update: tooltip things.
remove: unused var.

fix: broken SSE.
fix: upgrade flow not working.
feat: csrf tokens for better security.
fix: local testing mode with wrong paths.
feat: csrf validations pre-post hook plus proper permissions handling on files.
feat: js modules for better handling of js operations on web installer frontend ui.

fix: referencing wrong file in upgrade task.

feat: mocking options.

fix: password eye button not showing again.

misc: updates, cleanups.

update: update task callback.

The $tenant attribute type in the database library is being changed from
VAR_INTEGER to VAR_ID, which handles both SQL (integer) and MongoDB
(UUID7 string) adapters natively. This removes the now-unnecessary
conditional casting pattern throughout the codebase.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Updates utopia-php/database to dev-fix-mongo-perms which changes the
$tenant internal attribute type from VAR_INTEGER to VAR_ID, fixing
MongoDB shared tables where tenant values are UUID7 strings.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Adds utopia-php/mongo dev-fix-collection-exists-code which sets error
code 48 (NamespaceExists) when createCollection detects the collection
already exists. This allows the database adapter to handle it as a
DuplicateException and return true, fixing shared tables mode where
collections like _audit are shared across projects.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Use released versions instead of dev branches:
- database 5.3.11: $tenant type VAR_INTEGER -> VAR_ID for MongoDB compatibility
- mongo 1.0.1: collection exists exception uses error code 48

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Picks up reverted Sequence validator changes that were breaking
MariaDB shared tables.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

The composer update pulled in utopia-php/di 0.3.1 which removed the
Dependency class, causing fatal errors. Pin to 0.1.0 and servers 0.2.5.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Document::getTenant() casts numeric tenants to (int), but
adapter->getTenant() held a string from getSequence(). The strict
!== comparison in Database::getCollection() then failed, returning
"Collection not found" for all shared-table MariaDB projects.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…omparison"

This reverts commit 840b1fb.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

… key

The team resource query was changed from $internalId to $sequence,
breaking console session authentication (401 on project creation).
Also removed duplicate utopia-php/servers entry in composer.json
and updated composer.lock hash.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>

PostgreSQL adapter throws non-Duplicate exceptions when a table/index
already exists during concurrent createCollection. Catch Throwable and
attempt metadata-only creation as fallback. Also increase Realtime
coroutine attribute polling timeout from 30s to 60s.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…lity

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…rrors

The assertEventually call inside Coroutine\run() causes a fatal PHP
error (exit 255) when it times out, killing the entire test process.
Moving DB/collection/attribute setup and polling outside the coroutine
ensures PHPUnit can properly handle assertion failures.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>

The root cause (PostgreSQL duplicate index race condition) has been
fixed in the database library, so the timeout workarounds are no
longer needed.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

# Conflicts:
#	composer.json
#	composer.lock

The baseline had gone stale after System::getEnv signature changed from
string|null to string. Regenerated to remove unmatched patterns and add
new installer code entries. Also excluded app/sdks from analysis since
those are auto-generated SDK files.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

The app/sdks directory is gitignored and doesn't exist in CI. Removing
the exclusion to avoid PHPStan failing on a non-existent path.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…ation

Points to fix-collection-recreate branch which prevents the orphan
reconciliation logic from dropping and recreating shared physical tables
when a new tenant creates collections. In shared-tables mode, a
DuplicateException from the adapter means the table is shared with other
tenants, not an orphan from a partial failure.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…ions

The timeout parameters were accidentally removed in daaf1d7, causing
the assertEventually to use the default timeout which is too short for
deployment builds in CI.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>