F2: one shared cache version renamed every cache, so the v2 bump that
drops the v1 API cache (dinner responses with the pasted recipe_url) also
deleted saved photos, fonts and the precache. Each cache now carries its
own version in cacheVersions; only api is v2, so activate deletes
mealquest-api-v1 and keeps mealquest-precache-v1, -media-v1 and -fonts-v1.
F3: replace the source-text activation test with src/sw.test.ts, which
loads the worker with the Workbox precache and router stubbed, dispatches
activate against mocked Cache Storage, and asserts caches.delete is called
for mealquest-api-v1 only. tsconfig.sw.json type-checks the test with the
worker's types.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F1: bump the service worker cache version to v2 so activate deletes the
v1 API cache, whose dinner responses still carried the pasted recipe_url
and could be served offline.
F2: nameFromURL now drops words holding a digit and ends the name at the
first credential word (token, access, secret, ...), so a token in the
link's last path segment never reaches the public dinner name.
/recipes/beef-stew is still "Beef stew".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A pasted recipe link may carry a personal token in its query, and the
dinners API returned it from create, list, get, patch and ground, where
other household clients and the PWA's cache of dinner reads could keep
it. Drop recipe_url from the public Dinner shape so it stays in the
database for grounding and dedupe only.
TestCreateDinnerByURL and TestCreateDinnerByName now assert the field is
absent; TestDinnerResponsesHideRecipeURL creates a Regular from a
token-bearing link and checks neither the create nor the list response
holds the link, host or token while the stored link remains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dev_agentandClaude Opus 5.5
orchestrator-agent