@galadrim/galadmin 0.2.11 → 0.3.0-alpha.2.1

package/.agents/report/port/2026-10-06-cycle-04-user-filters.md

@@ -0,0 +1,11 @@
+# Configured user-filter contracts — cycle 4
+
+Scope: `src/api/routes/foreignSelectRecords.ts`, `src/api/routes/records.ts`, `src/api/routes/recordsExport.ts` and shared user declarations/constructor. These routes scope foreign options, record lists and exports through configured callbacks. Outcome: accepted strict coverage, resolving the [prior user-filter failures](../failures/2026-09-23-api-user-filter-contract.md) with [revised identifier and session guidance](../remediation/2026-10-02-api-user-filter-remediation.md).
+
+**type:** [src/types/database.ts:2](../../../src/types/database.ts#L2) defines `DatabaseId = string | number`, reused by `TrustedUser.userId`. [src/types/config.ts:5](../../../src/types/config.ts#L5) defines `RootUser`, `RegularUser` and `FilterUser`; `isRegularUser` narrows established callback users. All three configured `filtersFromUser` declarations now accept one `FilterUser` object. [src/api/filterUser.ts:7](../../../src/api/filterUser.ts#L7) checks unknown session input and constructs that domain object without assertions, coercion or session mutation. Routes use established local request-body and database/query contracts; erased lookup assertions preserve original string indexing and optional configuration behavior.
+
+**attention:** the marked [session constructor](../../../src/api/filterUser.ts#L3) and filter branches in [foreign options](../../../src/api/routes/foreignSelectRecords.ts#L39), [record lists](../../../src/api/routes/records.ts#L36) and [exports](../../../src/api/routes/recordsExport.ts#L38) implement the authorized breaking callback change from `(userId, role)` to `(user)`. Root callbacks receive only `{ role: "root" }`; regular users retain exact string/numeric IDs, or receive `{ role }` for absent/undefined IDs. Invalid filtered sessions return HTTP 401 before callback/data query. Existing callbacks must adopt the object contract and explicitly handle root, missing IDs and string identifiers; affected repository fixtures are migrated. No legacy overload is introduced.
+
+The constructor validates object/role/ID shapes only at a configured filter boundary. Root treatment ignores IDs; regular string/number values are preserved without finite, positive, formatting or normalization restrictions. Routes without filters do not inspect the session. Callbacks retain their receiver, getter/invocation count, failure propagation and placement after original preceding table/body/filter evaluation. Other view/subview/request filters, authorization order and query/render behavior remain covered. Real-database tests verify SQL string escaping and matching list/export/foreign scoping, frozen-session identity, zero data-query calls on invalid users, and callback/error/evaluation ordering. Original characterization passed 281 tests and failed only 102 named authorized policy assertions.
+
+**checks:** ordinary build, strict `--noEmit`, compiler closure, 149 unit tests, 902 real-database integration tests across 17 suites and planner review pass; 4 preexisting skips excluded. Warning scan: 15 route non-null assertions reviewed against declarations/producers; 27 existing config `any` declarations unchanged; no added `any` or suppression. Complete plan, original/final test logs, diff, checked/reviewed hashes and review: `/tmp/ts-port-20261006/cycle04/` (session-local). The independent panel-roles blocker remains unresolved.

package/.agents/report/port/2026-10-06-resume-cycle-01-panel-import.md

@@ -0,0 +1,9 @@
+# Panel import — resumed cycle 1
+
+Scope: `src/api/routes/subrecordsImport.ts`, which imports configured parser output into a parent record's panel table. Outcome: accepted strict coverage, resolving the [panel import failures](../failures/2026-10-03-cycle-07-panel-import-parser-contract.md) using the [approved parser and panel-role contracts](../remediation/2026-10-06-import-parser-remediation.md).
+
+**type:** [src/types/config.ts:301](../../../src/types/config.ts#L301) shares `BaseTypeView`'s `roles?: string[]` declaration through `BaseTypePanel` and its request representation. The route reuses `DbManager` and the existing checked `Record<string, unknown>[]` parser boundary. Erased multipart/index, initialized-driver, and mutation-result assertions preserve original property access and response behavior; no new `any` or suppression is added.
+
+**attention:** the marked [src/api/routes/subrecordsImport.ts:50](../../../src/api/routes/subrecordsImport.ts#L50) rejects non-array parser results and primitive, null, undefined, array, function, or sparse-hole elements with HTTP 400 before insertion. Shape validation is necessary to establish the approved record-access contract. Valid array/record/field identities, custom prototypes, inherited enumeration, getter timing, parser receiver and exact parent arguments remain unchanged. Authorization still checks view before panel and bypasses role restrictions for root; the roles declaration adds no runtime validation. Parser exceptions and database/insertion failures retain their prior behavior. PostgreSQL's existing panel SQL incompatibility remains characterized as HTTP 500.
+
+**checks:** ordinary build, strict `--noEmit`, compiler closure, 149 unit tests, 989 real-database integration tests across 17 suites, warning assessment, and planner review pass; 4 preexisting skipped tests excluded. Original-source characterization passed 156 preservation tests and failed only 48 authorized sanitization assertions. Warning scan: 13 route non-null assertions justified against producers/guards; 27 existing configuration `any` declarations unchanged. Plan, original/final logs, complete diff, checked/reviewed hashes, and erased-runtime comparison: `/tmp/ts-port-resume-20261006/cycle01/` (session-local).

package/.agents/report/port/2026-10-07-cycle-01-api-assembly.md

@@ -0,0 +1,16 @@
+# API assembly — cycle 1
+
+Scope: `src/api.ts`, which filters request configuration and registers API routes. Outcome: accepted strict coverage. This resolves the [previous API assembly failure](../failures/2026-10-07-resume-cycle-02-api-assembly-contract.md) under the [approved remediation](../remediation/2026-10-07-api-assembly-remediation.md).
+
+**type:** `src/api.ts:56` gives the factory `DbManager` and `Config` parameters. `Column & StandardColumn` at [src/api.ts:103](../../../src/api.ts#L103) permits an optional name without requiring one. The read-only branch retains its literal `canCreate: false` type. Eight erased assertions preserve existing session and configuration access. The legacy Express session boundary remains unchanged; no new production `any` is added. The upstream `FakeDb` fix passes the typed factory without another adapter.
+
+**attention:** the marker at [src/api.ts:105](../../../src/api.ts#L105) records the sole runtime change: exclude null and undefined from `__hiddenColumns`. The original optional-name producer could not establish the existing `string[]` contract. The approved filter establishes it without changing column enrichment or authorization helpers.
+
+| Restricted column name | Hidden-name entry after the change | Effect |
+| --- | --- | --- |
+| `undefined` or `null` value | Removed | A missing name no longer strips or rejects a literal property named `"undefined"` or `"null"`. |
+| Any string, including `""`, `"undefined"`, or `"null"` | Retained | Named restrictions keep their existing read and write behavior. |
+
+The source column stays unchanged. Name getters still run at the original mapping point; the added filter reads mapped values only. Route registration, view filtering, read-only flags, session reads, import comparisons, and error behavior remain unchanged. Real-database tests check hidden metadata, GET responses, UPDATE status, and stored rows.
+
+**checks:** build, strict `--noEmit`, compiler closure, warning assessment, 149 unit tests, 992 integration tests across 17 suites, and planner review pass; 4 preexisting skipped tests excluded. Original characterization passed 225 checks and failed only the two approved nullish-policy assertions. All eight scan warnings are the justified session/configuration assertions. Independent transpilation confirms only the nullish-name filter changes runtime code. Plan, original/final logs, diff, hashes, and review: `/tmp/ts-port-20261007/cycle01/` (session-local).

package/.agents/report/port/2026-10-07-cycle-02-index-entry-point.md

@@ -0,0 +1,13 @@
+# Application entry point — cycle 2
+
+Scope: `src/index.ts`, which creates the Express app, session store, authentication handlers, and static-file routes. Outcome: accepted strict coverage for one backend source file.
+
+**type:** the local `MySQLSessionStoreConstructor` at [src/index.ts:22](../../../src/index.ts#L22) retains the declared callback constructor and adds the runtime-supported `mysql2/promise.Pool` overload, returning `session.Store`. The existing constructor call uses one narrow assertion; the actual store supports promise queries and real MySQL tests verify persistence and logout. The factory at [src/index.ts:27](../../../src/index.ts#L27) now infers `express.Express` instead of `any`. `passwordMatch` at [src/index.ts:93](../../../src/index.ts#L93) accepts the existing optional `boolean | undefined` flag. The login candidate at [src/index.ts:124](../../../src/index.ts#L124) is `DatabaseRow | undefined`, retaining the selected row object and configured ID value.
+
+Eighteen erased non-null assertions preserve the existing session, configuration, and MIME accesses: five MySQL fields, one trusted-auth callback, nine session accesses, one role loop, and two MIME inputs. They preserve existing failures for invalid configuration and unknown MIME types. The legacy Express session input contract remains unchanged. No new production `any`, double assertion, suppression, or ambient shim is added.
+
+**attention:** no runtime change and no new `#PORTING-EDIT` marker. Independent emitted-JavaScript comparison is identical. Existing authentication guards, configuration reads, callback receiver, registration order, object identity, static headers, and error behavior stay unchanged. The new real-MySQL characterization checks persisted sessions, logout deletion, trusted-auth revocation, text substitution, PNG bytes, and the existing unknown-MIME HTTP 500.
+
+Exact development declarations are added for `@types/express-mysql-session` 3.0.8, `@types/connect-pg-simple` 7.0.3, and `@types/bcryptjs` 2.4.6. All existing dependency lock entries remain unchanged; all nine added packages are development dependencies. The isolated runtime test loader characterizes the original source despite its incomplete store declaration; ordinary build and strict compilation verify the final source separately.
+
+**checks:** build, strict `--noEmit`, compiler closure, warning assessment, 149 unit tests, 993 integration tests across 18 suites, diff check, and planner review pass; four preexisting skipped tests excluded. Original characterization passed one focused integration test with no skips. All 18 scan warnings are the justified erased assertions. Plan, original/final logs, dependency comparison, runtime comparison, complete diff, hashes, and review: `/tmp/ts-port-20261007/cycle02/` (session-local).

package/.agents/report/remediation/2026-10-02-api-user-filter-remediation.md

@@ -0,0 +1,71 @@
+# API user filter remediation
+
+Scope: `src/api/routes/records.ts`, `src/api/routes/foreignSelectRecords.ts`, and `src/api/routes/recordsExport.ts`, which apply configured user filters to lists, foreign options, and exports. Supporting contracts are in `src/types/config.ts`; the shared identifier type belongs in `src/types/database.ts`.
+
+Date: 2026-10-02; revised 2026-10-06. Decision: user-approved guidance for a migration retry. This revision supersedes the numeric-only regular-user policy and addresses the October 3 failed retry.
+
+Failure: [API user filter contract, including the October 3 retry](../failures/2026-09-23-api-user-filter-contract.md).
+
+**type:** introduce the shared database identifier type in `src/types/database.ts`:
+
+```ts
+/** A supported database identifier: numeric, string, or UUID. */
+export type DatabaseId = string | number;
+```
+
+This type represents identifier values, not column names or array indices. Absence belongs to the consuming contract through an optional property or explicit union; do not include null or undefined in DatabaseId. Preserve numeric and string IDs exactly, including UUIDs and numeric strings. Do not convert, trim, parse, or fabricate IDs.
+
+In `src/types/config.ts`, import DatabaseId with `import type`, reuse it for `TrustedUser.userId?: DatabaseId`, and define the filter types:
+
+```ts
+export type RootUser = { role: "root" };
+export type RegularUser = { role: string; userId?: DatabaseId };
+export type FilterUser = RootUser | RegularUser;
+
+export function isRegularUser(user: FilterUser): user is RegularUser {
+  return user.role !== "root";
+}
+```
+
+The runtime constructor must always give a "root" role root treatment; RegularUser.role is a string and does not statically exclude "root". The guard narrows an already established FilterUser; it does not validate unchecked session data.
+
+The public callback contract becomes:
+
+```ts
+filtersFromUser?: (user: FilterUser) => string;
+```
+
+**policy:** invoke configured filters for both root and regular sessions.
+
+- Root callbacks receive `{ role: "root" }`, even when the session also contains an ID. Each callback defines its root filter; returning `""` adds no user filter.
+- Regular callbacks receive `{ role, userId }` when userId is a string or number, with the exact original value.
+- A regular user with missing or undefined userId receives `{ role }`. This is supported by the existing TrustedUser contract and does not by itself invalidate authentication. The callback must explicitly decide whether its access policy can operate without an ID.
+- Preserve other view, column, subview, and request filters. Never bypass a configured filter because an ID is absent or invalid.
+
+An owner-scoped callback may explicitly deny access without an ID:
+
+```ts
+filtersFromUser: (user) => {
+  if (!isRegularUser(user)) return "";
+  if (user.userId === undefined) return "1 = 0";
+  return ownerFilter(user.userId);
+}
+```
+
+Here ownerFilter is illustrative application code, not a new library helper. It must correctly escape supported string/numeric identifiers for the configured database. Do not reuse the previous raw numeric SQL interpolation for arbitrary string IDs. Applications may instead define role-based access for regular users without IDs.
+
+**attention:** validate unchecked session input before constructing a FilterUser for a configured callback. Require a non-null, non-array object and a string role. A "root" role takes precedence over the ID. For a regular role, accept absent/undefined userId, string IDs, and numeric IDs; reject null, boolean, array, object, bigint, or other unsupported ID types. Do not impose integer, positive-number, UUID-format, or string-normalization requirements as part of this retry.
+
+When a configured filter cannot receive a valid FilterUser, return HTTP 401 before invoking that filter or executing its data query. Do not silently omit the filter, invent a root identity, or pass invalid input through an assertion. Apply this behavior consistently to all three routes. Validate only at the configured filter boundary; retain existing authorization ordering and ordinary behavior for routes without configured user filters.
+
+This revision explicitly authorizes that local rejection behavior. Place the required #PORTING-EDIT marker immediately before each runtime change, documenting the reason and changed response/query behavior. Do not destroy or mutate the stored session, change login or trustedAuth behavior, add global authentication validation, or redesign session revalidation in this retry.
+
+**compatibility:** the user authorizes the breaking change from `(userId, role)` to one FilterUser argument. Update all three declarations, all three route calls, and affected repository test callbacks. Required-number consumers must migrate to the object argument, handle root and absent IDs explicitly, and narrow numeric versus string IDs when their application requires it. Do not add a legacy overload or infer callback signatures at runtime.
+
+DatabaseId is reusable for other primary-key contracts, but this retry only introduces it and adopts it in the filter and TrustedUser contracts. Do not replace generic DatabaseRow values, column-name fields such as primaryId, request view indices, or unrelated callback contracts. The known create/edit/delete callback mismatches and PostgreSQL's absent insertion ID still require their own policy; this document does not remove the issue #45 exceptions.
+
+**retry:** use a shared, checked session-to-FilterUser constructor for the three routes, with unknown confined to that boundary. Validate every promised property and construct the approved domain object through normal narrowing. Preserve callback receiver and existing invocation/error behavior for valid users. Do not add any, unchecked assertions, suppression comments, or weaken compiler settings.
+
+Set this document as the user-filter group's remediationReport in [the blocker index](../blockers.json). The entire three-route/declaration/test group may be retried; its failed files and blocked dependents remain blocked until acceptance. Other blocker entries remain unchanged.
+
+**checks:** report-only revision; no production source changes and no migration checks rerun. The retry must pass strict compilation, compiler closure, ordinary build, applicable integration tests, and required review. Use real databases with minimal mocks, following repository test rules. Cover root invocation (including root with an ID), numeric IDs (including zero), string/UUID IDs without coercion, regular trusted users without IDs, malformed users/roles and invalid IDs, HTTP 401 before callback/query on invalid filtered requests, unchanged sessions, unchanged authorization order, callback receiver/error behavior, and matching list/export scoping. Verify SQL handling for string IDs. Keep the blocker until the entire group passes these checks.

package/.agents/report/remediation/2026-10-02-api-values-remediation.md

@@ -0,0 +1,17 @@
+# API expression result remediation
+
+Scope: `src/api/values.ts`, which evaluates configured expressions and formats export and insertion values.
+
+Date: 2026-10-02. Decision: user-approved guidance for a migration retry.
+
+Failure: [API expression result contract](../failures/2026-09-23-api-values-contract.md).
+
+**accepted:** try `evalExpression(expression: string, data: Record<string, unknown>): unknown`. Annotate the direct `eval` result as `unknown`. `Record<string, unknown>` covers the string keys read by `for...in`; symbol keys are not enumerated.
+
+For this retry, the expression evaluator is an unchecked-value boundary. The user accepts `unknown` for its input field values and result, and for those results passed through formatting to CSV concatenation and JSON serialization. `getFormattedValue` may return `Promise<unknown>`. This is an explicit exception to the migration rule that internal interfaces use domain types. It does not authorize replacing unrelated domain types with `unknown`.
+
+**preserve:** keep direct `eval` in its current scope, including access to `data`, `statement`, and `varString`. Do not validate or restrict expression results. Preserve getter reads, object identity, CSV coercion, JSON serialization, null/undefined handling, the record's `options` assignment, and existing error behavior. Do not normalize, clone, or pre-serialize results to make them fit a narrower type.
+
+**retry:** try these annotations and ordinary narrowing first. Do not add `any`, assertions that claim a checked result, or suppression comments. If another compiler or migration-rule conflict remains, report its exact location and explain which `unknown` approach was tried and why it failed.
+
+**checks:** a strict compiler probe accepted the proposed signature, string-value narrowing, and string concatenation of an `unknown` result. This was not a full module migration. The retry must pass the required compiler, build, and applicable tests before this blocker is removed.

package/.agents/report/remediation/2026-10-03-callback-id-contract-remediation.md

@@ -0,0 +1,36 @@
+# Callback ID contract remediation
+
+Scope: `src/api/routes/createRecord.ts`, `src/api/routes/deleteRecord.ts`, `src/api/routes/deleteRecordFromPanel.ts`, and `src/api/routes/updateRecord.ts`, which forward record IDs to configured callbacks.
+
+Date: 2026-10-03. Decision: user-approved temporary type assertions for migration retries.
+
+Issue: [Callback ID types do not match current runtime values #45](https://github.com/galadrimteam/galadmin/issues/45).
+
+Failures covered:
+
+- [Create callback result contract](../failures/2026-10-01-cycle-02-create-callback-contract.md).
+- [Delete callback ID contract](../failures/2026-10-01-cycle-06-delete-callback-id-contract.md).
+- [Panel delete callback ID contract](../failures/2026-10-01-cycle-07-panel-delete-callback-id-contract.md).
+- [Edit callback ID contract](../failures/2026-10-01-cycle-13-update-callback-id-contract.md).
+
+**accepted:** preserve the existing public `id: number` callback contracts and runtime behavior. The user authorizes narrow `as number` assertions at the callback ID assignments for these four routes. This is an explicit exception to the migration's assertion restrictions for these known mismatches only. The assertions are not runtime validation and must not be described as proof that the IDs are numbers.
+
+Create example, after the insert ID has been read from the database result without changing its value:
+
+```ts
+// TODO: https://github.com/galadrimteam/galadmin/issues/45 — PostgreSQL supplies undefined.
+id: insertId as number,
+```
+
+Edit and delete example:
+
+```ts
+// TODO: https://github.com/galadrimteam/galadmin/issues/45 — Primary keys can be strings.
+id: primaryValue as number,
+```
+
+**preserve:** PostgreSQL create callbacks continue to receive `undefined`; MySQL/mysql2 insertion IDs remain unchanged. Edit and delete callbacks receive the original supplied key, including UUID strings and string route parameters. Preserve other payload fields, callback execution, error handling, HTTP callback payloads, and route responses. Do not add RETURNING, retrieve or fabricate IDs, convert keys with Number/parseInt, change public signatures, or suppress callbacks.
+
+**retry:** add a TODO with the issue URL beside each temporary ID assertion. Keep assertions limited to the ID expression; do not cast a whole request, database result, or callback payload. Use normal narrowing to read the database result: successful PostgreSQL row arrays have no insertId and yield `undefined`; mutation results expose their existing insertId. Report any additional shape conflict rather than hiding it behind an assertion. Remove the temporary assertions when issue #45 resolves the contracts.
+
+**checks:** the current real-database create test at `tests/integration/routes.crud.integration.test.ts:434` records successful insertion and `id: undefined` on PostgreSQL. The other failure reports record historical UUID edit/delete tests; those temporary tests were removed. No tests were rerun for this report-only change. Each migration retry must pass strict compilation, build, applicable integration tests, and required review. Keep every blocker until its own group passes those checks; this report permits retries, not automatic acceptance.

package/.agents/report/remediation/2026-10-06-import-parser-remediation.md

@@ -0,0 +1,41 @@
+# Import parser-element remediation
+
+Scope: `src/api/routes/recordsImport.ts` and `src/api/routes/subrecordsImport.ts`, which import configured parser results into a view or panel table.
+
+Date: 2026-10-06. Decision: user-approved parser shape validation, unchecked field-value boundary, and shared panel-roles declaration for migration retries.
+
+Failures:
+- [Record import parser-element contract](../failures/2026-10-03-cycle-06-record-import-parser-contract.md).
+- [Panel import parser-element contract](../failures/2026-10-03-cycle-07-panel-import-parser-contract.md).
+
+**accepted:** keep the public parser declarations unchanged. View parsers retain `(file: FormDataFile) => Promise<any[]>`; panel parsers retain `(file: FormDataFile, id?: any) => Promise<any[]>`. This preserves existing declarations; it does not authorize adding new any types.
+
+**panel roles:** extend `BaseTypePanel` with `Pick<BaseTypeView, "roles">` in `src/types/config.ts` to share the existing `roles?: string[]` contract. `RequestPanel` inherits this property through `ViewPanel`; reuse that declaration instead of adding a separate request-only roles type.
+
+Trust the host application's configuration. Supported panel roles are absent or a string array. String, numeric, boolean, and null values are unsupported configuration; their accidental behavior, including substring matching, need not be preserved. Add no runtime roles validation and keep `canWriteView`, its root bypass, and the existing view-then-panel authorization order unchanged.
+
+This declaration resolves the panel-roles blocker reported in the 2026-10-06 retry. Check absent roles, empty arrays, allowed and denied array roles, root access, and authorization rejection before parser invocation with real-database integration tests.
+
+Receive each configured parser's result as unknown internally. Validate that it is an array and that every element is a non-null, non-array object before using it as a record. Reject primitive, null, undefined, array, and function elements. Custom object instances remain supported; do not require a plain prototype.
+
+The approved internal record shape is `Record<string, unknown>`. The parser output, its record fields, and values passed to the existing insertion formatter are an explicitly permitted unchecked-value boundary. This exception does not authorize unrelated internal interfaces to use unknown. A checked helper may establish the string-indexed property-access shape through normal narrowing; it must not claim that fields are validated database/domain values or use unchecked assertions to claim a valid parser result.
+
+**policy:** if the result is not an array or any element is invalid, reject the entire import with HTTP 400 before building or executing its insertion query. Use `res.sendStatus(400)`; do not skip invalid rows, perform a partial import, or convert invalid elements into objects. Validate every indexed element, including sparse-array holes as undefined; Array.every alone skips holes and is insufficient.
+
+An empty array retains HTTP 200 with `{ affectedRows: 0 }`. Preserve existing view/panel authorization and panel configuration checks before invoking the parser. Preserve parser arguments, callback receiver, and invocation count.
+
+**preserve:** retain the existing for-in column enumeration, including inherited enumerable keys. Do not replace it with own-key enumeration. Validate only array and element shapes, without recursively inspecting field values, cloning records, reading field getters early, normalizing values, or restricting prototypes. Keep object and field identity and existing getter/property-read timing during column enumeration and insertion formatting.
+
+Preserve field values exactly and pass them through the existing formatValueForInsertion behavior, including numeric/string/boolean/date/object handling. Missing fields in a row continue to produce undefined through indexed access and receive the formatter's current handling. Do not normalize missing fields to null, add defaults, coerce IDs, or fabricate columns.
+
+**attention:** the user authorizes rejecting non-array results and invalid elements with HTTP 400. This changes historical behavior where string elements exposed character-index columns or null entries failed later during value access. Place the required #PORTING-EDIT marker immediately before each runtime change, explaining the shape requirement and rejection before insertion.
+
+Only malformed resolved parser output receives this new 400 behavior. Parser exceptions/rejections remain outside this remediation; do not move parser invocation into a catch or alter those failures. Retain existing database/insertion error responses. Panel parent-ID parsing/interpolation, PostgreSQL panel SQL compatibility, and insertion-result/affectedRows contracts remain outside scope.
+
+**retry:** introduce or reuse one shared shape validator for both routes, keeping unknown at the approved parser/formatter boundary. Preserve the original array and record instances when validation succeeds. Use normal narrowing; do not add unchecked assertions, suppression comments, or weakened compiler settings. If strict typing reveals another conflict, report it instead of extending this exception.
+
+Link this report from both import entries in [the blocker index](../blockers.json). This guidance permits retries of both failed groups; each route still requires its own acceptance checks and review. Keep failed files and blocked dependents in the index until their corresponding group is accepted. Preserve unrelated blockers and remediation links.
+
+**checks:** report-only decision; production source/config interfaces are unchanged and migration tests have not been rerun. Each retry must pass strict compilation, compiler closure, ordinary build, applicable integration tests, warning assessment, and required review. Follow repository test rules with real databases and minimal mocks.
+
+Cover both routes: valid object rows and mixed field types; empty-array success; non-array results; primitive/null/undefined/array/function elements; sparse holes; invalid elements after valid rows returning 400 without insertion; preserved inherited keys, custom prototypes, getters, object/field identity, and missing-field behavior; authorization rejection before parser invocation; unchanged panel parent-ID arguments; and unchanged parser-exception and database-error behavior. Reuse valid existing evidence and keep preexisting PostgreSQL panel failures characterized rather than fixing them in this retry.

package/.agents/report/remediation/2026-10-06-rich-text-upload-remediation.md

@@ -0,0 +1,33 @@
+# Rich-text upload boundary remediation
+
+Scope: `src/api/routes/uploadFileFromBetterRichTextInput.ts`, which authorizes a selected rich-text column and passes its server-configured upload settings to the shared uploader. The client identifies the column through `viewIndex` and `columnId` query parameters.
+
+Date: 2026-10-06. Decision: user-supplied production fix reviewed as guidance for a migration retry.
+
+Failure: [Rich-text upload header contract](../failures/2026-10-01-cycle-15-rich-text-upload-boundary-contract.md).
+
+**accepted:** the production fix [277ed9f — resolve rich-text upload settings on the server](https://github.com/galadrimteam/galadmin/commit/277ed9f1704173d06c7c426ef4886519cc8371f4) replaces client-supplied JSON settings with server-side column lookup. Current master is cb372254abb766fdcb608ebd2cdaf15f3c998ddb; the migration branch includes it (comparison reports master as the merge base, zero commits behind). The extracted migration route and frontend contain the fix.
+
+This supersedes the old request for primitive normalization and invalid JSON-field policies. The route no longer parses the file-upload-properties header, so header values such as 0, malformed JSON, or numeric pathTransform cannot become upload settings. Missing and arbitrary legacy headers are ignored; do not restore a header fallback.
+
+**type:** reuse FileUploadProperties and the existing configured column/request types. Upload settings originate in server configuration, where pathTransform can remain a function. Query parameters remain an external boundary and require ordinary string narrowing. Resolve a betterRichText column with configured fileUploadProperties before calling uploadFile. Do not claim JSON can contain callable transforms, introduce any, or broaden the uploader contract.
+
+**preserve:** use the exact server-configured settings object, including callable S3/GCP transforms, storage destinations, and existing uploader behavior. Do not serialize, clone, normalize, or reconstruct those settings. Preserve client query construction through URLSearchParams and removal of the legacy settings header.
+
+Retain the fixed route's target resolution and response behavior:
+- Require string viewIndex containing only digits and a string columnId; malformed queries return 403.
+- Resolve viewIndex against the request's role-filtered views. Missing or non-writable views return 403 before uploader invocation.
+- Search view columns and panel createConfig columns for the configured column ID.
+- Missing or role-restricted columns return 403.
+- A column that is not betterRichText or has no fileUploadProperties returns 400 with `{ error: "Invalid rich-text upload column" }`.
+- Valid authorized targets call uploadFile(settings, "upload", req, res). Target checks occur before the shared uploader parses multipart data or contacts storage.
+
+The historical broad check for any writable view is superseded by authorization of the selected view and column. These runtime changes are already in the user-supplied baseline; the strict retry must preserve them, not reproduce the old header behavior. Do not add new server-configuration validation, storage policies, index normalization, authorization redesign, or legacy-client compatibility behavior in this retry.
+
+**retry:** the original failure's unchecked-JSON versus callable-field conflict is resolved by the production fix. Retry the route against the current rebased source, narrow query/configuration lookups, and add its strict entry only after compiler closure and checks pass. Any new runtime change requires separate justification under the migration rules and the required #PORTING-EDIT marker. Report unrelated compiler or configuration conflicts rather than hiding them behind assertions.
+
+Set this report as the rich-text upload group's remediationReport in [the blocker index](../blockers.json). Keep the failed file and blocked dependents until the group passes acceptance review and required checks. Preserve other remediation links and blocker entries.
+
+**checks:** source review covered the master fix, extracted route, client query construction, configuration enrichment, uploader signature/transform calls, and added frontend/integration coverage. Twelve focused route probes passed using the current route and authorization helper: server settings identity and callable transform; ignored malformed/primitive legacy headers; panel creation-column lookup; malformed/missing/out-of-range targets; read-only views; missing/restricted columns; wrong column type; and absent settings. An uploader call recorder verified no calls on rejected requests. These were isolated handler probes with no database or real storage execution; TypeScript transpilation was used to execute them and is not strict compilation. Local probe: /tmp/rich-upload-review/probe.cjs.
+
+The committed regression tests cover S3/GCP transforms with mocked storage SDKs, ignored legacy headers, role-filtered indexes, panel columns, target authorization, and client URL/header construction. Their presence was reviewed; they were not rerun in this workspace. Full ordinary build, strict compilation, and integration/frontend suites were not run for this report-only change and no strict acceptance is claimed. The retry must pass strict compilation, compiler closure, build, applicable real-database upload/authorization tests, warning assessment, and required review. Actual remote storage behavior remains unverified.

package/.agents/report/remediation/2026-10-07-api-assembly-remediation.md

@@ -0,0 +1,32 @@
+# API assembly remediation
+
+Date: 2026-10-07. Scope: retry strict typing of `src/api.ts` after the [failed attempt](../failures/2026-10-07-resume-cycle-02-api-assembly-contract.md).
+
+The user approved the proposed `DbManager` typing, an update to the existing `FakeDb`, and filtering nullish column names from `__hiddenColumns`.
+
+## Database test helper
+
+The user permits updating this existing database mock despite the repository's general rule against database mocks. Tests need not become strict; test-side assertions are permitted. Production contracts and compiler checks must remain intact.
+
+This fix is complete: [FakeDb](../../../tests/helpers/fakeDb.ts#L20) implements `DbManager`, provides a no-op `init`, and derives its query return type from `DbManager`. Query results contain `err`, `rows`, and `fields`. Existing fixture inputs remain flexible. All 149 unit tests passed with `npm run test:unit -- --runInBand` after the change.
+
+## Hidden column names
+
+Keep [column names optional](../../../src/types/config.ts#L38). When [the API collects restricted column names](../../../src/api.ts#L99), remove null and undefined values:
+
+```ts
+__hiddenColumns: view.columns
+  .filter((column) => !allowed(column))
+  .map((column) => column.name)
+  .filter((name): name is string => name != null),
+```
+
+This approved behavior change keeps `__hiddenColumns` as `string[]` in request and authorization types. Preserve empty strings and all other string names. Do not require a name, invent one, or change column enrichment.
+
+An unnamed restricted column will no longer cause [read stripping](../../../src/api/authorization.ts#L118) or [write checks](../../../src/api/authorization.ts#L128) to treat it as a property named `"undefined"`. Keep these helpers and the import route's string comparison unchanged. Place the required `#PORTING-EDIT` marker at the filter change.
+
+## Retry checks
+
+Check that named restricted columns still lose their fields in read responses and reject writes with HTTP 403. Check that unnamed restricted columns produce no hidden-name entry and no longer remove or reject a property named `"undefined"`. Use real-database integration tests under repository test rules.
+
+The production filter is approved for the retry but has not been applied. Run the build, strict compilation, compiler closure, applicable tests, warning assessment, and required review before accepting the group. Keep the blocker and its dependents listed until acceptance. Report any new issue instead of expanding this remediation.

package/.agents/skills/port-javascript-to-typescript/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: port-javascript-to-typescript
+description: Migrate JavaScript or loosely typed TypeScript to strict TypeScript.
+---
+
+# Port JavaScript to TypeScript
+
+Port the smallest eligible dependency group per batch. Complete one batch unless continued migration is requested. Default to backend source; frontend and test typing require explicit scope.
+
+Follow the [shared rules](references/rules.md) throughout the migration.
+
+## Agents
+
+Each agent reads its role reference and supplied inputs. Spawn with `fork_turns: "none"` and explicit `model` / `reasoning_effort`:
+
+| Role | Model | Reasoning |
+|---|---|---|
+| Selector | `gpt-6-luna` | medium |
+| Planner | `gpt-6-astra` | high |
+| Implementer | `gpt-6-luna` | medium |
+
+Report unavailable models or delegation before using a fallback.
+
+## Prepare
+
+Read repository instructions. Establish scope and record commands/working directories for the compiler, build, unit/integration tests, and [CLI tools](references/tools.md). Use disposable test services.
+
+Preserve initial source/tests/configuration and user edits. Establish passing build, test, and existing strict baselines. Without a strict configuration, record no strict coverage; extend the source configuration with `strict` and replace inherited file lists for the selected group. An empty program is not a baseline. Resolve missing tooling within scope; required build migrations block the attempt.
+
+Read relevant reports for prior type decisions and failures, checking them against current source. Reuse unchanged evidence.
+
+## Run a batch
+
+1. Run the recorded graph command and collect compiler file lists and diagnostics, using the source project if no strict project exists. Refresh blockers and approve retries according to [blockers.md](references/blockers.md).
+2. Spawn the [selector](references/selection.md). Supply its reference, area, owned-source scope, accepted files, CLI output paths, and blockers with approved retries.
+3. Verify selection and compiler closure; add explicit strict entries without removing accepted files. Resolve omitted dependencies; send type errors to the planner.
+4. Spawn the [planner](references/planning.md) with the group, diagnostics, original code, relevant reports, retry guidance, and commands.
+5. Spawn the [implementer](references/porting.md) with that plan and its linked evidence. Send plan blockers back to the same planner.
+6. Return the complete attempt diff and check evidence to the same planner for review. Send findings to the same implementer. Abort after three unsuccessful review rounds, or earlier when the rules cannot be met.
+7. Follow [reporting.md](references/reporting.md) to finish or restore the attempt. Finish the report and any authorized commit before selecting again. Stop when no eligible group remains.
+
+Use Git and commit only when authorized. Never push. Return the area, newly strict file count, check results, report path, and actual commit identifier if committed.

package/.agents/skills/port-javascript-to-typescript/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Port Javascript to Typescript"
+  short_description: "Port minimal dependency groups to strict TypeScript"

package/.agents/skills/port-javascript-to-typescript/references/blockers.md

@@ -0,0 +1,31 @@
+# Blockers
+
+The master maintains `.agents/report/blockers.json`, an array of failed dependency groups:
+
+```json
+[
+  {
+    "failedFiles": ["src/example.ts"],
+    "failureReport": ".agents/report/failures/example.md",
+    "blockedDependents": ["src/service.ts"],
+    "remediationReport": null
+  }
+]
+```
+
+Use repository-relative paths and sorted, unique lists. `blockedDependents` contains all reverse transitive local dependents outside the failed group.
+
+## Before selection
+
+Reconcile missing entries from unresolved failure reports, consulting success reports to avoid restoring resolved blockers. An absent index does not mean no failures. Preserve existing entries during reconciliation.
+
+Refresh only dependent lists from the current graph. Approve a failed group's retry only when its externally supplied `remediationReport` exists and gives sufficient guidance within authorized scope. Read it with the latest failure evidence; pass approved retries to the selector and implementation guidance to the planner. Preserve the link during assessment. Approval does not unblock dependents or authorize behavior changes.
+
+Store externally supplied remediation documents in `.agents/report/remediation/` with unique `YYYY-MM-DD-area.md` names. Set `remediationReport` to the repository-relative document path.
+
+Migration agents never create, edit, or link remediation documents.
+
+## After an attempt
+
+- Failure: create the index if needed, add/update the failed group and report link, and compute dependents from restored source. Always reset `remediationReport` to `null`, including on retries. Leave unrelated entries unchanged.
+- Success: remove a blocker only after its entire group passes planner review and required checks. Retain the failure report as history and link it from the success report.

package/.agents/skills/port-javascript-to-typescript/references/planning.md

@@ -0,0 +1,43 @@
+# Plan and review
+
+Follow the [shared rules](rules.md). Read selected code, callers, declarations, schemas, tests, and retry evidence. Establish behavior and contracts. Send new dependencies to the master before expanding scope.
+
+## Prepare the handoff
+
+Reuse existing coverage. Add only missing unit or integration tests for meaningful behavior, following repository test rules. Run characterization tests against the original implementation. For approved sanitization, identify the intended failing assertion; unrelated failures block handoff.
+
+Hand off only implementation decisions: paths/renames, reused types, definitions/owners of new complex types, guards, and justified behavior changes. Link tests, baseline results, and check commands. Hand off when every selected file has resolved type decisions and characterization tests pass, except documented sanitization assertions. Link evidence instead of repeating source or logs.
+
+## Types and boundaries
+
+Keep types near their owner; share them when meaning or use is shared. Use generics only for input/output relationships. Discriminants must exist at runtime. Do not make required fields optional to hide incompatible contracts.
+
+Plan `import type` for type-only symbols without losing side-effect imports. Avoid typing constructs that add runtime behavior.
+
+Prefer trustworthy declarations and existing parsers. Boundary helpers must validate every promised property and return domain types. Reject unchecked generic results and casts disguised as guards. Error helpers must preserve logging, response, and rethrow behavior.
+
+Prefer narrowing. Assertions must be narrow, local, and justified against real producers and consumers; non-null assertions need the same evidence.
+
+## Sanitization exception
+
+Permit minimal input/result sanitization only when accurate types and existing helpers cannot establish a coherent contract. Trace caller effects, including identity, coercions, property reads, mutations, and exceptions. Unrelated fixes and refactoring are outside scope.
+
+Immediately before each behavior change, retain this marker with its reason:
+
+```ts
+/*
+#PORTING-EDIT
+Explain why sanitization is necessary and what behavior changes.
+*/
+```
+
+Test the change and surrounding behavior. Change expectations only for documented sanitization, preserving other coverage. Justify necessity and minimality in planning and review. Return `ABORT` with evidence if contracts require broader changes.
+
+## Review the implementation
+
+Follow repository review-tool requirements. Compare original/current code, the complete diff, callers, and retry evidence against the shared rules. Question the plan's assumptions. Return source fixes to the implementer; change tests only to correct the contract.
+
+- Verify compiler closure, strict entries, renames, and JavaScript coverage. Imported files can enter despite `exclude`; inclusion alone does not establish accepted coverage.
+- Inspect check logs and warning decisions for the reviewed state. Reuse valid results; add targeted probes for unresolved behavior or uncertain evidence.
+
+Return `ACCEPT`, `CHANGES_REQUIRED`, or `ABORT` with evidence and the reviewed state. Findings need a location, violated rule, and resolution criterion. Acceptance requires all checks passing, no unresolved findings, and justified marked changes. Changes to relevant source, tests, or configuration require renewed checks and review.

package/.agents/skills/port-javascript-to-typescript/references/porting.md

@@ -0,0 +1,9 @@
+# Implement
+
+Follow the [shared rules](rules.md) and the planner's handoff. Read the selected code and linked types/tests, then apply the specified renames, types, and guards. Preserve runtime imports, module format, output paths, and public imports. Update strict entries for approved renames/helpers; preserve accepted entries and compiler settings.
+
+If the plan cannot resolve a type error or preserve behavior, return the exact diagnostic, path, and conflicting contract to the planner. Do not invent contracts, expand scope, or edit tests.
+
+Run every recorded deterministic check: compiler closure and strict compilation, build, [warning scan](tools.md), applicable unit tests, the integration suite, and focused behavior checks. Inspect diagnostics and confirm intended tests ran. Fix implementation failures; send environment blockers to the master.
+
+Return `READY_FOR_REVIEW` only when all checks pass. Link the diff and check logs; identify the checked state, warning decisions, and plan deviations. Otherwise return a specific blocker or `ABORT`. Apply planner findings and rerun affected checks before returning.

package/.agents/skills/port-javascript-to-typescript/references/reporting.md

@@ -0,0 +1,24 @@
+# Reports and completion
+
+The master stores success reports in `.agents/report/port/` and failure reports in `.agents/report/failures/`. Use unique `YYYY-MM-DD-area.md` names. On a failed retry, append a dated attempt to the existing report, retaining earlier evidence. Exclude secrets and full private payloads.
+
+Use Rust compiler style: neutral messages with exact symbols, types, values, code examples and visual help. Use ASD-STE100 language : the report should be helpfull and enable the reviewer to make an informed decision.  
+
+Start with scope (selected files) and module responsibility in one or two sentences. Show repository-root-relative `file:line` labels; link to paths relative to the report file's directory with `#L<number>` line anchors. 
+
+Link detailed evidence instead of repeating logs or workflow history.
+
+## Success
+
+- `type`: each new important domain or shared-contract type, its location, and what it represents.
+- `attention`: each runtime change, its `#PORTING-EDIT` location, why a type-only port was insufficient, the chosen behavior, caller effects, and test evidence.
+- `checks`: one line with results and limits.
+
+Report-only edits need no rerun. For authorized commits, inspect exact contents: only reviewed, owned changes, the report, and blocker updates. Stop if user edits cannot be separated safely. Report the actual commit identifier; otherwise leave changes uncommitted.
+
+## Abort
+
+1. Preserve diagnostics and behavior evidence. Restore only the failed attempt's source, tests, renames, helpers, and configuration; preserve user work and earlier accepted groups. Report any cleanup conflict.
+2. Write one `error` per root cause: source location, conflicting contracts, and a concrete call that exposes the conflict. Distinguish type errors from observed runtime failures. End with `help`: the required decision or fix for retry; label optional suggestions. For environment failures, give the failed command and cause. Link preserved evidence.
+3. Update the [blocker index](blockers.md). An authorized failure commit contains only the failure report and index changes. Keep earlier accepted work separate.
+4. Return `ABORT` with report paths and cleanup state. Never bypass failing commit hooks. Continue to another group only when requested.

package/.agents/skills/port-javascript-to-typescript/references/rules.md

@@ -0,0 +1,8 @@
+# Shared rules
+
+- Preserve signatures, defaults, return values, side effects, errors, and runtime module behavior. Only the rare, minimal [sanitization exception](planning.md#sanitization-exception) permits behavior changes.
+- Keep `unknown` at external boundaries and their parsing/error helpers. Internal interfaces use domain types.
+- Use one absence representation per contract unless callers depend on distinct states. Normalize only under the sanitization exception.
+- Prefer inference and existing types. No added `any`, double assertions, broad ambient declarations, suppression comments, or weakened compiler settings. Inspect existing escape hatches in selected code too.
+- Preserve the ordinary build and runtime target. Check migration source through a separate strict configuration with the installed compiler and `--noEmit`; retain compiler-cache settings. Never weaken tests to pass. Skipped suites and environment failures are not passes.
+- Only one agent writes at a time. The planner writes tests; the implementer edits production source and approved strict entries; the master owns other configuration and reports. Any `ABORT` ends the attempt.

package/.agents/skills/port-javascript-to-typescript/references/selection.md

@@ -0,0 +1,16 @@
+# Select
+
+Read only this reference and the supplied CLI evidence, scope, accepted strict files, and blocker list. Make no edits or contract decisions.
+
+1. Report incomplete scope, failed tools, or unresolved imports as `SELECTION_BLOCKED`. Expected type errors in unported files do not block selection.
+2. For each unaccepted source file in the requested area, form its transitive local dependency group, excluding accepted files and external declarations. Keep cycles intact. Dependencies outside authorized scope need a master decision.
+3. Exclude groups containing `blockedDependents` or failed files without a master-approved retry. A retry includes the entire failed group and its dependency closure; its dependents remain blocked until acceptance.
+4. Select the group with the fewest newly strict owned files. Break ties by sorted repository-relative paths.
+
+Return:
+
+- `SELECTED`: group, count, accepted dependencies, direct callers, and relevant evidence/blocker references.
+- `NO_SELECTION`: area complete or all groups blocked, with blocker references.
+- `SELECTION_BLOCKED`: missing evidence or required scope decision.
+
+Link CLI output instead of copying it.

package/.agents/skills/port-javascript-to-typescript/references/tools.md

@@ -0,0 +1,20 @@
+# CLI tools
+
+Run the bundled scripts from the repository root. They use pinned npm tools and require Bash, npm, and Node.js 22.12+. First use may need network access. Use `--help` for arguments.
+
+```sh
+bash /path/to/skill/scripts/graph.sh tsconfig.json <source-roots-or-entry-files>
+bash /path/to/skill/scripts/check.sh <selected-and-supporting-source-files>
+```
+
+## Graph
+
+`graph.sh` emits a JSON map of repository-relative file paths to imports. Record and reuse the verified source scope, including dependencies and callers but excluding vendored/generated candidates. Read stderr for unresolved imports and skipped files; resolve gaps before selection. Computed imports and runtime-loaded modules require separate inspection.
+
+The graph includes type-only and literal dynamic imports and mixed module formats. It establishes static dependencies, not strict acceptance. Verify compiler closure with the installed compiler's `--noEmit --listFilesOnly` and confirm renamed JavaScript receives strict coverage.
+
+## Warnings
+
+`check.sh` checks explicit `any`, non-null assertions, and suppression comments. It emits JSON without fixes and ignores repository ignore files. Warnings normally exit zero: inspect each diagnostic and lint-disable comment. Parse/setup/execution errors are failures. This scan does not replace strict compilation, build, or integration tests.
+
+When modifying these scripts, run `node /path/to/skill/scripts/test-tools.cjs`.

package/.agents/skills/port-javascript-to-typescript/scripts/check.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ ${1:-} == --help || ${1:-} == help ]]; then
+  printf '%s\n' 'Usage: check.sh <source-file-or-directory> [...]' \
+    'Print Oxlint warnings as JSON. This does not replace the strict compiler or tests.' \
+    'Requires Bash, Node.js 22.12+ and npm; npx may download the pinned tool.'
+  exit 0
+fi
+if (( $# == 0 )); then
+  printf '%s\n' 'Usage: check.sh <source-file-or-directory> [...]' >&2
+  exit 2
+fi
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+exec npx --yes --package=oxlint@1.85.0 -- oxlint \
+  --config "$script_dir/oxlint.json" --no-ignore --format json -- "$@"

package/.agents/skills/port-javascript-to-typescript/scripts/graph.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ ${1:-} == --help || ${1:-} == help ]]; then
+  printf '%s\n' 'Usage: graph.sh <tsconfig.json> <source-file-or-directory> [...]' \
+    'Print the Madge dependency graph as JSON. Inspect stderr for skipped files.' \
+    'Run from the target repository. Requires Bash, Node.js and npm; npx may download the pinned tool.'
+  exit 0
+fi
+if (( $# < 2 )); then
+  printf '%s\n' 'Usage: graph.sh <tsconfig.json> <source-file-or-directory> [...]' >&2
+  exit 2
+fi
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+repo_dir=$PWD
+paths=()
+for path in "$@"; do
+  case "$path" in
+    /*) paths+=("$path") ;;
+    *) paths+=("$repo_dir/$path") ;;
+  esac
+done
+cd -- "$script_dir"
+export madge_config="$script_dir/madge.json"
+command=(npx --yes --package=madge@8.0.0 -- madge --no-color --no-spinner
+  --basedir "$repo_dir" --ts-config "${paths[0]}")
+# Madge omits skipped-file warnings in JSON mode.
+"${command[@]}" --warning -- "${paths[@]:1}" >&2
+exec "${command[@]}" --json -- "${paths[@]:1}"

package/.agents/skills/port-javascript-to-typescript/scripts/madge.json

@@ -0,0 +1,12 @@
+{
+  "fileExtensions": ["js", "jsx", "ts", "tsx", "mjs", "cjs", "mts", "cts"],
+  "includeNpm": false,
+  "excludeRegExp": [],
+  "webpackConfig": null,
+  "requireConfig": null,
+  "detectiveOptions": {
+    "es6": { "mixedImports": true },
+    "ts": { "mixedImports": true, "skipTypeImports": false, "skipAsyncImports": false },
+    "tsx": { "mixedImports": true, "skipTypeImports": false, "skipAsyncImports": false }
+  }
+}