- NIP-17 wraps now carry the app's ['skatespots','push'] marker on every admin
copy (including the sender), so the push service wakes the phone with the app
closed. Push test wraps 39fbbd4e…/c88c9f55… verified on the community relay.
- The weekly scan-only job DMs only when the OSV summary changes; unchanged
scans are logged, not messaged.
- auto-deploy alerts on Netlify failure and on a post-deploy production URL
health-check failure; deploy-failed/health-failed appear in ops-health and
the daily report.
- scripts/ops-report.sh builds a simple daily report (app, website, deps,
security, weekly scan); --send DMs it to the two admins from src/lib/admins.ts
via NIP-17 (scripts/send-ops-report.ts), sender = app identity.
- Delivery discovers kind-10050 inboxes + NIP-65 write relays and always
includes the community relay; OPS_DRY_RUN=1 previews without publishing.
- scripts/send-ops-alert.sh sends short alerts; wired into auto-deploy
(preflight/smoke), update-deps (full+fallback failure) and ops-health --notify.
- skatespots-ops-report.timer daily 07:00 + installer.
- Signer moved into the 0600 zsp.env; old history copies removed.
- scripts/preflight.sh: app+server tsc, eslint, i18n, vitest; installed as
.githooks/pre-push (scripts/install-hooks.sh) and run by auto-deploy before
Netlify. Failures record preflight-failed and ops-health flags them.
- update-deps.sh: if the blanket npm update fails, restore the lock and retry
patch-level packages one at a time, keeping those that pass a fast gate; the
final npm test + smoke still gates the result, otherwise revert + 3-day retry.
- release.sh/deps set SKIP_PREFLIGHT=1 (they run the full npm test themselves).
- Dependency job is now 16 days (service env + script default); a separate
weekly scan-only timer reports npm/OSV findings without changing the lockfile.
- TimeoutStartSec=30min on the deps job and 20min on the deploy job (systemd's
90s default could kill a legitimate run); both scripts resolve the newest nvm
Node instead of hardcoding v22.23.1.
- npm override pins @tanstack/query-core to $@tanstack/react-query so a blanket
npm update cannot create a second copy (the Oct 26 tsc failure).
- Failed runs keep test/smoke logs + attempted package files in failures/
(rotated, 8 kept) and a last-failure marker; reports rotate (12 kept).
- scripts/release.sh: notes check -> npm test -> bump -> Android build ->
zsp publish -> relay verify -> commit/push + tag.
- Deploy/deps systemd units are tracked under scripts/systemd/.
Notifications now include the OSV summary. A failed run restores the lockfile
and schedules a retry in ~3 days instead of consuming the full 20-day interval.
A minor bump can nest a duplicate transitive copy and break tsc type identity
(@tanstack/query-core, @nostrify/*). Dedupe after npm update before the test gate.
- update-deps.sh now runs osv-scanner (OSV DB) pre/post update, alongside npm
audit; it immediately found 107 known vulns (5 critical) npm audit missed
(vite/vitest dev deps, xlsx with no fix, zod patch).
- Layout opens the themed LoginDialog once for a logged-out desktop visitor
(non-native, >=1024px, ~900ms), dismissible and remembered; it also offers
SignupDialog. Reuses the existing extension/bunker/Amber/nsec/NostrConnect
methods.
scripts/update-deps.sh (systemd user timer skatespots-deps.timer, daily tick, self-gated to 20 days): scans npm outdated + npm audit, applies non-breaking updates only, gates on npm test + smoke, then commits+pushes on green or restores the lockfile on red. Never --force; skips on a dirty tree; bounds the signed push.
