153 Commits

Author	SHA1	Message	Date
jubnl	d7c4324afc	chore(capacitor): base files for capacitor (#2020) ... * chore(capacitor): base files for capacitor * chore(capacitor): base plugins * feat(auth): hand a browser sign-in over to the native app The native apps show the server's own UI in a WebView, where neither SSO nor passkeys can run. They sign in through the system browser instead and need a way to carry that session back. The app keeps a random verifier and sends only its sha256 into the browser. Once signed in there, the browser trades that challenge for a one-time code (cookie session only, so an API or MCP token cannot mint itself a browser session), and the WebView redeems the code together with the verifier. The code rides through a URL scheme any app could claim, so on its own it is worthless; it is single use and good for a minute. Also: /api/health/features reports nativeApp so the apps can refuse servers that predate this, and hashed files under assets/ are served immutable, which the iOS app needs to start offline without a service worker. * feat(native): the apps load the server's own UI The apps ship only an address screen now. Once a server is picked, the native side points the WebView at it: TrekBridgeViewController on iOS and a config copy with server.url on Android. The UI then comes from that server, in the version it runs and on its own origin, so the session cookie, uploads, /ws and plugins work exactly as in a browser and no app release has to keep pace with the servers out there. The address screen (native-shell/, built into native-dist/) probes /api/health/features through native HTTP, tries https before http when no scheme was typed, and refuses servers without the nativeApp flag. It also serves as the error page when the remembered server does not load: retry, change server, or on iOS the stored copy of the server's start page. TrekShell is the app's own plugin for all of that: remember, change and reload the server, sign in through ASWebAuthenticationSession or a Custom Tab, and on iOS keep and open the offline copy of the start page, because WKWebView runs no service worker for a domain the app does not list. Plugins the frame does not use are gone (push, camera, geolocation, calendar, file transfer, in-app browser and more): the WebView covers the camera and location itself, and push needs a relay before it is worth shipping. With them go the push entitlement, the calendar usage strings and the Firebase bits. The iOS scheme falls back to capacitor://, since Capacitor drops an iosScheme of https, and the arm64 capability replaces armv7. * feat(native): the UI knows when it runs inside the app Everything the server's UI does differently inside the iOS and Android app lives under src/native and is inert in a browser. Sign-in: SSO and the passkey button go through the system browser (signInThroughBrowser), because identity providers refuse embedded browsers and WebAuthn needs a domain association no build can have for every server. The browser end is the new /native-handoff page: it signs the user in if needed and hands the session over only after an explicit tap, so a link carrying somebody else's challenge cannot pass a session on silently. The verifier is hashed with @noble/hashes because crypto.subtle is missing on the plain-http servers many home networks use. An OIDC-only install no longer bounces to the IdP inside the WebView, and passkey management is hidden in the app. Downloads: the WebView cannot save a blob, so downloadBlob, downloadFile and openFile write to the app cache and open the share sheet. The eight places that built their own download anchor now use downloadBlob, which they should have anyway. The rest: "Change server" on the login page and in the account settings, the splash hides after the first frame, Android's back button walks history before it leaves the app, the status bar follows the scheme, and on iOS the start page is refreshed and every chunk of the build (listed in the new asset-manifest.json) is pulled into WebKit's cache so the app can start without network. * ci(native): build the Android and iOS shells on every change to them Compiles the Swift side on a macOS runner so nobody needs a Mac to know it still builds, and leaves a debug APK on every run to install on a phone. Unsigned: signing and store uploads need secrets fork PRs do not get. * feat(native): offline vector maps in the iOS app In a browser the service worker answers MapLibre from the gl-map-offline cache that glPrefetcher fills for trips marked for offline. The iOS app has no service worker, so nothing read that cache there and the map went blank without network. A trek-offline:// protocol takes the service worker's place. Inside the iOS app the MapLibre style URL is rewritten to it, the handler rewrites every https URL inside the style and its TileJSON the same way, and then serves documents network first and tiles, glyphs and sprites cache first. Outside the iOS app nothing changes. The default OpenFreeMap basemap is covered; Mapbox GL has no protocol hook and stays online-only in the app, as does a custom raster template, whose opaque responses only a service worker can store. * fix(native): keep the iOS offline copy inside the app loadSimulatedRequest went to the server URL without its trailing slash, and Capacitor keeps a navigation in the WebView only when it starts with the bridge's serverURL, slash included. The offline start page would have opened in Safari instead. Also covers the platform helpers and the hand-off API module. * feat(native): the small things that give a WebView away - A short haptic tap on success, warning and error toasts, which is where every save and delete already reports. Info toasts stay silent. - No "‹ › Done" strip above the iOS keyboard. - No Safari preview when a link is long-pressed. - The swipe from the left edge goes back on iOS, through the same history Android's back button walks. * test(mobile): the backup-code download revokes its URL after the shared delay The mobile twin of the AccountTab test still expected the object URL to be revoked in the same tick. Since both screens download through downloadBlob, the revoke happens after its 100 ms grace period. * fix(native): remember the login by default inside the app With the switch off the app got a session cookie, which dies with the app process, so every time the phone unloaded TREK the user had to sign in again. Found while running the Android build in the emulator. * fix(native): no overscroll stretch on Android The UI asks for no overscroll effect with overscroll-behavior: none on html, and Chrome honours it. The Android WebView draws the stretch on its root scroller natively, though, and it scales the whole view, so the top bar and the bottom dock were pulled along with the page. Found in the emulator. * fix(native): Android shows "server not reachable" instead of a blank page Capacitor injects its bridge on Android only into the server's origin once server.url is set, so the local error page it switches to when the server does not load had no bridge. It could neither retry nor change the server and stayed blank. TrekWebViewClient now catches a failed page load (a network error, or a 5xx from a proxy while TREK restarts) and the app starts over on the bundled address screen, where the bridge is present and the screen offers exactly those two choices. The server config no longer carries errorPath. Two traps on the way, both found in the emulator: a restart during launch has to be a fresh task, since recreate() leaves the system splash lying over the new page; and a restart shows no launch splash at all, because the splash plugin cannot take it down again when the page hides it early. * feat(native): TREK's own app icon and launch screen, named just TREK The shells still carried Capacitor's placeholder icon and splash, the blue X on a grid. They now show the white TREK mark on a dark, slightly glassy tile: a soft light from the top left and a sheen over the upper half, in the app's launch colour #09090b. Android 12+ draws its launch screen on the same colour instead of light grey. scripts/generate-app-icons.mjs renders the sources into assets/ from public/icons/icon-white.svg, and `npm run icons:app` turns them into every size both platforms ask for through @capacitor/assets. The Android foreground mark is sized for the adaptive icon's round mask. The home screen label is TREK: the old "TREK - Plan your trips!" was cut off under the icon, and the longer title belongs to the store listings. * fix(native): new lint warnings and the MapLibre protocol type after the dev merge Awaits that sat in loops in the native-auth tests run together, the hand-off hook marks its navigations as ignored, the native tests drop their non-null assertions, and the offline protocol answers with the data type MapLibre 6.15 expects. * fix(native): strict types in the address screen, Prettier on the native-auth e2e suite, file-local exports The address screen's element helper returns the plain element instead of Object.assign's intersection, which strict mode could not represent; the haptics test reads an optional argument as optional; three exports only their own file used are local now. * fix(native): Prettier on the native client files, rate-limit e2e requests in sequence Formats the files the client formatting gate listed, and NATIVE-E2E-005 sends its twenty exchange attempts one after another: all at once they reset the test server's connections. * fix(native): hide passkeys in the app through usePasskeys The flag in useAccountSettings grew the identical destructuring in both account views past the duplication threshold; the shared passkeys hook already decides when its card is hidden, so the app check lives there now. * feat(native): everything the App Store and Google Play submissions need - iOS: microphone usage text for "Take Video", no-export-compliance flag, ExportOptions.plist for App Store Connect uploads, the unused push forwarders gone; CI builds with Xcode 26 and lints the property lists. - Android: version and signing from Gradle properties (unsigned without them), R8 with keep rules for TREK's and Capacitor's reflective classes, no Auto Backup of the session cookie, no external file provider path, template and Firebase leftovers removed, keystores and service accounts ignored, full-size adaptive icon layers with a monochrome layer; CI also builds the release APK. - native-release.yml: signed bundle to a Play testing track and archive to TestFlight, by hand or on a v* tag, behind the store environment. - Version handshake: the server reports nativeApi 1, the app refuses a server below its minimum and tolerates an app older than the offline copy. - Address screen: privacy policy link, "Try the demo" and "What is a TREK server?"; the privacy link also in the app's server settings. Three new native strings in all 27 locales. - Donation links and the notices asking for one are hidden in the app. - Store listings for "TREK Travel Planner" in client/fastlane: texts, review notes with placeholders, privacy and account deletion page drafts, the feature graphic and icon, a length and image check in CI, and a Playwright store project with the scripts that turn its captures into screenshots. - Docs: wiki/Native-Apps.md, README no longer says there is no store app. * fix(native): read a notice button's href without a weak type An action button carries no href, so a parameter typed as only an optional href refused the notice DTO; the button type now names its kind as well. * feat(native): a welcoming onboarding for the address screen The app's own screen now opens on a welcome: the TREK mark, a line about what TREK is, and two clear paths — connect the TREK you already open in the browser, or get TREK Cloud. Both lead to polished screens: the address field with live validation, a shake and haptic on a bad address and a success tick before the server takes over; and a TREK Cloud intro with what it offers and a way in. Screens slide and stagger in, buttons give a tap, and it all respects the safe areas, light and dark, and reduced motion. Self-hosters are unaffected: cloud is its own path, never in the way. New native strings are added across all locales (English placeholders outside en/de, to translate). * feat(native): a plan picker for TREK Cloud, with live prices The Get TREK Cloud path now leads to a plan picker that reads the live plans from the site (/api/plans), so the prices and quotas always match the website. Monthly and yearly in a segmented toggle, the year marked with its saving, each plan a card with its price and what it includes. Subscribe is wired to finish on the web order for now; it becomes an Apple/Google in-app purchase once the store products exist. New strings across all locales (en and de translated). * feat(native): light status bar and a Go key on the address screen The address screen sits on the near-black surface, so set the status bar to draw its clock and icons in light while it is up; the server's own UI takes over the style once it loads. The address field's on-screen return key now reads Go. Both fail quietly where there is no native status bar (web, the simulator). * i18n(native): translate the onboarding into es, fr, it, nl and pl The welcome, TREK Cloud and plan-picker strings were English placeholders in every locale but en and de. The five largest remaining European languages are now translated in full; the others still carry the English text and are a follow-up for native speakers. * feat(native): the in-app TREK Cloud subscription flow After picking a plan, the app now carries the whole purchase itself when the build can take one: choose your address (checked for free as you type, against the same endpoint the website uses), your email, and subscribe. The receipt goes to /api/iap/redeem, and a Setting up your TREK screen waits on the new address and loads it the moment it answers. The purchase sits behind an IapClient seam (src/native/iap.ts): a fake drives the whole flow in development and preview, the native client reports itself unavailable until the store plugin and products exist, and until then the plan picker still finishes on the web, so nothing half-wired faces a customer. New claim and provisioning strings across all locales (en, de and the five largest European languages translated). * i18n(native): translate the app into the remaining 20 languages The onboarding, plan picker, claim and provisioning strings were English placeholders outside en, de and the five largest European languages. They are now translated in full across the other 20 locales (ar, az, br, ca, cs, et, gr, hu, id, ja, ko, ru, sk, sv, th, tr, uk, vi, zh, zh-TW), placeholders and brand kept. The app now speaks every language TREK does. * fix(i18n): add the Hebrew native strings, and correct the LoginPage size baseline The he locale had every domain but native.ts, which broke i18n parity, the shared coverage specs and the client parity test once the native strings existed. Add he/native.ts with all native keys translated. Also correct the LoginPage size baseline to its current line count. * i18n(native): excuse the TREK Cloud brand, mark Email same-as-en, exempt the quota counts The strict i18n checks, which the feature-branch CI does not run, catch three things now that the native strings exist in every locale: TREK Cloud read as an untranslated English phrase (it is a product name, like Vacay and Atlas, so add it to the brand list); Email left identical in Italian, Indonesian and Vietnamese, where it is the local word too (mark same-as-en) and in Greek (give it a Greek term); and the GB and AI-document quota strings carrying {n} without being plural groups (both are figures that never show a singular, like the other unit-symbol counts in NOT_PLURAL). * fix(native): typecheck, lint and knip on the native code; wire he's native bundle The full suite, which the feature-branch CI does not run, catches four things the native work still had: a non-narrowed union in the claim flow (tsc), a helper named useFake that the react-hooks rule read as a hook (eslint), two iap types exported but used only inside the file (knip), and the Hebrew native strings present as a file but never spread into he's merged bundle (the aggregated key parity test). All four fixed. * fix(native): a flat redeem result, so the claim flow typechecks The discriminated union did not narrow under the native-shell tsconfig, so the failure code read as absent on the whole type. Use a flat result with optional instanceUrl and code instead: both are always present on the type, no narrowing needed, and the ok plus instanceUrl guard still routes success from refusal. * style: prettier-format the native and i18n changes The feature-branch CI does not run the formatting check, so the conflict-resolved files (AboutTab, useAccountSettings, useTripExport), the native shell and iap module, and the i18n files touched by the translation scripts were never run through Prettier. Format them all; no behaviour changes. * chore(native): re-trigger CI on the formatted tree --------- Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-11-05 21:09:04 +01:00
Maurice	887f5d8c84	fix(deps): restore the vite 8.3.5 security floor ... Re-applying the reverted dependency update left vite below the patched version.	2026-11-05 14:36:23 +01:00
Maurice	61378559ca	chore(deps): runtime security floors and the CI action updates ... - sharp 0.35.5 (librsvg CVE), with the musl pins that ship in the image. - follow-redirects 1.16.2, postcss-selector-parser 6.1.5 and serialize-javascript 7.1.3, from the open advisories. - GitHub Actions: github-script 9 and the minor-and-patch group. - plugin-sdk: @types/update-notifier 6.0.9. The grouped npm update is left out: with it the server build runs out of memory in tsc, and the culprit is not found yet.	2026-11-02 21:58:16 +01:00
Maurice	84df69c18a	Revert "chore(deps): take the safe updates from the open Dependabot PRs" ... The server build runs out of memory in tsc with the grouped updates. Back to the previous dependencies until the update that causes it is found.	2026-11-02 21:56:33 +01:00
Maurice	6194a658d9	chore(deps): take the safe updates from the open Dependabot PRs ... - The npm minor-and-patch group (#2952) without mapbox-gl: 3.34 drops setRTLTextPlugin from its typings, and the RTL plugin is what joins Arabic, Hebrew and Persian labels. react and react-dom move to 19.3.1 together, overrides included, so the workspace keeps one React. - Security floors from the open alerts: sharp 0.35.5, vite 8.3.5, follow-redirects 1.16.2 (#2927), postcss-selector-parser 6.1.5 (#2865) and serialize-javascript 7.1.3. - GitHub Actions: github-script 9 (#2951) and the minor-and-patch group (#2950). - plugin-sdk: @types/update-notifier 6.0.9 (#2948).	2026-11-02 21:30:17 +01:00
github-actions[bot]	dc36c21c08	chore: bump version to 5.1.0 [skip ci]	2026-10-31 11:12:52 +00:00
github-actions[bot]	a0943f8226	chore: bump version to 5.0.1 [skip ci]	2026-10-28 10:43:52 +00:00
github-actions[bot]	bd1de9e1d5	chore: bump version to 5.0.0 [skip ci]	2026-10-25 11:07:55 +00:00
Maurice	1696162d22	fix(deps): maplibre-gl 6.15.0 past the attribution sanitizer advisory ... GHSA-jrc7-96c5-q579 covers every maplibre-gl up to 6.4.0 and has no 5.x release, so npm audit kept flagging the patched 5.24.0. Moving to 6.15.0 retires the local backport: patch-maplibre.mjs and its postinstall, predev and prebuild hooks go, along with the Dockerfile copy and its format-baseline entry. 6.x sanitizes attributions against an allow list. What the major changes for TREK: - ESM only, no default export: the engine module imports the namespace and hands that out as its default, so every caller stays as it was. - The worker is no longer inlined, and inside a bundle MapLibre cannot find it next to its own module. The engine sets it from Vite's ?worker&url build before any map, the Leaflet bridge's included. - WebGL2 only: the probe asks for webgl2 alone, so a WebGL1-only browser gets the raster basemap instead of a GPUInitializationError. - 6.9 shapes right-to-left text itself and deprecated setRTLTextPlugin; the old plugin would replace that and could only run through eval in the module worker, so MapLibre no longer registers it. Mapbox does. The lockfile moves maplibre-gl and its own dependencies only; the Leaflet bridge already allows ^6.0.0 as its peer.	2026-10-24 22:41:56 +00:00
Maurice	9b8626622f	fix(deps): zod at 4.6.7 across the tree, jimp's copy included ... Zod before 4.6.6 can exhaust memory while it validates an oversized constrained collection (GHSA-mrhx-c7xc-m3w5), and every request body and tool call goes through it. The workspaces ask for 4.6.7 and the root holds it as a floor for the whole tree, so jimp, which pins zod 3 and has no release on 4, resolves to the same copy. Its option schemas use only object, number, tuple, literal, union, nativeEnum, boolean, string, instanceof and array, all of which zod 4 keeps; resize, scaleToFit, crop, cover, contain, blit, composite, rotate, flip, quantize and the jpeg and png encoders run on it.	2026-10-23 22:06:45 +00:00
Maurice	fabefed39f	feat(studio): 34 typefaces with real weights and italics, a categorised font picker ... The book catalogue grows from 7 families to 34, all self-hosted through @fontsource under the SIL OFL 1.1 or the Apache License 2.0: condensed and poster faces, heavy retro display, elegant display serifs, Montserrat, twelve scripts and DM Mono. Weights run from 100 to 900, each family offering only the weights it ships, and the serifs gain real italics. The catalogue lives in @trek/shared (book-fonts.data.ts) with each family's roles (display, heading, body, script, mono), weights, italics and letter width, so the Studio, the findings, the design engine and the assistant read one list. Page operations and the design engine set a weight a family lacks at its nearest one, describe_book_page names the role and the weight, and font_mix no longer counts scripts and mono faces, warning above three. The Studio gets StudioFontPicker: the current family set in itself, a searchable list grouped by kind with every family in its own face and the book's own families first, and a weight slider over the weights the family has. Faces load only when used; the assistant's page snapshot embeds only the faces a page draws, the service worker installs only the latin files of the original seven families, and the faces of an opened book are cached for offline use. BOOK_SCHEMA_REV goes to 2.	2026-10-23 21:01:29 +02:00
Maurice	d3f797c803	Merge branch 'main' into dev (4.3.4 version bump)	2026-10-23 12:56:44 +02:00
Maurice	09ffc7d946	feat(studio): the assistant sits beside the book and draws the page it looks at ... A chat column in the Studio with its own privacy notice, a live page snapshot through modern-screenshot that leaves out photos of other people and foreign map tiles, and flushes before every turn and apply.	2026-10-22 21:34:15 +00:00
Maurice	b64da26651	feat(assistant): trip assistant chat with your own AI connection ... Adds an in-app assistant that reads and plans the open trip. Users connect their own provider (Sign in with ChatGPT, or an Anthropic, OpenAI, Gemini or OpenRouter key) or use the one the admin set up, including a custom OpenAI-compatible server. It is an addon and only shows while a connection is usable. The chat runs on the existing MCP tools, pinned to the trip. Every change is held as a change card the user applies or discards, and applied changes can be undone. On the desktop it is a floating window that can be moved and resized; on the phone it is fullscreen. Search results show as place cards that can go onto a day, weather lookups as a strip, proposed places as ghost markers on the map with a before/after switch, and an answer can be shared into the trip chat. Booking files can be dropped in and are read into change cards.	2026-10-22 21:30:12 +00:00
github-actions[bot]	d80577480c	chore: bump version to 4.3.4 [skip ci]	2026-10-21 21:08:51 +00:00
Maurice	83d807781e	ci(client): hold strict null check errors per file to a baseline that only shrinks ... The client compiles with strict: false, so nullable contract fields arrive as if always present and implicit anys stay invisible. tsconfig.strict.json is the same program with strictNullChecks and noImplicitAny, and lint:strict (scripts/strict-lint.mjs) counts its errors per file against scripts/strict-baseline.json: a file may not gain one, a new file has to be clean, and an entry above its count fails until --update lowers it. Nothing is converted here; today's 534 errors in 165 files are frozen. allowJs stays: the tests import the .mjs scripts and read their JSDoc types through it. The todo MSW handler maps a cleared priority to its default so the test helper written in this branch starts at zero. The check runs after the typecheck in client-quality.	2026-10-10 21:32:59 +02:00
Maurice	242756708e	ci(client): run theme:lint as a per-file ratchet with the missing token rules ... theme:lint only reported a total and exited 0, skipped whole files by name and never ran in CI. It now counts per file under src/ against scripts/theme-baseline.json, which only shrinks, like lint:rtl: the colour literals, arbitrary colour classes and numeric font sizes it already saw, plus palette classes (bg-gray-100, text-indigo-600, bg-white), raw text sizes (text-sm, text-[13px]) instead of the type tiers, z-index literals above z-50 instead of a step of the layering scale, and reads of the dark_mode setting. The file exemptions are gone; the map, PDF and brand files carry their count in the baseline instead. theme-lint-disable markers stay valid in a comment and are counted against scripts/theme-disable-baseline.json, like rtl-lint-disable in lint:rtl; a new one raises its file's entry by hand, where review sees it. The comment handling lint:rtl already had moves into scripts/lib/source.mjs so both read source the same way. The check runs in the client-quality job.	2026-10-10 21:32:05 +02:00
Maurice	feef872776	ci(client): lint:pairs keeps a desktop view and its phone twin on one hook ... Most features have a desktop view and a phone view, and until now each carried its own copy of the feature's logic, so a fix on one side drifted away from the other. With the logic moved into one shared hook per feature, scripts/feature-pairs.json names every feature with its hooks and the desktop and phone files that run on them. lint:pairs fails when a listed view stops importing one of its pair's hooks (a type only import does not count), when a listed file is gone, when a hook sits in a view layer rather than under components, hooks, utils or the folder of a page under pages/, and when a file under src/mobile/screens is in no pair and not under mobileOnly with the reason it has no twin. A new phone screen is so either wired to the desktop feature's hook or marked as phone only on purpose. lint:dup catches the copies that look alike; this one catches the copies written anew. The manifest starts with 120 features and 62 phone only screen files, each with the reason it stays on the phone alone. client/CLAUDE.md says how to change a feature, add one with both views and add a phone screen.	2026-10-09 15:20:10 +02:00
Maurice	88d196bae8	ci(client): lint:dup holds copied code to a baseline that only shrinks ... Most features have a desktop view and a phone view, and each carried its own copy of the feature's logic, so SonarCloud's duplication condition was the gate a pull request touching both failed most often, and only after a scan of twenty minutes. lint:dup finds the same copies before the push. It runs jscpd's detector (@jscpd/core with @jscpd/tokenizer) over the source files under src/ at the thresholds the SonarCloud gate applies to TypeScript, 100 tokens over at least 10 lines, and counts per file the lines inside a block that repeats elsewhere or in the same file. Tests and declaration files are left out as Sonar leaves them out, and .ts and .tsx are read as one language, so a hook that repeats a view's code is a copy too. The files are read sorted and with readText, so every machine counts the same. scripts/dup-baseline.json holds the files that still hold copies with their count; a file may hold no more than its entry, a file without an entry none, and an entry above its file or for a file that is gone fails until --update lowers it. --list prints every block with its other side. The engine packages are used instead of the jscpd command, which walks the tree in file system order, skips files past its size limits without a word and drops every result once it meets a file it has no format for.	2026-10-09 15:20:10 +02:00
Maurice	2f5d16ac74	build: pin the Node major in .nvmrc and declare the supported range ... Nothing said which Node TREK runs on. The image is node:24, part of CI ran 22 under comments saying 22 matched the server runtime, and the dev guide said "22+". A bare-metal or dev install on an unsupported Node installed without a word and then failed at runtime: isomorphic-dompurify needs ^22.22.2 or ^24.15.0, the plugin jail's --permission flag is new in 22.x. .nvmrc now holds the major the Docker image runs, for nvm/fnm and for every workflow to read. engines in the root and each workspace states the range the runtime dependencies accept, the same one isomorphic-dompurify declares. Without engine-strict npm only warns outside it, so no existing install stops installing.	2026-10-08 13:04:43 +02:00
Maurice	43ed960f30	fix(deps): lift the vulnerable runtime packages and move the overrides to the root ... The image scan has been red since 10-06 on five advisories in four runtime packages: proxy-addr 2.0.7 (critical, IP spoofing through an IPv4-mapped IPv6 trust subnet), brace-expansion 2.1.4, source-map-js 1.2.1 and @modelcontextprotocol/sdk 1.30.0. brace-expansion had been fixed once already; the ORM squash regenerated the lockfile and took it back to 2.1.4 without anything noticing. The overrides block in server/package.json was meant to hold such floors, but npm reads overrides from the root package.json only, so none of them ever applied: @nestjs/platform-ws kept its own ws 8.21.2 next to the 8.21.3 the block asked for. The floors move to the root, together with new ones for every package this lifts, so the next lockfile regeneration cannot quietly undo them. picomatch ^4 is dropped instead of moved: at the root it would force micromatch's 2.x copy across a major. js-yaml is lifted only inside its 5.x line, the one @nestjs/swagger pins. The SDK goes to 1.31.0, the first fixed release; it stays hoisted, which the CJS path aliases in server/tsconfig.json depend on. dompurify, fast-uri, ip-address and js-yaml come along because npm audit flags the same lockfile for them and each fix is inside the range already used. @mikro-orm/postgresql (with pg), marked and topojson-client are dropped: nothing in src, tests or scripts imports them, and the ORM config names only the SQLite driver. The Postgres driver comes back with a Postgres job that exercises it. npm audit --omit=dev now reports only maplibre-gl, whose fix is the 6.x major tracked separately.	2026-10-08 13:04:42 +02:00
Maurice	f00c354d0d	fix(i18n): add the two keys the client named without en having them ... BudgetPanel titled its add button with budget.addCategory (since April) and the trip form labelled its cover remove button with common.remove (since August). Neither key was ever in en, and t() returns an unknown key unchanged, so both rendered as the raw key in every language. Both are added to all 27 locales. Locale parity compares the locales with en, never en with the code, so nothing could catch this. client/scripts/i18n-keys.mjs (npm run lint:i18n-keys) now resolves every literal key src/ names against en: the first argument of t(), tHtml() and tr() (both sides of a conditional included), <TransHtml html>, the fallback of translateApiError and any *Key property or prop. A template key, a prefix with the rest appended and the help registry's key builders pass when their fixed parts match an en key; the one template with no fixed part is on an allow-list that names the keys it resolves to, and an entry nothing uses fails. With --unused it lists the en keys nothing reaches, as information only. en is read with shared/scripts/i18n-catalog.mjs, a reader for the locale tables as text that the parity tooling will share. It refuses a value that is not one string literal instead of skipping the key.	2026-10-08 13:04:41 +02:00
Maurice	0f1020cb80	ci(client): lint:skips forbids .only and ratchets skipped tests ... JourneyDetailPage.test.tsx has carried 35 describe.skip blocks since April, for contributors, trip linking and the map view, features that were reworked rather than removed. Nothing stops the next skip, and nothing stops a stray .only from passing CI while the rest of its file never runs. lint:skips reads every vitest file under src/ and tests/ and every Playwright spec under e2e/ from its syntax tree. A .only on any runner fails the check, always. Skipped and todo tests (it.skip, describe.skip, test.todo, the x-shorthands, skip.each) are counted per file against scripts/skip-baseline.json, which only lowers. A skip that decides at run time is not a declaration and is not counted: skipIf, runIf, Playwright's test.skip(condition, 'why') and a bare test.skip() inside a test.	2026-10-08 13:04:40 +02:00
Maurice	07f35d8b81	ci(client): lint:warnings ratchets the ESLint warning counts per rule ... eslint.config.mjs keeps most rules at warn so that CI stayed green on a codebase that was never linted, and CI runs eslint without --max-warnings. Warnings therefore only ever accumulated: 1218 today, among them 194 unused variables and 144 missing effect dependencies in app code, the kind behind the stale closures #2610 chased. lint:warnings runs ESLint over the client with its own config and counts the warnings per rule, separately for app code and for tests, so the headroom from fixing a test cannot be spent in app code. Messages that an eslint-disable comment silenced are counted as a third group, so an inline disable is no way past the ratchet either. No count may pass its entry in scripts/eslint-baseline.json, and --update only lowers. Any error, a parse failure included, fails the check too, so it can replace the plain lint:check step in CI instead of running ESLint twice.	2026-10-08 13:04:40 +02:00
Maurice	7a7903a799	ci(client): lint:offline stops new views from calling the API directly ... The offline core only works when the views go through it: component, feature hook, store, repo, then api or Dexie, with writes through the mutation queue. A view that imports src/api/ skips the cache, the optimistic write and the idempotent replay. client/CLAUDE.md said so and noted that no ratchet held the line, and the number of view files importing api/client grew from 161 to 190 in two months. lint:offline lists the 213 files under components/, mobile/, pages/ and hooks/ that import anything from src/api/ for more than types (api/client, the websocket, the per-domain modules) in scripts/offline-baseline.json. No other view file may, and a listed file that stops leaves the list through --update, so the next file at that path does not inherit the exemption. Type-only imports do not count: they carry no request. client/CLAUDE.md describes the rule next to the data-flow section, including that an online-only domain puts its calls in a store or repo.	2026-10-08 13:04:40 +02:00
Maurice	798553b13b	ci(client): lint:layers holds the import direction between src/ trees ... Components reach up into pages/ for models and helpers (28 imports in 25 files: the journey detail helpers, the collections, atlas and dashboard models) and sideways into mobile/ for phone hooks and sheets (36 in 30 files), and a few stores and a repo import from components/. Nothing stopped the next one, and every such import ties two trees together that should move and split independently. lint:layers reads each source file's imports from its syntax tree (multi-line imports, re-exports, import() and type imports included, nothing inside comments or strings) and checks them against a small rule table: a component imports neither pages/ nor mobile/, a shared hook no view, nothing under the views (store, repo, sync, api, db, utils and the other helpers) any view, a repo no store, and the Dexie schema none of the layers above it. mobile/ and pages/ stay free, since the phone screens reuse the page hooks by design. The 80 imports that break a rule today are counted per file in scripts/layers-baseline.json, and a file may hold no more than its entry. Type imports count: a type the lower layer needs belongs below it. Tests are not checked.	2026-10-08 13:04:39 +02:00
Maurice	37d386178b	ci(client): lint:format keeps new client code Prettier-formatted ... client/package.json has had a format:check script, but no workflow runs it, and 2144 of the 2171 .ts, .tsx and .css files under src/ and tests/ differ from what .prettierrc asks for. Without a formatter gate the line count in lint:size could also be gamed, and every new file picked its own layout. Formatting everything in one commit would bury the history, so lint:format lists today's unformatted files in scripts/format-baseline.json and only lets the list shrink: a file outside it, any new file in particular, must be formatted, and a listed file that has been formatted must leave the list (--update takes it off and never adds one). A stale entry fails the check, since it would let the next file at that path in unformatted. The check runs Prettier through its API with the config that applies to each file and reads the text with LF line ends, so a Windows checkout agrees with CI about endOfLine. A file Prettier cannot parse counts as unformatted, and a missing config stops the run.	2026-10-08 13:04:39 +02:00
Maurice	5189d7fcca	ci(client): source files may not grow past their size baseline ... lint:size counts the lines of every source file under client/src, tests aside. A file may hold 1000 lines; the 24 files that are longer today are listed in scripts/size-baseline.json with their current length and fail the check when they grow. --update lowers an entry once a file shrinks and never raises one, so a long file is split by concern instead of growing. A baseline that cannot be read or parsed stops the check with its reason, and --update leaves it as it is. It runs in the client job next to the reading direction check.	2026-10-08 05:02:47 +00:00
Maurice	ba70ad28b8	fix(client): spacing and alignment follow the reading direction ... Arabic runs the app right to left, but margins, paddings, insets, text alignment, borders and corner radii were written for the left side, so icons sat against the wrong edge of their labels, indents and badges pointed the wrong way and amount columns aligned left. They now use the logical forms (ms-, ps-, start-, text-start, marginInlineStart, insetInlineEnd and their CSS equivalents), which are the very same sides in a left to right language. Geometry stays physical on purpose: maps, positions measured from the pointer or a bounding box, time axes, sliders, transforms and print output. Amounts drawn as several spans keep their order in a right to left row, the time picker keeps hours before minutes, and two switches whose thumb slid out of its track in Arabic now move the right way. lint:rtl counts what is still physical per file against a baseline that may only shrink (1512 uses in 370 files before, 319 in 113 now), and CI runs it, so new code reaches for the logical forms.	2026-10-07 22:33:58 +00:00
jubnl	de8caa81a2	Feat/orm : mikroorm (#2416) ... * base entities * update deps * fix date as string * rename entities * migrations + seeders * feat(db): DbTimestampType keeps DATETIME columns as the CURRENT_TIMESTAMP text * feat(db): discover entities from an explicit list instead of a glob * test(db): createTestOrm binds an ORM to a suite's own SQLite handle * feat(db): dialect helper is the one place SQL functions are spelled * test(db): dialect helper refuses malformed column references and day counts * feat(db): snake_case entity shape and the first three repositories (Days, DayNotes, Trips) * fix(db): repositories mirror the statement's column set and guard their row types * feat(db): request-context and unit-of-work helpers for the ORM, with concurrency tests * test(server): integration suites boot on the migrated schema snapshot * test(server): snapshot harness keeps the legacy id semantics * fix(test): route MikroORM's dynamic imports through vitest from the setup file, not the ORM config * test(db): coverage ratchet entries for the ORM foundation * test(server): websocket suites boot on the migrated schema snapshot * test(server): coverage's uncovered-file pass goes through the SWC transform * fix(db): dialect helpers dispatch on the platform; lint gate for the repository layer * test(server): ORM suites open the schema snapshot; RESET_TABLES derived from the schema * chore(server): promise safety net and sweep tooling for the async migration * refactor(realtime, systemNotices, addons, airports, audit, categories, permissions, query-helpers, tags, transit, trip-membership): async DB-touching methods; transactions through UnitOfWork * fix(server): observe every promise the async sweep left unobserved (timer, handshake, plugin-runtime test) * test(doc-sync): unit suites await the methods the async sweep made async * refactor(atlas, school-holidays, settings): async DB-touching methods; transactions through UnitOfWork * chore(server): lint rule refusing a Promise used as a plain value, and the misses it found * test(server): suites await the methods Task 1's forced edits made async * refactor(budget, common, day-notes, days): async DB-touching methods; transactions through UnitOfWork * test(oauth): controller suite awaits the async service * chore(server): db-call-graph --unawaited lists calls to async methods whose result is used without await * refactor(llm-parse, mcp-shared, oauth, place-shadow, route-usage, storage, todo, trip-invite): async DB-touching methods; transactions through UnitOfWork * refactor(plugins): async DB-touching methods; transactions through UnitOfWork * chore(server): db-call-graph --sync stops its transitive walk at an async callee * chore(plugins): drop gate-only asyncs; observe the scheduler's rejection; async event-sink stub * refactor(notifications, place-photos, backup): async DB-touching methods; transactions through UnitOfWork * refactor(auth, files): async DB-touching methods; transactions through UnitOfWork * test(server): suites await the methods earlier sweep groups made async * refactor(tokens): async DB-touching methods; the auth token handlers await them * test(files): upload filters fail closed on an excluded or unresolvable type * refactor(collab, collections, maps): async DB-touching methods; transactions through UnitOfWork * refactor(memories, photos, packing, share): async DB-touching methods; transactions through UnitOfWork * chore(server): lint rule also refuses a Promise handed to expect() without resolves/rejects * refactor(vacay, admin, doc-sync): async DB-touching methods; transactions through UnitOfWork * fix(vacay): type the loop accumulators the async sweep introduced * refactor(journey, oidc, place-enrichment, tokens, trip-members): async DB-touching methods; transactions through UnitOfWork * fix(server): the journey hooks are awaited by their callers, not detached * refactor(assignments, public-api, accommodations, places): async DB-touching methods; transactions through UnitOfWork * refactor(trips): rewrite AccommodationsService.createAccommodation .bind alias Recipe R4 trap named in the Task 12 brief: a .bind alias of an AssignmentsService/AccommodationsService method is typed any and hides a missing await from tsc and the promise lint rules. createAccommodation belongs to this task's group, so rewritten as an arrow forwarding to the method instead of a bound reference. * refactor(assignments): drop the unused Trip type alias * refactor(reservations, booking-import, calendar, integrations, roadtrip): async DB-touching methods; transactions through UnitOfWork * refactor(roadtrip, reservations): return await on transactional; document the single-flight promises * refactor(trip-read-model, trips, feeds): async DB-touching methods; transactions through UnitOfWork * refactor(server): remove DatabaseService.transaction — every transaction runs through UnitOfWork * refactor(trips, feeds): drop added return annotations; no double await on the feed guard * fix(server): phase 1 review follow-ups — awaited returns, logged upload-filter rejections, covered handshake/notice branches, call-graph gate in CI, dead test imports * fix(server): upload filters answer multer once on a throwing callback; positive call-graph gate test * test(db): entity metadata must match the migrated schema; fix the four drifts it found * feat(db): primary-relation entities proven (BudgetCategoryOrder, VacayUserSettings) * test(db): parity gate also holds declared pivot entities; per-field column types; missing-set ratchets both ways * test(db): numeric ids for the primary-relation spike * feat(db): re-runnable entity generator encoding the snake_case/DbTimestampType rules * fix(db): generator guard rails — validation cannot mask hidden()/index loss; typed JSON; loud failures * fix(db): generator keeps NOT NULL boolean defaults; fails if a JSON interface import survives * refactor(db): every entity in the snake_case shape; document-sync entities added; one repository per entity * fix(db): no NaN class-field initialisers; entity generator --check gate in CI; parity normaliser keeps literal case * chore(db): entity --check reports stray files; class-field census is a ratchet; migrate-encryption typechecked * feat(db): AppSettings and Users repositories; forFeature wiring pattern * refactor(permissions): permission flags through AppSettingsRepository * fix(server): boot-time settings read runs inside an explicit ORM request context * refactor(audit): audit log writes through AuditLogRepository * fix(db): PK reads refresh past the identity map; typed owned-lookup generics; e2e ORM module mirrors production config * docs(db): owned-lookup call-site convention; refresh side effect; e2e ORM module spread notes * fix(audit): audit rows are native inserts, not a unit-of-work flush; closed test ORMs * fix(server): non-HTTP entrypoints run inside an ORM request context; permission loads fail closed on context errors * refactor(categories, tags): repositories replace raw SQL * refactor(addons): addon catalog and photo providers through repositories * fix(db): generator captures inline UNIQUE constraints SqliteSchemaHelper.getIndexes() drops every unnamed sqlite_autoindex_ entry before entity-generator ever sees it, so a table-level UNIQUE(...) constraint with no separate named CREATE UNIQUE INDEX (settings' UNIQUE(user_id, key) among ~40 others) never reached the generated entity's uniques: metadata. Adds a general RULE9_addImplicitUniqueConstraints (skips a column set identical to the table's own primary key — AppSettings.key/Addons.id noise) fed by a PRAGMA index_list/index_info scan, and regenerates every entity. * chore(addons): well-known gate wraps only the addon read in a request context; drop unused test factories * fix(platform): well-known gate tolerates a synchronous addon read from the context helper * fix(db): PK lookups inside patch refresh past the identity map; corrected identity-map notes * refactor(settings): user and instance settings through repositories SettingsRepository (getForUser/upsertForUser/getOne/deleteForUser) replaces the per-user settings table's raw SQL; SettingsService drops DatabaseService entirely. instance-api-keys.ts's readInstanceApiKey/writeInstanceApiKey/ resolveApiKey take an explicit AppSettingsRepository/UsersRepository instead of a raw connection. An earlier version resolved those two repositories itself from the active MikroORM request context, so none of its six callers needed to change. That worked in production and e2e (always inside a real request) but broke service construction in plain unit tests across every calling domain (addons, auth x2, maps, transit, unsplash - 185 failures on a full run), since none of them wrap a request context. Each of those six services now injects its own AppSettingsRepository/UsersRepository and passes them through explicitly, matching how every other converted repository in this migration is consumed; their own SQL is untouched (outside Plan 3a). * test(server): harness constructors follow the Task 5 repository signatures; one test ORM per handle in the plugin host * fix(db): generator names relation properties in captured UNIQUE constraints * fix(settings): drop dead wiring and the speculative deleteForUser; strict row assertions * fix(server): plan 3a review follow-ups — fail closed without an ORM at every choke point; seam and D5 ratchet tests; dead method and DDL copies removed * fix(server): plan 3a re-review follow-ups — plugin boot activation and the airports backfill inside a request context; the supervisor answers the child before failing closed; BOOT-SWEEP-001 drives the real boot hooks; ws adapter seam pinned * feat(db): generated entities declare their repository type; test casts dropped * fix(server): plan 3a re-review 2 follow-ups — absent-ORM boot branch pinned; airports boot hook never rejects; BOOT-SWEEP-001 asserts the seven routes; duplicate comment removed * feat(server): pre-init photo route and WS handshake run in a request context; InviteTokensRepository * refactor(auth): users table through UsersRepository; JWT and MFA lookups repository-backed * refactor(tokens): MCP and API tokens through McpTokensRepository * refactor(auth): passkeys and registration invites through repositories * fix(db): row-out repository reads bypass the identity map — stale write-back over nativeUpdate at flush; insertUser via em.insert; settings round-trip pinned * fix(server): non-numeric route ids answer the legacy not-found, never NaN (tokens, categories, tags); mint path back to two statements; identity-map regression pinned * refactor(oauth): OAuth server tables through repositories OauthClientsRepository/OauthTokensRepository/OauthConsentsRepository replace OauthService's raw SQL (OA1-OA33). revokeChain's recursive CTE and the oauth_clients join (its FK actually targets client_id, not the row id the generated relation assumes) go through em.getKysely(); OA19's chain revoke is one nativeUpdate($in); OA12's consent grant is em.upsert on the (client, user) unique key. revokeAllForUser built now for Task 5. Every row-out read is disableIdentityMap: true; inserts go through em.insert. * fix(auth): non-numeric passkey and invite ids answer the legacy 404, never NaN; invite join type pinned * fix(db): generator emits the referenced column for non-PK foreign keys; OAuth client joins through the relation; FK parity un-skipped * refactor(db): TrekRepository base — every repository path validates the request context and reads bypass the identity map by default * refactor(auth): AuthService and account cleanup through repositories * refactor(oidc): OIDC identities and settings through repositories * fix(auth): invite validation keeps expires_at null on the wire; password transaction scopes and reset-token burn pinned * fix(server): plan 3b close-out — case folding on both sides for identifier lookups (non-ASCII login regression); coverage ratchet restored; repository scaffold and instanceof ratchet on TrekRepository; D-shape tests load-bearing * refactor(server): trip-access primitives async at every caller * refactor(trips): trip access through TripsRepository; demo seed in a request context; dialect helpers for the trips cluster * refactor(days): days and day notes through repositories * refactor(assignments): day assignments through repositories * refactor(server): trip-membership, place-shadow, place-enrichment, place-photos and query helpers through repositories * refactor(trip-members): membership, guests and the trip read model through repositories * refactor(places): places, tags, ratings and place images through repositories * fix(server): place-shadow source counts ordered in SQL; identity-map ratchets load-bearing; photo-cache race pinned * refactor(places): import paths through repositories * refactor(trips): trips through repositories * fix(server): trip ids parsed once at the gate for places and assignments; NUL-safe value quoting on the SQLite platform; places parity tests completed * refactor(trips): trip copy through repositories for the owned tables * fix(server): plan 3c close-out — non-finite ids bound as NULL, trip id parsed once at every places/days/ws gate Platform: NulSafeSqlitePlatform now renders a bound NaN as NULL and +/-Infinity as 9e999/-9e999, matching better-sqlite3's own legacy binding (rule 22 extension) — the program-wide fail-safe for any caller that still passes an unguarded Number(untrusted) into a converted statement. PlacesService.verifyTripAccess and RealtimeGateway.handleJoin stop doing that: verifyTripAccess parses once with toRowId and threads the parsed id through create/import/bulk/rating/export.gpx (deleting the seven toRowId(tripId) ?? -1 sites), and handleJoin gets a Number.isFinite guard. DaysService gets the same treatment across list/create/getDay/reorder/ insert/resyncAccommodationDays, closing the gap where a hex-spelled trip id could renumber a real trip's days while the raw-bind inverted-accommodation guard silently matched nothing. DatabaseService.getTripTitle is deleted; PlacesService injects TripsRepository directly and calls getTitle itself. Template/cheap-item cleanup: DayAssignmentsRepository.listForTimeSort uses $castTo instead of an unknown bridge; the duplicated TagRow interface in Places.repository.ts is now imported from Tags.repository.ts; AssignmentWithPlaceRow extends the guarded DayAssignmentRow instead of restating its columns; PlaceShadowPicksRepository.totals drops its unreachable ??-fallback branch; Places.repository.ts's updatePlace types the NOT NULL name column as string; trip-members.service.ts's transferOwnership threads one parsed trip id through all three writes and corrects two stale "raw-bind seam" docstrings that were actually Number() seams; a dead canAccessTrip mock is removed from reservations.e2e.test.ts. Tests: the 23 new no-explicit-any warnings in TRIP-SVC-069 are typed (lint back to 2416); HTTP and WS regression coverage for the non-finite and non-canonical id shapes across places/days routes, mutation-proved; TRIP-JOIN-005 asserts the exact concurrent-join settlement instead of >= 1; a new tests/unit/db/transaction-yield.test.ts pins rule 24's measured transaction-yield/dirty-read/nested-BEGIN behaviour. * test(server): plan 3c close-out — copy-source full-row parity, Kysely rollback proofs, identity-map relabels, trips e2e on the snapshot DB * fix(server): plan 3c close-out — days create/insert answer the guard 404 for non-canonical trip ids instead of 500; exact settlement and cross-request yield ratchets * feat(server): plan 3d groundwork — dialect helpers, visibility predicate, feed and cron context ratchets * refactor(roadtrip): roadtrip tables through repositories * refactor(reservations): reservations, endpoints and travelers through repositories * refactor(feeds): ICS feed tokens and anonymous feeds through repositories * refactor(accommodations): stays through repositories inside the existing transactions * test(server): plan 3d — MCP test helper constructors follow the accommodations and days services * refactor(trips): trip copy through repositories for the roadtrip, accommodation and reservation tables * refactor(calendar): calendar reads and reservation visibility through one predicate * feat(server): plan 3e groundwork — packing visibility predicate, memories access-gate audit * fix(server): plan 3d close-out — legacy text shape for stored accommodation ids restores the date-change restamp; reservation ids parsed once at the gate; parity tests for the reservation repositories * refactor(photos): trek photos, memories access and cache sweeps through repositories * refactor(files): trip files and file links through repositories, with transactions added * test(server): plan 3e — hand-built FilesService, FilesRpc and AllowedFileTypesService calls follow the repository constructors * refactor(memories): unified, immich and synology photo sync through repositories * refactor(collab): notes, polls, messages and links through repositories * refactor(budget): budget items, members, payers and settlements through repositories * refactor(todo): todo items through repositories * refactor(packing): packing items, bags and templates through repositories * feat(server): plan 3f groundwork — systemNotices DI shape, TRAVELER_OWNS predicate, ntfy/storage-health specs, composite-PK pins * refactor(school-holidays): country and region catalog through repositories * refactor(notifications): in-app notifications and channel preferences through repositories * refactor(notifications): reminder crons, mailer, ntfy and webhook transports through repositories * fix(server): plan 3e close-out — repository registrations restore the boot; packing assignee and bag updates parse and no-op as legacy; coverage and scoping ratchets for the budget, packing and collab repositories * refactor(vacay): vacation plans, entries, shares and holiday calendars through repositories * refactor(system-notices): notice dismissals through a Nest provider and repository * refactor(atlas): visited countries, regions and bucket list through repositories * feat(server): plan 3g groundwork — GALLERY_CHRONOLOGICAL_ORDER Kysely ordering, unixEpochToIsoKysely helper, composite-PK DDL pins, JB5/R7 confirmations * refactor(journey): journey and trip access control, CRUD and the trip-sync engine through repositories * feat(server): plan 3h groundwork — date-offset dialect helpers, entity/repository fitness confirmations, pre-init and encryption pattern confirmations, survivor re-grep * fix(server): plan 3f close-out — ntfy operator-scope test on the live send path; vacay date-offset and shift-order parity; todo reminder window; coverage and parity ratchets for the atlas and vacay repositories * refactor(journey): journey stats, entries, photos, contributors and suggestions through repositories * refactor(journey): public share links, TREK Studio books and the journal facades through repositories * refactor(collections): access model, hydration, export/import and list CRUD through repositories * refactor(server): journey-table survivors in trips, photos, memories, auth-cleanup and plugin-contributions through repositories * refactor(integrations): dawarich connection, sync, tracks and review-flow through repositories * refactor(collections): saved places, copy-to-trip, labels and invitations through repositories * refactor(integrations,booking-import,airports,maps,route-usage): airtrail, booking import, airport backfill, maps cache and route-usage counters through repositories * refactor(doc-sync): connections, reconciler and controller-SQL relocation through repositories * test(integrations): add AirTrail saveSettings tx-asymmetry ratchet (Plan 3h Task 4 addendum) * fix(server): plan 3g close-out — transactional book first-save, skeleton reconcile and share-link create; unknown-key entry patches are no-ops again; parity and authorization pins for the journey repositories * feat(server): plan 3i groundwork — AuditLogRepository's reserved methods, the demo connection-swap spike, repository-fitness confirmations * feat(server): plan 3j groundwork — scheduler onto CronRegistrarService, SDK-contract confirmation, repository fitness * refactor(storage): backend/category config and usage stats through AppSettingsRepository; fix the seed-file test race and the shared-replica migration-flip gap * refactor(share): public share links, the pre-init photo fallback, and collection-places survivors through repositories * feat(server): plan 3j — the withCamelCase utility, unwired, pending a contract decision * refactor(admin): user CRUD, stats, audit log, version check and addon config through repositories * test(admin): pin createUser's pre-existing non-transactional uniqueness-check race (AD2-4) * refactor(plugins): the trip-write role gate through a repository, in isolation * refactor(demo,backup): seed and reset through DemoRepository, live-connection backup statements through MaintenanceRepository, isDemoUserId through an injected DemoService * fix(server): plan 3h close-out — new-value-wins COALESCE restores stay/reservation propagation; doc-sync state filter truthiness; request-context and parity ratchets for share, doc-sync and the integrations * refactor(plugins): runtime lifecycle, config CRUD and the uninstall cascade through repositories * fix(server): plan 3i close-out — DemoModule imported where its service is consumed (e2e restored); admin addons list selects the provider relation; saveDemoBaseline awaited; backup tests on the maintenance repository * refactor(plugins): outbound OAuth tokens and per-user plugin settings through repositories * refactor(plugins): install-time gates, the capability-audit hash chain and the registry through repositories * refactor(plugins): contribution-hook controllers, the small plugin controllers and the plugins-table survivors through repositories * test(server): plan 4 — collapse mcp tool test harnesses onto the ORM snapshot * test(server): plan 4 — collapse nest service test harnesses onto the ORM snapshot * fix(server): plan 3j close-out — serialized audit-chain appends, atomic metadata and scheduler limits, rollback and race proofs for the plugin repositories * refactor(server): plan 4 — convert the program's orphaned raw-SQL callers * fix(server): plan 4 — un-skip PARITY-009 (FK deleteRule and index-name parity) * refactor(server): plan 4 — inline canAccessTrip/isOwner off DatabaseService (trip-domain services) * refactor(server): plan 4 — inline canAccessTrip/isOwner off DatabaseService (plugins + MCP surfaces) * fix(server): plan 4 — RULE12 paren-count scanner ignores string literals The entity generator's RULE12_fixGarbledCheckExpressions CHECK-expression paren-balance scanner counted every `(`/`)` character regardless of whether it fell inside a single-quoted SQL string literal. A CHECK expression like `status IN ('confirmed)', 'tentative')` has a literal `)` inside its first string value; the scanner would hit depth 0 at that in-string character and truncate the expression, losing its own real closing paren. The scanner now tracks single-quote string state (handling the doubled `''` SQLite escape) and skips parens while inside one. Latent-bug fix — no shipped entity's CHECK expression has hit this shape yet (3d's ledger: "nothing affected today"). * refactor(server): plan 4 — unify the trip-access predicate's Kysely copies TripsRepository.findForViewer/listForUser/activeTrip each hand-wrote the identical trip-access boolean (t.user_id = ? OR m.user_id IS NOT NULL) through the Kysely expression builder. Task 7's security review (M1) evaluated a shared helper and set it aside for time, falling back to the TRIPREPO-041 cross-method parity test as a regression guard instead. Extracted the boolean into one generic helper, tripAccessExpr (_shared/trip-access.ts), following the reservation-visibility.ts publicReservationExpr precedent: fully generic over <DB, TB> since the predicate has no correlated subquery, so it composes across TripSelectKyselyDB and ActiveTripKyselyDB without needing a narrower fixed-alias shape. The LEFT JOIN itself stays hand-written at each call site — tripSelectQuery's own docstring already explains why a shared join helper can't be typed across these differently-joined outer queries. feeds.service.ts and memories-access.service.ts no longer duplicate this predicate at all (Task 2's facade-inline sweep already converted both onto TripsRepository.findAccessible/getFeedTokenIfReachable/ listReachableActiveTrips, which read through the canonical MikroORM QueryBuilder form, accessibleTripsQuery) — the remaining duplication this task closes is the three Kysely copies inside this file. TRIPREPO-041 (64/64 in the file) stays green as the unification's own regression guard. * fix(server): plan 4 — trek_photo_cache_meta.cache_key NOT NULL The column was a bare TEXT PRIMARY KEY, which SQLite does not implicitly make NOT NULL (unlike an INTEGER PRIMARY KEY rowid alias). Every writer (TrekPhotoCacheMetaRepository.upsertMeta, the table's only INSERT path) has always bound a real string — 3e's R5 confirmed this. Appends a new migration rebuilding the table with cache_key NOT NULL (SQLite has no ALTER COLUMN, so this follows the same rebuild recipe Migration20200101020000 uses in the opposite direction) and updates the entity/generated metadata to match. Schema tightening, not a behaviour change. * refactor(server): plan 4 — retire the safely-convertible string-form where conditions (rule 23) Places.repository.ts's existsInTrip/findInTrip/findRaw/reclaimInputs/ listByTripAndIds and Trips.repository.ts's findPublicForShare all took a raw `.where('col = ?', [v])` string condition even though their id/trip_id parameters were already plain `number` (or, for findPublicForShare, narrowed to `number` here after confirming its one caller, share.service.ts#getSharedTripData, only ever passes a number sourced from a Kysely-typed share_tokens row, never an unconverted URL param) — converted all six to MikroORM's typed `.where({...})` filter object. The remaining raw string-form conditions in src/db/repositories/** are NOT converted here: they are the `number | string` raw-bind seam findAccessible/isOwner's own docstrings describe (trip_id/id threaded through unconverted from req.params), which structurally requires the deferred guard-level single toRowId parse to land first — narrowing any of those methods' signatures now would either break the '0x10'/'007' id parity those docstrings warn about, or duplicate the deferred item's own work ahead of it landing. * refactor(server): plan 4 — trek-photos.repository.ts finishes its rename 3e Task 6 renamed the CLASS (TrekPhotosRepository -> TrekPhotoRegistrationService, since the name collided with the generated ORM TrekPhotos.repository.ts) but left the FILE and its test file's names unchanged. Renames both to trek-photo-registration.service.ts / .test.ts. The old path is kept as a thin re-export stub (the src/websocket.ts shape) rather than repointed at every one of its ~20 importers in this pass: several of those files sit in two sibling tasks' exclusively-owned windows on this shared branch (Task 3's budget/packing/todo/accommodations/places ripple, reached through tests/helpers/plugin-host.ts and mcp-test-controllers.ts; Task 5c's held-back tests/unit/services/{trekPhotoMedia,conflictUpdate}.test.ts) and are off limits here. Flagged for a follow-up once those tasks land: delete the stub and repoint every remaining importer at ./trek-photo-registration.service. * fix(server): plan 4 — plugin discovery's delete+reinsert pairs are atomic install/discovery.ts#upsert refreshed a plugin's actions and settings-field descriptors as two independent delete-then-reinsert pairs (DI5-DI8) with no transaction spanning either pair, let alone both: a crash between a delete and its own reinsert left that plugin with an EMPTY actions or settings-field set until the next discovery run, instead of its previous still-valid rows. Wraps both pairs in one uow.transactional, so a discovery refresh for a plugin's descriptors is now all-or-nothing. Deliberate behaviour change, named for the user per the task brief. DiscoveryRepos grows a UnitOfWork; PluginRegistryService (the other production caller, registry.service.ts) picks it up the same @Optional() way PluginRuntimeService already does, with the same guard-throw. Updates the two hand-constructed test call sites that actually exercise discovery (discovery.test.ts, registry.test.ts) to pass a real UnitOfWork. * refactor(server): plan 4 — facade inline sweep part B (rosterUserIds/getPlaceWithTags) Inline DatabaseService.rosterUserIds onto TripMembersRepository.rosterUserIds directly in budget.service.ts, budget.mcp.ts and todo.service.ts, and DatabaseService.getPlaceWithTags onto PlacesRepository.findWithTagsAndRatings in accommodations.service.ts (placesRepo was already injected there). BudgetService/BudgetMcp/TodoService collapse their constructors, dropping the now-fully-unused DatabaseService param (budget.module.ts/todo.module.ts register TripMembers on forFeature). PackingService keeps DatabaseService as a vestigial param behind an optional TripMembersRepository with a fallback in tripRosterIds: an in-flight Task 5c file (tests/unit/services/conflictUpdate.test.ts) hand-constructs PackingService positionally without the new repository, so its arity cannot change this task; the fallback keeps that file's DatabaseService.rosterUserIds spy working until Task 4 drops the param with the class itself. * test(server): plan 4 — constructor ripple for the rosterUserIds/getPlaceWithTags inline Hand-built BudgetService/BudgetMcp/TodoService call sites drop the removed DatabaseService constructor arg (budgetRepoArgs() now appends a TripMembersRepository so most spread call sites need no other change); budget.service.test.ts's rosterHas() helper and svc() factory move from a spied DatabaseService to a stubbed TripMembersRepository. The AccommodationsService helper (tests/helpers/accommodations-service.ts) and its two direct callers drop the same arg. PackingService call sites are untouched (its new param is optional, so every existing hand-built instance still resolves rosterUserIds through the DatabaseService fallback). * fix(server): plan 4 — thread the discovery UnitOfWork through PluginRuntimeService too Complements the just-landed discovery atomicity fix (DiscoveryRepos.uow): PluginRuntimeService's own discoveryRepos getter still built the bundle without a uow field. Threads its already-injected, @Optional() uow through so its own onApplicationBootstrap/reload/dev-link discovery calls also get the transactional DI5-DI8 refresh, not just PluginRegistryService's. No throwing guard here, unlike PluginRegistryService's: several hand-built partial-DI-graph test instances of this class (boot-registry-order.test.ts, in a sibling task's held file window) construct it with uow omitted and exercise onApplicationBootstrap's discovery call directly. Discovery must never refuse outright just because a test built a partial graph, so it degrades to the pre-existing untransacted sequence when uow is absent (DiscoveryRepos.uow's own docstring covers this), the same "boot must never block app init" defensiveness this file already applies elsewhere. * fix(server): plan 4 — guard-level single parse: verify + correct the overclaiming verifyTripAccess docstring (L-2) TripAccessGuard/TripOwnerGuard already parse :tripId exactly once (Number(), guarded by Number.isFinite) and hand the resolved TripAccess row to the handler via request[TRIP_REQUEST_KEY], TripOwnerGuard reusing TripAccessGuard's own lookup when both are on the same route rather than re-querying — verified by reading both guards directly, no change needed there. PlacesService.verifyTripAccess's own docstring separately claimed its returned `tid` gets "returned... for every downstream call to reuse (never re-parsing)" (3c's Task 9 review, L-2, carried to Plan 4). Reading every call site (not assumed) shows this is false: `.tid` has exactly one reader (PlacesController.requireTrip itself), which discards it — none of requireTrip's 13 callers read `.tid` off the trip it returns; each passes the original raw tripId string on to the write/read method it calls next, which toRowId-parses it again itself. That second parse cannot be eliminated by this gate alone: the same service methods are called directly by places.mcp.ts too, an entry point with no requireTrip gate at all (its own numeric tripId is re-stringified, String(tripId), to call them), so each method owns its own id validation regardless of entry point. Threading `tid` all the way through would mean giving every one of ~15 methods a second, number-only call shape for the REST path alone to use — a real refactor, out of this docstring fix's own scope. Corrected the docstring to say so plainly instead of repeating the false claim. * refactor(server): plan 4 — relocate JS7/10/13/14 off the journey-share fallback stub JourneyShareTokensRepository's own JS7/JS10/JS13/JS14 Kysely reads were a 3g Task 3 fallback (Task 2's JourneyPhotosRepository/JourneyEntriesRepository/ JourneyEntryPhotosRepository were still mid-flight). Now that those repositories are stable, relocate: JS7/JS10 (photo/asset validation joins) onto JourneyPhotosRepository (already injected into JourneyShareService as photosRepo, no constructor change); JS13 (public entry list) onto JourneyEntriesRepository.listPublicEntries; JS14 (public per-entry photo read) onto JourneyEntryPhotosRepository.listForPublicJourney, deduped against that repository's own JP_COLUMNS select list instead of a hand-duplicated copy. JourneyShareService gains two new @InjectRepository params (both already registered in journey-domain.module.ts's forFeature), rippled through mcp-test-controllers.ts and journey-share.service.test.ts (P04/P05 parity tests now pin the new homes). * refactor(server): plan 4 — document unreachable ?? default arms after single-row aggregates 3f Task 7's fix wave flagged a cluster of `row?.x ?? default` arms after unqualified, ungrouped aggregate reads (MAX/COUNT/COALESCE(SUM,0)) as "same class as OauthClients:147" but left them unexamined per-site. Decided per site: document, don't delete — TypeScript still types executeTakeFirst()'s result as `| undefined` even though SQL guarantees exactly one row for these unqualified aggregates, so the optional chain can't be removed without a non-null assertion (worse, not safer). Six sites: JourneyEntries.repository.ts (maxSortOrderForDate JG42, countStatsPlaces JG67), JourneyEntryPhotos.repository.ts (maxSortOrderForEntry JG91), JourneyPhotos.repository.ts (maxSortOrder JG88/JG99), VacayEntries.repository.ts (sumFraction VC1, sumCompFraction VC2). No behavior change — comments only. * refactor(server): plan 4 — unify the two user-data-erasure enqueue paths UserCleanupService.erasePluginUserData (the account-deletion transaction's own UC2/UC3 enqueue) and PluginRuntimeService.enqueueUserErasure (the emitUserDeleted sink's post-commit enqueue) independently walked the identical SELECT id, permissions FROM plugins + JSON.parse + hook:user-data filter + INSERT OR IGNORE — and both genuinely run for every account deletion, since every emitUserDeleted call site (auth.service.ts, admin.service.ts, trip-members.service.ts's guest removal) fires immediately after deleteUserCompletely. Extracted the shared filter into enqueueHookUserDataErasures (nest/plugins/user-erasure-enqueue.ts) and pointed both call sites at it. UC2/UC3 also come off DatabaseService onto PluginsRepository/ PluginUserErasureQueueRepository in the same change (they were the last raw statements standing in the way of sharing one implementation) — this narrows the Plan 3b Task 5 "stays raw, owned by Plan 3j" ruling to UC1 only (plugin_user_config/plugin_oauth_tokens/plugin_oauth_state), which still stays raw, unaffected. UserCleanupService's orphan-data-directory scan (a plugin uninstalled with data retained) has no equivalent on the enqueueUserErasure side and stays there, now via the same repository. Both enqueue calls still run per deletion (INSERT OR IGNORE keeps this idempotent) — this unifies the IMPLEMENTATION, not the call count; not touching the emitUserDeleted event-sink wiring itself was a deliberate, smaller-blast-radius choice for this task. * refactor(server): plan 4 — narrow TripMembersRepository.remove/TripsRepository.setOwner to number Both accepted trip_id: number | string per 3c's carry note (their "stays loose for other callers" reasoning), pending the guard-level single parse landing first. Re-checked every caller directly: setOwner's one production caller (trip-members.service.ts#transferOwnership) already passes trip.id, a real number resolved earlier in the same transaction; remove's callers are trips.rpc.ts (num(), already a validated number), trips.mcp.ts (Zod- typed tool input, already a number) and TripMembersController.removeMember (the one genuine raw-string caller, :id off the route with no class-level TripAccessGuard on this controller by design). TripMembersController.removeMember now parses :id once (toRowId, not Number() — rule 15's NaN-into-SQL trap) and threads the parsed number to both its own access check and removeMember, instead of passing the raw string through twice. TripMembersService.removeMember and both repository methods narrow to number accordingly; setOwner's WHERE also moves off its raw-bind escape hatch onto nativeUpdate now that trip_id is typed, and remove's trip_id half moves onto a typed .where({ trip: trip_id }) filter (user_id keeps its own raw bind — a different, still-live NaN-safety seam, unrelated to this narrowing). TRIPREPO-018 and TMEMREPO-023, which pinned the retired string-bind seam on setOwner/remove, no longer typecheck against the narrowed signatures and are removed with an explanatory comment in their place. * refactor(server): plan 4 — U6 gate-level id parsing for todo item ids Rule 21's carry from 3e Task 8's review: TodoController.update/.remove passed the raw :id route string all the way to TodoItemsRepository, relying on SQLite's column-affinity CAST to match it instead of a typed filter. Parse :id ONCE at the controller (toRowId, matching Task 8a's TripAccessGuard/removeMember shape), 404 on a non-canonical id, and thread the number down through TodoService.updateItem/deleteItem into TodoItemsRepository.findInTrip/existsInTrip/update/deleteById, all narrowed from number | string to number. todo.rpc.ts's num()-derived todoId no longer needs its String() wrapper. tripId stays string | number — a separate, already-accepted carry (23c292f2f). Two new e2e tests pin the non-numeric-id 404 at the gate. * test(server): plan 4 — full-key parity tests for ShareTokensRepository (3h L4) 3h L4's carry: ShareTokensRepository (SH1-SH6/SH17/UC6) had zero tests. 17 cases pinning every read against the legacy statement run raw on the same connection — findRawByTrip/findTokenByTrip with every nullable column both null and set, findValidByToken/findTripAndShareMapByToken/ findTripIdByToken's shared token+expiry predicate (valid, future-expiry, past-expiry, unknown token), plus insertNew/updateFlagsByTrip/deleteByTrip/ deleteByCreator's write correctness (deleteByCreator's cross-trip erasure kept distinct from deleteByTrip's single-trip scope, per the repository's own docstring). The listPublicForShare family (the other half of 3h L4) is a separate, larger carry — not in this file. * test(server): plan 4 — full-key parity for Reservations share/public-api reads (3d carry) Task 8b-2 item 1 (partial): the 8 share.service.ts/public-api.service.ts reads on ReservationsRepository flagged by the 3d Task 7 review as having no repository-level toEqual(<legacy raw>) coverage (listEndpointsForShare, listDayPositionsForShare, listPublicForShare, listPublicAccommodationsForShare, listScheduledForPublicApi, listUnscheduledForPublicApi, listAccommodationsForPublicApi, listUnplannedPlacesForPublicApi). 12 new cases against the legacy statement run raw on the same connection. * test(server): plan 4 — concurrency pins for boundaries-upsert and token-mint races (3d carry) Task 8b-2 item 2: R7's two remaining un-transacted-statement races flagged by the 3d Task 7 review (L4) but never pinned — RoadtripDayBoundariesService .save's belongs-check-then-upsert, and FeedsService.generateTripToken's read-then-write. Both tests pin today's actual outcome (an atomic ON CONFLICT upsert survives cleanly; the token mint has a last-write-wins loser) with the same concurrent-request-shape Promise.all/allSettled pattern roadtrip.service.test.ts's existing R7 vias pin uses. Not a fix. * test(server): plan 4 — full-key parity for Days/DayAssignments/Places roadtrip reads (3d carry) Task 8b-2 item 1 (remainder): the 3 non-share/public-api reads from the 3d Task 7 review's missing-parity list — DaysRepository.listPlanDays (RPL1), DayAssignmentsRepository.listRoadtripVisits (RPL2, the correlated-subquery LEFT JOIN), and PlacesRepository.isTrackInTrip (RT13, the review's "findTrackInTrip" — the actual method name). Completes the 11-file carry together with 434113937's 8 share/public-api reads. * test(server): plan 4 — dedupe overlapping listPlanDays/isTrackInTrip parity blocks 235f03665 landed two versions of the same DaysRepository.listPlanDays and PlacesRepository.isTrackInTrip parity coverage side by side (a merge artifact from concurrent work on the same carry item). Keeps one block per method, drops the duplicate describe/it blocks and their colliding test ids. * test(server): plan 4 — budget calc suite onto real repositories (3e carry) * test(server): plan 4 — at-rest encryption pins for AirTrail/doc-sync/webhook secrets (3h L3) Task 8b-2 item 4: the three credential columns the 3h Task 7 review flagged as having no at-rest pin — users.airtrail_api_key (AirtrailService#saveSettings), document_connections.secrets (DocSyncConfigService's whole-secret-map column), and trip_document_links.webhook_secret (createLink's per-binding mint). Each test saves through the real service, reads the raw column via better-sqlite3, asserts it is enc:v1:-prefixed ciphertext that never contains the plaintext, and asserts the service's own decrypt path rounds it back to the original value. * test(server): plan 4 — at-rest encryption pins for AirTrail/doc-sync secrets (3h L3 carry) Task 8b-2 item 4: the 3h Task 7 review's L3 finding ("users.airtrail_api_key has no at-rest pin", "document_connections.secrets ... has no enc:v1: check", "trip_document_links.webhook_secret - no at-rest pin"). Three targets, each proven by reading the raw column and asserting the stored value is enc:v1:-prefixed ciphertext that round-trips, never the plaintext: UsersRepository.setAirtrailSettingsWithKey/getAirtrailConnRow at the repository layer, AirtrailService.saveSettings/getAirtrailCredentials at the service layer, and DocSyncConfigService's connection secrets map plus createLink's webhook secret. * test(server): plan 4 — drop duplicate AirTrail encryption repository test Task 8b-2 item 4 follow-up: 6965869dd already covers UsersRepository.setAirtrailSettingsWithKey/getAirtrailConnRow's at-rest ciphertext at the service layer (airtrail.service.test.ts's AIRTRAIL-SVC-ENC-001/002) plus the doc-sync secrets/webhook pins (DOCSYNC-ENC-001/002); this repository-level file duplicated the same AirTrail assertion a second time. * test(server): plan 4 — atlas read-model parity remainder (3f L6 carry) Task 8b-2 item 3 (atlas half): full-key toEqual(<legacy raw>) coverage for the atlas read models the 3f Task 7 review's L6 finding listed as missing (minus AT1/TRAVELER_OWNS-consumer, already landed) — AT2 (Places. listForTripIds), AT3/AT28 (PlaceRegions.listCountryCodesForPlaceIds/ listForPlaceIds), AT5/AT10/AT43 (VisitedCountries.listCodesForUser/ listForUser), AT21/AT24/AT25 (VisitedRegions.listForUser/ listRegionCodesForCountry/findCountryCode), AT22 (HiddenRegions.listForUser), AT23/AT40/AT44 (PlaceRegions.listDistinctRegionCodesForCountryAndPlaces/ countPlacesByCountryForTrip/listVisitedCountryCodesForUser), AT30/33/34 (BucketList.listForUser/findById/findForUser), AT41 (Places. listAddressesForUser), AT42 (Trips.countTripsAndDaysForUser). New standalone files for HiddenRegions/VisitedCountries/VisitedRegions/PlaceRegions, which had none. AT6/45/46 (the TRAVELER_OWNS endpoint reads) are proven on ids only by the existing consumer test — full-row parity for those three is NOT done here (carried forward, same as the review's own open item). * test(server): plan 4 — vacay read-model parity remainder (3f L6 carry) Task 8b-2 item 3 (vacay half): full-key toEqual(<legacy raw>) coverage for the vacay read models the 3f Task 7 review's L6 finding listed as missing (minus VC81/82, already landed) — VacayPlans.findByOwner/findById (the getPlanData/getStats composite's own plan read), VacayYears.listForPlan (listYears), VacayCompanyHolidays.listForPlan (the company-holidays list), VacayHolidayCalendars.listForPlan/findById (holiday-calendar reads), VacayUserSettings.findForUser (user year settings), VacayUserYears. findForYear (getStats rows, including the NULL vacation_days case the review named explicitly), and VacayPlanMembers.listAvailableForFusion/ listPendingForPlan/listPendingForUser (the fusion and share pickers). Seven new standalone files — only VacayShares had a repository-level test before this. getSharedCalendars itself is a service-level composite over these same reads plus VacayCompanyHolidays.listDatesForRange (already exercised elsewhere); its own dedicated test is NOT added here. * test(server): plan 4 — full-key parity for PackingItemsRepository.listPublicForShare (3h L4) Task 8b-4a: no repository-level toEqual(<legacy raw>) coverage existed for the share.service.ts SH13 read. Seeds Common items with every nullable column both null and set, plus Personal and Shared-with-people items on both sides of the is_private/owner/recipient predicate, and proves only the Common tier surfaces. * test(server): plan 4 — full-key parity for BudgetItemsRepository.listPublicForShare (3h L4) Task 8b-4a: no repository-level toEqual(<legacy raw>) coverage existed for the share.service.ts SH14 read. Seeds two items — every nullable column set and every nullable column null — plus a foreign-trip item, and proves the ORDER BY category ASC shape (unlike BG72's listAllForTrip, which has none). * test(server): plan 4 — full-key parity for CollabMessagesRepository.listPublicForShare (3h L4) Task 8b-4a: no repository-level toEqual(<legacy raw>) coverage existed for the share.service.ts SH16 read. Seeds a root message, a reply (reply_to set), a deleted message (must be excluded) and a foreign-trip message, and proves the narrower username/avatar-only join shape (no reply_text/ reply_username, unlike joinedQuery). * test(server): plan 4 — full-key parity for PlacesRepository.listPublicForShare (3h L4) Task 8b-4a: no repository-level toEqual(<legacy raw>) coverage existed for the share.service.ts SH12 read. Seeds a categorised place with every nullable column set and an uncategorised place with every nullable column null, plus a foreign-trip place, and proves the named 20-column allow-list never leaks an owner-only column (reservation_status, google_place_id, …). * test(server): plan 4 — full-key parity for DayAssignmentsRepository.listPublicForShare (3h L4) Task 8b-4a: no repository-level toEqual(<legacy raw>) coverage existed for the SH9 read. Seeds assignments across multiple days (one excluded day_id never leaks in), every nullable place/assignment column both null and set, and proves the six owner-only columns SharePublicAssignmentRow omits (google_place_id, google_ftid, osm_id, amap_poi_id, stop_type, fill_percent) never appear on the row at all. * test(server): plan 4 — collapse remaining test harnesses; triage legacy migration tests * test(server): plan 4 — todo controller test expects the gate-parsed item id (U6 follow-up) * fix(server): add the missing numbered migration for the booked-night reseat step (#242) reseatBookedNights (legacy step 242) was never invoked from any shipped MikroORM migration -- only from the retired db/migrations.ts array -- so an install upgrading through the numbered chain never got the one-time reorder. Adds Migration20200101040300, which calls the frozen function through the native better-sqlite3 handle so it runs inside the migration's own transaction. orm-driver.ts's BoundSqliteConnection now also captures that handle onto the field SqliteConnection.getNativeClient() reads, which its createKyselyDialect() override previously left unset -- needed for this migration (and any future one) to reach it in production, not just under the bare test driver. RESEAT-009 moves off the legacy createTables+runMigrations builder onto the real Migrator via tests/helpers/migration-step.ts, plus a new fresh-install guard (RESEAT-011). * test(server): plan 4 — swap 4 of 5 straggler nest test harnesses off legacy schema builder day-notes.service.test.ts, public-api-scopes.test.ts, registration-invites.service.test.ts, trip-invite.service.test.ts onto createSnapshotTestDb() via the async vi.mock idiom (5a/5b/5c precedent), dropping their own hand-rolled createTables()+runMigrations() harness. trip-invite.service.test.ts and registration-invites.service.test.ts also drop their now-redundant DatabaseService wrapper (its .connection was always just the same test db handle). expect( assertions unchanged. user-cleanup.service.test.ts held back: its constructor call was updated to match UserCleanupService's new EntityManager-based shape, but deleteUserCompletely() now deadlocks against a real UnitOfWork (reproduced in isolation, independent of this test file -- see the report), which looks like a genuine bug in erasePluginUserData's new MaintenanceRepository(em) call versus UnitOfWork.transactional(), not a test-harness problem. * test(server): plan 4 — move auto-backup.test.ts and demo-reset-path.test.ts off createTestDb() Both build a schema db while 'fs'/'node:fs' are mocked (wholesale in auto-backup.test.ts, selectively spied in demo-reset-path.test.ts) for their own archiver/filesystem assertions, which broke createSnapshotTestDb()'s read of the schema snapshot through schema-snapshot.ts's own fs import. auto-backup.test.ts: fs is mocked wholesale, so the snapshot db is now built via a small helper that points fsMock's three calls at the real filesystem (fetched through vi.importActual, bypassing the mock) just long enough to build the db, before the test installs its own existsSync stub -- never touching schema-snapshot.ts itself. demo-reset-path.test.ts: fs.existsSync is selectively spied to answer only for the baseline path, so the db is now built before that spy is installed instead of after. * test(server): plan 4 — retire the legacy-runner-only migration hygiene checks migration-hygiene.test.ts deleted outright: every block in it (the destructive-op allowlist, the empty-catch guard, the full-chain smoke) scans or runs the legacy db/migrations.ts array being deleted this plan, never the numbered src/db/migrations/*.ts chain, so there is nothing in it to carry forward. leg-mode-incoming.test.ts: deleted its first describe block (the legacy-runner column-add + replay-safety smoke, also against db/migrations.ts); the read-path parity block, already on the modern createSnapshotTestDb() harness, is untouched. * chore(server): delete the legacy schema/migration/seed builders MikroORM's migrations are the only schema source now, including for tests: src/db/schema.ts, src/db/migrations.ts and src/db/seeds.ts are gone, along with tests/unit/db/schema-parity.test.ts (the parity gate that guarded them, already red on 8a's cache_key NOT NULL) and createTestDb() + its now-dead imports out of tests/helpers/test-db.ts (its last two callers moved onto createSnapshotTestDb() this plan). Their three entries drop from eslint.config.mjs's better-sqlite3 allow-list -- the files they exempted no longer exist. Ruling 7's frozen files (migration-utils.ts, reseat-booked-nights.ts, document-provider-seed.ts) and every numbered migration in src/db/migrations/ are untouched. Precondition grep (server/tests + server/src, from the task brief) is now empty: grep -rlE "from ['\"].*db/schema['\"]|from ['\"].*db/migrations['\"]|from ['\"].*db/seeds['\"]" server/tests server/src --include="*.ts" * docs: plan 4 — the repository layer is the only data access path DatabaseService/DatabaseModule are gone; queries go through repositories (server/src/db/repositories/) and UnitOfWork (server/src/nest/database/ unit-of-work.ts) for transactions. MikroORM's migrations are the only schema source, including for tests — the hand-kept schema.ts/migrations.ts/ seeds.ts test builders and their parity test are deleted. Documents the db/database.ts (connection only) / db/orm-driver.ts (bound driver) / UnitOfWork / repository shape, withRequestContext for non-HTTP entrypoints, the better-sqlite3 ESLint restriction, and the entity generator (gen:entities/ check:entities) as the schema-parity guard. Corrects two stale nest/README.md mentions (realtime.gateway.ts's now-repository constructor, the BE-Phase 1 trip-access bullet) and marks the legacy src/services/ migration recipe as a historical changelog rather than current guidance. * refactor(server): plan 4 — drop the 13 vestigial DatabaseService params/getters Removes the now-dead DatabaseService injection (or private get db() getter) from addons.service.ts, trips.service.ts, trip-invite.mcp.ts, place-photo-cache.service.ts, trek-photo-registration.service.ts, categories.mcp.ts, journey-domain.service.ts, plugins.service.ts, plugin-runtime.service.ts, plugin-mcp-tools.service.ts, places.service.ts and packing.service.ts — every one of them was fully repository-backed already (Task 2/3's facade inline sweep), just still carrying the param. PackingService's TripMembersRepository is required now (the this.db.rosterUserIds fallback is gone with it) and PluginRuntimeService's uow is no longer @Optional() — both moved ahead of the optional registry?/hostFactory? params, since TypeScript refuses a required parameter after an optional one; install/discovery.ts's DiscoveryRepos.uow is required to match, and its upsert() always runs the descriptor refresh inside one transaction instead of falling back to an un-transacted sequence. user-cleanup.service.ts's UC1 (the one genuinely live raw site, Plan 3b's "stays raw" plugin-table trio) moves off DatabaseService onto a new MaintenanceRepository.deletePluginUserData method — the rule-4-permitted connection.execute() home, built from a directly-injected EntityManager. Threads the active UnitOfWork.transactional's transaction context through execute()'s ctx param: without it, a raw connection.execute() call issued from inside deleteUserCompletely's open transaction contends for the same single-connection checkout the transaction already holds and deadlocks (never released, since the transaction is itself awaiting the call). tests/unit/db/transaction-yield.test.ts's probe B already pinned this exact hazard class for a raw better-sqlite3 statement; this is the same mechanism reached through the ORM's connection pool instead. nest/photos/trek-photos.repository.ts (the Plan 4 Task 8a re-export shim) is deleted, with every importer repointed to trek-photo-registration.service directly. The ~7 files that only imported the TripAccess/PlaceWithTags type re-export from database.service.ts now import them from Trips.repository.ts/Places.repository.ts directly, the actual single source. * refactor(server): plan 4 — delete DatabaseService, DatabaseModule and database.tokens.ts Grep gate confirmed zero src/ importers of DatabaseService left outside these three files (Task 1/2/3's earlier conversions + this task's own vestigial-param sweep). Deletes database.service.ts, database.module.ts and database.tokens.ts, drops DatabaseModule from app.module.ts's imports and the five other modules that still listed it (accommodations/calendar/doc-sync/feeds/trip-members) — none of them had a live DatabaseService injection left, so the import was already dead. OrmModule is the module that survives DatabaseModule's deletion, per the Phase 0 ledger's own ruling; untouched. db/database.ts's `db` Proxy export itself stays, deliberately: ~190 test files' vi.mock('…/db/database', …) factories return a { db: <mock handle>, … } shape, and their own `import { db as testDb } from '…/db/database'` is typed against this file's real exports regardless of the runtime mock — vi.mock swaps the module at runtime, but tsc resolves the import statically. Deleting the export would fail typecheck:tests across the whole suite for a test-harness idiom this task's file set doesn't own (Track B's territory). src/ has zero remaining importers, so the ESLint no-restricted-imports gate this task also shrinks still holds this file to its permanent allow-list entry either way. * test(server): plan 4 — repoint the test suite off the deleted DatabaseService/DatabaseModule Mechanical follow-through of the previous two commits across ~110 test files: - The 41 tests/e2e/*.e2e.test.ts suites composed DatabaseModule into their partial Test.createTestingModule graphs; the import and the array entry are dropped (nothing in any composed domain module injected DatabaseService any more, so the entry was already dead weight). - The shared test helpers (mcp-test-controllers.ts, plugin-host.ts, accommodations-service.ts, notifications.ts, test-addons.ts, test-uow.ts) each held a DatabaseService/DatabaseService-shaped param used only for its raw better-sqlite3 handle; every one now takes that handle directly, and every constructor call site the helpers make (PackingService, PlacesService, JourneyDomainService, PlacePhotoCacheService, TrekPhotoRegistrationService, TripsService, UserCleanupService, AddonsService, PluginsService, PluginRuntimeService) drops the removed param and, where PluginRuntimeService's uow is involved, reorders it ahead of the optional registry?/hostFactory? params to match the real constructor. - ~60 further unit/integration test files hand-constructed one or more of those same services directly; same fix, file by file. Four of them (memories-access.service.test.ts, places.directions.test.ts, places.service.test.ts, unified-memories.service.test.ts) also drop a vi.spyOn(DatabaseService.prototype | instance, 'canAccessTrip' | 'isOwner' | 'rosterUserIds' | 'getPlaceWithTags') spy left over from when those methods delegated through DatabaseService — dead now that the services read the owning repository directly. - database-service.test.ts and database-service.delegation.test.ts tested DatabaseService directly and are deleted with it. - tests/unit/db/transaction-yield.test.ts's probe B, which pinned a raw DatabaseService statement's dirty-read behaviour inside an open transaction (rule 24), now issues the same raw better-sqlite3 statement directly against the shared test handle — the exact shape DatabaseService.get/run used to wrap (this.conn.prepare(sql).get/run(), bypassing MikroORM/Kysely entirely) — so the hazard it documents is unchanged. Verified still green. No expect(...) assertion changed in any file; only construction/import plumbing. typecheck, typecheck:tests and the full touched-file run (101 files / 2668 tests) are green, plus the compiled boot (bootstrap.test.ts + boot-sweeps-request-context.test.ts) and one real e2e boot file (trips.e2e.test.ts). tests/unit/nest/user-cleanup.service.test.ts is deliberately NOT in this commit — see the next one. * test(server): plan 4 — finish user-cleanup.service.test.ts's harness swap; regression-test the UC1 transactional deadlock fix This file arrived already modified and unstaged in the shared tree — Task 6 (the parallel legacy-schema-deletion task) had swapped its DB harness onto createSnapshotTestDb() and updated the UserCleanupService construction to this task's new EntityManager-first shape while landing its own commits. Finished here: USER-CLEANUP-005 ("survives a slim schema without the plugin tables") passed a fake `{} as unknown as EntityManager`, which doesn't reach the real UC1 path any more (the previous raw DatabaseService.run swallowed everything in a try/catch regardless); it now builds a real EntityManager bound to the slim handle via sharedTestOrm(slim), so the per-statement query against the missing plugin_user_config/plugin_oauth_tokens/plugin_oauth_state tables is what's actually being proven caught, not a construction-time throw. USER-CLEANUP-006 through -010 (deleteUserCompletely, all of them exercising UC1 inside the real uow.transactional wrap) are the regression test for the previous commit's deadlock fix in user-cleanup.service.ts/MaintenanceRepository.ts: before that fix, every one of these hung and timed out. Green now, verified directly. * chore(server): plan 4 — shrink the better-sqlite3 ESLint allow-list Per ruling 6: database.service.ts's entry comes off (the file is deleted). The five plugin entries (plugin-route-normalize.ts, plugin-host-state.ts, install/discovery.ts, settings-defaults.ts, signature-status.ts) come off too — re-verified none of the five import better-sqlite3 or DatabaseService any more (3j's own conversion). The src/demo/** blanket entry was already gone (3i's own task landed it). reseat-booked-nights.ts and document-provider-seed.ts stay, with the `// TODO(plan 4)` comment corrected: they're frozen forever (ruling 7), invoked from inside numbered, already-shipped MikroORM migrations, never Plan 4's or any future plan's to touch. Permanent allow-list after this commit: src/db/database.ts, src/db/orm-driver.ts, src/db/durability.ts (the driver homes), src/nest/plugins/host/plugin-data.service.ts (3j's R-out-of-scope — a plugin's own sqlite file is never TREK's schema), src/nest/backup/backup.impl.ts (3i's R1, exactly the untrusted-upload-file probe), src/db/reseat-booked-nights.ts and src/db/document-provider-seed.ts (frozen forever). src/db/{schema,migrations,seeds}.ts entries were already removed by Task 6 when it deleted those files. 0 new lint errors; warning count unchanged at 2123 (well under the 2247 lean-gate ceiling) — every file the shrink touches was already fully converted. * refactor(server): plan 4 — U6 gate-level id parsing for budget item/settlement ids Rule 21's 3e carry, same discipline 218f75d0f applied to todo: every :id/:settlementId/:userId route param in BudgetController is parsed ONCE at the gate with toRowId, matching the legacy affinity-seam "not found" outcome for a malformed id on each route (404 'Budget item not found'/'Settlement not found', except toggleMemberPaid — the one legacy handler that never 404'd an unknown item/member either, so a malformed id there skips the write and keeps the same 200 { member } + Number(id)/Number(userId) broadcast shape it always had). The parsed numbers thread down through BudgetService's update/updateMembers/ setPayers/toggleMemberPaid/remove/updateSettlement/deleteSettlement (and their updateBudgetItem/deleteBudgetItem/setItemPayers/getBudgetItem/ applySettlementUpdate/getSettlement internals) into BudgetItemsRepository's getCurrency/findInTrip/existsInTrip/findForDelete/findById/update/deleteById and BudgetSettlementsRepository's findWithUsers/findGuard/update/deleteById, all narrowed from number | string to number; trip_id stays loose, a separate, already-accepted carry. costs.rpc.ts's num()-derived itemId no longer needs its String() wrapper on the update/delete calls; budget.mcp.ts was already Zod-typed to number throughout. Two new e2e tests pin the non-numeric-id 404 at the gate; controller/service unit tests cover the narrowed call args and the toggleMemberPaid malformed-id parity case. * refactor(server): plan 4 — U6 gate-level id parsing for packing item/bag/template ids Rule 21's 3e carry, same discipline 218f75d0f applied to todo: every :id/:bagId/:templateId/:userId route param in PackingController is parsed ONCE at the gate with toRowId, matching the legacy affinity-seam "not found" outcome for a malformed id on the routes with a pre-ORM Express precedent (update/remove -> 'Item not found', updateBag/deleteBag/setBagMembers -> 'Bag not found', applyTemplate -> 'Template not found or empty'). #858's sharing/contributors routes (setSharing/clone/addContributor/ removeContributor) are native Nest code with no pre-ORM precedent (landed in 7eabf6066, after the migration) — a malformed id there just 404s the same way an unknown one already does. removeContributor's :userId used to reach contributorsRepo.deleteOne through a bare Number.parseInt(), the exact NaN-into-SQL trap row-id.ts documents; it now parses through toRowId too. The parsed numbers thread down through PackingService's updateItem/ setItemSharing/addContributor/removeContributor/cloneItem/deleteItem/ getItemPrivacy/updateBag/deleteBag/setBagMembers/applyTemplate, all narrowed from number | string to number; tripId stays loose, a separate, already-accepted carry. PackingItemsRepository's getPrivacy/findVisibleInTrip/ update/updateSharing/delete/findById, PackingBagsRepository's findInTrip/ update/findWithAssignee/delete and PackingTemplateItemsRepository.listForApply narrow the same way. packing.rpc.ts's num()-derived itemId/bagId no longer need their String() wrappers on the update/delete/updateBag/deleteBag/ setBagMembers calls; packing.mcp.ts was already Zod-typed to number throughout. Two new e2e tests pin the non-numeric-id 404 at the gate; controller/rpc unit tests cover the narrowed call args and the removeContributor malformed-userId parity case. AdminPackingTemplatesController (/api/admin/packing-templates) is out of scope — a separate admin-gated surface with its own string-typed template CRUD, not part of this trip-scoped controller's :id chain. * test(server): plan 4 review — three pins catch up with the gate-parsed ids and the cache_key NOT NULL (M1–M3) * fix(server): boot baselines legacy-runner installs before running MikroORM migrations (B1) An install the retired positional runner migrated has a schema_version row and no mikro_orm_migrations rows, so its first boot on this branch replayed all 244 migrations over an already-migrated schema: eight refuse the boot, and the replay-safe ones overwrite user data (step 26 rewrites every day_assignments.assignment_time). runSchemaBootstrap now records the baseline plus every migration whose "Legacy migration step N" docstring is <= schema_version as executed, in one transaction through the migrator's own storage, before the ordinary run applies the rest. The step map is derived from the discovered migrations' source, never hand-kept, and anything unmappable (a newer or malformed schema_version, a duplicated, missing or out-of-order step) refuses the boot. * test(server): boot the app on three legacy-runner fixtures to pin the B1 baseline SQL dumps of databases the retired runner itself built: schema_version 205 (main at fa406b708), 242 (417d0445b, the runner's last commit) and 82 (v2.9.14, so seven of the eight non-replay-safe migrations still lie ahead and run for the first time). Each gets canary rows: user-set assignment times and a booked night. buildApp() on each asserts the baseline and the applied rest in order, the assignment times untouched, the booked-night reseat run exactly once on 205 and 82 and not at all on 242, schema_version kept, no half-built *_new table, a schema identical to a fresh install's, and an idempotent re-run. * refactor(server): demo-reset reads the live path off getRawConnection, not the db Proxy (m1) demo-reset.ts was the one src/ consumer of the db Proxy left, reached through a runtime require that a grep on `from` misses. It now imports closeDb/getRawConnection/reinitialize statically, the way backup.impl.ts does, so the Proxy genuinely has no src/ importer (the claim in database.ts and server/CLAUDE.md now holds). The path test mocks the module with vi.mock instead of teaching Node's require loader to answer for a .ts file. * test(server): renumber the duplicate ASSIGNREPO/PLACEREPO test ids Plan 4 introduced (m3) ASSIGNREPO-031/032 (the legacy-statement parity pair) become 034/035, and the later PLACEREPO-030..038 block becomes 053..061, the next free ids, so each id names one test again. No test body changes. * refactor(server): derive the two restated public row types instead of copying their columns (m4) JourneyPublicEntryPhotoRow restated JourneyPublicGalleryRow's nineteen columns with only the parent key changed; it is now that row with journey_id swapped for entry_id. PublicApiAssignedPlaceRow and its Kysely table shape restated PlaceRow's columns; both now Pick them off PlaceRow. Types only. The review's CPD method over Plan 4's new src lines drops from about 3.4% to 0.64%. * test(server): full-key parity for TripsRepository.findPublicForShare and VacaySharesRepository.listAvailableForShare (m5) Neither read had any test reference. Each is now pinned with toEqual(<legacy statement run raw on the same connection>), the listPublicForShare family shape: SH7 on a filled and a NULL-heavy trip plus a missing id (TRIPREPO-067/068), and VC90 over one world exercising every exclusion (caller, guest, existing share, plan owner, accepted member) and a missing plan. * fix(server): the legacy baseline runs createTables() instead of marking it, atomically with the run (N1) The legacy runner ran the running release's createTables() on every boot before its pending steps, and about 30 tables exist only there. Marking the baseline migration as executed left installs older than those tables (below legacy step 68) failing with "no such table: photo_provider_fields" and, since the rows were committed before the run, stuck half-baselined for every later boot. Only steps 1..N are recorded now, so the baseline's IF NOT EXISTS DDL runs first, as the legacy boot did. The rows are logged inside the same transaction as migrator.up({ transaction }), so a failed first boot records nothing and the next boot baselines again. A v66 fixture (the runner at 5be2e9b26) boots: 66 recorded, 178 applied, canaries kept. Its two schema differences from a fresh install (users.immich_access_token, reservations.accommodation_id INTEGER) come from the legacy chain itself and are pinned as carried. * fix(deps): sync the lockfiles with the bumped manifests and follow lucide's icon renames feat/orm raised react to ^19.3.0 and several plugin-sdk dependencies without regenerating the lockfiles, so npm ci failed on every CI job. The root overrides now pin react 19.3.0, both lockfiles are regenerated with npm 11, and the tests that select lucide icons by their old class names use the current ones. Two tests cover the Immich prefs reads and the boot restore branch that the coverage thresholds were missing. * ci: give the server lint step an 8 GB heap for the type-aware rules * test(server): keep the no-promise-as-value rule tester out of single-run mode on CI With CI=true typescript-eslint infers single-run mode, builds the program from the fixture file on disk and ignores the code each case passes in, so all 24 invalid cases reported nothing on the runner. Both testers now set disallowAutomaticSingleRunInference. * refactor(server): name the new migrations after the first seven words of their purpose, like the rest * fix(server): keep tsx a production dependency so image key rotation can load it * test(server): re-pin the repositories branch floor at the measured 89.83% * test(planner): keep the sidebar fixtures on past dates so the jump to today never fires in jsdom * test(server): keep console output for failing tests only and teach Nest's logger LOG_LEVEL * test(client): keep console output for failing tests only and answer the health probe * test(client): drop the health handler, it races the admin page's first load * chore(sonar): assert explicitly in two e2e cases, Number.NaN, and ignore S2187 on the legacy-upgrade fixtures --------- Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-10-06 19:27:30 +02:00
Maurice	6c0d08a415	Merge branch 'main' into fix/v4.3.3-dev ... Brings the v4.3.3 release back into the dev line, so the 4.4.0 release merges into main without conflicts. All twelve conflicts resolve to the dev side, which carries the same fixes adapted to dev (migration order of #2527, dev only code around the costs and PWA fixes). Against the dev fixes alone, the only change is the version bump to 4.3.3.	2026-09-26 14:23:45 +02:00
github-actions[bot]	1c05ee4b3a	chore: bump version to 4.3.3 [skip ci]	2026-09-26 12:23:05 +00:00
Maurice	4346d7f2c1	feat(help): in-app help center with per-screen guides and pictures ... A help icon on every screen opens a panel with the screen's overview, its sub-screens, task guides with a framed picture per step, search across guides and the wiki, and a switch to any other screen's help. Guides exist for the dashboard, Vacay, Atlas, Collections, Journey (list, journal, studio), Settings (all tabs), Admin (all tabs) and the trip frame; the trip's own screens are in progress. Pictures are produced by Playwright (client/e2e/help), texts in all 23 languages.	2026-09-24 14:05:42 +02:00
github-actions[bot]	151e32107f	chore: bump version to 4.3.2 [skip ci]	2026-09-24 11:14:02 +00:00
github-actions[bot]	ed8acf4c4b	chore: bump version to 4.3.1 [skip ci]	2026-09-22 12:17:29 +00:00
github-actions[bot]	b98787f836	chore: bump version to 4.3.0 [skip ci]	2026-09-20 13:56:50 +00:00
Maurice	67dd43bc8a	fix(maps): backport attribution sanitizer fix without dropping WebGL1	2026-09-11 14:55:37 +02:00
Maurice	f5ef14a05f	build(deps-dev): update vitest and coverage together	2026-09-11 14:35:51 +02:00
Maurice	7eba81dfd8	build(deps-dev): update sharp with its musl bindings	2026-09-11 14:35:50 +02:00
github-actions[bot]	8913782694	chore: bump version to 4.2.0 [skip ci]	2026-09-06 17:10:12 +02:00
Mohamed Elkmeshi	dc7d1f5e10	fix(maps): register the RTL text plugin so Arabic labels join ... Vector basemaps rendered Arabic, Hebrew, Persian and Urdu place names as isolated letters in logical order — "القاهرة" drawn as "ة ر ه ا ق ل ا" — because neither GL engine loads its optional RTL text plugin by default and TREK never registered one. Raster basemaps hid the problem, since their labels are drawn server-side, so it only became visible for everyone when the default basemap became a vector style. Both engine entry points now register the plugin lazily, so the payload is only fetched once a map actually paints RTL text and Latin-only users download nothing. The call is left with each engine because the two signatures genuinely differ: MapLibre takes (url, lazy) and returns a promise, Mapbox takes (url, callback, deferred). The plugin is bundled rather than loaded from a CDN: TREK is offline-first and the production CSP is script-src 'self', so a remote plugin URL would be refused by the worker that imports it. Bundling also puts it in the Workbox precache, so shaping keeps working offline. It needs a resolve alias because the package publishes only its ESM/WASM entry point through "exports" while setRTLTextPlugin requires the classic script in dist/ — the alias is shared by the build and test configs so the two cannot drift.	2026-09-04 19:53:33 +02:00
jubnl	394201cd32	feat(plugins): instance-wide settings editor in the admin UI (#2170) ... * chore: bump version to 4.1.0 [skip ci] * fix(collections): stop findDuplicateCollectionPlace merging places by coordinates alone Three places answered "is this a place the trip already has?", not two: PlacesService.findDuplicatePlace and isPlaceDuplicate got the shared strategy list in #2130; CollectionsService.findDuplicateCollectionPlace was missed and kept its own hand-rolled copy of the pre-#2130 order. Unlike findDuplicatePlace, this one had no isPlaceDuplicate() guard in front of it — savePlace calls it directly — so the coordinate fallback for a NAMED candidate was live, not latent: two distinct places sharing an address (a restaurant and the bar upstairs) would report each other as duplicates the moment their coordinates round to the same ~11 m box, regardless of name. It also never read google_place_id/google_ftid/osm_id at all, even though every collection_places row stores them, so a place renamed since it was saved could be saved again instead of being recognised by its provider id. Now walks placeMatchStrategies() from @trek/shared, same as findMatchingPlaceId: provider id, then name, then coordinates only when there is no name. savePlace passes the provider id fields through since they are already on the request body; the two bulk call sites (importablePlaces, saveFromTripPlaces) are unchanged, since their source rows don't carry provider ids to pass. Closes #2137 * fix(collections): ask the same question at all three call sites savePlace was not the only caller of findDuplicateCollectionPlace. The bulk copy already carries google_place_id/google_ftid/osm_id into the row it writes but asked without them, and the import picker never selected them at all, so a renamed place was recognised on one path and not on the other two. The picker answering differently from the import is the drift the method exists to prevent: a row shown as new would come back refused. COLLECTIONS-SVC-102 and -103 cover the bulk copy and the picker. * fix(map): give the Leaflet map its own zoom ceiling, so a vector basemap cannot take the planner down Opening a trip on 4.1.0 could land on the error boundary with "Map has no maxZoom specified", and so could the map settings tab, which left no screen from which to pick a different basemap. Leaflet answers getMaxZoom() from the map options first and otherwise from a layer that brought one, and only a GridLayer ever contributes via its beforeAdd hook. A vector basemap is a GL canvas on a plain L.Layer, so it contributes nothing, and MapContainer set no ceiling of its own. MarkerClusterGroup.onAdd refuses an infinite one by throwing, before any clustering, so an empty trip hit it too. That path opened when the default basemap became a MapLibre style. It reaches further than an operator choosing OpenFreeMap: resolveTileUrl sends a keyless CARTO template to the app default, which is now a vector style, so every instance still carrying the old CARTO basemap fell into it on upgrade. The ceiling belongs on the map rather than on the base layer, because it has to hold whichever of the three branches renders. 19 matches what the raster and satellite layers already carried, so nothing changes for the maps that worked. SharedTripPage gets the same treatment: it has no cluster to throw, but it draws the same vector basemap and its fitBounds asks for a ceiling. mapZoomCeiling.test.ts pins Leaflet's own semantics against the real library rather than a mock, since a mocked react-leaflet would have kept passing through all of this. * fix(map): put the CARTO key back on the template the settings preview draws The map settings fields hold what the user is editing rather than what useTileUrl already resolved, so the preview received a bare template with no key on it. resolveTileUrl then read it as a keyless CARTO url and did what it is meant to do with one: fall back to the app default. The preview drew OpenFreeMap while the fields said CARTO, whether or not a key was saved. Same reason the tab crashed for anyone on a CARTO basemap even after entering a key, which is the loop that made this hard to escape: the key is entered on the page the fallback had taken down. FE-COMP-MAP-033b pins the template the preview is handed, with and without a key. * fix(admin): put the CARTO key back on the default-settings map preview too Same shape as the user-facing map tab, and reported alongside it: the field holds what the admin is editing, so the preview resolved a keyless CARTO template and drew the app default instead of the basemap being set. * fix(mobile): put the CARTO key back on the phone map settings preview too The third preview with the same shape, and the one that matters most while the crash is live: the phone layout is where someone would go to change the basemap when the desktop tab will not open. * fix(calendar): a fully timed stay is its two hand-overs, not a week-long bar Closes #2136 A stay was always exported as an all-day block across its whole range, and the check-in and check-out markers came on top of it. When the stay records both ends of its clock the markers already say everything the block does, and the block is the half nobody can act on: it takes a week of calendar to repeat what two one-hour events state precisely. Same shape as the parking and rental windows in #2068. Only where the markers actually stand in for the booking, though. They are emitted once per stay and titled from its lowest-id reservation, so a second room on the same stay would otherwise be left with nothing at all. A stay that knows only one end keeps its block too, since nothing else carries the other end's date. CAL-025b covers the drop, -025c the one-sided stay, -025d the second room. * fix(mobile): the phone admin map preview needs the CARTO key too The fourth preview with the same shape, missed when the other three were fixed. Sonar pointed at it: the desktop and phone admin pages are near-identical, so the duplication report named the file the change had not reached. * chore: bump version to 4.1.1 [skip ci] * feat(plugins): admin editor for instance-wide plugin settings The scope:'instance' settings a plugin declares had API endpoints but no UI. - shared: plugins.schema.ts — the settings-field descriptor and the admin instance-config GET/PUT wire contracts, imported by both sides - server: GET /api/admin/plugins/:id/config now returns the declared fields alongside the (masked) values; PUT re-spawns an ACTIVE plugin (its child reads config once, at init) and reports it via 'restarted'; the admin list carries instanceSettingsCount so the UI gates its menu item without a fetch - client: 'Instance settings' row action opening a form modal (desktop) / MSheet (phone) in both admin shells — checkbox/select/secret rendering as in the user settings form; an untouched secret mask is never sent back - i18n: three new admin.plugins.* keys in every locale * refactor(plugins): move the admin body contracts to @trek/shared The remaining plugin DTO schemas (install, link, activate, uninstall, retrust, update, egress-hosts, user-settings update, route) now live in shared/src/plugins/plugins.schema.ts with their inferred types, alongside the instance-config contracts. The journey-contract doctrine notes (#1842) moved with them — each body stays deliberately loose so the handlers keep the rejections and fallbacks they already own, and new spec tests pin that looseness so a well-meant tightening breaks a test that explains itself. plugins.dto.ts is now thin createZodDto wrappers over the shared schemas (same class names, no controller changes), and the client's pluginInstall types its options and body against PluginInstallRequest. * fix(admin): offer Allowed hosts only to plugins that declared operatorEgress The row's egress chip was already gated on the declaration, but the kebab menu (desktop) and row action sheet (phone) offered Allowed hosts on every installed plugin — inviting the admin to widen egress for plugins that never asked for it. Both entries now render only when the plugin declares operatorEgress; the dialog's unsupported-notice fallback stays as the truth-teller for stale list data. * test(admin): close the Sonar gaps on the instance-settings form The PR gate flagged new-code coverage (76.4%) and duplication (10.9%). - The two identical 39-line handler blocks were logic, not markup — they move into one shared useInstanceSettings hook; each shell keeps its own markup (the deliberate desktop/phone divergence stays) - New tests per shell cover the untested branches: every field type renders and round-trips into the save payload (select, checkbox/MToggle, number, hint, no-label key fallback), a failed fetch is a toast, a rejected save shows the server reason and keeps the edits, and the dialog/sheet closes without saving - INS-009 covers the controller's no-body '|| {}' fallback --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: michael-bohr <263459669+michael-bohr@users.noreply.github.com> Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-09-01 06:45:24 +02:00
Maurice	e6ccaf89de	Revert "chore: bump version to 4.1.0 [skip ci]" ... This reverts commit 88ebf89ab3.	2026-08-29 13:15:22 +02:00
github-actions[bot]	88ebf89ab3	chore: bump version to 4.1.0 [skip ci]	2026-08-29 10:59:15 +00:00
Maurice	b401da2264	fix(maps): default the Leaflet basemap to OpenFreeMap ... CARTO started stamping "API KEY REQUIRED" across every keyless basemap tile on 26.08.2026. #2060 added a key field as the immediate answer, but it leaves a self-hosted instance needing an email exchange with CARTO before its maps look right, and every default in the client still pointed at CARTO. Default to OpenFreeMap Positron instead: no key, no account, no request limit, commercial use allowed, attribution required. OpenFreeMap serves vector tiles only, so the Leaflet basemap is a MapLibre style document rather than an XYZ template. maplibre-gl-leaflet hangs a GL canvas into Leaflet's own tile pane, which leaves everything above it alone - markers, GeoJSON, clusters, plugin layers, the custom panes, and the click handling, since Leaflet's CSS already puts pointer-events:none on that layer. maplibre-gl still arrives only through a dynamic import, so no chunk that draws a map grows by a megabyte. Switched: the trip planner, the MapView fallback every preview goes through, the journey map, collections, the atlas, the shared trip page and the offline tile prefetch. OpenFreeMap Positron and Bright join the tile presets in settings, the admin defaults and both mobile screens. A CARTO template that is already saved keeps working when a key backs it - that stays a supported choice. Without a key it is not drawn at all: resolveTileUrl falls back to the default rather than to a watermark, so an instance that upgrades with one in its settings sees the new basemap immediately and needs no migration. The stored value is left as it is, so the Map settings tab still shows what was chosen and the warning underneath it explains why - one sentence appended, in all 23 locales. OpenFreeMap asks for a credit of its own; OpenStreetMap alone under its tiles is wrong and a licence problem. attributionForTile() derives it from the URL rather than from a flag at each call site, and the shared trip map, which carried no attribution at all, now gets one. Offline maps keep working and get cheaper. A vector style is four things instead of one, so sync/glPrefetcher.ts walks the style document, its sprite, the Latin glyph ranges of each font stack it uses, the TileJSON - the planet path is versioned, so guessing it answers 200 with an empty body - and then the .pbf tiles. Over the Berlin bounding box TREK computes, raster z10-16 is 2237 requests and 34.6 MB and gives up above z16; vector z10-14 is 177 requests and 32.1 MB and stays sharp above that, because MapLibre scales the z14 tile rather than asking for another. The Workbox rule for tiles.openfreemap.org moves to CacheFirst and shares the prefetcher's cache, so browsing tops a downloaded region up instead of filling a second copy beside it - a versioned tile path can never be stale. Clearing offline maps clears it too. The atlas loses its second raster layer. It existed to warm the HTTP cache of neighbouring zoom levels, which a vector basemap does not need; a second one would only cost a second WebGL context. OpenFreeMap has no label-free style, so its labels are switched off on the live map instead - they are all symbol layers, while borders and coastlines are line and fill - re-armed on style.load so a theme switch keeps them off. Theme changes call setStyle in place rather than rebuilding the layer: a swap per toggle would leak a WebGL context, and browsers cap those in the low teens.	2026-08-29 00:51:43 +02:00
github-actions[bot]	a00b84b216	chore: bump version to 4.0.0 [skip ci]	2026-08-27 11:23:54 +00:00
jubnl	77dddd5e8a	v4.0.0 (#1719) ... Release branch for 4.0.0.	2026-08-27 13:22:39 +02:00
github-actions[bot]	a099465889	chore: bump version to 3.4.1 [skip ci]	2026-07-19 17:30:21 +00:00
github-actions[bot]	55fa668dd2	chore: bump version to 3.4.0 [skip ci]	2026-07-18 20:51:16 +00:00
jubnl	f1b585727a	fix: build	2026-07-18 22:49:56 +02:00