Merge pull request #116 from bitloops/modernise/pnpm-frontend-foundation

Modernise/pnpm frontend foundation

Author: danias

.dockerignore

@@ -0,0 +1,13 @@
+.git
+.github
+.vscode
+**/node_modules
+**/dist
+**/coverage
+**/.nyc_output
+**/*.log
+**/*.tsbuildinfo
+**/.env
+**/.development.env
+README.md
+k8s

.github/dependabot.yml

@@ -5,20 +5,19 @@
 
 version: 2
 updates:
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "/backend" # Location of package manifests
+  - package-ecosystem: "npm"
+    directory: "/"
     schedule:
       interval: "weekly"
     target-branch: "develop"
     labels:
       - "npm dependencies"
-      - "backend"
-      
-  - package-ecosystem: "npm"
-    directory: "/frontend"
+      - "workspace"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
       interval: "weekly"
     target-branch: "develop"
     labels:
-      - "npm dependencies"
-      - "frontend"
+      - "github actions"

.github/workflows/main.yml

@@ -1,43 +1,58 @@
-name: Node.js CI
+name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
-  build:
-
+  node:
+    name: Node workspace
     runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [20.11.1]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_DB: bitloops_test
+          POSTGRES_USER: user
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U user -d bitloops_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
 
     steps:
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'yarn'
-        cache-dependency-path: backend/yarn.lock
-    - name: Install Yarn
-      run: npm install -g yarn
-    - run: yarn install --frozen-lockfile
-      working-directory: backend
-    - name: Run build script if present
-      run: |
-        if grep -q "\"build\":" backend/package.json; then
-          yarn run build
-        else
-          echo "Build script not found. Skipping."
-        fi
-      working-directory: backend
-    - run: yarn test
-      working-directory: backend
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Build backend
+        run: pnpm --dir backend run build
+      - name: Lint backend
+        run: pnpm --dir backend run lint
+      - name: Test backend
+        run: pnpm --dir backend run test
+      - name: Test backend PostgreSQL integration
+        run: pnpm --dir backend run test:integration
+        env:
+          PG_DATABASE: bitloops_test
+          PG_USER: user
+          PG_PASSWORD: postgres
+      - name: Lint frontend
+        run: pnpm --dir frontend run lint
+      - name: Build frontend
+        run: pnpm --dir frontend run build
+      - name: Test frontend behaviour
+        run: pnpm --dir frontend/tests run test

.gitignore

@@ -1,2 +1,5 @@
 .DS_Store
 */.env
+node_modules
+.pnpm-store
+*.tsbuildinfo

CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to this project are documented in this file. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
+project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-07-31
+
+### Added
+
+- A pnpm workspace pinned through Corepack, with Node.js 24 and TypeScript 6.
+- A frontend anti-corruption layer that translates backend `completed` values
+  into the UI model's `isCompleted` property for REST and SSE messages.
+- Unit and behavioural frontend tests for transport mapping and Todo state
+  transitions.
+- PostgreSQL event sourcing for the Todo aggregate, including append-only
+  events, an optimistic version check, and a query projection.
+- A PostgreSQL transactional outbox and retrying NATS relay for Todo domain
+  events.
+- Real-PostgreSQL integration tests for atomic persistence and stale aggregate
+  rejection.
+- Backend linting, database integration tests, and PostgreSQL 18 in CI.
+- Production-focused Node.js 24 Docker images and validated Kubernetes
+  manifests.
+
+### Changed
+
+- Modernised the frontend to Vite 7, Redux Toolkit, current generated OpenAPI
+  client tooling, and an nginx runtime image.
+- Modernised the backend to NestJS 11, Fastify 5, ESLint 10, Jest 30, pnpm 11,
+  and TypeScript 6.
+- Consolidated IAM, Marketing, Todo projections, Todo events, and the outbox on
+  PostgreSQL as the sole application database.
+- Changed external browser communication to REST and server-sent events.
+- Made NATS publishing awaitable, bounded failed-message redelivery, and
+  isolated tracing delivery failures from business operations.
+- Aligned the root, backend, frontend, and frontend-test package versions at
+  `1.0.0`.
+
+### Removed
+
+- Yarn and npm lockfiles in favour of one pnpm lockfile.
+- MongoDB code, dependencies, Compose services, persistent volumes, and
+  Kubernetes resources.
+- The unused gRPC/protobuf generation pipeline, generated stubs, gRPC guard,
+  and Envoy deployment resources.
+
+### Security
+
+- Updated direct dependencies and constrained vulnerable Fastify/Nest
+  transitive packages to patched releases.
+- Stopped persisting request JWTs in Todo event or outbox metadata.

CONTRIBUTING.md

@@ -17,6 +17,20 @@ We recommend baby steps so you can get familiar with our contribution process. W
 If you decide to fix an issue, please be sure to check the comments in case somebody is already working on it. If there hasn’t been any activity, then leave a comment stating that you intend to work on it so other people don’t accidentally duplicate your effort.
 If the issue has already been claimed by someone else, but there hasn’t been any recent activity, then feel free to take over after leaving a comment. 
 
+Use Node.js 24 and the pnpm version pinned by the root `packageManager` field.
+Before opening a pull request, run the workspace gates:
+
+```bash
+corepack enable
+pnpm install --frozen-lockfile
+pnpm build
+pnpm lint
+pnpm test
+```
+
+Changes to Todo persistence should also include the PostgreSQL integration lane
+described in [`docs/backend-architecture.md`](./docs/backend-architecture.md).
+
 We would also welcome any new issues you may find. We do suggest searching for the particular issue you would like to report in the existing issue list before reporting new ones. In addition, if you do encounter any vulnerability issues, please do follow our [Security Policy](https://github.com/bitloops/bitloops-language/blob/main/.github/SECURITY) instead of creating a new issue. 
 
 ### Create a Pull Request

K8s.md

@@ -1,7 +1,45 @@
 # Deploying on Kubernetes
 
-Run the following script after making sure you have added the appropriate secrets to your configuration files located in the k8s folder:
+The manifests under `k8s` deploy the frontend, backend, PostgreSQL, NATS, and
+the observability services. MongoDB and the former Envoy/gRPC edge are no
+longer part of the deployment.
+
+## Prepare images and secrets
+
+Build and publish the application images, or load them into your local cluster:
+
+```bash
+docker build -f backend/Dockerfile -t todo-backend:latest .
+docker build -f frontend/Dockerfile -t todo-frontend:latest .
+```
+
+For a remote registry, change the image names in
+`k8s/deployment-todo-backend.yaml` and
+`k8s/deployment-todo-frontend.yaml` to immutable, registry-qualified tags.
+
+Before applying the manifests, replace every development value in
+`k8s/secret-bl-postgres-secret.yaml`, especially `POSTGRES_PASSWORD` and
+`JWT_SECRET`. Do not commit production secrets. PostgreSQL is the sole
+application database and uses the `bitloops` database by default.
+
+## Validate and apply
+
+Perform a client-side validation first:
+
+```bash
+kubectl apply --dry-run=client --validate=false -f k8s
+```
+
+Apply the namespace and resources in dependency order with:
 
 ```bash
 ./apply_k8s_files.sh
 ```
+
+The application image currently initialises its schemas idempotently at
+startup. For a production deployment, introduce a dedicated migration job
+before scaling the backend beyond one replica.
+
+Keycloak is not included in the 1.0.0 manifests. Its proposed database and
+deployment boundary are documented in
+[`docs/keycloak-iam-roadmap.md`](./docs/keycloak-iam-roadmap.md).