A conflict replay collapsed every step into one edit, so a closed tab's
adopted step lost `yields` after the first conflict and a second one
replayed its old position over a newer one. Its steps now stay as they
are, and only this page's own collapse into one edit on top of them.
The move combines recently viewed items one per item, keeping the newest
view and its artwork, then newest first; before, the server's older copy
of an item won over a later browser view.
A failed sign-in clears the stored token only on a 401: a network
failure says nothing about the token, and another tab may have stored
the same one meanwhile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A sign-in that fails clears the token only while it is still the one
this attempt stored: another tab that signed in meanwhile keeps its
valid token.
The move orders the combined Xtream recent items by viewedAt, newest
first, as the app keeps them: browser views appended after the server's
history were cut by the next view once the server held 50.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PwaService joins paths to the backend URL without its trailing slashes,
so BACKEND_URL=/ no longer yields a protocol-relative //… URL that names
another host, and it attaches the server token only when the request URL
resolves to the backend (isBackendUrl), like the interceptor.
The move's item key adds the Stalker series flag to id and category: a
provider category can hold a movie and a series of one id, and the
series favorite was dropped as a duplicate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The access token is stored with the instance id it was given for, and a
page reads it only for its own instance: a tab still open on the old
backend after BACKEND_URL changed no longer sends the new server's
token there. The API client hands every 401 to reportAccessDenied(),
which now also sends a page without a token for its instance to sign-in,
while one that holds its token back until the instance is checked keeps
it.
A closed tab's adopted edits carry `yields`: replayed, they change only
what is still as that tab saw it, so they never replace progress this
tab or another device saved since. The flag survives the journal.
The sync spec's fake server and memory storage move to a test-helpers
file to keep the spec under its line limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A page started from memory (startedOffline) withholds the token until the
instance is verified, so sign-in on that page sent no token and the
server's 401 cleared the right one. Sign-in now first calls
ServerStorageSession.ensureVerified(): it reads /instance without a
token, marks the status verified when the instance id matches, and
reloads the page when another server answers at the address.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ServerStorageStatusService.accessToken() returns the stored token only
while server mode runs on an instance this start verified. The API
client, the HttpClient interceptor and PwaService's raw fetch calls use
it, so after an offline start from a remembered instance no request
(including the /instance reachability check) carries the token to
whatever answers at that address, and a 401 then does not clear it.
- Sign-in remembers the server along with the token; when storage refuses
either, it reports SIGN_IN_STORAGE instead of reloading into a start
that would drop the token.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A server that answers as another backend URL or instance id than the
remembered one makes the browser forget the stored token, so server A's
token never reaches server B.
- The session installs its page-hide and heartbeat listeners before it
returns for sign-in, so a page holding another page load's writes still
marks itself closed on unload.
- Closed tabs are found by stale records only again: saved writes without
a record may belong to a running tab whose record storage refused, and
are left to that tab's own reload.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The unconfirmed-writes registry stores each page load's record under
its own key (iptvnator-server:unconfirmed:<instance>:<page>), listed
through a new keys() on the user-data storage adapter, so tabs never
overwrite each other's records. Saved writes without a fresh record,
also when the record was lost, are adopted as a closed tab's (#1920).
- PwaService sends the stored server token on its raw fetch calls only
while server mode runs, and a backend that answers without server
storage makes the browser forget the token.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- PlaylistEffects.setFavorites$ applies the drag's order through
transformPlaylistFavorites (reorderFavorites): favorites added on another
device stay, ones removed there stay out.
- The remembered server matches the backend URL by origin and path
without trailing slashes, so /api and /api/ start offline in server
mode alike.
- Maps keyed by playlist id are built without a prototype (idMap), so an
id such as __proto__ is an ordinary key in the cache, conflict replays,
re-reads and tags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(search): one 300 ms debounce between typing and the global search query
Typing in the header search box waited twice before a query ran: 350 ms in
the workspace shell (SEARCH_INPUT_DEBOUNCE_MS), then another 300 ms in
SearchResultsComponent. On J4 (large catalog, "system") the query and first
page take 30-40 ms; about 650 ms of the ~690 ms from the last key to settled
results was waiting.
The results component now searches as soon as the applied term reaches the
store, and the shell debounce is the only one, lowered to 300 ms: above the
gap between keys of steady typing, so a word typed in one go still queries
once. Superseded queries are dropped by the existing request versions. The
component's route sync reads the store term untracked, so a term the shell
applied before writing q is not pushed back to the stale q and re-queried.
J4 locally (3 runs per build): lastKeystrokeToSettledMs P50 692-695 ms ->
336-337 ms, ipcCallsPerSearch 1 and sqlStatementsPerSearch 2 unchanged. At
400 ms per key both builds run five queries; only typing with 300-350 ms
gaps queries per key where it did not before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(journeys): enforce J4 ipcCallsPerSearch 1 and sqlStatementsPerSearch 2
Both counters were identical in all 816 J4 iterations of the 136 CI journey
jobs since #1816 and in all 18 iterations of three runner runs of this PR
(run 38165392046, attempts 1-3). They guard the single debounce: a search
that queries per keystroke or twice for one term raises them. Guard-only
note, since the wall-clock gain came without moving them. Added to the
Performance journeys --only list; the direction check reports 2 added,
nothing weakened.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(search): run a prefilled in-portal search again once the catalog has loaded
Review follow-up on #1899 (Greptile P1). Without the results component's
300 ms timer, an in-portal search applied while the portal's catalog is still
loading (a reload or deep link with q) runs against the incomplete catalog,
and nothing re-ran it afterwards. The old timer only helped when loading
finished within 300 ms. The component now runs the current in-portal search
once more when nothing of the catalog is loading or importing any more, the
readiness the Discover route already uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(search): one search effect for a new term and the loaded catalog
Review follow-up on #1899 (Greptile). With separate effects, a term and the
end of catalog loading arriving in the same flush each ran executeSearch for
the same term: the request version dropped the first answer, but the
catalog scan or desktop search still ran twice. One effect now tracks both
triggers and searches once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
PUT /v1/user-state/:namespace/:playlistId answers 404 playlist_missing
when the server has no such playlist, so an edit queued on another device
(including its conflict replay with If-None-Match: *) cannot recreate the
state of a playlist deleted meanwhile. The client drops such an edit and
its cache entry instead of retrying; page-hide writes report it as gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A served copy carries the version it came from (a symbol property that
spreads keep and JSON drops), so a mutation of a portal document names
the version it was built on, not the latest read.
- A 401 for a token replaced since (a new sign-in) neither clears the new
token nor reports unauthorized, in the API client, the HttpClient
interceptor and PwaService's proxy calls.
- Moving browser data counts a browser user-data map that cannot be read
as a failure, so the move stays on offer.
- An edit made before the first read on top of this tab's recovered
unsent write is applied to that write, not to the server's value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clearing an optional playlist field (User-Agent, Referrer, Origin,
credentials, EPG URL lists, file path) did not persist in Electron: the
codec maps an empty value to `undefined`, `ON CONFLICT DO UPDATE` skips
undefined keys, and `parseAppPlaylist` prefers the stale column over the
updated payload, so the old value came back on the next read.
`playlistConflictUpdate` now sets every optional column the document
leaves empty to NULL, so both desktop upserts (`DB_UPSERT_APP_PLAYLIST`
and `DB_UPSERT_APP_PLAYLISTS`) replace the stored row. The cleared-columns
list moves from the web backend's playlist repository into the shared
conflict module, and the server now uses the shared version.
`date_created`, `name`, `type`, `autoRefresh`, `payload` and `last_usage`
are never cleared.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(m3u): keep groups hidden in Manage groups after a restart (#1894)
Electron fills the playlist store from DB_GET_APP_PLAYLIST_METAS, which
reads the metadata columns only. hiddenGroupTitles lives only in the JSON
payload, so after a restart the store had none and the groups rail showed
every group, although SQLite still held the saved selection; saving the
dialog from that state then overwrote it.
M3uWorkspaceRouteSession already reads the full playlist to publish its
channels and favorites. It now copies hiddenGroupTitles from that read into
the store (updatePlaylistMeta, persist: false) before the channels, unless
the store value changed while the read was queued behind a save.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(m3u): wait for the playlist entity before hydrating hidden groups
The startup inventory publishes playlists only after settings and EPG
reconciliation, while a restored or deep-linked playlist route waits for
the metadata read alone. The route session's full read could therefore
finish first, and updateOne dropped the hydration for the missing entity
for the whole session. The hydration now waits for the entity.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(m3u): cover hidden groups when the Groups route opens before the inventory
An Electron E2E reloads the renderer on the Groups route while the startup
inventory is held (the EPG reconcile fails once and its retry is parked),
and records from document start whether a hidden group is ever rendered
visibly. It fails on the previous hydration that did not wait for the
playlist entity. A service test pins that getPlaylist reads hidden groups
from a meta update that is still being written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(m3u): type empty hidden-group arrays in the route session spec
The CI spec typecheck (apps/web/tsconfig.spec.json) rejected `[]` inferred
as never[] inside the PlaylistMeta and Playlist casts with TS2352.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A favorite or rename (keepPayload PUT) is sent with If-Match on the
version it was read at. The server answers 412 when another device wrote
since; the store throws PlaylistWriteConflict and PlaylistsService's
per-playlist write queue runs the mutation again, which reads the
playlist afresh, so two devices' metadata edits both survive. A retry on
the same unread copy writes unconditionally, as before; refresh and
import writes stay last write wins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The 30 s retry also re-reads and flushes while online when the first
user-data read failed or writes the server refused (a 5xx) are queued;
the same failure notice shows at most every five minutes.
- Moving browser data adds a legacy snapshot alias only where no typed
snapshot exists, so a newer typed copy is not overwritten.
- writeServerAccessToken reports whether storage kept the token; the
sign-in page says so (SERVER_STORAGE.SIGN_IN_STORAGE, 19 locales)
instead of calling a right token rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(playback): resume an episode whose connection drops instead of skipping it (#1902)
Embedded MPV sessions run with keep-open, so a provider that closes the
connection mid-episode (and refuses ffmpeg's own reconnect) reaches the app
as eof-reached: status `ended` at the drop position. The reconnect policy
counted `ended` as a loss only for live playback, so on VOD it stood for
the end of the file and series autoplay started the next episode.
- The reconnect policy now treats a VOD `ended` with more than
max(10 s, 1 % of the duration) left as a dropped connection and reloads
it at the last position. A reload that ends again before getting 5 s past
where it resumed proves the file ends there (bitrate-estimated duration),
so it is left as the end and autoplay continues after one attempt.
- The service passes the snapshot duration to the policy.
- The player emits playbackEnded only for an `ended` session without a
pending reconnect.
- Xtream mock: `streamdrop` scenario whose episodes drop a third of the way
into a local 60 s clip and refuse the retry for 4 s; Electron E2E covers
the native-view engine (skips without an Embedded MPV runtime).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(playback): keep the early-EOF retry on a refused reload or after a seek
The resume point that tells a reload ending where it resumed from a new
drop was recorded before the reload ran, so a reload the addon refused made
the original EOF look like the end and the next poll cancelled the retry.
Record it only once the reload started, and forget it when the user seeks:
an EOF after a seek is judged on its position alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(e2e): fail the stream-drop resume check when the reload restarts the episode
A reload that started the episode over would also reach the 25 s mark
within the timeout, since the mock drops each episode only once. Every
position played after the drop must now stay within 3 s of it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- A queued write keeps its edits as steps: an edit continuing the last one
joins it, one made behind a travelling write or on another tab's change
stays apart, and a conflict replays them in order. Saved writes and
early edits store the steps too.
- The instance probe treats any refusal but 404 (a proxy's 429 or 403) as
unreachable, so a browser keeps its remembered server.
- Cache reads that browser storage refuses fall back to memory, so a
re-read and later edits still work.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- User-state entries carry a content tag; PUT/DELETE accept If-Match or
If-None-Match: * and answer 412 with the current value and tag. The PWA
sends each edit on the tag it read and replays it (before → after) on
the server's value after a conflict, so another device's change to the
same playlist's favorites or positions is kept instead of overwritten.
- The access token goes only to the backend URL (same origin and path),
never to another host or a sibling path.
- Deleting a playlist (or all) first drops its queued user-data edits and
waits for writes in flight, so none recreates deleted data.
- The migration copy writes on the tags it read.
- The write queue moves out of ServerUserDataStorage into
UserDataWriteQueue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(e2e): wait for the persisted Xtream import status, not only the overlay
waitForXtreamImportToFinish gave the loading overlay 5 s to appear and then
treated "no overlay" as finished. The overlay appears only once the portal's
account check answers; a freshly started mock generates the large catalog on
that first request, so J4's seed sometimes closed the app while the series
import was still running. The template then had no series rows, and J4's
query for "system" (series titles only) returned an empty list on the first
launch after seeding.
On an Xtream route the wait now also requires the import status the app
persists to read completed for live, movie and series. The new
xtream-import-wait.e2e.ts holds get_account_info past the overlay window and
fails without the fix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(e2e): judge the Xtream catalog complete the way the app does
Review follow-ups on #1897:
- A refresh deletes the catalog and re-imports it without resetting the
persisted import statuses, so `completed` alone proves nothing after one.
A type now counts as imported when its status reads completed and it has
rows, the same rule the app uses before reusing its cache; a type without
categories (a live-only panel) counts by status, and a portal without any
category is not imported yet. A second spec refreshes a portal behind the
slowed account check. Today the refresh keeps its preparation overlay up
across that check, so it passes with the earlier wait as well; it guards
the helper's contract.
- The proxy is closed in its own finally, so a failed launch or close no
longer leaves it listening.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- Before the first user-data read finishes, an edit is compared with the
cache, so it sends only its own playlist entry.
- Queued entries carry their edit number; a failed write is retried only
when nothing newer replaced it.
- Moving M3U favorites and history translates channel ids through the
stream URL (ids are random per import).
- The server-storage E2E runs in Chromium only: one shared database.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Moving Stalker favorites and history keys items by id and category, so
a channel and a movie with one id both survive.
- Writes after a page-hide flush wait for its keepalive requests.
- A probe whose body is cut off counts as unreachable and keeps the
remembered server.
- Settings → Server renders without @defer so settings search can reveal
its rows on the first visit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Moved playback positions are matched by content type and Xtream id and
name the server playlist.
- Page-hide writes report whether the server took them; refused ones go
back into the queue. Re-reads run one at a time.
- The access guard's 401 carries WWW-Authenticate: Bearer
realm="iptvnator"; the interceptor and PwaService's raw fetches turn it
into sign-in, so a token changed on the server is noticed on provider
calls too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A merged playlist gains the browser document's favorites and history;
Xtream values for one server entry are combined (lists unioned, maps
merged, the server winning conflicts) and written once.
- A failed user-data write stays queued and survives a re-read; the
page-hide flush waits for a batch still travelling.
- The start-up screen lets the sign-in route through whatever its check
reports.
- The backend refuses IPTVNATOR_ACCESS_TOKEN without server storage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Moving browser playlists matches them to the server's by id or source and
carries the legacy Xtream maps under the server id; it no longer goes
through the backup format, whose PWA export has no Xtream user data. A
partial move stays on offer.
- User-data batches go out in order, and a re-read keeps entries edited
while it was in flight.
- A keepPayload write keeps its cached copy only when the server replaced
the version its payload came from (new X-Replaced-ETag header).
- 502/503/504 from the proxy count as offline.
- The start-up screen lets the sign-in page through while a token is
required.
- Settings → Server offers a reload after a move.
- The probe detects Electron through RuntimeCapabilitiesService.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed start-up probe used to fall back to browser mode, which showed an
empty library while the backend restarted and let new playlists land in the
browser. The browser now remembers the server; without an answer it starts
in server mode, offline, and reloads once the server is back. Settings →
Server shows the backend address instead of the page's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(interfaces): add the server storage HTTP contract
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): read server storage configuration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): open the server database and track revisions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): playlist and user-state repositories
Playlist documents use the shared desktop row codec, so the server writes
the same rows. keepPayload upserts take the stored playlist/items/header
fields when the client leaves them out. Xtream user data lives in the
server-only server_user_state table, one JSON value per namespace and
playlist.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): storage error mapping and access token guard
Storage errors map to JSON status bodies and are logged by name and code
only. An optional bearer token guards every route except /, /health,
/config.js and /v1/instance, provider proxy routes included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): serve the /v1 server storage API
/v1/instance is always public and reports whether server storage is on.
With storage, /v1/playlists serves whole documents with ETags and 304s,
accepts keepPayload upserts, and deletes playlists with their user state;
/v1/user-state and /v1/app-state store the rest. The proxy routes are
unchanged unless an access token is configured.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): open server storage on start and close on shutdown
With IPTVNATOR_STORAGE=server, main.ts opens the database before it
listens and exits with a clear message when the data directory is not
writable. SIGTERM and SIGINT close the server and the database. The
native better-sqlite3 module stays outside the esbuild bundle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): match weakened ETags on playlist reads
nginx weakens the ETag of a gzipped response, and clients send the weak
form back in If-None-Match. The route now compares tags weakly, as RFC 9110
requires for GET, so it answers 304 before reading the document.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(docker): persist server storage on a volume
The image builds better-sqlite3 in a native stage per target platform,
enables server storage on the /data volume, and raises the nginx body
limit to 64 MB for /api with gzip for JSON. The compose file mounts a
named volume and documents the optional access token. The PWA does not
use the storage yet; docs say so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(web-backend): type the storage route responses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): harden server storage reads, deletes and app state
- Metadata reads return the stored document without its payload fields,
so fields that live only in the JSON survive a metadata round-trip.
- A conditional GET checks that the playlist exists before answering 304.
- Deleting a playlist and its user state commits in one transaction; the
ETag moves only after the commit.
- Browser app state is stored under a client: prefix and the instance id
is repaired when empty, so a client write cannot stop the backend.
- User-state buckets have no prototype, so ids like __proto__ round-trip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(self-hosted): keep the access token unset until the PWA sends it
Add the release note for the Docker server storage volume.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): bound shutdown and reject padded playlist ids
- SIGTERM closes idle connections at once and cuts the rest after five
seconds, so a long provider download cannot keep the backend running.
- Playlist ids with surrounding whitespace are rejected: the row codec
trims ids, so storage and ETags would track different keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): clear optional columns on whole-document upserts
The row codec maps empty values to undefined, which ON CONFLICT DO UPDATE
skips, so a cleared User-Agent, Referrer or credential kept its old column
value and came back on the next read. Server upserts now write NULL to
every replaceable column the document no longer sets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(self-hosted): linear token parsing, no-store app state, longer start
- The access guard reads the Bearer token by string scanning instead of a
regular expression that CodeQL flagged as polynomial on long whitespace.
- GET /v1/app-state/:key sends Cache-Control: no-store like the other
state routes, so devices never reuse a stale value.
- The entrypoint waits up to IPTVNATOR_BACKEND_START_TIMEOUT (300 s) for
/health, because the backend migrates its database before it listens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(self-hosted): metadata reads skip payloads, redact JSON parse warnings
List playlist metadata from a server-only payload-free copy of each
document instead of running json_remove over every payload blob, and log
only the error name when a stored JSON value fails to parse, since the
parser's message quotes the stored text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): copy carried-over panel clock into playlist metadata
When an upsert keeps the stored serverTimezone, build the metadata copy
from the saved payload so metadata and full reads agree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Every reused-instance MPV IPC command now carries a request_id and waits, within the existing 2 s bound, for mpv's matching reply; an error or missing reply falls back to a fresh launch like a socket failure, and the racing post-loadfile seek is gone. MPV launches run one at a time through a launch queue so overlapping launches never act on the same child; Stop on a queued launch delegates to the in-flight launch's own closer, a failed exit stays retryable, and the dock keeps the newest launch. Position polling and output-error reporting moved out of mpv-session.service.ts, which leaves the max-lines baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(storage): server storage design and implementation plans
Design for keeping playlists and user data on the self-hosted server
(#305), revised against master, plus three implementation plans: storage
seams, the web-backend storage API, and the PWA server mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(database): share the playlist row codec
Move buildPlaylistRow, parseAppPlaylist and the upsert conflict helpers
from the Electron database operations into libs/shared/database
(@iptvnator/shared/database/app-playlist) so the self-hosted web backend
can write the same rows. The Electron modules re-export them; behavior is
unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(database): read the data root from IPTVNATOR_DATA_DIR
Deployments that keep the database on a mounted volume, such as the
self-hosted web backend in Docker, can now set the data root. The E2E
override still wins; without either variable the root stays ~/.iptvnator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(services): add the playlist storage backend resolver
PlaylistStorageBackend becomes the single place that decides whether
playlists persist through the Electron bridge or IndexedDB, and defines
the PlaylistDocumentStore contract a server store will implement.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(services): resolve playlist storage through one backend
PlaylistsService asks PlaylistStorageBackend for its document store
instead of reading window.electron and supportsSqlite directly. Paths that
only make sense on the desktop (legacy IndexedDB import, worker deletion
with progress, the favorites-channel query) check for the Electron kind
explicitly. Behavior is unchanged: the backend still resolves to the
Electron bridge or IndexedDB.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(xtream): store PWA user data through USER_DATA_STORAGE
PwaXtreamDataSource and PwaCollectionStorage read and write favorites,
recently viewed items, collection snapshots and playback positions through
the new USER_DATA_STORAGE token (default: localStorage) instead of calling
localStorage directly, so a deployment can substitute a server-synced
storage. Behavior is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(pwa): document the storage seams
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(database): bracket access in the shared playlist codec
libs/shared/database compiles with noPropertyAccessFromIndexSignature,
which the Electron backend did not enforce on the moved code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* build(electron): alias the shared playlist codec in the worker bundle
The database worker is bundled by esbuild with an explicit alias table;
without the new entry, @iptvnator/shared/database/app-playlist resolved
under the library's index file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(services): read localStorage lazily in USER_DATA_STORAGE
When the browser denies storage access, reading localStorage itself
throws. The default factory returned the global, so injecting the token
failed and PwaXtreamDataSource could not be constructed. The adapter now
reads the global inside each call, where the data source already guards
its reads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(database): describe /data as an example data root
The Docker image does not set IPTVNATOR_DATA_DIR yet; that arrives with
the server storage backend.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Chromium drops a keyboard scroll pressed in the frame or two after the
previous smooth scroll lands but before Blink handles the compositor's
finish: ScrollAnimator retargets the finished curve
(kRunningOnCompositorButNeedsUpdate), then the late
CompositorAnimationFinished treats that state as finished and resets it.
The Live TV responsiveness spec pressed the next key as soon as an
expect.poll saw scrollTop change, so a poll that sampled the final frame
sent PageDown or Home into that window (2 of 5 local runs on master, all
three CI attempts on PR #1886).
pressScrollKey presses a scroll key and waits for that scroll's
scrollend. The Live TV spec uses it for PageDown, PageDown and Home with
the same position assertions; the VOD detail spec swaps its stable-frame
fence for it. The validation map documents the race.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): welcome screens and drop overlay follow the app theme
The welcome dashboard, the empty Sources page and the playlist drop
overlay switched on `prefers-color-scheme`, so with the app set to dark on
a light OS (or light on a dark OS) they painted the other theme's colours.
They now read `--app-*` tokens, which follow the `.dark-theme` class set
from Settings, and the hard-coded blues are derived from the selection
colour (a local "strong" accent mixed toward the heading ink keeps chips
and filled labels at 4.5:1 in both themes).
White rgba() fills that vanished in the light theme (season empty panel,
catalog refinement chips and menu divider, Xtream archive banner and
disabled paginator icons, shell download-activity track, search field)
now use the widget surface, on-surface mixes or the search tokens.
Reads of custom properties that nothing declares are fixed: the release
notes error, the search-layout empty state and the collection reload dim
now use declared tokens; unset hooks are replaced by their fallback value.
New guard `pnpm run styles:theme-references:validate` (CI) rejects
undeclared var() reads and prefers-color-scheme outside the settings
resolver. Electron E2E os-color-scheme.e2e.ts flips the OS scheme under
each explicit app theme and checks colours, contrast and screenshots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(e2e): retry the rejected-drop comparison when the card dismisses mid-read
The rejection hides itself after 1.8s, and the OS-scheme comparison reads
the overlay twice with an emulateMedia call between. A slow runner could
lose the card between the reads; the comparison now drops again until both
reads see it. A colour that follows the OS still fails every attempt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(e2e): measure welcome text contrast from rendered pixels
The feature and source cards paint gradients, which a backgroundColor
walk ignores, so card titles, descriptions and chips could pass while
falling short on the actual card. Every text on the three surfaces is now
measured against the pixels under it, as the filled button labels were.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tools): scan only runtime sources in the theme-references guard
The guard read every tracked file under apps/ and libs/ except specs, so
an E2E, mock-server or test-helper declaration could satisfy a runtime
var() read that nothing in the app declares (dashboard-rail-focus.e2e.ts
sets --cover-rail-width), and a test-only read could fail the check. It
now skips spec/test/e2e files, test helpers and stubs, testing projects,
the E2E and mock-server apps and the marketing website.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(xtream): set live paginator tokens through mat.paginator-overrides
The live layout hand-declared --mat-paginator-* tokens, which the UI
guidelines route through the overrides mixin so a mistyped name fails the
build instead of silently doing nothing. Same values, same output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tools): skip every test-only naming convention in the theme guard
The runtime scan still read .stub, .harness, .fixtures, .spec-stubs,
.spec-helpers, .spec-fixtures, test-setup and test-double sources, and
test-stubs/ or *fixtures/ directories, so a declaration in one could mask
an undeclared runtime read. A file is now test-only when a dot segment
after its name marks it (spec, stub, fixture, harness, mock, spec-*,
test-*, *-fixtures), its stem is a test bootstrap, or it sits in a test
directory. Runtime names such as xtream-connection-test.service.ts stay
in the scan; no runtime source imports an excluded file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): keep welcome card text legible while hovered
At the 16%/10% hover tint the dark theme's body text on a feature card
measured 4.45:1. The hover fill steps up to 10%/6% instead (4.78:1 in
dark, 6.6:1 in light); lift, border and shadow carry the rest. The E2E
now measures feature and source card text while hovered, in both themes;
with the old tint it fails at 4.45.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Retranslate SETTINGS.EPG_URL_LABEL, EPG_URL_PLACEHOLDER, EPG_URL_ERROR,
EPG_SOURCES_DESCRIPTION and EPG_EMPTY_HINT in 16 locales that still kept
the URL-only meaning after local XMLTV files became EPG sources (#1600).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(playback): size diagnostic cards to the player and wrap their labels
The recovery cards ellipsized every translated action wider than their
124px label column (de, ru, hu, pt, pl, by and others), and the banner
took its padding from the window rather than the player. In a short inline
player just wider than the 760px breakpoint that squeezed the content
until it overflowed, and align-items: center pushed its top above the
scroll origin.
The panel host is now a size container over the player: padding uses
container units, a compact layout applies to players up to 560px tall,
auto margins centre the content without clipping its top, labels wrap,
and the cards grow to 240px.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(playback): keep short diagnostic players at full content width
Measure the layout E2E with the whole banner translated, not only the
card labels: the badge, headline, description, hints and utilities set the
banner's height too. With them, a by banner in a 920px-wide, 404px-tall
player had 45px to spare, because 18cqi side padding left a 588px column.
Short players now grow their side padding from 16px at the 760px
breakpoint, which keeps the 720px column and about 90px spare.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(workspace): remove standalone-layout branches no route can reach
Every routed view sits under the /workspace route (the other top-level
paths are redirects), so isWorkspaceLayoutRoute() was true for every
caller. Global search became a route on 2026-01-12 and the last route
outside the workspace went with the home component on 2026-03-02;
nothing opens SearchResultsComponent in a MatDialog.
Removed as unreachable:
- isWorkspaceLayoutRoute() and the route's data.layout marker; the
channel list, Xtream live layout and unified collection read the q
query param directly, the clear-view command no longer checks a flag
that was always true, and the M3U EPG guide header action keeps only
its supportsEpg gate.
- The playback sidebar's playlist header (Home button and playlist
switcher, showPlaylistHeader, its stylesheet and the macOS padding
rule). The switcher itself stays: the workspace header uses it.
- Xtream search's dialog mode (MAT_DIALOG_DATA initialQuery, dialogRef,
close buttons) and inline search input; Back is offered whenever the
search is not the global one, as before.
- Stalker search's inline-input flag (Back is always offered, as before).
- SearchLayoutComponent's showSearchInput, showCloseButton, closeClick,
searchTermChange and focusSearchInput, and SearchFormComponent, which
only it rendered.
- SETTINGS.BACK_TO_HOME and PORTALS.SEARCH in all 19 locales, the
zoneless checklist entry for the deleted form, the specs that only
covered these paths, and two Electron E2E assertions that the deleted
form is absent.
Behaviour of every reachable path is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(ui): drop the macOS host class and switcher rule nothing uses
The app root's `macos-platform` host class only fed the removed sidebar
header's padding rule, so no stylesheet reads it any more. The shared
portal-sidebar partial's `.sidebar-header .switcher` rule matched no
element: the only `switcher` class lived in that removed header, which
used `.current-playlist`, not `.sidebar-header`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): one focus ring colour everywhere via the shared mixin
#1866 gave the app a keyboard focus ring token (`--app-focus-ring`, at
least 3:1 on every surface), but 59 component rings still drew their own
colour: the selection blue under several names (`--app-selection-color`,
`--mat-sys-primary`, `--app-selection-border`, the EPG's `$accent-blue`,
`--embedded-mpv-accent`, `--apd-accent`, the hero's `--accent-color`),
the heading colour, or the overlay's literal text colour. The selection
blue falls to 2.6:1 on the stronger selection tint.
- Every one now includes `focus-ring.focus-ring-declarations`, keeping its
offset; the projects that newly import `libs/ui/styles` declare
`ui-styles`.
- The mixin reads the token alone: it is declared on `html` in both
themes, and the fallback chain cost bytes in every ring.
- `tools/nx/check-focus-ring-colour.mjs` joins `styles:focus-visible:
validate`: an outline in a focus rule must use the token or, over
video, the player's `--pc-*` palette. Three deliberate exceptions are
listed with their reasons, and a stale one is reported. On master it
reports these 59 rings.
- The keyboard-focus E2E asserts each ring's colour equals the token
where it is drawn.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): search fields and shadow rings take the focus colour too; guard reads them
Local review (Greptile P2): the ring-colour guard read only `outline`, so a
focus indicator drawn as a shadow or a border kept any colour. Search
fields showed focus as a `--mat-sys-primary`/selection border with a 12-16%
halo, the EPG guide's keyboard cell as an inset `$accent-blue` shadow, and
the downloads cards tinted their artwork border with the M3 primary.
- Every one now uses `--app-focus-ring` (the halos and tints keep their
strength through `color-mix()`); over video the panel's search border
mixes the overlay's own ring colour.
- The guard reads a focus rule's outline, its unblurred ring or line
shadows and its border colours. Neutral boundaries (separator and
widget-border tokens, transparent, currentColor) and blurred lift
shadows are not indicators. On the previous commit it reports these 21
declarations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): check every focus colour on its own; count exceptions only where they excuse a ring
Greptile on #1882 (2×P2):
- The guard joined a declaration's colours and accepted the lot when the
token appeared anywhere, so `border-color: var(--app-focus-ring) red`
or a `color-mix()` of the token and red passed. It now splits each
declaration into plain colours, every `color-mix()` argument included,
and checks each one: the token, the player palette or a neutral
boundary. An outline or shadow ring without a colour is drawn in the
text colour, which only a border may keep.
- An exception counted as used when its value appeared in any
declaration (the diagnostic's amber is also a text colour), so a stale
one was never reported. It now counts only where it excuses an
off-token focus indicator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(settings): the row a search result reveals takes the app focus ring
Codex on #1882 (P2): choosing a settings search result with Enter focuses
its row by script, and the keypress keeps `:focus-visible`, so the row's
60%-transparent selection outline was a real keyboard focus ring under
3:1, not the passive marker its guard exception described. The row now
includes the shared mixin (keeping its 12px radius), the exception is
gone, and the keyboard-focus E2E reveals a row with Enter and asserts the
app ring on it; with the old rule it fails on the 60% colour.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): accept focus colour tokens by exact name
Greptile (local, P2): the guard matched `--app-focus-ring` and the neutral
boundary tokens by prefix, so `var(--app-focus-ring-other, red)` or
`var(--app-separator-strong)` passed. It now reads the property a `var()`
names and accepts exactly `--app-focus-ring`, a `--pc-*` palette token or
one of the four neutral boundary tokens; their fallbacks are never drawn,
since the tokens are always declared, so they are not checked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): check the body of a focus mixin, the shared ring included
Greptile (local, P2): a mixin body has no selector and its includes are
not expanded, so the shared `focus-ring-declarations` itself escaped the
colour check; turning it red would change every ring and pass. The
walker now names the mixin a declaration sits in, and the colour guard
treats the body of a mixin whose name mentions focus as a focus rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): read logical border sides in the focus colour guard
Greptile on #1882 (P2): only `border`, `border-color` and the physical
sides were read, so `border-inline-start: 2px solid red` in a focus rule
passed. The guard now reads every colour-carrying border property: the
shorthand and the physical and logical sides, with or without `-color`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): an exception excuses its own colour, not the declaration
Greptile (local, P2): an exception matched the whole declaration, so in
the player stylesheet `box-shadow: 0 0 0 2px #ffffff, 0 0 0 4px red`, or
the white mixed with red, passed. Exceptions now apply to each plain
colour, by exact value, like every other check; an exception counts as
used only where it excuses one of a focus indicator's colours.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): tell a var() or calc() width from the ring colour
Greptile (local, P2): `outline: var(--ring-width) solid var(--app-focus-
ring)` failed the guard, since any non-length token counted as a colour.
Math functions now count as lengths, and a shorthand with one colour slot
takes its literal colour, else an accepted token (the other `var()`s are
widths), else reports every candidate it cannot prove; `border-color`
still checks a colour per side.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): read a shadow ring whose spread is computed
Codex (local, P2): with `box-shadow: 0 0 0 calc(1px + 1px) red` or a
`var()` spread, only three literal zeros were left as lengths, so the
shadow looked flat and was skipped. A shadow is now skipped only when it
is provably not a ring: a literal non-zero blur in the third place, or
every length a literal zero with no `var()` that could be a spread. The
test with a variable-width token ring now asserts it is read, not skipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): read shadow lengths by type, with the colour first or no blur
Greptile (local, P2): the guard took a shadow's first three tokens as its
lengths, so `0 2px` (a line in the text colour, no blur) was skipped as
blurred and a colour-first lift shadow was read as a ring. Lengths are
now read by type: a colour sits before or after them, never between, and
a missing blur is zero. A `var()` counts as a possible length, so a
shadow is skipped only when the first three possible lengths prove a
blur, or every length and the first four possible ones are zero.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): a negated focus condition does not make a focus rule
Greptile (local, P2): the colour guard read `:focus-visible` inside
`:not()` as a focus rule, so a hover style such as
`.button:hover:not(:focus-visible) { border-color: red; }` failed. The
selector is now tested without its `:not()` arguments; a focus condition
elsewhere, `:has()` included, still makes a focus rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tooling): read a width in any CSS length unit
Greptile (local, P2): only px, em and rem were lengths, so `outline: 1pt
solid var(--app-focus-ring)` took `1pt` for the colour and failed. Every
CSS length unit (absolute, font-relative, viewport and container) now
counts as a length.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): the open-in-playlist chip rings in the app focus colour
Codex on #1882 (P2): the chip's inline component styles drew its focus
ring in `--app-selection-color`, out of the colour guard's reach (it reads
stylesheets). It was the only inline-style focus ring in the repository;
it now uses `--app-focus-ring` like every other ring.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(ui): move the open-in-playlist chip styles into a stylesheet
Codex on #1882 (P2) suggested this over scanning TS inline styles: the
chip was the only component with a focus ring in inline `styles`, which
the colour guard does not read. Its styles now live in
`open-in-playlist-chip.component.scss` unchanged, the ring through the
shared `focus-ring-declarations` mixin, so the guard covers it (a drifted
colour there is reported).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(i18n): translate source cleanup, source health and diagnostics strings
Translate every English-identical SOURCE_CLEANUP, SOURCE_HEALTH and
PLAYBACK_DIAGNOSTICS value in all 18 locales, plus the external playback
dock statuses (the same strings as the diagnostic ones), the EPG source
list strings, and leftover English in hu, ko and el. The identical-English
baseline drops 973 entries (2106 -> 1133) and gains none.
Add tools/i18n/check-duplicates.mjs (pnpm run i18n:duplicates), a report
of English strings defined under several keys whose translations differ
per locale, and align drifted wordings: 101 diverging groups -> 65.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(i18n): call cleaned-up zh/zhtw sources invalid, not unactivated
The cleanup dialog lists expired and disabled accounts too, so 未激活 /
未啟用 ("not activated") misexplained why a source is offered for deletion.
Use 失效 ("no longer valid") in the title and the confirmed group heading.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(i18n): one zh/zhtw wording for copying the stream URL
The playback diagnostics button said 复制 URL / 複製 URL while the
channel details dialog (new on master) says 复制流 URL / 複製串流網址
for the same action; use the details dialog wording in both places.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): skeletons that match the M3U header and dashboard rails
Loading skeletons now take their boxes from the code that draws the
content, so the content lands where the skeleton was.
- M3U channel list: the loading state's headers, divider, groups rail
and first row share `styles/_channel-list-layout.scss` with the All
channels, context and groups views. The All channels list moved down
by 19px when a playlist loaded; the group header was 79px against the
real 69px (the panel header's 52px minimum plus the padding that
`.sidebar .sidebar-header` gives it, now one mixin both include).
Group rows start at the list's top-left like the virtual-scroll rows.
- Dashboard rails: `lib-dashboard-rail-skeleton` replaces six copies of
the skeleton markup and takes the rail's layout and aspect ratio
(channel cards for live favorites, 16:9 for sources, posters with a
title and a meta line otherwise). Its header, track, cards and text
line boxes come from `_dashboard-rail-geometry.scss`, which the rail
itself now uses. The skeleton was 328px against the 337.8px poster
rail and a 2:3 poster in front of the 83.5px channel cards.
- One shimmer in `libs/ui/styles/_skeleton-shimmer.scss`, mixed from
`--app-on-surface`: the rail sweep between the widget surfaces was
1.04:1 on the light theme. The dashboard hero and the detail
skeletons (through a forward) use it too.
- Electron E2E `skeleton-geometry.e2e.ts` holds the IPC channel behind
each loading state, compares skeleton and content boxes to 0.5px at
1280x700 and caps the dashboard layout-shift score at 0.01.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(dashboard): keep rail heights when a skeleton stands for a label-less or live rail
Review follow-up (Greptile, local):
- Rails that replace a skeleton (Continue Watching, sources, Xtream
recently added, TMDB) keep an empty meta line under cards without
labels (`reserveMetaLine`), as the skeleton always draws one; a
Continue Watching rail of movies with no known duration came in
shorter.
- The recent-content skeleton follows the recent rail it waits for:
posters while Continue Watching is still loading with no cards,
channel cards otherwise.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A Sources row opened only on a pointer click: the row div was not
focusable and had no key handler, so a keyboard user could Tab to its
actions but never open the playlist.
Following app-content-card, the row's title and meta block becomes the
keyboard activation element: role="button", tabindex="0", named by the
source title, aria-current on the active source, aria-disabled while
busy. Enter and Space open the source (Space prevents the page scroll).
The drag handle, health indicator and actions stay its siblings, so no
control is nested inside a role="button" and their keys never bubble
into it. A click anywhere on the row still opens it via the row.
The row draws the ring with the shared focus-ring mixin, inset, because
the list's scroller would cut a ring drawn outside the full-width row.
playlist-shared-ui now declares its ui-styles stylesheet dependency.
Tests: unit spec for Enter/Space, bubbling from an action button, busy
and selected states; Electron E2E tabs to a source row, checks the ring
and opens it with Enter (fails on the previous component).
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): accessible names for icon-only buttons and a guard
Icon-only buttons named only by a matTooltip (or by nothing) had no
accessible name: the icon ligature is hidden from assistive technology
and a tooltip only adds a description. 22 buttons on master, in .html
and inline templates, now carry a translated aria-label bound to their
tooltip key. The channel row's favorite star keeps one label
("Favorite") and reports its state through aria-pressed.
New guard `pnpm run a11y:icon-buttons:validate` (CI step) fails on a
<button> whose only content is mat-icons (through control flow,
ng-container and spinners) without aria-label, an aria-label binding
or aria-labelledby. The inline-template lookup moves to a shared
tools/nx/inline-templates.mjs used by the icon-ligature guard too.
web-e2e icon-button-names.e2e.ts runs axe's button-name rule on a
channel list, the channel details dialog, Sources, the playlist info
dialog and an Xtream search. Five new keys are translated in all 18
locales.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): text hidden from assistive technology never names an icon button
Greptile: a static aria-hidden="true" child's text counted as the
button's name, so <button><mat-icon/><span aria-hidden="true">Close</span>
passed the guard. Hidden subtrees now add only their icons.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(catalog): short sort chip label and radio sort menus
The catalog sort chip now shows one short label per mode at every width
("Newest", "A-Z", "Top rated") and keeps the full "Sort: ..." text in its
aria-label, so it no longer truncates in long translations. The rating
chip follows the same rule and puts its clear icon after the value. The
1120px container query that swapped full and compact labels is gone.
Single-choice mat-menus get a shared appMenuItemRadio /
appMenuItemRadioCheck pair: rows are menuitemradio with aria-checked, and
every row reserves a leading check slot that is visible only when
checked. Material projects every mat-icon ahead of the label, so the old
check rendered only on the chosen row shifted that row's label. Applied
to the catalog refine menu (sort and rating groups), Xtream live
channels, M3U all channels and groups, unified collection favorites,
workspace categories and workspace sources.
Adds WORKSPACE.SORT_CHIP keys in all locales and drops the unused
WORKSPACE.FILTER_RATING key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(catalog): read the full sort to screen readers from hidden text
A plain div cannot carry an accessible name, so screen readers could skip
the chip's aria-label and read only the short "Newest". The full
"Sort: ..." text now sits in a visually hidden span and the short label
is aria-hidden; the polite live region announces the full text on change.
The spec checks the text outside aria-hidden, and the E2E checks the
chip's accessibility tree in en, de, ru and hu.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The settings facade filled its version signal only inside the GitHub
releases callback, so offline or under an api.github.com rate limit the
installed version was missing from the sidebar's About item and the About
page. The version is known locally from DataService, so the signal starts
with it. The release check also gets an error handler: SettingsService
already logs the failure, and without it the error resurfaced uncaught.
The sidebar layout E2E no longer needs to stub the releases request; a new
E2E aborts it and expects the version in both places.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
