v2026.05.20.1512

What's Changed

🚀 Features

• Add/Edit Family tool + Google Places provider (#10) — New /tools/addeditfamily tool for end-to-end household management (household, addresses, members, donor, envelope) modeled on MP's cloud Add/Edit Family. Includes a server-side Google Places provider/service with session-token billing, wired into address autocomplete with graceful fallback when no key is configured.
• Hide All Separators bulk action (#11) — Field Management gains a footer button that flips Hidden=true on every separator field and moves them into 99 - Other Fields in one click.

🔧 Maintenance

• Security audit + mjml fix (#12) — Resolves 3 of 7 npm audit vulnerabilities (kysely high via better-auth bump, @xmldom/xmldom, brace-expansion, next 16.2.6 DoS patch) and applies safe minor/patch updates across react, zod, vitest, tailwindcss, mjml, openai, lucide-react, and more. Adds await for mjml 5.2.2's now-Promise-returning mjml2html().
• Lint cleanup: 113 errors → 0 (#13) — Resolves all ESLint errors/warnings introduced by eslint-config-next 16.2.6 (React Compiler-aware hooks rules, stricter unused-vars). Includes one real correctness fix in add-edit-family.tsx (callback ordering) plus scoped, commented disables for legitimate SSR/loading/debounce patterns.

Full Changelog: v2026.04.19.2041...v2026.05.20.1512

v2026.04.19.2041

What's Changed

🚀 Features

• Surface MP Separator fields in field-management editor (#9) — The page-order editor now lists Separator fields so they can be reordered alongside regular fields.
• Thread $userId through MP write paths (#9) — Create/update calls through the MP provider and services now propagate the current user for a proper audit trail.

🐛 Bug Fixes

• Throw when BETTER_AUTH_URL/NEXTAUTH_URL unset on sign-out (#9) — Prevents silent fallback to localhost; fails loudly in misconfigured environments.
• Tighten proxy API whitelist, add /signin error UI, optimize /home redirect (#9) — Narrows the /api/* bypass, surfaces OAuth errors, reduces an unnecessary redirect hop.
• Validate contactId in getAddressForContact (#9) — Rejects invalid IDs up front and closes related doc-drift TODOs.
• Hydrate display maps in group-wizard edit mode (#9) — Edit flow now renders selected values correctly; added regression tests.
• Skip null-household records in address-labels (#9) — Avoids crashes on incomplete data; fixes a broken POSTNET test fixture.
• Log barcode fallbacks, guard tool-params NaN (#9) — Adds observability for barcode fallback paths and defensive parsing for tool params.

🔧 Maintenance

• Dedup MP token refresh, unify HTTP error messages, preserve ZodError.issues (#9) — Eliminates concurrent token refreshes and keeps validation details intact on rewraps.
• Refactor MP provider test fixtures + refresh stale provider docs (#9)
• Extract requireDevSession helper in dev-panel; fix toolService JSDoc drift (#9)
• Unify ui/dialog to plain-function pattern (#9)
• Rename contexts hook, dedupe BATCH_SIZE, validate mailerId, refresh docs (#9)
• Expand local permission allowlist for .claude/ ops (#9)

✅ Tests

• Add render and interaction tests for user-menu (#9)
• Cover /signin OAuth redirect logic (#9)

📚 Documentation

• Document field-management tool in CLAUDE.md and README (#9)
• Retire flat auth/components/testing reference files (#9) — Superseded by the hierarchical layout under .claude/references/.

Full Changelog: v2026.04.17.1958...v2026.04.19.2041

v2026.04.17.1958

What's Changed

🚀 Features

• Unified DevPanel with Deploy Tool (#5) — Consolidates params, selection, contact records, and user tools debug panels into a single DevPanel overlay gated to localhost + dev env, available in every tool via ToolContainer. Adds a Deploy Tool control that deploys a tool's stored procedures and pages to a target MP instance using isolated dev credentials. Retires the legacy scattered debug components.

Full Changelog: v2026.04.17.1051...v2026.04.17.1958

v2026.04.17.1051

What's Changed

🚀 Features

• Copy API and generate-sequence in MPHelper (#4) — Adds copyRecord(), copyRecordWithSubpages(), and generateSequence() with recurrence pattern types (RecurrencePattern, CopyParameters, etc.) for record duplication and recurrence preview.
• Inline field config editing with schema-enforced required (f96e9be) — Lets users edit field configuration inline with schema-based required-field validation.

🐛 Bug Fixes

• Preserve original URL through login redirect (0a3a545) — When auth sent users through /signin, they previously always landed on the tool index (/) after OAuth, losing the originally requested tool + query params. The proxy now forwards the requested pathname+search via an x-pathname request header and AuthWrapper reads it to build a proper callbackUrl, so users return to the exact tool URL they asked for (critical for production where tools are launched from MP with selectionId/pageID/recordID/userId params).
• http-client POST error test mock (e45a4c4) — Adds missing text() method to mock response in the POST error-path test.

🔧 Maintenance

• Expanded test coverage (0a3a545) — Adds new test suites across MP services (communication, domain, file, metadata, procedure), auth client-credentials, validation, barcode-image, field management, address labels, user service, logger, and http-client; plus an AuthWrapper test suite for the redirect-URL preservation behavior. Full suite now 449 tests across 35 files.
• Reference-doc refresh (0a3a545) — Updates to .claude/references/components.md, services.md, testing.md, plus minor CLAUDE.md/README.md tweaks.

Full Changelog: v2026.04.16.1620...v2026.04.17.1051

v2026.04.16.1620

What's Changed

🚀 Features

• Field Management Tool (#4c50af0) — New tool with drag-and-drop field ordering for Ministry Platform pages, including page search, sortable groups, and field order editing.

🔧 Maintenance

• newstoredproc command (#8a87e27) — Added new stored procedure slash command for scaffolding MP stored procedures.
• DomainID parameter (#ccdc9cc) — Updated newstoredproc command to include @domainID as required first parameter.

Full Changelog: v2026.04.16.0333...v2026.04.16.1620

v2026.04.16.0333

What's Changed

🚀 Features

• Error boundary & loading states — Added error.tsx for authenticated routes, loading.tsx skeletons for all 4 tool pages, and fixed unhandled promise rejections in signin and group wizard.
• Optimized MP reference generators — Improved context efficiency for stored procedure and schema reference file generation.

🐛 Bug Fixes

• SQL injection input validation — Created src/lib/validation.ts with GUID, numeric, column name, and filter string validators. Applied across 8 source files.
• Auth check on shared action — Added session validation to getCurrentUserProfile(), the only server action missing it.
• Singleton double initialization — Removed redundant initialize() call from constructors of all 4 service classes.
• Zod date validation — Fixed schema generator to use z.string().date() for Date fields instead of .datetime().
• Missing SQL indexes — Added nonclustered indexes on Contact_Private_Notes FK columns (User_ID, Contact_ID, Domain_ID).

⚡ Performance

• UserProvider memoization — Added useMemo and useCallback to prevent unnecessary re-renders of all useUser() consumers.

🔧 Maintenance

• MPHelper refactor — Moved dp_Users GUID lookup from 4 server actions to UserService.getUserIdByGuid(). Removed direct MPHelper imports from action files.
• Dead code removal — Removed unused SessionContext from session-context.tsx.
• Logging cleanup — Removed 12 verbose console.log/error statements from ToolService for consistency.
• JSDoc fix — Removed stale domainId parameter from getUserTools() documentation.

📚 Documentation

• Full codebase review — Updated CLAUDE.md, all 6 reference files (components, services, testing, auth, stored procs, schema), added GroupService documentation, expanded server action inventory.

🧪 Testing

• GroupService test suite — 14 new tests covering all 6 methods (lookups, search, CRUD, error propagation). Total: 262 tests across 22 files.

Full Changelog: v2026.04.16.0132...v2026.04.16.0333

v2026.04.16.0132

What's Changed

🚀 Features

• MP SQL Install Script Pipeline — Combines SQL files from db/ into a unified ministryplatform-install.sql for streamlined database deployment.
• Collapsible Debug Panels — All Development Mode debug panels (ParamsDebug, SelectionDebug, ContactRecordsDebug) are now collapsible for a cleaner workspace.
• Contact Records Resolution — New ContactRecordsDebug component, resolveContactIds service method, and resolveContactRecords server action for resolving selection IDs to contact records.
• SelectionDebug Callback — Added onRecordIdsResolved callback to SelectionDebug for downstream components to consume resolved record IDs.
• Group Wizard — Initial implementation of the Group Wizard tool.
• Project Foundation — Next.js 16 App Router with Better Auth, Ministry Platform OAuth provider, tool framework (Container, Header, Footer), and shadcn/ui component library.

🐛 Bug Fixes

• Server Action Type Export — Removed invalid type re-export from server action file that caused build issues.
• SelectionDebug useEffect Deps — Added missing onRecordIdsResolved to useEffect dependency array preventing stale closures.
• ES2020 Target for BigInt — Bumped tsconfig target to ES2020 to support BigInt literals used by the MP provider.

🔧 Maintenance

• Production-Safe Logger (#1) — Added lightweight logger utility that silences debug output in production while preserving error logging. Migrated all MP provider runtime files from raw console methods.
• Remove Deprecated OIDC Vars — Cleaned up deprecated OIDC environment variables from the project.
• Debug Panel Enhancements — Updated app title and added Contact_ID_Field display to debug panel.

Full Changelog: https://github.com/MinistryPlatform-Community/MPNext-Tools/commits/v2026.04.16.0132