Merge remote-tracking branch 'origin/main' into claude/payment-record-tables

# Conflicts:
#	scripts/mutation/equivalent-mutants.txt

Author: claude

scripts/mutation/equivalent-mutants.txt

@@ -111,17 +111,18 @@ src/fp.ts:452:17  ++ → --   # either direction changes generation and invalida
 src/fp.ts:455:49  ?? → ||   # items?.length is undefined or a non-negative integer; 0 and undefined both produce 0
 
 # Table inputs make these operators equivalent: nullable query results exclude
-# undefined, paired null checks already reject both nullish values, optional
-# conditions/dependencies are objects or arrays, and non-generated primary keys
-# are overwritten from the input-column fold in either initial-row branch.
-src/shared/db/table.ts:521:24  ?: → consequent only   # generated keys use the consequent; non-generated keys are overwritten by their input-column value
-src/shared/db/table.ts:561:28  ?? → ||   # condition?.args is an array or undefined, and every array is truthy
-src/shared/db/table.ts:733:32  ?? → ||   # dependsOn is a readonly array or undefined, and every array is truthy
+# undefined, paired null checks already reject both nullish values, and optional
+# conditions/dependencies are objects or arrays.
+src/shared/db/table.ts:441:28  ?? → ||   # condition?.args is an array or undefined, and every array is truthy
+src/shared/db/table.ts:488:71  ?? → ||   # a found row is a truthy object, and a miss is undefined, so both operators give the row or null
+src/shared/db/table.ts:492:31  ?? → ||   # findByIds's element is a truthy row, null, or undefined, and all three agree
+src/shared/db/table.ts:580:21  ?? → ||   # dependsOn is a readonly array or undefined, and every array is truthy
+src/shared/db/table.ts:613:32  ?? → ||   # the cached table's dependsOn is the same array-or-undefined as above
 
 # Login attempt rows store an integer count. For undefined, null, zero, or any
 # non-zero integer, `(attempts ?? 0) + 1` and `(attempts || 0) + 1` agree.
 src/shared/db/login-attempts.ts:46:39  ?? → ||
-src/shared/db/users.ts:263:62  ?? → ||   # queryAll()[0] is a truthy UserAuthFields object or undefined, so both operators return the row or null
+src/shared/db/users.ts:264:62  ?? → ||   # queryAll()[0] is a truthy UserAuthFields object or undefined, so both operators return the row or null
 src/shared/db/query-log.ts:71:62  ?? → ||   # queryLogScope.current() is a truthy QueryLogState object or undefined
 src/shared/db/query-log.ts:252:43  ?? → ||   # stored read counts start at 1 and remain positive, so only undefined reaches the zero fallback
 src/shared/db/query-log.ts:292:22  ?? → ||   # store is a truthy QueryLogState object or undefined
@@ -991,6 +992,10 @@ src/features/admin/attendee-page.ts:122:43  ?? → ||   # URLSearchParams.get re
 src/features/admin/attendees-list.ts:56:52  ?? → ||   # parsePositiveInt validates against PositiveIntSchema (minValue 1), so it returns a number of 1 or more, or null — it can never return 0, the only falsy number that would tell ?? and || apart
 src/features/admin/listing-page-data.ts:282:61  ?? → ||   # Map.get returns ListingWithCount[] | undefined, and every array — empty included — is truthy, so only undefined reaches the fallback and both operators yield the same []
 
+# The news card query names a single table, so its columns need no alias to
+# resolve.
+src/shared/db/news-posts.ts:148:47  news_post → ""   # dropping the alias leaves the column names unqualified, and the read selects from one table (news_posts AS news_post) plus scalar subqueries that carry their own qualified id, so every name still resolves to the same column
+
 # A revision a row rule already makes unreachable.
 src/shared/db/migrations/schema/payments/cases.ts:42:70  1 → 0   # alert_sent_revision can never be 0 while it is there: the row rule "alert_sent_revision IS NULL OR (alerted_revision IS NOT NULL AND alert_sent_revision = alerted_revision)" ties it to alerted_revision, whose own floor is 1, so the value is either missing (both floors pass) or at least 1
 

src/shared/db/news-posts.ts

@@ -55,6 +55,7 @@ import type {
   NewsPostCard,
   NewsPostSummary,
 } from "#shared/types.ts";
+import { isInstant } from "#shared/validation/timestamp.ts";
 
 /** Create/update input (camelCase keys → snake_case columns). `created`, `slug`,
  * and `slugIndex` are computed in {@link createNewsPost}, never posted by the
@@ -193,6 +194,11 @@ export const createNewsPost = async (
   transaction?: TxScope,
 ): Promise<NewsPost> => {
   const created = input.created ?? nowIso();
+  // The permalink is built from this date and can never be rebuilt, so a caller
+  // that pins a date it made up gets an error rather than a broken /news link.
+  if (!isInstant(created)) {
+    throw new Error(`News post created is not a real timestamp: "${created}"`);
+  }
   return useTransaction(transaction, async (tx) => {
     const { slug, slugIndex } = await uniqueSlugFromBase({
       base: newsSlugBase(created, input.name),

test/shared/db/news-posts.test.ts

@@ -9,6 +9,7 @@ import {
   getNewsPostBySlugIndex,
   getNewsPostCards,
   getNewsPostNames,
+  getNewsPostSummaries,
   hasNewsPosts,
   updateNewsPost,
 } from "#shared/db/news-posts.ts";
@@ -237,6 +238,43 @@ describeWithEnv("db > news-posts", { db: true }, () => {
     });
   });
 
+  describe("createNewsPost", () => {
+    // The /news permalink is built from this date and is never rebuilt, so a
+    // date that isn't a real moment has to fail before the post is written.
+    test("rejects a pinned created date that is not a real timestamp", async () => {
+      for (const created of ["", "not a date", "2026-02-30T10:00:00.000Z"]) {
+        await expect(
+          createTestNewsPost("Bad date", { created }),
+        ).rejects.toThrow("News post created is not a real timestamp");
+      }
+      expect(await hasNewsPosts()).toBe(false);
+    });
+  });
+
+  describe("getNewsPostSummaries", () => {
+    // The news feed and the admin news page both show these summaries in the
+    // order they come back, so newest-first is part of what this returns.
+    test("lists newest first, most recently created of a shared day first", async () => {
+      await createTestNewsPost("Oldest", {
+        created: "2026-07-01T10:00:00.000Z",
+      });
+      await createTestNewsPost("Same day, written first", {
+        created: "2026-07-03T10:00:00.000Z",
+      });
+      await createTestNewsPost("Same day, written second", {
+        created: "2026-07-03T10:00:00.000Z",
+      });
+
+      const summaries = await getNewsPostSummaries();
+
+      expect(summaries.map((summary) => summary.name)).toEqual([
+        "Same day, written second",
+        "Same day, written first",
+        "Oldest",
+      ]);
+    });
+  });
+
   describe("getNewsPostNames", () => {
     test("maps id to decrypted name", async () => {
       const post = await createTestNewsPost("Named post");