- Update AGENTS.md with 400-line hard ceiling and sub-feature slicing rules
- Update scripts/lint_arch.ts to enforce 400 lines max with anti-formatting heuristics
- Subdivide src/shared/ui/ into layout, navbar, and admin layout fragments
- Subdivide src/features/auth/ into modular login, register, and recovery routes/fragments
- Subdivide src/features/admin/ into users, user details, apps, and audit fragments
- Maintain backwards compatibility via fragment index re-exports
- Scaffold shared UI fragments and styles in src/shared/ui/
- Implement full Auth vertical slice in src/features/auth/ with WebAuthn ceremonies and recovery endpoints
- Implement full Admin vertical slice in src/features/admin/ with responsive tables and mobile decks
- Add public client-side JS utilities and pure JS BIP-39 module
- Mount routes in src/main.ts and keep legacy server/ and ui/ quarantined
- Add pure JSX and API tests for Auth and Admin slices
docs(plan): add hypermedia architecture migration plan
migration from the legacy `server/` and `ui/` directories to a domain-oriented vertical slice architecture under `src/features/`. The plan spans four phases: Core Foundation, Base Slices, Real-Time Slices, and Architectural Testing.
Adds a comprehensive, 4-phase execution plan in `tasks/new/` outlining the architectural transition to a Datastar-driven Hypermedia paradigm and Vertical Feature Slicing, adhering to the project's task guidelines and blueprint.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat: UI and Event Polish Phase
Completed Phase 6 Final Polish according to the task specification `2026-0826.06.gem.feat.ui.sessions-and-events-final-polish-2305.ph6.md`. Fixes backend rotation vulnerabilities and extension math bugs while implementing high-polish UI elements including bounded 2-row cards, WAI-ARIA compliant delegation tabs, and natural telemetry formatters. Checked against all standard quality gates.
Sessions UI Overhaul Phase 5
Implemented Phase 5 Task Plan for Sessions UI Overhaul: fixed the backend attendee session revocation permission checks to allow event creators to delete sessions; upgraded the EventGuestsDrawer into a fixed slide-over panel on Desktop and bottom sheet on Mobile; added standardized dynamic countdown pills using SSR and client-side real-time ticking; added a multi-event compact density toggle with localStorage memory; optimized the mobile session deck view; fixed unit tests to mock SQL correctly due to SQL query changes.
- Update `DELETE /api/sessions/:id` in `server/routes/sessions.ts` to allow event creators to delete guests' sessions.
- Update page hierarchy and top headings in `ui/components/SessionsPage.tsx`.
- Refactor `EventAttendeesDrawer.tsx` to `EventGuestsDrawer.tsx` as a fixed slide-over overlay.
- Add multi-event compact view toggle with `localStorage` persistence in `EventCockpitDeck.tsx`.
- Standardize dynamic countdown pills across `EventCockpitDeck.tsx`, `EventGuestsDrawer.tsx`, `SessionDeck.tsx`, and `SessionTable.tsx`.
- Optimize mobile session deck in `SessionDeck.tsx`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat: implement live attendee management drawer and session pause
Implemented Phase 4 of the Event & Session Overhaul:
- **Database:** Added `is_paused` flag to `sessions` and `event_passes` tables safely via soft-fail migrations.
- **API (Sessions):** Added `POST /api/sessions/:id/pause` endpoint; updated `session_resolver` to serialize `is_paused` into Valkey caches and the edge middleware (`auth_forward.ts`) to return 403 when paused.
- **API (Events):** Added endpoints to fetch `attendees` (resolving via `guest_<slug>_<seat>` deterministic lookup), `rotate-pin`, and `expand` seats. Secured all event modification endpoints to enforce `created_by` or global admin scope.
- **UI & Scripts:** Built `EventAttendeesDrawer` to visualize live connections, injected the `<EventAttendeesDrawer />` container in `SessionsPage`, added quick controls to the `EventCockpitDeck`, and backed the DOM manipulation seamlessly with vanilla JS in `SessionsScript.tsx`.
This commit finalizes Phase 4 of the Event & Session Overhaul:
1. Implements session pause logic across PostgreSQL schema, Valkey cache, and `auth_forward.ts` edge check (`is_paused`).
2. Implements non-destructive operational endpoints (`/api/events/:id/rotate-pin`, `/api/events/:id/expand`, `/api/events/:id/attendees`) with Zero-Trust Ownership verification.
3. Upgrades existing `end` and `extend` endpoints in `events.ts` to utilize robust Zero-Trust Ownership queries (created_by OR isGlobalAdmin).
4. Creates `EventAttendeesDrawer.tsx` to handle live participant inspection and individual session controls (Pause, Revoke).
5. Updates `EventCockpitDeck.tsx` and `SessionsScript.tsx` to mount and drive the new controls via vanilla JavaScript, respecting zero-framework guidelines.
6. Ensures `deno fmt`, `deno task lint`, `deno task check` and `deno test` execute successfully against the new schema and API guards.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Created a detailed Markdown task specification in `tasks/new/` for Phase 4 of the event system overhaul, outlining the database updates for session pausing, API endpoints for live controls, and UI enhancements for the attendee slide-out drawer based on provided architectural guidance.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat(ui): implement 2-state workshop drawer machine and refine session page hierarchy
Reorganized the Sessions page hierarchy to place the Event Cockpit below the main header. Refactored the Workshop Drawer to utilize a strict 2-state container machine for clean transitions between the creation form and the success handoff modal. Implemented UI accessibility enhancements and fixed mobile text wrapping constraints.
- Moved `EventCockpitDeck` below main header in `SessionsPage.tsx`
- Refactored `WorkshopDrawer.tsx` to strictly use a 2-state display toggle (`#eventCreateState` and `#eventHandoffState`)
- Added `aria-label`s to copy buttons for accessibility
- Configured `#status-banner` with `role="status"` and `aria-live="polite"`
- Fixed mobile title text wrapping on `#createdEventTitle`
- Fixed script emoji injection logic to prevent double emojis
- Added JS reset logic in `closeDelegateDrawer` to restore drawer states and clear form data
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
