feat: v0.6.0 — What's New popup, new-user defaults, rate limit fix

- Bump version to 0.6.0
- Add WhatsNewOverlay for existing users: prompts to enable weekly
  celebrations + mid-week encouragement on upgrade, navigates to settings
- New user registrations auto-enable both celebrations and encouragement
  (stats_only tier) at signup
- Fix rate limiter NaN crash: guard against corrupt non-finite values in
  rate_limits table rows
- Fix .env.example: HMAC_SECRET was misnamed WEEKLY_RHYTHMS_TOKEN_SECRET
- Fix snapshot record label: use subcategory instead of name for session labels

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: InfantLab

app/.env.example

@@ -85,7 +85,7 @@ APP_URL=http://localhost:3000
 # ============================================
 # HMAC secret for one-click email unsubscribe tokens
 # Generate with: openssl rand -hex 32
-WEEKLY_RHYTHMS_TOKEN_SECRET=
+HMAC_SECRET=
 
 # ============================================
 # Analytics (optional)

app/components/onboarding/WhatsNewOverlay.vue

@@ -0,0 +1,119 @@
+<script setup lang="ts">
+/**
+ * What's New Overlay
+ *
+ * Shows once for existing users who upgrade to a new version.
+ * Currently highlights the Weekly Celebrations feature (v0.6.0).
+ * If user says "Yes", enables both celebrations + encouragement
+ * and navigates to settings so they can see the options.
+ */
+
+const { hasNewVersion, acknowledgeNewVersion } = useOnboarding();
+const router = useRouter();
+
+const isVisible = ref(false);
+const isAuthenticated = ref(false);
+const enabling = ref(false);
+
+onMounted(async () => {
+  try {
+    const response = await $fetch<{ user: { id: string } | null }>("/api/auth/session");
+    isAuthenticated.value = !!response.user;
+  } catch {
+    isAuthenticated.value = false;
+  }
+
+  if (isAuthenticated.value && hasNewVersion.value) {
+    setTimeout(() => {
+      isVisible.value = true;
+    }, 800);
+  }
+});
+
+async function handleEnable() {
+  enabling.value = true;
+  try {
+    await $fetch("/api/weekly-rhythms/settings", {
+      method: "PUT",
+      body: {
+        celebrationEnabled: true,
+        encouragementEnabled: true,
+      },
+    });
+  } catch {
+    // Settings will be off — user can enable manually in settings
+  }
+  enabling.value = false;
+  isVisible.value = false;
+  acknowledgeNewVersion();
+  await router.push("/settings");
+}
+
+function handleDismiss() {
+  isVisible.value = false;
+  acknowledgeNewVersion();
+}
+</script>
+
+<template>
+  <Teleport to="body">
+    <Transition
+      enter-active-class="transition-all duration-500 ease-out"
+      enter-from-class="opacity-0"
+      enter-to-class="opacity-100"
+      leave-active-class="transition-all duration-300 ease-in"
+      leave-from-class="opacity-100"
+      leave-to-class="opacity-0"
+    >
+      <div
+        v-if="isVisible"
+        class="fixed inset-0 z-[100] flex items-center justify-center p-6"
+      >
+        <!-- Backdrop -->
+        <div
+          class="absolute inset-0 bg-gradient-to-b from-tada-900/80 to-stone-900/90 backdrop-blur-sm"
+          @click="handleDismiss"
+        />
+
+        <!-- Content card -->
+        <div
+          class="relative bg-white dark:bg-stone-800 rounded-2xl shadow-2xl max-w-sm w-full p-6 text-center"
+        >
+          <div class="text-4xl mb-4">🎉</div>
+
+          <h2 class="text-xl font-bold text-stone-800 dark:text-stone-100 mb-2">
+            New in Ta-Da!
+          </h2>
+
+          <p class="text-sm text-stone-600 dark:text-stone-300 mb-1">
+            <strong>Weekly Celebrations</strong> — get a stats summary every Monday
+            to see how your week went.
+          </p>
+          <p class="text-sm text-stone-600 dark:text-stone-300 mb-5">
+            Plus a gentle <strong>mid-week encouragement</strong> on Thursdays.
+          </p>
+
+          <p class="text-sm text-stone-500 dark:text-stone-400 mb-5">
+            Want to turn them on?
+          </p>
+
+          <div class="flex flex-col gap-2">
+            <button
+              class="w-full py-2.5 px-4 rounded-xl bg-tada-600 hover:bg-tada-700 text-white font-medium text-sm transition-colors disabled:opacity-60"
+              :disabled="enabling"
+              @click="handleEnable"
+            >
+              {{ enabling ? "Turning on..." : "Yes, turn it on!" }}
+            </button>
+            <button
+              class="w-full py-2 px-4 rounded-xl text-stone-500 dark:text-stone-400 hover:bg-stone-100 dark:hover:bg-stone-700 text-sm transition-colors"
+              @click="handleDismiss"
+            >
+              Maybe later
+            </button>
+          </div>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+</template>

app/layouts/default.vue

@@ -347,6 +347,7 @@ onUnmounted(() => {
     <ErrorTrackerPanel />
     <CookieConsent />
     <onboarding-WelcomeOverlay />
+    <OnboardingWhatsNewOverlay />
     <ContextualHelpPanel v-model:open="showHelpPanel" />
   </div>
 </template>

app/nuxt.config.ts

@@ -41,7 +41,7 @@ export default defineNuxtConfig({
   runtimeConfig: {
     public: {
       appName: "Tada",
-      appVersion: "0.5.0",
+      appVersion: "0.6.0",
       appUrl: process.env["APP_URL"] || "http://localhost:3000",
       isCloudMode:
         process.env["TADA_CLOUD_MODE"] === "true" ||

app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tada",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "private": true,
   "type": "module",
   "description": "Personal lifelogger - Track Activities, Discover Achievements",

app/server/api/auth/register.post.ts

@@ -7,6 +7,7 @@ import { nanoid } from "nanoid";
 import { createLogger } from "~/server/utils/logger";
 import { hashPassword } from "~/server/utils/password";
 import { apiError, internalError } from "~/server/utils/response";
+import { upsertWeeklyRhythmSettings, refreshNextDueTimes } from "~/server/services/weekly-rhythms/settings";
 
 const logger = createLogger("api:auth:register");
 
@@ -68,6 +69,20 @@ export default defineEventHandler(async (event) => {
     const session = await createSession(userId);
     setSessionCookie(event, session.id);
 
+    // Auto-enable weekly celebrations + encouragement for new users
+    try {
+      await upsertWeeklyRhythmSettings(userId, {
+        celebrationEnabled: true,
+        encouragementEnabled: true,
+        celebrationTier: "stats_only",
+        onboardingCompletedAt: new Date().toISOString(),
+      });
+      await refreshNextDueTimes(userId);
+    } catch (settingsErr) {
+      // Non-fatal — user can enable manually in settings
+      logger.error("Failed to create default weekly rhythm settings", settingsErr);
+    }
+
     logger.info("User registered successfully", { username: body.username });
 
     return {

app/server/services/rate-limit.ts

@@ -63,7 +63,17 @@ export function checkRateLimit(
     .where(eq(rateLimits.key, cacheKey))
     .get();
 
-  if (!existing || existing.windowEnd <= now) {
+  // Guard against corrupt data — treat non-finite values as expired
+  if (
+    existing &&
+    (!Number.isFinite(existing.windowEnd) ||
+      !Number.isFinite(existing.windowStart) ||
+      !Number.isFinite(existing.count))
+  ) {
+    db.delete(rateLimits).where(eq(rateLimits.key, cacheKey)).run();
+  }
+
+  if (!existing || !Number.isFinite(existing.windowEnd) || existing.windowEnd <= now) {
     // No entry or window has expired — start a new window
     const windowEnd = now + WINDOW_DURATION;
 

app/server/services/weekly-rhythms/snapshots.ts

@@ -304,7 +304,7 @@ async function extractPersonalRecords(
     }
   }
   if (longestSession && longestSession.durationSeconds) {
-    const sessionName = longestSession.name ?? longestSession.category ?? "session";
+    const sessionName = longestSession.subcategory ?? longestSession.category ?? "session";
     records.push({
       type: "longest_session",
       label: `Longest ${sessionName} session this month`,