2026-05-28 - 2026-08-28
Overview
137 Pull requests merged by 4 users
Merged
#246 fix(test): de-flake authProvider.test.ts OOBE test-connection (GRO-2745) [uat → main]
Merged
#245 fix(test): de-flake authProvider.test.ts OOBE test-connection (GRO-2745)
Merged
#244 fix(test): de-flake authProvider.test.ts OOBE test-connection (GRO-2745)
Merged
#243 fix(db): GRO-2722 schema-safe reset (TRUNCATE, no DROP) [uat→main]
Merged
#241 dev → uat: GRO-2722 schema-safe reset (TRUNCATE, no DROP)
Merged
#240 fix(db): GRO-2722 schema-safe reset — TRUNCATE, no DROP
Merged
#235 feat(api): promote uat → main — /api/readyz DB health check (GRO-2687)
Merged
#239 promote(api): dev → uat — /api/readyz auth bypass fix + /health/ready revert (GRO-2687)
Merged
#238 fix(auth): add /api/readyz to auth bypass list (GRO-2692)
Merged
#237 fix(api): add /api/readyz to authMiddleware bypass (GRO-2687 UAT fix)
Merged
#236 revert(api): remove /health/ready — superseded by /api/readyz (GRO-2689)
Merged
#232 promote: dev → uat (GRO-2687 /api/readyz DB health check)
Merged
#233 feat(api): add DB-touching /health/ready readiness probe (GRO-2678)
Merged
#231 feat(api): add DB-touching /api/readyz so schema loss cannot hide behind /health (GRO-2678)
Merged
#230 fix(db): GRO-2672 swap drizzle-orm migrate() for drizzle-kit migrate in reset.ts (uat→main)
Merged
#229 fix(GRO-2672): use drizzle-kit migrate in reset.ts (dev→uat)
Merged
#228 fix(GRO-2672): use drizzle-kit migrate in reset.ts to bypass HWM bug
Merged
#226 feat: GRO-2652 boot ECONNRESET resilience + CORS enforcement + OOBE endpoint (uat→main)
Merged
#223 fix(GRO-2652): promote boot ECONNRESET resilience to UAT (dev→uat)
Merged
#225 fix(GRO-2652): reset authInitPromise on failure so retry loop actually retries
Merged
#224 fix(GRO-2652): restore ci.yml from double-base64 corruption + UAT_PLAYBOOK §4.20 clients-from-auth
Merged
#222 fix(GRO-2652): boot ECONNRESET resilience — retry-with-backoff in initAuth, server-first startup
Merged
#221 uat→main (PROD): GRO-2586 CORS origin allowlist enforcement (frozen @2d4edb6)
Merged
#220 promote(GRO-2586): dev → uat — CORS origin allowlist enforcement
Merged
#219 fix(GRO-2586): enforce trusted-origins allowlist on Better Auth CORS responses
Merged
#218 uat→main (PROD): GRO-2425 comma-split CORS_ORIGIN (frozen @63d7aaa)
Merged
#217 chore: promote dev → uat (GRO-2425 comma-split CORS_ORIGIN)
Merged
#216 feat(GRO-2425): split CORS_ORIGIN on commas for multiple trusted auth origins
Merged
#215 docs: add AGENTS.md and CONTRIBUTING.md (GRO-2381)
Merged
#214 Promote uat → main (PROD): GRO-2359 OOBE portal-creation routing (api)
Merged
#213 Promote dev → uat: GRO-2359 clients-from-auth endpoint
Merged
#212 feat(GRO-2359): add POST /api/portal/clients-from-auth for OOBE
Merged
#211 uat→main (PROD): GRO-2342 portal waitlist service {id, name} (frozen @47e2021 + cherry-pick c737bfe)
Merged
#209 Promote dev → uat: GRO-2342 portal waitlist service {id, name}
Merged
#208 fix(GRO-2342): portal waitlist card populates service {id, name}
Merged
#207 Promote uat → main (PROD): GRO-2319 portal waitlist surfacing + seed
Merged
#206 uat→main (PROD): GRO-2311 seed portal StatusBadge appointments (frozen @df5e768)
Merged
#205 feat(GRO-2319): dev→uat — portal waitlist surfacing + seed (api)
Merged
#203 uat→main (PROD): GRO-2172 pet extended-field schema fix (frozen @c4385617)
Merged
#204 feat(GRO-2319): surface active waitlist entries on portal appointments + seed
Merged
#202 dev → uat: GRO-2311 seed portal StatusBadge appointments (#201)
Merged
#201 feat(seed): seed upcoming appointments across statuses for UAT portal customer (GRO-2311)
Merged
#200 dev → uat: GRO-2172 extended pet fields
Merged
#199 GRO-2172: add missing extended pet fields to create/update schemas
Merged
#160 fix(GRO-2139): serialize the entire reset→migrate→seed chain under the seed advisory lock
Merged
#198 uat → main: GRO-2299 redact googleMapsApiKey from PATCH /api/admin/settings
Merged
#197 uat→main (PROD): GRO-2294 Route Optimization security hardening (frozen @2566fb8)
Merged
#196 dev → uat: GRO-2299 redact googleMapsApiKey from PATCH /api/admin/settings
Merged
#195 fix(GRO-2299): redact googleMapsApiKey from PATCH /api/admin/settings response
Merged
#194 Promote GRO-2294 to UAT: Route Optimization security hardening
Merged
#193 GRO-2294: Route Optimization security hardening (geocode-batch limit cap + redact settings secret)
Merged
#192 uat→main (PROD): GRO-2157 nav export + GRO-2225/2235 (frozen @4868f18)
Merged
#191 uat→main (PROD): GRO-2234 portal session fix + validated batch
Merged
#188 Promote dev→uat: GRO-2225 + GRO-2235 + GRO-2157 (atomic)
Merged
#190 feat(GRO-2157): navigation export endpoints (Phase 2.3)
Merged
#189 fix(GRO-2235): return 409 on duplicate portal waitlist submit
Merged
#186 promote(uat→main FROZEN @6120b96): + GRO-2156 route buffer/reorder (supersedes #185)
Merged
#187 feat(GRO-2225): UAT seed route cohort + receptionist credential
Merged
#182 Promote dev → uat: GRO-2155/2156/2203/2211/2163 + GRO-2234 (cumulative batch)
Merged
#183 fix(GRO-2234): bounded sliding expiration for SSO portal sessions
Merged
#180 feat(GRO-2156): travel buffer + reorder endpoint (Phase 2.2)
Merged
#178 dev → uat: GRO-2203 portal pet PATCH malformed-petId 500→404
Merged
#179 fix(portal): validate waitlist preferredTime/preferredDate, return 400 on bad input (GRO-2211)
Merged
#177 fix(portal): GRO-2203 validate petId as UUID before PATCH lookup (500→404)
Merged
#176 dev → uat: GRO-2155 route optimization endpoints (carries GRO-2163)
Merged
#175 feat(GRO-2155): route CRUD + optimization endpoint (Phase 2.1)
Merged
#161 fix(db): wait for/retry DB DNS resolution before drizzle-kit migrate (GRO-2163)
Merged
#174 uat → main: portal pet PATCH + photoKey S3 key-hijack fix (GRO-2187)
Merged
#173 dev → uat: portal photoKey S3 key-hijack fix (GRO-2187/GRO-2198)
Merged
#172 fix(portal): drop writable photoKey from PATCH /portal/pets — S3 key-hijack (GRO-2187/GRO-2198)
Merged
#171 dev → uat: GRO-2154 geocoding endpoints (Phase 1.3)
Merged
#170 feat(GRO-2154): geocoding endpoints + auto-geocode on client mutations
Merged
#169 fix(ci): GRO-2197 api lint/typecheck/test run root scripts (de-false-green)
Merged
#168 dev → uat: GRO-2153 abstracted geocoding service
Merged
#166 dev → uat: GRO-2187 portal pet PATCH + GET enrichment (carries GRO-2152)
Merged
#167 feat(GRO-2153): abstracted geocoding service (Nominatim + Google)
Merged
#165 fix(portal): implement PATCH /portal/pets/:petId + enrich GET (GRO-2187, fixes GRO-1480 §5.23)
Merged
#164 feat(GRO-2152): route optimization schema migration
Merged
#157 promote(uat→main): GRO-2123 seed advisory lock + GRO-2100 uat-groomer linkage ordering
Merged
#158 chore: delete stale apps/api/src/db/seed.ts duplicate (GRO-2129)
Merged
#156 dev → uat: GRO-2123 seed advisory lock
Merged
#155 fix(GRO-2123): serialize seed.ts with Postgres advisory lock
Merged
#154 chore(uat): GRO-2100 promote uat-groomer seed-linkage ordering fix to uat
Merged
#153 fix(seed): GRO-2100 run uat-groomer linkage AFTER services seed (regression in #151)
Merged
#152 Promote dev→uat: GRO-2100 uat-groomer ↔ UAT Pup Alpha linkage
Merged
#151 fix(seed): GRO-2100 deterministic uat-groomer ↔ UAT Pup Alpha linkage
Merged
#150 promote(uat→main): owner-bypass audit fix (GRO-2062) + services seed-idempotency fix (GRO-2064)
Merged
#149 Promote dev→uat: GRO-2033 services_pkey seed fix (fc6c6ef7)
Merged
#148 fix(db): make services seed idempotent across resets (GRO-2064, GRO-2033 close-out)
Merged
#147 promote(dev→uat): owner-bypass read audit row in GET /pets/:id/profile-summary (GRO-2063)
Merged
#146 security(audit): log owner-bypass reads in GET /pets/:id/profile-summary (GRO-2062)
Merged
#145 promote(main): GRO-2033 prod migration fix + GRO-2013/2014 + rbac auto-provision (uat→main)
Merged
#144 Promote dev→uat: rbac Better-Auth auto-provision (GRO-2052)
Merged
#143 fix(rbac): port Better-Auth user auto-provision into legacy ./src tree (GRO-2052)
Merged
#142 promote(uat): GRO-2013 owner-bypass + GRO-2033 idempotent migrations (dev→uat)
Merged
#139 fix(pets): port owner-bypass into deployed tree (GRO-2013)
Merged
#140 fix(db): re-register 0034/0036 schema changes via idempotent 0039/0040 (GRO-2033)
Merged
#135 fix(pets): customer can view own pet profile summary (GRO-2013)
Merged
#138 promote(uat): GRO-2014 profile-summary error-handling fix (dev→uat)
Merged
#137 fix(api): GRO-2014 — profile-summary 500 → 404/401/JSON-500
Merged
#136 promote: uat → main — pnpm-offline Docker hardening + accumulated UAT fixes (GRO-1985)
Merged
#134 Promote dev → uat: UAT seed-password source-of-truth playbook (GRO-2000)
Merged
#132 docs(UAT_PLAYBOOK): document canonical source-of-truth for UAT seed passwords (GRO-2000)
Merged
#133 promote(docker): bake pnpm via npm to remove Corepack runtime downloads (GRO-1981)
Merged
#129 fix(docker): bake pnpm via npm to remove Corepack runtime downloads (GRO-1981)
Merged
#131 promote(db): register extra_large via migration 0038 to UAT (GRO-2004)
Merged
#130 fix(db): register extra_large via migration 0038 (GRO-1999)
Merged
#127 docs(UAT_PLAYBOOK): add TC-API-3.28 for pet_size_category enum (GRO-1999)
Merged
#126 Promote dev→uat: GRO-1982 pet_size_category extra_large enum migration
Merged
#125 fix(docker): install pnpm via npm instead of corepack shim (GRO-1983)
Merged
#124 fix(db): GRO-1979 add 0037 — register extra_large in pet_size_category enum
Merged
#123 Promote dev→uat: restore deterministic TestCooper/TestRocky alerts (GRO-1962)
Merged
#122 fix(seed): restore deterministic alerts for TestCooper/TestRocky (GRO-1962)
Merged
#121 fix(seed): update credential password on re-run instead of skipping (GRO-1977)
Merged
#120 fix(seed): update credential password on existing accounts — not skip (GRO-1977)
Merged
#119 Promote dev→uat: add missing coat_type enum values (GRO-1971)
Merged
#118 fix: add missing coat_type enum values (GRO-1971)
Merged
#117 Promote dev→uat: expand UAT seed to 30+ pets with medicalAlerts 25-35% distribution (GRO-1962)
Merged
#115 fix(seed): remove stale uc.petName closure ref, correct medicalAlerts distribution to 30%
Merged
#114 GRO-1961: populate extended fields on UAT Pup Alpha/Beta on re-runs
Merged
#113 ci: promote dev→uat (GRO-1939 smoke + GRO-1953/1955/1949 seed/db)
Merged
#111 ci: add blackhole smoke for migrate image (GRO-1939)
Merged
#112 GRO-1955: hotfix seed.ts broken uc reference in random pet batch
Merged
#110 fix(db): add missing 'short' value to coat_type enum (GRO-1953)
Merged
#109 GRO-1949: add behavioral and skin medicalAlertPool types, deterministic seeding for TestCooper/TestRocky
Merged
#108 Promote: dev → uat (GRO-1945 root src/pets visit-count hotfix)
Merged
#106 GRO-1921: Fix UAT reset CronJob to seed full UAT profile with extended pet fields
Merged
#107 fix(api): repair root src/routes/pets.ts visit-count query (GRO-1945)
Merged
#104 fix(seed): add uat-customer client record for SSO bridge UAT (GRO-1935)
Merged
#101 fix(docker): bake pnpm into image to avoid runtime corepack downloads (GRO-1909)
Merged
#103 Promote: dev → uat (GRO-1913 extended pet profile seed + hotfixes)
Merged
#102 fix(test): mock db to handle sql count(*) queries (GRO-1917)
Merged
#100 fix(seed): use typeof on enum.enumValues for db build
Merged
#99 feat(seed): populate extended pet profile fields for UAT verification
Merged
#97 fix(gro-1889): bake pnpm into reset stage to avoid runtime DNS
Merged
#96 Promote dev → uat: SSO bridge endpoint + role scope (GRO-1866)
Merged
#93 fix(gro-1866): add session-from-auth portal endpoint + role scope
2 Issues closed from 1 user
Closed
#162 Bug: portal pet save 404s — implement PATCH /api/portal/pets/:petId + enrich GET (GRO-1480/GRO-1470)
Closed
#163 Bug: portal pet save 404s — implement PATCH /api/portal/pets/:petId + enrich GET (GRO-1480/GRO-1470)
2 Issues created by 0 users
Opened
#162 Bug: portal pet save 404s — implement PATCH /api/portal/pets/:petId + enrich GET (GRO-1480/GRO-1470)
Opened
#163 Bug: portal pet save 404s — implement PATCH /api/portal/pets/:petId + enrich GET (GRO-1480/GRO-1470)