SPEC §15.6 W-21 to W-23, §9.12 CP-1 to CP-14, FR-22 (D-174, D-180):
- api/cards.ts: the card snapshot read through E-40 (pulled from 0, then from its
cursor on focus, every 60 s and after every card write; cursor_ahead restarts),
E-44 sent at once; shared because cards, expenses, accounts and settings read it.
- features/cards: W-21 Kortköp (header with artwork, Uppdatera via E-42, filters with
counts, day groups, Preliminär/Insättning/Utländsk valuta, the CP-10 match chip,
the purchase as a side panel from 720 px and a dialog below with every S-23 sheet
action, expiring/expired/fetch-failed/first-fetch/empty states, ?attempt= polling
E-38 every 2 s, ?account= as S-27); W-22 catalogue and connect step (history
7/30/90/180, E-37 with client web, the bank's https page in the same tab);
W-23 the connection (E-41 shorter history, renew, E-43 with erase_handled).
The committed SJ Prio artwork mapped from image key sj_prio_mastercard, the
D-173 drawn card for unknown keys.
- lib/domain/matchCardPurchase (§14.5.8) with its cases; vectors.test.ts runs K1's
match_card_purchase.json against it (moved from NOT_PORTED to PORTED).
- W-5 ?cardPurchase= prefill per CP-9 and the link on save; W-6 card line with
Ta bort koppling; W-3 "Från kortköp" while connected; W-13 "Anslut kort" row.
- Sidebar and bottom bar: Kortköp after Översikt (D-172); icons credit_card,
link_off, visibility_off added to the generated table; /cards in the dev proxy.
- test/cards.ts fixtures and the fake server's card endpoints.
Strings: the §13.3 keys from K2's docs/ux/strings.csv (dictionaries regenerated), plus
K2's cards_foreign_amount (the foreign amount) and settings_cards_expired (W-13 row of an
ended connection); web-only texts as web_cards_ and web_expenses_ keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).
Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.
Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".
Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
K0 ran on the owner's SJ Prio Mastercard on 2026-10-24; the report
docs/spikes/K0-enable-banking.md holds aggregates only. SPEC v0.36 answers
every K0 TODO(spec) of §9.12: D-177 K0's outcome and the owner's
assumptions (partner card, pending->booked, next-day session; verified by
K1's owner steps), D-178 the windowed history fetch (100-row cap, no
continuation key: 30-day windows split at 100 rows), D-179 the transaction
mapping (merchant from remittance_information, booking date else value
date, FEE debits to handle, debtor/CPAN fields never stored), D-180 the
artwork cropped to the card (1313 x 829) and committed for Android and the
web. K plans, prompts/README and HANDOFF follow; K1 to K3 spec text goes
into v0.37.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A member naming the other user's device now gets the same 404 not_found
body as an unknown id, so E-16 no longer reveals whose a device id is.
The admin keeps revoking any device except the current one (AC-3.2, §8.4).
contracts/openapi.yaml drops the 403 on E-16 and states the rule;
web/src/api/schema.d.ts regenerated. The forbidden test becomes a
not_found test, plus one asserting the body equals the unknown-id body
and that nothing was revoked.
Also bumps ctutils 0.4.3 -> 0.4.4 (lockfile only) for RUSTSEC-2026-0385,
published 2026-10-23, which failed cargo audit on main.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
- Root cause of the raw keys (web_accounts_load_failed, the settle missing state) on main:
Vitest 5's file-system module cache (on by default) skips only modules whose source
contains the literal `import.meta.glob(`. catalog.ts wrote `import.meta.glob<…>(`, so
its transform was cached by its own content and kept the glob result from before a
feature added its i18n/*.json; the main checkout's node_modules/.vitest-cache served
that stale catalog until a config change invalidated it. Fresh worktrees passed.
- catalog.ts: glob without a type argument (typed by annotation), with the reason.
- catalog.test.ts: the loaded feature catalogs must equal the i18n files on disk.
- A string two features render moves to the shared catalog: web_accounts_load_failed
(accounts/PageStates, also rendered by Home) is now web_ledger_load_failed in
src/i18n/web-strings.csv; sv.json/en.json regenerated.
- vectors.test.ts: suggest_category is PORTED and runs against features/expenses/suggest.
- fakeServer: bodies by Content-Type (JSON parsed, text/* as text, else raw bytes);
ProfilePage's picture test asserts the uploaded bytes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
- domain/: TypeScript port of resolveRange and spendSeries (contract vectors 13 + 13),
AnalyticsRules (averages, moving average, caption, filter rules, drill-down URL),
S-11/S-12 model from the sync snapshot, W-11 mapping of the E-34/E-35 responses.
- W-9 /app/analytics: period menu with custom range dialog, interval, measure, group-by;
total card; Recharts stacked bars (4/2 corners, 2 px segment gaps) with bucket links
as keyboard stops, legend, table view; category and account breakdowns.
- W-10 /app/analytics/:groupKind/:groupId (category, account, bucket): own period and
interval in the query string, header card, line chart with range average, 3-bucket
moving average and caption, expense rows.
- W-11 /app/insights: household and per-category trends, two-month forecast per account
with its recurring and average parts; online only, loading/error/empty states.
- Strings in features/analytics/i18n; render tests per page state, domain and chart tests.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
W-5 expense editor (S-7): amount, description, category quick row and
"Alla" grid with the §9.11 suggestion for a new expense (CS-1 to CS-7),
the four fixed option rows (D-102), split modes default, ratio, exact and
full with live shares, notes, inline §9.6 validation, one POST /sync per
save, delete with confirmation, the discard dialog on Cancel, Esc and
in-app navigation (D-080), rejection and network failures shown on the
page with the form kept (§15.5). Defaults per AC-8.6 with this browser's
last account and category; ?account= preselects the opener's account.
W-6 expense detail (S-8): hero, facts, shares and mode, recurring
template badge, the AC-12.4 timeline, deleted and missing states.
W-12 search with filters in the URL query, count and sum, rows a hundred
at a time, and the CSV export (UTF-8 BOM, semicolons, CRLF, decimal
comma, ISO dates, header in the page language), built in the browser.
The §9.11 port passes contracts/test-vectors/suggest_category.json (65
cases); the keyword table is a Vite raw import of
contracts/category-keywords.csv, which needs ../contracts in
server.fs.allow (vite.config.ts).
Shared editor fields of design-spec §3.7 in web/src/components/editor/
for W5's template editor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
- W-13: household card (roles, partner missing), rows with category and recurring summaries, Invites for the
admin only, language and theme (W0's card), log out that forgets the token only (§15.2).
- W-14: picture upload (E-9, raw bytes, JPEG/PNG/WebP up to 5 MiB) and remove (E-10), name validation and save
(E-8); the S-2 step once per browser after a partner login (AC-2.10).
- W-15: list in sort_order with drag and keyboard reorder (arrow keys on the handle, move up/down) saved through
E-24 sort_order with restore on failure; archived section; editor with reset name, 33 icons, 14 colours,
archive/unarchive, delete or the reason from the snapshot (AC-7.6).
- W-16: list (account, payer, schedule, next date, paused badge); editor with D-072/AC-9.8 defaults, schedule,
pause/resume hints, create (E-28), patch of changed fields only (E-29), delete (E-30), discard dialog (D-080).
Uses minimal local fields until W2's shared editor fields land.
- W-17: devices (E-15) with this browser marked, revoke with confirmation (E-16), never the current device.
- W-18: create partner or device invites (E-12), code in groups of 4, link, expiry, copy to clipboard, pending
invites (E-13) with cancel (E-14); `/settings/invites` aliases W0's `/settings/invite`.
- W-19: web build version, server origin, server version from /health or the X-Kvitt-Server-Version header.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
W-7 (/app/settle, mirrors S-9): global, per account (?account=<id>) and
editing (?settlement=<id>). Defaults per AC-11.3/11.4/11.6, proposal from
proposeAllocation over all non-deleted accounts with nets excluding the
edited payment, rows follow the proposal until one is edited, "Föreslå
igen", swap, over-settle warnings and confirm dialog (AC-11.5), remaining
indicator, add account, untouched info line (D-093), date and note,
§14.5.3 errors live, one POST /sync mutation, §14.4.6 rejections shown
with a re-pull, discard dialog on leaving with changes (D-080).
W-8 (/app/settlements/:id, mirrors S-10): hero, date, note, allocations,
audit timeline (AC-12.4), deleted and missing states, edit link and soft
delete with confirmation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
Home (mirrors S-4, S-3 while the partner has not joined): global balance hero
with the seesaw and §9.3 wording, Settle up, active accounts with balance and
this month's count, collapsed "Arkiverade (n)" kept for the session, empty,
loading and error states, New expense when an active account exists.
Account detail (S-5): header with default split, split bar, archived badge and
balance; expenses and settlements interleaved by date, grouped by month with
household spend (settlement rows carry the allocation, AC-11.7); overflow menu
with Edit, Archive/Unarchive (undo snackbar, D-071) and Delete only when
allowed (AC-6.5); not-found, loading and error states.
Account editor (S-6): name (1-60 code points, name_taken on the field), two
percent fields that always sum to 100 with two decimals, slider and presets,
the "Av 100,00 kr" preview; discard dialog with a title and no body (D-080)
on every navigation away; E-18/E-19 apply the returned row.
The account preset for W-5 and W-7 is the query parameter `account`
(proposed D-144). Tests over a shared snapshot fixture and the fake server.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
v0.30: D-140 S-22 "Check for update" calls UpdateRepository.checkNow(), which always asks
GET /apk/latest and restarts the 6-hour window (AC-16.2, AC-16.6, S-22, §14.2.4).
v0.31: D-141 InsightsRepository UI contract (§14.2.4); D-142 Insights placement and loading
on S-11; D-143 display rules; design-spec S-11 "Insights" and §3.10; strings.csv 588 rows
(16 analytics_insights_* keys), web dictionaries regenerated; §11.2 W0 and W6 landed.
HANDOFF: state at 1c9856b, Pi image deploy step, numbering (D-144..D-155 reserved, next v0.32).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
web/ is the browser client's scaffold: Vite 8, React 19, TypeScript 5.9 strict, React Router 7 (basename /app, every
fixed route with a lazy placeholder page), TanStack Query 5 (refetch on focus and every 60 s), openapi-typescript
types generated from contracts/openapi.yaml with openapi-fetch. Reads go through GET /sync (no REST reads exist for
the ledger, SPEC §7): useLedger() pulls from cursor 0 and then incrementally, restarting on a new epoch or
cursor_ahead. Login pairs the browser as "Web · <browser>" with an invite code (E-3); every call sends the SPEC
§14.3.1 headers, a 401 signs out. kvitt-domain's split, balances, allocation and settlement rules are ported to
web/src/lib and pass every case of contracts/test-vectors. Design tokens from design-spec §2 in tokens.css
(light-dark()), Material Symbols Rounded (Apache-2.0) as generated inline SVG, sv/en catalogs generated from
docs/ux/strings.csv plus web-strings.csv. Gate: cd web && npm run check.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
jacobh2