chore(release): v1.4.25

Largest feature delta in the v1.4.x line. Insights expands into seven dedicated metric sub-pages; GLP-1 medication tracking lands end-to-end (drug-level chart with Research Mode acknowledgment, EMA titration ladder, cadence + compliance, side-effect taxonomy, pen/vial inventory); cross-source priority becomes a two-axis resolver; per-user timezone threads through ten analytics surfaces; Withings activity + sleep v2 sync; onboarding rebuilt as a nested-route wizard; Personal Records ship end-to-end; Health Score provenance accordion; Coach runs native first-party prompts across six locales with a 1800-assertion refusal-probe matrix; OpenAPI drift gate hard-fails; multi-arch GHCR image. Migrations 0043 through 0060 are additive and forward-only. PROMPT_VERSION 4.24.0 → 4.25.0 with GROUND RULE 9 (refuses dose recommendations) and GROUND RULE 15 (refuses drug-level estimates with MDR + MDCG 2021-24 cites).

See CHANGELOG.md for the full per-section delta.

src/lib/api/__tests__/read-error.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+
+import { readError } from "../read-error";
+
+function makeResponse(body: unknown, status: number, opts?: { invalidJson?: boolean }): Response {
+  if (opts?.invalidJson) {
+    return new Response("<<not json>>", {
+      status,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+describe("readError", () => {
+  it("returns the server-supplied error string when present", async () => {
+    const res = makeResponse({ data: null, error: "Goal limit reached" }, 422);
+    expect(await readError(res)).toBe("Goal limit reached");
+  });
+
+  it("falls back to status-coded fallback when the envelope omits error", async () => {
+    const res = makeResponse({ data: null }, 500);
+    expect(await readError(res)).toBe("Request failed (500)");
+  });
+
+  it("falls back when the error field is empty", async () => {
+    const res = makeResponse({ data: null, error: "" }, 400);
+    expect(await readError(res)).toBe("Request failed (400)");
+  });
+
+  it("falls back when the JSON body fails to parse", async () => {
+    const res = makeResponse(null, 503, { invalidJson: true });
+    expect(await readError(res)).toBe("Request failed (503)");
+  });
+
+  it("falls back when the error field is the wrong type", async () => {
+    const res = makeResponse({ data: null, error: 42 }, 400);
+    expect(await readError(res)).toBe("Request failed (400)");
+  });
+
+  it("never throws even when the response body is empty", async () => {
+    const res = new Response(null, { status: 502 });
+    expect(await readError(res)).toBe("Request failed (502)");
+  });
+});

src/lib/api/read-error.ts

@@ -0,0 +1,27 @@
+/**
+ * v1.4.25 W21 Fix-N — shared client-side error reader.
+ *
+ * The four onboarding components (WelcomeCarousel, GoalsChipPicker,
+ * SourceCardGrid, BaselineForm) all hand-rolled the same helper to
+ * extract the `error` string from a non-OK `apiError` envelope, with an
+ * identical fall-through to `Request failed (<status>)`. Hoisting the
+ * helper keeps the four call sites honest — the envelope shape only
+ * needs to evolve once.
+ *
+ * Contract:
+ *   - The server-side `apiError` helper writes `{ data: null, error: "<msg>" }`.
+ *   - On parse failure (network error, non-JSON body, malformed shape)
+ *     fall back to a stable string the toast can surface.
+ *   - Never throw — the caller is already in a catch / setError path.
+ */
+export async function readError(res: Response): Promise<string> {
+  try {
+    const json = (await res.json()) as { error?: string };
+    if (typeof json.error === "string" && json.error.length > 0) {
+      return json.error;
+    }
+  } catch {
+    /* fall through */
+  }
+  return `Request failed (${res.status})`;
+}