null/BillTracker
null
/
BillTracker
1
0
Fork 0
Code Issues 4 Pull Requests Packages Projects Releases 1 Wiki Activity
BillTracker/package.json

116 lines
4.3 KiB
JSON
Raw Normal View History

initial commit
2026-05-03 19:51:57 -05:00
{
"name": "bill-tracker",
release: v0.41.1 — passkeys shipped + QA blind-spot fixes + standards unification Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:31:27 -05:00
"version": "0.41.1",
initial commit
2026-05-03 19:51:57 -05:00
"description": "Monthly bill tracking system",
refactor(server): migrate app entry point to TypeScript (.cts) — server migration 100% Completes the JS→TS server migration. server.js → server.cts (Node type-stripping, no build step), and every launch/config reference now points at it: package.json (main/dev:api/start/check:server) and the Docker CMD. scripts/seedDemoData.js is required at runtime by routes/user.cts, so it crosses into the server runtime — migrated to .cts and its require of db/database updated to the .cts path. The remaining scripts/*.js are standalone dev/ops tooling (outside the runtime and the check:server boundary); their stale extensionless requires of now-.cts modules were repaired so they still run, and the PM2 ecosystem config entry point was updated to server.cts. Verified: 0 runtime .js remain in the server tree; typecheck:server and check:server clean; 226/226 tests pass; `node server.cts` boots and /api/health returns 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 11:41:56 -05:00
"main": "server.cts",
chore(deploy): harden Docker/compose from the deployment audit - Dockerfile: npm ci (reproducible, lock-pinned, matches CI) instead of npm install; add a HEALTHCHECK against the /api/health liveness route. - package.json: pin engines node>=22.18.0 — the server require()s .mts/.cts and relies on Node's default TS type-stripping (unflagged only on >=22.18), which was previously undocumented on a floating base image. - .dockerignore: exclude .env / .env.* so a stray env file can't be baked into the image by COPY . . - docker-compose: set TRUST_PROXY=true (behind the reverse proxy, so Secure cookies + client IP for rate-limit/audit are correct); flip CSRF_HTTP_ONLY to true (SPA reads the token from an endpoint, so no JS cookie access needed); remove the active default INIT_ADMIN_PASS; document TOKEN_ENCRYPTION_KEY (set it to move at-rest secrets off the DB-resident key); drop obsolete version key. Not included: TOKEN_ENCRYPTION_KEY itself — that's a secret to generate and inject into the deployment env (the app self-migrates to the env-key scheme on next boot); documented in compose + .env.example. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-05 18:54:50 -05:00
"engines": {
"node": ">=22.18.0"
},
initial commit
2026-05-03 19:51:57 -05:00
"scripts": {
refactor(server): migrate app entry point to TypeScript (.cts) — server migration 100% Completes the JS→TS server migration. server.js → server.cts (Node type-stripping, no build step), and every launch/config reference now points at it: package.json (main/dev:api/start/check:server) and the Docker CMD. scripts/seedDemoData.js is required at runtime by routes/user.cts, so it crosses into the server runtime — migrated to .cts and its require of db/database updated to the .cts path. The remaining scripts/*.js are standalone dev/ops tooling (outside the runtime and the check:server boundary); their stale extensionless requires of now-.cts modules were repaired so they still run, and the PM2 ecosystem config entry point was updated to server.cts. Verified: 0 runtime .js remain in the server tree; typecheck:server and check:server clean; 226/226 tests pass; `node server.cts` boots and /api/health returns 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 11:41:56 -05:00
"dev:api": "node --watch server.cts",
initial commit
2026-05-03 19:51:57 -05:00
"dev:ui": "vite",
"dev": "concurrently \"npm run dev:api\" \"npm run dev:ui\"",
"build": "vite build",
refactor(server): migrate app entry point to TypeScript (.cts) — server migration 100% Completes the JS→TS server migration. server.js → server.cts (Node type-stripping, no build step), and every launch/config reference now points at it: package.json (main/dev:api/start/check:server) and the Docker CMD. scripts/seedDemoData.js is required at runtime by routes/user.cts, so it crosses into the server runtime — migrated to .cts and its require of db/database updated to the .cts path. The remaining scripts/*.js are standalone dev/ops tooling (outside the runtime and the check:server boundary); their stale extensionless requires of now-.cts modules were repaired so they still run, and the PM2 ecosystem config entry point was updated to server.cts. Verified: 0 runtime .js remain in the server tree; typecheck:server and check:server clean; 226/226 tests pass; `node server.cts` boots and /api/health returns 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 11:41:56 -05:00
"check:server": "find server.cts db middleware routes services utils workers \\( -name '*.js' -o -name '*.mts' -o -name '*.cts' -o -name '*.ts' \\) -print0 | xargs -0 -n1 node --check",
feat(server-ts): migrate the money boundary to TypeScript on Node's native runtime (Phase 2) Establishes the server-TypeScript foundation and migrates utils/money → utils/money.mts with branded Cents/Dollars (mirroring the client), so the cents↔dollars boundary — the origin of the reconciliation bug class — is a compile error for any typed server caller. Approach (no build step): Node 25 runs .ts natively (type-stripping). Migrated modules use the explicit-ESM .mts extension (the project is "type":"commonjs", which disables .ts ESM auto-detection) and are required from the CJS callers via Node's require(esm) — verified working. Infra: tsconfig.server.json (allowJs + checkJs:false → incremental like the client), npm run typecheck:server, check:server extended to .mts, wired into ci. 28 require sites repointed to money.mts. typecheck:server clean; full server suite 225 + e2e probe 17/17 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-05 13:44:04 -05:00
"typecheck:server": "tsc --noEmit -p tsconfig.server.json",
chore(tooling): add Prettier + editorconfig, extend ESLint to the server Standardization foundation (Pillar A): - Prettier (.prettierrc.json, .prettierignore) + `format`/`format:check` scripts; style tuned to the house style (single quotes, semicolons, 2-space, printWidth 100). - .editorconfig for editor-level consistency. - Extend the flat ESLint config to lint server `.cts` (Node globals, TS parser, "focused signal" rule set mirroring the client) so `eslint .` now covers both halves; `lint` → `eslint .`. - Wire `format:check` into the `ci` script. `npm run lint` is green (0 errors; pre-existing intentional patterns kept as advisory warnings to ratchet later). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:23:53 -05:00
"lint": "eslint .",
"format": "prettier --write client routes services middleware db workers utils setup scripts tests e2e types server.cts \"*.{json,md,mjs}\"",
"format:check": "prettier --check client routes services middleware db workers utils setup scripts tests e2e types server.cts \"*.{json,md,mjs}\"",
build(ts): TypeScript foundation — tsconfig + typecheck in CI (T1) Adopting TypeScript incrementally (the move off plain JS). Upgraded jsconfig -> tsconfig with strict + noUncheckedIndexedAccess, but allowJs + checkJs:false so every existing .js/.jsx keeps resolving and running untouched — only .ts/.tsx get type-checked. Added 'npm run typecheck' (tsc --noEmit) and wired it into 'npm run ci'. Installed typescript 6 + @types/react/react-dom 19. Client-scoped (Vite resolves the '@/' paths); the CommonJS server is a separate TS story. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 21:33:26 -05:00
"typecheck": "tsc --noEmit -p tsconfig.json",
v0.28.0
2026-05-15 22:45:38 -05:00
"check": "npm run check:server && npm run build",
v0.28.01
2026-05-16 20:26:09 -05:00
"test": "node --test tests/*.test.js",
feat(cashflow): safe-to-spend projection with timeline, vitest setup, package upgrades
2026-06-12 01:32:28 -05:00
"test:client": "vitest run",
"test:all": "npm run test && npm run test:client",
fix(qa): seed demo data amounts, bill amount validation, negative USD format, a11y aria-labels, Playwright E2E setup (batch 0.41.0 QA)
2026-07-02 20:36:09 -05:00
"test:e2e": "node e2e/setup/prepare-db.js && playwright test --project=chromium-desktop --project=chromium-mobile",
"test:e2e:ui": "node e2e/setup/prepare-db.js && playwright test --ui",
"test:e2e:update": "node e2e/setup/prepare-db.js && playwright test --project=chromium-desktop --project=chromium-mobile --update-snapshots",
"test:e2e:probe": "node e2e/setup/prepare-db.js && playwright test --project=probe",
test(qa): production-build smoke (B15) — validates split chunks at runtime - scripts/prod-smoke.js + prod-smoke.sh: build, boot `node server.js` serving dist/ against a scratch DB, and drive the real artifact with Playwright (login + lazy routes) to confirm the vendor-chunk split loads in production - npm run smoke:prod; passes green - docs: B15 harness command + status Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-02 21:45:25 -05:00
"smoke:prod": "bash scripts/prod-smoke.sh",
ci(enforce): run the full gate in CI + add lefthook pre-commit + Knip Pillar A enforcement so standards can't drift: - .forgejo CI now runs format:check + lint (client+server) + typecheck (client) + typecheck:server, in addition to the existing check:server / tests / build. Previously lint and typecheck were NOT run in CI. - lefthook pre-commit auto-formats staged files (prettier) + lints; pre-push typechecks. Auto-installed via the `prepare` script. - Knip config (advisory `npm run knip`) for dead-code/unused-export review; the design-system ui/** is ignored to keep signal clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:27:03 -05:00
"knip": "knip",
chore(tooling): add Prettier + editorconfig, extend ESLint to the server Standardization foundation (Pillar A): - Prettier (.prettierrc.json, .prettierignore) + `format`/`format:check` scripts; style tuned to the house style (single quotes, semicolons, 2-space, printWidth 100). - .editorconfig for editor-level consistency. - Extend the flat ESLint config to lint server `.cts` (Node globals, TS parser, "focused signal" rule set mirroring the client) so `eslint .` now covers both halves; `lint` → `eslint .`. - Wire `format:check` into the `ci` script. `npm run lint` is green (0 errors; pre-existing intentional patterns kept as advisory warnings to ratchet later). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:23:53 -05:00
"ci": "npm run format:check && npm run lint && npm run typecheck && npm run typecheck:server && npm run check:server && npm run test:all && npm run build",
ci(enforce): run the full gate in CI + add lefthook pre-commit + Knip Pillar A enforcement so standards can't drift: - .forgejo CI now runs format:check + lint (client+server) + typecheck (client) + typecheck:server, in addition to the existing check:server / tests / build. Previously lint and typecheck were NOT run in CI. - lefthook pre-commit auto-formats staged files (prettier) + lints; pre-push typechecks. Auto-installed via the `prepare` script. - Knip config (advisory `npm run knip`) for dead-code/unused-export review; the design-system ui/** is ignored to keep signal clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:27:03 -05:00
"prepare": "lefthook install",
refactor(server): migrate app entry point to TypeScript (.cts) — server migration 100% Completes the JS→TS server migration. server.js → server.cts (Node type-stripping, no build step), and every launch/config reference now points at it: package.json (main/dev:api/start/check:server) and the Docker CMD. scripts/seedDemoData.js is required at runtime by routes/user.cts, so it crosses into the server runtime — migrated to .cts and its require of db/database updated to the .cts path. The remaining scripts/*.js are standalone dev/ops tooling (outside the runtime and the check:server boundary); their stale extensionless requires of now-.cts modules were repaired so they still run, and the PM2 ecosystem config entry point was updated to server.cts. Verified: 0 runtime .js remain in the server tree; typecheck:server and check:server clean; 226/226 tests pass; `node server.cts` boots and /api/health returns 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 11:41:56 -05:00
"start": "node server.cts"
initial commit
2026-05-03 19:51:57 -05:00
},
"dependencies": {
"@radix-ui/react-alert-dialog": "^1.1.2",
"@radix-ui/react-checkbox": "^1.1.2",
v0.25.0: roadmap redesign, import CSRF fix, AdminDashboard removed - RoadmapPage: kanban-style priority lanes, shadcn Collapsible/Tabs, lazy-loaded activity log, admin-only /api/about/roadmap + /dev-log endpoints - Import CSRF fix: added x-csrf-token header to importAdminBackup, previewSpreadsheetImport, previewUserDbImport raw fetch() calls - Removed AdminDashboard.jsx, replaced by RoadmapPage - Added @radix-ui/react-collapsible + collapsible shadcn component - Security audit by Private_Hudson: PASS (CSRF fix verified, admin endpoints gated, path traversal mitigated, XSS safe)
2026-05-11 21:42:36 -05:00
"@radix-ui/react-collapsible": "^1.1.12",
initial commit
2026-05-03 19:51:57 -05:00
"@radix-ui/react-dialog": "^1.1.2",
"@radix-ui/react-dropdown-menu": "^2.1.2",
"@radix-ui/react-label": "^2.1.0",
"@radix-ui/react-select": "^2.1.2",
"@radix-ui/react-slot": "^1.1.0",
"@radix-ui/react-switch": "^1.1.1",
"@radix-ui/react-tabs": "^1.1.1",
"@radix-ui/react-tooltip": "^1.1.3",
feat: bank sync section, data sources route, subscription page updates, package updates
2026-06-07 02:03:00 -05:00
"@simplewebauthn/browser": "^13.0.0",
"@simplewebauthn/server": "^13.0.0",
v0.22.0: React Query Migration - Added @tanstack/react-query and @tanstack/react-query-devtools - Created useTracker, useBills, useCategories custom hooks (useQueries.js) - Migrated TrackerPage from manual useState/useEffect to useQuery - Added QueryClientProvider with 2min staleTime, 1 retry, refetchOnWindowFocus: false - Added ReactQueryDevtools for development - Fixed error handling: useRef pattern prevents duplicate toast notifications - Replaced load() callback with refetch() from useQuery - Hudson security audit: 4/5 PASS (1 FAIL fixed: error handling toast duplication)
2026-05-10 03:10:43 -05:00
"@tanstack/react-query": "^5.100.9",
"@tanstack/react-query-devtools": "^5.100.9",
feat: bank sync section, data sources route, subscription page updates, package updates
2026-06-07 02:03:00 -05:00
"@tanstack/react-virtual": "^3.14.2",
chore(deps): low-risk majors — bcryptjs 3, sonner 2, lucide-react 1.x, concurrently 10 (4e) bcryptjs 3 verifies existing $2a/$2b hashes (authService tests 7/7); sonner 2 + lucide 1.x compile clean (typecheck + build); no icon renames in our set. Server 252/252, client 52/52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:35:39 -05:00
"bcryptjs": "^3.0.3",
push
2026-05-09 13:03:36 -05:00
"better-sqlite3": "^12.9.0",
initial commit
2026-05-03 19:51:57 -05:00
"class-variance-authority": "^0.7.0",
"clsx": "^2.1.1",
"cookie-parser": "^1.4.6",
"cors": "^2.8.5",
feat(server): upgrade Express 4.18 → 5.2 (Phase 2) The maintained line, and it forwards rejected async handlers to the error middleware natively — closing the Express-4 gap where a throw in an async route became an unhandled rejection that hung the request (this is why no throwaway asyncHandler wrapper was needed). Small surface: only three bare-* routes needed the path-to-regexp-v8 named-wildcard form (/api/*splat, /legacy/*splat, /{*splat}); no removed APIs in use, all req.query uses are reads. Suite 225 + probe 17/17 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-05 13:25:00 -05:00
"express": "^5.2.1",
initial commit
2026-05-03 19:51:57 -05:00
"express-rate-limit": "^8.4.1",
feat: framer-motion page transitions and UI polish
2026-06-07 15:14:09 -05:00
"framer-motion": "^12.40.0",
feat(db): Kysely typed-SQL POC — sync builder, proven parity (Pillar E) De-risks the flagship. The app is synchronous (better-sqlite3) but Kysely executes async, so db/kysely.cts uses Kysely as a TYPE-SAFE BUILDER only: build the query (columns + user_id/deleted_at scoping + types checked at compile time), `.compile()`, then run via sync helpers (all/get/run) on the shared connection. No async ripple, no change to the sync model. - Schema typed for `categories` (extend as adopted). - tests/kyselyPoc.test.js proves byte-identical rows vs the raw SQL and that compiled SQL is parameterized (injection-safe). - Pattern documented in CODE_STANDARDS; adopt for new/refactored queries; it type-enforces user-scoping (the biggest data-isolation win) and removes Row=any at the call site. typecheck:server + check:server clean; 248/248 server tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 16:23:50 -05:00
"kysely": "^0.29.3",
chore(deps): low-risk majors — bcryptjs 3, sonner 2, lucide-react 1.x, concurrently 10 (4e) bcryptjs 3 verifies existing $2a/$2b hashes (authService tests 7/7); sonner 2 + lucide 1.x compile clean (typecheck + build); no icon renames in our set. Server 252/252, client 52/52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:35:39 -05:00
"lucide-react": "^1.24.0",
security fixes
2026-05-28 03:59:35 -05:00
"node-cron": "^4.2.1",
fix(deps)!: clear both high-severity vulns; CI audit gate raised to high - nodemailer 8 -> 9 (GHSA-p6gq-j5cr-w38f, raw-option file-read/SSRF; we never use the raw option — notificationDelivery tests 13/13) - xlsx -> official SheetJS dist 0.20.3 (prototype pollution GHSA-4r6h-8v6p-xvw6 + ReDoS GHSA-5pgg-2g8v-p4x9; npm registry line is abandoned at 0.18.5 with no fix). API-identical for our 8 call sites; import/export round-trip tests green. NOTE: the lockfile now pins https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz — CI runners and Docker builds need egress to cdn.sheetjs.com - CI: npm audit --audit-level critical -> high (0 vulns as of this commit; highs can no longer pass silently — QA-B0-02) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:34:51 -05:00
"nodemailer": "^9.0.3",
chore(deps)!: openid-client 5 -> 6 (4j) v6 replaced the Issuer/Client classes with a functional API. The four touchpoints rewritten: discovery() + ClientSecretBasic/Post for the cached configuration, serverMetadata() for the admin config test, buildAuthorizationUrl() (returns URL -> .href), and authorizationCodeGrant() with pkceCodeVerifier/expectedNonce/expectedState for the callback exchange — same validation surface (JWKS signature, iss/aud/exp/nbf, PKCE, state, nonce), now enforced by the library's single grant call. scripts/test-oidc-smoke.js: 44/44. Server suite 252/252. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 18:05:57 -05:00
"openid-client": "^6.8.4",
feat: TOTP 2FA for login & profile setup flow
2026-06-04 04:10:14 -05:00
"otplib": "^13.4.1",
"qrcode": "^1.5.4",
chore: dependency updates and UI fixes (batch)
2026-06-07 14:23:19 -05:00
"react": "^19.2.7",
"react-dom": "^19.2.7",
chore(deps)!: vite 8 (rolldown) + @vitejs/plugin-react 6 (4h) Build drops 6.5s -> 0.65s. Three breakages found by the prod-smoke gate, all fixed: - rolldown removed object-form manualChunks -> function form in vite.config.mjs (same vendor split, all @radix/@tanstack grouped) - the 4a 'send' bump rejects bare absolute paths: SPA fallback sendFile and both download routes (admin backup, user-db export) now use the root-option form - rolldown minifies inline HTML scripts, breaking any CSP hash approach: the pre-paint theme script moved to client/public/theme-init.js so script-src 'self' holds with no inline hash to maintain @testing-library/dom added (peer no longer auto-installed). Server 252, client 52, probe 18/18, PROD SMOKE: PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:53:27 -05:00
"react-router-dom": "^7.18.1",
chore(deps): low-risk majors — bcryptjs 3, sonner 2, lucide-react 1.x, concurrently 10 (4e) bcryptjs 3 verifies existing $2a/$2b hashes (authService tests 7/7); sonner 2 + lucide 1.x compile clean (typecheck + build); no icon renames in our set. Server 252/252, client 52/52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:35:39 -05:00
"sonner": "^2.0.7",
chore(deps)!: tailwind 3 -> 4 via @tailwindcss/vite (4i) Official codemod (run in a clean worktree; docker-owned data/ blocks it in-tree): tailwind.config.js inlined into client/index.css as CSS-first @theme/@utility (config file deleted — v4 auto-detects content, which also retires the .tsx-content-glob failure class from the TS migration), 33 template files' class renames applied, tailwindcss-animate loads via the v4 @plugin bridge. Build runs through @tailwindcss/vite; postcss config is now plugin-free. tailwind-merge -> 3 (v4 class model). Visual-regression gate: only diffs were a ~2px global preflight shift + the version string (baseline predated 0.41.1); re-baselined both login screenshots in this commit after review. webauthn.probe confined to the probe project (it enables WebAuthn for the seeded user, racing the parallel UI projects' password logins). e2e 27 passed, probe 18/18, PROD SMOKE PASS, typecheck/lint/tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 18:03:15 -05:00
"tailwind-merge": "^3.6.0",
initial commit
2026-05-03 19:51:57 -05:00
"tailwindcss-animate": "^1.0.7",
fix(deps)!: clear both high-severity vulns; CI audit gate raised to high - nodemailer 8 -> 9 (GHSA-p6gq-j5cr-w38f, raw-option file-read/SSRF; we never use the raw option — notificationDelivery tests 13/13) - xlsx -> official SheetJS dist 0.20.3 (prototype pollution GHSA-4r6h-8v6p-xvw6 + ReDoS GHSA-5pgg-2g8v-p4x9; npm registry line is abandoned at 0.18.5 with no fix). API-identical for our 8 call sites; import/export round-trip tests green. NOTE: the lockfile now pins https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz — CI runners and Docker builds need egress to cdn.sheetjs.com - CI: npm audit --audit-level critical -> high (0 vulns as of this commit; highs can no longer pass silently — QA-B0-02) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:34:51 -05:00
"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
initial commit
2026-05-03 19:51:57 -05:00
},
"devDependencies": {
fix(qa): seed demo data amounts, bill amount validation, negative USD format, a11y aria-labels, Playwright E2E setup (batch 0.41.0 QA)
2026-07-02 20:36:09 -05:00
"@axe-core/playwright": "^4.10.1",
chore(deps): eslint 10 stack — @eslint/js 10, react-hooks 7, react-refresh 0.5 (4f) eslint 10's recommended set adds no-useless-assignment; fixed the three real dead initial assignments it caught (version.cts updatedAt, simplefinService claimUrl/accessUrl). Lint 0 errors; ratchet rules from the standards batch carry over unchanged. Server 252, client 52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:36:50 -05:00
"@eslint/js": "^10.0.1",
fix(qa): seed demo data amounts, bill amount validation, negative USD format, a11y aria-labels, Playwright E2E setup (batch 0.41.0 QA)
2026-07-02 20:36:09 -05:00
"@playwright/test": "^1.50.1",
chore(deps)!: tailwind 3 -> 4 via @tailwindcss/vite (4i) Official codemod (run in a clean worktree; docker-owned data/ blocks it in-tree): tailwind.config.js inlined into client/index.css as CSS-first @theme/@utility (config file deleted — v4 auto-detects content, which also retires the .tsx-content-glob failure class from the TS migration), 33 template files' class renames applied, tailwindcss-animate loads via the v4 @plugin bridge. Build runs through @tailwindcss/vite; postcss config is now plugin-free. tailwind-merge -> 3 (v4 class model). Visual-regression gate: only diffs were a ~2px global preflight shift + the version string (baseline predated 0.41.1); re-baselined both login screenshots in this commit after review. webauthn.probe confined to the probe project (it enables WebAuthn for the seeded user, racing the parallel UI projects' password logins). e2e 27 passed, probe 18/18, PROD SMOKE PASS, typecheck/lint/tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 18:03:15 -05:00
"@tailwindcss/vite": "^4.3.2",
chore(deps)!: vite 8 (rolldown) + @vitejs/plugin-react 6 (4h) Build drops 6.5s -> 0.65s. Three breakages found by the prod-smoke gate, all fixed: - rolldown removed object-form manualChunks -> function form in vite.config.mjs (same vendor split, all @radix/@tanstack grouped) - the 4a 'send' bump rejects bare absolute paths: SPA fallback sendFile and both download routes (admin backup, user-db export) now use the root-option form - rolldown minifies inline HTML scripts, breaking any CSP hash approach: the pre-paint theme script moved to client/public/theme-init.js so script-src 'self' holds with no inline hash to maintain @testing-library/dom added (peer no longer auto-installed). Server 252, client 52, probe 18/18, PROD SMOKE: PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:53:27 -05:00
"@testing-library/dom": "^10.4.1",
feat(settings): auto-save preferences with live save status (batch 0.39.0) Replace all Save buttons on the Settings page with debounced auto-save: - useAutoSave hook: debounce with latest-payload-wins, flush() for blur, pending-edit flush on unmount, status machine (idle/saving/saved/error) with saved fading back to idle. Covered by 6 Vitest tests (fake timers). - SaveStatus pill (framer-motion) in the page header and notification card headers — Saving…/Saved/Save failed. - Timing per control: toggles/selects/channel ~150-400ms; typed inputs (email, URLs, grace period, drift pct) 900ms + flush on blur. - Push token never auto-saves mid-type: saves on blur only, so a partial token can never overwrite a working one. - Notification cards no longer refetch parent settings on save (would clobber in-flight edits under auto-save). - Decision: no undo toast — settings are non-destructive and instantly re-editable; undo would add noise without safety. - vitest include now picks up .jsx tests; jsdom + @testing-library/react added as devDependencies.
2026-06-12 02:08:42 -05:00
"@testing-library/react": "^16.3.2",
feat(server-ts): migrate the money boundary to TypeScript on Node's native runtime (Phase 2) Establishes the server-TypeScript foundation and migrates utils/money → utils/money.mts with branded Cents/Dollars (mirroring the client), so the cents↔dollars boundary — the origin of the reconciliation bug class — is a compile error for any typed server caller. Approach (no build step): Node 25 runs .ts natively (type-stripping). Migrated modules use the explicit-ESM .mts extension (the project is "type":"commonjs", which disables .ts ESM auto-detection) and are required from the CJS callers via Node's require(esm) — verified working. Infra: tsconfig.server.json (allowJs + checkJs:false → incremental like the client), npm run typecheck:server, check:server extended to .mts, wired into ci. 28 require sites repointed to money.mts. typecheck:server clean; full server suite 225 + e2e probe 17/17 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-05 13:44:04 -05:00
"@types/node": "^26.1.0",
build(ts): TypeScript foundation — tsconfig + typecheck in CI (T1) Adopting TypeScript incrementally (the move off plain JS). Upgraded jsconfig -> tsconfig with strict + noUncheckedIndexedAccess, but allowJs + checkJs:false so every existing .js/.jsx keeps resolving and running untouched — only .ts/.tsx get type-checked. Added 'npm run typecheck' (tsc --noEmit) and wired it into 'npm run ci'. Installed typescript 6 + @types/react/react-dom 19. Client-scoped (Vite resolves the '@/' paths); the CommonJS server is a separate TS story. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 21:33:26 -05:00
"@types/react": "^19.2.17",
"@types/react-dom": "^19.2.3",
chore(deps)!: vite 8 (rolldown) + @vitejs/plugin-react 6 (4h) Build drops 6.5s -> 0.65s. Three breakages found by the prod-smoke gate, all fixed: - rolldown removed object-form manualChunks -> function form in vite.config.mjs (same vendor split, all @radix/@tanstack grouped) - the 4a 'send' bump rejects bare absolute paths: SPA fallback sendFile and both download routes (admin backup, user-db export) now use the root-option form - rolldown minifies inline HTML scripts, breaking any CSP hash approach: the pre-paint theme script moved to client/public/theme-init.js so script-src 'self' holds with no inline hash to maintain @testing-library/dom added (peer no longer auto-installed). Server 252, client 52, probe 18/18, PROD SMOKE: PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:53:27 -05:00
"@vitejs/plugin-react": "^6.0.3",
build(react): enable React Compiler (React 19 auto-memoization) (F2) Added babel-plugin-react-compiler to the Vite React plugin. The compiler auto-memoizes components/hooks at build time, so manual useMemo/useCallback become largely unnecessary going forward (existing ones are left in place — harmless, and the compiler adds the rest). Safe here because the codebase is rules-of-hooks clean (enforced by eslint-plugin-react-hooks). Validated: production build succeeds and the e2e probe passes 17/17 with the compiler on — every authed page renders axe-clean and Tracker/Summary/Analytics reconciliation holds. (Build time ~2.2s -> ~6.2s from the compiler pass; the runtime win is automatic memoization.) The compiler ESLint rule needs eslint-plugin-react-hooks v6 — a future upgrade. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 21:20:26 -05:00
"babel-plugin-react-compiler": "^1.0.0",
chore(deps): low-risk majors — bcryptjs 3, sonner 2, lucide-react 1.x, concurrently 10 (4e) bcryptjs 3 verifies existing $2a/$2b hashes (authService tests 7/7); sonner 2 + lucide 1.x compile clean (typecheck + build); no icon renames in our set. Server 252/252, client 52/52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:35:39 -05:00
"concurrently": "^10.0.3",
chore(deps): eslint 10 stack — @eslint/js 10, react-hooks 7, react-refresh 0.5 (4f) eslint 10's recommended set adds no-useless-assignment; fixed the three real dead initial assignments it caught (version.cts updatedAt, simplefinService claimUrl/accessUrl). Lint 0 errors; ratchet rules from the standards batch carry over unchanged. Server 252, client 52. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:36:50 -05:00
"eslint": "^10.7.0",
"eslint-plugin-react-hooks": "^7.1.1",
"eslint-plugin-react-refresh": "^0.5.3",
test(money): property-based proof of cent-exact invariants (fast-check, Pillar F) A financial app must prove its money math, not sample it. tests/ moneyProperties.test.js fuzzes utils/money.mts: toCents always integer; dollars→cents→dollars == roundMoney (no drift); sumMoney is cent-exact; integer cents round-trip; classic float-drift cases exact; invalid inputs never yield a bogus number. 6 properties, all hold. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 16:08:50 -05:00
"fast-check": "^4.8.0",
build(lint): add ESLint 9 + eslint-plugin-react-hooks/react-refresh (R1) There was no linting at all — nothing enforced rules-of-hooks (conditional-hook crashes) or exhaustive-deps (stale closures) across 125 client components/pages. Added an ESLint flat config (eslint.config.mjs) scoped to client/, an 'npm run lint' script, and the devDeps. First run: 0 rules-of-hooks violations (good), 6 errors + 13 exhaustive-deps warnings to work through next. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 19:41:24 -05:00
"globals": "^17.7.0",
feat(settings): auto-save preferences with live save status (batch 0.39.0) Replace all Save buttons on the Settings page with debounced auto-save: - useAutoSave hook: debounce with latest-payload-wins, flush() for blur, pending-edit flush on unmount, status machine (idle/saving/saved/error) with saved fading back to idle. Covered by 6 Vitest tests (fake timers). - SaveStatus pill (framer-motion) in the page header and notification card headers — Saving…/Saved/Save failed. - Timing per control: toggles/selects/channel ~150-400ms; typed inputs (email, URLs, grace period, drift pct) 900ms + flush on blur. - Push token never auto-saves mid-type: saves on blur only, so a partial token can never overwrite a working one. - Notification cards no longer refetch parent settings on save (would clobber in-flight edits under auto-save). - Decision: no undo toast — settings are non-destructive and instantly re-editable; undo would add noise without safety. - vitest include now picks up .jsx tests; jsdom + @testing-library/react added as devDependencies.
2026-06-12 02:08:42 -05:00
"jsdom": "^29.1.1",
ci(enforce): run the full gate in CI + add lefthook pre-commit + Knip Pillar A enforcement so standards can't drift: - .forgejo CI now runs format:check + lint (client+server) + typecheck (client) + typecheck:server, in addition to the existing check:server / tests / build. Previously lint and typecheck were NOT run in CI. - lefthook pre-commit auto-formats staged files (prettier) + lints; pre-push typechecks. Auto-installed via the `prepare` script. - Knip config (advisory `npm run knip`) for dead-code/unused-export review; the design-system ui/** is ignored to keep signal clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:27:03 -05:00
"knip": "^6.24.0",
"lefthook": "^2.1.9",
chore(tooling): add Prettier + editorconfig, extend ESLint to the server Standardization foundation (Pillar A): - Prettier (.prettierrc.json, .prettierignore) + `format`/`format:check` scripts; style tuned to the house style (single quotes, semicolons, 2-space, printWidth 100). - .editorconfig for editor-level consistency. - Extend the flat ESLint config to lint server `.cts` (Node globals, TS parser, "focused signal" rule set mirroring the client) so `eslint .` now covers both halves; `lint` → `eslint .`. - Wire `format:check` into the `ci` script. `npm run lint` is green (0 errors; pre-existing intentional patterns kept as advisory warnings to ratchet later). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-06 14:23:53 -05:00
"prettier": "3.9.4",
chore(deps)!: tailwind 3 -> 4 via @tailwindcss/vite (4i) Official codemod (run in a clean worktree; docker-owned data/ blocks it in-tree): tailwind.config.js inlined into client/index.css as CSS-first @theme/@utility (config file deleted — v4 auto-detects content, which also retires the .tsx-content-glob failure class from the TS migration), 33 template files' class renames applied, tailwindcss-animate loads via the v4 @plugin bridge. Build runs through @tailwindcss/vite; postcss config is now plugin-free. tailwind-merge -> 3 (v4 class model). Visual-regression gate: only diffs were a ~2px global preflight shift + the version string (baseline predated 0.41.1); re-baselined both login screenshots in this commit after review. webauthn.probe confined to the probe project (it enables WebAuthn for the seeded user, racing the parallel UI projects' password logins). e2e 27 passed, probe 18/18, PROD SMOKE PASS, typecheck/lint/tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 18:03:15 -05:00
"tailwindcss": "^4.3.2",
build(ts): TypeScript foundation — tsconfig + typecheck in CI (T1) Adopting TypeScript incrementally (the move off plain JS). Upgraded jsconfig -> tsconfig with strict + noUncheckedIndexedAccess, but allowJs + checkJs:false so every existing .js/.jsx keeps resolving and running untouched — only .ts/.tsx get type-checked. Added 'npm run typecheck' (tsc --noEmit) and wired it into 'npm run ci'. Installed typescript 6 + @types/react/react-dom 19. Client-scoped (Vite resolves the '@/' paths); the CommonJS server is a separate TS story. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 21:33:26 -05:00
"typescript": "^6.0.3",
build(lint): extend ESLint to .ts/.tsx via typescript-eslint As files convert to TypeScript they must keep the react-hooks enforcement. Added a .ts/.tsx config block using the typescript-eslint parser with the same rules-of-hooks/exhaustive-deps/react-refresh rules; swapped core no-undef + no-unused-vars (type-blind) for TS-aware equivalents. Verified 'npm run lint' traverses .ts and flags issues there; 0 errors on the existing .ts files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 21:44:35 -05:00
"typescript-eslint": "^8.62.1",
chore(deps)!: vite 8 (rolldown) + @vitejs/plugin-react 6 (4h) Build drops 6.5s -> 0.65s. Three breakages found by the prod-smoke gate, all fixed: - rolldown removed object-form manualChunks -> function form in vite.config.mjs (same vendor split, all @radix/@tanstack grouped) - the 4a 'send' bump rejects bare absolute paths: SPA fallback sendFile and both download routes (admin backup, user-db export) now use the root-option form - rolldown minifies inline HTML scripts, breaking any CSP hash approach: the pre-paint theme script moved to client/public/theme-init.js so script-src 'self' holds with no inline hash to maintain @testing-library/dom added (peer no longer auto-installed). Server 252, client 52, probe 18/18, PROD SMOKE: PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 17:53:27 -05:00
"vite": "^8.1.4",
feat(cashflow): safe-to-spend projection with timeline, vitest setup, package upgrades
2026-06-12 01:32:28 -05:00
"vite-plugin-pwa": "^1.3.0",
"vitest": "^4.1.8"
push
2026-05-09 13:03:36 -05:00
},
"directories": {
"doc": "docs"
},
"repository": {
"type": "git",
"url": "ssh://forgejo/null/BillTracker.git"
},
"keywords": [],
"author": "",
"license": "ISC",
"type": "commonjs"
initial commit
2026-05-03 19:51:57 -05:00
}