Development Update — 2026-08-07

Overview: Where Development Is Heading

Backend — The backend is focused on hardening authentication, validation, and security. Recent work tightens /signin and /signup password handling to align with the frontend's base64(nacl.hash(plaintext)) format while preserving legacy account compatibility. The /validate endpoint is being hardened against missing tokens, and email templates plus error visibility are being cleaned up. The goal is a stable, production-ready auth foundation before more blockchain features are layered on.

Frontend — The frontend is actively migrating from Next.js to Vite + TanStack Router + TanStack Query. Recent commits stabilize the /validate flow as a layout route, ensure SSR validation links render correctly, and clean up dead references from route tree generation. The intent is to finish the routing migration, then progressively move API calls from the legacy Backend() client into typed TanStack Query functions so the app is type-safe and easier to maintain at scale.

Project Direction — Together the repos are converging on a clean, secure multi-chain NFT marketplace. The backend is locking down auth and data correctness; the frontend is modernizing its architecture so that future wallet, collection, and minting features can ship reliably.

Backend Commits

bfc2b4a 2026-08-07 00:12:35
fix: accept frontend base64(nacl.hash(plaintext)) in /signup and /signin schemas

51b200e 2026-08-06 23:57:40
fix: align password normalization with frontend base64(nacl.hash(plaintext))

82523ba 2026-08-06 23:40:07
fix: re-try legacy/base64/sha256 password encodings in /signin
Restore compatibility with passwords stored before normalization,
while keeping the normalized path for newly created accounts.

3446958 2026-08-06 22:22:52
fix: normalize auth password paths and harden signin/validation

a0579fc 2026-08-06 21:21:39
fix: normalize password formats across auth flows and harden validation/password-change paths

34d1786 2026-08-06 18:12:21
fix: lookup validated account by email instead of relying on returning id

b69c2e5 2026-08-06 18:08:22
fix: remove duplicate insert catch and safely use returning id

b533d68 2026-08-06 18:08:03
fix: handle returning id properly after validating account

1e999cb 2026-08-06 18:02:08
feat: improve database error visibility and prevent invalid validation payloads

5bef17b 2026-08-06 17:37:26
fix: populate error message and stack trace in server-error template

027e443 2026-08-06 17:29:02
fix: guard empty token lookup in /validate

5995502 2026-08-06 16:58:22
fix: use named template imports in email template registry

0408510 2026-08-06 16:56:50
fix: correct email template import path in utils/email.js

99344f5 2026-08-06 16:53:19
feat: add HTML/plaintext email templates for auth, admin, and contact emails

e51cea5 2026-08-06 16:38:22
fix: make accounts.bmp an integer instead of boolean

05261ba 2026-08-06 16:37:34
feat: add migrations for accounts.bmp and profile_visibility

7f6b750 2026-08-06 16:34:33
feat: add migration for accounts.lastact column

22ed1ab 2026-08-06 16:33:03
fix: ignore missing accounts.lastact column during successful auth

7fc9cd8 2026-08-06 16:26:10
fix: guard bcrypt.compare in checkAuth when session or token is missing

ca5ccf4 2026-08-06 16:19:04
fix: reset lastpwReset to 0 on successful password change

cb5244c 2026-08-06 16:16:20
fix: serialize profile socials and improve registration/reset email responses

ad306f0 2026-08-06 15:56:21
fix: treat null lastpwReset as no prior password reset request

65cda5a 2026-08-06 15:53:41
fix: add lastpwReset timestamp to accounts for password reset rate limiting

670a533 2026-08-06 15:50:09
fix: add isReset tinyint column to unregistered table

6b40ee0 2026-08-05 22:45:08
fix: allow walletassoc.siteid=0 sentinel for unassociated wallets

Frontend Commits

8119822 2026-08-07 20:18:40
fix: update footer and signup secondary form

c19ed01 2026-08-06 22:16:17
updates

ebcf8e8 2026-08-06 21:47:05
fix: remove dead validate refs and use stable reset route query

84eaf30 2026-08-06 21:30:51
Merge remote-tracking branch 'origin/hermes' into hermes

673a300 2026-08-06 21:30:03
updates

cd8df1a 2026-08-06 20:39:11
merge: bring latest routeTree/admin auth changes onto build-host history

abe0a4b 2026-08-06 20:38:24
chore: regenerate routeTree and minor AdminMintingDapps auth header fix

817084d 2026-08-06 17:17:32
chore: regenerate routeTree after validate layout refactor

04a67a6 2026-08-06 17:15:17
fix: make /validate a layout route so /validate/$token renders and backend is contacted

2d54a93 2026-08-06 15:39:56
fix: pass forgot-password mode via /validate search params instead of location state

2199137 2026-08-06 15:36:31
merge: bring local routeTree/chunk-limit changes onto build-host history

ea9c24b 2026-08-06 15:36:02
chore: regenerate routeTree after adding /validate/ route

76a66ad 2026-08-06 15:25:48
chore: reduce chunk-size build noise by raising warning limit

f3b3fa7 2026-08-06 15:24:07
fix: remove tanstack from manualChunks to avoid SSR external conflict

f7b6398 2026-08-06 15:13:46
chore: commit generated routeTree and lockfile after validate route fix

19cbc7a 2026-08-06 15:19:20
chore: split large client chunks and raise chunk warning limit

f8d3891 2026-08-06 15:03:28
fix: avoid invariant by passing auth token from /validate/$authInfo route

08e49cc 2026-08-06 01:40:17
fix: use relative import for ValidateContainer in /validate/ route

5e2ffce 2026-08-06 01:38:15
fix: correct ValidateContainer import alias in /validate/ route

55f3659 2026-08-06 01:35:18
fix: restore /validate/ route for SSR validation links

215274f 2026-08-06 01:22:58
fix: extract validation token from URL pathname in SSR mode

24b3bc7 2026-08-06 01:13:16
fix: redirect /validate to /validate/ for tokenized validation links

98161bc 2026-08-06 01:13:08
chore: add root AGENTS.md with project summary and conventions

f05235e 2026-08-06 00:53:32
fix: make /validate accept tokenized validation URLs

ac78d23 2026-08-05 18:08:00
ai changes