Merge branch 'main' into domain-type-unification

.github/dependabot.yml

@@ -20,10 +20,22 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
-      # react-native is pinned by the Expo SDK — upgrade it via an Expo
+      # These packages are version-pinned by the Expo SDK (see
-      # SDK bump, not on its own. Community react-native-* libraries are
+      # expo/bundledNativeModules.json) — upgrade them via an Expo SDK
-      # intentionally NOT ignored here; they can be bumped independently.
+      # bump / `npx expo install --fix`, never on their own. Dependabot
+      # bumping them past the SDK's expected version broke the native
+      # build (expo-modules-core macro mismatch, June 2026) because CI
+      # never compiles native code. `react` stays unignored: the web
+      # apps own its version via the workspace catalog, and apps/mobile
+      # excludes it from expo version checks.
       - dependency-name: "react-native"
+      - dependency-name: "react-native-gesture-handler"
+      - dependency-name: "react-native-reanimated"
+      - dependency-name: "react-native-safe-area-context"
+      - dependency-name: "react-native-screens"
+      - dependency-name: "react-native-worklets"
+      - dependency-name: "@sentry/react-native"
+      - dependency-name: "jest-expo"
 
   - package-ecosystem: "github-actions"
     directory: "/"

apps/journal/app/lib/activities.server.ts

@@ -4,8 +4,8 @@ import { unionAll } from "drizzle-orm/pg-core";
 import { getDb } from "./db.ts";
 import { activities, routes, syncImports, users, follows, remoteActors } from "@trails-cool/db/schema/journal";
 import type { Visibility } from "@trails-cool/db/schema/journal";
-import { validateGpx, writeGeom } from "./gpx-save.server.ts";
+import { processGpx, writeGeom } from "./gpx-save.server.ts";
-import type { GpxData } from "./gpx-save.server.ts";
+import type { ProcessedGpx } from "./gpx-save.server.ts";
 import { enqueueOptional } from "./boss.server.ts";
 import type { OwnedRef } from "./ownership.server.ts";
 import {
@@ -70,7 +70,7 @@ export async function createActivity(ownerId: string, input: ActivityInput) {
   const db = getDb();
   const id = randomUUID();
 
-  let parsed: GpxData | null = null;
+  let processed: ProcessedGpx | null = null;
   let distance: number | null = input.distance ?? null;
   let elevationGain: number | null = null;
   let elevationLoss: number | null = null;
@@ -78,13 +78,12 @@ export async function createActivity(ownerId: string, input: ActivityInput) {
   const duration: number | null = input.duration ?? null;
 
   if (input.gpx) {
-    parsed = await validateGpx(input.gpx);
+    processed = await processGpx(input.gpx);
-    distance = parsed.distance || distance;
+    // GPX-derived distance wins unless it is zero; caller input is the fallback
-    elevationGain = parsed.elevation.gain;
+    distance = processed.stats.distance || distance;
-    elevationLoss = parsed.elevation.loss;
+    elevationGain = processed.stats.elevationGain;
-    if (!startedAt && parsed.tracks[0]?.[0]?.time) {
+    elevationLoss = processed.stats.elevationLoss;
-      startedAt = new Date(parsed.tracks[0][0].time);
+    startedAt = startedAt ?? processed.stats.startTime;
-    }
   }
 
   await db.transaction(async (tx) => {
@@ -104,9 +103,8 @@ export async function createActivity(ownerId: string, input: ActivityInput) {
       ...(input.synthetic ? { synthetic: true } : {}),
     });
 
-    if (input.gpx && parsed) {
+    if (input.gpx && processed) {
-      const coords = parsed.tracks.flat().map((p) => [p.lon, p.lat] as [number, number]);
+      await writeGeom(tx, id, "activities", processed.coords);
-      await writeGeom(tx, id, "activities", coords);
     }
   });
 
@@ -332,8 +330,7 @@ export async function createRouteFromActivity(ownedActivity: OwnedRef): Promise<
     .where(and(eq(activities.id, activityId), eq(activities.ownerId, ownerId)));
   if (!activity?.gpx) return null;
 
-  const parsed = await validateGpx(activity.gpx);
+  const { coords } = await processGpx(activity.gpx);
-  const coords = parsed.tracks.flat().map((p) => [p.lon, p.lat] as [number, number]);
   const routeId = randomUUID();
 
   await db.transaction(async (tx) => {

apps/journal/app/lib/demo-bot.server.ts

@@ -6,7 +6,7 @@ import { getDb } from "./db.ts";
 import { activities, routes, users } from "@trails-cool/db/schema/journal";
 import { createRoute } from "./routes.server.ts";
 import { createActivity } from "./activities.server.ts";
-import { validateGpx } from "./gpx-save.server.ts";
+import { processGpx } from "./gpx-save.server.ts";
 import { TERMS_VERSION } from "./legal.ts";
 import { logger } from "./logger.server.ts";
 import {
@@ -649,10 +649,8 @@ export async function generateOneWalk(
   const name = templateName(now, locale, persona);
   const description = templateDescription(now, locale, persona);
 
-  const parsed = await validateGpx(result.gpx);
+  const { stats } = await processGpx(result.gpx);
-  const distance = parsed.distance;
+  const { distance, elevationGain, elevationLoss } = stats;
-  const elevationGain = parsed.elevation.gain;
-  const elevationLoss = parsed.elevation.loss;
 
   if (!distance || distance < 500) return null;
 

apps/journal/app/lib/gpx-save.server.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
-import { validateGpx, GpxValidationError } from "./gpx-save.server.ts";
+import { generateGpx } from "@trails-cool/gpx";
+import { processGpx, validateGpx, GpxValidationError } from "./gpx-save.server.ts";
 
 const VALID_GPX = `<?xml version="1.0" encoding="UTF-8"?>
 <gpx version="1.1" xmlns="http://www.topografix.com/GPX/1/1">
@@ -84,3 +85,68 @@ describe("validateGpx", () => {
     expect(err.name).toBe("GpxValidationError");
   });
 });
+
+const TIMED_GPX = `<?xml version="1.0" encoding="UTF-8"?>
+<gpx version="1.1" xmlns="http://www.topografix.com/GPX/1/1">
+  <metadata><desc>An alpine loop</desc></metadata>
+  <trk>
+    <trkseg>
+      <trkpt lat="47.0" lon="8.0"><ele>500</ele><time>2026-06-01T08:00:00Z</time></trkpt>
+      <trkpt lat="47.1" lon="8.1"><ele>520</ele><time>2026-06-01T09:00:00Z</time></trkpt>
+    </trkseg>
+  </trk>
+</gpx>`;
+
+describe("processGpx", () => {
+  it("extracts coords in [lon, lat] PostGIS axis order", async () => {
+    const { coords } = await processGpx(VALID_GPX);
+    expect(coords).toEqual([
+      [8.0, 47.0],
+      [8.1, 47.1],
+      [8.2, 47.2],
+    ]);
+  });
+
+  it("derives distance, elevation, description, and start time", async () => {
+    const { stats } = await processGpx(TIMED_GPX);
+    expect(stats.distance).toBeGreaterThan(0);
+    expect(stats.elevationGain).not.toBeNull();
+    expect(stats.elevationLoss).not.toBeNull();
+    expect(stats.description).toBe("An alpine loop");
+    expect(stats.startTime).toEqual(new Date("2026-06-01T08:00:00Z"));
+  });
+
+  it("returns null startTime and empty dayBreaks when absent", async () => {
+    const { stats } = await processGpx(VALID_GPX);
+    expect(stats.startTime).toBeNull();
+    expect(stats.dayBreaks).toEqual([]);
+  });
+
+  it("derives dayBreaks from day-break waypoints (round-trip via generateGpx)", async () => {
+    const gpx = generateGpx({
+      name: "Multi-day",
+      waypoints: [
+        { lat: 47.0, lon: 8.0, name: "Start" },
+        { lat: 47.1, lon: 8.1, name: "Hut", isDayBreak: true },
+        { lat: 47.2, lon: 8.2, name: "End" },
+      ],
+      tracks: [[
+        { lat: 47.0, lon: 8.0 },
+        { lat: 47.1, lon: 8.1 },
+        { lat: 47.2, lon: 8.2 },
+      ]],
+    });
+
+    const { stats } = await processGpx(gpx);
+    expect(stats.dayBreaks).toEqual([1]);
+  });
+
+  it("propagates GpxValidationError from validation", async () => {
+    await expect(processGpx(ONE_POINT_GPX)).rejects.toThrow(GpxValidationError);
+  });
+
+  it("returns the parsed GpxData so callers never re-parse", async () => {
+    const { parsed } = await processGpx(VALID_GPX);
+    expect(parsed.tracks.flat()).toHaveLength(3);
+  });
+});

apps/journal/app/lib/gpx-save.server.ts

@@ -45,6 +45,51 @@ export async function validateGpx(gpx: string): Promise<GpxData> {
   return parsed;
 }
 
+export interface GpxStats {
+  distance: number | null;
+  elevationGain: number | null;
+  elevationLoss: number | null;
+  /** Indices of waypoints flagged as day breaks. */
+  dayBreaks: number[];
+  /** GPX-level description, when present. */
+  description?: string;
+  /** Timestamp of the first track point, when present. */
+  startTime: Date | null;
+}
+
+export interface ProcessedGpx {
+  parsed: GpxData;
+  /** [lon, lat] pairs in PostGIS axis order, ready for writeGeom. */
+  coords: Array<[number, number]>;
+  stats: GpxStats;
+}
+
+/**
+ * The validate-and-derive step every GPX save starts with: parse +
+ * validate (throws GpxValidationError), extract the geometry
+ * coordinates, and derive the stats rows store. Callers own the
+ * precedence between these derived stats and caller-supplied ones —
+ * routes let explicit input win wholesale, activities prefer the GPX
+ * distance unless it is zero.
+ */
+export async function processGpx(gpx: string): Promise<ProcessedGpx> {
+  const parsed = await validateGpx(gpx);
+  return {
+    parsed,
+    coords: parsed.tracks.flat().map((p) => [p.lon, p.lat] as [number, number]),
+    stats: {
+      distance: parsed.distance ?? null,
+      elevationGain: parsed.elevation.gain ?? null,
+      elevationLoss: parsed.elevation.loss ?? null,
+      dayBreaks: parsed.waypoints
+        .map((w, i) => (w.isDayBreak ? i : -1))
+        .filter((i) => i >= 0),
+      description: parsed.description,
+      startTime: parsed.tracks[0]?.[0]?.time ? new Date(parsed.tracks[0][0].time) : null,
+    },
+  };
+}
+
 type Tx = Parameters<Parameters<Database["transaction"]>[0]>[0];
 
 /**

apps/journal/app/lib/routes.server.ts

@@ -4,8 +4,8 @@ import { getDb } from "./db.ts";
 import { routes, routeVersions } from "@trails-cool/db/schema/journal";
 import type { Visibility } from "@trails-cool/db/schema/journal";
 import { sql } from "drizzle-orm";
-import { validateGpx, writeGeom } from "./gpx-save.server.ts";
+import { processGpx, writeGeom } from "./gpx-save.server.ts";
-import type { GpxData } from "./gpx-save.server.ts";
+import type { ProcessedGpx } from "./gpx-save.server.ts";
 import type { OwnedRef } from "./ownership.server.ts";
 
 export interface RouteInput {
@@ -26,21 +26,17 @@ export async function createRoute(ownerId: string, input: RouteInput) {
   const db = getDb();
   const id = randomUUID();
 
-  let parsed: GpxData | null = null;
+  let processed: ProcessedGpx | null = null;
   let distance: number | null = input.distance ?? null;
   let elevationGain: number | null = input.elevationGain ?? null;
   let elevationLoss: number | null = input.elevationLoss ?? null;
   let dayBreaks: number[] = input.dayBreaks ?? [];
 
   if (input.gpx) {
-    parsed = await validateGpx(input.gpx);
+    processed = await processGpx(input.gpx);
-    // Only compute stats from GPX if not pre-supplied by caller
+    // Only use GPX-derived stats if not pre-supplied by caller
     if (input.distance === undefined) {
-      const stats = computeRouteStats(parsed);
+      ({ distance, elevationGain, elevationLoss, dayBreaks } = processed.stats);
-      distance = stats.distance;
-      elevationGain = stats.elevationGain;
-      elevationLoss = stats.elevationLoss;
-      dayBreaks = stats.dayBreaks;
     }
   }
 
@@ -60,9 +56,8 @@ export async function createRoute(ownerId: string, input: RouteInput) {
       ...(input.synthetic ? { synthetic: true } : {}),
     });
 
-    if (input.gpx && parsed) {
+    if (input.gpx && processed) {
-      const coords = parsed.tracks.flat().map((p) => [p.lon, p.lat] as [number, number]);
+      await writeGeom(tx, id, "routes", processed.coords);
-      await writeGeom(tx, id, "routes", coords);
 
       await tx.insert(routeVersions).values({
         id: randomUUID(),
@@ -135,9 +130,9 @@ export async function updateRoute(route: OwnedRef, input: Partial<RouteInput>) {
   const { id, ownerId } = route;
   const db = getDb();
 
-  let parsed: GpxData | null = null;
+  let processed: ProcessedGpx | null = null;
   if (input.gpx) {
-    parsed = await validateGpx(input.gpx);
+    processed = await processGpx(input.gpx);
   }
 
   const updateData: Record<string, unknown> = { updatedAt: new Date() };
@@ -145,8 +140,8 @@ export async function updateRoute(route: OwnedRef, input: Partial<RouteInput>) {
   if (input.description !== undefined) updateData.description = input.description;
   if (input.visibility !== undefined) updateData.visibility = input.visibility;
 
-  if (input.gpx && parsed) {
+  if (input.gpx && processed) {
-    const stats = computeRouteStats(parsed);
+    const { stats } = processed;
     updateData.gpx = input.gpx;
     updateData.distance = stats.distance;
     updateData.elevationGain = stats.elevationGain;
@@ -163,9 +158,8 @@ export async function updateRoute(route: OwnedRef, input: Partial<RouteInput>) {
       .set(updateData)
       .where(and(eq(routes.id, id), eq(routes.ownerId, ownerId)));
 
-    if (input.gpx && parsed) {
+    if (input.gpx && processed) {
-      const coords = parsed.tracks.flat().map((p) => [p.lon, p.lat] as [number, number]);
+      await writeGeom(tx, id, "routes", processed.coords);
-      await writeGeom(tx, id, "routes", coords);
 
       const existingVersions = await tx
         .select()
@@ -197,19 +191,6 @@ export async function deleteRoute(route: OwnedRef) {
   return result.length > 0;
 }
 
-function computeRouteStats(gpxData: GpxData) {
-  const dayBreaks = gpxData.waypoints
-    .map((w, i) => (w.isDayBreak ? i : -1))
-    .filter((i) => i >= 0);
-  return {
-    distance: gpxData.distance,
-    elevationGain: gpxData.elevation.gain,
-    elevationLoss: gpxData.elevation.loss,
-    dayBreaks,
-    description: gpxData.description,
-  };
-}
-
 async function getGeojson(table: "routes" | "activities", id: string): Promise<string | null> {
   try {
     const db = getDb();

apps/mobile/package.json

@@ -41,7 +41,7 @@
     "@trails-cool/map-core": "workspace:*",
     "@trails-cool/sentry-config": "workspace:*",
     "@trails-cool/types": "workspace:*",
-    "expo": "~56.0.4",
+    "expo": "~56.0.9",
     "expo-constants": "~56.0.17",
     "expo-crypto": "~56.0.4",
     "expo-dev-client": "~56.0.19",
@@ -62,10 +62,10 @@
     "react": "catalog:",
     "react-native": "0.85.3",
     "react-native-gesture-handler": "^2.31.2",
-    "react-native-reanimated": "^4.4.1",
+    "react-native-reanimated": "^4.3.1",
-    "react-native-safe-area-context": "~5.8.0",
+    "react-native-safe-area-context": "~5.7.0",
     "react-native-screens": "~4.25.2",
-    "react-native-worklets": "0.9.1",
+    "react-native-worklets": "0.8.3",
     "use-latest-callback": "^0.3.4",
     "zod": "^4.4.3"
   },

e2e/auth.test.ts

@@ -1,50 +1,5 @@
 import { test, expect, waitForHydration, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, removeVirtualAuthenticator, submitRegistration, logout } from "./helpers/auth";
-// Virtual authenticator helpers
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function removeVirtualAuthenticator(cdp: CDPSession, authenticatorId: string) {
-  await cdp.send("WebAuthn.removeVirtualAuthenticator", { authenticatorId });
-  await cdp.send("WebAuthn.disable");
-}
-
-async function registerUser(page: Page, email: string, username: string) {
-  await page.goto("/auth/register");
-  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
-  await waitForHydration(page);
-  await page.getByLabel("Email").click();
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").click();
-  await page.getByLabel("Username").fill(username);
-  // Verify both fields retained values before submitting
-  await expect(page.getByLabel("Email")).toHaveValue(email);
-  await expect(page.getByLabel("Username")).toHaveValue(username);
-  // Accept the Terms of Service (required)
-  await page.getByRole("checkbox").check();
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-}
-
-async function logout(page: Page, accountLabel: string) {
-  // The account cluster lives inside an avatar dropdown now. Click the
-  // avatar (its aria-label is displayName || username), then click the
-  // Log Out menuitem inside the popup.
-  await waitForHydration(page);
-  await page.getByRole("navigation").getByRole("button", { name: accountLabel }).click();
-  await page.getByRole("menuitem", { name: "Log Out" }).click();
-  await expect(page.getByRole("navigation").getByRole("link", { name: "Sign In" })).toBeVisible({ timeout: 5000 });
-}
 
 test.describe("Passkey Authentication", () => {
   test("register with passkey and sign in", async ({ page }) => {
@@ -55,7 +10,7 @@ test.describe("Passkey Authentication", () => {
     const username = `testuser${Date.now()}`;
 
     // Register
-    await registerUser(page, email, username);
+    await submitRegistration(page, email, username);
     await expect(page).toHaveURL("/", { timeout: 10000 });
     // The avatar button's aria-label is the displayName or username;
     // for a freshly-registered user with no displayName set, that's
@@ -95,12 +50,12 @@ test.describe("Passkey Authentication", () => {
     const firstUsername = `first${Date.now()}`;
 
     // Register first user
-    await registerUser(page, email, firstUsername);
+    await submitRegistration(page, email, firstUsername);
     await expect(page).toHaveURL("/", { timeout: 10000 });
     await logout(page, firstUsername);
 
     // Try to register with same email
-    await registerUser(page, email, `second${Date.now()}`);
+    await submitRegistration(page, email, `second${Date.now()}`);
     await expect(page.getByText(/already in use/i)).toBeVisible({ timeout: 10000 });
 
     await removeVirtualAuthenticator(cdp, authenticatorId);
@@ -113,12 +68,12 @@ test.describe("Passkey Authentication", () => {
     const username = `uniq${Date.now()}`;
 
     // Register first user
-    await registerUser(page, `first-${Date.now()}@example.com`, username);
+    await submitRegistration(page, `first-${Date.now()}@example.com`, username);
     await expect(page).toHaveURL("/", { timeout: 10000 });
     await logout(page, username);
 
     // Try to register with same username
-    await registerUser(page, `second-${Date.now()}@example.com`, username);
+    await submitRegistration(page, `second-${Date.now()}@example.com`, username);
     await expect(page.getByText(/already taken/i)).toBeVisible({ timeout: 10000 });
 
     await removeVirtualAuthenticator(cdp, authenticatorId);

e2e/explore.test.ts

@@ -1,29 +1,5 @@
 import { test, expect, waitForHydration, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, registerUser } from "./helpers/auth";
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function registerUser(page: Page, email: string, username: string) {
-  await page.goto("/auth/register");
-  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
-  await waitForHydration(page);
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").fill(username);
-  await page.getByRole("checkbox").check();
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-  await expect(page).toHaveURL("/", { timeout: 10000 });
-}
 
 async function setProfileVisibility(page: Page, value: "public" | "private") {
   await page.goto("/settings");

e2e/helpers/auth.ts

@@ -0,0 +1,84 @@
+// Shared auth helpers for journal specs. These were previously
+// copy-pasted per spec file and had already drifted (the auth spec's
+// registerUser lost the final URL assertion the other copies had, and
+// the settings spec's variant skipped hydration and the Terms
+// checkbox). One canonical copy lives here.
+
+import { expect, waitForHydration, type CDPSession, type Page } from "../fixtures/test";
+
+export async function setupVirtualAuthenticator(cdp: CDPSession): Promise<string> {
+  await cdp.send("WebAuthn.enable");
+  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
+    options: {
+      protocol: "ctap2",
+      transport: "internal",
+      hasResidentKey: true,
+      hasUserVerification: true,
+      isUserVerified: true,
+    },
+  });
+  return authenticatorId;
+}
+
+export async function removeVirtualAuthenticator(
+  cdp: CDPSession,
+  authenticatorId: string,
+): Promise<void> {
+  await cdp.send("WebAuthn.removeVirtualAuthenticator", { authenticatorId });
+  await cdp.send("WebAuthn.disable");
+}
+
+/**
+ * Fill and submit the registration form (passkey + Terms acceptance).
+ * Makes no assertion about the outcome — use this directly for
+ * expected-failure attempts (duplicate email/username), and
+ * registerUser for the success path.
+ */
+export async function submitRegistration(
+  page: Page,
+  email: string,
+  username: string,
+): Promise<void> {
+  await page.goto("/auth/register");
+  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
+  await waitForHydration(page);
+  await page.getByLabel("Email").click();
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Username").click();
+  await page.getByLabel("Username").fill(username);
+  // Verify both fields retained values before submitting
+  await expect(page.getByLabel("Email")).toHaveValue(email);
+  await expect(page.getByLabel("Username")).toHaveValue(username);
+  // Accept the Terms of Service (required)
+  await page.getByRole("checkbox").check();
+  await page.getByRole("button", { name: /Register with Passkey/ }).click();
+}
+
+/** Register a user with a passkey and wait for the signed-in redirect. */
+export async function registerUser(page: Page, email: string, username: string): Promise<void> {
+  await submitRegistration(page, email, username);
+  await expect(page).toHaveURL("/", { timeout: 10000 });
+}
+
+/** Register a throwaway user with unique credentials derived from `prefix`. */
+export async function registerFreshUser(
+  page: Page,
+  prefix: string,
+): Promise<{ email: string; username: string }> {
+  const email = `${prefix}-${Date.now()}@example.com`;
+  const username = `${prefix}${Date.now()}`;
+  await registerUser(page, email, username);
+  return { email, username };
+}
+
+export async function logout(page: Page, accountLabel: string): Promise<void> {
+  // The account cluster lives inside an avatar dropdown. Click the
+  // avatar (its aria-label is displayName || username), then click the
+  // Log Out menuitem inside the popup.
+  await waitForHydration(page);
+  await page.getByRole("navigation").getByRole("button", { name: accountLabel }).click();
+  await page.getByRole("menuitem", { name: "Log Out" }).click();
+  await expect(
+    page.getByRole("navigation").getByRole("link", { name: "Sign In" }),
+  ).toBeVisible({ timeout: 5000 });
+}

e2e/helpers/journal.ts

@@ -0,0 +1,39 @@
+// Shared journal-side constants and seed helpers. The /api/e2e/*
+// endpoints only exist when the journal runs with E2E=true.
+
+import type { APIRequestContext } from "@playwright/test";
+import { expect } from "../fixtures/test";
+
+export const JOURNAL = "http://localhost:3000";
+export const PLANNER = "http://localhost:3001";
+
+/** Mint a route + single-use callback JWT via /api/e2e/seed. */
+export async function seedRoute(
+  request: APIRequestContext,
+): Promise<{ routeId: string; token: string }> {
+  const resp = await request.post(`${JOURNAL}/api/e2e/seed`);
+  expect(resp.ok(), "POST /api/e2e/seed failed — is the journal running with E2E=true?").toBeTruthy();
+  return (await resp.json()) as { routeId: string; token: string };
+}
+
+/** Whether the route has PostGIS geometry stored (via /api/e2e/route/:id). */
+export async function routeHasGeom(
+  request: APIRequestContext,
+  routeId: string,
+): Promise<boolean> {
+  const resp = await request.get(`${JOURNAL}/api/e2e/route/${routeId}`);
+  expect(resp.ok()).toBeTruthy();
+  const { hasGeom } = (await resp.json()) as { hasGeom: boolean };
+  return hasGeom;
+}
+
+/** Seeds a Komoot connection for the e2e test user; returns the session cookie. */
+export async function seedKomootConnection(
+  request: APIRequestContext,
+  mode: "public" | "authenticated" = "public",
+): Promise<{ cookie: string }> {
+  const resp = await request.post(`${JOURNAL}/api/e2e/komoot`, { data: { mode } });
+  if (!resp.ok()) throw new Error(`komoot seed failed: ${resp.status()}`);
+  const cookie = resp.headers()["set-cookie"];
+  return { cookie };
+}

e2e/integration.test.ts

@@ -1,4 +1,5 @@
 import { test, expect } from "./fixtures/test";
+import { JOURNAL, PLANNER, seedRoute, routeHasGeom } from "./helpers/journal";
 
 /**
  * Integration tests that require the full dev stack:
@@ -9,8 +10,6 @@ import { test, expect } from "./fixtures/test";
  * Locally, run `pnpm dev:full` first (with E2E=true for the callback tests).
  */
 
-const JOURNAL = "http://localhost:3000";
-const PLANNER = "http://localhost:3001";
 
 const VALID_GPX = `<?xml version="1.0" encoding="UTF-8"?>
 <gpx version="1.1" xmlns="http://www.topografix.com/GPX/1/1">
@@ -30,9 +29,7 @@ const ONE_POINT_GPX = `<?xml version="1.0" encoding="UTF-8"?>
 
 test.describe("Integration: Planner callback → geometry stored", () => {
   test("valid GPX stores geometry atomically", async ({ request }) => {
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId, token } = await seedRoute(request);
-    expect(seedResp.ok()).toBeTruthy();
-    const { routeId, token } = await seedResp.json() as { routeId: string; token: string };
 
     const callbackResp = await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
       headers: { Authorization: `Bearer ${token}` },
@@ -40,14 +37,11 @@ test.describe("Integration: Planner callback → geometry stored", () => {
     });
     expect(callbackResp.status()).toBe(200);
 
-    const geomResp = await request.get(`${JOURNAL}/api/e2e/route/${routeId}`);
+    expect(await routeHasGeom(request, routeId)).toBe(true);
-    const { hasGeom } = await geomResp.json() as { hasGeom: boolean };
-    expect(hasGeom).toBe(true);
   });
 
   test("invalid GPX returns 400 and does not store geometry", async ({ request }) => {
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId, token } = await seedRoute(request);
-    const { routeId, token } = await seedResp.json() as { routeId: string; token: string };
 
     const callbackResp = await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
       headers: { Authorization: `Bearer ${token}` },
@@ -57,14 +51,11 @@ test.describe("Integration: Planner callback → geometry stored", () => {
     const body = await callbackResp.json() as { error: string };
     expect(body.error).toMatch(/at least 2 track points/);
 
-    const geomResp = await request.get(`${JOURNAL}/api/e2e/route/${routeId}`);
+    expect(await routeHasGeom(request, routeId)).toBe(false);
-    const { hasGeom } = await geomResp.json() as { hasGeom: boolean };
-    expect(hasGeom).toBe(false);
   });
 
   test("missing token returns 401", async ({ request }) => {
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId } = await seedRoute(request);
-    const { routeId } = await seedResp.json() as { routeId: string };
 
     const resp = await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
       data: { gpx: VALID_GPX },
@@ -73,8 +64,7 @@ test.describe("Integration: Planner callback → geometry stored", () => {
   });
 
   test("token is single-use — second submit is rejected (Phase B replay guard)", async ({ request }) => {
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId, token } = await seedRoute(request);
-    const { routeId, token } = await seedResp.json() as { routeId: string; token: string };
 
     // First save succeeds.
     const first = await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
@@ -163,9 +153,7 @@ test.describe("Integration: POI metadata roundtrip", () => {
   </trkseg></trk>
 </gpx>`;
 
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId, token } = await seedRoute(request);
-    expect(seedResp.ok()).toBeTruthy();
-    const { routeId, token } = await seedResp.json() as { routeId: string; token: string };
 
     const callbackResp = await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
       headers: { Authorization: `Bearer ${token}` },
@@ -182,8 +170,7 @@ test.describe("Integration: POI metadata roundtrip", () => {
   });
 
   test("GPX without POI extensions shows no waypoints section", async ({ page, request }) => {
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+    const { routeId, token } = await seedRoute(request);
-    const { routeId, token } = await seedResp.json() as { routeId: string; token: string };
     await request.post(`${JOURNAL}/api/routes/${routeId}/callback`, {
       headers: { Authorization: `Bearer ${token}` },
       data: { gpx: VALID_GPX },

e2e/journal-planner-save.test.ts

@@ -17,10 +17,9 @@
 // computes a route and the Save button has GPX to ship.
 
 import { test, expect } from "./fixtures/test";
+import { JOURNAL, PLANNER, seedRoute, routeHasGeom } from "./helpers/journal";
 import { mockBRouter } from "./fixtures/brouter-mock";
 
-const JOURNAL = "http://localhost:3000";
-const PLANNER = "http://localhost:3001";
 
 // Mock BRouter so the in-browser route compute is deterministic and
 // fast — same approach as `planner-coloring.test.ts`. Without this the
@@ -35,9 +34,7 @@ const WAYPOINTS = encodeURIComponent(JSON.stringify([
 ]));
 
 async function seedRouteAndPlannerSession(request: import("@playwright/test").APIRequestContext) {
-  const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
+  const { routeId, token } = await seedRoute(request);
-  expect(seedResp.ok()).toBeTruthy();
-  const { routeId, token } = (await seedResp.json()) as { routeId: string; token: string };
 
   // Create a planner session with the journal callback wired up — no
   // GPX seeded into the session itself. We pass waypoints via URL
@@ -85,9 +82,7 @@ test.describe("Journal ↔ Planner save handoff (Phase A + B)", () => {
     expect(observed.some((s) => s.includes(token))).toBe(false);
 
     // Sanity: the journal's route now has geometry.
-    const geomResp = await request.get(`${JOURNAL}/api/e2e/route/${routeId}`);
+    expect(await routeHasGeom(request, routeId)).toBe(true);
-    const { hasGeom } = (await geomResp.json()) as { hasGeom: boolean };
-    expect(hasGeom).toBe(true);
   });
 
   test("token is single-use — second save through the planner UI fails", async ({ page, request }) => {

e2e/komoot-import.test.ts

@@ -1,8 +1,8 @@
 import { test, expect } from "./fixtures/test";
+import { JOURNAL, seedKomootConnection, seedRoute } from "./helpers/journal";
 
 // Fixed test data — the e2e seed endpoint creates a stable user + Komoot connection
 const KOMOOT_USER_ID = "99999999999";
-const JOURNAL = "http://localhost:3000";
 
 const SAMPLE_GPX = `<?xml version="1.0" encoding="UTF-8"?>
 <gpx version="1.1" creator="komoot" xmlns="http://www.topografix.com/GPX/1/1">
@@ -34,19 +34,6 @@ const MOCK_TOURS_RESPONSE = {
   page: { totalPages: 1, number: 0 },
 };
 
-// Seeds a Komoot connection for the e2e test user and returns a session cookie.
-async function seedKomootConnection(
-  request: import("@playwright/test").APIRequestContext,
-  mode: "public" | "authenticated" = "public",
-) {
-  const resp = await request.post(`${JOURNAL}/api/e2e/komoot`, {
-    data: { mode },
-  });
-  if (!resp.ok()) throw new Error(`komoot seed failed: ${resp.status()}`);
-  const cookie = resp.headers()["set-cookie"];
-  return { cookie };
-}
-
 test.describe("Komoot connection page", () => {
   test("unauthenticated user is redirected to login", async ({ page }) => {
     await page.goto("/settings/connections/komoot");
@@ -105,10 +92,8 @@ test.describe("Komoot import page", () => {
   test.setTimeout(60000);
 
   test("redirects to connect page when not connected", async ({ page, request }) => {
-    // Seed user without Komoot connection (use seed endpoint to just get a session)
-    const seedResp = await request.post(`${JOURNAL}/api/e2e/seed`);
-    const data = await seedResp.json() as { routeId: string; token: string };
     // We only need the session — navigate to import page unauthenticated redirects to login
+    await seedRoute(request);
     await page.goto("/sync/import/komoot");
     await expect(page).toHaveURL(/\/auth\/login|\/settings\/connections\/komoot/, { timeout: 5000 });
   });

e2e/notifications.test.ts

@@ -1,29 +1,5 @@
 import { test, expect, waitForHydration, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, registerUser } from "./helpers/auth";
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function registerUser(page: Page, email: string, username: string) {
-  await page.goto("/auth/register");
-  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
-  await waitForHydration(page);
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").fill(username);
-  await page.getByRole("checkbox").check();
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-  await expect(page).toHaveURL("/", { timeout: 10000 });
-}
 
 async function setProfileVisibility(page: Page, value: "public" | "private") {
   await page.goto("/settings");

e2e/public-content.test.ts

@@ -1,31 +1,5 @@
 import { test, expect, waitForHydration, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, registerUser } from "./helpers/auth";
-// Reuses the virtual-authenticator + register helpers from auth.test.ts.
-// Inlined rather than factored out to keep this file independently runnable.
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function registerUser(page: Page, email: string, username: string) {
-  await page.goto("/auth/register");
-  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
-  await waitForHydration(page);
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").fill(username);
-  await page.getByRole("checkbox").check();
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-  await expect(page).toHaveURL("/", { timeout: 10000 });
-}
 
 async function createRoute(page: Page, name: string): Promise<string> {
   await page.goto("/routes/new");

e2e/settings.test.ts

@@ -1,36 +1,5 @@
 import { test, expect, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, removeVirtualAuthenticator, registerFreshUser } from "./helpers/auth";
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function removeVirtualAuthenticator(cdp: CDPSession, authenticatorId: string) {
-  await cdp.send("WebAuthn.removeVirtualAuthenticator", { authenticatorId });
-  await cdp.send("WebAuthn.disable");
-}
-
-async function registerAndLogin(page: Page, cdp: CDPSession) {
-  const email = `settings-${Date.now()}@example.com`;
-  const username = `settingsuser${Date.now()}`;
-
-  await page.goto("/auth/register");
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").fill(username);
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-  await expect(page).toHaveURL("/", { timeout: 10000 });
-
-  return { email, username };
-}
 
 test.describe("Account Settings", () => {
   test("unauthenticated user is redirected to login", async ({ page }) => {
@@ -41,7 +10,7 @@ test.describe("Account Settings", () => {
   test("settings page loads for authenticated user", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    await registerAndLogin(page, cdp);
+    await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
     await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
@@ -55,7 +24,7 @@ test.describe("Account Settings", () => {
   test("update display name and bio", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    const { username } = await registerAndLogin(page, cdp);
+    const { username } = await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
 
@@ -79,7 +48,7 @@ test.describe("Account Settings", () => {
   test("passkey list shows registered passkey", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    await registerAndLogin(page, cdp);
+    await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
     // Should show the passkey registered during registration
@@ -92,7 +61,7 @@ test.describe("Account Settings", () => {
   test("add and delete passkey from settings", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    await registerAndLogin(page, cdp);
+    await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
 
@@ -119,7 +88,7 @@ test.describe("Account Settings", () => {
   test("delete last passkey shows warning", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    await registerAndLogin(page, cdp);
+    await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
 
@@ -142,7 +111,7 @@ test.describe("Account Settings", () => {
   test("settings link reachable from nav when logged in", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    const { username } = await registerAndLogin(page, cdp);
+    const { username } = await registerFreshUser(page, "settings");
 
     // Settings now lives inside the avatar dropdown; opening the
     // dropdown reveals the menuitem.
@@ -161,7 +130,7 @@ test.describe("Account Settings", () => {
   test("account deletion requires correct username", async ({ page }) => {
     const cdp = await page.context().newCDPSession(page);
     const authenticatorId = await setupVirtualAuthenticator(cdp);
-    const { username } = await registerAndLogin(page, cdp);
+    const { username } = await registerFreshUser(page, "settings");
 
     await page.goto("/settings");
 

e2e/social.test.ts

@@ -1,31 +1,5 @@
 import { test, expect, waitForHydration, type CDPSession, type Page } from "./fixtures/test";
-
+import { setupVirtualAuthenticator, registerUser } from "./helpers/auth";
-// Inline virtual-authenticator + register helpers, mirroring the pattern
-// in auth.test.ts / public-content.test.ts so this file runs standalone.
-async function setupVirtualAuthenticator(cdp: CDPSession) {
-  await cdp.send("WebAuthn.enable");
-  const { authenticatorId } = await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-  return authenticatorId;
-}
-
-async function registerUser(page: Page, email: string, username: string) {
-  await page.goto("/auth/register");
-  await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
-  await waitForHydration(page);
-  await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Username").fill(username);
-  await page.getByRole("checkbox").check();
-  await page.getByRole("button", { name: /Register with Passkey/ }).click();
-  await expect(page).toHaveURL("/", { timeout: 10000 });
-}
 
 async function setProfileVisibility(page: Page, value: "public" | "private") {
   await page.goto("/settings");

playwright.config.ts

@@ -14,6 +14,9 @@ export default defineConfig({
     trace: "on-first-retry",
     screenshot: "only-on-failure",
   },
+  // NOTE: specs only run if a project below matches them — a new
+  // e2e/*.test.ts file MUST be registered here or it silently never
+  // executes (settings/explore/social sat unregistered for months).
   projects: [
     {
       name: "journal",