mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
73362dc0ae
Production: the AWS SDK S3 client and lib-storage 3.1152.0, Prisma (client, adapter-pg, CLI) 7.10.1, TanStack Query 5.104.3 and Virtual 3.14.21, dotenv 18.0.8, jspdf-autotable 5.0.9, lucide-react 1.59.0, nodemailer 10.1.2, pg-boss 12.38.0, React and React DOM 19.3.1 (still exact) and undici 8.12. React 19.3.1 and undici 8.12.2 are security releases. Prisma 7.10.1 stops a nested interactive transaction from leaking its id into a later top-level one. pg-boss moves its schema from 45 to 46; the worker applies the migration on start and the index builds continue in the background. Its list and delete helpers now page and batch, which touches only the queue retirement at boot, and that is idempotent. The retention test pins the installed version, so it moves to 12.38.0 after re-checking every source line it asserts. Development: @axe-core/playwright 4.14.0, Playwright 1.64.1, Vitest and its coverage provider 5.0.5, shadcn 4.22.0. The Stryker runner patch still applies; it touches the runner's own name join, and 5.0.5 changes nothing in how Vitest builds a test's full name. axe-core 4.14 turns on label-content-name-mismatch for the WCAG 2.1 A tag the a11y specs run. The S3 client is held on the same release as lib-storage rather than the newest one its range allows, so the two share one SDK core. Vite gets a floor at 8.1.6 for GHSA-587h-7wmj-h5pm and four sibling advisories against its dev server and bundled launch-editor. It arrives only under Vitest and never reaches the image. The image's separate Prisma CLI install moves with the app tree to 7.10.1, and its dotenv to 18.0.8, which it had trailed by a patch.
src/
Application source. HealthLog is a Next.js 16 App Router project (output: "standalone", React 19, TypeScript strict). The path alias @/* resolves to this directory. Everything a request touches lives under here; the layout below follows the request flow rather than alphabetical order.
Request flow
client → src/proxy.ts → src/app/<route>/route.ts → src/lib/api-handler.ts → handler body → src/lib/api-response.ts → client
proxy.ts— the HTTP edge (Next.js 16's renamedmiddleware). Public-path allowlist, demo-mode mutation block, server-side onboarding redirect, worker-only refusal,x-request-id+ CSP nonce generation, every security header.app/— App Router pages (RSC by default) and API routes. Every API route wraps its handler inapiHandler. Seeapp/README.md.lib/— the server/runtime toolkit:apiHandler, auth, crypto, rollups, AI, notifications, pg-boss jobs, integrations, rate limiting. Seelib/README.md.components/— React components (shadcn/ui new-york, kebab-case files). Seecomponents/README.md.
Other directories
hooks/— shared React hooks (use-prefix, kebab-case).types/— shared TypeScript declarations.generated/prisma/— the generated Prisma client (do not edit; regenerated byprisma generate). Imported as@/generated/prisma.instrumentation.ts— Next.js startup hook; boots the pg-boss worker registry and boot-time backfill queues.__tests__/— cross-cutting unit tests; most tests live in__tests__/folders next to the code they cover.
Conventions
See ../CLAUDE.md for the full set. The load-bearing ones: RSC by default ("use client" only when a hook/state/browser API needs it); every API route wraps apiHandler and parses its body with Zod safeParse; userId is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from src/lib/query-keys/; outbound HTTP goes through src/lib/safe-fetch.ts.