[autofix.ci] apply automated fixes

.coderabbit.yaml

@@ -13,6 +13,8 @@ reviews:
       mode: off
       enabled: false
   labeling_instructions:
+    - label: 'suspect ai generated'
+      instructions: 'This issue or PR is suspected to be generated by AI.'
     - label: 'API'
       instructions: 'This issue or PR updates the API in `packages/api`.'
     - label: 'documentation'

.cursor/rules/pr-and-commit.mdc

@@ -1,74 +0,0 @@
----
-description: Rules for AI-generated commits and pull requests
-globs:
-alwaysApply: true
----
-
-# PR and Commit Rules for AI Agents
-
-Canonical source: `.github/agents/pr-and-commit-rules.md`
-
-## Commit Rules
-
-### [AI] Prefix Requirement
-
-**ALL commit messages MUST be prefixed with `[AI]`.** This is a mandatory requirement with no exceptions.
-
-**Examples:**
-
-- `[AI] Fix type error in account validation`
-- `[AI] Add support for new transaction categories`
-- `Fix type error in account validation` (MISSING PREFIX - NOT ALLOWED)
-- `Add support for new transaction categories` (MISSING PREFIX - NOT ALLOWED)
-
-### Git Safety Rules
-
-- **Never** update git config
-- **Never** run destructive git operations (force push, hard reset) unless the user explicitly requests it
-- **Never** skip hooks (`--no-verify`, `--no-gpg-sign`)
-- **Never** force push to `main`/`master`
-- **Never** commit unless explicitly asked by the user
-
-## Pre-Commit Quality Checklist
-
-Before committing, ensure all of the following:
-
-- [ ] Commit message is prefixed with `[AI]`
-- [ ] `yarn typecheck` passes
-- [ ] `yarn lint:fix` has been run
-- [ ] Relevant tests pass
-- [ ] User-facing strings are translated
-- [ ] Code style conventions followed (see `AGENTS.md` for full style guide)
-
-## Pull Request Rules
-
-### [AI] Prefix Requirement
-
-**ALL pull request titles MUST be prefixed with `[AI]`.** This is a mandatory requirement with no exceptions.
-
-**Examples:**
-
-- `[AI] Fix type error in account validation`
-- `[AI] Add support for new transaction categories`
-- `Fix type error in account validation` (MISSING PREFIX - NOT ALLOWED)
-
-### Labels
-
-Add the **"AI generated"** label to all AI-created pull requests.
-
-### PR Template: Do Not Fill In
-
-- **NEVER fill in the PR template** (`.github/PULL_REQUEST_TEMPLATE.md`). Leave all blank spaces and placeholder comments as-is.
-- **Exception**: If a human **explicitly asks** you to fill out the PR template, then fill it out **in Chinese** (简体中文).
-
-## Quick-Reference Workflow
-
-1. Make your changes
-2. Run `yarn typecheck` — fix any errors
-3. Run `yarn lint:fix` — fix any remaining lint errors
-4. Run relevant tests (`yarn test` for all, or workspace-specific)
-5. Stage files and commit with `[AI]` prefix — do not skip hooks
-6. When creating a PR:
-   - Use `[AI]` prefix in the title
-   - Add the `"AI generated"` label
-   - Leave the PR template blank (do not fill it in)

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,21 +1 @@
 <!-- Thank you for submitting a pull request! Make sure to follow the instructions to write release notes for your PR — it should only take a minute or two: https://github.com/actualbudget/docs#writing-good-release-notes. Try running yarn generate:release-notes *before* pushing your PR for an interactive experience. -->
-
-## Description
-
-<!-- What does this PR do? Why is it needed? Please give context on the "why?": why do we need this change? What problem is it solving for you?-->
-
-## Related issue(s)
-
-<!-- e.g. Fixes #123, Relates to #456 -->
-
-## Testing
-
-<!-- What did you test? How can we reproduce the issue you are fixing or how can we test the feature you built? -->
-
-## Checklist
-
-- [ ] Release notes added (see link above)
-- [ ] No obvious regressions in affected areas
-- [ ] Self-review has been performed - I understand what each change in the code does and why it is needed
-
-<!--- actual-bot-sections --->

.github/actions/ai-generated-release-notes/check-release-notes-exists.js

@@ -74,4 +74,4 @@ async function checkReleaseNotesExists() {
   }
 }
 
-void checkReleaseNotesExists();
+checkReleaseNotesExists();

.github/actions/ai-generated-release-notes/comment-on-pr.js

@@ -74,4 +74,4 @@ async function commentOnPR() {
   }
 }
 
-void commentOnPR();
+commentOnPR();

.github/actions/ai-generated-release-notes/create-release-notes-file.js

@@ -16,19 +16,14 @@ if (!token || !repo || !issueNumber || !summaryDataJson || !category) {
 const [owner, repoName] = repo.split('/');
 const octokit = new Octokit({ auth: token });
 
-const VALID_CATEGORIES = [
-  'Features',
-  'Bugfixes',
-  'Enhancements',
-  'Maintenance',
-];
-const GITHUB_USERNAME_RE =
-  /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9])){0,38}$/;
-
 async function createReleaseNotesFile() {
   try {
     const summaryData = JSON.parse(summaryDataJson);
 
+    console.log('Debug - Category value:', category);
+    console.log('Debug - Category type:', typeof category);
+    console.log('Debug - Category JSON stringified:', JSON.stringify(category));
+
     if (!summaryData) {
       console.log('No summary data available, cannot create file');
       return;
@@ -39,62 +34,26 @@ async function createReleaseNotesFile() {
       return;
     }
 
-    // Normalize category - strip surrounding quotes and validate against allow-list
+    // Create file content - ensure category is not quoted
     const cleanCategory =
       typeof category === 'string'
         ? category.replace(/^["']|["']$/g, '')
         : category;
-
-    if (!VALID_CATEGORIES.includes(cleanCategory)) {
-      console.log(
-        `Invalid category "${cleanCategory}". Must be one of: ${VALID_CATEGORIES.join(', ')}`,
-      );
-      return;
-    }
-
-    // Validate author is a plausible GitHub username
-    const author = String(summaryData.author || '');
-    if (!GITHUB_USERNAME_RE.test(author)) {
-      console.log(
-        `Invalid author "${author}", aborting release notes creation`,
-      );
-      return;
-    }
-
-    // Normalize summary: collapse whitespace to a single line so it cannot
-    // introduce extra YAML frontmatter or break the markdown structure.
-    const cleanSummary = String(summaryData.summary || '')
-      .replace(/\s+/g, ' ')
-      .trim();
-    if (!cleanSummary) {
-      console.log('Empty summary, aborting release notes creation');
-      return;
-    }
-
-    // Validate PR number - must be a positive integer. The value comes from
-    // the GitHub API, but we harden it because it's used to build a file path
-    // and a commit message.
-    const validatedPrNumber = Number(summaryData.prNumber);
-    if (!Number.isInteger(validatedPrNumber) || validatedPrNumber <= 0) {
-      console.log(
-        `Invalid PR number "${summaryData.prNumber}", aborting release notes creation`,
-      );
-      return;
-    }
+    console.log('Debug - Clean category:', cleanCategory);
 
     const fileContent = `---
 category: ${cleanCategory}
-authors: [${author}]
+authors: [${summaryData.author}]
 ---
 
-${cleanSummary}
+${summaryData.summary}
 `;
 
-    const fileName = `upcoming-release-notes/${validatedPrNumber}.md`;
+    const fileName = `upcoming-release-notes/${summaryData.prNumber}.md`;
 
-    console.log(
-      `Creating release notes file: ${fileName} (category: ${cleanCategory}, author: ${author})`,
-    );
+    console.log(`Creating release notes file: ${fileName}`);
+    console.log('File content:');
+    console.log(fileContent);
 
     // Get PR info
     const { data: pr } = await octokit.rest.pulls.get({
@@ -116,7 +75,7 @@ ${cleanSummary}
       owner: headOwner,
       repo: headRepo,
       path: fileName,
-      message: `Add release notes for PR #${validatedPrNumber}`,
+      message: `Add release notes for PR #${summaryData.prNumber}`,
       content: Buffer.from(fileContent).toString('base64'),
       branch: prBranch,
       committer: {
@@ -135,4 +94,4 @@ ${cleanSummary}
   }
 }
 
-void createReleaseNotesFile();
+createReleaseNotesFile();

.github/actions/ai-generated-release-notes/generate-summary.js

@@ -25,6 +25,8 @@ try {
     process.exit(0);
   }
 
+  console.log('CodeRabbit comment body:', commentBody);
+
   const data = JSON.stringify({
     model: 'gpt-4o-mini',
     messages: [

.github/actions/ai-generated-release-notes/pr-details.js

@@ -37,57 +37,19 @@ async function getPRDetails() {
     console.log('- PR Author:', pr.user.login);
     console.log('- PR Title:', pr.title);
     console.log('- Base Branch:', pr.base.ref);
-    console.log('- Head Branch:', pr.head.ref);
-
-    // Fetch all changed files to detect docs-only PRs
-    const files = await octokit.paginate(octokit.rest.pulls.listFiles, {
-      owner,
-      repo: repoName,
-      pull_number: issueNumber,
-      per_page: 100,
-    });
-
-    const changedFiles = files.map(f => f.filename);
-    const isDocsOnly =
-      changedFiles.length > 0 &&
-      changedFiles.every(file => file.startsWith('packages/docs/'));
-
-    console.log('- Changed Files:', changedFiles.length);
-    console.log('- Is Docs Only:', isDocsOnly);
 
     const result = {
       number: pr.number,
       author: pr.user.login,
       title: pr.title,
       baseBranch: pr.base.ref,
-      headBranch: pr.head.ref,
     };
 
-    let eligible = true;
-    if (pr.base.ref !== 'master') {
-      console.log(
-        'PR does not target master branch, skipping release notes generation',
-      );
-      eligible = false;
-    } else if (pr.head.ref.startsWith('release/')) {
-      console.log(
-        'PR head branch is a release branch, skipping release notes generation',
-      );
-      eligible = false;
-    } else if (isDocsOnly) {
-      console.log(
-        'PR only changes documentation, skipping release notes generation',
-      );
-      eligible = false;
-    }
-
     setOutput('result', JSON.stringify(result));
-    setOutput('eligible', JSON.stringify(eligible));
   } catch (error) {
     console.log('Error getting PR details:', error.message);
     console.log('Stack:', error.stack);
     setOutput('result', 'null');
-    setOutput('eligible', 'false');
     process.exit(1);
   }
 }
@@ -96,6 +58,5 @@ getPRDetails().catch(error => {
   console.log('Unhandled error:', error.message);
   console.log('Stack:', error.stack);
   setOutput('result', 'null');
-  setOutput('eligible', 'false');
   process.exit(1);
 });

.github/actions/check-migrations.js

@@ -1,14 +1,14 @@
+#!/usr/bin/env node
+
 // overview:
 // 1. Identify the migrations in packages/loot-core/migrations/* on `master` and HEAD
 // 2. Make sure that any new migrations on HEAD are dated after the latest migration on `master`.
 
-import { spawnSync } from 'child_process';
-import path from 'path';
-import { fileURLToPath } from 'url';
+const { spawnSync } = require('child_process');
+const path = require('path');
 
 const migrationsDir = path.join(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..',
+  __dirname,
   '..',
   '..',
   'packages',
@@ -16,7 +16,7 @@ const migrationsDir = path.join(
   'migrations',
 );
 
-function readMigrations(ref: string) {
+function readMigrations(ref) {
   const { stdout } = spawnSync('git', [
     'ls-tree',
     '--name-only',

.github/actions/docs-spelling/excludes.txt

@@ -68,6 +68,7 @@ ignore$
 ^\Qsrc/\E$
 ^\Qstatic/\E$
 ^\Q.github/\E$
+(?:^|/)package(?:-lock|)\.json$
 (?:^|/)yarn\.lock$
 (?:^|/)(?i)docusaurus.config.js
 (?:^|/)(?i)README.md

.github/actions/docs-spelling/expect.txt

@@ -2,9 +2,7 @@ Abanca
 ABNAMRO
 ABNANL
 Activo
-actualrc
 AESUDEF
-ajv
 ALZEY
 Anglais
 ANZ
@@ -33,7 +31,6 @@ CAGLPTPL
 Caixa
 CAMT
 cashflow
-Catppuccin
 Cetelem
 cimode
 Citi
@@ -126,7 +123,6 @@ Moldovan
 murmurhash
 NETWORKDAYS
 nginx
-nodenext
 OIDC
 Okabe
 overbudgeted
@@ -134,8 +130,6 @@ overbudgeting
 oxc
 Paribas
 passwordless
-PAYPAL
-picomatch
 pluggyai
 Poste
 PPABPLPK
@@ -176,11 +170,8 @@ tada
 taskbar
 templating
 THB
-TIMEFRAME
 touchscreen
 triaging
-tsgo
-TWD
 UAH
 ubuntu
 undici

.github/actions/docs-spelling/patterns.txt

@@ -79,6 +79,3 @@
 
 # allowlist specific non-English words with non-ASCII characters
 \b(Länsförsäkringar|München|Złoty)\b
-
-# allowlist specific proper nouns
-\b(CodeRabbit)\b

.github/actions/release-notes/check/action.yml

@@ -1,17 +0,0 @@
-name: Check release notes
-description: Validate that a PR includes a properly formatted release note file
-
-runs:
-  using: composite
-  steps:
-    - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-      with:
-        node-version: 22
-    - name: Install dependencies
-      shell: bash
-      run: yarn workspaces focus @actual-app/ci-actions
-    - name: Check release notes
-      env:
-        PR_NUMBER: ${{ github.event.pull_request.number }}
-      shell: bash
-      run: node packages/ci-actions/bin/release-notes-check.mjs

.github/actions/release-notes/generate/action.yml

@@ -1,17 +0,0 @@
-name: Generate release notes
-description: Generate release documentation from release note files
-
-runs:
-  using: composite
-  steps:
-    - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-      with:
-        node-version: 22
-    - name: Install dependencies
-      shell: bash
-      run: yarn workspaces focus @actual-app/ci-actions
-    - name: Generate release notes
-      shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: node packages/ci-actions/bin/release-notes-generate.mjs

.github/actions/setup/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Install node
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
       with:
         node-version: 22
     - name: Install yarn
@@ -27,7 +27,7 @@ runs:
       run: echo "version=$(node -v)" >> "$GITHUB_OUTPUT"
       shell: bash
     - name: Cache
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       id: cache
       with:
         path: ${{ format('{0}/**/node_modules', inputs.working-directory) }}
@@ -36,7 +36,7 @@ runs:
       run: mkdir -p ${{ format('{0}/.lage', inputs.working-directory) }}
       shell: bash
     - name: Cache Lage
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ format('{0}/.lage', inputs.working-directory) }}
         key: lage-${{ runner.os }}-${{ github.sha }}
@@ -48,7 +48,7 @@ runs:
       shell: bash
       if: steps.cache.outputs.cache-hit != 'true'
     - name: Download translations
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: actualbudget/translations
         path: ${{ inputs.working-directory }}/packages/desktop-client/locale

.github/agents/pr-and-commit-rules.md

@@ -1,70 +0,0 @@
-# PR and Commit Rules for AI Agents
-
-This is the single source of truth for all commit and pull request rules that AI agents must follow when working with Actual Budget.
-
-## Commit Rules
-
-### [AI] Prefix Requirement
-
-**ALL commit messages MUST be prefixed with `[AI]`.** This is a mandatory requirement with no exceptions.
-
-**Examples:**
-
-- `[AI] Fix type error in account validation`
-- `[AI] Add support for new transaction categories`
-- `Fix type error in account validation` (MISSING PREFIX - NOT ALLOWED)
-- `Add support for new transaction categories` (MISSING PREFIX - NOT ALLOWED)
-
-### Git Safety Rules
-
-- **Never** update git config
-- **Never** run destructive git operations (force push, hard reset) unless the user explicitly requests it
-- **Never** skip hooks (`--no-verify`, `--no-gpg-sign`)
-- **Never** force push to `main`/`master`
-- **Never** commit unless explicitly asked by the user
-
-## Pre-Commit Quality Checklist
-
-Before committing, ensure all of the following:
-
-- [ ] Commit message is prefixed with `[AI]`
-- [ ] `yarn typecheck` passes
-- [ ] `yarn lint:fix` has been run
-- [ ] Relevant tests pass
-- [ ] User-facing strings are translated
-- [ ] Code style conventions followed (see `AGENTS.md` for full style guide)
-
-## Pull Request Rules
-
-### [AI] Prefix Requirement
-
-**ALL pull request titles MUST be prefixed with `[AI]`.** This is a mandatory requirement with no exceptions.
-
-**Examples:**
-
-- `[AI] Fix type error in account validation`
-- `[AI] Add support for new transaction categories`
-- `Fix type error in account validation` (MISSING PREFIX - NOT ALLOWED)
-
-### Labels
-
-Add the **"AI generated"** label to all AI-created pull requests. This helps maintainers understand the nature of the contribution.
-
-### PR Template: Do Not Fill In
-
-- **NEVER fill in the PR template** (`.github/PULL_REQUEST_TEMPLATE.md`). Leave all blank spaces and placeholder comments as-is. Humans are expected to fill in the Description, Related issue(s), Testing, and Checklist sections.
-- **Exception**: If a human **explicitly asks** you to fill out the PR template, then fill it out **in Chinese**, using Chinese characters (简体中文) for all content you add.
-
-## Quick-Reference Workflow
-
-Follow these steps when committing and creating PRs:
-
-1. Make your changes
-2. Run `yarn typecheck` — fix any errors
-3. Run `yarn lint:fix` — fix any remaining lint errors
-4. Run relevant tests (`yarn test` for all, or workspace-specific)
-5. Stage files and commit with `[AI]` prefix — do not skip hooks
-6. When creating a PR:
-   - Use `[AI]` prefix in the title
-   - Add the `"AI generated"` label
-   - Leave the PR template blank (do not fill it in)

.github/scripts/count-points.mjs

@@ -8,13 +8,13 @@ const CONFIG = {
   POINTS_PER_ISSUE_TRIAGE_ACTION: 1,
   POINTS_PER_ISSUE_CLOSING_ACTION: 1,
   POINTS_PER_RELEASE_PR: 4, // Awarded to whoever merges the release PR
-  PR_CONTRIBUTION_POINTS: [
-    { categories: ['Features'], points: 2 },
-    { categories: ['Enhancements'], points: 2 },
-    { categories: ['Bugfixes', 'Bugfix'], points: 3 },
-    { categories: ['Maintenance'], points: 2 },
-    { categories: ['Unknown'], points: 2 },
-  ],
+  PR_CONTRIBUTION_POINTS: {
+    Features: 2,
+    Enhancements: 2,
+    Bugfix: 3,
+    Maintenance: 2,
+    Unknown: 2,
+  },
   // Point tiers for code changes (non-docs)
   CODE_PR_REVIEW_POINT_TIERS: [
     { minChanges: 500, points: 8 },
@@ -35,11 +35,7 @@ const CONFIG = {
     'release-notes/**/*',
     'upcoming-release-notes/**/*',
   ],
-  DOCS_FILES_PATTERNS: [
-    'packages/docs/**/*',
-    '!packages/docs/package.json',
-    '.github/actions/docs-spelling/*',
-  ],
+  DOCS_FILES_PATTERN: 'packages/docs/**/*',
 };
 
 /**
@@ -61,38 +57,84 @@ function parseReleaseNotesCategory(content) {
   return categoryMatch[1].trim();
 }
 
+/**
+ * Get the last commit SHA on or before a given date.
+ * @param {Octokit} octokit - The Octokit instance.
+ * @param {string} owner - Repository owner.
+ * @param {string} repo - Repository name.
+ * @param {Date} beforeDate - The date to find the last commit before.
+ * @returns {Promise<string|null>} The commit SHA or null if not found.
+ */
+async function getLastCommitBeforeDate(octokit, owner, repo, beforeDate) {
+  try {
+    // Get the default branch from the repository
+    const { data: repoData } = await octokit.repos.get({ owner, repo });
+    const defaultBranch = repoData.default_branch;
+
+    const { data: commits } = await octokit.repos.listCommits({
+      owner,
+      repo,
+      sha: defaultBranch,
+      until: beforeDate.toISOString(),
+      per_page: 1,
+    });
+
+    if (commits.length > 0) {
+      return commits[0].sha;
+    }
+  } catch {
+    // If error occurs, return null to fall back to default branch
+  }
+
+  return null;
+}
+
 /**
  * Get the category and points for a PR by reading its release notes file.
  * @param {Octokit} octokit - The Octokit instance.
  * @param {string} owner - Repository owner.
  * @param {string} repo - Repository name.
- * @param {string|null} releaseNoteBlobSha - The blob SHA of the release notes file, or null if not found.
- * @returns {Promise<Object>} Object with category and points.
+ * @param {number} prNumber - PR number.
+ * @param {Date} monthEnd - The end date of the month to use as base revision.
+ * @returns {Object} Object with category and points, or null if error.
  */
 async function getPRCategoryAndPoints(
   octokit,
   owner,
   repo,
-  releaseNoteBlobSha,
+  prNumber,
+  monthEnd,
 ) {
+  const releaseNotesPath = `upcoming-release-notes/${prNumber}.md`;
+
   try {
-    if (releaseNoteBlobSha) {
-      const { data: blob } = await octokit.git.getBlob({
-        owner,
-        repo,
-        file_sha: releaseNoteBlobSha,
-      });
+    // Get the last commit of the month to use as base revision
+    const commitSha = await getLastCommitBeforeDate(
+      octokit,
+      owner,
+      repo,
+      monthEnd,
+    );
 
-      const content = Buffer.from(blob.content, 'base64').toString('utf-8');
-      const category = parseReleaseNotesCategory(content);
-      const tier = CONFIG.PR_CONTRIBUTION_POINTS.find(e =>
-        e.categories.includes(category),
+    // Try to read the release notes file from the last commit of the month
+    const { data: fileContent } = await octokit.repos.getContent({
+      owner,
+      repo,
+      path: releaseNotesPath,
+      ref: commitSha || undefined, // Use commit SHA if available, otherwise default branch
+    });
+
+    if (fileContent.content) {
+      // Decode base64 content
+      const content = Buffer.from(fileContent.content, 'base64').toString(
+        'utf-8',
       );
+      const category = parseReleaseNotesCategory(content);
 
-      if (tier) {
+      if (category && CONFIG.PR_CONTRIBUTION_POINTS[category]) {
         return {
           category,
-          points: tier.points,
+          points: CONFIG.PR_CONTRIBUTION_POINTS[category],
         };
       }
     }
@@ -100,12 +142,9 @@ async function getPRCategoryAndPoints(
     // Do nothing
   }
 
-  const unknownTier = CONFIG.PR_CONTRIBUTION_POINTS.find(e =>
-    e.categories.includes('Unknown'),
-  );
   return {
     category: 'Unknown',
-    points: unknownTier.points,
+    points: CONFIG.PR_CONTRIBUTION_POINTS.Unknown,
   };
 }
 
@@ -231,25 +270,13 @@ async function countContributorPoints() {
             ),
         );
 
-        const isDocsFile = file => {
-          const positivePatterns = CONFIG.DOCS_FILES_PATTERNS.filter(
-            p => !p.startsWith('!'),
-          );
-          const negativePatterns = CONFIG.DOCS_FILES_PATTERNS.filter(p =>
-            p.startsWith('!'),
-          );
-          return (
-            positivePatterns.some(p =>
-              minimatch(file.filename, p, { dot: true }),
-            ) &&
-            negativePatterns.every(p =>
-              minimatch(file.filename, p, { dot: true }),
-            )
-          );
-        };
-
-        const docsFiles = filteredFiles.filter(isDocsFile);
-        const codeFiles = filteredFiles.filter(file => !isDocsFile(file));
+        const docsFiles = filteredFiles.filter(file =>
+          minimatch(file.filename, CONFIG.DOCS_FILES_PATTERN, { dot: true }),
+        );
+        const codeFiles = filteredFiles.filter(
+          file =>
+            !minimatch(file.filename, CONFIG.DOCS_FILES_PATTERN, { dot: true }),
+        );
 
         const docsChanges = docsFiles.reduce(
           (sum, file) => sum + file.additions + file.deletions,
@@ -296,15 +323,12 @@ async function countContributorPoints() {
           // Award points to PR author if they are a core maintainer
           const prAuthor = pr.user?.login;
           if (prAuthor && orgMemberLogins.has(prAuthor)) {
-            const releaseNoteFile = modifiedFiles.find(
-              file =>
-                file.filename === `upcoming-release-notes/${pr.number}.md`,
-            );
             const categoryAndPoints = await getPRCategoryAndPoints(
               octokit,
               owner,
               repo,
-              releaseNoteFile?.sha ?? null,
+              pr.number,
+              until,
             );
 
             if (categoryAndPoints) {

.github/workflows/ai-generated-release-notes.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -41,8 +41,21 @@ jobs:
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
 
+      - name: Check if PR targets master branch
+        if: steps.check-first-comment.outputs.result == 'true' && steps.pr-details.outputs.result != 'null'
+        id: check-base-branch
+        run: |
+          BASE_BRANCH=$(echo '${{ steps.pr-details.outputs.result }}' | jq -r '.baseBranch')
+          echo "Base branch: $BASE_BRANCH"
+          if [ "$BASE_BRANCH" = "master" ]; then
+            echo "targets_master=true" >> $GITHUB_OUTPUT
+          else
+            echo "targets_master=false" >> $GITHUB_OUTPUT
+            echo "PR does not target master branch, skipping release notes generation"
+          fi
+
       - name: Check if release notes file already exists
-        if: steps.pr-details.outputs.eligible == 'true'
+        if: steps.check-first-comment.outputs.result == 'true' && steps.pr-details.outputs.result != 'null' && steps.check-base-branch.outputs.targets_master == 'true'
         id: check-release-notes-exists
         run: node .github/actions/ai-generated-release-notes/check-release-notes-exists.js
         env:
@@ -52,7 +65,7 @@ jobs:
           PR_DETAILS: ${{ steps.pr-details.outputs.result }}
 
       - name: Generate summary with OpenAI
-        if: steps.check-release-notes-exists.outputs.result == 'false'
+        if: steps.check-first-comment.outputs.result == 'true' && steps.check-release-notes-exists.outputs.result == 'false'
         id: generate-summary
         run: node .github/actions/ai-generated-release-notes/generate-summary.js
         env:
@@ -61,7 +74,7 @@ jobs:
           PR_DETAILS: ${{ steps.pr-details.outputs.result }}
 
       - name: Determine category with OpenAI
-        if: steps.generate-summary.outputs.result != 'null' && steps.generate-summary.outputs.result != ''
+        if: steps.check-first-comment.outputs.result == 'true' && steps.check-release-notes-exists.outputs.result == 'false' && steps.generate-summary.outputs.result != 'null'
         id: determine-category
         run: node .github/actions/ai-generated-release-notes/determine-category.js
         env:
@@ -71,7 +84,7 @@ jobs:
           SUMMARY_DATA: ${{ steps.generate-summary.outputs.result }}
 
       - name: Create and commit release notes file via GitHub API
-        if: steps.determine-category.outputs.result != 'null' && steps.determine-category.outputs.result != ''
+        if: steps.check-first-comment.outputs.result == 'true' && steps.check-release-notes-exists.outputs.result == 'false' && steps.generate-summary.outputs.result != 'null' && steps.determine-category.outputs.result != 'null' && steps.determine-category.outputs.result != ''
         run: node .github/actions/ai-generated-release-notes/create-release-notes-file.js
         env:
           GITHUB_TOKEN: ${{ secrets.ACTIONS_UPDATE_TOKEN }}
@@ -81,7 +94,7 @@ jobs:
           CATEGORY: ${{ steps.determine-category.outputs.result }}
 
       - name: Comment on PR
-        if: steps.determine-category.outputs.result != 'null' && steps.determine-category.outputs.result != ''
+        if: steps.check-first-comment.outputs.result == 'true' && steps.check-release-notes-exists.outputs.result == 'false' && steps.generate-summary.outputs.result != 'null' && steps.determine-category.outputs.result != 'null' && steps.determine-category.outputs.result != ''
         run: node .github/actions/ai-generated-release-notes/comment-on-pr.js
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/autofix.yml

@@ -15,11 +15,11 @@ jobs:
   autofix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
           download-translations: 'false'
       - name: Format code
         run: yarn lint:fix
-      - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8 # v1.3.3
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27

.github/workflows/build.yml

@@ -22,24 +22,24 @@ jobs:
   api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
           download-translations: 'false'
       - name: Build API
-        run: yarn build:api
+        run: cd packages/api && yarn build
       - name: Create package tgz
         run: cd packages/api && yarn pack && mv package.tgz actual-api.tgz
       - name: Prepare bundle stats artifact
         run: cp packages/api/app/stats.json api-stats.json
       - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-api
           path: packages/api/actual-api.tgz
       - name: Upload API bundle stats
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: api-build-stats
           path: api-stats.json
@@ -47,7 +47,7 @@ jobs:
   crdt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -56,67 +56,35 @@ jobs:
         run: cd packages/crdt && yarn build
       - name: Create package tgz
         run: cd packages/crdt && yarn pack && mv package.tgz actual-crdt.tgz
-      - name: Prepare bundle stats artifact
-        run: cp packages/crdt/dist/stats.json crdt-stats.json
       - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-crdt
           path: packages/crdt/actual-crdt.tgz
-      - name: Upload CRDT bundle stats
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: crdt-build-stats
-          path: crdt-stats.json
 
   web:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Build Web
         run: yarn build:browser
       - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-web
           path: packages/desktop-client/build
       - name: Upload Build Stats
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: build-stats
           path: packages/desktop-client/build-stats
 
-  cli:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up environment
-        uses: ./.github/actions/setup
-        with:
-          download-translations: 'false'
-      - name: Build CLI
-        run: yarn build:cli
-      - name: Create package tgz
-        run: cd packages/cli && yarn pack && mv package.tgz actual-cli.tgz
-      - name: Prepare bundle stats artifact
-        run: cp packages/cli/dist/stats.json cli-stats.json
-      - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: actual-cli
-          path: packages/cli/actual-cli.tgz
-      - name: Upload CLI bundle stats
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cli-build-stats
-          path: cli-stats.json
-
   server:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -124,7 +92,7 @@ jobs:
       - name: Build Server
         run: yarn workspace @actual-app/sync-server build
       - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: sync-server
           path: packages/sync-server/build

.github/workflows/check.yml

@@ -12,20 +12,10 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
 jobs:
-  constraints:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up environment
-        uses: ./.github/actions/setup
-        with:
-          download-translations: 'false'
-      - name: Check dependency version consistency
-        run: yarn constraints
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -35,7 +25,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -45,7 +35,7 @@ jobs:
   validate-cli:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -57,31 +47,21 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
           download-translations: 'false'
       - name: Test
         run: yarn test
-  check-gh-actions:
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
 
   migrations:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up environment
-        uses: ./.github/actions/setup
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          download-translations: 'false'
+          node-version: 22
       - name: Check migrations
-        run: yarn workspace @actual-app/ci-actions tsx bin/check-migrations.ts
+        run: node ./.github/actions/check-migrations.js

.github/workflows/codeql.yml

@@ -22,14 +22,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/init@v3
         with:
           languages: javascript
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/analyze@v3
         with:
           category: '/language:javascript'

.github/workflows/count-points.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:

.github/workflows/cut-release-branch.yml

@@ -1,100 +0,0 @@
-name: Cut release branch
-
-on:
-  schedule:
-    # 17:00 UTC on the 25th of each month
-    - cron: '0 17 25 * *'
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: 'Commit or branch to release'
-        required: true
-        default: 'master'
-      version:
-        description: 'Version number for the release (optional)'
-        required: false
-        default: ''
-      release-date:
-        description: 'Expected release date, YYYY-MM-DD (optional)'
-        required: false
-        default: ''
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  cut-release-branch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.inputs.ref || 'master' }}
-
-      - name: Set up environment
-        uses: ./.github/actions/setup
-        with:
-          download-translations: 'false'
-
-      - name: Bump package versions
-        id: bump_package_versions
-        shell: bash
-        env:
-          INPUT_VERSION: ${{ github.event.inputs.version }}
-        run: |
-          declare -A packages=(
-            [web]="desktop-client"
-            [electron]="desktop-electron"
-            [sync]="sync-server"
-            [api]="api"
-            [cli]="cli"
-            [core]="loot-core"
-          )
-          declare -A new_versions
-
-          for key in "${!packages[@]}"; do
-            pkg="${packages[$key]}"
-
-            if [[ -n "$INPUT_VERSION" ]]; then
-              version=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts \
-                --package-json "./packages/$pkg/package.json" \
-                --version "$INPUT_VERSION" \
-                --update)
-            else
-              version=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts \
-                --package-json "./packages/$pkg/package.json" \
-                --type auto \
-                --update)
-            fi
-
-            new_versions[$key]="$version"
-          done
-
-          echo "version=${new_versions[web]}" >> "$GITHUB_OUTPUT"
-
-      - name: Compute release date
-        id: release_date
-        shell: bash
-        env:
-          INPUT_DATE: ${{ github.event.inputs['release-date'] }}
-        run: |
-          if [[ -n "$INPUT_DATE" ]]; then
-            echo "date=$INPUT_DATE" >> "$GITHUB_OUTPUT"
-          else
-            # default to the 1st of next month
-            echo "date=$(date -d '+1 month' '+%Y-%m-01')" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create release branch and PR
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.ACTIONS_UPDATE_TOKEN }}
-          commit-message: '🔖 (${{ steps.bump_package_versions.outputs.version }})'
-          title: '🔖 (${{ steps.bump_package_versions.outputs.version }})'
-          body: |
-            Generated by [cut-release-branch.yml](../tree/master/.github/workflows/cut-release-branch.yml)
-
-            <!-- release-date:${{ steps.release_date.outputs.date }} -->
-          branch: 'release/${{ steps.bump_package_versions.outputs.version }}'
-          base: master

.github/workflows/docker-edge.yml

@@ -36,17 +36,17 @@ jobs:
       matrix:
         os: [ubuntu, alpine]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           # Push to both Docker Hub and Github Container Registry
           images: ${{ env.IMAGES }}
@@ -54,14 +54,14 @@ jobs:
           tags: ${{ env.TAGS }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         if: github.event_name != 'pull_request' && !github.event.repository.fork
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
@@ -76,7 +76,7 @@ jobs:
         run: yarn build:server
 
       - name: Build image for testing
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: false
@@ -87,13 +87,13 @@ jobs:
       - name: Test that the docker image boots
         run: |
           docker run --detach --network=host actualbudget/actual-server-testing
-          sleep 10
-          curl --fail -sS -LI -w '%{http_code}\n' --retry 20 --retry-delay 1 --retry-connrefused localhost:5006
+          sleep 5
+          curl --fail -sS -LI -w '%{http_code}\n' --retry 10 --retry-delay 1 --retry-connrefused localhost:5006
 
       # This will use the cache from the earlier build step and not rebuild the image
       # https://docs.docker.com/build/ci/github-actions/test-before-push/
       - name: Build and push images
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/docker-release.yml

@@ -28,17 +28,17 @@ jobs:
     name: Build Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           # Push to both Docker Hub and Github Container Registry
           images: ${{ env.IMAGES }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Docker meta for Alpine image
         id: alpine-meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ${{ env.IMAGES }}
           # Automatically update :latest
@@ -58,13 +58,13 @@ jobs:
           tags: ${{ env.TAGS }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -78,7 +78,7 @@ jobs:
         run: yarn build:server
 
       - name: Build and push ubuntu image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true
@@ -87,7 +87,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
 
       - name: Build and push alpine image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true

.github/workflows/docs-spelling.yml

@@ -79,12 +79,12 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # main
+        uses: check-spelling/check-spelling@main
         with:
           suppress_push_for_open_pull_request: 1
           checkout: true
           check_file_names: 1
-          spell_check_this: check-spelling/spell-check-this@92453f59cac8985482dfc301a8ece4c6d7de8a0c # prerelease
+          spell_check_this: check-spelling/spell-check-this@prerelease
           post_comment: 0
           use_magic_file: 1
           experimental_apply_changes_via_bot: 1
@@ -114,10 +114,10 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # main
+        uses: check-spelling/check-spelling@main
         with:
           checkout: true
-          spell_check_this: check-spelling/spell-check-this@92453f59cac8985482dfc301a8ece4c6d7de8a0c # prerelease
+          spell_check_this: check-spelling/spell-check-this@prerelease
           task: ${{ needs.spelling.outputs.followup }}
           config: .github/actions/docs-spelling
 
@@ -131,10 +131,10 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # main
+        uses: check-spelling/check-spelling@main
         with:
           checkout: true
-          spell_check_this: check-spelling/spell-check-this@92453f59cac8985482dfc301a8ece4c6d7de8a0c # prerelease
+          spell_check_this: check-spelling/spell-check-this@prerelease
           task: ${{ needs.spelling.outputs.followup }}
           experimental_apply_changes_via_bot: 1
           config: .github/actions/docs-spelling
@@ -156,7 +156,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: apply spelling updates
-        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # main
+        uses: check-spelling/check-spelling@main
         with:
           experimental_apply_changes_via_bot: 1
           checkout: true

.github/workflows/e2e-test.yml

@@ -30,9 +30,9 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4, 5]
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-jammy
+      image: mcr.microsoft.com/playwright:v1.57.0-jammy
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
@@ -41,7 +41,7 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Run E2E Tests
         run: yarn e2e --shard=${{ matrix.shard }}/5
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: desktop-client-test-results-shard-${{ matrix.shard }}
@@ -53,25 +53,19 @@ jobs:
     name: Functional Desktop App
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-jammy
+      image: mcr.microsoft.com/playwright:v1.57.0-jammy
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
           download-translations: 'false'
       - name: Trust the repository directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-
-      # Build tools are needed to rebuild native modules like better-sqlite3 used by the Desktop app, which is required to run E2E tests on the Desktop app.
-      - name: Install build tools
-        run: apt-get update && apt-get install -y build-essential python3
-
       - name: Run Desktop app E2E Tests
         run: |
-          yarn rebuild-electron
           xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: desktop-app-test-results
@@ -87,16 +81,16 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4, 5]
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-jammy
+      image: mcr.microsoft.com/playwright:v1.57.0-jammy
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
         with:
           download-translations: 'false'
       - name: Run VRT Tests
         run: yarn vrt --shard=${{ matrix.shard }}/5
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: vrt-blob-report-${{ matrix.shard }}
@@ -110,13 +104,13 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !cancelled() }}
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-jammy
+      image: mcr.microsoft.com/playwright:v1.57.0-jammy
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Download all blob reports
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           path: packages/desktop-client/all-blob-reports
           pattern: vrt-blob-report-*
@@ -124,7 +118,7 @@ jobs:
       - name: Merge reports
         id: merge-reports
         run: yarn workspace @actual-app/web run playwright merge-reports --reporter html ./all-blob-reports
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         id: playwright-report-vrt
         with:
           name: html-report--attempt-${{ github.run_attempt }}
@@ -140,7 +134,7 @@ jobs:
           echo "${{ steps.playwright-report-vrt.outputs.artifact-url }}" > vrt-metadata/artifact-url.txt
       - name: Upload VRT metadata
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: vrt-comment-metadata
           path: vrt-metadata/

.github/workflows/e2e-vrt-comment.yml

@@ -18,7 +18,7 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request'
     steps:
       - name: Download VRT metadata
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
@@ -53,7 +53,7 @@ jobs:
 
       - name: Comment on PR with VRT report link
         if: steps.metadata.outputs.should_comment == 'true'
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           number: ${{ steps.metadata.outputs.pr_number }}
           header: vrt-comment

.github/workflows/electron-master.yml

@@ -29,7 +29,7 @@ jobs:
           - macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
       - if: ${{ ! startsWith(matrix.os, 'windows') }}
@@ -74,7 +74,7 @@ jobs:
         if: ${{ ! startsWith(matrix.os, 'macos') }}
         run: ./bin/package-electron
       - name: Upload Build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}
           path: |
@@ -85,13 +85,13 @@ jobs:
             packages/desktop-electron/dist/*.flatpak
       - name: Upload Windows Store Build
         if: ${{ startsWith(matrix.os, 'windows') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}-appx
           path: |
             packages/desktop-electron/dist/*.appx
       - name: Add to new release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
         with:
           draft: true
           body: |
@@ -126,7 +126,7 @@ jobs:
           Install-Module -Name StoreBroker -AcceptLicense -Force -Scope CurrentUser -Verbose
 
       - name: Download Microsoft Store artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: actual-electron-windows-latest-appx
 
@@ -156,3 +156,53 @@ jobs:
             -NoStatus `
             -AutoCommit `
             -Force
+
+  publish-flathub:
+    needs: build
+    runs-on: ubuntu-22.04
+    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
+    steps:
+      - name: Download Linux artifacts
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: actual-electron-ubuntu-22.04
+
+      - name: Calculate AppImage SHA256
+        id: appimage_sha256
+        run: |
+          APPIMAGE_X64_SHA256=$(sha256sum Actual-linux-x86_64.AppImage | awk '{ print $1 }')
+          APPIMAGE_ARM64_SHA256=$(sha256sum Actual-linux-arm64.AppImage | awk '{ print $1 }')
+          echo "APPIMAGE_X64_SHA256=$APPIMAGE_X64_SHA256" >> "$GITHUB_ENV"
+          echo "APPIMAGE_ARM64_SHA256=$APPIMAGE_ARM64_SHA256" >> "$GITHUB_ENV"
+
+      - name: Checkout Flathub repo
+        uses: actions/checkout@v6
+        with:
+          repository: flathub/com.actualbudget.actual
+          token: ${{ secrets.FLATHUB_GITHUB_TOKEN }}
+
+      - name: Update manifest with new SHA256
+        run: |
+          # Replace x86_64 entry
+          sed -i "/x86_64.AppImage/{n;s|sha256:.*|sha256: ${{ env.APPIMAGE_X64_SHA256 }}|}" com.actualbudget.actual.yml
+          sed -i "/x86_64.AppImage/s|url:.*|url: https://github.com/actualbudget/actual/releases/download/v${{ needs.build.outputs.version }}/Actual-linux-x86_64.AppImage|" com.actualbudget.actual.yml
+
+          # Replace arm64 entry
+          sed -i "/arm64.AppImage/{n;s|sha256:.*|sha256: ${{ env.APPIMAGE_ARM64_SHA256 }}|}" com.actualbudget.actual.yml
+          sed -i "/arm64.AppImage/s|url:.*|url: https://github.com/actualbudget/actual/releases/download/v${{ needs.build.outputs.version }}/Actual-linux-arm64.AppImage|" com.actualbudget.actual.yml
+
+          cat com.actualbudget.actual.yml
+
+      - name: Create PR in Flathub repo
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.FLATHUB_GITHUB_TOKEN }}
+          commit-message: 'Update Actual flatpak to version ${{ needs.build.outputs.version }}'
+          branch: 'release/${{ needs.build.outputs.version }}'
+          draft: true
+          title: 'Update Actual flatpak to version ${{ needs.build.outputs.version }}'
+          body: |
+            This PR updates the Actual desktop flatpak to version ${{ needs.build.outputs.version }}.
+
+            :link: [View release notes](https://actualbudget.org/blog/release-${{ needs.build.outputs.version }})
+          reviewers: 'jfdoming,MatissJanis,youngcw' # The core team that have accepted the collaborator access to the Flathub repo

.github/workflows/electron-pr.yml

@@ -33,7 +33,7 @@ jobs:
           - macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
       - if: ${{ ! startsWith(matrix.os, 'windows') }}
@@ -42,8 +42,6 @@ jobs:
           python3 -m venv .venv
           source .venv/bin/activate
           python3 -m pip install setuptools
-      - name: Set up environment
-        uses: ./.github/actions/setup
       - if: ${{ startsWith(matrix.os, 'ubuntu') }}
         name: Setup Flatpak dependencies
         run: |
@@ -58,63 +56,65 @@ jobs:
 
           METAINFO_FILE="packages/desktop-electron/extra-resources/linux/com.actualbudget.actual.metainfo.xml"
           TODAY=$(date +%Y-%m-%d)
-          VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/desktop-electron/package.json --type nightly)
+          VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/desktop-electron/package.json --type nightly)
           sed -i "s/%RELEASE_VERSION%/$VERSION/g; s/%RELEASE_DATE%/$TODAY/g" "$METAINFO_FILE"
           flatpak run --command=flatpak-builder-lint org.flatpak.Builder appstream "$METAINFO_FILE"
+      - name: Set up environment
+        uses: ./.github/actions/setup
       - name: Build Electron
         run: ./bin/package-electron
 
       - name: Upload Linux x64 AppImage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-linux-x86_64.AppImage
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-linux-x86_64.AppImage
 
       - name: Upload Linux arm64 AppImage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-linux-arm64.AppImage
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-linux-arm64.AppImage
 
       - name: Upload Linux x64 flatpak
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-linux-x86_64.flatpak
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-linux-x86_64.flatpak
 
       - name: Upload Windows x32 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-ia32.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-ia32.exe
 
       - name: Upload Windows x64 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-x64.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-x64.exe
 
       - name: Upload Windows arm64 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-arm64.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-arm64.exe
 
       - name: Upload Mac x64 dmg
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-mac-x64.dmg
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-mac-x64.dmg
 
       - name: Upload Mac arm64 dmg
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-mac-arm64.dmg
           if-no-files-found: ignore
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload Windows Store Build
         if: ${{ startsWith(matrix.os, 'windows') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}-appx
           path: |

.github/workflows/fork-pr-welcome.yml

@@ -25,7 +25,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name != github.repository
     steps:
       - name: Post welcome comment
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           number: ${{ github.event.pull_request.number }}

.github/workflows/generate-release-pr.yml

@@ -0,0 +1,60 @@
+name: Generate release PR
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Commit or branch to release'
+        required: true
+        default: 'master'
+      version:
+        description: 'Version number for the release (optional)'
+        required: false
+        default: ''
+
+jobs:
+  generate-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.inputs.ref }}
+      - name: Bump package versions
+        id: bump_package_versions
+        shell: bash
+        run: |
+          declare -A packages=(
+            [web]="desktop-client"
+            [electron]="desktop-electron"
+            [sync]="sync-server"
+            [api]="api"
+          )
+
+          for key in "${!packages[@]}"; do
+            pkg="${packages[$key]}"
+
+            if [[ -n "${{ github.event.inputs.version }}" ]]; then
+              version=$(node ./packages/ci-actions/bin/get-next-package-version.js \
+                --package-json "./packages/$pkg/package.json" \
+                --version "${{ github.event.inputs.version }}" \
+                --update)
+            else
+              version=$(node ./packages/ci-actions/bin/get-next-package-version.js \
+                --package-json "./packages/$pkg/package.json" \
+                --type auto \
+                --update)
+            fi
+
+            eval "NEW_${key^^}_VERSION=\"$version\""
+          done
+
+          echo "version=$NEW_WEB_VERSION" >> "$GITHUB_OUTPUT"
+      - name: Create PR
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ secrets.ACTIONS_UPDATE_TOKEN }}
+          commit-message: '🔖 (${{ steps.bump_package_versions.outputs.version }})'
+          title: '🔖 (${{ steps.bump_package_versions.outputs.version }})'
+          body: 'Generated by [generate-release-pr.yml](../tree/master/.github/workflows/generate-release-pr.yml)'
+          branch: 'release/v${{ steps.bump_package_versions.outputs.version }}'

.github/workflows/i18n-string-extract-master.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'actualbudget/actual'
     steps:
       - name: Check out main repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: actual
       - name: Set up environment
@@ -27,23 +27,12 @@ jobs:
       - name: Configure i18n client
         run: |
           pip install wlc
-      - name: Configure Weblate API credentials
-        env:
-          WEBLATE_API_KEY: ${{ secrets.WEBLATE_API_KEY_CI_STRINGS }}
-        run: |
-          # Write the API key to wlc's config file instead of passing it on
-          # the command line, so the secret doesn't appear in process listings.
-          mkdir -p "$HOME/.config"
-          umask 077
-          cat > "$HOME/.config/weblate" <<EOF
-          [keys]
-          https://hosted.weblate.org/api/ = ${WEBLATE_API_KEY}
-          EOF
 
       - name: Lock translations
         run: |
           wlc \
             --url https://hosted.weblate.org/api/ \
+            --key "${{ secrets.WEBLATE_API_KEY_CI_STRINGS }}" \
             lock \
             actualbudget/actual
 
@@ -51,10 +40,11 @@ jobs:
         run: |
           wlc \
             --url https://hosted.weblate.org/api/ \
+            --key "${{ secrets.WEBLATE_API_KEY_CI_STRINGS }}" \
             push \
             actualbudget/actual
       - name: Check out updated translations
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ssh-key: ${{ secrets.STRING_IMPORT_DEPLOY_KEY }}
           repository: actualbudget/translations
@@ -83,6 +73,7 @@ jobs:
         run: |
           wlc \
             --url https://hosted.weblate.org/api/ \
+            --key "${{ secrets.WEBLATE_API_KEY_CI_STRINGS }}" \
             pull \
             actualbudget/actual
 
@@ -91,5 +82,6 @@ jobs:
         run: |
           wlc \
             --url https://hosted.weblate.org/api/ \
+            --key "${{ secrets.WEBLATE_API_KEY_CI_STRINGS }}" \
             unlock \
             actualbudget/actual

.github/workflows/issues-feature-implemented.yml

@@ -24,8 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # This is not a security concern because we have approved & merged the PR
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22
       - name: Handle feature requests

.github/workflows/merge-freeze-unfreeze.yml

@@ -1,37 +0,0 @@
-# When the "unfreeze" label is added to a PR, add that PR to Merge Freeze's unblocked list
-# so it can be merged during a freeze. Uses pull_request_target so the workflow runs in
-# the base repo and has access to MERGEFREEZE_ACCESS_TOKEN for fork PRs; it does not
-# checkout or run any PR code. Requires MERGEFREEZE_ACCESS_TOKEN repo secret
-# (project-specific token from Merge Freeze Web API panel for actualbudget/actual / master).
-# See: https://docs.mergefreeze.com/web-api#post-freeze-status
-
-name: Merge Freeze – add PR to unblocked list
-
-on:
-  pull_request_target:
-    types: [labeled]
-
-jobs:
-  unfreeze:
-    if: ${{ github.event.label.name == 'unfreeze' }}
-    runs-on: ubuntu-latest
-    permissions: {}
-    concurrency:
-      group: merge-freeze-unfreeze-${{ github.ref }}-labels
-      cancel-in-progress: false
-    steps:
-      - name: POST to Merge Freeze – add PR to unblocked list
-        env:
-          MERGEFREEZE_ACCESS_TOKEN: ${{ secrets.MERGEFREEZE_ACCESS_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          USER_NAME: ${{ github.actor }}
-        run: |
-          set -e
-          if [ -z "$MERGEFREEZE_ACCESS_TOKEN" ]; then
-            echo "::error::MERGEFREEZE_ACCESS_TOKEN secret is not set"
-            exit 1
-          fi
-          url="https://www.mergefreeze.com/api/branches/actualbudget/actual/master/?access_token=${MERGEFREEZE_ACCESS_TOKEN}"
-          payload=$(jq -n --arg user_name "$USER_NAME" --argjson pr "$PR_NUMBER" '{frozen: true, user_name: $user_name, unblocked_prs: [$pr]}')
-          curl -sf -X POST "$url" -H "Content-Type: application/json" -d "$payload"
-          echo "Merge Freeze updated: PR #$PR_NUMBER added to unblocked list."

.github/workflows/netlify-release.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup
@@ -34,11 +34,10 @@ jobs:
 
       - name: Deploy to Netlify
         id: netlify_deploy
-        env:
-          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_API_TOKEN }}
         run: |
           netlify deploy \
             --dir packages/desktop-client/build \
+            --site ${{ secrets.NETLIFY_SITE_ID }} \
+            --auth ${{ secrets.NETLIFY_API_TOKEN }} \
             --filter @actual-app/web \
             --prod

.github/workflows/pr-ai-label-cleanup.yml

@@ -0,0 +1,25 @@
+name: Remove 'suspect ai generated' label when 'AI generated' is present
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  remove-suspect-label:
+    if: >-
+      ${{ contains(github.event.pull_request.labels.*.name, 'AI generated') &&
+          contains(github.event.pull_request.labels.*.name, 'suspect ai generated') }}
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              name: 'suspect ai generated'
+            });

.github/workflows/publish-flathub.yml

@@ -1,126 +0,0 @@
-name: Publish Flathub
-
-defaults:
-  run:
-    shell: bash
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag (e.g. v25.3.0)'
-        required: true
-        type: string
-
-concurrency:
-  group: publish-flathub
-  cancel-in-progress: false
-
-jobs:
-  publish-flathub:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Resolve version
-        id: resolve_version
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-          INPUT_TAG: ${{ inputs.tag }}
-        run: |
-          if [[ "$EVENT_NAME" == "release" ]]; then
-            TAG="$RELEASE_TAG"
-          else
-            TAG="$INPUT_TAG"
-          fi
-
-          if [[ -z "$TAG" ]]; then
-            echo "::error::No tag provided"
-            exit 1
-          fi
-
-          # Validate tag format (v-prefixed semver, e.g. v25.3.0 or v1.2.3-beta.1)
-          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
-            echo "::error::Invalid tag format: $TAG (expected v-prefixed semver, e.g. v25.3.0)"
-            exit 1
-          fi
-
-          VERSION="${TAG#v}"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Resolved tag=$TAG version=$VERSION"
-
-      - name: Verify release assets exist
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          TAG="${{ steps.resolve_version.outputs.tag }}"
-
-          echo "Checking release assets for tag $TAG..."
-          ASSETS=$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq '.assets[].name')
-
-          echo "Found assets:"
-          echo "$ASSETS"
-
-          if ! echo "$ASSETS" | grep -qx "Actual-linux-x86_64.AppImage"; then
-            echo "::error::Missing asset: Actual-linux-x86_64.AppImage"
-            exit 1
-          fi
-
-          if ! echo "$ASSETS" | grep -qx "Actual-linux-arm64.AppImage"; then
-            echo "::error::Missing asset: Actual-linux-arm64.AppImage"
-            exit 1
-          fi
-
-          echo "All required AppImage assets found."
-
-      - name: Calculate AppImage SHA256 (streamed)
-        run: |
-          VERSION="${{ steps.resolve_version.outputs.version }}"
-          BASE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}"
-
-          echo "Streaming x86_64 AppImage to compute SHA256..."
-          APPIMAGE_X64_SHA256=$(curl -fSL "${BASE_URL}/Actual-linux-x86_64.AppImage" | sha256sum | awk '{ print $1 }')
-          echo "x86_64 SHA256: $APPIMAGE_X64_SHA256"
-
-          echo "Streaming arm64 AppImage to compute SHA256..."
-          APPIMAGE_ARM64_SHA256=$(curl -fSL "${BASE_URL}/Actual-linux-arm64.AppImage" | sha256sum | awk '{ print $1 }')
-          echo "arm64 SHA256: $APPIMAGE_ARM64_SHA256"
-
-          echo "APPIMAGE_X64_SHA256=$APPIMAGE_X64_SHA256" >> "$GITHUB_ENV"
-          echo "APPIMAGE_ARM64_SHA256=$APPIMAGE_ARM64_SHA256" >> "$GITHUB_ENV"
-
-      - name: Checkout Flathub repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: flathub/com.actualbudget.actual
-          token: ${{ secrets.FLATHUB_GITHUB_TOKEN }}
-
-      - name: Update manifest with new version
-        run: |
-          VERSION="${{ steps.resolve_version.outputs.version }}"
-
-          # Replace x86_64 entry
-          sed -i "/x86_64.AppImage/{n;s|sha256:.*|sha256: ${{ env.APPIMAGE_X64_SHA256 }}|}" com.actualbudget.actual.yml
-          sed -i "/x86_64.AppImage/s|url:.*|url: https://github.com/actualbudget/actual/releases/download/v${VERSION}/Actual-linux-x86_64.AppImage|" com.actualbudget.actual.yml
-
-          # Replace arm64 entry
-          sed -i "/arm64.AppImage/{n;s|sha256:.*|sha256: ${{ env.APPIMAGE_ARM64_SHA256 }}|}" com.actualbudget.actual.yml
-          sed -i "/arm64.AppImage/s|url:.*|url: https://github.com/actualbudget/actual/releases/download/v${VERSION}/Actual-linux-arm64.AppImage|" com.actualbudget.actual.yml
-
-          echo "Updated manifest:"
-          cat com.actualbudget.actual.yml
-
-      - name: Create PR in Flathub repo
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.FLATHUB_GITHUB_TOKEN }}
-          commit-message: 'Update Actual flatpak to version ${{ steps.resolve_version.outputs.version }}'
-          branch: 'release/${{ steps.resolve_version.outputs.version }}'
-          title: 'Update Actual flatpak to version ${{ steps.resolve_version.outputs.version }}'
-          body: |
-            This PR updates the Actual desktop flatpak to version ${{ steps.resolve_version.outputs.version }}.
-
-            :link: [View release notes](https://actualbudget.org/blog/release-${{ steps.resolve_version.outputs.version }})
-          reviewers: 'jfdoming,MatissJanis,youngcw'

.github/workflows/publish-nightly-electron.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
 
@@ -39,9 +39,6 @@ jobs:
           source .venv/bin/activate
           python3 -m pip install setuptools
 
-      - name: Set up environment
-        uses: ./.github/actions/setup
-
       - if: ${{ startsWith(matrix.os, 'ubuntu') }}
         name: Setup Flatpak dependencies
         run: |
@@ -56,14 +53,16 @@ jobs:
 
           METAINFO_FILE="packages/desktop-electron/extra-resources/linux/com.actualbudget.actual.metainfo.xml"
           TODAY=$(date +%Y-%m-%d)
-          VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/desktop-electron/package.json --type nightly)
+          VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/desktop-electron/package.json --type nightly)
           sed -i "s/%RELEASE_VERSION%/$VERSION/g; s/%RELEASE_DATE%/$TODAY/g" "$METAINFO_FILE"
           flatpak run --command=flatpak-builder-lint org.flatpak.Builder appstream "$METAINFO_FILE"
+      - name: Set up environment
+        uses: ./.github/actions/setup
 
       - name: Update package versions
         run: |
           # Get new nightly version
-          NEW_DESKTOP_APP_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/desktop-electron/package.json --type nightly)
+          NEW_DESKTOP_APP_VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/desktop-electron/package.json --type nightly)
 
           # Set package version
           npm version $NEW_DESKTOP_APP_VERSION --no-git-tag-version --workspace=desktop-electron --no-workspaces-update
@@ -83,49 +82,49 @@ jobs:
         run: ./bin/package-electron
 
       - name: Upload Linux x64 AppImage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-linux-x86_64.AppImage
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-linux-x86_64.AppImage
 
       - name: Upload Linux arm64 AppImage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-linux-arm64.AppImage
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-linux-arm64.AppImage
 
       - name: Upload Windows x32 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-ia32.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-ia32.exe
 
       - name: Upload Windows x64 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-x64.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-x64.exe
 
       - name: Upload Windows arm64 exe
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-windows-arm64.exe
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-windows-arm64.exe
 
       - name: Upload Mac x64 dmg
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-mac-x64.dmg
           if-no-files-found: ignore
           path: packages/desktop-electron/dist/Actual-mac-x64.dmg
 
       - name: Upload Mac arm64 dmg
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Actual-mac-arm64.dmg
           if-no-files-found: ignore
@@ -133,7 +132,7 @@ jobs:
 
       - name: Upload Windows Store Build
         if: ${{ startsWith(matrix.os, 'windows') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}-appx
           path: |

.github/workflows/publish-nightly-npm-packages.yml

@@ -12,7 +12,7 @@ jobs:
     name: Build and pack npm packages
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup
@@ -20,27 +20,19 @@ jobs:
       - name: Update package versions
         run: |
           # Get new nightly versions
-          NEW_CORE_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/loot-core/package.json --type nightly)
-          NEW_WEB_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/desktop-client/package.json --type nightly)
-          NEW_SYNC_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/sync-server/package.json --type nightly)
-          NEW_API_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/api/package.json --type nightly)
-          NEW_CLI_VERSION=$(yarn workspace @actual-app/ci-actions tsx bin/get-next-package-version.ts --package-json ./packages/cli/package.json --type nightly)
+          NEW_WEB_VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/desktop-client/package.json --type nightly)
+          NEW_SYNC_VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/sync-server/package.json --type nightly)
+          NEW_API_VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/api/package.json --type nightly)
 
           # Set package versions
-          npm version $NEW_CORE_VERSION --no-git-tag-version --workspace=@actual-app/core --no-workspaces-update
           npm version $NEW_WEB_VERSION --no-git-tag-version --workspace=@actual-app/web --no-workspaces-update
           npm version $NEW_SYNC_VERSION --no-git-tag-version --workspace=@actual-app/sync-server --no-workspaces-update
           npm version $NEW_API_VERSION --no-git-tag-version --workspace=@actual-app/api --no-workspaces-update
-          npm version $NEW_CLI_VERSION --no-git-tag-version --workspace=@actual-app/cli --no-workspaces-update
 
       - name: Yarn install
         run: |
           yarn install
 
-      - name: Pack the core package
-        run: |
-          yarn workspace @actual-app/core pack --filename @actual-app/core.tgz
-
       - name: Build Server & Web
         run: yarn build:server
 
@@ -56,23 +48,14 @@ jobs:
         run: |
           yarn workspace @actual-app/api pack --filename @actual-app/api.tgz
 
-      - name: Build CLI
-        run: yarn workspace @actual-app/cli build
-
-      - name: Pack the cli package
-        run: |
-          yarn workspace @actual-app/cli pack --filename @actual-app/cli.tgz
-
       - name: Upload package artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: npm-packages
           path: |
-            packages/loot-core/@actual-app/core.tgz
             packages/desktop-client/@actual-app/web.tgz
             packages/sync-server/@actual-app/sync-server.tgz
             packages/api/@actual-app/api.tgz
-            packages/cli/@actual-app/cli.tgz
 
   publish:
     runs-on: ubuntu-latest
@@ -83,22 +66,16 @@ jobs:
       packages: write
     steps:
       - name: Download the artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: npm-packages
 
       - name: Setup node and npm registry
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Publish Core
-        run: |
-          npm publish loot-core/@actual-app/core.tgz --access public --tag nightly
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Publish Web
         run: |
           npm publish desktop-client/@actual-app/web.tgz --access public --tag nightly
@@ -116,9 +93,3 @@ jobs:
           npm publish api/@actual-app/api.tgz --access public --tag nightly
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish CLI
-        run: |
-          npm publish cli/@actual-app/cli.tgz --access public --tag nightly
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish-npm-packages.yml

@@ -11,15 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and pack npm packages
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup
 
-      - name: Pack the core package
-        run: |
-          yarn workspace @actual-app/core pack --filename @actual-app/core.tgz
-
       - name: Build Web
         run: yarn build:server
 
@@ -35,23 +31,14 @@ jobs:
         run: |
           yarn workspace @actual-app/api pack --filename @actual-app/api.tgz
 
-      - name: Build CLI
-        run: yarn workspace @actual-app/cli build
-
-      - name: Pack the cli package
-        run: |
-          yarn workspace @actual-app/cli pack --filename @actual-app/cli.tgz
-
       - name: Upload package artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: npm-packages
           path: |
-            packages/loot-core/@actual-app/core.tgz
             packages/desktop-client/@actual-app/web.tgz
             packages/sync-server/@actual-app/sync-server.tgz
             packages/api/@actual-app/api.tgz
-            packages/cli/@actual-app/cli.tgz
 
   publish:
     runs-on: ubuntu-latest
@@ -62,22 +49,16 @@ jobs:
       packages: write
     steps:
       - name: Download the artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: npm-packages
 
       - name: Setup node and npm registry
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Publish Core
-        run: |
-          npm publish loot-core/@actual-app/core.tgz --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Publish Web
         run: |
           npm publish desktop-client/@actual-app/web.tgz --access public
@@ -95,9 +76,3 @@ jobs:
           npm publish api/@actual-app/api.tgz --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish CLI
-        run: |
-          npm publish cli/@actual-app/cli.tgz --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-notes.yml

@@ -3,10 +3,6 @@ name: Release notes
 on:
   pull_request:
 
-permissions:
-  contents: write
-  pull-requests: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -15,31 +11,11 @@ jobs:
   release-notes:
     runs-on: ubuntu-latest
     steps:
-      - name: Check if triggered by bot
-        id: bot-check
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { data: commit } = await github.rest.git.getCommit({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              commit_sha: context.payload.pull_request.head.sha,
-            });
-            const skip = commit.author.name === 'github-actions[bot]'
-              && commit.message.startsWith('Generate release notes');
-            console.log(`Head commit by "${commit.author.name}": ${commit.message.split('\n')[0]}`);
-            console.log(`Skip: ${skip}`);
-            core.setOutput('skip', String(skip));
-
       - name: Checkout
-        if: steps.bot-check.outputs.skip != 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
-          token: ${{ secrets.ACTIONS_UPDATE_TOKEN || github.token }}
-
       - name: Get changed files
-        if: steps.bot-check.outputs.skip != 'true'
         id: changed-files
         run: |
           git fetch origin ${{ github.base_ref }}
@@ -52,17 +28,9 @@ jobs:
           else
             echo "only_docs=false" >> $GITHUB_OUTPUT
           fi
-
       - name: Check release notes
-        if: >-
-          steps.bot-check.outputs.skip != 'true'
-          && startsWith(github.head_ref, 'release/') == false
-          && steps.changed-files.outputs.only_docs != 'true'
-        uses: ./.github/actions/release-notes/check
-
+        if: startsWith(github.head_ref, 'release/') == false && steps.changed-files.outputs.only_docs != 'true'
+        uses: actualbudget/actions/release-notes/check@main
       - name: Generate release notes
-        if: >-
-          steps.bot-check.outputs.skip != 'true'
-          && startsWith(github.head_ref, 'release/') == true
-          && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name
-        uses: ./.github/actions/release-notes/generate
+        if: startsWith(github.head_ref, 'release/') == true
+        uses: actualbudget/actions/release-notes/generate@main

.github/workflows/size-compare.yml

@@ -35,7 +35,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.base_ref }}
       - name: Set up environment
@@ -57,20 +57,6 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           checkName: api
           ref: ${{github.base_ref}}
-      - name: Wait for ${{github.base_ref}} CLI build to succeed
-        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
-        id: master-cli-build
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          checkName: cli
-          ref: ${{github.base_ref}}
-      - name: Wait for ${{github.base_ref}} CRDT build to succeed
-        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
-        id: master-crdt-build
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          checkName: crdt
-          ref: ${{github.base_ref}}
 
       - name: Wait for PR build to succeed
         uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
@@ -86,29 +72,15 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           checkName: api
           ref: ${{github.event.pull_request.head.sha}}
-      - name: Wait for CLI PR build to succeed
-        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
-        id: wait-for-cli-build
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          checkName: cli
-          ref: ${{github.event.pull_request.head.sha}}
-      - name: Wait for CRDT PR build to succeed
-        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
-        id: wait-for-crdt-build
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          checkName: crdt
-          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Report build failure
-        if: steps.wait-for-web-build.outputs.conclusion == 'failure' || steps.wait-for-api-build.outputs.conclusion == 'failure' || steps.wait-for-cli-build.outputs.conclusion == 'failure' || steps.wait-for-crdt-build.outputs.conclusion == 'failure'
+        if: steps.wait-for-web-build.outputs.conclusion == 'failure' || steps.wait-for-api-build.outputs.conclusion == 'failure'
         run: |
           echo "Build failed on PR branch or ${{github.base_ref}}"
           exit 1
 
       - name: Download web build artifact from ${{github.base_ref}}
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         id: pr-web-build
         with:
           branch: ${{github.base_ref}}
@@ -117,7 +89,7 @@ jobs:
           name: build-stats
           path: base
       - name: Download API build artifact from ${{github.base_ref}}
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         id: pr-api-build
         with:
           branch: ${{github.base_ref}}
@@ -126,7 +98,7 @@ jobs:
           name: api-build-stats
           path: base
       - name: Download build stats from PR
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         with:
           pr: ${{github.event.pull_request.number}}
           workflow: build.yml
@@ -135,7 +107,7 @@ jobs:
           path: head
           allow_forks: true
       - name: Download API stats from PR
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         with:
           pr: ${{github.event.pull_request.number}}
           workflow: build.yml
@@ -143,40 +115,6 @@ jobs:
           name: api-build-stats
           path: head
           allow_forks: true
-      - name: Download CLI build artifact from ${{github.base_ref}}
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
-        with:
-          branch: ${{github.base_ref}}
-          workflow: build.yml
-          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
-          name: cli-build-stats
-          path: base
-      - name: Download CLI stats from PR
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
-        with:
-          pr: ${{github.event.pull_request.number}}
-          workflow: build.yml
-          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
-          name: cli-build-stats
-          path: head
-          allow_forks: true
-      - name: Download CRDT build artifact from ${{github.base_ref}}
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
-        with:
-          branch: ${{github.base_ref}}
-          workflow: build.yml
-          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
-          name: crdt-build-stats
-          path: base
-      - name: Download CRDT stats from PR
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
-        with:
-          pr: ${{github.event.pull_request.number}}
-          workflow: build.yml
-          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
-          name: crdt-build-stats
-          path: head
-          allow_forks: true
       - name: Strip content hashes from stats files
         run: |
           if [ -f ./head/web-stats.json ]; then
@@ -198,13 +136,9 @@ jobs:
             --base desktop-client=./base/web-stats.json \
             --base loot-core=./base/loot-core-stats.json \
             --base api=./base/api-stats.json \
-            --base cli=./base/cli-stats.json \
-            --base crdt=./base/crdt-stats.json \
             --head desktop-client=./head/web-stats.json \
             --head loot-core=./head/loot-core-stats.json \
             --head api=./head/api-stats.json \
-            --head cli=./head/cli-stats.json \
-            --head crdt=./head/crdt-stats.json \
             --identifier combined \
             --format pr-body > bundle-stats-comment.md
       - name: Post combined bundle stats comment

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           close-pr-message: 'This PR was closed because it has been stalled for 5 days with no activity.'
@@ -18,7 +18,7 @@ jobs:
   stale-wip:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-pr-message: ':wave: Hi! It looks like this PR has not had any changes for a week now. Would you like someone to review this PR? If so - please remove the "[WIP]" prefix from the PR title. That will let the community know that this PR is open for a review.'
           days-before-stale: 7
@@ -29,7 +29,7 @@ jobs:
   stale-needs-info:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-issue-label: 'needs info'
           days-before-stale: -1

.github/workflows/vrt-update-apply.yml

@@ -19,7 +19,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download patch artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
@@ -27,7 +27,7 @@ jobs:
           path: /tmp/artifacts
 
       - name: Download metadata artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
@@ -54,7 +54,7 @@ jobs:
 
       - name: Checkout fork branch
         if: steps.metadata.outputs.pr_number != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: ${{ steps.metadata.outputs.head_repo }}
           ref: ${{ steps.metadata.outputs.head_ref }}
@@ -133,15 +133,12 @@ jobs:
 
       - name: Comment on PR - Failure
         if: failure() && steps.metadata.outputs.pr_number != ''
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          APPLY_ERROR: ${{ steps.apply.outputs.error }}
-          PR_NUMBER: ${{ steps.metadata.outputs.pr_number }}
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const error = process.env.APPLY_ERROR || 'Unknown error occurred';
+            const error = `${{ steps.apply.outputs.error }}` || 'Unknown error occurred';
             await github.rest.issues.createComment({
-              issue_number: parseInt(process.env.PR_NUMBER, 10),
+              issue_number: ${{ steps.metadata.outputs.pr_number }},
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: `❌ Failed to apply VRT updates: ${error}\n\nPlease check the workflow logs for details.`

.github/workflows/vrt-update-generate.yml

@@ -26,7 +26,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add 👀 reaction to comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -44,11 +44,11 @@ jobs:
       github.event.issue.pull_request &&
       startsWith(github.event.comment.body, '/update-vrt')
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-jammy
+      image: mcr.microsoft.com/playwright:v1.57.0-jammy
     steps:
       - name: Get PR details
         id: pr
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { data: pr } = await github.rest.pulls.get({
@@ -60,7 +60,7 @@ jobs:
             core.setOutput('head_ref', pr.head.ref);
             core.setOutput('head_repo', pr.head.repo.full_name);
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ steps.pr.outputs.head_sha }}
 
@@ -69,14 +69,9 @@ jobs:
         with:
           download-translations: 'false'
 
-      # Build tools are needed to rebuild native modules like better-sqlite3 used by the Desktop app, which is required to run VRT tests on the Desktop app and generate updated snapshots.
-      - name: Install build tools
-        run: apt-get update && apt-get install -y build-essential python3
-
       - name: Run VRT Tests on Desktop app
         continue-on-error: true
         run: |
-          yarn rebuild-electron
           xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop --update-snapshots
 
       - name: Run VRT Tests
@@ -118,7 +113,7 @@ jobs:
 
       - name: Upload patch artifact
         if: steps.create-patch.outputs.has_changes == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: vrt-patch-${{ github.event.issue.number }}
           path: vrt-update.patch
@@ -134,7 +129,7 @@ jobs:
 
       - name: Upload PR metadata
         if: steps.create-patch.outputs.has_changes == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: vrt-metadata-${{ github.event.issue.number }}
           path: pr-metadata/

.gitignore

@@ -33,9 +33,7 @@ packages/desktop-electron/dist
 packages/desktop-electron/loot-core
 packages/desktop-client/service-worker
 packages/plugins-service/dist
-packages/component-library/dist
 packages/loot-core/lib-dist
-**/.tsbuildinfo
 packages/sync-server/coverage
 bundle.desktop.js
 bundle.desktop.js.map
@@ -58,10 +56,6 @@ bundle.mobile.js.map
 # IntelliJ IDEA
 .idea
 
-# Claude Code
-.claude/worktrees/*
-.claude/settings.local.json
-
 # Misc
 .#*
 
@@ -85,11 +79,3 @@ build/
 
 *storybook.log
 storybook-static
-
-# cli config when testing locally
-.actualrc.json
-.actualrc
-.actualrc.yaml
-.actualrc.yml
-actual.config.js
-.playwright-cli/

.husky/post-checkout

@@ -1,21 +0,0 @@
-#!/bin/sh
-# Run yarn install when switching branches (if yarn.lock changed)
-# or when creating a new worktree (node_modules won't exist yet)
-
-# $3 is 1 for branch checkout, 0 for file checkout
-if [ "$3" != "1" ]; then
-  exit 0
-fi
-
-# Worktree creation: node_modules doesn't exist yet, always install
-if [ ! -d "node_modules" ]; then
-  echo "New worktree detected — running yarn install..."
-  yarn install || exit 1
-  exit 0
-fi
-
-# Check if yarn.lock changed between the old and new HEAD
-if git diff --name-only "$1" "$2" | grep -q "^yarn.lock$"; then
-  echo "yarn.lock changed — running yarn install..."
-  yarn install
-fi

.husky/post-merge

@@ -1,7 +0,0 @@
-#!/bin/sh
-# Run yarn install after pulling/merging (if yarn.lock changed)
-
-if git diff --name-only ORIG_HEAD HEAD | grep -q "^yarn.lock$"; then
-  echo "yarn.lock changed — running yarn install..."
-  yarn install
-fi

.oxfmtrc.json

@@ -9,14 +9,24 @@
       "react",
       "builtin",
       "external",
-      ["parent", "subpath"],
+      "loot-core",
+      "parent",
       "sibling",
-      "index"
+      "index",
+      "desktop-client"
     ],
     "customGroups": [
       {
         "groupName": "react",
-        "elementNamePattern": ["react", "react-dom/*", "react-*"]
+        "elementNamePattern": ["react"]
+      },
+      {
+        "groupName": "loot-core",
+        "elementNamePattern": ["loot-core"]
+      },
+      {
+        "groupName": "desktop-client",
+        "elementNamePattern": ["@desktop-client"]
       }
     ],
     "newlinesBetween": true

.oxlintrc.json

@@ -20,74 +20,72 @@
   "rules": {
     // Import sorting
     "perfectionist/sort-named-imports": [
-      "error",
+      "warn",
       {
         "groups": ["value-import", "type-import"]
       }
     ],
 
     // Actual rules
-    "actual/typography": "error",
+    "actual/typography": "warn",
     "actual/no-untranslated-strings": "error",
     "actual/prefer-trans-over-t": "error",
-    "actual/prefer-if-statement": "error",
+    "actual/prefer-if-statement": "warn",
     "actual/prefer-logger-over-console": "error",
-    "actual/object-shorthand-properties": "error",
-    "actual/prefer-const": "error",
-    "actual/no-anchor-tag": "error",
-    "actual/no-react-default-import": "error",
-    "actual/prefer-subpath-imports": "error",
-    "actual/no-extraneous-dependencies": "error",
+    "actual/object-shorthand-properties": "warn",
+    "actual/prefer-const": "warn",
+    "actual/no-anchor-tag": "warn",
+    "actual/no-react-default-import": "warn",
 
     // JSX A11y rules
     "jsx-a11y/no-autofocus": [
-      "error",
+      "warn",
       {
         "ignoreNonDOM": true
       }
     ],
-    "jsx-a11y/alt-text": "error",
-    "jsx-a11y/anchor-has-content": "error",
+    "jsx-a11y/alt-text": "warn",
+    "jsx-a11y/anchor-has-content": "warn",
     "jsx-a11y/anchor-is-valid": [
-      "error",
+      "warn",
       {
         "aspects": ["noHref", "invalidHref"]
       }
     ],
-    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
-    "jsx-a11y/aria-props": "error",
-    "jsx-a11y/aria-proptypes": "error",
+    "jsx-a11y/aria-activedescendant-has-tabindex": "warn",
+    "jsx-a11y/aria-props": "warn",
+    "jsx-a11y/aria-proptypes": "warn",
     "jsx-a11y/aria-role": [
-      "error",
+      "warn",
       {
         "ignoreNonDOM": true
       }
     ],
-    "jsx-a11y/aria-unsupported-elements": "error",
-    "jsx-a11y/heading-has-content": "error",
-    "jsx-a11y/iframe-has-title": "error",
-    "jsx-a11y/img-redundant-alt": "error",
-    "jsx-a11y/no-access-key": "error",
-    "jsx-a11y/no-distracting-elements": "error",
-    "jsx-a11y/no-redundant-roles": "error",
-    "jsx-a11y/role-has-required-aria-props": "error",
-    "jsx-a11y/role-supports-aria-props": "error",
-    "jsx-a11y/scope": "error",
+    "jsx-a11y/aria-unsupported-elements": "warn",
+    "jsx-a11y/heading-has-content": "warn",
+    "jsx-a11y/iframe-has-title": "warn",
+    "jsx-a11y/img-redundant-alt": "warn",
+    "jsx-a11y/no-access-key": "warn",
+    "jsx-a11y/no-distracting-elements": "warn",
+    "jsx-a11y/no-redundant-roles": "warn",
+    "jsx-a11y/role-has-required-aria-props": "warn",
+    "jsx-a11y/role-supports-aria-props": "warn",
+    "jsx-a11y/scope": "warn",
 
     // Typescript rules
-    "typescript/ban-ts-comment": ["error"],
-    "typescript/consistent-type-definitions": ["error", "type"],
+    "typescript/ban-ts-comment": ["warn"],
+    "typescript/consistent-type-definitions": ["warn", "type"],
     "typescript/consistent-type-imports": [
-      "error",
+      "warn",
       {
         "prefer": "type-imports",
         "fixStyle": "inline-type-imports"
       }
     ],
-    "typescript/no-implied-eval": "error",
-    "typescript/no-explicit-any": "error",
+    "typescript/no-implied-eval": "warn",
+    "typescript/no-explicit-any": "warn",
     "typescript/no-restricted-types": [
-      "error",
+      "warn",
       {
         "types": {
           // forbid FC as superfluous
@@ -100,30 +98,19 @@
         }
       }
     ],
-    "typescript/no-var-requires": "error",
-    // we want to allow unions such as "{ name: DbAccount['name'] | DbPayee['name'] }"
-    "typescript/no-duplicate-type-constituents": "off",
-    // we want to allow unions such as "string | 'network' | 'file-key-mismatch'"
-    "typescript/no-redundant-type-constituents": "off",
-    "typescript/await-thenable": "error",
-    "typescript/no-floating-promises": "error",
-    "typescript/require-array-sort-compare": "error",
-    "typescript/unbound-method": "error",
-    "typescript/no-for-in-array": "error",
-    "typescript/restrict-template-expressions": "error",
-    "typescript/no-misused-spread": "warn", // TODO: enable this
-    "typescript/no-base-to-string": "warn", // TODO: enable this
-    "typescript/no-unsafe-unary-minus": "warn", // TODO: enable this
-    "typescript/no-unsafe-type-assertion": "warn", // TODO: enable this
+    "typescript/no-var-requires": "warn",
 
     // Import rules
-    "import/consistent-type-specifier-style": "error",
+    "import/consistent-type-specifier-style": "warn",
     "import/first": "error",
     "import/no-amd": "error",
-    "import/no-default-export": "error",
+    "import/no-default-export": "warn",
     "import/no-webpack-loader-syntax": "error",
+    "import/no-useless-path-segments": "warn",
+    "import/no-unresolved": "warn",
+    "import/no-unused-modules": "warn",
     "import/no-duplicates": [
-      "error",
+      "warn",
       {
         "prefer-inline": false
       }
@@ -131,121 +118,122 @@
 
     // React rules
     "react/exhaustive-deps": [
-      "error",
+      "warn",
       {
         "additionalHooks": "(^useQuery$|^useEffectAfterMount$)"
       }
     ],
-    "react/jsx-curly-brace-presence": "error",
+    "react/jsx-curly-brace-presence": "warn",
     "react/jsx-filename-extension": [
-      "error",
+      "warn",
       {
         "extensions": [".jsx", ".tsx"],
         "allow": "as-needed"
       }
     ],
-    "react/jsx-no-comment-textnodes": "error",
-    "react/jsx-no-duplicate-props": "error",
-    "react/jsx-no-target-blank": "error",
+    "react/jsx-no-comment-textnodes": "warn",
+    "react/jsx-no-duplicate-props": "warn",
+    "react/jsx-no-target-blank": "warn",
     "react/jsx-no-undef": "error",
-    "react/jsx-no-useless-fragment": "error",
+    "react/jsx-no-useless-fragment": "warn",
     "react/jsx-pascal-case": [
-      "error",
+      "warn",
       {
         "allowAllCaps": true,
         "ignore": []
       }
     ],
-    "react/no-danger-with-children": "error",
-    "react/no-direct-mutation-state": "error",
-    "react/no-is-mounted": "error",
+    "react/no-danger-with-children": "warn",
+    "react/no-direct-mutation-state": "warn",
+    "react/no-is-mounted": "warn",
+    "react/no-unstable-nested-components": "warn",
     "react/require-render-return": "error",
     "react/rules-of-hooks": "error",
-    "react/self-closing-comp": "error",
-    "react/style-prop-object": "error",
-    "react/jsx-boolean-value": "error",
+    "react/self-closing-comp": "warn",
+    "react/style-prop-object": "warn",
+    "react/jsx-boolean-value": "warn",
 
     // ESLint rules
-    "eslint/array-callback-return": "error",
-    "eslint/curly": ["error", "multi-line", "consistent"],
+    "eslint/array-callback-return": "warn",
+    "eslint/curly": ["warn", "multi-line", "consistent"],
     "eslint/default-case": [
-      "error",
+      "warn",
       {
         "commentPattern": "^no default$"
       }
     ],
-    "eslint/eqeqeq": ["error", "smart"],
-    "eslint/no-array-constructor": "error",
-    "eslint/no-caller": "error",
-    "eslint/no-cond-assign": ["error", "except-parens"],
-    "eslint/no-const-assign": "error",
-    "eslint/no-control-regex": "error",
-    "eslint/no-delete-var": "error",
-    "eslint/no-dupe-class-members": "error",
-    "eslint/no-dupe-keys": "error",
-    "eslint/no-duplicate-case": "error",
-    "eslint/no-empty-character-class": "error",
-    "eslint/no-empty-function": "error",
-    "eslint/no-empty-pattern": "error",
-    "eslint/no-eval": "error",
-    "eslint/no-ex-assign": "error",
-    "eslint/no-extend-native": "error",
-    "eslint/no-extra-bind": "error",
-    "eslint/no-extra-label": "error",
-    "eslint/no-fallthrough": "error",
-    "eslint/no-func-assign": "error",
-    "eslint/no-invalid-regexp": "error",
-    "eslint/no-iterator": "error",
-    "eslint/no-label-var": "error",
-    "eslint/no-var": "error",
+    "eslint/eqeqeq": ["warn", "smart"],
+    "eslint/no-array-constructor": "warn",
+    "eslint/no-caller": "warn",
+    "eslint/no-cond-assign": ["warn", "except-parens"],
+    "eslint/no-const-assign": "warn",
+    "eslint/no-control-regex": "warn",
+    "eslint/no-delete-var": "warn",
+    "eslint/no-dupe-class-members": "warn",
+    "eslint/no-dupe-keys": "warn",
+    "eslint/no-duplicate-case": "warn",
+    "eslint/no-empty-character-class": "warn",
+    "eslint/no-empty-function": "warn",
+    "eslint/no-empty-pattern": "warn",
+    "eslint/no-eval": "warn",
+    "eslint/no-ex-assign": "warn",
+    "eslint/no-extend-native": "warn",
+    "eslint/no-extra-bind": "warn",
+    "eslint/no-extra-label": "warn",
+    "eslint/no-fallthrough": "warn",
+    "eslint/no-func-assign": "warn",
+    "eslint/no-invalid-regexp": "warn",
+    "eslint/no-iterator": "warn",
+    "eslint/no-label-var": "warn",
+    "eslint/no-var": "warn",
     "eslint/no-labels": [
-      "error",
+      "warn",
       {
         "allowLoop": true,
         "allowSwitch": false
       }
     ],
-    "eslint/no-new-func": "error",
-    "eslint/no-script-url": "error",
-    "eslint/no-self-assign": "error",
-    "eslint/no-self-compare": "error",
-    "eslint/no-sequences": "error",
-    "eslint/no-shadow-restricted-names": "error",
-    "eslint/no-sparse-arrays": "error",
-    "eslint/no-template-curly-in-string": "error",
-    "eslint/no-this-before-super": "error",
-    "eslint/no-throw-literal": "error",
-    "eslint/no-unreachable": "error",
-    "eslint/no-obj-calls": "error",
-    "eslint/no-new-wrappers": "error",
-    "eslint/no-unsafe-negation": "error",
-    "eslint/no-multi-str": "error",
-    "eslint/no-global-assign": "error",
-    "eslint/no-lone-blocks": "error",
-    "eslint/no-unused-labels": "error",
-    "eslint/no-object-constructor": "error",
-    "eslint/no-new-native-nonconstructor": "error",
-    "eslint/no-redeclare": "error",
-    "eslint/no-useless-computed-key": "error",
-    "eslint/no-useless-concat": "error",
-    "eslint/no-useless-escape": "error",
-    "eslint/require-yield": "error",
-    "eslint/getter-return": "error",
-    "eslint/unicode-bom": ["error", "never"],
-    "eslint/use-isnan": "error",
-    "eslint/valid-typeof": "error",
+    "eslint/no-new-func": "warn",
+    "eslint/no-script-url": "warn",
+    "eslint/no-self-assign": "warn",
+    "eslint/no-self-compare": "warn",
+    "eslint/no-sequences": "warn",
+    "eslint/no-shadow-restricted-names": "warn",
+    "eslint/no-sparse-arrays": "warn",
+    "eslint/no-template-curly-in-string": "warn",
+    "eslint/no-this-before-super": "warn",
+    "eslint/no-throw-literal": "warn",
+    "eslint/no-unreachable": "warn",
+    "eslint/no-obj-calls": "warn",
+    "eslint/no-new-wrappers": "warn",
+    "eslint/no-unsafe-negation": "warn",
+    "eslint/no-multi-str": "warn",
+    "eslint/no-global-assign": "warn",
+    "eslint/no-lone-blocks": "warn",
+    "eslint/no-unused-labels": "warn",
+    "eslint/no-object-constructor": "warn",
+    "eslint/no-new-native-nonconstructor": "warn",
+    "eslint/no-redeclare": "warn",
+    "eslint/no-useless-computed-key": "warn",
+    "eslint/no-useless-concat": "warn",
+    "eslint/no-useless-escape": "warn",
+    "eslint/require-yield": "warn",
+    "eslint/getter-return": "warn",
+    "eslint/unicode-bom": ["warn", "never"],
+    "eslint/no-use-isnan": "warn",
+    "eslint/valid-typeof": "warn",
     "eslint/no-useless-rename": [
-      "error",
+      "warn",
       {
         "ignoreDestructuring": false,
         "ignoreImport": false,
         "ignoreExport": false
       }
     ],
-    "eslint/no-with": "error",
-    "eslint/no-regex-spaces": "error",
+    "eslint/no-with": "warn",
+    "eslint/no-regex-spaces": "warn",
     "eslint/no-restricted-globals": [
-      "error",
+      "warn",
 
       // https://github.com/facebook/create-react-app/tree/main/packages/confusing-browser-globals
       "addEventListener",
@@ -307,7 +295,7 @@
       "top"
     ],
     "eslint/no-restricted-imports": [
-      "error",
+      "warn",
       {
         "paths": [
           {
@@ -333,9 +321,14 @@
         ],
         "patterns": [
           {
-            "group": ["**/*.api", "**/*.electron"],
+            "group": ["**/*.api", "**/*.web", "**/*.electron"],
             "message": "Don't directly reference imports from other platforms"
           },
+          {
+            "group": ["uuid"],
+            "importNames": ["*"],
+            "message": "Use `import { v4 as uuidv4 } from 'uuid'` instead"
+          },
           {
             "group": ["**/style", "**/colors"],
             "importNames": ["colors"],
@@ -352,11 +345,9 @@
         ]
       }
     ],
-    "eslint/no-useless-constructor": "error",
-    "eslint/no-undef": "error",
-    "eslint/no-unused-expressions": "error",
-    "eslint/no-return-assign": "error",
-    "eslint/no-unused-vars": "error"
+    "eslint/no-useless-constructor": "warn",
+    "eslint/no-undef": "warn",
+    "eslint/no-unused-expressions": "warn"
   },
   "overrides": [
     {
@@ -416,16 +407,6 @@
       "rules": {
         "eslint/no-empty-function": "off"
       }
-    },
-    // crdt enforces the repo's "TODO: enable this" typescript rules as errors
-    {
-      "files": ["packages/crdt/**/*"],
-      "rules": {
-        "typescript/no-misused-spread": "error",
-        "typescript/no-base-to-string": "error",
-        "typescript/no-unsafe-unary-minus": "error",
-        "typescript/no-unsafe-type-assertion": "error"
-      }
     }
   ]
 }

.yarnrc.yml

@@ -6,4 +6,4 @@ enableTransparentWorkspaces: false
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.13.0.cjs
+yarnPath: .yarn/releases/yarn-4.10.3.cjs

AGENTS.md

@@ -42,12 +42,6 @@ yarn start:desktop
 - Use `yarn workspace <workspace-name> run <command>` for workspace-specific tasks
 - Tests run once and exit by default (using `vitest --run`)
 
-### ⚠️ CRITICAL REQUIREMENT: AI-Generated Commit Messages and PR Titles
-
-**ALL commit messages and PR titles MUST be prefixed with `[AI]`.** No exceptions.
-
-See [PR and Commit Rules](.github/agents/pr-and-commit-rules.md) for the full specification, including git safety rules, pre-commit checklist, and PR workflow.
-
 ### Task Orchestration with Lage
 
 The project uses **[lage](https://microsoft.github.io/lage/)** (a task runner for JavaScript monorepos) to efficiently run tests and other tasks across multiple workspaces:
@@ -84,7 +78,7 @@ The core application logic that runs on any platform.
 
   ```bash
   # Run all loot-core tests
-  yarn workspace @actual-app/core run test
+  yarn workspace loot-core run test
 
   # Or run tests across all packages using lage
   yarn test
@@ -219,7 +213,7 @@ yarn test
 yarn test:debug
 
 # Run tests for a specific package
-yarn workspace @actual-app/core run test
+yarn workspace loot-core run test
 ```
 
 **E2E Tests (Playwright)**
@@ -298,7 +292,6 @@ Always run `yarn typecheck` before committing.
 
 **React Patterns:**
 
-- The project uses **React Compiler** (`babel-plugin-react-compiler`) in the desktop-client. The compiler auto-memoizes component bodies, so you can omit manual `useCallback`, `useMemo`, and `React.memo` when adding or refactoring code; prefer inline callbacks and values unless a stable identity is required by a non-compiled dependency.
 - Don't use `React.FunctionComponent` or `React.FC` - type props directly
 - Don't use `React.*` patterns - use named imports instead
 - Use `<Link>` instead of `<a>` tags
@@ -331,7 +324,7 @@ Always maintain newlines between import groups.
 
 ### Platform-Specific Code
 
-- Don't directly reference platform-specific imports (`.api`, `.electron`)
+- Don't directly reference platform-specific imports (`.api`, `.web`, `.electron`)
 - Use conditional exports in `loot-core` for platform-specific code
 - Platform resolution happens at build time via package.json exports
 
@@ -345,7 +338,11 @@ Always maintain newlines between import groups.
 
 **Git Commands:**
 
-See [PR and Commit Rules](.github/agents/pr-and-commit-rules.md) for complete git safety rules, commit message requirements, and PR workflow.
+- Never update git config
+- Never run destructive git operations (force push, hard reset) unless explicitly requested
+- Never skip hooks (--no-verify, --no-gpg-sign)
+- Never force push to main/master
+- Never commit unless explicitly asked
 
 ## File Structure Patterns
 
@@ -501,14 +498,14 @@ Icons in `packages/component-library/src/icons/` are auto-generated. Don't manua
 
 1. Check `tsconfig.json` for path mappings
 2. Check package.json `exports` field (especially for loot-core)
-3. Verify platform-specific imports (`.electron`, `.api`)
+3. Verify platform-specific imports (`.web`, `.electron`, `.api`)
 4. Use absolute imports in `desktop-client` (enforced by ESLint)
 
 ### Build Failures
 
 1. Clean build artifacts: `rm -rf packages/*/dist packages/*/lib-dist packages/*/build`
 2. Reinstall dependencies: `yarn install`
-3. Check Node.js version (requires >=22)
+3. Check Node.js version (requires >=20)
 4. Check Yarn version (requires ^4.9.1)
 
 ## Testing Patterns
@@ -544,7 +541,6 @@ Icons in `packages/component-library/src/icons/` are auto-generated. Don't manua
 
 Before committing changes, ensure:
 
-- [ ] Commit and PR rules followed (see [PR and Commit Rules](.github/agents/pr-and-commit-rules.md))
 - [ ] `yarn typecheck` passes
 - [ ] `yarn lint:fix` has been run
 - [ ] Relevant tests pass
@@ -557,7 +553,9 @@ Before committing changes, ensure:
 
 ## Pull Request Guidelines
 
-See [PR and Commit Rules](.github/agents/pr-and-commit-rules.md) for complete PR creation rules, including title prefix requirements, labeling, and PR template handling.
+When creating pull requests:
+
+- **AI-Generated PRs**: If you create a PR using AI assistance, add the **"AI generated"** label to the pull request. This helps maintainers understand the nature of the contribution.
 
 ## Code Review Guidelines
 
@@ -588,7 +586,7 @@ yarn install:server
 
 ## Environment Requirements
 
-- **Node.js**: >=22
+- **Node.js**: >=20
 - **Yarn**: ^4.9.1 (managed by packageManager field)
 - **Browser Targets**: Electron >= 35.0, modern browsers (see browserslist)
 
@@ -601,40 +599,3 @@ The codebase is actively being migrated:
 - **React.\* → Named Imports**: Legacy React.\* patterns being removed
 
 When working with older code, follow the newer patterns described in this guide.
-
-## Cursor Cloud specific instructions
-
-### Services overview
-
-| Service             | Command                 | Port | Required                      |
-| ------------------- | ----------------------- | ---- | ----------------------------- |
-| Web Frontend (Vite) | `yarn start`            | 3001 | Yes                           |
-| Sync Server         | `yarn start:server-dev` | 5006 | Optional (sync features only) |
-
-All storage is **SQLite** (file-based via `better-sqlite3`). No external databases or services are needed.
-
-### Running the app
-
-- `yarn start` builds the plugins-service worker, loot-core browser backend, and starts the Vite dev server on port **3001**.
-- `yarn start:server-dev` starts both the sync server (port 5006) and the web frontend together.
-- The Vite HMR dev server serves many unbundled modules. In constrained environments, the browser may hit `ERR_INSUFFICIENT_RESOURCES`. If that happens, use `yarn build:browser` followed by serving the built output from `packages/desktop-client/build/` with proper COOP/COEP headers (`Cross-Origin-Opener-Policy: same-origin`, `Cross-Origin-Embedder-Policy: require-corp`).
-
-### Lint, test, typecheck
-
-Standard commands documented in `package.json` scripts and the Quick Start section above:
-
-- `yarn lint` / `yarn lint:fix` (uses oxlint + oxfmt)
-- `yarn test` (lage across all workspaces)
-- `yarn typecheck` (tsgo + lage typecheck)
-
-### Testing and previewing the app
-
-When running the app for manual testing or demos, use **"View demo"** on the initial setup screen (after selecting "Don't use a server"). This creates a test budget pre-populated with realistic sample data (accounts, transactions, categories, and budgeted amounts), which is far more useful than starting with an empty budget.
-
-### Gotchas
-
-- The `engines` field requires **Node.js >=22** and **Yarn ^4.9.1**. The `.nvmrc` specifies `v22/*`.
-- Pre-commit hook runs `lint-staged` (oxfmt + oxlint) via Husky. Run `yarn prepare` once after install to set up hooks.
-- Lage caches test results in `.lage/`. If tests behave unexpectedly, clear with `rm -rf .lage`.
-- Native modules (`better-sqlite3`, `bcrypt`) require build tools (`gcc`, `make`, `python3`). These are pre-installed in the Cloud VM.
-- All yarn commands must be run from the repository root, never from child workspaces.

CLAUDE.md

@@ -1,2 +0,0 @@
-@AGENTS.md
-@.github/agents/pr-and-commit-rules.md

bin/__tests__/validate-publish-imports.test.ts

@@ -1,218 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import {
-  derivePublishImports,
-  validatePackage,
-} from '../validate-publish-imports.js';
-
-describe('derivePublishImports', () => {
-  it('prepends ./build/ to .js paths', () => {
-    const imports = {
-      '#account-db': './src/account-db.js',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#account-db': './build/src/account-db.js',
-    });
-  });
-
-  it('converts .ts extension to .js and prepends ./build/', () => {
-    const imports = {
-      '#migrations': './src/migrations.ts',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#migrations': './build/src/migrations.js',
-    });
-  });
-
-  it('converts .tsx extension to .js and prepends ./build/', () => {
-    const imports = {
-      '#component': './src/component.tsx',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#component': './build/src/component.js',
-    });
-  });
-
-  it('preserves wildcard patterns', () => {
-    const imports = {
-      '#accounts/*': './src/accounts/*.js',
-      '#services/*': './src/app-gocardless/services/*.ts',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#accounts/*': './build/src/accounts/*.js',
-      '#services/*': './build/src/app-gocardless/services/*.js',
-    });
-  });
-
-  it('handles multiple entries with mixed extensions', () => {
-    const imports = {
-      '#account-db': './src/account-db.js',
-      '#migrations': './src/migrations.ts',
-      '#app-gocardless/errors': './src/app-gocardless/errors.ts',
-      '#util/*': './src/util/*.ts',
-      '#scripts/*': './src/scripts/*.js',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#account-db': './build/src/account-db.js',
-      '#migrations': './build/src/migrations.js',
-      '#app-gocardless/errors': './build/src/app-gocardless/errors.js',
-      '#util/*': './build/src/util/*.js',
-      '#scripts/*': './build/src/scripts/*.js',
-    });
-  });
-
-  it('returns empty object for empty imports', () => {
-    expect(derivePublishImports({})).toEqual({});
-  });
-
-  it('throws error for non-string imports values', () => {
-    const imports = {
-      '#foo': './src/foo.js',
-      '#conditional': {
-        browser: './src/browser.js',
-        node: './src/node.js',
-      },
-    };
-    expect(() => derivePublishImports(imports)).toThrow(
-      'Unsupported imports target for "#conditional". Expected a string path.',
-    );
-  });
-
-  it('handles paths with /index.js suffix', () => {
-    const imports = {
-      '#util/title': './src/util/title/index.js',
-    };
-    expect(derivePublishImports(imports)).toEqual({
-      '#util/title': './build/src/util/title/index.js',
-    });
-  });
-});
-
-describe('validatePackage', () => {
-  let tmpDir: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'validate-imports-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  function writePackageJson(content: Record<string, unknown>) {
-    const filePath = path.join(tmpDir, 'package.json');
-    fs.writeFileSync(filePath, JSON.stringify(content, null, 2) + '\n');
-    return filePath;
-  }
-
-  it('skips packages with no publishConfig', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: { '#foo': './src/foo.js' },
-    });
-    const { result, warnings } = validatePackage(filePath);
-    expect(result).toBeNull();
-    expect(warnings).toEqual([]);
-  });
-
-  it('skips packages with publishConfig but no publishConfig.imports', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: { '#foo': './src/foo.js' },
-      publishConfig: { access: 'public' },
-    });
-    const { result, warnings } = validatePackage(filePath);
-    expect(result).toBeNull();
-    expect(warnings).toEqual([]);
-  });
-
-  it('warns when publishConfig.imports exists but imports does not', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      publishConfig: {
-        imports: { '#foo': './build/src/foo.js' },
-      },
-    });
-    const { result, warnings } = validatePackage(filePath);
-    expect(result).toBeNull();
-    expect(warnings).toHaveLength(1);
-    expect(warnings[0]).toContain('orphaned');
-  });
-
-  it('returns no errors when publishConfig.imports matches', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: {
-        '#foo': './src/foo.js',
-        '#bar': './src/bar.ts',
-      },
-      publishConfig: {
-        imports: {
-          '#foo': './build/src/foo.js',
-          '#bar': './build/src/bar.js',
-        },
-      },
-    });
-    const { result } = validatePackage(filePath);
-    expect(result).not.toBeNull();
-    expect(result!.missingKeys).toEqual([]);
-    expect(result!.extraKeys).toEqual([]);
-    expect(result!.wrongValues).toEqual([]);
-  });
-
-  it('detects missing keys in publishConfig.imports', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: {
-        '#foo': './src/foo.js',
-        '#bar': './src/bar.ts',
-      },
-      publishConfig: {
-        imports: {
-          '#foo': './build/src/foo.js',
-        },
-      },
-    });
-    const { result } = validatePackage(filePath);
-    expect(result!.missingKeys).toEqual(['#bar']);
-  });
-
-  it('detects extra keys in publishConfig.imports', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: {
-        '#foo': './src/foo.js',
-      },
-      publishConfig: {
-        imports: {
-          '#foo': './build/src/foo.js',
-          '#orphan': './build/src/orphan.js',
-        },
-      },
-    });
-    const { result } = validatePackage(filePath);
-    expect(result!.extraKeys).toEqual(['#orphan']);
-  });
-
-  it('detects wrong values in publishConfig.imports', () => {
-    const filePath = writePackageJson({
-      name: 'test-pkg',
-      imports: {
-        '#foo': './src/foo.ts',
-      },
-      publishConfig: {
-        imports: {
-          '#foo': './src/foo.ts',
-        },
-      },
-    });
-    const { result } = validatePackage(filePath);
-    expect(result!.wrongValues).toEqual([
-      { key: '#foo', expected: './build/src/foo.js', actual: './src/foo.ts' },
-    ]);
-  });
-});

bin/package-browser

@@ -16,9 +16,8 @@ packages/desktop-client/bin/remove-untranslated-languages
 
 export NODE_OPTIONS="--max-old-space-size=4096"
 
-yarn workspace @actual-app/crdt build
 yarn workspace plugins-service build
-yarn workspace @actual-app/core build:browser
+yarn workspace loot-core build:browser
 yarn workspace @actual-app/web build:browser
 
 echo "packages/desktop-client/build"

bin/package-electron

@@ -43,7 +43,6 @@ if [ $SKIP_TRANSLATIONS == false ]; then
 
   pushd packages/desktop-client/locale > /dev/null
 
-  git checkout .
   git pull
   popd > /dev/null
   packages/desktop-client/bin/remove-untranslated-languages
@@ -51,19 +50,15 @@ fi
 
 export NODE_OPTIONS="--max-old-space-size=4096"
 
-yarn workspace @actual-app/crdt build
 yarn workspace plugins-service build
-yarn workspace @actual-app/core build:node
+yarn workspace loot-core build:node
 yarn workspace @actual-app/web build --mode=desktop # electron specific build
 
 # required for running the sync-server server
-yarn workspace @actual-app/core build:browser
+yarn workspace loot-core build:browser
 yarn workspace @actual-app/web build:browser
 yarn workspace @actual-app/sync-server build
 
-# Emit @actual-app/core declarations so desktop-electron (which includes typings/window.ts) can build
-yarn workspace @actual-app/core exec tsgo -p tsconfig.json
-
 yarn workspace desktop-electron update-client
 
 (

bin/release-note-generator.ts

@@ -178,4 +178,4 @@ async function execAsync(cmd: string, errorLog?: string): Promise<string> {
   });
 }
 
-void run();
+run();

bin/run-vrt

@@ -28,5 +28,5 @@ echo "Running VRT tests with the following parameters:"
 echo "E2E_START_URL: $E2E_START_URL"
 echo "VRT_ARGS: $VRT_ARGS"
 
-MSYS_NO_PATHCONV=1 docker run --rm --network host -v "$(pwd)":/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.59.1-jammy /bin/bash \
+MSYS_NO_PATHCONV=1 docker run --rm --network host -v "$(pwd)":/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.57.0-jammy /bin/bash \
   -c "E2E_START_URL=$E2E_START_URL yarn vrt $VRT_ARGS"

bin/validate-publish-imports.ts

@@ -1,216 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-/**
- * Derives publishConfig.imports from imports by:
- * 1. Prepending ./build/ to each value path
- * 2. Replacing .ts/.tsx extensions with .js
- */
-export function derivePublishImports(
-  imports: Record<string, string | object>,
-): Record<string, string> {
-  const result: Record<string, string> = {};
-  for (const [key, value] of Object.entries(imports)) {
-    if (typeof value !== 'string') {
-      throw new Error(
-        `Unsupported imports target for "${key}". Expected a string path.`,
-      );
-    }
-    const withBuildPrefix = value.replace(/^\.\//, './build/');
-    const withJsExtension = withBuildPrefix.replace(/\.tsx?$/, '.js');
-    result[key] = withJsExtension;
-  }
-  return result;
-}
-
-export type ValidationResult = {
-  packagePath: string;
-  packageName: string;
-  missingKeys: string[];
-  extraKeys: string[];
-  wrongValues: Array<{ key: string; expected: string; actual: string }>;
-};
-
-/**
- * Validates publishConfig.imports against imports for a single package.json.
- * Returns null if the package should be skipped (no publishConfig.imports).
- * Returns a ValidationResult if the package has both fields.
- */
-export function validatePackage(packageJsonPath: string): {
-  result: ValidationResult | null;
-  warnings: string[];
-} {
-  const warnings: string[] = [];
-  const content = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-  const packageName: string = content.name ?? packageJsonPath;
-
-  const imports: Record<string, string | object> | undefined = content.imports;
-  const publishImports: Record<string, string> | undefined =
-    content.publishConfig?.imports;
-
-  // No publishConfig.imports → skip
-  if (!publishImports) {
-    return { result: null, warnings };
-  }
-
-  // Has publishConfig.imports but no imports → warn
-  if (!imports) {
-    warnings.push(
-      `${packageName}: orphaned publishConfig.imports (no imports field)`,
-    );
-    return { result: null, warnings };
-  }
-
-  const expected = derivePublishImports(imports);
-  const expectedKeys = new Set(Object.keys(expected));
-  const actualKeys = new Set(Object.keys(publishImports));
-
-  const missingKeys = [...expectedKeys].filter(k => !actualKeys.has(k));
-  const extraKeys = [...actualKeys].filter(k => !expectedKeys.has(k));
-  const wrongValues: ValidationResult['wrongValues'] = [];
-
-  for (const key of expectedKeys) {
-    if (actualKeys.has(key) && publishImports[key] !== expected[key]) {
-      wrongValues.push({
-        key,
-        expected: expected[key],
-        actual: publishImports[key],
-      });
-    }
-  }
-
-  return {
-    result: {
-      packagePath: packageJsonPath,
-      packageName,
-      missingKeys,
-      extraKeys,
-      wrongValues,
-    },
-    warnings,
-  };
-}
-
-export function fixPackage(packageJsonPath: string): boolean {
-  const raw = fs.readFileSync(packageJsonPath, 'utf-8');
-  const content = JSON.parse(raw);
-
-  if (!content.imports || !content.publishConfig?.imports) {
-    return false;
-  }
-
-  const expected = derivePublishImports(content.imports);
-
-  // Check if already correct
-  if (
-    JSON.stringify(content.publishConfig.imports) === JSON.stringify(expected)
-  ) {
-    return false;
-  }
-
-  content.publishConfig.imports = expected;
-  fs.writeFileSync(packageJsonPath, JSON.stringify(content, null, 2) + '\n');
-  return true;
-}
-
-function findPackageJsonFiles(): string[] {
-  const packagesDir = path.resolve(__dirname, '..', 'packages');
-  const entries = fs.readdirSync(packagesDir, { withFileTypes: true });
-  const results: string[] = [];
-  for (const entry of entries) {
-    if (entry.isDirectory()) {
-      const pkgPath = path.join(packagesDir, entry.name, 'package.json');
-      if (fs.existsSync(pkgPath)) {
-        results.push(pkgPath);
-      }
-    }
-  }
-  return results;
-}
-
-function resolvePackageJsonPaths(filePaths: string[]): string[] {
-  const packagesRoot = path.resolve(__dirname, '..', 'packages');
-  const seen = new Set<string>();
-  for (const filePath of filePaths) {
-    const resolvedPath = path.resolve(filePath);
-    let dir = path.dirname(resolvedPath);
-    while (dir.startsWith(packagesRoot + path.sep)) {
-      const candidate = path.join(dir, 'package.json');
-      if (
-        fs.existsSync(candidate) &&
-        candidate.startsWith(packagesRoot + path.sep)
-      ) {
-        seen.add(candidate);
-        break;
-      }
-      dir = path.dirname(dir);
-    }
-  }
-  return [...seen];
-}
-
-function main() {
-  const args = process.argv.slice(2);
-  const fixMode = args.includes('--fix');
-  const filePaths = args.filter(arg => !arg.startsWith('--'));
-
-  const packageJsonFiles =
-    filePaths.length > 0
-      ? resolvePackageJsonPaths(filePaths)
-      : findPackageJsonFiles();
-
-  let hasErrors = false;
-  const allWarnings: string[] = [];
-
-  for (const pkgPath of packageJsonFiles) {
-    if (fixMode) {
-      const fixed = fixPackage(pkgPath);
-      if (fixed) {
-        const name = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')).name;
-        console.log(`Fixed publishConfig.imports in ${name}`);
-      }
-    } else {
-      const { result, warnings } = validatePackage(pkgPath);
-      allWarnings.push(...warnings);
-
-      if (result) {
-        const hasIssues =
-          result.missingKeys.length > 0 ||
-          result.extraKeys.length > 0 ||
-          result.wrongValues.length > 0;
-
-        if (hasIssues) {
-          hasErrors = true;
-          console.error(`\n${result.packageName}:`);
-
-          for (const key of result.missingKeys) {
-            console.error(`  Missing key: ${key}`);
-          }
-          for (const key of result.extraKeys) {
-            console.error(`  Extra key: ${key}`);
-          }
-          for (const { key, expected, actual } of result.wrongValues) {
-            console.error(`  Wrong value for ${key}:`);
-            console.error(`    expected: ${expected}`);
-            console.error(`    actual:   ${actual}`);
-          }
-        }
-      }
-    }
-  }
-
-  for (const warning of allWarnings) {
-    console.warn(`Warning: ${warning}`);
-  }
-
-  if (hasErrors) {
-    console.error(
-      '\npublishConfig.imports is out of sync. Run with --fix to auto-fix.',
-    );
-    process.exit(1);
-  }
-}
-
-if (require.main === module) {
-  main();
-}

bin/vitest.config.mts

@@ -1,9 +0,0 @@
-import { defineConfig } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    globals: true,
-    include: ['__tests__/**/*.test.ts'],
-    environment: 'node',
-  },
-});

lage.config.js

@@ -1,12 +1,6 @@
-const BUILD_OUTPUT_GLOBS = ['lib-dist/**', 'dist/**', 'build/**', '@types/**'];
-
 /** @type {import('lage').ConfigOptions} */
 module.exports = {
   pipeline: {
-    typecheck: {
-      type: 'npmScript',
-      dependsOn: ['^typecheck'],
-    },
     test: {
       type: 'npmScript',
       options: {
@@ -19,17 +13,16 @@ module.exports = {
     },
     build: {
       type: 'npmScript',
-      dependsOn: ['^build'],
       cache: true,
       options: {
-        outputGlob: BUILD_OUTPUT_GLOBS,
+        outputGlob: ['lib-dist/**', 'dist/**', 'build/**'],
       },
     },
   },
   cacheOptions: {
     cacheStorageConfig: {
       provider: 'local',
-      outputGlob: BUILD_OUTPUT_GLOBS,
+      outputGlob: ['lib-dist/**', 'dist/**', 'build/**'],
     },
   },
   npmClient: 'yarn',

package.json

@@ -25,23 +25,21 @@
     "start:desktop": "yarn desktop-dependencies && npm-run-all --parallel 'start:desktop-*'",
     "start:docs": "yarn workspace docs start",
     "desktop-dependencies": "npm-run-all --parallel rebuild-electron build:browser-backend build:plugins-service",
-    "start:desktop-node": "yarn workspace @actual-app/core watch:node",
+    "start:desktop-node": "yarn workspace loot-core watch:node",
     "start:desktop-client": "yarn workspace @actual-app/web watch",
     "start:desktop-server-client": "yarn workspace @actual-app/web build:browser",
     "start:desktop-electron": "yarn workspace desktop-electron watch",
     "start:browser": "yarn workspace plugins-service build-dev && npm-run-all --parallel 'start:browser-*'",
     "start:service-plugins": "yarn workspace plugins-service watch",
-    "start:browser-backend": "yarn workspace @actual-app/core watch:browser",
+    "start:browser-backend": "yarn workspace loot-core watch:browser",
     "start:browser-frontend": "yarn workspace @actual-app/web start:browser",
     "start:storybook": "yarn workspace @actual-app/components start:storybook",
-    "build": "lage build",
-    "build:browser-backend": "yarn workspace @actual-app/core build:browser",
+    "build:browser-backend": "yarn workspace loot-core build:browser",
     "build:server": "yarn build:browser && yarn workspace @actual-app/sync-server build",
     "build:browser": "./bin/package-browser",
     "build:desktop": "./bin/package-electron",
     "build:plugins-service": "yarn workspace plugins-service build",
-    "build:api": "yarn build --scope=@actual-app/api",
-    "build:cli": "yarn build --scope=@actual-app/cli",
+    "build:api": "yarn workspace @actual-app/api build",
     "build:docs": "yarn workspace docs build",
     "build:storybook": "yarn workspace @actual-app/components build:storybook",
     "deploy:docs": "yarn workspace docs deploy",
@@ -54,58 +52,50 @@
     "playwright": "yarn workspace @actual-app/web run playwright",
     "vrt": "yarn workspace @actual-app/web run vrt",
     "vrt:docker": "./bin/run-vrt",
-    "rebuild-electron": "./node_modules/.bin/electron-rebuild -m ./packages/loot-core && ./node_modules/.bin/electron-rebuild  -m ./packages/desktop-electron -o better-sqlite3,bcrypt",
-    "rebuild-node": "yarn workspace @actual-app/core rebuild",
-    "lint": "oxfmt --check . && oxlint --type-aware --quiet",
-    "lint:fix": "oxfmt . && oxlint --fix --type-aware --quiet",
+    "rebuild-electron": "./node_modules/.bin/electron-rebuild -m ./packages/loot-core",
+    "rebuild-node": "yarn workspace loot-core rebuild",
+    "lint": "oxfmt --check . && oxlint --deny-warnings",
+    "lint:fix": "oxfmt . && oxlint --deny-warnings --fix",
     "install:server": "yarn workspaces focus @actual-app/sync-server --production",
-    "constraints": "yarn constraints",
-    "typecheck": "tsgo -p tsconfig.root.json --noEmit && lage typecheck",
+    "typecheck": "yarn tsc --incremental && tsc-strict",
+    "jq": "./node_modules/node-jq/bin/jq",
     "prepare": "husky"
   },
   "devDependencies": {
     "@octokit/rest": "^22.0.1",
-    "@types/node": "^22.19.17",
+    "@types/node": "^22.19.3",
     "@types/prompts": "^2.4.9",
-    "@typescript/native-preview": "^7.0.0-dev.20260404.1",
-    "@yarnpkg/types": "^4.0.1",
-    "eslint": "^10.2.0",
-    "eslint-plugin-perfectionist": "^5.8.0",
+    "baseline-browser-mapping": "^2.9.14",
+    "cross-env": "^10.1.0",
+    "eslint": "^9.39.2",
+    "eslint-plugin-perfectionist": "^4.15.1",
     "eslint-plugin-typescript-paths": "^0.0.33",
+    "html-to-image": "^1.11.13",
     "husky": "^9.1.7",
-    "lage": "^2.15.5",
-    "lint-staged": "^16.4.0",
-    "minimatch": "^10.2.5",
+    "lage": "^2.14.15",
+    "lint-staged": "^16.2.7",
+    "minimatch": "^10.1.1",
+    "node-jq": "^6.3.1",
     "npm-run-all": "^4.1.5",
-    "oxfmt": "^0.44.0",
-    "oxlint": "^1.59.0",
-    "oxlint-tsgolint": "^0.20.0",
-    "p-limit": "^7.3.0",
+    "oxfmt": "^0.26.0",
+    "oxlint": "^1.41.0",
+    "p-limit": "^7.2.0",
     "prompts": "^2.4.2",
+    "source-map-support": "^0.5.21",
     "ts-node": "^10.9.2",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
+    "typescript": "^5.9.3",
+    "typescript-strict-plugin": "^2.4.4"
   },
   "resolutions": {
-    "adm-zip": "patch:adm-zip@npm%3A0.5.16#~/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch",
-    "minimatch@10.2.1": "10.2.5",
-    "minimatch@3.1.2": "3.1.5",
-    "minimatch@>=10.0.0 <11.0.0": "10.2.5",
-    "minimatch@>=3.0.0 <4.0.0": "3.1.5",
-    "minimatch@>=5.0.0 <6.0.0": "5.1.9",
-    "minimatch@>=9.0.0 <10.0.0": "9.0.9",
     "rollup": "4.40.1",
     "socks": ">=2.8.3"
   },
   "lint-staged": {
-    "packages/*/package.json": [
-      "ts-node ./bin/validate-publish-imports.ts --fix"
-    ],
     "*.{js,mjs,jsx,ts,tsx,md,json,yml,yaml}": [
       "oxfmt --no-error-on-unmatched-pattern"
     ],
     "*.{js,mjs,jsx,ts,tsx}": [
-      "oxlint --fix --type-aware --quiet"
+      "oxlint --deny-warnings --fix"
     ]
   },
   "browserslist": [
@@ -116,5 +106,5 @@
     "node": ">=22",
     "yarn": "^4.9.1"
   },
-  "packageManager": "yarn@4.13.0"
+  "packageManager": "yarn@4.10.3"
 }

packages/api/README.md

@@ -3,7 +3,3 @@ npm install @actual-app/api
 ```
 
 View docs here: https://actualbudget.org/docs/api/
-
-## TypeScript
-
-`@actual-app/api` publishes TypeScript declarations. Consumers using TypeScript must set `moduleResolution` to `"bundler"`, `"nodenext"`, or `"node16"` in their `tsconfig.json`. Legacy `"node"` / `"node10"` / `"classic"` resolution is not supported in strict mode — the published declarations rely on package.json `exports` conditions that older resolvers don't honor.

packages/api/app/query.js

@@ -1,7 +1,4 @@
 class Query {
-  /** @type {import('@actual-app/core/shared/query').QueryState} */
-  state;
-
   constructor(state) {
     this.state = {
       filterExpressions: state.filterExpressions || [],

packages/api/browser-worker.ts

@@ -1,102 +0,0 @@
-/// <reference lib="webworker" />
-
-// Worker entry for @actual-app/api's browser build.
-//
-// This owns the real loot-core instance (sql.js + absurd-sql + IndexedDB)
-// and speaks loot-core's existing backend protocol over postMessage:
-//   main → worker: {id, name, args, undoTag?, catchErrors?}
-//   worker → main: {type:'reply', id, result, mutated, undoTag}
-//                  {type:'error', id, error}
-//                  {type:'connect'}            (handshake heartbeat)
-//
-// Bootstrapping:
-//   - We register an `api-browser/init` handler that runs loot-core's public
-//     init(config), so the main-thread facade can kick off the DB + auth via
-//     a normal RPC call. The reply carries no return value (loot-core's
-//     `init(config)` resolves to `lib`, which isn't structured-cloneable).
-//   - connection.init(self, handlers) starts the message loop and the
-//     `{type:'connect'}` handshake loot-core's client connection expects.
-
-import * as connection from '@actual-app/core/platform/server/connection';
-import { handlers, init } from '@actual-app/core/server/main';
-import type { InitConfig } from '@actual-app/core/server/main';
-
-// Dev-server friendliness: consumer bundlers (Vite first, others too) run
-// import-analysis on every `.js` URL they serve. loot-core's JS migrations
-// use `#`-subpath imports that only resolve inside loot-core — analysis
-// fails when those files live under node_modules/@actual-app/api/dist/.
-// Our build writes those files with an extra `.data` suffix, so bundlers
-// leave them alone. Translate the URLs here so loot-core's fetch layer
-// still sees `.js` names both in the manifest and on-disk.
-//
-// The wrap has to install before connection.init() runs, and populateDefault-
-// Filesystem is kicked off lazily from the first `load-budget` / init call.
-{
-  const origFetch = globalThis.fetch;
-  const MIGRATION_JS = /\/data\/migrations\/[^/?]+\.js(\?.*)?$/;
-  globalThis.fetch = (async (
-    input: RequestInfo | URL,
-    initArg?: RequestInit,
-  ): Promise<Response> => {
-    const url =
-      typeof input === 'string' ? input : (input as URL | Request).toString();
-    if (MIGRATION_JS.test(url)) {
-      // Re-target .js → .js.data before hitting the network.
-      const patched = url.replace(/(\.js)(\?|$)/, '.js.data$2');
-      return origFetch(patched, initArg);
-    }
-    if (
-      url.endsWith('/data-file-index.txt') ||
-      url.endsWith('data-file-index.txt')
-    ) {
-      const res = await origFetch(input as RequestInfo | URL, initArg);
-      if (!res.ok) return res;
-      const text = await res.text();
-      const rewritten = text.replace(/\.js\.data(\r?\n|$)/g, '.js$1');
-      return new Response(rewritten, {
-        status: res.status,
-        statusText: res.statusText,
-        headers: res.headers,
-      });
-    }
-    return origFetch(input as RequestInfo | URL, initArg);
-  }) as typeof fetch;
-}
-
-// `api-browser/init` is a worker-local handler; it isn't part of the shared
-// Handlers type. Assign via the index-signature cast rather than extending
-// the type globally.
-(handlers as Record<string, (args?: unknown) => Promise<unknown>>)[
-  'api-browser/init'
-] = async function (args?: unknown) {
-  const payload = (args ?? {}) as InitConfig & { __assetsBaseUrl?: string };
-  // Main thread hands us a URL pointing at the api's own dist/ dir. Setting
-  // PUBLIC_URL here is what makes loot-core's populateDefaultFilesystem
-  // fetch `data-file-index.txt` / `data/<name>` / `sql-wasm.wasm` from our
-  // package instead of the consumer's page origin — no manual copy step.
-  const { __assetsBaseUrl, ...config } = payload;
-  if (__assetsBaseUrl) {
-    process.env.PUBLIC_URL = __assetsBaseUrl;
-  }
-  await init(config);
-  // Nothing to return — the resolved `lib` has functions and isn't
-  // structured-cloneable anyway.
-};
-
-self.addEventListener('error', e => {
-  // eslint-disable-next-line no-console
-  console.error(
-    '[api worker] uncaught',
-    (e as ErrorEvent).error ?? (e as ErrorEvent).message,
-  );
-});
-
-self.addEventListener('unhandledrejection', e => {
-  // eslint-disable-next-line no-console
-  console.error(
-    '[api worker] unhandled rejection',
-    (e as PromiseRejectionEvent).reason,
-  );
-});
-
-connection.init(self as unknown as Window, handlers);

packages/api/browser/lib-stub.ts

@@ -1,39 +0,0 @@
-// Browser main-thread stub for `@actual-app/core/server/main`.
-//
-// The real loot-core runs inside the worker (see browser-worker.ts). The
-// main-thread bundle reuses packages/api/methods.ts verbatim, but that file
-// reads `lib.send(...)` from loot-core. Resolving that import to this stub
-// routes every call over postMessage instead of touching loot-core on the
-// main thread.
-
-export type BrowserSendFn = (name: string, args?: unknown) => Promise<unknown>;
-
-let workerSend: BrowserSendFn = () => {
-  return Promise.reject(
-    new Error('@actual-app/api: call init() before any other method'),
-  );
-};
-
-// Shape-cast rather than `typeof import(...)` so this stub stays
-// module-graph-independent from the real loot-core.
-export const lib = {
-  send(name: string, args?: unknown) {
-    return workerSend(name, args);
-  },
-} as unknown as {
-  send: <T = unknown>(name: string, args?: unknown) => Promise<T>;
-};
-
-export function _setBrowserSend(fn: BrowserSendFn) {
-  workerSend = fn;
-}
-
-// Inline InitConfig (matches loot-core's shape) so this stub does not force
-// TS to pull in the real @actual-app/core/server/main module graph at all.
-export type InitConfig = {
-  dataDir?: string;
-  serverURL?: string;
-  password?: string;
-  sessionToken?: string;
-  verbose?: boolean;
-};

packages/api/browser/rpc.ts

@@ -1,132 +0,0 @@
-// Main-thread RPC bridge to the api worker.
-//
-// Reuses `createBackendWorker` from loot-core so absurd-sql's main-thread
-// plumbing (IDB helper worker, __absurd:* filtering) stays in one place.
-// Speaks loot-core's existing backend protocol:
-//   out: {id, name, args, catchErrors?}
-//   in : {type:'reply', id, result, error?}
-//        {type:'error', id, error}
-//        {type:'connect'}     (handshake heartbeat)
-//        {type:'push', name, args}
-//
-// We handle the handshake by replying {name:'client-connected-to-backend'}
-// on the first 'connect'. Messages sent before handshake completes are
-// queued.
-
-import { createBackendWorker } from '@actual-app/core/platform/client/backend-worker';
-import type { BackendWorker } from '@actual-app/core/platform/client/backend-worker';
-
-type Pending = {
-  resolve: (v: unknown) => void;
-  reject: (e: unknown) => void;
-};
-
-type Reply =
-  | {
-      type: 'reply';
-      id: string;
-      result?: unknown;
-      error?: { type?: string; message?: string; [k: string]: unknown };
-    }
-  | {
-      type: 'error';
-      id: string;
-      error: { type?: string; message?: string; [k: string]: unknown };
-    };
-
-let backend: BackendWorker | null = null;
-let connected = false;
-let queue: Array<{ id: string; name: string; args?: unknown }> = [];
-const pending = new Map<string, Pending>();
-
-function nextId(): string {
-  if (typeof crypto !== 'undefined' && 'randomUUID' in crypto) {
-    return crypto.randomUUID();
-  }
-  return Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);
-}
-
-function toError(info: { type?: string; message?: string } | undefined) {
-  const msg = info?.message || info?.type || 'api worker error';
-  const err = new Error(msg);
-  if (info?.type) err.name = info.type;
-  return err;
-}
-
-export function setWorker(worker: Worker): BackendWorker {
-  if (backend) {
-    backend.terminate();
-  }
-
-  connected = false;
-  queue = [];
-  pending.clear();
-
-  backend = createBackendWorker(worker);
-
-  backend.onMessage((data: unknown) => {
-    if (!data || typeof data !== 'object') return;
-    const msg = data as { type?: string; name?: string };
-
-    if (msg.type === 'connect') {
-      if (!connected) {
-        connected = true;
-        backend!.postMessage({ name: 'client-connected-to-backend' });
-        // Drain anything queued while waiting for the handshake.
-        const drained = queue;
-        queue = [];
-        for (const m of drained) backend!.postMessage(m);
-      }
-      return;
-    }
-
-    if (msg.type === 'reply' || msg.type === 'error') {
-      const reply = msg as Reply;
-      const p = pending.get(reply.id);
-      if (!p) return;
-      pending.delete(reply.id);
-      if (reply.type === 'error') {
-        p.reject(toError(reply.error));
-      } else if ('error' in reply && reply.error) {
-        // api/* handlers funnel errors through the reply envelope.
-        p.reject(toError(reply.error));
-      } else {
-        p.resolve(reply.result);
-      }
-      return;
-    }
-
-    // push/capture-exception/etc. — ignore for now; the api consumer
-    // doesn't subscribe to loot-core's server events.
-  });
-
-  return backend;
-}
-
-export function rpc(name: string, args?: unknown): Promise<unknown> {
-  if (!backend) {
-    return Promise.reject(
-      new Error('@actual-app/api: init() must be called before any api method'),
-    );
-  }
-  return new Promise((resolve, reject) => {
-    const id = nextId();
-    pending.set(id, { resolve, reject });
-    const msg = { id, name, args };
-    if (connected) {
-      backend!.postMessage(msg);
-    } else {
-      queue.push(msg);
-    }
-  });
-}
-
-export function terminate() {
-  if (backend) {
-    backend.terminate();
-    backend = null;
-  }
-  connected = false;
-  queue = [];
-  pending.clear();
-}

packages/api/index.browser.ts

@@ -1,66 +0,0 @@
-// Main-thread browser entry for @actual-app/api.
-//
-// Public surface matches the Node entry. The worker is spawned internally
-// so consumers write:
-//
-//   import * as api from '@actual-app/api';
-//   await api.init({ dataDir: '/documents', serverURL, password });
-//   await api.getAccounts();
-//
-// worker.js must be a sibling of browser.js at runtime. Our build ships
-// them together in dist/; the consumer's bundler resolves the worker URL
-// via `new URL(..., import.meta.url)`.
-
-import { _setBrowserSend } from './browser/lib-stub';
-import type { InitConfig } from './browser/lib-stub';
-import { rpc, setWorker, terminate } from './browser/rpc';
-
-export * from './methods';
-export * as utils from './utils';
-
-// Wire methods.ts's `lib.send` through the worker.
-_setBrowserSend((name, args) => rpc(name, args));
-
-function createWorker(): Worker {
-  // Vite's `vite:worker-import-meta-url` plugin rewrites this pattern at
-  // the CONSUMER's build time (emit worker.js as an asset, substitute the
-  // hashed URL). Feeding it a non-literal first argument keeps the api's
-  // OWN lib build from trying to pre-bundle it, which would fail because
-  // ./worker.js is not a source-tree sibling of this file.
-  const rel = './worker.js';
-  return new Worker(new URL(rel, import.meta.url), { type: 'module' });
-}
-
-export async function init(config: InitConfig = {}) {
-  setWorker(createWorker());
-  // Point loot-core's browser fs at our dist/ directory. We want the
-  // directory portion of this bundle's own URL so loot-core's fetches land
-  // on files we ship (data-file-index.txt, migrations/, default-db.sqlite,
-  // sql-wasm.wasm). Vite's asset plugin tries to pre-bundle
-  // `new URL('.', import.meta.url)` at consumer build time and picks up
-  // the `development` export condition (inlining index.ts as a data URL!).
-  // Derive the base URL via string manipulation instead so static analyzers
-  // leave it alone.
-  const assetsBaseUrl = import.meta.url.replace(/[^/]+$/, '');
-  await rpc('api-browser/init', { ...config, __assetsBaseUrl: assetsBaseUrl });
-  // Return a {send} handle compatible with the Node entry so existing
-  // consumer code that does `const internal = await api.init(...); internal.send(...)`
-  // keeps working on the browser build too.
-  return {
-    send: (name: string, args?: unknown) => rpc(name, args),
-  };
-}
-
-export async function shutdown() {
-  try {
-    await rpc('sync');
-  } catch {
-    // most likely no budget loaded
-  }
-  try {
-    await rpc('close-budget');
-  } catch {
-    // ignore
-  }
-  terminate();
-}

packages/api/index.ts

@@ -1,30 +1,53 @@
-import { init as initLootCore } from '@actual-app/core/server/main';
-import type { InitConfig, lib } from '@actual-app/core/server/main';
+import type {
+  RequestInfo as FetchInfo,
+  RequestInit as FetchInit,
+} from 'node-fetch';
 
+// loot-core types
+import type { InitConfig } from 'loot-core/server/main';
+
+// oxlint-disable-next-line typescript/ban-ts-comment
+// @ts-ignore: bundle not available until we build it
+import * as bundle from './app/bundle.api.js';
+import * as injected from './injected';
 import { validateNodeVersion } from './validateNodeVersion';
 
+let actualApp: null | typeof bundle.lib;
+export const internal = bundle.lib;
+
 export * from './methods';
 export * as utils from './utils';
 
-/** @deprecated Please use return value of `init` instead */
-export let internal: typeof lib | null = null;
-
 export async function init(config: InitConfig = {}) {
+  if (actualApp) {
+    return;
+  }
+
   validateNodeVersion();
 
-  internal = await initLootCore(config);
-  return internal;
+  if (!globalThis.fetch) {
+    globalThis.fetch = (url: URL | RequestInfo, init?: RequestInit) => {
+      return import('node-fetch').then(({ default: fetch }) =>
+        fetch(url as unknown as FetchInfo, init as unknown as FetchInit),
+      ) as unknown as Promise<Response>;
+    };
+  }
+
+  await bundle.init(config);
+  actualApp = bundle.lib;
+
+  injected.override(bundle.lib.send);
+  return bundle.lib;
 }
 
 export async function shutdown() {
-  if (internal) {
+  if (actualApp) {
     try {
-      await internal.send('sync');
+      await actualApp.send('sync');
     } catch {
       // most likely that no budget is loaded, so the sync failed
     }
-
-    await internal.send('close-budget');
-    internal = null;
+    await actualApp.send('close-budget');
+    actualApp = null;
   }
 }

packages/api/injected.js

@@ -0,0 +1,7 @@
+// TODO: comment on why it works this way
+
+export let send;
+
+export function override(sendImplementation) {
+  send = sendImplementation;
+}

packages/api/methods.test.ts

@@ -1,19 +1,21 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 
-import type { RuleEntity } from '@actual-app/core/types/models';
+import type { RuleEntity } from 'loot-core/types/models';
 
-import * as api from '../index';
+import * as api from './index';
 
 const budgetName = 'test-budget';
 
+global.IS_TESTING = true;
+
 beforeEach(async () => {
-  const budgetPath = path.join(__dirname, '/../mocks/budgets/', budgetName);
+  const budgetPath = path.join(__dirname, '/mocks/budgets/', budgetName);
   await fs.rm(budgetPath, { force: true, recursive: true });
 
   await createTestBudget('default-budget-template', budgetName);
   await api.init({
-    dataDir: path.join(__dirname, '/../mocks/budgets/'),
+    dataDir: path.join(__dirname, '/mocks/budgets/'),
   });
 });
 
@@ -25,10 +27,10 @@ afterEach(async () => {
 async function createTestBudget(templateName: string, name: string) {
   const templatePath = path.join(
     __dirname,
-    '/../../loot-core/src/mocks/files',
+    '/../loot-core/src/mocks/files',
     templateName,
   );
-  const budgetPath = path.join(__dirname, '/../mocks/budgets/', name);
+  const budgetPath = path.join(__dirname, '/mocks/budgets/', name);
 
   await fs.mkdir(budgetPath);
   await fs.copyFile(
@@ -875,73 +877,6 @@ describe('API CRUD operations', () => {
     );
     expect(transactions[0].notes).toBeNull();
   });
-
-  test('Transactions: reimportDeleted=false prevents reimporting deleted transactions', async () => {
-    const accountId = await api.createAccount({ name: 'test-account' }, 0);
-
-    // Import a transaction
-    const result1 = await api.importTransactions(accountId, [
-      {
-        date: '2023-11-03',
-        imported_id: 'reimport-test-1',
-        amount: 100,
-        account: accountId,
-      },
-    ]);
-    expect(result1.added).toHaveLength(1);
-
-    // Delete the transaction
-    await api.deleteTransaction(result1.added[0]);
-
-    // Reimport the same transaction with reimportDeleted=false
-    const result2 = await api.importTransactions(
-      accountId,
-      [
-        {
-          date: '2023-11-03',
-          imported_id: 'reimport-test-1',
-          amount: 100,
-          account: accountId,
-        },
-      ],
-      { reimportDeleted: false },
-    );
-
-    // Should match the deleted transaction and not create a new one
-    expect(result2.added).toHaveLength(0);
-    expect(result2.updated).toHaveLength(0);
-  });
-
-  test('Transactions: reimportDeleted=true reimports deleted transactions', async () => {
-    const accountId = await api.createAccount({ name: 'test-account' }, 0);
-
-    // Import a transaction
-    const result1 = await api.importTransactions(accountId, [
-      {
-        date: '2023-11-03',
-        imported_id: 'reimport-test-2',
-        amount: 200,
-        account: accountId,
-      },
-    ]);
-    expect(result1.added).toHaveLength(1);
-
-    // Delete the transaction
-    await api.deleteTransaction(result1.added[0]);
-
-    // Reimport the same transaction relying on reimportDeleted=true default
-    const result2 = await api.importTransactions(accountId, [
-      {
-        date: '2023-11-03',
-        imported_id: 'reimport-test-2',
-        amount: 200,
-        account: accountId,
-      },
-    ]);
-
-    // Should create a new transaction since deleted ones are ignored
-    expect(result2.added).toHaveLength(1);
-  });
 });
 
 //apis: createSchedule, getSchedules, updateSchedule, deleteSchedule

packages/api/methods.ts

@@ -6,16 +6,16 @@ import type {
   APIPayeeEntity,
   APIScheduleEntity,
   APITagEntity,
-} from '@actual-app/core/server/api-models';
-import { lib } from '@actual-app/core/server/main';
-import type { Query } from '@actual-app/core/shared/query';
-import type { ImportTransactionsOpts } from '@actual-app/core/types/api-handlers';
-import type { Handlers } from '@actual-app/core/types/handlers';
+} from 'loot-core/server/api-models';
+import type { Query } from 'loot-core/shared/query';
+import type { Handlers } from 'loot-core/types/handlers';
 import type {
   ImportTransactionEntity,
   RuleEntity,
   TransactionEntity,
-} from '@actual-app/core/types/models';
+} from 'loot-core/types/models';
+
+import * as injected from './injected';
 
 export { q } from './app/query';
 
@@ -23,7 +23,7 @@ function send<K extends keyof Handlers, T extends Handlers[K]>(
   name: K,
   args?: Parameters<T>[0],
 ): Promise<Awaited<ReturnType<T>>> {
-  return lib.send(name, args);
+  return injected.send(name, args);
 }
 
 export async function runImport(
@@ -126,6 +126,11 @@ export function addTransactions(
   });
 }
 
+export type ImportTransactionsOpts = {
+  defaultCleared?: boolean;
+  dryRun?: boolean;
+};
+
 export function importTransactions(
   accountId: APIAccountEntity['id'],
   transactions: ImportTransactionEntity[],

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actual-app/api",
-  "version": "26.4.0",
+  "version": "26.2.0",
   "description": "An API for Actual",
   "license": "MIT",
   "files": [
@@ -9,51 +9,27 @@
   ],
   "main": "dist/index.js",
   "types": "@types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./@types/index.d.ts",
-      "development": "./index.ts",
-      "browser": "./dist/browser.js",
-      "default": "./dist/index.js"
-    }
-  },
-  "publishConfig": {
-    "exports": {
-      ".": {
-        "types": "./@types/index.d.ts",
-        "browser": "./dist/browser.js",
-        "default": "./dist/index.js"
-      }
-    }
-  },
   "scripts": {
-    "build": "npm-run-all -s build:node build:browser-worker build:browser",
-    "build:node": "vite build --config vite.config.mts && tsgo --emitDeclarationOnly",
-    "build:browser": "vite build --config vite.browser.config.mts",
-    "build:browser-worker": "vite build --config vite.browser-worker.config.mts",
-    "test": "npm-run-all -cp 'test:*'",
-    "test:node": "vitest --run --config vite.config.mts",
-    "test:browser": "vitest --run --config vitest.browser.config.mts",
-    "typecheck": "tsgo -b && tsc-strict"
+    "build:app": "yarn workspace loot-core build:api",
+    "build:crdt": "yarn workspace @actual-app/crdt build",
+    "build:node": "tsc --p tsconfig.dist.json && tsc-alias -p tsconfig.dist.json",
+    "build:migrations": "cp migrations/*.sql dist/migrations",
+    "build:default-db": "cp default-db.sqlite dist/",
+    "build": "yarn run clean && yarn run build:app && yarn run build:node && yarn run build:migrations && yarn run build:default-db",
+    "test": "yarn run clean && yarn run build:app && yarn run build:crdt && vitest --run",
+    "clean": "rm -rf dist @types"
   },
   "dependencies": {
-    "@actual-app/core": "workspace:*",
-    "@actual-app/crdt": "workspace:*",
-    "absurd-sql": "0.0.54",
-    "better-sqlite3": "^12.8.0",
-    "compare-versions": "^6.1.1"
+    "@actual-app/crdt": "workspace:^",
+    "better-sqlite3": "^12.5.0",
+    "compare-versions": "^6.1.1",
+    "node-fetch": "^3.3.2",
+    "uuid": "^13.0.0"
   },
   "devDependencies": {
-    "@typescript/native-preview": "^7.0.0-dev.20260404.1",
-    "fake-indexeddb": "^6.2.5",
-    "jsdom": "^27.4.0",
-    "npm-run-all": "^4.1.5",
-    "rollup-plugin-visualizer": "^7.0.1",
-    "typescript-strict-plugin": "^2.4.4",
-    "vite": "^8.0.5",
-    "vite-plugin-node-polyfills": "^0.26.0",
-    "vite-plugin-peggy-loader": "^2.0.1",
-    "vitest": "^4.1.2"
+    "tsc-alias": "^1.8.16",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
   },
   "engines": {
     "node": ">=20"

packages/api/test/browser-facade.test.ts

@@ -1,183 +0,0 @@
-import { afterEach, describe, expect, test, vi } from 'vitest';
-
-import * as api from '../index.browser';
-
-// Swap the real Worker constructor for a mock that the tests control. Vitest
-// picks this up via vite.config resolve.alias; here we just stand in globally
-// because jsdom does not ship Worker at all.
-class MockWorker {
-  public posted: Array<unknown> = [];
-  public responder: (
-    req: { id: string; name: string; args?: unknown },
-    reply: (res: unknown) => void,
-  ) => void = () => undefined;
-
-  private listeners: Array<(e: MessageEvent) => void> = [];
-  onmessage: ((e: MessageEvent) => void) | null = null;
-  onerror: ((e: ErrorEvent) => void) | null = null;
-  private connected = false;
-
-  addEventListener(type: string, handler: (e: MessageEvent) => void) {
-    if (type === 'message') this.listeners.push(handler);
-  }
-
-  removeEventListener() {
-    // no-op for tests
-  }
-
-  postMessage(msg: unknown) {
-    this.posted.push(msg);
-
-    if (
-      msg &&
-      typeof msg === 'object' &&
-      (msg as { name?: string }).name === 'client-connected-to-backend'
-    ) {
-      // Handshake complete; we won't keep sending 'connect' heartbeats.
-      return;
-    }
-
-    const req = msg as { id: string; name: string; args?: unknown };
-    queueMicrotask(() => {
-      this.responder(req, (data: unknown) => {
-        const ev = { data } as MessageEvent;
-        this.onmessage?.(ev);
-        for (const l of this.listeners) l(ev);
-      });
-    });
-  }
-
-  /** Simulate loot-core's connect handshake from the worker side. */
-  fireConnect() {
-    if (this.connected) return;
-    this.connected = true;
-    const ev = { data: { type: 'connect' } } as MessageEvent;
-    this.onmessage?.(ev);
-    for (const l of this.listeners) l(ev);
-  }
-
-  terminate() {
-    this.listeners = [];
-  }
-}
-
-// Every Worker the api spawns inside init() comes through here.
-let lastMockWorker: MockWorker | null = null;
-const mockWorkerResponder = vi.fn<
-  (
-    req: { id: string; name: string; args?: unknown },
-    reply: (res: unknown) => void,
-  ) => void
->(() => undefined);
-
-// Global Worker stub — the api's internal `new Worker(...)` will call this.
-// @ts-expect-error jsdom has no Worker; we override the global for the test.
-globalThis.Worker = class {
-  constructor(_url: URL | string, _opts?: WorkerOptions) {
-    const w = new MockWorker();
-    w.responder = (req, reply) => mockWorkerResponder(req, reply);
-    lastMockWorker = w;
-    // Fire the connect handshake on the next tick so init() resolves.
-    queueMicrotask(() => w.fireConnect());
-    return w as unknown as Worker;
-  }
-};
-
-// absurd-sql's main-thread bridge expects real Worker event semantics. The
-// mock above exposes addEventListener; initSQLBackend just attaches a
-// message listener, so it's safe with jsdom.
-
-afterEach(async () => {
-  // Keep whatever responder the test installed so shutdown's sync/close-budget
-  // calls resolve rather than hang.
-  await api.shutdown().catch(() => undefined);
-  mockWorkerResponder.mockReset();
-  lastMockWorker = null;
-});
-
-describe('@actual-app/api browser facade', () => {
-  test('spawns a worker on init and forwards config via api-browser/init', async () => {
-    mockWorkerResponder.mockImplementation((req, reply) => {
-      reply({ type: 'reply', id: req.id, result: undefined });
-    });
-
-    await api.init({
-      dataDir: '/documents',
-      serverURL: 'https://example.test',
-      password: 'pw',
-    });
-
-    expect(lastMockWorker).toBeTruthy();
-    // First post after the handshake ack is the api-browser/init request.
-    const initCall = lastMockWorker!.posted.find(
-      m =>
-        m &&
-        typeof m === 'object' &&
-        (m as { name?: string }).name === 'api-browser/init',
-    ) as { name: string; args: unknown } | undefined;
-    expect(initCall).toBeTruthy();
-    expect(initCall!.args).toMatchObject({
-      dataDir: '/documents',
-      serverURL: 'https://example.test',
-      password: 'pw',
-    });
-    // The api also hands over its own asset base URL so loot-core's fs
-    // can fetch migrations / default-db / WASM from the api's dist/
-    // instead of the consumer's page origin.
-    expect(
-      (initCall!.args as { __assetsBaseUrl?: string }).__assetsBaseUrl,
-    ).toBeTypeOf('string');
-  });
-
-  test('rpc methods forward as {id, name, args} and read {type:reply, result}', async () => {
-    mockWorkerResponder.mockImplementation((req, reply) => {
-      if (req.name === 'api-browser/init') {
-        reply({ type: 'reply', id: req.id, result: undefined });
-        return;
-      }
-      if (req.name === 'api/accounts-get') {
-        reply({
-          type: 'reply',
-          id: req.id,
-          result: [{ id: 'a1', name: 'Checking' }],
-        });
-        return;
-      }
-      reply({
-        type: 'error',
-        id: req.id,
-        error: { type: 'APIError', message: 'unexpected' },
-      });
-    });
-
-    await api.init({ dataDir: '/documents' });
-    const accounts = await api.getAccounts();
-    expect(accounts).toEqual([{ id: 'a1', name: 'Checking' }]);
-
-    const sendCalls = lastMockWorker!.posted.filter(
-      m =>
-        m &&
-        typeof m === 'object' &&
-        (m as { name?: string }).name === 'api/accounts-get',
-    );
-    expect(sendCalls).toHaveLength(1);
-    expect((sendCalls[0] as { args?: unknown }).args).toBeUndefined();
-  });
-
-  test('worker errors reject at the call site', async () => {
-    mockWorkerResponder.mockImplementation((req, reply) => {
-      if (req.name === 'api-browser/init') {
-        reply({ type: 'reply', id: req.id, result: undefined });
-        return;
-      }
-      reply({
-        type: 'reply',
-        id: req.id,
-        error: { type: 'APIError', message: 'budget not loaded' },
-      });
-    });
-
-    await api.init({ dataDir: '/documents' });
-    await expect(api.getAccounts()).rejects.toThrow(/budget not loaded/);
-  });
-});

packages/api/test/integration.test.ts

@@ -1,43 +0,0 @@
-import { afterEach, describe, expect, test } from 'vitest';
-
-import * as api from '../index';
-
-declare const __API_DATA_DIR__: string;
-
-afterEach(async () => {
-  await api.shutdown();
-});
-
-describe('api CRUD roundtrip (Node)', () => {
-  test('creates a budget, writes, reads it back', async () => {
-    const internal = await api.init({ dataDir: __API_DATA_DIR__ });
-
-    await internal.send('create-budget', {
-      budgetName: 'Integration Test',
-      testMode: true,
-      testBudgetId: 'integration-test',
-    });
-    await api.loadBudget('integration-test');
-
-    const accountId = await api.createAccount(
-      { name: 'Checking', offbudget: false },
-      0,
-    );
-
-    await api.addTransactions(accountId, [
-      { date: '2026-04-01', amount: 1000, payee_name: 'Coffee' },
-      { date: '2026-04-02', amount: -500, payee_name: 'Book' },
-    ]);
-
-    const accounts = await api.getAccounts();
-    expect(accounts.map(a => a.name)).toContain('Checking');
-
-    const txns = await api.getTransactions(
-      accountId,
-      '2026-04-01',
-      '2026-04-30',
-    );
-    expect(txns).toHaveLength(2);
-    expect(txns.map(t => t.amount).sort((a, b) => a - b)).toEqual([-500, 1000]);
-  });
-});

packages/api/test/setup.node.ts

@@ -1,31 +0,0 @@
-import * as fsPromises from 'fs/promises';
-import * as os from 'os';
-import * as path from 'path';
-
-import { vi } from 'vitest';
-
-// In tests we run from source; loot-core's API fs uses __dirname (for the built dist/).
-// Mock the fs so path constants point at loot-core package root where migrations live.
-vi.mock(
-  '../../loot-core/src/platform/server/fs/index.api',
-  async importOriginal => {
-    const actual = (await importOriginal()) as Record<string, unknown>;
-    const lootCoreRoot = path.join(__dirname, '..', '..', 'loot-core');
-    return {
-      ...actual,
-      migrationsPath: path.join(lootCoreRoot, 'migrations'),
-      bundledDatabasePath: path.join(lootCoreRoot, 'default-db.sqlite'),
-      demoBudgetPath: path.join(lootCoreRoot, 'demo-budget'),
-    };
-  },
-);
-
-global.IS_TESTING = true;
-
-// Shared integration test lives in a filesystem-backed tmp dir.
-const dataDir = path.join(
-  os.tmpdir(),
-  `api-it-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-);
-await fsPromises.mkdir(dataDir, { recursive: true });
-globalThis.__API_DATA_DIR__ = dataDir;

packages/api/tsconfig.dist.json

@@ -0,0 +1,19 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    // Using ES2021 because that's the newest version where
+    // the latest Node 16.x release supports all of the features
+    "target": "ES2021",
+    "module": "CommonJS",
+    "moduleResolution": "node10",
+    "noEmit": false,
+    "declaration": true,
+    "outDir": "dist",
+    "declarationDir": "@types",
+    "paths": {
+      "loot-core/*": ["./@types/loot-core/src/*"]
+    }
+  },
+  "include": ["."],
+  "exclude": ["**/node_modules/*", "dist", "@types", "*.test.ts"]
+}

packages/api/tsconfig.json

@@ -1,36 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "composite": true,
-    // Using ES2021 because that's the newest version where
-    // the latest Node 16.x release supports all of the features
-    "target": "ES2021",
-    "module": "es2022",
-    "moduleResolution": "bundler",
-    "customConditions": ["api"],
-    // composite + declaration: true require `noEmit: false`, so use
-    // emitDeclarationOnly to keep typecheck + project refs working without
-    // clobbering the Vite build artifacts in dist/. build:node also passes
-    // --emitDeclarationOnly on the CLI (redundant but explicit).
-    "noEmit": false,
-    "emitDeclarationOnly": true,
-    "declaration": true,
-    "declarationMap": true,
-    "outDir": "dist",
-    "rootDir": ".",
-    "declarationDir": "@types",
-    "tsBuildInfoFile": "dist/.tsbuildinfo",
-    "plugins": [{ "name": "typescript-strict-plugin", "paths": ["."] }]
-  },
-  "references": [{ "path": "../crdt" }, { "path": "../loot-core" }],
-  "include": ["."],
-  "exclude": [
-    "**/node_modules/*",
-    "dist",
-    "@types",
-    "**/*.test.ts",
-    "test/setup.*.ts",
-    "*.config.ts",
-    "*.config.mts"
-  ]
-}

packages/api/typings.ts

@@ -1,2 +0,0 @@
-declare module 'hyperformula/i18n/languages/enUS';
-declare module '*.pegjs';

packages/api/typings/pegjs.d.ts

@@ -1 +0,0 @@
-declare module '*.pegjs';

packages/api/utils.ts

@@ -1,4 +1,6 @@
-import { lib } from '@actual-app/core/server/main';
+// oxlint-disable-next-line typescript/ban-ts-comment
+// @ts-ignore: bundle not available until we build it
+import * as bundle from './app/bundle.api.js';
 
-export const amountToInteger = lib.amountToInteger;
-export const integerToAmount = lib.integerToAmount;
+export const amountToInteger = bundle.lib.amountToInteger;
+export const integerToAmount = bundle.lib.integerToAmount;

packages/api/vite.browser-worker.config.mts

@@ -1,62 +0,0 @@
-import path from 'path';
-
-import { defineConfig } from 'vite';
-import { nodePolyfills } from 'vite-plugin-node-polyfills';
-import peggyLoader from 'vite-plugin-peggy-loader';
-
-const distDir = path.resolve(__dirname, 'dist');
-
-// Worker bundle: contains the full loot-core + sql.js + absurd-sql stack.
-// Runs inside a Web Worker where absurd-sql's Atomics.wait has the right
-// thread context. Consumer spawns the worker with this file as the entry.
-export default defineConfig({
-  define: {
-    // NODE_ENV is read at build time by dead-code elimination paths and
-    // must stay a literal. The others (PUBLIC_URL, DATA_DIR, SERVER_URL,
-    // DOCUMENT_DIR) are set at runtime via the `api-browser/init` handler
-    // which receives them from the main thread — so they stay as
-    // `process.env.<name>` references and the nodePolyfills-provided
-    // process shim serves as the backing store.
-    'process.env.NODE_ENV': JSON.stringify('production'),
-  },
-  build: {
-    target: 'esnext',
-    outDir: distDir,
-    emptyOutDir: false,
-    sourcemap: true,
-    lib: {
-      entry: path.resolve(__dirname, 'browser-worker.ts'),
-      formats: ['es'],
-      fileName: () => 'worker.js',
-    },
-    rollupOptions: {
-      output: {
-        codeSplitting: false,
-      },
-    },
-  },
-  plugins: [
-    peggyLoader(),
-    nodePolyfills({
-      include: [
-        'process',
-        'buffer',
-        'stream',
-        'path',
-        'crypto',
-        'timers',
-        'util',
-        'zlib',
-        'fs',
-        'assert',
-      ],
-      globals: {
-        process: true,
-        Buffer: true,
-        global: true,
-      },
-    }),
-  ],
-  // Intentionally no resolve.conditions: ['api'] — loot-core falls back to
-  // its default (browser) platform files.
-});

packages/api/vite.browser.config.mts

@@ -1,39 +0,0 @@
-import path from 'path';
-
-import { defineConfig } from 'vite';
-
-const distDir = path.resolve(__dirname, 'dist');
-
-// Main-thread facade only. Tiny bundle: no loot-core, no sql.js, no absurd-sql.
-// The worker is built separately by vite.browser-worker.config.mts. The
-// consumer constructs the Worker (handling URL resolution through their own
-// bundler) and hands it to init().
-export default defineConfig({
-  build: {
-    target: 'esnext',
-    outDir: distDir,
-    emptyOutDir: false,
-    sourcemap: true,
-    lib: {
-      entry: path.resolve(__dirname, 'index.browser.ts'),
-      formats: ['es'],
-      fileName: () => 'browser.js',
-    },
-    rollupOptions: {
-      output: {
-        codeSplitting: false,
-      },
-    },
-  },
-  resolve: {
-    alias: {
-      // methods.ts reads `lib.send` from loot-core's server/main. Route it
-      // through the main-thread stub so loot-core is never pulled into
-      // the main bundle.
-      '@actual-app/core/server/main': path.resolve(
-        __dirname,
-        'browser/lib-stub.ts',
-      ),
-    },
-  },
-});

packages/api/vite.config.mts

@@ -1,145 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-import { visualizer } from 'rollup-plugin-visualizer';
-import { defineConfig } from 'vite';
-import peggyLoader from 'vite-plugin-peggy-loader';
-
-const lootCoreRoot = path.resolve(__dirname, '../loot-core');
-const distDir = path.resolve(__dirname, 'dist');
-const typesDir = path.resolve(__dirname, '@types');
-
-function cleanOutputDirs() {
-  return {
-    name: 'clean-output-dirs',
-    buildStart() {
-      if (fs.existsSync(distDir)) fs.rmSync(distDir, { recursive: true });
-      if (fs.existsSync(typesDir)) fs.rmSync(typesDir, { recursive: true });
-    },
-  };
-}
-
-function copyMigrationsAndDefaultDb() {
-  return {
-    name: 'copy-migrations-and-default-db',
-    closeBundle() {
-      const migrationsSrc = path.join(lootCoreRoot, 'migrations');
-      const defaultDbPath = path.join(lootCoreRoot, 'default-db.sqlite');
-
-      if (!fs.existsSync(migrationsSrc)) {
-        throw new Error(`migrations directory not found at ${migrationsSrc}`);
-      }
-      const migrationsStat = fs.statSync(migrationsSrc);
-      if (!migrationsStat.isDirectory()) {
-        throw new Error(`migrations path is not a directory: ${migrationsSrc}`);
-      }
-
-      const migrationsDest = path.join(distDir, 'migrations');
-      fs.mkdirSync(migrationsDest, { recursive: true });
-      for (const name of fs.readdirSync(migrationsSrc)) {
-        if (name.endsWith('.sql') || name.endsWith('.js')) {
-          fs.copyFileSync(
-            path.join(migrationsSrc, name),
-            path.join(migrationsDest, name),
-          );
-        }
-      }
-
-      if (!fs.existsSync(defaultDbPath)) {
-        throw new Error(`default-db.sqlite not found at ${defaultDbPath}`);
-      }
-      fs.copyFileSync(defaultDbPath, path.join(distDir, 'default-db.sqlite'));
-
-      // Browser consumers need sql.js' WASM to be served at the same origin
-      // as the bundle. Ship it alongside dist/ so downstream apps just point
-      // a static handler at dist and don't have to reach into node_modules.
-      const sqlJsWasm = require.resolve('@jlongster/sql.js/dist/sql-wasm.wasm');
-      fs.copyFileSync(sqlJsWasm, path.join(distDir, 'sql-wasm.wasm'));
-
-      // loot-core's browser fs bootstraps by fetching:
-      //   `${PUBLIC_URL}data-file-index.txt`  - flat manifest
-      //   `${PUBLIC_URL}data/<name>`          - each file listed in the manifest
-      // We point PUBLIC_URL at the api's dist dir at runtime (see
-      // index.browser.ts), so these two shapes need to exist here.
-      //
-      // JS migrations get a `.data` suffix on the *wire* path. Consumer
-      // bundlers (Vite's dev server first, others to varying degrees)
-      // auto-transform `.js` URLs through their import-analysis pipelines,
-      // which fails on loot-core's `#`-subpath imports. The api's worker
-      // (browser-worker.ts) wraps `fetch` to translate back to `.js` so
-      // loot-core's migration runner finds the file under its original
-      // name in the virtual FS. `.sql` migrations stay as-is.
-      const dataDir = path.join(distDir, 'data');
-      const dataMigrationsDir = path.join(dataDir, 'migrations');
-      fs.mkdirSync(dataMigrationsDir, { recursive: true });
-
-      linkOrCopy(
-        path.join(distDir, 'default-db.sqlite'),
-        path.join(dataDir, 'default-db.sqlite'),
-      );
-      const wireMigrationNames: string[] = [];
-      for (const name of fs.readdirSync(migrationsDest)) {
-        const wireName = name.endsWith('.js') ? `${name}.data` : name;
-        linkOrCopy(
-          path.join(migrationsDest, name),
-          path.join(dataMigrationsDir, wireName),
-        );
-        wireMigrationNames.push(`migrations/${wireName}`);
-      }
-      wireMigrationNames.sort();
-
-      // data-file-index.txt: one path per line, relative to `data/`.
-      const manifest =
-        ['default-db.sqlite', ...wireMigrationNames].join('\n') + '\n';
-      fs.writeFileSync(path.join(distDir, 'data-file-index.txt'), manifest);
-    },
-  };
-}
-
-function linkOrCopy(src: string, dest: string) {
-  try {
-    fs.linkSync(src, dest);
-  } catch {
-    fs.copyFileSync(src, dest);
-  }
-}
-
-export default defineConfig({
-  ssr: {
-    noExternal: true,
-    external: ['better-sqlite3'],
-    resolve: { conditions: ['api'] },
-  },
-  build: {
-    ssr: true,
-    target: 'node20',
-    outDir: distDir,
-    emptyOutDir: true,
-    sourcemap: true,
-    lib: {
-      entry: path.resolve(__dirname, 'index.ts'),
-      formats: ['cjs'],
-      fileName: () => 'index.js',
-    },
-  },
-  plugins: [
-    cleanOutputDirs(),
-    peggyLoader(),
-    copyMigrationsAndDefaultDb(),
-    visualizer({ template: 'raw-data', filename: 'app/stats.json' }),
-  ],
-  resolve: {
-    conditions: ['api'],
-  },
-  test: {
-    globals: true,
-    environment: 'node',
-    setupFiles: ['./test/setup.node.ts'],
-    exclude: ['**/node_modules/**', '**/browser-facade.test.ts'],
-    onConsoleLog(log: string, type: 'stdout' | 'stderr'): boolean | void {
-      // print only console.error
-      return type === 'stderr';
-    },
-    maxWorkers: 2,
-  },
-});

packages/api/vitest.browser.config.mts

@@ -1,35 +0,0 @@
-import path from 'path';
-
-import { defineConfig } from 'vite';
-import peggyLoader from 'vite-plugin-peggy-loader';
-
-// Deliberately independent from vite.browser.config.mts: the build config
-// applies node polyfills that would swap out Node fs in the test setup
-// file. The test setup uses real Node fs to stream the on-disk fixtures
-// (default-db.sqlite, migrations, sql.js WASM) through a fetch polyfill.
-
-export default defineConfig({
-  plugins: [peggyLoader()],
-  // The facade test imports `../index.browser` directly and uses a mock
-  // Worker. loot-core never loads on the main thread, so no platform
-  // condition juggling is needed here. The sibling vite.browser.config.mts
-  // aliases loot-core to the stub for the bundled facade; for the test we
-  // mirror that so `methods.ts` resolves correctly.
-  resolve: {
-    alias: {
-      '@actual-app/core/server/main': path.resolve(
-        __dirname,
-        'browser/lib-stub.ts',
-      ),
-    },
-  },
-  test: {
-    globals: true,
-    environment: 'jsdom',
-    include: ['test/browser-facade.test.ts'],
-    onConsoleLog(log: string, type: 'stdout' | 'stderr'): boolean | void {
-      return type === 'stderr';
-    },
-    maxWorkers: 2,
-  },
-});

packages/api/vitest.config.ts

@@ -0,0 +1,10 @@
+export default {
+  test: {
+    globals: true,
+    onConsoleLog(log: string, type: 'stdout' | 'stderr'): boolean | void {
+      // print only console.error
+      return type === 'stderr';
+    },
+    maxWorkers: 2,
+  },
+};

packages/ci-actions/.gitignore

@@ -1 +0,0 @@
-dist/*

packages/ci-actions/bin/get-next-package-version.js

@@ -2,13 +2,13 @@
 
 // This script is used in GitHub Actions to get the next version based on the current package.json version.
 // It supports three types of versioning: nightly, hotfix, and monthly.
+
 import fs from 'node:fs';
 import { parseArgs } from 'node:util';
 
-import {
-  getNextVersion,
-  isValidVersionType,
-} from '../src/versions/get-next-package-version';
+import { getNextVersion } from '../src/versions/get-next-package-version.js';
+
+const args = process.argv;
 
 const options = {
   'package-json': {
@@ -28,53 +28,40 @@ const options = {
     short: 'u',
     default: false,
   },
-} as const;
-
-function fail(message: string): never {
-  console.error(message);
-  process.exit(1);
-}
+};
 
 const { values } = parseArgs({
+  args,
   options,
   allowPositionals: true,
 });
 
-const packageJsonPath = values['package-json'];
-if (!packageJsonPath) {
-  fail(
+if (!values['package-json']) {
+  console.error(
     'Please specify the path to package.json using --package-json or -p option.',
   );
+  process.exit(1);
 }
 
 try {
+  const packageJsonPath = values['package-json'];
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
-
-  if (!('version' in packageJson) || typeof packageJson.version !== 'string') {
-    fail('The specified package.json does not contain a valid version field.');
-  }
-
   const currentVersion = packageJson.version;
 
   const explicitVersion = values.version;
   let newVersion;
-
   if (explicitVersion) {
     newVersion = explicitVersion;
   } else {
-    const type = values.type;
-    if (!type || !isValidVersionType(type)) {
-      fail('Please specify the release type using --type or -t.');
-    }
-
     try {
       newVersion = getNextVersion({
         currentVersion,
-        type,
+        type: values.type,
         currentDate: new Date(),
       });
-    } catch (error) {
-      fail(error instanceof Error ? error.message : String(error));
+    } catch (e) {
+      console.error(e.message);
+      process.exit(1);
     }
   }
 
@@ -89,5 +76,6 @@ try {
     );
   }
 } catch (error) {
-  fail(`Error: ${error instanceof Error ? error.message : String(error)}`);
+  console.error('Error:', error.message);
+  process.exit(1);
 }

packages/ci-actions/bin/release-notes-check.mjs

@@ -1,68 +0,0 @@
-import * as fs from 'node:fs';
-
-import matter from 'gray-matter';
-
-import {
-  categoryAutocorrections,
-  categoryOrder,
-} from '../src/release-notes/util.mjs';
-
-console.log('Looking in ' + fs.realpathSync('upcoming-release-notes'));
-
-const expectedPath = `upcoming-release-notes/${process.env.PR_NUMBER}.md`;
-
-function reportError(message) {
-  console.log(`::error::${message}`);
-
-  process.stdout.write('::notice::');
-  fs.createReadStream('upcoming-release-notes/README.md').pipe(process.stdout);
-
-  fs.createReadStream('upcoming-release-notes/README.md')
-    .pipe(fs.createWriteStream(process.env.GITHUB_STEP_SUMMARY))
-    .on('close', () => {
-      process.exit(1);
-    });
-}
-
-(() => {
-  if (!fs.existsSync(expectedPath)) {
-    reportError(`Release note file ${expectedPath} not found`);
-    return;
-  }
-
-  const { data, content } = matter(fs.readFileSync(expectedPath, 'utf-8'));
-
-  if (!data.category) {
-    reportError(`Release note is missing a category.`);
-    return;
-  }
-  if (categoryAutocorrections[data.category]) {
-    data.category = categoryAutocorrections[data.category];
-  }
-  if (!categoryOrder.includes(data.category)) {
-    reportError(
-      `Release note category "${data.category}" is not one of ${categoryOrder
-        .map(JSON.stringify)
-        .join(', ')}`,
-    );
-    return;
-  }
-
-  if (!data.authors) {
-    reportError(`Release note is missing authors.`);
-    return;
-  }
-  if (!Array.isArray(data.authors)) {
-    reportError(`Release note authors should be a list.`);
-    return;
-  }
-
-  if (content.trim().split('\n').length !== 1) {
-    reportError(
-      `Release note file ${expectedPath} body should contain exactly one line`,
-    );
-    return;
-  }
-
-  console.log('Everything looks good! \u{1f389}');
-})();

packages/ci-actions/bin/release-notes-generate.mjs

@@ -1,229 +0,0 @@
-import * as childProcess from 'node:child_process';
-import * as fs from 'node:fs/promises';
-import { join } from 'node:path';
-import { inspect, promisify } from 'node:util';
-
-import matter from 'gray-matter';
-import listify from 'listify';
-
-import {
-  categoryAutocorrections,
-  categoryOrder,
-} from '../src/release-notes/util.mjs';
-
-const exec = promisify(childProcess.exec);
-
-const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/');
-
-const apiResult = await fetch('https://api.github.com/graphql', {
-  method: 'POST',
-  headers: {
-    Authorization: `bearer ${process.env.GITHUB_TOKEN}`,
-    'Content-Type': 'application/json',
-  },
-  body: JSON.stringify({
-    query: /* GraphQL */ `
-      query GetPRMetadata(
-        $name: String!
-        $owner: String!
-        $headRefName: String!
-      ) {
-        repository(name: $name, owner: $owner) {
-          pullRequests(headRefName: $headRefName, first: 1) {
-            edges {
-              node {
-                number
-                headRefName
-                body
-              }
-            }
-          }
-        }
-      }
-    `,
-    variables: {
-      name: repo,
-      owner,
-      headRefName: process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME,
-    },
-  }),
-}).then(res => res.json());
-
-await collapsedLog('API Response', apiResult);
-
-const prData = apiResult.data.repository.pullRequests.edges[0].node;
-
-const version = prData.headRefName.split('/')[1].replace(/^v/, '');
-const slug = version.replace(/\./g, '-');
-const author = process.env.GITHUB_ACTOR || 'TODO';
-const commitMessage = `Generate release notes for v${version}`;
-
-const releaseDateMatch = (prData.body || '').match(
-  /<!-- release-date:(\d{4}-\d{2}-\d{2}) -->/,
-);
-const releaseDate = releaseDateMatch ? releaseDateMatch[1] : 'TODO';
-
-const botName = 'github-actions[bot]';
-const botEmail = '41898282+github-actions[bot]@users.noreply.github.com';
-
-await exec(`git config user.name '${botName}'`);
-await exec(`git config user.email '${botEmail}'`);
-
-await group('Prepare branch', async () => {
-  if (process.env.GITHUB_HEAD_REF) {
-    await exec(`git fetch origin ${process.env.GITHUB_HEAD_REF}`, {
-      stdio: 'inherit',
-    });
-    await exec(`git checkout ${process.env.GITHUB_HEAD_REF}`, {
-      stdio: 'inherit',
-    });
-  }
-
-  // the previous generation commit deletes source files from
-  // upcoming-release-notes, rebase it out so we can regenerate from all of them
-  const { stdout: commitHash } = await exec(
-    `git log --grep='${commitMessage}' --format=%H -1`,
-  );
-  const hash = commitHash.trim();
-  if (hash) {
-    console.log(`Dropping previous release notes commit ${hash}`);
-    await exec(`git rebase --onto ${hash}~1 ${hash}`, {
-      stdio: 'inherit',
-    });
-  }
-});
-
-const { notesByCategory, files } = await parseReleaseNotes(
-  'upcoming-release-notes',
-);
-const categorizedNotes = formatNotes(notesByCategory);
-
-await collapsedLog('Release Notes', categorizedNotes);
-
-if (files.length === 0) {
-  console.log('No release notes found, nothing to generate');
-  process.exit(0);
-}
-
-const highlights = '- TODO: Add release highlights';
-
-await group('Generate blog post', async () => {
-  const blogPath = join(
-    'packages/docs/blog',
-    `${releaseDate}-release-${slug}.md`,
-  );
-
-  const blogContent = `---
-title: Release ${version}
-description: New release of Actual.
-date: ${releaseDate}T10:00
-slug: release-${version}
-tags: [announcement, release]
-hide_table_of_contents: false
-authors: ${author}
----
-
-${highlights}
-
-<!--truncate-->
-
-**Docker Tag: ${version}**
-
-${categorizedNotes}
-`;
-
-  await fs.writeFile(blogPath, blogContent);
-  console.log(`Wrote ${blogPath}`);
-});
-
-await group('Update releases.md', async () => {
-  const releasesPath = 'packages/docs/docs/releases.md';
-  const existing = await fs.readFile(releasesPath, 'utf-8');
-
-  const newSection = `## ${version}
-
-Release date: ${releaseDate}
-
-${highlights}
-
-**Docker Tag: ${version}**
-
-${categorizedNotes}`;
-
-  const updated = existing.replace(
-    '# Release Notes\n',
-    `# Release Notes\n\n${newSection}\n`,
-  );
-
-  await fs.writeFile(releasesPath, updated);
-  console.log(`Updated ${releasesPath}`);
-});
-
-await group('Remove used release notes', async () => {
-  await Promise.all(
-    files.map(f => fs.unlink(join('upcoming-release-notes', f))),
-  );
-});
-
-await group('Commit and push', async () => {
-  await exec(
-    'git add upcoming-release-notes packages/docs/blog packages/docs/docs/releases.md',
-    { stdio: 'inherit' },
-  );
-  await exec(`git commit -m '${commitMessage}'`);
-  await exec('git push --force-with-lease origin', { stdio: 'inherit' });
-});
-
-async function parseReleaseNotes(dir) {
-  const files = (await fs.readdir(dir)).filter(f => f.match(/^\d+\.md$/));
-  const notes = files.map(async name => {
-    const content = await fs.readFile(join(dir, name), 'utf-8');
-    const { data, content: body } = matter(content);
-    const number = name.replace('.md', '');
-    const authors = listify(
-      data.authors.map(a => `@${a}`),
-      { finalWord: '&' },
-    );
-    return {
-      category: categoryAutocorrections[data.category] ?? data.category,
-      value: `- [#${number}](https://github.com/actualbudget/${repo}/pull/${number}) ${body.trim()} — thanks ${authors}`,
-    };
-  });
-
-  const notesByCategory = (await Promise.all(notes)).reduce(
-    (acc, note) => {
-      if (!acc[note.category]) {
-        console.log(`WARNING: Unrecognized category "${note.category}"`);
-        acc[note.category] = [];
-      }
-      acc[note.category].push(note.value);
-      return acc;
-    },
-    Object.fromEntries(categoryOrder.map(c => [c, []])),
-  );
-
-  return { notesByCategory, files };
-}
-
-function formatNotes(notes) {
-  return Object.entries(notes)
-    .filter(([_, values]) => values.length > 0)
-    .map(([category, values]) => `#### ${category}\n\n${values.join('\n')}`)
-    .join('\n\n');
-}
-
-async function collapsedLog(name, value) {
-  await group(name, () => {
-    if (typeof value === 'string') {
-      console.log(value);
-    } else {
-      console.log(inspect(value, { depth: null }));
-    }
-  });
-}
-
-async function group(name, cb) {
-  console.log(`::group::${name}`);
-  await cb();
-  console.log('::endgroup::');
-}

packages/ci-actions/bin/tsx

@@ -1,8 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-cd ../../
-
-script="$1"
-shift
-exec node --import=extensionless/register --experimental-strip-types packages/ci-actions/"$script" "$@"

packages/ci-actions/package.json

@@ -3,21 +3,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "tsx": "bin/tsx",
-    "test": "vitest --run",
-    "typecheck": "tsgo -b"
+    "test": "vitest --run"
   },
   "devDependencies": {
-    "@octokit/rest": "^22.0.1",
-    "@typescript/native-preview": "^7.0.0-dev.20260404.1",
-    "extensionless": "^2.0.6",
-    "gray-matter": "^4.0.3",
-    "listify": "^1.0.3",
-    "vitest": "^4.1.2"
-  },
-  "extensionless": {
-    "lookFor": [
-      "ts"
-    ]
+    "vitest": "^4.0.16"
   }
 }

packages/ci-actions/src/release-notes/util.mjs

@@ -1,12 +0,0 @@
-export const categoryAutocorrections = {
-  Feature: 'Features',
-  Enhancement: 'Enhancements',
-  Bugfix: 'Bugfixes',
-};
-
-export const categoryOrder = [
-  'Features',
-  'Enhancements',
-  'Bugfixes',
-  'Maintenance',
-];

packages/ci-actions/src/versions/get-next-package-version.js

@@ -1,69 +1,35 @@
-export const versionTypeArray = [
-  'auto',
-  'hotfix',
-  'monthly',
-  'nightly',
-] as const;
-export type VersionType = (typeof versionTypeArray)[number];
-
-type ParsedVersion = {
-  versionYear: number;
-  versionMonth: number;
-  versionHotfix: number;
-};
-
-type GetNextVersionOptions = {
-  currentVersion: string;
-  type: VersionType;
-  currentDate?: Date;
-};
-
-function parseVersion(version: string): ParsedVersion {
+function parseVersion(version) {
   const [y, m, p] = version.split('.');
   return {
-    versionYear: Number.parseInt(y, 10),
-    versionMonth: Number.parseInt(m, 10),
-    versionHotfix: Number.parseInt(p, 10),
+    versionYear: parseInt(y, 10),
+    versionMonth: parseInt(m, 10),
+    versionHotfix: parseInt(p, 10),
   };
 }
 
-function computeNextMonth(versionYear: number, versionMonth: number) {
-  const versionDate = new Date(2000 + versionYear, versionMonth - 1, 1);
+function computeNextMonth(versionYear, versionMonth) {
+  // Create date and add 1 month
+  const versionDate = new Date(2000 + versionYear, versionMonth - 1, 1); // month is 0-indexed
   const nextVersionMonthDate = new Date(
     versionDate.getFullYear(),
     versionDate.getMonth() + 1,
     1,
   );
 
+  // Format back to YY.M format
   const fullYear = nextVersionMonthDate.getFullYear();
   const nextVersionYear = fullYear.toString().slice(fullYear < 2100 ? -2 : -3);
-  const nextVersionMonth = nextVersionMonthDate.getMonth() + 1;
-
+  const nextVersionMonth = nextVersionMonthDate.getMonth() + 1; // Convert back to 1-indexed
   return { nextVersionYear, nextVersionMonth };
 }
 
-export function isValidVersionType(value: string): value is VersionType {
-  return versionTypeArray.includes(value as VersionType);
-}
-
-function resolveType(
-  type: VersionType,
-  currentDate: Date,
-  versionYear: number,
-  versionMonth: number,
-) {
-  if (type !== 'auto') {
-    return type;
-  }
-
+// Determine logical type from 'auto' based on the current date and version
+function resolveType(type, currentDate, versionYear, versionMonth) {
+  if (type !== 'auto') return type;
   const inPatchMonth =
     currentDate.getFullYear() === 2000 + versionYear &&
     currentDate.getMonth() + 1 === versionMonth;
-
-  if (inPatchMonth && currentDate.getDate() < 25) {
-    return 'hotfix';
-  }
-
+  if (inPatchMonth && currentDate.getDate() <= 25) return 'hotfix';
   return 'monthly';
 }
 
@@ -71,7 +37,7 @@ export function getNextVersion({
   currentVersion,
   type,
   currentDate = new Date(),
-}: GetNextVersionOptions) {
+}) {
   const { versionYear, versionMonth, versionHotfix } =
     parseVersion(currentVersion);
   const { nextVersionYear, nextVersionMonth } = computeNextMonth(
@@ -85,10 +51,11 @@ export function getNextVersion({
     versionMonth,
   );
 
+  // Format date stamp once for nightly
   const currentDateString = currentDate
     .toISOString()
     .split('T')[0]
-    .replace(/-/g, '');
+    .replaceAll('-', '');
 
   switch (resolvedType) {
     case 'nightly':
@@ -99,7 +66,7 @@ export function getNextVersion({
       return `${nextVersionYear}.${nextVersionMonth}.0`;
     default:
       throw new Error(
-        `Invalid type ${String(resolvedType satisfies never)} specified. Use "auto", "nightly", "hotfix", or "monthly".`,
+        'Invalid type specified. Use "auto", "nightly", "hotfix", or "monthly".',
       );
   }
 }