Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
Branding URLs were baked with env.APP_URL=http://localhost:3000 at
upload time and stored verbatim in system_settings, so any logo/
background loaded from a non-localhost origin (an iPhone hitting the
Mac's LAN IP) failed to resolve. Same pattern bit Socket.IO (CORS +
client connection target) and the portal logout redirect.
- Branding: getPortBrandingConfig normalizes localhost/private-LAN
hosts to path-only; both upload routes store path-only going
forward; email shell re-absolutizes via absolutizeBrandingUrl() so
inboxes (no app origin) still get fetchable URLs. DB backfilled to
strip http://localhost:3000 from existing rows.
- Socket.IO: client connects to window.location.origin (io() with no
URL); server CORS allows localhost + private-LAN ranges in dev,
stays locked to APP_URL in prod.
- Portal logout: redirect target built from the request URL instead
of env.APP_URL.
- next.config: allowedDevOrigins widened from a hardcoded IP to
192.168/10/172.16-31 wildcards so HMR works across networks
without an edit per-network. (Without HMR the login form's React
click handler never hydrates and the form falls back to GET,
leaking the password into the URL.)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
