npm - @autobusal/providers - Versions diffs - 1.41.4 → 1.42.0 - Mend

@autobusal/providers 1.41.4 → 1.42.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/package.json CHANGED Viewed

@@ -1,7 +1,10 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.41.4",
+  "version": "1.42.0",
   "author": "Ferjolt Ozuni",
   "type": "module",
-  "main": "index.ts"
+  "main": "index.ts",
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/types/routes.ts CHANGED Viewed

@@ -217,6 +217,22 @@ export interface PriceData {
   display: string
   offer?: boolean
   value: number
+  /**
+   * What this party would have paid before a dynamic price rule reduced it.
+   *
+   * Claude - 2026-08-30 (roadmap P5, ruled by Ferjolt). Present ONLY on a
+   * reduction: "for a price rise, just the price; if the price drops, the
+   * standard fare cut through, and the actual price discounted". A surcharge
+   * deliberately publishes nothing here, so there is no "was" figure lying
+   * around for a card to render as a discount that never happened.
+   *
+   * It is a real total for the passengers being quoted - the same arithmetic
+   * as `value`, run against the pre-modifier fares - not a list price nobody
+   * was offered.
+   */
+  base?: number
+  base_display?: string
   from: LocationData
   to: LocationData
   adult: number

package/types/settings.ts CHANGED Viewed

@@ -131,6 +131,15 @@ export interface SettingsData {
     languages: {
       available: string[]
       default: string
+      /*
+       * Claude - 2026-08-30: every language the PLATFORM ships, as opposed to
+       * the ones this brand publishes in. The two answer different questions
+       * and a screen that confuses them gets the wrong one - `available` is
+       * what this site is served in, `all` is what we can WRITE in, which is
+       * what the operator-invitation form needs. Optional so nothing that
+       * never asks for it is affected.
+       */
+      all?: string[]
     }
     social: {

package/CHANGELOG.md DELETED Viewed

@@ -1,872 +0,0 @@
-## 1.41.4 - 2026-08-29
-- useGetMenu SUBSCRIBES to the language rather than only keying on it (audit A6-73). `i18next.language` was read during render and nothing re-rendered on a switch, so the i18n strings changed instantly while the admin-managed menu labels stayed in the previous language until a full reload.
-- SettingsData.preferences gains `legal` (company, address, city, VAT number) for the footer, and FoundData gains `stops` - the itinerary between the searched cities, with midnight offsets.
-## 1.41.3 - 2026-08-29
-- UserData gains shipping_enabled (published by Auth\Export for operator/employee accounts) so menus can hide the Shipments module honestly (audit A1-37).
-# Changelog
-## 1.41.0 (2026-08-29)
-- The app-shell title is set through document.title instead of a rendered <title> element - React 19 does not deduplicate titles across components, so the shell's and the page's both reached <head>, which is what Meta's cleanup was deleting one of (Sentry BUSMAGUS-7).
-## 1.40.7 (2026-08-28)
-- useReferralTouch: the web finally reads ?ref= - touch on landing, token in localStorage (referral_token field: the BFF strips top-level token); storedReferral() exported for checkout replay.
-## 1.40.6 (2026-08-26)
-- settings types: addons gains `flex` and `seats` entries (both optional).
-## 1.40.4
-### Fixed
-- **The Content-Language header survives a cold load** - requests firing before i18next.init resolved carried no language at all, which is the recurring English-menu-under-/sq leak (CMS-05/CMS-07). The interceptor now falls back to the URL's locale prefix, then the stored preference.
-## 1.40.3
-### Fixed
-- **An expired session interrupted on a private page carries that page through the logout hop** (`/account/logout?return=...`), so signing back in can resume there. (Audit ADM-08a.)
-## 1.40.2
-### Fixed
-- **A missing blog/help/page slug showed the "system error" screen, not a
-  404.** The public content screens load through `useSuspenseQuery`, whose
-  throw the ErrorBoundary rendered as a system error for every case; a 404
-  (unknown slug) or 422 (the articles endpoint's "invalid slug" on an
-  absent/unpublished article) is now shown as the styled 404. (Audit
-  CMS-01f/CMS-03d.)
-- **The public navigation menu was always English.** obtapi localises the
-  labels off `Content-Language` - sent correctly - but the menu was cached
-  under a language-blind key, so it loaded once and a language switch never
-  refetched it. Keyed on the active language. (Audit CMS-07b.)
-## 1.37.11
-### Added
-- Saved-passenger types and the account query, shared by the checkout chooser and the account manager so both read one shape.
-## 1.37.10
-### Added
-- `ReviewData.published_on` - the review's date as ISO 8601, beside the localized display string. Structured data needs a machine date, and reversing a printed `d/m/Y` back into one would couple the schema to a locale format.
-## 1.37.9
-### Added
-- **`Errors/Message` carries a `data-error-page` marker.** The prerenderer has to tell a rendered page from a rendered not-found, and it cannot do that by matching text when the app speaks fifteen languages - it was writing 404s to disk as if they were pages and counting them as successes.
-## 1.37.8
-### Added
-- **`SettingsData.map.tile_url`** - the basemap route maps draw on, from `/settings/get`. `null` until a commercial tile provider is configured server-side, which every client reads as "keep your built-in OpenStreetMap default". Served rather than built in because the mobile app shares this switch, and a compiled-in tile URL there could only be changed by shipping a store release.
-## 1.37.7
-### Added
-- **`OrderData.owner_category`** - `'agency' | 'operator' | 'individual'`, who actually owns an order, collapsed to what a viewer outside the account needs to know: who to contact if it needs to change. See `Libraries\Orders\View::ownerCategory()` (obtapi).
-### Changed
-- **`OrderData.comission_affiliate_display` is now optional.** obtapi's `View::get()` hides every `comission_*_display` field on a restricted (public lookup) response - see that method's own `$restricted` parameter for why.
-## 1.37.6
-### Fixed
-- **The DOM-corruption self-heal watchdog now actually recovers every navigation it's supposed to.** It had two gaps that left users stuck exactly like the bug it exists to catch: its 10-second reload cooldown was tracked globally, so a SECOND corrupted navigation to a different URL within 10s of a first one was silently swallowed - no reload, no recovery, stuck. Scoped the cooldown per-URL instead: a fresh URL always gets a fresh recovery attempt; only a repeat failure on the SAME URL is throttled (the loop-protection this cooldown exists for in the first place). It also only listened for synchronous `error` events - a promise-rejection-based failure (plausible from the lazy()/dynamic-import machinery a route transition drives) was invisible to it and got no recovery at all. Added an `unhandledrejection` listener alongside the existing one, both routed through the same recovery check.
-- **`apiClient`'s 401 handler no longer redirects multiple times for one dead session.** A page boot fires several requests in parallel (settings, menu, account refresh, whatever the current page needs); on a stale/invalid session every one of them 401s within the same tick, and each independently ran its own async `/session` confirmation and its own `window.location.href` redirect - the existing pathname guard only protects against a request that 401s AFTER a redirect has already navigated away, not against several 401s racing each other before any of them has. Reproduced live: a stale session landed on `/account/logout`, and before that page's own logout mutation finished, a second queued redirect (from another request's 401, still in flight when the first one fired) reloaded the page again - repeatedly, stacking a fresh "logged out" toast for every concurrent 401 the boot had fired. Now guarded with a synchronous flag set before the async confirmation, so only the first 401 of a burst does the work; every other one concurrent with it short-circuits immediately.
-## 1.37.5
-### Fixed
-- **`input[type="search"]` now gets the same theme styling as every other text-like input.** `GlobalStyles`'s selector list named `text`/`number`/`email`/`password` but not `search` - any search box on the site (the Help Center's new one) rendered with the browser's bare default appearance instead of the theme's background/border/radius/font.
-## 1.37.4
-### Changed
-- **`CategoryData.name` dropped its dead `name_en`/`name_sq` fields** - `articles_categories.name` is JSON keyed by locale now (obtapi's categories_name_to_json migration); `CategoryData` is the resolved-string shape an article's own `category` and the admin browse list use, the admin Manage form works with the raw per-locale shape directly (see magus Admin/Categories/services.ts).
-## 1.37.3
-### Added
-- **`SettingsData.currency`** - the label's ISO 4217 code, now exposed on the public `/api/settings/get` response. The same source `Facts` already trusted for its own `Offer` schema; every price elsewhere on the SPA is a pre-formatted display string with no machine-readable currency behind it, so this closes that gap for anywhere else that needs one.
-## 1.37.2
-### Added
-- **`OperatorData` gains the payout bank detail fields** (`bank_name`, `bank_address`, `iban`, `swift`, `bank_currency`, `account_owner`, `bank_document_url`) - see `@autobusal/account-update` 1.2.1.
-## 1.37.1
-### Added
-- **`MenuData.location` gains `'footer_1' | 'footer_2'`** - the site footer's two link columns are now admin-managed Menu items (same model the header nav's left/right already use) instead of hardcoded JSX. See `@autobusal/admin-menu` 1.1.3.
-## 1.37.0
-### Added
-- **Shipments types** (`ShipmentData`, `ShipmentStatus`, `SHIPMENT_STATUSES`, `ShipmentHistoryData`, etc.) for the new operator shipping module - see `@autobusal/operator-shipments` and `@autobusal/track-shipment`.
-- **`OperatorData.mobile_access` / `OperatorData.shipping_enabled`** - both admin-only booleans, properly typed now rather than one of them (`mobile_access`) being narrow-cast at its one call site to avoid a cross-repo publish that this release needed anyway.
-## 1.36.0
-### Added
-- **`LabelSettings.locales`** - `{default, available}`, an admin-editable override of `preferences.languages` (which UI locales this label's site responds to, and its default). Null until the new admin-label Locales tab saves one, in which case `preferences.languages` keeps coming from the label's settings.json file exactly as before.
-## 1.35.0
-### Changed
-- **`PageData` (the admin Pages shape) is now locale-object-based, not `_en`/`_sq` columns.** `title`/`content`/`keywords`/`description` are each `LocalizedText` (`Record<string, string>`, one value per locale) - matches obtapi's `pages_content_to_json` migration, which moved `pages` off the two-content-language ceiling onto the same JSON-per-locale shape `faqs` already established. `title_en`/`title_sq`/`content_en`/`content_sq` and friends are gone from the type entirely. New `PageSaveData` covers what the admin save endpoint actually accepts (each field JSON-stringified, not the raw object) - the public page-view response (`@autobusal/page/types.ts`) is unaffected, it was already a single resolved string per field.
-## 1.34.0
-### Added
-- **`OperatorData.brand_name` / `OperatorData.display_name`** - an operator's optional public-facing trade name and the computed field (`brand_name` if set, else `company`) every customer-facing display should read. `company` stays as the registered legal name, for legal/financial contexts only.
-## 1.33.0
-### Added
-- **`LabelSettings.ai`** and **`LabelData.is_main`** - a label's per-provider AI configuration (`{providers: {openai: {status, api_key?, models?, default_model?, labels_allowed?}, ...}, default_provider}`) and whether this label IS the platform's main one, both needed by the new admin-label AI tab to know which fields to show.
-## 1.32.0
-### Added
-- **`LabelSettings.theme`** — a label's chosen theme preset (`{preset, overrides}`), matching obtapi's new `labels_settings.theme` column. Optional/nullable: absent means the label still reads its colors straight out of settings.json, exactly as before this existed.
-## 1.31.1
-### Fixed
-- **A 422 no longer stacks one toast per query.** The search results page
-  asks three endpoints the same question, so a malformed URL rejected three
-  times and showed three identical messages. De-duplicated by the first
-  field error rather than by the message: Laravel's summary appends "(and N
-  more errors)" and each endpoint validates a different rule set, so the
-  three strings differ in that count alone while describing one problem.
-## 1.31.0
-### Added
-- **`PopularRoutesData`** - the city pairs behind the home page's route
-  columns. `from` and `to` arrive localised and `link` is built server-side,
-  so the search URL's date and slug rules live in one place.
-## 1.30.1
-### Fixed
-- **Only the documents 403 redirects to the documents page.** This fired on
-  every 403 there is. The intent is sound - an account blocked by an unsigned
-  document should be taken to the screen that unblocks it - but the other
-  source of a 403 in this API is the email-verification gate, and sending
-  somebody there for that told them nothing and fixed nothing. It read as a
-  deliberate product redirect and was this line. Keyed on a `reason` the
-  server sets rather than the message, which is translated fifteen ways, and
-  guarded against redirecting the documents page to itself.
-## 1.30.0
-### Added
-- **`BootstrapError` tells a transient failure from a real one and recovers
-  by itself.** A rate limit or a dropped connection is not a system error,
-  and "something broke on our side" is wrong twice for either: it blames the
-  wrong thing, and it hands the visitor a reload button for a situation where
-  reloading immediately makes it worse. 429/503/504 and a request with no
-  response at all now get their own wording and an automatic retry that backs
-  off 5s, 10s, 20s, 30s.
-## 1.29.4
-### Added
-- **`OrderData.addons`** (`OrderAddonData[]`) - the extra services bought at
-  checkout. There is no `data` field by design: the API withholds it because
-  the Telegram add-on's copy holds a bind token.
-- **`OrderData.fare_display`** - the fare WITHOUT add-ons. Optional, because
-  only the single-order endpoint opts into it; `amount_display` remains fare +
-  add-ons.
-## 1.29.3
-### Fixed
-- **A failed settings fetch white-screened the entire app.** `useGetSettings`
-  is a *suspense* query, so a failure throws during render rather than
-  resolving to an error state — and nothing in `Providers` caught it, so the
-  whole tree unmounted and left a blank page with no message, no retry and
-  nothing in the console. A rate limit, a brief API blip or a restart
-  mid-deploy all produced the same silent nothing. Reproduced in a browser,
-  not deduced.
-  Fixed with a new **`BootstrapError`** boundary wrapping everything. It
-  cannot be the existing `ErrorBoundary`: that renders `Errors/Message`,
-  which calls `useGetSettings()` itself and `useNavigate` — above the
-  settings fetch it would rethrow inside its own fallback. An error screen
-  for "nothing loaded" cannot depend on anything having loaded, so this one
-  uses no settings, no i18next, no router and no theme — inline styles and
-  the static `@lang/errors` map, with a reload button.
-### Changed
-- **Queries retry what can plausibly differ, and only that.** `retry: false`
-  was wrong in both directions: a single dropped connection or 500 was fatal
-  (and on the suspense bootstrap path, fatal meant the whole app), while
-  nothing distinguished that from a 401/403/404 — a decided answer that
-  repeats identically while spending the rate-limit budget a 429 exists to
-  protect. Now 5xx, 408, 425, 429 and network-level failures get two retries
-  at 700ms then 1400ms; everything else fails at once, so a real 403 surfaces
-  as a real 403 instead of three seconds of spinner.
-## 1.29.2
-### Removed
-- **Everything 1.29.0/1.29.1 added for multi-TLD** — `getLanguage`'s
-  `domainLocale` argument and the module-level origin it defaulted to, the
-  argument `Setup` passed it, and `SettingsData.domain` / `.domains` /
-  `.locale`. The stored language preference is once again the only thing that
-  outranks the brand default on an unprefixed URL.
-  See `@autobusal/common@1.27.1` for why. Published forward rather than
-  downgraded, for the same reason.
-## 1.28.1
-### Fixed
-- **The stale-chunk guard budgeted two reloads instead of one.** Measured: a
-  failure at `/operators` reloaded, the server answered with its canonical
-  `/operators/`, the same chunk failed again — and the raw path no longer
-  matched the one already spent, so it reloaded a second time. Bounded, but
-  twice what was intended, and on a genuinely broken deploy the user watched
-  the page flash twice before the error appeared. The budget key now strips a
-  trailing slash, so one journey gets one reload.
-  Only visible because the retest ran against a chunk that was *permanently*
-  missing rather than replaced — the ordinary stale-bundle case recovers on
-  the first reload and never reaches the second.
-## 1.28.0
-### Added
-- **`registerStaleChunkRecovery()`** — a tab left running a bundle that no
-  longer exists now reloads itself onto the page it was asked for, instead of
-  freezing.
-  Every route is `lazy(() => import(...))`, the build emits content-hashed
-  chunks, and it **empties the output directory** — so a new build deletes the
-  old chunk names outright (watched `index-DFPpSljG.js` disappear across one).
-  A tab still holding the previous `index.html` goes on asking for those names,
-  so the next navigation fetches a chunk that no longer resolves, the import
-  rejects, and the routed component never mounts — while the URL has *already*
-  changed. The address bar says one page and the screen shows the last one.
-  From the outside: "the page does not react at all, but the url seems to
-  change."
-  One listener on Vite's `vite:preloadError` covers all 141 lazy routes, which
-  is why this is a small module rather than a change to 141 call sites.
-  **Silent, not a prompt.** Every lazy chunk in both apps is a *route* —
-  checked, there is no lazily-loaded in-page component — so a chunk is only
-  ever fetched while navigating, which means the user has already left the page
-  they were on. Reloading to the destination costs them nothing the click was
-  not already costing them, and a "new version available?" dialog would be
-  asking permission to do the thing they just asked for.
-  **It cannot loop.** A missing chunk is usually a stale bundle but might be a
-  broken deploy, and reloading into a repeating failure would be far worse than
-  the bug. Each path gets at most one reload per tab; after that the error is
-  left to surface. `sessionStorage`, so the budget is per tab.
-  Verified by reproducing it: a tab pinned to an older bundle, its chunk
-  orphaned by a rebuild, then a client-side click — `vite:preloadError` fired,
-  the document was replaced, and the tab landed on `/operators` running the new
-  bundle.
-## 1.27.0
-### Added
-- `LabelSettings.sms` (BulkGate: status, credentials, sender) and
-  `SettingsData.addons.sms` — the paid per-order confirmation. Both optional,
-  so an older payload cannot crash a checkout.
-## 1.26.0
-### Added
-- `FoundData.arrival_offset` — whole days between boarding and arriving, for
-  the overnight marker on result cards. Optional: external-provider offers do
-  not report one, and a missing value must read as same-day rather than
-  invent a day.
-## 1.25.0
-### Added
-- `LabelSettings.whatsapp.alert_template_name` / `alert_template_language` —
-  the separate approved template the route+date broadcast composer sends
-  through. Optional: a brand can confirm purchases over WhatsApp without ever
-  broadcasting, and Meta approves a template for a stated purpose, so service
-  alerts cannot reuse the confirmation one.
-## 1.24.0
-**New `Setup/commerce.ts` — the booking funnel, pushed to the dataLayer.**
-`analytics.ts` already loaded the container and announced page views; this is what makes those page views mean something. Until now the funnel was unmeasurable for a more basic reason than missing events — every step of the wizard shared one URL, so no tool could tell a search from a checkout.
-Uses **GA4's own event names** (`view_item_list`, `select_item`, `begin_checkout`, `add_to_cart`, `remove_from_cart`, `purchase`) so a container wires them by picking from a list rather than needing a custom mapping per brand.
-`purchase` is the hard one and the reason this is a module rather than a few inline pushes: a card payment leaves the site entirely and returns on a URL carrying nothing but an order hash, and most buyers are guests with no account to read the order back from. So `stash()` remembers the value at order time and `flush()` announces it on return — clearing as it fires, and checking the hash, so neither a refresh nor a stale entry from an abandoned attempt can report a sale.
-Each push clears `ecommerce` first; GTM's dataLayer is cumulative, and without that a later event inherits the previous one's items.
-## 1.23.0
-- `CountryData.timezone` — the IANA zone, so the date picker can floor itself on the departure city's date rather than ours or the buyer's. Carried on `/api/cities/browse`, which the search form already loads.
-## 1.22.0
-**Flexible Ticket, and the `policies` rename.**
-- `PolicyData` is now `InformationData`, and its field `policies` is `information` — the route's free-text box is luggage, pets, boarding and ID, and never was cancellation terms. Calling it Policies invited operators to type terms into it that would then contradict the terms actually sold.
-- `RouteData.policies_en|sq` → `information_en|sq`.
-- `RouteData` gains `refund_hours` / `reschedule_hours`: the operator's own notice windows, in hours before departure. **Internal** — they reach the operator's route form and the admin, never a public payload. `null` means "not offered on this line", which is why they are nullable rather than 0.
-- New `FlexOffer`, the response of `GET /api/orders/flex`. Its hours are already resolved to the **stricter** leg of a return trip, so they are the numbers that will be enforced. Either may be null on its own — an operator who will reschedule but not refund is a real case.
-All notable changes to `@autobusal/providers` are documented here. This project
-adheres to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
-[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-> Note: 1.8.0 through 1.11.0 were published without changelog entries. The
-> gap is left as-is rather than reconstructed after the fact.
-## 1.21.0
-`SettingsData.today` — the earliest bookable date as the server reckons it,
-handed to the calendar at startup so the picker stops flooring on the buyer's
-device clock.
-## 1.20.0
-`FoundData.departs_in` — minutes until departure, for same-day searches only,
-null on every other date.
-## 1.19.0
-`types/reviews.ts` — `RatingData`, `ReviewData`, `ReviewSummaryData`. `rating`
-added to `OperatorData` and `RouteData`, always optional and often absent.
-## 1.18.0
-`LabelSettings.reviews` — the per-brand review moderation setting
-(`auto_publish`, `threshold`). Absent or false means every review waits for a
-human, which is the default for every brand.
-## [1.40.5] - 2026-08-26
-### Added
-- `OrderData.round_trip?` - whether the order is already half of a round
-  trip (either leg); computed by obtapi's single-order endpoint.
-## [1.17.0] - 2026-08-02
-### Changed
-- **`FeatureData` gains `slug` and drops `name_sq`.** Amenity names are
-  resolved server-side from obtapi's `lang/{locale}/features.php` now, so
-  `name` already arrives in the request's language - for the SPA and the
-  partner API alike, from one resolution point. `slug` is the stable
-  machine-readable key: `id` is ours alone and `name` moves with the
-  language, so it is the only thing safe to map against.
-## [1.16.0] - 2026-08-02
-### Changed
-- **SEO overrides are per language.** `LabelSettings.seo` and the location
-  types carry a `{locale: {title, description}}` map. The label's homepage
-  override is sent WHOLE and picked client-side, unlike the country/city
-  ones which resolve server-side - not an inconsistency but a bootstrap fact:
-  `/api/settings/get` is the one request that runs before i18n exists, so the
-  server cannot know which language to answer in. Resolving it there put
-  English copy on the Italian homepage.
-- **`seo_keywords` is gone** everywhere. Google has ignored the meta keywords
-  tag since 2009; the field could only ever cost somebody an afternoon.
-## [1.15.0] - 2026-08-02
-### Changed
-- **The URL decides the language.** `getLanguage()` now reads a locale prefix
-  off the path before falling back to the stored preference and then the
-  brand default, and takes the brand's `available` list so an unrecognised
-  first segment (`/city/tirana`) is never mistaken for a language. This is
-  the point of localised URLs: a link has to decide what its recipient sees,
-  so someone whose last visit was in Albanian still gets Italian from a
-  shared `/it/...` link. Unprefixed URLs are unaffected.
-## [1.14.0] - 2026-08-02
-### Changed
-- **`LabelSettings.telegram`/`.whatsapp` drop `price` and `refundable`.** They
-  moved to obtapi's `addons` table; the label manager reads them from the
-  label's `addons` map instead (see `@autobusal/admin-label` 1.15.0). The
-  public `settings.addons` shape is unchanged, but its contents are now
-  filtered by who is asking and through what channel.
-## [1.13.0] - 2026-08-01
-### Removed
-- **`CityData.booking_id`.** The only thing it ever fed was the Booking.com
-  affiliate banner on the results page, which is gone (see
-  `@autobusal/routes-order` 1.12.0), along with the `cities.booking_id`
-  column behind it. Type-only change; nothing read the field at runtime.
-## [1.12.0] - 2026-08-01
-### Added
-- `FoundData.stops_count` - intermediate stops between the searched from/to,
-  where 0 means a direct trip. Optional, because external-provider offers do
-  not report one: a filter must read "missing" as unknown, never as direct.
-- `FoundData.priority` - the operator's subscription priority, which obtapi
-  was already sending but which was not typed. Used only as a tiebreak in
-  routes-order's "recommended" ordering.
-## [1.7.0] - 2026-07-31
-### Added
-- **`LabelSettings.seo` / `SettingsData.seo`** (`types/settings.ts`): optional
-  homepage title/description/keywords override, admin-managed via the new
-  `@autobusal/admin-label` 1.9.0 SEO tab and persisted through obtapi's
-  `Labels\AdminController::seo()`. `SettingsData.seo` is the public-safe
-  subset exposed by `Settings\ViewController::get()` for `StaticHome.tsx`
-  to prefer over its i18n translation-template values when set.
-- **`CountryData.seo_title`/`seo_description`/`seo_keywords` and the same
-  three fields on `CityData`** (`types/locations.ts`): optional per-entity
-  override for a country/city landing page's meta tags, admin-managed
-  through the existing Countries/Cities admin forms and persisted via
-  obtapi's `Countries\AdminController`/`Cities\AdminController`.
-  `LocationCountry.tsx`/`LocationCity.tsx` prefer these over their i18n
-  translation-template + live-stats content when set.
-## [1.6.9] - 2026-07-31
-### Added (re-added)
-- **`useRecoverFromDomCorruption()`'s global `removeChild`/`insertBefore`
-  listener is back**, generalized. Removed in 1.6.8 as a backstop
-  specifically for `GoogleReCaptchaProvider`'s remount corruption, on the
-  assumption that removing that provider removed the trigger. It didn't:
-  `@autobusal/common` 1.8.3 fixed a second, independent cause
-  (`Meta.tsx`'s stale-tag cleanup racing React 19's own `<title>`/`<meta>`
-  hoisting), and the exact same uncaught error still reproduced
-  intermittently with BOTH fixes shipped - some remaining React/router
-  timing edge case neither touches. Reinstated as a permanent safety net
-  rather than a fix for one specific bug: whatever the next contributing
-  cause turns out to be, a reload of the current URL has recovered
-  cleanly in every reproduction so far.
-## [1.6.8] - 2026-07-31
-### Removed
-- **`Recaptcha/Recaptcha.tsx` and its `<Recaptcha>` wrapper around the
-  app in `Providers.tsx`.** This mounted `GoogleReCaptchaProvider`
-  (`react-google-recaptcha-v3`) as a persistent context provider inside
-  the same Suspense tree as `Styles`/`Notifications`/`Setup`; that
-  provider's script/badge injection is async and not remount-safe, and
-  any remount of it left the DOM in a state that could throw an
-  uncaught `removeChild`/`insertBefore` error on the next reconciliation
-  anywhere near the root - the actual root cause of the frozen-
-  navigation bug 1.6.6/1.6.7 worked around. `@autobusal/hooks` 1.3.1
-  moved reCAPTCHA to the same on-demand, no-provider pattern Turnstile
-  already used (`useRecaptcha`'s external API is unchanged), so nothing
-  needs this wrapper anymore - removing it removes the remount risk at
-  the root instead of continuing to recover from it. `useGetSettings()`
-  et al are otherwise unaffected: `Styles`/`Notifications`/`Setup` still
-  share the outer boundary exactly as before, just without `Recaptcha`
-  in the tree.
-- **`useRecoverFromDomCorruption()`'s global `removeChild`/`insertBefore`
-  listener**, added in 1.6.7 as a backstop specifically for the
-  `GoogleReCaptchaProvider` remount corruption above. With that provider
-  gone, its trigger no longer exists.
-## [1.6.7] - 2026-07-31
-### Added
-- **`Providers.tsx`: self-healing reload if the DOM ever corrupts near the
-  root.** 1.6.6 closed the deterministic trigger for the
-  `GoogleReCaptchaProvider` remount corruption (see 1.6.6 below), but its
-  script/badge injection is still fundamentally async - a script tag's
-  `onload` racing React's synchronous mount/cleanup - so a rare remount
-  can still leave the DOM in a state that throws an uncaught
-  `removeChild`/`insertBefore` error on the next reconciliation anywhere
-  near the root. That class of error isn't render-phase, so no
-  `ErrorBoundary` catches it, and it silently aborts whatever navigation
-  was in flight: the URL updates but the page never re-renders, with no
-  visible error and no way to navigate out. A reload of the current URL
-  always recovers cleanly (the router's `history.pushState` already
-  applied), so `Providers` now listens for exactly this error signature
-  and self-heals with one reload, guarded by a 10s `sessionStorage`
-  cooldown so a genuinely persistent error can't loop.
-## [1.6.6] - 2026-07-31
-### Fixed
-- **`Providers.tsx`: `Setup` (and its `useGetMenu()` call) now has its own
-  inner `<Suspense>` boundary**, instead of sharing the outer one with
-  `Recaptcha`/`Styles`/`Notifications`. `Setup` calls a second,
-  independently-resolving `useSuspenseQuery` (`get-menu`) after
-  `useGetSettings()`; on a cold menu cache this suspended AFTER
-  Recaptcha's `GoogleReCaptchaProvider` had already committed and
-  injected its script/badge - and a Suspense boundary that re-suspends
-  discards its already-committed content and remounts it once ready.
-  `GoogleReCaptchaProvider` isn't remount-safe (its script/badge
-  injection is async, outside React's own DOM bookkeeping), so the
-  remount left a duplicate, half-torn-down `.grecaptcha-badge` behind.
-  That corrupted DOM state then threw an uncaught `TypeError: Cannot
-  read properties of null (reading 'removeChild')` the next time React
-  reconciled anywhere near the root - i.e. on every subsequent route
-  change, since Recaptcha wraps the whole router. The exception isn't
-  caught by the app's `ErrorBoundary` (render-phase only), so it
-  silently aborted the commit: the URL would update (the router's
-  `history.pushState` already ran) but the page itself never
-  re-rendered - freezing client-side navigation app-wide, most visibly
-  reproduced via the account dropdown menu (Password, Telegram, and the
-  impersonation-aware Logout/"Return to my account" link, which is what
-  surfaced this).
-## [1.6.5] - 2026-07-31
-### Added
-- **`Queries/apiClient.ts` sends `Content-Language`** on every request,
-  reflecting the live active i18next language. The API's
-  ChangeApiLanguage middleware/Languaged trait expect this to localize
-  city/country/article/... names, but the frontend never sent it -
-  those names always rendered in the API's own default locale
-  regardless of the UI's actual language. Requires obtapi's
-  Traits\Languaged fix (falls back safely for the 13 UI languages the
-  database has no columns for) and @autobusal/bff 1.2.0 (forwards the
-  header upstream in bff mode) to actually take effect end-to-end.
-## [1.6.4] - 2026-07-30
-### Added
-- **`types/locations.ts` `CityStats`/`CityDestination` types + `CityData.stats`/`.destinations`** - real route/operator/destination-count/price stats and reachable-destinations list from obtapi's new `cities/view` endpoint, for city hub landing pages.
-## [1.6.3] - 2026-07-30
-### Added
-- **`types/locations.ts` `CountryStats` type + `CountryData.stats`** - real
-  route/operator/city/price-from counts from obtapi's enriched
-  `countries/view` endpoint, for country landing pages to render actual
-  descriptive content instead of a bare city list.
-## [1.6.2] - 2026-07-30
-### Fixed
-- **`Setup/analytics.ts` now initializes GA4 with `send_page_view: false`.**
-  Pairs with `@autobusal/common` 1.8.0, which sends every pageview
-  explicitly (including the first) from `Meta` instead - previously the
-  automatic initial page_view and any future manual tracking would have
-  double-counted the first page of every session.
-## [1.6.1] - 2026-07-30
-### Fixed
-- **`Organization`/`WebSite` JSON-LD `url` was wrong** (introduced in 1.6.0,
-  same day) - used `data.url` (`SettingsData.url`, from `Label::url()`),
-  which is deliberately the obtapi asset-storage path for this label's
-  uploaded files (`https://obtapi.../storage/labels/{label}`), not the
-  site's own public domain. Now uses `window.location.origin`.
-## [1.6.0] - 2026-07-30
-### Added
-- **Sitewide `Organization` + `WebSite` JSON-LD** (`Setup/Preload.tsx`), via
-  the new `@autobusal/common` `JsonLd` component - the entity-grounding
-  signal AI assistants and Google's Knowledge Graph use to resolve "who is
-  this brand". `Organization.sameAs` is populated from
-  `preferences.social.*`. No `WebSite.potentialAction`/SearchAction -
-  that schema is for a single free-text query field (Google's sitelinks
-  searchbox); this app's search is two-field (from/to), so a SearchAction
-  here would be invalid structured data, not a working sitelinks box.
-## [1.5.1] - 2026-07-30
-### Fixed
-- **`Errors/Message.tsx` (404 / system error page) never rendered a
-  `<title>` of its own** - relied entirely on `Preload`'s app-shell fallback
-  (the company name), and shipped `noIndex` neither. Now renders its own
-  `<Meta>` with the localized not-found/system-error message as the title
-  and `noIndex={true}` - error pages have no unique content worth indexing.
-  Pairs with `@autobusal/common` 1.5.1's title-ownership fix in the same
-  release, which also cleans up the resulting `<title>` duplication with
-  `Preload`'s fallback.
-## [1.5.0] - 2026-07-30
-### Fixed
-- **`Setup/Preload.tsx` migrated off `react-helmet`** to React 19's native
-  `<title>`/`<meta>`/`<link>` hoisting, same root cause and fix as
-  `@autobusal/common`'s `Meta.tsx` in this same release - see that
-  package's changelog for the full diagnosis. No behavior change intended
-  beyond making the title/favicon/theme-color tags this component sets
-  actually reach the DOM, which they silently weren't.
-## [1.4.1] - 2026-07-30
-### Fixed
-- **`<html lang>` never reflected the active language (`Setup/languages.ts`).**
-  `index.html` hardcodes `lang="en"` at build time and nothing updated it
-  afterward - every one of the 15 supported languages rendered under the same
-  `lang` attribute, a signal both search engines and screen readers rely on.
-  `languages()` now sets `document.documentElement.lang` immediately on init
-  (using the same `localStorage`-or-default resolution as the i18next `lng`
-  option) and keeps it in sync via `i18next.on('languageChanged', ...)`, so it
-  tracks every future change regardless of what triggers it.
-## [1.4.0] - 2026-07-30
-### Added
-- **Cache-busting on language file requests (`Setup/languages.ts`).** A
-  production report showed the admin panel still displaying raw i18n keys
-  after obtapi's translation JSON was fixed and confirmed correct
-  server-side - even after multiple manual hard-reloads. `Cache-Control:
-  no-cache` on obtapi's side only asks caches to revalidate before reuse,
-  which was not reliable enough against whatever was actually caching
-  (browser and/or an intermediate proxy) in the real deployment. The
-  `loadPath` now appends `?v={{VITE_BUILD_ID}}`, a fresh value baked in at
-  build time by the consuming app's `vite.config.ts` `define` - every
-  rebuild produces a URL nothing in the chain has ever cached, independent
-  of whether that cache actually honors Cache-Control. Falls back to a
-  fixed `'dev'` string if the consumer hasn't defined `VITE_BUILD_ID` yet
-  (no worse than before). **Requires consuming apps to add a
-  `VITE_BUILD_ID` define to `vite.config.ts`** (done for magus and
-  alvavel alongside this release) for the cache-busting to take effect -
-  without it, this version behaves identically to 1.3.9.
-- Companion fix in obtapi: `public/.htaccess` strengthened from
-  `Cache-Control: no-cache` to `no-store, no-cache, must-revalidate,
-  max-age=0` plus `Pragma`/`Expires`, so language JSON is never stored by
-  a compliant cache at all, not just revalidated.
-## [1.3.9] - 2026-07-30
-### Fixed
-- `Errors/Message.tsx`: the crash/404 page's logo `alt` text was hardcoded to
-  `"Home"` in every locale, bypassing the `@lang/errors` translation
-  dictionary used for the rest of the page. Now reads `translations.home`.
-  Requires consuming apps' `src/lang/errors.ts` to define a `home` key per
-  locale (added to magus and alvavel alongside this release).
-## [1.3.8] - 2026-07-29
-### Added
-- `LabelSettings.share`: admin-editable footer social-share links
-  (Facebook/X/Instagram/TikTok/LinkedIn/Trustpilot URLs), distinct from
-  the existing `LabelSettings.social` (OAuth login credentials). Feeds
-  the public `SettingsData.preferences.social` shape, unchanged.
-## [1.3.7] - 2026-07-27
-### Added
-- `FoundData.external`/`FoundData.price.id` widened to admit external
-  bus-route provider offers (Mode A: search + redirect) - `id`/`price.id`
-  become the synthetic `ext:{provider}:{offer_id}` string, and an optional
-  `external: {provider, mode, offer_id}` discriminator marks the row so the
-  frontend never sends it to local-only endpoints (seat maps, coupons,
-  checkout). Scoped to `FoundData` only - the shared `PriceData`/`RouteData`
-  interfaces (used by operator-side price editing) are untouched.
-## [1.3.6] - 2026-07-25
-### Added
-- `SettingsData.addons` - whether the WhatsApp/Telegram checkout addon is
-  available for this label and what it costs (never credentials), exposed
-  by obtapi's `Settings\ViewController::get()` for the checkout SPA to
-  render the addon selection at Step5.
-## [1.3.5] - 2026-07-25
-### Changed
-- `LabelSettings.telegram` upgraded from `{enabled: boolean}` to the same
-  `{status: 'disabled'|'dedicated'|'main', price, ...}` shape as the new
-  `LabelSettings.whatsapp` - both are now paid checkout addons that can
-  route through the main label's connection instead of requiring their
-  own.
-## [1.3.4] - 2026-07-25
-### Added
-- `LabelSettings.telegram`: admin-managed bot config (enabled/bot_token/
-  bot_username) for the Telegram route-notifications feature.
-## [1.3.3] - 2026-07-25
-### Added
-- `LabelPayments.raiffeisen.source`: 'dedicated' | 'main' - whether this
-  label uses its own RaiAccept account or routes through the main label's
-  account/domain (RaiAccept only accepts one registered domain per
-  merchant account). See obtapi RaiffeisenController::relay().
-## [1.3.2] - 2026-07-25
-### Fixed
-- `RouteData.passenger_fields` (route form submit shape) missing from 1.3.1.
-## [1.3.1] - 2026-07-25
-### Added
-- `TripData.passenger_fields` (which passenger details a route requires at
-  checkout) and `TicketData.whatsapp`/`telegram` messaging contacts.
-## [1.3.0] - 2026-07-25
-### Changed
-- **Captcha is now a runtime, per-label setting.** `Recaptcha.tsx` reads the
-  label's captcha config (provider + public site key) from `/api/settings/get`
-  via `useGetSettings()` and mounts `GoogleReCaptchaProvider` ONLY when the
-  provider is `recaptcha` (build-time `VITE_RECAPTCHA_KEY` remains as a
-  fallback). Cloudflare Turnstile needs no app-level provider. Because the
-  component now needs the query client, it moved INSIDE `<Queries>` in
-  `Providers.tsx`. `SettingsData`/`LabelSettings` types gained `captcha`.
-## [1.2.12] - 2026-07-24
-### Fixed
-- The full user profile - name, email, and via the nested admin/operator/agent/subagent/employee/driver/visitor sub-object: phone, address, passport, date of birth, company/NIPT - was persisted verbatim to localStorage, readable at rest by any script on the origin. Only a display-only subset (id, name, name_display, type, status) is now persisted; the full object still lives in-memory during an active session exactly as before. A new bootstrap fetch (wired into Setup) re-hydrates the full profile once per app load using the same reduced signal, guarded so it never fires for a genuine guest.
-## [1.2.11] - 2026-07-19
-### Fixed
-- bff-mode 401 no longer logs the user out when the BFF confirms the session is still valid: the apiClient now rejects the failed request (letting react-query retry) instead of tearing down auth. A single account query 401ing (transient race or a flaky upstream call) previously bounced the user to /login even though they were logged in. Bearer mode unchanged.
-## [1.2.10] - 2026-07-19
-### Fixed
-- Resilient bff-mode auth: on a 401 the apiClient now confirms the session with the BFF (GET /bff/session) before logging out, and transparently retries the request once if still authenticated. Prevents a transient post-login 401 (an account query racing the login cookie hand-off) from bouncing the user straight back to the login page. Bearer mode is unchanged.
-## [1.2.9] - 2026-07-19
-### Added
-- **Selectable auth transport in `Queries/apiClient.ts`.** A new
-  `VITE_AUTH_MODE` env flag (`bff` | `bearer`, defaulting to `bff`) picks how
-  the Axios client talks to the API. In `bff` mode the client targets the
-  same-origin `/bff` with `withCredentials`, relying on the httpOnly
-  `bff_session` cookie so no Bearer token or CSRF token ever lives in
-  JavaScript. `bearer` mode preserves the legacy transport (`VITE_API_OBT`
-  base URL, `withXSRFToken`, localStorage token) for brands that cannot run a
-  server-side component at their origin.
-- **`isBffMode` export** derived from `VITE_AUTH_MODE`, re-exported from the
-  package root (`index.ts`) so consumers can branch on the active transport.
-- **`GatewayCredentials<T>` interface in `types/settings.ts`**, modelling the
-  new per-gateway shape of `{ mode, sandbox, production }` so every payment
-  gateway can store a sandbox and a production credential set plus which one
-  is active.
-### Changed
-- **`Queries/apiClient.ts` request interceptor is now bearer-only.** The
-  interceptor that reads `token` from localStorage and sets the
-  `Authorization` header is only registered when not in BFF mode; in BFF mode
-  there is no token in JavaScript to attach.
-- **`types/settings.ts` `LabelPayments` gateways reshaped.** `bkt`, `stripe`,
-  `mollie`, `raiffeisen`, and `nexi` are now wrapped in
-  `GatewayCredentials<...>` (sandbox/production/mode). The BKT credential key
-  was corrected from `authid` to `authId`, Stripe gained a `webhook_secret`
-  field, and `devpos` gained `mode`, `sandbox_url`, and `production_url` so
-  its API host is configurable per-label instead of hardcoded to the demo URL.
-- **`Providers.tsx` wraps the tree in an outer `<Suspense>` boundary.**
-  `Styles` and `Setup` both call `useGetSettings()` (a suspense query) above
-  the existing inner boundary; on a cold settings cache their suspension had
-  no boundary to catch it. The outer boundary shows the `loading` fallback
-  during the initial settings fetch; the module-scope QueryClient means the
-  suspended remount reuses the same cache with no refetch loop.
-- **`Notifications/Notifications.tsx` error toast duration raised to 6000ms**
-  (from the 4s default) so users are less likely to miss error notifications.
-- **`Setup/languages.ts` i18next `debug` is now `import.meta.env.DEV`** instead
-  of hardcoded `true`, silencing i18next debug logging in production builds.
-- **`Errors/Message.tsx` logo is now a keyboard-accessible control** (`role`,
-  `tabIndex`, `onKeyDown` for Enter/Space, `alt` text) with a matching
-  `:focus-visible` outline and `display: inline-block` in `Errors/styles.ts`.
-### Fixed
-- **Error page crash on non-English locales (`Errors/Message.tsx`).** The
-  translations lookup now falls back to `errors.en` when the selected locale
-  is absent from `errors.ts`; previously a non-English selection (e.g.
-  `localStorage` language `sq`) made the lookup `undefined` and crashed the
-  error page.
-- **Crash inside the 500 response interceptor (`Queries/apiClient.ts`).** The
-  server-error message lookup now falls back to `languages.en` for the same
-  reason, so a missing locale can no longer throw from within the error
-  interceptor itself.
-Authored by Ferjolt Ozuni. Consolidated from the magus and alvavel whitelabel
-patch sets into canonical @autobusal source (eliminates per-repo patch-package
-divergence).
-## 1.8.0
-`TicketData.status` ('active' | 'cancelled'). A passenger can now be
-cancelled without the rest of the booking going with them, so consumers need
-a way to tell. Optional - a missing value means 'active', which keeps older
-payloads and any not-yet-rebuilt consumer type-checking.