removed unneccesary files

2026-03-21 17:30:11 -05:00
parent 952684fc25
commit 9c7f4d5139
93 changed files with 107 additions and 7734 deletions
--- a/docs/api-phase1-move-log.md
+++ b/docs/api-phase1-move-log.md
@@ -1,61 +0,0 @@
-# API Phase 1 Move Log
-
-Date: 2026-03-15  
-Scope: Move low-risk endpoints out of `api/src/server.ts` into dedicated route modules.
-
-## Route Registration Changes
- Registered session routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:1518)
- Registered user routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:1523)
- Registered health routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:1524)
-
-## Endpoint Movements
-
-1. `GET /health`
- Moved to [health.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/health.ts:11)
- References:
-  - [HealthPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/HealthPage.tsx:10)
-  - [security-misconfiguration.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/security-misconfiguration.test.ts:29)
-
-2. `GET /health/db` (non-production only)
- Moved to [health.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/health.ts:14)
- References:
-  - [HealthPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/HealthPage.tsx:15)
-
-3. `GET /auth/session`
- Moved to [session.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/session.ts:40)
- References:
-  - [useAuthSession.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useAuthSession.ts:23)
-  - [auth.routes.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/auth.routes.test.ts:120)
-
-4. `POST /app/update-notice/ack`
- Moved to [session.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/session.ts:77)
- References:
-  - [App.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/App.tsx:33)
-
-5. `PATCH /me`
- Moved to [user.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/user.ts:50)
- References:
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:394)
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:115)
-
-6. `PATCH /me/password`
- Moved to [user.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/user.ts:71)
- References:
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:148)
-  - [identification-auth-failures.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/identification-auth-failures.test.ts:57)
-
-7. `PATCH /me/income-frequency`
- Moved to [user.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/user.ts:112)
- References:
-  - Currently no frontend direct calls found by static search.
-
-8. `PATCH /user/config`
- Moved to [user.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/user.ts:135)
- References:
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:408)
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:171)
-
-## Notes
- `server.ts` endpoint blocks for the above routes were removed to prevent duplicate registration.
- Existing path contracts were preserved (same method + path).
- `openPaths` and auth/CSRF hook behavior remain unchanged.
--- a/docs/api-phase2-move-log.md
+++ b/docs/api-phase2-move-log.md
@@ -1,75 +0,0 @@
-# API Phase 2 Move Log
-
-Date: 2026-03-16  
-Scope: Move `auth` + `account` endpoints out of `api/src/server.ts` into a dedicated route module.
-
-## Route Registration Changes
- Registered auth/account routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:902)
- New route module: [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:111)
-
-## Endpoint Movements
-
-1. `POST /auth/register`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:115)
- References:
-  - [RegisterPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/RegisterPage.tsx:74)
-  - [auth.routes.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/auth.routes.test.ts:54)
-
-2. `POST /auth/login`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:169)
- References:
-  - [LoginPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/LoginPage.tsx:55)
-  - [identification-auth-failures.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/identification-auth-failures.test.ts:49)
-
-3. `POST /auth/logout`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:266)
- References:
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:215)
-  - [useSessionTimeout.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useSessionTimeout.ts:53)
-
-4. `POST /auth/verify`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:278)
- References:
-  - [VerifyPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/VerifyPage.tsx:43)
-  - [insecure-design.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/insecure-design.test.ts:93)
-
-5. `POST /auth/verify/resend`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:336)
- References:
-  - [VerifyPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/VerifyPage.tsx:65)
-  - [insecure-design.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/insecure-design.test.ts:40)
-
-6. `POST /auth/forgot-password/request`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:391)
- References:
-  - [auth.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/auth.ts:23)
-  - [forgot-password.security.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/forgot-password.security.test.ts:45)
-
-7. `POST /auth/forgot-password/confirm`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:471)
- References:
-  - [auth.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/auth.ts:31)
-  - [forgot-password.security.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/forgot-password.security.test.ts:110)
-
-8. `POST /account/delete-request`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:537)
- References:
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:251)
-  - [insecure-design.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/insecure-design.test.ts:67)
-
-9. `POST /account/confirm-delete`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:596)
- References:
-  - [AccountSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/AccountSettings.tsx:270)
-  - [access-control.account-delete.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/access-control.account-delete.test.ts:60)
-
-10. `POST /auth/refresh`
- Moved to [auth-account.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/auth-account.ts:677)
- References:
-  - [useSessionTimeout.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useSessionTimeout.ts:26)
-  - [cryptographic-failures.runtime.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/cryptographic-failures.runtime.test.ts:71)
-
-## Notes
- `server.ts` auth/account endpoint blocks were removed to prevent duplicate registration.
- Existing path contracts were preserved (same method + path + response shapes).
- Existing auth helpers (`issueEmailToken`, cooldown checks, security logging, lockout tracking) are still sourced from `server.ts` and injected into the route module.
--- a/docs/api-phase3-move-log.md
+++ b/docs/api-phase3-move-log.md
@@ -1,65 +0,0 @@
-# API Phase 3 Move Log
-
-Date: 2026-03-16  
-Scope: Move `variable-categories` endpoints out of `api/src/server.ts` into a dedicated route module.
-
-## Route Registration Changes
- Added variable-categories route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:18)
- Registered variable-categories routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:934)
- New canonical route module: [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:125)
- Removed inline variable-categories route block from `server.ts` to avoid duplicate endpoint registration.
-
-## Endpoint Movements
-
-1. `POST /variable-categories`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:129)
- References:
-  - [categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/categories.ts:12)
-  - [variable-categories.guard.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/variable-categories.guard.test.ts:38)
-
-2. `PATCH /variable-categories/:id`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:165)
- References:
-  - [categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/categories.ts:13)
-  - [variable-categories.guard.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/variable-categories.guard.test.ts:49)
-
-3. `DELETE /variable-categories/:id`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:202)
- References:
-  - [categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/categories.ts:14)
-  - [CategoriesSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/CategoriesSettings.tsx:360)
-
-4. `POST /variable-categories/rebalance`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:219)
- References:
-  - [categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/categories.ts:15)
-  - [CategoriesSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/CategoriesSettings.tsx:367)
-
-5. `GET /variable-categories/manual-rebalance`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:266)
- References:
-  - [rebalance.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/rebalance.ts:24)
-  - [variable-categories.manual-rebalance.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/variable-categories.manual-rebalance.test.ts:54)
-
-6. `POST /variable-categories/manual-rebalance`
- Moved to [variable-categories.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/variable-categories.ts:283)
- References:
-  - [rebalance.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/rebalance.ts:25)
-  - [RebalancePage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/RebalancePage.tsx:148)
-  - [variable-categories.manual-rebalance.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/variable-categories.manual-rebalance.test.ts:63)
-
-## Helper Ownership in Phase 3
- Kept variable-category-specific helpers local to the route module:
-  - `assertPercentTotal`
-  - `getLatestBudgetSession`
-  - `ensureBudgetSession`
-  - `ensureBudgetSessionAvailableSynced`
- Reused shared server helper by injection:
-  - `computeDepositShares` injected from `server.ts` registration.
- Reused shared mutation throttling by injection:
-  - `mutationRateLimit` injected from `server.ts` registration.
-
-## Follow-ups To Revisit
-1. Consolidate budget-session sync helpers into a shared service (`api/src/services/budget-session.ts`) once Phase 4 starts.
-2. Standardize response error envelopes for variable-category routes (`message` vs `ok/code/message`) to reduce client branching.
-3. Recheck `variable-categories.manual-rebalance.test.ts` over-80 error-code expectation versus current confirm-style behavior to keep tests aligned with product policy.
--- a/docs/api-phase4-move-log.md
+++ b/docs/api-phase4-move-log.md
@@ -1,57 +0,0 @@
-# API Phase 4 Move Log
-
-Date: 2026-03-17  
-Scope: Move `transactions` endpoints out of `api/src/server.ts` into a dedicated route module.
-
-## Route Registration Changes
- Added transactions route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:19)
- Registered transactions routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:938)
- New canonical route module: [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/transactions.ts:38)
- Removed inline transactions route blocks from `server.ts` to avoid duplicate registration:
-  - `POST /transactions` block
-  - `GET/PATCH/DELETE /transactions` block
-
-## Endpoint Movements
-
-1. `POST /transactions`
- Moved to [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/transactions.ts:42)
- References:
-  - [useTransactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useTransactions.ts:34)
-  - [payment-rollover.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/payment-rollover.test.ts:42)
-  - [transactions.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/transactions.test.ts:139)
-
-2. `GET /transactions`
- Moved to [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/transactions.ts:465)
- References:
-  - [useTransactionsQuery.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useTransactionsQuery.tsx:41)
-  - [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/transactions.ts:27)
-  - [transactions.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/transactions.test.ts:71)
-
-3. `PATCH /transactions/:id`
- Moved to [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/transactions.ts:601)
- References:
-  - [useTransactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useTransactions.ts:63)
-  - [transactions.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/transactions.test.ts:189)
-
-4. `DELETE /transactions/:id`
- Moved to [transactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/transactions.ts:659)
- References:
-  - [useTransactions.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useTransactions.ts:75)
-  - [SpendPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/SpendPage.tsx:296)
-
-## Helper Ownership in Phase 4
- Shared helper injection from `server.ts`:
-  - `mutationRateLimit`
-  - `computeDepositShares`
-  - `computeWithdrawShares`
-  - `computeOverdraftShares`
-  - `calculateNextDueDate`
-  - `toBig`
-  - `parseCurrencyToCents`
- Route-local helper:
-  - `isDate` query validator
-
-## Follow-ups To Revisit
-1. Split `POST /transactions` into smaller internal handlers (`variable_spend` vs `fixed_payment`) after endpoint migration phases complete.
-2. Replace broad `any` shapes in transaction where-clause/order composition with a typed query builder to reduce regression risk.
-3. Reconcile test expectations for plan overdraft behavior (`OVERDRAFT_PLAN` vs current fixed-payment reconciliation semantics) before behavior changes in later phases.
--- a/docs/api-phase5-move-log.md
+++ b/docs/api-phase5-move-log.md
@@ -1,121 +0,0 @@
-# API Phase 5 Move Log
-
-Date: 2026-03-17  
-Scope: Move `fixed-plans` endpoints out of `api/src/server.ts` into a dedicated route module.
-
-## Route Registration Changes
- Added fixed-plans route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:20)
- Registered fixed-plans routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:948)
- New canonical route module: [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:71)
- Removed inline fixed-plans route blocks from `server.ts` to avoid duplicate registration:
-  - `PATCH /fixed-plans/:id/early-funding`
-  - `POST /fixed-plans/:id/attempt-final-funding`
-  - `PATCH /fixed-plans/:id/mark-unpaid`
-  - `POST /fixed-plans/:id/fund-from-available`
-  - `POST /fixed-plans/:id/catch-up-funding`
-  - `POST /fixed-plans`
-  - `PATCH /fixed-plans/:id`
-  - `DELETE /fixed-plans/:id`
-  - `POST /fixed-plans/:id/true-up-actual`
-  - `GET /fixed-plans/due`
-  - `POST /fixed-plans/:id/pay-now`
-
-## Endpoint Movements
-
-1. `PATCH /fixed-plans/:id/early-funding`
- Original: `server.ts` line 1414
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:71)
- References:
-  - [EarlyPaymentPromptModal.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/EarlyPaymentPromptModal.tsx:34)
-  - [EarlyFundingModal.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/EarlyFundingModal.tsx:19)
-
-2. `POST /fixed-plans/:id/attempt-final-funding`
- Original: `server.ts` line 1475
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:131)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:58)
-  - [DashboardPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/DashboardPage.tsx:219)
-
-3. `PATCH /fixed-plans/:id/mark-unpaid`
- Original: `server.ts` line 1635
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:287)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:84)
-
-4. `POST /fixed-plans/:id/fund-from-available`
- Original: `server.ts` line 1674
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:325)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:95)
-  - [PlansSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/PlansSettings.tsx:461)
-
-5. `POST /fixed-plans/:id/catch-up-funding`
- Original: `server.ts` line 1828
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:478)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:106)
-  - [PlansSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/PlansSettings.tsx:512)
-
-6. `POST /fixed-plans`
- Original: `server.ts` line 2036
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:659)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:39)
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:449)
-  - [fixed-plans.estimated-true-up.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/fixed-plans.estimated-true-up.test.ts:43)
-
-7. `PATCH /fixed-plans/:id`
- Original: `server.ts` line 2122
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:747)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:41)
-  - [PlansSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/PlansSettings.tsx:502)
-
-8. `DELETE /fixed-plans/:id`
- Original: `server.ts` line 2239
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:866)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:42)
-  - [PlansSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/PlansSettings.tsx:443)
-
-9. `POST /fixed-plans/:id/true-up-actual`
- Original: `server.ts` line 2285
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:911)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:108)
-  - [PlansSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/PlansSettings.tsx:549)
-  - [fixed-plans.estimated-true-up.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/fixed-plans.estimated-true-up.test.ts:79)
-
-10. `GET /fixed-plans/due`
- Original: `server.ts` line 2429
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:1054)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:45)
-  - [DashboardPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/DashboardPage.tsx:363)
-
-11. `POST /fixed-plans/:id/pay-now`
- Original: `server.ts` line 2495
- Moved to [fixed-plans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/fixed-plans.ts:1118)
- References:
-  - [fixedPlans.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/fixedPlans.ts:77)
-  - [DashboardPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/DashboardPage.tsx:649)
-  - [fixed-plans.estimated-true-up.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/fixed-plans.estimated-true-up.test.ts:170)
-
-## Helper Ownership in Phase 5
- Shared helper injection from `server.ts`:
-  - `mutationRateLimit`
-  - `computeDepositShares`
-  - `computeWithdrawShares`
-  - `calculateNextDueDate`
-  - `toBig`
- Route-local helper:
-  - `DAY_MS` constant for date-window computations
-  - `PlanBody` / `PlanAmountMode` zod schemas
-
-## Verification
-1. Build
- `cd api && npm run build` ✅
-
-2. Focused tests
- `cd api && npm run test -- tests/fixed-plans.estimated-true-up.test.ts tests/payment-rollover.test.ts tests/transactions.test.ts`
- Result: blocked by local DB connectivity (`127.0.0.1:5432` unavailable), suites skipped/failed before endpoint assertions.
--- a/docs/api-phase6-move-log.md
+++ b/docs/api-phase6-move-log.md
@@ -1,100 +0,0 @@
-# API Phase 6 Move Log
-
-Date: 2026-03-17  
-Scope: Move `income`, `budget`, and `payday` endpoints out of `api/src/server.ts` into dedicated route modules.
-
-## Route Registration Changes
- Added income route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:21)
- Added payday route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:22)
- Added budget route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:23)
- Registered income routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:946)
- Registered payday routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:949)
- Registered budget routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:953)
- Removed inline route blocks from `server.ts` to avoid duplicate registration:
-  - `POST /income`
-  - `GET /income/history`
-  - `POST /income/preview`
-  - `GET /payday/status`
-  - `POST /payday/dismiss`
-  - `POST /budget/allocate`
-  - `POST /budget/fund`
-  - `POST /budget/reconcile`
-
-## Endpoint Movements
-
-1. `POST /income`
- Original: `server.ts` line 1382
- Moved to [income.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/income.ts:31)
- References:
-  - [useIncome.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useIncome.ts:27)
-  - [PaydayOverlay.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/PaydayOverlay.tsx:71)
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:479)
-  - [income.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/income.test.ts:19)
-  - [income.integration.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/income.integration.test.ts:59)
-
-2. `GET /income/history`
- Original: `server.ts` line 1421
- Moved to [income.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/income.ts:78)
- References:
-  - [useIncomeHistory.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useIncomeHistory.ts:15)
-
-3. `POST /income/preview`
- Original: `server.ts` line 1459
- Moved to [income.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/income.ts:115)
- References:
-  - [useIncomePreview.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useIncomePreview.ts:16)
-
-4. `GET /payday/status`
- Original: `server.ts` line 1483
- Moved to [payday.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/payday.ts:29)
- References:
-  - [PaydayOverlay.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/PaydayOverlay.tsx:35)
-
-5. `POST /payday/dismiss`
- Original: `server.ts` line 1586
- Moved to [payday.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/payday.ts:135)
- References:
-  - [PaydayOverlay.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/PaydayOverlay.tsx:54)
-
-6. `POST /budget/allocate`
- Original: `server.ts` line 1597
- Moved to [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/budget.ts:43)
- References:
-  - [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/budget.ts:58)
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:8)
-
-7. `POST /budget/fund`
- Original: `server.ts` line 1624
- Moved to [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/budget.ts:69)
- References:
-  - [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/budget.ts:65)
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:473)
-
-8. `POST /budget/reconcile`
- Original: `server.ts` line 1657
- Moved to [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/budget.ts:98)
- References:
-  - [budget.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/budget.ts:72)
-  - [ReconcileSettings.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/settings/ReconcileSettings.tsx:8)
-
-## Helper Ownership in Phase 6
- Shared helper injection from `server.ts`:
-  - `mutationRateLimit`
-  - `computeDepositShares`
-  - `computeWithdrawShares`
-  - `isProd` flag for environment-sensitive logging
- Route-local schemas/helpers:
-  - `income.ts`: `AllocationOverrideSchema`
-  - `budget.ts`: `BudgetBody`, `ReconcileBody`
-  - `payday.ts`: local debug logger and query schema
-
-## Notes
- Removed legacy unregistered `api/src/routes/income-preview.ts` to avoid duplicate endpoint logic drift.
-
-## Verification
-1. Build
- `cd api && npm run build` ✅
-
-2. Focused tests
- `cd api && npm run test -- tests/income.test.ts tests/income.integration.test.ts`
- Result: blocked by local DB connectivity (`127.0.0.1:5432` unavailable), suites skipped/failed before endpoint assertions.
--- a/docs/api-phase7-move-log.md
+++ b/docs/api-phase7-move-log.md
@@ -1,48 +0,0 @@
-# API Phase 7 Move Log
-
-Date: 2026-03-17  
-Scope: Move dashboard read endpoints out of `api/src/server.ts` into a dedicated route module.
-
-## Route Registration Changes
- Added dashboard route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:24)
- Registered dashboard routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:944)
- New canonical route module: [dashboard.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/dashboard.ts:24)
- Removed inline dashboard route blocks from `server.ts` to avoid duplicate registration:
-  - `GET /dashboard`
-  - `GET /crisis-status`
-
-## Endpoint Movements
-
-1. `GET /dashboard`
- Original: `server.ts` line 1081
- Moved to [dashboard.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/dashboard.ts:24)
- References:
-  - [useDashboard.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/hooks/useDashboard.ts:85)
-  - [OnboardingPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/OnboardingPage.tsx:172)
-  - [auth.routes.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/auth.routes.test.ts:37)
-  - [security-logging-monitoring-failures.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/security-logging-monitoring-failures.test.ts:48)
-
-2. `GET /crisis-status`
- Original: `server.ts` line 1330
- Moved to [dashboard.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/dashboard.ts:273)
- References:
-  - No direct web/api wrapper references currently found via repo search.
-  - Endpoint remains available for API consumers and future UI wiring.
-
-## Helper Ownership in Phase 7
- Route-local helpers in `dashboard.ts`:
-  - `monthKey`
-  - `monthLabel`
-  - `buildMonthBuckets`
-  - `DAY_MS`
- Reused allocator date helpers:
-  - static `getUserMidnightFromDateOnly`
-  - dynamic import of `getUserMidnight` and `calculateNextPayday` for parity with pre-move logic
-
-## Verification
-1. Build
- `cd api && npm run build` ✅
-
-2. Focused tests
- `cd api && npm run test -- tests/auth.routes.test.ts`
- Result: blocked by local DB connectivity (`127.0.0.1:5432` unavailable), suite skipped/failed before endpoint assertions.
--- a/docs/api-phase8-move-log.md
+++ b/docs/api-phase8-move-log.md
@@ -1,70 +0,0 @@
-# API Phase 8 Move Log
-
-Date: 2026-03-17  
-Scope: Move `admin` and `site-access` endpoints out of `api/src/server.ts` into dedicated route modules.
-
-## Route Registration Changes
- Added site-access route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:24)
- Added admin route import in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:25)
- Registered site-access routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:946)
- Registered admin routes in [server.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/server.ts:960)
- New canonical route modules:
-  - [site-access.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/site-access.ts:29)
-  - [admin.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/admin.ts:10)
- Removed inline route blocks from `server.ts` to avoid duplicate registration:
-  - `GET /site-access/status`
-  - `POST /site-access/unlock`
-  - `POST /site-access/lock`
-  - `POST /admin/rollover`
-
-## Endpoint Movements
-
-1. `GET /site-access/status`
- Original: `server.ts` line 946
- Moved to [site-access.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/site-access.ts:30)
- References:
-  - [siteAccess.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/siteAccess.ts:10)
-  - [BetaGate.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/components/BetaGate.tsx:20)
-  - [BetaAccessPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/BetaAccessPage.tsx:22)
-
-2. `POST /site-access/unlock`
- Original: `server.ts` line 957
- Moved to [site-access.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/site-access.ts:41)
- References:
-  - [siteAccess.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/siteAccess.ts:14)
-  - [BetaAccessPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/BetaAccessPage.tsx:40)
-
-3. `POST /site-access/lock`
- Original: `server.ts` line 994
- Moved to [site-access.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/site-access.ts:78)
- References:
-  - [siteAccess.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/api/siteAccess.ts:18)
-  - [BetaAccessPage.tsx](/mnt/c/Users/jholt/clone-test/SkyMoney/web/src/pages/BetaAccessPage.tsx:59)
-
-4. `POST /admin/rollover`
- Original: `server.ts` line 1045
- Moved to [admin.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/src/routes/admin.ts:11)
- References:
-  - [access-control.admin-rollover.test.ts](/mnt/c/Users/jholt/clone-test/SkyMoney/api/tests/access-control.admin-rollover.test.ts:44)
-
-## Helper Ownership in Phase 8
- Shared helper injection from `server.ts`:
-  - `authRateLimit`
-  - `mutationRateLimit`
-  - `hasSiteAccessBypass`
-  - `safeEqual`
-  - `isInternalClientIp`
-  - runtime config flags and cookie settings (`UNDER_CONSTRUCTION`, break-glass, cookie domain/secure, etc.)
- Route-local helpers/schemas:
-  - `site-access.ts`: unlock payload schema
-  - `admin.ts`: rollover payload schema
- Retained in `server.ts` by design for global hook behavior:
-  - site-access bypass token derivation and onRequest maintenance-mode enforcement
-
-## Verification
-1. Build
- `cd api && npm run build` ✅
-
-2. Focused tests
- `cd api && npm run test -- tests/access-control.admin-rollover.test.ts tests/security-misconfiguration.test.ts`
- Result: blocked by local DB connectivity (`127.0.0.1:5432` unavailable), suite skipped/failed before endpoint assertions.
--- a/docs/api-refactor-lightweight-plan.md
+++ b/docs/api-refactor-lightweight-plan.md
@@ -1,168 +0,0 @@
-# API Refactor Lightweight Plan
-
-## Goal
-Reduce `api/src/server.ts` size and duplication with low-risk, incremental moves.
-
-Current state (2026-03-17):
- `server.ts` still holds most business routes, but Phases 1-8 are complete.
- Completed move logs:
-  - `docs/api-phase1-move-log.md`
-  - `docs/api-phase2-move-log.md`
-  - `docs/api-phase3-move-log.md`
-  - `docs/api-phase4-move-log.md`
-  - `docs/api-phase5-move-log.md`
-  - `docs/api-phase6-move-log.md`
-  - `docs/api-phase7-move-log.md`
-  - `docs/api-phase8-move-log.md`
-
-## Refactor Guardrails
-1. Keep route behavior identical while moving code.
-2. Move one domain at a time; do not mix domains in one PR.
-3. Do not redesign architecture (no repositories/DI/container work).
-4. Extract only duplicated logic into shared helpers/services.
-5. Preserve global hooks and plugin registration in `server.ts` until final cleanup.
-6. Keep response shapes stable (`ok`, `code`, `message`, etc.) during moves.
-7. Require tests to pass after each move phase.
-
-## Canonical Source Rule
-`server.ts` is the canonical route logic right now.
-
-When moving a domain:
-1. Copy current logic from `server.ts` into the domain route module.
-2. Register the module.
-3. Remove the original block from `server.ts`.
-4. Confirm no duplicate route registrations remain.
-
-## Shared Helpers (Phase 0)
-Create and/or finish these helpers to keep endpoint moves lightweight:
-
-1. `api/src/services/user-context.ts`
- `getUserTimezone(...)`
- Removes repeated user timezone lookup logic.
-
-2. `api/src/services/category-shares.ts`
- `computePercentShares(...)`
- `computeWithdrawShares(...)`
- `computeOverdraftShares(...)`
- `computeDepositShares(...)`
- Centralizes repeated category-share math.
-
-3. `api/src/services/budget-session.ts`
- `getLatestBudgetSession(...)`
- `ensureBudgetSession(...)`
- `ensureBudgetSessionAvailableSynced(...)`
- Prevents session/value drift bugs.
-
-4. `api/src/services/api-errors.ts`
- Standard typed error object and response body builder.
- Keeps endpoint error handling consistent.
-
-## Progress Snapshot
-Completed:
-1. Phase 1: low-risk endpoints (`health`, `session`, `me`, `user/config`).
-2. Phase 2: `auth` + `account` endpoints.
-3. Phase 3: `variable-categories` endpoints.
-4. Phase 4: `transactions` endpoints.
-5. Phase 5: `fixed-plans` endpoints.
-6. Phase 6: `income`, `budget`, `payday` endpoints.
-7. Phase 7: `dashboard` + `crisis-status`.
-8. Phase 8: `admin` + site access endpoints.
-
-Remaining:
-1. Phase 9: final cleanup and helper consolidation.
-
-## Remaining Plan (Detailed)
-
-### Phase 5: Fixed Plans Domain
-Move these routes out of `server.ts` into `api/src/routes/fixed-plans.ts` (or split module if needed):
-1. `PATCH /fixed-plans/:id/early-funding`
-2. `POST /fixed-plans/:id/attempt-final-funding`
-3. `PATCH /fixed-plans/:id/mark-unpaid`
-4. `POST /fixed-plans/:id/fund-from-available`
-5. `POST /fixed-plans/:id/catch-up-funding`
-6. `POST /fixed-plans`
-7. `PATCH /fixed-plans/:id`
-8. `DELETE /fixed-plans/:id`
-9. `POST /fixed-plans/:id/true-up-actual`
-10. `GET /fixed-plans/due`
-11. `POST /fixed-plans/:id/pay-now`
-
-Primary risk:
- Payment/funding workflows are tightly coupled with available budget math and rollover rules.
-
-Test focus:
- `api/tests/fixed-plans*.test.ts`
- `api/tests/payment-rollover.test.ts`
-
-### Phase 6: Income, Budget, Payday Domain
-Move these routes into a dedicated module (e.g., `api/src/routes/budget-income.ts`):
-1. `POST /income`
-2. `GET /income/history`
-3. `POST /income/preview`
-4. `POST /budget/allocate`
-5. `POST /budget/fund`
-6. `POST /budget/reconcile`
-7. `GET /payday/status`
-8. `POST /payday/dismiss`
-
-Primary risk:
- Budget-session synchronization and allocator side effects.
-
-Test focus:
- Income/budget allocation tests
- Any tests asserting payday status/dismiss behavior
-
-### Phase 7: Dashboard Read Domain
-Move read endpoints into `api/src/routes/dashboard.ts`:
-1. `GET /dashboard`
-2. `GET /crisis-status`
-
-Primary risk:
- Derived numbers diverging between dashboard and rebalance/session APIs.
-
-Test focus:
- Dashboard API contract checks and UI smoke verification.
-
-### Phase 8: Admin and Site Access Domain
-Move operational endpoints into `api/src/routes/admin.ts` and/or `api/src/routes/site-access.ts`:
-1. `POST /admin/rollover`
-2. `GET /site-access/status`
-3. `POST /site-access/unlock`
-4. `POST /site-access/lock`
-
-Primary risk:
- Lockout/maintenance flow regressions and accidental open access.
-
-Test focus:
- Site access flow tests
- Admin rollover auth/permission checks
-
-### Phase 9: Final Cleanup
-1. Remove dead helper duplicates from `server.ts` and route modules.
-2. Consolidate common helpers into `api/src/services/*`.
-3. Normalize error envelopes where safe (no contract change unless explicitly planned).
-4. Re-run full API/security suites and perform deployment smoke checks.
-
-## Reference Audit Requirement (Per Move)
-For every endpoint moved:
-1. Record original location in `server.ts`.
-2. Record new route module location.
-3. Record frontend references (`web/src/api/*`, hooks, pages).
-4. Record test references.
-5. Add a phase move log under `docs/api-phaseX-move-log.md`.
-
-## Verification Steps (Per Phase)
-1. Build:
- `cd api && npm run build`
-2. Run focused tests for moved domain.
-3. Run security suites relevant to moved endpoints.
-4. Deploy.
-5. Run production endpoint smoke checks for the moved routes.
-6. Confirm logs show expected status codes (no unexplained 401/403/500 shifts).
-
-## Definition of Done per Phase
-1. Endpoints compile and register once.
-2. Existing tests pass.
-3. No route path/method changes.
-4. No response contract changes.
-5. `server.ts` net line count decreases.