Close the four gaps that could be done without the lab

A DOM for the Vue suites, a multi-line box, better-auth's own client, and
service images that carry no build tooling. Each has an ADR and each was
verified against the running system rather than in a diff.

jsdom, pinned in the catalog, and the admin app's privileged controls tested as
sequences rather than as states. One click never turns card access on, a card is
assigned only after the question naming the member is answered, the roles form
sends only what changed and never card access, and the rear unlock button and
every stale door control send nothing. Each was watched failing against a
deliberately broken component. 28 new tests in the admin app.

Field takes rows, and above one the box is a text area. The two skills questions
on the members profile use it. Typed into a browser, saved, and read back out of
Postgres with the line break intact.

The members app builds better-auth's client with createAuthClient rather than
posting to four paths copied out of its published sources. Sign in, a refused
sign in, sign out and the whole reset loop including the emailed link were
walked in a browser against the running stack.

Both services bundle to one file per entry point with esbuild, and neither
runtime image has a node_modules. The API image is 240 MB rather than 475, of
which 231 MB is the node:24.20-alpine base. The door image is 232 MB rather than
271. Every entry point in the API image was run: migrate, seed, make-admin, and
the server signing a seeded member in. pnpm deploy --prod does not prune a
workspace dependency's devDependencies, and the two pnpm-shaped fixes were tried
and measured before this one; ADR 0013 records both.

Also: password-reset.test.ts failed rather than skipping without DATABASE_URL,
because Vitest runs a skipped describe's body to collect the names in it. It
uses the harness's testConfig now, so pnpm check passes with no database, the
way README.md says it does.

631 tests. Lint, typecheck and the voice check are clean.

Author: virgilvox

ATTRIBUTIONS.md

@@ -21,7 +21,7 @@ the lockfile changes.
 
 ## Direct dependencies
 
-The 24 packages named in a `package.json` in this workspace. Versions are the
+The 28 packages named in a `package.json` in this workspace. Versions are the
 ones installed, and every shared version is pinned once in the
 `pnpm-workspace.yaml` catalog.
 
@@ -35,14 +35,18 @@ ones installed, and every shared version is pinned once in the
 | `@vitejs/plugin-vue` | 6.0.8 | MIT | Single file component compilation |
 | `vite` | 8.2.2 | MIT | Dev server and app builds |
 | `vitest` | 4.1.11 | MIT | Test runner everywhere |
+| `jsdom` | 30.0.1 | MIT | The DOM the Vue suites click in, per ADR 0011 |
+| `esbuild` | 0.28.2 | MIT | Bundles each service to one file for its image, per ADR 0013 |
 | `hono` | 4.13.5 | MIT | HTTP framework for the API and the door service |
 | `@hono/node-server` | 2.1.1 | MIT | Node adapter under Hono |
 | `@hono/zod-validator` | 0.9.1 | MIT | Validates requests against the shared schemas |
 | `zod` | 4.5.4 | MIT | Request and response schemas in `packages/schema` |
-| `better-auth` | 1.7.2 | MIT | Sessions and accounts inside the API service |
+| `better-auth` | 1.7.2 | MIT | Sessions and accounts inside the API service, and its own client in the members app, per ADR 0012 |
 | `bcryptjs` | 3.0.2 | BSD-3-Clause | Verifies the legacy password hashes, per ADR 0004 |
 | `drizzle-orm` | 0.45.2 | Apache-2.0 | Tables and queries |
 | `drizzle-kit` | 0.31.10 | MIT | Generates the migrations, per ADR 0006 |
+| `nodemailer` | 9.1.1 | MIT | Sends the password reset mail from the API |
+| `@types/nodemailer` | 8.0.1 | MIT | Types for the mailer |
 | `pg` | 8.23.0 | MIT | Postgres driver. Also the only dependency of `tools/import`, which resolves it from `services/api` |
 | `@types/pg` | 8.15.6 | MIT | Types for the driver |
 | `typescript` | 6.0.3 | Apache-2.0 | The language, pinned by ADR 0009 |

HANDOFF.md

@@ -13,23 +13,25 @@ runs on a laptop under Docker Compose, and `README.md` is the instructions.
 | Part | State | Proven by |
 |---|---|---|
 | `packages/schema` | built | 26 tests, 3 migrations applied to a real Postgres |
-| `packages/ui` | built | 24 tests, rendered in a browser in both themes |
+| `packages/ui` | built | 28 tests, rendered in a browser in both themes |
 | `packages/api-client` | built | 14 tests |
 | `services/api` | built | 198 tests against a real Postgres |
 | `services/door` | built, never spoken to hardware | 125 tests against a fake controller |
-| `apps/members` | built | 44 tests, walked through in a browser |
+| `apps/members` | built | 50 tests, walked through in a browser |
 | `apps/signup` | built | 33 tests, walked through in a browser |
-| `apps/admin` | built | 129 tests, walked through in a browser |
+| `apps/admin` | built | 157 tests, walked through in a browser |
 | `tools/import` | built, run against the real dump | 23 tests, plus the run in section 2 |
 | Compose stack | runs | brought up from nothing, every URL answers |
 | Backup and restore | works | `tools/restore-drill.sh` passes, in CI |
 | Deployment | not started | no host exists yet, see section 5 |
 
-593 tests. Lint, typecheck and the voice check are clean.
+631 tests. Lint, typecheck and the voice check are clean.
 
-14,668 lines of TypeScript and Vue, 7,334 lines of tests, 22 routes, 10 ADRs.
-The previous attempt was 50,941 lines and deployed nothing; the difference is
-almost entirely enforcement machinery that is not here on purpose.
+14,402 lines of TypeScript, Vue and build scripts, and 9,186 lines of tests,
+fixtures and harnesses, counted across `apps`, `packages`, `services` and
+`tools` with build output excluded. 22 routes, 13 ADRs. The previous attempt was
+50,941 lines and deployed nothing; the difference is almost entirely enforcement
+machinery that is not here on purpose.
 
 ## 2. What has been proven against real data
 
@@ -179,18 +181,39 @@ Beyond section 3. None of these is hidden in the code.
 
 - The door service has never spoken to real hardware. Every test runs against a
   fake that speaks the same wire protocol through the same codec.
-- The API image is 487 MB because `pnpm deploy --prod` keeps a workspace
-  dependency's own devDependencies. Roughly 110 MB of build tooling ships and
-  never runs.
-- The members app posts to the three better-auth endpoints directly rather than
-  using `better-auth/vue`, which is not a dependency of that app. The call sites
-  name the file and line each path was read from.
-- `packages/ui` has no multi-line input, so the two free text profile fields use
-  single line ones.
-- The admin suites render with `renderToString` and cannot click, because no DOM
-  environment is installed. Interaction is covered by rendering each state and by
-  pure functions.
 - No deploy workflow. Deployment is four lines by hand in `docs/operations.md`.
+- A stack trace from either service points into a bundled file rather than into
+  a source file. `docs/decisions/0013-services-ship-as-a-bundle.md` says why,
+  and rebuilding the same commit gives the same line numbers.
+
+Closed since the audit. These are the four this section used to list as doable
+now, each with an ADR and each verified against the running system rather than
+in a diff.
+
+- **jsdom, and the admin app's interactions.** The privileged controls are
+  tested as sequences, not as states: one click never turns card access on, a
+  card is assigned only after the question naming the member is answered, the
+  roles form sends only what changed and never card access, and the rear unlock
+  button and every stale control send nothing. Each of those was watched failing
+  against a deliberately broken component. ADR 0011.
+- **A multi-line box.** `Field` takes `rows`, and the two skills questions on
+  the profile use it. Typed into a browser, saved, and read back out of Postgres
+  with the line break intact.
+- **better-auth's own client** in the members app, in place of four hand-copied
+  paths. ADR 0012. Sign in, a refused sign in, sign out and the whole reset loop
+  including the emailed link were walked in a browser against the running stack.
+- **The images.** Both services bundle to one file per entry point and neither
+  runtime image has a `node_modules`. The API image is 240 MB rather than 475,
+  of which 231 MB is the `node:24.20-alpine` base and 6.9 MB is the application.
+  The door image is 232 MB rather than 271. Every entry point in the API image
+  was run: migrate, seed, make-admin, and the server signing a seeded member in.
+  ADR 0013.
+
+One more thing turned up while running the baseline. `password-reset.test.ts`
+failed rather than skipping without `DATABASE_URL`, because Vitest runs a
+skipped describe's body to collect the names in it and that body called
+`loadConfig` with an empty URL. It uses the harness's `testConfig` now, and the
+suite skips the way `README.md` says it does.
 
 ## 8. Open licence questions
 

README.md

@@ -192,7 +192,7 @@ pnpm dev
 pnpm check      # lint, typecheck, test
 ```
 
-593 tests. The ones that need a database read `DATABASE_URL` and skip with a
+631 tests. The ones that need a database read `DATABASE_URL` and skip with a
 message when it is not set. The door service tests run against a fake controller
 that speaks the real wire protocol, so they need no hardware.
 

apps/admin/README.md

@@ -75,12 +75,17 @@ reads as a sentence rather than a 409, a slot above 199 is marked as one the
 reader cannot see, and the guard sends every wrong role to the refusal screen
 rather than into a directory it cannot read.
 
-They render with `renderToString` from `@vue/test-utils` rather than `mount`,
-because neither `jsdom` nor `happy-dom` is installed in this workspace. That is
-why the logic worth asserting on lives in `src/lib` and in props rather than
-inside a click handler: the views fetch and hold state, the components under
-them take props and emit what an admin asked for, and both halves can be tested
-without a DOM.
+The logic worth asserting on lives in `src/lib` and in props rather than inside
+a click handler: the views fetch and hold state, and the components under them
+take props and emit what an admin asked for.
+
+The privileged controls are also tested as sequences rather than as states,
+under jsdom, because this app grants roles and opens a building. One click never
+turns card access on, a card is assigned only after the question naming the
+member is answered, the roles form sends only what changed and never card
+access, the rear unlock button sends nothing, and the door controls send nothing
+while the last report is stale. `src/test-support/interact.ts` finds a control
+by the words on it, the way a person does.
 
 ## What it depends on
 

apps/admin/package.json

@@ -21,6 +21,7 @@
     "@vitejs/plugin-vue": "catalog:",
     "@vue/test-utils": "catalog:",
     "@vue/tsconfig": "catalog:",
+    "jsdom": "catalog:",
     "typescript": "catalog:",
     "vite": "catalog:",
     "vitest": "catalog:",

apps/admin/src/components/CardAccessControl.test.ts

@@ -1,7 +1,8 @@
 import { ApiError } from '@hsl/api-client'
-import { renderToString } from '@vue/test-utils'
+import { mount, renderToString } from '@vue/test-utils'
 import { describe, expect, it } from 'vitest'
 
+import { attached, click } from '../test-support/interact.ts'
 import CardAccessControl from './CardAccessControl.vue'
 
 const base = { memberName: 'Sam Rivera', saving: false, error: null }
@@ -38,3 +39,67 @@ describe('CardAccessControl', () => {
     expect(html).toContain('That needs an admin.')
   })
 })
+
+/**
+ * Card access is a building key and the control asks twice. Rendering proves
+ * the first question is on the screen and the second is not. Only clicking
+ * proves the second cannot be reached without answering the first.
+ */
+describe('CardAccessControl, clicked', () => {
+  it('asks rather than granting, so one click never opens a building', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: false } })
+
+    await click(wrapper, 'Turn card access on')
+
+    expect(wrapper.emitted('set')).toBeUndefined()
+    expect(wrapper.text()).toContain('Give Sam Rivera card access?')
+  })
+
+  it('grants it once the second question is answered', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: false } })
+
+    await click(wrapper, 'Turn card access on')
+    await click(wrapper, 'Yes, do it')
+
+    expect(wrapper.emitted('set')).toEqual([[true]])
+  })
+
+  it('takes it away from a member who has it, rather than setting it again', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: true } })
+
+    await click(wrapper, 'Turn card access off')
+    await click(wrapper, 'Yes, do it')
+
+    expect(wrapper.emitted('set')).toEqual([[false]])
+  })
+
+  it('changes nothing when the question is cancelled', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: false } })
+
+    await click(wrapper, 'Turn card access on')
+    await click(wrapper, 'Cancel')
+
+    expect(wrapper.emitted('set')).toBeUndefined()
+    expect(wrapper.text()).toContain('Turn card access on')
+  })
+
+  it('will not send a second time while the first is still saving', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: false } })
+    await click(wrapper, 'Turn card access on')
+    await wrapper.setProps({ saving: true })
+
+    await click(wrapper, 'Saving')
+
+    expect(wrapper.emitted('set')).toBeUndefined()
+  })
+
+  it('drops the stale question when the answer arrives', async () => {
+    const wrapper = mount(CardAccessControl, { ...attached, props: { ...base, cardAccess: false } })
+    await click(wrapper, 'Turn card access on')
+
+    await wrapper.setProps({ cardAccess: true })
+
+    expect(wrapper.text()).not.toContain('Give Sam Rivera card access?')
+    expect(wrapper.text()).toContain('Card access is on')
+  })
+})

apps/admin/src/components/CardAssignForm.test.ts

@@ -1,7 +1,8 @@
 import { ApiError } from '@hsl/api-client'
-import { renderToString } from '@vue/test-utils'
+import { mount, renderToString } from '@vue/test-utils'
 import { describe, expect, it } from 'vitest'
 
+import { attached, click, fill, optionLabels } from '../test-support/interact.ts'
 import { directoryEntries } from '../test-fixtures.ts'
 import CardAssignForm from './CardAssignForm.vue'
 
@@ -94,3 +95,76 @@ describe('CardAssignForm', () => {
     expect(html).toContain('1061 members match')
   })
 })
+
+/**
+ * Assigning a card takes a slot on a physical controller and gives somebody a
+ * way into the building. The form picks the member, the question names them,
+ * and nothing is sent until the question is answered.
+ */
+describe('CardAssignForm, filled in', () => {
+  function form() {
+    return mount(CardAssignForm, { ...attached, props: { ...base, members: directoryEntries } })
+  }
+
+  it('reviews before assigning, so picking a member sends nothing', async () => {
+    const wrapper = form()
+
+    await fill(wrapper, 'Member', 'mbr_volkov')
+    await click(wrapper, 'Review')
+
+    expect(wrapper.emitted('assign')).toBeUndefined()
+    expect(wrapper.text()).toContain('Give card 0004B1C7 to M. Volkov?')
+  })
+
+  it('assigns the member who was picked once the question is answered', async () => {
+    const wrapper = form()
+
+    await fill(wrapper, 'Member', 'mbr_volkov')
+    await click(wrapper, 'Review')
+    await click(wrapper, 'Yes, assign it')
+
+    expect(wrapper.emitted('assign')).toEqual([
+      [{ userId: 'mbr_volkov', cardNumber: '0004B1C7' }],
+    ])
+  })
+
+  it('carries a typed label, trimmed, and leaves it out when it is blank', async () => {
+    const wrapper = form()
+
+    await fill(wrapper, 'Member', 'mbr_rivera')
+    await fill(wrapper, 'Label, optional', '  blue fob  ')
+    await click(wrapper, 'Review')
+    await click(wrapper, 'Yes, assign it')
+
+    expect(wrapper.emitted('assign')).toEqual([
+      [{ userId: 'mbr_rivera', cardNumber: '0004B1C7', label: 'blue fob' }],
+    ])
+  })
+
+  it('goes back to the form without assigning', async () => {
+    const wrapper = form()
+
+    await fill(wrapper, 'Member', 'mbr_rivera')
+    await click(wrapper, 'Review')
+    await click(wrapper, 'Back')
+
+    expect(wrapper.emitted('assign')).toBeUndefined()
+    expect(wrapper.text()).toContain('Search name or email')
+  })
+
+  it('narrows the list to what was searched, over name and email both', async () => {
+    const wrapper = form()
+
+    await fill(wrapper, 'Search name or email', 'volkov')
+
+    expect(optionLabels(wrapper, 'Member')).toEqual(['Pick a member', 'M. Volkov'])
+  })
+
+  it('will not review until a member is picked', async () => {
+    const wrapper = form()
+
+    await click(wrapper, 'Review')
+
+    expect(wrapper.text()).not.toContain('Yes, assign it')
+  })
+})

apps/admin/src/components/DoorControlPanel.test.ts

@@ -1,7 +1,8 @@
 import type { DoorStatusResponse } from '@hsl/schema'
-import { renderToString } from '@vue/test-utils'
+import { mount, renderToString } from '@vue/test-utils'
 import { describe, expect, it } from 'vitest'
 
+import { attached, buttonLabels, click, isDisabled } from '../test-support/interact.ts'
 import { doorReportingLive } from '../test-fixtures.ts'
 import DoorControlPanel from './DoorControlPanel.vue'
 
@@ -68,3 +69,56 @@ describe('DoorControlPanel', () => {
     expect(html).toContain('Open front was refused.')
   })
 })
+
+/**
+ * The controls that open a building. Rendering proves the rear unlock button is
+ * on the screen and disabled. Only clicking proves that pressing it sends
+ * nothing, which is the part the 2018 lab decision is about.
+ */
+describe('DoorControlPanel, clicked', () => {
+  function panel(door: DoorStatusResponse = doorReportingLive) {
+    return mount(DoorControlPanel, { ...attached, props: { ...base, door } })
+  }
+
+  it('sends the command on the button that was pressed', async () => {
+    const wrapper = panel()
+
+    await click(wrapper, 'Open front')
+
+    expect(wrapper.emitted('send')).toEqual([['open-front', 'Open front']])
+  })
+
+  it('sends nothing when the rear unlock button is pressed, per the 2018 decision', async () => {
+    const wrapper = panel()
+
+    expect(isDisabled(wrapper, 'Unlock rear')).toBe(true)
+    await click(wrapper, 'Unlock rear')
+
+    expect(wrapper.emitted('send')).toBeUndefined()
+  })
+
+  it('sends nothing while the last report is too old to read as live', async () => {
+    const wrapper = panel({ ...doorReportingLive, stale: true })
+
+    await click(wrapper, 'Open front')
+    await click(wrapper, 'Lock all')
+
+    expect(wrapper.emitted('send')).toBeUndefined()
+  })
+
+  it('sends nothing while another command is already in flight', async () => {
+    const wrapper = panel()
+    await wrapper.setProps({ busy: 'open-front' })
+
+    await click(wrapper, 'Lock all')
+
+    expect(wrapper.emitted('send')).toBeUndefined()
+  })
+
+  it('offers no alarm toggle at all when there is no status to toggle', () => {
+    const wrapper = panel({ status: null, reportedAt: null, stale: true })
+
+    expect(buttonLabels(wrapper)).not.toContain('Arm alarm')
+    expect(buttonLabels(wrapper)).not.toContain('Disarm alarm')
+  })
+})