Merge branch 'main' into migrate-og-takumi-v2

Author: AlemTuzlak

docs/source-code-audit-2026-06-23.md

@@ -17,9 +17,11 @@ These are quick, high-leverage patches because later fixes can reuse them instea
 - [done 2026-06-24: `pnpm run test:unit`, `pnpm test`] Make `pnpm test` honest about TypeScript tests, or split script names so validation expectations are clear.
 - [done 2026-06-24: `pnpm run test:tsc`, `pnpm run test:lint`] Default non-submit buttons/select triggers to `type="button"`, fix the shared pagination label/id contract, and clean up tooltip child prop merging.
 - [done 2026-06-24: `pnpm run test:unit`, `pnpm run test:tsc`, `pnpm run test:lint`] Add tiny helpers for response filenames, package slug encoding, and row-local ids.
-- Add tiny helpers for external URL normalization, internal route classification, and guarded storage.
-- Fix custom `useMutation` stale callbacks, clipboard/copied-state timers, docs sidebar timers, popup blocked-state handling, and simple page-visibility/reduced-motion helpers.
-- Normalize easy static data contracts: maintainer bare-domain URLs, Scarf id validation, public-library selector, partner analytics seed buckets, blog image URLs, host cache purge response policy.
+- [done 2026-06-24: `pnpm test`, 60-route local smoke] Add tiny helpers for external URL normalization, internal route classification, and guarded storage.
+- [done 2026-06-24: `pnpm test`, 60-route local smoke] Share low-risk clipboard/copy-state timers and auth popup centering.
+- Fix custom `useMutation` stale callbacks, docs sidebar timers, remaining popup blocked-state handling, and remaining page-visibility/reduced-motion call sites.
+- [done 2026-06-24: `pnpm test`, 60-route local smoke] Normalize maintainer bare-domain URLs, add Scarf/social URL contract tests, and centralize the public-library selector.
+- Normalize partner analytics seed buckets, blog image URLs, and host cache purge response policy.
 
 ### 2. One-off cleanup that lowers noise
 
@@ -33,10 +35,10 @@ Do these early when they're obvious and isolated, but don't let them block highe
 
 These are small enough to do before deeper refactors and they reduce risk while larger helpers are being designed.
 
-- Analytics proxy header allowlist, GitHub webhook fail-closed secret, Cloudflare-first IP extraction, route response filename sanitizing, Discord raw-body size/signature-shape guard, MCP transport content-type/length guard and masked errors.
-- Public pagination and route-search caps, admin pagination/range caps, docs feedback content caps, showcase field/array caps, Shopify page-size/quantity/discount caps, UploadThing client preflight caps, image transform clamps, community-resource frontmatter schema.
-- URL/link hardening: Intent metadata URLs, Intent tarball source paths, markdown/source/search link classification, legacy redirect segment matching, local docs path containment.
-- OAuth/login quick fixes: return-to key mismatch, login modal stale callbacks, provider route param picklists, session revocation conflict retry, and session base64 fallback removal once covered.
+- [done 2026-06-24: `pnpm test:tsc`, `pnpm test:lint`, `pnpm test`] Analytics proxy header allowlist, GitHub webhook fail-closed secret, Cloudflare-first IP extraction, route response filename sanitizing, Discord raw-body size/signature-shape guard, MCP transport content-type/length guard and masked errors.
+- [done 2026-06-24: `pnpm test:tsc`, `pnpm test:lint`, `pnpm test`] Public pagination and route-search caps, admin pagination/range caps, docs feedback content caps, showcase field/array caps, Shopify page-size/quantity/discount caps, UploadThing client preflight caps, image transform clamps, community-resource frontmatter schema.
+- [done 2026-06-24: `pnpm test:tsc`, `pnpm test:lint`, `pnpm test`] URL/link hardening: Intent metadata URLs, Intent tarball source paths, markdown/source/search link classification, legacy redirect segment matching, local docs path containment.
+- [done 2026-06-24: `pnpm test:tsc`, `pnpm test:lint`, `pnpm test`] OAuth/login quick fixes: return-to key mismatch, login modal stale callbacks, provider route param picklists, session revocation conflict retry, and session base64 fallback removal once covered.
 
 ### 4. Small controllers that prevent repeat bugs
 
@@ -89,9 +91,12 @@ Treat these as tracked initiatives, not normal cleanup PRs.
 
 ## Batch Log
 
+- 2026-06-24: Landed the grouped security pass across public request boundaries, OAuth/login/session flows, builder/GitHub deploy APIs, outbound fetches, stats/Intent/docs/shop/showcase caps, UploadThing/image preflight, markdown/search link classification, docs redirects/path containment, and community-resource frontmatter validation.
+- 2026-06-24: Second pass simplified the security patch by sharing bounded body readers, npm package-name/page/date/chart schemas, and URL normalization; removed the local application-starter request guard while preserving same-origin/content-type/body-size enforcement.
 - 2026-06-24: Added shared response filename/content-disposition helpers, package route slug encoding helpers, and row-local id helpers; wired them into builder/docs downloads, Intent registry links, and moderation note inputs.
 - 2026-06-24: Hardened shared UI primitives: defaulted shop buttons and shared select triggers to non-submit buttons, gave pagination a unique page-size label/id pair plus non-submit controls, and made Tooltip merge trigger handlers/refs without `any`.
 - 2026-06-24: Added `test:unit` and wired it into `pnpm test` so existing TypeScript assertion tests run in the default validation path.
+- 2026-06-24: Added guarded browser storage/effect helpers, migrated low-risk clipboard/timer/popup/storage/reduced-motion call sites, centralized public-library selection, normalized maintainer URLs, and added static data contract tests.
 - 2026-06-23: Audit created and ordered.
 
 ## Highest Priority Findings
@@ -2183,7 +2188,7 @@ This is a strong candidate for a reusable TanStack docs-site cache helper or at
 
 ### Good pattern: slim data modules with explicit heavy-data escape hatches
 
-`src/libraries/libraries.ts:1-2` keeps base library data lightweight, while `src/libraries/index.tsx:34-44` explicitly avoids re-exporting extended per-library landing-page projects that contain React nodes and heavier assets. This is the right shape for global navigation/docs data: a slim default import path plus opt-in heavy modules for routes that actually render the full experience.
+`src/libraries/libraries.ts:1-2` keeps base library data lightweight, while `src/libraries/index.tsx:34-44` explicitly avoids re-exporting extended per-library landing-page projects that contain React nodes and heavier assets. `publicLibraries` and `isPublicLibrary` now give navigation/search/API callers one shared public catalog boundary. This is the right shape for global navigation/docs data: a slim default import path plus opt-in heavy modules for routes that actually render the full experience.
 
 ### Good pattern: lazy activation for expensive navbar features
 
@@ -2206,6 +2211,7 @@ This is a strong candidate for a reusable TanStack docs-site cache helper or at
 - Builder definition schema shared between client UI, validate, compile, download, deploy, and MCP.
 - A deploy-dialog controller shared by builder-generated projects and docs example deployment.
 - React/browser effect helpers for timed flags, popup polling, clipboard writes, guarded storage, outside-click behavior, and drag-resize listeners.
+- Static data contract tests for public catalogs, maintainer/social URLs, package metadata IDs, and other small hand-authored data tables.
 - An OAuth PKCE helper with atomic code consumption patterns for Drizzle/Postgres.
 - A first-party OAuth callback helper that validates provider params, clears transient cookies on every exit, and normalizes provider token/profile responses.
 - A React Query query-options linter/helper that asserts query keys include every query-function input.

src/auth/cli-tickets.server.ts

@@ -9,6 +9,7 @@
  */
 
 const TICKET_TTL_MS = 5 * 60 * 1000
+const MAX_TICKETS = 1_000
 
 interface CliTicket {
   userId: string | null
@@ -38,18 +39,34 @@ const tickets: Map<string, CliTicket> = (globalScope[TICKETS_KEY] ??= new Map<
 if (!globalScope[TICKETS_INTERVAL_KEY]) {
   globalScope[TICKETS_INTERVAL_KEY] = setInterval(
     () => {
-      const now = Date.now()
-      for (const [id, ticket] of tickets) {
-        if (ticket.expiresAt < now) {
-          tickets.delete(id)
-        }
-      }
+      cleanupExpiredTickets()
     },
     60 * 1000, // every minute
   )
 }
 
+function cleanupExpiredTickets() {
+  const now = Date.now()
+  for (const [id, ticket] of tickets) {
+    if (ticket.expiresAt < now) {
+      tickets.delete(id)
+    }
+  }
+}
+
+function trimTicketStore() {
+  cleanupExpiredTickets()
+
+  while (tickets.size >= MAX_TICKETS) {
+    const oldestId = tickets.keys().next().value
+    if (!oldestId) break
+    tickets.delete(oldestId)
+  }
+}
+
 export function createCliTicket(): string {
+  trimTicketStore()
+
   const id = crypto.randomUUID()
   tickets.set(id, {
     userId: null,

src/auth/client.ts

@@ -6,6 +6,7 @@
  */
 
 import type { OAuthProvider } from './types'
+import { openCenteredPopupWindow } from '~/utils/browser-effects'
 
 // ============================================================================
 // Auth Client
@@ -36,15 +37,13 @@ export const authClient = {
      * Initiate OAuth sign-in in a popup window (for modal-based login)
      */
     socialPopup: ({ provider }: { provider: OAuthProvider }) => {
-      const width = 500
-      const height = 600
-      const left = window.screenX + (window.outerWidth - width) / 2
-      const top = window.screenY + (window.outerHeight - height) / 2
-      window.open(
-        `/auth/${provider}/start?popup=true`,
-        'tanstack-oauth',
-        `width=${width},height=${height},left=${left},top=${top},popup=yes`,
-      )
+      return openCenteredPopupWindow({
+        url: `/auth/${provider}/start?popup=true`,
+        target: 'tanstack-oauth',
+        width: 500,
+        height: 600,
+        features: ['popup=yes'],
+      })
     },
   },
 
@@ -74,7 +73,7 @@ export function navigateToSignIn(
     window.location.href = url
   } else {
     const url = returnTo
-      ? `/login?returnTo=${encodeURIComponent(returnTo)}`
+      ? `/login?redirect=${encodeURIComponent(returnTo)}`
       : '/login'
     window.location.href = url
   }