release: v0.5.3

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true
+  }
+}

CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to the PEACE Protocol are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.5.3] - 2026-05-04
+
+### Added
+- Updater: accurate download progress with rolling-window speed and ETA, route toast Download to Settings, expand release notes into a modal, cancel an in-flight download (#128)
+- Activity: wallet send/receive transactions in the History tab, sourced from a new `/api/chain/activity/:pkh` backend endpoint with scroll-to-top button on the virtualized list (#129)
+- History: CSV export of historical sales and purchases for tax records, sourced from on-chain re-encryption events (#130)
+- UI: Dusk three-color palette (lilac / mint / sand), marketplace and library card hierarchy with image banner / hero / quiet footer, tighter dashboard status pills, equal-height stat and listing cards, atmospheric empty state, welcome treatment for the wallet mode chooser, celebration toast on first wallet creation, type scale and `--text-*` token roles (#131)
+- Marketplace: fuzzy near-match suggestion when a search yields no results, segmented control for Place Bid quick actions, Decrypt "How it works" collapses to a disclosure after first decrypt (#131)
+- i18n: locale-aware `formatAda` / `formatDate` / `formatRelativeTime` helpers, lint guard against hardcoded a11y attribute strings, EN-key backfill for polish-pass strings, translated Dashboard tab badge aria-labels (#132)
+- Inputs: thousands-separator comma formatting on Place Bid, Update Bid, and Update Price currency inputs, with a centralized `formatWithCommas` / `stripCommas` helper (D16) (#133)
+- Typography: Bricolage Grotesque display face for hero text, with Inter and JetBrains Mono tracked via `@fontsource-variable` (#134)
+
+### Fixed
+- Updater: auto-check timer survives StrictMode double-invoke (#128)
+- History: `reconcileWithOnChain` now refreshes existing records' fields from on-chain instead of insert-only, and reads `tx_timestamp` from Koios `/tx_info` (closes a long-silent stale-field bug) (#129)
+- Activity: include wallet activity in the manual refresh path; `bundle:be` runs on `run.sh` startup so backend changes are not stale at runtime (#129)
+- A11y: EncryptionCard description uses a real button instead of a `role=button` wrapper (#131)
+- Library: equal-height grid cards regardless of imageLink presence (#131)
+- Cards: scrim wrapper on image overlays, NSFW badge relocated to top-right, price + ADA and bid count + storage chips locked on one line (#131)
+- MySales: stack price and storage badge on narrow cards; card price font scales with card width via container queries (#133)
+
 ## [0.5.2] - 2026-04-22
 
 ### Added

CLAUDE.md

@@ -79,7 +79,7 @@ All active product development happens here. The full architecture reference liv
 
 - **App name:** "Veiled" (single word — spaces produce awkward binary names).
 - **Identifier:** `com.peace-protocol.veiled-desktop` (kept stable for app data dir compatibility).
-- **Backend requires explicit build.** Tauri runs `node dist/index.js`, *not* `tsx src/index.ts`. Every change in `app/gui/be/src/` needs `cd app/gui/be && npm run build` before restarting Tauri. The frontend hot-reloads via Vite; the backend does not. `run.sh` starts a `tsc --watch` automatically — if you run `tauri dev` manually, you have to handle this yourself.
+- **Backend requires explicit build AND re-bundle.** Tauri runs `node dist/index.js`, *not* `tsx src/index.ts`. Worse, it loads from a *bundled* copy at `app/gui/src-tauri/resources/be/dist/`, not from `app/gui/be/dist/`. So a backend change needs `cd app/gui/be && npm run build` *and* `cd app/gui && npm run bundle:be` (copies `be/dist/` into `src-tauri/resources/be/dist/`) before restarting Tauri. `run.sh` runs both on startup, but the `tsc --watch` it leaves running only updates `be/dist/` — the bundled copy stays stale until you re-run `bundle:be` and restart. The frontend hot-reloads via Vite; the backend does not.
 - **127.0.0.1 not localhost.** WebKitGTK on Linux has DNS resolution issues; all local URLs use `127.0.0.1`.
 - **No CLAUDE.md duplication.** This file deliberately stays out of GUI internals — see `app/gui/CLAUDE.md` for context boundaries, modal patterns, IPC commands, and other GUI-specific conventions.
 

app/contracts/aiken.toml

@@ -1,5 +1,5 @@
 name = "logical-mechanism/peace-protocol"
-version = "0.5.2"
+version = "0.5.3"
 compiler = "v1.1.21"
 plutus = "v3"
 license = "GPL-3.0-only"

app/gui/be/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veiled-be",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Veiled Backend API",
   "engines": {
     "node": ">=20.19.0",

app/gui/be/src/middleware/timeout.ts

@@ -3,9 +3,19 @@ import { logger } from '../services/logger.js';
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 
+// Routes that involve multiple sequential Koios round-trips (asset_txs
+// per-token + credential_txs + chunked tx_info) and legitimately need
+// more headroom. Keyed on path suffix so the same handler under both
+// `/reencryption-history` and `/api/chain/reencryption-history` matches.
+const LONG_RUNNING_ROUTES: Array<{ pattern: RegExp; timeoutMs: number }> = [
+  { pattern: /\/reencryption-history\//, timeoutMs: 120_000 },
+];
+
 export function requestTimeout(timeoutMs: number = DEFAULT_TIMEOUT_MS) {
   return (req: Request, res: Response, next: NextFunction): void => {
     let timedOut = false;
+    const override = LONG_RUNNING_ROUTES.find((r) => r.pattern.test(req.path));
+    const effectiveTimeoutMs = override?.timeoutMs ?? timeoutMs;
 
     // Abort controller for cancelling in-flight fetch operations on timeout.
     // Route handlers can pass res.locals.abortSignal to service calls.
@@ -32,7 +42,7 @@ export function requestTimeout(timeoutMs: number = DEFAULT_TIMEOUT_MS) {
           requestId: req.requestId,
           method: req.method,
           path: req.path,
-          timeoutMs,
+          timeoutMs: effectiveTimeoutMs,
         });
         // Send 504 before setting timedOut — origJson internally calls
         // the patched res.send, which must pass through for this response.
@@ -49,7 +59,7 @@ export function requestTimeout(timeoutMs: number = DEFAULT_TIMEOUT_MS) {
         res.locals.timedOut = true;
         abortController.abort();
       }
-    }, timeoutMs);
+    }, effectiveTimeoutMs);
 
     res.on('finish', () => clearTimeout(timer));
     res.on('close', () => clearTimeout(timer));