Commit graph

612 commits

Author SHA1 Message Date
SkateSpots
8badbeacf1 fix(auth): show the desktop welcome sign-in once per session
The dismissal was stored in localStorage, so one early ✕ suppressed the prompt
forever. Switch to sessionStorage (key skatespots:desktop-welcome-snoozed): it
reappears in a new tab/session but respects 'keep browsing' for the current one.
2026-10-26 12:19:52 +07:00
SkateSpots
fe3d9bae22 ui(auth): compact, scroll-safe sign-in dialog
- Fix the real bug: the dialog clipped its bottom links (flex column + max-h
  calc(100dvh-2rem), content min-h-0 flex-1 overflow-y-auto).
- One dominant action per state: 'New here' is a compact row, not a second hero.
- Plain card labels (Browser extension / Signer app / Sign in with your phone)
  with tiny NIP-07/46/55 hints; protocol jargon out of the main labels.
- Bunker: input + Connect with instructions collapsed under 'Where do I get a
  bunker?'; no duplicate heading/divider.
- Secret key moved to a quiet bottom link; subtitle says 'or keep browsing'.
- 8px spacing grid (px-5 gutters, space-y-4 sections, gap-2 cards, p-2.5 cards,
  448px max width). New strings backfilled into all 20 locales.
Verified with headless 1280x900 + 390x844 screenshots.
2026-10-26 12:12:36 +07:00
SkateSpots
87f58cd84e feat(android): pass-the-app card (QR + share sheet + NFC tag)
About page renders ShareAppCard on Android only: a QR of the Zapstore listing,
a share-sheet button for the install link, and NfcWriteButton to write it to a
tag. Single-sourced APP_INSTALL_URL in lib/platform.ts (also used by the About
download button). No peer-to-peer APK transfer (needs native Wi-Fi Direct/BLE +
PackageInstaller + device QA); Zapstore handles install/update.
2026-10-26 11:41:51 +07:00
SkateSpots
2164dd61b0 ui(auth): 3-card sign-in chooser (extension / signer / phone) + lockfile note
LoginDialog leads with a three-card chooser (Browser extension, Signer =
Bunker on desktop / Amber on Android, Sign in with your phone) and a quiet
Secret Key link; the NostrConnect QR moved to its own connect panel. The
desktop welcome modal opens on this. Verified with a headless 1280x900
screenshot. Also records why the full npm update was reverted (duplicate
transitive copies + TS bump) and that the remaining fixes are majors.
2026-10-26 11:12:00 +07:00
SkateSpots
aa2a70e9fd feat: osv-scanner in the deps job + desktop welcome sign-in modal
- update-deps.sh now runs osv-scanner (OSV DB) pre/post update, alongside npm
  audit; it immediately found 107 known vulns (5 critical) npm audit missed
  (vite/vitest dev deps, xlsx with no fix, zod patch).
- Layout opens the themed LoginDialog once for a logged-out desktop visitor
  (non-native, >=1024px, ~900ms), dismissible and remembered; it also offers
  SignupDialog. Reuses the existing extension/bunker/Amber/nsec/NostrConnect
  methods.
2026-10-26 10:59:53 +07:00
SkateSpots
a9669c17b8 feat(crew-chat): shareable 'join this crew's chat' invite
The MLS private-chat panel gets an admin 'Invite' action that shares the crew's
private-chat link (…?tab=mls) via the OS share sheet or clipboard, landing the
invitee on the Ask-to-join flow. Added cordnUi.shareInvite/shareInviteText/
inviteCopied to en/es and backfilled them into all 20 locale drift fragments so
i18n stays at 100%.
2026-10-13 19:18:14 +07:00
SkateSpots
10299d07f2 perf(dm): persist the decrypt cache so each message decrypts once, ever
The last Amber pain: a fresh launch re-decrypted the whole inbox (2 signer ops
per wrap). Decrypted messages are now persisted to IndexedDB
(src/lib/dmDecryptCache.ts, keyed viewerPk:wrapId, bounded 4000/account, pruned
oldest-first) and hydrated once per session before the first lookup, so a wrap is
decrypted at most once ever. Cleared per-account on logout (plaintext at rest
otherwise readable by another account on the device).
2026-10-13 18:58:35 +07:00
SkateSpots
707dcaf644 refactor(crew-chat): Chat tab is always NIP-17; widen group read window
Per the crew-chat audit recommendations:
- The crew Chat tab no longer silently switches transport on a coordinator tag.
  It is always NIP-17; coordinator routing lives only in the Private chat (MLS).
  useCordnChat / useCrewChatUnread / lib/cordn client+crypto are kept but unwired
  (headers marked). Drops the tab's Cordn-only unread dot.
- Group reads (Groups list + crew thread) widened 200 -> 500 wraps; the shared
  decrypt cache makes the extra reads affordable. 1:1 list stays 200.
2026-10-13 18:35:03 +07:00
SkateSpots
8e7c5bfa09 fix(crew-chat): show sent messages, stop re-decrypting the inbox
Audit of the crew Chat tab (see CREW_CHAT_AUDIT.md):
- A sent crew message never appeared: useSendDirectMessage invalidated the list
  keys but not ['group-messages', gid, ...] (the thread key). Now optimistically
  inserts the sender's own plaintext (no refetch -> no Amber pop-ups).
- Every reader decrypted every wrap under its own query key, so each view
  (Messages, then each crew thread) re-decrypted the whole inbox. Added a shared,
  coalesced, bounded session decrypt cache (decryptGiftWrap), successes only.
- Threads dedup by rumor id; CrewChat guards double-send with a ref; the Cordn
  path optimistically inserts and invalidates only for silent signers.
2026-10-13 00:21:42 +07:00
SkateSpots
fa0fc1cc15 ux(cordn): reconcile the crew chat card with the MLS tab (+ audit)
The sidebar card badged 'Private chat - On' while the MLS tab said 'not created
yet', and led with external apps. Rewrote CrewCoordinatorCard to show two
explicit rows (Chat = NIP-17 always on; Private chat = MLS with real status) and
make the in-app chat the primary CTA (?tab=mls); demoted Cordn web / Staircase
under 'Open in another app'. Panel now gives join feedback + an admin invite
hint. Adds CORDN_UX_AUDIT.md (findings, terminology model, deferred items).
2026-10-12 23:41:29 +07:00
SkateSpots
a2bc42c94b fix(onboarding): stop the first-run checklist + backup reminder nagging returning users
- FirstRunChecklist showed to any logged-in user until manually dismissed; it now
  requires a recent signup_completed stamp AND first-run-seen (auto, once), so
  established/imported accounts never see it.
- SignupDialog wrote the backup-confirmed flag under user?.pubkey while the login
  was still settling, so it landed on 'backup-confirmed:anon' and the post-signup
  BackupReminder nagged every session. Now markBackupConfirmed() is called with the
  pubkey derived from the minted nsec.
- NIP-49 export password field autoComplete new-password -> off (fewer browser
  save-password prompts).
2026-10-12 23:11:42 +07:00
SkateSpots
a9a5966714 Cordn native: browser probe, group-ref sharing, image messages
- scripts/cordn-browser-probe.mjs: headless-Chromium proof that the built
  native chunk runs in a real browser — imports the chunk, runs a session
  against the coordinator (publish kp, create group, send), then reopens from
  the Dexie/IndexedDB store. Not part of npm test (needs network + Chromium).
- Group ref: the panel shows/copies the group's cordn1... ref
  (encodeGroupRef from the crew coordinate + coordinator), so it can be opened
  in Staircase/cordn-web. Computed in the hook via the lazy native import.
- Images: attach button uploads to Blossom (useUploadFile) and sends the URL
  inside the encrypted MLS envelope (['image', url]); CordnChatMessage.imageUrl
  + ImageWithFallback rendering. Covered by the live test.
- Unread badge deliberately not built (needs a background signed request).

npm test + smoke + browser probe + 3 live scenarios all pass.
2026-10-12 22:42:44 +07:00
SkateSpots
383fb07127 Cordn native UI: crew MLS chat tab, IndexedDB store, membership flow
Milestone 2 for the native Cordn client.

- Session now runs on the viewer's own signer (NIP-07/Amber/nsec) instead of a
  raw key, so the Cordn identity is the user's pubkey. Added idbStore.ts
  (Dexie 'SkateSpotsCordnDB', one snapshot per account) so MLS state survives a
  reload, plus membership delivery: requestJoin / fetchJoinRequests /
  fetchWelcomes / acceptWelcome / addMemberByIdentifier, and addMember now also
  stores the Welcome on the coordinator for the target.
- useCordnNative owns the session lifecycle and lazy-imports the native module,
  keeping @contextvm/sdk + ts-mls in a separate ~678 kB async chunk (entry
  bundle unchanged at 1.9 MB).
- CordnNativePanel: a third 'Private chat' tab on the crew page — founder/admin
  create the group and approve join requests; members ask to join and check for
  an invite; live message list + composer (polling only for silent signers).
- Strings in i18n/legacy/cordnUi.ts (en/es).

Verified live against our coordinator with a new scenario
(join-request -> approve -> welcome) plus the existing two; npm test + smoke
pass. Not yet exercised in a real browser (browser tooling was offline this
session) — the dynamic-import failure path degrades to an inline error.
2026-10-12 22:30:15 +07:00
SkateSpots
9251aea5b1 feat(cordn): crew Cordn group link-out (Level 1)
Crews can carry a Cordn group ref (['cordn', <cordn1-ref-or-url>] -> SkateCrew.cordnGroup): CrewForm gains a 'Cordn group' field and CrewCoordinatorCard shows an 'Open crew chat' (cordn.net/chat/<ref>) + 'Copy for Staircase' row. Verified a real ContextVM client (@contextvm/sdk) connects + lists tools against our self-hosted coordinator.
2026-10-12 21:46:03 +07:00
SkateSpots
bb1cedb68d perf: self-host Leaflet CSS+icons (drop unpkg), preconnect relay/blossom
Bundles leaflet CSS + MarkerCluster CSS (main.tsx) and the default marker PNGs (SpotMap) instead of loading them from unpkg.com, so boot makes no third-party request; unpkg.com removed from the CSP (index.html meta + _headers + netlify.toml). Adds dns-prefetch/preconnect for relay.skate-spots.org and blossom.skate-spots.org.
2026-10-12 20:14:34 +07:00
SkateSpots
c95dd54a7a fix(coordinator): status badge shows labels (missing socialUi prefix) + 15min announce
STATUS_META labels were 'coordinator.*' but keys live under 'socialUi.coordinator.*', so badges rendered raw keys (e.g. coordinator.statusStale). Prefixed all six. Also dropped relay announce_interval_secs from 86400 (24h) to 900 (15m) so the coordinator health probe reads Connected instead of stale.
2026-10-12 17:36:27 +07:00
SkateSpots
3d9234d65c feat(cordn): web + Staircase MLS entry points on the crew coordinator card
Relabel the cordn.net add-link accurately as 'Cordn (web)' (real MLS in the browser) and add a 'Copy for Staircase' button that copies the coordinator nprofile for the native app. Our coordinator by default; a BYO coordinator's add-link when it has a pubkey.
2026-10-12 17:23:32 +07:00
SkateSpots
e262aed938 feat(cordn): 'Open in Staircase' link on the crew coordinator card
CrewCoordinatorCard now offers a StaircaseLink in both branches: our coordinator (SKATESPOTS_COORDINATOR add-link) when a crew has none, and the crew's own coordinator add-link when it has a pubkey (falls back to the Cordn home otherwise). Lets crews jump to real MLS chat in the native Cordn client.
2026-10-12 17:04:34 +07:00
SkateSpots
a8e411faa0 feat(cordn): embedded coordinator on the relay, crews default to it, disclosure
Newlay runs its embedded Cordn coordinator (identity cordn.key, uid 10001). SKATESPOTS_COORDINATOR is the provided default: Settings -> Coordinator shows a 'Use SkateSpots coordinator' block and CrewForm prefills it for new crews; BYO coordinator stays client-side. Disclosure copy (coordinators see ciphertext + metadata, never contents) in socialUi.coordinator.ourDefault* + existing privacyNote.
2026-10-12 16:36:56 +07:00
SkateSpots
b0c4684b4a feat(onboarding): first-run checklist with dynamic crew step
A one-shot 'Get started' nudge on the map for freshly signed-up users: Add a spot / crew / wallet. The crew CTA adapts to whether any crew exists yet — 'Join a crew' (/crews) when there are some, 'Start your crew' (/create-crew) when there are none. Dismissal persists; logged-out visitors see the welcome banner instead.
2026-10-12 15:15:35 +07:00
SkateSpots
ca810326f3 fix(spot-card): make the whole card clickable again
The stretched Link was z-0 behind the card content, and backdrop-blur made the card its own paint layer above it, so no click ever reached the link (the card looked dead in the map list view). Link -> z-10, drop backdrop-blur, move hover to the wrapper (group + group-hover:), and raise the action row to z-20 so its buttons stay above the link. Verified headlessly: card click navigates, kebab opens its menu without navigating.
2026-10-12 14:03:16 +07:00
SkateSpots
54882285b6 feat(weather): 6-day forecast
FORECAST_DAYS=6 in lib/weather.ts is the single source for the fetch length and the UI labels (spot card + map popup). New count-interpolated labels spotUi.forecastDays / mapUi.forecastDays (en/es; other locales fall back to English). Legend colours moved to lib/skateabilityLevels.ts to keep the react-refresh lint at zero.
2026-10-12 13:51:29 +07:00
SkateSpots
e47c4b9d81 feat(weather): legend, refresh/error states, sunrise/sunset, reason chips
- WeatherLegend overlay on the map (only while the weather layer is on), colours mirroring calculateSkateability
- Spot weather card: freshness line + manual refresh, and an error/retry state when Open-Meteo is unreachable
- Sunrise/sunset row (weather.ts now fetches Open-Meteo daily sunrise,sunset)
- Score reasons render as chips, not a bullet-joined run-on
- Map popup muted text gray-500 -> gray-300 for contrast
Units stay Celsius/km/h (deliberate).
2026-10-12 13:44:19 +07:00
SkateSpots
84c0ba7b3c feat(relays): ensure the community relay is in the NIP-65 list (+ silent republish)
lib/relays gains withCommunityRelay/ensureCommunityRelay; AppProvider and NostrSync add wss://relay.skate-spots.org to a stored list that lacks it (unless useSkateRelay is off). NostrSync republishes kind-10002 once for non-Amber signers so other clients pick up the community relay; Amber users keep it local to avoid an unprompted popup.
2026-10-12 13:29:04 +07:00
SkateSpots
37cc0d5d68 fix(relays): prune retired/dead relays from stored lists (runtime + load + sync)
Adds RETIRED_RELAY_HOSTS (goskatespots.nostr1.com, wotr.relatr.xyz) with isRetiredRelay/pruneRetiredRelays. Applied in resolveRelays (runtime), AppProvider (one-time cleanup on load) and NostrSync (when applying a fetched NIP-65), so existing users stop showing/using the retired relay without manual edits.
2026-10-12 13:20:09 +07:00
SkateSpots
6efd6b8deb feat(relay): retire the legacy hosted relay from the app + servers
Verified the legacy relay held the same 115 events as the new one (0 diff) before removing it, so no data is lost. Drops wss://goskatespots.nostr1.com from the default pools, the DM/CVM/zap relay arrays, and the cvm-server + push-service defaults.
2026-10-12 13:06:02 +07:00
SkateSpots
6407310213 feat(relay): cut over community relay to self-hosted Newlay
Point SKATE_RELAY, the default relay pools, the DM/CVM/zap relay arrays, the cvm-server + push-service defaults, and the archive default at wss://relay.skate-spots.org, keeping the legacy hosted relay as a fallback during the client-update window. Restored 115/115 archived events; the relay runs behind Caddy with TLS. Docs + AGENTS.md updated.
2026-10-12 12:38:13 +07:00
SkateSpots
0b645d6d67 feat(lab): add Clothing Designer craft (kind 35015)
New data-driven Lab craft, mirroring the artist role: three skill
sections (What You Make [required] / How You Make It / Materials) plus
minimum order, turnaround, size range, samples and customisation extras,
inheriting the shared Lab extras (rate, payment, gallery, reel,
languages, availability, booking).

Wired through types.ts (kind, label/description maps, parse, collective-
capable), labelKeys, useLabProfiles (kind list + dispatch), becomeRoles
(role card), craftFields, LabPage (tab, filters, offer button, empty
state, counts, deep links), LabCrewsStrip, NIP.md, and en/es i18n
(labOptions, becomeRolesUi, labUi). /become/clothing added to the smoke
route list. tsc, eslint, check-i18n, vitest 101/101, build and smoke all
pass.
2026-10-10 19:30:47 +07:00
SkateSpots
f1497fc0bf feat(marketplace): close the deal from an accepted offer
Seller UX: the offer thread shows a Close deal button on an accepted,
unsold listing. It opens MarkSoldDialog prefilled with the buyer, the
agreed amount, and the settlement method (lightning when a payment pointer
was attached, else cash), so the seller never pastes an npub by hand.
MarkSoldDialog gains defaultBuyer/defaultAmountSats/defaultMethod and
re-seeds on open. New marketUi.offers.closeDeal (en/es).
2026-10-10 15:51:58 +07:00
SkateSpots
7a60099bab fix(marketplace): show an outage instead of an empty trade/reputation state
TradesPage, SellerDashboard, TradeReputationPanel, TradeReputationCard and
ShippingStatusCard now surface a relay outage explicitly instead of
rendering nothing-waiting / no-trades / hidden reputation. Shared
marketUi.loadFailed (en/es).
2026-10-10 09:32:52 +07:00
SkateSpots
7a5ec82f84 fix(marketplace): escrow-required guard, ask-seller on active, scoped receipts
Correctness batch from MARKETPLACE_FLOW_AUDIT.md:
- canBuy is disabled when the seller requires escrow (item.escrow ===
  'required'), so a direct Buy-with-sats cannot bypass it.
- ask-seller (31872) is available on an active listing, not only once sold,
  so a buyer who paid off-app is no longer at a dead end.
- payment receipts (lib/receipts.ts) are scoped to the payer's pubkey, so a
  stale or foreign receipt cannot be attached to a trade by another account
  viewing the same listing.
2026-10-10 09:08:52 +07:00
SkateSpots
b48f0e53ee feat(escrow): seller-advertised mint, preferred by the buyer
Finishes the escrow-mint work: advertiseEscrowKey now also publishes
cashu_mint (the seller's preferred mint from Wallet > Escrow) on kind 0,
documented in NIP.md. The buyer's EscrowRequestDialog reads the seller's
cashu_mint, includes it in the mint picker even if it is not in the buyer's
trust list, and prefers it (falling back to the buyer's preference, then
first trusted mint). Funds locked at a mint the seller actually uses are
the ones they can redeem. Still open: seller-side receive from a mint they
do not already have. New marketUi.escrowRequest.sellerMintHint (en/es).
2026-10-10 08:57:33 +07:00
SkateSpots
c71d176226 fix(marketplace): verify payment_hash and never pay fiat as sats
- usePayPaymentPointer now checks the seller's committed payment_hash (from
  the accepted offer) against the invoice actually paid; a swapped pointer
  is rejected before any payment.
- PayWithSats no longer offers an in-app sats Pay button for a non-SATS
  offer: a fiat amount is never paid as if it were sats. New
  marketUi.pay.nonSats (en/es).
- ListingOffersPanel passes paymentHash + currency through.
Docs updated (still open: NWC->WebLN/Cashu fallback, empty preimage).
2026-10-09 23:14:29 +07:00
SkateSpots
ac1b22674c fix(escrow): show and choose the mint, block non-P2PK mints
The escrow mint was silently the buyer's preferred/first trusted mint
(useCashuEscrow: prefs.preferredMintUrl || mints[0].url) with no UI, even
though the seller redeems there. Now:
- the escrow dialog shows the mint and lets the buyer pick from their
  trusted mints (defaults to their preference);
- a mint whose NUT-06 info advertises no NUT-11 (P2PK) support is blocked
  with a clear message before minting (cashuEscrow.mintSupportsP2PK);
- the create call uses the selected mint.
Still open (scoped separately): consult a seller-advertised mint and
seller-side receive from an unfamiliar mint. Recorded in the audit.
2026-10-09 23:07:24 +07:00
SkateSpots
077fb2d5d1 fix(marketplace): payment, attestation, and escrow safety
Next batch from MARKETPLACE_FLOW_AUDIT.md:
- bolt11.ts: getBolt11Expiry / isBolt11Expired; usePayPaymentPointer refuses
  an expired invoice before paying (a lapsed offer invoice used to fail deep
  in the wallet with a confusing error).
- PayWithSats shows unsupported pointer kinds (creq/clink) as unavailable up
  front instead of enabling a button that fails after the click.
- useTradeAttestations: verify events (onlyVerified) and keep the newest per
  (author, kind, d), so a newer s=revoked supersedes a stale valid copy;
  useTradeReputation no longer trusts unverified relay events.
- EscrowRequestDialog persists the minted token locally before publishing
  (lib/pendingEscrow.ts), so a failed send cannot strand the locked funds.
2026-10-09 23:00:35 +07:00
SkateSpots
4b92759913 fix(marketplace): close P0 trade/offer bugs + deep flow audit
Deep audit (MARKETPLACE_FLOW_AUDIT.md): full trade/escrow/offers lifecycle,
severity-ranked findings, and a state-coverage matrix.

Fixes:
- Grid Mark as sold now opens MarkSoldDialog, so the kind-31871 attestation
  (buyer, method) is recorded from the grid too, not just the detail page.
- Offers accept attaches a payment pointer only when the accepting user is the
  listing owner (seller); previously the buyer could publish their own lud16 as
  the payee and misdirect payment.
- advertiseEscrowKey refuses to publish kind 0 before the profile loads, so it
  cannot overwrite name/picture/lud16 with a cashu_escrow-only profile.
- useListingOffers passes requireAny, so the offers panel error state actually
  fires on an outage (previously an outage looked like no offers).
- Offer messages invalidate the offer queries, so accept/counter/decline update
  immediately instead of after the stale window.
2026-10-09 21:35:06 +07:00
SkateSpots
5f8975d631 fix(ux): URL-addressable marketplace tabs, offers error state, nav reset
Next P1 slice from UX_AUDIT_2026-10-09.md:
- Marketplace hub tabs now live in the URL (?tab=...) so refresh, share and
  back/forward keep the tab; unknown values fall back to Browse.
- ListingOffersPanel shows an error state on a relay outage instead of
  returning null (a failure no longer reads as no offers).
- Nav customizer Reset reseeds from DEFAULT_TAB_IDS (4) instead of a
  hardcoded 3, matching MIDDLE_SLOTS.
New marketUi.offers.loadFailed (en/es).
2026-10-09 21:04:52 +07:00
SkateSpots
18a9e28f0b feat(trust): network alerts for reported accounts you follow
Fifth slice of TRUST_SCORE.md. useNetworkAlerts reads the viewer's NIP-85
assertions for the accounts they follow and surfaces those trusted people
reported or muted. New /alerts page lists them with Ignore / Unfollow /
Mute / Report (reusing useFollowActions, useMuteUser, ReportDialog) —
inform, never auto-act. Settings -> Trust links to it with a live count;
ignored accounts are device-local. /alerts added to the smoke list.
2026-10-09 18:32:47 +07:00
SkateSpots
e66888128f feat(trust): a real mute (NIP-51 kind 10000) that hides content
Completes the safety loop. useMuteList reads the viewer's kind-10000 mute
list plus optimistic local mutes (lib/localMutes.ts); useMuteUser
republishes the list with the target added, records it locally and
invalidates content queries. useAdminModeration carries a new
mutedPubkeys set, and the shared filterAdminHidden/filterAdminHiddenMixed
drop muted authors — so every list hook filters them with no per-hook
changes (admin tooling with includeHidden still sees them). The flagged
notice gains a Mute action.
2026-10-09 18:23:04 +07:00
SkateSpots
ff5cd8f6eb perf(market): drop the duplicate per-card trust query
MarketplaceItemCard ran useTrustScore(item.pubkey) AND rendered
TrustBadge for the same author. It only needed the >=60 bit, which the
shared viewer graph (via useTrustBucket.localScore) already provides, so
the extra heavy per-card query is gone. Behaviour preserved.
2026-10-09 18:09:48 +07:00
SkateSpots
3b06e90d15 feat(trust): let the viewer choose the trust provider (NIP-85 kind 10040)
Settings -> Trust is now functional, not read-only. useSetTrustProvider
publishes a kind-10040 designation for a custom provider (npub or 64-hex +
wss relay, the five 30382:<type> rows) and can clear it to fall back to the
community provider. The card validates input, prompts the signer, and
invalidates the provider + assertion queries so scores refresh. Docs
updated.
2026-10-09 17:55:00 +07:00
SkateSpots
fd9316331b feat(trust): Settings -> Trust and name AGPL on the License page
- Settings -> Trust section (?section=trust, TrustSettingsCard): a
  show/hide-marks toggle (useTrustDisplay; Flagged is never hidden) and the
  active provider + relay (useTrustProvider), linked to /trust.
- TrustBadge respects the display preference.
- Name AGPL-3.0 on the License page by updating its existing copy
  (licenseLabel + body) in en/es.
- Settings + card i18n keys; /settings?section=trust added to the smoke
  list. Docs updated.
2026-10-09 17:45:56 +07:00
SkateSpots
d1fae2688c feat(trust): attribute the badge and add a /trust explainer
Legibility pass: a trust verdict has to be explainable and sourced.

- TrustBadge tooltips now attribute the claim (from your network / the
  community provider / the provider you chose) and link to /trust.
- New /trust page: the three states, why absence is not distrust, who
  computes it, presence-is-not-endorsement, and point-of-view. Public,
  linked from the badge; added to the smoke-test route list.
- New trustUi.* keys and four walletUi.trust attribution keys (en/es).
2026-10-09 17:30:00 +07:00
SkateSpots
2d1144bb7e feat(trust): batch provider reads, neutral direct follows, flagged notice
Second pass of TRUST_SCORE.md.

- useTrustAssertions now batches: every TrustBadge registers its subject into
  a shared per-viewer union and ONE query fetches the union (no per-card
  query), with a debounced refetch when a list grows. Same hook API.
- A direct follow (or self) is no longer shown as Verified - only a
  friend-of-friend or a provider assertion counts; Flagged is never
  suppressed.
- useUserReports reads public NIP-56 reports for an account, and
  TrustFlaggedNotice shows a flagged counterparty with the reporters grouped
  by the viewer's network plus Report / Dismiss. Wired into the listing
  seller card and the coach detail page.
- New walletUi.trust.* keys (en/es).
2026-10-09 17:17:11 +07:00
SkateSpots
fead9ca781 feat(trust): spec-correct NIP-85 consumer + Verified/Unknown/Flagged badge
First slice of TRUST_SCORE.md.

- lib/nip85.ts: parse kind-10040 provider designations, resolve a provider
  with a house fallback, parse kind-30382 assertions (rank/followers/
  reporters/muters/hops; absent hops means no path, absence is not
  distrust), and author-check the provider.
- hooks/useTrustAssertions.ts: batch read from the resolved provider,
  signature-verified via onlyVerified + the author check.
- lib/trustLadder.ts: three buckets and thresholds (flagged = trusted
  reporters >= 2; verified rank >= 2).
- hooks/useTrustBucket.ts: prefers a NIP-85 assertion (verify + flag),
  falls back to the local WoT ladder (verify only).
- TrustBadge.tsx: now renders Verified / Unknown / Flagged with glyph,
  colour and tooltip; Unknown hidden by default, Flagged always shown.
  Reaches the map/tour/event cards, marketplace card, listing detail and
  coach detail through the shared component.

Open follow-ups (in TRUST_SCORE.md): batch the bucket at list level, a
'who reported' breakdown, a provider-choice setting, alerts, confidence
scoring.
2026-10-09 17:07:34 +07:00
SkateSpots
486ffdb000 feat(map): add autocomplete suggestions to the search bar
Typing in the map search pill now opens a suggestions dropdown built
from the items that already match the active filters:
- Spots: title matches; selecting one flies to it and opens its sheet.
- Places: distinct city/region/country tokens split out of each item's
  location; selecting one sets the query to that token (e.g. spain ->
  Spain).

buildSearchSuggestions lives in lib (pure, testable) and
MapSearchSuggestions.tsx is presentational; MapPage owns the list and
keyboard nav (ArrowUp/Down, Enter, Escape). Adds mapPage.searchSuggestPlaces
(en/es only; other locales fall back to English).
2026-10-09 16:31:31 +07:00
SkateSpots
281a4c6ba5 feat(i18n): add search/filter to the language picker
The language list now has a search input in both the header dropdown
(pinned above the scrolling list) and the inline list used in the mobile
nav sheet. Filtering matches the English name, native name, or locale
code, and shows a localized empty state. Adds nav.searchLanguages and
nav.noLanguages to en/es (other locales fall back to English).
2026-10-08 18:16:13 +07:00
SkateSpots
bd9eaf9b5f fix(ui): make long dropdown menus scrollable
The shared DropdownMenuContent used overflow-hidden with no max-height,
so any menu taller than the viewport (e.g. the language picker with 22
locales) was clipped and could not scroll to its last items. Apply
Radix's available-height CSS var as max-height and switch to
overflow-y-auto (canonical shadcn pattern).
2026-10-08 18:10:55 +07:00
SkateSpots
d7a836e558 i18n(uk): complete Ukrainian (100%) + add to picker 2026-10-08 17:21:03 +07:00
SkateSpots
2e1167f8bd i18n(id): complete Indonesian (100%) + add to picker 2026-10-08 17:19:24 +07:00
SkateSpots
86427a0fb0 i18n(cs): complete Czech (100%) + add to picker 2026-10-08 17:18:34 +07:00
SkateSpots
2d656e5269 i18n(ro): complete Romanian (100%) + add to picker 2026-10-08 17:18:03 +07:00
SkateSpots
4acfa59e56 i18n(sv): complete Swedish (100%) + add to picker 2026-10-08 17:17:54 +07:00
SkateSpots
9998e7b8f6 i18n(el): complete Greek (100%) + add to picker 2026-10-08 17:17:43 +07:00
SkateSpots
09859bb7da i18n(vi): complete Vietnamese (100%) + add to picker 2026-10-08 17:17:35 +07:00
SkateSpots
69d04469f5 i18n(tr): complete Turkish (100%) + add to picker 2026-10-08 17:17:34 +07:00
SkateSpots
8e98a43949 i18n(zh-TW): complete Traditional Chinese (100%) + add to picker 2026-10-08 17:15:51 +07:00
SkateSpots
1c670d314b i18n(zh-CN): complete Simplified Chinese (100%) + add to picker 2026-10-08 16:00:33 +07:00
SkateSpots
1dd23c1549 i18n(ko): separate South and North Korean options, one flag each 2026-10-08 12:45:09 +07:00
SkateSpots
4e8999b84c i18n(ko): show both Korean flags in the language picker 2026-10-08 12:24:31 +07:00
SkateSpots
361f03c988 i18n(ru,ko): complete Russian + Korean translations; use North Korean flag for Korean 2026-10-07 23:56:20 +07:00
SkateSpots
1460b06277 i18n: lazy-load locales + register 8 new (pt fr de it nl pl ru ko) with fonts 2026-10-07 21:23:39 +07:00
SkateSpots
a3b7f311ce i18n: translate image alt/aria + generated export documents (last English literals) 2026-10-07 18:30:52 +07:00
SkateSpots
f7c9f9ef4c i18n: sweep hardcoded English (deckCost, becomeRoles, weather, skaterLabels, notify, misc) into 4 locales 2026-10-07 18:09:57 +07:00
SkateSpots
af0a138d1a fix(nav): inline language switcher in the mobile sheet (portaled dropdown was unclickable inside a dialog) 2026-10-07 17:54:32 +07:00
SkateSpots
ab05973ff0 i18n(ja): add Japanese as fourth locale (plumbing + font + batch 1 shell) 2026-10-07 17:21:18 +07:00
SkateSpots
94a6628faa i18n(es): translate page/component toasts (follow, delete, reports, sync, review queue) 2026-10-07 17:14:18 +07:00
SkateSpots
dd2062dc74 i18n(es): translate status presets, SetStatusDialog, nutzap + wallet toasts 2026-10-07 17:04:04 +07:00
SkateSpots
97c90c506a i18n(es): translate zap/NWC/delete/stash toasts + reuse feesUi keys for fee metadata 2026-10-07 16:55:33 +07:00
SkateSpots
b01bd22e96 i18n(es): translate SupportSkateSpots + hook toasts (follow, report, offline, publish) 2026-10-07 16:50:00 +07:00
SkateSpots
7e578fb7d9 i18n(es): translate shared component literals (camera, quality meter, entity picker, offline, comments) 2026-10-07 16:44:23 +07:00
SkateSpots
f58b19e310 chore(map): drop the "Supported by N" backer count from the map footer strip 2026-10-07 16:12:04 +07:00
SkateSpots
efd7e9608d feat(create-spot): pin map, progressive disclosure, mandatory photo+description, inline errors, draft autosave 2026-10-07 10:29:01 +07:00
SkateSpots
24322b3b1c feat(map): tap drops a pin + confirm card instead of jumping into create-spot 2026-10-07 10:26:36 +07:00
SkateSpots
b8c306125c i18n(th): batch 2 — map (mapUi + mapPage) + AGENTS note 2026-10-06 13:35:20 +07:00
SkateSpots
39572998a0 feat(clink): real bech32+TLV decode/validation (lib/clink.ts), spec-correct raw QR/copy, show decoded pricing; validate scanner 2026-10-06 11:16:20 +07:00
SkateSpots
9ca5f2a604 fix(audit UI/UX): 44px slabs, missing grid base cols, aria-labels, dark weather panel, contrast, sheet width, stretched-link SpotCard 2026-10-05 21:47:29 +07:00
SkateSpots
84f80d8330 fix(audit P2 money/auth): invoice amount checks (Pro/fee/pointer), verify embedded zap req, harden NIP-05 proof + Pro grant, sanitize cordn link 2026-10-05 21:32:58 +07:00
SkateSpots
f2bfbf4274 fix(newsletter): Monday reminder banner on mobile (bottom, above nav) not clipped by the map toolbar 2026-10-05 20:48:02 +07:00
SkateSpots
8a05aa3b69 chore(footer): remove the 'Supported by N' chip 2026-10-05 20:15:55 +07:00
SkateSpots
a9dcb5719c feat(supporters): per-row dates + 'updated', dedicated /donate page, extract shared support cards 2026-10-05 19:54:49 +07:00
SkateSpots
24e1369f6c feat(supporters): unified ranked wall, verifiable zaps, tier legend, impact link, pay-for detail, anonymous flag, map chip, OG meta 2026-10-05 18:55:16 +07:00
SkateSpots
1bdaa57aa3 feat(supporters): on-chain verify chips, real avatars/names, fiat total, footer count 2026-10-05 17:56:10 +07:00
SkateSpots
5baec5fb80 Deck calculator: fix the mobile layout (no horizontal scrolling)
The sheet tables carry 5-8 columns and were unusable on a phone: values were
truncated ("900" -> "90") and columns fell off the edge, and the cost-vs-quantity
table scrolled sideways.

- On max-width:639px the four data tables render as stacked cards (.ss-sheet-table
  in index.css): thead hidden, each td a label/value row (label via data-label +
  td::before), cells flex-wrap so a long label plus input never overflows.
- The cost-vs-quantity block is now a vertical list instead of a table, so it
  never scrolls horizontally.

Verified at 390px: values are full and each row is a readable card.
2026-10-05 15:30:12 +07:00
SkateSpots
bed0fb8e34 Deck calculator polish: collapse quote fields, duplicate rows, tax-aware hand-off
- The Client quote fields (15+ inputs) are now a collapsed <details>, so the
  always-visible Margins card stays short; the chevron rotates on open.
- CalcSection buttons set aria-expanded.
- Every equipment/material/process/packaging row gains a duplicate (Copy) action.
- The sticky summary chip shows the order total when quantity > 1 and uses the
  setup-inclusive cost.
- "List a deck at this price" passes a buyer-inclusive unit price (tax added on
  top unless tax is marked inclusive).
2026-10-05 12:45:23 +07:00
SkateSpots
475497b205 Deck calculator: Advanced mode — per-op rate/scrap, batch setup, tax, cost curve
A Simple <-> Advanced switch (not "Pro" — that name is Sasquatch Pro). Advanced
reveals four things a working shop needs:

- Per-operation labour rate (0 = shop rate) and per-operation scrap, which
  compounds with the general scrap into an effective waste %.
- One-off batch setup (hours + cost), amortised over the order quantity, so the
  unit price depends on qty; cost/board now uses the setup-inclusive unit cost.
- A tax / VAT line (inclusive or added on top), shown on the client quote as
  Subtotal / Tax / Total or "includes X%".
- A cost-vs-quantity curve (1/5/10/25/50/100 decks).

All fields round-trip through CSV. The sheet is merged over DEFAULT_CALC on read
and clampPct is NaN-safe, so an old saved sheet or preset can't produce NaN;
currency switching also converts the new money fields.
2026-10-05 12:38:58 +07:00
SkateSpots
df92399abf Deck calculator: collapsible sections, templates, batch/trade pricing, warnings
A+B+C pass on /deck-cost.

A - Declutter: each sheet section is now an accordion (CalcSection) with its
live per-board subtotal in the header (Labor open by default, Margins always
visible), plus quick-start templates (Hobby starter / Small shop) that prefll a
realistic sheet.

B - Batch & trade: a quantity field (unit price vs order total), a wholesale
markup giving a wholesale/unit price, profit per deck, and a breakeven
(fixed / profit) with an optional target-monthly-profit goal. The client quote
shows "x N" and the order total; the deposit is taken on the total.

C - Guards: an amber warning block for markup < 1x, wholesale >= retail, rows
with 0 boards, fixed costs with 0 boards/month, no materials, equipment+overhead
over 60% of cost, and equipment spread over a single board; number inputs clamp
negatives to 0.

New state round-trips through CSV (margins rows). The default sheet produces no
warnings.
2026-10-05 12:25:27 +07:00
SkateSpots
3b8fadad2c Deck calculator: make labels match the maths (burden, loaded rate, markup)
The arithmetic was already consistent, but three labels described something
other than what the code computes:
- "Overhead factor" multiplied labour only while a separate section held the
  real overhead, inviting double-counting -> "Labour burden (x)" + a hint.
- "Labor cost" showed wage x burden, i.e. the loaded rate, not a per-board
  cost -> "Loaded rate".
- "Profit margin (x)" was a markup -> "Markup (x)", with the implied gross
  margin % shown so the name matches the number.

Also: distinct board-count columns (Lifetime boards / Boards per order /
Boards per run) instead of three identical "# boards"; "Scrap / waste (%)".
PDF and Markdown exports use the same names. CSV machine keys are unchanged so
existing exports still round-trip.
2026-10-05 11:21:38 +07:00
SkateSpots
5b9616a86d Deck calculator quotes: payment terms, methods, deposit and optional Incoterms
QuoteProfile gains payment methods (multi-select chips), a deposit percent
(PDF splits "Deposit due now" / "Balance on completion"), free-text payment
terms, separate payment details (bank/PayPal), and an optional Incoterm
(EXW/FCA/DAP/DDP). The client PDF gains a payment block; the PNG shows the
deposit. Quote state is now merged over DEFAULT_QUOTE on read so a quote saved
before a new field existed cannot crash the tool.
2026-10-05 11:16:37 +07:00
SkateSpots
b247be13b0 DIY: parametric 2D deck designer with 1:1 printable template
New /diy/deck-designer tool. src/lib/deckDesign.ts holds the pure geometry
(outline, waist, rounded ends, kicks, concave) and the exporters; the component
renders a live top view, side profile and concave section with presets, saved
locally.

Exports: true-size SVG, a tiled 1:1 PDF (A4/Letter, split across sheets with
corner registration crosses), and an R12 DXF (outline polyline + 3/16" truck
holes + centreline, $INSUNITS=4). Truck patterns: New school 53.975x41.275 mm
and Old school 63.5x41.275 mm.

Deliberately 2D: this is the outline a builder traces and cuts, not a SK8CAD
clone (SK8CAD is proprietary; only its JSCAD engine is MIT, and we copied
nothing).
2026-10-05 11:16:34 +07:00
SkateSpots
a55aa7b53b Deck calculator quotes: optional Nostr identity (NIP-05, npub, Lightning)
The Quote details block gains NIP-05, npub and a Lightning address (lud16), plus
a "Fill from profile" button that autofills name/website/NIP-05/Lightning/npub
from the logged-in kind-0 profile. The client PDF lists the NIP-05 and npub in
the contact block and "Pay via Lightning: <lud16>" under the total; the PNG shows
the NIP-05 (or npub) under the business name. A PDF is a snapshot — the identity
is verifiable on Nostr, not on the paper.
2026-10-05 11:10:15 +07:00
SkateSpots
3f90967f6c Deck calculator: quote number/validity, logo on PNG, shared quote profile
- Extract the client-quote identity into its own store (QuoteProfile,
  skatespots:deck-cost:quote) so it is NOT part of CalcState — loading or saving
  a preset now keeps the same business name/logo/contact details.
- Client quote PDF: a real quote number counter (Q-0007, with a +1 button) and a
  configurable validity window, shown as "Quote valid until <date>".
- PNG summary card now also draws the logo (top-right) and the business name.
2026-10-05 11:04:20 +07:00
SkateSpots
c8cbb848e1 Deck cost calculator: quote logo + business/contact details + notes
A "Quote details" block (in the Result section) lets the user set a business/
shop name, a logo (stored as a data URL — no upload/network, capped 500 KB),
email/phone/website/address and notes/terms. The client quote PDF now renders a
logo + contact header, the line item + total, and the notes/terms. Bumped the
localStorage key to :v2 (and guarded preset/JSON loads) so an older saved sheet
without the quote block can't crash the tool.
2026-10-05 10:59:28 +07:00
SkateSpots
1a8c483682 Deck cost calculator: quote PDF, PNG, XLSX, copy, supplier import
Export ▾ now offers: PDF (full sheet), PDF (client quote — uses an optional
businessName), PNG summary card (canvas), XLSX multi-sheet workbook (lazy
SheetJS), CSV, Markdown, JSON, and Copy summary (clipboard).

Import auto-detects the CSV shape: a `name,order_cost,…` header is treated as a
supplier price list and replaces the Materials table; otherwise the CSV
round-trips the whole sheet. JSON still loads a backup.
2026-10-05 10:54:37 +07:00
SkateSpots
daeb3fbf3e Deck cost calculator: CSV + Markdown export, CSV import
- Export is now a menu: PDF (quote/print), CSV (spreadsheet-friendly
  section,item,field,value rows), Markdown, JSON (backup).
- Import auto-detects .json / .csv: JSON loads a backup, CSV round-trips the
  whole sheet (hand-rolled CSV quote/parse so commas in material names are safe).
2026-10-05 10:47:23 +07:00
SkateSpots
885e818e3b Deck cost calculator: BTC denomination + a full materials checklist
- Currency picker now offers BOTH Bitcoin units — ₿ sats and ₿ BTC (plus fiat).
  BTC is 1 per BTC, sats 1e8; switching converts between them and fiats
  (BTC shows up to 8 decimals, trimmed).
- Default Materials is now a complete deck-build checklist, grouped: wood & core
  (veneer/edge tape/logs), adhesives & fillers (glue/epoxy/filler), press/mold
  consumables (release/vacuum film), shaping (sandpaper/saw+drill bits/masking
  tape), finish & graphics (stain/primer/paint/clearcoat/grip) and Other. New
  rows default to 0 so the worked example is unchanged.
2026-10-05 10:43:26 +07:00
SkateSpots
0387d005d0 Fix the deck-cost PDF layout
The first pass overflowed the right margin (long value strings), had no section
separation, and split the Result across pages. Rebuilt the generator:
- accent rule + title, date/currency subtitle;
- each section gets a lime underline + a hairline rule;
- rows are two-line items (name + per-board value, then a grey detail line with
  cost/boards/setup), so nothing runs past the margin;
- Result section is kept together (page-break guard) and the two selling prices
  render in highlighted boxes;
- page numbers (n / N).
2026-10-05 10:39:35 +07:00
SkateSpots
71f53bcc51 Deck cost calculator: export a PDF by default
The toolbar's primary Export now generates a real PDF (lazy-loaded jspdf) — a
formatted one-page summary: labour, equipment, operations, materials, processes,
packaging, margins and the selling prices, plus the date/currency. Print-to-PDF
was rejected because window.print() doesn't work in the Capacitor WebView.

A secondary JSON export stays (for Import/backup); Import still reads JSON.
jspdf is dynamically imported so it never enters the initial bundle.
2026-10-05 10:36:25 +07:00
SkateSpots
f3242e2fed Deck cost calculator: correctness + presets + a marketplace hand-off
- Equipment now amortises setup time too: (cost + setupHrs × labor/hr) ÷ boards,
  so the Setup (h) column actually does something.
- sats values round to whole numbers on currency conversion.
- Each section shows a per-board subtotal (equipment/materials/processes/packaging).
- Sticky summary bar (under the header) keeps cost + selling price visible while
  you edit.
- Save/Load named presets (localStorage) + Export/Import JSON; Reset now confirms.
- Results gain "List a deck at this price →" (deep-links CreateListingPage with
  ?price&currency, which now reads currency too) and "Get it made →" (Lab Builder).
2026-10-05 10:33:30 +07:00
SkateSpots
985801e19e DIY deck cost: allow only fiat + bitcoin (sats) in the currency picker
Coinbase's exchange-rates response includes crypto (BTC, ETH, USDT, …). Filter
the picker to ISO-4217 fiat codes (FIAT_CODES) plus sats, so only real
currencies and bitcoin are selectable.
2026-10-05 10:21:26 +07:00