Android now uses google_account_token (no googleid or
play-services-auth). Desktop PKCE sends client_secret.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzxdWY1k4muZfdVJfb7YGJ
ts_core and web_ui depend on `link:../ts_config`. pnpm links the directory
and installs nothing inside it, and a flat config imports its plugins from
the preset's own node_modules, so CI died on "Cannot find package
'@eslint/js'" while the local tree (where ts_config had been installed by
hand) passed. Both workflows now `pnpm install` in ts_config first, and
trigger on ts_config/** too so a preset change re-verifies its consumers.
The same push turned the dependency-freshness job red on five pins that had
aged underneath it (ruff 0.16.8 in four requirements.txt,
flutter_secure_storage 11.2.0 in crdt_sync_flutter); bumped, pubspec.lock is
ignored in that package so nothing else moves.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DnAYyNH1Sm4iJNidfYbrZJ
sync_settings_ui 0.4.1 and crdt_sync_flutter 0.3.1 both pinned the v0.11.0
tag, which predates crdt_sync_dart's exact pins -- so anything taking these
libraries resolved the shared package to its pre-upgrade constraints.
`flutter pub get` re-resolves cleanly in both; 88 tests green in
crdt_sync_flutter, 35 in sync_settings_ui, 321 in crdt_sync_dart.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
Exact-pins every registry dependency (crypto 3.0.7, google_sign_in 7.2.0,
http 1.6.0, shared_preferences 2.5.5, url_launcher 6.3.2, uuid 4.6.0) and takes
flutter_secure_storage 10.3.1 -> 11.0.0, a major.
The major is safe here for a specific reason, not by assumption. 11.0.0 removes
the algorithms deprecated in v10 and makes data written by them unreadable --
but this package has been on ^10.x throughout, and v10 migrated that data
automatically. It also removes `encryptedSharedPreferences` and
`sharedPreferencesName` from `AndroidOptions`; keystore.dart constructs a bare
`FlutterSecureStorage()` and passes no AndroidOptions at all, so neither is
reachable from here. The remaining break is minSdk 24 / compileSdk 37, which
consuming apps inherit from `flutter.minSdkVersion` (Flutter 3.35 already
raised its own floor to 24) and which fails a Gradle build loudly if wrong.
Analyze clean, 88 tests green, coverage held at 202/202 (100%).
Also installs the dependency-freshness gate in pre-commit -- the first repo to
carry it. Pre-commit only, not CI: the other ten manifests here are not
upgraded yet, and `--all` in CI would be permanently red until they are. The
`files:` regex means a source-only commit makes zero network requests.
Proven in both directions through the hook itself, not just the CLI:
crdt_sync_flutter/pubspec.yaml passes, github_device_auth/pubspec.yaml fails
and names http ^1.2.0 and url_launcher ^6.3.0, and a .dart path is skipped
by the filter.
Version 0.2.1 -> 0.3.0; consumers move their git pins after the tag.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
A caret range's *floor* is the only comparable number it carries, and all four
libs sat at ^10.2.0 while 10.3.0 was current. The Q13 carve-out lets these lint
packages keep a caret; it does not let the floor rot.
Deliberately its own commit, separate from any dependency bump: a lint-package
major/minor lands new rules across four packages at once, and tangling that
with a resolution change would make an analyze cascade indistinguishable from a
version conflict. `flutter analyze` is clean in all four, and all four suites
pass unchanged (88 / 68 / 24 / 35).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
An optional '' default reads as "this parameter is usually irrelevant", and
it made `avoid_redundant_argument_values` fire in the first app to pass ''
explicitly -- pushing that app toward deleting the argument, which is exactly
the line that must stay for when the Desktop client id arrives.
Requiring it forces each app to state which halves it configured. Passing ''
still means "not configured"; it just has to be said out loud.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG
Five apps had copied google_sign_in_backend.dart; home_inventory's copy was
byte-identical to todo's. lyricanki was about to become the sixth, which is
the mistake this package exists to prevent. So the plugin call moves here.
Desktop is the new half. google_sign_in ships android, ios and web
implementations only -- there is no google_sign_in_linux -- so lyricanki's
real GTK build could never have used the plugin, and "one tap" would have
meant "one tap on the phone, type a password on the PC". The OAuth loopback
flow covers it: bind a socket, open the system browser, catch the redirect,
exchange the code with PKCE. Both halves return a Google ID token of the same
shape, so signInWithGoogle cannot tell them apart.
googleSignInSupported takes the client id rather than reading a const. In
todo the emptiness check was a second conjunct at the call site, and moving
the fetcher here without it would have let a forgetful app ship a button that
always reports "cancelled" -- todo's own file documents that failure. Taking
the value as an argument makes the check impossible to drop.
The decision (which flow, or none) is pure and covered; the two one-line
delegations that reach a platform channel and a real browser are the only
suppressions. 83 tests, 100% coverage.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG
flutter_secure_storage 9 pins flutter_secure_storage_windows 3, which pins
win32 5 -- and share_plus 13 needs win32 6. Any app depending on both
(lyricanki, the first consumer) failed version solving outright, and pub's
suggested way out was downgrading share_plus, which would undo a just-shipped
Android share fix.
home_inventory already runs 10.3.1, so this moves toward the fleet rather than
away from it. 35 tests still green on the newer plugin.
Released as v0.1.1 rather than re-cutting v0.1.0: that tag is already pushed,
and moving a published tag breaks anyone who resolved against it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG
`crdt_sync` is pure Dart so it can run from CLI tools and headless systemd
jobs, which means it takes closures instead of depending on
flutter_secure_storage and google_sign_in. Every Flutter app then wrote the
same ~390 lines to supply them, and five apps ended up carrying near-identical
copies of firebase_backend.dart.
Those copies drifted. `todo` gained an opt-out flag and a seeded-session path
that home_inventory and wake_alarm never received, so the same bug was fixed
in one copy and left live in the others -- which is the actual cost being paid
here, not the line count.
This package owns that glue once: the keystore adapter, the persisted
per-install device id, the account store and a one-call bootstrap. A new app
needs a SyncApp const and `openSync(kApp)`.
The wrapper routes are a parameter rather than a constant, because todo's copy
hardcoded its own `~/.config/todo/firebase_auth.json`. An extraction only one
app could adopt would be worse than the copies.
Also documents what made this hard to find: crdt_sync_dart's README covered
only the *old* GitHub transport and never mentioned the Firebase surface at
all, and sync_settings_ui -- a complete drop-in settings screen -- had no
README whatsoever.
The five existing apps stay on their copies and on crdt_sync_dart-v0.10.0.
Migration is forward-only and those fallbacks are load-bearing; converging
them is a separate task, and the README says so.
35 tests, 100% line coverage, no suppressions.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG
