...(c ?? {}), address: formatAddress(l.address) ?? undefined, website: l.url ?? undefined, phone: l.telephone ?? undefined };
+
+  const { date: checkInDate, time: checkInTime } = splitIso(r.checkinTime);
+  const { date: checkOutDate, time: checkOutTime } = splitIso(r.checkoutTime);
+  const checkIn = checkInDate ? `${checkInDate}${checkInTime ? `T${checkInTime}` : ''}` : undefined;
+  const checkOut = checkOutDate ? `${checkOutDate}${checkOutTime ? `T${checkOutTime}` : ''}` : undefined;
+
+  return {
+    type: 'hotel',
+    title: l.name,
+    confirmation_number: r.reservationNumber ?? null,
+    location: formatAddress(l.address),
+    _venue: venue,
+    _accommodation: { check_in: checkIn, check_out: checkOut, confirmation: r.reservationNumber ?? undefined },
+    metadata: { ...(checkInTime ? { check_in_time: checkInTime } : {}), ...(checkOutTime ? { check_out_time: checkOutTime } : {}) },
+    source,
+  };
+}
+
+function mapFood(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const f = r.reservationFor as KiFoodEstablishment | undefined;
+  if (!f?.name) return null;
+
+  const c = coords(f.geo);
+  const venue: ParsedVenue = { name: f.name, ...(c ?? {}), address: formatAddress(f.address) ?? undefined, website: f.url ?? undefined, phone: f.telephone ?? undefined };
+
+  return { type: 'restaurant', title: f.name, reservation_time: toIsoString(r.startTime), reservation_end_time: toIsoString(r.endTime), confirmation_number: r.reservationNumber ?? null, location: formatAddress(f.address), _venue: venue, source };
+}
+
+function mapRentalCar(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const car = r.reservationFor as KiRentalCar | undefined;
+  const company = car?.rentalCompany?.name ?? '';
+  const carName = car?.name ?? [car?.make, car?.model].filter(Boolean).join(' ') ?? '';
+  const title = [company, carName].filter(Boolean).join(' — ') || 'Rental Car';
+
+  const pickup = r.pickupLocation as KiReservation['pickupLocation'];
+  const pc = coords(pickup?.geo);
+  const venue: ParsedVenue | undefined = pickup?.name ? { name: pickup.name, ...(pc ?? {}), address: formatAddress(pickup.address) ?? undefined } : undefined;
+
+  return { type: 'car', title, reservation_time: toIsoString(r.pickupTime), reservation_end_time: toIsoString(r.dropoffTime), confirmation_number: r.reservationNumber ?? null, ...(venue ? { _venue: venue } : {}), source };
+}
+
+function mapEvent(r: KiReservation, source: ParsedBookingItem['source']): ParsedBookingItem | null {
+  const e = r.reservationFor as KiEvent | undefined;
+  if (!e?.name) return null;
+
+  const loc = e.location;
+  const c = coords(loc?.geo);
+  const venue: ParsedVenue | undefined = loc?.name ? { name: loc.name, ...(c ?? {}), address: formatAddress(loc.address) ?? undefined } : undefined;
+
+  return { type: 'event', title: e.name, reservation_time: toIsoString(e.startDate), reservation_end_time: toIsoString(e.endDate), confirmation_number: r.reservationNumber ?? null, location: loc ? (formatAddress(loc.address) ?? loc.name ?? null) : null, ...(venue ? { _venue: venue } : {}), source };
+}
+
+// ---------------------------------------------------------------------------
+// Public
+// ---------------------------------------------------------------------------
+
+export function mapReservations(kiItems: KiReservation[], fileName: string): { items: ParsedBookingItem[]; warnings: string[] } {
+  const items: ParsedBookingItem[] = [];
+  const warnings: string[] = [];
+
+  for (let i = 0; i < kiItems.length; i++) {
+    const r = kiItems[i];
+    const source = { fileName, index: i };
+    let item: ParsedBookingItem | null = null;
+
+    // Group consecutive connecting flight legs that share a PNR into one booking.
+    if (r['@type'] === 'FlightReservation') {
+      const pnr = r.reservationNumber ?? null;
+      const group = [r];
+      while (
+        i + 1 < kiItems.length &&
+        kiItems[i + 1]['@type'] === 'FlightReservation' &&
+        pnr != null &&
+        (kiItems[i + 1].reservationNumber ?? null) === pnr &&
+        sameConnection(group[group.length - 1], kiItems[i + 1])
+      ) {
+        group.push(kiItems[++i]);
+      }
+      item = group.length > 1 ? mapFlightGroup(group, source) : mapFlight(r, source);
+      if (item) items.push(item);
+      continue;
+    }
+
+    switch (r['@type']) {
+      case 'TrainReservation':             item = mapTrain(r, source);   break;
+      case 'BusReservation':              item = mapBus(r, source);     break;
+      case 'BoatReservation':             item = mapBoat(r, source);    break;
+      case 'LodgingReservation':          item = mapLodging(r, source); break;
+      case 'FoodEstablishmentReservation': item = mapFood(r, source);   break;
+      case 'RentalCarReservation':        item = mapRentalCar(r, source); break;
+      case 'EventReservation':
+      case 'TouristAttractionVisit':      item = mapEvent(r, source);   break;
+      default:
+        warnings.push(`Unknown type "${r['@type']}" in ${fileName}[${i}] — skipped`);
+    }
+
+    if (item) items.push(item);
+  }
+
+  return { items, warnings };
+}

server/src/nest/booking-import/kitinerary.types.ts

@@ -0,0 +1,188 @@
+/** KItinerary JSON-LD output types (schema.org subset) */
+
+/** KDE's custom date/time wrapper — used when timezone info is present */
+export interface KiDateTime {
+  '@type': 'QDateTime';
+  '@value': string;    // ISO 8601 local time (KDE serializes as @value)
+  timezone?: string;   // IANA timezone id
+}
+
+export type KiDateTimeish = string | KiDateTime | null | undefined;
+
+export interface KiGeo {
+  '@type'?: string;
+  latitude?: number;
+  longitude?: number;
+}
+
+export interface KiAddress {
+  '@type'?: string;
+  streetAddress?: string;
+  addressLocality?: string;
+  postalCode?: string;
+  addressCountry?: string;
+}
+
+export interface KiAirport {
+  '@type'?: string;
+  name?: string;
+  iataCode?: string;
+  geo?: KiGeo;
+}
+
+export interface KiStation {
+  '@type'?: string;
+  name?: string;
+  geo?: KiGeo;
+}
+
+export interface KiBusStop {
+  '@type'?: string;
+  name?: string;
+  geo?: KiGeo;
+}
+
+export interface KiFlight {
+  '@type'?: string;
+  flightNumber?: string;
+  airline?: { name?: string; iataCode?: string };
+  departureAirport?: KiAirport;
+  arrivalAirport?: KiAirport;
+  departureTime?: KiDateTimeish;
+  arrivalTime?: KiDateTimeish;
+}
+
+export interface KiTrainTrip {
+  '@type'?: string;
+  trainNumber?: string;
+  trainName?: string;
+  departureStation?: KiStation;
+  arrivalStation?: KiStation;
+  departureTime?: KiDateTimeish;
+  arrivalTime?: KiDateTimeish;
+}
+
+export interface KiBusTrip {
+  '@type'?: string;
+  busNumber?: string;
+  busName?: string;
+  departureBusStop?: KiBusStop;
+  arrivalBusStop?: KiBusStop;
+  departureTime?: KiDateTimeish;
+  arrivalTime?: KiDateTimeish;
+}
+
+export interface KiBoatTrip {
+  '@type'?: string;
+  name?: string;
+  departureBoatTerminal?: KiStation;
+  arrivalBoatTerminal?: KiStation;
+  departureTime?: KiDateTimeish;
+  arrivalTime?: KiDateTimeish;
+}
+
+export interface KiLodgingBusiness {
+  '@type'?: string;
+  name?: string;
+  address?: string | KiAddress;
+  geo?: KiGeo;
+  telephone?: string;
+  url?: string;
+}
+
+export interface KiFoodEstablishment {
+  '@type'?: string;
+  name?: string;
+  address?: string | KiAddress;
+  geo?: KiGeo;
+  telephone?: string;
+  url?: string;
+}
+
+export interface KiRentalCar {
+  '@type'?: string;
+  name?: string;
+  model?: string;
+  make?: string;
+  rentalCompany?: { name?: string };
+}
+
+export interface KiEventVenue {
+  '@type'?: string;
+  name?: string;
+  address?: string | KiAddress;
+  geo?: KiGeo;
+}
+
+export interface KiEvent {
+  '@type'?: string;
+  name?: string;
+  startDate?: KiDateTimeish;
+  endDate?: KiDateTimeish;
+  location?: KiEventVenue;
+}
+
+/** A single output node from kitinerary-extractor's JSON array */
+export interface KiReservation {
+  '@type': string;
+  reservationNumber?: string;
+  checkinTime?: KiDateTimeish;
+  checkoutTime?: KiDateTimeish;
+  pickupTime?: KiDateTimeish;
+  dropoffTime?: KiDateTimeish;
+  startTime?: KiDateTimeish;
+  endTime?: KiDateTimeish;
+  reservationFor?: Record<string, unknown>;
+  pickupLocation?: KiEventVenue;
+  [key: string]: unknown;
+}
+
+/** Endpoint row shape (matches reservation_endpoints table) */
+export interface ParsedEndpoint {
+  role: 'from' | 'to' | 'stop';
+  sequence: number;
+  name: string;
+  code: string | null;
+  lat: number;
+  lng: number;
+  timezone: string | null;
+  local_time: string | null;
+  local_date: string | null;
+}
+
+/** Venue used to auto-create a places row on confirm */
+export interface ParsedVenue {
+  name: string;
+  lat?: number;
+  lng?: number;
+  address?: string;
+  website?: string;
+  phone?: string;
+}
+
+/** Hotel accommodation side-effect data */
+export interface ParsedAccommodation {
+  check_in?: string;
+  check_out?: string;
+  confirmation?: string;
+}
+
+/**
+ * Parsed reservation preview item — sent to the frontend and passed back on confirm.
+ * Carries everything createReservation() needs plus _venue / _accommodation for
+ * server-side side effects, and source for the preview UI.
+ */
+export interface ParsedBookingItem {
+  type: string;
+  title: string;
+  reservation_time?: string | null;
+  reservation_end_time?: string | null;
+  confirmation_number?: string | null;
+  location?: string | null;
+  metadata?: Record<string, unknown>;
+  endpoints?: ParsedEndpoint[];
+  needs_review?: boolean;
+  _venue?: ParsedVenue;
+  _accommodation?: ParsedAccommodation;
+  source: { fileName: string; index: number };
+}

server/src/nest/budget/budget.controller.ts

@@ -0,0 +1,252 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import type { User } from '../../types';
+import { BudgetService } from './budget.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+/**
+ * /api/trips/:tripId/budget — trip-scoped expense planner.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/budget.ts):
+ * every handler verifies trip access (404); mutations check 'budget_edit' (403);
+ * create is 201, the rest 200; bespoke 400/404 bodies reproduced; mutations
+ * broadcast over WebSocket with the forwarded X-Socket-Id. Static sub-routes
+ * (summary, settlement, reorder/*) are declared before /:id so they win over the
+ * param. Updating total_price on a reservation-linked item syncs the price back.
+ */
+@Controller('api/trips/:tripId/budget')
+@UseGuards(JwtAuthGuard)
+export class BudgetController {
+  constructor(private readonly budget: BudgetService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.budget.verifyTripAccess(tripId, user.id);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+    return trip;
+  }
+
+  private requireEdit(trip: ReturnType<BudgetService['verifyTripAccess']>, user: User): void {
+    if (!this.budget.canEdit(trip!, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+  }
+
+  @Get()
+  list(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return { items: this.budget.list(tripId) };
+  }
+
+  @Get('summary/per-person')
+  perPerson(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return { summary: this.budget.perPersonSummary(tripId) };
+  }
+
+  @Get('settlement')
+  settlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Query('base') base?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    return this.budget.settlement(tripId, base, (trip as { currency?: string }).currency || 'EUR');
+  }
+
+  @Get('settlements')
+  listSettlements(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return { settlements: this.budget.listSettlements(tripId) };
+  }
+
+  @Post('settlements')
+  createSettlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { from_user_id?: number; to_user_id?: number; amount?: number },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (body.from_user_id == null || body.to_user_id == null || body.amount == null) {
+      throw new HttpException({ error: 'from_user_id, to_user_id and amount are required' }, 400);
+    }
+    const settlement = this.budget.createSettlement(
+      tripId,
+      { from_user_id: body.from_user_id, to_user_id: body.to_user_id, amount: body.amount },
+      user.id,
+    );
+    this.budget.broadcast(tripId, 'budget:settlement-created', { settlement }, socketId);
+    return { settlement };
+  }
+
+  @Delete('settlements/:settlementId')
+  deleteSettlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('settlementId') settlementId: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.budget.deleteSettlement(settlementId, tripId)) {
+      throw new HttpException({ error: 'Settlement not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:settlement-deleted', { settlementId: Number(settlementId) }, socketId);
+    return { success: true };
+  }
+
+  @Post()
+  create(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { name?: string; category?: string; total_price?: number; persons?: number | null; days?: number | null; note?: string | null; expense_date?: string | null },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!body.name) {
+      throw new HttpException({ error: 'Name is required' }, 400);
+    }
+    const item = this.budget.create(tripId, body as { name: string });
+    this.budget.broadcast(tripId, 'budget:created', { item }, socketId);
+    return { item };
+  }
+
+  @Put('reorder/items')
+  reorderItems(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body('orderedIds') orderedIds: number[],
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    this.budget.reorderItems(tripId, orderedIds);
+    this.budget.broadcast(tripId, 'budget:reordered', { orderedIds }, socketId);
+    return { success: true };
+  }
+
+  @Put('reorder/categories')
+  reorderCategories(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body('orderedCategories') orderedCategories: string[],
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    this.budget.reorderCategories(tripId, orderedCategories);
+    this.budget.broadcast(tripId, 'budget:reordered', { orderedCategories }, socketId);
+    return { success: true };
+  }
+
+  @Put(':id')
+  update(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body() body: Record<string, unknown>,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const updated = this.budget.update(id, tripId, body);
+    if (!updated) {
+      throw new HttpException({ error: 'Budget item not found' }, 404);
+    }
+    if (updated.reservation_id && body.total_price !== undefined) {
+      this.budget.syncReservationPrice(tripId, updated.reservation_id, updated.total_price, socketId);
+    }
+    this.budget.broadcast(tripId, 'budget:updated', { item: updated }, socketId);
+    return { item: updated };
+  }
+
+  @Put(':id/members')
+  updateMembers(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body('user_ids') userIds: unknown,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!Array.isArray(userIds)) {
+      throw new HttpException({ error: 'user_ids must be an array' }, 400);
+    }
+    const result = this.budget.updateMembers(id, tripId, userIds);
+    if (!result) {
+      throw new HttpException({ error: 'Budget item not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:members-updated', { itemId: Number(id), members: result.members, persons: result.item.persons }, socketId);
+    return { members: result.members, item: result.item };
+  }
+
+  @Put(':id/payers')
+  setPayers(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body('payers') payers: unknown,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!Array.isArray(payers)) {
+      throw new HttpException({ error: 'payers must be an array' }, 400);
+    }
+    const item = this.budget.setPayers(id, tripId, payers as { user_id: number; amount: number }[]);
+    if (!item) {
+      throw new HttpException({ error: 'Budget item not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:updated', { item }, socketId);
+    return { item };
+  }
+
+  @Put(':id/members/:userId/paid')
+  toggleMemberPaid(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Param('userId') userId: string,
+    @Body('paid') paid: boolean,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const member = this.budget.toggleMemberPaid(id, tripId, userId, paid);
+    this.budget.broadcast(tripId, 'budget:member-paid-updated', { itemId: Number(id), userId: Number(userId), paid: paid ? 1 : 0 }, socketId);
+    return { member };
+  }
+
+  @Delete(':id')
+  remove(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.budget.remove(id, tripId)) {
+      throw new HttpException({ error: 'Budget item not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:deleted', { itemId: Number(id) }, socketId);
+    return { success: true };
+  }
+}

server/src/nest/budget/budget.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { BudgetController } from './budget.controller';
+import { BudgetService } from './budget.service';
+
+/** Budget domain (S4 — Phase 2 trip sub-domain). Registered in AppModule. */
+@Module({
+  controllers: [BudgetController],
+  providers: [BudgetService],
+})
+export class BudgetModule {}

server/src/nest/budget/budget.service.ts

@@ -0,0 +1,108 @@
+import { Injectable } from '@nestjs/common';
+import { db } from '../../db/database';
+import { broadcast } from '../../websocket';
+import { checkPermission } from '../../services/permissions';
+import type { User } from '../../types';
+import * as svc from '../../services/budgetService';
+import { getRates } from '../../services/exchangeRateService';
+
+type Trip = NonNullable<ReturnType<typeof svc.verifyTripAccess>>;
+
+/**
+ * Thin Nest wrapper around the existing budget service. Trip-access, the
+ * 'budget_edit' permission, the SQL, settlement maths and the WebSocket
+ * broadcasts all reuse the legacy code unchanged.
+ */
+@Injectable()
+export class BudgetService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return svc.verifyTripAccess(tripId, userId);
+  }
+
+  canEdit(trip: Trip, user: User): boolean {
+    return checkPermission('budget_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  list(tripId: string) {
+    return svc.listBudgetItems(tripId);
+  }
+
+  perPersonSummary(tripId: string) {
+    return svc.getPerPersonSummary(tripId);
+  }
+
+  async settlement(tripId: string, base: string | undefined, tripCurrency: string) {
+    const effectiveBase = (base || tripCurrency || 'EUR').toUpperCase();
+    const rates = await getRates(effectiveBase);
+    return svc.calculateSettlement(tripId, { base: effectiveBase, rates, tripCurrency });
+  }
+
+  create(tripId: string, data: Parameters<typeof svc.createBudgetItem>[1]) {
+    return svc.createBudgetItem(tripId, data);
+  }
+
+  update(id: string, tripId: string, data: Parameters<typeof svc.updateBudgetItem>[2]) {
+    return svc.updateBudgetItem(id, tripId, data);
+  }
+
+  remove(id: string, tripId: string): boolean {
+    return svc.deleteBudgetItem(id, tripId);
+  }
+
+  updateMembers(id: string, tripId: string, userIds: number[]) {
+    return svc.updateMembers(id, tripId, userIds);
+  }
+
+  toggleMemberPaid(id: string, tripId: string, userId: string, paid: boolean) {
+    return svc.toggleMemberPaid(id, tripId, userId, paid);
+  }
+
+  setPayers(id: string, tripId: string, payers: { user_id: number; amount: number }[]) {
+    return svc.setItemPayers(id, tripId, payers);
+  }
+
+  listSettlements(tripId: string) {
+    return svc.listSettlements(tripId);
+  }
+
+  createSettlement(tripId: string, data: { from_user_id: number; to_user_id: number; amount: number }, userId: number) {
+    return svc.createSettlement(tripId, data, userId);
+  }
+
+  deleteSettlement(id: string, tripId: string): boolean {
+    return svc.deleteSettlement(id, tripId);
+  }
+
+  reorderItems(tripId: string, orderedIds: number[]): void {
+    svc.reorderBudgetItems(tripId, orderedIds);
+  }
+
+  reorderCategories(tripId: string, orderedCategories: string[]): void {
+    svc.reorderBudgetCategories(tripId, orderedCategories);
+  }
+
+  /**
+   * Mirrors the legacy PUT /:id side effect: when a price-linked budget item's
+   * total_price changes, write it into the reservation's metadata and broadcast
+   * reservation:updated. Non-fatal — a failure here never breaks the budget update.
+   */
+  syncReservationPrice(tripId: string, reservationId: number, totalPrice: number, socketId: string | undefined): void {
+    try {
+      const reservation = db.prepare(
+        'SELECT id, metadata FROM reservations WHERE id = ? AND trip_id = ?',
+      ).get(reservationId, tripId) as { id: number; metadata: string | null } | undefined;
+      if (!reservation) return;
+      const meta = reservation.metadata ? JSON.parse(reservation.metadata) : {};
+      meta.price = String(totalPrice);
+      db.prepare('UPDATE reservations SET metadata = ? WHERE id = ?').run(JSON.stringify(meta), reservation.id);
+      const updatedRes = db.prepare('SELECT * FROM reservations WHERE id = ?').get(reservation.id);
+      broadcast(tripId, 'reservation:updated', { reservation: updatedRes }, socketId);
+    } catch (err) {
+      console.error('[budget] Failed to sync price to reservation:', err);
+    }
+  }
+}

server/src/nest/categories/categories.controller.ts

@@ -0,0 +1,65 @@
+import { Body, Controller, Delete, Get, HttpException, Param, Post, Put, UseGuards } from '@nestjs/common';
+import type { Category, CategoryListResponse } from '@trek/shared';
+import type { User } from '../../types';
+import { CategoriesService } from './categories.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { AdminGuard } from '../auth/admin.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+/**
+ * /api/categories — place-category palette CRUD.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/categories.ts):
+ * listing is open to any authenticated user; create/update/delete require admin
+ * (JwtAuthGuard + AdminGuard). Status codes match the Nest defaults the legacy
+ * route also used (201 on create, 200 elsewhere), and the bespoke 400/404 bodies
+ * are reproduced exactly.
+ */
+@Controller('api/categories')
+export class CategoriesController {
+  constructor(private readonly categories: CategoriesService) {}
+
+  @Get()
+  @UseGuards(JwtAuthGuard)
+  list(): CategoryListResponse {
+    return { categories: this.categories.list() };
+  }
+
+  @Post()
+  @UseGuards(JwtAuthGuard, AdminGuard)
+  create(
+    @CurrentUser() user: User,
+    @Body('name') name?: string,
+    @Body('color') color?: string,
+    @Body('icon') icon?: string,
+  ): { category: Category } {
+    if (!name) {
+      throw new HttpException({ error: 'Category name is required' }, 400);
+    }
+    return { category: this.categories.create(user.id, name, color, icon) };
+  }
+
+  @Put(':id')
+  @UseGuards(JwtAuthGuard, AdminGuard)
+  update(
+    @Param('id') id: string,
+    @Body('name') name?: string,
+    @Body('color') color?: string,
+    @Body('icon') icon?: string,
+  ): { category: Category } {
+    if (!this.categories.getById(id)) {
+      throw new HttpException({ error: 'Category not found' }, 404);
+    }
+    return { category: this.categories.update(id, name, color, icon) };
+  }
+
+  @Delete(':id')
+  @UseGuards(JwtAuthGuard, AdminGuard)
+  remove(@Param('id') id: string): { success: boolean } {
+    if (!this.categories.getById(id)) {
+      throw new HttpException({ error: 'Category not found' }, 404);
+    }
+    this.categories.remove(id);
+    return { success: true };
+  }
+}

server/src/nest/categories/categories.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { CategoriesController } from './categories.controller';
+import { CategoriesService } from './categories.service';
+
+/** Categories domain (L4 leaf module). Registered in AppModule. */
+@Module({
+  controllers: [CategoriesController],
+  providers: [CategoriesService],
+})
+export class CategoriesModule {}

server/src/nest/categories/categories.service.ts

@@ -0,0 +1,37 @@
+import { Injectable } from '@nestjs/common';
+import type { Category } from '@trek/shared';
+import {
+  listCategories,
+  getCategoryById,
+  createCategory,
+  updateCategory,
+  deleteCategory,
+} from '../../services/categoryService';
+
+/**
+ * Thin Nest wrapper around the existing category service. The SQL and the
+ * default colour/icon fallbacks stay in categoryService, so behaviour is
+ * unchanged.
+ */
+@Injectable()
+export class CategoriesService {
+  list(): Category[] {
+    return listCategories() as Category[];
+  }
+
+  getById(id: string | number): Category | undefined {
+    return getCategoryById(id) as Category | undefined;
+  }
+
+  create(userId: number, name: string, color?: string, icon?: string): Category {
+    return createCategory(userId, name, color, icon) as Category;
+  }
+
+  update(id: string | number, name?: string, color?: string, icon?: string): Category {
+    return updateCategory(id, name, color, icon) as Category;
+  }
+
+  remove(id: string | number): void {
+    deleteCategory(id);
+  }
+}

server/src/nest/collab/collab.controller.ts

@@ -0,0 +1,300 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpCode,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  Query,
+  UploadedFile,
+  UseGuards,
+  UseInterceptors,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { diskStorage } from 'multer';
+import path from 'path';
+import fs from 'fs';
+import { v4 as uuidv4 } from 'uuid';
+import type { User } from '../../types';
+import { CollabService } from './collab.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { BLOCKED_EXTENSIONS } from '../../services/fileService';
+
+const MAX_NOTE_FILE_SIZE = 50 * 1024 * 1024;
+const filesDir = path.join(__dirname, '../../../uploads/files');
+const NOTE_UPLOAD = {
+  storage: diskStorage({
+    destination: (_req, _file, cb) => { if (!fs.existsSync(filesDir)) fs.mkdirSync(filesDir, { recursive: true }); cb(null, filesDir); },
+    filename: (_req, file, cb) => cb(null, `${uuidv4()}${path.extname(file.originalname)}`),
+  }),
+  limits: { fileSize: MAX_NOTE_FILE_SIZE },
+  defParamCharset: 'utf8', // parity with legacy routes/collab.ts — preserve non-ASCII original filenames
+  fileFilter: (_req: unknown, file: Express.Multer.File, cb: (err: Error | null, accept: boolean) => void) => {
+    const ext = path.extname(file.originalname).toLowerCase();
+    if (BLOCKED_EXTENSIONS.includes(ext) || file.mimetype.includes('svg') || file.mimetype.includes('html') || file.mimetype.includes('javascript')) {
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err, false);
+    }
+    cb(null, true);
+  },
+};
+
+/**
+ * /api/trips/:tripId/collab — shared notes, polls, chat (+ reactions), link
+ * previews. WebSocket-backed group collaboration.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/collab.ts): trip
+ * access (404), 'collab_edit' (403) on mutations + 'file_upload' on note files,
+ * create 201 / rest 200 (vote + react POST stay 200), the bespoke 400/403/404
+ * bodies, the chat/note notifications, and all WebSocket broadcasts with the
+ * forwarded X-Socket-Id.
+ */
+@Controller('api/trips/:tripId/collab')
+@UseGuards(JwtAuthGuard)
+export class CollabController {
+  constructor(private readonly collab: CollabService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.collab.verifyTripAccess(tripId, user.id);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+    return trip;
+  }
+
+  private requireEdit(trip: NonNullable<ReturnType<CollabService['verifyTripAccess']>>, user: User): void {
+    if (!this.collab.canEdit(trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+  }
+
+  // ── Notes ───────────────────────────────────────────────────────────────
+  @Get('notes')
+  listNotes(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return { notes: this.collab.listNotes(tripId) };
+  }
+
+  @Post('notes')
+  createNote(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: { title?: string; content?: string; category?: string; color?: string; website?: string }, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!body.title) {
+      throw new HttpException({ error: 'Title is required' }, 400);
+    }
+    const note = this.collab.createNote(tripId, user.id, {
+      title: body.title,
+      content: body.content,
+      category: body.category,
+      color: body.color,
+      website: body.website,
+    });
+    this.collab.broadcast(tripId, 'collab:note:created', { note }, socketId);
+    this.collab.notifyCollab(tripId, user);
+    return { note };
+  }
+
+  @Put('notes/:id')
+  updateNote(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body() body: { title?: string; content?: string; category?: string; color?: string; pinned?: number | boolean; website?: string }, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const note = this.collab.updateNote(tripId, id, {
+      title: body.title,
+      content: body.content,
+      category: body.category,
+      color: body.color,
+      pinned: body.pinned,
+      website: body.website,
+    });
+    if (!note) {
+      throw new HttpException({ error: 'Note not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:note:updated', { note }, socketId);
+    return { note };
+  }
+
+  @Delete('notes/:id')
+  deleteNote(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.collab.deleteNote(tripId, id)) {
+      throw new HttpException({ error: 'Note not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:note:deleted', { noteId: Number(id) }, socketId);
+    return { success: true };
+  }
+
+  @Post('notes/:id/files')
+  @UseInterceptors(FileInterceptor('file', NOTE_UPLOAD))
+  addNoteFile(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @UploadedFile() file: Express.Multer.File | undefined, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.collab.canUploadFiles(trip, user)) {
+      throw new HttpException({ error: 'No permission to upload files' }, 403);
+    }
+    if (!file) {
+      throw new HttpException({ error: 'No file uploaded' }, 400);
+    }
+    const result = this.collab.addNoteFile(tripId, id, file);
+    if (!result) {
+      throw new HttpException({ error: 'Note not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:note:updated', { note: this.collab.getFormattedNoteById(id) }, socketId);
+    return result;
+  }
+
+  @Delete('notes/:id/files/:fileId')
+  deleteNoteFile(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Param('fileId') fileId: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.collab.deleteNoteFile(id, fileId)) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:note:updated', { note: this.collab.getFormattedNoteById(id) }, socketId);
+    return { success: true };
+  }
+
+  // ── Polls ───────────────────────────────────────────────────────────────
+  @Get('polls')
+  listPolls(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return { polls: this.collab.listPolls(tripId) };
+  }
+
+  @Post('polls')
+  createPoll(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: { question?: string; options?: unknown[]; multiple?: boolean; multiple_choice?: boolean; deadline?: string }, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!body.question) {
+      throw new HttpException({ error: 'Question is required' }, 400);
+    }
+    if (!Array.isArray(body.options) || body.options.length < 2) {
+      throw new HttpException({ error: 'At least 2 options are required' }, 400);
+    }
+    const poll = this.collab.createPoll(tripId, user.id, {
+      question: body.question,
+      options: body.options,
+      multiple: body.multiple,
+      multiple_choice: body.multiple_choice,
+      deadline: body.deadline,
+    });
+    this.collab.broadcast(tripId, 'collab:poll:created', { poll }, socketId);
+    return { poll };
+  }
+
+  @Post('polls/:id/vote')
+  @HttpCode(200)
+  votePoll(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body('option_index') optionIndex: number, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const result = this.collab.votePoll(tripId, id, user.id, optionIndex);
+    if (result.error === 'not_found') throw new HttpException({ error: 'Poll not found' }, 404);
+    if (result.error === 'closed') throw new HttpException({ error: 'Poll is closed' }, 400);
+    if (result.error === 'invalid_index') throw new HttpException({ error: 'Invalid option index' }, 400);
+    this.collab.broadcast(tripId, 'collab:poll:voted', { poll: result.poll }, socketId);
+    return { poll: result.poll };
+  }
+
+  @Put('polls/:id/close')
+  closePoll(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const poll = this.collab.closePoll(tripId, id);
+    if (!poll) {
+      throw new HttpException({ error: 'Poll not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:poll:closed', { poll }, socketId);
+    return { poll };
+  }
+
+  @Delete('polls/:id')
+  deletePoll(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.collab.deletePoll(tripId, id)) {
+      throw new HttpException({ error: 'Poll not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:poll:deleted', { pollId: Number(id) }, socketId);
+    return { success: true };
+  }
+
+  // ── Messages ────────────────────────────────────────────────────────────
+  @Get('messages')
+  listMessages(@CurrentUser() user: User, @Param('tripId') tripId: string, @Query('before') before?: string) {
+    this.requireTrip(tripId, user);
+    return { messages: this.collab.listMessages(tripId, before) };
+  }
+
+  @Post('messages')
+  createMessage(@CurrentUser() user: User, @Param('tripId') tripId: string, @Body() body: { text?: string; reply_to?: number | null }, @Headers('x-socket-id') socketId?: string) {
+    if (body.text && body.text.length > 5000) {
+      throw new HttpException({ error: 'text must be 5000 characters or less' }, 400);
+    }
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!body.text || !body.text.trim()) {
+      throw new HttpException({ error: 'Message text is required' }, 400);
+    }
+    const result = this.collab.createMessage(tripId, user.id, body.text, body.reply_to);
+    if (result.error === 'reply_not_found') {
+      throw new HttpException({ error: 'Reply target message not found' }, 400);
+    }
+    this.collab.broadcast(tripId, 'collab:message:created', { message: result.message }, socketId);
+    const t = body.text.trim();
+    this.collab.notifyCollab(tripId, user, t.length > 80 ? t.substring(0, 80) + '...' : t);
+    return { message: result.message };
+  }
+
+  @Post('messages/:id/react')
+  @HttpCode(200)
+  react(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body('emoji') emoji: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!emoji) {
+      throw new HttpException({ error: 'Emoji is required' }, 400);
+    }
+    const result = this.collab.reactMessage(id, tripId, user.id, emoji);
+    if (!result.found) {
+      throw new HttpException({ error: 'Message not found' }, 404);
+    }
+    this.collab.broadcast(tripId, 'collab:message:reacted', { messageId: Number(id), reactions: result.reactions }, socketId);
+    return { reactions: result.reactions };
+  }
+
+  @Delete('messages/:id')
+  deleteMessage(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const result = this.collab.deleteMessage(tripId, id, user.id);
+    if (result.error === 'not_found') throw new HttpException({ error: 'Message not found' }, 404);
+    if (result.error === 'not_owner') throw new HttpException({ error: 'You can only delete your own messages' }, 403);
+    this.collab.broadcast(tripId, 'collab:message:deleted', { messageId: Number(id), username: result.username || user.username }, socketId);
+    return { success: true };
+  }
+
+  // ── Link preview ──────────────────────────────────────────────────────────
+  @Get('link-preview')
+  async linkPreview(@CurrentUser() user: User, @Param('tripId') tripId: string, @Query('url') url?: string) {
+    // NB: the legacy route does not verify trip access on link-preview; kept 1:1.
+    void user; void tripId;
+    if (!url) {
+      throw new HttpException({ error: 'URL is required' }, 400);
+    }
+    try {
+      const preview = await this.collab.linkPreview(url);
+      const asRecord = preview as { error?: string };
+      if (asRecord.error) {
+        throw new HttpException({ error: asRecord.error }, 400);
+      }
+      return preview;
+    } catch (err) {
+      if (err instanceof HttpException) throw err;
+      return { title: null, description: null, image: null, url };
+    }
+  }
+}

server/src/nest/collab/collab.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { CollabController } from './collab.controller';
+import { CollabService } from './collab.service';
+
+@Module({
+  controllers: [CollabController],
+  providers: [CollabService],
+})
+export class CollabModule {}

server/src/nest/collab/collab.service.ts

@@ -0,0 +1,63 @@
+import { Injectable } from '@nestjs/common';
+import { db } from '../../db/database';
+import { broadcast } from '../../websocket';
+import { checkPermission } from '../../services/permissions';
+import type { User } from '../../types';
+import * as svc from '../../services/collabService';
+
+type Trip = NonNullable<ReturnType<typeof svc.verifyTripAccess>>;
+
+/**
+ * Thin Nest wrapper around the existing collab service. Trip access, the
+ * 'collab_edit' / 'file_upload' permissions, the SQL and the WebSocket
+ * broadcasts reuse the legacy code unchanged.
+ */
+@Injectable()
+export class CollabService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return svc.verifyTripAccess(tripId, userId);
+  }
+
+  canEdit(trip: Trip, user: User): boolean {
+    return checkPermission('collab_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  canUploadFiles(trip: Trip, user: User): boolean {
+    return checkPermission('file_upload', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  listNotes(tripId: string) { return svc.listNotes(tripId); }
+  createNote(tripId: string, userId: number, data: Parameters<typeof svc.createNote>[2]) { return svc.createNote(tripId, userId, data); }
+  updateNote(tripId: string, id: string, data: Parameters<typeof svc.updateNote>[2]) { return svc.updateNote(tripId, id, data); }
+  deleteNote(tripId: string, id: string): boolean { return svc.deleteNote(tripId, id); }
+  addNoteFile(tripId: string, id: string, file: Parameters<typeof svc.addNoteFile>[2]) { return svc.addNoteFile(tripId, id, file); }
+  getFormattedNoteById(id: string) { return svc.getFormattedNoteById(id); }
+  deleteNoteFile(id: string, fileId: string): boolean { return svc.deleteNoteFile(id, fileId); }
+
+  listPolls(tripId: string) { return svc.listPolls(tripId); }
+  createPoll(tripId: string, userId: number, data: Parameters<typeof svc.createPoll>[2]) { return svc.createPoll(tripId, userId, data); }
+  votePoll(tripId: string, id: string, userId: number, optionIndex: number) { return svc.votePoll(tripId, id, userId, optionIndex); }
+  closePoll(tripId: string, id: string) { return svc.closePoll(tripId, id); }
+  deletePoll(tripId: string, id: string): boolean { return svc.deletePoll(tripId, id); }
+
+  listMessages(tripId: string, before?: string) { return svc.listMessages(tripId, before); }
+  createMessage(tripId: string, userId: number, text: string, replyTo?: number | null) { return svc.createMessage(tripId, userId, text, replyTo); }
+  deleteMessage(tripId: string, id: string, userId: number) { return svc.deleteMessage(tripId, id, userId); }
+  reactMessage(id: string, tripId: string, userId: number, emoji: string) { return svc.addOrRemoveReaction(id, tripId, userId, emoji); }
+
+  linkPreview(url: string) { return svc.fetchLinkPreview(url); }
+
+  /** Fire-and-forget collab notification (mirrors the route's dynamic import). */
+  notifyCollab(tripId: string, actor: User, preview?: string): void {
+    import('../../services/notificationService').then(({ send }) => {
+      const tripInfo = db.prepare('SELECT title FROM trips WHERE id = ?').get(tripId) as { title: string } | undefined;
+      const params: Record<string, string> = { trip: tripInfo?.title || 'Untitled', actor: actor.email, tripId: String(tripId) };
+      if (preview !== undefined) params.preview = preview;
+      send({ event: 'collab_message', actorId: actor.id, scope: 'trip', targetId: Number(tripId), params }).catch(() => {});
+    });
+  }
+}

server/src/nest/common/idempotency.interceptor.ts

@@ -0,0 +1,90 @@
+import { CallHandler, ExecutionContext, HttpException, Injectable, NestInterceptor } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { Observable, of } from 'rxjs';
+import { DatabaseService } from '../database/database.service';
+
+/**
+ * Nest counterpart of the legacy `applyIdempotency` middleware
+ * (server/src/middleware/idempotency.ts), which the Express `authenticate`
+ * middleware runs on every authenticated request.
+ *
+ * The TREK client attaches an `X-Idempotency-Key` to ALL write operations (see
+ * client/src/api/client.ts) and the offline sync queue replays mutations with
+ * that key, so a migrated mutating route MUST honour it — otherwise a replayed
+ * POST would create a duplicate instead of returning the cached response. This
+ * reproduces the legacy behaviour exactly, against the same `idempotency_keys`
+ * table:
+ *   - non-mutating method, or no key, or no authenticated user -> pass through
+ *   - key longer than the cap -> 400 with the exact legacy message
+ *   - (key, user, method, path) already stored -> replay the cached response
+ *   - otherwise -> capture a successful JSON response under the key
+ *
+ * Capturing wraps `res.json`, so 204 / `res.end()` responses are not cached —
+ * matching the Express wrapper, which only fires on `res.json`.
+ */
+
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const MAX_KEY_LENGTH = 128;
+const MAX_CACHED_BODY_BYTES = 256 * 1024;
+
+interface IdempotencyRow {
+  status_code: number;
+  response_body: string;
+}
+
+@Injectable()
+export class IdempotencyInterceptor implements NestInterceptor {
+  constructor(private readonly database: DatabaseService) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const req = context.switchToHttp().getRequest<Request & { user?: { id: number } }>();
+    const res = context.switchToHttp().getResponse<Response>();
+
+    if (!MUTATING_METHODS.has(req.method)) return next.handle();
+
+    const key = req.headers['x-idempotency-key'] as string | undefined;
+    if (!key) return next.handle();
+
+    // Idempotency only applies to authenticated requests — the legacy code runs
+    // inside `authenticate`, after req.user is set.
+    const userId = req.user?.id;
+    if (userId == null) return next.handle();
+
+    if (key.length > MAX_KEY_LENGTH) {
+      throw new HttpException({ error: 'X-Idempotency-Key exceeds maximum length of 128 characters' }, 400);
+    }
+
+    // Scope the lookup by method + path as well as user, so the same key replayed
+    // against a different endpoint can't return an unrelated cached body.
+    const existing = this.database.get<IdempotencyRow>(
+      'SELECT status_code, response_body FROM idempotency_keys WHERE key = ? AND user_id = ? AND method = ? AND path = ?',
+      key, userId, req.method, req.path,
+    );
+    if (existing) {
+      res.status(existing.status_code);
+      return of(JSON.parse(existing.response_body));
+    }
+
+    const originalJson = res.json.bind(res);
+    const database = this.database;
+    res.json = function (body: unknown): Response {
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        try {
+          const serialized = JSON.stringify(body);
+          if (serialized.length <= MAX_CACHED_BODY_BYTES) {
+            database.run(
+              `INSERT OR IGNORE INTO idempotency_keys (key, user_id, method, path, status_code, response_body, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?)`,
+              key, userId, req.method, req.path, res.statusCode, serialized, Math.floor(Date.now() / 1000),
+            );
+          }
+        } catch {
+          // Non-fatal: if storage fails, the request still succeeds.
+        }
+      }
+      return originalJson(body);
+    };
+
+    return next.handle();
+  }
+}

server/src/nest/common/trek-exception.filter.ts

@@ -0,0 +1,69 @@
+import { ArgumentsHost, Catch, ExceptionFilter, HttpException } from '@nestjs/common';
+import type { Response } from 'express';
+import { MulterError } from 'multer';
+
+/**
+ * Normalises every Nest exception to TREK's legacy error envelope so migrated
+ * routes are byte-identical for the client. This mirrors the legacy global
+ * Express error handler (server/src/app.ts) exactly:
+ *   - multer errors            -> 413 (LIMIT_FILE_SIZE) / 400, body { error: <multer message> }
+ *   - { error, code? } bodies  -> passed through unchanged (auth guards, ZodValidationPipe)
+ *   - other HttpExceptions     -> { error: <message> } at the same status
+ *   - plain errors w/ statusCode/status -> that status, { error: <message> } for 4xx
+ *   - everything else          -> 500 { error: 'Internal server error' }
+ *
+ * Without the multer + statusCode handling, file-upload rejections (multer's
+ * LIMIT_FILE_SIZE and the fileFilter errors that carry `statusCode = 400`) would
+ * collapse to Nest's `{ statusCode, message, error }` 413 body or a 500, diverging
+ * from the legacy `{ error: 'File too large' }` (413) and `{ error: '<reason>' }` (400).
+ */
+@Catch()
+export class TrekExceptionFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost): void {
+    const res = host.switchToHttp().getResponse<Response>();
+
+    // 1. Raw multer errors that slipped past @nestjs/platform-express's
+    //    transformException (it leaves codes it does not recognise untouched).
+    //    Legacy: LIMIT_FILE_SIZE -> 413, everything else -> 400, body { error: message }.
+    if (exception instanceof MulterError) {
+      const status = exception.code === 'LIMIT_FILE_SIZE' ? 413 : 400;
+      res.status(status).json({ error: exception.message });
+      return;
+    }
+
+    if (exception instanceof HttpException) {
+      const status = exception.getStatus();
+      const body = exception.getResponse();
+
+      if (body && typeof body === 'object') {
+        const obj = body as Record<string, unknown>;
+        // TREK-native shape ({ error } / { error, code } from guards + the Zod
+        // pipe): pass through verbatim. Nest's own exceptions instead carry the
+        // { statusCode, message, error } trio (incl. transformException's
+        // PayloadTooLargeException for LIMIT_FILE_SIZE) and must be normalised.
+        if ('error' in obj && !('statusCode' in obj) && !('message' in obj)) {
+          res.status(status).json(obj);
+          return;
+        }
+        const raw = obj.message ?? obj.error;
+        const message =
+          status < 500 ? (Array.isArray(raw) ? raw.join(', ') : String(raw ?? 'Error')) : 'Internal server error';
+        res.status(status).json({ error: message });
+        return;
+      }
+
+      const message = status < 500 ? String(body ?? 'Error') : 'Internal server error';
+      res.status(status).json({ error: message });
+      return;
+    }
+
+    // 2. Plain errors carrying an explicit status (the fileFilter rejections set
+    //    `statusCode = 400`; transformException returns them unchanged). Legacy:
+    //    status = err.statusCode || err.status || 500; 4xx exposes err.message.
+    const err = exception as { statusCode?: number; status?: number; message?: unknown } | null;
+    const status = (err && (err.statusCode || err.status)) || 500;
+    if (status >= 500) console.error('Unhandled error:', exception);
+    const message = status < 500 ? String(err?.message ?? 'Error') : 'Internal server error';
+    res.status(status).json({ error: message });
+  }
+}

server/src/nest/common/zod-validation.pipe.ts

@@ -0,0 +1,26 @@
+import { ArgumentMetadata, HttpException, Injectable, PipeTransform } from '@nestjs/common';
+import type { ZodType } from 'zod';
+
+/**
+ * Validates an incoming @Body()/@Query() against a Zod schema (from @trek/shared)
+ * and returns the parsed, typed value. On failure it throws TREK's error envelope
+ * `{ error: string }` with status 400 — the same shape the legacy routes produce,
+ * so the client's error handling is unaffected.
+ *
+ * Usage: `@Body(new ZodValidationPipe(someSchema)) dto: Dto`.
+ */
+@Injectable()
+export class ZodValidationPipe implements PipeTransform {
+  constructor(private readonly schema: ZodType) {}
+
+  transform(value: unknown, _metadata: ArgumentMetadata): unknown {
+    const result = this.schema.safeParse(value);
+    if (!result.success) {
+      const message = result.error.issues
+        .map((i) => `${i.path.join('.') || 'body'}: ${i.message}`)
+        .join('; ');
+      throw new HttpException({ error: message }, 400);
+    }
+    return result.data;
+  }
+}

server/src/nest/config/config.controller.ts

@@ -0,0 +1,18 @@
+import { Controller, Get } from '@nestjs/common';
+import type { PublicConfig } from '@trek/shared';
+import { DEFAULT_LANGUAGE } from '../../config';
+
+/**
+ * /api/config — public (unauthenticated) bootstrap config.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/publicConfig.ts):
+ * no auth guard, returns the server's configured default language. Deliberately
+ * has no service — it just surfaces a config constant, exactly like the original.
+ */
+@Controller('api/config')
+export class ConfigController {
+  @Get()
+  getConfig(): PublicConfig {
+    return { defaultLanguage: DEFAULT_LANGUAGE };
+  }
+}

server/src/nest/config/config.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { ConfigController } from './config.controller';
+
+/** Public config domain (L2 leaf module). Registered in AppModule. */
+@Module({
+  controllers: [ConfigController],
+})
+export class ConfigModule {}

server/src/nest/database/database.module.ts

@@ -0,0 +1,13 @@
+import { Global, Module } from '@nestjs/common';
+import { DatabaseService } from './database.service';
+
+/**
+ * Global so every migrated module can inject DatabaseService without re-importing.
+ * Wraps the existing better-sqlite3 singleton (no new connection).
+ */
+@Global()
+@Module({
+  providers: [DatabaseService],
+  exports: [DatabaseService],
+})
+export class DatabaseModule {}

server/src/nest/database/database.service.ts

@@ -0,0 +1,39 @@
+import { Injectable } from '@nestjs/common';
+import type Database from 'better-sqlite3';
+import { db } from '../../db/database';
+
+/**
+ * Injectable wrapper around TREK's existing better-sqlite3 connection.
+ *
+ * `db` is a Proxy onto the singleton connection the legacy app already uses
+ * (WAL enabled), so Nest modules share the exact same connection — no second
+ * connection, no split state, single writer preserved.
+ */
+@Injectable()
+export class DatabaseService {
+  /** The shared better-sqlite3 connection (same singleton the legacy app uses). */
+  get connection(): Database.Database {
+    return db;
+  }
+
+  prepare(sql: string): Database.Statement {
+    return db.prepare(sql);
+  }
+
+  get<T = unknown>(sql: string, ...params: unknown[]): T | undefined {
+    return db.prepare(sql).get(...params) as T | undefined;
+  }
+
+  all<T = unknown>(sql: string, ...params: unknown[]): T[] {
+    return db.prepare(sql).all(...params) as T[];
+  }
+
+  run(sql: string, ...params: unknown[]): Database.RunResult {
+    return db.prepare(sql).run(...params);
+  }
+
+  /** Run `fn` inside a synchronous better-sqlite3 transaction. */
+  transaction<T>(fn: (conn: Database.Database) => T): T {
+    return db.transaction(() => fn(db))();
+  }
+}

server/src/nest/days/day-notes.controller.ts

@@ -0,0 +1,127 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  UseGuards,
+} from '@nestjs/common';
+import type { User } from '../../types';
+import { DayNotesService } from './day-notes.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+type DayNoteBody = { text?: string; time?: string; icon?: string; sort_order?: number };
+
+// Mirrors the legacy validateStringLengths({ text: 500, time: 150 }) middleware,
+// which runs BEFORE the trip-access check — so an over-long field 400s first.
+const MAX_LENGTHS: Record<string, number> = { text: 500, time: 150 };
+
+function validateLengths(body: Record<string, unknown>): void {
+  for (const [field, max] of Object.entries(MAX_LENGTHS)) {
+    const value = body[field];
+    if (value && typeof value === 'string' && value.length > max) {
+      throw new HttpException({ error: `${field} must be ${max} characters or less` }, 400);
+    }
+  }
+}
+
+/**
+ * /api/trips/:tripId/days/:dayId/notes — free-text annotations on a day.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/dayNotes.ts):
+ * the string-length guard runs first (400), then trip access (404), then the
+ * 'day_edit' permission (403); create 201 / rest 200; the bespoke "Day not
+ * found" / "Note not found" / "Text required" bodies; WebSocket broadcasts with
+ * the forwarded X-Socket-Id.
+ */
+@Controller('api/trips/:tripId/days/:dayId/notes')
+@UseGuards(JwtAuthGuard)
+export class DayNotesController {
+  constructor(private readonly notes: DayNotesService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.notes.verifyTripAccess(tripId, user.id);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+    return trip;
+  }
+
+  private requireEdit(trip: NonNullable<ReturnType<DayNotesService['verifyTripAccess']>>, user: User): void {
+    if (!this.notes.canEdit(trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+  }
+
+  @Get()
+  list(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('dayId') dayId: string) {
+    this.requireTrip(tripId, user);
+    return { notes: this.notes.list(dayId, tripId) };
+  }
+
+  @Post()
+  create(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Body() body: DayNoteBody,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    validateLengths(body);
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.notes.dayExists(dayId, tripId)) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    if (!body.text?.trim()) {
+      throw new HttpException({ error: 'Text required' }, 400);
+    }
+    const note = this.notes.create(dayId, tripId, body.text, body.time, body.icon, body.sort_order);
+    this.notes.broadcast(tripId, 'dayNote:created', { dayId: Number(dayId), note }, socketId);
+    return { note };
+  }
+
+  @Put(':id')
+  update(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Param('id') id: string,
+    @Body() body: DayNoteBody,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    validateLengths(body);
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const current = this.notes.getNote(id, dayId, tripId);
+    if (!current) {
+      throw new HttpException({ error: 'Note not found' }, 404);
+    }
+    const note = this.notes.update(id, current as never, { text: body.text, time: body.time, icon: body.icon, sort_order: body.sort_order });
+    this.notes.broadcast(tripId, 'dayNote:updated', { dayId: Number(dayId), note }, socketId);
+    return { note };
+  }
+
+  @Delete(':id')
+  remove(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('dayId') dayId: string,
+    @Param('id') id: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.notes.getNote(id, dayId, tripId)) {
+      throw new HttpException({ error: 'Note not found' }, 404);
+    }
+    this.notes.remove(id);
+    this.notes.broadcast(tripId, 'dayNote:deleted', { noteId: Number(id), dayId: Number(dayId) }, socketId);
+    return { success: true };
+  }
+}

server/src/nest/days/day-notes.service.ts

@@ -0,0 +1,50 @@
+import { Injectable } from '@nestjs/common';
+import { broadcast } from '../../websocket';
+import { checkPermission } from '../../services/permissions';
+import type { User } from '../../types';
+import * as dayNoteService from '../../services/dayNoteService';
+
+type Trip = NonNullable<ReturnType<typeof dayNoteService.verifyTripAccess>>;
+
+/**
+ * Thin Nest wrapper around the existing day-note service. Trip access + the
+ * 'day_edit' permission reuse the legacy checks; the SQL is unchanged.
+ */
+@Injectable()
+export class DayNotesService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return dayNoteService.verifyTripAccess(tripId, userId);
+  }
+
+  canEdit(trip: Trip, user: User): boolean {
+    return checkPermission('day_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  list(dayId: string, tripId: string) {
+    return dayNoteService.listNotes(dayId, tripId);
+  }
+
+  dayExists(dayId: string, tripId: string) {
+    return dayNoteService.dayExists(dayId, tripId);
+  }
+
+  getNote(id: string, dayId: string, tripId: string) {
+    return dayNoteService.getNote(id, dayId, tripId);
+  }
+
+  create(dayId: string, tripId: string, text: string, time?: string, icon?: string, sortOrder?: number) {
+    return dayNoteService.createNote(dayId, tripId, text, time, icon, sortOrder);
+  }
+
+  update(id: string, current: Parameters<typeof dayNoteService.updateNote>[1], fields: { text?: string; time?: string; icon?: string; sort_order?: number }) {
+    return dayNoteService.updateNote(id, current, fields);
+  }
+
+  remove(id: string): void {
+    dayNoteService.deleteNote(id);
+  }
+}

server/src/nest/days/days.controller.ts

@@ -0,0 +1,132 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpException,
+  Param,
+  Post,
+  Put,
+  UseGuards,
+} from '@nestjs/common';
+import type { User } from '../../types';
+import { DaysService } from './days.service';
+import { DayReorderError } from '../../services/dayService';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+
+/**
+ * /api/trips/:tripId/days — trip itinerary days.
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/days.ts): trip
+ * access (404 "Trip not found"), the 'day_edit' permission on mutations (403),
+ * create 201 / rest 200, the bespoke 404 "Day not found", and WebSocket
+ * broadcasts with the forwarded X-Socket-Id.
+ */
+@Controller('api/trips/:tripId/days')
+@UseGuards(JwtAuthGuard)
+export class DaysController {
+  constructor(private readonly days: DaysService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.days.verifyTripAccess(tripId, user.id);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+    return trip;
+  }
+
+  private requireEdit(trip: NonNullable<ReturnType<DaysService['verifyTripAccess']>>, user: User): void {
+    if (!this.days.canEdit(trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+  }
+
+  @Get()
+  list(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    this.requireTrip(tripId, user);
+    return this.days.list(tripId);
+  }
+
+  @Post()
+  create(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { date?: string; notes?: string; position?: number },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    // A `position` means "insert a new empty day here" (which on a dated trip
+    // extends the trip and re-pins dates); without it, the legacy append.
+    const day = body.position !== undefined
+      ? this.days.insert(tripId, body.position)
+      : this.days.create(tripId, body.date, body.notes);
+    // An insert can shuffle dates/positions of other days, so collaborators
+    // refetch the whole list; a plain append only needs the new day.
+    const event = body.position !== undefined ? 'day:reordered' : 'day:created';
+    this.days.broadcast(tripId, event, { day }, socketId);
+    return { day };
+  }
+
+  @Put('reorder')
+  reorder(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { orderedIds?: number[] },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!Array.isArray(body.orderedIds)) {
+      throw new HttpException({ error: 'orderedIds must be an array' }, 400);
+    }
+    try {
+      this.days.reorder(tripId, body.orderedIds);
+    } catch (err) {
+      if (err instanceof DayReorderError) {
+        throw new HttpException({ error: err.message }, 400);
+      }
+      throw err;
+    }
+    this.days.broadcast(tripId, 'day:reordered', { orderedIds: body.orderedIds }, socketId);
+    return { success: true };
+  }
+
+  @Put(':id')
+  update(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body() body: { notes?: string; title?: string | null },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    const current = this.days.getDay(id, tripId);
+    if (!current) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    const day = this.days.update(id, current as never, { notes: body.notes, title: body.title });
+    this.days.broadcast(tripId, 'day:updated', { day }, socketId);
+    return { day };
+  }
+
+  @Delete(':id')
+  remove(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.days.getDay(id, tripId)) {
+      throw new HttpException({ error: 'Day not found' }, 404);
+    }
+    this.days.remove(id);
+    this.days.broadcast(tripId, 'day:deleted', { dayId: Number(id) }, socketId);
+    return { success: true };
+  }
+}

server/src/nest/days/days.module.ts

@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { DaysController } from './days.controller';
+import { DaysService } from './days.service';
+import { DayNotesController } from './day-notes.controller';
+import { DayNotesService } from './day-notes.service';
+
+/**
+ * Days + day-notes domain (S6 — Phase 2 trip sub-domain). The single prefix
+ * /api/trips/:tripId/days covers both the days mount and the nested
+ * /days/:dayId/notes mount.
+ */
+@Module({
+  controllers: [DaysController, DayNotesController],
+  providers: [DaysService, DayNotesService],
+})
+export class DaysModule {}

server/src/nest/days/days.service.ts

@@ -0,0 +1,57 @@
+import { Injectable } from '@nestjs/common';
+import { broadcast } from '../../websocket';
+import { canAccessTrip } from '../../db/database';
+import { checkPermission } from '../../services/permissions';
+import type { User } from '../../types';
+import * as dayService from '../../services/dayService';
+
+type Trip = { user_id: number };
+
+/**
+ * Thin Nest wrapper around the day parts of the existing day service. Trip access
+ * mirrors the requireTripAccess middleware (canAccessTrip); mutations use the
+ * 'day_edit' permission. The SQL and the day/assignment shaping reuse the legacy
+ * code unchanged.
+ */
+@Injectable()
+export class DaysService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return canAccessTrip(Number(tripId), userId) as Trip | null | undefined;
+  }
+
+  canEdit(trip: Trip, user: User): boolean {
+    return checkPermission('day_edit', user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  list(tripId: string) {
+    return dayService.listDays(tripId);
+  }
+
+  getDay(id: string, tripId: string) {
+    return dayService.getDay(id, tripId);
+  }
+
+  create(tripId: string, date?: string, notes?: string) {
+    return dayService.createDay(tripId, date, notes);
+  }
+
+  insert(tripId: string, position?: number) {
+    return dayService.insertDay(tripId, position);
+  }
+
+  reorder(tripId: string, orderedIds: number[]) {
+    return dayService.reorderDays(tripId, orderedIds);
+  }
+
+  update(id: string, current: Parameters<typeof dayService.updateDay>[1], fields: { notes?: string; title?: string | null }) {
+    return dayService.updateDay(id, current, fields);
+  }
+
+  remove(id: string): void {
+    dayService.deleteDay(id);
+  }
+}

server/src/nest/files/files-download.controller.ts

@@ -0,0 +1,58 @@
+import { Controller, Get, HttpException, Param, Req, Res } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import path from 'path';
+import fs from 'fs';
+import { FilesService } from './files.service';
+
+/**
+ * GET /api/trips/:tripId/files/:id/download — authenticated file download.
+ *
+ * Deliberately NOT behind the JwtAuthGuard: it accepts a cookie, a Bearer header
+ * OR a one-shot `?token=` query param (so links can be opened directly), all via
+ * the legacy authenticateDownload helper. Byte-identical to the legacy route:
+ * 401 token, 404 trip/file, 403 path traversal, .pkpass served inline for Wallet.
+ */
+@Controller('api/trips/:tripId/files')
+export class FilesDownloadController {
+  constructor(private readonly files: FilesService) {}
+
+  @Get(':id/download')
+  download(@Req() req: Request, @Res() res: Response, @Param('tripId') tripId: string, @Param('id') id: string): void {
+    const auth = this.files.authenticateDownload(req);
+    if ('error' in auth) {
+      throw new HttpException({ error: auth.error }, auth.status);
+    }
+
+    const trip = this.files.verifyTripAccess(tripId, auth.userId);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+
+    const file = this.files.getFileById(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+
+    const { resolved, safe } = this.files.resolveFilePath(file.filename);
+    if (!safe) {
+      throw new HttpException({ error: 'Forbidden' }, 403);
+    }
+    if (!fs.existsSync(resolved)) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+
+    // Serve Apple Wallet passes inline with the canonical MIME type so Safari
+    // (iOS/macOS) hands them to Wallet instead of downloading as a blob.
+    if (path.extname(resolved).toLowerCase() === '.pkpass') {
+      res.setHeader('Content-Type', 'application/vnd.apple.pkpass');
+      res.setHeader('Content-Disposition', `inline; filename="${path.basename(file.original_name || resolved)}"`);
+    }
+
+    // Serve with an explicit { root } + basename rather than an absolute path:
+    // under the Nest ExpressAdapter, res.sendFile(absolutePath) resolves the
+    // file relative to the (rewritten) req.url and fails with a spurious
+    // "Not Found", whereas the root-relative form streams correctly. The
+    // resolveFilePath guard above already pins this to the uploads dir.
+    res.sendFile(path.basename(resolved), { root: path.dirname(resolved) });
+  }
+}

server/src/nest/files/files.controller.ts

@@ -0,0 +1,225 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  HttpCode,
+  HttpException,
+  Param,
+  Patch,
+  Post,
+  Put,
+  Query,
+  UploadedFile,
+  UseGuards,
+  UseInterceptors,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { diskStorage } from 'multer';
+import path from 'path';
+import fs from 'fs';
+import { v4 as uuidv4 } from 'uuid';
+import type { User } from '../../types';
+import { FilesService } from './files.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { MAX_FILE_SIZE, BLOCKED_EXTENSIONS, filesDir, getAllowedExtensions } from '../../services/fileService';
+import { isDemoEmail } from '../../services/demo';
+
+const UPLOAD = {
+  storage: diskStorage({
+    destination: (_req, _file, cb) => { if (!fs.existsSync(filesDir)) fs.mkdirSync(filesDir, { recursive: true }); cb(null, filesDir); },
+    filename: (_req, file, cb) => cb(null, `${uuidv4()}${path.extname(file.originalname)}`),
+  }),
+  limits: { fileSize: MAX_FILE_SIZE },
+  defParamCharset: 'utf8', // parity with legacy routes/files.ts — preserve non-ASCII original filenames
+  fileFilter: (_req: unknown, file: Express.Multer.File, cb: (err: Error | null, accept: boolean) => void) => {
+    const ext = path.extname(file.originalname).toLowerCase();
+    const reject = () => {
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      cb(err, false);
+    };
+    if (BLOCKED_EXTENSIONS.includes(ext) || file.mimetype.includes('svg')) return reject();
+    const allowed = getAllowedExtensions().split(',').map((e) => e.trim().toLowerCase());
+    const fileExt = ext.replace('.', '');
+    if (allowed.includes(fileExt) || (allowed.includes('*') && !BLOCKED_EXTENSIONS.includes(ext))) return cb(null, true);
+    reject();
+  },
+};
+
+/**
+ * /api/trips/:tripId/files — trip file manager (upload, metadata, starring,
+ * trash + restore, reservation links). The authenticated download lives in the
+ * separate unguarded FilesDownloadController (it carries its own token auth).
+ *
+ * Byte-identical to the legacy Express route (server/src/routes/files.ts): trip
+ * access (404), the demo-mode upload block (403), the file_upload/file_edit/
+ * file_delete permissions (403), create 201 / rest 200, the bespoke bodies and
+ * the WebSocket broadcasts with the forwarded X-Socket-Id.
+ */
+@Controller('api/trips/:tripId/files')
+@UseGuards(JwtAuthGuard)
+export class FilesController {
+  constructor(private readonly files: FilesService) {}
+
+  private requireTrip(tripId: string, user: User) {
+    const trip = this.files.verifyTripAccess(tripId, user.id);
+    if (!trip) {
+      throw new HttpException({ error: 'Trip not found' }, 404);
+    }
+    return trip;
+  }
+
+  @Get()
+  list(@CurrentUser() user: User, @Param('tripId') tripId: string, @Query('trash') trash?: string) {
+    this.requireTrip(tripId, user);
+    return { files: this.files.listFiles(tripId, trash === 'true') };
+  }
+
+  @Post()
+  @UseInterceptors(FileInterceptor('file', UPLOAD))
+  upload(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @UploadedFile() file: Express.Multer.File | undefined,
+    @Body() body: { place_id?: string; description?: string; reservation_id?: string },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    if (process.env.DEMO_MODE?.toLowerCase() === 'true' && isDemoEmail(user.email)) {
+      throw new HttpException({ error: 'Uploads are disabled in demo mode. Self-host TREK for full functionality.' }, 403);
+    }
+    if (!this.files.can('file_upload', trip, user)) {
+      throw new HttpException({ error: 'No permission to upload files' }, 403);
+    }
+    if (!file) {
+      throw new HttpException({ error: 'No file uploaded' }, 400);
+    }
+    const created = this.files.createFile(tripId, file, user.id, {
+      place_id: body.place_id,
+      description: body.description,
+      reservation_id: body.reservation_id,
+    });
+    this.files.broadcast(tripId, 'file:created', { file: created }, socketId);
+    return { file: created };
+  }
+
+  @Put(':id')
+  update(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body() body: { description?: string; place_id?: string | null; reservation_id?: string | null }, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_edit', trip, user)) {
+      throw new HttpException({ error: 'No permission to edit files' }, 403);
+    }
+    const file = this.files.getFileById(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+    const updated = this.files.updateFile(id, file, { description: body.description, place_id: body.place_id, reservation_id: body.reservation_id });
+    this.files.broadcast(tripId, 'file:updated', { file: updated }, socketId);
+    return { file: updated };
+  }
+
+  @Patch(':id/star')
+  star(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_edit', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    const file = this.files.getFileById(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+    const updated = this.files.toggleStarred(id, file.starred);
+    this.files.broadcast(tripId, 'file:updated', { file: updated }, socketId);
+    return { file: updated };
+  }
+
+  @Delete('trash/empty')
+  async emptyTrash(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_delete', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    const deleted = await this.files.emptyTrash(tripId);
+    return { success: true, deleted };
+  }
+
+  @Delete(':id/permanent')
+  async permanent(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_delete', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    const file = this.files.getDeletedFile(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found in trash' }, 404);
+    }
+    await this.files.permanentDeleteFile(file);
+    this.files.broadcast(tripId, 'file:deleted', { fileId: Number(id) }, socketId);
+    return { success: true };
+  }
+
+  @Delete(':id')
+  remove(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_delete', trip, user)) {
+      throw new HttpException({ error: 'No permission to delete files' }, 403);
+    }
+    const file = this.files.getFileById(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+    this.files.softDeleteFile(id);
+    this.files.broadcast(tripId, 'file:deleted', { fileId: Number(id) }, socketId);
+    return { success: true };
+  }
+
+  @Post(':id/restore')
+  @HttpCode(200) // Express answers restore with res.json (200), not the POST-default 201.
+  restore(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Headers('x-socket-id') socketId?: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_delete', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    const file = this.files.getDeletedFile(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found in trash' }, 404);
+    }
+    const restored = this.files.restoreFile(id);
+    this.files.broadcast(tripId, 'file:created', { file: restored }, socketId);
+    return { file: restored };
+  }
+
+  @Post(':id/link')
+  @HttpCode(200) // Express answers link with res.json (200).
+  link(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Body() body: { reservation_id?: string | null; assignment_id?: string | null; place_id?: string | null }) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_edit', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    const file = this.files.getFileById(id, tripId);
+    if (!file) {
+      throw new HttpException({ error: 'File not found' }, 404);
+    }
+    const links = this.files.createFileLink(id, { reservation_id: body.reservation_id, assignment_id: body.assignment_id, place_id: body.place_id });
+    return { success: true, links };
+  }
+
+  @Delete(':id/link/:linkId')
+  unlink(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string, @Param('linkId') linkId: string) {
+    const trip = this.requireTrip(tripId, user);
+    if (!this.files.can('file_edit', trip, user)) {
+      throw new HttpException({ error: 'No permission' }, 403);
+    }
+    this.files.deleteFileLink(linkId, id);
+    return { success: true };
+  }
+
+  @Get(':id/links')
+  links(@CurrentUser() user: User, @Param('tripId') tripId: string, @Param('id') id: string) {
+    this.requireTrip(tripId, user);
+    return { links: this.files.getFileLinks(id) };
+  }
+}

server/src/nest/files/files.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { FilesController } from './files.controller';
+import { FilesDownloadController } from './files-download.controller';
+import { FilesService } from './files.service';
+
+@Module({
+  controllers: [FilesController, FilesDownloadController],
+  providers: [FilesService],
+})
+export class FilesModule {}

server/src/nest/files/files.service.ts

@@ -0,0 +1,49 @@
+import { Injectable } from '@nestjs/common';
+import type { Request } from 'express';
+import { broadcast } from '../../websocket';
+import { checkPermission } from '../../services/permissions';
+import type { User, TripFile } from '../../types';
+import * as svc from '../../services/fileService';
+
+type Trip = NonNullable<ReturnType<typeof svc.verifyTripAccess>>;
+type FilePermission = 'file_upload' | 'file_edit' | 'file_delete';
+
+/**
+ * Thin Nest wrapper around the existing file service. Trip access, the
+ * file_* permissions, the SQL, the path-resolution guard, the download-token
+ * auth and the WebSocket broadcasts reuse the legacy code unchanged.
+ */
+@Injectable()
+export class FilesService {
+  verifyTripAccess(tripId: string, userId: number) {
+    return svc.verifyTripAccess(tripId, userId);
+  }
+
+  can(action: FilePermission, trip: Trip, user: User): boolean {
+    return checkPermission(action, user.role, trip.user_id, user.id, trip.user_id !== user.id);
+  }
+
+  broadcast(tripId: string, event: string, payload: Record<string, unknown>, socketId: string | undefined): void {
+    broadcast(tripId, event, payload, socketId);
+  }
+
+  // Download-token auth + safe path resolution (used by the unguarded download route).
+  authenticateDownload(req: Request) { return svc.authenticateDownload(req); }
+  resolveFilePath(filename: string) { return svc.resolveFilePath(filename); }
+
+  listFiles(tripId: string, showTrash: boolean) { return svc.listFiles(tripId, showTrash); }
+  getFileById(id: string, tripId: string) { return svc.getFileById(id, tripId); }
+  getDeletedFile(id: string, tripId: string) { return svc.getDeletedFile(id, tripId); }
+  createFile(tripId: string, file: Parameters<typeof svc.createFile>[1], userId: number, opts: Parameters<typeof svc.createFile>[3]) {
+    return svc.createFile(tripId, file, userId, opts);
+  }
+  updateFile(id: string, current: TripFile, updates: Parameters<typeof svc.updateFile>[2]) { return svc.updateFile(id, current, updates); }
+  toggleStarred(id: string, currentStarred: number | undefined) { return svc.toggleStarred(id, currentStarred); }
+  softDeleteFile(id: string) { return svc.softDeleteFile(id); }
+  restoreFile(id: string) { return svc.restoreFile(id); }
+  permanentDeleteFile(file: TripFile) { return svc.permanentDeleteFile(file); }
+  emptyTrash(tripId: string) { return svc.emptyTrash(tripId); }
+  createFileLink(id: string, opts: Parameters<typeof svc.createFileLink>[1]) { return svc.createFileLink(id, opts); }
+  deleteFileLink(linkId: string, id: string) { return svc.deleteFileLink(linkId, id); }
+  getFileLinks(id: string) { return svc.getFileLinks(id); }
+}