fix unit tests from using response

Allows test environment PM2 processes to load environment variables
from /var/www/flyer-crawler-test.projectium.com/.env file, enabling
manual restarts without requiring CI/CD to inject variables.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/settings.local.json

@@ -95,7 +95,11 @@
       "Bash(timeout 300 tail:*)",
       "mcp__filesystem__list_allowed_directories",
       "mcp__memory__add_observations",
-      "Bash(ssh:*)"
+      "Bash(ssh:*)",
+      "mcp__redis__list",
+      "Read(//d/gitea/bugsink-mcp/**)",
+      "Bash(d:/nodejs/npm.cmd install)",
+      "Bash(node node_modules/vitest/vitest.mjs run:*)"
     ]
   }
 }

.env.example

@@ -102,3 +102,13 @@ VITE_SENTRY_ENABLED=true
 # Enable debug mode for SDK troubleshooting (default: false)
 SENTRY_DEBUG=false
 VITE_SENTRY_DEBUG=false
+
+# ===================
+# Source Maps Upload (ADR-015)
+# ===================
+# Auth token for uploading source maps to Bugsink
+# Create at: https://bugsink.projectium.com (Settings > API Keys)
+# Required for de-minified stack traces in error reports
+SENTRY_AUTH_TOKEN=
+# URL of your Bugsink instance (for source map uploads)
+SENTRY_URL=https://bugsink.projectium.com

.gitea/workflows/deploy-to-prod.yml

@@ -63,8 +63,8 @@ jobs:
       - name: Check for Production Database Schema Changes
         env:
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_USER: ${{ secrets.DB_USER_PROD }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
           DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
         run: |
           if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_NAME" ]; then
@@ -87,11 +87,22 @@ jobs:
           fi
 
       - name: Build React Application for Production
+        # Source Maps (ADR-015): If SENTRY_AUTH_TOKEN is set, the @sentry/vite-plugin will:
+        # 1. Generate hidden source maps during build
+        # 2. Upload them to Bugsink for error de-minification
+        # 3. Delete the .map files after upload (so they're not publicly accessible)
         run: |
           if [ -z "${{ secrets.VITE_GOOGLE_GENAI_API_KEY }}" ]; then
             echo "ERROR: The VITE_GOOGLE_GENAI_API_KEY secret is not set."
             exit 1
           fi
+
+          # Source map upload is optional - warn if not configured
+          if [ -z "${{ secrets.SENTRY_AUTH_TOKEN }}" ]; then
+            echo "WARNING: SENTRY_AUTH_TOKEN not set. Source maps will NOT be uploaded to Bugsink."
+            echo "         Errors will show minified stack traces. To fix, add SENTRY_AUTH_TOKEN to Gitea secrets."
+          fi
+
           GITEA_SERVER_URL="https://gitea.projectium.com"
           COMMIT_MESSAGE=$(git log -1 --grep="\[skip ci\]" --invert-grep --pretty=%s)
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
@@ -101,6 +112,8 @@ jobs:
           VITE_SENTRY_DSN="${{ secrets.VITE_SENTRY_DSN }}" \
           VITE_SENTRY_ENVIRONMENT="production" \
           VITE_SENTRY_ENABLED="true" \
+          SENTRY_AUTH_TOKEN="${{ secrets.SENTRY_AUTH_TOKEN }}" \
+          SENTRY_URL="https://bugsink.projectium.com" \
           VITE_API_BASE_URL=/api VITE_API_KEY=${{ secrets.VITE_GOOGLE_GENAI_API_KEY }} npm run build
 
       - name: Deploy Application to Production Server
@@ -117,8 +130,8 @@ jobs:
         env:
           # --- Production Secrets Injection ---
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_USER: ${{ secrets.DB_USER_PROD }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
           DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
           # Explicitly use database 0 for production (test uses database 1)
           REDIS_URL: 'redis://localhost:6379/0'

.gitea/workflows/deploy-to-test.yml

@@ -121,10 +121,11 @@ jobs:
         env:
           # --- Database credentials for the test suite ---
           # These are injected from Gitea secrets into the runner's environment.
+          # CRITICAL: Use TEST-specific credentials that have CREATE privileges on the public schema.
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-          DB_NAME: 'flyer-crawler-test' # Explicitly set for tests
+          DB_USER: ${{ secrets.DB_USER_TEST }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_TEST }}
+          DB_NAME: ${{ secrets.DB_DATABASE_TEST }}
 
           # --- Redis credentials for the test suite ---
           # CRITICAL: Use Redis database 1 to isolate tests from production (which uses db 0).
@@ -328,10 +329,11 @@ jobs:
       - name: Check for Test Database Schema Changes
         env:
           # Use test database credentials for this check.
+          # CRITICAL: Use TEST-specific credentials that have CREATE privileges on the public schema.
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }} # This is used by psql
-          DB_NAME: ${{ secrets.DB_DATABASE_TEST }} # This is used by the application
+          DB_USER: ${{ secrets.DB_USER_TEST }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_TEST }}
+          DB_NAME: ${{ secrets.DB_DATABASE_TEST }}
         run: |
           # Fail-fast check to ensure secrets are configured in Gitea.
           if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_NAME" ]; then
@@ -372,6 +374,11 @@ jobs:
         # We set the environment variable directly in the command line for this step.
         # This maps the Gitea secret to the environment variable the application expects.
         # We also generate and inject the application version, commit URL, and commit message.
+        #
+        # Source Maps (ADR-015): If SENTRY_AUTH_TOKEN is set, the @sentry/vite-plugin will:
+        # 1. Generate hidden source maps during build
+        # 2. Upload them to Bugsink for error de-minification
+        # 3. Delete the .map files after upload (so they're not publicly accessible)
         run: |
           # Fail-fast check for the build-time secret.
           if [ -z "${{ secrets.VITE_GOOGLE_GENAI_API_KEY }}" ]; then
@@ -379,6 +386,12 @@ jobs:
             exit 1
           fi
 
+          # Source map upload is optional - warn if not configured
+          if [ -z "${{ secrets.SENTRY_AUTH_TOKEN }}" ]; then
+            echo "WARNING: SENTRY_AUTH_TOKEN not set. Source maps will NOT be uploaded to Bugsink."
+            echo "         Errors will show minified stack traces. To fix, add SENTRY_AUTH_TOKEN to Gitea secrets."
+          fi
+
           GITEA_SERVER_URL="https://gitea.projectium.com" # Your Gitea instance URL
           # Sanitize commit message to prevent shell injection or build breaks (removes quotes, backticks, backslashes, $)
           COMMIT_MESSAGE=$(git log -1 --grep="\[skip ci\]" --invert-grep --pretty=%s | tr -d '"`\\$')
@@ -389,6 +402,8 @@ jobs:
           VITE_SENTRY_DSN="${{ secrets.VITE_SENTRY_DSN_TEST }}" \
           VITE_SENTRY_ENVIRONMENT="test" \
           VITE_SENTRY_ENABLED="true" \
+          SENTRY_AUTH_TOKEN="${{ secrets.SENTRY_AUTH_TOKEN }}" \
+          SENTRY_URL="https://bugsink.projectium.com" \
           VITE_API_BASE_URL="https://flyer-crawler-test.projectium.com/api" VITE_API_KEY=${{ secrets.VITE_GOOGLE_GENAI_API_KEY_TEST }} npm run build
 
       - name: Deploy Application to Test Server
@@ -427,9 +442,10 @@ jobs:
           # Your Node.js application will read these directly from `process.env`.
 
           # Database Credentials
+          # CRITICAL: Use TEST-specific credentials that have CREATE privileges on the public schema.
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_USER: ${{ secrets.DB_USER_TEST }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_TEST }}
           DB_NAME: ${{ secrets.DB_DATABASE_TEST }}
 
           # Redis Credentials (use database 1 to isolate from production)

.gitea/workflows/manual-db-backup.yml

@@ -20,9 +20,9 @@ jobs:
       # Use production database credentials for this entire job.
       DB_HOST: ${{ secrets.DB_HOST }}
       DB_PORT: ${{ secrets.DB_PORT }}
-      DB_USER: ${{ secrets.DB_USER }}
-      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-      DB_NAME: ${{ secrets.DB_NAME_PROD }}
+      DB_USER: ${{ secrets.DB_USER_PROD }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
+      DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
 
     steps:
       - name: Validate Secrets

.gitea/workflows/manual-db-reset-prod.yml

@@ -23,9 +23,9 @@ jobs:
     env:
       # Use production database credentials for this entire job.
       DB_HOST: ${{ secrets.DB_HOST }}
-      DB_USER: ${{ secrets.DB_USER }}
-      DB_PASSWORD: ${{ secrets.DB_PASSWORD }} # Used by psql
-      DB_NAME: ${{ secrets.DB_DATABASE_PROD }} # Used by the application
+      DB_USER: ${{ secrets.DB_USER_PROD }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
+      DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
 
     steps:
       - name: Checkout Code

.gitea/workflows/manual-db-reset-test.yml

@@ -23,9 +23,9 @@ jobs:
     env:
       # Use test database credentials for this entire job.
       DB_HOST: ${{ secrets.DB_HOST }}
-      DB_USER: ${{ secrets.DB_USER }}
-      DB_PASSWORD: ${{ secrets.DB_PASSWORD }} # Used by psql
-      DB_NAME: ${{ secrets.DB_DATABASE_TEST }} # Used by the application
+      DB_USER: ${{ secrets.DB_USER_TEST }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD_TEST }}
+      DB_NAME: ${{ secrets.DB_DATABASE_TEST }}
 
     steps:
       - name: Checkout Code

.gitea/workflows/manual-db-restore.yml

@@ -22,8 +22,8 @@ jobs:
     env:
       # Use production database credentials for this entire job.
       DB_HOST: ${{ secrets.DB_HOST }}
-      DB_USER: ${{ secrets.DB_USER }}
-      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+      DB_USER: ${{ secrets.DB_USER_PROD }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
       DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
       BACKUP_DIR: '/var/www/backups' # Define a dedicated directory for backups
 

.gitea/workflows/manual-deploy-major.yml

@@ -62,8 +62,8 @@ jobs:
       - name: Check for Production Database Schema Changes
         env:
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_USER: ${{ secrets.DB_USER_PROD }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
           DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
         run: |
           if [ -z "$DB_HOST" ] || [ -z "$DB_USER" ] || [ -z "$DB_PASSWORD" ] || [ -z "$DB_NAME" ]; then
@@ -113,8 +113,8 @@ jobs:
         env:
           # --- Production Secrets Injection ---
           DB_HOST: ${{ secrets.DB_HOST }}
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_USER: ${{ secrets.DB_USER_PROD }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
           DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
           # Explicitly use database 0 for production (test uses database 1)
           REDIS_URL: 'redis://localhost:6379/0'

CLAUDE-MCP.md

@@ -0,0 +1,378 @@
+# Claude Code MCP Configuration Guide
+
+This document explains how to configure MCP (Model Context Protocol) servers for Claude Code, covering both the CLI and VS Code extension.
+
+## The Two Config Files
+
+Claude Code uses **two separate configuration files** for MCP servers. They must be kept in sync manually.
+
+| File                      | Used By                       | Notes                                       |
+| ------------------------- | ----------------------------- | ------------------------------------------- |
+| `~/.claude.json`          | Claude CLI (`claude` command) | Requires `"type": "stdio"` in each server   |
+| `~/.claude/settings.json` | VS Code Extension             | Simpler format, supports `"disabled": true` |
+
+**Important:** Changes to one file do NOT automatically sync to the other!
+
+## File Locations (Windows)
+
+```text
+C:\Users\<username>\.claude.json           # CLI config
+C:\Users\<username>\.claude\settings.json  # VS Code extension config
+```
+
+## Config Format Differences
+
+### VS Code Extension Format (`~/.claude/settings.json`)
+
+```json
+{
+  "mcpServers": {
+    "server-name": {
+      "command": "path/to/executable",
+      "args": ["arg1", "arg2"],
+      "env": {
+        "ENV_VAR": "value"
+      },
+      "disabled": true // Optional - disable without removing
+    }
+  }
+}
+```
+
+### CLI Format (`~/.claude.json`)
+
+The CLI config is a larger file with many settings. The `mcpServers` section is nested within it:
+
+```json
+{
+  "numStartups": 14,
+  "installMethod": "global",
+  // ... other settings ...
+  "mcpServers": {
+    "server-name": {
+      "type": "stdio", // REQUIRED for CLI
+      "command": "path/to/executable",
+      "args": ["arg1", "arg2"],
+      "env": {
+        "ENV_VAR": "value"
+      }
+    }
+  }
+  // ... more settings ...
+}
+```
+
+**Key difference:** CLI format requires `"type": "stdio"` in each server definition.
+
+## Common MCP Server Examples
+
+### Memory (Knowledge Graph)
+
+```json
+// VS Code format
+"memory": {
+  "command": "D:\\nodejs\\npx.cmd",
+  "args": ["-y", "@modelcontextprotocol/server-memory"]
+}
+
+// CLI format
+"memory": {
+  "type": "stdio",
+  "command": "D:\\nodejs\\npx.cmd",
+  "args": ["-y", "@modelcontextprotocol/server-memory"],
+  "env": {}
+}
+```
+
+### Filesystem
+
+```json
+// VS Code format
+"filesystem": {
+  "command": "d:\\nodejs\\node.exe",
+  "args": [
+    "c:\\Users\\<user>\\AppData\\Roaming\\npm\\node_modules\\@modelcontextprotocol\\server-filesystem\\dist\\index.js",
+    "d:\\path\\to\\project"
+  ]
+}
+
+// CLI format
+"filesystem": {
+  "type": "stdio",
+  "command": "d:\\nodejs\\node.exe",
+  "args": [
+    "c:\\Users\\<user>\\AppData\\Roaming\\npm\\node_modules\\@modelcontextprotocol\\server-filesystem\\dist\\index.js",
+    "d:\\path\\to\\project"
+  ],
+  "env": {}
+}
+```
+
+### Podman/Docker
+
+```json
+// VS Code format
+"podman": {
+  "command": "D:\\nodejs\\npx.cmd",
+  "args": ["-y", "podman-mcp-server@latest"],
+  "env": {
+    "DOCKER_HOST": "npipe:////./pipe/podman-machine-default"
+  }
+}
+```
+
+### Gitea
+
+```json
+// VS Code format
+"gitea-myserver": {
+  "command": "d:\\gitea-mcp\\gitea-mcp.exe",
+  "args": ["run", "-t", "stdio"],
+  "env": {
+    "GITEA_HOST": "https://gitea.example.com",
+    "GITEA_ACCESS_TOKEN": "your-token-here"
+  }
+}
+```
+
+### Redis
+
+```json
+// VS Code format
+"redis": {
+  "command": "D:\\nodejs\\npx.cmd",
+  "args": ["-y", "@modelcontextprotocol/server-redis", "redis://localhost:6379"]
+}
+```
+
+### Bugsink (Error Tracking)
+
+**Important:** Bugsink has a different API than Sentry. Use `bugsink-mcp`, NOT `sentry-selfhosted-mcp`.
+
+**Note:** The `bugsink-mcp` npm package is NOT published. You must clone and build from source:
+
+```bash
+# Clone and build bugsink-mcp
+git clone https://github.com/j-shelfwood/bugsink-mcp.git d:\gitea\bugsink-mcp
+cd d:\gitea\bugsink-mcp
+npm install
+npm run build
+```
+
+```json
+// VS Code format (using locally built version)
+"bugsink": {
+  "command": "d:\\nodejs\\node.exe",
+  "args": ["d:\\gitea\\bugsink-mcp\\dist\\index.js"],
+  "env": {
+    "BUGSINK_URL": "https://bugsink.example.com",
+    "BUGSINK_TOKEN": "your-api-token"
+  }
+}
+
+// CLI format
+"bugsink": {
+  "type": "stdio",
+  "command": "d:\\nodejs\\node.exe",
+  "args": ["d:\\gitea\\bugsink-mcp\\dist\\index.js"],
+  "env": {
+    "BUGSINK_URL": "https://bugsink.example.com",
+    "BUGSINK_TOKEN": "your-api-token"
+  }
+}
+```
+
+- GitHub: <https://github.com/j-shelfwood/bugsink-mcp>
+- Get token from Bugsink UI: Settings > API Tokens
+- **Do NOT use npx** - the package is not on npm
+
+### Sentry (Cloud or Self-hosted)
+
+For actual Sentry instances (not Bugsink), use:
+
+```json
+"sentry": {
+  "command": "D:\\nodejs\\npx.cmd",
+  "args": ["-y", "@sentry/mcp-server"],
+  "env": {
+    "SENTRY_AUTH_TOKEN": "your-sentry-token"
+  }
+}
+```
+
+## Troubleshooting
+
+### Server Not Loading
+
+1. **Check both config files** - Make sure the server is defined in both `~/.claude.json` AND `~/.claude/settings.json`
+
+2. **Verify server order** - Servers load sequentially. Broken/slow servers can block others. Put important servers first.
+
+3. **Check for timeout** - Each server has 30 seconds to connect. Slow npx downloads can cause timeouts.
+
+4. **Fully restart VS Code** - Window reload is not enough. Close all VS Code windows and reopen.
+
+### Verifying Configuration
+
+**For CLI:**
+
+```bash
+claude mcp list
+```
+
+**For VS Code:**
+
+1. Open VS Code
+2. View → Output
+3. Select "Claude" from the dropdown
+4. Look for MCP server connection logs
+
+### Common Errors
+
+| Error                                | Cause                         | Solution                                                                    |
+| ------------------------------------ | ----------------------------- | --------------------------------------------------------------------------- |
+| `Connection timed out after 30000ms` | Server took too long to start | Move server earlier in config, or use pre-installed packages instead of npx |
+| `npm error 404 Not Found`            | Package doesn't exist         | Check package name spelling                                                 |
+| `The system cannot find the path`    | Wrong executable path         | Verify the command path exists                                              |
+| `Connection closed`                  | Server crashed on startup     | Check server logs, verify environment variables                             |
+
+### Disabling Problem Servers
+
+In `~/.claude/settings.json`, add `"disabled": true`:
+
+```json
+"problem-server": {
+  "command": "...",
+  "args": ["..."],
+  "disabled": true
+}
+```
+
+**Note:** The CLI config (`~/.claude.json`) does not support the `disabled` flag. You must remove the server entirely from that file.
+
+## Adding a New MCP Server
+
+1. **Install/clone the MCP server** (if not using npx)
+
+2. **Add to VS Code config** (`~/.claude/settings.json`):
+
+   ```json
+   "new-server": {
+     "command": "path/to/command",
+     "args": ["arg1", "arg2"],
+     "env": { "VAR": "value" }
+   }
+   ```
+
+3. **Add to CLI config** (`~/.claude.json`) - find the `mcpServers` section:
+
+   ```json
+   "new-server": {
+     "type": "stdio",
+     "command": "path/to/command",
+     "args": ["arg1", "arg2"],
+     "env": { "VAR": "value" }
+   }
+   ```
+
+4. **Fully restart VS Code**
+
+5. **Verify with `claude mcp list`**
+
+## Quick Reference: Available MCP Servers
+
+| Server              | Package/Repo                                       | Purpose                     |
+| ------------------- | -------------------------------------------------- | --------------------------- |
+| memory              | `@modelcontextprotocol/server-memory`              | Knowledge graph persistence |
+| filesystem          | `@modelcontextprotocol/server-filesystem`          | File system access          |
+| redis               | `@modelcontextprotocol/server-redis`               | Redis cache inspection      |
+| postgres            | `@modelcontextprotocol/server-postgres`            | PostgreSQL queries          |
+| sequential-thinking | `@modelcontextprotocol/server-sequential-thinking` | Step-by-step reasoning      |
+| podman              | `podman-mcp-server`                                | Container management        |
+| gitea               | `gitea-mcp` (binary)                               | Gitea API access            |
+| bugsink             | `j-shelfwood/bugsink-mcp` (build from source)      | Error tracking for Bugsink  |
+| sentry              | `@sentry/mcp-server`                               | Error tracking for Sentry   |
+| playwright          | `@anthropics/mcp-server-playwright`                | Browser automation          |
+
+## Best Practices
+
+1. **Keep configs in sync** - When you change one file, update the other
+
+2. **Order servers by importance** - Put essential servers (memory, filesystem) first
+
+3. **Disable instead of delete** - Use `"disabled": true` in settings.json to troubleshoot
+
+4. **Use node.exe directly** - For faster startup, install packages globally and use `node.exe` instead of `npx`
+
+5. **Store sensitive data in memory** - Use the memory MCP to store API tokens and config for future sessions
+
+---
+
+## Future: MCP Launchpad
+
+**Project:** <https://github.com/kenneth-liao/mcp-launchpad>
+
+MCP Launchpad is a CLI tool that wraps multiple MCP servers into a single interface. Worth revisiting when:
+
+- [ ] Windows support is stable (currently experimental)
+- [ ] Available as an MCP server itself (currently Bash-based)
+
+**Why it's interesting:**
+
+| Benefit                | Description                                                    |
+| ---------------------- | -------------------------------------------------------------- |
+| Single config file     | No more syncing `~/.claude.json` and `~/.claude/settings.json` |
+| Project-level configs  | Drop `mcp.json` in any project for instant MCP setup           |
+| Context window savings | One MCP server in context instead of 10+, reducing token usage |
+| Persistent daemon      | Keeps server connections alive for faster repeated calls       |
+| Tool search            | Find tools across all servers with `mcpl search`               |
+
+**Current limitations:**
+
+- Experimental Windows support
+- Requires Python 3.13+ and uv
+- Claude calls tools via Bash instead of native MCP integration
+- Different mental model (runtime discovery vs startup loading)
+
+---
+
+## Future: Graphiti (Advanced Knowledge Graph)
+
+**Project:** <https://github.com/getzep/graphiti>
+
+Graphiti provides temporal-aware knowledge graphs - it tracks not just facts, but _when_ they became true/outdated. Much more powerful than simple memory MCP, but requires significant infrastructure.
+
+**Ideal setup:** Run on a Linux server, connect via HTTP from Windows:
+
+```json
+// Windows client config (settings.json)
+"graphiti": {
+  "type": "sse",
+  "url": "http://linux-server:8000/mcp/"
+}
+```
+
+**Linux server setup:**
+
+```bash
+git clone https://github.com/getzep/graphiti.git
+cd graphiti/mcp_server
+docker compose up -d  # Starts FalkorDB + MCP server on port 8000
+```
+
+**Requirements:**
+
+- Docker on Linux server
+- OpenAI API key (for embeddings)
+- Port 8000 open on LAN
+
+**Benefits of remote deployment:**
+
+- Heavy lifting (Neo4j/FalkorDB + embeddings) offloaded to Linux
+- Always-on server, Windows connects/disconnects freely
+- Multiple machines can share the same knowledge graph
+- Avoids Windows Docker/WSL2 complexity
+
+---
+
+\_Last updated: January 2026

CLAUDE.md

@@ -1,5 +1,35 @@
 # Claude Code Project Instructions
 
+## Session Startup Checklist
+
+**IMPORTANT**: At the start of every session, perform these steps:
+
+1. **Check Memory First** - Use `mcp__memory__read_graph` or `mcp__memory__search_nodes` to recall:
+   - Project-specific configurations and credentials
+   - Previous work context and decisions
+   - Infrastructure details (URLs, ports, access patterns)
+   - Known issues and their solutions
+
+2. **Review Recent Git History** - Check `git log --oneline -10` to understand recent changes
+
+3. **Check Container Status** - Use `mcp__podman__container_list` to see what's running
+
+---
+
+## Project Instructions
+
+### Things to Remember
+
+Before writing any code:
+
+1. State how you will verify this change works (test, bash command, browser check, etc.)
+
+2. Write the test or verification step first
+
+3. Then implement the code
+
+4. Run verification and iterate until it passes
+
 ## Communication Style: Ask Before Assuming
 
 **IMPORTANT**: When helping with tasks, **ask clarifying questions before making assumptions**. Do not assume:
@@ -263,22 +293,25 @@ To add a new secret (e.g., `SENTRY_DSN`):
 
 **Shared (used by both environments):**
 
-- `DB_HOST`, `DB_USER`, `DB_PASSWORD` - Database credentials
+- `DB_HOST` - Database host (shared PostgreSQL server)
 - `JWT_SECRET` - Authentication
 - `GOOGLE_MAPS_API_KEY` - Google Maps
 - `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` - Google OAuth
 - `GH_CLIENT_ID`, `GH_CLIENT_SECRET` - GitHub OAuth
+- `SENTRY_AUTH_TOKEN` - Bugsink API token for source map uploads (create at Settings > API Keys in Bugsink)
 
 **Production-specific:**
 
-- `DB_DATABASE_PROD` - Production database name
+- `DB_USER_PROD`, `DB_PASSWORD_PROD` - Production database credentials (`flyer_crawler_prod`)
+- `DB_DATABASE_PROD` - Production database name (`flyer-crawler`)
 - `REDIS_PASSWORD_PROD` - Redis password (uses database 0)
 - `VITE_GOOGLE_GENAI_API_KEY` - Gemini API key for production
 - `SENTRY_DSN`, `VITE_SENTRY_DSN` - Bugsink error tracking DSNs (production projects)
 
 **Test-specific:**
 
-- `DB_DATABASE_TEST` - Test database name
+- `DB_USER_TEST`, `DB_PASSWORD_TEST` - Test database credentials (`flyer_crawler_test`)
+- `DB_DATABASE_TEST` - Test database name (`flyer-crawler-test`)
 - `REDIS_PASSWORD_TEST` - Redis password (uses database 1 for isolation)
 - `VITE_GOOGLE_GENAI_API_KEY_TEST` - Gemini API key for test
 - `SENTRY_DSN_TEST`, `VITE_SENTRY_DSN_TEST` - Bugsink error tracking DSNs (test projects)
@@ -292,6 +325,55 @@ The test environment (`flyer-crawler-test.projectium.com`) uses **both** Gitea C
 - **Redis database 1**: Isolates test job queues from production (which uses database 0)
 - **PM2 process names**: Suffixed with `-test` (e.g., `flyer-crawler-api-test`)
 
+### Database User Setup (Test Environment)
+
+**CRITICAL**: The test database requires specific PostgreSQL permissions to be configured manually. Schema ownership alone is NOT sufficient - explicit privileges must be granted.
+
+**Database Users:**
+
+| User                 | Database             | Purpose    |
+| -------------------- | -------------------- | ---------- |
+| `flyer_crawler_prod` | `flyer-crawler-prod` | Production |
+| `flyer_crawler_test` | `flyer-crawler-test` | Testing    |
+
+**Required Setup Commands** (run as `postgres` superuser):
+
+```bash
+# Connect as postgres superuser
+sudo -u postgres psql
+
+# Create the test database and user (if not exists)
+CREATE DATABASE "flyer-crawler-test";
+CREATE USER flyer_crawler_test WITH PASSWORD 'your-password-here';
+
+# Grant ownership and privileges
+ALTER DATABASE "flyer-crawler-test" OWNER TO flyer_crawler_test;
+\c "flyer-crawler-test"
+ALTER SCHEMA public OWNER TO flyer_crawler_test;
+GRANT CREATE, USAGE ON SCHEMA public TO flyer_crawler_test;
+
+# Create required extension (must be done by superuser)
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+```
+
+**Why These Steps Are Necessary:**
+
+1. **Schema ownership alone is insufficient** - PostgreSQL requires explicit `GRANT CREATE, USAGE` privileges even when the user owns the schema
+2. **uuid-ossp extension** - Required by the application for UUID generation; must be created by a superuser before the app can use it
+3. **Separate users for prod/test** - Prevents accidental cross-environment data access; each environment has its own credentials in Gitea secrets
+
+**Verification:**
+
+```bash
+# Check schema privileges (should show 'UC' for flyer_crawler_test)
+psql -d "flyer-crawler-test" -c "\dn+ public"
+
+# Expected output:
+#  Name  |       Owner        |            Access privileges
+# -------+--------------------+------------------------------------------
+# public | flyer_crawler_test | flyer_crawler_test=UC/flyer_crawler_test
+```
+
 ### Dev Container Environment
 
 The dev container runs its own **local Bugsink instance** - it does NOT connect to the production Bugsink server:

DATABASE.md

@@ -14,6 +14,17 @@ Flyer Crawler uses PostgreSQL with several extensions for full-text search, geog
 
 ---
 
+## Database Users
+
+This project uses **environment-specific database users** to isolate production and test environments:
+
+| User                 | Database             | Purpose    |
+| -------------------- | -------------------- | ---------- |
+| `flyer_crawler_prod` | `flyer-crawler-prod` | Production |
+| `flyer_crawler_test` | `flyer-crawler-test` | Testing    |
+
+---
+
 ## Production Database Setup
 
 ### Step 1: Install PostgreSQL
@@ -34,15 +45,19 @@ sudo -u postgres psql
 Run the following SQL commands (replace `'a_very_strong_password'` with a secure password):
 
 ```sql
--- Create a new role for your application
-CREATE ROLE flyer_crawler_user WITH LOGIN PASSWORD 'a_very_strong_password';
+-- Create the production role
+CREATE ROLE flyer_crawler_prod WITH LOGIN PASSWORD 'a_very_strong_password';
 
 -- Create the production database
-CREATE DATABASE "flyer-crawler-prod" WITH OWNER = flyer_crawler_user;
+CREATE DATABASE "flyer-crawler-prod" WITH OWNER = flyer_crawler_prod;
 
 -- Connect to the new database
 \c "flyer-crawler-prod"
 
+-- Grant schema privileges
+ALTER SCHEMA public OWNER TO flyer_crawler_prod;
+GRANT CREATE, USAGE ON SCHEMA public TO flyer_crawler_prod;
+
 -- Install required extensions (must be done as superuser)
 CREATE EXTENSION IF NOT EXISTS postgis;
 CREATE EXTENSION IF NOT EXISTS pg_trgm;
@@ -57,7 +72,7 @@ CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
 Navigate to your project directory and run:
 
 ```bash
-psql -U flyer_crawler_user -d "flyer-crawler-prod" -f sql/master_schema_rollup.sql
+psql -U flyer_crawler_prod -d "flyer-crawler-prod" -f sql/master_schema_rollup.sql
 ```
 
 This creates all tables, functions, triggers, and seeds essential data (categories, master items).
@@ -67,7 +82,7 @@ This creates all tables, functions, triggers, and seeds essential data (categori
 Set the required environment variables and run the seed script:
 
 ```bash
-export DB_USER=flyer_crawler_user
+export DB_USER=flyer_crawler_prod
 export DB_PASSWORD=your_password
 export DB_NAME="flyer-crawler-prod"
 export DB_HOST=localhost
@@ -88,20 +103,24 @@ sudo -u postgres psql
 ```
 
 ```sql
+-- Create the test role
+CREATE ROLE flyer_crawler_test WITH LOGIN PASSWORD 'a_very_strong_password';
+
 -- Create the test database
-CREATE DATABASE "flyer-crawler-test" WITH OWNER = flyer_crawler_user;
+CREATE DATABASE "flyer-crawler-test" WITH OWNER = flyer_crawler_test;
 
 -- Connect to the test database
 \c "flyer-crawler-test"
 
+-- Grant schema privileges (required for test runner to reset schema)
+ALTER SCHEMA public OWNER TO flyer_crawler_test;
+GRANT CREATE, USAGE ON SCHEMA public TO flyer_crawler_test;
+
 -- Install required extensions
 CREATE EXTENSION IF NOT EXISTS postgis;
 CREATE EXTENSION IF NOT EXISTS pg_trgm;
 CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
 
--- Grant schema ownership (required for test runner to reset schema)
-ALTER SCHEMA public OWNER TO flyer_crawler_user;
-
 -- Exit
 \q
 ```
@@ -110,12 +129,28 @@ ALTER SCHEMA public OWNER TO flyer_crawler_user;
 
 Ensure these secrets are set in your Gitea repository settings:
 
+**Shared:**
+
 | Secret    | Description                           |
-| ------------- | ------------------------------------------ |
+| --------- | ------------------------------------- |
 | `DB_HOST` | Database hostname (e.g., `localhost`) |
 | `DB_PORT` | Database port (e.g., `5432`)          |
-| `DB_USER`     | Database user (e.g., `flyer_crawler_user`) |
-| `DB_PASSWORD` | Database password                          |
+
+**Production-specific:**
+
+| Secret             | Description                                     |
+| ------------------ | ----------------------------------------------- |
+| `DB_USER_PROD`     | Production database user (`flyer_crawler_prod`) |
+| `DB_PASSWORD_PROD` | Production database password                    |
+| `DB_DATABASE_PROD` | Production database name (`flyer-crawler-prod`) |
+
+**Test-specific:**
+
+| Secret             | Description                               |
+| ------------------ | ----------------------------------------- |
+| `DB_USER_TEST`     | Test database user (`flyer_crawler_test`) |
+| `DB_PASSWORD_TEST` | Test database password                    |
+| `DB_DATABASE_TEST` | Test database name (`flyer-crawler-test`) |
 
 ---
 
@@ -135,7 +170,7 @@ This approach is faster than creating/destroying databases and doesn't require s
 ## Connecting to Production Database
 
 ```bash
-psql -h localhost -U flyer_crawler_user -d "flyer-crawler-prod" -W
+psql -h localhost -U flyer_crawler_prod -d "flyer-crawler-prod" -W
 ```
 
 ---
@@ -149,7 +184,7 @@ SELECT PostGIS_Full_Version();
 
 Example output:
 
-```
+```text
 PostgreSQL 14.19 (Ubuntu 14.19-0ubuntu0.22.04.1)
 POSTGIS="3.2.0 c3e3cc0" GEOS="3.10.2-CAPI-1.16.0" PROJ="8.2.1"
 ```
@@ -171,13 +206,13 @@ POSTGIS="3.2.0 c3e3cc0" GEOS="3.10.2-CAPI-1.16.0" PROJ="8.2.1"
 ### Create a Backup
 
 ```bash
-pg_dump -U flyer_crawler_user -d "flyer-crawler-prod" -F c -f backup.dump
+pg_dump -U flyer_crawler_prod -d "flyer-crawler-prod" -F c -f backup.dump
 ```
 
 ### Restore from Backup
 
 ```bash
-pg_restore -U flyer_crawler_user -d "flyer-crawler-prod" -c backup.dump
+pg_restore -U flyer_crawler_prod -d "flyer-crawler-prod" -c backup.dump
 ```
 
 ---

README.md

@@ -62,13 +62,15 @@ See [INSTALL.md](INSTALL.md) for detailed setup instructions.
 This project uses environment variables for configuration (no `.env` files). Key variables:
 
 | Variable                                     | Description                      |
-| ----------------------------------- | -------------------------------- |
-| `DB_HOST`, `DB_USER`, `DB_PASSWORD` | PostgreSQL credentials           |
-| `DB_DATABASE_PROD`                  | Production database name         |
+| -------------------------------------------- | -------------------------------- |
+| `DB_HOST`                                    | PostgreSQL host                  |
+| `DB_USER_PROD`, `DB_PASSWORD_PROD`           | Production database credentials  |
+| `DB_USER_TEST`, `DB_PASSWORD_TEST`           | Test database credentials        |
+| `DB_DATABASE_PROD`, `DB_DATABASE_TEST`       | Database names                   |
 | `JWT_SECRET`                                 | Authentication token signing key |
 | `VITE_GOOGLE_GENAI_API_KEY`                  | Google Gemini API key            |
 | `GOOGLE_MAPS_API_KEY`                        | Google Maps Geocoding API key    |
-| `REDIS_PASSWORD_PROD`               | Redis password                   |
+| `REDIS_PASSWORD_PROD`, `REDIS_PASSWORD_TEST` | Redis passwords                  |
 
 See [INSTALL.md](INSTALL.md) for the complete list.
 

docs/adr/0019-data-backup-and-recovery-strategy.md

@@ -42,9 +42,9 @@ jobs:
     env:
       DB_HOST: ${{ secrets.DB_HOST }}
       DB_PORT: ${{ secrets.DB_PORT }}
-      DB_USER: ${{ secrets.DB_USER }}
-      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-      DB_NAME: ${{ secrets.DB_NAME_PROD }}
+      DB_USER: ${{ secrets.DB_USER_PROD }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD_PROD }}
+      DB_NAME: ${{ secrets.DB_DATABASE_PROD }}
 
     steps:
       - name: Validate Secrets

ecosystem-test.config.cjs

@@ -7,10 +7,53 @@
 //
 // These apps:
 // - Run from /var/www/flyer-crawler-test.projectium.com
-// - Use NODE_ENV='test' (enables file logging in logger.server.ts)
+// - Use NODE_ENV='staging' (enables file logging in logger.server.ts)
 // - Use Redis database 1 (isolated from production which uses database 0)
 // - Have distinct PM2 process names to avoid conflicts with production
 
+// --- Load Environment Variables from .env file ---
+// This allows PM2 to start without requiring the CI/CD pipeline to inject variables.
+// The .env file should be created on the server with the required secrets.
+// NOTE: We implement a simple .env parser since dotenv may not be installed.
+const path = require('path');
+const fs = require('fs');
+
+const envPath = path.join('/var/www/flyer-crawler-test.projectium.com', '.env');
+if (fs.existsSync(envPath)) {
+  console.log('[ecosystem-test.config.cjs] Loading environment from:', envPath);
+  const envContent = fs.readFileSync(envPath, 'utf8');
+  const lines = envContent.split('\n');
+  for (const line of lines) {
+    // Skip comments and empty lines
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+
+    // Parse KEY=value
+    const eqIndex = trimmed.indexOf('=');
+    if (eqIndex > 0) {
+      const key = trimmed.substring(0, eqIndex);
+      let value = trimmed.substring(eqIndex + 1);
+      // Remove quotes if present
+      if (
+        (value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))
+      ) {
+        value = value.slice(1, -1);
+      }
+      // Only set if not already in environment (don't override CI/CD vars)
+      if (!process.env[key]) {
+        process.env[key] = value;
+      }
+    }
+  }
+  console.log('[ecosystem-test.config.cjs] Environment loaded successfully');
+} else {
+  console.warn('[ecosystem-test.config.cjs] No .env file found at:', envPath);
+  console.warn(
+    '[ecosystem-test.config.cjs] Environment variables must be provided by the shell or CI/CD.'
+  );
+}
+
 // --- Environment Variable Validation ---
 // NOTE: We only WARN about missing secrets, not exit.
 // Calling process.exit(1) prevents PM2 from reading the apps array.

notes-to-ai5.txt

@@ -0,0 +1,196 @@
+What is the correct named pipe address for Podman on Windows if it's not using the default docker_engine pipe?
+
+How do I configure the chrome-devtools-mcp server to connect to an existing Chrome instance using the browser_url input?
+
+
+Unused Input: The browser_url input is defined but not used in any server arguments. If you intend to connect chrome-devtools-mcp to an existing Chrome instance, you would typically pass that URL in the arguments instead of launching a new headless instance.
+
+
+
+
+
+Based on your current configuration and project setup (Gitea, Podman, PostgreSQL, Redis), here are several other valuable MCP servers available for VS Code.
+
+Recommended for Your Stack
+Since you are running a PostgreSQL and Redis stack via Podman, these servers would be immediately useful:
+
+PostgreSQL (@modelcontextprotocol/server-postgres)
+
+Purpose: Allows the AI to query your database directly (inspect schemas, run SELECT queries) without needing to shell into the container.
+Config:
+json
+"postgres": {
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-postgres", "postgresql://postgres:postgres@localhost:5432/flyer_crawler_dev"]
+}
+
+
+
+Redis (@modelcontextprotocol/server-redis)
+
+Purpose: Inspect and modify keys in your Redis instance.
+Config:
+json
+"redis": {
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-redis", "redis://localhost:6379"]
+}
+General Utility Servers
+These servers enhance the AI's core capabilities regardless of the specific project:
+
+
+Memory (@modelcontextprotocol/server-memory)
+
+Purpose: Gives the AI a persistent "knowledge graph" to remember context, user preferences, and project details across different chat sessions.
+Config:
+json
+"memory": {
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-memory"]
+}
+
+
+Brave Search (@modelcontextprotocol/server-brave-search)
+
+Purpose: Performs actual web searches (finding current docs, libraries, or solutions) rather than just fetching specific URLs like the fetch server does.
+Config:
+json
+ Show full code block 
+"brave-search": {
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-brave-search"],
+  "env": {
+    "BRAVE_API_KEY": "YOUR_API_KEY_HERE"
+  }
+}
+
+
+Sequential Thinking (@modelcontextprotocol/server-sequential-thinking)
+
+Purpose: A tool that helps the AI break down complex problems into step-by-step thought processes. It is particularly useful for debugging difficult logic or architectural planning.
+Config:
+json
+"sequential-thinking": {
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"]
+}
+
+
+Other Popular Servers
+
+GitHub: (@modelcontextprotocol/server-github) - If you ever need to interact with GitHub.com in addition to Gitea.
+
+Google Drive: (@modelcontextprotocol/server-google-drive) - Access files in Google Drive.
+
+Slack: (@modelcontextprotocol/server-slack) - Read and send Slack messages.
+
+Sentry: (@modelcontextprotocol/server-sentry) - Analyze error reports directly from Sentry.
+
+How to Find More
+The community maintains a comprehensive list of servers in the Awesome MCP Servers repository. You can find servers for almost any major tool (AWS, Azure, Linear, Jira, etc.).
+
+To add any of these, you simply add a new entry to the mcpServers object in your mcp.json file, similar to how you configured podman or fetch.
+
+
+
+
+
+
+Create a new ADR for "Worker Health Checks" to monitor stalled background jobs.
+
+Storybook !  for UI
+
+
+
+
+
+
+
+
+
+
+
+{
+  "mcpServers": {
+    "gitea-projectium": {
+      "command": "d:\\gitea-mcp\\gitea-mcp.exe",
+      "args": ["run", "-t", "stdio"],
+      "env": {
+        "GITEA_HOST": "https://gitea.projectium.com",
+        "GITEA_ACCESS_TOKEN": "b111259253aa3cadcb6a37618de03bf388f6235a"
+      }
+    },
+    "gitea-torbonium": {
+      "command": "d:\\gitea-mcp\\gitea-mcp.exe",
+      "args": ["run", "-t", "stdio"],
+      "env": {
+        "GITEA_HOST": "https://gitea.torbonium.com",
+        "GITEA_ACCESS_TOKEN": "563d01f9edc792b6dd09bf4cbd3a98bce45360a4"
+      }
+    },
+    "gitea-lan": {
+      "command": "d:\\gitea-mcp\\gitea-mcp.exe",
+      "args": ["run", "-t", "stdio"],
+      "env": {
+        "GITEA_HOST": "https://gitea.torbolan.com",
+        "GITEA_ACCESS_TOKEN": "YOUR_LAN_TOKEN_HERE"
+      },
+      "disabled": true
+    },
+    "podman": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "podman-mcp-server@latest"],
+      "env": {
+        "DOCKER_HOST": "npipe:////./pipe/podman-machine-default"
+      }
+    },
+    "filesystem": {
+      "command": "d:\\nodejs\\node.exe",
+      "args": [
+        "c:\\Users\\games3\\AppData\\Roaming\\npm\\node_modules\\@modelcontextprotocol\\server-filesystem\\dist\\index.js",
+        "d:\\gitea\\flyer-crawler.projectium.com\\flyer-crawler.projectium.com"
+      ]
+    },
+    "fetch": {
+      "command": "C:\\Users\\games3\\.local\\bin\\uvx.exe",
+      "args": ["mcp-server-fetch"]
+    },
+    "chrome-devtools": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": [
+        "chrome-devtools-mcp@latest",
+        "--headless",
+        "false",
+        "--isolated",
+        "false",
+        "--channel",
+        "stable"
+      ],
+      "disabled": true
+    },
+    "markitdown": {
+      "command": "C:\\Users\\games3\\.local\\bin\\uvx.exe",
+      "args": ["markitdown-mcp"]
+    },
+    "sequential-thinking": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"]
+    },
+    "memory": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "@modelcontextprotocol/server-memory"]
+    },
+    "postgres": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "@modelcontextprotocol/server-postgres", "postgresql://postgres:postgres@localhost:5432/flyer_crawler_dev"]
+    },
+    "playwright": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "@anthropics/mcp-server-playwright"]
+    },
+    "redis": {
+      "command": "D:\\nodejs\\npx.cmd",
+      "args": ["-y", "@modelcontextprotocol/server-redis", "redis://localhost:6379"]
+    }
+  }
+}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "flyer-crawler",
-  "version": "0.9.107",
+  "version": "0.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "flyer-crawler",
-      "version": "0.9.107",
+      "version": "0.11.0",
       "dependencies": {
         "@bull-board/api": "^6.14.2",
         "@bull-board/express": "^6.14.2",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "flyer-crawler",
   "private": true,
-  "version": "0.9.107",
+  "version": "0.11.0",
   "type": "module",
   "scripts": {
     "dev": "concurrently \"npm:start:dev\" \"vite\"",

sql/fix_permissions.sql

@@ -10,11 +10,16 @@
 -- Usage:
 -- Connect to the database as a superuser (e.g., 'postgres') and run this
 -- entire script.
+--
+-- IMPORTANT: Set the new_owner variable to the appropriate user:
+--   - For production: 'flyer_crawler_prod'
+--   - For test: 'flyer_crawler_test'
 
 DO $$
 DECLARE
     -- Define the new owner for all objects.
-    new_owner TEXT := 'flyer_crawler_user';
+    -- Change this to 'flyer_crawler_test' when running against the test database.
+    new_owner TEXT := 'flyer_crawler_prod';
     
     -- Variables for iterating through object names.
     tbl_name TEXT;
@@ -81,7 +86,7 @@ END $$;
 -- 
 --         -- Construct and execute the ALTER FUNCTION statement using the full signature.
 --         -- This command is now unambiguous and will work for all functions, including overloaded ones.
---         EXECUTE format('ALTER FUNCTION %s OWNER TO flyer_crawler_user;', func_signature);
+--         EXECUTE format('ALTER FUNCTION %s OWNER TO flyer_crawler_prod;', func_signature);
 --     END LOOP;
 -- END $$;
 

src/config/env.ts

@@ -262,8 +262,9 @@ function parseConfig(): EnvConfig {
       '',
     ].join('\n');
 
-    // In test environment, throw instead of exiting to allow test frameworks to catch
-    if (process.env.NODE_ENV === 'test') {
+    // In test/staging environment, throw instead of exiting to allow test frameworks to catch
+    // and to provide better visibility into config errors during staging deployments
+    if (process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'staging') {
       throw new Error(errorMessage);
     }
 
@@ -323,6 +324,19 @@ export const isDevelopment = config.server.nodeEnv === 'development';
  */
 export const isStaging = config.server.nodeEnv === 'staging';
 
+/**
+ * Returns true if running in a test-like environment (test or staging).
+ * Use this for behaviors that should be shared between unit/integration tests
+ * and the staging deployment server, such as:
+ * - Using mock AI services (no GEMINI_API_KEY required)
+ * - Verbose error logging
+ * - Fallback URL handling
+ *
+ * Do NOT use this for security bypasses (auth, rate limiting) - those should
+ * only be active in NODE_ENV=test, not staging.
+ */
+export const isTestLikeEnvironment = isTest || isStaging;
+
 /**
  * Returns true if SMTP is configured (all required fields present).
  */

src/hooks/queries/useActivityLogQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useActivityLogQuery', () => {
       { id: 1, action: 'user_login', timestamp: '2024-01-01T10:00:00Z' },
       { id: 2, action: 'flyer_uploaded', timestamp: '2024-01-01T11:00:00Z' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchActivityLog.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockActivityLog),
+      json: () => Promise.resolve({ success: true, data: mockActivityLog }),
     } as Response);
 
     const { result } = renderHook(() => useActivityLogQuery(), { wrapper });
@@ -46,9 +47,10 @@ describe('useActivityLogQuery', () => {
 
   it('should fetch activity log with custom limit and offset', async () => {
     const mockActivityLog = [{ id: 3, action: 'item_added', timestamp: '2024-01-01T12:00:00Z' }];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchActivityLog.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockActivityLog),
+      json: () => Promise.resolve({ success: true, data: mockActivityLog }),
     } as Response);
 
     const { result } = renderHook(() => useActivityLogQuery(10, 5), { wrapper });
@@ -102,9 +104,10 @@ describe('useActivityLogQuery', () => {
   });
 
   it('should return empty array for no activity log entries', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchActivityLog.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useActivityLogQuery(), { wrapper });

src/hooks/queries/useActivityLogQuery.ts

@@ -33,7 +33,9 @@ export const useActivityLogQuery = (limit: number = 20, offset: number = 0) => {
         throw new Error(error.message || 'Failed to fetch activity log');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     // Activity log changes frequently, keep stale time short
     staleTime: 1000 * 30, // 30 seconds

src/hooks/queries/useApplicationStatsQuery.test.tsx

@@ -35,9 +35,10 @@ describe('useApplicationStatsQuery', () => {
       pendingCorrectionsCount: 10,
       recipeCount: 75,
     };
+    // API returns wrapped response: { success: true, data: {...} }
     mockedApiClient.getApplicationStats.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockStats),
+      json: () => Promise.resolve({ success: true, data: mockStats }),
     } as Response);
 
     const { result } = renderHook(() => useApplicationStatsQuery(), { wrapper });

src/hooks/queries/useApplicationStatsQuery.ts

@@ -31,7 +31,9 @@ export const useApplicationStatsQuery = () => {
         throw new Error(error.message || 'Failed to fetch application stats');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: {...} }, extract the data object
+      return json.data ?? json;
     },
     staleTime: 1000 * 60 * 2, // 2 minutes - stats change moderately, not as frequently as activity log
   });

src/hooks/queries/useAuthProfileQuery.ts

@@ -41,7 +41,9 @@ export const useAuthProfileQuery = (enabled: boolean = true) => {
         throw new Error(error.message || 'Failed to fetch user profile');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: {...} }, extract the data object
+      return json.data ?? json;
     },
     enabled: enabled && hasToken,
     staleTime: 1000 * 60 * 5, // 5 minutes

src/hooks/queries/useBestSalePricesQuery.ts

@@ -31,7 +31,9 @@ export const useBestSalePricesQuery = (enabled: boolean = true) => {
         throw new Error(error.message || 'Failed to fetch best sale prices');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled,
     // Prices update when flyers change, keep fresh for 2 minutes

src/hooks/queries/useBrandsQuery.ts

@@ -27,7 +27,9 @@ export const useBrandsQuery = (enabled: boolean = true) => {
         throw new Error(error.message || 'Failed to fetch brands');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled,
     staleTime: 1000 * 60 * 5, // 5 minutes - brands don't change frequently

src/hooks/queries/useCategoriesQuery.test.tsx

@@ -32,9 +32,10 @@ describe('useCategoriesQuery', () => {
       { category_id: 2, name: 'Bakery' },
       { category_id: 3, name: 'Produce' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchCategories.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockCategories),
+      json: () => Promise.resolve({ success: true, data: mockCategories }),
     } as Response);
 
     const { result } = renderHook(() => useCategoriesQuery(), { wrapper });
@@ -88,9 +89,10 @@ describe('useCategoriesQuery', () => {
   });
 
   it('should return empty array for no categories', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchCategories.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useCategoriesQuery(), { wrapper });

src/hooks/queries/useCategoriesQuery.ts

@@ -26,7 +26,9 @@ export const useCategoriesQuery = () => {
         throw new Error(error.message || 'Failed to fetch categories');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     staleTime: 1000 * 60 * 60, // 1 hour - categories rarely change
   });

src/hooks/queries/useFlyerItemCountQuery.ts

@@ -40,7 +40,9 @@ export const useFlyerItemCountQuery = (flyerIds: number[], enabled: boolean = tr
         throw new Error(error.message || 'Failed to count flyer items');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: {...} }, extract the data object
+      return json.data ?? json;
     },
     enabled: enabled && flyerIds.length > 0,
     // Count doesn't change frequently

src/hooks/queries/useFlyerItemsForFlyersQuery.ts

@@ -37,7 +37,9 @@ export const useFlyerItemsForFlyersQuery = (flyerIds: number[], enabled: boolean
         throw new Error(error.message || 'Failed to fetch flyer items');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled: enabled && flyerIds.length > 0,
     // Flyer items don't change frequently once created

src/hooks/queries/useFlyerItemsQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useFlyerItemsQuery', () => {
       { item_id: 1, name: 'Milk', price: 3.99, flyer_id: 42 },
       { item_id: 2, name: 'Bread', price: 2.49, flyer_id: 42 },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchFlyerItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve({ items: mockFlyerItems }),
+      json: () => Promise.resolve({ success: true, data: mockFlyerItems }),
     } as Response);
 
     const { result } = renderHook(() => useFlyerItemsQuery(42), { wrapper });
@@ -103,9 +104,10 @@ describe('useFlyerItemsQuery', () => {
   // respects the enabled condition. The guard exists as a defensive measure only.
 
   it('should return empty array when API returns no items', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchFlyerItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve({ items: [] }),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useFlyerItemsQuery(42), { wrapper });
@@ -115,16 +117,20 @@ describe('useFlyerItemsQuery', () => {
     expect(result.current.data).toEqual([]);
   });
 
-  it('should handle response without items property', async () => {
+  it('should handle response without data property (fallback)', async () => {
+    // Edge case: API returns unexpected format without data property
+    // The hook falls back to returning the raw json object
+    const legacyItems = [{ item_id: 1, name: 'Legacy Item' }];
     mockedApiClient.fetchFlyerItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve({}),
+      json: () => Promise.resolve(legacyItems),
     } as Response);
 
     const { result } = renderHook(() => useFlyerItemsQuery(42), { wrapper });
 
     await waitFor(() => expect(result.current.isSuccess).toBe(true));
 
-    expect(result.current.data).toEqual([]);
+    // Falls back to raw response when .data is undefined
+    expect(result.current.data).toEqual(legacyItems);
   });
 });

src/hooks/queries/useFlyerItemsQuery.ts

@@ -35,9 +35,9 @@ export const useFlyerItemsQuery = (flyerId: number | undefined) => {
         throw new Error(error.message || 'Failed to fetch flyer items');
       }
 
-      const data = await response.json();
-      // API returns { items: FlyerItem[] }
-      return data.items || [];
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     // Only run the query if we have a valid flyer ID
     enabled: !!flyerId,

src/hooks/queries/useFlyersQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useFlyersQuery', () => {
       { flyer_id: 1, store_name: 'Store A', valid_from: '2024-01-01', valid_to: '2024-01-07' },
       { flyer_id: 2, store_name: 'Store B', valid_from: '2024-01-01', valid_to: '2024-01-07' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchFlyers.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockFlyers),
+      json: () => Promise.resolve({ success: true, data: mockFlyers }),
     } as Response);
 
     const { result } = renderHook(() => useFlyersQuery(), { wrapper });
@@ -46,9 +47,10 @@ describe('useFlyersQuery', () => {
 
   it('should fetch flyers with custom limit and offset', async () => {
     const mockFlyers = [{ flyer_id: 3, store_name: 'Store C' }];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchFlyers.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockFlyers),
+      json: () => Promise.resolve({ success: true, data: mockFlyers }),
     } as Response);
 
     const { result } = renderHook(() => useFlyersQuery(10, 5), { wrapper });
@@ -102,9 +104,10 @@ describe('useFlyersQuery', () => {
   });
 
   it('should return empty array for no flyers', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchFlyers.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useFlyersQuery(), { wrapper });

src/hooks/queries/useFlyersQuery.ts

@@ -32,7 +32,9 @@ export const useFlyersQuery = (limit: number = 20, offset: number = 0) => {
         throw new Error(error.message || 'Failed to fetch flyers');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     // Keep data fresh for 2 minutes since flyers don't change frequently
     staleTime: 1000 * 60 * 2,

src/hooks/queries/useLeaderboardQuery.ts

@@ -29,7 +29,9 @@ export const useLeaderboardQuery = (limit: number = 10, enabled: boolean = true)
         throw new Error(error.message || 'Failed to fetch leaderboard');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled,
     staleTime: 1000 * 60 * 2, // 2 minutes - leaderboard can change moderately

src/hooks/queries/useMasterItemsQuery.test.tsx

@@ -32,9 +32,10 @@ describe('useMasterItemsQuery', () => {
       { master_item_id: 2, name: 'Bread', category: 'Bakery' },
       { master_item_id: 3, name: 'Eggs', category: 'Dairy' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchMasterItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockMasterItems),
+      json: () => Promise.resolve({ success: true, data: mockMasterItems }),
     } as Response);
 
     const { result } = renderHook(() => useMasterItemsQuery(), { wrapper });
@@ -88,9 +89,10 @@ describe('useMasterItemsQuery', () => {
   });
 
   it('should return empty array for no master items', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchMasterItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useMasterItemsQuery(), { wrapper });

src/hooks/queries/useMasterItemsQuery.ts

@@ -31,7 +31,9 @@ export const useMasterItemsQuery = () => {
         throw new Error(error.message || 'Failed to fetch master items');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     // Master items change infrequently, keep data fresh for 10 minutes
     staleTime: 1000 * 60 * 10,

src/hooks/queries/usePriceHistoryQuery.ts

@@ -34,7 +34,9 @@ export const usePriceHistoryQuery = (masterItemIds: number[], enabled: boolean =
         throw new Error(error.message || 'Failed to fetch price history');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled: enabled && masterItemIds.length > 0,
     staleTime: 1000 * 60 * 10, // 10 minutes - historical data doesn't change frequently

src/hooks/queries/useShoppingListsQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useShoppingListsQuery', () => {
       { shopping_list_id: 1, name: 'Weekly Groceries', items: [] },
       { shopping_list_id: 2, name: 'Party Supplies', items: [] },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchShoppingLists.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockShoppingLists),
+      json: () => Promise.resolve({ success: true, data: mockShoppingLists }),
     } as Response);
 
     const { result } = renderHook(() => useShoppingListsQuery(true), { wrapper });
@@ -98,9 +99,10 @@ describe('useShoppingListsQuery', () => {
   });
 
   it('should return empty array for no shopping lists', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchShoppingLists.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useShoppingListsQuery(true), { wrapper });

src/hooks/queries/useShoppingListsQuery.ts

@@ -31,7 +31,9 @@ export const useShoppingListsQuery = (enabled: boolean) => {
         throw new Error(error.message || 'Failed to fetch shopping lists');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled,
     // Keep data fresh for 1 minute since users actively manage shopping lists

src/hooks/queries/useSuggestedCorrectionsQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useSuggestedCorrectionsQuery', () => {
       { correction_id: 1, item_name: 'Milk', suggested_name: 'Whole Milk', status: 'pending' },
       { correction_id: 2, item_name: 'Bread', suggested_name: 'White Bread', status: 'pending' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.getSuggestedCorrections.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockCorrections),
+      json: () => Promise.resolve({ success: true, data: mockCorrections }),
     } as Response);
 
     const { result } = renderHook(() => useSuggestedCorrectionsQuery(), { wrapper });
@@ -87,9 +88,10 @@ describe('useSuggestedCorrectionsQuery', () => {
   });
 
   it('should return empty array for no corrections', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.getSuggestedCorrections.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useSuggestedCorrectionsQuery(), { wrapper });

src/hooks/queries/useSuggestedCorrectionsQuery.ts

@@ -26,7 +26,9 @@ export const useSuggestedCorrectionsQuery = () => {
         throw new Error(error.message || 'Failed to fetch suggested corrections');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     staleTime: 1000 * 60, // 1 minute - corrections change moderately
   });

src/hooks/queries/useUserAddressQuery.ts

@@ -36,7 +36,9 @@ export const useUserAddressQuery = (
         throw new Error(error.message || 'Failed to fetch user address');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: {...} }, extract the data object
+      return json.data ?? json;
     },
     enabled: enabled && !!addressId,
     staleTime: 1000 * 60 * 5, // 5 minutes - address data doesn't change frequently

src/hooks/queries/useUserProfileDataQuery.ts

@@ -48,8 +48,12 @@ export const useUserProfileDataQuery = (enabled: boolean = true) => {
         throw new Error(error.message || 'Failed to fetch user achievements');
       }
 
-      const profile: UserProfile = await profileRes.json();
-      const achievements: (UserAchievement & Achievement)[] = await achievementsRes.json();
+      const profileJson = await profileRes.json();
+      const achievementsJson = await achievementsRes.json();
+      // API returns { success: true, data: {...} }, extract the data
+      const profile: UserProfile = profileJson.data ?? profileJson;
+      const achievements: (UserAchievement & Achievement)[] =
+        achievementsJson.data ?? achievementsJson;
 
       return {
         profile,

src/hooks/queries/useWatchedItemsQuery.test.tsx

@@ -31,9 +31,10 @@ describe('useWatchedItemsQuery', () => {
       { master_item_id: 1, name: 'Milk', category: 'Dairy' },
       { master_item_id: 2, name: 'Bread', category: 'Bakery' },
     ];
+    // API returns wrapped response: { success: true, data: [...] }
     mockedApiClient.fetchWatchedItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve(mockWatchedItems),
+      json: () => Promise.resolve({ success: true, data: mockWatchedItems }),
     } as Response);
 
     const { result } = renderHook(() => useWatchedItemsQuery(true), { wrapper });
@@ -98,9 +99,10 @@ describe('useWatchedItemsQuery', () => {
   });
 
   it('should return empty array for no watched items', async () => {
+    // API returns wrapped response: { success: true, data: [] }
     mockedApiClient.fetchWatchedItems.mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve([]),
+      json: () => Promise.resolve({ success: true, data: [] }),
     } as Response);
 
     const { result } = renderHook(() => useWatchedItemsQuery(true), { wrapper });

src/hooks/queries/useWatchedItemsQuery.ts

@@ -31,7 +31,9 @@ export const useWatchedItemsQuery = (enabled: boolean) => {
         throw new Error(error.message || 'Failed to fetch watched items');
       }
 
-      return response.json();
+      const json = await response.json();
+      // API returns { success: true, data: [...] }, extract the data array
+      return json.data ?? json;
     },
     enabled,
     // Keep data fresh for 1 minute since users actively manage watched items

src/middleware/errorHandler.ts

@@ -161,9 +161,12 @@ export const errorHandler = (err: Error, req: Request, res: Response, next: Next
     `Unhandled API Error (ID: ${errorId})`,
   );
 
-  // Also log to console in test environment for visibility in test runners
-  if (process.env.NODE_ENV === 'test') {
-    console.error(`--- [TEST] UNHANDLED ERROR (ID: ${errorId}) ---`, err);
+  // Also log to console in test/staging environments for visibility in test runners
+  if (process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'staging') {
+    console.error(
+      `--- [${process.env.NODE_ENV?.toUpperCase()}] UNHANDLED ERROR (ID: ${errorId}) ---`,
+      err,
+    );
   }
 
   // In production, send a generic message to avoid leaking implementation details.

src/routes/ai.routes.ts

@@ -239,10 +239,13 @@ router.post(
         'Handling /upload-and-process',
       );
 
-      // Fix: Explicitly clear userProfile if no auth header is present in test env
+      // Fix: Explicitly clear userProfile if no auth header is present in test/staging env
       // This prevents mockAuth from injecting a non-existent user ID for anonymous requests.
       let userProfile = req.user as UserProfile | undefined;
-      if (process.env.NODE_ENV === 'test' && !req.headers['authorization']) {
+      if (
+        (process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'staging') &&
+        !req.headers['authorization']
+      ) {
         userProfile = undefined;
       }
 

src/services/aiService.server.ts

@@ -160,7 +160,11 @@ export class AIService {
     this.logger = logger;
     this.logger.info('---------------- [AIService] Constructor Start ----------------');
 
-    const isTestEnvironment = process.env.NODE_ENV === 'test' || !!process.env.VITEST_POOL_ID;
+    // Use mock AI in test and staging environments (no real API calls, no GEMINI_API_KEY needed)
+    const isTestEnvironment =
+      process.env.NODE_ENV === 'test' ||
+      process.env.NODE_ENV === 'staging' ||
+      !!process.env.VITEST_POOL_ID;
 
     if (aiClient) {
       this.logger.info(

src/services/logger.server.ts

@@ -19,7 +19,8 @@ import path from 'path';
 
 const isProduction = process.env.NODE_ENV === 'production';
 const isTest = process.env.NODE_ENV === 'test';
-const isDevelopment = !isProduction && !isTest;
+const isStaging = process.env.NODE_ENV === 'staging';
+const isDevelopment = !isProduction && !isTest && !isStaging;
 
 // Determine log directory based on environment
 // In production/test, use the application directory's logs folder

src/tests/setup/globalApiMock.ts

@@ -19,21 +19,27 @@ import { vi } from 'vitest';
  *   // ... rest of the test
  * });
  */
+/**
+ * Helper to create a mock API response in the standard format.
+ * API responses are wrapped in { success: true, data: ... } per ADR-028.
+ */
+const mockApiResponse = <T>(data: T): Response =>
+  new Response(JSON.stringify({ success: true, data }));
+
 // Global mock for apiClient - provides defaults for tests using renderWithProviders.
 // Note: Individual test files must also call vi.mock() with their relative path.
 vi.mock('../../services/apiClient', () => ({
   // --- Provider Mocks (with default successful responses) ---
   // These are essential for any test using renderWithProviders, as AppProviders
   // will mount all these data providers.
-  fetchFlyers: vi.fn(() =>
-    Promise.resolve(new Response(JSON.stringify({ flyers: [], hasMore: false }))),
-  ),
-  fetchMasterItems: vi.fn(() => Promise.resolve(new Response(JSON.stringify([])))),
-  fetchWatchedItems: vi.fn(() => Promise.resolve(new Response(JSON.stringify([])))),
-  fetchShoppingLists: vi.fn(() => Promise.resolve(new Response(JSON.stringify([])))),
-  getAuthenticatedUserProfile: vi.fn(() => Promise.resolve(new Response(JSON.stringify(null)))),
-  fetchCategories: vi.fn(() => Promise.resolve(new Response(JSON.stringify([])))), // For CorrectionsPage
-  fetchAllBrands: vi.fn(() => Promise.resolve(new Response(JSON.stringify([])))), // For AdminBrandManager
+  // All responses use the standard API format: { success: true, data: ... }
+  fetchFlyers: vi.fn(() => Promise.resolve(mockApiResponse([]))),
+  fetchMasterItems: vi.fn(() => Promise.resolve(mockApiResponse([]))),
+  fetchWatchedItems: vi.fn(() => Promise.resolve(mockApiResponse([]))),
+  fetchShoppingLists: vi.fn(() => Promise.resolve(mockApiResponse([]))),
+  getAuthenticatedUserProfile: vi.fn(() => Promise.resolve(mockApiResponse(null))),
+  fetchCategories: vi.fn(() => Promise.resolve(mockApiResponse([]))), // For CorrectionsPage
+  fetchAllBrands: vi.fn(() => Promise.resolve(mockApiResponse([]))), // For AdminBrandManager
 
   // --- General Mocks (return empty vi.fn() by default) ---
   // These functions are commonly used and can be implemented in specific tests.

src/utils/serverUtils.ts

@@ -15,9 +15,9 @@ export function getBaseUrl(logger: Logger): string {
   let baseUrl = (process.env.FRONTEND_URL || process.env.BASE_URL || '').trim();
   if (!baseUrl || !baseUrl.startsWith('http')) {
     const port = process.env.PORT || 3000;
-    // In test/development, use http://localhost. In production, this should never be reached.
+    // In test/staging/development, use http://localhost. In production, this should never be reached.
     const fallbackUrl =
-      process.env.NODE_ENV === 'test'
+      process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'staging'
         ? `http://localhost:${port}`
         : `http://example.com:${port}`;
     if (baseUrl) {

vite.config.ts

@@ -2,6 +2,7 @@
 import path from 'path';
 import { defineConfig } from 'vitest/config';
 import react from '@vitejs/plugin-react';
+import { sentryVitePlugin } from '@sentry/vite-plugin';
 
 // Ensure NODE_ENV is set to 'test' for all Vitest runs.
 process.env.NODE_ENV = 'test';
@@ -10,6 +11,13 @@ process.on('unhandledRejection', (reason, promise) => {
   console.error('Unhandled Rejection at:', promise, 'reason:', reason);
 });
 
+/**
+ * Determines if we should enable Sentry source map uploads.
+ * Only enabled during production builds with the required environment variables.
+ */
+const shouldUploadSourceMaps =
+  process.env.VITE_SENTRY_DSN && process.env.SENTRY_AUTH_TOKEN && process.env.NODE_ENV !== 'test';
+
 /**
  * This is the main configuration file for Vite and the Vitest 'unit' test project.
  * When running `vitest`, it is orchestrated by `vitest.workspace.ts`, which
@@ -18,7 +26,40 @@ process.on('unhandledRejection', (reason, promise) => {
 export default defineConfig({
   // Vite-specific configuration for the dev server, build, etc.
   // This is inherited by all Vitest projects.
-  plugins: [react()],
+  build: {
+    // Generate source maps for production builds (hidden = not referenced in built files)
+    // The Sentry plugin will upload them and then delete them
+    sourcemap: shouldUploadSourceMaps ? 'hidden' : false,
+  },
+  plugins: [
+    react(),
+    // Conditionally add Sentry plugin for production builds with source map upload
+    ...(shouldUploadSourceMaps
+      ? [
+          sentryVitePlugin({
+            // URL of the Bugsink instance (Sentry-compatible)
+            // This is read from SENTRY_URL env var or falls back to the DSN's origin
+            url: process.env.SENTRY_URL,
+
+            // Org and project are required by the API but Bugsink ignores them
+            // when using debug ID matching (Bugsink 1.5+)
+            org: 'flyer-crawler',
+            project: 'flyer-crawler-frontend',
+
+            // Auth token from environment variable
+            authToken: process.env.SENTRY_AUTH_TOKEN,
+
+            sourcemaps: {
+              // Delete source maps after upload to prevent public exposure
+              filesToDeleteAfterUpload: ['./dist/**/*.map'],
+            },
+
+            // Disable telemetry to Sentry
+            telemetry: false,
+          }),
+        ]
+      : []),
+  ],
   server: {
     port: 3000,
     host: '0.0.0.0',