Plan-First Clock Flow: Gates, Drafts, RichEditor Composer, and SuperChat Feed (Milestones 1–7)

.dockerignore

@@ -1,5 +1,6 @@
 # Dependencies
 node_modules/
+vendor/ui/node_modules/
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*

.github/dependabot.yml

@@ -0,0 +1,24 @@
+# Dependabot: PR-based notifications when dependencies advance.
+#
+# - npm: watches the root package.json/lock (includes @kerebron/* pins).
+#   @kerebron packages are grouped into a single PR so a release train of
+#   editor + kits + extensions lands together instead of as 10 PRs.
+# - gitsubmodule: bumps the vendor/ui (and vendor/meteor-wormhole) submodule
+#   pointers when their upstream default branches advance. Kerebron bumps
+#   *inside* vendor/ui must be configured in the mieweb/ui repo itself —
+#   Dependabot cannot update a submodule's package.json from here.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      kerebron:
+        patterns:
+          - '@kerebron/*'
+
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/pr-preview.yml

@@ -55,7 +55,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: true
+          # Only init meteor-wormhole — vendor/ui is on a branch not pushed to
+          # the public mieweb/ui repo, so a full submodules: true would fail.
+          # The app installs @mieweb/ui from the committed vendor/mieweb-ui.tgz.
+          submodules: false
+
+      - name: Init meteor-wormhole submodule
+        run: git submodule update --init vendor/meteor-wormhole
 
       - id: container
         name: Compute container name

.gitignore

@@ -46,6 +46,8 @@ pollenate-test-*.png
 # Meteor build output and local packages
 meteor-backend/prod-build/
 meteor-backend/packages/
+meteor-backend/.meteor/local/
+meteor-backend/.meteor/local-test/
 
 # Local development scripts and configs (machine-specific, never commit)
 backend/nginx-apple-proxy.conf

.gitmodules

@@ -2,3 +2,6 @@
 [submodule "vendor/meteor-wormhole"]
 	path = vendor/meteor-wormhole
 	url = https://github.com/mieweb/meteor-wormhole
+[submodule "vendor/ui"]
+	path = vendor/ui
+	url = https://github.com/mieweb/ui

Dockerfile

@@ -30,7 +30,13 @@ COPY packages/README.md ./packages/
 COPY meteor-backend/package.json meteor-backend/package-lock.json ./meteor-backend/
 COPY scripts ./scripts
 
-# Install all dependencies (dev included — needed for Vite build + Meteor)
+# @mieweb/ui is installed from a committed tarball (see package.json:
+# "@mieweb/ui": "file:vendor/mieweb-ui.tgz") — the vendor/ui submodule branch is
+# not pushed to the public mieweb/ui repo, so it can't be built here. Copy the
+# tarball before install so npm can resolve the file: dependency.
+COPY vendor/mieweb-ui.tgz ./vendor/mieweb-ui.tgz
+
+# Install all dependencies (dev included — needed for Vite build + Meteor).
 RUN npm install
 RUN cd meteor-backend && npm install
 
@@ -75,6 +81,10 @@ WORKDIR /app
 # Root production deps (serve, etc.)
 COPY package.json package-lock.json ./
 COPY scripts ./scripts
+# @mieweb/ui resolves to file:vendor/mieweb-ui.tgz — copy it so the install can
+# resolve the dependency (it's bundled into dist/ at build time, but npm still
+# needs the file present to satisfy the manifest).
+COPY vendor/mieweb-ui.tgz ./vendor/mieweb-ui.tgz
 RUN npm install --production
 
 # Copy pre-built artifacts from builder — no source, no Meteor, no vendor

meteor-backend/package.json

@@ -12,7 +12,7 @@
     "@agendajs/mongo-backend": "^4.0.2",
     "@babel/runtime": "^7.23.5",
     "@casl/ability": "^6.8.1",
-    "@mieweb/pulsevault": "^0.1.0",
+    "@mieweb/pulsevault": "github:mieweb/pulsevault",
     "@parse/node-apn": "^8.1.0",
     "@swc/helpers": "^0.5.17",
     "agenda": "^6.2.5",
@@ -21,11 +21,15 @@
     "busboy": "^1.6.0",
     "firebase-admin": "^14.0.0",
     "jose": "^6.2.3",
+    "lib0": "^0.2.109",
     "lodash.throttle": "^4.1.1",
     "meteor-node-stubs": "^1.2.12",
     "nodemailer": "^9.0.1",
     "srvx": "^0.11.18",
-    "web-push": "^3.6.7"
+    "web-push": "^3.6.7",
+    "ws": "^8.21.0",
+    "y-protocols": "^1.0.6",
+    "yjs": "^13.6.30"
   },
   "devDependencies": {
     "@eslint/js": "^9.17.0",
@@ -35,8 +39,7 @@
     "mongodb": "^6.12.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.19.1",
-    "vitest": "^4.1.9",
-    "ws": "^8.21.0"
+    "vitest": "^4.1.9"
   },
   "meteor": {
     "mainModule": {

meteor-backend/server/clock.js

@@ -123,7 +123,7 @@ Meteor.methods({
   },
 
   /** Clock in: close any dangling open events, open a new one, fire side-effects. */
-  async 'clock.start'({ teamId } = {}) {
+  async 'clock.start'({ teamId, planPostId } = {}) {
     const identity = await requireIdentity(this);
     const userId = identity.userId;
     const team = await findUserTeam(userId, teamId);
@@ -147,6 +147,15 @@ Meteor.methods({
     const created = await ClockEvents.findOneAsync(_id);
     const pub = toPublicClockEvent(created, []);
 
+    // Plan-first flow: link the just-posted plan to this session so the
+    // per-session clock-out gate can find it (one post per clock session).
+    if (planPostId && isValidId(planPostId)) {
+      await rawDb().collection('huddlePosts').updateOne(
+        { _id: new ObjectId(planPostId), userId },
+        { $set: { clockEventId: created._id.toHexString(), updatedAt: new Date() } }
+      );
+    }
+
     // Schedule 4h break reminder + 7h45m shift-end reminder.
     scheduleClockJobs(created._id.toHexString(), userId, teamId, now).catch((err) =>
       console.error('[agenda] scheduleClockJobs failed:', err)
@@ -190,6 +199,24 @@ Meteor.methods({
     const event = await ClockEvents.findOneAsync({ userId, teamId, endTime: null });
     if (!event) throw new Meteor.Error('not-found', 'No active clock event');
 
+    const team = await findUserTeam(userId, teamId);
+
+    // Plan-first flow: when the team requires a plan, block clock-out until
+    // THIS session's Huddle post has a wrap-up. One post per clock session,
+    // linked by clockEventId (see clock-post-simple-plan.md). Drafts never
+    // count — only published posts.
+    if (team?.settings?.requirePlanForClock) {
+      const post = await rawDb()
+        .collection('huddlePosts')
+        .findOne(
+          { teamId, userId, clockEventId: event._id.toHexString(), status: { $ne: 'draft' } },
+          { sort: { createdAt: -1 } }
+        );
+      if (!post?.wrapUpAt) {
+        throw new Meteor.Error('plan-required', "Add a wrap-up to this session's post first");
+      }
+    }
+
     const now = Date.now();
     const eventId = event._id.toHexString();
 
@@ -221,7 +248,6 @@ Meteor.methods({
     const updated = await ClockEvents.findOneAsync(event._id);
     const pub = toPublicClockEvent(updated, closedBreaks);
 
-    const team = await findUserTeam(userId, teamId);
     if (team) {
       const userName = await userDisplayName(userId);
       const totalSecs = pub.accumulatedTime ?? 0;