feat: promote Watch reference data, sleep-stage rules, biometrics calibration, saved curves and presence auto-on

.github/workflows/mutation.yml

@@ -59,6 +59,8 @@ jobs:
             mutate: "src/streaming/**/*.ts,!src/**/tests/**,!src/**/*.test.ts,!src/**/*.test.tsx,!src/**/*.d.ts"
           - name: hooks
             mutate: "src/hooks/**/*.ts,src/hooks/**/*.tsx,!src/**/tests/**,!src/**/*.test.ts,!src/**/*.test.tsx,!src/**/*.d.ts"
+          - name: biometrics
+            mutate: "src/biometrics/**/*.ts,!src/**/tests/**,!src/**/*.test.ts,!src/**/*.test.tsx,!src/**/*.d.ts"
           - name: db
             mutate: "src/db/**/*.ts,!src/**/tests/**,!src/**/*.test.ts,!src/**/*.test.tsx,!src/**/*.d.ts"
     name: mutate (${{ matrix.shard.name }})

.github/workflows/python-modules.yml

@@ -5,17 +5,23 @@ on:
     branches: [dev]
     paths:
       - 'modules/**/*.py'
+      - 'modules/common/biometrics/*.json'
+      - 'modules/piezo-processor/fixtures/*.json'
       - 'modules/**/pyproject.toml'
       - 'modules/**/uv.lock'
       - 'modules/.coveragerc'
+      - 'scripts/**/*.py'
       - '.github/workflows/python-modules.yml'
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - 'modules/**/*.py'
+      - 'modules/common/biometrics/*.json'
+      - 'modules/piezo-processor/fixtures/*.json'
       - 'modules/**/pyproject.toml'
       - 'modules/**/uv.lock'
       - 'modules/.coveragerc'
+      - 'scripts/**/*.py'
       - '.github/workflows/python-modules.yml'
   workflow_dispatch:
 
@@ -48,9 +54,9 @@ jobs:
             workdir: modules
             target: common
             cov_source: common
-            # cbor2 is needed to decode the real NATS capture fixtures through
-            # NatsFollower's decode path (test_nats_follower).
-            deps: "cbor2"
+            # Build-identity tests inspect installed NumPy/SciPy metadata;
+            # use the piezo module's locked environment, including cbor2.
+            deps: ""
           - name: cover-buttons
             workdir: modules/cover-buttons
             target: .
@@ -70,12 +76,20 @@ jobs:
             workdir: modules/piezo-processor
             target: .
             cov_source: .
+            cov_extra: "--cov=../common/biometrics"
             deps: "numpy scipy"
           - name: sleep-detector
             workdir: modules/sleep-detector
             target: .
             cov_source: .
             deps: ""
+          # Stdlib-only repo scripts; tests load them by path from
+          # scripts/tests/.
+          - name: scripts
+            workdir: scripts
+            target: tests
+            cov_source: .
+            deps: ""
 
     steps:
       - name: Checkout
@@ -86,7 +100,7 @@ jobs:
         with:
           # Pod runtime is pinned to 3.10 by every module's pyproject
           # (`requires-python = ">=3.9,<3.11"`). Match it in CI.
-          python-version: '3.14'
+          python-version: '3.10'
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4
@@ -96,11 +110,16 @@ jobs:
       - name: Install test deps
         working-directory: ${{ matrix.module.workdir }}
         run: |
-          if [ -f uv.lock ]; then
+          if [ "${{ matrix.module.name }}" = "common" ]; then
+            # Keep common's cwd/import layout while using the numerical lock.
+            UV_PROJECT_ENVIRONMENT="$PWD/.venv" uv sync --project piezo-processor --locked --no-install-project
+          elif [ -f uv.lock ]; then
             uv sync --locked --no-install-project
           else
             uv venv .venv
-            uv pip install --python .venv/bin/python ${{ matrix.module.deps }}
+            if [ -n "${{ matrix.module.deps }}" ]; then
+              uv pip install --python .venv/bin/python ${{ matrix.module.deps }}
+            fi
           fi
           # shellcheck source=/dev/null
           . .venv/bin/activate
@@ -114,12 +133,13 @@ jobs:
           pytest ${{ matrix.module.target }} \
             --cov-config=${{ github.workspace }}/modules/.coveragerc \
             --cov=${{ matrix.module.cov_source }} \
+            ${{ matrix.module.cov_extra }} \
             --cov-report=xml:coverage.xml \
             --junit-xml=junit.xml \
             -o junit_family=legacy
 
       - name: Upload coverage to Codecov
-        if: ${{ !cancelled() }}
+        if: ${{ github.repository == 'sleepypod/core' && !cancelled() }}
         uses: codecov/codecov-action@v5
         with:
           use_oidc: true
@@ -132,7 +152,7 @@ jobs:
           working-directory: ${{ matrix.module.workdir }}
 
       - name: Upload test results to Codecov
-        if: ${{ !cancelled() }}
+        if: ${{ github.repository == 'sleepypod/core' && !cancelled() }}
         uses: codecov/codecov-action@v5
         with:
           report_type: test_results

.github/workflows/test.yml

@@ -29,6 +29,7 @@ jobs:
           - { name: "Lint", cmd: "CHANGED=$(git diff --name-only --diff-filter=d origin/${BASE_REF#refs/heads/}...HEAD -- '*.ts' '*.tsx' | head -200); if [ -n \"$CHANGED\" ]; then echo \"$CHANGED\" | xargs -d '\\n' pnpm eslint --; else echo 'No TS/TSX files changed'; fi" }
           - { name: "Typecheck", cmd: "pnpm tsc" }
           - { name: "Unit Tests", cmd: "pnpm test run --coverage --passWithNoTests" }
+          - { name: "Browser Tests", cmd: "NODE_ENV=production CI=1 pnpm build && pnpm test:browser" }
 
     steps:
       - name: Checkout
@@ -51,6 +52,27 @@ jobs:
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Setup Python for runtime integration
+        if: matrix.task.name == 'Unit Tests' || matrix.task.name == 'Browser Tests'
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Setup uv for runtime integration
+        if: matrix.task.name == 'Unit Tests' || matrix.task.name == 'Browser Tests'
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Install locked runtime integration dependencies
+        if: matrix.task.name == 'Unit Tests' || matrix.task.name == 'Browser Tests'
+        working-directory: modules/piezo-processor
+        run: uv sync --locked --no-install-project
+
+      - name: Install browser
+        if: matrix.task.name == 'Browser Tests'
+        run: pnpm exec playwright install --with-deps chromium
+
       - name: Cache Assets (Vitest)
         id: asset-cache
         uses: actions/cache@v5
@@ -68,7 +90,7 @@ jobs:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.event.merge_group.base_ref }}
 
       - name: Upload coverage reports to Codecov
-        if: matrix.task.name == 'Unit Tests' && !cancelled()
+        if: github.repository == 'sleepypod/core' && matrix.task.name == 'Unit Tests' && !cancelled()
         uses: codecov/codecov-action@v5
         with:
           use_oidc: true
@@ -79,7 +101,7 @@ jobs:
           flags: javascript
 
       - name: Upload test results to Codecov
-        if: matrix.task.name == 'Unit Tests' && !cancelled()
+        if: github.repository == 'sleepypod/core' && matrix.task.name == 'Unit Tests' && !cancelled()
         uses: codecov/codecov-action@v5
         with:
           report_type: test_results
@@ -89,4 +111,12 @@ jobs:
           fail_ci_if_error: false
           slug: sleepypod/core
           files: test-results/junit.xml
-          flags: javascript
+          flags: javascript
+
+      - name: Upload browser evidence
+        if: matrix.task.name == 'Browser Tests' && !cancelled()
+        uses: actions/upload-artifact@v6
+        with:
+          name: calibration-browser-results
+          path: test-results/browser
+          retention-days: 7

app/[lang]/schedule/[curve]/page.tsx

@@ -8,15 +8,16 @@ const SIDES: SideSelection[] = ['left', 'right', 'both']
 
 export default async function ScheduleCurve({ params, searchParams }: {
   params: Promise<{ curve: string }>
-  searchParams: Promise<{ side?: string | string[], from?: string | string[] }>
+  searchParams: Promise<{ side?: string | string[], from?: string | string[], saved?: string | string[] }>
 }) {
   const { curve } = await params
-  const { side, from } = await searchParams
+  const { side, from, saved } = await searchParams
   return (
     <SchedulePage
       curve={curve}
       curveSide={SIDES.find(s => s === side)}
       fromBoth={from === 'both'}
+      savedCurve={typeof saved === 'string' ? saved : undefined}
     />
   )
 }

app/api/biometrics/watch-upload/route.test.ts

@@ -0,0 +1,157 @@
+// @vitest-environment node
+import { createServer, type Server } from 'node:http'
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, expect, it, vi } from 'vitest'
+import { POST } from './route'
+
+let directory: string
+let server: Server
+const seen = new Set<number>()
+const requests: Array<{ side: string, source: string }> = []
+beforeAll(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'watch-upload-test-'))
+  vi.stubEnv('WATCH_UPLOAD_DIR', directory)
+  server = createServer(async (req, res) => {
+    let body = ''
+    for await (const chunk of req) body += chunk
+    const data = JSON.parse(body)
+    requests.push(data)
+    let written = 0
+    for (const sample of data.samples ?? []) {
+      if (!seen.has(sample.timestamp)) {
+        seen.add(sample.timestamp)
+        written++
+      }
+    }
+    res.setHeader('Content-Type', 'application/json')
+    res.end(JSON.stringify({ written }))
+  })
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  if (!address || typeof address === 'string') throw new Error('missing test port')
+  vi.stubEnv('PORT', String(address.port))
+})
+afterAll(async () => {
+  await new Promise<void>((resolve, reject) => server.close(error => error ? reject(error) : resolve()))
+  await rm(directory, { recursive: true, force: true })
+  vi.unstubAllEnvs()
+})
+
+it('streams XML through the real importer, routes to the selected side, dedupes, and removes the file', async () => {
+  const date = new Date().toISOString().replace('T', ' ').replace(/\.\d+Z$/, ' +0000')
+  const xml = `<HealthData><Record type="HKQuantityTypeIdentifierHeartRate" sourceName="Apple Watch" startDate="${date}" endDate="${date}" value="62" unit="count/min" /></HealthData>`
+  const request = () => new Request('http://pod/api/biometrics/watch-upload?side=right&days=7', { method: 'POST', body: xml })
+  const response = await POST(request())
+  expect(response.status).toBe(200)
+  expect(await response.json()).toMatchObject({ vitals: 1, stages: 0, matchedVitals: 1 })
+  expect(requests[0]).toMatchObject({ side: 'right', source: 'apple_watch' })
+  expect(await (await POST(request())).json()).toMatchObject({ vitals: 0, matchedVitals: 1 })
+  expect(await readdir(directory)).toEqual([])
+})
+
+it('rejects malformed files and cleans up after parser failure', async () => {
+  const response = await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', body: '<HealthData><broken' }))
+  expect(response.status).toBe(422)
+  expect(await readdir(directory)).toEqual([])
+})
+
+it('gives import a fresh budget after staging and ignores the expired upload budget', async () => {
+  const upload = new AbortController()
+  const importer = new AbortController()
+  let staged = false
+  const timeout = vi.spyOn(AbortSignal, 'timeout')
+    .mockReturnValueOnce(upload.signal)
+    .mockImplementationOnce(() => {
+      expect(staged).toBe(true)
+      upload.abort(new DOMException('Upload budget expired', 'TimeoutError'))
+      return importer.signal
+    })
+  try {
+    const body = new ReadableStream({
+      pull(controller) {
+        controller.enqueue(new TextEncoder().encode('<HealthData/>'))
+        staged = true
+        controller.close()
+      },
+    })
+    const request = new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', body, duplex: 'half' } as RequestInit)
+    const response = await POST(request)
+    expect(response.status).toBe(200)
+    expect(timeout.mock.calls.map(call => call[0])).toEqual([30 * 60_000, 10 * 60_000])
+    expect(await readdir(directory)).toEqual([])
+  }
+  finally { timeout.mockRestore() }
+})
+
+it('accepts a same-origin browser upload even though Next reports the 0.0.0.0 bind address in request.url', async () => {
+  const response = await POST(new Request('http://0.0.0.0:3000/api/biometrics/watch-upload?side=left', {
+    method: 'POST', headers: { origin: 'http://192.168.1.88:3000', host: '192.168.1.88:3000' }, body: '<HealthData/>',
+  }))
+  expect(response.status).toBe(200)
+  expect(await readdir(directory)).toEqual([])
+})
+
+it('rejects cross-origin requests, missing side, and oversized bodies before import', async () => {
+  for (const origin of ['http://evil', 'http://192.168.1.88:8080', 'null']) {
+    const response = await POST(new Request('http://0.0.0.0:3000/api/biometrics/watch-upload?side=left', { method: 'POST', headers: { origin, host: '192.168.1.88:3000' }, body: 'x' }))
+    expect(response.status).toBe(403)
+  }
+  expect((await POST(new Request('http://pod/api/biometrics/watch-upload', { method: 'POST', body: 'x' }))).status).toBe(400)
+  expect((await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', headers: { 'content-length': String(513 * 1024 * 1024) }, body: 'x' }))).status).toBe(413)
+})
+
+it('still honors a client disconnect when switching to the import budget', async () => {
+  const client = new AbortController()
+  const timeout = vi.spyOn(AbortSignal, 'timeout')
+    .mockReturnValueOnce(new AbortController().signal)
+    .mockImplementationOnce(() => {
+      client.abort()
+      return new AbortController().signal
+    })
+  try {
+    const response = await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', {
+      method: 'POST', body: '<HealthData/>', signal: client.signal,
+    }))
+    expect(response.status).toBe(408)
+    expect(await readdir(directory)).toEqual([])
+  }
+  finally { timeout.mockRestore() }
+})
+
+it('rejects missing and empty bodies without retaining staged files', async () => {
+  for (const body of [undefined, '']) {
+    const response = await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', body }))
+    expect(response.status).toBe(400)
+    expect(await readdir(directory)).toEqual([])
+  }
+})
+
+it('enforces the streaming size limit even without a content-length header', async () => {
+  const chunk = new Uint8Array(1)
+  Object.defineProperty(chunk, 'byteLength', { value: 513 * 1024 * 1024 })
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(chunk)
+      controller.close()
+    },
+  })
+  const response = await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', body, duplex: 'half' } as RequestInit))
+  expect(response.status).toBe(413)
+  expect(await response.json()).toEqual({ error: 'Upload exceeds 512 MiB' })
+  expect(await readdir(directory)).toEqual([])
+})
+
+it('rejects concurrent uploads and releases the slot after staging is cancelled', async () => {
+  const client = new AbortController()
+  const response = POST(new Request('http://pod/api/biometrics/watch-upload?side=left', {
+    method: 'POST', body: new ReadableStream(), duplex: 'half', signal: client.signal,
+  } as RequestInit))
+  const competing = await POST(new Request('http://pod/api/biometrics/watch-upload?side=right', { method: 'POST', body: '<HealthData/>' }))
+  expect(competing.status).toBe(409)
+  client.abort()
+  expect((await response).status).toBe(408)
+  expect(await readdir(directory)).toEqual([])
+  expect((await POST(new Request('http://pod/api/biometrics/watch-upload?side=left', { method: 'POST', body: '<HealthData/>' }))).status).toBe(200)
+})