# Build and repository clean-up

Branch: `build-cleanup` → `main`

PR 8 of the review fixes plan (`docs/review-fixes-plan.md`), part of the 0.5.3 series; the version does not change in this PR.

## What changed

**A committed lockfile (S6).**
- `frontend/package-lock.json` is now in the repository, so every build installs the same package versions. `npm ci` installs exactly what it lists.
- It was made fresh with `npm install`, under the new `.npmrc` setting below. Every package comes from `registry.npmjs.org`.

**`.npmrc` (bajdev, 2026-11-13).**
- **Before:** `minimum-release-age=10080` is pnpm's setting. npm ignored it and warned "Unknown project config … will stop working in the next major version" on every install.
- **Now:** `min-release-age=7`, npm's own setting (in days). npm 11 enforces it whenever it picks versions, as `npm install` and `npm update` do: it won't take a version published less than 7 days ago. `npm ci` installs the lockfile as it is.
- **Result:** the warning is gone.

**No server mode and no Docker (S6, M8).**
- **Server mode:** the `build:server` and `run:server` tasks are removed, and so are their entries in the root `Taskfile.yml`. Server mode would have served the bound methods over HTTP.
- **Docker:** the `build:docker`, `run:docker` and `setup:docker` tasks are removed. There is no `build/docker` folder, so they could not have run anyway.
- **Cross-compiling (bajdev, 2026-11-13):** `setup:docker` built the `wails-cross` image, which the Windows, macOS and Linux Taskfiles used to cross-compile cgo builds. Since you build natively on each system, that path is gone too:
  - Each platform's `build` task now always builds natively.
  - Where that cannot work, a precondition stops the build with a plain message instead of asking for Docker:
    - "The macOS app must be built on a Mac."
    - "A cgo build for Windows must be made on Windows."
    - "The Linux app must be built on Linux, with gcc or clang, for the same architecture."
  - A Windows build without cgo, the default, can still be cross-compiled by Go.
- `wails3 task --list-all` shows no server or Docker task.

**`build/config.yml` (M8).** The commented-out `ios` block, the `fileAssociations` sample and `other: My Other Data` are removed. The header comment no longer mentions `fileAssociations`.

**`Service.Version()` removed (M7).** Nothing called it; the frontend gets the version from `About()`. The bindings are regenerated.

**`wav` package comment (R1).** It said the package "does not decode audio", but `DecodeFile` does. It now describes `ReadFile`, `Validate` and `DecodeFile`.

## Notes

- **The build still runs `npm install`.** The Wails install step (`common:install:frontend:deps:npm`) runs `npm install`, not `npm ci`. With a lockfile that matches `package.json`, that installs the locked versions and leaves the file alone; a full `wails3 build` on the server left it byte-for-byte unchanged. I kept `npm install` so `wails3 dev` doesn't reinstall everything each time.
- **Template leftovers not removed, as the plan doesn't list them:**
  - the iOS device tasks (`common:ios:device:list`, `common:ios:run:device`);
  - the pnpm, yarn and bun variants of the frontend tasks;
  - the `cfBundleIconName` comment in `build/config.yml`.
  
  Say if you want them gone too.
- **`docs/build-plan.md`** still lists `Version()` in its M4 API sketch, which I left as history, like PR 5's notes.

## Testing

**On the server, every command with `GOTOOLCHAIN=go1.27.4`:**
- `go test ./...` passes.
- `go vet ./...` (also with `GOOS=windows`) and `staticcheck ./...` are clean.
- `govulncheck ./...`: "No vulnerabilities found."
- In `frontend`: `npm ci` from the lockfile ("added 51 packages"), then `npm run check` (0 errors, 0 warnings) and `npm run build`. No npm warnings.
- `wails3 build` builds, the lockfile is unchanged afterwards, and the app starts under Xvfb.
- `wails3 task --list-all`: no server or Docker tasks.
- `wails3 task darwin:build`, `wails3 task windows:build CGO_ENABLED=1` and `wails3 task linux:build ARCH=arm64` each stop with their message.

**On the laptop (PowerShell, in the repo):**
1. `git fetch; git checkout build-cleanup`
2. `cd frontend; npm ci; npm run check; cd ..`: `npm ci` installs without the "Unknown project config" warning, and the check shows 0 errors, 0 warnings. If your npm is too old to know `min-release-age`, it warns about that setting instead and the rest still works. The server's npm 11.16 knows it; updating npm (`npm install -g npm@11`) fixes the warning.
3. `wails3 build`: it builds, and `git status` shows no change to `frontend\package-lock.json`.
4. Run `bin\mpckit.exe`: About shows "Version 0.5.2" (the version changes in PR 9).
5. `wails3 task --list-all | Select-String "server|docker"`: no output.