Development Update — 2026-08-07

Overview: Where Development Is Heading

The backend repo is currently focused on general improvements. Recent commit subjects include: fix: accept frontend base64(nacl.hash(plaintext)) in /signup and /signin schemas; fix: align password normalization with frontend base64(nacl.hash(plaintext)); fix: re-try legacy/base64/sha256 password encodings in /signin restore compatibility with passwords stored before normalization, while keeping the normalized path for newly created accounts.; fix: normalize auth password paths and harden signin/validation; fix: normalize password formats across auth flows and harden validation/password-change paths. The work is tightening the foundation before more blockchain-facing features ship.

Overview: Where Development Is Heading

The frontend repo is currently focused on general improvements. Recent commit subjects include: refactor: remove window upload/nft globals in favor of uploadproxy; refactor: migrate signin, validate, and secnavitem to useauth/window-shim; feat: add lightweight client-side errorboundary; fix: update footer and signup secondary form; updates. The work is converging on a more stable and maintainable user experience.

Project Direction — The project is progressing across both backend and frontend toward a clean, maintainable multi-chain NFT marketplace.

Backend Commits

bfc2b4a 2026-08-07 00:12:35
fix: accept frontend base64(nacl.hash(plaintext)) in /signup and /signin schemas

51b200e 2026-08-06 23:57:40
fix: align password normalization with frontend base64(nacl.hash(plaintext))

82523ba 2026-08-06 23:40:07
fix: re-try legacy/base64/sha256 password encodings in /signin
Restore compatibility with passwords stored before normalization,
while keeping the normalized path for newly created accounts.

3446958 2026-08-06 22:22:52
fix: normalize auth password paths and harden signin/validation

a0579fc 2026-08-06 21:21:39
fix: normalize password formats across auth flows and harden validation/password-change paths

34d1786 2026-08-06 18:12:21
fix: lookup validated account by email instead of relying on returning id

b69c2e5 2026-08-06 18:08:22
fix: remove duplicate insert catch and safely use returning id

b533d68 2026-08-06 18:08:03
fix: handle returning id properly after validating account

1e999cb 2026-08-06 18:02:08
feat: improve database error visibility and prevent invalid validation payloads

5bef17b 2026-08-06 17:37:26
fix: populate error message and stack trace in server-error template

027e443 2026-08-06 17:29:02
fix: guard empty token lookup in /validate

5995502 2026-08-06 16:58:22
fix: use named template imports in email template registry

0408510 2026-08-06 16:56:50
fix: correct email template import path in utils/email.js

99344f5 2026-08-06 16:53:19
feat: add HTML/plaintext email templates for auth, admin, and contact emails

e51cea5 2026-08-06 16:38:22
fix: make accounts.bmp an integer instead of boolean

05261ba 2026-08-06 16:37:34
feat: add migrations for accounts.bmp and profile_visibility

7f6b750 2026-08-06 16:34:33
feat: add migration for accounts.lastact column

22ed1ab 2026-08-06 16:33:03
fix: ignore missing accounts.lastact column during successful auth

7fc9cd8 2026-08-06 16:26:10
fix: guard bcrypt.compare in checkAuth when session or token is missing

ca5ccf4 2026-08-06 16:19:04
fix: reset lastpwReset to 0 on successful password change

cb5244c 2026-08-06 16:16:20
fix: serialize profile socials and improve registration/reset email responses

ad306f0 2026-08-06 15:56:21
fix: treat null lastpwReset as no prior password reset request

65cda5a 2026-08-06 15:53:41
fix: add lastpwReset timestamp to accounts for password reset rate limiting

670a533 2026-08-06 15:50:09
fix: add isReset tinyint column to unregistered table

6b40ee0 2026-08-05 22:45:08
fix: allow walletassoc.siteid=0 sentinel for unassociated wallets

Frontend Commits

9eac361 2026-08-08 00:41:54
refactor: remove window upload/nft globals in favor of uploadProxy

ac41e57 2026-08-08 00:33:34
refactor: migrate SignIn, Validate, and SecNavItem to useAuth/window-shim

0df3ce1 2026-08-08 00:23:37
feat: add lightweight client-side ErrorBoundary

8119822 2026-08-07 20:18:40
fix: update footer and signup secondary form

c19ed01 2026-08-06 22:16:17
updates

ebcf8e8 2026-08-06 21:47:05
fix: remove dead validate refs and use stable reset route query

84eaf30 2026-08-06 21:30:51
Merge remote-tracking branch 'origin/hermes' into hermes

673a300 2026-08-06 21:30:03
updates

cd8df1a 2026-08-06 20:39:11
merge: bring latest routeTree/admin auth changes onto build-host history

abe0a4b 2026-08-06 20:38:24
chore: regenerate routeTree and minor AdminMintingDapps auth header fix

817084d 2026-08-06 17:17:32
chore: regenerate routeTree after validate layout refactor

04a67a6 2026-08-06 17:15:17
fix: make /validate a layout route so /validate/$token renders and backend is contacted

2d54a93 2026-08-06 15:39:56
fix: pass forgot-password mode via /validate search params instead of location state

2199137 2026-08-06 15:36:31
merge: bring local routeTree/chunk-limit changes onto build-host history

ea9c24b 2026-08-06 15:36:02
chore: regenerate routeTree after adding /validate/ route

76a66ad 2026-08-06 15:25:48
chore: reduce chunk-size build noise by raising warning limit

f3b3fa7 2026-08-06 15:24:07
fix: remove tanstack from manualChunks to avoid SSR external conflict

f7b6398 2026-08-06 15:13:46
chore: commit generated routeTree and lockfile after validate route fix

19cbc7a 2026-08-06 15:19:20
chore: split large client chunks and raise chunk warning limit

f8d3891 2026-08-06 15:03:28
fix: avoid invariant by passing auth token from /validate/$authInfo route

08e49cc 2026-08-06 01:40:17
fix: use relative import for ValidateContainer in /validate/ route

5e2ffce 2026-08-06 01:38:15
fix: correct ValidateContainer import alias in /validate/ route

55f3659 2026-08-06 01:35:18
fix: restore /validate/ route for SSR validation links

215274f 2026-08-06 01:22:58
fix: extract validation token from URL pathname in SSR mode

24b3bc7 2026-08-06 01:13:16
fix: redirect /validate to /validate/ for tokenized validation links