hypercerts-org · holkexyz · May 29, 2026 · May 28, 2026 · May 28, 2026 · May 28, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - staging
+      - main
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.9.0'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Test
+        run: npm test
diff --git a/.gitignore b/.gitignore
@@ -40,4 +40,4 @@ yarn-error.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
-core
+/core
diff --git a/.nvmrc b/.nvmrc
@@ -0,0 +1 @@
+20.9.0
diff --git a/AGENTS.md b/AGENTS.md
@@ -92,7 +92,10 @@ Certified is a passwordless identity platform built on **AT Protocol** (atproto)
 | React | 19.x |
 | Language | TypeScript 5 (strict, `paths: { "@/*": ["./src/*"] }`) |
 | Styling | Tailwind CSS 3.4 (utilities only) + custom CSS in `globals.css` (BEM-like) |
-| Atproto SDK | `@atproto/api` 0.19, `@atproto/oauth-client-node` 0.3, `@atproto/jwk-jose` 0.1 (`@atproto/oauth-client` 0.6 pulled in transitively) |
+| Theming | `next-themes` 0.4 (light/dark via `data-theme` on `<html>`) |
+| Atproto SDK | `@atproto/api` 0.13, `@atproto/oauth-client-node` 0.3, `@atproto/jwk-jose` 0.1 (`@atproto/oauth-client` 0.6 pulled in transitively) |
+| Rich text | `@tiptap/react` 3.x (+ `starter-kit`, `extension-link`, `extension-placeholder`, `pm`) |
+| Maps | `leaflet` 1.9 + `react-leaflet` 5.x |
 | Session/State store | Upstash Redis (`@upstash/redis`) — REST-based, serverless-safe |
 | Server actions | None — all server work is in route handlers (`src/app/api/**`) |
 | Wallets | `wagmi` 2.x + `viem` 2.x + `@tanstack/react-query` (mounted only on `/settings/wallet`) |
@@ -642,7 +645,7 @@ These rules are mandatory. Treat any deviation as a regression.
 6. **Sanitize input twice** — client AND server (defense in depth). Use `stripInvisible`, `sanitizeEmail`, `sanitizeHandle` from `src/lib/utils/sanitize.ts`. The regex is `/[-‏ - ⁠-⁯͏؜᠎]/g`.
 7. **Sanitize 5xx errors.** Never echo `err.message` from upstream PDS errors when status ≥ 500 — return `"Internal server error"` (or a route-specific generic). The XRPC proxy and `/api/groups/register` both do this; copy the pattern. (4xx errors *can* echo upstream messages — those are usually validation errors a user can act on.)
 8. **Repo ownership on writes** — for `createRecord`/`putRecord`/`deleteRecord`, `body.repo` must equal the session DID. Cross-repo writes are 403.
-9. **Collection allowlist** — only the four `ALLOWED_WRITE_COLLECTIONS` can be written through the XRPC proxy. Add to that array consciously, not implicitly.
+9. **Collection allowlist** — only the eleven `ALLOWED_WRITE_COLLECTIONS` can be written through the XRPC proxy. Add to that array consciously, not implicitly.
 10. **Blob limits** — 4 MB cap (image MIME types only) on `/api/xrpc/[...method]` for `uploadBlob`; 5 MB on the group blob route. Both check `Content-Length` and the actual buffer size. Vercel has a hard ~4.5 MB body cap that constrains the XRPC proxy.
 11. **Service-auth tokens are short-lived and per-LXM** — `getServiceAuthToken(agent, lxm)` issues a token bound to a single method. Don't cache or reuse.
 

diff --git a/CHANGES.md b/CHANGES.md
diff --git a/REVIEW.md b/REVIEW.md
diff --git a/eslint.config.mjs b/eslint.config.mjs
@@ -12,10 +12,19 @@
 
 import nextConfig from "eslint-config-next/core-web-vitals";
 
-export default [
+// Now that `npm run lint` runs `eslint .` (not just `src/`), the ignore
+// list must cover build output at any depth — `.claude/worktrees/*` holds
+// nested checkouts with their own `.next/` chunks, so a bare `.next/`
+// (root-anchored in flat config) would let ESLint lint generated bundles.
+const config = [
   ...nextConfig,
   {
-    ignores: [".next/", "node_modules/", "coverage/"],
+    ignores: [
+      "**/.next/",
+      "**/node_modules/",
+      "**/coverage/",
+      ".claude/",
+    ],
   },
   {
     rules: {
@@ -33,3 +42,5 @@ export default [
     },
   },
 ];
+
+export default config;
diff --git a/package.json b/package.json
@@ -2,14 +2,19 @@
   "name": "certified-app",
   "version": "0.1.0",
   "private": true,
+  "engines": {
+    "node": ">=20.9.0"
+  },
   "scripts": {
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "eslint src/ --ext .ts,.tsx",
+    "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "typecheck:test": "tsc --noEmit -p tsconfig.test.json"
   },
   "dependencies": {
     "@atproto/api": "^0.13.20",

diff --git a/scripts/audit-screenshots.mjs b/scripts/audit-screenshots.mjs
@@ -11,7 +11,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..");
 const OUT = join(ROOT, "docs/design-audit/screenshots");
 
-const BASE = process.env.BASE || "http://localhost:3001";
+const BASE = process.env.BASE || "http://localhost:3000";
 
 const SURFACES = [
   { name: "01-root", url: "/", note: "Root entry point" },

diff --git a/scripts/capture-divergence-sheet.mjs b/scripts/capture-divergence-sheet.mjs
@@ -7,7 +7,13 @@ import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..");
-const SHEET = "file://" + join(ROOT, "docs/design-audit/divergence-sheet.html");
+// This sheet is a static file, not a dev-server route. BASE, when set, points
+// the capture at a served origin; the file:// path is the default fallback so
+// the script keeps working with no dev server running. (process.env.BASE is
+// the same knob the other audit scripts read; default origin is :3000 there.)
+const SHEET = process.env.BASE
+  ? process.env.BASE + "/docs/design-audit/divergence-sheet.html"
+  : "file://" + join(ROOT, "docs/design-audit/divergence-sheet.html");
 const OUT = join(ROOT, "docs/design-audit/divergence");
 
 await mkdir(OUT, { recursive: true });

diff --git a/scripts/recapture-landing.mjs b/scripts/recapture-landing.mjs
@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const OUT = join(__dirname, "..", "docs/design-consolidation/after");
+const BASE = process.env.BASE || "http://localhost:3000";
 await mkdir(OUT, { recursive: true });
 
 const browser = await chromium.launch();
@@ -18,15 +19,15 @@ for (const theme of ["light", "dark"]) {
     try { localStorage.setItem("theme", t); } catch {}
   }, theme);
   const page = await ctx.newPage();
-  await page.goto("http://localhost:3000/welcome", { waitUntil: "domcontentloaded" });
+  await page.goto(BASE + "/welcome", { waitUntil: "domcontentloaded" });
   await page.waitForTimeout(1000);
   await page.screenshot({ path: join(OUT, `landing_${theme}.png`), fullPage: true });
   console.log(`✓ landing ${theme}`);
   // Also capture /apps and /privacy as additional dark-mode tests.
-  await page.goto("http://localhost:3000/apps", { waitUntil: "domcontentloaded" });
+  await page.goto(BASE + "/apps", { waitUntil: "domcontentloaded" });
   await page.waitForTimeout(600);
   await page.screenshot({ path: join(OUT, `apps_${theme}.png`), fullPage: true });
-  await page.goto("http://localhost:3000/privacy", { waitUntil: "domcontentloaded" });
+  await page.goto(BASE + "/privacy", { waitUntil: "domcontentloaded" });
   await page.waitForTimeout(600);
   await page.screenshot({ path: join(OUT, `privacy_${theme}.png`), fullPage: true });
   await ctx.close();

diff --git a/src/app/__tests__/create-image-upload-error.test.tsx b/src/app/__tests__/create-image-upload-error.test.tsx
@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"
+import { render, screen, cleanup, fireEvent, waitFor } from "@testing-library/react"
+
+// --- Module mocks -----------------------------------------------------
+// CreatePage pulls in auth/org contexts, next/navigation, navbar title,
+// author info, and the blob uploader. Stub everything that isn't under
+// test so the authenticated form mounts, then drive the image picker.
+
+vi.mock("@/lib/auth/auth-context", () => ({
+  useAuth: () => ({ did: "did:plc:me", isAuthenticated: true, isLoading: false }),
+}))
+
+vi.mock("@/lib/groups/org-context", () => ({
+  useOrg: () => ({ activeOrg: null }),
+}))
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn() }),
+}))
+
+vi.mock("@/lib/navbar-context", () => ({
+  usePageTitle: () => {},
+}))
+
+vi.mock("@/hooks/use-author-info", () => ({
+  useAuthorInfo: () => ({ info: null }),
+}))
+
+// authFetch is used for the rights dropdown load — keep it inert so the
+// effect resolves to an empty list without a real network call.
+vi.mock("@/lib/auth/fetch", () => ({
+  authFetch: vi.fn().mockResolvedValue({
+    ok: true,
+    json: async () => ({ records: [] }),
+  }),
+}))
+
+// The unit under test: uploadBlob rejects, simulating a failed blob
+// write. The page must surface the error and clear the dangling preview.
+const uploadBlob = vi.fn()
+vi.mock("@/lib/atproto/profile", () => ({
+  uploadBlob: (...args: unknown[]) => uploadBlob(...args),
+}))
+
+import CreatePage from "../create/page"
+
+beforeEach(() => {
+  cleanup()
+  uploadBlob.mockReset()
+  // jsdom doesn't implement object URLs — stub so the preview logic runs.
+  // @ts-expect-error — test shim
+  URL.createObjectURL = vi.fn(() => "blob:preview-url")
+  // @ts-expect-error — test shim
+  URL.revokeObjectURL = vi.fn()
+})
+
+afterEach(() => {
+  cleanup()
+})
+
+describe("CreatePage image upload failure", () => {
+  it("surfaces an error and clears the preview when uploadBlob rejects", async () => {
+    uploadBlob.mockRejectedValue(new Error("blob write failed"))
+
+    const { container } = render(<CreatePage />)
+
+    const input = container.querySelector(
+      "input.image-edit-overlay__input",
+    ) as HTMLInputElement
+    expect(input).toBeTruthy()
+
+    const file = new File(["x"], "hero.png", { type: "image/png" })
+    fireEvent.change(input, { target: { files: [file] } })
+
+    // The error message surfaces in the page's role="alert" region.
+    expect(await screen.findByText("blob write failed")).toBeTruthy()
+
+    // The optimistic preview must be cleared — no <img> left behind that
+    // would let the user publish a cert without the previewed image.
+    await waitFor(() => {
+      expect(
+        container.querySelector("img.cert-detail__image-img"),
+      ).toBeNull()
+    })
+  })
+})
diff --git a/src/app/__tests__/endorsements-received-rejected.test.tsx b/src/app/__tests__/endorsements-received-rejected.test.tsx
@@ -0,0 +1,127 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"
+import { render, screen, cleanup, waitFor } from "@testing-library/react"
+import type { ReceivedEndorsement } from "@/hooks/use-received-endorsements"
+
+// --- Module mocks -----------------------------------------------------
+// EndorsementsPage pulls in auth, navbar/navigation contexts, the
+// given-endorsements hook, the own-response-states hook, and per-row
+// author-info. None of those are under test here — stub them to inert
+// defaults so the page mounts on the Received tab and we can assert
+// whether a rejected endorsement row is rendered.
+//
+// The one mock that carries the assertion is `useReceivedEndorsements`:
+// it mirrors the real hook's `includeRejected` contract (rejected
+// awards are stripped unless the caller opts in). The page is the
+// owner's own management inbox, so the fix is for the page to pass
+// `{ includeRejected: true }`; before the fix it passes nothing and
+// the rejected row is filtered out.
+
+const DID = "did:plc:owner"
+
+const REJECTED_ENDORSEMENT: ReceivedEndorsement = {
+  uri: "at://did:plc:issuer/app.certified.badge.award/rejected1",
+  cid: "bafyrejected",
+  issuerDid: "did:plc:issuer",
+  createdAt: "2025-01-01T00:00:00.000Z",
+  note: "Rejected endorsement note",
+  responseState: "rejected",
+}
+
+vi.mock("@/lib/auth/auth-context", () => ({
+  useAuth: () => ({ did: DID, isAuthenticated: true }),
+}))
+
+vi.mock("@/lib/navbar-context", () => ({
+  usePageTitle: () => undefined,
+}))
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/endorsements",
+  useRouter: () => ({ replace: vi.fn(), push: vi.fn() }),
+  useSearchParams: () => new URLSearchParams("tab=received"),
+}))
+
+vi.mock("@/hooks/use-endorsements", () => ({
+  useGivenEndorsements: () => ({
+    endorsements: [],
+    isLoading: false,
+    error: null,
+    refetch: vi.fn(async () => undefined),
+  }),
+}))
+
+// Mirror the real hook's `includeRejected` filter: rejected awards are
+// only returned when the caller opts in. This is the exact behavior the
+// fix exercises from the page's call site.
+const receivedHook = vi.fn(
+  (
+    _profileDid: string | null,
+    opts?: { includeRejected?: boolean },
+  ) => {
+    const all = [REJECTED_ENDORSEMENT]
+    const endorsements = opts?.includeRejected
+      ? all
+      : all.filter((e) => e.responseState !== "rejected")
+    return { endorsements, isLoading: false, error: null }
+  },
+)
+
+vi.mock("@/hooks/use-received-endorsements", () => ({
+  useReceivedEndorsements: (
+    profileDid: string | null,
+    opts?: { includeRejected?: boolean },
+  ) => receivedHook(profileDid, opts),
+}))
+
+vi.mock("@/hooks/use-own-response-states", () => ({
+  useOwnResponseStates: () => ({
+    resolve: () => ({ state: "rejected" as const }),
+    responses: [],
+    isLoading: false,
+    invalidate: vi.fn(),
+    refetch: vi.fn(async () => undefined),
+  }),
+}))
+
+vi.mock("@/hooks/use-author-info", () => ({
+  useAuthorInfo: () => ({
+    info: { did: "did:plc:issuer", handle: "issuer.test", displayName: "Issuer Name", avatarUrl: null },
+    isLoading: false,
+    error: null,
+  }),
+}))
+
+vi.mock("@/lib/atproto/badges", () => ({
+  deleteEndorsementAward: vi.fn(async () => undefined),
+}))
+
+import EndorsementsPage from "../endorsements/page"
+
+beforeEach(() => {
+  cleanup()
+  receivedHook.mockClear()
+})
+
+afterEach(() => {
+  cleanup()
+})
+
+describe("EndorsementsPage Received tab — rejected endorsements", () => {
+  it("requests rejected endorsements and renders the rejected row (owner inbox)", async () => {
+    render(<EndorsementsPage />)
+
+    // The owner's own inbox must opt into seeing rejected awards so the
+    // user can review (and un-reject) them — §22.21 privacy is preserved
+    // because this is the owner viewing their own inbox.
+    await waitFor(() => {
+      expect(receivedHook).toHaveBeenCalledWith(
+        DID,
+        expect.objectContaining({ includeRejected: true }),
+      )
+    })
+
+    // And the rejected row actually renders.
+    expect(await screen.findByText("Issuer Name")).toBeTruthy()
+    expect(screen.getByText("Rejected endorsement note")).toBeTruthy()
+  })
+})